| *** openstackgerrit has quit IRC | 00:01 | |
| *** openstackgerrit has joined #openstack-keystone | 00:02 | |
| *** openstackstatus has quit IRC | 00:02 | |
| *** openstack has joined #openstack-keystone | 00:03 | |
| *** openstackstatus has joined #openstack-keystone | 00:03 | |
| *** ChanServ sets mode: +v openstackstatus | 00:03 | |
| *** mylu has quit IRC | 00:06 | |
| *** mylu has joined #openstack-keystone | 00:06 | |
| *** devlaps has quit IRC | 00:09 | |
| *** dsirrine has quit IRC | 00:10 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Multiple URLs may be specified for ldap url https://review.openstack.org/228644 | 00:10 |
|---|---|---|
| *** geoffarnold has quit IRC | 00:11 | |
| *** mylu has quit IRC | 00:13 | |
| *** mylu has joined #openstack-keystone | 00:14 | |
| *** mylu has quit IRC | 00:14 | |
| *** jvarlamova has quit IRC | 00:15 | |
| *** mylu has joined #openstack-keystone | 00:15 | |
| *** shadower has quit IRC | 00:23 | |
| *** shadower has joined #openstack-keystone | 00:23 | |
| *** dsirrine has joined #openstack-keystone | 00:25 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Catalog scoped roles https://review.openstack.org/228477 | 00:32 |
| *** mylu has quit IRC | 00:32 | |
| ayoung | richm, https://review.openstack.org/#/c/228644/2 multiple LDAP urls? Is that an AD thing? | 00:33 |
| *** sdake_ has joined #openstack-keystone | 00:38 | |
| *** stevemar has joined #openstack-keystone | 00:40 | |
| *** ChanServ sets mode: +o stevemar | 00:40 | |
| *** wwwjfy_ has quit IRC | 00:41 | |
| *** sdake has quit IRC | 00:43 | |
| gyee | ayoung, afaik, Java JNDI supports multiple LDAP URLS for redundancy | 00:48 |
| gyee | not sure if that's the same on the python side | 00:48 |
| ayoung | gyee, on https://review.openstack.org/#/c/125704/ I state under the | 00:48 |
| ayoung | Developer Impact | 00:48 |
| ayoung | ---------------- | 00:48 |
| ayoung | In the future, policy files can take advantage of the hierarchical nature of | 00:48 |
| ayoung | roles and avoid rules like domain_admin_or_project_admin. | 00:48 |
| ayoung | gyee, I read through the bug report. Looks OK, but not sure how much trouble I'm willing to go through to test. | 00:49 |
| gyee | yeah, testing will be tough | 00:49 |
| gyee | ayoung, for the policy stuff, we either going to have fine grained policy or centralized policy | 00:50 |
| *** dsirrine has quit IRC | 00:51 | |
| gyee | otherwise, hierarchical roles or virtual roles won't be very useful | 00:51 |
| *** su_zhang has quit IRC | 00:52 | |
| *** su_zhang has joined #openstack-keystone | 00:52 | |
| *** sdake_ has quit IRC | 00:53 | |
| gyee | anyway, the idea of multiple LDAP URLs sound like an oxymoron as LDAP by design is *centralized*, *highly available*, and "fast lookup". | 00:54 |
| ayoung | gyee, I know. | 00:54 |
| ayoung | gyee, I think the multiple URLs is a HA/Failover thing | 00:55 |
| ayoung | if it works, we should support it. Its come up a few times. Might avoid someone having to run HA proxy infront of their LDAP server | 00:55 |
| gyee | for HA, we should be talking to a VIP which is LB across multiple nodes | 00:55 |
| ayoung | gyee, that has been the story thus far, but Keystone really should not be driving that. If an org has a setup already, it might be outside the Keystone operators control | 00:56 |
| *** _cjones_ has quit IRC | 00:56 | |
| ayoung | gyee, on the implied roles thing; this is a baby step. I' | 00:56 |
| ayoung | I'm trying to make *any* progreasa here, and this is the smallest step I can conceive. | 00:57 |
| *** browne has quit IRC | 00:57 | |
| gyee | I am not oppose to supporting it, we have to be flexible anyway | 00:57 |
| gyee | we can't force operator to do things certain way | 00:57 |
| *** EinstCrazy has joined #openstack-keystone | 00:58 | |
| gyee | ayoung, oh I am all for improving role management | 00:58 |
| gyee | but I also think that this is a cross-project thingy | 00:59 |
| *** ankita_wagh has quit IRC | 01:01 | |
| *** brad[] has joined #openstack-keystone | 01:05 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Implied Roles https://review.openstack.org/125704 | 01:06 |
| ayoung | gyee, this is a prereq. Policy and roles are cross project | 01:07 |
| gyee | ayoung, I see | 01:08 |
| gyee | so the plan is get this done in Keystone first, then work on the individual projects | 01:09 |
| ayoung | gyee, I also want to split the policy fioles into two parts | 01:09 |
| *** wwwjfy has joined #openstack-keystone | 01:09 | |
| ayoung | one part will be matching the scope. THat should not be changed. THe second is the role, and that can then be dynamically generated | 01:09 |
| gyee | using overlay | 01:09 |
| gyee | one concern I have is Horizon | 01:10 |
| ayoung | overlay? you mean the policy thing? Maybe, although I could also see the role part of policy becoming URL based instead of API | 01:10 |
| ayoung | How is that? | 01:10 |
| gyee | as of now they are still manually importing policy files | 01:10 |
| gyee | ayoung, I mean how does oslo.policy using the two parts, by overlay right? | 01:11 |
| gyee | I thought we have this capability in oslo policy already no? | 01:11 |
| ayoung | gyee, maybe. But it does not have to be. I could see the role check being done in middleware, and the scope check being done in the python code layer. Often the scope check needs to fetch the object from the database | 01:12 |
| ayoung | but, to start with..yeah, probably overlay. Although that might not work; opverlay reaplces a rule, and these need to be anded together | 01:12 |
| gyee | ayoung, you mean like this? https://github.com/openstack/swift/blob/master/swift/common/middleware/keystoneauth.py#L408 | 01:15 |
| gyee | ayoung, so there are Swift and Barbican ACL and role checks middleware | 01:16 |
| ayoung | gyee, I think so...looks sort of right | 01:16 |
| gyee | I think there's opportunity to unify them | 01:16 |
| gyee | into one general purpose authorization middleware | 01:16 |
| ayoung | gyee, that is why I've backed off on policy until we have hierarchical roles. And I think we need the catalog-role-assignments too | 01:17 |
| ayoung | catalog-role-assignments splits the project based APIs from the ones that are endpoint management... | 01:17 |
| gyee | you mean endpoint scoping? | 01:19 |
| gyee | sure | 01:19 |
| ayoung | gyee, although the catalog-role-assignments approach makes splitting policy harder. | 01:19 |
| ayoung | gyee, yeah...endpoint scoping | 01:19 |
| *** davechen1 has joined #openstack-keystone | 01:23 | |
| richm | ayoung: the multiple URL thing corresponds to the -H argument of openldap commands | 01:27 |
| richm | -H ldapuri | 01:27 |
| richm | Specify URI(s) referring to the ldap server(s); a list of URI, | 01:27 |
| richm | separated by whitespace or commas is expected; | 01:27 |
| ayoung | richm, so his change looks sane? I've kindof come to that conclusion | 01:27 |
| ayoung | that is what the bug report says, too | 01:27 |
| * morgan wasn't aware that python-ldap elegantly handled that | 01:27 | |
| *** su_zhang has quit IRC | 01:28 | |
| morgan | without a bunch of extra logic wrapped around it | 01:28 |
| richm | ayoung: it is sane to support multiple ldap URIs, yes | 01:28 |
| ayoung | richm, I added yo as a reviewer. I think he still has some kinks to work out, but a general thumbs up on the approach from you would make it easier for other reviewes to bless it | 01:29 |
| ayoung | morgan, same here...I think it will make people happy | 01:29 |
| richm | does keystone allow you to specify an LDAP URI with the suffix as in ldap://host:port/dc=example,dc=com ? | 01:30 |
| *** morgan is now known as notreallymorgan | 01:30 | |
| *** notreallymorgan is now known as morgan | 01:30 | |
| richm | if so, this will require admins to specify the LDAP URI with the commas escaped as per LDAP URL escaping | 01:31 |
| morgan | richm: i think so? | 01:31 |
| ayoung | richm, Keystone does not parse the URIs itslef, so it would allow that | 01:31 |
| richm | . . . which they are probably already doing if they are using ldapsearch -H with multiple URLs anyway | 01:31 |
| morgan | richm: but i don't think python-ldap can support ldap://<host>, ldap://<host> | 01:31 |
| morgan | at least i am really not sure that it does | 01:32 |
| ayoung | morgan, according to the bug report it can | 01:32 |
| * morgan remembers writing terribad code around that because it didn't work | 01:32 | |
| ayoung | https://bugs.launchpad.net/keystone/+bug/1500631 | 01:32 |
| openstack | Launchpad bug 1500631 in Keystone "ldap url option actually supports multiple URIs" [Low,In progress] - Assigned to Eric Brown (ericwb) | 01:32 |
| morgan | ayoung: yeah I saw the bug | 01:32 |
| ayoung | l = ldap.initialize('ldap://localhost:389,ldaps://ldaps.company.com:636') | 01:32 |
| ayoung | l.simple_bind_s() | 01:32 |
| ayoung | (97, [], 1, []) | 01:32 |
| morgan | i just remember python-ldap doing weeeeeiiirrdd things | 01:32 |
| morgan | where like if the first one timed out it took ages to connect to the second one | 01:33 |
| *** fawadkhaliq has joined #openstack-keystone | 01:33 | |
| morgan | it's not a connect to both and return first success or anything, but just horrible delays when the primary was out | 01:33 |
| morgan | better to use haproxy as i recall | 01:33 |
| morgan | but again it has been a while | 01:33 |
| * morgan shrugs | 01:33 | |
| gyee | the production LDAP server I dealt with in the past have only one URL and supports startTLS | 01:34 |
| gyee | only need to burn one hole in the firewall instead of multiple :) | 01:35 |
| *** mylu has joined #openstack-keystone | 01:45 | |
| stevemar | morgan: according to the docs it works | 01:51 |
| jamielennox | gyee: sorry just -1ed the global enforcement patch | 01:57 |
| *** sdake has joined #openstack-keystone | 01:58 | |
| jamielennox | morgan, bknudson: can you have a look at https://review.openstack.org/#/c/225516/ - it's a cherry-pick to stable | 01:59 |
| *** agireud has quit IRC | 02:00 | |
| jamielennox | also, easy ones: https://review.openstack.org/#/c/224975/ https://review.openstack.org/224407 https://review.openstack.org/229161 | 02:00 |
| gyee | jamielennox, that's fine, I am OK with it as separate middleware | 02:00 |
| gyee | thanks for the review | 02:00 |
| jamielennox | gyee: not even trying that any more, it's been so long | 02:01 |
| gyee | jamielennox, all I need is enforcement at middleware, AuthToken or otherwise | 02:02 |
| gyee | I am very much open to suggestions on the deployment side | 02:02 |
| jamielennox | gyee: i have the start of ideas for that | 02:02 |
| *** stevemar has quit IRC | 02:02 | |
| jamielennox | a general way to fix the policy checking at decorator time | 02:03 |
| gyee | ayoung and I were chatting about generic authorization middleware earlier | 02:03 |
| jamielennox | i think we can do it either there or auth_token | 02:03 |
| jamielennox | via the _user plugin | 02:03 |
| gyee | I like the general direction, just haven't thought about the details | 02:03 |
| jamielennox | have auth_token middleware enforce that some policy has been checked on get_response() | 02:04 |
| jamielennox | or similar | 02:04 |
| jamielennox | still thinking about that one, but i spent a chunk of the morning ripping up the AuthContext stuff | 02:04 |
| jamielennox | need to have a chat with someone about how we fix oslo.context | 02:04 |
| gyee | token validation -> build auth context -> authorization -> service | 02:04 |
| gyee | jamielennox, Swift and Barbican also support ACLs, which is based on attribute matching | 02:06 |
| gyee | I am sure we can generalize them with oslo policy | 02:06 |
| jamielennox | right, but can we do auth_token middleware, oslo.context and oslo.policy in keystone in a way that other services can replicate | 02:06 |
| gyee | yeah that would be nice | 02:07 |
| ayoung | I'm seeing rpc_backend = nova.openstack.common.rpc.impl_qpid | 02:07 |
| ayoung | and similar in Neutron. Did they not get the memo that oslo-messaging is a separate library, or does no one care? Or Maybethuis is Kilo code.... | 02:07 |
| jamielennox | i've got the auth_token bit, ttrying to figure out the context bit now, not sure on the policy yet | 02:07 |
| ayoung | yeah.....Kilo | 02:08 |
| jamielennox | ayoung: nova.openstack.common implies oslo-incubator , must have been about when it split | 02:12 |
| gyee | didn't we deprecated the incubator stuff? | 02:12 |
| *** stevemar has joined #openstack-keystone | 02:12 | |
| *** ChanServ sets mode: +o stevemar | 02:12 | |
| jamielennox | gyee: kilo | 02:12 |
| gyee | ah | 02:13 |
| dims_ | gyee: ayoung: those are rpc aliases that are still supported even now - http://git.openstack.org/cgit/openstack/neutron/tree/neutron/common/rpc.py#n41 | 02:17 |
| *** stevemar has quit IRC | 02:17 | |
| ayoung | dims_, are there any examples of how to configure using the new config options? Specifically, the amqp driver? | 02:18 |
| *** ngupta_ has joined #openstack-keystone | 02:18 | |
| *** ngupta has joined #openstack-keystone | 02:18 | |
| jamielennox | ah ok, they're just aliases though, so they still point to the correct oslo.messaging driver underneath | 02:19 |
| gyee | dims_, k, gotcha | 02:19 |
| dims_ | y | 02:19 |
| dims_ | ayoung: amqp driver, best bet is to catch kgiusti | 02:20 |
| dims_ | ayoung: or flaper87 | 02:20 |
| *** spandhe has quit IRC | 02:20 | |
| ayoung | dims_, heh...yeah, talked with kgiusti earlier today. Was wondering if anyone actually documented how to use any of these... | 02:20 |
| ayoung | looks like the number of config options is slightly larger than the docs say... | 02:21 |
| dims_ | ayoung: it would be one of them who should :) | 02:21 |
| ayoung | dims_, but, even if it were amqp or rabbit, what would I start with? | 02:22 |
| ayoung | dims_, I'm working with packstack which still uses the embedded nova and neutron specific values for qpid_driver (or rabbit_) | 02:23 |
| dims_ | ayoung: i usually pick what's in devstack, i look at the configuration files in a DSVM CI job | 02:23 |
| ayoung | ok...I can start with that | 02:23 |
| ayoung | dims_, you got a link? | 02:25 |
| *** ngupta has quit IRC | 02:26 | |
| dims_ | ayoung: example rabbitmq config for nova.conf - http://logs.openstack.org/64/227564/4/check/gate-tempest-dsvm-full/4eac836/logs/etc/nova/nova.conf.txt.gz | 02:27 |
| ayoung | dims_, ok thanks...that works... | 02:27 |
| ayoung | rpc_backend = rabbit is still global. I guess I replace that with rpc_backend = amqp. Where is the URL.... | 02:28 |
| dims_ | ayoung: neutron - http://logs.openstack.org/64/227564/4/check/gate-tempest-dsvm-neutron-large-ops/009056b/logs/etc/neutron/neutron.conf.txt.gz | 02:28 |
| dims_ | hang on let me find if there's a CI job for amqp | 02:28 |
| *** ngupta_ has quit IRC | 02:29 | |
| *** ngupta has joined #openstack-keystone | 02:29 | |
| *** lhcheng has quit IRC | 02:29 | |
| ayoung | rabbit_hosts = 127.0.0.1 | 02:30 |
| ayoung | Must be something comparable for amqp... | 02:30 |
| ayoung | dims_, so http://git.openstack.org/cgit/openstack/oslo.messaging/tree/oslo_messaging/_drivers/protocols/amqp/opts.py seems like it would be tehe set of options, but I don't see something that maps to the URL or host or something | 02:32 |
| ayoung | unless it is server_request_prefix but that seems odd | 02:33 |
| ayoung | http://git.openstack.org/cgit/openstack/oslo.messaging/tree/oslo_messaging/_drivers/amqp.py has a coupole more...but no URL.. | 02:33 |
| *** lhcheng has joined #openstack-keystone | 02:33 | |
| *** ChanServ sets mode: +v lhcheng | 02:33 | |
| *** ankita_wagh has joined #openstack-keystone | 02:34 | |
| ayoung | http://git.openstack.org/cgit/openstack/oslo.messaging/tree/oslo_messaging/_drivers/base.py#n23 has conn pool | 02:34 |
| *** stevemar has joined #openstack-keystone | 02:36 | |
| *** ChanServ sets mode: +o stevemar | 02:36 | |
| ayoung | http://logs.openstack.org/96/204696/1/check/gate-oslo.messaging-dsvm-functional-amqp1-f21/6fae401/logs/etc/nova/nova.conf.txt.gz has RPC backedn Rabbit... Doesn't seem very functional to me | 02:38 |
| dims_ | ayoung: that's not a good one | 02:39 |
| dims_ | ayoung: have you seen the devstack plugin for amqp yet? https://github.com/kgiusti/amqp1-devstack/tree/master/devstack | 02:39 |
| dims_ | it actually moved in http://git.openstack.org/cgit/openstack/devstack-plugin-amqp1/tree/devstack | 02:40 |
| ayoung | dims_, there is no config of the services in there, though | 02:40 |
| ayoung | dims_, do we not need to set the rpc_driver in each service anymore? Can they now autodiscover it? | 02:41 |
| ayoung | dims_, scary, isn't it? | 02:45 |
| dims_ | ayoung: the right thing to do is get ken and flavio to define a experimental job with devstack+tempest with the qpidd plugin enabled tomorrow and then we can inspect that ci environment | 02:47 |
| dims_ | i got to drop off will ping them tomorrow | 02:47 |
| ayoung | dims_, I was working with ken today...will beat him up about this tomorrow...but thanks | 02:47 |
| dims_ | cool | 02:47 |
| *** richm has quit IRC | 02:48 | |
| *** stevemar has quit IRC | 02:49 | |
| *** stevemar has joined #openstack-keystone | 02:50 | |
| *** ChanServ sets mode: +o stevemar | 02:50 | |
| gyee | nighty night, y'all, (late) dinner time for me | 02:52 |
| *** gyee has quit IRC | 02:52 | |
| ayoung | dims_, found it: | 02:53 |
| ayoung | http://git.openstack.org/cgit/openstack/oslo.messaging/tree/oslo_messaging/transport.py#n38 | 02:53 |
| *** stevemar has quit IRC | 02:54 | |
| *** dims_ has quit IRC | 02:57 | |
| ayoung | jamielennox, cloud-init continues to reset the /etc/resolv.conf files... | 03:10 |
| *** davechen has joined #openstack-keystone | 03:16 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v3_token() https://review.openstack.org/196877 | 03:18 |
| jamielennox | ayoung: i've notcied that | 03:18 |
| ayoung | jamielennox, we can safely uninstall cloud-init once it's done its work | 03:18 |
| jamielennox | i think we could override it from network-scripts as well | 03:18 |
| *** davechen1 has quit IRC | 03:19 | |
| jamielennox | also it's getting that value from the project configuration | 03:19 |
| jamielennox | network configuration | 03:19 |
| jamielennox | so you could set it there i guess, it's just kind of the wrong way about | 03:19 |
| jamielennox | also because i'm not sure it is cloud-init as opposed to just network manager doing a dhcp lease | 03:22 |
| lbragstad | dolphm: dstanek morgan thoughts on the comment here - https://review.openstack.org/#/c/196877/25/keystone/token/provider.py | 03:22 |
| *** stevemar has joined #openstack-keystone | 03:22 | |
| *** ChanServ sets mode: +o stevemar | 03:22 | |
| *** stevemar_ has joined #openstack-keystone | 03:24 | |
| *** ChanServ sets mode: +o stevemar_ | 03:24 | |
| dolphm | lbragstad: the difference between _validate_token() and validate_token() is the caching boundary | 03:24 |
| lbragstad | dolphm: so we need to have it? | 03:24 |
| dolphm | lbragstad: it's more efficient to cache the result of a single token alone than it is to cache the result of single_token + belongsTo | 03:24 |
| *** lhcheng has quit IRC | 03:25 | |
| dolphm | lbragstad: and besides, belongsTo is a kwarg, so it can't be cached without changing that | 03:25 |
| lbragstad | gotcha | 03:25 |
| dolphm | lbragstad: you're the one that's adding validate_non_persistent_token which is the one that seems weird to me ;) so i can't comment on that | 03:25 |
| lbragstad | dolphm: yeah, I'm just looking for feedback to make it simpler | 03:26 |
| dolphm | lbragstad: the difference in doc strings and method signatures between validate_non_persistent_token and validate_v3_token leaves me scratching my head | 03:26 |
| lbragstad | dolphm: bknudson suggested that we rename validate_v3_token_reference back to validate_v3_token | 03:27 |
| *** stevemar has quit IRC | 03:27 | |
| dolphm | token ID vs token_ref and non-persistent implied-v3 vs v3? | 03:27 |
| *** wwwjfy has quit IRC | 03:27 | |
| dolphm | lbragstad: why are we validating token dicts instead of just token strings? what is there to validate? | 03:28 |
| lbragstad | dolphm: you mean validating the token reference? | 03:28 |
| lbragstad | dolphm: I'm not sure I can answer that | 03:28 |
| *** wwwjfy has joined #openstack-keystone | 03:28 | |
| dolphm | lbragstad: i assume it's a reference to a complex object, and that object is a dict? | 03:28 |
| *** stevemar_ has quit IRC | 03:28 | |
| lbragstad | dolphm: yeah, its the reference we pull the sql | 03:29 |
| lbragstad | or where ever keystone is storing the tokens | 03:29 |
| dolphm | lbragstad: if it came from sql, it should be valid, no? | 03:29 |
| morgan | dolphm: hmm wait let me read the scrollback | 03:29 |
| *** agireud has joined #openstack-keystone | 03:29 | |
| lbragstad | dolphm: well, it still puts it through the expiration checks and stuff... | 03:30 |
| * dolphm forgets how silly the token table is | 03:30 | |
| morgan | ok | 03:30 |
| *** lhcheng has joined #openstack-keystone | 03:30 | |
| *** ChanServ sets mode: +v lhcheng | 03:30 | |
| morgan | so we have to verify things like domain exists | 03:30 |
| morgan | project exists | 03:30 |
| morgan | etc | 03:30 |
| morgan | etc | 03:30 |
| morgan | thats what the bulk is doing | 03:30 |
| morgan | for validate v2/v3 | 03:30 |
| dolphm | because the token table is entirely a blob - right | 03:31 |
| morgan | yep | 03:31 |
| lbragstad | morgan: that's why we pull the token from persistence? | 03:31 |
| *** lhcheng_ has joined #openstack-keystone | 03:31 | |
| morgan | lbragstad: pulling from persistence saves *some* of the heavy lifting | 03:31 |
| *** lhcheng has quit IRC | 03:31 | |
| morgan | we don't reconstruct the SC | 03:31 |
| morgan | we don't reconstruct some of ther other icky parts | 03:31 |
| *** stevemar has joined #openstack-keystone | 03:31 | |
| *** ChanServ sets mode: +o stevemar | 03:31 | |
| morgan | but we do validate things exists/should be there | 03:31 |
| morgan | dolphm: and we can't use FKs etc. | 03:32 |
| morgan | we *could* make all tokens just look like fernet tokens in the DB (except PKI... but meh) | 03:32 |
| dolphm | ha | 03:32 |
| morgan | interesting idea... | 03:32 |
| morgan | actually | 03:32 |
| lbragstad | morgan: so make token validation *always* rebuild everything, like it has to with fernet? | 03:33 |
| dolphm | use fernet on the backend? lol | 03:33 |
| morgan | dolphm: maaaybe? | 03:33 |
| morgan | ;) | 03:33 |
| lbragstad | and then we only validate token ID strings... validating a token object/dict wouldn't make sense. | 03:33 |
| morgan | lbragstad: so i think step 1 is still only ever "issue" v3 tokens then convert to v2 | 03:33 |
| morgan | i would even go as far as saying we should stop storing v2 tokens and convert "on the fly" as needed (even for PKI) so it really is a shim layer | 03:34 |
| morgan | we could simply use fernet for everything except the PKI token stuff and even that.. we *technically* could just make fernet the workhorse and reconstruct everything each time as needed | 03:35 |
| morgan | and then start streamlining the token construction | 03:35 |
| morgan | dolphm: iiiiinttterrrrrresting ideas | 03:35 |
| * morgan also likes thinking that it'll be stevemar's job to tell us "no that is terrible" if it is | 03:36 | |
| * dolphm leaves morgan to his late night ideas | 03:37 | |
| lbragstad | dolphm: morgan well, i just needed to rebase that patch and it got me thinking... should be passing now and have current comments addressed | 03:38 |
| stevemar | morgan: everything is terrible all the time | 03:38 |
| *** sdake has quit IRC | 03:38 | |
| stevemar | lbragstad: dolphm umm, more background? | 03:40 |
| lbragstad | stevemar: I was rebasing https://review.openstack.org/#/c/196877/25/keystone/token/provider.py | 03:40 |
| lbragstad | and I left a comment. | 03:40 |
| *** sdake has joined #openstack-keystone | 03:41 | |
| stevemar | lbragstad: you're gonna end up needed a validate_non_persistent_v2_token | 03:45 |
| stevemar | and validate_non_persistent_v3_token | 03:45 |
| *** sdake has quit IRC | 03:46 | |
| *** links has joined #openstack-keystone | 03:53 | |
| *** ankita_wagh has quit IRC | 03:55 | |
| *** ankita_wagh has joined #openstack-keystone | 03:56 | |
| *** dims has joined #openstack-keystone | 03:57 | |
| stevemar | jamielennox: marekd no takers? https://review.openstack.org/#/c/224993/ :) | 04:00 |
| stevemar | did you want to see proof of it working? :) | 04:00 |
| jamielennox | stevemar: i guess i trust you | 04:01 |
| stevemar | jamielennox: tricked! it's all broken and undocumented! | 04:02 |
| *** dims has quit IRC | 04:03 | |
| jamielennox | stevemar: it and everything else | 04:05 |
| stevemar | jamielennox: sad but true | 04:06 |
| stevemar | jamielennox: i can't wait for 2.0.0 of ksc! | 04:07 |
| stevemar | we're gonna piss off so many people when we remove the CLI | 04:07 |
| jamielennox | stevemar: i've no idea how we're going to manage that one | 04:07 |
| stevemar | it's going to be fantastic | 04:07 |
| jamielennox | i thought we'd get a feature branch and quick cut over | 04:07 |
| jamielennox | but no, we have to pass it through | 04:07 |
| *** davechen1 has joined #openstack-keystone | 04:08 | |
| stevemar | jamielennox: you referring to your giant patch? | 04:08 |
| stevemar | feature branches stink | 04:08 |
| jamielennox | no i won't do it as a giant patch | 04:08 |
| jamielennox | but i thought we'd be able to delare a v2 branch | 04:08 |
| jamielennox | apparently that wsa disallowed and we should do them as normal reviews | 04:09 |
| jamielennox | ask morgan for more details | 04:09 |
| * morgan hides | 04:09 | |
| morgan | HEY THIS IS MY ROCK | 04:09 |
| morgan | no asking me to come out from under it :P | 04:09 |
| *** davechen has quit IRC | 04:10 | |
| *** kiran-r has joined #openstack-keystone | 04:11 | |
| *** fawadkhaliq has quit IRC | 04:12 | |
| *** davechen has joined #openstack-keystone | 04:15 | |
| stevemar | morgan: for the liberty-backport-potential tag, did you just create those to boot out some bugs to M? | 04:16 |
| morgan | stevemar: yep | 04:16 |
| morgan | stevemar: basically if it looked like something that almost landed for liberty | 04:16 |
| morgan | i tagged it | 04:16 |
| stevemar | morgan: okie dokie, that's kosher | 04:16 |
| morgan | feel free to drop the tag if you want | 04:16 |
| morgan | :) | 04:16 |
| *** davechen1 has quit IRC | 04:18 | |
| *** hidekazu has joined #openstack-keystone | 04:19 | |
| stevemar | morgan: nah its fine | 04:21 |
| stevemar | dstanek: around? | 04:21 |
| *** kiran-r has quit IRC | 04:22 | |
| *** fawadkhaliq has joined #openstack-keystone | 04:34 | |
| *** fawadkhaliq has quit IRC | 04:35 | |
| *** fawadkhaliq has joined #openstack-keystone | 04:35 | |
| *** ayoung has quit IRC | 04:36 | |
| *** links has quit IRC | 04:36 | |
| *** grantbow has quit IRC | 04:37 | |
| *** grantbow has joined #openstack-keystone | 04:39 | |
| *** fawadkhaliq has quit IRC | 04:41 | |
| *** mylu has quit IRC | 04:46 | |
| *** ngupta has quit IRC | 04:47 | |
| *** browne has joined #openstack-keystone | 04:51 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Multiple URLs may be specified for ldap url https://review.openstack.org/228644 | 05:02 |
| *** thiagop has quit IRC | 05:08 | |
| *** kfox1111 has quit IRC | 05:09 | |
| *** iurygregory has quit IRC | 05:10 | |
| *** lhcheng_ has quit IRC | 05:12 | |
| openstackgerrit | Merged openstack/keystoneauth: add openid connect plugins https://review.openstack.org/224993 | 05:12 |
| *** links has joined #openstack-keystone | 05:12 | |
| *** tellesnobrega is now known as tellesnobrega_af | 05:22 | |
| *** gildub has joined #openstack-keystone | 05:25 | |
| gildub | jamielennox, hi - Bring back https://bugs.launchpad.net/keystone/+bug/1475091 to the table | 05:26 |
| openstack | Launchpad bug 1475091 in Keystone "Missing name field for trusts" [Wishlist,Won't fix] | 05:26 |
| gildub | jamielennox, after trying different approaches, it turns out this is a [BLOCKER] for using trusts in openstack puppet | 05:27 |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Move response status check to the call https://review.openstack.org/227883 | 05:28 |
| jamielennox | gildub: yea, not sure what to do there | 05:28 |
| gildub | jamielennox, bring it to the weekly meeting topics, ayoung wasn't convinced but something needs to be done. | 05:29 |
| jamielennox | gildub: yea, i see that you need something to add there | 05:30 |
| jamielennox | and the problem with name and desc | 05:30 |
| gildub | jamielennox, the commit message of https://review.openstack.org/200996 is explicit | 05:30 |
| *** lhcheng has joined #openstack-keystone | 05:32 | |
| *** ChanServ sets mode: +v lhcheng | 05:32 | |
| gildub | jamielennox, when puppet runs as a daemon, which is mostly the case in production, then every time the puppet catalog would be executed, all the trusts declared in the catalog will created (added), an infinity of trusts is going to be there very quickly, this is not acceptable for puppet users. | 05:32 |
| gildub | ^ s/will created/will be created/ | 05:33 |
| gildub | jamielennox, I'm updating the bug accordingly | 05:34 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Show v3 endpoints in v2 endpoint list https://review.openstack.org/215870 | 05:35 |
| jamielennox | stevemar: thoughts ^ | 05:35 |
| stevemar | jamielennox: gildub looking at the patch and bug | 05:37 |
| gildub | stevemar, thanks. BTW thanks for pushing review 215870! | 05:38 |
| *** Nirupama has joined #openstack-keystone | 05:39 | |
| * stevemar goes to see what 215870 is | 05:39 | |
| stevemar | oh that one, yeah - i want it in | 05:39 |
| gildub | stevemar, :) | 05:39 |
| stevemar | in liberty, i'll backport it | 05:40 |
| *** su_zhang has joined #openstack-keystone | 05:40 | |
| *** hrou has quit IRC | 05:40 | |
| stevemar | gildub: why does puppet need trusts? | 05:41 |
| *** errr has quit IRC | 05:41 | |
| stevemar | i'm trying to decide if trusts need to be domain scoped, i don't think they need to be | 05:41 |
| stevemar | since they should be used to delegate roles between domains, then they should be "above" that, and globally unique named | 05:42 |
| stevemar | lhcheng: you're alive! | 05:42 |
| *** lsmola has joined #openstack-keystone | 05:42 | |
| lhcheng | hey stevemar! | 05:43 |
| lhcheng | I've picked up my passport today, ready to go for Japan :) | 05:43 |
| stevemar | woo hoo lhcheng | 05:43 |
| stevemar | lhcheng: i need to bug you about osc reviews when you have a few minutes | 05:44 |
| lhcheng | sure, I was just looking at the v2-v3 endpoint patch | 05:44 |
| stevemar | lhcheng: oh yeah, do that instead :) | 05:45 |
| lhcheng | the patch you fixed above. | 05:45 |
| stevemar | then this patch chain - hehe https://review.openstack.org/#/c/222046/ | 05:45 |
| lhcheng | yeah this patch is rc potential :) | 05:45 |
| lhcheng | when do we target to wrap up rc2? | 05:46 |
| *** mylu has joined #openstack-keystone | 05:47 | |
| lhcheng | stevemar: perfect timing, I just enabled swift on my devstack :) | 05:49 |
| jamielennox | stevemar: no we don't want to domain scope trusts | 05:52 |
| *** mylu has quit IRC | 05:53 | |
| *** errr has joined #openstack-keystone | 05:54 | |
| gildub | stevemar, why not having trust in puppet? But a real case need has been driven by heat, which needs the trust created so it can go ahead | 05:55 |
| gildub | stevemar, re https://review.openstack.org/215870, great looking forward for it. | 06:01 |
| *** stevemar has quit IRC | 06:04 | |
| *** stevemar has joined #openstack-keystone | 06:04 | |
| *** ChanServ sets mode: +o stevemar | 06:04 | |
| *** stevemar has quit IRC | 06:08 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Zanata https://review.openstack.org/228119 | 06:09 |
| *** mflobo has joined #openstack-keystone | 06:11 | |
| *** mflobo has left #openstack-keystone | 06:11 | |
| *** sileht has quit IRC | 06:17 | |
| *** ParsectiX has joined #openstack-keystone | 06:25 | |
| *** sileht has joined #openstack-keystone | 06:28 | |
| *** Nirupama has quit IRC | 06:32 | |
| *** Nirupama has joined #openstack-keystone | 06:33 | |
| *** jaosorior has joined #openstack-keystone | 06:41 | |
| *** GB21 has joined #openstack-keystone | 06:48 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Using the right format to render the docstring correctly https://review.openstack.org/226225 | 06:50 |
| *** mylu has joined #openstack-keystone | 06:50 | |
| *** ParsectiX has quit IRC | 06:54 | |
| *** ParsectiX has joined #openstack-keystone | 06:54 | |
| *** mylu has quit IRC | 06:54 | |
| *** su_zhang has quit IRC | 06:55 | |
| *** topol has joined #openstack-keystone | 06:55 | |
| *** ChanServ sets mode: +v topol | 06:55 | |
| *** Nirupama has quit IRC | 06:56 | |
| *** topol has quit IRC | 07:00 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Using the right format to render the docstring correctly https://review.openstack.org/226225 | 07:00 |
| *** afazekas_ has joined #openstack-keystone | 07:01 | |
| *** ankita_w_ has joined #openstack-keystone | 07:03 | |
| *** jlvillal has quit IRC | 07:05 | |
| *** ankita_wagh has quit IRC | 07:06 | |
| *** browne has quit IRC | 07:09 | |
| *** roxanagh_ has joined #openstack-keystone | 07:10 | |
| *** pnavarro has joined #openstack-keystone | 07:12 | |
| *** roxanagh_ has quit IRC | 07:17 | |
| *** roxanagh_ has joined #openstack-keystone | 07:17 | |
| *** Nirupama has joined #openstack-keystone | 07:22 | |
| *** urulama has quit IRC | 07:24 | |
| *** roxanagh_ has quit IRC | 07:24 | |
| *** urulama has joined #openstack-keystone | 07:24 | |
| *** roxanagh_ has joined #openstack-keystone | 07:25 | |
| *** henrynash has joined #openstack-keystone | 07:29 | |
| *** ChanServ sets mode: +v henrynash | 07:29 | |
| *** roxanagh_ has quit IRC | 07:31 | |
| *** davechen has left #openstack-keystone | 07:32 | |
| *** Nirupama has quit IRC | 07:34 | |
| openstackgerrit | Hidekazu Nakamura proposed openstack/keystone: Update development environment set up doc https://review.openstack.org/223020 | 07:38 |
| *** afazekas_ has quit IRC | 07:40 | |
| *** gildub has quit IRC | 07:48 | |
| *** henrynash has quit IRC | 07:55 | |
| *** jvarlamova has joined #openstack-keystone | 07:55 | |
| *** henrynash has joined #openstack-keystone | 07:55 | |
| *** jvarlamova has quit IRC | 07:55 | |
| *** jvarlamova has joined #openstack-keystone | 07:55 | |
| *** ParsectiX has quit IRC | 08:00 | |
| *** fhubik has joined #openstack-keystone | 08:02 | |
| *** jistr has joined #openstack-keystone | 08:02 | |
| *** Nakato has quit IRC | 08:03 | |
| *** lhcheng has quit IRC | 08:03 | |
| *** Nakato has joined #openstack-keystone | 08:03 | |
| *** e0ne has joined #openstack-keystone | 08:03 | |
| *** ankita_w_ has quit IRC | 08:05 | |
| *** ankita_wagh has joined #openstack-keystone | 08:05 | |
| *** ParsectiX has joined #openstack-keystone | 08:05 | |
| *** brad[] has quit IRC | 08:07 | |
| openstackgerrit | Tony Wang proposed openstack/keystone: Show v3 endpoints in v2 endpoint list https://review.openstack.org/215870 | 08:10 |
| *** ankita_wagh has quit IRC | 08:15 | |
| *** ankita_wagh has joined #openstack-keystone | 08:15 | |
| *** stevemar has joined #openstack-keystone | 08:16 | |
| *** ChanServ sets mode: +o stevemar | 08:16 | |
| *** ankita_wagh has quit IRC | 08:20 | |
| *** markvoelker has quit IRC | 08:20 | |
| *** stevemar has quit IRC | 08:21 | |
| *** brad[] has joined #openstack-keystone | 08:52 | |
| *** agireud has quit IRC | 08:54 | |
| *** ParsectiX has quit IRC | 08:56 | |
| *** henrynash has joined #openstack-keystone | 08:58 | |
| *** ChanServ sets mode: +v henrynash | 08:58 | |
| *** e0ne has quit IRC | 09:00 | |
| *** e0ne has joined #openstack-keystone | 09:00 | |
| *** EinstCrazy has quit IRC | 09:01 | |
| *** ParsectiX has joined #openstack-keystone | 09:02 | |
| *** katkapilatova has joined #openstack-keystone | 09:03 | |
| *** aix has joined #openstack-keystone | 09:06 | |
| *** urulama has quit IRC | 09:09 | |
| *** urulama has joined #openstack-keystone | 09:09 | |
| *** markvoelker has joined #openstack-keystone | 09:21 | |
| *** markvoelker has quit IRC | 09:26 | |
| *** henrynash has quit IRC | 09:28 | |
| *** EinstCrazy has joined #openstack-keystone | 09:28 | |
| *** dims has joined #openstack-keystone | 09:32 | |
| *** dims has quit IRC | 09:39 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Deprecate local conf in paste-ini https://review.openstack.org/134124 | 09:40 |
| *** EinstCrazy has quit IRC | 09:40 | |
| *** dims has joined #openstack-keystone | 09:42 | |
| *** marzif has joined #openstack-keystone | 09:51 | |
| *** lhcheng has joined #openstack-keystone | 09:52 | |
| *** ChanServ sets mode: +v lhcheng | 09:52 | |
| *** lhcheng has quit IRC | 09:57 | |
| *** rajesht_ has joined #openstack-keystone | 09:58 | |
| *** topol has joined #openstack-keystone | 10:01 | |
| *** ChanServ sets mode: +v topol | 10:01 | |
| *** fhubik is now known as fhubik_brb | 10:01 | |
| *** rajesht has quit IRC | 10:01 | |
| *** marzif has quit IRC | 10:03 | |
| *** topol has quit IRC | 10:06 | |
| *** EinstCrazy has joined #openstack-keystone | 10:07 | |
| *** jaosorior has quit IRC | 10:07 | |
| *** ParsectiX has quit IRC | 10:10 | |
| *** pnavarro has quit IRC | 10:18 | |
| *** jasondotstar_afk is now known as jasondotstar | 10:19 | |
| *** e0ne has quit IRC | 10:36 | |
| *** mylu has joined #openstack-keystone | 10:51 | |
| *** mylu has quit IRC | 10:56 | |
| *** ParsectiX has joined #openstack-keystone | 10:59 | |
| *** e0ne has joined #openstack-keystone | 11:18 | |
| *** BAKfr has quit IRC | 11:18 | |
| *** EinstCra_ has joined #openstack-keystone | 11:19 | |
| openstackgerrit | Hidekazu Nakamura proposed openstack/keystone: Remove unused get_user_projects() https://review.openstack.org/229369 | 11:20 |
| *** nisha has joined #openstack-keystone | 11:20 | |
| *** EinstCrazy has quit IRC | 11:21 | |
| *** BAKfr has joined #openstack-keystone | 11:21 | |
| *** pnavarro has joined #openstack-keystone | 11:22 | |
| *** markvoelker has joined #openstack-keystone | 11:22 | |
| *** itlinux has joined #openstack-keystone | 11:25 | |
| *** itlinux has quit IRC | 11:26 | |
| *** itlinux has joined #openstack-keystone | 11:26 | |
| *** markvoelker has quit IRC | 11:27 | |
| *** GB21_ has joined #openstack-keystone | 11:40 | |
| *** lhcheng has joined #openstack-keystone | 11:41 | |
| *** ChanServ sets mode: +v lhcheng | 11:41 | |
| *** gordc has joined #openstack-keystone | 11:42 | |
| *** GB21 has quit IRC | 11:44 | |
| *** lhcheng has quit IRC | 11:45 | |
| *** iurygregory has joined #openstack-keystone | 11:53 | |
| *** GB21_ has quit IRC | 11:56 | |
| *** jaosorior has joined #openstack-keystone | 11:59 | |
| *** fhubik_brb is now known as fhubik | 11:59 | |
| *** Ephur has joined #openstack-keystone | 12:00 | |
| *** markvoelker has joined #openstack-keystone | 12:03 | |
| *** lhcheng has joined #openstack-keystone | 12:05 | |
| *** ChanServ sets mode: +v lhcheng | 12:05 | |
| *** htruta` is now known as htruta | 12:05 | |
| openstackgerrit | Dave Chen proposed openstack/keystonemiddleware: update middlewarearchitecture.rst https://review.openstack.org/219162 | 12:06 |
| *** lhcheng has quit IRC | 12:10 | |
| *** tellesnobrega_af is now known as tellesnobrega | 12:12 | |
| *** raildo-afk is now known as raildo | 12:12 | |
| openstackgerrit | Dave Chen proposed openstack/keystonemiddleware: update middlewarearchitecture.rst https://review.openstack.org/219162 | 12:19 |
| *** pnavarro has quit IRC | 12:20 | |
| *** aix has quit IRC | 12:22 | |
| *** pnavarro has joined #openstack-keystone | 12:22 | |
| *** pnavarro has quit IRC | 12:34 | |
| *** amakarov_away is now known as amakarov | 12:39 | |
| *** marzif has joined #openstack-keystone | 12:43 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Skip rows with empty remote_ids https://review.openstack.org/206561 | 12:44 |
| *** pnavarro has joined #openstack-keystone | 12:47 | |
| *** richm has joined #openstack-keystone | 12:51 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystonemiddleware: Move response status check to the call https://review.openstack.org/227883 | 12:51 |
| amakarov | jamielennox, hi! Please, update your +2, if you don't mind ^^ | 12:52 |
| *** edmondsw has joined #openstack-keystone | 12:54 | |
| *** aix has joined #openstack-keystone | 12:55 | |
| *** tellesnobrega is now known as tellesnobrega_af | 12:59 | |
| *** pauloewerton has joined #openstack-keystone | 13:01 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 13:02 |
| *** GB21 has joined #openstack-keystone | 13:11 | |
| *** raildo is now known as raildo-afk | 13:12 | |
| *** hrou has joined #openstack-keystone | 13:12 | |
| *** geoffarnold has joined #openstack-keystone | 13:14 | |
| *** jecarey has joined #openstack-keystone | 13:14 | |
| *** geoffarn_ has joined #openstack-keystone | 13:15 | |
| *** nisha has quit IRC | 13:17 | |
| *** geoffarnold has quit IRC | 13:18 | |
| *** dsirrine has joined #openstack-keystone | 13:23 | |
| openstackgerrit | Rajesh Tailor proposed openstack/keystone: Fix order of arguments in assertDictEqual https://review.openstack.org/229421 | 13:24 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v3_token() https://review.openstack.org/196877 | 13:27 |
| *** doug-fish has quit IRC | 13:27 | |
| *** ayoung has joined #openstack-keystone | 13:28 | |
| *** ChanServ sets mode: +v ayoung | 13:28 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v2_token() https://review.openstack.org/197647 | 13:30 |
| *** su_zhang has joined #openstack-keystone | 13:30 | |
| *** alejandrito has joined #openstack-keystone | 13:30 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 13:30 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Remove domain table references https://review.openstack.org/165936 | 13:31 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Bye Bye Domain Table https://review.openstack.org/161854 | 13:31 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain in token response https://review.openstack.org/197331 | 13:31 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change policy to comply with is_domain in token https://review.openstack.org/206063 | 13:31 |
| *** raildo-afk is now known as raildo | 13:33 | |
| *** jsavak has joined #openstack-keystone | 13:33 | |
| *** su_zhang has quit IRC | 13:34 | |
| *** urulama has quit IRC | 13:35 | |
| *** geoffarn_ has quit IRC | 13:35 | |
| *** urulama has joined #openstack-keystone | 13:35 | |
| *** geoffarnold has joined #openstack-keystone | 13:35 | |
| *** tellesnobrega_af is now known as tellesnobrega | 13:37 | |
| *** marzif has quit IRC | 13:43 | |
| *** doug-fish has joined #openstack-keystone | 13:43 | |
| *** cjschaef has joined #openstack-keystone | 13:44 | |
| htruta | hey bknudson, are you around? regarding the comment you've made at https://review.openstack.org/#/c/215167/7/keystone/resource/backends/ldap.py | 13:45 |
| *** BAKfr has quit IRC | 13:45 | |
| bknudson | htruta: I am around for a few minutes | 13:45 |
| *** ngupta has joined #openstack-keystone | 13:46 | |
| htruta | bknudson: ok... we've added the pragma no cover because you suggested here: https://review.openstack.org/#/c/213273/7/keystone/resource/backends/ldap.py | 13:47 |
| *** doug-fish has quit IRC | 13:47 | |
| htruta | bknudson: should we keep it or not? | 13:47 |
| *** doug-fish has joined #openstack-keystone | 13:48 | |
| bknudson | htruta: I think you should write a unit test to cover that line rather than ignore it from the coverage report | 13:48 |
| *** su_zhang has joined #openstack-keystone | 13:48 | |
| bknudson | just call the method with a ref that's not a dict or list. | 13:48 |
| *** dims has quit IRC | 13:49 | |
| *** dims has joined #openstack-keystone | 13:49 | |
| htruta | bknudson: ok. can I call it directly from the test? or is it from a backend call? | 13:49 |
| bknudson | htruta: you can call whatever you want in a unit test. | 13:50 |
| htruta | bknudson: ok. I'll do that and try to split the patch (more) | 13:50 |
| htruta | thanks | 13:50 |
| *** doug-fish has quit IRC | 13:52 | |
| *** doug-fish has joined #openstack-keystone | 13:54 | |
| *** zzzeek has joined #openstack-keystone | 13:54 | |
| *** stevemar has joined #openstack-keystone | 13:56 | |
| *** ChanServ sets mode: +o stevemar | 13:56 | |
| *** geoffarnold has quit IRC | 13:56 | |
| *** geoffarnold has joined #openstack-keystone | 13:57 | |
| *** nisha_ has joined #openstack-keystone | 13:57 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:59 | |
| *** LukeHinds has joined #openstack-keystone | 14:01 | |
| stevemar | jamielennox: thoughts on the name of keystoneauth_saml2? should it be keystoneauth-saml2 | 14:01 |
| *** topol has joined #openstack-keystone | 14:03 | |
| *** ChanServ sets mode: +v topol | 14:03 | |
| *** BAKfr has joined #openstack-keystone | 14:05 | |
| *** jsavak has quit IRC | 14:06 | |
| *** jsavak has joined #openstack-keystone | 14:07 | |
| *** itlinux has quit IRC | 14:08 | |
| marekd | dstanek: Hi, I fixed the migration script and added a test for that: https://review.openstack.org/#/c/206561 | 14:10 |
| dstanek | marekd: great thx | 14:10 |
| *** j_king has joined #openstack-keystone | 14:12 | |
| *** ParsectiX has quit IRC | 14:13 | |
| stevemar | marekd: nice add :) | 14:14 |
| *** roxanagh_ has joined #openstack-keystone | 14:15 | |
| *** pnavarro has quit IRC | 14:16 | |
| marekd | stevemar: thank you, sir. | 14:16 |
| marekd | :) | 14:17 |
| marekd | now go ahead and review, please :-) | 14:17 |
| *** j_king has left #openstack-keystone | 14:17 | |
| amakarov | stevemar, hi! I've updated https://review.openstack.org/#/c/227883/ - would you please update your +2 there before anybody merge something breaking the tests? :) | 14:17 |
| *** geoffarnold has quit IRC | 14:17 | |
| *** geoffarnold has joined #openstack-keystone | 14:18 | |
| *** jsavak has quit IRC | 14:20 | |
| *** jsavak has joined #openstack-keystone | 14:21 | |
| stevemar | amakarov: will do sir! | 14:22 |
| *** roxanagh_ has quit IRC | 14:24 | |
| *** panbalag has joined #openstack-keystone | 14:25 | |
| *** urulama has quit IRC | 14:25 | |
| *** panbalag has left #openstack-keystone | 14:25 | |
| *** urulama has joined #openstack-keystone | 14:25 | |
| stevemar | amakarov: +2! | 14:26 |
| amakarov | stevemar, yay! | 14:26 |
| marekd | amakarov: and anther +2 from me. | 14:26 |
| amakarov | marekd, stevemar: thank you, honoured colleagues! :) | 14:29 |
| *** pnavarro has joined #openstack-keystone | 14:30 | |
| *** pnavarro has quit IRC | 14:31 | |
| *** pnavarro has joined #openstack-keystone | 14:31 | |
| stevemar | amakarov: <3 | 14:32 |
| marekd | hehe | 14:32 |
| *** su_zhang has quit IRC | 14:34 | |
| bknudson | stevemar: I don't think you can import keystoneauth-saml2 | 14:34 |
| marekd | bknudson: import where? | 14:34 |
| bknudson | in a python script | 14:35 |
| *** doug-fish has quit IRC | 14:35 | |
| *** geoffarnold is now known as geoffarnoldX | 14:35 | |
| marekd | bknudson: a little bit or context? | 14:35 |
| marekd | bknudson: ksa-saml2 doesn't have patch merged that depends on ksa | 14:36 |
| bknudson | if you "import keystoneauth-saml2", "keystoneauth-saml2.plugin" it's not going to work | 14:36 |
| marekd | because it should be "import keystoneauth_saml2" | 14:36 |
| bknudson | marekd: that would work... stevemar was wondering why it's not keystoneauth-saml2 instead. | 14:37 |
| stevemar | bknudson: yeah, i realized that this morning | 14:38 |
| stevemar | which is why i approved it now | 14:38 |
| marekd | bknudson: let me double check but i am pretty convinced i was already using ksa-saml2 in my scripts. | 14:38 |
| *** geoffarnoldX has quit IRC | 14:38 | |
| stevemar | marekd: nah you can't, i think | 14:38 |
| marekd | https://review.openstack.org/#/c/186854/ finally! | 14:38 |
| stevemar | bknudson: the project itself is keystoneauth-saml2, just not the top level dir | 14:39 |
| openstackgerrit | Merged openstack/keystoneauth-saml2: Depend on keystoneauth https://review.openstack.org/186854 | 14:39 |
| stevemar | that makes sense, since it's the same as the oslo bits, like oslo_log | 14:39 |
| *** geoffarnold has joined #openstack-keystone | 14:39 | |
| bknudson | in oslo it's oslo.log -> oslo_log | 14:39 |
| marekd | stevemar: bknudson ++ | 14:40 |
| bknudson | we also have python-keystoneclient -> keystoneclient... | 14:40 |
| stevemar | yep | 14:40 |
| bknudson | I think that's in setup.cfg? | 14:40 |
| *** su_zhang has joined #openstack-keystone | 14:40 | |
| *** agireud has joined #openstack-keystone | 14:41 | |
| *** slberger has joined #openstack-keystone | 14:41 | |
| *** doug-fish has joined #openstack-keystone | 14:41 | |
| *** su_zhang has quit IRC | 14:42 | |
| *** roxanagh_ has joined #openstack-keystone | 14:45 | |
| *** doug-fish has quit IRC | 14:46 | |
| *** itlinux has joined #openstack-keystone | 14:46 | |
| *** doug-fish has joined #openstack-keystone | 14:47 | |
| marekd | bknudson: https://github.com/openstack/keystoneauth-saml2/blob/master/setup.cfg#L23 | 14:49 |
| marekd | probably (?) | 14:50 |
| *** csoukup has joined #openstack-keystone | 14:51 | |
| *** doug-fish has quit IRC | 14:51 | |
| bknudson | marekd: I think that's it. | 14:52 |
| *** phalmos has joined #openstack-keystone | 14:52 | |
| openstackgerrit | Merged openstack/keystone-specs: Clarify documentation about scope https://review.openstack.org/224792 | 14:53 |
| *** kiran-r has joined #openstack-keystone | 14:55 | |
| *** doug-fish has joined #openstack-keystone | 15:00 | |
| *** geoffarnold has quit IRC | 15:00 | |
| *** geoffarn_ has joined #openstack-keystone | 15:01 | |
| *** r-daneel has joined #openstack-keystone | 15:01 | |
| *** diazjf has joined #openstack-keystone | 15:01 | |
| *** nisha_ has quit IRC | 15:01 | |
| *** fhubik is now known as fhubik_brb | 15:02 | |
| *** pnavarro has quit IRC | 15:03 | |
| *** jsavak has quit IRC | 15:05 | |
| *** jsavak has joined #openstack-keystone | 15:05 | |
| *** browne has joined #openstack-keystone | 15:06 | |
| *** jistr has quit IRC | 15:07 | |
| lbragstad | jamielennox: what kind of error do you see when you don't pass in PBR_VERSION - https://review.openstack.org/#/c/224407/1 ? | 15:07 |
| *** browne has quit IRC | 15:10 | |
| *** sdake has joined #openstack-keystone | 15:10 | |
| *** phalmos has quit IRC | 15:16 | |
| *** dims_ has joined #openstack-keystone | 15:16 | |
| *** kiran-r has quit IRC | 15:17 | |
| *** fhubik_brb is now known as fhubik | 15:19 | |
| *** kiran-r has joined #openstack-keystone | 15:20 | |
| *** dims has quit IRC | 15:20 | |
| *** browne has joined #openstack-keystone | 15:20 | |
| *** geoffarn_ has quit IRC | 15:21 | |
| *** links has quit IRC | 15:21 | |
| *** geoffarnold has joined #openstack-keystone | 15:22 | |
| *** katkapilatova has left #openstack-keystone | 15:22 | |
| openstackgerrit | Julien Danjou proposed openstack/keystone: wsgi: fix base_url finding https://review.openstack.org/226464 | 15:22 |
| *** itlinux has quit IRC | 15:23 | |
| *** ChanServ sets mode: +v marekd | 15:29 | |
| *** jsavak has quit IRC | 15:30 | |
| *** jsavak has joined #openstack-keystone | 15:31 | |
| *** BAKfr has quit IRC | 15:36 | |
| *** akanksha_ has joined #openstack-keystone | 15:40 | |
| *** BAKfr has joined #openstack-keystone | 15:41 | |
| *** marzif has joined #openstack-keystone | 15:41 | |
| stevemar | dstanek: my most stanek of friends, i had a question about https://review.openstack.org/#/c/167675/ | 15:41 |
| *** Sam-I-Am has joined #openstack-keystone | 15:42 | |
| Sam-I-Am | howdy | 15:42 |
| *** jecarey_ has joined #openstack-keystone | 15:43 | |
| *** cjschaef_ has joined #openstack-keystone | 15:43 | |
| *** geoffarn_ has joined #openstack-keystone | 15:43 | |
| Sam-I-Am | working on updating the install guide for liberty and running into some v2/v3 bootstrapping problems | 15:43 |
| *** doug-fis_ has joined #openstack-keystone | 15:43 | |
| *** geoffarnold has quit IRC | 15:43 | |
| *** jecarey__ has joined #openstack-keystone | 15:44 | |
| *** jecarey has quit IRC | 15:44 | |
| *** cjschaef__ has joined #openstack-keystone | 15:44 | |
| *** cjschaef has quit IRC | 15:44 | |
| *** doug-fi__ has joined #openstack-keystone | 15:44 | |
| dstanek | stevemar: ok, i'll have a look see | 15:44 |
| *** roxanagh_ has quit IRC | 15:44 | |
| stevemar | dstanek: oh i didn't write anything out yet, just wanted to better understand it | 15:45 |
| *** roxanagh_ has joined #openstack-keystone | 15:45 | |
| dstanek | ah, ok | 15:45 |
| Sam-I-Am | dstanek: moo. | 15:45 |
| *** doug-fish has quit IRC | 15:46 | |
| *** doug-fis_ has quit IRC | 15:48 | |
| *** cjschaef_ has quit IRC | 15:48 | |
| *** jecarey_ has quit IRC | 15:48 | |
| Sam-I-Am | anyone? | 15:48 |
| Sam-I-Am | dstanek: pretty sure there's some kind of bug here | 15:50 |
| dstanek | Sam-I-Am: what's up? | 15:50 |
| Sam-I-Am | trying to bootstrap keystone ... service, endpoints, initial project/user | 15:51 |
| Sam-I-Am | historically, its been OS_URL=http://blah:35357/v2.0 and OS_TOKEN=admin (or whatever is in keystone.conf) | 15:51 |
| Sam-I-Am | all of this uses v2 | 15:51 |
| Sam-I-Am | while working on putting more v3 into the install guide, i found out that the openstack client changes the command line arguments for endpoint creation depending on whether you're using v2 or v3 (which is awesome) | 15:52 |
| Sam-I-Am | i prefer to keep some consistency for our users, so showing them how to create endpoints one way and then changing it will confuse them and cause people to file bugs | 15:52 |
| Sam-I-Am | so, i tried to use OS_URL=http://blah:35357/v3 | 15:53 |
| *** BAKfr has quit IRC | 15:53 | |
| Sam-I-Am | that alone doesnt work, and also requires OS_IDENTITY_API_VERSION=3 | 15:53 |
| Sam-I-Am | so far so good.. i can create a service and endpoints | 15:53 |
| Sam-I-Am | however, if i try to create a user, i get 401 auth required | 15:53 |
| Sam-I-Am | even though i'm using auth type token_endpoint | 15:54 |
| dims_ | stevemar: hmm, seems like https://review.openstack.org/#/c/221738/ did not make it into a python-keystoneclient release yet. | 15:54 |
| dims_ | stevemar: that will help with this nova review - https://review.openstack.org/#/c/229368/ | 15:54 |
| Sam-I-Am | so i'm not sure why i'm getting asked for auth when i'm bypassing it in bootstrap mode | 15:54 |
| dstanek | Sam-I-Am: so you can create services and endpoints, but not users? | 15:55 |
| Sam-I-Am | if i try to use /v2.0 with os_identity_api_version=3, i can create users but not endpoints/services | 15:55 |
| *** BAKfr has joined #openstack-keystone | 15:55 | |
| Sam-I-Am | yeah | 15:55 |
| *** fhubik has quit IRC | 15:55 | |
| dstanek | Sam-I-Am: do you have any debug logging going on to see what is happening? ideally from both the server and client | 15:56 |
| Sam-I-Am | dstanek: sure, hold on | 15:56 |
| *** aix has quit IRC | 15:57 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Move response status check to the call https://review.openstack.org/227883 | 15:57 |
| Sam-I-Am | dstanek: http://paste.openstack.org/show/q5vVpZ9FbnSYdCwgMpub/ | 15:58 |
| Sam-I-Am | thats the client debug output | 15:58 |
| *** mylu has joined #openstack-keystone | 15:59 | |
| *** nisha_ has joined #openstack-keystone | 15:59 | |
| dstanek | Sam-I-Am: almost seems as if it isn't really passing the token | 16:01 |
| Sam-I-Am | yeah | 16:01 |
| Sam-I-Am | lets look at the debug for service create... | 16:02 |
| *** david8hu has quit IRC | 16:02 | |
| Sam-I-Am | dstanek: http://paste.openstack.org/show/j8WOUOTeBQkwz1cGhz9f/ | 16:03 |
| *** lhcheng has joined #openstack-keystone | 16:03 | |
| *** ChanServ sets mode: +v lhcheng | 16:03 | |
| *** diazjf has quit IRC | 16:04 | |
| *** geoffarn_ has quit IRC | 16:04 | |
| *** diazjf has joined #openstack-keystone | 16:04 | |
| stevemar | dims_: hmmm? | 16:04 |
| *** marzif has quit IRC | 16:04 | |
| *** geoffarnold has joined #openstack-keystone | 16:04 | |
| *** tonytan4ever has joined #openstack-keystone | 16:06 | |
| stevemar | dims_: okay, is this needed for liberty? | 16:06 |
| *** dims_ has quit IRC | 16:06 | |
| stevemar | or are you just asking for a ksc refresh for M? | 16:06 |
| Sam-I-Am | dstanek: http://paste.openstack.org/show/JwEwKKXcYaiCAf9DKPsG/ | 16:07 |
| Sam-I-Am | dstanek: thats keystone server debug | 16:07 |
| *** mylu has quit IRC | 16:07 | |
| *** jlvillal has joined #openstack-keystone | 16:10 | |
| *** raildo is now known as raildo-afk | 16:14 | |
| *** phalmos has joined #openstack-keystone | 16:14 | |
| *** gyee has joined #openstack-keystone | 16:22 | |
| *** ChanServ sets mode: +v gyee | 16:22 | |
| *** sweetjeebus has joined #openstack-keystone | 16:23 | |
| sweetjeebus | Hi all | 16:23 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Documentation for other services https://review.openstack.org/204801 | 16:23 |
| dstanek | Sam-I-Am: hmmm...are you providing a domain_id for the user you want to create? | 16:23 |
| sweetjeebus | I was sent here by one Mr. Kingshott to speak with #mdrnstrm, but I don't see him online | 16:24 |
| sweetjeebus | Maybe some of you have experience with my questions, though? Upgrading keystone. | 16:25 |
| *** ankita_wagh has joined #openstack-keystone | 16:25 | |
| *** geoffarnold has quit IRC | 16:25 | |
| dstanek | sweetjeebus: he's morgan in IRC | 16:25 |
| sweetjeebus | Hey, cool. Thanks | 16:25 |
| Sam-I-Am | dstanek: no | 16:25 |
| *** ankita_wagh has quit IRC | 16:25 | |
| *** geoffarnold has joined #openstack-keystone | 16:25 | |
| dstanek | sweetjeebus: you should just ask your question and if somebody knows hopefully they'll respond | 16:26 |
| Sam-I-Am | lemmie try that | 16:26 |
| sweetjeebus | @morgan, are you here? | 16:26 |
| dstanek | sweetjeebus: not everyone's in the same timezone so you may have to wait a bit depending on the question | 16:26 |
| *** ankita_wagh has joined #openstack-keystone | 16:26 | |
| sweetjeebus | yeah, I understand | 16:26 |
| sweetjeebus | So... maybe someone can answer this. I'm wondering about backwards compatibility of keystone client to keystone-db. If I'm currently running icehouse, can I upgrade the keystone-cluster to kilo and expect it to work without upgrading the db yet (for uptime purposes, I want to get my keystone servers upgraded and leave the db running). | 16:28 |
| sweetjeebus | sorry, I said 'keystone client', but I mean 'keystone server' | 16:29 |
| Sam-I-Am | dstanek: --os-domain-name or other? | 16:29 |
| Sam-I-Am | dstanek: the docs are terribad | 16:29 |
| Sam-I-Am | as in, nonexistant as to the variants of domain name | 16:29 |
| *** raildo-afk is now known as raildo | 16:30 | |
| *** doug-fi__ is now known as doug-fish | 16:30 | |
| sweetjeebus | I'm about to try this upgrade, but I figured I'd ask about peoples' experience first. | 16:30 |
| dstanek | Sam-I-Am: i think it's --domain, but i'd have to go look | 16:30 |
| dstanek | sweetjeebus: my guess is no, since we don't to anything to make sure new code works with old schema | 16:31 |
| Sam-I-Am | dstanek: it doesnt understand --domain | 16:31 |
| Sam-I-Am | dstanek: so far all combinations return a 401 | 16:31 |
| sweetjeebus | ha. That's about what I expected | 16:31 |
| sweetjeebus | +dstanek: thanks. I'll update you with the results of any testing I perform. | 16:32 |
| dstanek | Sam-I-Am: hmm... i would have guessed 'openstack user create dstanek --password secrete --domain default' to work is the OS_TOKEN is set | 16:32 |
| dstanek | s/is the/if the/ | 16:32 |
| Sam-I-Am | it does not | 16:33 |
| *** dims_ has joined #openstack-keystone | 16:33 | |
| *** su_zhang has joined #openstack-keystone | 16:33 | |
| Sam-I-Am | also, they moved the username to the end of the argument list :/ | 16:34 |
| Sam-I-Am | but thats not the problem here | 16:34 |
| dstanek | what's the server log look like since you specified the domain? | 16:34 |
| *** stevemar has quit IRC | 16:35 | |
| Sam-I-Am | well, --domain is not a valid switch, so we need to figure out which variant to use | 16:35 |
| Sam-I-Am | i thought os_default_domain, but that defaults to 'default' which is there already | 16:35 |
| dstanek | what version of openstack client are you using? | 16:35 |
| Sam-I-Am | 1.7 | 16:35 |
| Sam-I-Am | which iirc is the latest tag | 16:36 |
| *** henrynash has joined #openstack-keystone | 16:38 | |
| *** ChanServ sets mode: +v henrynash | 16:38 | |
| openstackgerrit | Tony Wang proposed openstack/keystone: Show v3 endpoints in v2 endpoint list https://review.openstack.org/215870 | 16:39 |
| Sam-I-Am | dstanek: http://paste.openstack.org/show/Z9NSXopYgYoIM1txbMcN/ | 16:40 |
| Sam-I-Am | dstanek: that includes the command i used with all possible domain flags set | 16:40 |
| *** _cjones_ has joined #openstack-keystone | 16:42 | |
| *** _cjones_ has quit IRC | 16:42 | |
| *** _cjones_ has joined #openstack-keystone | 16:42 | |
| odyssey4me | Sam-I-Am do you perhaps have any OS_ env vars set? | 16:43 |
| odyssey4me | as I recall there are known conflicts | 16:43 |
| *** nicodemos has joined #openstack-keystone | 16:43 | |
| openstackgerrit | Merged openstack/keystoneauth: Fix doc session example https://review.openstack.org/226262 | 16:44 |
| *** lsmola has quit IRC | 16:44 | |
| dstanek | Sam-I-Am: hmm...that's strange - this is what i was remembering when i gave you that command http://git.openstack.org/cgit/openstack-dev/devstack/tree/functions-common#n773 | 16:44 |
| dstanek | Sam-I-Am: that's how devstack sets it up (i think with OS_TOKEN) | 16:45 |
| dstanek | Sam-I-Am: i dig deeper and see if i can reproduce | 16:45 |
| Sam-I-Am | hmm | 16:46 |
| dstanek | Sam-I-Am: ok, got a new devstack setup so i can try this out | 16:48 |
| Sam-I-Am | dstanek: thats interesting... putting '--domain default' at the end seems to work | 16:49 |
| Sam-I-Am | dstanek: yet '--domain' is not documented anywhere | 16:49 |
| Sam-I-Am | including the help | 16:49 |
| dstanek | Sam-I-Am: if it was documented then it would be easy. why would we want that? | 16:50 |
| *** devlaps has joined #openstack-keystone | 16:50 | |
| dstanek | Sam-I-Am: maybe it has to be after the --os-* stuff | 16:50 |
| Sam-I-Am | dstanek: i am using env vars for the OS_ stuff | 16:51 |
| Sam-I-Am | so my command is just user create blah --password blah --domain default | 16:51 |
| Sam-I-Am | i wonder why --domain is not documented | 16:51 |
| *** harlowja has quit IRC | 16:52 | |
| Sam-I-Am | dstanek: well, at least we figured out how to make it work | 16:53 |
| Sam-I-Am | not sure why passing env or --os-* arguments dont work in this specific case (they do once keystone is bootstrapped) | 16:53 |
| *** flaper87 has quit IRC | 16:55 | |
| *** flaper87 has joined #openstack-keystone | 16:55 | |
| *** phalmos has quit IRC | 16:55 | |
| Sam-I-Am | dstanek: time to try walking through all of the other bootstrapping steps to see anything else breaks | 16:56 |
| *** henrynash has quit IRC | 17:01 | |
| *** roxanagh_ has quit IRC | 17:04 | |
| *** geoffarnold has quit IRC | 17:06 | |
| *** geoffarnold has joined #openstack-keystone | 17:07 | |
| *** stevemar has joined #openstack-keystone | 17:07 | |
| *** ChanServ sets mode: +o stevemar | 17:07 | |
| *** ankita_wagh has quit IRC | 17:11 | |
| *** e0ne has quit IRC | 17:14 | |
| *** LukeHinds has quit IRC | 17:15 | |
| *** aix has joined #openstack-keystone | 17:19 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Create tests for set_default_is_domain in LDAP https://review.openstack.org/229536 | 17:20 |
| *** jsavak has quit IRC | 17:23 | |
| *** jsavak has joined #openstack-keystone | 17:24 | |
| *** stevemar has quit IRC | 17:24 | |
| *** roxanagh_ has joined #openstack-keystone | 17:26 | |
| *** stevemar has joined #openstack-keystone | 17:26 | |
| *** ChanServ sets mode: +o stevemar | 17:26 | |
| *** ankita_wagh has joined #openstack-keystone | 17:27 | |
| *** jsavak has quit IRC | 17:28 | |
| *** geoffarn_ has joined #openstack-keystone | 17:28 | |
| *** geoffarnold has quit IRC | 17:28 | |
| *** roxanag__ has joined #openstack-keystone | 17:28 | |
| *** jsavak has joined #openstack-keystone | 17:29 | |
| *** roxanagh_ has quit IRC | 17:29 | |
| stevemar | dolphm: ayoung add a name to trusts? oui ou non? | 17:30 |
| stevemar | i'm thinking it shouldn't be bad because we don't need to domain scope them | 17:31 |
| openstackgerrit | Merged openstack/keystone: Update bandit blacklist_calls config https://review.openstack.org/225327 | 17:31 |
| ayoung | stevemar, nope | 17:32 |
| stevemar | ayoung: esplain! | 17:32 |
| ayoung | stevemar, there is so much more we should do on the delegation front, lets focus on the real issue | 17:32 |
| ayoung | stevemar, see amakarov 's unified delegation spec | 17:32 |
| ayoung | stevemar, " don't need to domain scope" does not make sense...what do you mean by that? | 17:33 |
| stevemar | ayoung: sorry, i picked a poor time for this conversation | 17:33 |
| ayoung | there is no good time as PTL | 17:33 |
| stevemar | i might have to run away for an hour | 17:34 |
| stevemar | meh | 17:34 |
| ayoung | stevemar, https://review.openstack.org/#/c/189816/ read that first | 17:34 |
| stevemar | ayoung: so, i figured trusts could be named, and the names could be globally unique, like roles | 17:34 |
| ayoung | and then we can discuss | 17:34 |
| ayoung | stevemar, you mean something like a trust named "all_users_trust_nova_to_fetch_images" | 17:35 |
| ayoung | like, use the name as a template? | 17:35 |
| stevemar | ayoung: yes, when creating trust it should have a name field, the name can be "all_users_trust_nova_to..." | 17:36 |
| *** diazjf has quit IRC | 17:36 | |
| stevemar | apparently it's important for puppet, they are unable to do stuff and things without it very nicely | 17:37 |
| stevemar | https://bugs.launchpad.net/keystone/+bug/1475091 | 17:37 |
| openstack | Launchpad bug 1475091 in Keystone "Missing name field for trusts" [Wishlist,Won't fix] | 17:37 |
| ayoung | stevemar, So instead of using a trust_id to execure the trust by id they need a name? | 17:37 |
| ayoung | stevemar, ah...this | 17:37 |
| ayoung | yeah, tell themn to stuff it | 17:37 |
| stevemar | ayoung: that's not diplomatic :) | 17:38 |
| ayoung | I cannot flippuing stand puppet | 17:38 |
| ayoung | its like in another languaege or something | 17:38 |
| openstackgerrit | Merged openstack/keystone: Fix order of arguments in assertDictEqual https://review.openstack.org/229421 | 17:38 |
| ayoung | nah...I understand the concern: they don;'t want to have to read a value off of Keystone after they create somethign in order to be able to use it...its the same deal as endpoint ids | 17:39 |
| *** roxanag__ has quit IRC | 17:39 | |
| *** ngupta has quit IRC | 17:39 | |
| ayoung | stevemar, and if there is a trust already created with that name? Puppet is hosed | 17:40 |
| ayoung | then they will want namespaces for trusts | 17:40 |
| ayoung | we can do all that crap | 17:40 |
| *** ngupta has joined #openstack-keystone | 17:41 | |
| amakarov | ayoung, about delegations: do you have any suggestion how to handle hierarchical projects (and roles)? | 17:45 |
| *** nisha__ has joined #openstack-keystone | 17:45 | |
| amakarov | ayoung, Does it mean, that having role delegated on root project gives that role on the leaf project? | 17:46 |
| bknudson | morgan: do you know if dogpile.cache supports atomic operations (like memcache has incr for ints). | 17:46 |
| *** nisha__ has quit IRC | 17:46 | |
| ayoung | amakarov, that should be based on the same rules as HMT already proscribes. One reason I called my thing implied rulesinstead of hierarchical was to avoid a naming clash there | 17:47 |
| bknudson | I'm looking at the nova review to switch to oslo.cache -- https://review.openstack.org/#/c/203049/24/nova/api/ec2/__init__.py | 17:47 |
| *** nisha__ has joined #openstack-keystone | 17:47 | |
| raildo | amakarov, we handle with this using inherited roles... this is not enough for this delegate issue? | 17:47 |
| ayoung | amakarov, so, the role assignment is either for the project specified , the child nodes, or both | 17:47 |
| ayoung | raildo, is ^^ strictly speaking correct? | 17:47 |
| dolphm | lbragstad: have a link to your tempest patch? | 17:48 |
| *** nisha_ has quit IRC | 17:48 | |
| amakarov | ayoung, this information supposed to be in the delegation, right? | 17:48 |
| lbragstad | dolphm: which patch? | 17:48 |
| raildo | ayoung, you're right | 17:49 |
| *** geoffarn_ has quit IRC | 17:49 | |
| *** nisha__ has quit IRC | 17:49 | |
| *** geoffarnold has joined #openstack-keystone | 17:49 | |
| amakarov | raildo, please see https://review.openstack.org/#/c/198418/ - does it fit for HMT? | 17:49 |
| *** nisha_ has joined #openstack-keystone | 17:50 | |
| raildo | amakarov, looking | 17:50 |
| ayoung | amakarov, it should work for HTM role assignments. | 17:50 |
| ayoung | HMT | 17:50 |
| amakarov | raildo, ayoung I need to know if I can rely on this structure in delegations | 17:50 |
| *** roxanagh_ has joined #openstack-keystone | 17:51 | |
| ayoung | amakarov, projects are strictly hierarchical. Your materialed path approach should uniquely identify the path. Plus, the hierarchy is pretty rigid: we don't allow moving projects around, so simpler case than you have addressed | 17:51 |
| lbragstad | dolphm: there is this, but it's already merged - https://review.openstack.org/#/c/220272/1 | 17:53 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add test case passing is_domain flag as False https://review.openstack.org/229549 | 17:53 |
| *** syin has joined #openstack-keystone | 17:53 | |
| *** diazjf has joined #openstack-keystone | 17:53 | |
| amakarov | ayoung, I still haven't reviewed implied roles, are you implementing a network of roles? | 17:55 |
| dolphm | lbragstad: so should this pass without a depends-on? https://review.openstack.org/#/c/195780/ | 17:55 |
| ayoung | amakarov, yes | 17:56 |
| lbragstad | dolphm: i'm not sure if it will pass, | 17:56 |
| raildo | amakarov, I think that I understand what ayoung are trying to say.... your solution are correct, but since we prohibit any updates in the hierarchy we can make this patch simpler... | 17:56 |
| ayoung | dolphm, did you see the spec I posted on Catalog Scoped roles? I tried to extrapolate from what you had said in a previous conversation | 17:56 |
| lbragstad | dolphm: there is nothing proposed to keystone that will correct the issues exposed by your testing patch. There also isn't anything proposed to tempest for waits | 17:57 |
| amakarov | ayoung, how do you suggest to traverse roles? Recursion? | 17:57 |
| ayoung | https://review.openstack.org/#/c/228477/ dolphm when you get a chance | 17:57 |
| *** stevemar has quit IRC | 17:57 | |
| dolphm | ayoung: i havent reviewed specs in a while | 17:57 |
| ayoung | amakarov, sort of | 17:57 |
| *** stevemar has joined #openstack-keystone | 17:57 | |
| *** ChanServ sets mode: +o stevemar | 17:57 | |
| ayoung | dolphm, we discussed the "project was deleted, resource is still around" issue and you said it felt like it should be a service admin's job to fix that | 17:58 |
| amakarov | raildo, it's a textbook tree implementation, actually :) It can be considered atomic | 17:58 |
| dolphm | ayoung: no, i said it should be the service's job to listen for notifications | 17:59 |
| ayoung | dolphm, you said both. | 17:59 |
| ayoung | dolphm, there was the fact that we cannot guarantee deliver of the notifications. THis was the backup for that | 17:59 |
| dstanek | ayoung: dolphm: this is why ESBs were invented | 18:00 |
| *** doug-fis_ has joined #openstack-keystone | 18:00 | |
| dolphm | ++ considering services arent listening today, there's not a problem to solve. but when there is, fix the message bus. | 18:01 |
| ayoung | dstanek, yeah, and we should pursue that as well, but we'll have an ice age here before all of the project get notifications handled correctly. We are talking guaranteed delivery to a topic to all listeners, and that is just .... | 18:01 |
| *** stevemar has quit IRC | 18:01 | |
| dolphm | ayoung: and you think they'll implement the "backup" solution first? | 18:02 |
| ayoung | dolphm, but this addresses a wider array of issues anyway. For example, the Nova call to add a hypervisor is not scoped to a project | 18:02 |
| ayoung | dolphm, I think modifying policy is simpler than implementing a message listener | 18:02 |
| dolphm | tenant-less service-scoped tokens has a bp | 18:02 |
| ayoung | dolphm, so, this is the role-assignment piece to support that. | 18:04 |
| *** doug-fish has quit IRC | 18:04 | |
| *** doug-fis_ has quit IRC | 18:04 | |
| dolphm | lol | 18:05 |
| ayoung | dolphm, you know what it is called? I'm not going to continue this if it is at cross purposes with another effort. I'd rather see else is being proposed. | 18:08 |
| dolphm | i think we agree that it's a pain for tokens to explicitly convey authorization, but i'm not a fan of adding way more complexity as a solution | 18:09 |
| *** geoffarnold has quit IRC | 18:10 | |
| *** geoffarnold has joined #openstack-keystone | 18:11 | |
| ayoung | dolphm, who's idea was it to have roles scoped to projects in the first place? | 18:12 |
| *** harlowja has joined #openstack-keystone | 18:13 | |
| *** e0ne has joined #openstack-keystone | 18:13 | |
| *** doug-fish has joined #openstack-keystone | 18:13 | |
| *** su_zhang has quit IRC | 18:15 | |
| dolphm | ayoung: i think that part makes sense - but it's the tokens scoped to a project that introduces all sorts of problems | 18:15 |
| dolphm | if tokens only conveyed identity and the user was free to authenticate themselves in the context of any project, then it'd be up to keystone to provide the authorization in that context, if any | 18:16 |
| *** openstackgerrit has quit IRC | 18:16 | |
| dolphm | so identity + tenant ID in the URL would suddenly make sense | 18:16 |
| dolphm | or identity + like an X-Project header of some kind specified by the client | 18:17 |
| *** openstackgerrit has joined #openstack-keystone | 18:17 | |
| ayoung | dolphm, if that were the case, we really wouldn't need tokens, either. They would be optional for people that didn't want, say SAML | 18:17 |
| ayoung | or some other stnadard authentication mechanism | 18:17 |
| dolphm | right, saml would work too, it'd just be a very heavy as a general solution | 18:17 |
| ayoung | dolphm, you could always do password direct to Nova for an all-in-one deployment, the smaller side. | 18:18 |
| *** phalmos has joined #openstack-keystone | 18:18 | |
| dolphm | i'd rather move towards signature based requests than sending passwords in headers, but sure lol | 18:19 |
| ayoung | Kerberos or X509 for the enterprise. Tokens make sense for a very specific type of deployment | 18:19 |
| ayoung | dolphm, signature based would work for CLI | 18:19 |
| dolphm | ? it works for http requests regardless of the interface or agent | 18:19 |
| ayoung | not certain what the Horizon story would be there, but I guess Horizon could sign for the users. | 18:19 |
| ayoung | Browser based crypto is ... uneven | 18:20 |
| ayoung | dolphm, I'd love it if we could build something base on code signing from the Browser. Do you think it is a reality? | 18:20 |
| dstanek | ayoung: that would mean the browser would be crafting the request to the backend services, right? why would you want that? | 18:21 |
| ayoung | dstanek, authentication. If My private key signed the message, it came from me. Period | 18:22 |
| dolphm | dstanek: that's what reach does | 18:22 |
| dolphm | dstanek: it's also the model most modern web apps use, including, say, facebook | 18:22 |
| dstanek | dolphm: so when i'm in reach it's actually formulating the http calls and signing them? | 18:23 |
| *** e0ne has quit IRC | 18:23 | |
| ayoung | what is reach? | 18:23 |
| dolphm | ayoung: rackspace public cloud's version of horizon, which predates horizon | 18:24 |
| dolphm | dstanek: not signing, but yes | 18:25 |
| ayoung | we can do client certs today. Its not quite the same as a signed request, as the crypto is done in channel. It means that if I call nova boot, Nova can authenticate me, but the call from nova to glance is unauthenticated. If GLance trusts nova, this is probably OK, so long as we could have nova make the call also using a client cert, and glancewas told "Nova can impersonatye people for fetching images" | 18:26 |
| dstanek | hmm....i can't seem to find any API urls, only seems to build proxy urls | 18:26 |
| *** roxanagh_ has quit IRC | 18:26 | |
| ayoung | I know Mozilla was working on a broader set of Crypo tools, but I don't see them, | 18:26 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Deprecate httpd/keystone.py https://review.openstack.org/221975 | 18:26 |
| ayoung | https://developer.mozilla.org/en-US/docs/Archive/Security/Introduction_to_Public-Key_Cryptography | 18:26 |
| ayoung | Wow that is bright | 18:27 |
| dolphm | ayoung: there aren't many examples of request signing in javascript... but i found this one https://opensocial.atlassian.net/wiki/display/OSREF/Introduction+To+Signed+Requests | 18:27 |
| ayoung | dolphm, be careful...there are some JS based signing libraries out there, but they are doing centralized key management...which is not secure | 18:27 |
| ayoung | Its not a language thing so much as it needs to come from the users platform. | 18:28 |
| dolphm | ayoung: what does centralized key management have to do with the security of a javscript library? | 18:28 |
| dstanek | fun fact about signing or any encryption in the browser. you have to have you key in browser memory and would be open to the types of cross tab attacks that have been done in the past. | 18:28 |
| *** roxanagh_ has joined #openstack-keystone | 18:29 | |
| ayoung | dolphm, private key should not leave the users control. Its very hackable... there is a pretty famous esssay about it...let me see if I can find it | 18:29 |
| dolphm | dstanek: how's that different from cookies, session IDs, etc? | 18:29 |
| dstanek | mozilla fixed their stuff and theoretically chromes architecture prevents the attack, but i don't trust browsers anymore | 18:29 |
| *** e0ne has joined #openstack-keystone | 18:29 | |
| ayoung | I think this is it ... https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/ | 18:30 |
| dstanek | dolphm: it's not. it that now your private key is compromised and not a session key or transient data | 18:30 |
| *** aix has quit IRC | 18:30 | |
| morgan | bknudson: atomic in what context? | 18:31 |
| dolphm | http://alexbilbie.com/2014/11/oauth-and-javascript/ | 18:31 |
| dolphm | dstanek: would the solution be to make them transient then? | 18:31 |
| bknudson | morgan: as in memcache's compare-and-swap http://neopythonic.blogspot.com/2011/08/compare-and-set-in-memcache.html | 18:32 |
| *** geoffarnold has quit IRC | 18:32 | |
| *** geoffarn_ has joined #openstack-keystone | 18:32 | |
| bknudson | test-and-set ... whatever you want to call it | 18:32 |
| morgan | Not in the same way. Dogpile doesnt support cas. | 18:32 |
| *** roxanagh_ has quit IRC | 18:32 | |
| dstanek | dolphm: you could. lots or security protocols rely on keys that are only supposed to last for a session | 18:32 |
| bknudson | mmm. cookies. | 18:33 |
| morgan | It does locking to get around that. CAS is wierd in memcache and not universal for kvs | 18:33 |
| *** roxanagh_ has joined #openstack-keystone | 18:34 | |
| ayoung | dolphm, so, lets assume browser based signing is out for the moment. That might not be such a huge deal. The only problem they really solve is multi-hop. And even then...its really kind of wonky, because glance would have to be able to read a nova-boot request and say "ah yes, that nova can grab that image by ID" | 18:36 |
| ayoung | so, tokens are a poor but light weight proxy for authentication | 18:36 |
| ayoung | if we were to reduce them to just that, then the question still reamains: if a user is requesting an action, are they authorized | 18:37 |
| ayoung | If that is an endpoint scoped action, should the authorization be on the endpoint, and not on some random project? Or, should we make all endpoints be owned by some project, and make them know about their project iD? I'm OK with either approach...I've suggested both at various times | 18:38 |
| dolphm | i don't know about the solution, but it's hard to address the problem at all without strictly defining authorization boundaries | 18:41 |
| *** jaosorior has quit IRC | 18:42 | |
| *** wwwjfy has quit IRC | 18:42 | |
| *** wwwjfy has joined #openstack-keystone | 18:43 | |
| *** su_zhang has joined #openstack-keystone | 18:45 | |
| *** dims_ has quit IRC | 18:46 | |
| *** openstackgerrit has quit IRC | 18:46 | |
| *** lhcheng_ has joined #openstack-keystone | 18:46 | |
| *** aix has joined #openstack-keystone | 18:46 | |
| *** dims_ has joined #openstack-keystone | 18:46 | |
| *** openstackgerrit has joined #openstack-keystone | 18:47 | |
| *** lhcheng has quit IRC | 18:48 | |
| dolphm | ayoung: the simplest case is all services trusting each other regardless of tenancy, right? for example, i only trust nova to make these 3 calls, and not this 4th one, but i never care about which tenant nova wants to work with | 18:48 |
| ayoung | dolphm, right. | 18:49 |
| ayoung | nova can fetch any image it wants, but should never ask to store one... | 18:49 |
| ayoung | it can create a snapshot, though | 18:49 |
| *** ayoung is now known as ayoung-meeting | 18:51 | |
| dolphm | sure | 18:51 |
| *** doug-fish has quit IRC | 18:52 | |
| *** doug-fish has joined #openstack-keystone | 18:52 | |
| *** tonytan4ever has quit IRC | 18:54 | |
| *** aix has quit IRC | 18:55 | |
| *** tonytan4ever has joined #openstack-keystone | 18:55 | |
| *** david-lyle has quit IRC | 18:55 | |
| *** david-lyle has joined #openstack-keystone | 18:55 | |
| *** ankita_wagh has quit IRC | 18:56 | |
| dolphm | ayoung-meeting: in that case, is there a simpler solution than https w/ client authentication? policy checks would have to be reduced to "is the client nova? if so, allow" (completely ignoring tenancy) | 18:57 |
| ayoung-meeting | dolphm, probably. Its the service token thing, right? | 18:58 |
| *** henrynash has joined #openstack-keystone | 18:58 | |
| *** ChanServ sets mode: +v henrynash | 18:58 | |
| dolphm | i'm not considering tokens as an option unless they solve a problem that we can't solve otherwise | 18:58 |
| ayoung-meeting | any API can, potentially take a service token. If the service token says it is ok, then ... still need a RBAC check on the user its doing it for | 18:59 |
| ayoung-meeting | dolphm, it could be basic-auth, so long as the password is shared only between nova and glance | 18:59 |
| *** ankita_wagh has joined #openstack-keystone | 18:59 | |
| ayoung-meeting | there are multiple ways: all that could be done on a private interface without authentication, access to the network is authentication enough | 19:00 |
| ayoung-meeting | I mean, I don;t love that as a solution, but it was done for years | 19:00 |
| *** su_zhang has quit IRC | 19:01 | |
| dolphm | i don't think network access is sufficient in 2015 :) | 19:02 |
| dolphm | ayoung-meeting: but basic auth is a good counter example. upside: you could default the password to secrete :) the downsides: no request integrity verification, no strong client authentication. | 19:02 |
| dolphm | it'd be an insecure default to have enabled if you really want people to switch to something stronger | 19:03 |
| *** mylu has joined #openstack-keystone | 19:03 | |
| dolphm | so beyond devstack, you're going to want https anyway | 19:04 |
| morgan | dolphm: basic auth or client-certs would be a good option | 19:05 |
| morgan | For "is this nova" | 19:05 |
| morgan | For example. | 19:05 |
| dolphm | ayoung-meeting: familiar with this one? i think it's new to me http://tools.ietf.org/html/rfc4279 | 19:05 |
| ayoung-meeting | or SPNEGO for those that prefer Kerberos. Once Barbican is deployed by defaulty, Client certs becomes lighter weight to | 19:05 |
| ayoung-meeting | dolphm, heh, that was KDS | 19:06 |
| ayoung-meeting | Kite | 19:06 |
| ayoung-meeting | Not 100% BUT roughly | 19:06 |
| dolphm | ha | 19:06 |
| dolphm | it seems like this is trying to avoid the need for additional complexity like kite, as a compromise between performance vs security? | 19:08 |
| dolphm | and compexlity | 19:08 |
| dolphm | (i'm not sure how that l migrated over so far) | 19:08 |
| syin | Hi, wondering if this is the right place for my question. I'm looking at domain support in Neutron. In Keystone, we have policy.v3cloudsample.json which have checks like "(domain_id:%(domain_id)s". But I don't see a similar policy.json in Neutron. How do I go about supporting domains in Neutron? Is there a domain-enabled version of policy.json like in Keystone? | 19:10 |
| syin | Also when I was tracing the code in Neutron, it looks like during policy check, the credentials of the user/requester doesn't even have domain_id in the dictionary. | 19:11 |
| syin | I'm looking at Kilo | 19:11 |
| dolphm | syin: just curious, what's the use case for domain-level operations in neutron? | 19:12 |
| dolphm | syin: domain-level quota management or something? | 19:12 |
| syin | So in the rest of the system, we have domain support so there are a different set of users/projects for each domain | 19:13 |
| dolphm | syin: but what is neutron's use case for caring about domain-level operations? | 19:13 |
| *** geoffarn_ has quit IRC | 19:14 | |
| syin | but when it comes to Neutron, I find that an admin in project1 of domain1 would be able to see networks from domain2, because the Neutron policy only checks for role:admin, which the admin has for project1 | 19:14 |
| *** phalmos has quit IRC | 19:14 | |
| *** geoffarnold has joined #openstack-keystone | 19:14 | |
| syin | so basically i thought the Neutron policy should be domain-aware so that it doesn't "leak" networks across different domains | 19:14 |
| *** kiran-r has quit IRC | 19:15 | |
| dolphm | syin: well, it needs to respect roles per project, first, right? "admin" in openstack generally ignores tenancy, unfortunately. | 19:15 |
| *** phalmos has joined #openstack-keystone | 19:15 | |
| syin | exactly. for example, i want to have dom1 and dom2 for say 2 different organizations. within each org, they have their own users and projects, along with their own admins. | 19:16 |
| syin | now obviously it'd be bad that an admin from org one using domain1 suddenly starts seeing networks from domain2. | 19:16 |
| syin | if you look at the current neutron policy.json, there are a lot of checks for rule:admin_only, which translate to role:admin without checking the context (ie. admin of which project, or admin of which domain) | 19:17 |
| *** _cjones_ has quit IRC | 19:17 | |
| *** GB21 has quit IRC | 19:18 | |
| lbragstad | lifeless: do you now if there is a way to get around https://bugs.launchpad.net/pbr/+bug/1374677 without setting PBR_VERSION and using pip install -e . ? | 19:19 |
| openstack | Launchpad bug 1374677 in PBR "setup.py with pbr attempts to do git operations in tarball" [Medium,Confirmed] | 19:19 |
| dolphm | syin: so the two obvious (?) solutions to that problem are either to not assign the "admin" role to anyone should not be root of openstack, or to re-write neutron's policy file to require the "admin" role *and* a matching tenancy | 19:19 |
| dolphm | syin: so, *always* require a matching authz context | 19:20 |
| lbragstad | s/now/know/ | 19:20 |
| lifeless | lbragstad: I hadn't seen that bug. | 19:21 |
| lifeless | lbragstad: it shouldn't happen at all | 19:21 |
| lbragstad | lifeless: interesting | 19:21 |
| amakarov | ayoung-meeting, DAG lgtm, albeit I'd like to understand more clear, how we are supposed to work with them | 19:21 |
| lbragstad | lifeless: I was just curious, because I don't think pbr is supporting the use of python setup.py, right? | 19:21 |
| *** david-lyle has quit IRC | 19:22 | |
| lifeless | lbragstad: ayoung-meeting is wrong IMO - pbr doesn't conflict with rpm versioning (we've explicitly got behaviours there to support distros) | 19:22 |
| syin | dolphm: thanks for the suggestions. 1) isn't going to work because each organization really needs their own admins, but these are project-level and domain-level admins, not root openstack admins. currently there is no way to distinguish what kind of admins they are when validating policies. | 19:22 |
| lbragstad | lifeless: ok, so given that, I have a question | 19:22 |
| *** david-lyle has joined #openstack-keystone | 19:22 | |
| lifeless | lbragstad: so for end users running 'python setup.py' is nearly always the wrong thing because it triggers easy_install (which is nothing to do with pbr) | 19:23 |
| ayoung-meeting | syin, don't call em admins | 19:23 |
| *** tonytan4ever has quit IRC | 19:23 | |
| dolphm | syin: and it's the policy file not checking context that essentially makes an "admin" into "root" | 19:23 |
| ayoung-meeting | call them managers and make a new role | 19:23 |
| syin | 2) that's actually what i've done now - with a context_is_admin being changed to role:admin and tenant_id:%(tenant_id)s | 19:23 |
| lifeless | lbragstad: at a plumbing level we'll definitely support what rpm and dpkg etc need | 19:23 |
| lbragstad | lifeless: ah, makes sense, which is why you recommend using pip install -e with pbr | 19:23 |
| ayoung-meeting | add a policy check for the manager role | 19:23 |
| *** su_zhang has joined #openstack-keystone | 19:23 | |
| lifeless | lbragstad: the -e gets you 'develop', without -e it gets you 'install', but without as much room for easy-install to creep in | 19:24 |
| lbragstad | lifeless: because pip doesn't invoke easy_install | 19:24 |
| lifeless | lbragstad: just be sure you install pbr (which as a build-time dep pip doesn't handle yet) by hand first | 19:24 |
| lifeless | yah | 19:24 |
| lifeless | lbragstad: so you're seeing the same behaviour as in that bug ? | 19:24 |
| lbragstad | lifeless: yes, something similar but i believe my situation is different | 19:25 |
| lbragstad | lifeless: say i have a project that depends on an upstream project, and in my project's requirements.txt i have a link to the upstream git url, so a tarball | 19:25 |
| lifeless | lbragstad: don't do that :)( | 19:26 |
| lbragstad | lifeless: ok :) | 19:26 |
| *** stevemar has joined #openstack-keystone | 19:26 | |
| *** ChanServ sets mode: +o stevemar | 19:26 | |
| syin | dolphm: however that's not the best solution (or at least it requires a lot of changes), because there are a lot of references to rule:admin_only, and if the target object does not have a tenant_id, there will be an exception due to the Neutron custom OwnerCheck(), which tries to look up "tenant" object as a parent if it cannot find tenant_id in the target's dictionary. e.g. dhcp_agent is one such object. | 19:26 |
| lbragstad | lifeless: what should i do? | 19:26 |
| lifeless | lbragstad: so part of the problem here is that requirements.txt as pip defines it and pbr defines it differ | 19:26 |
| lifeless | lbragstad: (We're working on deprecated requirements.txt to fix this difference) | 19:26 |
| lifeless | lbragstad: pip install -r requirements.txt will resolve urls etc | 19:27 |
| dolphm | syin: that's the broader problem that ayoung-meeting and i were just discussing. there are lots of tenant-less operations in openstack and we don't have a great authorization model for those. nothing in policy is really sufficient today, so the super root "admin" junk fills that gap | 19:27 |
| syin | dolphm: yes the problem is that the default neutron policy.json basically treats anyone with an admin role as a super-root-admin type of user. and the other problem is during policy enforcement, the "creds" dictionary does not have any domain_id for the policy file to check with. | 19:27 |
| lifeless | lbragstad: python setup.py install triggers reflection from pbr to map requirements.txt into setup(install_requires="...") | 19:27 |
| lbragstad | lifeless: interesting | 19:27 |
| lifeless | lbragstad: but setuptools install_requires cannot handle urls | 19:27 |
| lifeless | lbragstad: (at all) | 19:28 |
| *** tonytan4ever has joined #openstack-keystone | 19:28 | |
| lifeless | lbragstad: so pbr has to strip out the urls and transforms them to just the package names | 19:28 |
| ayoung-meeting | syin, bug 968696 | 19:28 |
| openstack | bug 968696 in OpenStack Compute (nova) ""admin"-ness not properly scoped" [High,Confirmed] https://launchpad.net/bugs/968696 | 19:28 |
| ayoung-meeting | cinder claims they close it. Cinder lies | 19:28 |
| dolphm | syin: there will only be a domain ID if the API user is authenticating with a domain-scoped token | 19:28 |
| dolphm | syin: a project scoped token has no domain-level authorization | 19:29 |
| lifeless | lbragstad: this leads to developer confusion when the url version is not installed by 'pip install mypackage' and instead the version of the egginfo name from PyPI is installed | 19:29 |
| lifeless | lbragstad: the options are: | 19:29 |
| lbragstad | lifeless: yeah, i notice two different behaviors when I set version in my project's setup.cfg and when i set PBR_VERSION to something else | 19:30 |
| lifeless | - use pip install -r requirements.txt . # this will honour the urls (until we publish to PyPI) | 19:30 |
| lifeless | - use the name in requirements.txt and a constraints file to force the url version of the dep #makes it explicit that its a local choide | 19:30 |
| lifeless | lbragstad: PBR_VERSION just overrides the version | 19:31 |
| syin | dolphm: hmm, right. so basically if i want to allow my policy.json to check for domain_ids, i would have to add code somewhere before policy enforcement to "inject" the domain_id info? ie. receive API call, look up which domain_id the user or project belongs to, and append it to the "creds" dictionary. then I can compare domain_id in my policy.json file. | 19:31 |
| lifeless | lbragstad: version in setup.cfg sets a *target* version, not an actual version | 19:31 |
| lbragstad | lifeless: ah, ok... I thought that set the version of my package | 19:31 |
| *** amakarov is now known as amakarov_away | 19:33 | |
| nisha_ | hello everyone :D | 19:33 |
| *** jsavak has quit IRC | 19:33 | |
| nisha_ | I am a newbie and I want to contribute in keystone | 19:34 |
| lifeless | lbragstad: http://docs.openstack.org/developer/pbr/#version | 19:34 |
| nisha_ | samueldmq, helped me and found an easy bug for me | 19:34 |
| sweetjeebus | Hi y'all | 19:35 |
| *** david-lyle has quit IRC | 19:35 | |
| nisha_ | It involved replacing all occurences of of http://code.google.com/p/sqlalchemy-migrate/ by https://github.com/stackforge/sqlalchemy-migrate | 19:35 |
| lbragstad | lifeless: so when I had version set in my setup.cfg, and I installed my package, I saw the version listed as <version>-dev31 or something similar | 19:35 |
| lbragstad | lifeless: so that all makes sense | 19:35 |
| sweetjeebus | Anybody familiar with that 'UTF8' Bug? https://bugs.launchpad.net/keystone/+bug/1469029 ? | 19:35 |
| openstack | Launchpad bug 1469029 in Keystone "Migrations fail going from juno -> kilo" [High,Fix released] - Assigned to Morgan Fainberg (mdrnstm) | 19:35 |
| dolphm | syin: the auth_token middleware will pass down a domain ID if the user used a domain-scoped token | 19:35 |
| dolphm | syin: just because the user is owned by a domain should NOT imply that the user has any sort of authorization on that domain | 19:35 |
| *** jsavak has joined #openstack-keystone | 19:35 | |
| lifeless | lbragstad: yep | 19:36 |
| dolphm | syin: the same goes for the domain that owns the project. | 19:36 |
| dolphm | syin: those are exposed to services to namespace users and projects, not to provide some means of privilege escalation | 19:36 |
| sweetjeebus | for what its worth, I had a backup of my db at v55 | 19:36 |
| lifeless | lbragstad: generally these days I think noone should need version= in their setup.cfg, the git automatic semver should just do the right thing | 19:36 |
| sweetjeebus | and ran through it a few times | 19:36 |
| nisha_ | So, I did the changes and did git commit. But I have some problem in git review. http://paste.openstack.org/show/474921/ Can someone please help me? I would be really grateful :) | 19:36 |
| sweetjeebus | before importing the db dump, I ran: | 19:36 |
| sweetjeebus | alter table revocation_event convert to character set utf8 collate utf8_unicode_ci ; alter database keystone CHARACTER SET utf8 COLLATE utf8_unicode_ci; - after this, it works | 19:36 |
| lbragstad | lifeless: but when i had to install my requirements.txt (which contained a url to keystone's master tarball) I'd get something like - http://cdn.pasteraw.com/saj757pt746cbvg8a8s7zezvhjglnd2 | 19:36 |
| sweetjeebus | anyway, its an easy way around it for now | 19:37 |
| lbragstad | lifeless: so, then I set PBR_VERSION to something, and then both my project version and the version of keystone are the same as the PBR_VERSION | 19:37 |
| lifeless | lbragstad: oh, so yeah I know whats going on | 19:37 |
| lifeless | lbragstad: I think you've got two separate things confused | 19:37 |
| lbragstad | lifeless: probably :) | 19:37 |
| lifeless | lbragstad: that error is nothing to do with your project | 19:37 |
| lifeless | lbragstad: its because the git *exports* from github aren't usable | 19:37 |
| lifeless | lbragstad: they have no version data in them. Don't try to use them. | 19:38 |
| lifeless | lbragstad: If you want to use master from git, use a git url | 19:38 |
| lifeless | lbragstad: https://pip.pypa.io/en/latest/reference/pip_install/#vcs-support | 19:38 |
| lifeless | lbragstad: whats happening is that the tarball on github has no version data, so the pbr logic for *it* [not your project] fails | 19:39 |
| lbragstad | lifeless: ah, so put that in my requirements.txt and not - https://github.com/openstack/keystone/tarball/master#egg=keystone | 19:39 |
| lifeless | lbragstad: right | 19:39 |
| lifeless | lbragstad: don't alter your project at all :) | 19:39 |
| lbragstad | just alter my requirements | 19:39 |
| lifeless | lbragstad: that said, because of the aforementioned limitations on requirements reflection, don't put that in your requirements.txt either | 19:39 |
| lifeless | put 'keystone' in your requirements.txt | 19:40 |
| *** marzif has joined #openstack-keystone | 19:40 | |
| lifeless | and put the url in a new file 'constraints.txt' | 19:40 |
| lifeless | the pip install -c constraints.txt pathtoyourproject | 19:40 |
| lifeless | https://pip.pypa.io/en/latest/user_guide/#constraints-files | 19:41 |
| syin | @dolphm: so in my example, i have someone who is a project admin or a domain admin, who has the admin role for that particular project or domain, and I need to make sure s/he does not see networks from a different domain, the best way is just to match tenant_id of creds against tenant_id of the target (the network) (solution 2 above), and change all the rule:admin_only to use this new, more specific admin-checking rule. | 19:42 |
| lbragstad | lifeless: makes sense, so - http://cdn.pasteraw.com/qq01aidp62pwc6clcy5uiqx5z8t56un | 19:42 |
| ayoung-meeting | nisha_, here is better | 19:42 |
| syin | @dolphm: and then i just have to work out the cases when the target does not have tenent_id in its dictionary and make sure those use the old context_is_admin rule. | 19:42 |
| ayoung-meeting | nisha_, but I am debugging somethign at the moment | 19:43 |
| lbragstad | lifeless: then i should be able to install my project without exporting PBR_VERSION | 19:43 |
| lbragstad | and still retain my project's version defined in my setup.cfg | 19:43 |
| *** su_zhang has quit IRC | 19:44 | |
| syin | @dolphm: I wanted to check here if there is already an upstream solution for my issue that I'm not aware of. I'm kind of surprised that Neutron thinks anyone with admin role is admin across all projects/domains. | 19:44 |
| dolphm | syin: all projects make that assumption | 19:45 |
| dolphm | syin: neutron isn't the only one | 19:45 |
| syin | @dolphm: i thought keystone, for example, distinguishes between project and domain admins? eg. "role add --user user1 --project project1 admin" gives a different role than "role add --user user1 --domain dom1 admin" | 19:46 |
| dolphm | syin: it absolutely does, but when you use the role name "admin" most projects will ignore the tenancy | 19:47 |
| dolphm | most services* | 19:47 |
| nisha_ | ohh sure ayoung-meeting | 19:47 |
| dolphm | sorry, don't mean for this to be more confusing than it already is :) | 19:47 |
| nisha_ | I wil wait, no problem :) | 19:47 |
| nisha_ | This, channel seems very busy right now. So I am in no hurry | 19:47 |
| syin | @dolphm: no i really really appreciate your help. judging from those keystone commands, I thought every project, such as neutron, would understand the concept of different types of admins. | 19:49 |
| syin | @dolphm: I thought domains were introduced as a further segregation of user/projects. if services such as neutron ignore tenancy / domains, then how can the segregation be done? | 19:51 |
| lifeless | lbragstad: right | 19:51 |
| lbragstad | lifeless: awesome! testing it out now | 19:51 |
| lifeless | lbragstad: if you use git tags for releases you can just skip the version= line in setup.cfg entirely | 19:51 |
| lbragstad | lifeless: because pbr will derive the version from git tags, right? | 19:52 |
| lifeless | lbragstad: and use tags and/or sem-ver: pseudo headers in your git commits to control the version | 19:52 |
| lifeless | yeah | 19:52 |
| lbragstad | lifeless: makes sense | 19:52 |
| dolphm | syin: depends on what you mean by segregation? domains provide namespaces for users & projects, so that two users / projects can have identical names. | 19:52 |
| *** david-lyle has joined #openstack-keystone | 19:52 | |
| dolphm | syin: but all tenants, regardless of owning domain, should have their resources segregated from each other. domains don't change that. | 19:52 |
| *** mylu has quit IRC | 19:53 | |
| syin | @dolphm: right. in my case, some of my requirements are: 1) each domain should have its own admin(s) with admin rights only for resources belonging to its own domain, | 19:54 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Includes server_default option in is_domain column https://review.openstack.org/215167 | 19:55 |
| syin | @dolphm: 2) networks are tenant-specific. you know how when you list networks, you see networks from your own tenant but also external and shared networks? Well I need to restrict that to each domain. so a "shared" network or external network only appears in 1 domain and not another. | 19:55 |
| *** geoffarnold has quit IRC | 19:56 | |
| *** geoffarnold has joined #openstack-keystone | 19:56 | |
| syin | @dolphm: so with these kind of requirements, i am playing around with policy.json to best achieve the separation, and i'm just having troubles with the role:admin part. | 19:56 |
| dolphm | syin: that's not really a use case we've addressed via keystone, that i'm aware of. i imagine you'd have to ask keystone for the enumeration of projects that belong to the domain in a domain-scoped token to achieve that? | 19:58 |
| dolphm | syin: and then enumerate resources in neutron that belong to any of those projects? | 19:59 |
| morgan | dolphm: alternatively other projects could grow domain awareness I guess =/ | 19:59 |
| dolphm | syin: depending on the domain, there could be a lot of projects and a lot of resources, obviously. you could handle that client-side, as well... the client could establish sessions for a number of different tenants, make requests to neutron for each, and combine the results into a single interface | 20:00 |
| morgan | dolphm: we can assert a project cannot be moved between domains, and domain info is propagated | 20:00 |
| morgan | (we do assert projects can't be moved) - but this is just forward speculation on what could be done | 20:00 |
| morgan | syin: ^ cc | 20:00 |
| * dolphm <rant> or if we didn't have scoped-tokens then the client could just make a single request and enumerate a bunch of tenants it cared about </rant> | 20:01 | |
| *** lhcheng_ has quit IRC | 20:01 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add test case passing is_domain flag as False https://review.openstack.org/229549 | 20:01 |
| morgan | dolphm: heh | 20:01 |
| bknudson | you can get the list of tenants you have a role on | 20:02 |
| *** nisha__ has joined #openstack-keystone | 20:03 | |
| *** Sam-I-Am has left #openstack-keystone | 20:04 | |
| htruta | speaking of not moving a project between domains, do you guys think we can land this still in liberty? | 20:06 |
| syin | @dolphm @morgan: to somehow get a list of projects belonging to a domain along with the token might work, but i was thinking more along the lines of just being able to determine what type of role:admin we're talking about (for what project or for what domain), then being able to match that against the project or domain of the target (eg. a network) | 20:06 |
| *** lhcheng has joined #openstack-keystone | 20:06 | |
| *** ChanServ sets mode: +v lhcheng | 20:06 | |
| *** david-ly_ has joined #openstack-keystone | 20:07 | |
| *** nisha_ has quit IRC | 20:07 | |
| *** su_zhang has joined #openstack-keystone | 20:07 | |
| syin | if this kind of info is available when enforcing policies, i think i can come up with a better way to meet my requirements. | 20:07 |
| morgan | syin: that is going back to the enumeration issue. | 20:07 |
| *** david-lyle has quit IRC | 20:07 | |
| morgan | it can/would be expensive to make that query or balloon the data needed for the token | 20:07 |
| *** lhcheng_ has joined #openstack-keystone | 20:08 | |
| *** david-ly_ is now known as david-lyle | 20:08 | |
| morgan | it would likely be easier to make neutron domain aware, project info always has domain id associated with it - it is a check of a single value instead of a "search to see if this matches". | 20:08 |
| *** nisha__ has quit IRC | 20:09 | |
| morgan | you can tell what project you're scoped to, you can tell what domain the project is in | 20:09 |
| *** nisha_ has joined #openstack-keystone | 20:09 | |
| morgan | but it is hard to know what other projects are in the domain without a query. much easier to store/reference that data directly | 20:09 |
| morgan | and again, projects *cannot* be moved between domains (for security reasons). | 20:09 |
| *** jsavak has quit IRC | 20:10 | |
| *** lhcheng has quit IRC | 20:11 | |
| syin | @morgan: i do understand we don't want to move projects between domains - that's fits very well with my intention to use domains to completely separate 2 organizations. | 20:12 |
| morgan | syin: this looks like a feature add that will be needed to meet your use-case compared to what is available today | 20:13 |
| *** jsavak has joined #openstack-keystone | 20:13 | |
| morgan | at least at face value (something added to neutron) | 20:13 |
| morgan | but I am guessing here, playing catchup on the scrollback | 20:14 |
| syin | @morgan: yes i think so too | 20:14 |
| *** mylu has joined #openstack-keystone | 20:14 | |
| syin | @morgan: my main intention here is to make sure i'm not missing something that is already available / implemented upstream. if nothing is available, i will have to hack some code to get the separation i want. | 20:14 |
| morgan | I dont think what you want is currently available | 20:15 |
| morgan | I can see the use-case/benefit | 20:15 |
| syin | @morgan: ok thanks for the confirmation. though i'm still trying wrap my head around how most services still aren't domain aware in some way. | 20:15 |
| morgan | most services dont need to be domain aware | 20:16 |
| *** gyee has quit IRC | 20:16 | |
| syin | @morgan, that is what i learned today with the discussion between @dolphm and you | 20:16 |
| morgan | since tokens are project scoped | 20:16 |
| *** zzzeek has quit IRC | 20:16 | |
| morgan | regardless of any silly behavior of "admin" vs "admin" between projects [lets ignore that for a second] | 20:16 |
| morgan | when you tell nova to boot a VM, does it care what domain? no, just what project | 20:16 |
| morgan | similar for most everything since resources are limited to projects | 20:16 |
| morgan | heat is the notable exception | 20:17 |
| syin | @morgan: maybe I can write up a few use cases to better explain what i want to do, and then maybe you could give me some suggestions on how best to tackle it? I came up with some way but I'm new to neutron / keystone so other suggestions are definitely welcomed. | 20:17 |
| morgan | your use-case for neutron would be an exception as well | 20:17 |
| morgan | but a VM via nova *cant* be in two projects or bridge two projects | 20:17 |
| *** geoffarn_ has joined #openstack-keystone | 20:17 | |
| morgan | syin: this is something I do encourage sending to the dev mailing list | 20:17 |
| syin | @morgan: i see your point about some services don't need to be domain aware | 20:17 |
| *** geoffarnold has quit IRC | 20:18 | |
| morgan | and definitely circle up w/ us and the neutron team(s) | 20:18 |
| syin | @morgan: yes neutron is probably an exception because it has stuff like external networks and shared networks which spans across projects, but in my case i don't want them to span across domains. | 20:18 |
| *** zzzeek has joined #openstack-keystone | 20:18 | |
| morgan | worth discussing more then :) | 20:18 |
| morgan | i suggest also talking to neutron folks and/or sending the use-case to the dev mailing list | 20:19 |
| syin | @morgan: this is my first contact with upstream openstack community, could you please kindly point to a channel, email address where I can send my discussion to? | 20:19 |
| morgan | neutron is #openstack-neutron | 20:19 |
| morgan | and the dev mailing list... sec | 20:19 |
| morgan | https://wiki.openstack.org/wiki/Mailing_Lists here is the wiki on mailing lists | 20:20 |
| syin | this issue is across neutron and keystone, so i guess openstack@lists.openstack.org ? | 20:21 |
| morgan | this would be openstack-dev likely | 20:21 |
| morgan | and in the subject you'll want "[keystone][neutron] <your subject/title>" | 20:22 |
| syin | ah ok. thanks. is there a way for me to CC you and @dolphm? | 20:22 |
| morgan | you probably want to subscribe to the list | 20:22 |
| morgan | we're on the list for sure | 20:22 |
| syin | will do | 20:22 |
| morgan | the [keystone] and [neutron] in the subject will help folks who watch the mailing list filter/see that it is related to both projects | 20:23 |
| syin | @morgan @dolphm: ok. i'll try to tidy up my thoughts and post there. thank you so much for your help today. It's encouraging that you guys take my question seriously and take the time to respond to me! | 20:24 |
| dolphm | syin: i definitely get everything with [keystone] in the subject, along with a bunch of other tags | 20:27 |
| *** sweetjeebus has quit IRC | 20:27 | |
| *** su_zhang has quit IRC | 20:28 | |
| *** su_zhang has joined #openstack-keystone | 20:30 | |
| syin | @dolphm: ok thanks! will continue the discussion there. I might not be able to get to it today but it'll get there :) | 20:32 |
| *** urulama has quit IRC | 20:37 | |
| *** _cjones_ has joined #openstack-keystone | 20:37 | |
| *** urulama has joined #openstack-keystone | 20:37 | |
| *** geoffarn_ has quit IRC | 20:38 | |
| *** geoffarnold has joined #openstack-keystone | 20:38 | |
| *** stevemar has quit IRC | 20:39 | |
| *** stevemar has joined #openstack-keystone | 20:40 | |
| *** ChanServ sets mode: +o stevemar | 20:40 | |
| *** mylu has quit IRC | 20:40 | |
| *** phalmos has quit IRC | 20:41 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for projects acting as domains https://review.openstack.org/213448 | 20:41 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain parameter to get_project_by_name https://review.openstack.org/210600 | 20:41 |
| *** nisha_ has quit IRC | 20:43 | |
| *** stevemar has quit IRC | 20:45 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add test case passing is_domain flag as False https://review.openstack.org/229549 | 20:45 |
| *** topol has quit IRC | 20:46 | |
| *** _cjones_ has quit IRC | 20:48 | |
| *** _cjones_ has joined #openstack-keystone | 20:49 | |
| *** henrynash has quit IRC | 20:50 | |
| *** ankita_wagh has quit IRC | 20:52 | |
| *** stevemar has joined #openstack-keystone | 20:53 | |
| *** ChanServ sets mode: +o stevemar | 20:53 | |
| *** hrou has quit IRC | 20:53 | |
| *** raildo is now known as raildo-afk | 20:55 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Includes server_default option in is_domain column https://review.openstack.org/215167 | 20:55 |
| *** ankita_wagh has joined #openstack-keystone | 20:56 | |
| *** geoffarnold has quit IRC | 20:59 | |
| *** geoffarnold has joined #openstack-keystone | 21:00 | |
| *** su_zhang has quit IRC | 21:02 | |
| *** nicodemos has quit IRC | 21:02 | |
| *** ankita_w_ has joined #openstack-keystone | 21:03 | |
| *** ankita_wagh has quit IRC | 21:03 | |
| *** david-lyle has quit IRC | 21:03 | |
| *** david-ly_ has joined #openstack-keystone | 21:03 | |
| *** su_zhang has joined #openstack-keystone | 21:05 | |
| *** david-ly_ is now known as david-lyle | 21:05 | |
| *** jsavak has quit IRC | 21:05 | |
| *** gildub has joined #openstack-keystone | 21:06 | |
| *** syin has quit IRC | 21:12 | |
| stevemar | dstanek: yo | 21:25 |
| stevemar | you -1ed https://review.openstack.org/#/c/215870/12 and left no comments | 21:26 |
| *** woodster_ has joined #openstack-keystone | 21:26 | |
| *** gabriel-bezerra has quit IRC | 21:26 | |
| *** david-lyle has quit IRC | 21:26 | |
| *** david-lyle has joined #openstack-keystone | 21:29 | |
| *** albertom has quit IRC | 21:33 | |
| *** doug-fish has quit IRC | 21:36 | |
| *** doug-fish has joined #openstack-keystone | 21:36 | |
| stevemar | pokes lbragstad: lhcheng_ about https://review.openstack.org/#/c/215870/ | 21:38 |
| *** doug-fis_ has joined #openstack-keystone | 21:39 | |
| dolphm | stevemar: i believe the bug report mentioned in that code review dstanek -1'd might be a dupe of one opened by odyssey4me | 21:40 |
| dolphm | or maybe i just remember discussing the issue with odyssey4me .. | 21:40 |
| *** doug-fish has quit IRC | 21:41 | |
| stevemar | dolphm: i dunno, there are no comments so i can't be certain | 21:41 |
| dolphm | stevemar: i'm not saying that's why he -1'd | 21:42 |
| *** geoffarnold has quit IRC | 21:42 | |
| *** doug-fish has joined #openstack-keystone | 21:42 | |
| *** geoffarn_ has joined #openstack-keystone | 21:42 | |
| * stevemar shrugs at dolphm | 21:42 | |
| stevemar | dolphm: review: https://review.openstack.org/#/c/206561/ ? | 21:43 |
| stevemar | dolphm: i'm itching to get these rc bugs merged | 21:43 |
| dolphm | i wonder how many reviews are -1's without comments | 21:43 |
| *** john5223 has joined #openstack-keystone | 21:43 | |
| dolphm | like, in general | 21:43 |
| *** doug-fis_ has quit IRC | 21:43 | |
| dolphm | stevemar: looking! | 21:43 |
| stevemar | dolphm: generally few i think | 21:44 |
| *** doug-fish has quit IRC | 21:46 | |
| stevemar | dolphm: agreed, it looks goo | 21:47 |
| stevemar | d | 21:47 |
| *** pauloewerton has quit IRC | 21:47 | |
| *** david-lyle has quit IRC | 21:48 | |
| stevemar | dolphm: same patch but for liberty | 21:52 |
| stevemar | https://review.openstack.org/#/c/229647/ | 21:52 |
| *** doug-fish has joined #openstack-keystone | 21:54 | |
| *** david-lyle has joined #openstack-keystone | 21:54 | |
| *** sdake has quit IRC | 21:55 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Make __all__ immutable https://review.openstack.org/229656 | 21:58 |
| *** sdake has joined #openstack-keystone | 21:58 | |
| *** gordc has quit IRC | 21:58 | |
| *** doug-fish has quit IRC | 21:58 | |
| *** iurygregory has quit IRC | 21:59 | |
| *** geoffarnold has joined #openstack-keystone | 22:04 | |
| *** geoffarn_ has quit IRC | 22:04 | |
| *** svasheka has quit IRC | 22:05 | |
| *** lhcheng_ has quit IRC | 22:06 | |
| jamielennox | dolphm: who would mess with __all__? | 22:06 |
| *** csoukup has quit IRC | 22:06 | |
| dolphm | jamielennox: no one malicious, certainly | 22:08 |
| *** diazjf has quit IRC | 22:08 | |
| *** ngupta has quit IRC | 22:09 | |
| *** topol has joined #openstack-keystone | 22:09 | |
| *** ChanServ sets mode: +v topol | 22:09 | |
| *** slberger has left #openstack-keystone | 22:09 | |
| *** su_zhang has quit IRC | 22:10 | |
| *** su_zhang has joined #openstack-keystone | 22:11 | |
| *** tonytan4ever has quit IRC | 22:13 | |
| *** lhcheng has joined #openstack-keystone | 22:14 | |
| *** ChanServ sets mode: +v lhcheng | 22:14 | |
| *** cjschaef__ has quit IRC | 22:14 | |
| *** mylu has joined #openstack-keystone | 22:14 | |
| *** david-lyle has quit IRC | 22:15 | |
| *** topol has quit IRC | 22:16 | |
| *** hrou has joined #openstack-keystone | 22:17 | |
| *** jecarey__ has quit IRC | 22:17 | |
| *** mylu has quit IRC | 22:20 | |
| *** su_zhang has quit IRC | 22:21 | |
| stevemar | pokes at morgan for a stable/liberty change https://review.openstack.org/#/c/229647/ | 22:22 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add LimitRequestBody to sample httpd config https://review.openstack.org/208208 | 22:23 |
| morgan | stevemar: you are now admin of LP groups | 22:26 |
| stevemar | morgan: yay \o/ | 22:26 |
| morgan | stevemar: you can add/remove people from keystone-drivers and keystone-coresec | 22:26 |
| morgan | you are now also responsible for security things. | 22:26 |
| morgan | ;) | 22:26 |
| stevemar | morgan: whats the difference between the two | 22:26 |
| morgan | coresec is security bugs | 22:26 |
| morgan | drivers is the normal core group | 22:27 |
| stevemar | oh fun | 22:28 |
| *** devlaps has quit IRC | 22:30 | |
| *** ankita_wagh has joined #openstack-keystone | 22:30 | |
| *** ankita_w_ has quit IRC | 22:30 | |
| *** dims__ has joined #openstack-keystone | 22:30 | |
| *** su_zhang has joined #openstack-keystone | 22:31 | |
| *** e0ne has quit IRC | 22:33 | |
| *** dims_ has quit IRC | 22:33 | |
| *** david-lyle has joined #openstack-keystone | 22:36 | |
| *** su_zhang has quit IRC | 22:36 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Cleanup _build_federated_info https://review.openstack.org/220658 | 22:36 |
| *** mylu has joined #openstack-keystone | 22:38 | |
| htruta | hey stevemar, how do I know if I can propose something to stable/liberty? | 22:40 |
| *** mylu has quit IRC | 22:40 | |
| stevemar | htruta: only if it's a bug that is critical to liberty | 22:40 |
| htruta | stevemar: it's not critical, but it's pretty simple... just deprecating an update | 22:41 |
| htruta | that would help us in a short future | 22:42 |
| *** hrou has quit IRC | 22:42 | |
| stevemar | htruta: link? | 22:43 |
| htruta | https://review.openstack.org/#/c/207218/ | 22:44 |
| htruta | stevemar, it just hasn't merged before because I've put it in the middle of the reseller chains | 22:44 |
| *** spandhe has joined #openstack-keystone | 22:50 | |
| stevemar | htruta: i think bumping it to M is the right move, it's a wishlist bug, and no need to rush it into L. we'll carry the deprecation for another cycle, not that big of a deal | 22:50 |
| *** su_zhang has joined #openstack-keystone | 22:51 | |
| *** mylu has joined #openstack-keystone | 22:51 | |
| htruta | stevemar, fine. totally agreed | 22:52 |
| htruta | tks | 22:53 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Document token provider support https://review.openstack.org/224888 | 22:53 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Document token provider support https://review.openstack.org/224888 | 22:54 |
| htruta | stevemar, deprecating it in M and removing in M looks good to you? | 22:59 |
| *** browne1 has joined #openstack-keystone | 23:03 | |
| *** alejandrito has quit IRC | 23:04 | |
| boltR | is there a way to put secrets into the keystone token? | 23:06 |
| *** browne has quit IRC | 23:06 | |
| boltR | like passwords | 23:06 |
| *** geoffarnold has quit IRC | 23:07 | |
| *** geoffarnold has joined #openstack-keystone | 23:07 | |
| *** marzif has quit IRC | 23:10 | |
| *** EinstCra_ has quit IRC | 23:22 | |
| stevemar | htruta: we would remove in N | 23:23 |
| *** stevemar has quit IRC | 23:23 | |
| *** stevemar has joined #openstack-keystone | 23:24 | |
| *** ChanServ sets mode: +o stevemar | 23:24 | |
| *** brad[] has quit IRC | 23:25 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:26 | |
| *** geoffarnold has quit IRC | 23:28 | |
| *** stevemar has quit IRC | 23:28 | |
| *** geoffarnold has joined #openstack-keystone | 23:29 | |
| *** mylu has quit IRC | 23:33 | |
| *** mylu has joined #openstack-keystone | 23:33 | |
| *** mylu has quit IRC | 23:34 | |
| *** mylu has joined #openstack-keystone | 23:34 | |
| openstackgerrit | Merged openstack/keystone: Skip rows with empty remote_ids https://review.openstack.org/206561 | 23:35 |
| *** akanksha_ has quit IRC | 23:38 | |
| *** roxanagh_ has quit IRC | 23:38 | |
| *** hrou has joined #openstack-keystone | 23:38 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Restricting domain_id update https://review.openstack.org/207218 | 23:40 |
| *** roxanagh_ has joined #openstack-keystone | 23:41 | |
| *** topol has joined #openstack-keystone | 23:45 | |
| *** ChanServ sets mode: +v topol | 23:45 | |
| *** su_zhang has quit IRC | 23:47 | |
| *** hidekazu has quit IRC | 23:48 | |
| *** hidekazu has joined #openstack-keystone | 23:48 | |
| *** su_zhang has joined #openstack-keystone | 23:49 | |
| *** topol has quit IRC | 23:50 | |
| *** geoffarnold has quit IRC | 23:50 | |
| *** geoffarn_ has joined #openstack-keystone | 23:50 | |
| *** dsirrine has quit IRC | 23:51 | |
| *** syin has joined #openstack-keystone | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!