| *** roxanaghe has joined #openstack-keystone | 00:02 | |
| *** mjb has quit IRC | 00:04 | |
| *** roxanaghe has quit IRC | 00:06 | |
| *** mylu_ has joined #openstack-keystone | 00:14 | |
| *** mjb has joined #openstack-keystone | 00:16 | |
| *** mylu has quit IRC | 00:16 | |
| *** EinstCrazy has quit IRC | 00:21 | |
| *** wwwjfy has joined #openstack-keystone | 00:21 | |
| *** shadower has quit IRC | 00:23 | |
| *** shadower has joined #openstack-keystone | 00:23 | |
| mordred | jamielennox: ok. SO | 00:25 |
|---|---|---|
| jamielennox | mordred: yup | 00:25 |
| mordred | jamielennox: python-neutronclient is the one I've gotten the furthest on (although I've got first steps on glance and nova ...) | 00:26 |
| mordred | jamielennox: and I've just discovered the fascinating world of the codebase that doesn't use keystone sessions | 00:26 |
| jamielennox | yea, that's fun | 00:26 |
| mordred | jamielennox: can you think of any reason why the HTTPClient class shouldn't just create a ksa Session itself? | 00:27 |
| jamielennox | especially when they want you to keep compatibility with every non-used argument | 00:27 |
| mordred | jamielennox: well, I'm fine with having layers where old arguments get ignored - that I can do :) | 00:27 |
| jamielennox | mordred: mostly it just became easier for compatibility, having that sort of join is what i did for keystoneclient and i ended up with deprecated arguments and all sorts of indirection to make all the old code keep working | 00:28 |
| mordred | nod | 00:28 |
| jamielennox | so i said if you pass session= then you are opting in to new behaviour and you can't use some things | 00:28 |
| mordred | ah - yeah. totally | 00:28 |
| jamielennox | like pulling tokens out of authenticated clients and reusing stuff | 00:28 |
| jamielennox | the other one is that session auths as necessary and most of the time HTTPClient did it up front | 00:29 |
| jamielennox | you can make session do that, it just got confusing | 00:29 |
| jamielennox | and one day it'll be a whole lot easier to say "ok, all this code is no longer supported" because they are two different things | 00:30 |
| mordred | the thing I'm about to have to try to debug is: http://logs.openstack.org/25/236325/7/check/gate-neutronclient-test-dsvm-functional/0d6b7bf/testr_results.html.gz | 00:30 |
| mordred | which is in the non-Session code patch | 00:31 |
| mordred | path | 00:31 |
| mordred | I'm _guessing_ it's because the auth url in clouds.yaml is a v3 endpoint | 00:31 |
| mordred | and without ksa, the discovery is going do the wrong thing | 00:31 |
| mordred | and attempt to do v2 things with the v3 endpoint | 00:31 |
| jamielennox | yea, that would do it | 00:32 |
| jamielennox | i've been trying not to "fix" the old code too much, if it's broken then it's a good reason to use sessions where all this stuff works | 00:32 |
| mordred | totally | 00:33 |
| *** browne has quit IRC | 00:33 | |
| jamielennox | are they the only two functional tests of neutronclient? | 00:34 |
| mordred | I guess I've just got to look at the old codepath a little and figure out how the old code was feeding the right values into that codepath worked | 00:34 |
| mordred | no - there are others | 00:34 |
| mordred | those are just the only two that fail (they're the only two that explicitly test the old HTTPClient codepath) | 00:34 |
| jamielennox | i'm guessing you have to have os_client_config code in those tests anyway | 00:35 |
| jamielennox | would anyone care if you used a session for the test instead? | 00:35 |
| mordred | well, this particular test is testing the non-session codepath :) | 00:35 |
| jamielennox | it is.. but they aren't named like that is a goal | 00:35 |
| jamielennox | test_post_put_delele_network_StringException test_list_network_StringException | 00:36 |
| mordred | LibraryHTTPClientTest is the class it's in | 00:36 |
| mordred | they have those two tests | 00:36 |
| mordred | and they mixin them into a httpclient and a sessionclient test | 00:36 |
| mordred | so each path does both tests | 00:37 |
| jamielennox | i think os-client-config is going to have a similar time as the sessions, it's just not a good idea to use the os-client-config params with the old way | 00:37 |
| jamielennox | ah | 00:37 |
| mordred | I agree - althoug, right now I'm not sure why occ has different values than the functional_creds.conf | 00:37 |
| mordred | I mena, if I just use occ to pull the values out and then pass the 4 values into the constructor | 00:38 |
| mordred | I would expect it to be the same as the previos | 00:38 |
| jamielennox | occ does v3 doesn't it? | 00:38 |
| jamielennox | or maybe non-versioned | 00:38 |
| mordred | it does ksa discovery _if_ you use it to get an Auth | 00:38 |
| *** jbell8 has joined #openstack-keystone | 00:38 | |
| jamielennox | so if you can override the HTTPClient case you can do like | 00:38 |
| jamielennox | auth.get_endpoint(service_type=AUTH_INTERFACE, version=(2, 0)) | 00:39 |
| *** jbell8 has quit IRC | 00:39 | |
| jamielennox | and use that as the auth_url for those tests | 00:39 |
| *** jbell8 has joined #openstack-keystone | 00:39 | |
| jamielennox | that will discover on the auth_url rather than the identity endpoint in catalog | 00:40 |
| jamielennox | i'm pretty sure we merged that one | 00:40 |
| *** wwwjfy has quit IRC | 00:40 | |
| *** wwwjfy_ has joined #openstack-keystone | 00:40 | |
| *** mylu_ has quit IRC | 00:40 | |
| jamielennox | ksa1.plugin.AUTH_INTERFACE | 00:40 |
| mordred | hrm. interesting | 00:41 |
| mordred | (I'm also putting in a change to cat out some files so I can look at them in the logs - but I'm going to try your thing too ...) | 00:41 |
| *** jasonsb has joined #openstack-keystone | 00:44 | |
| *** mylu has joined #openstack-keystone | 00:47 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth-saml2: Redirect on 303 in SAML plugin https://review.openstack.org/236761 | 00:49 |
| *** dims_ has joined #openstack-keystone | 00:53 | |
| *** su_zhang has joined #openstack-keystone | 00:53 | |
| *** dimsum__ has quit IRC | 00:56 | |
| *** chlong has joined #openstack-keystone | 01:01 | |
| mordred | jamielennox: http://127.0.0.1:35357 is the URL that is in clouds.yaml - http://127.0.0.1:5000/v2.0 was the one that was in functional_creds.conf | 01:02 |
| *** roxanaghe has joined #openstack-keystone | 01:02 | |
| *** chlong has quit IRC | 01:03 | |
| jamielennox | yea, that makes sense | 01:03 |
| *** dims_ has quit IRC | 01:03 | |
| mordred | jamielennox: will auth.get_endpoint(service_type=ksa1.plugin.AUTH_INTERFACE, version=(2, 0)) get me http://127.0.0.1:5000/v2.0 ? | 01:03 |
| jamielennox | i've been trying to exclude the version from devstack | 01:03 |
| openstackgerrit | Merged openstack/keystoneauth-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 01:03 |
| jamielennox | it should get you :35357/v2.0 | 01:03 |
| mordred | and that'll be a working v2 endpoint then? | 01:03 |
| jamielennox | it won't jump across public/internal ports | 01:04 |
| jamielennox | yea, it'll be fine for what those tests are doing | 01:04 |
| *** chlong has joined #openstack-keystone | 01:05 | |
| mordred | jamielennox: I don't suppose there is a way to do that with ksc that makes any sense is there? because I've got one patch that just pulls from occ - and then one that moves to ksa | 01:05 |
| mordred | I could also collapse them if I need to | 01:05 |
| *** chlong has quit IRC | 01:05 | |
| *** chlong_ has joined #openstack-keystone | 01:05 | |
| jamielennox | that same function exists on ksc | 01:05 |
| *** rdo has quit IRC | 01:05 | |
| *** chlong_ has quit IRC | 01:05 | |
| mordred | ah! I see what I can steal ... v2_auth_url = ks_discover.url_for('2.0') | 01:05 |
| *** dimsum__ has joined #openstack-keystone | 01:05 | |
| jamielennox | not much of the session/auth plugin stuff changes across ksa/ksc | 01:06 |
| *** chlong has joined #openstack-keystone | 01:06 | |
| jamielennox | mordred: that will always expect an unversioned url though | 01:06 |
| mordred | as input? | 01:06 |
| jamielennox | right, going to discover directly is asking it to perform on a specific url | 01:06 |
| *** EinstCrazy has joined #openstack-keystone | 01:07 | |
| jamielennox | so it will work for changing /v2.0 -> / | 01:07 |
| *** roxanaghe has quit IRC | 01:07 | |
| mordred | woot! | 01:07 |
| mordred | worked | 01:07 |
| jamielennox | actually it might work anyway with a /v2.0 because if you discover on /v2.0 it will give you /v2.0 | 01:07 |
| *** rdo has joined #openstack-keystone | 01:08 | |
| mordred | http://paste.openstack.org/show/476634 | 01:08 |
| jamielennox | i'd go the get_endpoint route myself because it will trim the /v2.0 to / and discover on that, but either should wokr | 01:08 |
| *** dimsum__ has quit IRC | 01:08 | |
| *** dimsum__ has joined #openstack-keystone | 01:08 | |
| mordred | so - I'm going to do the get_endpoint route in the next patch | 01:08 |
| mordred | because I agee, it's a better route | 01:08 |
| mordred | jamielennox: then this for the ksa patch: http://paste.openstack.org/show/476635 yeah? | 01:12 |
| jamielennox | mordred: there's no session passed to auth | 01:13 |
| jamielennox | does OCC add the auth to session or not? | 01:13 |
| mordred | occ only gets an auth | 01:14 |
| mordred | do I need a session for auth.get_endpoint()? | 01:14 |
| jamielennox | you pretty much need a session whenever you talk to the plugin directly | 01:14 |
| jamielennox | most of the time you attach the plugin to a session, then call the method on session which just passes itself as first argument | 01:15 |
| mordred | jamielennox: how do I give the auth a session? | 01:15 |
| jamielennox | session is the first param | 01:15 |
| mordred | auth.get_endpoint(session, service_type='identity', version=(2, 0)) | 01:18 |
| mordred | ? | 01:18 |
| jamielennox | service_type='identity' will mean get identity from the catalog, AUTH_INTERFACE will query on what you passed as auth_url | 01:18 |
| jamielennox | in this case they're probably the same thing | 01:19 |
| mordred | k. I'll try: auth.get_endpoint(session, interface=keystoneauth1.plugin.AUTH_INTERFACE, version=(2, 0)) | 01:19 |
| *** davechen has joined #openstack-keystone | 01:21 | |
| mordred | jamielennox: ok. I think I have it - just submitted two new patces - thanks for the help! | 01:27 |
| mordred | (now let's see if devstack agrees with me :) ) | 01:27 |
| jamielennox | np, will see how they go later | 01:27 |
| *** topol has joined #openstack-keystone | 01:28 | |
| *** ChanServ sets mode: +v topol | 01:28 | |
| *** topol has quit IRC | 01:29 | |
| *** andreykurilin has quit IRC | 01:33 | |
| *** andreykurilin has joined #openstack-keystone | 01:39 | |
| *** lhcheng has quit IRC | 01:42 | |
| *** browne has joined #openstack-keystone | 01:46 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Make public the base loader classes https://review.openstack.org/236765 | 01:46 |
| *** wwwjfy_ has quit IRC | 01:49 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Make public the base loader classes https://review.openstack.org/236765 | 01:50 |
| *** mylu has quit IRC | 02:00 | |
| *** mylu has joined #openstack-keystone | 02:00 | |
| *** roxanaghe has joined #openstack-keystone | 02:03 | |
| *** doug-fish has joined #openstack-keystone | 02:04 | |
| *** mylu has quit IRC | 02:04 | |
| *** mylu has joined #openstack-keystone | 02:05 | |
| *** doug-fi__ has joined #openstack-keystone | 02:06 | |
| *** doug-fis_ has quit IRC | 02:06 | |
| *** roxanaghe has quit IRC | 02:08 | |
| *** doug-fish has quit IRC | 02:09 | |
| *** su_zhang has quit IRC | 02:13 | |
| *** dimsum__ has quit IRC | 02:24 | |
| *** dimsum__ has joined #openstack-keystone | 02:24 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: test_backend_sql work with python34 https://review.openstack.org/205352 | 02:25 |
| davechen | dstanek: ping? | 02:26 |
| davechen | dstanek: nose has gone from this patch - https://review.openstack.org/#/c/205352/ | 02:27 |
| davechen | dstanek: pls help to check it @ your convenience :) | 02:27 |
| *** marzif has quit IRC | 02:27 | |
| *** topol has joined #openstack-keystone | 02:29 | |
| *** ChanServ sets mode: +v topol | 02:29 | |
| *** jbell8 has quit IRC | 02:39 | |
| *** wwwjfy has joined #openstack-keystone | 02:51 | |
| *** dimsum__ has quit IRC | 02:51 | |
| *** dimsum__ has joined #openstack-keystone | 02:51 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth-saml2: Redirect on 303 in SAML plugin https://review.openstack.org/236761 | 02:54 |
| *** roxanaghe has joined #openstack-keystone | 03:04 | |
| *** ajaya has joined #openstack-keystone | 03:06 | |
| *** jamielennox has left #openstack-keystone | 03:07 | |
| *** davechen has quit IRC | 03:08 | |
| *** jamielennox has joined #openstack-keystone | 03:08 | |
| *** ChanServ sets mode: +v jamielennox | 03:08 | |
| *** topol has quit IRC | 03:08 | |
| *** topol has joined #openstack-keystone | 03:08 | |
| *** ChanServ sets mode: +v topol | 03:08 | |
| *** roxanaghe has quit IRC | 03:09 | |
| *** davechen has joined #openstack-keystone | 03:10 | |
| *** davechen1 has joined #openstack-keystone | 03:19 | |
| *** davechen has quit IRC | 03:21 | |
| *** dimsum__ has quit IRC | 03:30 | |
| *** lhcheng has joined #openstack-keystone | 03:30 | |
| *** ChanServ sets mode: +v lhcheng | 03:30 | |
| *** dimsum__ has joined #openstack-keystone | 03:31 | |
| *** dimsum__ has quit IRC | 03:31 | |
| *** dimsum__ has joined #openstack-keystone | 03:31 | |
| *** lhcheng has quit IRC | 03:36 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint_filter migrations into keystone core https://review.openstack.org/186988 | 03:36 |
| *** topol has quit IRC | 03:36 | |
| *** dimsum__ has quit IRC | 03:37 | |
| *** dimsum__ has joined #openstack-keystone | 03:38 | |
| *** links has joined #openstack-keystone | 03:41 | |
| *** mylu has quit IRC | 03:56 | |
| *** dimsum__ has quit IRC | 03:57 | |
| *** mylu has joined #openstack-keystone | 04:00 | |
| *** roxanaghe has joined #openstack-keystone | 04:05 | |
| *** ajaya has quit IRC | 04:07 | |
| *** roxanaghe has quit IRC | 04:09 | |
| *** spandhe has joined #openstack-keystone | 04:12 | |
| *** su_zhang has joined #openstack-keystone | 04:21 | |
| *** jamielennox is now known as jamielennox|away | 04:32 | |
| *** jamielennox|away is now known as jamielennox | 04:35 | |
| *** lhcheng has joined #openstack-keystone | 04:40 | |
| *** ChanServ sets mode: +v lhcheng | 04:40 | |
| *** jaosorior has joined #openstack-keystone | 04:46 | |
| stevemar_ | jamielennox: poke | 04:46 |
| jamielennox | stevemar_: yea | 04:46 |
| stevemar_ | jamielennox: anything else needed for ksa 1.2.0? | 04:46 |
| stevemar_ | i'm trying to release ksa and osc tmrw | 04:47 |
| stevemar_ | looking at https://review.openstack.org/#/q/status:open+project:openstack/keystoneauth,n,z i don't see anything super pressing | 04:47 |
| jamielennox | stevemar_: yea, that's what i'm looking at, i added one or two more today but they're not blockers | 04:48 |
| stevemar_ | jamielennox: coolio | 04:48 |
| stevemar_ | will release the newest then | 04:49 |
| stevemar_ | sha: 79104aa0fe51a7c729561c111010f6dcd77ff2ad | 04:49 |
| jamielennox | stevemar_: looks right to me | 04:49 |
| *** topol has joined #openstack-keystone | 04:51 | |
| *** ChanServ sets mode: +v topol | 04:51 | |
| *** stevemar_ has quit IRC | 04:51 | |
| *** mylu has quit IRC | 04:53 | |
| *** stevemar_ has joined #openstack-keystone | 04:53 | |
| *** ChanServ sets mode: +o stevemar_ | 04:53 | |
| stevemar_ | jamielennox: if you're interested: https://review.openstack.org/#/c/236797/ | 04:57 |
| *** GB21 has quit IRC | 05:01 | |
| *** topol_ has joined #openstack-keystone | 05:01 | |
| *** ChanServ sets mode: +v topol_ | 05:01 | |
| *** topol has quit IRC | 05:05 | |
| *** roxanaghe has joined #openstack-keystone | 05:06 | |
| *** ajaya has joined #openstack-keystone | 05:07 | |
| *** roxanaghe has quit IRC | 05:10 | |
| *** su_zhang has quit IRC | 05:11 | |
| *** florianf|away has quit IRC | 05:16 | |
| *** jbell8 has joined #openstack-keystone | 05:19 | |
| davechen1 | stevemar_: replied your comments - https://review.openstack.org/#/c/205352/ | 05:23 |
| davechen1 | stevemar_: pls let me know if i miss something, thanks! | 05:24 |
| stevemar_ | davechen1: ah yeah, i missed the change at L4700... token_id.encode('utf-8')) | 05:24 |
| *** Nirupama has joined #openstack-keystone | 05:24 | |
| *** davechen1 is now known as davechen | 05:24 | |
| stevemar_ | davechen: i think py3 does encoding automagically, so no UnicodeDecodeError is raised | 05:26 |
| davechen | and for the nose, i am not trying to import nose anyway, just try to slove the issue cause by nose for python3. | 05:26 |
| lifeless | davechen: do you still need nose? | 05:26 |
| davechen | stevemar_: I think so, although i didn't ever dig into this but UnicodeDecodeError will not raise in pytho3 for this case. | 05:27 |
| davechen | lifeless: no, i am not | 05:27 |
| davechen | lifeless: but currently python3 testing does. | 05:27 |
| lifeless | davechen: I meant 'does keystone testing of python3 ...' :) | 05:28 |
| lifeless | davechen: anyhow | 05:28 |
| davechen | yes, we are trying to enable the testing of python3. | 05:28 |
| lifeless | stevemar_: python3 refuses to do any unicode('str' actually in python3)<->bytes conversions | 05:28 |
| lifeless | stevemar_: its one of the major steps needed in porting | 05:28 |
| davechen | lifeless: a lot of work has been done by brant. | 05:29 |
| lifeless | davechen: cool | 05:29 |
| lifeless | I know haypo used nose as a workaround when the files weren't all parseable by python3 | 05:29 |
| lifeless | we could probably switch to a testr filter now easily enough | 05:30 |
| lifeless | davechen: whats the issue nose is causing for you ? | 05:30 |
| davechen | lifeless: we have methods but not a testcase which include "test" as a part of the name of the method. | 05:30 |
| davechen | lifeless: so, nose assume they are testcase and try to execute them as a testcase. | 05:31 |
| lifeless | davechen: ugh | 05:31 |
| davechen | i figure out two approach to address them, | 05:32 |
| lifeless | so that nose command | 05:32 |
| davechen | 1. use @nottest decorator | 05:32 |
| lifeless | can easily be switched over to testr | 05:32 |
| davechen | 2. update the name of the method. | 05:32 |
| lifeless | if you want to | 05:32 |
| *** jaosorior has quit IRC | 05:32 | |
| *** jaosorior has joined #openstack-keystone | 05:32 | |
| davechen | maybe, some follow-up patches I think. | 05:32 |
| lifeless | that would avoid the need to use either the decorator or change method names | 05:45 |
| lifeless | :) | 05:45 |
| davechen | sure. :) | 05:46 |
| davechen | so, this is the third approach. | 05:47 |
| *** dimsum__ has joined #openstack-keystone | 05:54 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/236807 | 05:56 |
| *** hidekazu has joined #openstack-keystone | 05:57 | |
| stevemar_ | oh no, our update config bot is dying :( | 05:58 |
| stevemar_ | he seems to be a bit broken | 05:58 |
| *** dimsum__ has quit IRC | 05:59 | |
| *** stevemar_ has quit IRC | 06:00 | |
| *** stevemar_ has joined #openstack-keystone | 06:01 | |
| *** ChanServ sets mode: +o stevemar_ | 06:01 | |
| *** roxanaghe has joined #openstack-keystone | 06:02 | |
| *** roxanaghe has quit IRC | 06:02 | |
| *** stevemar_ has quit IRC | 06:04 | |
| *** topol_ has quit IRC | 06:06 | |
| *** topol has joined #openstack-keystone | 06:07 | |
| *** ChanServ sets mode: +v topol | 06:07 | |
| *** topol has quit IRC | 06:12 | |
| *** lsmola_ has joined #openstack-keystone | 06:16 | |
| breton | o/ | 06:16 |
| *** ajaya has quit IRC | 06:20 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Switch to use CA certificate for SAML signing https://review.openstack.org/234531 | 06:27 |
| *** GB21 has joined #openstack-keystone | 06:27 | |
| *** boris-42 has joined #openstack-keystone | 06:28 | |
| *** jamielennox is now known as jamielennox|away | 06:33 | |
| *** ParsectiX has joined #openstack-keystone | 06:38 | |
| *** jaosorior has quit IRC | 06:42 | |
| *** jaosorior has joined #openstack-keystone | 06:42 | |
| *** yasu has joined #openstack-keystone | 06:45 | |
| *** jaosorior has quit IRC | 06:45 | |
| *** jaosorior has joined #openstack-keystone | 06:45 | |
| *** ajaya has joined #openstack-keystone | 06:46 | |
| *** jaosorior has quit IRC | 06:47 | |
| *** jaosorior has joined #openstack-keystone | 06:47 | |
| *** gildub has quit IRC | 06:53 | |
| *** dimsum__ has joined #openstack-keystone | 06:56 | |
| *** yasu has quit IRC | 06:58 | |
| *** yasu__ has joined #openstack-keystone | 06:58 | |
| *** roxanaghe has joined #openstack-keystone | 06:59 | |
| *** dimsum__ has quit IRC | 07:00 | |
| *** e0ne has joined #openstack-keystone | 07:01 | |
| *** roxanaghe has quit IRC | 07:04 | |
| openstackgerrit | ZhiQiang Fan proposed openstack/python-keystoneclient: remove unused FakeLog class in test code https://review.openstack.org/236824 | 07:05 |
| lifeless | davechen: ok so I had a poke at making the 3.4 stuff run with testr | 07:08 |
| lifeless | davechen: problem is discovery - all the ldap tests try to load and fail | 07:08 |
| *** markvoelker has quit IRC | 07:08 | |
| lifeless | davechen: Its possible to address that, but its not a trivial change; I'm timing out on it, but may poke at it some more later in the week // on th eplane | 07:08 |
| davechen | lifeless: great! | 07:09 |
| davechen | lifeless: btw, what do you mean the failure of ldap tests? | 07:09 |
| davechen | lifeless: afaik, it's not failed in keystone as far. | 07:10 |
| lifeless | davechen: ldap isn't installable on python 3.4 | 07:10 |
| lifeless | davechen: all the tests like keystone/tests/unit/test_backend_ldap_pool.py assume its importable | 07:10 |
| lifeless | davechen: which means that rather than the tests being importable and then not run | 07:10 |
| lifeless | davechen: they're erroring during discovery | 07:10 |
| lifeless | davechen: let me commit my WIP and push it up and you can see what I mean easily | 07:11 |
| davechen | lifeless: get it, this file is not acutally tested and not enabled for py3 testing. | 07:11 |
| lifeless | yeah | 07:11 |
| openstackgerrit | lifeless proposed openstack/keystone: WIP / DNM: don't use nose for Python 3.4 tests. https://review.openstack.org/236827 | 07:11 |
| davechen | lifeless: sure, that's great, thanks. | 07:11 |
| lifeless | np | 07:12 |
| davechen | lifeless: significant update | 07:12 |
| davechen | lifeless: i think i need rebase my patch on that. :) | 07:13 |
| lifeless | davechen: well, its a WIP - the nose approach is to not load those tests at all | 07:13 |
| lifeless | davechen: but whatever works :) | 07:14 |
| davechen | lifeless: yeah. | 07:14 |
| lifeless | if keystone cores feel this approach is preferrable, I'll happily run the remainder of it down to ground and get it working | 07:15 |
| davechen | hope so. | 07:16 |
| davechen | at least, I think dstanek like it more. :) | 07:16 |
| *** fesp has joined #openstack-keystone | 07:18 | |
| *** e0ne has quit IRC | 07:20 | |
| *** spandhe has quit IRC | 07:23 | |
| *** chlong has quit IRC | 07:23 | |
| *** e0ne has joined #openstack-keystone | 07:24 | |
| *** lhcheng has quit IRC | 07:26 | |
| *** browne has quit IRC | 07:27 | |
| *** gildub has joined #openstack-keystone | 07:28 | |
| *** e0ne has quit IRC | 07:31 | |
| *** fesp has quit IRC | 07:36 | |
| *** ajaya has quit IRC | 07:43 | |
| *** fhubik has joined #openstack-keystone | 07:49 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Deprecate local conf in paste-ini https://review.openstack.org/134124 | 07:59 |
| *** roxanaghe has joined #openstack-keystone | 08:01 | |
| *** stevemar_ has joined #openstack-keystone | 08:02 | |
| *** ChanServ sets mode: +o stevemar_ | 08:02 | |
| *** roxanaghe has quit IRC | 08:05 | |
| *** stevemar_ has quit IRC | 08:06 | |
| *** pnavarro has joined #openstack-keystone | 08:07 | |
| *** markvoelker has joined #openstack-keystone | 08:09 | |
| *** GB21 has quit IRC | 08:12 | |
| *** markvoelker has quit IRC | 08:14 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Move federation extension into keystone core https://review.openstack.org/214775 | 08:15 |
| *** e0ne has joined #openstack-keystone | 08:16 | |
| *** jistr has joined #openstack-keystone | 08:17 | |
| *** jistr has quit IRC | 08:18 | |
| *** jistr has joined #openstack-keystone | 08:20 | |
| *** GB21 has joined #openstack-keystone | 08:21 | |
| *** e0ne has quit IRC | 08:29 | |
| *** fhubik is now known as fhubik_brb | 08:29 | |
| *** e0ne has joined #openstack-keystone | 08:33 | |
| *** e0ne has quit IRC | 08:35 | |
| *** marzif has joined #openstack-keystone | 08:37 | |
| *** fhubik_brb is now known as fhubik | 08:39 | |
| *** yasu__ has quit IRC | 08:41 | |
| *** ajaya has joined #openstack-keystone | 08:42 | |
| *** marzif has quit IRC | 08:45 | |
| *** dimsum__ has joined #openstack-keystone | 08:59 | |
| *** dimsum__ has quit IRC | 09:04 | |
| *** fhubik is now known as fhubik_brb | 09:04 | |
| *** openstack has joined #openstack-keystone | 09:17 | |
| *** fhubik is now known as fhubik_brb | 09:25 | |
| *** fhubik_brb is now known as fhubik | 09:28 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Federation Identity Provider functional tests https://review.openstack.org/203258 | 09:36 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Functional tests for federation mapping CRUD https://review.openstack.org/231574 | 09:36 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Functional tests for federation protocols CRUD https://review.openstack.org/233733 | 09:36 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Adds a base class for functional tests https://review.openstack.org/203142 | 09:36 |
| *** GB21 has quit IRC | 09:39 | |
| *** marzif has joined #openstack-keystone | 09:51 | |
| *** Nirupama has quit IRC | 09:54 | |
| *** davechen has left #openstack-keystone | 09:55 | |
| *** ParsectiX has quit IRC | 09:58 | |
| *** jaosorior has quit IRC | 09:59 | |
| *** jaosorior has joined #openstack-keystone | 10:00 | |
| *** roxanaghe has joined #openstack-keystone | 10:01 | |
| *** stevemar_ has joined #openstack-keystone | 10:03 | |
| *** ChanServ sets mode: +o stevemar_ | 10:03 | |
| *** roxanaghe has quit IRC | 10:05 | |
| *** stevemar_ has quit IRC | 10:06 | |
| *** dimsum__ has joined #openstack-keystone | 10:07 | |
| *** yasu has joined #openstack-keystone | 10:13 | |
| *** jbell8 has quit IRC | 10:24 | |
| *** jbell8 has joined #openstack-keystone | 10:25 | |
| *** akanksha_ has joined #openstack-keystone | 10:33 | |
| *** pnavarro is now known as pnavarro|mtg | 10:36 | |
| *** wwwjfy has quit IRC | 10:38 | |
| *** urulama has quit IRC | 10:39 | |
| *** urulama has joined #openstack-keystone | 10:39 | |
| *** weihan has joined #openstack-keystone | 10:39 | |
| openstackgerrit | Hidekazu Nakamura proposed openstack/keystone: Adds sample data for policy.v3cloudsample.json https://review.openstack.org/236898 | 10:44 |
| *** marzif has quit IRC | 10:46 | |
| *** Nirupama has joined #openstack-keystone | 10:48 | |
| *** ParsectiX has joined #openstack-keystone | 10:49 | |
| *** dimsum__ is now known as dims | 10:52 | |
| *** fhubik is now known as fhubik_brb | 10:54 | |
| *** roxanaghe has joined #openstack-keystone | 11:02 | |
| *** roxanaghe has quit IRC | 11:06 | |
| *** fhubik_brb is now known as fhubik | 11:08 | |
| *** marzif has joined #openstack-keystone | 11:14 | |
| *** ParsectiX has quit IRC | 11:15 | |
| *** fhubik is now known as fhubik_brb | 11:19 | |
| *** e0ne has quit IRC | 11:20 | |
| *** gordc has joined #openstack-keystone | 11:21 | |
| *** markvoelker has joined #openstack-keystone | 11:22 | |
| *** doug-fish has quit IRC | 11:22 | |
| *** fhubik_brb is now known as fhubik | 11:24 | |
| *** doug-fish has joined #openstack-keystone | 11:25 | |
| *** markvoelker has quit IRC | 11:27 | |
| *** Nirupama has quit IRC | 11:30 | |
| *** markvoelker has joined #openstack-keystone | 11:34 | |
| *** fhubik is now known as fhubik_brb | 11:34 | |
| *** ParsectiX has joined #openstack-keystone | 11:36 | |
| *** pnavarro|mtg is now known as pnavarro | 11:38 | |
| *** fhubik_brb is now known as fhubik | 11:42 | |
| *** amakarov_away is now known as amakarov | 11:43 | |
| *** mylu has joined #openstack-keystone | 11:45 | |
| *** krotscheck_ is now known as krotscheck | 11:48 | |
| *** pnavarro is now known as pnavarro|mtg | 11:50 | |
| *** pnavarro|mtg is now known as pnavarro|lunch | 11:50 | |
| *** wwwjfy has joined #openstack-keystone | 11:51 | |
| *** mylu has quit IRC | 11:52 | |
| *** ParsectiX has quit IRC | 11:53 | |
| *** fhubik is now known as fhubik_brb | 11:53 | |
| *** markvoelker has quit IRC | 12:02 | |
| *** roxanaghe has joined #openstack-keystone | 12:02 | |
| *** josecastroleon has joined #openstack-keystone | 12:03 | |
| *** stevemar_ has joined #openstack-keystone | 12:04 | |
| *** ChanServ sets mode: +o stevemar_ | 12:04 | |
| *** davechen has joined #openstack-keystone | 12:05 | |
| *** roxanaghe has quit IRC | 12:07 | |
| *** stevemar_ has quit IRC | 12:07 | |
| *** yasu has quit IRC | 12:11 | |
| *** e0ne has joined #openstack-keystone | 12:12 | |
| *** fhubik_brb is now known as fhubik | 12:13 | |
| *** raildo-afk is now known as raildo | 12:21 | |
| *** weihan_ has joined #openstack-keystone | 12:25 | |
| *** weihan_ has quit IRC | 12:26 | |
| *** weihan has quit IRC | 12:26 | |
| *** jistr is now known as jistr|mtg | 12:26 | |
| *** weihan has joined #openstack-keystone | 12:26 | |
| *** weihan has quit IRC | 12:27 | |
| *** yasu has joined #openstack-keystone | 12:27 | |
| *** weihan has joined #openstack-keystone | 12:27 | |
| *** dims has quit IRC | 12:27 | |
| *** dims has joined #openstack-keystone | 12:28 | |
| *** topol has joined #openstack-keystone | 12:29 | |
| *** ChanServ sets mode: +v topol | 12:29 | |
| *** edmondsw has joined #openstack-keystone | 12:29 | |
| *** pauloewerton has joined #openstack-keystone | 12:30 | |
| *** weihan has quit IRC | 12:30 | |
| *** weihan has joined #openstack-keystone | 12:31 | |
| *** ParsectiX has joined #openstack-keystone | 12:34 | |
| *** weihan has quit IRC | 12:34 | |
| *** e0ne has quit IRC | 12:35 | |
| *** weihan has joined #openstack-keystone | 12:37 | |
| *** weihan has quit IRC | 12:37 | |
| *** weihan has joined #openstack-keystone | 12:38 | |
| *** dikonoor has joined #openstack-keystone | 12:41 | |
| *** yasu has quit IRC | 12:42 | |
| *** petertr7_away is now known as petertr7 | 12:43 | |
| *** davechen1 has joined #openstack-keystone | 12:45 | |
| *** ayoung has joined #openstack-keystone | 12:45 | |
| *** ChanServ sets mode: +v ayoung | 12:45 | |
| *** weihan has quit IRC | 12:46 | |
| *** davechen has quit IRC | 12:47 | |
| *** weihan has joined #openstack-keystone | 12:47 | |
| *** gildub has quit IRC | 12:48 | |
| *** nicodemos has joined #openstack-keystone | 12:50 | |
| *** marzif has quit IRC | 12:51 | |
| *** ajaya has quit IRC | 12:51 | |
| *** lhcheng has joined #openstack-keystone | 12:56 | |
| *** ChanServ sets mode: +v lhcheng | 12:56 | |
| *** jistr|mtg is now known as jistr | 12:59 | |
| *** ParsectiX has quit IRC | 13:00 | |
| *** jbell8 has quit IRC | 13:04 | |
| *** topol has quit IRC | 13:05 | |
| *** topol has joined #openstack-keystone | 13:06 | |
| *** ChanServ sets mode: +v topol | 13:06 | |
| *** petertr7 is now known as petertr7_away | 13:16 | |
| *** akanksha_ has quit IRC | 13:18 | |
| *** lhcheng has quit IRC | 13:20 | |
| *** petertr7_away is now known as petertr7 | 13:20 | |
| *** marzif has joined #openstack-keystone | 13:23 | |
| *** e0ne has joined #openstack-keystone | 13:24 | |
| *** topol has quit IRC | 13:25 | |
| *** davechen1 has left #openstack-keystone | 13:26 | |
| *** jsavak has joined #openstack-keystone | 13:26 | |
| *** marzif has quit IRC | 13:27 | |
| *** richm has joined #openstack-keystone | 13:28 | |
| *** marzif has joined #openstack-keystone | 13:30 | |
| *** ParsectiX has joined #openstack-keystone | 13:37 | |
| *** marzif has quit IRC | 13:42 | |
| *** links has quit IRC | 13:44 | |
| lbragstad | dstanek i'm really liking http://dstanek.com/keystone-bugday/2015-10-16/index.html | 13:46 |
| lbragstad | that's awesome info | 13:47 |
| dstanek | :) | 13:47 |
| *** exploreshaifali has joined #openstack-keystone | 13:47 | |
| *** marzif has joined #openstack-keystone | 13:48 | |
| dstanek | i was going to add a graph of gerrit data (reviews pushed, etc), but wasn't sure about the value | 13:49 |
| krotscheck | This might seem like a stupid question, but does keystone use keystonemiddleware? | 13:49 |
| lbragstad | dstanek ++ even just an active number of bugs open would be good too | 13:50 |
| *** pnavarro|lunch is now known as pnavarro | 13:50 | |
| dstanek | krotscheck: yes, but not necessarily the same as the other projects | 13:50 |
| *** nate_gone is now known as njohnston | 13:50 | |
| dstanek | lbragstad: yeah, i wasn't sure how to easily get that retroactively. | 13:51 |
| lbragstad | dstanek are you scrapping launchpad using their api? | 13:51 |
| dstanek | lbragstad: yes | 13:51 |
| dstanek | lbragstad: counting the "won't fix", "invalid", "expired" and "fix released" is a good indicator of how many bugs were handled and don't need anymore work | 13:52 |
| lbragstad | dstanek I think i used something like - https://github.com/lbragstad/openstack-infra-scripts/blob/master/recent_bugs.py#L52-L57 | 13:53 |
| dstanek | you could add "opinion" in there, but i haven't seen any of those ever on this project | 13:53 |
| dstanek | lbragstad: sorta | 13:53 |
| lbragstad | but that is to get "New", "Confirmed", "Triaged", and "In Progress" | 13:53 |
| dstanek | i'll public my script to github today | 13:53 |
| lbragstad | dstanek cool, I'd like to check it out | 13:54 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:55 | |
| *** weihan has quit IRC | 13:55 | |
| *** pumaranikar has joined #openstack-keystone | 13:58 | |
| *** roxanaghe has joined #openstack-keystone | 14:04 | |
| *** stevemar_ has joined #openstack-keystone | 14:04 | |
| *** ChanServ sets mode: +o stevemar_ | 14:04 | |
| *** tonytan4ever has joined #openstack-keystone | 14:06 | |
| lbragstad | stevemar_ ! - https://github.com/dhellmann/ansible-znc-on-znc | 14:06 |
| lbragstad | stevemar_ i had to remember to give that to you | 14:06 |
| *** ParsectiX has quit IRC | 14:07 | |
| *** stevemar_ has quit IRC | 14:08 | |
| *** roxanaghe has quit IRC | 14:09 | |
| *** diazjf has joined #openstack-keystone | 14:09 | |
| *** marzif has quit IRC | 14:10 | |
| *** marzif has joined #openstack-keystone | 14:10 | |
| *** EinstCrazy has quit IRC | 14:12 | |
| *** zz_john5223 is now known as john5223 | 14:13 | |
| *** marzif has quit IRC | 14:14 | |
| *** csoukup has joined #openstack-keystone | 14:14 | |
| *** marzif has joined #openstack-keystone | 14:14 | |
| *** rderose has joined #openstack-keystone | 14:16 | |
| *** links has joined #openstack-keystone | 14:26 | |
| *** timcline has joined #openstack-keystone | 14:33 | |
| *** stevemar_ has joined #openstack-keystone | 14:34 | |
| *** ChanServ sets mode: +o stevemar_ | 14:34 | |
| *** browne has joined #openstack-keystone | 14:35 | |
| *** links has quit IRC | 14:35 | |
| stevemar_ | o/ | 14:35 |
| marekd | \o | 14:35 |
| *** weihan has joined #openstack-keystone | 14:37 | |
| *** marzif has quit IRC | 14:38 | |
| *** marzif has joined #openstack-keystone | 14:39 | |
| dstanek | stevemar_: hey | 14:39 |
| *** EinstCrazy has joined #openstack-keystone | 14:40 | |
| lbragstad | stevemar_ mornin' | 14:40 |
| *** weihan has quit IRC | 14:40 | |
| *** chlong has joined #openstack-keystone | 14:40 | |
| breton | too many talks at the summit | 14:41 |
| *** weihan has joined #openstack-keystone | 14:41 | |
| breton | I checked 5 talks and they are at the same time | 14:41 |
| breton | so hard to choose. | 14:41 |
| *** slberger has joined #openstack-keystone | 14:41 | |
| *** jaosorior has quit IRC | 14:42 | |
| *** jaosorior has joined #openstack-keystone | 14:43 | |
| *** pgbridge has joined #openstack-keystone | 14:44 | |
| *** jaosorior has quit IRC | 14:52 | |
| *** jaosorior has joined #openstack-keystone | 14:52 | |
| htruta | breton: looks like they've put the same amount of 4 day talks in 3 | 14:53 |
| *** petertr7 is now known as petertr7_away | 14:54 | |
| *** rderose has quit IRC | 14:55 | |
| *** rderose has joined #openstack-keystone | 14:56 | |
| dstanek | breton: just fork when you get to tokyo, but don't forget to join before you leave | 14:57 |
| *** su_zhang has joined #openstack-keystone | 14:59 | |
| *** petertr7_away is now known as petertr7 | 15:00 | |
| *** su_zhang has quit IRC | 15:00 | |
| *** su_zhang has joined #openstack-keystone | 15:01 | |
| stevemar_ | dstanek: or a time machine | 15:02 |
| *** jbell8 has joined #openstack-keystone | 15:02 | |
| *** roxanaghe has joined #openstack-keystone | 15:05 | |
| *** fhubik is now known as fhubik_brb | 15:07 | |
| *** fhubik_brb is now known as fhubik | 15:09 | |
| *** fhubik is now known as fhubik_brb | 15:09 | |
| *** roxanaghe has quit IRC | 15:11 | |
| *** ajaya has joined #openstack-keystone | 15:16 | |
| *** roxanaghe has joined #openstack-keystone | 15:21 | |
| *** dikonoor has quit IRC | 15:22 | |
| *** jbell8 has quit IRC | 15:22 | |
| *** akanksha_ has joined #openstack-keystone | 15:22 | |
| *** phalmos has joined #openstack-keystone | 15:22 | |
| *** jbell8 has joined #openstack-keystone | 15:23 | |
| *** urulama has quit IRC | 15:23 | |
| *** urulama has joined #openstack-keystone | 15:24 | |
| *** fhubik_brb is now known as fhubik | 15:26 | |
| *** josecastroleon has quit IRC | 15:26 | |
| *** ankurgupta has joined #openstack-keystone | 15:27 | |
| *** jbell8 has quit IRC | 15:30 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation migration https://review.openstack.org/237047 | 15:34 |
| *** marzif has quit IRC | 15:34 | |
| *** marzif has joined #openstack-keystone | 15:35 | |
| *** nicodemos has left #openstack-keystone | 15:37 | |
| *** roxanaghe has quit IRC | 15:38 | |
| *** phalmos has quit IRC | 15:41 | |
| *** marzif has quit IRC | 15:42 | |
| *** marzif has joined #openstack-keystone | 15:42 | |
| *** jbell8 has joined #openstack-keystone | 15:42 | |
| *** ajaya has quit IRC | 15:44 | |
| *** phalmos has joined #openstack-keystone | 15:45 | |
| *** aix has quit IRC | 15:46 | |
| *** pnavarro is now known as pnavarro|off | 15:46 | |
| ayoung | stevemar_, so I just posted a further revision of my thinking on Admin. Its on the mailing list, and also here: http://adam.younglogic.com/2015/10/admin/ | 15:52 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move federation extension into keystone core https://review.openstack.org/214775 | 15:53 |
| ayoung | "The Service Catalog is a Domain" | 15:53 |
| *** gyee has joined #openstack-keystone | 15:57 | |
| *** ChanServ sets mode: +v gyee | 15:57 | |
| *** e0ne has quit IRC | 15:57 | |
| *** jbell8 has quit IRC | 15:59 | |
| *** jbell8 has joined #openstack-keystone | 16:00 | |
| *** haneef__ has quit IRC | 16:00 | |
| *** petertr7 is now known as petertr7_away | 16:00 | |
| *** su_zhang has quit IRC | 16:01 | |
| ayoung | What the actual? http://git.openstack.org/cgit/openstack/heat/tree/etc/heat/policy.json#n45 Deny Everybody? | 16:02 |
| *** roxanaghe has joined #openstack-keystone | 16:02 | |
| marekd | stevemar_: https://review.openstack.org/#/c/234537/ would be happy to see answer to my question and get you +2 | 16:03 |
| amakarov | ayoung, good day! I've described delegation https://review.openstack.org/#/c/189816/ and made some patches to https://blueprints.launchpad.net/keystone/+spec/unified-delegation, please take a look if you don't mind | 16:04 |
| ayoung | amakarov, Don't mind if I do.... | 16:04 |
| openstackgerrit | Michael Krotscheck proposed openstack/keystone: Moved CORS Middleware from application to paste.ini https://review.openstack.org/237062 | 16:05 |
| amakarov | ayoung, am I playing Yoda? :) | 16:05 |
| ayoung | amakarov, amakarov Look as good you will not when 900 years you reach! | 16:06 |
| ayoung | amakarov, Other contributors: None? Hey now!@ | 16:06 |
| *** roxanaghe has quit IRC | 16:06 | |
| lbragstad | dolphm browne rebased and resolved the merge conflicts - https://review.openstack.org/#/c/236078/ | 16:07 |
| amakarov | ayoung, may I enlist you? ;) | 16:07 |
| ayoung | amakarov, I don't enlist. I'm an officer. | 16:07 |
| ayoung | You may Commission me. | 16:07 |
| ayoung | lbragstad, when a Fernet token comes in to Keystone for validation, you need to expand out the data anyway. Won't most revocation events be filtered out; if a role is unassigned, or a domain deactivated, the token will be invalid, right? | 16:09 |
| *** SpamapS_ is now known as SpamapS | 16:09 | |
| amakarov | ayoung, that differs from my experience: in our army one gets commissioned if he is disabled or has some serious health problems: he goes home then :D | 16:10 |
| stevemar_ | marekd: yo | 16:10 |
| ayoung | amakarov, that is "De-commissioned" | 16:10 |
| *** SpamapS has quit IRC | 16:10 | |
| *** SpamapS has joined #openstack-keystone | 16:10 | |
| ayoung | amakarov, https://en.wikipedia.org/wiki/Commission_%28document%29 | 16:11 |
| lbragstad | ayoung the fernet token will be expanded into its component parts, then all that information is passed to get_token_data(). After that it will check the token reference against the revocation events | 16:11 |
| ayoung | lbragstad, I'm thinking we can seriously decomplexify revocation events | 16:11 |
| ayoung | it might also have a pretty good performance impact. | 16:12 |
| lbragstad | ayoung if you create an assignment on a project, get a scoped token for that project, then remove the assignment on that project, the validation of that token will return 401 | 16:12 |
| stevemar_ | marekd: answered, but don't +2 yet, i still need to make some tweaks :) | 16:12 |
| lbragstad | ayoung I believe we have test cases that test that for fernet | 16:12 |
| ayoung | lbragstad, right. But the real infomration is in the token validation response | 16:13 |
| ayoung | so, if You have a token with one role on a proejct, and that role gets revoked, the user would have no roles on the project | 16:13 |
| stevemar_ | bknudson: i answered most of your questions here: https://review.openstack.org/#/c/171916/19 not sure what to do about the last one | 16:13 |
| ayoung | same return code | 16:13 |
| ayoung | On tjhe other hand, if a user had to roles, and only one was removed, the token validation response would be 200 but only have a single role on it | 16:14 |
| lbragstad | ayoung if the role you have on the project is removed and you go to validate your token, you'll get a 401 | 16:14 |
| lbragstad | oh, i see what you're saying | 16:14 |
| ayoung | lbragstad, yeah.... | 16:14 |
| amakarov | ayoung, tell me please, what is the correct thing to state in "Other contributors" in the spec? | 16:14 |
| ayoung | lbragstad, I wrote Revocation Events assuming remote validation | 16:14 |
| lbragstad | ayoung i thought you were only talking about a single role assignment | 16:15 |
| ayoung | amakarov, at least me: Adam Young ayoung@redhat.com | 16:15 |
| ayoung | amakarov, anyone else involved can tell you themselves | 16:15 |
| ayoung | lbragstad, so the need for in-process revocation events drops significantly | 16:15 |
| *** su_zhang has joined #openstack-keystone | 16:16 | |
| ayoung | if we are always validating against current data, all we need to really check is for password change-type events, where the token is a proxy for authentication | 16:16 |
| lbragstad | ayoung this would technically still return a list of roles that you have on the project - https://github.com/openstack/keystone/blob/68e885d0ad0b64e892de891b07137991e103745f/keystone/token/providers/common.py#L265 | 16:16 |
| ayoung | lbragstad, right. So we would need to make clear that a validation would always return the current list, not the list at the time of token issue | 16:17 |
| lbragstad | ayoung yep | 16:17 |
| ayoung | I think it would simplify a lot. | 16:17 |
| lbragstad | ayoung I think that is different than the uuid model? | 16:17 |
| lbragstad | ayoung with uuid tokens we persist the entire reference to the database and then validate based on that (i think?) | 16:18 |
| ayoung | lbragstad, not really. With UUID, we serialize the auth data for performance sake, but we could serialize just the fernet subset of it, and then use common logic | 16:18 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Unified delegation spec https://review.openstack.org/189816 | 16:18 |
| ayoung | So we could make it work | 16:18 |
| *** spandhe has joined #openstack-keystone | 16:18 | |
| ayoung | Again, simplify, and better code | 16:19 |
| lbragstad | ayoung by rebuilding the reference for each validation? | 16:19 |
| lbragstad | instead of relying on possibly stale data? | 16:19 |
| ayoung | lbragstad, exactly | 16:20 |
| lbragstad | ayoung that makes sense, but i think that's where we took a performance hit | 16:21 |
| lbragstad | with fernet anyway | 16:21 |
| lbragstad | but we have patches up to mitigate some of that | 16:21 |
| ayoung | lbragstad, rebuilding the references? | 16:21 |
| lbragstad | ayoung yes | 16:21 |
| ayoung | lbragstad, well, we'll need to solve it anyway. | 16:21 |
| lbragstad | ayoung ++ | 16:21 |
| lbragstad | ayoung https://review.openstack.org/#/c/215715/ | 16:21 |
| lbragstad | ayoung https://review.openstack.org/#/c/215212/ | 16:22 |
| ayoung | lbragstad, looking | 16:22 |
| lbragstad | ayoung see the performance improvements noted in the commit messages | 16:22 |
| ayoung | validation requests by 7.5%: | 16:22 |
| ayoung | good | 16:22 |
| ayoung | lbragstad, you didn't report a validation speed up on 215715. Did you not see one, or was it unmeasured? | 16:23 |
| lbragstad | ayoung we did see an improvement in https://review.openstack.org/#/c/215715/ | 16:23 |
| lbragstad | ayoung it was around 28% | 16:23 |
| ayoung | Excellent | 16:24 |
| *** spandhe has quit IRC | 16:24 | |
| ayoung | lbragstad, just the commit message only mentions creation. I think that would be true, too, for validation | 16:24 |
| lbragstad | ayoung yeah | 16:25 |
| *** jistr has quit IRC | 16:26 | |
| *** jbell8_ has joined #openstack-keystone | 16:26 | |
| *** richm has quit IRC | 16:27 | |
| *** lifeless has quit IRC | 16:28 | |
| *** jbell8 has quit IRC | 16:28 | |
| *** crinkle has quit IRC | 16:29 | |
| *** crinkle has joined #openstack-keystone | 16:29 | |
| *** chlong has quit IRC | 16:29 | |
| *** alex_xu has quit IRC | 16:29 | |
| *** chmouel has quit IRC | 16:29 | |
| *** jrist has quit IRC | 16:29 | |
| ayoung | lbragstad, I'm willing to +2 both of those as is. | 16:30 |
| ayoung | and I did | 16:30 |
| *** lifeless has joined #openstack-keystone | 16:30 | |
| *** su_zhang has quit IRC | 16:32 | |
| *** weihan has quit IRC | 16:33 | |
| lbragstad | ayoung thank you sir! | 16:34 |
| *** chmouel has joined #openstack-keystone | 16:34 | |
| ayoung | lbragstad, Maybe on the Flight to Tokyo I'll take some time to see what it would take to implement UUID in terms of Fernet | 16:35 |
| *** alex_xu has joined #openstack-keystone | 16:35 | |
| *** ajaya has joined #openstack-keystone | 16:35 | |
| ayoung | it would only use the internal format, not the whole spec, I thinkt | 16:35 |
| ayoung | Unless you want to take it? | 16:35 |
| ayoung | lbragstad, and, infact, we could do the same thing with PKI tokens. All online validations get the same treatment | 16:36 |
| lbragstad | ayoung I want to say morgan had some ideas on that, too? | 16:37 |
| lbragstad | ayoung he has some ideas that tie together all the bits for consolidating all the common parts of the different token paths. | 16:40 |
| lbragstad | (if that makes sense?) | 16:41 |
| ayoung | lbragstad, Yeah, it makes sense. | 16:41 |
| *** chlong has joined #openstack-keystone | 16:42 | |
| *** richm has joined #openstack-keystone | 16:42 | |
| *** tonytan4ever has quit IRC | 16:42 | |
| *** tqtran has joined #openstack-keystone | 16:42 | |
| *** jrist has joined #openstack-keystone | 16:42 | |
| *** jrist has joined #openstack-keystone | 16:42 | |
| *** tsymanczyk has joined #openstack-keystone | 16:45 | |
| *** exploreshaifali has quit IRC | 16:45 | |
| *** tsymanczyk is now known as Guest5869 | 16:45 | |
| lbragstad | ayoung i think it would be beneficial to sit down in go through that with morgan though | 16:45 |
| ayoung | lbragstad, absolutely. Just wanted to give you some lead time to think it through prior to Tokyo | 16:46 |
| lbragstad | ayoung ++ | 16:46 |
| *** e0ne has joined #openstack-keystone | 16:47 | |
| *** tsymancz1k has joined #openstack-keystone | 16:47 | |
| *** e0ne has quit IRC | 16:47 | |
| *** e0ne has joined #openstack-keystone | 16:48 | |
| *** jasonsb has quit IRC | 16:49 | |
| *** Ephur has joined #openstack-keystone | 16:50 | |
| *** fhubik has quit IRC | 16:50 | |
| *** petertr7_away is now known as petertr7 | 16:52 | |
| *** marzif has quit IRC | 16:53 | |
| *** marzif has joined #openstack-keystone | 16:56 | |
| *** kiran-r has joined #openstack-keystone | 16:56 | |
| *** tonytan4ever has joined #openstack-keystone | 16:57 | |
| *** jbell8_ has quit IRC | 16:58 | |
| *** mfisch` is now known as mfisch | 16:59 | |
| *** mfisch is now known as Guest27947 | 16:59 | |
| *** kiranr has joined #openstack-keystone | 17:00 | |
| *** Guest27947 is now known as mfisch | 17:00 | |
| *** mfisch has quit IRC | 17:00 | |
| *** mfisch has joined #openstack-keystone | 17:00 | |
| *** Satya_ has joined #openstack-keystone | 17:00 | |
| Satya_ | Hi All | 17:01 |
| *** openstackgerrit has quit IRC | 17:01 | |
| Satya_ | i am just figuring out is there any way i can integrate keystone with docker for tenant management and user management? | 17:01 |
| *** openstackgerrit has joined #openstack-keystone | 17:02 | |
| *** kiran-r has quit IRC | 17:02 | |
| *** jaosorior has quit IRC | 17:03 | |
| *** lsmola_ has quit IRC | 17:04 | |
| *** jlvillal has joined #openstack-keystone | 17:05 | |
| *** petertr7 is now known as petertr7_away | 17:07 | |
| *** phalmos has quit IRC | 17:09 | |
| *** lhcheng has joined #openstack-keystone | 17:09 | |
| *** ChanServ sets mode: +v lhcheng | 17:09 | |
| *** browne has quit IRC | 17:10 | |
| *** lhcheng_ has joined #openstack-keystone | 17:11 | |
| *** rderose has quit IRC | 17:13 | |
| *** lhcheng has quit IRC | 17:14 | |
| *** rderose has joined #openstack-keystone | 17:14 | |
| Satya_ | any help? | 17:15 |
| *** josecastroleon has joined #openstack-keystone | 17:15 | |
| *** spandhe has joined #openstack-keystone | 17:19 | |
| stevemar_ | Satya_: not sure anyone has tried that yet | 17:22 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Improves domain name case sensitivity tests https://review.openstack.org/236103 | 17:26 |
| gyee | stevemar_, can you please take a peak at my response whenever you have a chance? https://review.openstack.org/#/c/231749/ | 17:28 |
| *** jsavak has quit IRC | 17:32 | |
| *** pnavarro|off has quit IRC | 17:33 | |
| *** jsavak has joined #openstack-keystone | 17:33 | |
| *** jasonsb has joined #openstack-keystone | 17:39 | |
| *** kiranr has quit IRC | 17:40 | |
| *** jbell8 has joined #openstack-keystone | 17:46 | |
| *** josecastroleon has quit IRC | 17:46 | |
| *** jasonsb has quit IRC | 17:47 | |
| breton | what's the problem with our current /v3/policies? Is it used by anybody? | 17:47 |
| *** marzif has quit IRC | 17:48 | |
| *** marzif has joined #openstack-keystone | 17:48 | |
| *** josecastroleon has joined #openstack-keystone | 17:50 | |
| breton | it looks to me like poor man's redis | 17:50 |
| *** browne has joined #openstack-keystone | 17:56 | |
| lbragstad | is it just me or does the Wednesday of the summit seem a little light in the morning? | 18:00 |
| lbragstad | does anyone have some good sessions going on Wednesday morning? | 18:00 |
| *** markvoelker has joined #openstack-keystone | 18:03 | |
| *** markvoelker has quit IRC | 18:05 | |
| bknudson | "Software should only work with Unicode strings internally, decoding the input data as soon as possible and encoding the output only at the end." -- https://docs.python.org/3/howto/unicode.html#tips-for-writing-unicode-aware-programs | 18:06 |
| bknudson | maybe we should do this in keystone | 18:06 |
| stevemar_ | gyee: i shall sir | 18:06 |
| bknudson | although in keystone case the output is also unicode | 18:06 |
| stevemar_ | ayoung: i like what you're doing with policy | 18:06 |
| lbragstad | bknudson we output unicode? | 18:06 |
| gyee | arigato stevemar_ son | 18:07 |
| stevemar_ | ayoung: it's been a lot of effort and i think we're all finally understanding the problem you're trying to solve | 18:07 |
| stevemar_ | and thanks for bending and meeting us all half way | 18:07 |
| breton | lbragstad: yep, almost nothing there | 18:07 |
| bknudson | lbragstad: you know, that's a good question. unicode in JSON isn't pretty... maybe it's UTF-8? | 18:07 |
| stevemar_ | gyee: +1 for mentioning bat flip | 18:08 |
| bknudson | lbragstad: "A string is a sequence of zero or more Unicode characters" according to http://www.json.org/ | 18:08 |
| gyee | lbragstad, those keystone sessions are fantastical | 18:08 |
| lbragstad | bknudson whats the types in the header? | 18:08 |
| gyee | keynote I mean | 18:08 |
| *** rderose has quit IRC | 18:08 | |
| *** diazjf has quit IRC | 18:08 | |
| lbragstad | gyee breton impromptu keystone working group? hallway session? | 18:09 |
| gyee | lbragstad, ++ | 18:09 |
| breton | ++ :) | 18:10 |
| lbragstad | gyee breton that's actually a pretty good slice of time to work on something | 18:10 |
| lbragstad | I don't have anything on my calendar (yet!) until 2 pm | 18:11 |
| bknudson | lbragstad: looks like headers are limited to ascii | 18:11 |
| lbragstad | bknudson ah, that makes sense | 18:11 |
| bknudson | http://tools.ietf.org/html/rfc822#section-3.3 | 18:11 |
| bknudson | so unicode for headers is pushing it. | 18:11 |
| lbragstad | bknudson I remember there being a difference in between the type of a string pulled out of a header and the type of a string pulled out of a request body. | 18:11 |
| bknudson | let's just convert them all to unicode and deal with unicode internally | 18:12 |
| lbragstad | that was a bug we hit with fernet between v2.0 and v3 | 18:12 |
| lbragstad | bknudson I'd be fine with that | 18:12 |
| breton | lbragstad: there is https://mitakadesignsummit.sched.org/event/eff8cae351c3fc02331de07110ebefea, I hope to hear some of deployers' pains. | 18:12 |
| lbragstad | at least we'd be consistent internally | 18:12 |
| bknudson | right, there's a difference between what's allowed in X-Auth-Token and "token" data in auth request. | 18:12 |
| lbragstad | breton nice, I'll add that one | 18:13 |
| lbragstad | bknudson so, all the ways we take input from a client would be through the headers (v3 tokens) and request bodies, right? | 18:14 |
| gyee | breton, nice one | 18:14 |
| bknudson | well, we get input from the config file, too. | 18:14 |
| lbragstad | gyee breton we could still work on something in the morning? | 18:14 |
| lbragstad | bknudson oh, right... duh | 18:14 |
| gyee | lbragstad, only if I don't have any hangovers from the booth crawl | 18:15 |
| breton | yep, from 9am | 18:15 |
| bknudson | and potentially from command line | 18:15 |
| lbragstad | gyee does that classify as a blocker? | 18:15 |
| lbragstad | command line should be translated to request body by the client, right? | 18:15 |
| lbragstad | unless you're talking about keystone-manage | 18:15 |
| stevemar_ | bknudson: lbragstad headers are ascii only | 18:16 |
| bknudson | lbragstad: y, keystone-manage and keystone-all I guess | 18:16 |
| bknudson | e.g., keystone-manage --config <what is this?> | 18:16 |
| lbragstad | yep | 18:17 |
| bknudson | and logs, not sure if that's unicode | 18:17 |
| lbragstad | bknudson i think that would be whatever argparse uses? | 18:17 |
| bknudson | apparently on windows the encoding of filenames depends on a config option | 18:17 |
| gyee | bknudson, can oslo.config handle unicode filename? | 18:20 |
| dstanek | bknudson: the unicode strings internally is what i've been trying to push for | 18:20 |
| bknudson | gyee: I don't know... I don't know if it can handle unicode contents of files either. | 18:21 |
| dstanek | bytes generally are only for the boundaries when you are talking about strings | 18:21 |
| *** josecastroleon has quit IRC | 18:21 | |
| bknudson | I'm just going to stick a bunch of assert isinstance(token_id, unicode) all over. | 18:21 |
| dstanek | bknudson: what are you trying to do? | 18:22 |
| *** devlaps has joined #openstack-keystone | 18:22 | |
| bknudson | dstanek: https://review.openstack.org/#/c/231711/ | 18:22 |
| bknudson | dstanek: see https://review.openstack.org/#/c/231711/8/keystone/token/provider.py -- I added a bunch of comments like "this is a str" | 18:22 |
| bknudson | but it shouldn't be a str, should be unicode | 18:23 |
| gyee | bknudson, can we do the conversion at the middleware filter? the same way we do xml-json conversion before? | 18:23 |
| gyee | then internally, we can assume a single encoding | 18:24 |
| bknudson | "Since Python 3.0, the language features a str type that contain Unicode characters," -- so apparently str in py3 is unicode on py2 | 18:24 |
| lbragstad | gyee will we be able to do the conversion for all input methods? | 18:24 |
| lbragstad | s/conversion/conversion in middleware/ | 18:24 |
| bknudson | gyee: sure, I just need to change every test since they don't all go through the pipeline | 18:24 |
| gyee | lbragstad, sure if everything is coming in via API | 18:24 |
| dstanek | bknudson: i started similar work a while back | 18:24 |
| dstanek | https://review.openstack.org/#/c/207526/ | 18:24 |
| bknudson | dstanek: y, that looks familiar | 18:25 |
| dstanek | the provider.py module should be considered a boundary i think | 18:25 |
| bknudson | controller should be reponsible for conversion | 18:25 |
| *** jasonsb has joined #openstack-keystone | 18:26 | |
| bknudson | (or even a middleware per gyee's comment) | 18:26 |
| dstanek | instead of checking types i'd rather the functions just work with text and convert to bytes | 18:26 |
| lbragstad | dstanek the provider.py would be a boundary for non-persistent tokens for sure | 18:26 |
| bknudson | dstanek: what do you mean by text? it's got to be either str or unicode | 18:26 |
| lbragstad | since that's the hand off point for whatever crypto method your using, but what about uuid providers? | 18:26 |
| dstanek | text is unicode | 18:27 |
| bknudson | bytes for the encryption? | 18:27 |
| dstanek | or basically six.text_type | 18:27 |
| bknudson | six.text_type would make things a little easier | 18:28 |
| lbragstad | we already use that through places of keystone | 18:28 |
| dstanek | bknudson: i don't think we should be checking the type though. the functions should take either text or bytes and then return either strings or bytes; anything else should be an error | 18:29 |
| bknudson | we shouldn't have to use it except in specific places where we're taking in strings... and all over in the tests! | 18:29 |
| dstanek | i'm actually working on some py3 tests now. | 18:29 |
| bknudson | dstanek: right, and by text you mean six.text_type | 18:30 |
| *** pumaranikar has quit IRC | 18:30 | |
| dstanek | bknudson: yes | 18:30 |
| bknudson | we don't have to have our internal functions support both str and unicode | 18:30 |
| *** Satya_ has quit IRC | 18:30 | |
| bknudson | as in, all our tests are broken since they pass '' rather than six.text_type('') | 18:30 |
| dstanek | u'some string' is much nicer than six.text_type('some string') | 18:32 |
| bknudson | also, from what I can tell oslo.cache doesn't support unicode keys, so that's all broken | 18:32 |
| dstanek | bknudson: that's what i'm fixing now the mangling stuff | 18:33 |
| dstanek | i'm currently stuck in rebase hell | 18:33 |
| bknudson | dstanek: all the cache stuff moved to oslo.cache | 18:33 |
| *** jsavak has quit IRC | 18:34 | |
| *** roxanaghe has joined #openstack-keystone | 18:34 | |
| dstanek | bknudson: yep | 18:34 |
| lbragstad | yeah, that was a fun rebase | 18:34 |
| *** jsavak has joined #openstack-keystone | 18:35 | |
| *** mylu has joined #openstack-keystone | 18:35 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Fix docstring https://review.openstack.org/234881 | 18:36 |
| bknudson | isinstance(u'', six.text_type) == True on python 3 | 18:36 |
| *** petertr7_away is now known as petertr7 | 18:38 | |
| *** diazjf has joined #openstack-keystone | 18:39 | |
| *** jlvillal_ has joined #openstack-keystone | 18:40 | |
| *** phalmos has joined #openstack-keystone | 18:44 | |
| dstanek | that should be true everywhere | 18:44 |
| *** Guest3686 is now known as mgagne | 18:45 | |
| *** mgagne has joined #openstack-keystone | 18:45 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystonemiddleware: Define entry points for filter factories for Paste Deployment https://review.openstack.org/233839 | 18:46 |
| *** jasonsb has quit IRC | 18:50 | |
| *** mylu has quit IRC | 18:53 | |
| bknudson | dstanek: you're right, it's True on py2 also | 18:55 |
| *** pumaranikar has joined #openstack-keystone | 18:56 | |
| *** mylu has joined #openstack-keystone | 18:56 | |
| *** boris-42 has quit IRC | 18:58 | |
| dstanek | bknudson: b'' should be str in 2 and bytes in 3 | 18:59 |
| dstanek | makes life easy | 18:59 |
| bknudson | I don't think we have too many binary strings, but I'll look out for it. | 18:59 |
| bknudson | binary literals | 18:59 |
| dstanek | i've had to make that change for the wsgi tests and a few other things | 19:00 |
| *** jsavak has quit IRC | 19:00 | |
| samueldmq | I wonder why there are those type differences between python 2 and 3 | 19:00 |
| samueldmq | :( | 19:01 |
| dstanek | python 3 moved to the java model where strings are text and there is a real binary type | 19:01 |
| dstanek | in py2 strings were binary because there were always binary and they added a unicode type | 19:01 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystonemiddleware: Define entry points for filter factories for Paste Deployment https://review.openstack.org/233839 | 19:01 |
| dstanek | samueldmq: ^ | 19:02 |
| *** jasonsb has joined #openstack-keystone | 19:03 | |
| *** jsavak has joined #openstack-keystone | 19:03 | |
| samueldmq | dstanek: kk | 19:04 |
| samueldmq | dstanek: also, there are some differences in builtin methods, like print("") and print "", right? | 19:05 |
| dstanek | samueldmq: yes, print is actually a function in 3 | 19:06 |
| *** roxanagh_ has joined #openstack-keystone | 19:07 | |
| dstanek | samueldmq: they added some future stuff to help with py3 things | 19:07 |
| *** roxanagh_ has quit IRC | 19:11 | |
| samueldmq | dstanek: nice, do you recommend any good books on python ? like learning it deeply | 19:14 |
| ayoung | stevemar_, I think I can use Henrynash's split of assignment from resource to implement this. | 19:14 |
| samueldmq | ayoung: hey, what's up ? | 19:15 |
| ayoung | samueldmq, did you see the latest? | 19:15 |
| samueldmq | ayoung: no | 19:16 |
| samueldmq | ayoung: just saw stevemar_ said he likes what you're doing with policies :p | 19:16 |
| ayoung | samueldmq, http://adam.younglogic.com/2015/10/admin/ | 19:16 |
| *** ChanServ sets mode: +o dolphm | 19:19 | |
| samueldmq | ayoung: hmm ... looking at it | 19:19 |
| samueldmq | ayoung: we could simply take the actual admin as global admin, and add new project_admin, domain_admin roles to our policies ? | 19:20 |
| *** tonytan4ever has quit IRC | 19:20 | |
| dstanek | i'm not sure why kvs does so much dogpile stuff | 19:20 |
| ayoung | samueldmq, I think so. | 19:22 |
| ayoung | samueldmq, then again, it might not make sense to split admin off of the thing it is assigned to | 19:22 |
| ayoung | admin on project would, here, mean something different from admin on domain, or on endpoint | 19:23 |
| ayoung | But more specific roles could be very useful | 19:23 |
| samueldmq | ayoung: yeah but I think splitting it off in the naming is helpful too | 19:23 |
| samueldmq | ayoung: as it provides clarity | 19:23 |
| ayoung | samueldmq, true. I kindof like "manager" for new roles going forward, especially for a project role that involves assigne other user to the project | 19:24 |
| samueldmq | ayoung: project_manager ? domain_manager? | 19:24 |
| ayoung | samueldmq, I also think quota is going to be different, as that really needs to be controlled by a role outside the project | 19:24 |
| ayoung | samueldmq, yes, and also storage, network, etc. | 19:25 |
| samueldmq | ayoung: storage_manager is indeed a project manager (only on that project), but only delegated storage-y things | 19:26 |
| *** su_zhang has joined #openstack-keystone | 19:27 | |
| ayoung | samueldmq, maybe...need to think it through. I was thinking more that storage maanger is like admin, but just for storage stuff, across swift, cinder, and glance....we can afford a few cycles on that one, though | 19:28 |
| samueldmq | ayoung: yes, I agree, but it is like global admin ? or project-scoped admin ? | 19:29 |
| ayoung | samueldmq, heh...I think I was slippin back to thinkning about implied roles...punt on it for now | 19:29 |
| *** tonytan4ever has joined #openstack-keystone | 19:30 | |
| ayoung | for now, I think we make admin work as people currently understand it, with admin-on-endpoint explicit as opposed to assumed | 19:30 |
| bknudson | ayoung: https://blueprints.launchpad.net/keystone/+spec/service-scoped-tokens ? | 19:32 |
| ayoung | bknudson, yep. that is pretty much it. | 19:34 |
| ayoung | bknudson, but instead of making it a new scope on a token (which has problems) we make the catalog its own domain, and scope tokens to services-as-projects | 19:35 |
| *** petertr7 is now known as petertr7_away | 19:35 | |
| *** marzif has quit IRC | 19:36 | |
| bknudson | ayoung: so to create a service you create a project? | 19:37 |
| *** marzif has joined #openstack-keystone | 19:37 | |
| *** woodster_ has joined #openstack-keystone | 19:37 | |
| bknudson | how is that going to work with nova? | 19:37 |
| ayoung | bknudson, I don't think so. I think that when you create a service or endpoint, you implicitly create a project | 19:37 |
| bknudson | oh, you're saying this is only for some kind of "service admin" role | 19:37 |
| ayoung | bknudson, we treat the catalog as a read-only backed for "resources" | 19:37 |
| *** petertr7_away is now known as petertr7 | 19:38 | |
| ayoung | bknudson, so when you create an endpoint with id "FEEDBABACAFE000" you get a proejdct with project_id "FEEDBABACAFE000" in the "catalog" domain | 19:38 |
| bknudson | which you can scope a token to | 19:38 |
| bknudson | and assign roles on | 19:38 |
| ayoung | bknudson, yeah | 19:39 |
| bknudson | then what do I use it for? give it to nova? | 19:39 |
| ayoung | bknudson, by keeping it as a proejct, you don't change the clienst | 19:39 |
| ayoung | bknudson, ok, on nova you can then use it to scope a toklen for "admin" actions like add a hypervisor | 19:39 |
| ayoung | but also like deleting a vm for a rpoject that was deleted but the notiffication got missed | 19:39 |
| bknudson | how does nova handle this? changes to policy.json or hardcoded or what? | 19:40 |
| ayoung | In Keystone, we can use it to scope operations to the Keystone server, like creating new domains or uploading policy files | 19:40 |
| bknudson | we've got cloudpolicy.json already that controls that | 19:40 |
| ayoung | bknudson, I think we can do some magiv in the policy enforcement, but maybe an explicit change to "is_admin" | 19:40 |
| ayoung | bknudson, but that needs to be edited, which is a tooling problem | 19:41 |
| bknudson | how do you do it without editing? | 19:41 |
| bknudson | endpoint=keystone? | 19:41 |
| ayoung | yeah | 19:41 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystonemiddleware: Define entry points for filter factories for Paste Deployment https://review.openstack.org/233839 | 19:42 |
| *** mylu has quit IRC | 19:43 | |
| *** ajaya has quit IRC | 19:45 | |
| *** ankurgupta has quit IRC | 19:45 | |
| *** ankurgupta has joined #openstack-keystone | 19:46 | |
| *** marzif has quit IRC | 19:46 | |
| *** ankurgupta has left #openstack-keystone | 19:48 | |
| *** amakarov is now known as amakarov_away | 19:49 | |
| *** exploreshaifali has joined #openstack-keystone | 19:50 | |
| *** pumaranikar has quit IRC | 19:52 | |
| *** pumaranikar has joined #openstack-keystone | 19:52 | |
| pauloewerton | heys guys, reviews for the patch https://review.openstack.org/#/c/192438/ would be highly appreciated. seems it is the only one being maintained atm in the feature/keystoneauth_integration branch for keystoneclient | 20:03 |
| *** su_zhang has quit IRC | 20:04 | |
| *** roxanagh_ has joined #openstack-keystone | 20:08 | |
| *** maxabidi has joined #openstack-keystone | 20:10 | |
| ayoung | pauloewerton, oooh. I'll look | 20:12 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Handle fernet payload timestamp differences https://review.openstack.org/232711 | 20:12 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix fernet padding for python 3 https://review.openstack.org/231711 | 20:12 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix key_repository_signature method for python3 https://review.openstack.org/236096 | 20:12 |
| *** roxanagh_ has quit IRC | 20:12 | |
| htruta | bknudson: quick question about your comment here: https://review.openstack.org/#/c/134095/6/keystone/common/sql/migrate_repo/versions/081_add_constraint_endpoint.py | 20:13 |
| htruta | in this case, should we just raise an error or remove the duplicate entries? | 20:13 |
| bknudson | htruta: I think an error should be raised. | 20:14 |
| bknudson | I don't know how you could remove duplicate entries safely. | 20:14 |
| htruta | bknudson: that's what I was thinking | 20:14 |
| *** Guest5869 has quit IRC | 20:15 | |
| *** tsymancz1k has quit IRC | 20:15 | |
| *** urulama has quit IRC | 20:15 | |
| pauloewerton | ayoung, nice, thx! | 20:15 |
| *** urulama has joined #openstack-keystone | 20:15 | |
| *** dims_ has joined #openstack-keystone | 20:16 | |
| htruta | bknudson: I'll add the test. thanks | 20:16 |
| *** maxabidi has quit IRC | 20:17 | |
| *** akanksha_ has quit IRC | 20:18 | |
| *** dims has quit IRC | 20:19 | |
| *** e0ne has quit IRC | 20:20 | |
| *** Ephur has quit IRC | 20:31 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Unified delegation spec https://review.openstack.org/189816 | 20:36 |
| ayoung | amakarov_away, just cleaned up some language | 20:36 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Handle fernet payload timestamp differences https://review.openstack.org/232711 | 20:37 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix fernet padding for python 3 https://review.openstack.org/231711 | 20:37 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix key_repository_signature method for python3 https://review.openstack.org/236096 | 20:37 |
| *** gordc has quit IRC | 20:38 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Handle fernet payload timestamp differences https://review.openstack.org/232711 | 20:42 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix fernet padding for python 3 https://review.openstack.org/231711 | 20:42 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix key_repository_signature method for python3 https://review.openstack.org/236096 | 20:42 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Constraint to prevent duplicates endpoints https://review.openstack.org/134095 | 20:44 |
| *** hidekazu has quit IRC | 20:45 | |
| *** Ephur has joined #openstack-keystone | 20:49 | |
| *** tsymancz1k has joined #openstack-keystone | 20:52 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Tests for subprojects acting as domains https://review.openstack.org/234907 | 20:53 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Sub projects acting as domains https://review.openstack.org/235544 | 20:53 |
| *** petertr7 is now known as petertr7_away | 20:54 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Remove domain table references https://review.openstack.org/165936 | 20:54 |
| *** su_zhang has joined #openstack-keystone | 20:54 | |
| *** jlvillal_ has quit IRC | 20:57 | |
| *** urulama has quit IRC | 20:58 | |
| *** pauloewerton has quit IRC | 20:58 | |
| *** urulama has joined #openstack-keystone | 20:58 | |
| *** jlvillal_ has joined #openstack-keystone | 20:58 | |
| *** jsavak has quit IRC | 20:59 | |
| *** spandhe has quit IRC | 21:00 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Bye Bye Domain Table https://review.openstack.org/161854 | 21:01 |
| *** jsavak has joined #openstack-keystone | 21:01 | |
| *** spandhe has joined #openstack-keystone | 21:01 | |
| *** jlvillal_ has quit IRC | 21:02 | |
| *** jsavak has quit IRC | 21:07 | |
| *** tsymancz1k has quit IRC | 21:07 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Remove endpoint policy extensions that should be part of main keystone https://review.openstack.org/237201 | 21:08 |
| *** jsavak has joined #openstack-keystone | 21:08 | |
| *** roxanagh_ has joined #openstack-keystone | 21:10 | |
| *** e0ne has joined #openstack-keystone | 21:11 | |
| *** roxanagh_ has quit IRC | 21:14 | |
| *** tsymancz1k has joined #openstack-keystone | 21:14 | |
| *** haneef has joined #openstack-keystone | 21:16 | |
| *** raildo is now known as raildo-afk | 21:17 | |
| *** e0ne has quit IRC | 21:20 | |
| *** jbell8 has quit IRC | 21:20 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Refactor test use of new_*_ref https://review.openstack.org/237205 | 21:21 |
| *** stevemar_ has quit IRC | 21:22 | |
| *** stevemar_ has joined #openstack-keystone | 21:22 | |
| *** ChanServ sets mode: +o stevemar_ | 21:22 | |
| *** stevemar_ has quit IRC | 21:22 | |
| *** stevemar_ has joined #openstack-keystone | 21:23 | |
| *** ChanServ sets mode: +o stevemar_ | 21:23 | |
| *** spandhe has quit IRC | 21:30 | |
| *** spandhe has joined #openstack-keystone | 21:32 | |
| dstanek | wow, still 2260 unicode related test errors :-( | 21:35 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Merge keystone.config info keystone.common.config https://review.openstack.org/237209 | 21:36 |
| *** njohnston is now known as nate_gone | 21:36 | |
| bknudson | dstanek: because of caching? | 21:38 |
| dstanek | no, i've been working on making a unicode center and bytey outside - lots of fun | 21:42 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds already passing tests to py34 run https://review.openstack.org/237210 | 21:42 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes kvs cache key mangling issue for Py3 https://review.openstack.org/237211 | 21:42 |
| dstanek | that addresses the kvs caching stuff | 21:43 |
| *** timcline has quit IRC | 21:45 | |
| *** tonytan4ever has quit IRC | 21:49 | |
| *** diazjf has left #openstack-keystone | 21:50 | |
| *** tsymanczyk has joined #openstack-keystone | 21:51 | |
| *** tsymanczyk is now known as Guest78253 | 21:51 | |
| *** phalmos has quit IRC | 21:53 | |
| *** slberger has left #openstack-keystone | 21:53 | |
| *** markvoelker has joined #openstack-keystone | 22:00 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:01 | |
| *** alex_xu has quit IRC | 22:04 | |
| *** jsavak has quit IRC | 22:04 | |
| *** alex_xu has joined #openstack-keystone | 22:05 | |
| *** urulama_ has joined #openstack-keystone | 22:06 | |
| *** jbell8 has joined #openstack-keystone | 22:06 | |
| *** pumaranikar has quit IRC | 22:08 | |
| *** urulama has quit IRC | 22:09 | |
| *** roxanagh_ has joined #openstack-keystone | 22:10 | |
| *** jbell8 has quit IRC | 22:12 | |
| *** exploreshaifali has quit IRC | 22:14 | |
| *** thiagop has quit IRC | 22:14 | |
| *** jbell8 has joined #openstack-keystone | 22:14 | |
| *** dims_ has quit IRC | 22:15 | |
| *** roxanagh_ has quit IRC | 22:17 | |
| *** jbell8 has quit IRC | 22:19 | |
| *** su_zhang has quit IRC | 22:25 | |
| *** jamielennox|away is now known as jamielennox | 22:26 | |
| *** csoukup has quit IRC | 22:47 | |
| jamielennox | morgan or ayoung: https://review.openstack.org/#/c/236761/ is an easy +A | 22:54 |
| ayoung | jamielennox, did you origianlly write the BP for service/endpoint scoped tokens? | 22:55 |
| jamielennox | i don't think so | 22:55 |
| *** su_zhang has joined #openstack-keystone | 22:55 | |
| jamielennox | also it seems there should be an ABAC thing there | 22:56 |
| jamielennox | that doesn't look right | 22:56 |
| jamielennox | the admin rbac | 22:56 |
| *** markvoelker has quit IRC | 22:57 | |
| ayoung | jamielennox, https://review.openstack.org/#/c/61869/ I misread...it was dolphs and you responded first | 22:58 |
| ayoung | Unscoped == service scoped for the keystone server that issued it seems ... maybe right? | 22:58 |
| jamielennox | it's a better way of looking at unscoped tokens, it just doesn't necessarily imply any roles | 23:00 |
| openstackgerrit | Merged openstack/keystoneauth-saml2: Redirect on 303 in SAML plugin https://review.openstack.org/236761 | 23:01 |
| *** su_zhang has quit IRC | 23:02 | |
| ayoung | jamielennox, no argument there. It just doesn't really map to how we use them today. Unscoped is certaily limited to Keystone only, but it would not be the same as a domain scoped token. And, if we do the endpoint scoped role assignments , it kindof implies that the user has some role on the endpoint | 23:02 |
| jamielennox | right, well it doesn't map because we don't really have the concept of a service scoped token | 23:03 |
| ayoung | Although I guess that anyone with an active account in Keystone has an implied role on Keystone? | 23:03 |
| jamielennox | well you have the role that lets you list things you're a member of | 23:03 |
| ayoung | rotof like _member_ in that they can list their own data? | 23:03 |
| ayoung | I can accept that explanation | 23:03 |
| jamielennox | still there feels like an admin-rbac solution that would be better here | 23:04 |
| jamielennox | seperate management roles from usage roles | 23:04 |
| jamielennox | it's just kind of complex | 23:04 |
| ayoung | jamielennox, what about the rest of my thought process. Where the service catalog becomes a read-only "resource" backend for single domain | 23:05 |
| jamielennox | was that in the review? | 23:05 |
| ayoung | partially I'm trying to be pragmatic | 23:05 |
| ayoung | jamielennox, nah, posted to the mailing list earlier today | 23:05 |
| ayoung | blog posted it, too | 23:05 |
| jamielennox | oh, haven't seen that yet | 23:05 |
| ayoung | jamielennox, http://adam.younglogic.com/2015/10/admin/ | 23:06 |
| ayoung | you know most of this..you can cut to... | 23:06 |
| ayoung | "All of these constraints drive toward a solution where we link the admin project to the existing endpoint ids. " | 23:06 |
| *** su_zhang has joined #openstack-keystone | 23:08 | |
| jamielennox | hmm | 23:09 |
| jamielennox | no i think that's going the wrong way | 23:09 |
| jamielennox | Make regions, services, and endpoints projects | 23:10 |
| jamielennox | i think i understand the rationale, but you're trying to squeeze a complex problem into our limited role system | 23:10 |
| jamielennox | and maybe we should just make the role system less limited | 23:10 |
| ayoung | jamielennox, you have a counter-proposal? | 23:11 |
| ayoung | And, might I add, one that we can implement within the openstack development process? | 23:11 |
| jamielennox | no, but at the moment i'm thinking that projects shouldn't be the top level | 23:11 |
| jamielennox | i don't know if that means domains | 23:12 |
| ayoung | jamielennox, you do realize that a response like that "no, but I have no alternative" is very frustrating to hear. | 23:12 |
| jamielennox | especially as we just essentially ripped those out | 23:12 |
| jamielennox | i do | 23:12 |
| ayoung | And the reason this has been broken for so long | 23:12 |
| ayoung | So...I'm willing to make something work, but I need a positive direction to head | 23:12 |
| jamielennox | and given the token formats specify one scope per token we are going to have to have a situation where you can scope to more than either a project or domain | 23:13 |
| ayoung | I do like the idea (on its own) of the proejct hierarchy for a domain coming from a source other than the main SQL-resources table, like we do with identity | 23:13 |
| jamielennox | do we even talk about domains any more? | 23:13 |
| *** roxanagh_ has joined #openstack-keystone | 23:14 | |
| jamielennox | domains had some useful properties that i'm not sure we retain with the merging into projects | 23:14 |
| ayoung | they are still there, and Henrynash just went crazy getting DB config for them working | 23:14 |
| jamielennox | right, but that's because we assume idp == domain | 23:14 |
| ayoung | jamielennox, but, "project" or even "tenant" is not really any differnt than saying "label" link in an SELinux sort of wat | 23:15 |
| ayoung | way | 23:15 |
| jamielennox | it's kind of an authn/authz problem, and i'm thinking of z | 23:15 |
| ayoung | so saying that "labels" can come from the catalog does feel consistent to me. | 23:15 |
| ayoung | role assignments would stay in the assignments backend. | 23:16 |
| ayoung | So...we create a special domain, call it the catalog domain | 23:16 |
| ayoung | Everythuing inside the service catalog then maps to a project | 23:16 |
| ayoung | the Ids are the same | 23:16 |
| ayoung | so endpoint_id == project_id | 23:16 |
| jamielennox | you're trying really hard not to create a new concept | 23:16 |
| jamielennox | what happens when someone gets confused and tries to launch a vm in that project | 23:17 |
| ayoung | jamielennox, it lets the client keep working, and does not break the remote services | 23:17 |
| ayoung | I thought of that. Really, launching a VM should be a separate role from admin anyway | 23:17 |
| ayoung | the easy case to catch is if you get a token for nova. The endpointid == project id, and the policy in nova could filter it out | 23:18 |
| jamielennox | so we're in to domain specific policy to make sure noone does anything project-y in the project | 23:18 |
| ayoung | when you get a token scoped to any catalog project, the only endpoint you get is that endpoint. | 23:18 |
| ayoung | so we could it with the endpoint binding of the tokens, too | 23:18 |
| ayoung | And, really, only admins could make that mistake | 23:19 |
| ayoung | perhaps we also make sure they have a quota of 0? | 23:19 |
| ayoung | Launching a vm in one would really not break anything, would it? | 23:19 |
| jamielennox | so that's a lot of runtime enforcement to make this work | 23:20 |
| *** roxanagh_ has quit IRC | 23:20 | |
| jamielennox | note because it appears i forgot to say earlier: that's a pretty cool hack, i'm just wary of putting hacks in such fundamental places | 23:20 |
| ayoung | jamielennox, that is a lot of runtime enforcement to catch a minor case that I think is kindof minimally worth wortrying about. | 23:21 |
| ayoung | Heh | 23:21 |
| ayoung | It just lets the cliens work as is today, and Horizon, too. I'm mnot 100% against adding "endpoint" as a scope for tokens to report. | 23:21 |
| ayoung | Dinner.... | 23:21 |
| *** topol has joined #openstack-keystone | 23:22 | |
| *** ChanServ sets mode: +v topol | 23:22 | |
| *** mylu has joined #openstack-keystone | 23:26 | |
| *** tsymancz1k has quit IRC | 23:27 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/237293 | 23:28 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/237294 | 23:28 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/237310 | 23:32 |
| *** tsymancz1k has joined #openstack-keystone | 23:32 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/235690 | 23:32 |
| *** jbell8 has joined #openstack-keystone | 23:33 | |
| *** mylu has quit IRC | 23:34 | |
| *** mylu has joined #openstack-keystone | 23:35 | |
| *** spandhe has quit IRC | 23:53 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!