| *** richm has quit IRC | 00:00 | |
| *** mylu has joined #openstack-keystone | 00:02 | |
| *** hidekazu has joined #openstack-keystone | 00:07 | |
| *** markvoelker has quit IRC | 00:11 | |
| openstackgerrit | guang-yee proposed openstack/keystone: update mailmap with gyee's new email https://review.openstack.org/241413 | 00:12 |
|---|---|---|
| *** josecastroleon has quit IRC | 00:15 | |
| jamielennox | so httpd.py is deprecated in favour of keystone-wsgi-admin and keystone-wsgi-main https://github.com/openstack/keystone/blob/master/httpd/keystone.py#L31-L33 | 00:17 |
| jamielennox | where are they exactly? | 00:17 |
| *** slberger has left #openstack-keystone | 00:18 | |
| jamielennox | oh, they get generated and installed into /usr/bin | 00:19 |
| jamielennox | that's weird | 00:19 |
| jamielennox | why would i want scripts that can only be executed by mod_wsgi installed into bin? | 00:20 |
| *** jbell8 has quit IRC | 00:21 | |
| *** dims has joined #openstack-keystone | 00:28 | |
| *** browne has quit IRC | 00:29 | |
| *** hrou has joined #openstack-keystone | 00:29 | |
| *** edmondsw has quit IRC | 00:32 | |
| openstackgerrit | Merged openstack/keystoneauth: Make public the base loader classes https://review.openstack.org/236765 | 00:37 |
| *** jerrygb has joined #openstack-keystone | 00:44 | |
| openstackgerrit | zouyee proposed openstack/keystone: get_user_roles in RoleAssignmentV2 to resolve KeyError https://review.openstack.org/237658 | 00:46 |
| *** bapalm has quit IRC | 00:46 | |
| *** bapalm has joined #openstack-keystone | 00:48 | |
| *** jerrygb has quit IRC | 00:48 | |
| *** mylu has quit IRC | 00:48 | |
| *** jsavak has quit IRC | 00:49 | |
| *** mylu has joined #openstack-keystone | 00:49 | |
| *** tellesnobrega is now known as tellesnobrega_af | 00:51 | |
| *** mylu has quit IRC | 00:53 | |
| *** mylu has joined #openstack-keystone | 00:58 | |
| *** RA_ has quit IRC | 01:07 | |
| *** gildub has joined #openstack-keystone | 01:08 | |
| *** RA_ has joined #openstack-keystone | 01:09 | |
| *** markvoelker has joined #openstack-keystone | 01:12 | |
| *** arunkant has quit IRC | 01:15 | |
| *** arunkant has joined #openstack-keystone | 01:17 | |
| *** markvoelker has quit IRC | 01:17 | |
| *** chlong has joined #openstack-keystone | 01:18 | |
| *** gyee has quit IRC | 01:28 | |
| *** lhcheng has quit IRC | 01:30 | |
| *** shaleh has quit IRC | 01:32 | |
| *** mylu has quit IRC | 01:36 | |
| *** mylu has joined #openstack-keystone | 01:36 | |
| *** su_zhang has quit IRC | 01:37 | |
| *** davechen has joined #openstack-keystone | 01:42 | |
| *** btully has quit IRC | 01:43 | |
| *** phalmos has quit IRC | 01:45 | |
| *** arunkant has quit IRC | 01:48 | |
| *** arunkant has joined #openstack-keystone | 01:48 | |
| *** tellesnobrega_af is now known as tellesnobrega | 01:48 | |
| *** tellesnobrega is now known as tellesnobrega_af | 01:49 | |
| samueldmq | jamielennox: to make that job pass, did you have some changes in tempest as well ? | 01:55 |
| samueldmq | jamielennox: (I am expecting you did) | 01:56 |
| *** bandwidth has joined #openstack-keystone | 01:57 | |
| *** bandwidth has quit IRC | 01:59 | |
| *** jerrygb has joined #openstack-keystone | 02:00 | |
| *** browne has joined #openstack-keystone | 02:01 | |
| openstackgerrit | lei zhang proposed openstack/keystone: Update sample catalog templates https://review.openstack.org/218711 | 02:07 |
| *** woodster_ has quit IRC | 02:09 | |
| jamielennox | samueldmq: there were some changes in tempest but they should all be done now | 02:10 |
| *** dims has quit IRC | 02:13 | |
| *** jbell8 has joined #openstack-keystone | 02:13 | |
| *** topol has joined #openstack-keystone | 02:25 | |
| *** ChanServ sets mode: +v topol | 02:25 | |
| *** chlong has quit IRC | 02:25 | |
| *** flwang has quit IRC | 02:30 | |
| *** chlong has joined #openstack-keystone | 02:31 | |
| *** flwang has joined #openstack-keystone | 02:31 | |
| *** btully has joined #openstack-keystone | 02:31 | |
| samueldmq | jamielennox: yep, just wanted to check, thanks | 02:32 |
| jamielennox | so best i can tell keystone is broken using an admin_token? | 02:32 |
| jamielennox | that can't be right, devstack must do something there | 02:32 |
| samueldmq | jamielennox: what is that ? | 02:33 |
| samueldmq | jamielennox: admin_token bypass all the checks, using is_admin:1 in the policies, is that , | 02:33 |
| samueldmq | ? | 02:33 |
| jamielennox | there is a part of the standard path that is trying to fetch the token dictionary from the context and fails if it's not present | 02:33 |
| jamielennox | but in the admin_token case this information is not populated | 02:33 |
| jamielennox | so i see | 02:34 |
| jamielennox | 2015-11-04 02:30:55.386036 2015-11-04 02:30:55.385 4783 WARNING keystone.common.utils [req-9a2e2a03-ee52-4502-b074-4b527086487f - - - - -] Couldn't find the auth context. | 02:34 |
| jamielennox | 2015-11-04 02:30:55.388632 2015-11-04 02:30:55.387 4783 WARNING keystone.common.wsgi [req-9a2e2a03-ee52-4502-b074-4b527086487f - - - - -] Authorization failed. The request you have made requires authentication. | 02:34 |
| samueldmq | jamielennox: yeah, admin_token contains no context, it should simply get authorized all the time | 02:34 |
| *** jbell8 has quit IRC | 02:35 | |
| samueldmq | jamielennox: that's weird we don't test that anywhere. probably going to be in functional tests | 02:36 |
| samueldmq | maybe tempest was supposed to test that | 02:36 |
| jamielennox | ah, no i found it | 02:37 |
| jamielennox | so if you don't specify domain parameters for certain create calls like openstack user create then it tries to put them in the same domain as your current scope | 02:38 |
| jamielennox | in the ADMIN token case we don't have a scope | 02:38 |
| jamielennox | and it fails out as unauthorized | 02:38 |
| openstackgerrit | zouyee proposed openstack/keystone: get_user_roles in RoleAssignmentV2 to resolve KeyError https://review.openstack.org/237658 | 02:38 |
| openstackgerrit | Tony Wang proposed openstack/keystone: add `type' filter for list_credentials_for_user https://review.openstack.org/235214 | 02:39 |
| openstackgerrit | zouyee proposed openstack/keystone: get_user_roles in RoleAssignmentV2 to resolve KeyError https://review.openstack.org/237658 | 02:41 |
| *** chlong has quit IRC | 02:42 | |
| *** markvoelker has joined #openstack-keystone | 02:43 | |
| samueldmq | jamielennox: maybe it'd be better to fail with bad request ? or something more accurate ? | 02:46 |
| *** markvoelker has quit IRC | 02:48 | |
| openstackgerrit | Merged openstack/keystone: update mailmap with gyee's new email https://review.openstack.org/241413 | 02:48 |
| jamielennox | samueldmq: yea, i mean there could just be a debug helper there that says if is_admin and 'token' not in context['KEYSTONE_AUTH_CONTEXT'] provide a better message | 02:50 |
| jamielennox | i can probably fix that real quick | 02:50 |
| jamielennox | ah there is a bug and an attempted fix | 02:52 |
| samueldmq | :( | 02:59 |
| samueldmq | jamielennox: BTW, see https://review.openstack.org/#/c/241452/ | 02:59 |
| samueldmq | jamielennox: for making the jobs non-voting in both devstack and tempest (where they exist as experimental today) | 03:00 |
| jamielennox | samueldmq: looks reasonable, but i'm not very good with the infra reviews | 03:01 |
| samueldmq | jamielennox: me neither, I can do changes by learning with code that is around and behave similarly | 03:03 |
| samueldmq | jamielennox: I added you as reviewer so you can follow that patch :) | 03:03 |
| samueldmq | jamielennox: tomorrow I will try to get mtreinish's opinion on making them non-voting + some reviews from infra experts ( andreaf helped me a the time I created that first gate ) | 03:04 |
| jamielennox | probably better off asking in -infra | 03:05 |
| jamielennox | mtreinish and andreaf might know but they are more on the tempest side of things | 03:05 |
| jamielennox | i doubt they would have any concerns with getting the job voting as i know andreaf has put a lot of work into that | 03:06 |
| samueldmq | nice | 03:06 |
| samueldmq | having their +1 there will give infra folks confidence to approve that | 03:07 |
| samueldmq | and I will ask -infra folks directly tomorrow too | 03:07 |
| * samueldmq is going to hit the sack | 03:07 | |
| samueldmq | jamielennox: see you | 03:08 |
| jamielennox | samueldmq: night | 03:08 |
| openstackgerrit | Merged openstack/keystone: Revert "Added CORS support to Keystone" https://review.openstack.org/241316 | 03:10 |
| *** sileht has joined #openstack-keystone | 03:19 | |
| *** jmccrory has quit IRC | 03:23 | |
| *** dims has joined #openstack-keystone | 03:33 | |
| *** spandhe has quit IRC | 03:36 | |
| *** jamielennox is now known as jamielennox|away | 03:38 | |
| *** jamielennox|away is now known as jamielennox | 03:40 | |
| *** topol has quit IRC | 03:42 | |
| *** mylu has quit IRC | 03:51 | |
| *** mylu has joined #openstack-keystone | 03:53 | |
| *** mylu has quit IRC | 03:55 | |
| *** su_zhang has joined #openstack-keystone | 03:58 | |
| *** mylu has joined #openstack-keystone | 03:59 | |
| *** mylu has quit IRC | 04:01 | |
| *** mylu has joined #openstack-keystone | 04:01 | |
| *** dims has quit IRC | 04:03 | |
| *** mylu has quit IRC | 04:06 | |
| *** jbell8 has joined #openstack-keystone | 04:08 | |
| *** hrou has quit IRC | 04:08 | |
| *** bapalm_ has joined #openstack-keystone | 04:10 | |
| *** kragniz_ has joined #openstack-keystone | 04:10 | |
| *** gus_ has joined #openstack-keystone | 04:10 | |
| *** flwang has quit IRC | 04:11 | |
| *** RA_ has quit IRC | 04:11 | |
| *** mjb has quit IRC | 04:11 | |
| *** browne has quit IRC | 04:11 | |
| *** bapalm has quit IRC | 04:11 | |
| *** errr has quit IRC | 04:11 | |
| *** ryanpetrello has quit IRC | 04:11 | |
| *** gus has quit IRC | 04:11 | |
| *** kragniz has quit IRC | 04:11 | |
| *** mylu has joined #openstack-keystone | 04:12 | |
| *** roxanaghe has quit IRC | 04:13 | |
| *** ryanpetrello has joined #openstack-keystone | 04:15 | |
| *** mjb has joined #openstack-keystone | 04:15 | |
| *** browne has joined #openstack-keystone | 04:15 | |
| *** gus_ is now known as gus | 04:18 | |
| *** errr has joined #openstack-keystone | 04:24 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Split ADFS and SAML2 plugins https://review.openstack.org/241081 | 04:26 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: SAML2 authentication plugins in keystoneauth https://review.openstack.org/238549 | 04:26 |
| *** boris-42 has quit IRC | 04:28 | |
| *** chlong has joined #openstack-keystone | 04:33 | |
| openstackgerrit | Merged openstack/keystone: Capitalize a Few Words https://review.openstack.org/240290 | 04:38 |
| *** jmccrory has joined #openstack-keystone | 04:44 | |
| *** markvoelker has joined #openstack-keystone | 04:44 | |
| *** chlong has quit IRC | 04:45 | |
| openstackgerrit | Merged openstack/keystoneauth: Declare an extras directory for plugins https://review.openstack.org/241055 | 04:46 |
| *** chlong has joined #openstack-keystone | 04:49 | |
| *** markvoelker has quit IRC | 04:49 | |
| *** su_zhang has quit IRC | 04:52 | |
| *** daemontool has quit IRC | 04:53 | |
| *** daemontool has joined #openstack-keystone | 04:54 | |
| *** btully has quit IRC | 04:57 | |
| *** links has joined #openstack-keystone | 05:02 | |
| *** chlong has quit IRC | 05:10 | |
| openstackgerrit | Merged openstack/keystoneauth: Correct references in authentication-plugin.rst https://review.openstack.org/241229 | 05:11 |
| *** fangzhou_ has joined #openstack-keystone | 05:13 | |
| *** fangzhou has quit IRC | 05:14 | |
| *** fangzhou_ is now known as fangzhou | 05:14 | |
| *** fangzhou has quit IRC | 05:17 | |
| *** kragniz_ is now known as kragniz | 05:18 | |
| *** jraju has joined #openstack-keystone | 05:36 | |
| *** links has quit IRC | 05:37 | |
| *** jaosorior has joined #openstack-keystone | 05:40 | |
| *** btully has joined #openstack-keystone | 05:41 | |
| *** ajaya has joined #openstack-keystone | 05:41 | |
| *** ramishra has quit IRC | 05:46 | |
| *** ramishra has joined #openstack-keystone | 05:46 | |
| *** topol has joined #openstack-keystone | 05:54 | |
| *** ChanServ sets mode: +v topol | 05:54 | |
| *** topol has quit IRC | 05:58 | |
| *** jerrygb has quit IRC | 06:01 | |
| *** jasonsb has joined #openstack-keystone | 06:04 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Zanata https://review.openstack.org/238789 | 06:10 |
| *** jraju has quit IRC | 06:15 | |
| openstackgerrit | zouyee proposed openstack/keystone: get_user_roles in RoleAssignmentV2 to resolve KeyError https://review.openstack.org/237658 | 06:26 |
| *** wanghua_ has quit IRC | 06:27 | |
| *** wanghua has joined #openstack-keystone | 06:27 | |
| openstackgerrit | zouyee proposed openstack/keystone: get_user_roles in RoleAssignmentV2 to resolve KeyError https://review.openstack.org/237658 | 06:31 |
| *** lhcheng has joined #openstack-keystone | 06:36 | |
| *** ChanServ sets mode: +v lhcheng | 06:36 | |
| *** tobberydberg has joined #openstack-keystone | 06:37 | |
| *** sawangpongm has joined #openstack-keystone | 06:39 | |
| *** e0ne has joined #openstack-keystone | 06:40 | |
| *** links has joined #openstack-keystone | 06:42 | |
| *** sawangpongm has quit IRC | 06:44 | |
| *** markvoelker has joined #openstack-keystone | 06:45 | |
| *** sawangpongm has joined #openstack-keystone | 06:46 | |
| *** sawangpongm has quit IRC | 06:48 | |
| *** markvoelker has quit IRC | 06:49 | |
| *** e0ne has quit IRC | 06:50 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Change `region` to `region_id` for endpoint reference https://review.openstack.org/167534 | 06:51 |
| *** freerunner has quit IRC | 06:51 | |
| *** sawangpongm has joined #openstack-keystone | 06:53 | |
| *** freerunner has joined #openstack-keystone | 06:53 | |
| *** sawangpongm has left #openstack-keystone | 06:53 | |
| *** GB21_ has joined #openstack-keystone | 06:55 | |
| *** GB21 has joined #openstack-keystone | 06:55 | |
| *** tobberyd_ has joined #openstack-keystone | 06:56 | |
| *** gildub has quit IRC | 06:58 | |
| *** tobberydberg has quit IRC | 06:59 | |
| *** GB21 has quit IRC | 07:00 | |
| *** markvoelker has joined #openstack-keystone | 07:00 | |
| *** jamielennox is now known as jamielennox|away | 07:02 | |
| *** josecastroleon has joined #openstack-keystone | 07:02 | |
| *** lsmola has joined #openstack-keystone | 07:03 | |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/keystone: Use the oslo.utils.reflection to extract the class name https://review.openstack.org/241494 | 07:04 |
| *** GB21_ is now known as GB21 | 07:05 | |
| *** markvoelker has quit IRC | 07:05 | |
| *** tsufiev has quit IRC | 07:12 | |
| *** tsufiev has joined #openstack-keystone | 07:12 | |
| *** dobson has quit IRC | 07:27 | |
| *** cloudnull has quit IRC | 07:27 | |
| *** jamiec has quit IRC | 07:27 | |
| *** urulama has joined #openstack-keystone | 07:32 | |
| *** cloudkiller has joined #openstack-keystone | 07:36 | |
| *** dobson has joined #openstack-keystone | 07:40 | |
| *** ktychkova has quit IRC | 07:44 | |
| *** ktychkova has joined #openstack-keystone | 07:45 | |
| *** mylu has quit IRC | 07:45 | |
| *** jerrygb has joined #openstack-keystone | 07:47 | |
| davechen | henrynash: ping? | 07:49 |
| davechen | henrynash: let me see if i am lucky to catch you at this time. :) | 07:50 |
| *** jerrygb has quit IRC | 07:52 | |
| *** jbell8 has quit IRC | 07:52 | |
| *** jbell8 has joined #openstack-keystone | 07:57 | |
| *** tobberyd_ has quit IRC | 07:58 | |
| *** jaosorior has quit IRC | 08:00 | |
| *** lhcheng has quit IRC | 08:00 | |
| *** jaosorior has joined #openstack-keystone | 08:01 | |
| *** jaosorior has quit IRC | 08:01 | |
| *** jaosorior has joined #openstack-keystone | 08:02 | |
| *** Nirupama has joined #openstack-keystone | 08:04 | |
| *** kodokuu has joined #openstack-keystone | 08:07 | |
| kodokuu | Hi, I have issue with keystone when I use ec2 credential. Keystone return me bad signature. Anyone have fix or idea ? | 08:08 |
| kodokuu | Or someone know what is the URI is taken for test signature | 08:15 |
| davechen | kodokuu: what's the URI do you mean here? | 08:20 |
| *** btully has quit IRC | 08:24 | |
| *** Nirupama has quit IRC | 08:26 | |
| kodokuu | davechen For generate ec2 credential, we need accesskey, secretkey and an URI no ? | 08:27 |
| *** cloudkiller is now known as cloudnull | 08:28 | |
| davechen | kodokuu: for the easier way, you can just use openstack cli to generate the ec credential | 08:29 |
| kodokuu | davechen I can generate signature ? | 08:32 |
| *** wanghua has quit IRC | 08:33 | |
| *** wanghua has joined #openstack-keystone | 08:33 | |
| kodokuu | davechen because my issue is the url generate by heat pour scalinggroup not work because keystone say wrong signature | 08:34 |
| kodokuu | for scalinggroup | 08:34 |
| *** josecastroleon has quit IRC | 08:34 | |
| davechen | kodokuu: so, do you have your ec2 credentails created at the first? all you need is to create ec2 credentail is accesskey and secretkey. | 08:35 |
| kodokuu | davechen heat create ec2 for me | 08:36 |
| kodokuu | davechen I check with V3 API, ec2 credential is created. But the issue is when keystone check signature | 08:37 |
| davechen | kodokuu: i guess the url you metioned is what you want to generate the signature from. | 08:37 |
| *** Guest98556 is now known as d0ugal | 08:37 | |
| *** d0ugal has quit IRC | 08:38 | |
| *** d0ugal has joined #openstack-keystone | 08:38 | |
| davechen | kodokuu: i have no idea how heat did those. | 08:38 |
| davechen | kodokuu: this is where the check logic is given: https://github.com/openstack/keystone/blob/master/keystone/contrib/ec2/controllers.py#L56 | 08:40 |
| kodokuu | thx | 08:42 |
| kodokuu | davechen I have that Invalid EC2 signature | 08:42 |
| kodokuu | davechen so "signature = signer.generate(credentials)" this is where keystone generate signature | 08:43 |
| kodokuu | and keystone check with utils.auth_str_equal | 08:43 |
| davechen | you properly need dig into the code to see what happened there, it's around the L77 where you will see "Invalid EC2 signature" | 08:44 |
| kodokuu | I need to see signature variable :) | 08:44 |
| kodokuu | I'am not a dev but I need to copy signature variable to a file | 08:45 |
| kodokuu | davechen where can I find ec2_utils for see generate function ? | 08:46 |
| davechen | it's from keystone cient. | 08:47 |
| kodokuu | ok | 08:47 |
| davechen | without debugging in your env, i think it's hard to detect what's going wrong. | 08:48 |
| *** josecastroleon has joined #openstack-keystone | 08:49 | |
| davechen | it's here: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/contrib/ec2/utils.py | 08:49 |
| kodokuu | I find genrate https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/contrib/ec2/utils.py#L142 | 08:49 |
| kodokuu | yeah ;) | 08:49 |
| kodokuu | I need to find where keystone call check_signature for see credential params | 08:51 |
| davechen | here are read some testcase i wrote long time ago, hope it will helpful: https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_contrib_ec2.py, you will see how we check_signature, generate signature. | 08:52 |
| kodokuu | ok thx I'll read it | 08:52 |
| kodokuu | davechen For test, I add return True to https://github.com/openstack/keystone/blob/master/keystone/contrib/ec2/controllers.py#L74 | 08:56 |
| kodokuu | For accept all signature | 08:56 |
| *** fhubik has joined #openstack-keystone | 08:56 | |
| kodokuu | but no works^^ | 08:57 |
| davechen | kodokuu: cool! so, all you need is someway to workaround? | 08:57 |
| kodokuu | davechen I have always Invalid EC2 signature. Strange.... | 08:57 |
| kodokuu | If I add return True before If for compar signature, all signature is good no ? | 08:58 |
| davechen | try to restart your keystone service. | 08:59 |
| kodokuu | ok | 08:59 |
| *** e0ne has joined #openstack-keystone | 08:59 | |
| kodokuu | And if I want to Log a variable without warning or exception do you have a fucntion ? | 09:00 |
| *** pnavarro has joined #openstack-keystone | 09:00 | |
| *** markvoelker has joined #openstack-keystone | 09:01 | |
| kodokuu | davechen same error after restart service :/ | 09:02 |
| kodokuu | I add return True to first line of function :p | 09:02 |
| davechen | you should import log, if you just want to see the value of the varaiable you can just print it. | 09:03 |
| kodokuu | where python print ? | 09:03 |
| kodokuu | in log ? | 09:03 |
| davechen | sys lib, so you needn't import anyting. | 09:03 |
| kodokuu | ok | 09:04 |
| *** fhubik is now known as fhubik_brb | 09:05 | |
| *** markvoelker has quit IRC | 09:06 | |
| *** jistr has joined #openstack-keystone | 09:08 | |
| kodokuu | I add print now I search the print ;:p | 09:09 |
| kodokuu | davechen I'am on centos, do you know where I can find the result of print command ? | 09:12 |
| kodokuu | ok find /var/log/httpd/keystone_wsgi_main_error.log | 09:15 |
| kodokuu | OMG davechen I found BUG | 09:19 |
| davechen | :-D | 09:19 |
| kodokuu | look the print | 09:19 |
| kodokuu | signer: FTh0hLTk3PnH18YTTBDm88 e1DlnUR4kkiSK rLEDMo= signature: FTh0hLTk3PnH18YTTBDm88+e1DlnUR4kkiSK+rLEDMo= | 09:19 |
| kodokuu | Why I have space ? | 09:19 |
| davechen | i think it's the bug from heat. | 09:19 |
| davechen | they are different signature per my undestanding. | 09:20 |
| kodokuu | hum | 09:20 |
| kodokuu | with new test | 09:20 |
| kodokuu | signer: tEnIPQxhbDlcR1MIuQCyzZ92UtHrDcVITlG/rWfqPQA= signature: FTh0hLTk3PnH18YTTBDm88+e1DlnUR4kkiSK+rLEDMo= | 09:20 |
| kodokuu | So heat send not good signature | 09:20 |
| kodokuu | or keystone generate not a good signature | 09:20 |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/keystone: Use the oslo.utils.reflection to extract the class name https://review.openstack.org/241494 | 09:21 |
| *** fhubik_brb is now known as fhubik | 09:22 | |
| *** fhubik is now known as fhubik_brb | 09:22 | |
| davechen | i remember you told me heat generate ec2 credentaials, if they are treated as equal it will keystone's bug. :) | 09:22 |
| davechen | good catch! | 09:22 |
| kodokuu | davechen I force signature and I have signer: FTh0hLTk3PnH18YTTBDm88+e1DlnUR4kkiSK+rLEDMo= signature: FTh0hLTk3PnH18YTTBDm88+e1DlnUR4kkiSK+rLEDMo= | 09:24 |
| kodokuu | So this is equal | 09:24 |
| kodokuu | but keystone end always User is not authorized to perform action | 09:24 |
| kodokuu | send* | 09:25 |
| davechen | User is not authorized to perform action is properly anthoer issue. | 09:25 |
| kodokuu | hum sorry it's heat error. I have always Invalid EC2 signature. | 09:27 |
| kodokuu | So I fail here ==> if utils.auth_str_equal(credentials['signature'],signature): | 09:28 |
| kodokuu | But I Print ==> print "signer: %s signature: %s" % (credentials['signature'],signature) | 09:28 |
| kodokuu | and it's same string O_o | 09:28 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Get user role without project id is not implemented https://review.openstack.org/237658 | 09:28 |
| *** GB21 has quit IRC | 09:33 | |
| *** LukeHinds has joined #openstack-keystone | 09:34 | |
| *** browne has quit IRC | 09:37 | |
| *** fhubik_brb is now known as fhubik | 09:39 | |
| davechen | kodokuu: Good luck! i need back home now. | 09:42 |
| davechen | kodokuu: ask someone beside you who understand python will be helpful :) | 09:42 |
| *** davechen has left #openstack-keystone | 09:44 | |
| *** placeed has joined #openstack-keystone | 09:45 | |
| placeed | Hi all, every 5 minute when i start to interact with keystone, it doesn't answere. When i restart it, everything work fine for few minutes and then he don't answere again | 09:47 |
| *** aix has joined #openstack-keystone | 09:48 | |
| placeed | In client side, it look like he wait for a timeout | 09:48 |
| placeed | I see nothing bad in logs, someone can help me please ? | 09:48 |
| *** gildub has joined #openstack-keystone | 09:49 | |
| *** jgriffith has quit IRC | 09:50 | |
| *** jgriffith has joined #openstack-keystone | 09:51 | |
| *** jgriffith is now known as Guest90242 | 09:51 | |
| *** alex_xu has quit IRC | 09:54 | |
| *** jamielennox|away is now known as jamielennox | 09:55 | |
| *** alex_xu has joined #openstack-keystone | 09:57 | |
| *** kodokuu has quit IRC | 10:03 | |
| placeed | It seem that the problem is on /auth/tokens? | 10:04 |
| *** urulama has quit IRC | 10:06 | |
| *** urulama has joined #openstack-keystone | 10:06 | |
| *** samueldmq has quit IRC | 10:13 | |
| *** samueldmq has joined #openstack-keystone | 10:15 | |
| *** alex_xu has quit IRC | 10:23 | |
| *** alex_xu has joined #openstack-keystone | 10:24 | |
| *** gildub has quit IRC | 10:37 | |
| *** pgbridge has quit IRC | 10:42 | |
| *** wanghua has quit IRC | 10:42 | |
| *** wanghua has joined #openstack-keystone | 10:43 | |
| *** fhubik is now known as fhubik_brb | 10:45 | |
| *** ajaya has quit IRC | 10:45 | |
| *** jistr_ has joined #openstack-keystone | 10:48 | |
| *** jistr has quit IRC | 10:48 | |
| *** fhubik_brb has quit IRC | 10:49 | |
| *** khomkrit has joined #openstack-keystone | 10:50 | |
| *** daemontool has quit IRC | 10:51 | |
| *** jistr_ has quit IRC | 10:53 | |
| *** markvoelker has joined #openstack-keystone | 11:02 | |
| *** jistr_ has joined #openstack-keystone | 11:05 | |
| *** markvoelker has quit IRC | 11:06 | |
| *** akanksha_ has joined #openstack-keystone | 11:11 | |
| *** GB21 has joined #openstack-keystone | 11:20 | |
| *** topol has joined #openstack-keystone | 11:22 | |
| *** ChanServ sets mode: +v topol | 11:22 | |
| *** topol has quit IRC | 11:26 | |
| *** josecastroleon has quit IRC | 11:31 | |
| *** jaosorior has quit IRC | 11:40 | |
| *** jaosorior has joined #openstack-keystone | 11:41 | |
| *** aix has quit IRC | 11:41 | |
| *** GB21 has quit IRC | 11:45 | |
| *** jaosorior has quit IRC | 11:49 | |
| *** jaosorior has joined #openstack-keystone | 11:50 | |
| *** ayoung has quit IRC | 11:50 | |
| *** GB21 has joined #openstack-keystone | 11:51 | |
| *** henrynash has quit IRC | 11:58 | |
| *** tellesnobrega_af is now known as tellesnobrega | 12:00 | |
| *** ayoung has joined #openstack-keystone | 12:03 | |
| *** ChanServ sets mode: +v ayoung | 12:03 | |
| *** daemontool has joined #openstack-keystone | 12:03 | |
| *** pgreg has joined #openstack-keystone | 12:06 | |
| *** ericksonsantos has quit IRC | 12:08 | |
| *** ericksonsantos has joined #openstack-keystone | 12:09 | |
| *** pgreg has quit IRC | 12:13 | |
| *** aix has joined #openstack-keystone | 12:13 | |
| *** wasmum has quit IRC | 12:14 | |
| *** markvoelker has joined #openstack-keystone | 12:17 | |
| *** dims has joined #openstack-keystone | 12:18 | |
| *** tellesnobrega is now known as tellesnobrega_af | 12:19 | |
| *** markvoelker has quit IRC | 12:22 | |
| *** hrou has joined #openstack-keystone | 12:26 | |
| *** placeed has quit IRC | 12:26 | |
| *** EinstCrazy has joined #openstack-keystone | 12:30 | |
| *** gordc has joined #openstack-keystone | 12:30 | |
| *** kodokuu has joined #openstack-keystone | 12:31 | |
| *** tellesnobrega_af is now known as tellesnobrega | 12:32 | |
| *** hrou has quit IRC | 12:39 | |
| *** sawangpongm has joined #openstack-keystone | 12:39 | |
| *** josecastroleon has joined #openstack-keystone | 12:40 | |
| *** sawangpongm has left #openstack-keystone | 12:40 | |
| *** dims has quit IRC | 12:43 | |
| *** chlong has joined #openstack-keystone | 12:43 | |
| *** jistr_ is now known as jistr | 12:44 | |
| *** wanghua has quit IRC | 12:45 | |
| *** wanghua has joined #openstack-keystone | 12:46 | |
| *** GB21 has quit IRC | 12:48 | |
| *** jamielennox is now known as jamielennox|away | 12:48 | |
| *** wasmum has joined #openstack-keystone | 12:50 | |
| *** fhubik_brb has joined #openstack-keystone | 12:54 | |
| *** daemontool has quit IRC | 12:57 | |
| *** daemontool has joined #openstack-keystone | 12:57 | |
| *** dobson has quit IRC | 13:00 | |
| *** chlong has quit IRC | 13:01 | |
| *** chlong has joined #openstack-keystone | 13:02 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Get user role without project id is not implemented https://review.openstack.org/237658 | 13:03 |
| *** urulama has quit IRC | 13:07 | |
| *** urulama has joined #openstack-keystone | 13:07 | |
| *** pnavarro has quit IRC | 13:07 | |
| *** dims has joined #openstack-keystone | 13:09 | |
| *** petertr7_away is now known as petertr7 | 13:18 | |
| *** pauloewerton has joined #openstack-keystone | 13:19 | |
| *** evrardjp has left #openstack-keystone | 13:19 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Tests for projects acting as domains https://review.openstack.org/211219 | 13:20 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 13:20 |
| *** dims has quit IRC | 13:20 | |
| *** markvoelker has joined #openstack-keystone | 13:23 | |
| *** xek has joined #openstack-keystone | 13:25 | |
| *** jvarlamova_ has joined #openstack-keystone | 13:29 | |
| *** kodokuu has quit IRC | 13:33 | |
| *** su_zhang has joined #openstack-keystone | 13:33 | |
| *** edmondsw has joined #openstack-keystone | 13:34 | |
| *** links has quit IRC | 13:41 | |
| marekd | jamielennox|away: so here https://review.openstack.org/#/c/238549/8/setup.cfg saml2 plugins are not listed - is it because you are going to do some sort of private stuff ? | 13:44 |
| marekd | _saml2 etc | 13:44 |
| *** fhubik_brb is now known as fhubik | 13:47 | |
| *** placeed has joined #openstack-keystone | 13:49 | |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: Unit test for checking that migrations don't cause downtime https://review.openstack.org/241603 | 13:49 |
| placeed | Hi all ! I have an issue with keystone ... Someone can help me ? | 13:49 |
| placeed | Sometime the services stop to get token and stay blocked on keystone.common.wsgi [-] POST /auth/tokens? | 13:49 |
| placeed | I tried with apache wsgi or keystone wsgi and i get the same issue | 13:50 |
| placeed | If i restart keystone, the service work again ... but few minutes after, same issue | 13:50 |
| *** henrynash has joined #openstack-keystone | 13:54 | |
| *** ChanServ sets mode: +v henrynash | 13:54 | |
| *** henrynash has quit IRC | 13:54 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain in token response https://review.openstack.org/197331 | 13:54 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change policy to comply with is_domain in token https://review.openstack.org/206063 | 13:54 |
| *** hrou has joined #openstack-keystone | 13:56 | |
| placeed | Someone can help me ? | 14:00 |
| *** richm has joined #openstack-keystone | 14:02 | |
| marekd | placeed: anything in the logs ? | 14:02 |
| marekd | where does it hang? | 14:02 |
| marekd | just..no reponse? | 14:02 |
| marekd | what tokens are you using? uuid, pki, fernet? | 14:03 |
| dstanek | placeed: what do you mean blocked? | 14:03 |
| placeed | it seem it hang | 14:05 |
| dstanek | you don't get any response back to the client? | 14:05 |
| placeed | the client "for example openstack endpoint list" wait | 14:05 |
| placeed | nop | 14:05 |
| placeed | it stay waiting | 14:05 |
| placeed | Token = uuid | 14:06 |
| dstanek | does it print a timeout message? | 14:06 |
| dstanek | what happens when you use curl directly? | 14:06 |
| placeed | No, but after few minute the service is available again | 14:07 |
| placeed | It stay blocked with curl too | 14:07 |
| placeed | It look like big hang on keystone services | 14:07 |
| *** fhubik is now known as fhubik_brb | 14:07 | |
| *** fhubik_brb is now known as fhubik | 14:07 | |
| placeed | dstanek : did u already see such issue ? | 14:09 |
| *** jsavak has joined #openstack-keystone | 14:10 | |
| dstanek | placeed: no, I've never seen it | 14:13 |
| dstanek | Did you try curl? I'm interested to know what it sees | 14:14 |
| dstanek | Also, do other requests work when tokens appear to be blocking? | 14:14 |
| placeed | another stange issue now | 14:15 |
| placeed | openstack endpoint list work fine | 14:15 |
| placeed | openstack server list stay blocked | 14:15 |
| *** miguelgrinberg has quit IRC | 14:17 | |
| dstanek | try using curl on the blocked calk | 14:17 |
| *** links has joined #openstack-keystone | 14:17 | |
| *** gds has joined #openstack-keystone | 14:18 | |
| placeed | Can't find the url | 14:18 |
| *** pgbridge has joined #openstack-keystone | 14:18 | |
| *** miguelgrinberg has joined #openstack-keystone | 14:19 | |
| placeed | http://paste.ofcode.org/37QEqgSXRysWYLCFQdEE6UB | 14:19 |
| placeed | it seem to work with curl | 14:20 |
| *** jvarlamova_ has joined #openstack-keystone | 14:21 | |
| *** topol has joined #openstack-keystone | 14:23 | |
| *** ChanServ sets mode: +v topol | 14:23 | |
| dstanek | placeed: so while the client doesn't return to the shell, a curl worked? | 14:25 |
| dstanek | placeed: I'm on my phone so I'm a little slow | 14:25 |
| placeed | dstanek : No problem ... I m not sure because "openstack endpoint list" work fine while "openstack server list" don't work | 14:27 |
| *** phalmos has joined #openstack-keystone | 14:27 | |
| placeed | Can't understand why ... There is no logic | 14:27 |
| placeed | This is the output when it don't work (server list on this case) http://paste.ofcode.org/Q7rMVi8WYh7HAJYpFDeqCD | 14:27 |
| dstanek | When you say that it doesn't work, what exactly are you seeing from the client? | 14:28 |
| *** jerrygb has joined #openstack-keystone | 14:28 | |
| dstanek | When you say that it doesn't work, what exactly are you seeing from the client? | 14:29 |
| *** mhu has joined #openstack-keystone | 14:29 | |
| placeed | Nothing | 14:29 |
| placeed | it still waiting | 14:29 |
| *** phalmos has quit IRC | 14:29 | |
| dstanek | So it doesn't return to the shell? | 14:29 |
| placeed | nop | 14:29 |
| placeed | He wait for /auth/tokens i think | 14:30 |
| *** urulama has quit IRC | 14:30 | |
| *** urulama has joined #openstack-keystone | 14:31 | |
| *** su_zhang has quit IRC | 14:33 | |
| *** phalmos has joined #openstack-keystone | 14:33 | |
| marekd | placeed: do you have access to logs in the server? | 14:34 |
| placeed | yes | 14:34 |
| marekd | placeed: anything suspicous? | 14:34 |
| placeed | no ... i only see that he stay blocked on INFO eventlet.wsgi.server [-] 10.10.25.21 - - [04/Nov/2015 15:34:04] "GET /v3/auth/tokens HTTP/1.1" 200 2714 0.057018 | 14:34 |
| placeed | I disabled memcache but same issue | 14:35 |
| dstanek | Sounds like you may need to do a bit of debugging in the client | 14:35 |
| marekd | placeed: i would recommend checking the /auth/tokens with curl | 14:35 |
| marekd | placeed: and see if it behaves that way too | 14:35 |
| marekd | so you can narrow down the problem to either server or as dstanek says client. | 14:35 |
| dstanek | marekd: curling seemed to work while the client was broken | 14:36 |
| marekd | dstanek: placeed so create venv, install client and try with fresh version. | 14:37 |
| placeed | But sometime client work, sometime not | 14:37 |
| placeed | it depent of the client request | 14:37 |
| placeed | "openstack endpoint list" work fine while "openstack server list" don't work | 14:37 |
| *** pece has joined #openstack-keystone | 14:37 | |
| dstanek | Do you have caching on? | 14:37 |
| marekd | placeed: i suggest trying with fresh installation within say...venv so you can isolate | 14:37 |
| placeed | caching = memcache ? | 14:38 |
| placeed | I disabled it | 14:38 |
| placeed | driver read directly on sq | 14:38 |
| placeed | sql | 14:38 |
| *** topol has quit IRC | 14:40 | |
| *** jsavak has quit IRC | 14:41 | |
| *** jsavak has joined #openstack-keystone | 14:41 | |
| marekd | dolphm: do you have your profiling results somehere published? | 14:42 |
| placeed | No idea ? Only fresh install ? | 14:42 |
| marekd | placeed: no fresh install. | 14:42 |
| marekd | placeed: try fresh client. | 14:43 |
| *** openstackgerrit has quit IRC | 14:47 | |
| *** openstackgerrit has joined #openstack-keystone | 14:48 | |
| *** jaosorior has quit IRC | 14:51 | |
| *** links has quit IRC | 14:56 | |
| *** pnavarro has joined #openstack-keystone | 15:04 | |
| *** Ctina has joined #openstack-keystone | 15:05 | |
| *** GB21 has joined #openstack-keystone | 15:06 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: More useful message when using direct driver import https://review.openstack.org/241403 | 15:07 |
| *** pnavarro has quit IRC | 15:09 | |
| *** pumaranikar has joined #openstack-keystone | 15:13 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: More useful message when using direct driver import https://review.openstack.org/241403 | 15:13 |
| *** csoukup has joined #openstack-keystone | 15:18 | |
| *** placeed has quit IRC | 15:18 | |
| *** akanksha_ has quit IRC | 15:18 | |
| *** tellesnobrega is now known as tellesnobrega_af | 15:20 | |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: Unit test for checking that migrations don't cause downtime https://review.openstack.org/241603 | 15:20 |
| *** pnavarro has joined #openstack-keystone | 15:22 | |
| *** GB21 has quit IRC | 15:22 | |
| *** btully has joined #openstack-keystone | 15:22 | |
| *** jsavak has quit IRC | 15:27 | |
| *** Ctina is now known as ctina | 15:27 | |
| *** timcline has joined #openstack-keystone | 15:27 | |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: Unit test for checking that migrations don't cause downtime https://review.openstack.org/241603 | 15:28 |
| *** jsavak has joined #openstack-keystone | 15:28 | |
| *** tonytan4ever has joined #openstack-keystone | 15:30 | |
| *** slberger has joined #openstack-keystone | 15:30 | |
| *** dobson has joined #openstack-keystone | 15:31 | |
| *** jamiec has joined #openstack-keystone | 15:31 | |
| *** dobson has quit IRC | 15:31 | |
| *** dobson has joined #openstack-keystone | 15:33 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Adds a base class for functional tests https://review.openstack.org/203142 | 15:34 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Federation Identity Provider functional tests https://review.openstack.org/203258 | 15:35 |
| *** jsavak has quit IRC | 15:35 | |
| *** mylu has joined #openstack-keystone | 15:39 | |
| lbragstad | dolphm fyi, i pushed a new patch set - https://review.openstack.org/#/c/231191/ | 15:39 |
| *** zqfan_afk has joined #openstack-keystone | 15:40 | |
| *** jsavak has joined #openstack-keystone | 15:42 | |
| *** ayoung has quit IRC | 15:43 | |
| bknudson | lbragstad: "Lance Bradstag will be the new Docs liaison" -- hehe | 15:45 |
| *** ayoung has joined #openstack-keystone | 15:46 | |
| *** ChanServ sets mode: +v ayoung | 15:46 | |
| *** jsavak has quit IRC | 15:46 | |
| *** jsavak has joined #openstack-keystone | 15:47 | |
| lbragstad | bknudson I don't know who that is... | 15:50 |
| bknudson | he probably hangs out with that Nudson guy. | 15:50 |
| lbragstad | bknudson probably | 15:50 |
| lbragstad | bknudson that must mean the responsibility goes back to stevemar? | 15:51 |
| bknudson | spelling is important for the docs liaison, so might be a bad choice. | 15:52 |
| *** roxanaghe has joined #openstack-keystone | 15:55 | |
| *** topol has joined #openstack-keystone | 15:57 | |
| *** ChanServ sets mode: +v topol | 15:57 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Federation Identity Provider functional tests https://review.openstack.org/203258 | 15:58 |
| *** daemontool has quit IRC | 16:02 | |
| *** pnavarro has quit IRC | 16:02 | |
| *** phalmos has quit IRC | 16:03 | |
| *** chrisshattuck has joined #openstack-keystone | 16:05 | |
| *** lsmola has quit IRC | 16:05 | |
| openstackgerrit | Brian Elliott proposed openstack/keystone: Bump oslo.log to fix startup error https://review.openstack.org/241670 | 16:10 |
| bknudson | were we planning to remove any ldap drivers this release? | 16:14 |
| lbragstad | bknudson I know it came up a lot in the deprecations sessions | 16:14 |
| bknudson | we should do that before we work on switching to ldap3 | 16:14 |
| *** pnavarro has joined #openstack-keystone | 16:15 | |
| *** phalmos has joined #openstack-keystone | 16:16 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Handle fernet payload timestamp differences https://review.openstack.org/232711 | 16:27 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix fernet padding for python 3 https://review.openstack.org/231711 | 16:27 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix key_repository_signature method for python3 https://review.openstack.org/236096 | 16:27 |
| *** roxanaghe has quit IRC | 16:29 | |
| *** roxanaghe has joined #openstack-keystone | 16:30 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Handle fernet payload timestamp differences https://review.openstack.org/232711 | 16:30 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix fernet padding for python 3 https://review.openstack.org/231711 | 16:30 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix key_repository_signature method for python3 https://review.openstack.org/236096 | 16:30 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Bye Bye Domain Table https://review.openstack.org/161854 | 16:31 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Remove domain table references https://review.openstack.org/165936 | 16:31 |
| andrewbogott | ayoung: does policy.json only work with the v3 api? It looks like all the v2 calls just assert_admin right up top. | 16:36 |
| ayoung | andrewbogott, nope. The file http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.json was written for v2. | 16:37 |
| ayoung | V3 should work with both that one and an edited version of | 16:37 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json | 16:37 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Functional tests for federation mapping CRUD https://review.openstack.org/231574 | 16:38 |
| andrewbogott | ok, then what’s with the assert_admin calls? It seems like no matter what I set in my policy file, I’m foiled by the lack of adminship | 16:38 |
| ayoung | where you substitute in the value for admin domain idf | 16:38 |
| ayoung | gah | 16:38 |
| ayoung | I need an oversized keybaord for these fat fingers | 16:38 |
| andrewbogott | So, the policy file can change what is meant by ‘admin’ but I can’t actually allow non-admins to do things, is that right? | 16:39 |
| andrewbogott | An example of my confusion: I just added a reference to a non-existent rule: "identity:list_projects": "rule:waffle_required" | 16:41 |
| *** roxanaghe has quit IRC | 16:41 | |
| andrewbogott | When I hit that command (‘keystone tenant-list’) it succeeds, and the logs show an attempt to verify admin but no reference to waffle_required | 16:41 |
| bknudson | keystone CLI only uses v2 API, and the v2 api only uses the is_admin rule in policy.json | 16:43 |
| bknudson | it's not going to check identity:list_projects -- that's GET v3/projects | 16:43 |
| bknudson | see http://docs.openstack.org/developer/keystone/policy_mapping.html | 16:44 |
| bknudson | (technically, there are a couple of v2 apis that use different policy.json rules) | 16:44 |
| andrewbogott | bknudson: so when ayoung said that http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.json was written for v2… he meant just the first line? Everything else only applies to v3? | 16:44 |
| ayoung | Nope | 16:45 |
| bknudson | maybe he meant that it was written to work like v2? | 16:45 |
| ayoung | andrewbogott, is_admin is a rule, that is called in by the other rules | 16:45 |
| bknudson | it doesn't take advantage of some v3 features. | 16:45 |
| *** mylu has quit IRC | 16:45 | |
| bknudson | ... should be able to point to the code ... | 16:45 |
| ayoung | andrewbogott, so when you call ‘keystone tenant-list that calls into the python code and hits: | 16:46 |
| *** hrou has quit IRC | 16:46 | |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.json#n38 | 16:46 |
| ayoung | or the next line | 16:46 |
| ayoung | depending on how the client calls it | 16:46 |
| ayoung | "rule:admin_required", is resolved | 16:46 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.json#n2 as you know | 16:46 |
| ayoung | and the other | 16:46 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.json#n39 | 16:47 |
| ayoung | is admin_or_owner is resolved | 16:47 |
| andrewbogott | just to confirm… you and bknudson are disagreeing about how v2 works? | 16:47 |
| bknudson | Here's the v2 controller: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/resource/controllers.py#n40 | 16:47 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.json#n6 | 16:47 |
| ayoung | which is in turn either is_admikn as before or | 16:47 |
| ayoung | "owner" : "user_id:%(user_id)s", | 16:47 |
| ayoung | andrewbogott, I am saying how "policy" works | 16:47 |
| ayoung | not all of the V2 API is calling in to policy | 16:48 |
| *** phalmos has quit IRC | 16:48 | |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/resource/controllers.py#n41 | 16:48 |
| ayoung | does not | 16:48 |
| bknudson | it calls assert_admin which is http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/wsgi.py#n297 | 16:49 |
| bknudson | ayoung: get_all_projects calls self.assert_admin(context) | 16:49 |
| ayoung | bknudson, where is the List projects for user call? I thought that was v2 as well...has to be for the WebUI | 16:50 |
| andrewbogott | right, which I think is what I said before… the only part of policy.json that matters to the v2 api is the definition of admin. | 16:50 |
| andrewbogott | So — this has me back to being crippled until I upgrade to v3. | 16:50 |
| bknudson | ayoung: that would be in the v2 public controller ... I'll see if I can find it. | 16:51 |
| *** r-daneel has joined #openstack-keystone | 16:51 | |
| bknudson | (I mean router not controller) | 16:52 |
| *** phalmos has joined #openstack-keystone | 16:53 | |
| bknudson | ayoung: here it is: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/assignment/routers.py#n35 | 16:53 |
| bknudson | which is going to call http://git.openstack.org/cgit/openstack/keystone/tree/keystone/assignment/controllers.py#n43 | 16:54 |
| bknudson | which doesn't do any policy stuff | 16:54 |
| ayoung | andrewbogott, so, yeah, none of those use policy | 16:54 |
| ayoung | the fact that they were called "project" should have been a give-away | 16:54 |
| ayoung | Sorry bout that | 16:54 |
| bknudson | I can't remember if keystone tenant-list uses the public API or admin? | 16:54 |
| bknudson | maybe it depends on which endpoint you tell it to use. | 16:55 |
| *** daemontool has joined #openstack-keystone | 16:55 | |
| andrewbogott | and, do I recall correctly that I can’t use ldap assignment with v3? (I know I’m going in circles at this point.) | 16:55 |
| bknudson | I don't think we have a way to do domain role assignments using ldap. | 16:56 |
| andrewbogott | yep, ok | 16:56 |
| *** roxanaghe has joined #openstack-keystone | 16:56 | |
| bknudson | I think we can do group role assignments ... not sure if it was implemented. | 16:57 |
| *** gyee has joined #openstack-keystone | 16:57 | |
| *** ChanServ sets mode: +v gyee | 16:57 | |
| bknudson | user role assignments must work. | 16:57 |
| *** hrou has joined #openstack-keystone | 16:57 | |
| ayoung | andrewbogott, so, if users are in LDAP, but assignments are in SQL, you can assign. I think actually LDAP assignment will work with V3 as well, so long as everythign is in the default domain, but I would not be surprised if we broke that | 16:57 |
| *** su_zhang has joined #openstack-keystone | 16:57 | |
| bknudson | I should have said group role assignments on projects and user role assignments on projects above. | 16:58 |
| andrewbogott | I think my list of bugs-blocking-other-bugs is about to become a cyclic graph :) | 16:59 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Restricting domain_id update https://review.openstack.org/207218 | 16:59 |
| *** petertr7 is now known as petertr7_away | 16:59 | |
| andrewbogott | I definitely only have one domain, so maybe it’s worth a try. | 17:01 |
| *** rodrigods has left #openstack-keystone | 17:02 | |
| *** rodrigods has joined #openstack-keystone | 17:02 | |
| *** pumaranikar has quit IRC | 17:03 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Merge keystone.config into keystone.common.config https://review.openstack.org/237209 | 17:05 |
| *** pnavarro has quit IRC | 17:05 | |
| *** tellesnobrega_af is now known as tellesnobrega | 17:06 | |
| *** jistr has quit IRC | 17:08 | |
| *** su_zhang has quit IRC | 17:10 | |
| *** urulama has quit IRC | 17:10 | |
| *** ctina has quit IRC | 17:11 | |
| *** urulama has joined #openstack-keystone | 17:11 | |
| *** ctina has joined #openstack-keystone | 17:11 | |
| *** Ephur has quit IRC | 17:13 | |
| *** r-daneel has quit IRC | 17:26 | |
| *** e0ne has quit IRC | 17:27 | |
| *** r-daneel has joined #openstack-keystone | 17:27 | |
| *** doug-fish has joined #openstack-keystone | 17:33 | |
| *** shaleh has joined #openstack-keystone | 17:33 | |
| *** daemontool has quit IRC | 17:36 | |
| *** timcline has quit IRC | 17:39 | |
| openstackgerrit | Michael Krotscheck proposed openstack/keystone: Added CORS support to Keystone https://review.openstack.org/241317 | 17:39 |
| dstanek | hmmmm... so i cut the test runtime down by about 25%, but i'm getting random failures. | 17:39 |
| shaleh | yay | 17:40 |
| shaleh | whatr steps did you take to reduce the run time? | 17:40 |
| shaleh | I was going to start looking into it next week | 17:40 |
| dstanek | shaleh: restructing lots of stuff | 17:41 |
| dstanek | basically reduce redundant or useless setup | 17:41 |
| shaleh | dstanek: stuff we talked about. Good. | 17:42 |
| *** jsavak has quit IRC | 17:42 | |
| shaleh | perhaps some of the setup was masking behavior? Or there is some left over cruft between tests that it covered? | 17:42 |
| *** jsavak has joined #openstack-keystone | 17:43 | |
| dstanek | i think i'm missing a cleanup somewhere | 17:44 |
| shaleh | dstanek: sounds likely | 17:44 |
| *** jsavak has quit IRC | 17:48 | |
| shaleh | dstanek: if you would like another pair of eyes, you can mail me the patch | 17:48 |
| *** jsavak has joined #openstack-keystone | 17:48 | |
| *** tonytan4ever has quit IRC | 17:48 | |
| *** hrou has quit IRC | 17:49 | |
| dstanek | i'm in the process of breaking it apart now so that i can start putting it up for review | 17:50 |
| *** fhubik has quit IRC | 17:52 | |
| *** wanghua has quit IRC | 17:53 | |
| *** wanghua has joined #openstack-keystone | 17:54 | |
| *** su_zhang has joined #openstack-keystone | 17:54 | |
| *** petertr7_away is now known as petertr7 | 17:56 | |
| *** jvarlamova_ has quit IRC | 17:57 | |
| *** jsavak has quit IRC | 18:00 | |
| shaleh | dstanek: how much refactoring will i need to do in my new_*_ref() cleanup work? | 18:05 |
| dstanek | shaleh: likely none | 18:05 |
| *** petertr7 is now known as petertr7_away | 18:05 | |
| *** aix has quit IRC | 18:05 | |
| *** browne has joined #openstack-keystone | 18:08 | |
| *** mylu has joined #openstack-keystone | 18:14 | |
| andrewbogott | bknudson: ok, with my endpoints switched over to v3, here’s what I get: https://dpaste.de/ykpx | 18:16 |
| andrewbogott | Can you tell from the log what’s going on? Am I just missing an export? | 18:16 |
| *** e0ne has joined #openstack-keystone | 18:17 | |
| bknudson | "ERROR: openstack " | 18:17 |
| bknudson | that's pretty useful | 18:17 |
| andrewbogott | yeah, if I turn on —debug there’s more but not a lot more | 18:18 |
| bknudson | what request is failing? | 18:18 |
| andrewbogott | anyway, at least it’s hitting keystone, judging from the log | 18:18 |
| andrewbogott | bknudson: what do you mean? | 18:18 |
| bknudson | what's the REST call that's failing? | 18:18 |
| andrewbogott | I think auth/tokens | 18:18 |
| andrewbogott | but let me post the —debug output… should’ve done that anyway | 18:19 |
| bknudson | POST /v3/auth/tokens HTTP/1.1" 201 | 18:19 |
| *** mylu has quit IRC | 18:19 | |
| *** mylu has joined #openstack-keystone | 18:19 | |
| andrewbogott | bknudson: here’s the client-side debug: https://dpaste.de/NwBB | 18:20 |
| *** jerrygb has quit IRC | 18:21 | |
| bknudson | I think the log is showing that there are no roles assigned to the user on the project | 18:21 |
| bknudson | which is why you can't get a token | 18:21 |
| bknudson | search: base=ou=roles,dc=wikimedia,dc=org scope=1 filterstr=(&(cn=48c33cc399984b9e855cfc1636ddaba9)(objectClass=organizationalRole)) attrs=['cn'] attrsonly=0 | 18:21 |
| bknudson | that's the ldapsearch that it's doing | 18:22 |
| shaleh | v2 lookup, No OS_IDENTITY_API_VERSION=3 | 18:22 |
| andrewbogott | bknudson: ok, so that suggests that assignment with ldap isn’t working | 18:22 |
| andrewbogott | which is, I guess, what I was trying to learn | 18:22 |
| bknudson | andrewbogott: what do you think it's doing wrong? | 18:23 |
| bknudson | is that not the correct search? | 18:23 |
| andrewbogott | hm | 18:23 |
| andrewbogott | ‘48c33cc399984b9e855cfc1636ddaba9’ is supposed to be the role id? | 18:23 |
| *** mylu has quit IRC | 18:24 | |
| bknudson | andrewbogott: I assume so since it's looking under ou=roles,dc=wikimedia,dc=org | 18:24 |
| bknudson | so what should be in there are roles with objectclass organizationalRole and the cn is the id | 18:24 |
| bknudson | ... why would it be looking up the role by ID ... | 18:25 |
| bknudson | search: base=ou=roles,dc=wikimedia,dc=org scope=1 filterstr=(&(cn=admin)(objectClass=organizationalRole)) attrs=['cn'] attrsonly=0 | 18:25 |
| andrewbogott | I see that role defined in ldap but I’m not sure wher eit came from. IT doesn’t have anything human readable so I don’t know what it’s supposed to be. | 18:25 |
| bknudson | it did that just before ^^ | 18:25 |
| andrewbogott | But, let me add myself to the role and see what happens :) | 18:25 |
| bknudson | and it apparently worked | 18:25 |
| openstackgerrit | Ramaraja proposed openstack/keystone: Adding Mitaka version oslo.log https://review.openstack.org/241718 | 18:26 |
| bknudson | maybe it's checking to see if the role is disabled or something? | 18:26 |
| bknudson | we could use some better debug logging. | 18:26 |
| andrewbogott | ok, the role exists and novaadmin is in that role in project testlabs | 18:26 |
| andrewbogott | here’s what I see in ldap: https://dpaste.de/FkxJ | 18:28 |
| *** pumaranikar has joined #openstack-keystone | 18:29 | |
| *** timcline has joined #openstack-keystone | 18:30 | |
| *** timcline has quit IRC | 18:31 | |
| andrewbogott | I wonder where keystone is getting that ID? I have another role that’s just called ‘admin’ — that seems like the obvious choice | 18:31 |
| *** timcline has joined #openstack-keystone | 18:31 | |
| andrewbogott | (back in 5) | 18:32 |
| *** akanksha_ has joined #openstack-keystone | 18:37 | |
| andrewbogott | back. bknudson, are you code-digging, or surrendering for now? | 18:39 |
| *** fangzhou has joined #openstack-keystone | 18:41 | |
| *** hrou has joined #openstack-keystone | 18:46 | |
| bknudson | andrewbogott: I'm continuing to work on what I was doing before... it's open source so anybody can look at it. | 18:48 |
| andrewbogott | that’s fine, just didn’t want to go to lunch and leave you mid-debug :) | 18:49 |
| * andrewbogott ponders how to roll back this change, now that the api doesn’t work | 18:53 | |
| *** Ephur has joined #openstack-keystone | 18:55 | |
| *** doug-fis_ has joined #openstack-keystone | 18:56 | |
| *** jbell8 has quit IRC | 18:57 | |
| *** doug-fish has quit IRC | 18:58 | |
| andrewbogott | ok! I’m dumb, shaleh had a solution (at least partly) in the backscroll. Thanks shaleh | 18:58 |
| bknudson | you're not going to tell us what the solution was? | 18:59 |
| andrewbogott | OS_IDENTITY_API_VERSION=3 | 18:59 |
| shaleh | every time i have seen the "error: openstack" message it was due to using the wrong API version | 19:00 |
| bknudson | if the auth version was incorrect you'd get a 404 error | 19:00 |
| bknudson | since it would try to do v3/tokens rather than v3/auth/tokens | 19:00 |
| *** doug-fis_ has quit IRC | 19:00 | |
| *** jbell8 has joined #openstack-keystone | 19:02 | |
| *** jsavak has joined #openstack-keystone | 19:02 | |
| *** doug-fish has joined #openstack-keystone | 19:04 | |
| andrewbogott | it was throwing ‘EndpointNotFound’ which is probably due to a 404, although right before it was trying to hit /v3/auth/tokens | 19:05 |
| shaleh | it always annoys me that accessing /v3/blah does not inherently set the API_VERSION=3. | 19:07 |
| *** jsavak has quit IRC | 19:07 | |
| *** jsavak has joined #openstack-keystone | 19:07 | |
| andrewbogott | I also thought that the ‘openstack’ cli (vs the ‘keystone’ cli) was only compatible with v3 anyway. | 19:08 |
| *** doug-fish has quit IRC | 19:08 | |
| dstanek | shaleh: it really shouldn't. the client shouldn't know what the URL mean | 19:08 |
| andrewbogott | At least I couldn’t get it to cooperate with v2, but I didn’t try that hard. | 19:08 |
| *** doug-fish has joined #openstack-keystone | 19:08 | |
| shaleh | andrewbogott: it does function with v2, but not well. | 19:08 |
| shaleh | at least in my experience | 19:08 |
| andrewbogott | I guess it would be rude to make it default to 3 at this late date. | 19:09 |
| shaleh | dstanek: I get the purist viewpoint on that. but it is not great UX | 19:09 |
| bknudson | openstack CLI supports both v2 and v3 | 19:09 |
| andrewbogott | Yeah, I got responses but with a bunch of empty columns and such. | 19:09 |
| bknudson | if you want great UX you should use clouds.yaml | 19:09 |
| shaleh | bknudson: I do. Much happier :-) | 19:09 |
| andrewbogott | Anyway, setting OS_IDENTITY_API_VERSION is painless now that I know :) | 19:09 |
| andrewbogott | Maybe we should just change that ‘Error: openstack’ message to say “error: openstack. Probably you need to set OS_IDENTITY_API_VERSION" | 19:10 |
| shaleh | andrewbogott: I am sure it happens for other reasons. But yes, we should be better about it. | 19:10 |
| bknudson | the code is here: http://git.openstack.org/cgit/openstack/python-openstackclient/ | 19:11 |
| bknudson | if you have time go ahead and propose a fix. | 19:11 |
| dstanek | shaleh: i'd prefer not to have version in the URL :-) | 19:11 |
| andrewbogott | Or maybe the client should just check the version before doing anything else. That adds a roundtrip though. | 19:11 |
| shaleh | dstanek: that is how i know about andrewbogott's issue. Trying to get versionless URLs to work :-) | 19:12 |
| shaleh | bknudson: fixing that error message has been on my back burner for a bit. Thanks to both andrewbogott and you for reminding me | 19:12 |
| * andrewbogott lunches | 19:13 | |
| shaleh | andrewbogott: think you could ensure a bug exists for that behavior? | 19:14 |
| dstanek | shaleh: it's unfortunate that we don't use linking for the client to get around. i'd love to see the version disappear | 19:14 |
| dstanek | but unfortunately we publish URLs in our API docs | 19:14 |
| bknudson | we've got JSON Home support in keystone | 19:14 |
| bknudson | and the rels are published in the API docs | 19:15 |
| *** hrou has quit IRC | 19:15 | |
| bknudson | but it's not supported in the client lib yet | 19:15 |
| dstanek | bknudson: yeah, we are getting closer for sure | 19:15 |
| *** petertr7_away is now known as petertr7 | 19:16 | |
| dstanek | we also need rels in our resource representations too | 19:16 |
| dstanek | ... or headers | 19:16 |
| bknudson | we've got self links | 19:16 |
| *** LukeHinds has quit IRC | 19:16 | |
| *** c_soukup has joined #openstack-keystone | 19:18 | |
| dstanek | i think there are things missing like urls instead of or in addition to things like service_id | 19:19 |
| dstanek | right now the pattern we promote is templating a url | 19:19 |
| *** jerrygb has joined #openstack-keystone | 19:20 | |
| bknudson | should we be using os-testr for all the keystone projects? | 19:20 |
| bknudson | it's used in keystoneauth and I don't see why that needs to be a special snowflake. | 19:20 |
| dstanek | what is os-testr? | 19:21 |
| *** tonytan4ever has joined #openstack-keystone | 19:21 | |
| shaleh | bknudson: is that different from the testr used for keystone? | 19:21 |
| bknudson | in order to run a single test on keystoneauth I need to do tox -e py27 -- --regex <whatever> | 19:21 |
| bknudson | whereas for keystone I just do tox -e py27 <whatever> | 19:21 |
| bknudson | dstanek: http://docs.openstack.org/developer/os-testr/ | 19:21 |
| *** csoukup has quit IRC | 19:22 | |
| bknudson | https://github.com/openstack/os-testr#os-testr | 19:22 |
| bknudson | "A testr wrapper to provide functionality for OpenStack projects" | 19:22 |
| shaleh | bknudson: so maybe keystone is the special snowflake? | 19:22 |
| *** spandhe has joined #openstack-keystone | 19:22 | |
| bknudson | keystoneauth is newer than keystone | 19:22 |
| dstanek | bknudson: i don't care if we use it or not. doesn't seem to be anything in there that's useful to me, but also nothing that would hurt | 19:23 |
| bknudson | the other option is to change keystoneauth to work like keystone and the rest of the projects | 19:23 |
| dstanek | bknudson: does anyone else use that? | 19:24 |
| *** hrou has joined #openstack-keystone | 19:25 | |
| bknudson | dstanek: ./nova/tox.ini: ostestr --blacklist_file tests-py3.txt | 19:25 |
| bknudson | ./neutron/tox.ini: ostestr --regex '{posargs}' | 19:25 |
| bknudson | 6 projects use it | 19:25 |
| bknudson | out of 416 | 19:25 |
| *** jbell8 has quit IRC | 19:26 | |
| *** bradjones has quit IRC | 19:26 | |
| *** tellesnobrega is now known as tellesnobrega_af | 19:26 | |
| dstanek | i actually like the blacklist in the tox.ini so it's very "in your face" | 19:26 |
| shaleh | that might reflect people not updating to new tools | 19:26 |
| bknudson | the list of tests in keystone's tox.ini is pretty in your face | 19:26 |
| shaleh | dstanek: maybe once your patch is ready for review you could try it out and give an opinion? | 19:27 |
| *** tellesnobrega_af is now known as tellesnobrega | 19:27 | |
| *** jsavak has quit IRC | 19:40 | |
| *** NM has joined #openstack-keystone | 19:44 | |
| *** su_zhang has quit IRC | 19:46 | |
| *** su_zhang has joined #openstack-keystone | 19:46 | |
| *** doug-fish has quit IRC | 19:47 | |
| *** doug-fish has joined #openstack-keystone | 19:49 | |
| *** ctina has quit IRC | 19:49 | |
| *** jsavak has joined #openstack-keystone | 19:58 | |
| *** ayoung has quit IRC | 20:00 | |
| *** jbell8 has joined #openstack-keystone | 20:00 | |
| *** tellesnobrega is now known as tellesnobrega_af | 20:02 | |
| *** jsavak has quit IRC | 20:02 | |
| *** su_zhang has quit IRC | 20:04 | |
| *** su_zhang has joined #openstack-keystone | 20:06 | |
| *** su_zhang has quit IRC | 20:09 | |
| *** jsavak has joined #openstack-keystone | 20:09 | |
| *** su_zhang has joined #openstack-keystone | 20:11 | |
| *** timcline has quit IRC | 20:11 | |
| *** tellesnobrega_af is now known as tellesnobrega | 20:12 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Constraint to prevent duplicates endpoints https://review.openstack.org/134095 | 20:23 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change endpoint.url column type to String https://review.openstack.org/241748 | 20:23 |
| *** su_zhang has quit IRC | 20:25 | |
| *** khomkrit has quit IRC | 20:26 | |
| *** fawadkhaliq has joined #openstack-keystone | 20:31 | |
| *** jamielennox|away is now known as jamielennox | 20:36 | |
| *** timcline has joined #openstack-keystone | 20:37 | |
| *** fangzhou has quit IRC | 20:38 | |
| *** flwang has joined #openstack-keystone | 20:50 | |
| *** raildo is now known as raildo-afk | 20:56 | |
| *** ayoung has joined #openstack-keystone | 21:03 | |
| *** ChanServ sets mode: +v ayoung | 21:03 | |
| *** mylu has joined #openstack-keystone | 21:03 | |
| *** petertr7 is now known as petertr7_away | 21:04 | |
| *** e0ne has quit IRC | 21:06 | |
| *** urulama has quit IRC | 21:08 | |
| *** urulama has joined #openstack-keystone | 21:08 | |
| *** timcline has quit IRC | 21:12 | |
| andrewbogott | shaleh: I didn’t find an existing bug, although there may be one. Indeed, I’m not clear on if there is even a bug category for the openstack client? Anyway, here’s my best attempt: https://bugs.launchpad.net/keystone/+bug/1513216 | 21:14 |
| openstack | Launchpad bug 1513216 in OpenStack Identity (keystone) "Mismatched keystone api version produces cryptic 'Error: Openstack'" [Undecided,New] | 21:14 |
| *** su_zhang has joined #openstack-keystone | 21:15 | |
| shaleh | andrewbogott: thank you | 21:19 |
| shaleh | something for bug friday | 21:19 |
| bknudson | probably nobody's working on it since it's reported against keystone for some reason when it's an openstackclient bug. | 21:20 |
| *** jasonsb has quit IRC | 21:22 | |
| *** phalmos has quit IRC | 21:23 | |
| *** e0ne has joined #openstack-keystone | 21:26 | |
| *** petertr7_away is now known as petertr7 | 21:26 | |
| *** pece has quit IRC | 21:27 | |
| *** fangzhou has joined #openstack-keystone | 21:27 | |
| *** e0ne has quit IRC | 21:29 | |
| *** jamielennox is now known as jamielennox|away | 21:30 | |
| *** topol has quit IRC | 21:31 | |
| *** jsavak has quit IRC | 21:35 | |
| *** jerrygb has quit IRC | 21:36 | |
| *** jamielennox|away is now known as jamielennox | 21:37 | |
| *** jerrygb has joined #openstack-keystone | 21:38 | |
| *** aix has joined #openstack-keystone | 21:39 | |
| *** e0ne has joined #openstack-keystone | 21:40 | |
| *** e0ne has quit IRC | 21:41 | |
| *** pauloewerton has quit IRC | 21:43 | |
| *** jorge_munoz has joined #openstack-keystone | 21:44 | |
| *** jsavak has joined #openstack-keystone | 21:51 | |
| kfox1111_ | is there any issues running a liberty keystone with fernet tokens and kilo or other services on different nodes? | 21:55 |
| kfox1111_ | we're looking at setting up one keystone to rule over multiple regions. | 21:55 |
| *** petertr7 is now known as petertr7_away | 21:56 | |
| dolphm | kfox1111_: https://bugs.launchpad.net/keystone/+bugs?field.tag=fernet | 21:56 |
| *** phalmos has joined #openstack-keystone | 21:57 | |
| dolphm | kfox1111_: including a race condition that operators at the summit concluded was dwarfed by clock skew, but is summarized here https://bugs.launchpad.net/keystone/+bug/1473567/comments/15 | 21:57 |
| openstack | Launchpad bug 1473567 in OpenStack Identity (keystone) "Fernet tokens fail tempest runs" [High,In progress] - Assigned to Dolph Mathews (dolph) | 21:57 |
| *** petertr7_away is now known as petertr7 | 21:58 | |
| bknudson | dolphm: I think kfox1111_ is asking about different levels of services. | 21:59 |
| bknudson | e.g., new keystone old nova | 21:59 |
| bknudson | which I think people have asked before and we said there was no known issue | 21:59 |
| dolphm | bknudson: ah - yeah. no known issues, none expected. | 21:59 |
| dolphm | ooh, except you need kilo horizon at minumum for fernet | 22:00 |
| dolphm | minimum* | 22:00 |
| *** su_zhang has quit IRC | 22:01 | |
| *** gildub has joined #openstack-keystone | 22:04 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Validate Distinguished Names https://review.openstack.org/241005 | 22:04 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Change tests that are setting incorrect Distinguished Names https://review.openstack.org/241378 | 22:04 |
| *** e0ne has joined #openstack-keystone | 22:07 | |
| *** e0ne has quit IRC | 22:08 | |
| *** petertr7 is now known as petertr7_away | 22:10 | |
| *** jsavak has quit IRC | 22:11 | |
| jorge_munoz | dolphm: It seem that removing domain revocation events will have problem if you disable and reenable a domain. Meaning that a token should be revoked if a domain was disabled, and should stay invalid even if the domain gets reenabled. | 22:11 |
| *** henrynash has joined #openstack-keystone | 22:11 | |
| *** ChanServ sets mode: +v henrynash | 22:11 | |
| *** su_zhang has joined #openstack-keystone | 22:12 | |
| dolphm | jorge_munoz: i think that's an expectation we have to break. after all, what's the use case for keeping it disabled? | 22:13 |
| *** phalmos has quit IRC | 22:15 | |
| jorge_munoz | dolphm: I don’t see where this would happen very often, but its a security risk. I just want to make sure this is something we are willing to live with. | 22:17 |
| dolphm | jorge_munoz: what is the security risk? what's the attack vector? | 22:18 |
| jorge_munoz | dolphm: Ex: Some accounts got compromised in a domain, and a user wanted to disable the domains to invalidate all tokens and reenabled to allow usage again to user in that domain. | 22:20 |
| dolphm | jorge_munoz: wouldn't you disable the domain, delete the compromised users, and then re-enable the domain without risk? | 22:23 |
| *** lhcheng has joined #openstack-keystone | 22:24 | |
| *** ChanServ sets mode: +v lhcheng | 22:24 | |
| *** jasonsb has joined #openstack-keystone | 22:25 | |
| *** daemontool has joined #openstack-keystone | 22:26 | |
| *** doug-fish has quit IRC | 22:26 | |
| jorge_munoz | dolphm: Yes, in that workflow that would work just fine, but what if some tokens where compromised and the domain admin is unsure which are the compromisied users. | 22:28 |
| dolphm | jorge_munoz: then you'd leave the domain disabled? | 22:30 |
| *** pumaranikar has quit IRC | 22:31 | |
| *** pumaranikar has joined #openstack-keystone | 22:31 | |
| dolphm | jorge_munoz: the "what if" is missing a surgical fix - you can't safely revert the emergency sledgehammer fix until you have a surgically precise fix in place. | 22:31 |
| *** ctina has joined #openstack-keystone | 22:32 | |
| *** henrynash has quit IRC | 22:33 | |
| jorge_munoz | dolphm: Its changing the current funcionality, and allowing a token to be valid where it technically shouldn’t. | 22:36 |
| *** pumaranikar has quit IRC | 22:36 | |
| dolphm | jorge_munoz: (you're skipping the "why") | 22:37 |
| dolphm | change itself is not necessarily bad, and we don't have a use case to say the token should remain invalid | 22:38 |
| jorge_munoz | dolphm: but its an inconsistency on the api, right? I just want to cover my bases.. | 22:41 |
| dolphm | jorge_munoz: well it's a matter of documenting expectations, but what's the inconsistency? you disable a project, you can't scope to it, you re-enable the project, they can scope to it. you disable a service, it disappears from the catalog, you re-enable it, it re-appears. right? | 22:44 |
| *** c_soukup has quit IRC | 22:44 | |
| jorge_munoz | Well getting a 401 and then getting a 200. Thats fine, we can document expection and explain why a token may be invalid when a domain is disabled and valid when a domain gets re-enabled. Since the token never did get explicitly revoke, it makes sense the it would remain valid. | 22:47 |
| jorge_munoz | may -> is* | 22:48 |
| *** mylu has quit IRC | 22:50 | |
| *** mylu has joined #openstack-keystone | 22:51 | |
| *** tonytan4ever has quit IRC | 22:51 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Change tests that are setting incorrect Distinguished Names https://review.openstack.org/241378 | 22:54 |
| *** mylu has quit IRC | 22:55 | |
| notmorgan | huh | 22:57 |
| notmorgan | no stevemar | 22:57 |
| *** ctina has quit IRC | 22:57 | |
| shaleh | have not seen him all day | 22:57 |
| notmorgan | dolphm, ayoung, jamielennox: so i've been thinking about this | 22:57 |
| *** ctina has joined #openstack-keystone | 22:58 | |
| notmorgan | dolphm, ayoung, jamielennox: i think we might need to provide a new indicator in keystone projects that is not disabled...but locked. | 22:58 |
| notmorgan | basically a way to signal to other projects that this project should not be allowed to have more resources allocated to it. locking a project would still invalidate the tokens (so new tokens are needed) | 22:59 |
| notmorgan | but disabled has further reaching effects. | 22:59 |
| *** ctina has quit IRC | 23:02 | |
| *** fangzhou has quit IRC | 23:05 | |
| *** slberger has left #openstack-keystone | 23:11 | |
| *** su_zhang has quit IRC | 23:12 | |
| jamielennox | notmorgan: so what do you think you can do with a locked project vs a disabled project, and wouldn't that require keysotne having an understanding of how the roles are set up? | 23:17 |
| jamielennox | guess we can always add it to the token | 23:17 |
| notmorgan | yeah | 23:18 |
| *** jasonsb has quit IRC | 23:18 | |
| notmorgan | that's the thought | 23:18 |
| notmorgan | or the validated body at least | 23:18 |
| *** jasonsb has joined #openstack-keystone | 23:18 | |
| shaleh | but why locked v. disabled? What can one do with a locked project? | 23:19 |
| notmorgan | disabled is like deleted outside of keystone | 23:19 |
| notmorgan | locked could let someone tear down resources / act on resources but not allocate more. no new vms. no neutron ports etc | 23:20 |
| *** jbell8 has quit IRC | 23:20 | |
| notmorgan | that is my thought at least. | 23:20 |
| shaleh | notmorgan: so perhaps you want to use a term like "frozen" or some such? | 23:20 |
| notmorgan | sure | 23:20 |
| notmorgan | terminology doesn't matter when we are just talking concept | 23:21 |
| shaleh | my point here is a standard user could still be expected to auth and have a project scoped token for this project, right? | 23:21 |
| notmorgan | yes. | 23:21 |
| shaleh | they could access anything currently working | 23:21 |
| *** su_zhang has joined #openstack-keystone | 23:21 | |
| jamielennox | marekd: so testshib.org works with ecp? i couldn't figure it out with mod_auth_mellon, but probably because it's unsupported | 23:21 |
| jamielennox | marekd: (not expecting you to be here) | 23:22 |
| dolphm | notmorgan: couldn't we achieve that today with disabled? since it doesn't actually disable anything besides auth | 23:23 |
| dolphm | notmorgan: communicate that to services and handle it in policy? | 23:24 |
| jamielennox | dolphm: you can't get a token scoped to that disabled project | 23:25 |
| *** edmondsw has quit IRC | 23:25 | |
| ayoung | if we indicated that a project was disabled, but still allowed tokens to be created it would have the same effect. | 23:26 |
| ayoung | Lets not add a new state | 23:26 |
| shaleh | jamielennox: has Lasso caught up with ECP support? | 23:26 |
| jamielennox | shaleh: yes, if you're compiling from source | 23:27 |
| jamielennox | maybe fedora 23 | 23:27 |
| jamielennox | probably fedora 23 | 23:27 |
| jamielennox | definetly rhel 7.2 | 23:27 |
| shaleh | jamielennox: good to know | 23:27 |
| shaleh | jamielennox: I looked a few months back, it still seemed in flux then | 23:28 |
| shaleh | ayoung: why disable a project but allow people access to it? What would be the point in disabled then? | 23:29 |
| ayoung | deleting resources | 23:29 |
| shaleh | seems like bad UX to me | 23:29 |
| shaleh | ayoung: but notmorgan is talking about more than delete. Simply the user cannot allocate more. | 23:29 |
| ayoung | shaleh, locked means the user cannot create more resources. THat is waht disabled would mean, too. If you disable a project in Keystone, it can be reneabled. While it is locked you cannot get tokens scoped to that project. | 23:30 |
| ayoung | The only reason to have another status would be to deal with the gap between when we added it and when the other services wrote a policy role for it. | 23:31 |
| *** gordc has quit IRC | 23:31 | |
| ayoung | So, instead, lets have a config option that says you can or cannot get a token for a disabled project. It is the same net effect | 23:31 |
| shaleh | ayoung: that is not my understanding of notmorgan's request. I will let him talk for himself though. | 23:32 |
| ayoung | shaleh, "no more resources" can be done with quoata | 23:32 |
| *** fangzhou has joined #openstack-keystone | 23:32 | |
| shaleh | ayoung: but I stand by my statement that allowing users to auth and use a project marked 'disabled' is bad UX | 23:32 |
| shaleh | the cleanup case is a special one, I can see a use for that | 23:33 |
| *** hrou has quit IRC | 23:34 | |
| *** jbell8 has joined #openstack-keystone | 23:34 | |
| *** jbell8 has quit IRC | 23:37 | |
| notmorgan | ayoung: it depends on if we want to change "disabled" state functionality | 23:42 |
| notmorgan | i was assuming we didn't want to change things. | 23:42 |
| *** jerrygb has quit IRC | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!