| *** jerrygb_ has joined #openstack-keystone | 00:04 | |
| *** jerrygb has quit IRC | 00:05 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Add release notes for keystoneclient https://review.openstack.org/251160 | 00:06 |
|---|---|---|
| openstackgerrit | Michael Krotscheck proposed openstack/keystone: Added CORS support to Keystone https://review.openstack.org/241317 | 00:10 |
| *** belmoreira has quit IRC | 00:15 | |
| *** EinstCrazy has joined #openstack-keystone | 00:17 | |
| *** EinstCrazy has quit IRC | 00:23 | |
| *** roxanaghe has quit IRC | 00:23 | |
| *** openstackstatus has quit IRC | 00:24 | |
| *** openstackstatus has joined #openstack-keystone | 00:25 | |
| *** ChanServ sets mode: +v openstackstatus | 00:25 | |
| *** raildo is now known as raildo-afk | 00:30 | |
| *** aginwala_ has quit IRC | 00:40 | |
| *** aginwala has joined #openstack-keystone | 00:43 | |
| *** shaleh has quit IRC | 00:46 | |
| *** RichardRaseley has quit IRC | 00:56 | |
| *** EinstCrazy has joined #openstack-keystone | 00:59 | |
| *** richm has quit IRC | 01:16 | |
| *** openstackgerrit has quit IRC | 01:22 | |
| *** openstackgerrit has joined #openstack-keystone | 01:22 | |
| *** diegoadolfo has quit IRC | 01:29 | |
| *** diegoadolfo has joined #openstack-keystone | 01:29 | |
| *** aginwala has quit IRC | 01:30 | |
| *** jasonsb has quit IRC | 01:40 | |
| *** aginwala has joined #openstack-keystone | 01:43 | |
| *** markvoelker has quit IRC | 01:46 | |
| *** aginwala has quit IRC | 01:48 | |
| *** aginwala has joined #openstack-keystone | 01:49 | |
| *** jerrygb_ has quit IRC | 01:51 | |
| *** jerrygb has joined #openstack-keystone | 01:52 | |
| *** jerrygb has quit IRC | 01:55 | |
| *** spandhe has quit IRC | 02:06 | |
| openstackgerrit | Merged openstack/keystone: Needn't care about the sequence for cache validation https://review.openstack.org/251060 | 02:13 |
| *** sripriya has quit IRC | 02:17 | |
| *** feifei has joined #openstack-keystone | 02:22 | |
| feifei | hello | 02:25 |
| *** davechen has joined #openstack-keystone | 02:26 | |
| jamielennox | stevemar: have you done much with shib? | 02:45 |
| feifei | no | 02:47 |
| openstackgerrit | ayoung proposed openstack/keystone: set `is_admin` on tokens for admin project https://review.openstack.org/240719 | 02:48 |
| stevemar | jamielennox: nope | 02:55 |
| stevemar | i'm an oidc kinda guy | 02:55 |
| *** fawadkhaliq has joined #openstack-keystone | 02:57 | |
| jamielennox | ok, pros, it does lots of stuff, cons , it does lots of stuff | 02:58 |
| *** breitz has quit IRC | 03:05 | |
| *** mserngawy_ has quit IRC | 03:18 | |
| *** aginwala has quit IRC | 03:22 | |
| *** aginwala has joined #openstack-keystone | 03:27 | |
| *** jasonsb has joined #openstack-keystone | 03:27 | |
| *** _zouyee has joined #openstack-keystone | 03:32 | |
| *** ayoung has quit IRC | 03:35 | |
| *** links has joined #openstack-keystone | 03:39 | |
| *** aginwala has quit IRC | 03:41 | |
| *** aginwala has joined #openstack-keystone | 03:42 | |
| *** fangxu has quit IRC | 03:44 | |
| *** aginwala has quit IRC | 03:46 | |
| *** csoukup_ has quit IRC | 03:56 | |
| *** davechen1 has joined #openstack-keystone | 04:02 | |
| *** davechen has quit IRC | 04:02 | |
| *** davechen1 has left #openstack-keystone | 04:03 | |
| *** spandhe has joined #openstack-keystone | 04:17 | |
| *** links has quit IRC | 04:17 | |
| *** spandhe_ has joined #openstack-keystone | 04:20 | |
| *** spandhe has quit IRC | 04:21 | |
| *** spandhe_ is now known as spandhe | 04:21 | |
| *** ninag has quit IRC | 04:22 | |
| *** roxanaghe has joined #openstack-keystone | 04:34 | |
| *** gyee has quit IRC | 04:52 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/251638 | 05:01 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/251639 | 05:01 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/251640 | 05:05 |
| stevemar | damn proposal bot, quit proposing white space changes | 05:05 |
| *** jerrygb has joined #openstack-keystone | 05:35 | |
| *** links has joined #openstack-keystone | 05:35 | |
| *** fawadkhaliq has quit IRC | 05:36 | |
| openstackgerrit | Fernando Diaz proposed openstack/keystone: Strengthen Mapping Validation in Federation Mappings https://review.openstack.org/250162 | 05:37 |
| *** tyagiprince has joined #openstack-keystone | 05:40 | |
| openstackgerrit | Merged openstack/keystone: Reference environment close to use https://review.openstack.org/251276 | 05:43 |
| *** gildub has joined #openstack-keystone | 05:46 | |
| *** jerrygb has quit IRC | 05:52 | |
| stevemar | jamielennox: around? | 05:53 |
| jamielennox | stevemar: mmm | 05:53 |
| stevemar | jamielennox: trust based auth plugin | 05:54 |
| stevemar | how i do | 05:54 |
| jamielennox | from user/pass or rescope? | 05:54 |
| stevemar | i guess user/pass | 05:54 |
| stevemar | just user/pass and trust id right? | 05:55 |
| jamielennox | so it's just the same as normal, just use trust_id instead of project_id | 05:55 |
| *** fawadkhaliq has joined #openstack-keystone | 05:58 | |
| *** fawadkhaliq has quit IRC | 05:58 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:59 | |
| *** aginwala has joined #openstack-keystone | 06:04 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/251638 | 06:05 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth-saml2: Updated from global requirements https://review.openstack.org/247604 | 06:05 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/251639 | 06:05 |
| jamielennox | stevemar: what's the point of scoping to a service provider? | 06:08 |
| jamielennox | why do we do that step? | 06:09 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/251660 | 06:09 |
| jamielennox | context, K2K | 06:09 |
| *** dims has quit IRC | 06:09 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/251640 | 06:09 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/251664 | 06:09 |
| stevemar | jamielennox: https://review.openstack.org/#/c/241986/ | 06:13 |
| stevemar | jamielennox: to get the service providers catalog? | 06:13 |
| *** dims has joined #openstack-keystone | 06:14 | |
| jamielennox | stevemar: what's that? | 06:14 |
| jamielennox | (service provider's catalog) | 06:14 |
| jamielennox | the service providers come in the regular catalog right? | 06:15 |
| *** sripriya has joined #openstack-keystone | 06:16 | |
| *** sripriya_ has joined #openstack-keystone | 06:19 | |
| *** jaosorior has joined #openstack-keystone | 06:21 | |
| *** sripriya has quit IRC | 06:22 | |
| *** mhickey has joined #openstack-keystone | 06:25 | |
| *** aginwala has quit IRC | 06:28 | |
| *** aginwala has joined #openstack-keystone | 06:28 | |
| stevemar | jamielennox: have a link for me to look at? | 06:30 |
| *** lhcheng has joined #openstack-keystone | 06:30 | |
| *** ChanServ sets mode: +v lhcheng | 06:30 | |
| jamielennox | stevemar: umm, i haven't got full dumps | 06:31 |
| *** lhcheng_ has joined #openstack-keystone | 06:32 | |
| stevemar | jamielennox: alrighty | 06:32 |
| jamielennox | stevemar: https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/identity/v3/k2k.py#L175-L177 | 06:32 |
| jamielennox | is the dump | 06:32 |
| jamielennox | bah, not oding well with words today | 06:32 |
| *** aginwala has quit IRC | 06:33 | |
| jamielennox | so that's the get sp urls and it seems to be coming from the standard token | 06:33 |
| jamielennox | but the response of posting | 06:33 |
| jamielennox | https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/identity/v3/k2k.py#L92-L106 | 06:33 |
| jamielennox | to /auth/OS-FEDERATION/saml2/ecp' | 06:33 |
| jamielennox | is a ECP assertion | 06:34 |
| jamielennox | ok - so it's just a weird copy of the format rather than a scope | 06:34 |
| jamielennox | seems like that could have been a get with your existing token | 06:34 |
| *** lhcheng has quit IRC | 06:35 | |
| jamielennox | GET /OS-FEDERATION/service_providers/{sp_id}/assertion X-Auth-Token: {token} | 06:36 |
| jamielennox | actually if you did it that way with the vaos header then that would have been the standard ECP flow - yay for standards | 06:38 |
| *** yangweiwei has joined #openstack-keystone | 06:41 | |
| yangweiwei | hello, I want to ask some questions about policy. | 06:48 |
| yangweiwei | Now the policy rules of openstack in keystone and other projects are set in policy.json, in other words, the policy rules are equal | 06:49 |
| yangweiwei | to each projects. | 06:49 |
| yangweiwei | And the common ways to enforce are in decorative function like protected(). And in keystone project, it manage the users, projects, roles and other resources. Now, some particular projects(tenants) may have its own enforce rules, not just like the policy.json, and in that ways, could we update the usual decorative function of enforce to realize the authentification of projects? And now, the policy model appears in keystone project. Coul | 06:49 |
| yangweiwei | d we use it to create association between projects and policy? | 06:49 |
| *** aginwala has joined #openstack-keystone | 06:50 | |
| *** feifei has quit IRC | 06:51 | |
| yangweiwei | Is anyone here? | 06:52 |
| *** csoukup_ has joined #openstack-keystone | 06:52 | |
| *** amit213 has quit IRC | 06:55 | |
| *** amit213 has joined #openstack-keystone | 06:56 | |
| *** csoukup_ has quit IRC | 06:57 | |
| *** fangxu has joined #openstack-keystone | 06:59 | |
| stevemar | yangweiwei: ask away | 07:03 |
| stevemar | bed time is coming up :( | 07:03 |
| *** btully has quit IRC | 07:04 | |
| *** Nirupama has joined #openstack-keystone | 07:07 | |
| stevemar | jamielennox: i think that part is... after the user has authenticated with their local cloud, get the URL of the SP that they plan on using (via the SP's ID) | 07:07 |
| *** yangweiwei has left #openstack-keystone | 07:10 | |
| *** yangweiwei has joined #openstack-keystone | 07:11 | |
| *** gildub has quit IRC | 07:13 | |
| yangweiwei | Now the policy model has appeard, and it associate with the endpoint, could we use it with the project. | 07:15 |
| *** tyagiprince has quit IRC | 07:17 | |
| *** roxanaghe has quit IRC | 07:20 | |
| *** tyagiprince has joined #openstack-keystone | 07:24 | |
| *** jaosorior has quit IRC | 07:25 | |
| *** jaosorior has joined #openstack-keystone | 07:26 | |
| *** spandhe has quit IRC | 07:30 | |
| *** fangxu has quit IRC | 07:36 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Get versioned url for K2K auth https://review.openstack.org/251686 | 07:41 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Cleanups to K2K plugin https://review.openstack.org/251687 | 07:41 |
| openstackgerrit | Irina proposed openstack/keystone: Fix some inconsistency in docstrings https://review.openstack.org/250219 | 07:42 |
| *** fawadkhaliq has quit IRC | 07:52 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:53 | |
| *** fawadkhaliq has quit IRC | 07:53 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:54 | |
| *** fawadkhaliq has quit IRC | 07:57 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:57 | |
| *** fawadkhaliq has quit IRC | 07:57 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:58 | |
| *** sripriya_ has quit IRC | 08:02 | |
| *** fawadkhaliq has quit IRC | 08:02 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:03 | |
| *** fawadkhaliq has quit IRC | 08:03 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:04 | |
| *** wangqun has joined #openstack-keystone | 08:05 | |
| *** aginwala has quit IRC | 08:06 | |
| *** aginwala has joined #openstack-keystone | 08:07 | |
| openstackgerrit | Merged openstack/keystone: force releasenotes warnings to be treated as errors https://review.openstack.org/249988 | 08:09 |
| *** roxanaghe has joined #openstack-keystone | 08:20 | |
| *** spandhe has joined #openstack-keystone | 08:24 | |
| *** mhickey has quit IRC | 08:25 | |
| *** roxanaghe has quit IRC | 08:26 | |
| *** fhubik has joined #openstack-keystone | 08:32 | |
| *** rcernin has joined #openstack-keystone | 08:37 | |
| *** fhubik is now known as fhubik_brb | 08:37 | |
| *** fhubik_brb is now known as fhubik | 08:38 | |
| *** spandhe has quit IRC | 08:45 | |
| *** spandhe has joined #openstack-keystone | 08:47 | |
| *** josecastroleon1 has quit IRC | 08:50 | |
| *** jerrygb has joined #openstack-keystone | 08:52 | |
| *** spandhe has quit IRC | 08:53 | |
| *** spandhe has joined #openstack-keystone | 08:54 | |
| *** btully has joined #openstack-keystone | 08:57 | |
| *** fhubik is now known as fhubik_brb | 08:58 | |
| *** belmoreira has joined #openstack-keystone | 09:00 | |
| *** fawadkhaliq has quit IRC | 09:03 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:03 | |
| *** xek has joined #openstack-keystone | 09:07 | |
| *** fhubik_brb is now known as fhubik | 09:13 | |
| *** NM has joined #openstack-keystone | 09:18 | |
| *** roxanaghe has joined #openstack-keystone | 09:23 | |
| *** btully has quit IRC | 09:25 | |
| *** roxanaghe has quit IRC | 09:28 | |
| *** miyagishi_t has quit IRC | 09:29 | |
| *** mhickey has joined #openstack-keystone | 09:41 | |
| *** tyagiprince has quit IRC | 09:42 | |
| *** tyagiprince has joined #openstack-keystone | 09:42 | |
| *** tyagiprince has quit IRC | 09:49 | |
| *** tyagiprince has joined #openstack-keystone | 09:49 | |
| *** josecastroleon has joined #openstack-keystone | 09:50 | |
| *** spandhe has quit IRC | 09:51 | |
| *** jistr has joined #openstack-keystone | 09:52 | |
| *** lhcheng has joined #openstack-keystone | 09:55 | |
| *** ChanServ sets mode: +v lhcheng | 09:55 | |
| *** lhcheng_ has quit IRC | 09:59 | |
| *** aix has joined #openstack-keystone | 10:05 | |
| *** wuhg has joined #openstack-keystone | 10:09 | |
| *** NM has quit IRC | 10:09 | |
| *** wuhg has left #openstack-keystone | 10:11 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/python-keystoneclient: Add include_subtree to role_list_assignments call https://review.openstack.org/188184 | 10:16 |
| *** yangweiwei has quit IRC | 10:17 | |
| *** aginwala has quit IRC | 10:20 | |
| *** fmarco76 has joined #openstack-keystone | 10:21 | |
| *** kiran-r has joined #openstack-keystone | 10:22 | |
| *** fmarco76 has quit IRC | 10:23 | |
| *** _zouyee has quit IRC | 10:25 | |
| *** roxanaghe has joined #openstack-keystone | 10:25 | |
| *** roxanaghe has quit IRC | 10:30 | |
| *** jerrygb has quit IRC | 10:31 | |
| *** NM has joined #openstack-keystone | 10:36 | |
| *** e0ne has joined #openstack-keystone | 10:37 | |
| *** mdavidson has joined #openstack-keystone | 10:48 | |
| *** rvba has quit IRC | 10:48 | |
| *** e0ne has quit IRC | 10:51 | |
| *** rvba has joined #openstack-keystone | 10:52 | |
| *** rvba has quit IRC | 10:52 | |
| *** rvba has joined #openstack-keystone | 10:52 | |
| *** wangqun has quit IRC | 10:55 | |
| *** fhubik is now known as fhubik_brb | 11:00 | |
| *** fhubik_brb is now known as fhubik | 11:03 | |
| *** marekd has joined #openstack-keystone | 11:04 | |
| *** ChanServ sets mode: +v marekd | 11:04 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fix some inconsistency in docstrings https://review.openstack.org/250219 | 11:05 |
| *** aix has quit IRC | 11:06 | |
| samueldmq | morning keystoners | 11:06 |
| samueldmq | I hope you (who are based in US) had a great thanksgiving last week | 11:06 |
| *** fhubik has quit IRC | 11:09 | |
| *** _zouyee has joined #openstack-keystone | 11:12 | |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone-specs: Online schema migration https://review.openstack.org/245186 | 11:13 |
| *** jerrygb has joined #openstack-keystone | 11:16 | |
| *** aix has joined #openstack-keystone | 11:18 | |
| *** jerrygb has quit IRC | 11:19 | |
| *** roxanaghe has joined #openstack-keystone | 11:26 | |
| *** iurygregory_ is now known as iurygregory | 11:27 | |
| *** flaper87 has quit IRC | 11:30 | |
| *** flaper87 has joined #openstack-keystone | 11:30 | |
| *** roxanaghe has quit IRC | 11:30 | |
| *** chlong has quit IRC | 11:35 | |
| *** chlong has joined #openstack-keystone | 11:35 | |
| *** flaper87 has quit IRC | 11:39 | |
| *** fhubik has joined #openstack-keystone | 11:40 | |
| *** Nirupama has quit IRC | 11:41 | |
| *** svasheka has quit IRC | 11:43 | |
| *** flaper87 has joined #openstack-keystone | 11:47 | |
| *** flaper87 has quit IRC | 11:47 | |
| *** flaper87 has joined #openstack-keystone | 11:47 | |
| openstackgerrit | Boris Bobrov proposed openstack/python-keystoneclient: Support `truncated` flag returned by keystone https://review.openstack.org/250473 | 11:48 |
| *** svasheka has joined #openstack-keystone | 11:49 | |
| *** ninag has joined #openstack-keystone | 11:56 | |
| *** ninag has quit IRC | 12:01 | |
| *** EinstCrazy has quit IRC | 12:01 | |
| *** EinstCrazy has joined #openstack-keystone | 12:02 | |
| *** diegoadolfo__ has quit IRC | 12:05 | |
| *** diegoadolfo_ has quit IRC | 12:05 | |
| *** diegoadolfo has quit IRC | 12:05 | |
| *** clayton has quit IRC | 12:06 | |
| *** EinstCrazy has quit IRC | 12:06 | |
| *** zao_ has joined #openstack-keystone | 12:07 | |
| *** zao has quit IRC | 12:08 | |
| *** zao_ is now known as zao | 12:08 | |
| *** fhubik is now known as fhubik_brb | 12:10 | |
| *** clayton has joined #openstack-keystone | 12:13 | |
| *** jerrygb has joined #openstack-keystone | 12:20 | |
| *** kiranr has joined #openstack-keystone | 12:20 | |
| *** kiran-r has quit IRC | 12:21 | |
| *** raildo-afk is now known as raildo | 12:21 | |
| *** tyagiprince has quit IRC | 12:23 | |
| *** e0ne has joined #openstack-keystone | 12:25 | |
| *** pauloewerton has joined #openstack-keystone | 12:26 | |
| *** jerrygb has quit IRC | 12:27 | |
| *** zao has quit IRC | 12:27 | |
| *** roxanaghe has joined #openstack-keystone | 12:27 | |
| *** zao has joined #openstack-keystone | 12:27 | |
| *** EinstCrazy has joined #openstack-keystone | 12:29 | |
| *** edmondsw has joined #openstack-keystone | 12:29 | |
| *** NM has quit IRC | 12:30 | |
| *** wangqun has joined #openstack-keystone | 12:31 | |
| *** roxanaghe has quit IRC | 12:32 | |
| *** lhcheng has quit IRC | 12:33 | |
| *** lhcheng has joined #openstack-keystone | 12:34 | |
| *** ChanServ sets mode: +v lhcheng | 12:34 | |
| *** e0ne has quit IRC | 12:34 | |
| openstackgerrit | Rui Chen proposed openstack/python-keystoneclient: Fix Resource.__eq__ mismatch semantics of object equal https://review.openstack.org/251841 | 12:34 |
| *** EinstCra_ has joined #openstack-keystone | 12:34 | |
| *** e0ne_ has joined #openstack-keystone | 12:37 | |
| *** EinstCrazy has quit IRC | 12:37 | |
| *** jaosorior has quit IRC | 12:42 | |
| *** jaosorior has joined #openstack-keystone | 12:43 | |
| *** sileht has joined #openstack-keystone | 12:47 | |
| *** jaosorior has quit IRC | 12:47 | |
| *** jaosorior has joined #openstack-keystone | 12:47 | |
| *** _zouyee has quit IRC | 12:54 | |
| *** fawadkhaliq has quit IRC | 13:00 | |
| *** jerrygb has joined #openstack-keystone | 13:01 | |
| *** fawadkhaliq has joined #openstack-keystone | 13:01 | |
| *** fawadkhaliq has quit IRC | 13:02 | |
| *** fawadkhaliq has joined #openstack-keystone | 13:03 | |
| *** fawadkhaliq has quit IRC | 13:03 | |
| *** fawadkhaliq has joined #openstack-keystone | 13:04 | |
| *** fhubik_brb is now known as fhubik | 13:06 | |
| *** ninag has joined #openstack-keystone | 13:08 | |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: Remove eventlet support https://review.openstack.org/249486 | 13:09 |
| *** gordc has joined #openstack-keystone | 13:15 | |
| *** fawadkhaliq has quit IRC | 13:18 | |
| *** fawadkhaliq has joined #openstack-keystone | 13:19 | |
| *** kiranr has quit IRC | 13:19 | |
| *** lhinds has joined #openstack-keystone | 13:20 | |
| *** stevemar has quit IRC | 13:22 | |
| *** stevemar_znc has joined #openstack-keystone | 13:23 | |
| *** henrynash has joined #openstack-keystone | 13:29 | |
| *** ChanServ sets mode: +v henrynash | 13:29 | |
| henrynash | lhcheng: I updated https://review.openstack.org/#/c/200624/ to remove the text on domain hierarchies…are you OK with this now? | 13:30 |
| *** adelia has joined #openstack-keystone | 13:30 | |
| *** adelia has quit IRC | 13:33 | |
| *** adelia has joined #openstack-keystone | 13:34 | |
| *** adelia has quit IRC | 13:38 | |
| *** richm has joined #openstack-keystone | 13:44 | |
| *** links has quit IRC | 13:47 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 13:47 |
| *** markvoelker_ has joined #openstack-keystone | 13:49 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 13:52 |
| *** e0ne_ has quit IRC | 13:55 | |
| *** e0ne has joined #openstack-keystone | 13:55 | |
| lhcheng | henrynash: checking.. | 13:58 |
| henrynash | lhcheng: thx | 13:58 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 13:59 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation driver https://review.openstack.org/209600 | 14:01 |
| *** adelia has joined #openstack-keystone | 14:02 | |
| *** fhubik is now known as fhubik_brb | 14:02 | |
| *** fhubik_brb is now known as fhubik | 14:03 | |
| *** silvio is now known as gissi | 14:03 | |
| *** ayoung has joined #openstack-keystone | 14:05 | |
| *** ChanServ sets mode: +v ayoung | 14:05 | |
| *** breitz has joined #openstack-keystone | 14:05 | |
| *** fhubik is now known as fhubik_brb | 14:05 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation migration https://review.openstack.org/237047 | 14:06 |
| henrynash | lhcheng: thx | 14:08 |
| lhcheng | henrynash: thanks for the updated patch, the doc looks great! | 14:08 |
| lhcheng | henrynash: got a quick question related to this bug: https://bugs.launchpad.net/keystone/+bug/1466846 | 14:12 |
| openstack | Launchpad bug 1466846 in OpenStack Identity (keystone) "the function _config_to_list is not working well" [Medium,New] | 14:12 |
| lhcheng | henrynash: should the value from the config be injected in the whitelisted/sensitive list in here: https://github.com/openstack/keystone/blob/master/keystone/resource/core.py#L1024 | 14:14 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Deprecating API v2.0 https://review.openstack.org/251530 | 14:14 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Deprecating API v2.0 https://review.openstack.org/251530 | 14:16 |
| *** btully has joined #openstack-keystone | 14:17 | |
| *** henrynash has quit IRC | 14:17 | |
| *** henrynash_ has joined #openstack-keystone | 14:17 | |
| *** ChanServ sets mode: +v henrynash_ | 14:17 | |
| henrynash_ | lhcheng: hmm, that’s looks like bad Henry code to me! | 14:17 |
| henrynash_ | lhcheng: assign me the bug! | 14:17 |
| *** adelia has quit IRC | 14:17 | |
| *** adelia has joined #openstack-keystone | 14:18 | |
| *** csoukup has joined #openstack-keystone | 14:22 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation migration https://review.openstack.org/237047 | 14:23 |
| lhcheng | henrynash_: sure! | 14:23 |
| lhcheng | henrynash_: done! | 14:23 |
| henrynash_ | lhcheng: your wish is my command (polishes lamp in corner) | 14:24 |
| *** topol has joined #openstack-keystone | 14:24 | |
| *** ChanServ sets mode: +v topol | 14:24 | |
| *** Ctina has joined #openstack-keystone | 14:25 | |
| *** Ctina is now known as ctina | 14:25 | |
| *** jdennis1 has joined #openstack-keystone | 14:26 | |
| *** jdennis has quit IRC | 14:27 | |
| *** henrynash_ has quit IRC | 14:28 | |
| *** adelia has quit IRC | 14:28 | |
| *** topol has quit IRC | 14:29 | |
| *** roxanaghe has joined #openstack-keystone | 14:29 | |
| *** adelia has joined #openstack-keystone | 14:29 | |
| *** topol has joined #openstack-keystone | 14:29 | |
| *** ChanServ sets mode: +v topol | 14:29 | |
| *** jdennis1 has quit IRC | 14:30 | |
| *** adelia has quit IRC | 14:30 | |
| *** adelia has joined #openstack-keystone | 14:30 | |
| *** jdennis has joined #openstack-keystone | 14:30 | |
| *** btully has quit IRC | 14:32 | |
| *** btully has joined #openstack-keystone | 14:33 | |
| *** roxanaghe has quit IRC | 14:33 | |
| *** markvoelker has joined #openstack-keystone | 14:34 | |
| *** markvoelker_ has quit IRC | 14:35 | |
| *** adelia has quit IRC | 14:42 | |
| *** adelia has joined #openstack-keystone | 14:42 | |
| *** adelia has quit IRC | 14:47 | |
| *** btully has quit IRC | 14:51 | |
| *** petertr7_away is now known as petertr7 | 14:53 | |
| *** btully has joined #openstack-keystone | 14:55 | |
| *** wangqun has quit IRC | 15:00 | |
| *** NM has joined #openstack-keystone | 15:06 | |
| *** dims has quit IRC | 15:08 | |
| *** csoukup has quit IRC | 15:10 | |
| *** navid_ has joined #openstack-keystone | 15:12 | |
| *** csoukup has joined #openstack-keystone | 15:12 | |
| *** btully has quit IRC | 15:15 | |
| *** henrynash has joined #openstack-keystone | 15:16 | |
| *** ChanServ sets mode: +v henrynash | 15:16 | |
| *** btully has joined #openstack-keystone | 15:18 | |
| *** fawadkhaliq has quit IRC | 15:25 | |
| *** fawadkhaliq has joined #openstack-keystone | 15:26 | |
| *** markvoelker_ has joined #openstack-keystone | 15:28 | |
| *** e0ne has quit IRC | 15:29 | |
| *** roxanaghe has joined #openstack-keystone | 15:30 | |
| *** markvoelker has quit IRC | 15:32 | |
| *** markvoelker_ has quit IRC | 15:33 | |
| openstackgerrit | ayoung proposed openstack/keystone: set `is_admin` on tokens for admin project https://review.openstack.org/240719 | 15:33 |
| *** roxanaghe has quit IRC | 15:34 | |
| *** davechen has joined #openstack-keystone | 15:35 | |
| *** belmoreira has quit IRC | 15:35 | |
| *** ninag has quit IRC | 15:36 | |
| *** btully has quit IRC | 15:37 | |
| openstackgerrit | ayoung proposed openstack/keystone: SQLAlchemy column type for storing string arrays as flat strings (materialized path) https://review.openstack.org/251445 | 15:38 |
| *** btully has joined #openstack-keystone | 15:42 | |
| *** tyagiprince has joined #openstack-keystone | 15:44 | |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: Remove eventlet support https://review.openstack.org/249486 | 15:44 |
| *** tyagiprince has quit IRC | 15:46 | |
| *** e0ne has joined #openstack-keystone | 15:47 | |
| *** tyagiprince has joined #openstack-keystone | 15:49 | |
| *** EinstCra_ has quit IRC | 15:49 | |
| *** aix has quit IRC | 15:49 | |
| *** davechen1 has joined #openstack-keystone | 15:50 | |
| *** davechen has quit IRC | 15:52 | |
| *** dims has joined #openstack-keystone | 15:54 | |
| *** adelia has joined #openstack-keystone | 15:55 | |
| openstackgerrit | Boris Bobrov proposed openstack/python-keystoneclient: Support `truncated` flag returned by keystone https://review.openstack.org/250473 | 15:57 |
| *** btully has quit IRC | 15:57 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Materialized path convenience wrapper https://review.openstack.org/251455 | 15:58 |
| *** markvoelker has joined #openstack-keystone | 16:00 | |
| *** fhubik_brb is now known as fhubik | 16:02 | |
| *** petertr7 is now known as petertr7_away | 16:02 | |
| *** lhinds has quit IRC | 16:02 | |
| *** btully has joined #openstack-keystone | 16:03 | |
| *** rcernin has quit IRC | 16:04 | |
| *** dims_ has joined #openstack-keystone | 16:08 | |
| *** dims has quit IRC | 16:10 | |
| *** amakarov has quit IRC | 16:11 | |
| *** tsufiev has quit IRC | 16:11 | |
| *** pkarikh has quit IRC | 16:12 | |
| *** petertr7_away is now known as petertr7 | 16:13 | |
| *** btully has quit IRC | 16:17 | |
| *** amakarov has joined #openstack-keystone | 16:18 | |
| *** diazjf has joined #openstack-keystone | 16:19 | |
| *** sripriya has joined #openstack-keystone | 16:26 | |
| *** petertr7 is now known as petertr7_away | 16:26 | |
| *** btully has joined #openstack-keystone | 16:26 | |
| *** tsufiev has joined #openstack-keystone | 16:27 | |
| *** r-daneel has joined #openstack-keystone | 16:27 | |
| *** pkarikh has joined #openstack-keystone | 16:28 | |
| *** petertr7_away is now known as petertr7 | 16:29 | |
| *** dims has joined #openstack-keystone | 16:30 | |
| *** roxanaghe has joined #openstack-keystone | 16:30 | |
| *** dims_ has quit IRC | 16:33 | |
| *** roxanaghe has quit IRC | 16:35 | |
| *** slberger has joined #openstack-keystone | 16:37 | |
| *** btully has quit IRC | 16:39 | |
| *** deray_ has joined #openstack-keystone | 16:39 | |
| deray_ | hello all | 16:41 |
| deray_ | I am facing an issue with keystone while stacking up using devstack | 16:41 |
| *** btully has joined #openstack-keystone | 16:42 | |
| deray_ | the log shows as: | 16:43 |
| deray_ | "ContextualVersionConflict: (oslo.middleware 2.11.0 (/usr/local/lib/python2.7/dist-packages), Requirement.parse('oslo.middleware>=3.0.0'), set(['keystone']))" | 16:43 |
| deray_ | can anybody help me resolving this? | 16:44 |
| *** EinstCrazy has joined #openstack-keystone | 16:50 | |
| *** fawadkhaliq has quit IRC | 16:50 | |
| *** woodster_ has joined #openstack-keystone | 16:51 | |
| *** fhubik is now known as fhubik_brb | 16:52 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 16:52 |
| *** tyagiprince1 has joined #openstack-keystone | 16:53 | |
| *** tyagiprince has quit IRC | 16:54 | |
| *** tyagiprince1 is now known as tyagiprince | 16:54 | |
| *** EinstCrazy has quit IRC | 16:55 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: SQLAlchemy column type for storing string arrays as flat strings (materialized path) https://review.openstack.org/251445 | 16:57 |
| *** xek_ has joined #openstack-keystone | 16:58 | |
| *** petertr7 is now known as petertr7_away | 16:58 | |
| *** petertr7_away is now known as petertr7 | 16:58 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 16:59 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: SQLAlchemy column type for materialized path https://review.openstack.org/251445 | 16:59 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Use path hybrid property in query filtering https://review.openstack.org/251513 | 16:59 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Materialized path convenience wrapper https://review.openstack.org/251455 | 16:59 |
| *** btully has quit IRC | 17:01 | |
| *** btully has joined #openstack-keystone | 17:02 | |
| *** links has joined #openstack-keystone | 17:08 | |
| openstackgerrit | Tony Wang proposed openstack/keystone: Add `type' filter for list_credentials_for_user https://review.openstack.org/235214 | 17:09 |
| *** fhubik_brb is now known as fhubik | 17:12 | |
| *** btully has quit IRC | 17:13 | |
| *** gyee has joined #openstack-keystone | 17:14 | |
| *** ChanServ sets mode: +v gyee | 17:14 | |
| *** tyagiprince has quit IRC | 17:15 | |
| *** btully has joined #openstack-keystone | 17:16 | |
| *** lhcheng_ has joined #openstack-keystone | 17:17 | |
| *** lhcheng has quit IRC | 17:20 | |
| *** fawadkhaliq has joined #openstack-keystone | 17:22 | |
| *** fhubik is now known as fhubik_brb | 17:25 | |
| *** doug-fish has joined #openstack-keystone | 17:25 | |
| *** stevemar_znc is now known as stevemar | 17:25 | |
| *** ChanServ sets mode: +o stevemar | 17:25 | |
| *** shaleh has joined #openstack-keystone | 17:26 | |
| *** ayoung has quit IRC | 17:28 | |
| *** btully has quit IRC | 17:28 | |
| *** lhcheng_ has quit IRC | 17:29 | |
| breton | it seems that nobody wants to discuss anything today :) | 17:29 |
| *** lhcheng has joined #openstack-keystone | 17:29 | |
| *** ChanServ sets mode: +v lhcheng | 17:29 | |
| *** e0ne has quit IRC | 17:30 | |
| *** roxanaghe has joined #openstack-keystone | 17:31 | |
| *** btully has joined #openstack-keystone | 17:31 | |
| *** petertr7 is now known as petertr7_away | 17:31 | |
| *** roxanaghe has quit IRC | 17:35 | |
| *** deray_ has quit IRC | 17:39 | |
| gyee | breton, yeah, nothing on the agenda today | 17:40 |
| shaleh | the meeting is going to be about voting for specs | 17:40 |
| shaleh | mostly for cores | 17:40 |
| gyee | for everybody | 17:41 |
| *** navid_ has quit IRC | 17:42 | |
| stevemar | shaleh: everyone is allowed to comment | 17:45 |
| stevemar | shaleh: or throw tomatoes at the ptl | 17:46 |
| stevemar | whatever is your jam | 17:46 |
| *** lhcheng_ has joined #openstack-keystone | 17:46 | |
| shaleh | stevemar: :-) hmm, tomato jam.... | 17:46 |
| marekd | stevemar: don't be so harsh for yourself, you are great | 17:46 |
| stevemar | my use of cool urban slang backfired | 17:46 |
| stevemar | marekd: <3 | 17:46 |
| marekd | stevemar: and i mean that.... | 17:46 |
| marekd | :) | 17:47 |
| stevemar | marekd: :P | 17:47 |
| shaleh | stevemar: it is hard to be a hip, urban, white dude | 17:47 |
| stevemar | shaleh: drew carey makes it happen | 17:47 |
| shaleh | stevemar: fake it til you make it | 17:47 |
| gyee | throwing tomatoes to stevemar sounds fun | 17:48 |
| *** spandhe has joined #openstack-keystone | 17:49 | |
| *** lhcheng has quit IRC | 17:49 | |
| stevemar | gyee: i'm gonna bug you for simple reviews since you are here | 17:49 |
| stevemar | gyee: https://review.openstack.org/#/c/249469/ | 17:49 |
| gyee | yes sir | 17:49 |
| stevemar | https://review.openstack.org/#/c/249472/ | 17:49 |
| stevemar | gyee: https://review.openstack.org/#/c/249475/ | 17:50 |
| stevemar | and last one: https://review.openstack.org/#/c/251222/ | 17:50 |
| notmorgan | stevemar: so ksm -> ksa use | 17:50 |
| notmorgan | stevemar: approved | 17:50 |
| * stevemar is selfishly trying to make keystone mitaka-1 ready by tomorrow, cause he's off thursday and friday | 17:50 | |
| stevemar | notmorgan: :O | 17:51 |
| stevemar | baller | 17:51 |
| *** EinstCrazy has joined #openstack-keystone | 17:52 | |
| *** tqtran has joined #openstack-keystone | 17:53 | |
| *** jistr has quit IRC | 17:54 | |
| *** jasonsb has quit IRC | 17:56 | |
| *** EinstCrazy has quit IRC | 17:56 | |
| *** mhickey_ has joined #openstack-keystone | 17:56 | |
| stevemar | notmorgan: want me to update the SHA of my release request ? | 17:57 |
| notmorgan | stevemar: if you don't mind once that lands. | 17:58 |
| notmorgan | stevemar: but i'm not dying to have that fix in the release | 17:58 |
| notmorgan | stevemar: the fixture and the KSA fixes are important | 17:58 |
| stevemar | notmorgan: roger roger | 17:58 |
| openstackgerrit | Merged openstack/keystone-specs: Create an attic for APIs we don't support https://review.openstack.org/248828 | 17:58 |
| stevemar | meeting time! | 17:59 |
| stevemar | ajayaa, amakarov, ayoung, breton, browne, davechen, david8hu, dolphm, dstanek, ericksonsantos, geoffarnold, gyee, henrynash, hogepodge, htruta, jamielennox, joesavak, lbragstad, lhcheng, marekd, morganfainberg, nkinder, raildo, rodrigods, roxanaghe, samueldmq, shaleh, stevemar, tsymanczyk, topol, vivekd, wanghong, claudiub, rderose, samleon, xek, MaxPC, tjcocozz | 17:59 |
| *** spandhe has quit IRC | 17:59 | |
| stevemar | courtesy ping ^ | 17:59 |
| dolphm | stevemar: wrong channel :P | 17:59 |
| *** mhickey_ has quit IRC | 17:59 | |
| stevemar | dolphm: you and bknudson givin me grief | 18:00 |
| * notmorgan debates showing up to the meeting | 18:00 | |
| shaleh | notmorgan: no no no, you debate in the meeting | 18:00 |
| *** ayoung has joined #openstack-keystone | 18:01 | |
| *** ChanServ sets mode: +v ayoung | 18:01 | |
| *** jaosorior has quit IRC | 18:02 | |
| *** ayoung_ has joined #openstack-keystone | 18:02 | |
| *** fhubik_brb is now known as fhubik | 18:02 | |
| *** sripriya has left #openstack-keystone | 18:03 | |
| *** ayoung has quit IRC | 18:03 | |
| *** ayoung_ is now known as ayoung | 18:03 | |
| *** lhcheng_ is now known as lhcheng | 18:12 | |
| *** ChanServ sets mode: +v lhcheng | 18:12 | |
| *** davechen1 is now known as davechen | 18:14 | |
| ayoung | henrynash, ... putting this here for after the meeting. I am assuming a domain specific role can be an implied role, right? I can have on domain specific role impy another domain specific role which then implies a global role.... | 18:22 |
| henrynash | yes | 18:23 |
| *** jed56 has quit IRC | 18:23 | |
| *** diazjf has quit IRC | 18:24 | |
| *** links has quit IRC | 18:24 | |
| *** mancdaz has quit IRC | 18:26 | |
| *** fhubik has quit IRC | 18:26 | |
| *** mancdaz has joined #openstack-keystone | 18:27 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation migration https://review.openstack.org/237047 | 18:29 |
| *** tqtran has quit IRC | 18:30 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Expand endpoint filters to service providers https://review.openstack.org/188534 | 18:30 |
| *** rha has quit IRC | 18:31 | |
| *** jbell8 has joined #openstack-keystone | 18:35 | |
| *** spandhe has joined #openstack-keystone | 18:36 | |
| *** rcernin has joined #openstack-keystone | 18:38 | |
| *** petertr7_away is now known as petertr7 | 18:40 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation driver https://review.openstack.org/209600 | 18:40 |
| openstackgerrit | Merged openstack/oslo.policy: Updated from global requirements https://review.openstack.org/251660 | 18:41 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Explicitly check incorrect token input https://review.openstack.org/206921 | 18:43 |
| *** alex_xu has quit IRC | 18:48 | |
| *** mhickey has quit IRC | 18:48 | |
| *** navid_ has joined #openstack-keystone | 18:50 | |
| *** alex_xu has joined #openstack-keystone | 18:52 | |
| *** fangxu has joined #openstack-keystone | 18:53 | |
| *** jasonsb has joined #openstack-keystone | 18:56 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Explicitly check incorrect token input https://review.openstack.org/206921 | 18:57 |
| ayoung | henrynash, OK, so when implementing domain specific roles, we need to make sure the inference rules do not add DSRs to the token, but we do need to make sure that the DSRs are expanded. | 19:00 |
| ayoung | that is going to change this code.... | 19:00 |
| ayoung | https://review.openstack.org/#/c/242614/13/keystone/assignment/core.py,cm | 19:00 |
| gyee | ayoung, henrynash, sorry I have to run to another meeting | 19:01 |
| gyee | I'll ping you guys after the meeting | 19:01 |
| henrynash | gyee: ok | 19:01 |
| gyee | sorry about that | 19:01 |
| *** gyee has quit IRC | 19:02 | |
| henrynash | ayoung: I’ll ba back on late rtoo | 19:02 |
| davechen | lhcheng: so, you want a deprecation message on top of "identity_uri"? - https://review.openstack.org/#/c/220545/ | 19:03 |
| stevemar | notmorgan: can you check out this pycadf review: https://review.openstack.org/#/c/240979/ | 19:03 |
| notmorgan | stevemar: no i cannot >.> ok i can | 19:04 |
| stevemar | notmorgan: it'll need a major version bump too, and since we're already doing that cause of py26 support... | 19:04 |
| notmorgan | wait what is going on here? | 19:04 |
| stevemar | gordc: ^ | 19:04 |
| openstackgerrit | Merged openstack/keystonemiddleware: Use keystoneauth https://review.openstack.org/235090 | 19:04 |
| stevemar | notmorgan: the bulk of the changes are in identifier.py | 19:05 |
| stevemar | we're changing the type of ID that pycadf generates, so we're changing the data stream | 19:05 |
| stevemar | instead of having it prefixed with "openstack-", it'll just be a UUID | 19:05 |
| notmorgan | so this is going to break people who assumed openstack: before? | 19:05 |
| notmorgan | or looked at that | 19:06 |
| notmorgan | ? | 19:06 |
| stevemar | notmorgan: ye | 19:06 |
| stevemar | s | 19:06 |
| notmorgan | this looks like it's going to impact people who relied on this and/or break their correlation of events | 19:06 |
| gordc | notmorgan: basically. | 19:06 |
| stevemar | which is why it'll be going into a major version bump | 19:07 |
| gordc | notmorgan: main reason is that the 'openstack:' part is already breaking people when they try to define policies | 19:07 |
| notmorgan | i mean.. i guess with a major version bump... | 19:07 |
| notmorgan | gordc: ok.. sure | 19:07 |
| notmorgan | i think we're just in a bad state in both cases | 19:07 |
| gordc | yep | 19:07 |
| notmorgan | +2, someone else +A | 19:08 |
| stevemar | notmorgan: alrighty | 19:08 |
| lbragstad | stevemar small summary with only things that were voted yes - http://cdn.pasteraw.com/ivxkpn54ishq0eazrvjvkalg1xy9f3i | 19:09 |
| gordc | awesome! one more step to making uuid common place. | 19:09 |
| stevemar | lbragstad: thank you sir, you are a gentleman and a scholar | 19:09 |
| stevemar | lbragstad: easy review: https://review.openstack.org/#/c/251222/ ! | 19:10 |
| *** john5223 is now known as zz_john5223 | 19:20 | |
| dolphm | marekd: can you explain gyee's comment on L34? https://review.openstack.org/#/c/240595/4/specs/mitaka/shadow-users.rst,unified | 19:24 |
| marekd | dolphm: you can configure your mapping engine in a way, that a effective user will be a local user | 19:26 |
| marekd | dolphm: dolphm let me find a spec | 19:26 |
| marekd | dolphm: https://github.com/openstack/keystone-specs/blob/master/specs/kilo/federated-direct-user-mapping.rst | 19:27 |
| shaleh | gyee is away for a bit or I would ping him to explain himself | 19:28 |
| marekd | if the targeted user is not a member of 'Federated' Domain it means keystone expects to find a user in a users table, effectively ditching dynamic groups membership and returning whatever local user has | 19:28 |
| *** rderose has joined #openstack-keystone | 19:28 | |
| marekd | dolphm: if you happen to have same backend configured for keystone and your idp you may then use federated as an auth mean (and just that) | 19:29 |
| shaleh | I am not certain if he is arguing for more language in the spec or if he has not considered other use cases | 19:29 |
| marekd | dolphm: we use it for instance. | 19:29 |
| lbragstad | rderose ^ | 19:32 |
| lbragstad | rderose https://github.com/openstack/keystone-specs/blob/master/specs/kilo/federated-direct-user-mapping.rst | 19:32 |
| *** roxanaghe has joined #openstack-keystone | 19:32 | |
| *** roxanagh_ has joined #openstack-keystone | 19:33 | |
| *** roxanagh_ has quit IRC | 19:37 | |
| *** aginwala has joined #openstack-keystone | 19:46 | |
| *** diazjf has joined #openstack-keystone | 19:48 | |
| *** petertr7 is now known as petertr7_away | 19:51 | |
| *** jbell8 has quit IRC | 19:54 | |
| *** petertr7_away is now known as petertr7 | 19:57 | |
| *** jbell8 has joined #openstack-keystone | 20:01 | |
| dolphm | marekd: (thanks!) | 20:06 |
| *** fawadkhaliq has quit IRC | 20:09 | |
| openstackgerrit | Merged openstack/pycadf: make generate_uuid return valid uuid https://review.openstack.org/240979 | 20:10 |
| *** diazjf has quit IRC | 20:12 | |
| *** btully has quit IRC | 20:12 | |
| marekd | dolphm: no problem | 20:13 |
| *** aginwala has quit IRC | 20:14 | |
| *** btully has joined #openstack-keystone | 20:14 | |
| *** aginwala has joined #openstack-keystone | 20:17 | |
| *** fangxu has quit IRC | 20:23 | |
| *** NM has quit IRC | 20:31 | |
| *** errr_ is now known as errr | 20:32 | |
| openstackgerrit | Priti Desai proposed openstack/keystone: Fix for listing role assignments by project admin https://review.openstack.org/248892 | 20:33 |
| *** roxanagh_ has joined #openstack-keystone | 20:34 | |
| lbragstad | marekd what refactorization needs to be done in the mapping engine here (line 179) - https://review.openstack.org/#/c/240595/4/specs/mitaka/shadow-users.rst,unified | 20:37 |
| marekd | lbragstad: where would you specify what roles will be assigned to the shadow (federated) user? | 20:38 |
| *** roxanagh_ has quit IRC | 20:38 | |
| marekd | lbragstad: you must assume there is no such user in the database until somebody logs in for the first time | 20:38 |
| marekd | unless i misunderstood some concepts there. | 20:39 |
| lbragstad | marekd the current mapping engine determines which roles a user gets based on the attributes in the SAML, right? | 20:41 |
| *** EinstCrazy has joined #openstack-keystone | 20:41 | |
| marekd | lbragstad: no, it determines membership of the groups you will be. | 20:42 |
| marekd | groups is your link to roles. | 20:42 |
| lbragstad | marekd ah, right | 20:42 |
| lbragstad | marekd i was mixed up, I think we talked about being able to map directly to roles at the summit | 20:42 |
| marekd | perhaps :-) | 20:42 |
| lbragstad | marekd so, the mapping engine will have to be refactored to be smart enough to handle mapping to groups *and* users | 20:43 |
| marekd | in a sense you just wrote i can answer "it it smart enough to do so today". But i think you meant "shadow users"... | 20:44 |
| marekd | right? | 20:44 |
| marekd | lbragstad: | 20:44 |
| lbragstad | marekd yes | 20:44 |
| marekd | lbragstad: to be honest i am not sure how to solve it... | 20:44 |
| lbragstad | marekd it will have to be refactored to be smart enough to handle groups, local users, and shadow users | 20:45 |
| *** diazjf has joined #openstack-keystone | 20:45 | |
| marekd | dolphm: lbragstad shadow users change pretty much everything in terma of federation - i am not sure how to keep old maping rules doing what they are doing today | 20:45 |
| marekd | we can introduce new syntax, that's fine | 20:46 |
| marekd | lbragstad: do you know what i mena? | 20:47 |
| marekd | mean | 20:47 |
| *** btully has quit IRC | 20:47 | |
| *** EinstCrazy has quit IRC | 20:47 | |
| lbragstad | marekd yeah, kind of | 20:47 |
| lbragstad | marekd i need to familiarize myself with the mapping engine again | 20:47 |
| lbragstad | marekd i'm leaving a comment on the spec now | 20:47 |
| marekd | lbragstad: i need to do that everytime i am debugging those areas of code :P | 20:48 |
| lbragstad | marekd line 179 - https://review.openstack.org/#/c/240595/4/specs/mitaka/shadow-users.rst | 20:48 |
| *** btully has joined #openstack-keystone | 20:48 | |
| lbragstad | marekd does my response make sense? | 20:48 |
| marekd | yes | 20:51 |
| *** rderose has quit IRC | 20:51 | |
| *** rderose has joined #openstack-keystone | 20:51 | |
| marekd | after rethinking it i reckon this spec is quite big chunk of work and it may take >1 cycles to implement and merge unless somebody makes it a primary task. | 20:53 |
| openstackgerrit | Monty Taylor proposed openstack/python-keystoneclient: Accept v2 params to v3 service create https://review.openstack.org/233102 | 20:54 |
| *** mnaser has quit IRC | 20:58 | |
| shaleh | ^^^ shouldnt we make a deprecation notice if they do that? | 21:01 |
| *** raildo is now known as raildo-afk | 21:01 | |
| *** pauloewerton has quit IRC | 21:03 | |
| *** aginwala has quit IRC | 21:05 | |
| *** mnaser has joined #openstack-keystone | 21:06 | |
| *** aginwala has joined #openstack-keystone | 21:08 | |
| *** navid__ has joined #openstack-keystone | 21:10 | |
| *** navid_ has quit IRC | 21:10 | |
| openstackgerrit | Merged openstack/keystone: Remove RequestBodySizeLimiter from middleware https://review.openstack.org/249469 | 21:11 |
| dolphm | stevemar: fyi, lbragstad and rderose just went through the unified auth spec, left a few comments in response, but didn't have any need to submit a revision. so, it's sitting there with 2x+2 and a few -1's | 21:14 |
| dolphm | i think marekd is the only -1 that might be online ^ | 21:15 |
| *** navid__ has quit IRC | 21:15 | |
| openstackgerrit | ayoung proposed openstack/keystone: Updated Cloudsample https://review.openstack.org/240720 | 21:16 |
| stevemar | dolphm: i'm OK with +A'ing specs with the assumption that there is a bit of clean up to do | 21:16 |
| stevemar | bknudson, you working on friday? | 21:16 |
| bknudson | stevemar: I'm on vaca friday | 21:16 |
| stevemar | lol | 21:16 |
| stevemar | everyone seems to be! | 21:16 |
| dolphm | stevemar: can we close the New Bug form down for friday? | 21:17 |
| *** btully has quit IRC | 21:17 | |
| dolphm | "Report a bug" | 21:17 |
| openstackgerrit | ayoung proposed openstack/keystone: Updated Cloudsample https://review.openstack.org/240720 | 21:17 |
| openstackgerrit | Merged openstack/keystone: Remove check_role_for_trust https://review.openstack.org/249472 | 21:18 |
| openstackgerrit | Merged openstack/keystone: Remove deprecated notification event_type https://review.openstack.org/249475 | 21:18 |
| openstackgerrit | Merged openstack/keystone: Fix a typo in notifications function doc https://review.openstack.org/250876 | 21:18 |
| dolphm | stevemar: cleanup on what? the spec? | 21:20 |
| *** btully has joined #openstack-keystone | 21:20 | |
| *** mhickey has joined #openstack-keystone | 21:21 | |
| marekd | dolphm: stevemar: if you feel my comments are invalid orrrr you know how to handle everything i mentioned feel free to +A. | 21:22 |
| dolphm | marekd: they responded to your comments | 21:22 |
| dolphm | marekd: lbragstad / rderose did | 21:22 |
| *** ctina_ has joined #openstack-keystone | 21:22 | |
| dolphm | marekd: ah, they missed your newest comment :) | 21:24 |
| marekd | dolphm: no, i also left comment for the review (not inlined) | 21:25 |
| marekd | when i first -1 it. | 21:25 |
| marekd | "I am unsure on where operator would assign roles to a shadow users. [...]" | 21:25 |
| marekd | "What about backwards compatibility especially wrt old mapping rules, dynamic group membership etc? [..]" | 21:25 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Make keystone fully fledged SAML2 Service Provider https://review.openstack.org/244694 | 21:26 |
| *** dulek has quit IRC | 21:26 | |
| *** ctina has quit IRC | 21:26 | |
| marekd | dolphm: I think those are important topics. | 21:26 |
| *** dulek has joined #openstack-keystone | 21:27 | |
| *** ctina_ has quit IRC | 21:27 | |
| *** harlowja has quit IRC | 21:27 | |
| *** harlowja has joined #openstack-keystone | 21:28 | |
| lbragstad | marekd wouldn't an operator just assign roles like they would to any other user? | 21:29 |
| marekd | lbragstad: for federated user? | 21:29 |
| lbragstad | yes | 21:30 |
| lbragstad | since a federated user entity points to a shadow user | 21:30 |
| rderose | agree | 21:30 |
| marekd | lbragstad: so, as an operator you will need to create shadow users for all people from CERN IT | 21:30 |
| marekd | before they even login. | 21:31 |
| *** mancdaz has quit IRC | 21:31 | |
| lbragstad | no, the shadow user is created after the saml assertion is validated | 21:31 |
| lbragstad | once the identity is verified | 21:31 |
| *** rcernin has quit IRC | 21:31 | |
| rderose | mapping is created from token + saml | 21:31 |
| marekd | ok, so i madenis login for the first time. My assertion is valid, but i wil be blocked and wait for operator to assign me roles? | 21:32 |
| marekd | lbragstad: you just mentioned that operator would assign roles to a user. | 21:32 |
| *** jerrygb has quit IRC | 21:32 | |
| marekd | shadow user is created after my first login. | 21:32 |
| marekd | so it looks only then an operator can assign roles? | 21:32 |
| *** mancdaz has joined #openstack-keystone | 21:32 | |
| *** navid_ has joined #openstack-keystone | 21:33 | |
| *** roxanagh_ has joined #openstack-keystone | 21:34 | |
| *** aginwala has quit IRC | 21:35 | |
| marekd | lbragstad: rderose: looks like mapping engine will be responsible for that for the first time OR we need to add some new kickass feature which doesn't seem to be mentined in the spec. | 21:36 |
| lbragstad | marekd the operator assigns roles to the group the same way they do now | 21:36 |
| lbragstad | marekd option A | 21:36 |
| marekd | lbragstad: so, it's still membership through groups? | 21:36 |
| lbragstad | yes | 21:36 |
| marekd | it wasn't stated clearly in the spec :P | 21:36 |
| lbragstad | marekd the mapping engine will create a shadow user and also make that user a member of the groups in the mapping | 21:37 |
| shaleh | once the shadow exists the op can specify a specific mapping for a specific user, right? | 21:37 |
| marekd | shaleh: the problem is shadow user doesn't exist until you login | 21:37 |
| shaleh | marekd: understood | 21:37 |
| rderose | shaleh: you cannot do this today | 21:38 |
| shaleh | ayoung was talking about using a hash or the like so they could be precomputed | 21:38 |
| shaleh | getting around the login issue potentally | 21:38 |
| ayoung | shaleh, we do something like that with LDAP and multi backends | 21:38 |
| shaleh | if I remember correctly | 21:38 |
| ayoung | sha256{domain_id, userid} | 21:39 |
| marekd | shaleh: (and dolphm lbragstad ) oh, precomutping hash is another thing | 21:39 |
| *** roxanagh_ has quit IRC | 21:39 | |
| *** xek_ has quit IRC | 21:39 | |
| shaleh | ayoung: thank you, I remembered the high level bits but not the detail | 21:40 |
| ayoung | shaleh, look for id_mapping in keystone/identity/ for the details | 21:40 |
| *** fangxu has joined #openstack-keystone | 21:42 | |
| *** Guest55984 has quit IRC | 21:45 | |
| *** gildub has joined #openstack-keystone | 21:47 | |
| *** btully has quit IRC | 21:48 | |
| *** tsymanczyk has joined #openstack-keystone | 21:50 | |
| *** tsymanczyk is now known as Guest56486 | 21:50 | |
| lbragstad | ayoung the precomputed part was just to ensure authentication from two different auth types is mapped to the same shadow user, right? | 21:50 |
| ayoung | lbragstad, yes | 21:51 |
| ayoung | lbragstad, needed to pre-populate roles even in the case where there is only a single IDP,. too | 21:51 |
| *** topol has quit IRC | 21:51 | |
| lbragstad | ayoung could you map roles to federated users without using groups, would that work? | 21:52 |
| ayoung | lbragstad, I should say "propopulate role assignments" say you have not visited a cloud before.... | 21:52 |
| ayoung | lbragstad, I'm not certain how to parse that | 21:53 |
| ayoung | if by "map" you mean "use the federation mapping" then, in theory (and chadwick origianlly wanted that) but we can't allow other-than-admin to do that today | 21:53 |
| lbragstad | today federated users are mapped into groups, which have role assignments. | 21:53 |
| marekd | ayoung: create assignments to a 'dangling user', entity which will exist one day, but doesn't NOW | 21:53 |
| ayoung | lbragstad, in theory, yes. IN practice, there are no groups | 21:53 |
| ayoung | marekd, sounds like the virtual org spec | 21:54 |
| marekd | ayoung: perhaps | 21:54 |
| *** btully has joined #openstack-keystone | 21:54 | |
| ayoung | marekd, I think we need a way to say "what will ayoung@redhat.com get as a userid when he hits my cloud." | 21:54 |
| marekd | ayoung: i know that. | 21:55 |
| ayoung | that was the a"diagnostist" thmessage I sent to the mailing list | 21:55 |
| lbragstad | ayoung if you have no groups, how do you have role or role assignments? | 21:55 |
| *** navid_ has quit IRC | 21:55 | |
| marekd | uh, it's late i need to run. will read that convo tomorrow. | 21:55 |
| lbragstad | marekd o/ | 21:56 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: remove version from setup.cfg https://review.openstack.org/252078 | 21:57 |
| stevemar | keystoners: dstanek marekd lbragstad dolphm notmorgan henrynash jamielennox lhcheng gyee ayoung bknudson -- anything else critical that you guys want to land in mitaka-1? i plan on just adding release notes for things we've done so far and then tagging | 21:59 |
| ayoung | lbragstad, that is the conundrum, and why we need to be able to precompute userids | 22:00 |
| bknudson | I don't think we have any critical bugs to fix now. | 22:00 |
| ayoung | lbragstad, groups are kindof meaningless. THe fact that, say richm or nkinder and I are both in the IdM group at red hat does not show up in our SAAML assertions produced by Red Hat's saml provider. And even if they did, they would not mean that we should get the same permissions in an HP cloud used for hosting Keystone development on Openstack, right? | 22:01 |
| notmorgan | stevemar: all the things | 22:01 |
| *** aginwala has joined #openstack-keystone | 22:02 | |
| ayoung | really, the only thing you would have to go on if you were setting this up is my user name | 22:02 |
| lbragstad | stevemar - https://review.openstack.org/#/c/240595/4 | 22:03 |
| stevemar | specs are tomorrow | 22:04 |
| stevemar | this is what is going to go into mitaka-1, the actualy keystone code base | 22:04 |
| stevemar | (i assume not much) | 22:04 |
| stevemar | how the hell do we have 118 blueprints | 22:05 |
| stevemar | we need a blueprint squash day | 22:06 |
| stevemar | theres gotta be a bunch of overlap there | 22:06 |
| lbragstad | stevemar blueprint were superseded by specs | 22:07 |
| lbragstad | blueprints* | 22:07 |
| stevemar | lbragstad: excellent, i will mark them all as obsolete | 22:07 |
| lbragstad | rm -rf / | 22:07 |
| lbragstad | i believe that is what you're looking for | 22:07 |
| *** jbell8 has quit IRC | 22:08 | |
| ayoung | stevemar, blueprints are needed for the launchpad side fo things, but should be 1 to 1 with specs | 22:09 |
| *** jbell8 has joined #openstack-keystone | 22:10 | |
| ayoung | I'd kill any BP where the spec url is not a gerrit spec | 22:10 |
| stevemar | ayoung: yargh | 22:10 |
| stevemar | i agree | 22:10 |
| stevemar | there are some decent ideas in there | 22:10 |
| stevemar | but it's making it hard to track thigns | 22:11 |
| *** davechen has left #openstack-keystone | 22:12 | |
| *** zz_john5223 has quit IRC | 22:13 | |
| *** dtroyer has quit IRC | 22:14 | |
| *** dtroyer has joined #openstack-keystone | 22:15 | |
| *** rderose has quit IRC | 22:15 | |
| *** diazjf has quit IRC | 22:16 | |
| *** zz_john5223 has joined #openstack-keystone | 22:16 | |
| bknudson | we've got some bps that we said didn't need a spec | 22:17 |
| bknudson | hopefully they're all implemented by now | 22:17 |
| *** harlowja has quit IRC | 22:19 | |
| *** ayoung has quit IRC | 22:21 | |
| *** harlowja has joined #openstack-keystone | 22:21 | |
| *** gyee has joined #openstack-keystone | 22:22 | |
| *** ChanServ sets mode: +v gyee | 22:22 | |
| *** NM has joined #openstack-keystone | 22:23 | |
| *** gordc has quit IRC | 22:24 | |
| *** petertr7 is now known as petertr7_away | 22:26 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add release notes for mitaka-1 https://review.openstack.org/249523 | 22:27 |
| stevemar | gyee: around? | 22:28 |
| gyee | stevemar, yes sir | 22:29 |
| gyee | jumping back to spec reviews | 22:29 |
| stevemar | gyee: can you give me a one line description for x509 SSL cert auth support? | 22:29 |
| stevemar | i need to make a release note for it, it was merged before the releasenotes stuff came along | 22:29 |
| gyee | Support tokenless client SSL x.509 certificate authentication and authorization | 22:30 |
| stevemar | gyee: that's good enough for an operator? | 22:32 |
| gyee | yeah, the setup is in the doc already | 22:32 |
| *** jerrygb has joined #openstack-keystone | 22:32 | |
| gyee | stevemar, I need to start writing blogs about keystone features | 22:33 |
| stevemar | gyee: don't do it, it's a trick | 22:33 |
| gyee | hah | 22:33 |
| stevemar | you just end up getting emails and questions | 22:33 |
| gyee | charge them for it and make some $$ on the side :) | 22:34 |
| gyee | stevemar, https://github.com/openstack/keystone/blob/master/doc/source/configure_tokenless_x509.rst | 22:34 |
| gyee | if you prefer, we can use the Definitions section | 22:34 |
| stevemar | nah, thats good enough for now | 22:35 |
| *** roxanagh_ has joined #openstack-keystone | 22:35 | |
| *** NM has quit IRC | 22:35 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add release notes for mitaka-1 https://review.openstack.org/249523 | 22:36 |
| notmorgan | jamielennox: ping [you around?] | 22:36 |
| *** NM has joined #openstack-keystone | 22:36 | |
| stevemar | if i could get eyes on https://review.openstack.org/#/c/249523/ << this should be the last patch landing in mitaka | 22:36 |
| gyee | looking | 22:37 |
| *** jerrygb has quit IRC | 22:37 | |
| jamielennox | notmorgan: listening in to a meeting but sure | 22:38 |
| shaleh | stevemar: does that mean more stringent control on checkins for the next part of the cycle? | 22:38 |
| stevemar | shaleh: ? | 22:39 |
| stevemar | shaleh: does what mean that? | 22:39 |
| shaleh | "this should be the last patch landing in mitaka" | 22:39 |
| stevemar | oops | 22:39 |
| stevemar | mitaka-1! | 22:39 |
| stevemar | mitaka-2 should just be implementing all the features we agreed to in keystone-specs | 22:40 |
| shaleh | stevemar: this is my first full cycle | 22:40 |
| stevemar | i understand, that was my bad | 22:40 |
| *** EinstCrazy has joined #openstack-keystone | 22:40 | |
| *** roxanagh_ has quit IRC | 22:40 | |
| stevemar | mitaka-3 should be clean up, major bugs and stability | 22:40 |
| stevemar | each is about 6 weeks, so we have 6 hellish weeks to get all the fucntionality in :) | 22:40 |
| shaleh | I see | 22:41 |
| stevemar | happy holidays! | 22:41 |
| shaleh | so the mid-cycle is a chance to check on the state of the code and plan out the cleanup/finish? | 22:41 |
| stevemar | shaleh: that's supposed to be the case | 22:41 |
| gyee | stevemar, I like your style, celebrate holidays by doing bug triage | 22:41 |
| *** aginwala has quit IRC | 22:42 | |
| shaleh | gyee: it is like the world's worst Advent calendar :-) | 22:42 |
| gyee | hah | 22:42 |
| stevemar | shaleh: but i will understand if there is some spillage, and we should consider stretching out our deadline to land stuff by a week or so | 22:42 |
| stevemar | to take the midcycle into account | 22:42 |
| bknudson | according to http://russellbryant.net/openstack-stats/keystone-openreviews.html we've already got 258 reviews to handle | 22:43 |
| gyee | shaleh, I literally renamed my Keystone bug email rule to Steve, no kidding | 22:43 |
| stevemar | bknudson: what are you waiting for! review! | 22:44 |
| stevemar | gyee: i feel honored | 22:44 |
| gyee | he'll start with 258 -1s | 22:44 |
| *** edmondsw has quit IRC | 22:44 | |
| *** EinstCrazy has quit IRC | 22:45 | |
| *** adelia_ has joined #openstack-keystone | 22:46 | |
| *** mhickey has quit IRC | 22:46 | |
| shaleh | bknudson: might be time to bless another core or two | 22:47 |
| *** Guest56486 is now known as tsymanczyk | 22:48 | |
| *** adelia has quit IRC | 22:49 | |
| *** aginwala has joined #openstack-keystone | 22:50 | |
| *** adelia_ has quit IRC | 22:51 | |
| bknudson | y, we do have some people doing lots of reviews... http://russellbryant.net/openstack-stats/keystone-reviewers-90.txt | 22:51 |
| *** r-daneel has quit IRC | 22:52 | |
| *** chmouel has quit IRC | 22:55 | |
| shaleh | 59 0 0 59 0 0 100.0% | 5 ( 8.5%) | 22:56 |
| *** chmouel has joined #openstack-keystone | 22:56 | |
| *** harlowja has quit IRC | 22:57 | |
| bknudson | it's hard to trust someone who only +1s. We'd have to check the reviews. | 22:57 |
| gyee | bknudson, the guys must have a very positive attitude :) | 22:58 |
| stevemar | venkatamahesh is my hero | 22:58 |
| stevemar | | venkatamahesh | 84 0 1 83 0 0 98.8% | 4 ( 4.8%) | | 22:58 |
| stevemar | theres a guy who only seems to +1 bot proposals | 22:58 |
| stevemar | i forget who he is... | 22:58 |
| gyee | no disagreement what so ever | 22:58 |
| gyee | team playa | 22:59 |
| shaleh | that is what happens when work places stupid quota checks on you | 23:00 |
| shaleh | "have you reviewed enough this week? No, sorry that will hurt your rankings during our yearly reviews" | 23:01 |
| stevemar | gyee: haha http://stackalytics.com/?user_id=clint | 23:01 |
| stevemar | proposal bot guy! | 23:01 |
| *** harlowja has joined #openstack-keystone | 23:01 | |
| gyee | from HP?! | 23:02 |
| bknudson | he might be a bot | 23:02 |
| * stevemar shrugs | 23:02 | |
| stevemar | bknudson: HP is making sophisticated bots | 23:02 |
| bknudson | proposal bot reviewer bot | 23:02 |
| stevemar | lol | 23:02 |
| * gyee give shaleh a jingle | 23:02 | |
| bknudson | you mean HPE | 23:02 |
| gyee | No! | 23:03 |
| bknudson | HP just makes printers | 23:03 |
| shaleh | bknudson: and laptops | 23:03 |
| gyee | its Hewlett Packard Enterprise | 23:03 |
| gyee | you dig? | 23:03 |
| stevemar | bknudson: can you kick this through? https://review.openstack.org/#/c/249523/ so i can attach a SHA to the release request | 23:03 |
| bknudson | gyee drank the kool-aid | 23:03 |
| gyee | damn straight | 23:03 |
| bknudson | stevemar: I'll look at it tonight I have to take off. | 23:03 |
| *** jdennis has quit IRC | 23:05 | |
| *** omkarjoshi has joined #openstack-keystone | 23:05 | |
| *** NM has quit IRC | 23:06 | |
| stevemar | bknudson: alrighty | 23:07 |
| stevemar | bknudson: have fun bowling | 23:07 |
| shaleh | https://review.openstack.org/#/c/233102 | 23:09 |
| shaleh | Monty proposed this one. It allows v2 args into v3 CRUD | 23:09 |
| stevemar | shaleh: it sure does | 23:09 |
| shaleh | wouldn't we want to emit a deprecation wwarning? | 23:09 |
| stevemar | shaleh: yes we would | 23:10 |
| stevemar | shaleh: or just move "service_type" to be the last paramtere | 23:10 |
| shaleh | stevemar: will the user of that code see anything from keystone? Or does the warning need to be in the client library? | 23:10 |
| stevemar | user's would see the warnin g | 23:11 |
| *** csoukup has quit IRC | 23:11 | |
| shaleh | stevemar: what does moving service_type to the end do? | 23:11 |
| stevemar | shaleh: if someone is using it like: create('myname', mytype, True, 'my description') << then they'll get wonky results if the 3rd argument is now service_type | 23:13 |
| shaleh | stevemar: Monty wants this call to succeed. Moving service_type into the kwargs would cause it to fail. | 23:13 |
| *** slberger has left #openstack-keystone | 23:14 | |
| shaleh | stevemar: yeah the implication is people only use kw style args | 23:14 |
| stevemar | shaleh: yep | 23:14 |
| stevemar | shaleh: either make it the last parameter, before kwargs, or check if `service_type` is in kwargs | 23:14 |
| shaleh | stevemar: lots of keystone code is like that | 23:14 |
| stevemar | and then use it | 23:14 |
| shaleh | stevemar: Monty's patch has service_type as last arg before kwargs | 23:15 |
| shaleh | ah but he is not consistent | 23:15 |
| shaleh | I see your point | 23:15 |
| stevemar | mordred: ^ | 23:16 |
| shaleh | I personally use the inspect kwargs when I write this kind of code | 23:16 |
| stevemar | we're chatting about you | 23:16 |
| stevemar | shaleh: that could work | 23:16 |
| stevemar | feel free to propose a new patch | 23:16 |
| stevemar | i have to go cook and setup a christmas tree | 23:16 |
| stevemar | so long folks! | 23:16 |
| shaleh | cheers | 23:16 |
| gyee | merry christmas | 23:20 |
| shaleh | when i loaded it there were no comments. Weird. Oh well. Sorry stevemar. | 23:23 |
| mordred | what did I do? | 23:24 |
| mordred | I am not consistent | 23:24 |
| shaleh | mordred: we were talking about your revire 233102 | 23:25 |
| shaleh | s/revire/review/ | 23:25 |
| mordred | shaleh: my main goal is that I can make calls that are compatible regardless of whether I'm doing v2 or v3 | 23:25 |
| *** david-lyle has quit IRC | 23:25 | |
| shaleh | mordred: I support that. I don't like confusing the function parameters. It makes it confusing for people trying to determine how to correctly call the function. | 23:26 |
| shaleh | and as stevemar points out it breaks peopple no using kwargs | 23:26 |
| mordred | cool! happy to fix it then | 23:26 |
| shaleh | hmm, keyboard and I are not geling | 23:26 |
| shaleh | mordred: what about deprecations though? The user making v2 calls to a v3 interface should see a warning that they are not heading towards obsolescence. | 23:27 |
| mordred | well.... | 23:27 |
| notmorgan | wait but it's using the V3 interface? | 23:28 |
| mordred | so the problem is with the person who wants to write code that works on his clouds | 23:28 |
| mordred | yes | 23:28 |
| notmorgan | why would that raise a deprecation | 23:28 |
| notmorgan | ? | 23:28 |
| mordred | because getting a v2 or a v3 object is different than making calls | 23:28 |
| shaleh | v2 args to a v3 interface | 23:28 |
| mordred | because we're adding a v2 param name | 23:28 |
| notmorgan | shaleh: but... | 23:28 |
| mordred | v3 changed "service_type" to "type" | 23:28 |
| notmorgan | i don't see a reason that needs to be a "OMG DO SOMETHING ELSE" | 23:28 |
| notmorgan | warning | 23:28 |
| notmorgan | i mean, it could? | 23:28 |
| shaleh | allowing code to keep using the old args tends to lead to subtle bugs though | 23:29 |
| mordred | so a person who writes "client.services.create(service_type='foo')" - may not konw at that part of the code that it's a v2 or a v3 object | 23:29 |
| shaleh | we should alert them that they are heading down a less well lit path | 23:29 |
| mordred | honestly, we should add type as an arg to the v2 path too | 23:29 |
| notmorgan | unless the v2/v3 is hitting the same underlying code path | 23:29 |
| mordred | and we should label both as supported-until-the-end-of-time | 23:29 |
| mordred | otherwise end-users have to write this code: | 23:30 |
| mordred | https://github.com/openstack-infra/shade/blob/master/shade/operatorcloud.py#L762-L772 | 23:30 |
| *** spandhe has quit IRC | 23:30 | |
| mordred | which makes bunnies sad | 23:30 |
| mordred | and nobody wants sad bunnies | 23:31 |
| *** darrenc is now known as darrenc_afk | 23:31 | |
| shaleh | mordred: that code has to live somewhere. | 23:31 |
| shaleh | if it HAS to live in keystone, I would rather you inspect kwargs as I suggest in my review | 23:31 |
| notmorgan | ugh | 23:31 |
| mordred | okie! | 23:31 |
| shaleh | this keeps the method/function interface appropriate for v3 but supports old usage | 23:32 |
| notmorgan | but.. i mean. no | 23:32 |
| notmorgan | **kwargs is terrible and shouldn't be used | 23:32 |
| notmorgan | it makes bunnies cry too | 23:32 |
| shaleh | notmorgan: shush or really come back :-) | 23:32 |
| notmorgan | shaleh: i still have -2 powers | 23:32 |
| notmorgan | :P | 23:32 |
| notmorgan | shaleh: seriously, **kwargs is terrible | 23:32 |
| shaleh | notmorgan: nonsense | 23:32 |
| notmorgan | we should clearly state what we expect | 23:32 |
| *** jdennis has joined #openstack-keystone | 23:33 | |
| notmorgan | in function defs. | 23:33 |
| shaleh | when a user reads the code they should see how to use it. Advertising competing arguments in the function def is silly | 23:33 |
| notmorgan | taking a bundle of *random* from **kwargs is horrible | 23:33 |
| notmorgan | shaleh: i will never agree to that statement | 23:33 |
| notmorgan | because i also like C and proper polymorphism | 23:33 |
| notmorgan | and C++ | 23:33 |
| shaleh | notmorgan: that is what I am suggesting. The function def defines the actual, expected arguments. For compatibility we look for old ones in kwargs | 23:33 |
| notmorgan | no | 23:33 |
| notmorgan | you didn't read what i said. | 23:33 |
| notmorgan | i am saying we support both ways | 23:34 |
| *** spandhe has joined #openstack-keystone | 23:34 | |
| shaleh | notmorgan: which is boneheaded and leads to 100 parameters because we used one 5 releases ago and changed our minds | 23:34 |
| notmorgan | it is fine to explicitly define them and in the docstring explaining args to say "these are the same thing" | 23:34 |
| notmorgan | shaleh: we should stop changing our minds | 23:34 |
| *** e0ne has joined #openstack-keystone | 23:34 | |
| shaleh | notmorgan: I do not disagree, but since we have already lots take the bandaid off and move on | 23:35 |
| notmorgan | shaleh: the fact that the arguments changed names even though it is the same thing is the issue | 23:35 |
| notmorgan | it should *never* have changed names in the first place | 23:35 |
| shaleh | notmorgan: not disagreeing with you. but it happened | 23:35 |
| notmorgan | i am monumentally against "oh just yank this out of kwargs" | 23:35 |
| notmorgan | and always will be | 23:35 |
| *** e0ne has quit IRC | 23:36 | |
| shaleh | why? As a new coder asked to use the method, how should they choose between type and service_type? | 23:36 |
| notmorgan | if it is a supported arg, it is a supported arg. i would be happy if **kwargs was never used in something a user could consume | 23:36 |
| *** roxanagh_ has joined #openstack-keystone | 23:36 | |
| notmorgan | and yes, i am ok with 10000000 args | 23:36 |
| notmorgan | rather than magic from random keywords | 23:36 |
| *** e0ne has joined #openstack-keystone | 23:36 | |
| notmorgan | also because **kwargs means typos sneak through | 23:37 |
| notmorgan | serviec_type would silently fall through | 23:37 |
| shaleh | notmorgan: which get caught as bogus args at some point | 23:37 |
| notmorgan | again, i am against the **kwargs inspection | 23:37 |
| *** ayoung has joined #openstack-keystone | 23:37 | |
| *** ChanServ sets mode: +v ayoung | 23:37 | |
| notmorgan | now if stevemar says "we do **kwargs inspection" i'll not block it | 23:37 |
| notmorgan | but i really do disagree with that approach | 23:38 |
| notmorgan | heck i wont even block it based on this convo | 23:38 |
| notmorgan | i will point out i very much disagree when the code is written | 23:38 |
| shaleh | notmorgan: I agree with all of your points for standard code practices. I disagree when handling backwards compat issues. | 23:39 |
| *** e0ne_ has joined #openstack-keystone | 23:39 | |
| notmorgan | but it's not worth a "force another review" and cycle of code for a point that is largely principle | 23:39 |
| shaleh | either way, mordred's patch as written breaks positional parameters so at least that needs to be fixed. | 23:39 |
| notmorgan | [as you may have noticed i rarely -1 things these days unless it's really simple] | 23:39 |
| notmorgan | shaleh: and that much yes. that is fine | 23:40 |
| notmorgan | don't break positional | 23:40 |
| notmorgan | annnnnnyway. i wont block your recommended chang e(or even -1 it) | 23:40 |
| *** roxanagh_ has quit IRC | 23:41 | |
| shaleh | notmorgan: disagreeing but not enforcing it is pretty useless. The point of these reviews is to achieve consensus through argument. | 23:41 |
| *** e0ne has quit IRC | 23:41 | |
| notmorgan | shaleh: forcing another review and another cycle is not worth an argument on princple | 23:41 |
| *** dstanek has quit IRC | 23:41 | |
| *** dstanek has joined #openstack-keystone | 23:41 | |
| *** ChanServ sets mode: +v dstanek | 23:41 | |
| shaleh | notmorgan: if that were true then we are wasting our time on reviews | 23:42 |
| notmorgan | i would argue if i -1 this recommended change you made, i am well into the bikeshed realm | 23:42 |
| shaleh | style is just as important in coding as not writing bugs. In fact, style helps prevent bugs. | 23:42 |
| notmorgan | so, i'm arguing the point in channel before the review | 23:43 |
| shaleh | unless the group agrees that my proposed solution of parsing kwargs is boneheaded | 23:43 |
| *** topol has joined #openstack-keystone | 23:43 | |
| *** ChanServ sets mode: +v topol | 23:43 | |
| notmorgan | if we disagree, great, i'm telling you my stance and i am willing to concede that this isn't important enough stylistically to force another review | 23:43 |
| notmorgan | if it lands inspecting **kwargs | 23:43 |
| notmorgan | vs. declared | 23:43 |
| notmorgan | so, i defer to mordred's choice on approach | 23:44 |
| notmorgan | as long as we aren't breaking positional args | 23:45 |
| shaleh | mordred: marking "support old stuff" vs. expected should be considered in your future patches :-) | 23:45 |
| * notmorgan goes back to other things. | 23:45 | |
| notmorgan | like talking betamax with jamielennox in keystoneauth | 23:45 |
| mordred | shaleh: ++ | 23:46 |
| mordred | mmm | 23:46 |
| mordred | betamax | 23:46 |
| notmorgan | mordred: to be fair... i almost did go digital medium format >.< | 23:46 |
| notmorgan | mordred: they had a used one... | 23:46 |
| notmorgan | mordred: you're a bad influence | 23:46 |
| notmorgan | ^_^ | 23:46 |
| shaleh | notmorgan: I have not been able to justify 10k on a camera | 23:46 |
| notmorgan | shaleh: it was only going to be ~5k or so. | 23:46 |
| notmorgan | but still. | 23:47 |
| shaleh | but oooooh how I want one | 23:47 |
| notmorgan | used. | 23:47 |
| shaleh | notmorgan: which setup? | 23:47 |
| mordred | notmorgan: yes I am | 23:47 |
| notmorgan | don't remember off the top of my head, went w/ a Canon 6D, 50mm lens, 16-35MM, and 85MM | 23:47 |
| shaleh | mordred: what do you shoot? | 23:47 |
| notmorgan | mordred: but i also kno if i had gone medium format... i would have had to get a film back too... cause $reasons | 23:48 |
| *** lhcheng has quit IRC | 23:48 | |
| * shaleh recently bought a Fuji Xpro after years of Nikon shooting | 23:48 | |
| *** topol has quit IRC | 23:48 | |
| *** lhcheng has joined #openstack-keystone | 23:48 | |
| *** ChanServ sets mode: +v lhcheng | 23:48 | |
| mordred | shaleh: Mamiya 645 Pro AFD | 23:48 |
| shaleh | I gave up film when it became hard to find ilford paper. and dark rooms. | 23:48 |
| shaleh | mordred: bastard :-) That is my lust. | 23:49 |
| mordred | it's SO GOOD | 23:49 |
| *** e0ne has joined #openstack-keystone | 23:49 | |
| notmorgan | shaleh: what no silver plates? :P | 23:49 |
| notmorgan | shaleh: and mordred has some nice photos from that camera | 23:49 |
| shaleh | oh i bet | 23:49 |
| mordred | 6x4.5 Velvia FTW | 23:50 |
| mordred | now, it's only velvia 100 because FAIL - but stil | 23:50 |
| *** e0ne_ has quit IRC | 23:51 | |
| *** darrenc_afk is now known as darrenc | 23:52 | |
| shaleh | I need a 16mm and a 85mm for my Fuji. I really wanted both in Japan. | 23:52 |
| *** e0ne_ has joined #openstack-keystone | 23:52 | |
| shaleh | The normal lens I had on was nice but not enough | 23:52 |
| *** tsymanczyk has quit IRC | 23:52 | |
| notmorgan | the 50mm is my fav. lens to shoot with | 23:53 |
| notmorgan | tbh | 23:54 |
| notmorgan | well i take that back | 23:54 |
| notmorgan | the 100mm Macro 1:1 | 23:54 |
| notmorgan | that is my fav. | 23:54 |
| notmorgan | but, that is not super useful for general purpose | 23:54 |
| *** e0ne has quit IRC | 23:54 | |
| shaleh | notmorgan: agree on both counts | 23:54 |
| shaleh | but landscape/building stuff you often want wider | 23:55 |
| shaleh | I wanted to capture some neat spiders but I did not have a good macro like lens | 23:55 |
| notmorgan | shaleh: this is the lense to get: http://www.bhphotovideo.com/c/product/801201815-USE/canon_2527a001_super_telephoto_1200mm_f_5_6l.html | 23:56 |
| shaleh | heh | 23:57 |
| shaleh | no Canon here | 23:57 |
| shaleh | Canon cameras try to fall out of my hands | 23:57 |
| notmorgan | at that price, you buy a camera to go with the lense! | 23:57 |
| shaleh | I have never liked one | 23:57 |
| shaleh | I like Nikon bodies. I really like the Fuji X series cameras though. The Xpro1 I bought as few months back gives all of the manual twiddles. | 23:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: Domain Specific Roles https://review.openstack.org/226661 | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!