| *** agireud has quit IRC | 00:07 | |
| *** mhickey has quit IRC | 00:07 | |
| *** agireud has joined #openstack-keystone | 00:13 | |
| *** sileht has quit IRC | 00:15 | |
| *** woodster_ has quit IRC | 00:16 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Accept v2 params to v3 service create https://review.openstack.org/233102 | 00:16 |
|---|---|---|
| *** chlong has joined #openstack-keystone | 00:17 | |
| *** agireud has quit IRC | 00:18 | |
| *** jasonsb has joined #openstack-keystone | 00:18 | |
| *** agireud has joined #openstack-keystone | 00:21 | |
| breton | gyee: I stopped understanding how domain-specific config works. I expected it to do some funny stuff with CONF, but it seems that it doesn't touch CONF at all and the config values are not overriden, although we end up in the right backend. | 00:25 |
| gyee | breton, only the driver part is taking into consideration | 00:26 |
| breton | http://paste.openstack.org/show/480850/ | 00:26 |
| gyee | we need to save the conf that is being passed in at the driver level and use it | 00:26 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 00:26 | |
| *** sileht has joined #openstack-keystone | 00:27 | |
| openstackgerrit | Merged openstack/keystone: Update API version info for Liberty https://review.openstack.org/253034 | 00:28 |
| gyee | breton, a few things ... | 00:28 |
| *** su_zhang_ has quit IRC | 00:28 | |
| gyee | 1) the domain-specific conf is passed when loading the driver | 00:29 |
| gyee | see https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L102 | 00:29 |
| gyee | but we don't make use of it at the driver level | 00:29 |
| gyee | https://github.com/openstack/keystone/blob/master/keystone/common/manager.py#L64 | 00:30 |
| breton | https://github.com/openstack/keystone/blob/master/keystone/identity/backends/sql.py#L77 right | 00:32 |
| gyee | we basically need to make sure the driver save the "conf" arg and use it instead of the global CONF | 00:32 |
| gyee | breton, exactly! | 00:32 |
| breton | gyee: thank you, that's the part I couldn't figure out. | 00:33 |
| gyee | https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L1152 | 00:33 |
| gyee | so for list_limit, we can just do this | 00:33 |
| gyee | return self.conf.identity.list_limit or self.conf.list_limit | 00:33 |
| breton | is conf always passed, even for default domain? | 00:34 |
| gyee | yes, or we can do this | 00:34 |
| gyee | https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap.py#L38 | 00:35 |
| gyee | if you want to play safe | 00:35 |
| breton | got it | 00:36 |
| breton | gyee: have you already started coding that? Because if no, I'd like to do it | 00:37 |
| gyee | breton, the honor is all yours :) | 00:37 |
| breton | cool :) | 00:37 |
| gyee | great opportunity learn that aspect | 00:38 |
| gyee | thank you! | 00:38 |
| gyee | breton, gotta warn you, unit testing that stuff will be fun | 00:38 |
| *** agireud has quit IRC | 00:42 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 00:53 | |
| *** EinstCrazy has joined #openstack-keystone | 00:55 | |
| *** doug-fish has quit IRC | 01:08 | |
| *** agireud has joined #openstack-keystone | 01:12 | |
| *** gildub has quit IRC | 01:14 | |
| *** agireud has quit IRC | 01:14 | |
| *** browne has quit IRC | 01:20 | |
| *** _zouyee has quit IRC | 01:23 | |
| *** RichardRaseley has quit IRC | 01:28 | |
| *** arunkant_ has quit IRC | 01:29 | |
| *** agireud has joined #openstack-keystone | 01:30 | |
| *** gildub has joined #openstack-keystone | 01:30 | |
| *** agireud has quit IRC | 01:34 | |
| *** agireud has joined #openstack-keystone | 01:48 | |
| *** gyee has quit IRC | 01:50 | |
| *** agireud has quit IRC | 01:53 | |
| *** _zouyee has joined #openstack-keystone | 02:02 | |
| *** agireud has joined #openstack-keystone | 02:03 | |
| *** agireud has quit IRC | 02:07 | |
| *** aginwala has quit IRC | 02:21 | |
| *** darrenc is now known as darrenc_afk | 02:23 | |
| *** topol has joined #openstack-keystone | 02:31 | |
| *** ChanServ sets mode: +v topol | 02:31 | |
| *** adelia has joined #openstack-keystone | 02:34 | |
| *** aginwala has joined #openstack-keystone | 02:35 | |
| *** aginwala has quit IRC | 02:36 | |
| *** fangxu has quit IRC | 02:39 | |
| *** adelia has quit IRC | 02:39 | |
| *** markvoelker has quit IRC | 02:40 | |
| *** adelia has joined #openstack-keystone | 02:40 | |
| *** browne has joined #openstack-keystone | 02:40 | |
| *** adelia has quit IRC | 02:44 | |
| *** darrenc_afk is now known as darrenc | 02:50 | |
| *** adelia has joined #openstack-keystone | 02:53 | |
| *** adelia has quit IRC | 02:54 | |
| *** adelia has joined #openstack-keystone | 02:54 | |
| *** adelia has quit IRC | 02:59 | |
| openstackgerrit | Merged openstack/keystoneauth: Default for service service type should be empty https://review.openstack.org/253047 | 02:59 |
| *** wangqun has joined #openstack-keystone | 03:04 | |
| *** btully has joined #openstack-keystone | 03:28 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Deprecate the pki and pkiz token providers. https://review.openstack.org/241389 | 03:28 |
| *** btully has quit IRC | 03:35 | |
| *** btully has joined #openstack-keystone | 03:36 | |
| *** tsymanczyk has quit IRC | 03:39 | |
| *** topol has quit IRC | 03:40 | |
| *** topol has joined #openstack-keystone | 03:41 | |
| *** ChanServ sets mode: +v topol | 03:41 | |
| *** tsymanczyk has joined #openstack-keystone | 03:44 | |
| *** tsymanczyk is now known as Guest12815 | 03:44 | |
| *** topol has quit IRC | 03:45 | |
| *** flwang1 has quit IRC | 03:46 | |
| *** btully has quit IRC | 03:49 | |
| *** e0ne_ has joined #openstack-keystone | 03:52 | |
| *** davechen1 has joined #openstack-keystone | 03:53 | |
| *** su_zhang has joined #openstack-keystone | 03:56 | |
| *** btully has joined #openstack-keystone | 03:58 | |
| *** links has joined #openstack-keystone | 04:00 | |
| *** e0ne_ has quit IRC | 04:00 | |
| *** davechen has joined #openstack-keystone | 04:02 | |
| *** davechen1 has quit IRC | 04:04 | |
| *** btully has quit IRC | 04:05 | |
| *** stevemar has quit IRC | 04:09 | |
| *** btully has joined #openstack-keystone | 04:10 | |
| *** e0ne has joined #openstack-keystone | 04:12 | |
| *** stevemar_znc has joined #openstack-keystone | 04:12 | |
| *** e0ne has quit IRC | 04:16 | |
| *** Ephur_ has quit IRC | 04:22 | |
| *** fangxu has joined #openstack-keystone | 04:22 | |
| *** links has quit IRC | 04:23 | |
| *** spandhe has quit IRC | 04:26 | |
| *** fawadkhaliq has joined #openstack-keystone | 04:28 | |
| *** fawadkhaliq has quit IRC | 04:42 | |
| *** btully has quit IRC | 04:47 | |
| *** agireud has joined #openstack-keystone | 04:51 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:04 | |
| *** markvoelker has joined #openstack-keystone | 05:05 | |
| *** links has joined #openstack-keystone | 05:09 | |
| *** markvoelker has quit IRC | 05:09 | |
| *** markvoelker has joined #openstack-keystone | 05:10 | |
| *** btully has joined #openstack-keystone | 05:15 | |
| *** agireud has quit IRC | 05:23 | |
| *** roxanagh_ has joined #openstack-keystone | 05:24 | |
| *** roxanagh_ has quit IRC | 05:26 | |
| *** agireud has joined #openstack-keystone | 05:26 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Make tests run against original client and sessions https://review.openstack.org/117089 | 05:27 |
| *** itlinux has joined #openstack-keystone | 05:32 | |
| *** tyagiprince has joined #openstack-keystone | 05:33 | |
| *** aginwala has joined #openstack-keystone | 05:34 | |
| *** agireud has quit IRC | 05:35 | |
| *** davechen has left #openstack-keystone | 05:36 | |
| *** adelia has joined #openstack-keystone | 05:37 | |
| *** adelia has quit IRC | 05:42 | |
| *** david8hu has quit IRC | 05:42 | |
| *** david8hu has joined #openstack-keystone | 05:43 | |
| *** markvoelker_ has joined #openstack-keystone | 05:47 | |
| *** markvoelker has quit IRC | 05:50 | |
| *** markvoelker_ has quit IRC | 05:51 | |
| *** topol has joined #openstack-keystone | 05:53 | |
| *** ChanServ sets mode: +v topol | 05:53 | |
| *** topol has quit IRC | 05:58 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Perform middleware tests with webtest https://review.openstack.org/244440 | 06:08 |
| *** rcernin has joined #openstack-keystone | 06:13 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Disable memory caching of tokens https://review.openstack.org/212345 | 06:15 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't cache signed tokens https://review.openstack.org/190941 | 06:15 |
| *** david8hu has quit IRC | 06:21 | |
| *** david8hu has joined #openstack-keystone | 06:21 | |
| *** spandhe has joined #openstack-keystone | 06:26 | |
| *** Nirupama has joined #openstack-keystone | 06:30 | |
| *** henrynash has joined #openstack-keystone | 06:33 | |
| *** ChanServ sets mode: +v henrynash | 06:33 | |
| *** aginwala has quit IRC | 06:35 | |
| *** roxanagh_ has joined #openstack-keystone | 06:37 | |
| *** aginwala has joined #openstack-keystone | 06:37 | |
| *** su_zhang has quit IRC | 06:40 | |
| *** roxanagh_ has quit IRC | 06:41 | |
| *** itlinux has quit IRC | 06:42 | |
| *** spandhe_ has joined #openstack-keystone | 06:43 | |
| *** spandhe has quit IRC | 06:45 | |
| *** spandhe_ is now known as spandhe | 06:45 | |
| *** jaosorior has joined #openstack-keystone | 06:49 | |
| *** tjcocozz has quit IRC | 06:49 | |
| *** tjcocozz has joined #openstack-keystone | 06:50 | |
| *** agireud has joined #openstack-keystone | 06:50 | |
| *** gildub has quit IRC | 06:52 | |
| *** agireud has quit IRC | 06:54 | |
| *** rcernin has quit IRC | 06:59 | |
| *** josecastroleon has joined #openstack-keystone | 07:00 | |
| *** agireud has joined #openstack-keystone | 07:04 | |
| *** tyagiprince has quit IRC | 07:06 | |
| *** rcernin has joined #openstack-keystone | 07:07 | |
| *** agireud has quit IRC | 07:09 | |
| *** chlong has quit IRC | 07:19 | |
| *** spandhe has quit IRC | 07:24 | |
| *** btully has quit IRC | 07:44 | |
| *** _zouyee has quit IRC | 07:47 | |
| *** btully has joined #openstack-keystone | 07:47 | |
| *** lhcheng has joined #openstack-keystone | 08:03 | |
| *** ChanServ sets mode: +v lhcheng | 08:03 | |
| *** ctina_ has joined #openstack-keystone | 08:09 | |
| *** ctina_ has quit IRC | 08:10 | |
| *** lhcheng has quit IRC | 08:16 | |
| *** btully has quit IRC | 08:19 | |
| *** pnavarro has joined #openstack-keystone | 08:20 | |
| *** btully has joined #openstack-keystone | 08:21 | |
| *** josecastroleon has quit IRC | 08:28 | |
| *** fawadkhaliq has quit IRC | 08:31 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:31 | |
| *** btully has quit IRC | 08:32 | |
| *** btully has joined #openstack-keystone | 08:34 | |
| *** josecastroleon has joined #openstack-keystone | 08:34 | |
| *** browne has quit IRC | 08:36 | |
| *** btully has quit IRC | 08:44 | |
| *** btully has joined #openstack-keystone | 08:46 | |
| *** fawadkhaliq has quit IRC | 08:47 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:47 | |
| *** lhcheng has joined #openstack-keystone | 08:48 | |
| *** ChanServ sets mode: +v lhcheng | 08:48 | |
| *** henrynash has quit IRC | 08:57 | |
| *** btully has quit IRC | 08:58 | |
| *** btully has joined #openstack-keystone | 09:00 | |
| *** dims_ has quit IRC | 09:05 | |
| *** mhickey has joined #openstack-keystone | 09:08 | |
| *** dims has joined #openstack-keystone | 09:11 | |
| *** Nirupama has quit IRC | 09:12 | |
| *** aginwala has quit IRC | 09:23 | |
| *** dims has quit IRC | 09:23 | |
| *** fhubik has joined #openstack-keystone | 09:28 | |
| -openstackstatus- NOTICE: Tox tests are broken at the moment. From openstack-infra we are working to fix them. Please don't approve changes until we notify that tox tests work again. | 09:31 | |
| *** dims has joined #openstack-keystone | 09:34 | |
| *** Nirupama has joined #openstack-keystone | 09:35 | |
| *** tyagiprince has joined #openstack-keystone | 09:37 | |
| tyagiprince | Hey everyone.. I am facing problem in setting up secure connection with the ldap.. I configured everything as described in the keystone configuration guide.. It is giving the following error: CONNECT_ERROR: {'info': '(unknown error code)', 'desc': 'Connect error'} | 09:39 |
| tyagiprince | anyone? | 09:47 |
| *** Guest12815 has quit IRC | 10:09 | |
| *** btully has quit IRC | 10:12 | |
| *** btully has joined #openstack-keystone | 10:16 | |
| *** henrynash has joined #openstack-keystone | 10:19 | |
| *** ChanServ sets mode: +v henrynash | 10:19 | |
| *** Nirupama has quit IRC | 10:22 | |
| *** tsymanczyk has joined #openstack-keystone | 10:24 | |
| *** tsymanczyk is now known as Guest32650 | 10:25 | |
| *** agireud has joined #openstack-keystone | 10:29 | |
| *** openstackgerrit has quit IRC | 10:32 | |
| *** openstackgerrit has joined #openstack-keystone | 10:33 | |
| *** agireud has quit IRC | 10:34 | |
| *** Guest32650 has quit IRC | 10:34 | |
| *** wangqun has quit IRC | 10:35 | |
| *** tsymancz1k has joined #openstack-keystone | 10:44 | |
| *** aginwala has joined #openstack-keystone | 10:54 | |
| *** aginwala has quit IRC | 10:58 | |
| *** btully has quit IRC | 11:10 | |
| samueldmq | morning keystoners | 11:13 |
| *** btully has joined #openstack-keystone | 11:13 | |
| *** henrynash has quit IRC | 11:14 | |
| *** pnavarro is now known as pnavarro|lunch | 11:17 | |
| *** fhubik has quit IRC | 11:17 | |
| tyagiprince | Hey people.. I am facing problems in setting up LDAPS.. I have already configured LDAP with keystone. however after copying the certificate, it gives me an error: CONNECT_ERROR: {'info': '(unknown error code)', 'desc': 'Connect error'} | 11:24 |
| tyagiprince | Also I am doing some changes in the policy.json file... but I am not able to view the changes in the horizon.. What do I need to do? I created a new role and did some policy changes to do anything with all the users.. got nothing.. | 11:25 |
| samueldmq | tyagiprince: hi, regarding the roles and policies | 11:27 |
| samueldmq | tyagiprince: did you create role assignments ? that is the way the roles will appear in the users' tokens which in turn will be checked against the policy files | 11:27 |
| tyagiprince | I created a role project-admin.. | 11:28 |
| tyagiprince | samueldmq: | 11:28 |
| tyagiprince | I did assign the role to a user and I am logged in using that user only. | 11:29 |
| tyagiprince | I made a rule: "role:project-admin and tenant_id:%(tenant_id)s" | 11:29 |
| samueldmq | tyagiprince: try project instead of tenant | 11:30 |
| samueldmq | tyagiprince: "role:project-admin and project_id:%(project_id)s" | 11:30 |
| tyagiprince | samueldmq: I did not get the tab user on the horizon.. But I tried to open controller/horizon/identity/users and it gives Info: Insufficient privilege level to view user information. | 11:31 |
| tyagiprince | still the same.. nothing new happened when I changed it to project | 11:32 |
| samueldmq | tyagiprince: I believe you will need admin privilegies to acess user information | 11:34 |
| samueldmq | tyagiprince: in horizon | 11:34 |
| tyagiprince | I want a project-admin role which when assigned to a user can manage the project members thorigh horizon.. | 11:35 |
| tyagiprince | each project will have one or more users with project-admin role.. | 11:35 |
| samueldmq | tyagiprince: ah; btw horizon keeps copies of policies that are evaluated locally to render the pages | 11:35 |
| samueldmq | tyagiprince: perhaps you need to update them too to see changes reflected in horizon | 11:36 |
| tyagiprince | the admin is super_admin which is the different role that I'd be needing | 11:36 |
| samueldmq | tyagiprince: you should ask #openstck-horizon for more details on that | 11:36 |
| samueldmq | tyagiprince: and about the superadmin, we are working that out (cc ayoung) | 11:37 |
| *** btully has quit IRC | 11:37 | |
| samueldmq | tyagiprince: the solution will make a user acquire superadmin rights only on the project designed to be the admin project | 11:37 |
| *** btully has joined #openstack-keystone | 11:39 | |
| *** adelia has joined #openstack-keystone | 11:42 | |
| *** chlong has joined #openstack-keystone | 11:44 | |
| *** adelia has quit IRC | 11:46 | |
| *** fawadkhaliq has quit IRC | 11:53 | |
| *** fhubik has joined #openstack-keystone | 11:55 | |
| *** topol has joined #openstack-keystone | 11:55 | |
| *** ChanServ sets mode: +v topol | 11:55 | |
| *** henrynash has joined #openstack-keystone | 11:55 | |
| *** ChanServ sets mode: +v henrynash | 11:55 | |
| *** fhubik is now known as fhubik_brb | 11:56 | |
| *** noqa_v_g1ovnie is now known as noqa_v_qoovnie | 11:58 | |
| *** tyagiprince has quit IRC | 11:59 | |
| *** topol has quit IRC | 12:00 | |
| *** btully has quit IRC | 12:03 | |
| *** btully has joined #openstack-keystone | 12:06 | |
| *** EinstCrazy has quit IRC | 12:15 | |
| *** henrynash has quit IRC | 12:19 | |
| *** raildo-afk is now known as raildo | 12:21 | |
| *** henrynash has joined #openstack-keystone | 12:24 | |
| *** ChanServ sets mode: +v henrynash | 12:24 | |
| *** raildo is now known as raildo-afk | 12:24 | |
| *** raildo-afk is now known as raildo | 12:24 | |
| *** fhubik_brb is now known as fhubik | 12:27 | |
| *** btully has quit IRC | 12:28 | |
| *** mnaser has quit IRC | 12:30 | |
| *** henrynash has quit IRC | 12:31 | |
| *** btully has joined #openstack-keystone | 12:33 | |
| *** mnaser has joined #openstack-keystone | 12:34 | |
| *** arunkant_ has joined #openstack-keystone | 12:39 | |
| *** EinstCrazy has joined #openstack-keystone | 12:41 | |
| *** adelia has joined #openstack-keystone | 12:43 | |
| *** btully has quit IRC | 12:46 | |
| *** btully has joined #openstack-keystone | 12:47 | |
| *** adelia has quit IRC | 12:48 | |
| *** jaosorior has quit IRC | 12:49 | |
| *** jaosorior has joined #openstack-keystone | 12:50 | |
| *** btully has quit IRC | 12:58 | |
| *** btully has joined #openstack-keystone | 13:00 | |
| *** pauloewerton has joined #openstack-keystone | 13:02 | |
| *** btully has quit IRC | 13:11 | |
| *** fangxu has quit IRC | 13:11 | |
| *** fangxu has joined #openstack-keystone | 13:12 | |
| *** btully has joined #openstack-keystone | 13:13 | |
| *** fhubik has quit IRC | 13:14 | |
| *** fhubik has joined #openstack-keystone | 13:15 | |
| *** jaosorior has quit IRC | 13:30 | |
| *** jaosorior has joined #openstack-keystone | 13:30 | |
| *** btully has quit IRC | 13:30 | |
| *** btully has joined #openstack-keystone | 13:32 | |
| *** fhubik is now known as fhubik_brb | 13:37 | |
| *** fhubik_brb is now known as fhubik | 13:37 | |
| *** david-lyle has quit IRC | 13:43 | |
| *** adelia has joined #openstack-keystone | 13:45 | |
| *** ayoung has quit IRC | 13:46 | |
| *** markvoelker has joined #openstack-keystone | 13:47 | |
| *** adelia has quit IRC | 13:50 | |
| *** csoukup has joined #openstack-keystone | 13:53 | |
| *** pauloewerton has quit IRC | 13:56 | |
| *** iurygregory is now known as iurygregory_lunc | 13:57 | |
| *** iurygregory_lunc is now known as iury_lunch | 13:57 | |
| marekd | bknudson: hi, i am not sure what should be a corret json home path https://review.openstack.org/#/c/188534/12/api/v3/identity-api-v3-os-ep-filter-ext.rst in line 700 for instance | 13:57 |
| *** iury_lunch has quit IRC | 13:58 | |
| *** ayoung has joined #openstack-keystone | 13:58 | |
| *** ChanServ sets mode: +v ayoung | 13:58 | |
| marekd | bknudson: can you help me? | 13:58 |
| *** raildo is now known as raildo-afk | 13:59 | |
| *** links has quit IRC | 14:02 | |
| lbragstad | dstanek o/ happy bug day! what can I help with? | 14:03 |
| lbragstad | dstanek do you have an etherpad started/continued from somewhere? | 14:03 |
| dstanek | lbragstad: not a global one. just my personal hit list. feel free to find a bug that's interesting and hack on it or review an existing patch that fixes a bug | 14:04 |
| *** fhubik has quit IRC | 14:05 | |
| lbragstad | dstanek sounds good | 14:05 |
| lbragstad | dstanek we do have this - https://etherpad.openstack.org/p/keystone-bug-bash | 14:05 |
| lbragstad | dstanek I can update it | 14:05 |
| *** fhubik has joined #openstack-keystone | 14:05 | |
| dstanek | i'd love the number here (http://bit.ly/1LSpKm5) to be under 250 by monday! | 14:06 |
| *** gordc has joined #openstack-keystone | 14:09 | |
| *** ericksonsantos has quit IRC | 14:10 | |
| lbragstad | stevemar_znc is this still a valid bug in Keystone or can it be closes since it was fixed upstream? https://bugs.launchpad.net/keystone/+bug/1521844 | 14:12 |
| openstack | Launchpad bug 1521844 in OpenStack Identity (keystone) "pycadf ID validation fails for multi-domain IDs" [High,In progress] - Assigned to Steve Martinelli (stevemar) | 14:12 |
| *** lhcheng has quit IRC | 14:15 | |
| *** btully has quit IRC | 14:15 | |
| *** btully has joined #openstack-keystone | 14:16 | |
| marekd | dstanek: lbragstad: any hints on how proper json home relationships should look like? see https://review.openstack.org/#/c/188534/12/api/v3/identity-api-v3-os-ep-filter-ext.rst line 700 for instance | 14:21 |
| *** lhcheng has joined #openstack-keystone | 14:21 | |
| *** ChanServ sets mode: +v lhcheng | 14:21 | |
| *** markvoelker has quit IRC | 14:21 | |
| *** petertr7_away is now known as petertr7 | 14:25 | |
| *** lhcheng has quit IRC | 14:26 | |
| *** adelia has joined #openstack-keystone | 14:27 | |
| dstanek | marekd: yours look correct in format, but they are all the same | 14:32 |
| lbragstad | does anyone know if we plan to support running keystoneauth on OS X? | 14:33 |
| marekd | dstanek: format is fine, but the content isnt | 14:33 |
| lbragstad | i know we removed OS X support from keystone last year | 14:33 |
| marekd | lbragstad: ksc is runnable on osx? | 14:34 |
| lbragstad | marekd not really, but there is an open bug for it - https://bugs.launchpad.net/keystoneauth/+bug/1522046 | 14:34 |
| openstack | Launchpad bug 1522046 in keystoneauth "TCP defaults not supported on OSX" [Undecided,New] | 14:34 |
| lbragstad | it was just opened this week | 14:34 |
| marekd | lbragstad: aha | 14:35 |
| marekd | if kssc was runnable i'd expect ksa should also be. | 14:35 |
| lbragstad | i know we no longer care about support os x for keystone server.. but i'm not sure about keystoneauth | 14:35 |
| lbragstad | marekd yeah, that would make sense | 14:35 |
| lbragstad | looks like we support OSX on ksc - https://github.com/openstack/python-keystoneclient/blob/7c58da8435d96ce0ac3e42b6026d69f0d7199f4e/keystoneclient/session.py#L947 | 14:37 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: WIP List assignments with names https://review.openstack.org/249958 | 14:37 |
| *** bdossant has joined #openstack-keystone | 14:38 | |
| dstanek | lbragstad: we don't say we support it http://git.openstack.org/cgit/openstack/keystoneauth/tree/setup.cfg#n9 | 14:40 |
| lbragstad | dstanek so, we should remove that comment | 14:41 |
| lbragstad | and the code around it that is specific to OS X | 14:41 |
| lbragstad | dstanek looks like we say the same things for ksc - https://github.com/openstack/python-keystoneclient/blob/master/setup.cfg#L14 | 14:42 |
| dstanek | lbragstad: i don't know what the official openstack stance is on OS X, but I assume clients should run everywhere | 14:42 |
| lbragstad | dstanek and i assume that would mean ksa, too | 14:43 |
| dstanek | lbragstad: yeah, it would have to because ksc requires ksa | 14:43 |
| lbragstad | dstanek so we should add it to the setup.cfg as a supported system | 14:43 |
| lbragstad | for ksa and ksc | 14:44 |
| *** fawadkhaliq has joined #openstack-keystone | 14:46 | |
| dstanek | lbragstad: probably, but i think we don't do that because we can't test it | 14:48 |
| *** henrynash has joined #openstack-keystone | 14:49 | |
| *** ChanServ sets mode: +v henrynash | 14:49 | |
| *** NM has joined #openstack-keystone | 14:50 | |
| lbragstad | dstanek hmmm, interesting | 14:50 |
| samueldmq | ayoung: hi, you around ? | 14:52 |
| *** petertr7 is now known as petertr7_away | 14:52 | |
| *** topol has joined #openstack-keystone | 14:53 | |
| *** ChanServ sets mode: +v topol | 14:53 | |
| ayoung | samueldmq, with the holidays here, I'm getting rounder by the week | 14:54 |
| *** fhubik is now known as fhubik_brb | 14:54 | |
| dstanek | marekd: commented on the review | 14:54 |
| *** petertr7_away is now known as petertr7 | 14:54 | |
| *** alex_xu is now known as alexus | 14:56 | |
| samueldmq | ayoung: just to undertand a comment you left, but we can see this next week | 14:56 |
| samueldmq | understand* | 14:56 |
| ayoung | samueldmq, which comment? | 14:56 |
| samueldmq | ayoung: actually at TODO note, to be accurate | 14:57 |
| samueldmq | ayoung: https://github.com/openstack/keystone/blob/af399474b2e67b023225a8abffe8933af40c1548/keystone/contrib/ec2/core.py#L28 | 14:57 |
| ayoung | samueldmq, pretty sure that the def of those links needs a description field to be right | 14:57 |
| ayoung | samueldmq, I probably added that during the effort to make each extension register itself | 14:58 |
| *** Ephur has joined #openstack-keystone | 14:58 | |
| ayoung | like 3 years ago? | 14:58 |
| samueldmq | ayoung: is the standard described somewhere ? | 14:58 |
| samueldmq | ayoung: hehe :) | 14:58 |
| *** fhubik_brb is now known as fhubik | 14:58 | |
| samueldmq | ayoung: I am revisiting FIXME and TODO notes, so doing some cleanup, doing/fixing them | 14:59 |
| ayoung | samueldmq, what do the pthers look like... | 14:59 |
| samueldmq | ayoung: the ones I saw don't have either | 14:59 |
| samueldmq | ayoung: and there is nothing in the python docs | 15:00 |
| samueldmq | ayoung: https://github.com/openstack/keystone/blob/master/keystone/common/extension.py#L36 | 15:00 |
| ayoung | samueldmq, anything on the commit? | 15:00 |
| samueldmq | ayoung: hmm, looking | 15:00 |
| ayoung | samueldmq, look at the commit: | 15:01 |
| *** fhubik is now known as fhubik_brb | 15:01 | |
| ayoung | https://github.com/openstack/keystone/commit/c5900d0f | 15:01 |
| ayoung | extension_data is a dictionary. The expected fields are: | 15:01 |
| ayoung | ... | 15:01 |
| ayoung | 'description': text description of the extension | 15:01 |
| *** spotz_zzz is now known as spotz | 15:01 | |
| marekd | dstanek: thanks | 15:02 |
| samueldmq | ayoung: sure, and there is one | 15:02 |
| samueldmq | ayoung: it is outside "links", at the same level of it actually | 15:02 |
| samueldmq | ayoung: and your comments are inside "links", as there should be a description tehre | 15:02 |
| samueldmq | perhaps they aren't valid anymore ? | 15:03 |
| ayoung | samueldmq, so...I think they are | 15:04 |
| samueldmq | ayoung: k; thanks sir | 15:04 |
| ayoung | we should replaces "extension" with "submodules" but the geenral info is a good thing to have | 15:04 |
| ayoung | I'd like to see info like this if you hit /identity /auth /policy .... | 15:04 |
| *** fhubik_brb is now known as fhubik | 15:05 | |
| ayoung | samueldmq, this is why we should have Keystone render simple HTML. All this stuff would be very visible | 15:05 |
| dstanek | lbragstad: are you going to submit a real review with that patch? | 15:07 |
| lbragstad | dstanek I just wanted to look at the patch, locally | 15:07 |
| dstanek | lbragstad: if it looks good, go ahead a submit and i'll test on my mac too | 15:08 |
| dstanek | lbragstad: i'm assuming it look very similar to the ksc patch | 15:08 |
| lbragstad | dstanek i got an error from git trying to unpack it | 15:08 |
| lbragstad | dstanek yeah, it did | 15:08 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Remove invalid TODO in extensions https://review.openstack.org/253552 | 15:08 |
| samueldmq | ayoung: ^ | 15:08 |
| ayoung | samueldmq, reread what I read... | 15:09 |
| ayoung | I don;t agree | 15:09 |
| ayoung | samueldmq, let me fix that... | 15:10 |
| *** csoukup has quit IRC | 15:10 | |
| samueldmq | ayoung: aren't the TODO comments invalid ? | 15:10 |
| *** Ephur has quit IRC | 15:10 | |
| samueldmq | ayoung: not sure I got what you said | 15:11 |
| *** ir2ivps8 has quit IRC | 15:12 | |
| *** btully has quit IRC | 15:14 | |
| ayoung | samueldmq, hmmm... | 15:15 |
| *** btully has joined #openstack-keystone | 15:15 | |
| ayoung | samueldmq, OK...I was wrong. links don't need description. I'll change my review | 15:15 |
| *** davechen has joined #openstack-keystone | 15:16 | |
| samueldmq | ayoung: thanks sir | 15:16 |
| openstackgerrit | Marian Horban proposed openstack/python-keystoneclient: Remove lock object from BaseIdentityPlugin https://review.openstack.org/246521 | 15:17 |
| marekd | dstanek: what are your opinions on stevemar_znc's comment about renaming sp_group to service_providers_group -> shall we also change that in the urls as well? | 15:20 |
| *** Ephur has joined #openstack-keystone | 15:22 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:24 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Expand endpoint filters to service providers https://review.openstack.org/188534 | 15:25 |
| *** RichardRaseley has joined #openstack-keystone | 15:26 | |
| *** btully has quit IRC | 15:26 | |
| *** itlinux has joined #openstack-keystone | 15:27 | |
| *** btully has joined #openstack-keystone | 15:27 | |
| *** csoukup has joined #openstack-keystone | 15:32 | |
| *** Ephur has quit IRC | 15:33 | |
| *** btully has quit IRC | 15:40 | |
| *** fawadkhaliq has quit IRC | 15:41 | |
| *** david-lyle has joined #openstack-keystone | 15:42 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Reduce revocation records by removing the revoke events for disable domains and projects. https://review.openstack.org/253273 | 15:42 |
| *** btully has joined #openstack-keystone | 15:42 | |
| *** RichardRaseley has quit IRC | 15:43 | |
| topol | bknudson, notmorgan, henrynash, dstanek, I had a quick question on release notes. So if lbragstad already created a deprecated-as-of-mitaka release note shouldnt I just add to that one for my deprecation-as-of-mitaka patch as opposed to creating a new one? Or does it not matter? | 15:45 |
| *** markvoelker has joined #openstack-keystone | 15:45 | |
| *** Ephur has joined #openstack-keystone | 15:46 | |
| *** itlinux has quit IRC | 15:47 | |
| *** jaosorior has quit IRC | 15:49 | |
| *** jerrygb has joined #openstack-keystone | 15:52 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fix test_crud_user_project_role_grants https://review.openstack.org/253219 | 15:53 |
| samueldmq | lbragstad: thanks ^ | 15:53 |
| *** davechen1 has joined #openstack-keystone | 15:53 | |
| lbragstad | samueldmq np! | 15:53 |
| *** NM has quit IRC | 15:55 | |
| *** itlinux has joined #openstack-keystone | 15:56 | |
| *** davechen has quit IRC | 15:56 | |
| amakarov | bknudson, hi! Please review my patch https://review.openstack.org/#/c/222173 - samueldmq has some concerns about testing | 15:56 |
| *** csoukup has quit IRC | 15:57 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Put py34 first in the env order of tox https://review.openstack.org/252735 | 15:57 |
| openstackgerrit | Merged openstack/python-keystoneclient: Put py34 first in the env order of tox https://review.openstack.org/252734 | 15:57 |
| lbragstad | topol that's a good question, part of me thinks you'd just amend it | 15:59 |
| lbragstad | topol but I don't know for sure | 15:59 |
| lbragstad | topol i think stevemar_znc pushed that patch set for me :) | 15:59 |
| samueldmq | amakarov: look at patchset 12, I am refering to that comment from bknudson | 15:59 |
| topol | lbragstad, that's what I was thinking. I'll just add to yours once it merges | 16:00 |
| lbragstad | topol that sounds good to me | 16:00 |
| topol | lbragstad, thanks! | 16:01 |
| lbragstad | topol no problem! | 16:01 |
| *** iurygregory has joined #openstack-keystone | 16:02 | |
| *** jerrygb_ has joined #openstack-keystone | 16:03 | |
| *** jbell8 has joined #openstack-keystone | 16:03 | |
| davechen1 | topol: not sure about that either, since I am the bad guy re-raise the question for that on the your patch. | 16:04 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Reduce revocation records by removing the revoke events for disable domains and projects. https://review.openstack.org/253273 | 16:04 |
| davechen1 | topol: but there is already one for deprecation - https://github.com/openstack/keystone/blob/master/releasenotes/notes/deprecate-endpoint-policy-cfg-option-d018acab72a398a0.yaml | 16:05 |
| davechen1 | topol: basically, it's the same with yours. | 16:05 |
| topol | davechen1, so linhua also liked the idea of putting all the deprecated as of mitaka items in a single release note. that makes sense to me since they are all bundeled together in the same blueprint | 16:06 |
| topol | and they are all related | 16:06 |
| *** jerrygb has quit IRC | 16:06 | |
| *** davechen1 is now known as davechen | 16:06 | |
| davechen | topol: make sense, but we need a agreement on this. | 16:07 |
| *** jerrygb_ has quit IRC | 16:07 | |
| topol | davechen, I'm happy to do it either way.. Just looking for guidance on what is desired | 16:08 |
| openstackgerrit | Marian Horban proposed openstack/python-keystoneclient: Remove lock object from BaseIdentityPlugin https://review.openstack.org/246521 | 16:08 |
| davechen | I think it's a little bit chaos, pls just ignore my comments on that if others think it's okay to do that in that way. | 16:09 |
| *** jerrygb has joined #openstack-keystone | 16:10 | |
| topol | davechen I'll wait for others to chime in. No rush on this | 16:10 |
| *** raildo-afk is now known as raildo | 16:10 | |
| davechen | topol: okay. | 16:11 |
| amakarov | samueldmq, ok, so you suggest just remove the _race_condition and that's it, don't you? | 16:11 |
| *** raildo is now known as raildo-afk | 16:11 | |
| *** pauloewerton has joined #openstack-keystone | 16:11 | |
| *** raildo-afk is now known as raildo | 16:12 | |
| *** pwp has joined #openstack-keystone | 16:12 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Move region configuration to a critical section https://review.openstack.org/222173 | 16:14 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Move region configuration to a critical section https://review.openstack.org/222173 | 16:14 |
| *** pwp has quit IRC | 16:18 | |
| samueldmq | amakarov: yes, that way I think it would be addressing Brant's comment | 16:21 |
| samueldmq | amakarov: do you agree? | 16:21 |
| amakarov | samueldmq, ok, ^^ ^) | 16:21 |
| amakarov | samueldmq, ok, ^^ :) | 16:21 |
| lbragstad | has anyone here tried using voluptuous (https://pypi.python.org/pypi/voluptuous) | 16:21 |
| amakarov | samueldmq, as for me, I think we need better testing framework | 16:22 |
| amakarov | this one doesn't allow exposing such buts | 16:22 |
| samueldmq | amakarov: lgtm, tahnks | 16:22 |
| amakarov | s/buts/bugs/ | 16:22 |
| samueldmq | amakarov: like race conditions ? those aren't easy to demonstrate | 16:23 |
| samueldmq | amakarov: and I don't think that's our framework's fault :) | 16:23 |
| amakarov | samueldmq, in this case we could use mocks, but it will be completely unreadable | 16:24 |
| amakarov | samueldmq, I agree, that ours is not the worst in the world :) | 16:25 |
| davechen | lbragstad: looks like a alternative for jsonschema we used for schema validation. | 16:26 |
| lbragstad | davechen yeah, it's a validation framework, just curious if anyone has played with it | 16:26 |
| davechen | lbragstad: not yet, bookmarked :) | 16:27 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Update extensions links https://review.openstack.org/253587 | 16:28 |
| openstackgerrit | henry-nash proposed openstack/keystone: Create new version of assignment driver interface https://review.openstack.org/242853 | 16:31 |
| *** topol has quit IRC | 16:33 | |
| *** topol has joined #openstack-keystone | 16:34 | |
| *** ChanServ sets mode: +v topol | 16:34 | |
| *** bdossant has quit IRC | 16:34 | |
| *** ericksonsantos has joined #openstack-keystone | 16:40 | |
| *** jerrygb_ has joined #openstack-keystone | 16:40 | |
| dstanek | lbragstad: that patch does look incomplete :-( | 16:41 |
| *** roxanagh_ has joined #openstack-keystone | 16:41 | |
| lbragstad | yeah, it does | 16:42 |
| *** jerrygb has quit IRC | 16:42 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Create new version of assignment driver interface https://review.openstack.org/242853 | 16:43 |
| henrynash | dtsanek: could i borrow a portion of your brain to look at my next attempt at versioned drivers? | 16:43 |
| henrynash | dstanek: currently blowing up on line 73 of https://review.openstack.org/#/c/242853/19/keystone/assignment/core.py | 16:45 |
| henrynash | dstanek: saying can’t instantiate the new abstarct class with abstract methods <list of all the methos in V9) | 16:47 |
| dstanek | henrynash: ok, i'll download and give it a try | 16:48 |
| openstackgerrit | Merged openstack/keystoneauth: Put py34 first in the env order of tox https://review.openstack.org/252737 | 16:48 |
| *** david-lyle has quit IRC | 16:48 | |
| henrynash | dstanek: thx…… | 16:48 |
| *** petertr7 is now known as petertr7_away | 16:49 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/251638 | 16:49 |
| *** david-lyle has joined #openstack-keystone | 16:49 | |
| dstanek | henrynash: was there a specific test that failed? | 16:49 |
| henrynash | dstanek: run tox -elegacy_drivers | 16:50 |
| *** jbonjean has joined #openstack-keystone | 16:50 | |
| henrynash | dstanek: so the V9 drives work (perhaps not surprisingly), but its when we try and wrap the V8 one we fail to instantiate the wrapper class | 16:50 |
| *** jbonjean has left #openstack-keystone | 16:51 | |
| lbragstad | for all who are working on the bug day - https://etherpad.openstack.org/p/keystone-bug-bash | 16:51 |
| henrynash | dstanek: I think it’s because it’s expecting us to haev implemented the real methods….maybe the __getattr__ isn;t working/right | 16:51 |
| lbragstad | if you're working on a bug, have a patch up, and want reviews, please add it to the etherpad | 16:52 |
| dstanek | henrynash: yeah, you subclass the Abstract class, but don't implement the methods at all | 16:52 |
| *** rcernin has quit IRC | 16:52 | |
| henrynash | dtsanek: I assumed that’s what the __getattr__ was an attempt to get round? | 16:52 |
| *** gyee has joined #openstack-keystone | 16:53 | |
| *** ChanServ sets mode: +v gyee | 16:53 | |
| dstanek | henrynash: nope, because that won't pass the abc check. you actually need the methods | 16:53 |
| -openstackstatus- NOTICE: The earlier JJB bug which disrupted tox-based job configurations has been reverted and applied; jobs seem to be running successfully for the past two hours. | 16:53 | |
| henrynash | dstanek: yep, that’s what I feared….but the point f this was to just wrap the V8 driver!! So not sure how to get round that | 16:54 |
| dstanek | henrynash: you actually have to have one-line methods that call through | 16:54 |
| henrynash | dtsanek :-( | 16:54 |
| henrynash | dstanek: ok, get it…! | 16:55 |
| dstanek | it's an unfortunate side-effect of wanting to be like Java. you have to code like Java too | 16:55 |
| henrynash | dstanek: at least I can drink it too….oh well, here goes.... | 16:56 |
| henrynash | dstanek: thx | 16:56 |
| *** esp has left #openstack-keystone | 16:57 | |
| *** esp has joined #openstack-keystone | 16:57 | |
| *** josecastroleon has quit IRC | 16:59 | |
| *** rderose has joined #openstack-keystone | 16:59 | |
| *** browne has joined #openstack-keystone | 16:59 | |
| *** tqtran has joined #openstack-keystone | 17:02 | |
| *** petertr7_away is now known as petertr7 | 17:06 | |
| *** diazjf has joined #openstack-keystone | 17:12 | |
| *** david-lyle has quit IRC | 17:13 | |
| *** RichardRaseley has joined #openstack-keystone | 17:16 | |
| *** adelia has quit IRC | 17:19 | |
| *** tyagiprince has joined #openstack-keystone | 17:20 | |
| *** rderose has quit IRC | 17:21 | |
| *** shaleh has joined #openstack-keystone | 17:23 | |
| *** adelia has joined #openstack-keystone | 17:24 | |
| *** pkarikh has quit IRC | 17:25 | |
| *** tyagiprince has quit IRC | 17:26 | |
| *** amakarov has quit IRC | 17:27 | |
| davechen | bknudson: ping? | 17:27 |
| davechen | bknudson: does my reply make sense? - https://review.openstack.org/#/c/237448/ | 17:27 |
| *** pkarikh has joined #openstack-keystone | 17:28 | |
| davechen | I understand that we can update the schema definition to allow empty request body for creating a region. | 17:28 |
| *** amakarov has joined #openstack-keystone | 17:29 | |
| davechen | but it requires to change the code to allow empty request body by default, and the exception throw by jsonschema is not helpful indeed. | 17:30 |
| *** navid_ has joined #openstack-keystone | 17:31 | |
| davechen | i don't think we need to update validated() method that will impact the whole APIs to just address the specific issue against creating region. | 17:31 |
| davechen | any idea? | 17:31 |
| * notmorgan sighs at OSC | 17:34 | |
| * davechen sighs at bug fixing. | 17:35 | |
| *** davechen is now known as davechen_afk | 17:35 | |
| *** navid_ has quit IRC | 17:36 | |
| *** navid_ has joined #openstack-keystone | 17:36 | |
| *** davechen_afk has left #openstack-keystone | 17:38 | |
| *** davechen has joined #openstack-keystone | 17:43 | |
| *** davechen is now known as davechen_afk | 17:43 | |
| *** adelia has quit IRC | 17:43 | |
| stevemar_znc | notmorgan :( | 17:46 |
| *** fawadkhaliq has joined #openstack-keystone | 17:46 | |
| openstackgerrit | Merged openstack/keystone: Put py34 first in the env order of tox https://review.openstack.org/252443 | 17:46 |
| *** stevemar_znc is now known as stevemar | 17:47 | |
| *** ChanServ sets mode: +o stevemar | 17:47 | |
| notmorgan | so OSC seems to follow links sometimes | 17:47 |
| notmorgan | stevemar: ^ | 17:47 |
| notmorgan | it's... not consistent | 17:47 |
| stevemar | What links? | 17:47 |
| notmorgan | stevemar: well if keystone doesn't have admin_endpoint public_endpoint even if the catalog specifies another URI OSC strips off stuff it seems | 17:52 |
| notmorgan | stevemar: it's a little odd. | 17:52 |
| * notmorgan shrugs and contiues to setup POC things. | 17:53 | |
| *** adelia has joined #openstack-keystone | 17:57 | |
| *** pwp has joined #openstack-keystone | 17:58 | |
| *** lhcheng has joined #openstack-keystone | 17:59 | |
| *** ChanServ sets mode: +v lhcheng | 17:59 | |
| *** pnavarro|lunch has quit IRC | 18:00 | |
| pwp | Hello. | 18:03 |
| samueldmq | pwp: hey | 18:04 |
| *** lhcheng has quit IRC | 18:04 | |
| pwp | I'm looking at working on https://bugs.launchpad.net/keystone/+bug/1218682 | 18:04 |
| openstack | Launchpad bug 1218682 in python-keystoneclient "User's email format hasn't been checked" [Wishlist,In progress] | 18:04 |
| *** lxsli has quit IRC | 18:06 | |
| pwp | It says in progress but is not assigned to anyone. Is someone actually working on it? | 18:07 |
| *** diegows has joined #openstack-keystone | 18:07 | |
| *** petertr7 is now known as petertr7_away | 18:08 | |
| *** fhubik has quit IRC | 18:08 | |
| *** mylu has joined #openstack-keystone | 18:09 | |
| *** aginwala has joined #openstack-keystone | 18:09 | |
| *** davechen has joined #openstack-keystone | 18:14 | |
| *** aginwala has quit IRC | 18:14 | |
| *** davechen_afk has quit IRC | 18:16 | |
| *** pwp has quit IRC | 18:17 | |
| *** lhcheng has joined #openstack-keystone | 18:17 | |
| *** ChanServ sets mode: +v lhcheng | 18:17 | |
| *** browne has quit IRC | 18:18 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Remove invalid TODO related to bug 1265071 https://review.openstack.org/253636 | 18:20 |
| openstack | bug 1265071 in OpenStack Identity (keystone) "extra column is required for new models, otherwise unit tests fail" [Low,Fix released] https://launchpad.net/bugs/1265071 - Assigned to David Stanek (dstanek) | 18:20 |
| *** lhcheng has quit IRC | 18:21 | |
| *** lxsli has joined #openstack-keystone | 18:22 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystonemiddleware: a test for memcache_pool https://review.openstack.org/189284 | 18:22 |
| openstackgerrit | Boris Bobrov proposed openstack/keystonemiddleware: Fix inheritance of memcache client used in pool https://review.openstack.org/189285 | 18:22 |
| openstackgerrit | Boris Bobrov proposed openstack/keystonemiddleware: Fix usage of memcache_pool as contextmanager https://review.openstack.org/189286 | 18:23 |
| *** diazjf has quit IRC | 18:25 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Remove invalid comment about LDAP domain support https://review.openstack.org/253643 | 18:33 |
| *** spandhe has joined #openstack-keystone | 18:39 | |
| *** jbell8 has quit IRC | 18:41 | |
| *** jbell8 has joined #openstack-keystone | 18:44 | |
| *** aginwala has joined #openstack-keystone | 18:46 | |
| *** fangxu has quit IRC | 18:49 | |
| *** aginwala has quit IRC | 18:52 | |
| *** flwang1 has joined #openstack-keystone | 18:52 | |
| dstanek | gyee: ! terminology is important | 18:52 |
| *** aginwala has joined #openstack-keystone | 18:54 | |
| *** browne has joined #openstack-keystone | 18:58 | |
| *** abhiii5459_ has joined #openstack-keystone | 18:58 | |
| *** aginwala has quit IRC | 18:58 | |
| *** petertr7_away is now known as petertr7 | 18:59 | |
| gyee | dstanek, you are talking to an ESL guy :) | 18:59 |
| *** jbell8 has quit IRC | 19:00 | |
| *** aginwala has joined #openstack-keystone | 19:01 | |
| dstanek | gyee: for me refactoring has a very specific meaning | 19:02 |
| gyee | I hear ya | 19:03 |
| *** jbell8 has joined #openstack-keystone | 19:03 | |
| *** woodster_ has joined #openstack-keystone | 19:05 | |
| *** diazjf has joined #openstack-keystone | 19:05 | |
| *** david-lyle has joined #openstack-keystone | 19:06 | |
| *** david-ly_ has joined #openstack-keystone | 19:06 | |
| *** mylu has quit IRC | 19:13 | |
| *** petertr7 is now known as petertr7_away | 19:14 | |
| *** jerrygb has joined #openstack-keystone | 19:16 | |
| *** mylu_ has joined #openstack-keystone | 19:17 | |
| *** jerrygb_ has quit IRC | 19:18 | |
| *** petertr7_away is now known as petertr7 | 19:19 | |
| *** mancdaz has quit IRC | 19:21 | |
| *** mancdaz has joined #openstack-keystone | 19:22 | |
| *** mylu_ has quit IRC | 19:23 | |
| *** mylu has joined #openstack-keystone | 19:23 | |
| *** mylu has quit IRC | 19:25 | |
| *** mylu has joined #openstack-keystone | 19:26 | |
| *** diazjf has quit IRC | 19:28 | |
| *** fawadkhaliq has quit IRC | 19:29 | |
| lbragstad | notmorgan do you think you could revisit your -2 on https://review.openstack.org/#/c/130376/ ? | 19:29 |
| *** shaleh has quit IRC | 19:32 | |
| *** abhiii5459_ has quit IRC | 19:33 | |
| *** flwang1 has quit IRC | 19:36 | |
| sigmavirus24 | When listing users through ksc, does the client handle pagination for you? (e.g., a case like https://github.com/openstack/openstack-ansible/blob/11.2.4/playbooks/library/keystone#L660 )? | 19:37 |
| *** mylu has quit IRC | 19:37 | |
| *** mylu has joined #openstack-keystone | 19:38 | |
| *** david-lyle has quit IRC | 19:39 | |
| *** david-ly_ is now known as david-lyle | 19:39 | |
| *** gwei3 has joined #openstack-keystone | 19:39 | |
| *** spotz is now known as spotz_zzz | 19:40 | |
| *** spotz_zzz is now known as spotz | 19:41 | |
| *** diazjf has joined #openstack-keystone | 19:43 | |
| notmorgan | lbragstad: i dunno, whats in it for me? | 19:43 |
| lbragstad | notmorgan candy bars and beer | 19:44 |
| *** mylu has quit IRC | 19:44 | |
| lbragstad | :) | 19:44 |
| notmorgan | eh. | 19:44 |
| notmorgan | not really selling it are you? | 19:44 |
| notmorgan | :P | 19:44 |
| *** markvoelker has quit IRC | 19:44 | |
| cloudnull | sigmavirus24: i dont think it does based on "https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/base.py#L368-L396" | 19:45 |
| notmorgan | lbragstad: done. | 19:45 |
| notmorgan | lbragstad: so... can i get your review on something ? | 19:45 |
| notmorgan | lbragstad: https://review.openstack.org/#/c/250476/ | 19:45 |
| lbragstad | notmorgan sure thing | 19:45 |
| notmorgan | lbragstad: :) | 19:45 |
| cloudnull | from https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/users.py#L82-L110 | 19:45 |
| lbragstad | BetaMax intefaces? | 19:46 |
| lbragstad | notmorgan what's the short story for this? | 19:46 |
| notmorgan | yep | 19:46 |
| cloudnull | however idk if it simply returns everything or a limited set | 19:46 |
| notmorgan | lbragstad: sigmavirus24 wrote an awesome library :) | 19:46 |
| notmorgan | lbragstad: it's plan is to be used in consumers of KSA so we can do functional testing based on recordings of the requests for real clouds (aka OCC / Shade) | 19:46 |
| lbragstad | notmorgan interesting | 19:47 |
| lbragstad | notmorgan so we can get percentages based on calls, etc... ? | 19:47 |
| notmorgan | lbragstad: percentages? | 19:47 |
| lbragstad | notmorgan or a distribution? | 19:48 |
| notmorgan | marekd: before i press +A on this https://review.openstack.org/#/c/251289/ please 2x check that | 19:48 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add checks for unscoped token data creep to tests https://review.openstack.org/253669 | 19:48 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add checks for project scoped data creep to tests https://review.openstack.org/253670 | 19:48 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add checks for domain scoped data creep to tests https://review.openstack.org/253671 | 19:48 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Reuse project scoped token check for trusts https://review.openstack.org/253672 | 19:48 |
| notmorgan | lbragstad: uh.. not sure what you're asking | 19:48 |
| notmorgan | lbragstad: the idea is we'd perform action on <Cloud> and record it | 19:48 |
| notmorgan | in OCC, for example | 19:48 |
| lbragstad | notmorgan reading up on it | 19:48 |
| lbragstad | notmorgan in case you want to review ^ | 19:48 |
| lbragstad | notmorgan that's fixing a bug you opened | 19:48 |
| notmorgan | then if we change OCC we replay that to make sure we don't break a known working system | 19:48 |
| lbragstad | notmorgan oh | 19:48 |
| notmorgan | lbragstad: and if the cloud changes, we re-record | 19:49 |
| notmorgan | it's to prevent known working from regressing | 19:49 |
| notmorgan | especially in projects that have specific configs for real-life-clouds | 19:49 |
| notmorgan | aka OCC | 19:49 |
| notmorgan | lbragstad: /me is busy trying to set up a POC environment for sub-mounted URLs | 19:50 |
| notmorgan | lbragstad: so... will be reviewing a bit less today/next week until that is ready | 19:51 |
| lbragstad | notmorgan no worries | 19:51 |
| *** mgarza_ has joined #openstack-keystone | 19:51 | |
| notmorgan | actually wading through "how to setup openstack" is enlightening | 19:51 |
| notmorgan | it's ... downright awful in some steps | 19:51 |
| *** mylu has joined #openstack-keystone | 19:52 | |
| sigmavirus24 | notmorgan: lol | 19:52 |
| sigmavirus24 | now try setting up a project that's brand new with no documentation | 19:52 |
| *** mgarza_ has quit IRC | 19:53 | |
| notmorgan | sigmavirus24: oh i'm noticing our "setup rabbit" is not exactly well documented | 19:53 |
| sigmavirus24 | hah | 19:54 |
| *** pwp has joined #openstack-keystone | 19:54 | |
| notmorgan | the fact that i have to go look at devstack code to find the info is ... not realy that cool. | 19:54 |
| *** mylu has quit IRC | 19:54 | |
| sigmavirus24 | par for the course though notmorgan | 19:55 |
| sigmavirus24 | so, does keystone paginate user listing? | 19:55 |
| notmorgan | no | 19:55 |
| sigmavirus24 | okay so users.list(domain='domain_name') in v3 will return everything | 19:55 |
| sigmavirus24 | thanks notmorgan | 19:55 |
| *** mylu has joined #openstack-keystone | 19:56 | |
| sigmavirus24 | cloudnull: ^ | 19:56 |
| notmorgan | sigmavirus24: pretty sure | 19:56 |
| cloudnull | notmorgan: tyvm | 19:56 |
| notmorgan | unless you have configured a fixed limit | 19:57 |
| notmorgan | which case it truncates | 19:57 |
| cloudnull | notmorgan: did you get your OSA deployment to go ? | 19:57 |
| notmorgan | cloudnull: gave up on it | 19:57 |
| notmorgan | lxc was getting in the way | 19:57 |
| cloudnull | :( | 19:57 |
| cloudnull | sorry about that | 19:57 |
| cloudnull | you can turn it off | 19:57 |
| notmorgan | i've gotten more done hand-configuring the services in the last 2 hrs | 19:57 |
| notmorgan | it's not just LXC it's a lot of magic behind the scenes and trying to layer it on top of a virtualized environment | 19:58 |
| notmorgan | so now i have a working glance and keystone and haProxy w/ SSL | 19:58 |
| cloudnull | fair enough . | 19:58 |
| notmorgan | cloudnull: api.tempusfrangit.org/identity and api.tempusfrangit.org/image | 19:58 |
| notmorgan | cloudnull: :) | 19:58 |
| notmorgan | cloudnull: next is rabbit, cinder, nova | 19:58 |
| notmorgan | then neutron and horizon | 19:58 |
| cloudnull | friends dont let friends neutron, not even once | 19:59 |
| cloudnull | :p | 19:59 |
| notmorgan | cloudnull: also auth.tempusfrangit.org/(v2.0/tokens|/v3/auth/tokens) is the auth url | 19:59 |
| cloudnull | and this is using your hap middleware ? | 19:59 |
| notmorgan | cloudnull: i expect to have this done by the end of today and hopefully have everything happily running as sub-mounted urls | 20:00 |
| notmorgan | then i have a whole list of fixes to propose to the projects so it can be a real deployment method. | 20:00 |
| notmorgan | then i get to start working on the fun bits - offloading auth to the edge | 20:00 |
| cloudnull | sweet | 20:01 |
| *** shaleh has joined #openstack-keystone | 20:03 | |
| *** diazjf1 has joined #openstack-keystone | 20:04 | |
| *** diazjf1 has quit IRC | 20:04 | |
| *** diazjf1 has joined #openstack-keystone | 20:05 | |
| *** diazjf has quit IRC | 20:05 | |
| *** pkarikh has quit IRC | 20:06 | |
| *** shaleh_ has joined #openstack-keystone | 20:07 | |
| *** iurygregory has quit IRC | 20:09 | |
| *** ericksonsantos has quit IRC | 20:09 | |
| *** ericksonsantos has joined #openstack-keystone | 20:09 | |
| *** pkarikh has joined #openstack-keystone | 20:10 | |
| *** shaleh has quit IRC | 20:11 | |
| *** aginwala has quit IRC | 20:13 | |
| *** gordc has quit IRC | 20:13 | |
| diazjf1 | hey stevemar, I was working on setting up notifications on keystone following https://developer.ibm.com/opentech/2015/07/06/viewing-keystone-cadf-notifications-with-ceilometer-and-rabbitmq/ but it seems I don't get a message when a user is created, just one for authetication | 20:13 |
| openstackgerrit | werner mendizabal proposed openstack/keystone-specs: Multifactor Authentication https://review.openstack.org/130376 | 20:15 |
| *** aginwala has joined #openstack-keystone | 20:17 | |
| kfox1111 | does keystone_authtoken support passing domains? | 20:18 |
| kfox1111 | we'd like to switch fully to v3 and put all the service accounts we can into a seperate domain. | 20:18 |
| *** dtroyer has quit IRC | 20:19 | |
| ayoung | can someone please +2 this and put me out of 4 years of misery | 20:20 |
| ayoung | https://review.openstack.org/#/c/240719/ | 20:20 |
| ayoung | 2012-03-29 ... 3.75 anyway | 20:21 |
| ayoung | kfox1111, yes it does | 20:21 |
| kfox1111 | ayoung: know off hand what the settings are? | 20:22 |
| ayoung | kfox1111, do you read Ansible? | 20:23 |
| kfox1111 | ayoung: this patch looks useful. though one question. we're looking at setting up multiple regions, and the patch looks like it fits in nicely with that, but what if you want to have an admin tenant per region, so that different regions have different sets of admins? | 20:23 |
| kfox1111 | yeah, I can read ansible. | 20:23 |
| kfox1111 | there an example in openstack-ansible/kolla? | 20:23 |
| ayoung | kfox1111, https://github.com/admiyo/rippowam/blob/master/roles/packstack/tasks/serviceauth.yml | 20:24 |
| ayoung | kfox1111, the values are in the vars file... | 20:24 |
| kfox1111 | cool. I'll have a look. thanks. | 20:24 |
| ayoung | kfox1111, https://github.com/admiyo/rippowam/blob/master/roles/packstack/vars/main.yml#L5 | 20:24 |
| notmorgan | ayoung: -1 (just kidding! don't hurt me...), but you probably don't need the "admin_project_name" option in there, just id? or just name+domain? | 20:25 |
| notmorgan | ayoung: and no i am not really -1ing on that | 20:25 |
| ayoung | notmorgan, we need both | 20:25 |
| ayoung | notmorgan, the idea is to be config-tool friendlty | 20:25 |
| ayoung | so you don't need to know the id prior to setting this... | 20:25 |
| notmorgan | well just domain and name would be sufficient | 20:25 |
| ayoung | same thing | 20:26 |
| ayoung | need the domain_name | 20:26 |
| notmorgan | yah | 20:26 |
| notmorgan | domain_name since that is globally unique (still) | 20:26 |
| notmorgan | that would be config friendly | 20:26 |
| notmorgan | oh oh misread | 20:26 |
| notmorgan | sorry | 20:26 |
| notmorgan | read that as project_id | 20:26 |
| notmorgan | derp | 20:26 |
| ayoung | notmorgan, certain puppet savvy people said they would string me up by my nether regions if I didn | 20:26 |
| ayoung | 't | 20:26 |
| notmorgan | seriously... i'm looking at rabbit configs... :P | 20:27 |
| notmorgan | brain is not 100% python mode | 20:27 |
| ayoung | notmorgan, Erlangbrain | 20:27 |
| *** dtroyer has joined #openstack-keystone | 20:28 | |
| *** aginwala has quit IRC | 20:28 | |
| notmorgan | ayoung: so.. is_admin_project is part of the token? | 20:29 |
| ayoung | notmorgan, yep | 20:29 |
| notmorgan | ayoung: what part of the token is this in? | 20:30 |
| notmorgan | ayoung: just the top level? | 20:30 |
| ayoung | and don't make me rememeber exatly why we couldn;'t put it into the "project" section...it had to be top level for a reason.... | 20:30 |
| kfox1111 | ayoung: how much do services rely on the admin role these days? | 20:30 |
| ayoung | yeah...it was a practica,l constraint | 20:30 |
| notmorgan | ayoung: nod. | 20:30 |
| ayoung | kfox1111, a metric ton | 20:30 |
| henrynash | ayoung, marekd, topol: rebased https://review.openstack.org/#/c/226661/ could do with a couple of votes | 20:30 |
| kfox1111 | trying to figure out if we can share a keystone between two regions where the regions admins are disjoint. | 20:30 |
| ayoung | notmorgan, putting it deeper in means we would have to wait on updated access info for all the projects....it essentially would defeat the effectiveness | 20:31 |
| ayoung | kfox1111, you share a keystone between them? | 20:31 |
| notmorgan | ayoung: and it's http://specs.openstack.org/openstack/keystone-specs/specs/mitaka/is_admin_project.html right? | 20:31 |
| ayoung | I mean, do you do that now? | 20:31 |
| kfox1111 | thinking about it. | 20:31 |
| topol | henrynash, Im on it. | 20:31 |
| kfox1111 | is it something you can 's/admin/regionX_admin/' over the policy files of a region? | 20:31 |
| *** aginwala has joined #openstack-keystone | 20:31 | |
| kfox1111 | or is there deeper magic involved? | 20:32 |
| notmorgan | ayoung: enjoy | 20:32 |
| notmorgan | ayoung: that may be my last +2 on keystone server for a long time. | 20:32 |
| ayoung | notmorgan, that is a good swansong | 20:32 |
| ayoung | notmorgan, TYVM | 20:32 |
| henrynash | topol: thx | 20:32 |
| kfox1111 | I think ideally the other way to solve it is with a keystone per region, and federate, but horizon doesn't support k2k fully yet. :/ | 20:33 |
| ayoung | henrynash, one nice things about specs is diff to earlier version works well. +2 | 20:34 |
| ayoung | kfox1111, so, earlier discussion was whether to make admin project tied to the service catalog. This fix does;nt go that far, but it is something we could entertain in the future | 20:35 |
| topol | ayoung +++ | 20:35 |
| kfox1111 | ah. cause the service catalog is tied to a region? that would work. | 20:36 |
| kfox1111 | or maybe have a second, key/value option that ties region to project, and defaults to the other option specified. | 20:38 |
| ayoung | kfox1111, I think we would need to do more logic, though. We would need to know that token was targetted at a certain endpoint | 20:38 |
| ayoung | kfox1111, that is in the works, but I think you need it first, and then it would need to be enforced on all endpoints prior to scoping admin to, say a region | 20:39 |
| ayoung | kfox1111, separate Keystone servers is safer, and K2K is probably the way to go for enforcement | 20:39 |
| kfox1111 | yeah, seems like a great way to go, if it would work with horizon. :/ | 20:40 |
| kfox1111 | very few of our users use cli. :/ | 20:40 |
| kfox1111 | do you know the current state of the k2k horizon stuff? | 20:41 |
| kfox1111 | maybe if we run a mitaka 1 horizon? | 20:41 |
| *** itlinux_ has joined #openstack-keystone | 20:42 | |
| ayoung | kfox1111, good question. lin H is our current Keystone/Horizon liason but he's not here is he... | 20:43 |
| *** itlinux has quit IRC | 20:44 | |
| ayoung | henrynash, +2A...We approved at the meeting this week right? I'm not overstepping here. | 20:44 |
| kfox1111 | k. I'll to catch him later. | 20:46 |
| openstackgerrit | Merged openstack/keystone-specs: Domain Specific Roles https://review.openstack.org/226661 | 20:47 |
| kfox1111 | are there any known issues with K2K with any services? sahara, trove, heat, etc? | 20:47 |
| *** jasonsb has quit IRC | 20:49 | |
| *** diegows has quit IRC | 20:51 | |
| *** tjcocozz has quit IRC | 20:53 | |
| *** mylu has quit IRC | 20:53 | |
| *** raildo is now known as raildo-afk | 20:54 | |
| *** tjcocozz has joined #openstack-keystone | 20:56 | |
| *** aginwala has quit IRC | 20:57 | |
| kfox1111 | do trusts work with federation? | 21:02 |
| kfox1111 | k2k federation | 21:02 |
| lbragstad | dstanek so i got through fixing bug 1224273 starting here - https://review.openstack.org/#/c/253669/1 | 21:03 |
| openstack | bug 1224273 in OpenStack Identity (keystone) "Need a test to verify token's do not get data creep" [Medium,In progress] https://launchpad.net/bugs/1224273 - Assigned to Lance Bragstad (lbragstad) | 21:03 |
| lbragstad | dstanek do you think i should just reimplement that using jsonschema instead? | 21:03 |
| *** diegows has joined #openstack-keystone | 21:03 | |
| *** adelia has quit IRC | 21:04 | |
| *** pauloewerton has quit IRC | 21:04 | |
| lbragstad | dstanek do you have a strong opinion either way on using voluptuous over jsonschema? | 21:04 |
| henrynash | ayoung: gyee had severe reservations (not on the concept, just the API itself)….I had imagined that our PTL would have to make a call…. | 21:05 |
| *** diegows has quit IRC | 21:05 | |
| gyee | henrynash, reusing implied role APIs will cause confusion, we either merge the two concepts or use new APIs | 21:09 |
| henrynash | gyee: I understand your concern (I don’t see it as such an issue), but appreciate anyone fighting for good UX | 21:10 |
| ayoung | gyee, you are so wrong | 21:10 |
| gyee | ayoung, wrong in what? | 21:11 |
| ayoung | gyee, role-groups as a name would be just as confusing | 21:11 |
| ayoung | there is nothing wrong with this api | 21:11 |
| gyee | domain-specific roles don't appear in the token | 21:11 |
| ayoung | gyee, exactly | 21:11 |
| ayoung | roles are the things assigned to users | 21:11 |
| gyee | they are different from implied roles | 21:11 |
| ayoung | gyee, better to say that "implication" and "domain specific" are two potential attributes of a role | 21:12 |
| gyee | on top of that, we put special restrictions to make sure they can't be nested | 21:12 |
| ayoung | actually, my language could be better | 21:12 |
| ayoung | "inference" and "domain specific" are two potential attributes of a role | 21:12 |
| ayoung | gyee, ? | 21:12 |
| gyee | what is a "role"? | 21:13 |
| gyee | lets agree on that one first | 21:13 |
| *** navid_ has quit IRC | 21:13 | |
| gyee | a "role" appear in token? | 21:13 |
| *** navid_ has joined #openstack-keystone | 21:14 | |
| ayoung | gyee, so...a role is a label assigend to user that may be used for access control | 21:14 |
| ayoung | gyee, my preferred taxonomy would be: | 21:14 |
| *** aginwala has joined #openstack-keystone | 21:14 | |
| ayoung | role -> workflow -> priviledge or permission | 21:14 |
| gyee | a role gos onto the token, period | 21:14 |
| gyee | isn't that so much easier to explain it to people | 21:15 |
| gyee | ? | 21:15 |
| ayoung | we assign roles to uisers. assigne workflows top roles and assign permissions to workflows | 21:15 |
| ayoung | no | 21:15 |
| ayoung | gyee, roles are assigned to users on a project. Role inference is used to determine what goes in the token | 21:15 |
| gyee | now you are confusing me | 21:16 |
| gyee | what's the difference between a "role" and "role inference"? | 21:16 |
| ayoung | role inference is a rule that says one role implies another role | 21:17 |
| gyee | in your implied role spec, both prior and implied roles goes into the token | 21:17 |
| gyee | so they are all roles | 21:17 |
| ayoung | gyee, yes, because that spec did not depend on Henry's | 21:17 |
| ayoung | henry's depends on this | 21:17 |
| gyee | they are returned in the "roles" section of the token response | 21:17 |
| gyee | that's my point, the two concepts are fundamentally different, hence my objection | 21:18 |
| henrynash | for me, global roles always go in tokens, domain roles never go in tokens. | 21:18 |
| henrynash | period | 21:18 |
| *** breitz has quit IRC | 21:18 | |
| gyee | "global roles"? | 21:18 |
| henrynash | both can infer other roels | 21:19 |
| henrynash | roels | 21:19 |
| henrynash | global roles = a non domain specific role | 21:19 |
| *** breitz has joined #openstack-keystone | 21:19 | |
| gyee | you scare me there, we used to have "global" roles which have no target association :) | 21:19 |
| gyee | henrynash, come to think of it, why can't domain-specific roles go onto the token? | 21:20 |
| ayoung | gyee, roles are names/ you are refgerering to global role *assignments* which we got rid of | 21:20 |
| gyee | if we do that, we eliminate all the confusions | 21:20 |
| ayoung | roles have alwyas been global | 21:20 |
| ayoung | what we are dfoing here is making it such that a role can be less than global | 21:21 |
| gyee | role definitions has always been global | 21:21 |
| gyee | role defintions != global roles | 21:21 |
| gyee | global roles use to cause fears :) | 21:21 |
| henrynash | THAT is the change I am making….roles can be global (i.e go in tokens and appear in policy files), or they can be domain specific (in which case they never go in tokens and never appear in poly files)….but instead infer those roles that do | 21:22 |
| kfox1111 | so, we have one region with keystone configured. we want to use that keystone as the identity provider for k2k, while not breaking the existing region. is that ok? | 21:22 |
| kfox1111 | we're going to deprecate that region soon, so eventually that keystone could be a pure idp, but not for a bit at least. | 21:23 |
| gyee | henrynash, I understand what you are trying to do, all I am arguing is domain-specific *roles* are not roles because they don't end up in the token | 21:24 |
| gyee | I would hate to have a support person come up to me, time and again, asking why user don't get the role even though its been assigned | 21:25 |
| gyee | and I have to keep explaining to him they are not really roles | 21:25 |
| kfox1111 | +1 for not overloading terms too much. | 21:26 |
| *** jasonsb has joined #openstack-keystone | 21:26 | |
| *** navid_ has quit IRC | 21:27 | |
| *** boris-42_ has joined #openstack-keystone | 21:28 | |
| gyee | kfox1111, on the flip side, consulting business will be booming because only we know the stuff :) | 21:29 |
| ayoung | gyee, use the terms correctly. What you call role definitions are "roles". THese are global. Role assignments are scoped to proejcts, but were, in some pre-me-and-you-past global, and that is what is_admin was based on.... | 21:29 |
| ayoung | henrynash, is talking about global roles as definitions | 21:29 |
| ayoung | kfox1111, =1 for requiring a new term where an exiting one is appropriate. gyee did that to us already with domains. I'm still bitter, and this is the same thing all over again. The real issue is that what we call groups are in the identity sisde, and not something that keystone can manage. | 21:31 |
| ayoung | henrynash is extending the existing concepts in a sane way to make these things more manageable. Adding role-group as a concept would make things worse | 21:32 |
| *** petertr7 is now known as petertr7_away | 21:32 | |
| ayoung | and, why don't DSRs go in tokes? because tokens match on string, not on roel id | 21:32 |
| ayoung | role id | 21:32 |
| gyee | domain have specific use, unlike projects | 21:32 |
| ayoung | gyee, that use is to break every api acverywhere | 21:32 |
| kfox1111 | yeah, I still hate the term project. :/ tenants were much better. | 21:32 |
| ayoung | we should have made project nestable | 21:32 |
| kfox1111 | "project" means too many things to too many users. :/ | 21:33 |
| kfox1111 | at our site, "project" could be thought of closer to what keystone calls a domain. :/ | 21:33 |
| ayoung | kfox1111, we should never have started calling them projects, although tenatnst as a term sucks too, it sucks less than project | 21:33 |
| openstackgerrit | Merged openstack/keystone: Remove invalid FIXME note https://review.openstack.org/253123 | 21:33 |
| ayoung | kfox1111, I like taskforce myself | 21:33 |
| kfox1111 | yeah. I liked tenants because while users would need help to understand, we had the opertunityh to explian. they assume too much about projects. | 21:34 |
| kfox1111 | hah. taskforce. yeah. :) | 21:34 |
| gyee | ayoung, how's adding role group make things worst? how about add a special flag, is_group, to users and eliminate user groups? :) | 21:35 |
| ayoung | kfox1111, OTOH, " a project is a lable used to group remote resources" more closely matches the english than "a tenant is...." | 21:35 |
| gyee | that's sounds awesome! :D | 21:35 |
| ayoung | gyee, can't | 21:35 |
| ayoung | that stuff is in identity | 21:35 |
| ayoung | identity is read only | 21:35 |
| ayoung | this is why dchadwick wanted mapping to be editable by end user admins | 21:35 |
| kfox1111 | so, with k2k, do you have to make a mapping for every ldap group you have, if you want to extend it through? or do you just do map groups to roles in the idp, and then roles to roles in the sdp? | 21:35 |
| *** mhickey has quit IRC | 21:35 | |
| ayoung | it allows you to do all this stuff with mapping, but the mapping language is too complicated | 21:35 |
| ayoung | kfox1111, Not a clue | 21:36 |
| kfox1111 | kind of dreading if we have to update the rules every time we create a new ldap group. :/ | 21:36 |
| gyee | how about lets eliminate everything and make them generic "entities" | 21:36 |
| kfox1111 | we have a group per tenant currently. | 21:36 |
| ayoung | kfox1111, in federation mappingm, you can do general rules, but not sureif K2K inherits all that | 21:36 |
| gyee | just use special flags for everything | 21:36 |
| ayoung | gyee, the term you are looking for is principal | 21:36 |
| gyee | everything is a dict! | 21:37 |
| gyee | no more extras | 21:37 |
| kfox1111 | guess I'll just have to try it and see... | 21:38 |
| ayoung | gyee the thing is, it is the implied_roles part I care about. Domain specific is henrynash 's baby. I don't think they will be nearly as important as he does. But they will be useful | 21:38 |
| ayoung | bu the implied roles allow us to break down big chunks into little chuncks | 21:38 |
| gyee | ayoung, I have no problem with implied roles | 21:38 |
| ayoung | the thing we'll need after this is amakarov 's unified delagation ,adn the ability to request a token with a subset of (implied or explicit) roles | 21:38 |
| *** afazekas has quit IRC | 21:39 | |
| ayoung | gyee, SO if we renamed "domain specific roles" to "role groups" the plus would be that people would not expecct to see them in tokens, but the minus would be that we would need to retool all assignment code, including horizon. etc | 21:40 |
| *** afazekas has joined #openstack-keystone | 21:40 | |
| ayoung | With that trade off, I say that reusing the existing term is far, far more useful | 21:40 |
| *** petertr7_away is now known as petertr7 | 21:40 | |
| gyee | call them role groups would be consistent with the rest, like user groups | 21:40 |
| gyee | much easier to explain it to people | 21:41 |
| ayoung | gyee, before we did that, I think I would say "split identity into user and group" and then allow groups to vary indepentantly from the initial assertion, and reuse the group abstraction | 21:41 |
| ayoung | as I said, the real issue is that we cannot manage groups in keystone if the identity backend is read only | 21:42 |
| ayoung | and we've already made that nasty iwth federation | 21:42 |
| gyee | ayoung, I haven't thought about the implementation, all I care is getting the concept and API right at this point | 21:42 |
| gyee | APIs are like a contract, once finalized, its very hard to change | 21:42 |
| gyee | so we need to try to do it right the first time | 21:42 |
| kfox1111 | so, the docs make it look like you can only map groups to groups... | 21:43 |
| kfox1111 | so roles would have to be mapped in each sdp keystone. :/ | 21:43 |
| gyee | kfox1111, with K2K, you can map it to a specific set of roles | 21:43 |
| gyee | doesn't have to be a group | 21:44 |
| kfox1111 | gyee: have an example? | 21:44 |
| kfox1111 | hmm... http://docs.openstack.org/developer/keystone/mapping_combinations.html mentions k2k stuff is a little different, but doesn't have an example of roles or groups. | 21:46 |
| notmorgan | ayoung: woot: https://api.tempusfrangit.org/volume https://api.tempusfrangit.org/image https://api.tempusfrangit.org/identity | 21:48 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:49 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 21:49 | |
| *** gwei31 has joined #openstack-keystone | 21:49 | |
| *** aginwala has quit IRC | 21:49 | |
| *** gwei3 has quit IRC | 21:50 | |
| ayoung | Tempus Frangit, eh? time breaks. Sandman reference? | 21:51 |
| notmorgan | ayoung: yup | 21:52 |
| *** diazjf1 has quit IRC | 21:52 | |
| notmorgan | ayoung: so the cinder volume backend isn't there yet | 21:53 |
| notmorgan | ayoung: but glance is fully functional as is keystone | 21:53 |
| ayoung | notmorgan, so...behind the scenes, I am assuming that keystone is on 35357, but HTTPD? | 21:53 |
| notmorgan | ayoung: yeah. | 21:53 |
| *** aginwala has joined #openstack-keystone | 21:53 | |
| notmorgan | ayoung: api.tempusfrangit is HAProxy doing L7 routing | 21:53 |
| ayoung | notmorgan, what about Horizon? Just punting that to another server? | 21:53 |
| notmorgan | horizon will be /dashboard | 21:54 |
| *** diazjf has joined #openstack-keystone | 21:54 | |
| notmorgan | and if you go to api.tempusfrangit.org/ it redirects you to / | 21:54 |
| ayoung | notmorgan, and some randome port? | 21:54 |
| notmorgan | erm /dashboard | 21:54 |
| notmorgan | nope | 21:54 |
| notmorgan | no random port. | 21:54 |
| notmorgan | horizon will run on the same shared internal API node | 21:54 |
| ayoung | notmorgan, different vhost? | 21:54 |
| notmorgan | on port 80 | 21:54 |
| notmorgan | once it's all setup i'll be SSLing the internal hosts too | 21:54 |
| ayoung | notmorgan, so 80 is hidden from view? Only 443 to the outside world? | 21:55 |
| notmorgan | correct | 21:55 |
| notmorgan | any request to 80 on api.t.o redirects to 443 | 21:55 |
| ayoung | notmorgan, you are doing it right. Thanks | 21:55 |
| notmorgan | and auth URL is auth.tempusfrangit.org | 21:55 |
| notmorgan | so you auth there and then catalog is all elsewhere | 21:55 |
| notmorgan | also letsencrypt being public beta = win | 21:55 |
| *** topol has quit IRC | 21:57 | |
| *** topol has joined #openstack-keystone | 21:58 | |
| *** ChanServ sets mode: +v topol | 21:58 | |
| gyee | kfox1111, no direct role mapping, my bad | 21:59 |
| ayoung | I think so, but cautiously optimistic their. They need to make sure they don't sign for too too much with each cert...hard to do right. HAve not looked at their implementation | 22:00 |
| *** topol has quit IRC | 22:02 | |
| *** opilotte has quit IRC | 22:04 | |
| *** opilotte has joined #openstack-keystone | 22:04 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Reduce revoke events for disabled domains and projects. https://review.openstack.org/253273 | 22:04 |
| *** adelia has joined #openstack-keystone | 22:05 | |
| kfox1111 | is this still true: "Finally, the SP configuration also needs UUID tokens to avoid issues with the default Fernet tokens." ? | 22:06 |
| *** mylu has joined #openstack-keystone | 22:08 | |
| kfox1111 | ah. the document mentions it should be fixed in liberty. | 22:08 |
| kfox1111 | does openstack cli support k2k yet? | 22:09 |
| *** navid_ has joined #openstack-keystone | 22:09 | |
| *** adelia has quit IRC | 22:10 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Create new version of assignment driver interface https://review.openstack.org/242853 | 22:12 |
| *** navid_ has quit IRC | 22:14 | |
| *** jerrygb has quit IRC | 22:15 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Create new version of assignment driver interface https://review.openstack.org/242853 | 22:15 |
| *** henrynash has quit IRC | 22:16 | |
| *** haneef has joined #openstack-keystone | 22:18 | |
| openstackgerrit | Tim Burke proposed openstack/keystoneauth: Fix PyPI badges https://review.openstack.org/253721 | 22:18 |
| *** mylu has quit IRC | 22:18 | |
| *** mylu has joined #openstack-keystone | 22:19 | |
| *** aginwala_ has joined #openstack-keystone | 22:20 | |
| *** aginwala_ has quit IRC | 22:21 | |
| *** aginwala has quit IRC | 22:22 | |
| *** aginwala_ has joined #openstack-keystone | 22:22 | |
| *** diazjf has quit IRC | 22:24 | |
| *** mancdaz has quit IRC | 22:26 | |
| *** jbell8 has quit IRC | 22:27 | |
| *** mancdaz has joined #openstack-keystone | 22:27 | |
| *** gwei3 has joined #openstack-keystone | 22:27 | |
| *** gwei31 has quit IRC | 22:29 | |
| *** david-ly_ has joined #openstack-keystone | 22:29 | |
| *** petertr7 is now known as petertr7_away | 22:29 | |
| *** mylu has quit IRC | 22:30 | |
| *** mylu has joined #openstack-keystone | 22:30 | |
| shaleh_ | kfox1111: using keystone auth it is theoretically possible. But the UI/UX needs to be worked out | 22:31 |
| *** david-ly_ is now known as david-lyle_ | 22:31 | |
| shaleh_ | kfox1111: all of the k2k support is now in the libraries | 22:31 |
| *** david-lyle has quit IRC | 22:32 | |
| kfox1111 | k, so not at present. :/ | 22:32 |
| kfox1111 | where is the correct place to pull shibboleth for centos7? | 22:32 |
| shaleh_ | kfox1111: but nothing stopping it either | 22:33 |
| kfox1111 | shaleh_: thats the "its only a matter of code" response. ;) | 22:33 |
| kfox1111 | which is true, but only if your a coder. :) | 22:33 |
| shaleh_ | kfox1111: correct. But now that the libs support it the last bit pretty easy | 22:33 |
| kfox1111 | for some of my users, that answer means, "not possible" | 22:33 |
| kfox1111 | yeah. I might have to take a stab at it... | 22:33 |
| shaleh_ | kfox1111: get better users :-) | 22:34 |
| kfox1111 | if I can fit it into my 'copious amounts of free time' :) | 22:34 |
| shaleh_ | kfox1111: in all serious, though it should happen now | 22:34 |
| *** mylu has quit IRC | 22:35 | |
| shaleh_ | kfox1111: I had not yet because last time I had cycles we were waiting on keystoneauth | 22:36 |
| kfox1111 | ah. | 22:36 |
| shaleh_ | ayoung: could you take a minute and kick my open reviews down the pipe? | 22:36 |
| ayoung | shaleh_, link? | 22:36 |
| shaleh_ | ayoung: my unit test cleanups are dangling | 22:37 |
| shaleh_ | I get tired of needing to rebase them | 22:37 |
| kfox1111 | yeah, k2k looks really awesome, but asking users to only do things via rest api seems a little heavy handed. :/ | 22:37 |
| ayoung | kfox1111, we don't control horizon | 22:37 |
| kfox1111 | ayoung: is rdo planning on packaging shib? | 22:37 |
| ayoung | and we can't make it seamless | 22:37 |
| shaleh_ | kfox1111: agreed. python-keystoneclient and keystoneauth now support it natively | 22:37 |
| ayoung | kfox1111, nope | 22:37 |
| ayoung | kfox1111, we were origianlly going to go with Ipsilon, but not sure now. | 22:38 |
| shaleh_ | shaleh_: so from application code perspective it is pretty clean | 22:38 |
| ayoung | Ipsilon and Fedora AS merged... | 22:38 |
| shaleh_ | BAH | 22:38 |
| ayoung | but you don;'t need shib for K2K | 22:38 |
| *** shaleh_ is now known as shaleh | 22:38 | |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles https://review.openstack.org/242614 | 22:39 |
| openstackgerrit | ayoung proposed openstack/keystone: Create V9 Role Driver https://review.openstack.org/247805 | 22:39 |
| openstackgerrit | ayoung proposed openstack/keystone: Create new version of assignment driver interface https://review.openstack.org/242853 | 22:39 |
| ayoung | GAH | 22:39 |
| ayoung | rebase hell | 22:39 |
| ayoung | sorry henry | 22:39 |
| kfox1111 | ayoung: oh, really? how do you do it without? | 22:39 |
| shaleh | ayoung: https://review.openstack.org/#/q/owner:%22Sean+Perry%22+status:open,n,z <-- all of the ones with the Green check | 22:39 |
| notmorgan | ayoung: just realized i also need to do the crazy thing and use proper auth plugins for KSM for now | 22:39 |
| ayoung | kfox1111, shib is an external Federation provider. K2K uses py-saml, but not all of Shib | 22:39 |
| kfox1111 | shaleh_: so you can use keystone cli to get a token for the SP? | 22:40 |
| shaleh | kfox1111: no, but the Python code supports it. so an application can | 22:40 |
| shaleh | kfox1111: the keystone CLI is dead | 22:40 |
| kfox1111 | ayoung: following the directions here: http://blog.rodrigods.com/it-is-time-to-play-with-keystone-to-keystone-federation-in-kilo/ | 22:40 |
| kfox1111 | which mentions installing libapache2-mod-shib2. is that step not needed? | 22:41 |
| kfox1111 | I am doing it on centos7+rdo though. so trying to map it somehow. | 22:41 |
| shaleh | kfox1111: shib is the easy, supported path | 22:41 |
| shaleh | kfox1111: there are other paths | 22:41 |
| shaleh | kfox1111: the openstack CLI however needs a think. The code passes an auth plugin to the k2k plugin. So we need a way to say from the CLI --auth-with-plugin X --doing-k2k | 22:43 |
| shaleh | kfox1111: locally it would be trivial to make a openstack CLI which only did k2k auth. | 22:44 |
| *** aginwala_ has quit IRC | 22:46 | |
| shaleh | ayoung: thanks. those have been dangling for a while now | 22:46 |
| ayoung | shaleh, gonna +2 this one https://review.openstack.org/#/c/249509/3/keystone/tests/unit/test_backend.py,cm get the add'l cleanup in anther path, ok | 22:46 |
| ayoung | patch | 22:46 |
| shaleh | ayoung: agreed | 22:47 |
| kfox1111 | shaleh: or an environ var, so we can stick it in the horizon generated rc files. | 22:47 |
| shaleh | kfox1111: right, that is the "think it through" part. | 22:47 |
| ayoung | shaleh, https://review.openstack.org/#/c/249504/2/keystone/common/openssl.py,cm can probably go away. I think that is onluy needed for use cases I don;t want to support | 22:47 |
| shaleh | kfox1111: in your own local setup or tree you could easily make a OSC that always did k2k | 22:47 |
| shaleh | ayoung: we have quite a bit of dead wood | 22:49 |
| ayoung | shaleh, https://review.openstack.org/#/c/247257/2/keystone/tests/unit/core.py,cm | 22:49 |
| *** aginwala has joined #openstack-keystone | 22:49 | |
| ayoung | new_ref generats the uuid. WHy'd you do that again? | 22:49 |
| ayoung | did you ahve areason>? | 22:49 |
| shaleh | ayoung: I think this is part of the mess with rebasing | 22:50 |
| notmorgan | ayoung: server resize *should* be non-destructive right? | 22:50 |
| shaleh | ayoung: I can clean that one up | 22:50 |
| ayoung | shaleh, nope | 22:50 |
| shaleh | ayoung: no, I mean me locally | 22:50 |
| shaleh | ayoung: I had that right at one point | 22:50 |
| * notmorgan needs to add more ram to a box in this POC. | 22:50 | |
| notmorgan | or i guess i could just add another host... | 22:50 |
| ayoung | shaleh, I'm going to go with "just learning the code base" on that one... | 22:50 |
| * notmorgan goes for the former, it'll be less $ =/ | 22:51 | |
| shaleh | ayoung: more like learning how to use git the OpenStack way. | 22:51 |
| notmorgan | erm latter | 22:51 |
| shaleh | ayoung: that one can be dinged -1 if you like | 22:51 |
| shaleh | ayoung: no harm, no foul | 22:51 |
| shaleh | ayoung: I did not ask you so it would be rubber stamped :-) | 22:52 |
| shaleh | BRB all | 22:53 |
| kfox1111 | are the mappings created via the rest api? | 22:53 |
| ayoung | shaleh, on https://review.openstack.org/#/c/248889/1/keystone/tests/unit/test_backend_sql.py,cm are service enabled when created now? | 22:53 |
| shaleh | kfox1111: yes | 22:53 |
| kfox1111 | this is very involved. :/ | 22:53 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/catalog/core.py#n200 yep | 22:54 |
| *** jasonsb has quit IRC | 22:55 | |
| ayoung | shaleh, +2ed a bunch, -1ed one...should be less of a burden | 22:55 |
| shaleh | ayoung: thanks | 22:56 |
| shaleh | kfox1111: https://github.com/shaleh/multinode-vagrant-devstack | 22:57 |
| shaleh | kfox1111: ansible playbooks to setup an arbitrary number of Idp/SP connections between devstacks | 22:57 |
| shaleh | kfox1111: there are playbooks documenting all of the connection steps | 22:57 |
| shaleh | kfox1111: I did the REST calls by "hand" no Python libs or external depends | 22:58 |
| *** mylu has joined #openstack-keystone | 22:59 | |
| kfox1111 | k. I'll give that a try. | 23:02 |
| shaleh | kfox1111: that should help explain all the steps. It is a much simpler setup than say OSAD | 23:02 |
| shaleh | kfox1111: pull requests and/or issues are welcomed | 23:03 |
| shaleh | kfox1111: ignore the bit about the cachier plugin | 23:04 |
| shaleh | kfox1111: I found that caused more problems than it solved | 23:04 |
| notmorgan | i do have to admit it's kindof nice not grinding my laptop into the ground trying to setup a VM to test this stuff out | 23:05 |
| shaleh | notmorgan: who are you using to host? | 23:05 |
| notmorgan | shaleh: Vexxhost | 23:06 |
| notmorgan | shaleh: they're pretty fantastic! | 23:06 |
| notmorgan | seriously moving all my personal hosting to them too | 23:06 |
| notmorgan | shaleh: but this is the super cool part... | 23:06 |
| notmorgan | shaleh: http://paste.openstack.org/show/480949/ | 23:07 |
| shaleh | looks like a service catalog.... | 23:08 |
| notmorgan | yah | 23:08 |
| notmorgan | but notice no non-standard ports *and* everything under api.tempusfrangit.org | 23:08 |
| notmorgan | (thats my POC) | 23:08 |
| * notmorgan should do internal DNS on the thing too... but... | 23:08 | |
| notmorgan | eh | 23:08 |
| shaleh | so are you using a mod_rewrite kind of thing to redirect to the services? | 23:09 |
| *** dims has quit IRC | 23:10 | |
| notmorgan | shaleh: HAProxy | 23:14 |
| notmorgan | shaleh: full L7 routing | 23:14 |
| *** itlinux has joined #openstack-keystone | 23:14 | |
| shaleh | nice | 23:16 |
| *** itlinux_ has quit IRC | 23:17 | |
| *** pwp has quit IRC | 23:18 | |
| *** itlinux_ has joined #openstack-keystone | 23:19 | |
| *** itlinux has quit IRC | 23:19 | |
| *** aix has quit IRC | 23:19 | |
| *** itlinux has joined #openstack-keystone | 23:22 | |
| *** itlinux_ has quit IRC | 23:24 | |
| ayoung | gyee, please see my coments and, if you can, remove -1. | 23:25 |
| ayoung | https://review.openstack.org/#/c/240720/5 | 23:26 |
| *** itlinux has quit IRC | 23:27 | |
| *** gwei31 has joined #openstack-keystone | 23:29 | |
| *** spotz is now known as spotz_zzz | 23:29 | |
| *** gwei31 has quit IRC | 23:30 | |
| *** gwei3 has quit IRC | 23:31 | |
| *** lhcheng has joined #openstack-keystone | 23:32 | |
| *** ChanServ sets mode: +v lhcheng | 23:32 | |
| shaleh | notmorgan: what is (roughly) your monthly cost? | 23:32 |
| notmorgan | shaleh: for this POC, it's going to be about $80 or so | 23:33 |
| notmorgan | shaleh: or $90 | 23:33 |
| notmorgan | shaleh: it's all on top of their public cloud | 23:33 |
| notmorgan | shaleh: but i'm running like 7 hosts, a couple networks, and a couple routers [sdn] | 23:34 |
| *** gwei3 has joined #openstack-keystone | 23:34 | |
| *** itlinux has joined #openstack-keystone | 23:34 | |
| notmorgan | and my personal host [which runs this IRC bouncer for me] | 23:34 |
| openstackgerrit | ayoung proposed openstack/keystone: Create new version of assignment driver interface https://review.openstack.org/242853 | 23:34 |
| shaleh | notmorgan: i suppose that is decent. Especially considering what that costs to own. | 23:35 |
| notmorgan | shaleh: yeah. i mean my goal is <$100/mo | 23:35 |
| *** openstack has joined #openstack-keystone | 23:36 | |
| notmorgan | i figure i can afford a couple months of this poc | 23:36 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:36 | |
| openstackgerrit | ayoung proposed openstack/keystone: Create V9 Role Driver https://review.openstack.org/247805 | 23:38 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles https://review.openstack.org/242614 | 23:38 |
| ayoung | OK..hopefull I have that right now | 23:38 |
| *** itlinux has quit IRC | 23:39 | |
| kfox1111 | do you install shib on both keystones? | 23:39 |
| kfox1111 | this one doc says do it to just the SP, but other parts seem to imply it needs to be on both? | 23:40 |
| shaleh | kfox1111: the shibboleth daemon runs on the SP | 23:41 |
| ayoung | kfox1111, link? | 23:41 |
| stevemar | lbragstad: i dont think it's fixed yet | 23:44 |
| stevemar | we should still attempt to make the IDs we pass to pycadf become UUIDs | 23:44 |
| stevemar | so we don't run into the same problem | 23:45 |
| *** davechen has left #openstack-keystone | 23:46 | |
| *** dims has joined #openstack-keystone | 23:47 | |
| gyee | ayoung, your changes will break the existing deployment | 23:48 |
| kfox1111 | http://blog.rodrigods.com/it-is-time-to-play-with-keystone-to-keystone-federation-in-kilo/ | 23:49 |
| gyee | ayoung, is_admin_project need not be coupled with the 'admin' role | 23:49 |
| *** gwei3 has quit IRC | 23:50 | |
| kfox1111 | I'm getting a 404 from http://172.18.0.76:5000/v3/OS-FEDERATION/saml2/idp | 23:51 |
| kfox1111 | on the idp. | 23:51 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!