| *** pgbridge has quit IRC | 00:00 | |
| *** jerrygb has quit IRC | 00:00 | |
| *** jerrygb has joined #openstack-keystone | 00:02 | |
| *** tonytan4ever has joined #openstack-keystone | 00:02 | |
| *** jamielennox|away is now known as jamielennox | 00:05 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Use new_policy_ref consistently https://review.openstack.org/247257 | 00:07 |
|---|---|---|
| openstackgerrit | Merged openstack/keystone-specs: Shadow users: unified identity https://review.openstack.org/240595 | 00:09 |
| *** aginwala has quit IRC | 00:11 | |
| *** aginwala has joined #openstack-keystone | 00:17 | |
| *** jerrygb has quit IRC | 00:18 | |
| *** jerrygb has joined #openstack-keystone | 00:18 | |
| notmorgan | zigo: hey man, sometime this week we need to have a chat about some.debconf stuff being done in the packages. | 00:19 |
| zigo | notmorgan: Go ahead! :) | 00:19 |
| notmorgan | zigo: I think we need to discuss some philosophy here :) | 00:19 |
| notmorgan | I'm about o hop on a plane. So maybe tomorrow? | 00:19 |
| zigo | Ok. | 00:19 |
| zigo | Have a good flight then. | 00:19 |
| * notmorgan is headed from NYC back to home. :) | 00:20 | |
| notmorgan | Thnx. Talk with ya tomorrow :) | 00:20 |
| *** gildub has joined #openstack-keystone | 00:21 | |
| *** gordc has quit IRC | 00:22 | |
| *** jerrygb has quit IRC | 00:23 | |
| *** tonytan4ever has quit IRC | 00:23 | |
| *** gildub has quit IRC | 00:28 | |
| *** gildub has joined #openstack-keystone | 00:29 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use assertDictEqual instead of assertEqualPolicies https://review.openstack.org/251482 | 00:33 |
| jamielennox | notmorgan: still here? 2 fairly easy review | 00:38 |
| notmorgan | jamielennox: really laggy atm | 00:38 |
| jamielennox | https://review.openstack.org/#/c/253999/ and https://review.openstack.org/#/c/251687/ | 00:38 |
| jamielennox | ah - nvm then, no ruhs | 00:38 |
| *** aginwala has quit IRC | 00:39 | |
| notmorgan | jamielennox: give me a few mins... | 00:41 |
| notmorgan | might not be able to preboarding | 00:41 |
| openstackgerrit | Sean Perry proposed openstack/keystone: Refactor test use of new_*_ref https://review.openstack.org/237205 | 00:41 |
| shaleh | bknudson: I just rebased it for you ^^ | 00:41 |
| jamielennox | notmorgan: not a rush, i can find someone else around | 00:41 |
| shaleh | gah, jenkins is failing due to package versions | 00:41 |
| jamielennox | shaleh: awww, it's going to be one of those days | 00:42 |
| shaleh | jamielennox: yeah, one of the oslo libs | 00:43 |
| notmorgan | jamielennox: the saml one i can't load due to lag | 00:43 |
| notmorgan | but the other one +2/A | 00:43 |
| jamielennox | notmorgan: thanks | 00:45 |
| jamielennox | notmorgan: also - any idea when morgan is coming back? | 00:45 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Make tests run against original client and sessions https://review.openstack.org/117089 | 00:45 |
| shaleh | jamielennox: so what is the plan for the keystone auth review involving password prompting? | 00:45 |
| notmorgan | jamielennox: never | 00:45 |
| notmorgan | jamielennox: because mor<tab> was getting old. | 00:45 |
| *** alejandrito has quit IRC | 00:46 | |
| shaleh | notmorgan: it better reflects your non-positive energy anyways :-) | 00:46 |
| notmorgan | this way i only collide with notmyname and you know what, we overlap in fewer channels than mordred and I do | 00:46 |
| jamielennox | shaleh: so at the moment there is going to be a callback function you can use via os-client-config, that will let openstackclient do the special casing it does now | 00:46 |
| notmorgan | jamielennox: ++ | 00:46 |
| shaleh | jamielennox: I suspected that would end up being the solution | 00:46 |
| notmorgan | jamielennox: mordred needs some tests in his patch and it's pretty good looking | 00:46 |
| jamielennox | shaleh: in future we probably want the getpass attribute on the opts to allow it to be a bit more generic | 00:47 |
| notmorgan | jamielennox: i was planning on rolling tests tomorrow if he doesn't | 00:47 |
| jamielennox | notmorgan: yea, it was fairly easy when it came down to it | 00:47 |
| notmorgan | ok time to board soon. | 00:47 |
| jamielennox | shaleh: but for now the problem i'm trying to solve is on the OSC/OCC boundary so if that solves the current issue we'll worry about future stuff when appropriate | 00:47 |
| *** jasonsb has quit IRC | 00:47 | |
| shaleh | jamielennox: yeah. Like I mentioned, cleanliness aside, do the prompting from there made L10N hard. | 00:48 |
| jamielennox | yea, that was only going to matter in a very few scenarios | 00:48 |
| jamielennox | but the load_from_argparse stuff existed before os-client-config, at the moment it's pretty much deprecated in favour of using os-client-config | 00:49 |
| shaleh | yay, die old code :-) | 00:49 |
| jamielennox | not officially - if you want to use it go ahead, but most of what it was trying to solve is accomplished better by occ | 00:49 |
| notmorgan | ayoung: I am turning a corner on some ideas you had a year ago. | 00:50 |
| notmorgan | Fyi | 00:50 |
| shaleh | jamielennox: unrelated, where do we see passing around some form of list of current tokens. perhaps a parameter to KSA's Session? | 00:51 |
| *** aginwala has joined #openstack-keystone | 00:53 | |
| *** aginwala has quit IRC | 00:55 | |
| *** EinstCrazy has joined #openstack-keystone | 00:56 | |
| jamielennox | shaleh: list? where are you seeing the need for a list | 00:56 |
| *** RichardRaseley has quit IRC | 00:56 | |
| jamielennox | shaleh: so a while ago i was thinking of having a session have multiple auth plugins and then you could select the one you wanted by name | 00:56 |
| jamielennox | instead i went that you can pass an auth plugin directly to the request() functions | 00:56 |
| jamielennox | so it's not so much a list as there is one session and you can pass the auth into it | 00:57 |
| openstackgerrit | Cristian Sava proposed openstack/keystone: Related-Bug: 1479569 https://review.openstack.org/254456 | 00:57 |
| openstack | bug 1479569 in python-openstackclient "Output from "role assignment list" is not useful" [Medium,In progress] https://launchpad.net/bugs/1479569 - Assigned to Lin Hua Cheng (lin-hua-cheng) | 00:57 |
| shaleh | jamielennox: playing with some MOC federation stuff. I can easily have 3 or more active tokens. It might be nice to move some of the complexity of handling it into a lib somewhere. I was wondering if you had put any thought to it. My plan is to play around with various POC scenarios and see if an obvious refactor presents itself. | 00:59 |
| jamielennox | so my thought has been, create one session object, create as many plugins as active tokens you have on the go | 00:59 |
| jamielennox | then when you create a client do Client(session=session, auth=auth) for a specific auth | 00:59 |
| jamielennox | then have multiple client objects that are authenticated with different things | 01:00 |
| jamielennox | how you wrap that is really going to depend on what you want to do | 01:00 |
| jamielennox | but because there's no auth on load creating a client is fairly cheap | 01:00 |
| shaleh | jamielennox: that matches what I was going to implement up front | 01:00 |
| jamielennox | so you can do a Context() object or similar that creates clients as required | 01:01 |
| jamielennox | so context.glance('usera').images.list() or whatever | 01:01 |
| jamielennox | 'usera' depending on how you're managing plugins | 01:01 |
| jamielennox | glance() just does | 01:02 |
| jamielennox | return glanceclient.Client(2, session=self.session, auth=self.plugins[ident]) | 01:02 |
| jamielennox | probably have to manage some region stuff there as well | 01:02 |
| shaleh | jamielennox: yup, matches what I was thinking | 01:04 |
| shaleh | jamielennox: thanks | 01:04 |
| jamielennox | any time | 01:05 |
| *** andrewbogott has joined #openstack-keystone | 01:05 | |
| shaleh | finally down to 2 open reviews. Yay. | 01:07 |
| *** andrewbogott has quit IRC | 01:08 | |
| *** andrewbogott has joined #openstack-keystone | 01:08 | |
| shaleh | time to head out. Gotta sit through a holiday recital. !Yay. | 01:09 |
| *** shaleh has quit IRC | 01:09 | |
| *** lhcheng has joined #openstack-keystone | 01:22 | |
| *** ChanServ sets mode: +v lhcheng | 01:22 | |
| *** tonytan4ever has joined #openstack-keystone | 01:24 | |
| *** yangyapeng has joined #openstack-keystone | 01:27 | |
| *** lhcheng has quit IRC | 01:27 | |
| *** links has joined #openstack-keystone | 01:27 | |
| *** tonytan4ever has quit IRC | 01:28 | |
| *** yangyapeng has quit IRC | 01:33 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/254088 | 01:38 |
| *** yasu has joined #openstack-keystone | 01:39 | |
| *** aginwala has joined #openstack-keystone | 01:39 | |
| *** tqtran_ has quit IRC | 01:41 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/254462 | 01:41 |
| *** r-daneel has quit IRC | 01:43 | |
| ayoung | notmorgan, what ideas were those? | 01:43 |
| *** wangqun has joined #openstack-keystone | 01:44 | |
| openstackgerrit | Merged openstack/keystoneauth: Cleanups to K2K plugin https://review.openstack.org/251687 | 02:02 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/254444 | 02:06 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/254088 | 02:06 |
| *** jerrygb has joined #openstack-keystone | 02:14 | |
| *** jasonsb has joined #openstack-keystone | 02:14 | |
| *** jerrygb has quit IRC | 02:16 | |
| *** terry_yao has joined #openstack-keystone | 02:22 | |
| *** davechen has joined #openstack-keystone | 02:27 | |
| *** ayoung has quit IRC | 02:29 | |
| *** davechen1 has joined #openstack-keystone | 02:34 | |
| *** davechen has quit IRC | 02:35 | |
| *** browne has quit IRC | 02:39 | |
| *** davechen has joined #openstack-keystone | 02:42 | |
| *** btully has quit IRC | 02:43 | |
| *** davechen1 has quit IRC | 02:45 | |
| *** wanghua has joined #openstack-keystone | 02:47 | |
| *** davechen1 has joined #openstack-keystone | 02:49 | |
| *** davechen has quit IRC | 02:51 | |
| *** spandhe has quit IRC | 02:58 | |
| *** aginwala has quit IRC | 03:03 | |
| *** aginwala has joined #openstack-keystone | 03:07 | |
| *** edmondsw has quit IRC | 03:07 | |
| *** aginwala has quit IRC | 03:07 | |
| *** fangxu_ has joined #openstack-keystone | 03:10 | |
| *** aginwala has joined #openstack-keystone | 03:11 | |
| *** fangxu has quit IRC | 03:11 | |
| *** fangxu_ is now known as fangxu | 03:11 | |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles https://review.openstack.org/242614 | 03:18 |
| jamielennox | ayoung is not in the channel | 03:18 |
| *** ayoung has joined #openstack-keystone | 03:18 | |
| *** ayoung has quit IRC | 03:18 | |
| jamielennox | summoned then gone | 03:18 |
| jamielennox | ayoung | 03:18 |
| openstackgerrit | Dave Chen proposed openstack/keystonemiddleware: Configuration is outdated https://review.openstack.org/220545 | 03:20 |
| openstackgerrit | Dave Chen proposed openstack/keystonemiddleware: Configuration is outdated https://review.openstack.org/220545 | 03:23 |
| *** browne has joined #openstack-keystone | 03:24 | |
| *** gyee has quit IRC | 03:26 | |
| *** ccard__ has joined #openstack-keystone | 03:31 | |
| openstackgerrit | javeme proposed openstack/python-keystoneclient: remove the default arguments "[]" or "{}" https://review.openstack.org/254175 | 03:33 |
| *** ccard_ has quit IRC | 03:34 | |
| *** jerrygb has joined #openstack-keystone | 03:35 | |
| *** terry_yao has quit IRC | 03:42 | |
| *** ccard_ has joined #openstack-keystone | 03:44 | |
| *** ccard__ has quit IRC | 03:46 | |
| *** flwang1 has quit IRC | 03:55 | |
| *** tonytan4ever has joined #openstack-keystone | 04:05 | |
| *** darrenc is now known as darrenc_afk | 04:06 | |
| *** tonytan4ever has quit IRC | 04:09 | |
| *** aginwala has quit IRC | 04:13 | |
| *** timcline has joined #openstack-keystone | 04:15 | |
| *** aginwala has joined #openstack-keystone | 04:16 | |
| *** fangxu has quit IRC | 04:17 | |
| *** timcline_ has joined #openstack-keystone | 04:17 | |
| *** timcline has quit IRC | 04:17 | |
| *** aginwala has quit IRC | 04:20 | |
| *** davechen1 has left #openstack-keystone | 04:30 | |
| openstackgerrit | Dave Chen proposed openstack/python-keystoneclient: remove the default arguments "[]" or "{}" https://review.openstack.org/254175 | 04:33 |
| *** darrenc_afk is now known as darrenc | 04:42 | |
| *** boris-42_ has quit IRC | 04:43 | |
| *** terryyao_ has joined #openstack-keystone | 04:47 | |
| *** davechen has joined #openstack-keystone | 04:51 | |
| davechen | stevemar: still around? | 04:52 |
| stevemar | davechen: yes sir | 04:52 |
| *** flwang1 has joined #openstack-keystone | 04:52 | |
| *** spandhe has joined #openstack-keystone | 04:53 | |
| davechen | stevemar: a quick question, is it possible to call the method from controller layer in the manager layer? | 04:53 |
| davechen | i meant the method in the manager layer call the method from controller layer | 04:53 |
| davechen | it doesnot looks like a good pattern to do in that way | 04:54 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Pass dict into update() rather than **kwargs https://review.openstack.org/248116 | 04:54 |
| stevemar | davechen: no, you can't call controller functions from manager :( | 04:55 |
| stevemar | or at least, you shouldn't | 04:55 |
| stevemar | but those methods are static, just helper functions | 04:55 |
| davechen | stevemar: i also think so. | 04:55 |
| stevemar | brb | 04:56 |
| davechen | so, you meant we could do for those static method | 04:56 |
| *** spandhe_ has joined #openstack-keystone | 04:57 | |
| *** Nirupama has joined #openstack-keystone | 04:57 | |
| davechen | just call _get_endpoint_groups_for_project() from controller? - https://review.openstack.org/#/c/250032/2/keystone/catalog/core.py | 04:57 |
| *** spandhe has quit IRC | 04:58 | |
| *** spandhe_ is now known as spandhe | 04:58 | |
| *** davechen1 has joined #openstack-keystone | 05:00 | |
| *** roxanaghe has quit IRC | 05:00 | |
| *** davechen has quit IRC | 05:02 | |
| davechen1 | properly not, these duplicated are not staticmethod but a private method. | 05:03 |
| stevemar | davechen1: we can call private stuff from the same project | 05:04 |
| *** davechen1 is now known as davechen | 05:04 | |
| stevemar | i think we run into trouble when calling private stuff from projects we don't control | 05:04 |
| davechen | stevemar: yeah, i was wrong, i was thinking we cannot call private stuff even within the same project but from differnt module. | 05:06 |
| stevemar | davechen: ideally we shouldn't, but we can control that stuff | 05:07 |
| stevemar | its just a quick refactor fix if we really wanted to clean things up | 05:07 |
| stevemar | but not necessary | 05:07 |
| davechen | stevemar: looks like i just need remove the duplicated method from manager layer and just call it from the controller, right? | 05:07 |
| davechen | stevemar: i don't like the duplicated method just the same as you. :) | 05:08 |
| stevemar | davechen: i think so! | 05:09 |
| davechen | stevemar: gotcha, i will propose the fix. | 05:10 |
| stevemar | davechen: cool, hows life in TX been? | 05:10 |
| davechen | stevemar: and see what's others thinking about it. | 05:10 |
| davechen | stevemar: basically, all of my time is occupied by training stuff. | 05:11 |
| stevemar | davechen: doesn't sound too bad :) | 05:11 |
| davechen | and it's funny in the weekend. | 05:11 |
| davechen | shooting, shopping, sightseeing. | 05:12 |
| *** fawadkhaliq has joined #openstack-keystone | 05:12 | |
| davechen | stevemar: i think you will be in TX in the near future. :) | 05:13 |
| *** flwang1 has quit IRC | 05:13 | |
| *** davechen1 has joined #openstack-keystone | 05:16 | |
| stevemar | sounds like fun :) | 05:18 |
| *** davechen has quit IRC | 05:19 | |
| *** davechen1 has left #openstack-keystone | 05:20 | |
| *** roxanaghe has joined #openstack-keystone | 05:25 | |
| *** btully has joined #openstack-keystone | 05:37 | |
| *** aginwala has joined #openstack-keystone | 05:41 | |
| *** jerrygb has quit IRC | 05:50 | |
| *** jaosorior has joined #openstack-keystone | 05:51 | |
| *** dims has quit IRC | 05:57 | |
| *** yangyape_ has joined #openstack-keystone | 05:59 | |
| *** wolsen has quit IRC | 06:04 | |
| *** wolsen has joined #openstack-keystone | 06:05 | |
| breton | o/ | 06:14 |
| breton | oh, that web server talk again | 06:17 |
| *** dims has joined #openstack-keystone | 06:20 | |
| *** timcline_ has quit IRC | 06:26 | |
| stevemar | breton: it's fun times | 06:28 |
| stevemar | remove this, no don't, wait run it this way, i dont want to, now do this | 06:28 |
| *** yangyape_ is now known as Yangyapeng | 06:28 | |
| *** e0ne has joined #openstack-keystone | 06:38 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/254462 | 06:41 |
| *** aginwala has quit IRC | 06:43 | |
| *** e0ne has quit IRC | 06:45 | |
| *** aginwala has joined #openstack-keystone | 06:46 | |
| *** e0ne has joined #openstack-keystone | 06:49 | |
| *** e0ne has quit IRC | 06:52 | |
| *** aginwala has quit IRC | 06:52 | |
| *** spandhe_ has joined #openstack-keystone | 07:01 | |
| *** e0ne has joined #openstack-keystone | 07:02 | |
| *** spandhe has quit IRC | 07:02 | |
| *** spandhe_ is now known as spandhe | 07:02 | |
| *** dims has quit IRC | 07:11 | |
| *** fangxu has joined #openstack-keystone | 07:11 | |
| *** e0ne has quit IRC | 07:20 | |
| *** e0ne has joined #openstack-keystone | 07:21 | |
| *** terryyao_ has quit IRC | 07:21 | |
| *** aginwala has joined #openstack-keystone | 07:25 | |
| *** terryyao_ has joined #openstack-keystone | 07:25 | |
| *** spandhe has quit IRC | 07:27 | |
| *** dims has joined #openstack-keystone | 07:31 | |
| *** terryyao_ has quit IRC | 07:31 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/254445 | 07:33 |
| *** roxanaghe has quit IRC | 07:39 | |
| *** terryyao_ has joined #openstack-keystone | 07:39 | |
| *** fawadkhaliq has quit IRC | 07:41 | |
| *** flwang1 has joined #openstack-keystone | 07:41 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:42 | |
| openstackgerrit | Merged openstack/oslo.policy: Don't generate doc from test https://review.openstack.org/254061 | 07:46 |
| *** dims has quit IRC | 07:52 | |
| *** roxanaghe has joined #openstack-keystone | 07:52 | |
| *** btully has quit IRC | 07:55 | |
| *** e0ne has quit IRC | 07:56 | |
| *** gildub has quit IRC | 07:57 | |
| *** jerrygb has joined #openstack-keystone | 08:06 | |
| stevemar | dolphm: notmorgan, when you guys wake up https://review.openstack.org/#/c/241403/ | 08:10 |
| notmorgan | Jokes on me. Still awake :( | 08:10 |
| *** jerrygb has quit IRC | 08:12 | |
| marekd | stevemar: i can handle this patch, i think :-) | 08:13 |
| stevemar | marekd: ever better! | 08:13 |
| marekd | done | 08:13 |
| marekd | stevemar: https://review.openstack.org/#/c/188534/ now i don't know what's up with that one. Even if it's not approved I think I will just start coding this so it will be ready for FFE or next cycle. | 08:14 |
| *** flwang1 has quit IRC | 08:15 | |
| *** henrynash has joined #openstack-keystone | 08:15 | |
| *** ChanServ sets mode: +v henrynash | 08:15 | |
| *** fangxu has quit IRC | 08:18 | |
| stevemar | marekd: why don't you know whats up with it? | 08:21 |
| marekd | stevemar: because the deadline was mitaka-1, i am trying to push it and currently kind of failing. | 08:22 |
| stevemar | marekd: find 2 cores to champion your spec | 08:23 |
| marekd | i guess you are not on the list anymore due to your PTL responsibilities | 08:23 |
| stevemar | marekd: i wouldn't say that | 08:23 |
| stevemar | champion => willing to review patches | 08:24 |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/oslo.policy: Make sure item of policy_dirs is directory https://review.openstack.org/254607 | 08:25 |
| marekd | stevemar: yeah, i know what that mean :-) Anyway, would you take a look at this spec again? Guang had some questions about inheritance and domains, but I'd give it a baby steps pace and start with projects only. Later we can add more. | 08:26 |
| stevemar | definitely projects at first | 08:26 |
| marekd | stevemar: and this is main goal on what I want to do. | 08:27 |
| stevemar | marekd: give me 5 minutes, just reviewing something i am cooking up | 08:27 |
| marekd | stevemar: whenever you have time | 08:27 |
| *** roxanaghe has quit IRC | 08:28 | |
| *** gildub has joined #openstack-keystone | 08:32 | |
| *** lhcheng has joined #openstack-keystone | 08:37 | |
| *** ChanServ sets mode: +v lhcheng | 08:37 | |
| *** fhubik has joined #openstack-keystone | 08:39 | |
| *** miyagishi_t has quit IRC | 08:39 | |
| stevemar | jamielennox: PM your gmail addy | 08:41 |
| stevemar | lhcheng: you too | 08:41 |
| *** aginwala has quit IRC | 08:49 | |
| *** aginwala has joined #openstack-keystone | 08:53 | |
| *** links has quit IRC | 08:55 | |
| *** browne has quit IRC | 08:56 | |
| *** aginwala has quit IRC | 09:01 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Expand endpoint filters to service providers https://review.openstack.org/188534 | 09:01 |
| *** aginwala has joined #openstack-keystone | 09:01 | |
| *** fhubik is now known as fhubik_brb | 09:02 | |
| *** e0ne has joined #openstack-keystone | 09:03 | |
| *** fhubik_brb is now known as fhubik | 09:08 | |
| *** links has joined #openstack-keystone | 09:09 | |
| *** aginwala_ has joined #openstack-keystone | 09:10 | |
| *** pnavarro has joined #openstack-keystone | 09:10 | |
| *** aginwala has quit IRC | 09:14 | |
| *** aginwala_ has quit IRC | 09:15 | |
| openstackgerrit | Merged openstack/keystone: Cleans up code for `is_admin` in tokens https://review.openstack.org/254391 | 09:15 |
| notmorgan | marekd: https://review.openstack.org/#/c/253999/ could use your eyes | 09:17 |
| notmorgan | marekd: and can you comment on what the error with the internal LXML impl is on bknudson's patch? | 09:17 |
| notmorgan | marekd: i'd like to drop LXML asap from ksa | 09:17 |
| marekd | notmorgan: i will get back to that lxml. debugging with adfs is not the funniest thing to do :/ esp that i don't have direct access to or servers. | 09:18 |
| marekd | s/or/our/ | 09:19 |
| stevemar | notmorgan: thanks for responding | 09:19 |
| openstackgerrit | Merged openstack/keystone: Updating sample configuration file https://review.openstack.org/253745 | 09:19 |
| marekd | notmorgan: but im gonna ping whoever is needed | 09:19 |
| openstackgerrit | Merged openstack/keystone: Fix for GET project by project admin https://review.openstack.org/248892 | 09:19 |
| notmorgan | marekd: aye | 09:19 |
| openstackgerrit | Merged openstack/keystone: Improve comments in test_catalog https://review.openstack.org/248846 | 09:19 |
| notmorgan | marekd: figured just saw you here so ping :) | 09:20 |
| openstackgerrit | Merged openstack/keystone: Remove invalid TODO in extensions https://review.openstack.org/253552 | 09:20 |
| notmorgan | stevemar: home... | 09:20 |
| openstackgerrit | Merged openstack/keystone-specs: Online schema migration https://review.openstack.org/245186 | 09:20 |
| notmorgan | stevemar: but... doing laundry so i can sleep :( | 09:20 |
| notmorgan | waiting on the stupid dryer | 09:20 |
| marekd | notmorgan: i was ping? :P I am afraid you need to explain that joke :P | 09:20 |
| marekd | pink/ping ? :P | 09:20 |
| stevemar | notmorgan: ah, i often play that waiting game | 09:21 |
| notmorgan | marekd: no, i totally just suck at typing at ~4:20am [time i feel like it is] | 09:21 |
| stevemar | notmorgan: thats my real time | 09:21 |
| notmorgan | marekd: just landed back on the west coast after a couple weeks on the NYC | 09:21 |
| stevemar | so i go sleep | 09:21 |
| stevemar | even though i'm not sleepy | 09:21 |
| marekd | notmorgan: oh :( | 09:21 |
| notmorgan | marekd: already missing brooklyn, but <3 Portland | 09:21 |
| notmorgan | also have some fantastic music to listen to atm | 09:22 |
| marekd | notmorgan: ah yes, you moved to Portland! | 09:22 |
| notmorgan | marekd: yes! | 09:22 |
| *** tonytan4ever has joined #openstack-keystone | 09:22 | |
| marekd | notmorgan: what are you listening to now? | 09:22 |
| stevemar | notmorgan: glad to hear you're all set up in portland :) | 09:22 |
| notmorgan | marekd: right now: https://www.youtube.com/watch?v=Njkl6qSp6Eg#t=193 | 09:22 |
| marekd | notmorgan: i approved jamies patch. | 09:22 |
| notmorgan | marekd: also https://play.google.com/music/m/Bpnvnmk5kvgeuovmjbhklkpt6wu?t=Lifetime_Ago_-_Greg_Laswell | 09:23 |
| notmorgan | marekd: ^ that one is AMAZING. | 09:23 |
| marekd | notmorgan: checking. | 09:23 |
| *** gildub has quit IRC | 09:25 | |
| notmorgan | stevemar: https://review.openstack.org/#/c/253792/ failures make me sad | 09:25 |
| notmorgan | stevemar: so close | 09:25 |
| *** chenke_ has joined #openstack-keystone | 09:26 | |
| *** tonytan4ever has quit IRC | 09:26 | |
| notmorgan | marekd: the google music link i just pasted is wonderful stuff. it's like solidly in the "yes. this is the music i want to listen to all the time" type stuff | 09:27 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/254633 | 09:27 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/254633 | 09:28 |
| openstackgerrit | henry-nash proposed openstack/keystone: Create new version of assignment driver interface https://review.openstack.org/242853 | 09:29 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/254633 | 09:30 |
| openstackgerrit | henry-nash proposed openstack/keystone: Create V9 Role Driver https://review.openstack.org/247805 | 09:30 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/254633 | 09:31 |
| openstackgerrit | henry-nash proposed openstack/keystone: Use list_role_assignments to get projects/domains for user https://review.openstack.org/242513 | 09:31 |
| notmorgan | marekd: also... i almost have a working POC with all the services sub-url mounted ;) | 09:31 |
| notmorgan | wheeeeee productive couple of weeks | 09:31 |
| marekd | notmorgan: i saw some tweets :-) | 09:32 |
| marekd | notmorgan: i didn't dive too much into that tbh, what do you mean by suburl mounted services? | 09:32 |
| notmorgan | https://api.tempusfrangit.org/identity https://api.tempusfrangit.org/compute https://api.tempusfrangit.org/image https://api.tempusfrangit.org/volume etc | 09:33 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/254633 | 09:33 |
| marekd | notmorgan: oh,this. cool! | 09:33 |
| notmorgan | marekd: yah | 09:33 |
| notmorgan | marekd: also working on offloading auth so service to service never hits keystone | 09:33 |
| notmorgan | marekd: and user->service is handled at the edge | 09:33 |
| notmorgan | have a lua version of KSM (demo) working so haproxy can validate the tokens | 09:34 |
| notmorgan | marekd: it's been fun. | 09:34 |
| openstackgerrit | Merged openstack/keystone-specs: Expand endpoint filters to service providers https://review.openstack.org/188534 | 09:34 |
| notmorgan | have a massive "this is what is broken" etherpad too | 09:34 |
| notmorgan | :P | 09:34 |
| notmorgan | stevemar: if you're in NYC you should totally go do http://sleepnomore.com/#share | 09:35 |
| notmorgan | stevemar: it was one of the most fun theatre experiences i've ever done | 09:35 |
| marekd | notmorgan: NYC is on my trips list for 2016 so if I go there I will definitely look for some "you will not find it in a guide" kind of places :-) | 09:36 |
| *** mhickey has joined #openstack-keystone | 09:38 | |
| notmorgan | marekd: sleepnomore is amazing. | 09:40 |
| notmorgan | It's dark. But amazing | 09:40 |
| notmorgan | I blame mordred for talking up sleep no more so much ;) | 09:41 |
| *** terryyao_ has quit IRC | 09:41 | |
| marekd | hehe | 09:42 |
| breton | notmorgan: how does it validate fernet? It has the keys? | 09:50 |
| *** fhubik is now known as fhubik_brb | 09:52 | |
| *** woodster_ has quit IRC | 09:56 | |
| *** fhubik_brb is now known as fhubik | 09:58 | |
| *** gildub has joined #openstack-keystone | 09:59 | |
| *** aix has joined #openstack-keystone | 10:01 | |
| samueldmq | morning keystoners | 10:12 |
| xek | morning :) | 10:13 |
| *** lhcheng has quit IRC | 10:14 | |
| *** jistr has joined #openstack-keystone | 10:14 | |
| marekd | hey | 10:16 |
| *** fawadkhaliq has quit IRC | 10:21 | |
| *** aix has quit IRC | 10:21 | |
| *** fawadkhaliq has joined #openstack-keystone | 10:21 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/python-keystoneclient: Implements base classes for functional tests https://review.openstack.org/253971 | 10:23 |
| openstackgerrit | Merged openstack/keystone: Split resource tests from assignment tests https://review.openstack.org/252684 | 10:27 |
| *** fangxu has joined #openstack-keystone | 10:27 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/254633 | 10:28 |
| *** fangxu has quit IRC | 10:31 | |
| *** aix has joined #openstack-keystone | 10:33 | |
| jamielennox | stevemar: like you want my gmail? | 10:33 |
| *** pnavarro has quit IRC | 10:34 | |
| *** links has quit IRC | 10:37 | |
| *** dikonoor has joined #openstack-keystone | 10:48 | |
| *** dikonoor has quit IRC | 10:48 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/254088 | 10:51 |
| openstackgerrit | Merged openstack/keystoneauth: Extract SAML fixtures into templates https://review.openstack.org/253999 | 10:51 |
| openstackgerrit | Merged openstack/keystone: Deprecate ldap Role https://review.openstack.org/252669 | 10:52 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/254633 | 10:54 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/254444 | 10:56 |
| *** links has joined #openstack-keystone | 10:58 | |
| *** Yangyapeng has quit IRC | 10:58 | |
| *** EinstCrazy has quit IRC | 10:59 | |
| *** openstackgerrit has quit IRC | 11:02 | |
| *** openstackgerrit has joined #openstack-keystone | 11:02 | |
| marekd | jamielennox: pretty much | 11:02 |
| *** wangqun has quit IRC | 11:03 | |
| *** john5223 is now known as zz_john5223 | 11:06 | |
| *** EinstCrazy has joined #openstack-keystone | 11:24 | |
| *** Nirupama has quit IRC | 11:27 | |
| *** gildub has quit IRC | 11:33 | |
| *** yasu has quit IRC | 11:47 | |
| *** lhcheng has joined #openstack-keystone | 12:02 | |
| *** ChanServ sets mode: +v lhcheng | 12:02 | |
| *** e0ne has quit IRC | 12:03 | |
| *** esp has quit IRC | 12:05 | |
| *** esp has joined #openstack-keystone | 12:06 | |
| *** lhcheng has quit IRC | 12:07 | |
| *** jerrygb has joined #openstack-keystone | 12:09 | |
| *** e0ne has joined #openstack-keystone | 12:11 | |
| *** jerrygb has quit IRC | 12:13 | |
| *** fawadkhaliq has quit IRC | 12:14 | |
| *** fhubik is now known as fhubik_brb | 12:29 | |
| *** gordc has joined #openstack-keystone | 12:31 | |
| *** EinstCra_ has joined #openstack-keystone | 12:35 | |
| *** links has quit IRC | 12:36 | |
| *** fawadkhaliq has joined #openstack-keystone | 12:37 | |
| *** EinstCrazy has quit IRC | 12:37 | |
| *** fawadkhaliq has quit IRC | 12:40 | |
| *** jaosorior has quit IRC | 12:40 | |
| *** fawadkhaliq has joined #openstack-keystone | 12:40 | |
| *** jaosorior has joined #openstack-keystone | 12:42 | |
| *** arunkant has quit IRC | 12:43 | |
| *** tsymancz1k has quit IRC | 12:46 | |
| *** yangyapeng has joined #openstack-keystone | 12:59 | |
| *** tsymanczyk has joined #openstack-keystone | 13:04 | |
| *** tsymanczyk is now known as Guest76635 | 13:05 | |
| *** tonytan4ever has joined #openstack-keystone | 13:10 | |
| *** tonytan4ever has quit IRC | 13:14 | |
| *** dims has joined #openstack-keystone | 13:16 | |
| *** fhubik_brb is now known as fhubik | 13:18 | |
| *** pauloewerton has joined #openstack-keystone | 13:21 | |
| openstackgerrit | Jin Nan Zhang proposed openstack/keystone: Replace warnings.warn to LOG.warn https://review.openstack.org/254752 | 13:24 |
| *** arunkant_ has quit IRC | 13:29 | |
| *** edmondsw has joined #openstack-keystone | 13:31 | |
| *** topol has joined #openstack-keystone | 13:31 | |
| *** ChanServ sets mode: +v topol | 13:31 | |
| *** arunkant has joined #openstack-keystone | 13:35 | |
| *** terryyao has joined #openstack-keystone | 13:42 | |
| *** jerrygb has joined #openstack-keystone | 13:44 | |
| *** lhcheng has joined #openstack-keystone | 13:52 | |
| *** ChanServ sets mode: +v lhcheng | 13:52 | |
| *** topol has quit IRC | 13:53 | |
| *** topol has joined #openstack-keystone | 13:54 | |
| *** ChanServ sets mode: +v topol | 13:54 | |
| *** lhcheng has quit IRC | 13:57 | |
| *** fhubik is now known as fhubik_brb | 14:07 | |
| lbragstad | stevemar is there a limit to the number of champions a spec has? | 14:15 |
| *** breitz has quit IRC | 14:18 | |
| *** breitz has joined #openstack-keystone | 14:19 | |
| *** petertr7_away is now known as petertr7 | 14:21 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone-specs: Assignments in Apache Fortress https://review.openstack.org/254782 | 14:29 |
| *** lhcheng has joined #openstack-keystone | 14:30 | |
| *** ChanServ sets mode: +v lhcheng | 14:30 | |
| *** miyagishi_t has joined #openstack-keystone | 14:31 | |
| *** richm has joined #openstack-keystone | 14:32 | |
| *** lhcheng_ has joined #openstack-keystone | 14:34 | |
| *** lhcheng has quit IRC | 14:37 | |
| openstackgerrit | Merged openstack/keystone: More useful message when using direct driver import https://review.openstack.org/241403 | 14:40 |
| *** ayoung has joined #openstack-keystone | 14:40 | |
| *** ChanServ sets mode: +v ayoung | 14:40 | |
| *** tonytan4ever has joined #openstack-keystone | 14:41 | |
| *** tonytan4ever has quit IRC | 14:45 | |
| *** fawadkhaliq has quit IRC | 14:45 | |
| *** fawadkhaliq has joined #openstack-keystone | 14:46 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/254633 | 14:47 |
| *** edmondsw has quit IRC | 14:48 | |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles https://review.openstack.org/242614 | 14:50 |
| ayoung | How to properly handle delegation: http://www.questionablecontent.net/view.php?comic=3107 | 14:51 |
| *** dims_ has joined #openstack-keystone | 14:52 | |
| *** dims has quit IRC | 14:55 | |
| ayoung | samueldmq, care to +1 this one. You gave it a pretty thorough review, and I think follow on reviewers would want to see that you've approved of the changes made: https://review.openstack.org/#/c/242853/29 | 15:01 |
| *** yangyapeng has quit IRC | 15:01 | |
| samueldmq | ayoung: yeah, sure, was on my todo, but a bit overflooded this week :) | 15:05 |
| samueldmq | ayoung: thanks for the heads up | 15:05 |
| ayoung | samueldmq, get used to it | 15:05 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:06 | |
| samueldmq | ayoung: :-) | 15:06 |
| samueldmq | ayoung: done, implied roles is next | 15:09 |
| *** jerrygb has quit IRC | 15:09 | |
| *** jerrygb has joined #openstack-keystone | 15:10 | |
| samueldmq | ayoung: I have 6-hour workshop next week, and still a lot of material to prepare :) | 15:10 |
| ayoung | samueldmq, there is one in between | 15:10 |
| ayoung | samueldmq, lets focus on the prereqs... | 15:10 |
| samueldmq | ayoung: which one ? | 15:10 |
| ayoung | ah, you go0t them both...thanks | 15:10 |
| samueldmq | ayoung: yeah, v9 role | 15:11 |
| *** davechen has joined #openstack-keystone | 15:12 | |
| ayoung | dstanek, marekd can one of you guys prioritize looking at https://review.openstack.org/#/c/242853/29 and https://review.openstack.org/#/c/247805/11 which are the pre-reqs for implied roles. I think implied roles is going to be the killer feature this release, and I'd like to get it in before X-Mas break if possible. | 15:12 |
| marekd | ayoung: i will take a look! | 15:12 |
| ayoung | thanks | 15:13 |
| marekd | ayoung: let me just finish something. | 15:13 |
| *** edmondsw has joined #openstack-keystone | 15:13 | |
| *** topol has quit IRC | 15:13 | |
| *** jerrygb has quit IRC | 15:15 | |
| *** fawadkhaliq has quit IRC | 15:16 | |
| *** timcline has joined #openstack-keystone | 15:20 | |
| dstanek | ayoung: i can't promise today, but i'll bump it near the top of my Trello list; just started working on the one Henry gave to me yesterday | 15:24 |
| *** jerrygb has joined #openstack-keystone | 15:24 | |
| ayoung | dstanek, thanks...it is a Henry review. I've a;ready +2ed, and samueldmq has +1ed. If Marek gets it, it is good to go\ | 15:24 |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: Unit test for checking cross-version migrations compatibility https://review.openstack.org/241603 | 15:26 |
| *** slberger has joined #openstack-keystone | 15:33 | |
| ayoung | samueldmq, yep...thought I had | 15:34 |
| *** btully has joined #openstack-keystone | 15:35 | |
| samueldmq | ayoung: nice | 15:35 |
| ayoung | samueldmq, I really just want the pre-reqs merged so I don't have more rebase issues as I work on the implied roles patch | 15:36 |
| *** erhudy has joined #openstack-keystone | 15:36 | |
| samueldmq | ayoung: makes sense, and those should be ready to go already | 15:36 |
| erhudy | with keystone running under mod_wsgi, has anyone seen a situation where workers will start to die with the error "Fatal Python error: PyEval_AcquireThread: NULL new thread state", until every WSGI worker on the host has died and apache needs to be restarted? | 15:37 |
| erhudy | things start out okay after restarting apache but within 15-30 minutes it seems to degrade back to non-functionality | 15:37 |
| * breton hasn't | 15:40 | |
| *** terryyao has quit IRC | 15:40 | |
| bknudson | we've got products here that run keystone under apache and I'm sure they would have complained | 15:42 |
| erhudy | this is a pretty recent development, i'm trying to find out if anything might have changed recently | 15:42 |
| dstanek | erhudy: are you running master? | 15:43 |
| marekd | CERN also runs keystone w/ apache and we don't suffer from anything like that. | 15:43 |
| erhudy | no, kilo 2015.1.0 | 15:43 |
| erhudy | it looks like mod_python was enabled, killing that and restarting | 15:43 |
| *** tonytan4ever has joined #openstack-keystone | 15:43 | |
| *** jistr is now known as jistr|mtg | 15:43 | |
| breton | I read about issues when mod_python runs along mod_wsgi | 15:44 |
| erhudy | yeah, i found something like that a moment ago | 15:44 |
| *** andrewbogott has quit IRC | 15:46 | |
| openstackgerrit | Marian Horban proposed openstack/python-keystoneclient: Remove lock object from BaseIdentityPlugin https://review.openstack.org/246521 | 15:46 |
| *** alvipet has joined #openstack-keystone | 15:50 | |
| *** topol has joined #openstack-keystone | 15:51 | |
| *** ChanServ sets mode: +v topol | 15:51 | |
| tjcocozz | ping stevemar | 15:52 |
| *** fhubik_brb is now known as fhubik | 15:53 | |
| *** pgbridge has joined #openstack-keystone | 15:55 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Reduce revoke events for disabled domains and projects. https://review.openstack.org/253273 | 15:57 |
| *** gokrokve has joined #openstack-keystone | 15:59 | |
| erhudy | yeah, looks like it was probably mod_python sneaking back in | 15:59 |
| erhudy | easy fix at least | 15:59 |
| *** lhcheng has joined #openstack-keystone | 16:00 | |
| *** ChanServ sets mode: +v lhcheng | 16:00 | |
| *** lhcheng_ has quit IRC | 16:00 | |
| ayoung | erhudy, Sneaking *back* in? | 16:01 |
| erhudy | more like an oversight on our part to not disable it in the first place, just never noticed | 16:02 |
| *** petertr7 is now known as petertr7_away | 16:06 | |
| *** aix has quit IRC | 16:08 | |
| breton | ² | 16:08 |
| *** ninag has joined #openstack-keystone | 16:09 | |
| *** ninag has quit IRC | 16:09 | |
| notmorgan | breton: it talks to keystone. But, the other services don't have to. | 16:09 |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystone: Add backend support for deleting a projects list https://review.openstack.org/245916 | 16:12 |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystone: Manager support for project delete cascade https://review.openstack.org/244149 | 16:12 |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystone: API support for project cascade delete https://review.openstack.org/244248 | 16:12 |
| *** fawadkhaliq has joined #openstack-keystone | 16:12 | |
| *** browne has joined #openstack-keystone | 16:16 | |
| *** pumaranikar has joined #openstack-keystone | 16:22 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Reduce revoke events for disabled domains and projects. https://review.openstack.org/253273 | 16:28 |
| *** atiwari has joined #openstack-keystone | 16:29 | |
| stevemar | lbragstad: no limit, really, it's just saying "i promise to review this" | 16:33 |
| stevemar | notmorgan: i did see 'sleep no more!' | 16:33 |
| stevemar | tjcocozz: hola | 16:33 |
| tjcocozz | stevemar, just was having some problems trying to figure out what you and cristian were talking about here https://review.openstack.org/#/c/249958/ | 16:34 |
| kfox1111 | has anyone tested k2k and sahara, trove, or heat? | 16:35 |
| kfox1111 | do they all work ok? | 16:35 |
| *** reed has quit IRC | 16:36 | |
| bknudson | with k2k you get a regular keystone token which you can send to sahara, trove, or heat. | 16:36 |
| stevemar | kfox1111: presumably... i think most folks tried it with nova/glance/cinder/neutron | 16:36 |
| kfox1111 | yeah, but those don't need trusts or use the users credentials in the vm's. | 16:36 |
| stevemar | tjcocozz: right, so for that patch, we should try to optimize the SQL backend to get the info all in one shot | 16:37 |
| stevemar | instead of doing a fetch N times | 16:37 |
| tjcocozz | stevemar, but isnt the info in different backends? | 16:38 |
| *** reed has joined #openstack-keystone | 16:38 | |
| stevemar | tjcocozz: yep! that's why in cristians patch he does a join | 16:38 |
| openstackgerrit | David Stanek proposed openstack/keystone: Remove invalid comment about LDAP domain support https://review.openstack.org/253643 | 16:39 |
| ayoung | dstanek, marekd thanks...good catch on the test question, I missed that. | 16:40 |
| dstanek | ayoung: if you agree with my 1 letter commit message change you can +2+A samueldmq's review ^ | 16:40 |
| dstanek | ayoung: np | 16:40 |
| ayoung | dstanek, nice. | 16:41 |
| kfox1111 | do trusts work with k2k? | 16:41 |
| ayoung | kfox1111, what do you mean?\ | 16:41 |
| tjcocozz | stevemar, for some reason i thought you could some things in ldap backend and others in sql at the same time. | 16:41 |
| tjcocozz | store ^ | 16:41 |
| stevemar | tjcocozz: no no, it's one or the other | 16:42 |
| stevemar | unless it's identities, in which case we have that funky mapping table | 16:42 |
| kfox1111 | say I login with a keystone idp, go to a region maintained with a sp, then launch a heat stack, which creates a trust in the sp gainst the federated user, for future use. | 16:42 |
| kfox1111 | does that work properly? | 16:43 |
| tjcocozz | stevemar, oh that clears some stuff up. i guess. what is the problem with the mapping table? | 16:43 |
| *** boris-42_ has joined #openstack-keystone | 16:44 | |
| kfox1111 | yeah, it looks like sahara as of liberty still doesn't support trusts properly. :/ | 16:46 |
| *** fhubik has quit IRC | 16:46 | |
| kfox1111 | so I think k2k is also a dead end for us for now. :_( | 16:46 |
| *** openstackgerrit has quit IRC | 16:47 | |
| *** openstackgerrit has joined #openstack-keystone | 16:47 | |
| stevemar | tjcocozz: also, only optimize the SQL backend | 16:48 |
| stevemar | the LDAP backend will be removed/deprecated | 16:48 |
| stevemar | kfox1111: that stinks | 16:48 |
| tjcocozz | stevemar, how did you know i was looking into the ldap backend? lol I will focus on the sql backend, thanks for the heads up | 16:49 |
| stevemar | tjcocozz: magic ptl powers, duh | 16:49 |
| stevemar | :) | 16:49 |
| notmorgan | tjcocozz: don't ask too many questions | 16:49 |
| notmorgan | it's secret PTL powers ;) | 16:50 |
| tjcocozz | stevemar, haha it must be. | 16:50 |
| *** alejandrito has joined #openstack-keystone | 16:55 | |
| kfox1111 | stevemar: yeah. we were really hoping to have one keystone to rule all of our regions. | 16:59 |
| kfox1111 | I don't think there's away to do that curently. :/ | 16:59 |
| kfox1111 | sahara's one of our most commonly used services so its gota work. :/ | 16:59 |
| kfox1111 | looks like mitaka+ may support it. | 16:59 |
| *** gyee has joined #openstack-keystone | 17:00 | |
| *** ChanServ sets mode: +v gyee | 17:00 | |
| *** alex_xu has quit IRC | 17:04 | |
| *** rderose has joined #openstack-keystone | 17:05 | |
| *** davechen has quit IRC | 17:05 | |
| odyssey4me | stevemar is the LDAP backend being removed entirely... or just the writable access to LDAP? | 17:05 |
| breton | oh gawd, you merged https://review.openstack.org/#/c/240762/ | 17:05 |
| *** pauloewerton has quit IRC | 17:06 | |
| stevemar | breton: hit the revert button ;) | 17:06 |
| stevemar | breton: i realized this yesterday, a few days after merging it | 17:06 |
| stevemar | odyssey4me: so LDAP backend for projects/domains/role assignments ==> will be removed | 17:07 |
| stevemar | odyssey4me: LDAP backend for identity (user and groups) ==> will be read only | 17:07 |
| odyssey4me | stevemar entirely, wow... is it deprecated now, if so when was that done? and when do you think it'll be removed? | 17:08 |
| stevemar | odyssey4me: we've had deprecation warnings for projects/domains/role assignments for 2 releases | 17:08 |
| *** petertr7_away is now known as petertr7 | 17:08 | |
| stevemar | https://github.com/openstack/keystone/blob/master/keystone/assignment/backends/ldap.py#L35-L38 and https://github.com/openstack/keystone/blob/master/keystone/resource/backends/ldap.py#L36-L39 (this was branched from another that's why it says liberty) | 17:09 |
| *** pgbridge has quit IRC | 17:09 | |
| stevemar | does it impact you? | 17:09 |
| mtreinish | lbragstad: you asked me about this test once before right? http://status.openstack.org/openstack-health/#/test/tempest.api.identity.admin.v3.test_services.ServicesTestJSON.test_create_update_get_service | 17:09 |
| *** ayoung has quit IRC | 17:10 | |
| lbragstad | mtreinish checking | 17:10 |
| mtreinish | lbragstad: I'm just showing the page off :) | 17:10 |
| lbragstad | mtreinish it's *very* flashy | 17:10 |
| *** alex_xu has joined #openstack-keystone | 17:10 | |
| stevemar | mtreinish: oh *that* test | 17:10 |
| odyssey4me | stevemar well, I'm wondering what the alternative is for a global cluster where you need a common set of project ID's and project/domain/role assignments across regions | 17:11 |
| odyssey4me | there is, of course, replicating your DB | 17:11 |
| stevemar | odyssey4me: you were using ldap for that? | 17:11 |
| stevemar | yeah, that's the other option | 17:12 |
| mtreinish | lbragstad: it is, I'm just going through my irc logs finding everyone who asked me for a test perf graph at somepoint and pointing them to the dashboard now :) | 17:12 |
| mtreinish | stevemar: heh, yep | 17:12 |
| lbragstad | mtreinish nice, i remember you sending me some metrics on test times once | 17:12 |
| lbragstad | I want to say it was around race-conditions | 17:12 |
| mtreinish | lbragstad: I think it was a fernet thing | 17:12 |
| mtreinish | it's always a fernet thing :) | 17:12 |
| lbragstad | mtreinish yes, i think so | 17:12 |
| odyssey4me | stevemar in this particular case I'm looking at a swift cluster, so all I need is common account ID's... that with federation will do the trick (as with federation I can map the user to the domain, group and role) | 17:13 |
| odyssey4me | s/account id/project id/ | 17:13 |
| lbragstad | mtreinish lol apparently! | 17:13 |
| odyssey4me | swift uses the project id as the container id for objects | 17:13 |
| lbragstad | speaking of fernet | 17:14 |
| stevemar | odyssey4me: yep, i know all about swift using project id as the account id, which stores containers | 17:14 |
| * lbragstad leaves https://review.openstack.org/#/c/249863/ on the table next to mtreinish | 17:14 | |
| stevemar | odyssey4me: hmm, maybe dolphm has a clever answer for you | 17:14 |
| odyssey4me | stevemar so the answer is effectively db replication at this point | 17:15 |
| odyssey4me | alright, thanks | 17:15 |
| stevemar | odyssey4me: you're the first person to actually say you want to keep the project backend for LDAP around in about a year :) | 17:16 |
| stevemar | odyssey4me: we'll find a solution for you, and if push comes to shove, i won't remove it if it causes you significant pain | 17:16 |
| mtreinish | lbragstad: ugh, more magic sleeps... +2 | 17:16 |
| lbragstad | mtreinish yep | 17:17 |
| *** davechen_bot has joined #openstack-keystone | 17:17 | |
| *** pgbridge has joined #openstack-keystone | 17:17 | |
| *** RichardRaseley has joined #openstack-keystone | 17:17 | |
| odyssey4me | stevemar I'll see if we can work out another alternative, or whether DB sync will be suitable. Thanks! | 17:18 |
| *** petertr7 is now known as petertr7_away | 17:18 | |
| *** jistr|mtg is now known as jistr | 17:21 | |
| *** henrynash has quit IRC | 17:24 | |
| *** henrynash has joined #openstack-keystone | 17:25 | |
| *** ChanServ sets mode: +v henrynash | 17:25 | |
| *** ayoung has joined #openstack-keystone | 17:25 | |
| *** ChanServ sets mode: +v ayoung | 17:25 | |
| *** davechen has joined #openstack-keystone | 17:30 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Verify that attribute `enabled` equals True https://review.openstack.org/254881 | 17:30 |
| *** rderose has quit IRC | 17:30 | |
| *** tonytan4ever has quit IRC | 17:31 | |
| *** ayoung has quit IRC | 17:31 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Verify that attribute `enabled` equals True https://review.openstack.org/254881 | 17:31 |
| *** jdennis has quit IRC | 17:34 | |
| stevemar | breton: thanks for the patch | 17:34 |
| notmorgan | mtreinish: woo magic sleep | 17:34 |
| henrynash | dstanek: ping | 17:34 |
| dstanek | henrynash: pong | 17:35 |
| henrynash | dtsanek: re your comment on the V9 assignment patch, I would expect tox -e Legacy_drivers to fail with your change | 17:35 |
| henrynash | dstanek: but tox -e py27 would still pass since it doesn;t run the legacy tests | 17:36 |
| *** aginwala has joined #openstack-keystone | 17:36 | |
| henrynash | dstanek: that’s how I got round (I hope) avoiding the multiple models problem | 17:36 |
| dstanek | henrynash: how are you excluding the legacy tests? | 17:37 |
| *** jdennis has joined #openstack-keystone | 17:37 | |
| henrynash | tox -elegacy_drivers | 17:37 |
| henrynash | sorry | 17:37 |
| *** spandhe has joined #openstack-keystone | 17:37 | |
| henrynash | dtsanekL sorry (now read youquestion): by not having test in the name of teh file | 17:37 |
| dstanek | henrynash: that only add a target to specifically run them. it doesn't stop them from running with tox -e py27 | 17:38 |
| dstanek | do they not run under normal circumstances? | 17:38 |
| henrynash | dstanek: I ensured the name of the test file does not contain the word ‘test' | 17:38 |
| dstanek | henrynash: is that how testtools does it's discovery? i know that what nose used to do | 17:39 |
| henrynash | dstanek: that’s why the legacy test is called ‘sql.py” not “test_sql.py" | 17:39 |
| henrynash | dtsanek: I believe so….it certainly seems to (i.e. if you search for V8 in the output of a py27 run, those tests have not been execute | 17:40 |
| dstanek | henrynash: let me experiment a little more | 17:40 |
| henrynash | dtsanek: thanks, really appreciate it | 17:40 |
| *** aginwala has quit IRC | 17:42 | |
| *** tqtran has joined #openstack-keystone | 17:42 | |
| *** ayoung has joined #openstack-keystone | 17:44 | |
| *** ChanServ sets mode: +v ayoung | 17:44 | |
| samueldmq | henrynash: so you brought role groups back to life again ? | 17:45 |
| *** aginwala has joined #openstack-keystone | 17:45 | |
| *** haneef_ has joined #openstack-keystone | 17:45 | |
| *** ctina_ has joined #openstack-keystone | 17:46 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Verify that attribute `enabled` equals True https://review.openstack.org/254881 | 17:46 |
| henrynash | samueldmq: well only so people could compare - I personally prefer the API that has merged, but not everyone agrees - so I though the best way was to actually show what the alternate API would look like (all 800 lines of it) | 17:46 |
| samueldmq | henrynash: but creating role-groups is very similar to creating implied roles, isn't it ? | 17:48 |
| samueldmq | henrynash: a rle group contains one or more roles, and a implied role does too | 17:48 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Reduce revoke events for disabled domains and projects. https://review.openstack.org/253273 | 17:48 |
| henrynash | samueldmq: yes…and that;s teh point…it was raised (gyee) that a better way of doing Domain Specific Roles would be to actual do role-grousp and NOT do them as implied roles. I personally don’t share that view, but in order to compare I wanted to show how mush we would have to do for role groups | 17:49 |
| *** e0ne has quit IRC | 17:50 | |
| odyssey4me | stevemar apologies for what may be a dumb question - is the assignments LDAP back-end read-only, or read-write? | 17:51 |
| stevemar | odyssey4me: currently read-write | 17:51 |
| *** HoloIRCUser3 has joined #openstack-keystone | 17:51 | |
| *** HoloIRCUser3 has quit IRC | 17:51 | |
| *** HoloIRCUser1 has joined #openstack-keystone | 17:51 | |
| *** roxanaghe has joined #openstack-keystone | 17:53 | |
| samueldmq | henrynash: sure, that makes complete sense to bring this up to discusion | 17:53 |
| samueldmq | discussion* | 17:53 |
| odyssey4me | stevemar how about an option to switch that drive to be read-only... it should simplify the code somewhat, but still be useful - the responsibility for assignments and management would be entirely outside of Keystone, and Keystone would just be a consumer | 17:54 |
| stevemar | odyssey4me: i'd prefer to not make any changes to it :P | 17:55 |
| odyssey4me | stevemar horrible spaghetti, yeah? ;) | 17:56 |
| stevemar | unless this is someting you really want to stick with | 17:56 |
| odyssey4me | stevemar simply exploring options here | 17:56 |
| stevemar | odyssey4me: understood | 17:57 |
| stevemar | all the courtsey pings! ajayaa, amakarov, ayoung, breton, browne, davechen, david8hu, dolphm, dstanek, ericksonsantos, geoffarnold, gyee, henrynash, hogepodge, htruta, jamielennox, joesavak, lbragstad, lhcheng, marekd, morganfainberg, nkinder, raildo, rodrigods, roxanaghe, samueldmq, shaleh, stevemar, tsymanczyk, topol, vivekd, wanghong, claudiub, rderose, samleon, xek, MaxPC, tjcocozz | 17:59 |
| *** rderose has joined #openstack-keystone | 18:00 | |
| *** jaosorior has quit IRC | 18:00 | |
| ayoung | Weeee! | 18:02 |
| *** jistr has quit IRC | 18:05 | |
| *** Guest76635 is now known as tsymanczyk | 18:06 | |
| *** stevemar changes topic to "~45 days until mitaka-2 is released! see blueprints and bugs at: https://launchpad.net/keystone/+milestone/mitaka-2" | 18:07 | |
| *** tqtran_ has joined #openstack-keystone | 18:10 | |
| *** diazjf has joined #openstack-keystone | 18:11 | |
| *** tonytan4ever has joined #openstack-keystone | 18:16 | |
| *** jbell8 has joined #openstack-keystone | 18:16 | |
| *** jasonsb has quit IRC | 18:17 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Reduce revoke events for disabled domains and projects. https://review.openstack.org/253273 | 18:18 |
| *** richm has quit IRC | 18:19 | |
| *** alejandrito has quit IRC | 18:19 | |
| *** alejandrito has joined #openstack-keystone | 18:19 | |
| *** tonytan4ever has quit IRC | 18:21 | |
| bknudson | jamielennox: we have a test for a challenge-response auth plugin : http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/test_auth_plugin.py#n68 | 18:23 |
| *** gokrokve has quit IRC | 18:24 | |
| jamielennox | bknudson: cool, didn't know that, but yea i didn't think it'd be all that hard to do | 18:24 |
| bknudson | I don't know if anybody's actually used this feature. | 18:25 |
| *** gokrokve has joined #openstack-keystone | 18:25 | |
| *** mhickey has quit IRC | 18:26 | |
| *** pumaranikar has quit IRC | 18:29 | |
| *** gokrokve has quit IRC | 18:30 | |
| *** dims_ has quit IRC | 18:30 | |
| *** shaleh has joined #openstack-keystone | 18:31 | |
| *** gokrokve has joined #openstack-keystone | 18:31 | |
| *** gokrokve has quit IRC | 18:33 | |
| *** gokrokve has joined #openstack-keystone | 18:34 | |
| *** tonytan4ever has joined #openstack-keystone | 18:35 | |
| *** fangxu has joined #openstack-keystone | 18:36 | |
| jamielennox | ayoung: on not adding new abstraction levels, i'm going through your implied roles again, why did you add a new concept? why not just make roles hierarchical | 18:39 |
| *** jerrygb has quit IRC | 18:39 | |
| ayoung | jamielennox, they are! | 18:39 |
| ayoung | implied roles are hierarchical, but this is a namespacing issue | 18:39 |
| jamielennox | did we really need /implied_roles instead of just add it to /roles | 18:39 |
| *** e0ne has joined #openstack-keystone | 18:39 | |
| jamielennox | implied_roles are real in this case right? like they'll end up in the token? | 18:40 |
| ayoung | jamielennox, oh, that...I started with it in /roles, but the relationship between roles is really a seaprate entity from the roles themselcves | 18:40 |
| ayoung | many to many relation is easier to reprsent as a table | 18:40 |
| jamielennox | right, but that's because our role assignment interface sucks | 18:40 |
| ayoung | so, itr really is the rules that is the new entity, and the rules will determin what roles end up in the token | 18:40 |
| ayoung | so, yes | 18:40 |
| ayoung | heh | 18:40 |
| jamielennox | i dislike long winded PUT /a/{id}/b/{id}/c with no body | 18:41 |
| jamielennox | PUT /c with ids in body | 18:41 |
| jamielennox | but anyway | 18:41 |
| jamielennox | ayoung: so if implied roles don't end up in the token then i'm not sure why we don't just merge it with henrynash's DSR | 18:41 |
| jamielennox | domain specific implied roles | 18:42 |
| jamielennox | - and then just call them roles | 18:42 |
| ayoung | jamielennox, the implied roles do end up in the token | 18:42 |
| ayoung | DSRs do not | 18:42 |
| ayoung | DSRs will use the inference rules to put roles in the token | 18:42 |
| ayoung | so DSR IBM/admin can imple global admin, and a user assigned IBM/ADMIN on a project getsth global admin role | 18:43 |
| *** pumaranikar has joined #openstack-keystone | 18:43 | |
| jamielennox | ok, i was expecting them to end up in the tokne | 18:45 |
| jamielennox | so implied_roles are global DSRs and we just say that global ones go in the token? | 18:45 |
| *** ctina_ has quit IRC | 18:46 | |
| *** jerrygb has joined #openstack-keystone | 18:46 | |
| *** fangxu has quit IRC | 18:46 | |
| ayoung | gyee, we can cary on the convo here | 18:46 |
| ayoung | I can multiplex | 18:46 |
| *** aginwala has quit IRC | 18:47 | |
| jamielennox | ah, i gotta run for an hour or so | 18:47 |
| jamielennox | but i think it'd be good to merge the concepts somehow | 18:47 |
| gyee | ayoung, sure | 18:47 |
| ayoung | gyee, so, what if we split groups off identity | 18:48 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Reduce revoke events for disabled domains and projects. https://review.openstack.org/253273 | 18:48 |
| gyee | ayoung, in my view, user groups are essential permission templates | 18:49 |
| gyee | personas | 18:49 |
| ayoung | we can say "a users identity comes from one domain, but they can have groups for many. Only An admin for a domain is capable for setting up how to map users to groups for their domain" | 18:49 |
| *** david-ly_ has joined #openstack-keystone | 18:50 | |
| ayoung | gyee, agreed, and I thk that henrynash is using DSRs the same way. He was forced to DSRs due to groups being hardwired to the domain that the user comes from | 18:50 |
| *** tqtran_ has quit IRC | 18:51 | |
| ayoung | gyee, and also the fact that identity is read only, but we already have the idea that groups can be read/write, just that a user only gets groups from their home domain | 18:51 |
| *** david-ly_ is now known as david-lyle_ | 18:52 | |
| gyee | ayoung, I agreed we may not to decouple groups from identity, implementation-wise | 18:52 |
| gyee | may need | 18:52 |
| gyee | sorry about the typo | 18:53 |
| *** HoloIRCUser1 has quit IRC | 18:53 | |
| *** david-lyle has quit IRC | 18:54 | |
| *** davechen has left #openstack-keystone | 18:59 | |
| *** jasonsb has joined #openstack-keystone | 19:00 | |
| *** rderose has quit IRC | 19:00 | |
| stevemar | bknudson: so we are definitely aiming to have the ongoing stuff merge in M | 19:00 |
| ayoung | gyee, look at that diagnostic email link I posted again, and think through what you would want from it. I think the idea is super powerful | 19:00 |
| stevemar | i'm just doing what dolphm and notmorgan did, they had it as "ongoing" | 19:01 |
| gyee | ayoung, when did you send the email | 19:01 |
| gyee | ? | 19:01 |
| ayoung | gyee, I'll link again | 19:01 |
| bknudson | ongoing makes it sound like it's not targeted for M | 19:01 |
| amakarov | ayoung, I'd be nice - my commit chain starts with basic materialized path support that can be used in HMT right now | 19:01 |
| ayoung | gyee, https://openstack.nimeyo.com/66396/openstack-dev-keystone-diagnostic-apis-for-keystone | 19:01 |
| stevemar | bknudson: i wouldn't say that | 19:02 |
| *** openstackgerrit has quit IRC | 19:02 | |
| *** openstackgerrit has joined #openstack-keystone | 19:02 | |
| stevemar | bknudson: they are best-effort, and can go in while we are working on M3 or Mitaka-RC period | 19:02 |
| stevemar | i'd love for them to be in | 19:03 |
| *** davechen_bot has quit IRC | 19:03 | |
| ayoung | amakarov, I think the best bet is to have it ready to go as soon as N opens. That alone will be no easy task. But if the spec reflects the reality, e can merge the spec to backlog as soon as we have it firmed up, then the N dev cycle will run smoother | 19:03 |
| bknudson | ok, they're not in the section "To be completed for Mitaka", so seems like these aren't going to be completed for mitaka. | 19:03 |
| bknudson | aren't all of these best-effort? | 19:04 |
| amakarov | ayoung, interesting. I thought like "no specs after FF" | 19:04 |
| stevemar | bknudson: hmm, you're getting hung up on the wording, but i see your point | 19:05 |
| ayoung | amakarov, specs can always be approved to backlog | 19:06 |
| lbragstad | dstanek nonameentername xek I have my name down as a champion for a spec that you own. Please let me know if there are things you need from me as a reviewer | 19:06 |
| *** jasonsb has quit IRC | 19:06 | |
| ayoung | always post a spec to backlog until it gets approved, it stays out of the Named subfolder | 19:07 |
| *** jbell8 has quit IRC | 19:07 | |
| amakarov | ayoung, well, that's good news | 19:07 |
| ayoung | ++ amakarov and it will be more solid if you develop the spec and the code in parallel: the spec will more closely match reality | 19:07 |
| * ayoung needs food | 19:07 | |
| *** gokrokve has quit IRC | 19:08 | |
| bknudson | https://pypi.python.org/pypi/otpauth/ - a library for otp | 19:08 |
| bknudson | "You can create a QR code for Google Authenticator to scan" -- looking forward to seeing that in horizon | 19:08 |
| gyee | ayoung, so if we good enough INFO logs, diagnostics can be done outside of keystone, i.e. splunk, logger, kibana | 19:08 |
| bknudson | (or in the clouds.yaml ?) | 19:08 |
| bknudson | here's another one: https://pypi.python.org/pypi/oath | 19:08 |
| ayoung | gyee, nope | 19:09 |
| ayoung | we are going to want to be able to say "can Gyee execute this api on this resource" a-priori. Won;t be in a log, until we try | 19:09 |
| amakarov | ayoung, my case exactly: the spec follows the code. | 19:09 |
| stevemar | henrynash: you sure you're gonna manage with all your work? :) | 19:10 |
| * amakarov goes home | 19:10 | |
| gyee | ayoung, interesting, so this is like authorization API wrap in diagnostics? | 19:10 |
| *** wanghua has quit IRC | 19:13 | |
| *** david-lyle_ is now known as david-lyle | 19:14 | |
| *** fangxu has joined #openstack-keystone | 19:14 | |
| *** aginwala has joined #openstack-keystone | 19:15 | |
| *** gokrokve has joined #openstack-keystone | 19:16 | |
| *** henrynash has quit IRC | 19:19 | |
| ayoung | gyee, it is an API that could work for both authorization or for diagnostics | 19:21 |
| *** tqtran has quit IRC | 19:21 | |
| *** jbell8 has joined #openstack-keystone | 19:26 | |
| gyee | ayoung, ++, if user can ask meaningful questions like "can I do this with the given token?" that would be awesome | 19:28 |
| ayoung | gyee, or "...with an assertion that has these values..." | 19:29 |
| *** aginwala has quit IRC | 19:29 | |
| gyee | self-service is very much under-represented right now | 19:29 |
| *** aginwala has joined #openstack-keystone | 19:30 | |
| ayoung | gyee, I was thinking along the lines of "I have a user coming in to use my resources tomorrow...will he/she be able to do so?" | 19:30 |
| gyee | ayoung, but the scope of your email goes much deeper though, like diagnose misconfigurations | 19:30 |
| ayoung | and, if not...what do I need to do to get there | 19:30 |
| ayoung | gyee, right, I could see one step being "get me the username, userid, and groups for a user with assertion that has .... in it | 19:31 |
| *** diazjf has quit IRC | 19:31 | |
| *** diazjf has joined #openstack-keystone | 19:31 | |
| *** gokrokve has quit IRC | 19:31 | |
| ayoung | and then "if a user has ID X group Y, and trys to get a token on project P, what roles will they get. | 19:31 |
| ayoung | ^H? | 19:32 |
| ayoung | " | 19:32 |
| gyee | ayoung, but how does that detect misconfigurations? | 19:33 |
| ayoung | gyee, it lets you break up the token processing in to steps, and identify which step failed | 19:34 |
| gyee | say my LDAP filter is wrong, that'll result in user not found | 19:34 |
| gyee | but we can't say user not found always means my LDAP filter is wrong | 19:35 |
| *** flwang1 has joined #openstack-keystone | 19:36 | |
| *** harlowja has quit IRC | 19:38 | |
| *** harlowja has joined #openstack-keystone | 19:38 | |
| *** erhudy has quit IRC | 19:40 | |
| gyee | henrynash, ayoung, stevemar, I've responded to https://review.openstack.org/#/c/254139/ | 19:48 |
| *** atiwari has quit IRC | 19:48 | |
| gyee | so we have some closure on this | 19:48 |
| gyee | for now | 19:48 |
| *** tqtran has joined #openstack-keystone | 19:49 | |
| notmorgan | jamielennox: ping | 19:50 |
| ayoung | gyee, so...DSRs as experimental will let us play with them. I think we should explore doing more with the group abstrction. Want me to write up a spec for that? | 19:50 |
| ayoung | We can bat it around and, if we come up with something better, provide a migration from DSRs to Groups if we implement... | 19:50 |
| ayoung | notmorgan, just ask the question...no naked pings! | 19:50 |
| notmorgan | ayoung: always naked pings | 19:50 |
| notmorgan | ayoung: ping | 19:51 |
| notmorgan | see | 19:51 |
| *** atiwari has joined #openstack-keystone | 19:51 | |
| gyee | ayoung, it is essentially permission templates that we are after | 19:54 |
| ayoung | gyee, can youdefine what you want from a permission template? | 19:55 |
| *** mhickey has joined #openstack-keystone | 19:55 | |
| gyee | ayoung, user groups? | 19:55 |
| ayoung | gyee, describe the use case/pattern | 19:56 |
| ayoung | can be in email | 19:56 |
| *** petertr7_away is now known as petertr7 | 19:58 | |
| gyee | ayoung, you assign user groups roles for a given scope, whoever is part of that groups *inherit* those permissions | 20:01 |
| gyee | that model's been around for ages | 20:01 |
| gyee | simple, easy to use, easy to understand, easy to audit | 20:01 |
| gyee | you either part of a group or you don't | 20:01 |
| *** spandhe has quit IRC | 20:02 | |
| ayoung | gyee, so...I bet we could even make this work without changing the group API, but the issue is that group names are not scoped to domain | 20:02 |
| ayoung | I suspect we would nee the URL safe approach we were proposing for projects, and then: | 20:02 |
| gyee | ayoung, user groups are owned by domain | 20:02 |
| ayoung | gyee, yes, but... | 20:02 |
| ayoung | assume a user might have groups from multiple domains | 20:02 |
| ayoung | gyee, http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3.rst#n4676 | 20:04 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3.rst#n4575 | 20:04 |
| *** spandhe has joined #openstack-keystone | 20:04 | |
| ayoung | that already supports users in a different domain | 20:04 |
| *** aginwala has quit IRC | 20:05 | |
| gyee | ayoung, not sure if I understand, we are not returning groups in token response | 20:05 |
| ayoung | gyee, not in the token...this would be splitting identity | 20:05 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3.rst#n4276 is the key one | 20:06 |
| ayoung | gyee, it would work as is | 20:06 |
| gyee | ayoung, but that API returns the group ref, not just the name | 20:07 |
| ayoung | notmorgan, what would you say to the idea of splitting off groups from identity, such that we could manage group membership in keystone in addition to getting it from the FEderated assertions? | 20:07 |
| *** lhcheng has quit IRC | 20:07 | |
| gyee | notmorgan, hope you don't have to deal with floods in PDX | 20:07 |
| ayoung | gyee, if I ask for a token in domain D, I see what groups the user is in. If we properly limit assignment of users to groups, then it shouldnot open up any security holes | 20:08 |
| ayoung | gyee, I think that I am going to propose that as an alternative to DSRs | 20:08 |
| notmorgan | ayoung: i have very little care on that front | 20:08 |
| ayoung | wish henry washere, but I can ask him | 20:09 |
| ayoung | notmorgan, I know, but you have good kneejerk reactions | 20:09 |
| ayoung | what is your gut response to that proposal? | 20:09 |
| *** aginwala has joined #openstack-keystone | 20:09 | |
| * gyee poke a needle to notmorgan's knees | 20:09 | |
| *** pece has joined #openstack-keystone | 20:09 | |
| notmorgan | ayoung: i have no reaction to it. | 20:10 |
| notmorgan | ayoung: like... no care one way or another | 20:10 |
| notmorgan | ayoung: just ask [not deployer experience] what end user experience is impacted if anything | 20:10 |
| notmorgan | and think about people like mordred running things on the clouds | 20:10 |
| notmorgan | if it would make those folks' lives bad, don't do it | 20:10 |
| gyee | deployers get shit from their end users all the time :) | 20:11 |
| ayoung | notmorgan, all I can do is see how it would make my life better, and I can't see past that...maybe lbragstad or dolphm could chime in.... | 20:11 |
| gyee | if things don't work intuitively | 20:11 |
| ayoung | lbragstad, dolphm question: what if we manged groups separately from users, such that we could assign users from one domain to groups in another | 20:12 |
| ayoung | ? | 20:12 |
| notmorgan | ayoung: right. so, thats what i'm asking you to do. think about running things on top of a cloud you don't have admin on. make sure you don't make that experience worse | 20:12 |
| notmorgan | ayoung: most of the rest of the stuff is kindof low on my "care-o-meter" | 20:13 |
| notmorgan | ayoung: because right now i think we need end user happieness more than anything else. | 20:13 |
| ayoung | notmorgan, so...I *think*this will only increase it. | 20:13 |
| openstackgerrit | Sean Perry proposed openstack/keystone: Clean up new_credential_ref usage and surrounding code https://review.openstack.org/246713 | 20:14 |
| mordred | notmorgan: what did I do? | 20:14 |
| notmorgan | mordred: you run things on clouds | 20:14 |
| mordred | awesome | 20:15 |
| notmorgan | mordred: was using you as an example of "don't make peoiple's lives bad when interacting with the clouds" | 20:15 |
| mordred | yes plesae | 20:16 |
| *** fangxu has quit IRC | 20:18 | |
| *** petertr7 is now known as petertr7_away | 20:20 | |
| *** atiwari1 has joined #openstack-keystone | 20:30 | |
| *** timcline has quit IRC | 20:32 | |
| *** atiwari has quit IRC | 20:34 | |
| *** timcline has joined #openstack-keystone | 20:37 | |
| *** gyee has quit IRC | 20:40 | |
| *** henrynash has joined #openstack-keystone | 20:43 | |
| *** ChanServ sets mode: +v henrynash | 20:43 | |
| *** richm1 has joined #openstack-keystone | 20:45 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove keystoneclient tests https://review.openstack.org/240474 | 20:46 |
| *** davechen has joined #openstack-keystone | 20:50 | |
| *** alvipet has quit IRC | 20:50 | |
| openstackgerrit | Brant Knudson proposed openstack/keystoneauth: Switch saml2 from lxml to built-in xml https://review.openstack.org/242512 | 20:53 |
| *** fawadkhaliq has quit IRC | 20:55 | |
| *** gildub has joined #openstack-keystone | 20:58 | |
| stevemar | can someone please approve https://review.openstack.org/#/c/240474/ gyee notmorgan ayoung | 20:58 |
| ayoung | stevemar, looking | 20:58 |
| notmorgan | stevemar: +2, no +A cause jenkins. | 20:59 |
| notmorgan | stevemar: feel free to +A if you want | 20:59 |
| ayoung | stevemar, heh...I +Aed it anyway | 20:59 |
| stevemar | notmorgan: whats the harm in +A'ing? it's just less tests, i can't imagine how it's gonna fail | 21:00 |
| *** petertr7_away is now known as petertr7 | 21:00 | |
| *** fangxu has joined #openstack-keystone | 21:02 | |
| breton | if it will be +A'd and the tests won't pass, it will break hope. | 21:04 |
| *** aginwala has quit IRC | 21:05 | |
| samueldmq | dstanek: replied your comment on https://review.openstack.org/#/c/253219/ | 21:05 |
| jamielennox | notmorgan: pong | 21:07 |
| *** jamielennox has left #openstack-keystone | 21:07 | |
| *** jamielennox has joined #openstack-keystone | 21:07 | |
| *** ChanServ sets mode: +v jamielennox | 21:07 | |
| *** aginwala has joined #openstack-keystone | 21:09 | |
| *** fangxu has quit IRC | 21:13 | |
| *** lhcheng has joined #openstack-keystone | 21:14 | |
| *** ChanServ sets mode: +v lhcheng | 21:14 | |
| *** diazjf has quit IRC | 21:18 | |
| *** diazjf has joined #openstack-keystone | 21:20 | |
| *** topol has quit IRC | 21:21 | |
| *** fangxu has joined #openstack-keystone | 21:22 | |
| *** jasonsb has joined #openstack-keystone | 21:23 | |
| *** jasonsb has quit IRC | 21:23 | |
| *** jasonsb has joined #openstack-keystone | 21:24 | |
| *** pwp has joined #openstack-keystone | 21:25 | |
| *** davechen has quit IRC | 21:26 | |
| *** davechen has joined #openstack-keystone | 21:27 | |
| *** roxanaghe has quit IRC | 21:28 | |
| *** doug-fis_ has joined #openstack-keystone | 21:30 | |
| *** dims has joined #openstack-keystone | 21:31 | |
| *** ayoung has quit IRC | 21:31 | |
| *** doug-fish has quit IRC | 21:32 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/254444 | 21:32 |
| *** aginwala has quit IRC | 21:33 | |
| *** petertr7 is now known as petertr7_away | 21:33 | |
| *** petertr7_away is now known as petertr7 | 21:34 | |
| pwp | dolphm: I am looking at implementing this https://bugs.launchpad.net/keystone/+bug/1218682. Appears abandoned. I'm looking at their implementation now to find why it was rejected. I just wanted to make sure no one else was currently working on it. | 21:35 |
| openstack | Launchpad bug 1218682 in python-keystoneclient "User's email format hasn't been checked" [Wishlist,In progress] | 21:35 |
| *** mhickey has quit IRC | 21:49 | |
| *** reed has left #openstack-keystone | 21:50 | |
| *** dims has quit IRC | 21:59 | |
| stevemar | pwp: you are free to work on it | 22:00 |
| openstackgerrit | Merged openstack/keystone: Refactor: Move uncommon entities from setUp https://review.openstack.org/252692 | 22:01 |
| stevemar | pwp: commented | 22:02 |
| pwp | stevemar: Thanks! I know diazjf, so I'll keep you guys updated and use him as a guide for getting used to the community culture! Thanks! | 22:02 |
| *** spandhe has quit IRC | 22:03 | |
| openstackgerrit | Merged openstack/keystone: Refactor: Remove use of self where not needed https://review.openstack.org/252706 | 22:05 |
| *** spandhe has joined #openstack-keystone | 22:05 | |
| *** gokrokve has joined #openstack-keystone | 22:05 | |
| dstanek | bknudson: :-( found this buried in some gerrit data: http://paste.openstack.org/show/481248/ | 22:06 |
| bknudson | dstanek: I've been -1d. | 22:07 |
| *** gokrokve has quit IRC | 22:07 | |
| *** gokrokve has joined #openstack-keystone | 22:07 | |
| dstanek | bknudson: with all the -1s you hand out it was bound to happen | 22:08 |
| bknudson | goes around comes around | 22:09 |
| *** david-ly_ has joined #openstack-keystone | 22:10 | |
| dstanek | looks like that's the section of the review data for the people that voted -1 - so it's not targeted toward you after all! | 22:10 |
| bknudson | it was merged even though I -1d? | 22:11 |
| bknudson | that's pretty common | 22:11 |
| *** henrynash has quit IRC | 22:11 | |
| bknudson | also, I really need an avatar for gerrit | 22:12 |
| *** david-lyle has quit IRC | 22:13 | |
| *** david-ly_ is now known as david-lyle | 22:13 | |
| *** davechen is now known as davechen_afk | 22:16 | |
| stevemar | pwp: awesomeo | 22:16 |
| *** jbell8 has quit IRC | 22:17 | |
| *** belmoreira has joined #openstack-keystone | 22:19 | |
| breton | stevemar: re: bug 1218682 | 22:19 |
| openstack | bug 1218682 in OpenStack Identity (keystone) "User's email format hasn't been checked" [Wishlist,Triaged] https://launchpad.net/bugs/1218682 | 22:19 |
| *** diazjf has quit IRC | 22:19 | |
| breton | I thing we decided not to do any validation | 22:20 |
| breton | and we rejected several patches to that already | 22:20 |
| stevemar | breton: i'm ok with something super basic | 22:20 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: WIP List assignments with names https://review.openstack.org/249958 | 22:21 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/254633 | 22:21 |
| *** lhcheng has quit IRC | 22:23 | |
| *** pwp has quit IRC | 22:24 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/254633 | 22:25 |
| *** e0ne has quit IRC | 22:26 | |
| *** pumaranikar has quit IRC | 22:35 | |
| *** spandhe has quit IRC | 22:36 | |
| *** gokrokve has quit IRC | 22:39 | |
| *** petertr7 is now known as petertr7_away | 22:40 | |
| *** aginwala has joined #openstack-keystone | 22:42 | |
| *** lhcheng has joined #openstack-keystone | 22:43 | |
| *** ChanServ sets mode: +v lhcheng | 22:43 | |
| *** ayoung has joined #openstack-keystone | 22:43 | |
| *** ChanServ sets mode: +v ayoung | 22:43 | |
| *** gokrokve has joined #openstack-keystone | 22:49 | |
| *** lhcheng has quit IRC | 22:50 | |
| *** gokrokve has quit IRC | 22:50 | |
| *** timcline has quit IRC | 22:52 | |
| *** gokrokve has joined #openstack-keystone | 22:53 | |
| *** gokrokve_ has joined #openstack-keystone | 22:55 | |
| *** esp has quit IRC | 22:56 | |
| *** gokrokve has quit IRC | 22:56 | |
| *** samueldmq has quit IRC | 22:56 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:56 | |
| openstackgerrit | Merged openstack/keystone: Update extensions links https://review.openstack.org/253587 | 23:00 |
| *** gokrokve_ has quit IRC | 23:03 | |
| *** spandhe has joined #openstack-keystone | 23:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/254633 | 23:05 |
| *** davechen_afk has left #openstack-keystone | 23:07 | |
| *** lhcheng_ has joined #openstack-keystone | 23:10 | |
| *** chlong has quit IRC | 23:10 | |
| *** slberger has left #openstack-keystone | 23:14 | |
| *** gildub has quit IRC | 23:14 | |
| *** mkoderer has quit IRC | 23:15 | |
| *** mkoderer has joined #openstack-keystone | 23:18 | |
| *** lhcheng_ has quit IRC | 23:20 | |
| *** edmondsw has quit IRC | 23:21 | |
| *** alex_xu has quit IRC | 23:36 | |
| *** aginwala has quit IRC | 23:37 | |
| *** alex_xu has joined #openstack-keystone | 23:41 | |
| *** gordc has quit IRC | 23:41 | |
| *** pece has quit IRC | 23:44 | |
| *** gildub has joined #openstack-keystone | 23:54 | |
| *** jerrygb has quit IRC | 23:55 | |
| *** aginwala has joined #openstack-keystone | 23:55 | |
| *** jerrygb has joined #openstack-keystone | 23:56 | |
| *** andrewbogott has joined #openstack-keystone | 23:57 | |
| *** andrewbogott has quit IRC | 23:58 | |
| *** andrewbogott has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!