| openstackgerrit | Henrique Truta proposed openstack/keystone: Make project.domain_id column nullable https://review.openstack.org/264533 | 00:03 |
|---|---|---|
| *** aginwala has joined #openstack-keystone | 00:03 | |
| *** jasonsb has joined #openstack-keystone | 00:07 | |
| *** shoutm_ has joined #openstack-keystone | 00:17 | |
| *** shoutm has quit IRC | 00:19 | |
| *** Guest57135 has quit IRC | 00:30 | |
| openstackgerrit | ayoung proposed openstack/keystone: Implied roles driver and manager https://review.openstack.org/264260 | 00:32 |
| henrynash | ayoung: when you have a moment you might be intersted in: https://review.openstack.org/#/c/266617/ | 00:32 |
| *** topol_ has joined #openstack-keystone | 00:33 | |
| *** topol_ is now known as Guest93434 | 00:33 | |
| ayoung | henrynash, +2 | 00:33 |
| henrynash | ayoung: thx, admin_project worked a treat! | 00:34 |
| ayoung | henrynash, we're getting closer to where we should be... | 00:34 |
| henrynash | ayoung: yep | 00:34 |
| openstackgerrit | Merged openstack/python-keystoneclient: Revert "Change default endpoint for Keystone v3 to public" https://review.openstack.org/267180 | 00:34 |
| notmorgan | jamielennox: sorry about merge conflicts on positional | 00:36 |
| jamielennox | notmorgan: yea, i thought you were done, haven't looked at what you pushed yet | 00:36 |
| notmorgan | i just did sphinx stuff | 00:37 |
| notmorgan | so RTD will work | 00:37 |
| notmorgan | and merged your things except the README fix | 00:37 |
| notmorgan | so everything except your README fix is in | 00:37 |
| notmorgan | ok and i still didn't RTD to work. | 00:38 |
| notmorgan | ugh | 00:38 |
| notmorgan | jamielennox: so it builds... just... http://positional.readthedocs.org/en/latest/ not that interesting | 00:43 |
| notmorgan | something is missing. | 00:43 |
| notmorgan | i probably am doing something wrong | 00:43 |
| jamielennox | notmorgan: i don't know if i'd bother with RTD, there's not that much to explain | 00:44 |
| *** pai15 has joined #openstack-keystone | 00:44 | |
| *** dims has quit IRC | 00:45 | |
| *** henrynash has quit IRC | 00:47 | |
| notmorgan | jamielennox: we could also just import the README | 00:47 |
| notmorgan | or i can just can RTD | 00:48 |
| notmorgan | if you think it's not worth it | 00:48 |
| jamielennox | notmorgan: yea, import readme is good, did you do the same as me and just import it? | 00:48 |
| notmorgan | i think it's always nice to have RTD for indexing purposes at least | 00:48 |
| jamielennox | from the doc string? | 00:48 |
| notmorgan | yeah with proper RST conversions | 00:48 |
| notmorgan | it has a typo or two still in it | 00:48 |
| *** ryanpetrello has quit IRC | 00:49 | |
| notmorgan | so i should revert the sphinx change? | 00:50 |
| *** ryanpetrello has joined #openstack-keystone | 00:50 | |
| jamielennox | notmorgan: you got this far, even if it's the same as the README it's worth finishing | 00:51 |
| notmorgan | oh ok. | 00:51 |
| *** lhcheng has quit IRC | 00:51 | |
| notmorgan | hmm.. why is this not doing the right thing? | 00:52 |
| *** ryanpetrello has quit IRC | 00:55 | |
| *** edmondsw has quit IRC | 00:55 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Revert "Support `truncated` flag returned by keystone" https://review.openstack.org/267187 | 00:56 |
| *** ryanpetrello has joined #openstack-keystone | 00:57 | |
| *** ryanpetrello has quit IRC | 01:02 | |
| notmorgan | jamielennox: oooh huh. i think it's not creating api/* properly | 01:02 |
| openstackgerrit | Saulo Aislan Silva Eleuterio proposed openstack/keystone: Doc FIX https://review.openstack.org/267253 | 01:02 |
| *** pai15 has quit IRC | 01:03 | |
| *** tonytan4ever has quit IRC | 01:04 | |
| *** ankita_wagh has quit IRC | 01:05 | |
| *** ryanpetrello has joined #openstack-keystone | 01:06 | |
| notmorgan | jamielennox: http://positional.readthedocs.org/en/latest/index.html there we go | 01:07 |
| notmorgan | jamielennox: so i think we just need to address the typo(s) in README and fix the warn thing | 01:07 |
| jamielennox | notmorgan: ok, i'll do the warn thing now | 01:07 |
| notmorgan | and i'll close your README fix. do you want to make the README point at RTD instead? or just keep them both? | 01:08 |
| notmorgan | or we can make sphinx include the readme *shrug* | 01:08 |
| *** tonytan4ever has joined #openstack-keystone | 01:10 | |
| *** ryanpetrello has quit IRC | 01:11 | |
| *** aginwala has quit IRC | 01:12 | |
| *** jbell8 has joined #openstack-keystone | 01:12 | |
| *** ryanpetrello has joined #openstack-keystone | 01:13 | |
| *** browne has quit IRC | 01:13 | |
| *** EinstCrazy has joined #openstack-keystone | 01:14 | |
| *** wasmum has joined #openstack-keystone | 01:16 | |
| *** davechen has joined #openstack-keystone | 01:18 | |
| *** jasondotstar has quit IRC | 01:24 | |
| *** dims has joined #openstack-keystone | 01:24 | |
| notmorgan | jamielennox: ok readme is where the useage is now, your docstring fix is also merged | 01:26 |
| notmorgan | README is sourced in for RTD | 01:26 |
| notmorgan | jamielennox: just waiting on your PR for the warn bit | 01:26 |
| *** oomichi_away has quit IRC | 01:28 | |
| jamielennox | notmorgan: done, add a description to the repo (in github as well) | 01:28 |
| notmorgan | ah ok | 01:29 |
| *** jasondotstar has joined #openstack-keystone | 01:29 | |
| *** Guest93434 has quit IRC | 01:30 | |
| notmorgan | jamielennox: mind resolving the conflicts? | 01:30 |
| jamielennox | conflicts? | 01:30 |
| notmorgan | yeah | 01:30 |
| notmorgan | https://github.com/morganfainberg/positional/pull/13 | 01:30 |
| notmorgan | "this branch has conflicts that must be resolved" | 01:30 |
| *** aginwala has joined #openstack-keystone | 01:30 | |
| flwang1 | hi guys, is this a known issue? oslo_config.cfg.NoSuchOptError: no such option in group keystone_authtoken: auth_admin_prefix | 01:30 |
| notmorgan | jamielennox: i can do it locally, but it's easier if it's done in the PR | 01:31 |
| notmorgan | if you don't mind | 01:31 |
| *** _zouyee has joined #openstack-keystone | 01:31 | |
| jamielennox | notmorgan: yea, i just didn't notice them, i only branched it a few minutes ago | 01:31 |
| notmorgan | yeah that was part of the original merge resolution | 01:31 |
| notmorgan | sorry | 01:31 |
| *** __zouyee has joined #openstack-keystone | 01:31 | |
| notmorgan | for your readme thing | 01:31 |
| notmorgan | i fixed extra things in there i shouldn't have :P | 01:31 |
| notmorgan | also you should be a collaborator, so you should be able to merge PRs etc | 01:32 |
| notmorgan | i have it setup so you must pass travis before merges can happen | 01:32 |
| *** topol_ has joined #openstack-keystone | 01:32 | |
| *** topol_ is now known as Guest99924 | 01:33 | |
| notmorgan | and merged | 01:33 |
| ayoung | gyee, I think you will like the refactoring I did on https://review.openstack.org/#/c/264260/ It was triggered by your feedback | 01:33 |
| notmorgan | are you generally happy with this? i can tag/push to pypi now | 01:33 |
| jamielennox | notmorgan: one more | 01:34 |
| notmorgan | ok | 01:35 |
| notmorgan | oh sure | 01:35 |
| jamielennox | notmorgan: just cleaned it up | 01:36 |
| notmorgan | cool | 01:36 |
| jamielennox | i don't like how PRs keep merging things rather than rebasing | 01:36 |
| notmorgan | once travis is done will merge, tag 1.0 and call it a day | 01:36 |
| notmorgan | we can always move it into gerrit if we prefer | 01:36 |
| notmorgan | (i don't like PRs) | 01:36 |
| *** woodster_ has quit IRC | 01:36 | |
| notmorgan | but this is a stupid small project | 01:36 |
| jamielennox | i guess there is no reason to tag a < 1 | 01:37 |
| notmorgan | yah | 01:37 |
| notmorgan | going to tag 1.0.0 | 01:37 |
| notmorgan | actually 1.0.0-post19.breakpbr | 01:37 |
| notmorgan | jamielennox: :P | 01:37 |
| * notmorgan rolls eyes | 01:38 | |
| jamielennox | yea, currently dealing with the X.X.X+YpostZ format :( | 01:38 |
| flwang1 | ayoung: ping, is this a known issue? oslo_config.cfg.NoSuchOptError: no such option in group keystone_authtoken: auth_admin_prefix | 01:38 |
| notmorgan | oh fantastic. i can't find my secret gpg key. | 01:39 |
| jamielennox | notmorgan: haha | 01:39 |
| jamielennox | flwang1: it's kind of an issue that may have been created by the last release | 01:39 |
| jamielennox | flwang1: where's it coming from ? | 01:40 |
| flwang1 | from zaqar's unit test log | 01:40 |
| flwang1 | jamielennox: http://logs.openstack.org/31/266831/3/check/gate-zaqar-python34/ed3cd90/testr_results.html.gz | 01:40 |
| jamielennox | flwang1: hmm, i'm guessing it's coming from the way zaqar registers its options in testing | 01:41 |
| flwang1 | jamielennox: maybe, it's nice point, i will take a look | 01:42 |
| jamielennox | flwang1: we would have just released a keystonemiddleware version with https://review.openstack.org/#/c/253972/ in it | 01:43 |
| jamielennox | flwang1: from memory zaqar does funny things to with it's CONF object that might mean it was relying on that | 01:43 |
| *** davechen1 has joined #openstack-keystone | 01:44 | |
| flwang1 | jamielennox: pls define 'funny' :D | 01:44 |
| *** _cjones_ has quit IRC | 01:44 | |
| *** aginwala has quit IRC | 01:44 | |
| jamielennox | flwang1: it doesn't define the object globally like the other services | 01:44 |
| jamielennox | flwang1: so to load auth_token middleware it has to do workarounds | 01:44 |
| jamielennox | CONF object globally | 01:45 |
| flwang1 | jamielennox: yep, flaper87 did that, IIRC | 01:45 |
| *** davechen has quit IRC | 01:45 | |
| flwang1 | jamielennox: would you mind me reminding me what's the drawback? | 01:45 |
| jamielennox | so it's not ideal to have global objects - no debate | 01:46 |
| jamielennox | but auth_token middleware assumes there is a global CONF object that it can register all the options so the service doesn't have to | 01:46 |
| flwang1 | jamielennox: if it's not ideal, why the auth_token middleware still depends on that? | 01:47 |
| *** aginwala has joined #openstack-keystone | 01:47 | |
| jamielennox | the list_opts function is in keystonemiddleware so that oslo.config can generate sample config files with all the options in it | 01:48 |
| *** doug-fish has quit IRC | 01:48 | |
| jamielennox | if zaqar is relying on list_opts then when we remove deprecated options (so they don't show up in sample config) zaqar wont be registering them against there own CONF object | 01:48 |
| flwang1 | hmm... sounds like just because oslo.config needs it to auto generate conf sample, so we have to keep it, right? | 01:49 |
| flwang1 | sorry if it's stupid question | 01:49 |
| jamielennox | flwang1: i hate to say it but ideal has been replaced with what currently works for everyone | 01:49 |
| flwang1 | jamielennox: yep, that's what i want to say, seems it just because all the other services are using a 'not-ideal' way, so we have to follow that | 01:50 |
| flwang1 | it's not ideal :D | 01:50 |
| jamielennox | the problem would seem to be that the same function is being used for different purposes, we expected it to be for sample config and zaqar uses it as a full option list | 01:51 |
| notmorgan | jamielennox: ok positional is up and on pypu | 01:51 |
| notmorgan | pypi* | 01:51 |
| notmorgan | we can ask to add it to g-r now | 01:51 |
| jamielennox | we probably need to convert it to two distinct functions | 01:51 |
| flwang1 | jamielennox: it would be nice | 01:53 |
| flwang1 | jamielennox: so that zaqar won't run into this issue again and again | 01:53 |
| jamielennox | flwang1: yea, i think we might have to revert that patch :( | 01:56 |
| flwang1 | jamielennox: revert https://review.openstack.org/#/c/253972/ ? | 01:56 |
| *** pai15 has joined #openstack-keystone | 01:57 | |
| *** EinstCrazy has quit IRC | 01:57 | |
| flwang1 | i'm trying to figure out if there is anyway to fix it on zaqar side | 01:57 |
| jamielennox | flwang1: yep, and come up with a way to split the functions | 01:57 |
| jamielennox | i'm also interested if anyone else is hitting the problem | 01:57 |
| jamielennox | notmorgan: should probably try and use it in ksc and ksa before you do that - probably should have done that before 1.0 | 01:58 |
| notmorgan | jamielennox: i'll mark it WIP in gerrit for g-r | 01:59 |
| notmorgan | just posted it | 01:59 |
| jamielennox | notmorgan: it should be fine, just make sure it actually does everything | 01:59 |
| notmorgan | https://review.openstack.org/#/c/267270/1 | 01:59 |
| *** EinstCrazy has joined #openstack-keystone | 01:59 | |
| dims | +notmorgan, +jamielennox : please kick the tires - https://pypi.python.org/pypi/python-keystoneclient/2.1.1 | 01:59 |
| jamielennox | flwang1: do you have a bug filed? | 01:59 |
| notmorgan | jamielennox: so once we test we can use it | 02:00 |
| mordred | jamielennox, notmorgan: I hear that you have released a new keystoneclient | 02:03 |
| notmorgan | mordred: yes | 02:03 |
| notmorgan | ther eis a new keystoneclient | 02:03 |
| mordred | notmorgan: http://logs.openstack.org/32/266532/5/check/gate-shade-dsvm-functional-neutron/6bfb00a/console.html | 02:03 |
| notmorgan | what did we break? | 02:03 |
| mordred | notmorgan: it seems to have broken our functional tests | 02:03 |
| notmorgan | whoa | 02:04 |
| mordred | notmorgan: which might indicate that there was an interface that changed somewhere | 02:04 |
| notmorgan | yeah | 02:04 |
| notmorgan | that is no good | 02:04 |
| mordred | all of the fails are: http://logs.openstack.org/32/266532/5/check/gate-shade-dsvm-functional-neutron/6bfb00a/console.html#_2016-01-14_01_35_27_344 | 02:04 |
| mordred | AttributeError: 'str' object has no attribute 'get' | 02:04 |
| jamielennox | wow, we've been really unsuccessful with this round of release | 02:04 |
| jamielennox | s | 02:04 |
| notmorgan | garp, wtf. | 02:05 |
| stevemar | mordred: notmorgan just released a new ksc (2.1.1) | 02:05 |
| mordred | http://git.openstack.org/cgit/openstack-infra/shade/tree/shade/_utils.py#n375 | 02:05 |
| notmorgan | wow really screwed up more than one bit of interface | 02:05 |
| mordred | the first tihng that fails is us tryuing to pull things out of a domain - but we seem to have gotten a string instead of a dict-like-object | 02:05 |
| stevemar | mordred: we released 2.1.0 yesterday, and 2.1.1 like 10 minutes ago | 02:05 |
| mordred | stevemar: it's possible this broke with 2.1.0 and we just noticed it | 02:06 |
| mordred | I don't know that we've pushed many patches to shade in the last couple of days | 02:06 |
| mordred | also - I ahve not investigated really at all yet - just thought I'd mention here since you might have other users who are affected if we are | 02:06 |
| notmorgan | likely | 02:07 |
| notmorgan | mordred: fun. not sure what broke ya yet | 02:09 |
| mordred | notmorgan: cool. no rush on our side | 02:09 |
| mordred | notmorgan: I'm going to watch some teevee- and Shrews is going to look in to things in the morning | 02:09 |
| notmorgan | stevemar: when was our aste release? | 02:10 |
| notmorgan | last* | 02:10 |
| notmorgan | before 2.1? | 02:11 |
| *** EinstCra_ has joined #openstack-keystone | 02:13 | |
| notmorgan | jamielennox: https://github.com/openstack/python-keystoneclient/commit/c28d40814962b3a8ccb81e5e7d7f832c8f0a3c9a is one of the potential culprits | 02:13 |
| jamielennox | notmorgan: i think that already got reverted | 02:14 |
| notmorgan | ah it did | 02:14 |
| notmorgan | there is no way this has been lingering since ebfore 2.0... is there? | 02:15 |
| notmorgan | mordred: ^? | 02:15 |
| *** jasonsb has quit IRC | 02:15 | |
| notmorgan | ooh uh | 02:15 |
| notmorgan | maybe not | 02:15 |
| notmorgan | ah that landed in 2.1 | 02:16 |
| notmorgan | wem 2.2 | 02:16 |
| notmorgan | or whatever the most recent one was | 02:16 |
| *** browne has joined #openstack-keystone | 02:16 | |
| *** EinstCrazy has quit IRC | 02:16 | |
| notmorgan | this failed with ksc 2.0.p0 | 02:17 |
| notmorgan | fwiw | 02:17 |
| notmorgan | mordred, ^ this might be a non-issue with something newer than 2.0.0 | 02:17 |
| *** boris-42 has joined #openstack-keystone | 02:18 | |
| *** tonytan4ever has quit IRC | 02:20 | |
| flwang1 | jamielennox: file bug for keystone middleware or zaqar ? :D | 02:21 |
| jamielennox | flwang1: probably file it against both | 02:21 |
| flwang1 | now i'm trying to fix it on zaqar side, since it's breaking our gate | 02:21 |
| flwang1 | jamielennox: ok, will do | 02:21 |
| *** aginwala has quit IRC | 02:22 | |
| *** aginwala has joined #openstack-keystone | 02:27 | |
| *** dims has quit IRC | 02:29 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain parameter to get_project_by_name https://review.openstack.org/210600 | 02:31 |
| jamielennox | flwang1: have a bug number? i think i've got a fix | 02:31 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Make project.domain_id column nullable https://review.openstack.org/264533 | 02:32 |
| flwang1 | jamielennox: feel free update the description https://bugs.launchpad.net/keystonemiddleware/+bug/1533932 | 02:36 |
| openstack | Launchpad bug 1533932 in keystonemiddleware "Remove the deprecated opts from sample config breaking zaqar" [Undecided,New] | 02:36 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Split oslo_config and list all opts https://review.openstack.org/267277 | 02:39 |
| flwang1 | jamielennox: what a quick hand | 02:39 |
| jamielennox | stevemar, flwang1, notmorgan: i think this fixes it the auth_token regression | 02:39 |
| flwang1 | jamielennox: awesome | 02:40 |
| flwang1 | jamielennox: i will let a zaqar patch depens on that to see if it works | 02:40 |
| jamielennox | flwang1: i'm running the tests against zaqar, but i'd appreciate if you can confirm that fixes it | 02:40 |
| *** josecastroleon has quit IRC | 02:41 | |
| *** josecastroleon has joined #openstack-keystone | 02:42 | |
| *** jbell8 has quit IRC | 02:43 | |
| *** jbell8 has joined #openstack-keystone | 02:44 | |
| flwang1 | jamielennox: sure | 02:46 |
| jamielennox | flwang1: zaqar runs functional tests when you tox -e py27 ? | 02:48 |
| flwang1 | jamielennox: yes | 02:49 |
| jamielennox | flwang1: thats annoying | 02:49 |
| flwang1 | jamielennox: ;) | 02:49 |
| *** roxanag__ has joined #openstack-keystone | 02:50 | |
| *** crinkle_ has joined #openstack-keystone | 02:51 | |
| *** spzala has joined #openstack-keystone | 02:52 | |
| *** _fortis has quit IRC | 02:52 | |
| *** mkoderer has quit IRC | 02:52 | |
| *** dulek has quit IRC | 02:52 | |
| *** dstanek has quit IRC | 02:52 | |
| *** ekarlso has quit IRC | 02:52 | |
| *** boltR has quit IRC | 02:52 | |
| *** roxanagh_ has quit IRC | 02:52 | |
| *** ccard_ has quit IRC | 02:52 | |
| *** crinkle has quit IRC | 02:52 | |
| *** dstanek has joined #openstack-keystone | 02:53 | |
| *** ChanServ sets mode: +v dstanek | 02:53 | |
| *** boltR has joined #openstack-keystone | 02:53 | |
| *** dulek has joined #openstack-keystone | 02:54 | |
| *** mkoderer has joined #openstack-keystone | 02:55 | |
| *** ccard_ has joined #openstack-keystone | 02:55 | |
| *** spzala has quit IRC | 02:57 | |
| *** jbell8 has quit IRC | 02:57 | |
| *** jbell8 has joined #openstack-keystone | 02:58 | |
| stevemar | notmorgan: yeah that was released in 2.1.0 and reverted in 2.1.1 | 02:58 |
| *** dims has joined #openstack-keystone | 02:58 | |
| *** dims_ has joined #openstack-keystone | 03:01 | |
| *** pai15 has quit IRC | 03:03 | |
| *** dims has quit IRC | 03:03 | |
| *** _fortis has joined #openstack-keystone | 03:04 | |
| *** spandhe has quit IRC | 03:05 | |
| *** ekarlso has joined #openstack-keystone | 03:06 | |
| notmorgan | hmmm | 03:06 |
| notmorgan | ok so i need to look at everything in 2.0.0 and see what is horked | 03:06 |
| notmorgan | ugh | 03:06 |
| flwang1 | jamielennox: after your patch merged, how long we need to wait to get the release? | 03:07 |
| jamielennox | stevemar: ^ | 03:07 |
| notmorgan | flwang1: we need to submit a request to rel ream and then get the rel team to releawe... sometimes no more than a day. | 03:07 |
| notmorgan | depending on how broken/critical the fix is | 03:08 |
| *** roxanag__ has quit IRC | 03:08 | |
| flwang1 | notmorgan: that's cool | 03:08 |
| *** crinkle_ is now known as crinkle | 03:08 | |
| *** roxanagh_ has joined #openstack-keystone | 03:08 | |
| *** aginwala has quit IRC | 03:09 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Make project.domain_id column nullable https://review.openstack.org/264533 | 03:11 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Removes project.domain_id FK https://review.openstack.org/233274 | 03:11 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change project unique constraint https://review.openstack.org/158372 | 03:11 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain parameter to get_project_by_name https://review.openstack.org/210600 | 03:11 |
| *** aginwala has joined #openstack-keystone | 03:14 | |
| *** aginwala has quit IRC | 03:16 | |
| *** links has joined #openstack-keystone | 03:17 | |
| *** roxanagh_ has quit IRC | 03:18 | |
| *** ankita_wagh has joined #openstack-keystone | 03:21 | |
| *** daemontool has quit IRC | 03:30 | |
| *** oomichi has joined #openstack-keystone | 03:30 | |
| ayoung | jamielennox, I'll trade reviews with you. https://review.openstack.org/#/c/264260/ Is +417, -6I'll git you 423 Lines of review in exchange for it. | 03:33 |
| jamielennox | ayoung: i did say as was going to review this one | 03:34 |
| ayoung | that too. Plus it is the killer keystone feature for this release | 03:34 |
| ayoung | and it supports https://review.openstack.org/#/c/245629/ | 03:34 |
| stevemar | jamielennox: we gonna need a new ksm release? | 03:35 |
| jamielennox | stevemar: i think so | 03:35 |
| jamielennox | ayoung: if not CONF.token.infer_roles - we making this optional? | 03:36 |
| stevemar | jamielennox: for https://review.openstack.org/#/c/267277/ , booo | 03:36 |
| ayoung | jamielennox, yeah...it is a kill switch, | 03:36 |
| ayoung | jamielennox, and I wrote it that way so that we could, potentially, switch to expanded roles in policy files in the future | 03:37 |
| *** spzala has joined #openstack-keystone | 03:38 | |
| notmorgan | stevemar: oh nice | 03:41 |
| stevemar | notmorgan: what's nice, the fact that we broke everything? | 03:41 |
| notmorgan | yeah | 03:41 |
| notmorgan | :P | 03:41 |
| notmorgan | it's amazing | 03:41 |
| stevemar | spectacular | 03:42 |
| stevemar | *grumble grumble* | 03:42 |
| notmorgan | stevemar: so shade looks to be broken in 2.0.0 fwiw | 03:42 |
| notmorgan | stevemar: not just 2.1 or 2.2 | 03:42 |
| notmorgan | this is unfun. | 03:42 |
| stevemar | notmorgan: oh wow | 03:42 |
| stevemar | that's been out for months | 03:42 |
| notmorgan | yeah well the pip-freeze says the failure mordred reported was 2.0.0 | 03:42 |
| notmorgan | this is weird cause i mean... i was almost sure we run some things through gate post 2.0.0 for shade | 03:43 |
| * stevemar shrugs | 03:43 | |
| notmorgan | something has gone really sidewys. there are not fixes in 2.1 or .2.2 that should impact the object type shade is using | 03:43 |
| notmorgan | sooooooooooo | 03:43 |
| notmorgan | stevemar: also jamielennox and i rolled positional into a small independant lib | 03:44 |
| notmorgan | it's on pypi already | 03:44 |
| jamielennox | notmorgan: have you had a chance to test it? | 03:44 |
| stevemar | neat! | 03:44 |
| notmorgan | jamielennox: no :P | 03:44 |
| notmorgan | jamielennox: of course not | 03:44 |
| notmorgan | jamielennox: that would require me to not drink wine and stop watching TV and stop looking into shade failure | 03:44 |
| notmorgan | jamielennox: :( | 03:44 |
| jamielennox | notmorgan: it'd be a quick job compared to this implied roles review of ayoung's, this is going to take a while | 03:45 |
| notmorgan | jamielennox: really my issue is i'm digging into the shade + ksc ick | 03:46 |
| notmorgan | jamielennox: since that might be some ugly revert | 03:46 |
| notmorgan | and it's requiring some real chasing down. | 03:46 |
| ayoung | jamielennox, I love https://review.openstack.org/#/c/244472 but is it safe to yank the context out like that? Or is nothing using this yet? | 03:50 |
| notmorgan | ayoung: i'm sure it's fine :P | 03:50 |
| ayoung | notmorgan, its a work of pure art | 03:50 |
| ayoung | are is dangerous. | 03:51 |
| ayoung | art is dangerous. | 03:51 |
| notmorgan | jamielennox: i'm diving into ksm | 03:51 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Tests for projects acting as domains https://review.openstack.org/211219 | 03:51 |
| notmorgan | jamielennox: soon | 03:51 |
| notmorgan | jamielennox: you have an approach you want to seriously take on what we talked about the other day | 03:51 |
| jamielennox | ayoung: i don't think there's a problem with that one | 03:51 |
| notmorgan | jamielennox: cause i'm ready to just roll up thread.local fun ;) | 03:51 |
| jamielennox | ayoung: we're still constructing the context dict | 03:52 |
| notmorgan | and then hacking up ksa auth plugin to use it >.> | 03:52 |
| jamielennox | ayoung: ideally i want to pass around the request object instead, or maybe the oslo_context, just not that dict | 03:52 |
| * notmorgan shudders | 03:52 | |
| jamielennox | notmorgan: i haven't had time to pursue that one | 03:52 |
| notmorgan | oslo_context | 03:52 |
| notmorgan | shuuuudddddeerrrr | 03:52 |
| jamielennox | notmorgan: so oslo_context i have a few things for | 03:52 |
| notmorgan | ok | 03:53 |
| notmorgan | please make it better | 03:53 |
| flwang1 | jamielennox: i just updated a patch and let it depends on your patch, but seems it doesn't work | 03:53 |
| jamielennox | i wanted to replace oslo_context with the auth_token plugin obj but i don't think that's going to work | 03:53 |
| jamielennox | flwang1: you can't depends-on in a library | 03:53 |
| jamielennox | s/in/for | 03:53 |
| flwang1 | not sure if it's because the infra isn't so smart to get the correct keystonemiddle | 03:53 |
| jamielennox | or you couldn't last time i tried | 03:53 |
| flwang1 | oh | 03:54 |
| flwang1 | that makes sense | 03:54 |
| flwang1 | so we have to wait the fix release? | 03:54 |
| notmorgan | yeah you can't do a depends-on for a new lib | 03:54 |
| flwang1 | ok, got it | 03:54 |
| notmorgan | actually... can you depends-on for a g-r update? | 03:54 |
| notmorgan | i think that might work | 03:54 |
| notmorgan | but you'd need a release first | 03:54 |
| notmorgan | chicken-egg | 03:55 |
| notmorgan | flwang1: you could hack it and try it w/ a git:// url in requirements, but only locally | 03:55 |
| notmorgan | not in the gate itself | 03:55 |
| flwang1 | notmorgan: that's a good point, i will try it locally | 03:57 |
| *** browne1 has joined #openstack-keystone | 03:57 | |
| flwang1 | oh, wait, until it merged, i still can't get a valid url for the fix like git:// unless i download the patch to my local, right? | 03:58 |
| notmorgan | ayoung, jamielennox, stevemar: so i am moving on the ksm updates to offload keystone auth things. | 03:58 |
| notmorgan | flwang1: you could use the git:// from gerrit? or the http version [i'd have to look up the syntax] | 03:58 |
| openstackgerrit | ayoung proposed openstack/keystone: Use our own request in base wsgi class https://review.openstack.org/244472 | 03:59 |
| notmorgan | ayoung, jamielennox, stevemar: i am going to tack in a digest validator that can be enabled so for example haproxy can say "this is already valididated/auth" | 03:59 |
| ayoung | jamielennox, rebased it. +2 | 03:59 |
| jamielennox | notmorgan: what's the thing to say that it's ok to do from x import y passed hacking? | 03:59 |
| notmorgan | jamielennox: # noqa ? | 04:00 |
| notmorgan | i think | 04:00 |
| *** browne has quit IRC | 04:00 | |
| jamielennox | no there's a way to set it in hacking or tox or somewher | 04:00 |
| jamielennox | e | 04:00 |
| notmorgan | oh in tox.ini | 04:00 |
| notmorgan | you can do ignore https://github.com/morganfainberg/positional/blob/master/tox.ini#L35 | 04:01 |
| notmorgan | something like that | 04:01 |
| notmorgan | you just need to know the error to ignore | 04:01 |
| notmorgan | ayoung, jamielennox, stevemar: so i am looking at pushing a "if hmac(key, token_id) is valid" we don't ask keystone to validate if the proper headers are present (and don't strip headers). if ksm doesn't have an hmac key or headers are missing, normal validation occurs | 04:03 |
| notmorgan | any concerns with that kind of approach? | 04:04 |
| flwang1 | jamielennox: notmorgan: i'm going to log off to pick up my boy, thanks a lot for your help | 04:04 |
| notmorgan | the other thought was doing a TOTP implementation between edge and services so you can limit replay attacks. | 04:04 |
| flwang1 | really appreciate it | 04:04 |
| ayoung | notmorgan, its crap,. but you know that already. Go for it | 04:04 |
| notmorgan | but that seems overkill for edge -> service | 04:04 |
| jamielennox | flaper87: no problem - | 04:04 |
| notmorgan | ayoung: this is internal edge -> service stuff, *not* user -> cloud | 04:04 |
| flwang1 | jamielennox: flaper87 is my shadow :D | 04:05 |
| ayoung | notmorgan, I mean the token side of it...your part is fine | 04:05 |
| notmorgan | ayoung: right. you know what my long term goal is | 04:05 |
| jamielennox | flwang1: ah, woops | 04:05 |
| notmorgan | trying to kill tokens | 04:05 |
| notmorgan | but steps along the way :) | 04:05 |
| ayoung | notmorgan, https://review.openstack.org/#/c/245588/ | 04:05 |
| ayoung | But you have a better approach it sounds | 04:06 |
| jamielennox | notmorgan: you don't want to hmac the entire thing? | 04:06 |
| notmorgan | jamielennox: i could hmac all the headers | 04:06 |
| notmorgan | well except catalog cause.. no. | 04:07 |
| notmorgan | jamielennox: i was just thinking token_id cause it's lower cost to do so. | 04:07 |
| ayoung | notmorgan, userid, projectid, roles are the important part | 04:07 |
| jamielennox | i guess hmac(token_id) gives you authentication but not integrity | 04:07 |
| ayoung | auditId too probably | 04:07 |
| notmorgan | ayoung: if i expand beyond token_id, i'll do audit_ids instead of token_id | 04:07 |
| ayoung | and you need the timeout...so, yeah, everything but catalog | 04:07 |
| notmorgan | no don't need timeout | 04:07 |
| ayoung | notmorgan, otherwise two tokens will have same HMAC | 04:08 |
| ayoung | tokenid is OK as alternative | 04:08 |
| notmorgan | audit_id | 04:08 |
| ayoung | yep | 04:08 |
| notmorgan | :) | 04:08 |
| jamielennox | notmorgan: it depends on your concerns about intercept | 04:09 |
| notmorgan | jamielennox: the idea is that the edge will do the validation | 04:09 |
| notmorgan | from edge -> service i think it's a bit overkill | 04:09 |
| notmorgan | to do like totp or crazy levels of hmac on headers | 04:09 |
| notmorgan | if the edge to the service is compromised, we're kindof screwed | 04:09 |
| notmorgan | ayoung: your spec is along the lines of what i want to do, but i actually want to use a one time oauth to a given deploy [hence suburl] then use an http cookie | 04:10 |
| jamielennox | there's a replay attack as well | 04:10 |
| notmorgan | ayoung: aince the web-domain is consistent | 04:10 |
| jamielennox | notmorgan: i think the way i would do it is to convert everything to apache, do optional client cert auth in apache and don't strip headers/validate if the client cert is correct | 04:10 |
| notmorgan | can't do client cert from HAProxy | 04:10 |
| notmorgan | or similar | 04:10 |
| notmorgan | in many cases | 04:11 |
| notmorgan | i can validate a client cert, i just can't use one to talk to the backend servers | 04:11 |
| jamielennox | notmorgan: backend, why would you use one for backend? | 04:11 |
| notmorgan | many proxy/lbs suffer from the same limitation | 04:11 |
| notmorgan | jamielennox: this is meant to be an edge [ha-proxy] to service thing | 04:12 |
| notmorgan | not a user-> service thing | 04:12 |
| jamielennox | right, but it's not haproxy talking to other services, it's service->service | 04:12 |
| notmorgan | the user would still use tokens (for now) just the edge would auth validate not middleware | 04:12 |
| notmorgan | service would talk to HAProxy, since you still want sub-url | 04:12 |
| jamielennox | doesn't matter, the client cert would be from service->haproxy | 04:12 |
| notmorgan | riht | 04:13 |
| jamielennox | haproxy just needs to validate | 04:13 |
| notmorgan | and that is fine | 04:13 |
| notmorgan | i just need to make sure the service is sure it received the request from HAProxy | 04:13 |
| notmorgan | and HAProxy can't do a client cert | 04:13 |
| *** EinstCra_ has quit IRC | 04:13 | |
| ayoung | https://raymii.org/s/tutorials/haproxy_client_side_ssl_certificates.html looks like it is possible | 04:13 |
| *** EinstCrazy has joined #openstack-keystone | 04:13 | |
| jamielennox | notmorgan: typically haproxy passes on headers or something to indicate that it has validated the cert | 04:13 |
| notmorgan | ayoung: that validates the ssl cert from the end user | 04:13 |
| notmorgan | not haproxy to the backend. | 04:14 |
| jamielennox | notmorgan: haproxy -> (eg) n-api is assumed to be secured in another way | 04:14 |
| *** spandhe has joined #openstack-keystone | 04:14 | |
| ayoung | notmorgan, if HA Proxy is the safe boundary, then client cert to HAProxy is the right place to authenticate | 04:15 |
| jamielennox | there are things you can do there but not really a concern for now | 04:15 |
| notmorgan | so, the issue is likely that you'll have user->service and user->haproxy->service available. | 04:15 |
| jamielennox | notmorgan: these client certs would never be issued to users | 04:15 |
| notmorgan | i am just looking at letting the service have an extra layer of "yep haproxy sent this request" | 04:15 |
| notmorgan | jamielennox: long term i want to allow end users to use client certs too :P | 04:15 |
| jamielennox | notmorgan: ok, then you would need to also validate the issueing cert name or something to distinguish client from service | 04:16 |
| notmorgan | yeah | 04:16 |
| *** richm has quit IRC | 04:16 | |
| ayoung | notmorgan, you are one step ahead of me...yep agreed SSL/Client Cert from HA to app is a good approach | 04:16 |
| notmorgan | so is there no reason to provide a way to validate haproxy sent the request or it was passed via haproxy? | 04:16 |
| jamielennox | notmorgan: depends on your infrastructure i think | 04:17 |
| jamielennox | notmorgan: normally i think the HAProxy is the only one with an external ip | 04:17 |
| notmorgan | i mean, ideally i would use iptables and just lockout access to the apis | 04:17 |
| notmorgan | jamielennox: that is my end goal, but i am trying to also address the wierd mix deployments because osmeone will leave both things open | 04:18 |
| jamielennox | i know in big loadbalancers they have the edge router validate the public SSL cert then they have a seperate SSL system that authenticates the backend with the loadbalancer | 04:18 |
| notmorgan | yeah | 04:18 |
| jamielennox | that's how you maintain security without distributing the ssl key to each worker | 04:18 |
| jamielennox | i assume haproxy can do that - again it depends on layout as to whether its worth it | 04:19 |
| notmorgan | haprocxy can use TLS to the backend | 04:19 |
| notmorgan | it can't do client cert | 04:19 |
| notmorgan | unless i just circumvent haproxy totally [not what i want to do] | 04:19 |
| jamielennox | oh | 04:19 |
| jamielennox | i see what your saying | 04:20 |
| notmorgan | so you can validate a client cert at haproxy, you jsut can't use one to talk to the backend servers | 04:20 |
| notmorgan | most environments never need that | 04:20 |
| jamielennox | notmorgan: so i don't think you need to do client cert there? | 04:20 |
| notmorgan | in fact, many many many evironments wont SSL internally | 04:20 |
| jamielennox | internal CA loaded into haproxy | 04:20 |
| notmorgan | cause it's too expensive CPU wise, you can't pipeline anyway | 04:20 |
| jamielennox | TLS from haproxy -> backend | 04:21 |
| jamielennox | backend has SSL with a cert signed by CA | 04:21 |
| notmorgan | yeah. | 04:21 |
| notmorgan | standard simple TLS stuff | 04:21 |
| jamielennox | haproxy isn't issuing client cert requests just validating responses against specific CA | 04:21 |
| notmorgan | yep | 04:21 |
| notmorgan | also in most proxy envs. pipeline is bad cause you hold state | 04:22 |
| jamielennox | so i don't see that haproxy not issuing client cert requests is a problem | 04:22 |
| notmorgan | so a lot of envs wont even TLS interally | 04:22 |
| notmorgan | now, i have minor issue. i need to ensure we do normal token validate in the case a service doesn't something silly like talk directly to neutron | 04:23 |
| notmorgan | rather than going through haproxy | 04:23 |
| notmorgan | it's minor, but still need a way to be sure the connection came from haproxy | 04:23 |
| notmorgan | not say nova->neutron [i mean i can just reject too, i guess] | 04:24 |
| jamielennox | you'd check the presence of the client cert validation | 04:24 |
| jamielennox | oh, hmm | 04:24 |
| notmorgan | yeah. | 04:24 |
| notmorgan | it's an edge case for catching broken things | 04:24 |
| notmorgan | and allowing a roll to the new method | 04:25 |
| notmorgan | rather than needing it to be a "boom" big breaking change | 04:25 |
| jamielennox | http://security.stackexchange.com/questions/99553/using-separate-haproxy-and-api-tiers-how-can-i-ensure-a-request-came-from-hapro | 04:25 |
| notmorgan | yeah those two answers aren't really answers | 04:26 |
| jamielennox | reqadd isn't bad | 04:26 |
| notmorgan | right | 04:26 |
| notmorgan | i'm already working in lua i could do that there | 04:26 |
| jamielennox | i mean security by obscuring etc, but in practice it'd work | 04:27 |
| notmorgan | yeah this is the same thing i'm at now | 04:27 |
| notmorgan | reqadd is the same basically as where i'm at already | 04:27 |
| notmorgan | i was thinkgin HMAC only cause it is a digest rather than a plain-text thing | 04:28 |
| notmorgan | in case we accidently leak the data, you're not leaking the secret | 04:28 |
| notmorgan | i am also already stripping the magic headers when the request comes into haproxy | 04:28 |
| openstackgerrit | Merged openstack/oslo.policy: Run docs testenv by default with tox https://review.openstack.org/266591 | 04:29 |
| *** dims_ has quit IRC | 04:30 | |
| notmorgan | jamielennox: so i think it comes down to... is it worth even making this a digest? | 04:30 |
| jamielennox | notmorgan: i mean it's always safer as a digest, but you're always going to be putting keys somewhere | 04:32 |
| jamielennox | always a tradeoff | 04:32 |
| notmorgan | jamielennox: right, i'm asking cause it's stupid easy to match a header | 04:32 |
| notmorgan | it's a little more work to propose HMAC | 04:32 |
| jamielennox | notmorgan: for POC i'd just match the header | 04:32 |
| notmorgan | it;s a lot more work to use TOTP to prevent replay if we are really paranoid | 04:32 |
| notmorgan | this is partially POC and partially lining up what i'm proposing | 04:33 |
| jamielennox | more because it tells you if someone circumvented haproxy rather than it's great security | 04:33 |
| notmorgan | i could also just make it a plugable thing | 04:33 |
| *** ryanpetrello has quit IRC | 04:33 | |
| notmorgan | or plan to | 04:33 |
| notmorgan | because i have heard there is distinct interest in this a sa real deployment method from a couple places | 04:34 |
| jamielennox | for a real deploy i'd probably want to do more than header match | 04:36 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes KVS catalog backend https://review.openstack.org/158442 | 04:36 |
| openstackgerrit | David Stanek proposed openstack/keystone: WIP: better catalog tests https://review.openstack.org/267297 | 04:36 |
| *** ryanpetrello has joined #openstack-keystone | 04:38 | |
| jamielennox | notmorgan: positional works in ksa, you can unblock the g-r | 04:38 |
| notmorgan | yay | 04:38 |
| notmorgan | except i screwed something up in the g-r | 04:39 |
| notmorgan | looking | 04:39 |
| notmorgan | oh derp | 04:39 |
| notmorgan | and done | 04:40 |
| notmorgan | unblocked | 04:40 |
| notmorgan | feel free to +1 it | 04:40 |
| notmorgan | stevemar: could use your https://review.openstack.org/#/c/267270/ +1 there too | 04:41 |
| *** lhcheng has joined #openstack-keystone | 04:41 | |
| *** ChanServ sets mode: +v lhcheng | 04:41 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Use positional library instead of our own copy https://review.openstack.org/267300 | 04:42 |
| *** ryanpetrello has quit IRC | 04:43 | |
| *** RA_ has joined #openstack-keystone | 04:46 | |
| *** ankita_wagh has quit IRC | 04:49 | |
| *** ankita_wagh has joined #openstack-keystone | 04:50 | |
| stevemar | notmorgan: "from positional import positional" | 04:51 |
| stevemar | *facepalm* | 04:51 |
| jamielennox | stevemar: from pprint import pprint ? | 04:51 |
| stevemar | i suppose | 04:52 |
| stevemar | that has always been weird to me | 04:52 |
| jamielennox | otherwise it's @positional.positional() | 04:52 |
| notmorgan | not a good alternative | 04:52 |
| notmorgan | same thing w/ pprint | 04:52 |
| notmorgan | as jamielennox said | 04:52 |
| notmorgan | i mean @positonal.decorator would be the alternative | 04:53 |
| notmorgan | and i don't think that is particularly good | 04:53 |
| *** jasonsb has joined #openstack-keystone | 04:56 | |
| *** EinstCrazy has quit IRC | 04:57 | |
| *** oomichi is now known as oomichi_away | 04:58 | |
| *** ryanpetrello has joined #openstack-keystone | 05:00 | |
| *** EinstCrazy has joined #openstack-keystone | 05:01 | |
| *** ryanpetrello has quit IRC | 05:06 | |
| *** jbell8 has quit IRC | 05:07 | |
| *** lhcheng_ has joined #openstack-keystone | 05:07 | |
| *** vivekd has joined #openstack-keystone | 05:08 | |
| *** lhcheng has quit IRC | 05:09 | |
| *** oomichi_away has quit IRC | 05:10 | |
| *** itlinux has joined #openstack-keystone | 05:12 | |
| notmorgan | stevemar: henrynash also needs a bouncer | 05:14 |
| stevemar | i'll see what i can do | 05:15 |
| stevemar | notmorgan: did he register his nick with the nickserv? | 05:16 |
| *** shoutm has joined #openstack-keystone | 05:20 | |
| *** shoutm_ has quit IRC | 05:22 | |
| *** spzala has quit IRC | 05:23 | |
| *** spzala has joined #openstack-keystone | 05:24 | |
| *** Nirupama has joined #openstack-keystone | 05:26 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Deprecate the baseclient.Client https://review.openstack.org/258743 | 05:26 |
| openstackgerrit | Merged openstack/keystonemiddleware: Fix tests to work with keystoneauth1 2.2.0 https://review.openstack.org/267129 | 05:26 |
| *** jdennis has quit IRC | 05:28 | |
| *** spzala has quit IRC | 05:28 | |
| *** jdennis has joined #openstack-keystone | 05:29 | |
| *** gyee has quit IRC | 05:30 | |
| *** roxanagh_ has joined #openstack-keystone | 05:30 | |
| *** ankita_wagh has quit IRC | 05:34 | |
| *** roxanagh_ has quit IRC | 05:34 | |
| notmorgan | stevemar: no idea | 05:36 |
| notmorgan | stevemar: i think so | 05:36 |
| stevemar | notmorgan: any way i can check? | 05:36 |
| *** ankita_wagh has joined #openstack-keystone | 05:37 | |
| notmorgan | uhmm... | 05:37 |
| notmorgan | topol or henry? | 05:37 |
| notmorgan | cause.... | 05:37 |
| notmorgan | there is an easy way to test... | 05:38 |
| notmorgan | stevemar: 20.#openstack-keystone│05:38:34 UTC freenode -- | ChanServ (ChanServ@services.): 19 henrynash +Vt (#openstack-keystone) [modified 1y 8w 1d ago, on Nov 17 19:09:00 2014] | 05:38 |
| notmorgan | stevemar: henry is registered with nickserv as is topol | 05:39 |
| notmorgan | 19.##reboot-the-cloud │05:38:34 UTC freenode -- | ChanServ (ChanServ@services.): 18 topol_ +Vt (#openstack-keystone) [modified 1y 8w 1d ago, on Nov 17 18:35:52 2014] | 05:39 |
| stevemar | notmorgan: neato | 05:39 |
| notmorgan | stevemar: /msg chanserv flags #openstack-keystone | 05:40 |
| notmorgan | you should be able to see who can op/voice/etc on this channel | 05:40 |
| notmorgan | sinc ei added you to the op list | 05:40 |
| stevemar | neat | 05:41 |
| *** spandhe_ has joined #openstack-keystone | 05:42 | |
| *** spandhe has quit IRC | 05:43 | |
| *** spandhe_ is now known as spandhe | 05:43 | |
| stevemar | notmorgan: can you review the last of the liberty backports? https://review.openstack.org/#/c/256101/ | 05:44 |
| stevemar | notmorgan: also, we need to talk about dolphm's concerns about the validate domain bug | 05:44 |
| notmorgan | stevemar: i already responded unless he also responded since | 05:44 |
| openstackgerrit | Merged openstack/keystone: Fix incorrect signature in federation legacy V8 wrapper https://review.openstack.org/266559 | 05:45 |
| notmorgan | oh | 05:45 |
| notmorgan | i disagree with his assertion | 05:45 |
| notmorgan | we can't break behavior | 05:45 |
| notmorgan | plain and simple | 05:45 |
| lifeless | notmorgan: ++ | 05:45 |
| lifeless | notmorgan: +++ | 05:45 |
| notmorgan | we were broken before | 05:45 |
| lifeless | notmorgan: ++++ | 05:45 |
| notmorgan | it sucks | 05:45 |
| notmorgan | don't expect usernames to be unique | 05:45 |
| notmorgan | if you rely on usernames being unique and never check user_id... you're wrong | 05:46 |
| notmorgan | since we shipped and people deployed AND wrote systems around this broken behavior | 05:46 |
| notmorgan | so.. the answer is we have an ok to kill v2 keystone | 05:46 |
| notmorgan | even with the "don't ever remove APIs" sentiment from the TC and lots of folks | 05:47 |
| notmorgan | since we have known issues in v2 | 05:47 |
| notmorgan | so, we keep moving and we use it as a reason to encourage folks to use v3 | 05:47 |
| notmorgan | "v2 is bad, we know it's bad, sorry, here is why it is bad, don't do X" | 05:47 |
| notmorgan | people are relying on this behavior in production | 05:47 |
| notmorgan | lifeless: [see! I told you i'd hold that line, and as sucky as that line is... i want this to not break things even where it is sucky] | 05:49 |
| notmorgan | lifeless: also Hai! | 05:50 |
| *** jasonsb has quit IRC | 05:52 | |
| *** jaosorior has joined #openstack-keystone | 05:54 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/264346 | 05:54 |
| *** brad[] has quit IRC | 05:57 | |
| *** lhcheng_ has quit IRC | 06:01 | |
| *** lhcheng has joined #openstack-keystone | 06:01 | |
| *** ChanServ sets mode: +v lhcheng | 06:01 | |
| *** shoutm_ has joined #openstack-keystone | 06:02 | |
| *** shoutm has quit IRC | 06:03 | |
| *** vivekd has quit IRC | 06:03 | |
| *** henrynash has joined #openstack-keystone | 06:03 | |
| *** RA_ has quit IRC | 06:04 | |
| stevemar | henrynash: poke | 06:06 |
| *** itlinux has quit IRC | 06:09 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Removes KVS catalog backend https://review.openstack.org/158442 | 06:14 |
| *** aginwala has joined #openstack-keystone | 06:14 | |
| *** brad[] has joined #openstack-keystone | 06:15 | |
| stevemar | jamielennox: your patch is failing pep8: http://logs.openstack.org/77/267277/1/check/gate-keystonemiddleware-pep8/0091c2d/console.html#_2016-01-14_02_46_59_878 | 06:18 |
| jamielennox | stevemar: that doesn't sound like one of my patches | 06:18 |
| stevemar | jamielennox: https://review.openstack.org/#/c/267277/ | 06:18 |
| notmorgan | henrynash: oooooh i see a henrynash | 06:18 |
| notmorgan | henrynash: i need to bug you re @filterprotect | 06:19 |
| notmorgan | cause i think you're the only one who really understands it | 06:19 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Split oslo_config and list all opts https://review.openstack.org/267277 | 06:20 |
| *** vgridnev has joined #openstack-keystone | 06:20 | |
| jamielennox | stevemar: ^ | 06:20 |
| stevemar | jamielennox: weigh in on: https://review.openstack.org/#/c/255128/1 as well | 06:20 |
| stevemar | notmorgan: he is the ONLY ONE! | 06:21 |
| breton | yay, my name on 2 reverted patches tonight | 06:21 |
| notmorgan | stevemar: do you *really* get all the use of @filterprotected? | 06:21 |
| jamielennox | stevemar: umm, is that a normal thing? | 06:21 |
| notmorgan | stevemar: cause... | 06:22 |
| stevemar | jamielennox: look on like 246 | 06:22 |
| notmorgan | stevemar: it's a bit insane. | 06:22 |
| stevemar | notmorgan: oh hell no | 06:22 |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: Remove assignments when deleting a domain https://review.openstack.org/127433 | 06:22 |
| notmorgan | stevemar: i mean, i get most of it, but i need to 2x check :( | 06:22 |
| notmorgan | before i simply unwind it to an in-line .enforce | 06:22 |
| notmorgan | like it should hav ebeen | 06:22 |
| notmorgan | only cause the callback stuff is insanity | 06:22 |
| jamielennox | stevemar: i've really no idea where that came from | 06:23 |
| *** aginwala_ has joined #openstack-keystone | 06:23 | |
| jamielennox | and whether we want it on all 4xx errors | 06:23 |
| breton | stevemar: how do we support `truncated` in responses then? | 06:23 |
| stevemar | breton: i'm not sure, but i needed to unbreak the stable gates :( | 06:25 |
| breton | https://blueprints.launchpad.net/python-keystoneclient/+spec/return-request-id-to-caller this will also fail | 06:25 |
| stevemar | breton: i don't have an answer for you yet | 06:25 |
| *** aginwala has quit IRC | 06:26 | |
| stevemar | breton: maybe it's a special case where we return [] if no results | 06:26 |
| stevemar | that'll fix the tests, but not sure what the implications are for people using the library | 06:27 |
| *** aginwala has joined #openstack-keystone | 06:27 | |
| stevemar | cause it's returning an object now | 06:27 |
| stevemar | jamielennox: i figured you know the exceptions more than i did | 06:27 |
| breton | maybe do something like `class OurWrapper(list):` | 06:27 |
| stevemar | jamielennox: it is a real http header value | 06:27 |
| jamielennox | stevemar: i tried to make them sane but i mostly copied them from the oslo ones | 06:27 |
| jamielennox | stevemar: for all 4xx? | 06:28 |
| *** ankita_w_ has joined #openstack-keystone | 06:28 | |
| stevemar | jamielennox: probably not needed on all 400 | 06:30 |
| stevemar | breton: gotta dig up the patch, 1 sec | 06:30 |
| *** roxanagh_ has joined #openstack-keystone | 06:30 | |
| *** aginwala_ has quit IRC | 06:30 | |
| *** ankita_wagh has quit IRC | 06:32 | |
| *** roxanagh_ has quit IRC | 06:35 | |
| *** henrynash_ has joined #openstack-keystone | 06:35 | |
| *** ChanServ sets mode: +v henrynash_ | 06:35 | |
| *** ankita_w_ has quit IRC | 06:35 | |
| *** vivekd has joined #openstack-keystone | 06:37 | |
| *** markvoelker has quit IRC | 06:42 | |
| *** jaosorior has quit IRC | 06:42 | |
| *** jaosorior has joined #openstack-keystone | 06:43 | |
| *** aginwala has quit IRC | 06:43 | |
| *** aginwala has joined #openstack-keystone | 06:43 | |
| *** jaosorior has quit IRC | 06:45 | |
| *** jaosorior has joined #openstack-keystone | 06:46 | |
| *** spandhe has quit IRC | 06:49 | |
| davechen1 | notmorgan: you mean endpoint filter should be drepcated on master? | 06:49 |
| *** davechen1 is now known as davechen | 06:49 | |
| *** spandhe has joined #openstack-keystone | 06:50 | |
| *** gsilvis has quit IRC | 06:50 | |
| davechen | notmorgan: why? I saw marekd are still working on service provider filtering this cycle. | 06:50 |
| breton | yep, inheriting from the list kinda works | 06:50 |
| *** spandhe has quit IRC | 06:50 | |
| breton | but they are not strictly == | 06:50 |
| *** spandhe has joined #openstack-keystone | 06:51 | |
| *** browne1 has quit IRC | 06:52 | |
| *** gildub has quit IRC | 06:55 | |
| notmorgan | davechen: because endpoint filtering is awful. | 06:56 |
| davechen | marekd: not sure if you need change the router path or not., something like this (path=('/OS-EP-FILTER/projects/{project_id}''/service_providers/{sp_id}'),) | 06:56 |
| davechen | notmorgan, marekd: maybe, so I give marked a heads up, be careful then. :) | 06:58 |
| notmorgan | the SP filter is not the issue | 06:58 |
| notmorgan | it;s the ednpoint/catalog filter | 06:58 |
| notmorgan | SP filtering has different reasonings behind it - and SPs probably shouldn't have ended up inthe catalog (wrong choice but we need to live with it now) | 06:59 |
| *** mserngawy_ has quit IRC | 07:00 | |
| davechen | notmorgan: agreed, sp filtering implemented within ep filtering looks weird. | 07:00 |
| stevemar | jamielennox: how is http://logs.openstack.org/20/263920/2/check/gate-zaqar-python27/5829f73/testr_results.html.gz a keystonemiddleware bug? | 07:00 |
| davechen | they are not connected tightly. | 07:00 |
| breton | stevemar: return-request-id-to-caller will not fail because the wrapper is inherited from list | 07:00 |
| notmorgan | davechen: so i'm wanting to deprecate endpoint filter | 07:00 |
| notmorgan | davechen: especially since we have folks re-working how the catalog works | 07:00 |
| stevemar | breton: ++ | 07:01 |
| davechen | notmorgan: gotchar, i can work on it. | 07:01 |
| notmorgan | we shouldn't lock our sleves more into the current catalog | 07:01 |
| davechen | stevemar: ^ | 07:01 |
| notmorgan | davechen: i'd not worry too much we'll have more convos at the midcycle on this | 07:01 |
| stevemar | breton: my heart broke a little when i had to revert and release, cause i know you worked on it so hard :( | 07:01 |
| jamielennox | stevemar: that one doesn't look like our fault | 07:01 |
| stevemar | jamielennox: it was in the bug description | 07:01 |
| notmorgan | and i'm sure gyee_needs_a_boucer [seriously?! gyee too?!] will have a battle over endpoint filtering with me | 07:02 |
| stevemar | jamielennox: https://bugs.launchpad.net/keystonemiddleware/+bug/1533932 | 07:02 |
| openstack | Launchpad bug 1533932 in keystonemiddleware "Remove the deprecated opts from sample config breaking zaqar" [Critical,In progress] - Assigned to Jamie Lennox (jamielennox) | 07:02 |
| notmorgan | why does no one have a bouncer!? :P | 07:02 |
| breton | stevemar: nah, I'll re-propose it again, don't worry. Sorry for breaking the gate :) | 07:02 |
| stevemar | breton: it happens :) | 07:02 |
| stevemar | notmorgan: i may have set one up for henrynash | 07:02 |
| notmorgan | stevemar: LOL | 07:02 |
| davechen | notmorgan: depends on is there anyone still use it. | 07:02 |
| jamielennox | stevemar: http://logs.openstack.org/31/266831/3/check/gate-zaqar-python34/ed3cd90/testr_results.html.gz is the one i was shown on IRC | 07:03 |
| notmorgan | davechen: i am not advocating removing it, just deprecating it and when next-gen-catalog comes along, we don't re-implement it | 07:03 |
| stevemar | jamielennox: rgr | 07:03 |
| jamielennox | breton: it's a right of passage to jam the gate | 07:03 |
| stevemar | jamielennox: updated the gate | 07:04 |
| stevemar | err bug | 07:04 |
| notmorgan | breton: yeah if you've not wedged the gate at least once, you've not contributed enough | 07:04 |
| davechen | notmorgan: is there any substitution so far? | 07:04 |
| stevemar | notmorgan: LOL | 07:04 |
| stevemar | notmorgan: sad but true | 07:04 |
| notmorgan | davechen: for endpoint filtering? no ideally we would just stop supporting the concept | 07:05 |
| davechen | notmorgan: may need think more about it before other choices is given. | 07:07 |
| notmorgan | davechen: i don't think there should be an option for endpoint filtering | 07:08 |
| notmorgan | davechen: the catalog should not be mutable/change based on user/scope/auth | 07:08 |
| notmorgan | it's a discovery thing | 07:08 |
| stevemar | so long night-keystone, i'm calling it early today. keep the gates well guarded! | 07:10 |
| davechen | stevemar: sweet dreaming | 07:10 |
| *** oomichi has joined #openstack-keystone | 07:12 | |
| davechen | notmorgan: okay, let me see is there any decision made in the midcycle. ;-) | 07:13 |
| *** daemontool has joined #openstack-keystone | 07:14 | |
| *** gsilvis has joined #openstack-keystone | 07:18 | |
| *** daemontool has quit IRC | 07:22 | |
| *** roxanagh_ has joined #openstack-keystone | 07:31 | |
| *** lhcheng has quit IRC | 07:32 | |
| *** roxanag__ has joined #openstack-keystone | 07:34 | |
| *** aginwala has quit IRC | 07:34 | |
| *** ktychkova has quit IRC | 07:35 | |
| *** roxanagh_ has quit IRC | 07:36 | |
| *** ktychkova has joined #openstack-keystone | 07:38 | |
| *** spandhe has quit IRC | 07:39 | |
| *** jimbaker has quit IRC | 07:40 | |
| *** shoutm_ has quit IRC | 07:45 | |
| *** shoutm has joined #openstack-keystone | 07:46 | |
| *** vgridnev has quit IRC | 07:52 | |
| marekd | notmorgan: SPs are not in the catalog | 07:54 |
| *** belmoreira has joined #openstack-keystone | 07:55 | |
| *** henrynash_ has quit IRC | 07:56 | |
| Anticimex | so, having just run "pip install --upgrade python-openstackclient" (i.e. i have whatever was most recently released), i get "SSL: CERTIFICATE_VERIFY_FAILED". | 07:57 |
| Anticimex | i don't know if it worked before, but my systems trust store, /etc/ssl/certs/ does have the necessary ca certs. which begs me wondering if python-openstackclient avoids attempting to use that store by default? | 07:58 |
| Anticimex | i guess i can use OS_CACERT | 07:58 |
| Anticimex | and doh! my bad, had a lingering env variable set after switching between keystone endpoints | 07:59 |
| *** jaosorior has quit IRC | 08:05 | |
| *** vgridnev has joined #openstack-keystone | 08:13 | |
| *** RA_ has joined #openstack-keystone | 08:14 | |
| *** davechen1 has joined #openstack-keystone | 08:15 | |
| *** davechen1 has left #openstack-keystone | 08:15 | |
| *** davechen has quit IRC | 08:17 | |
| *** oomichi is now known as oomich_away | 08:22 | |
| *** jaosorior has joined #openstack-keystone | 08:24 | |
| *** vgridnev has quit IRC | 08:32 | |
| *** pnavarro has joined #openstack-keystone | 08:35 | |
| *** roxanag__ has quit IRC | 08:36 | |
| *** roxanagh_ has joined #openstack-keystone | 08:37 | |
| *** roxanagh_ has quit IRC | 08:42 | |
| *** markvoelker has joined #openstack-keystone | 08:43 | |
| *** fhubik has joined #openstack-keystone | 08:46 | |
| *** markvoelker has quit IRC | 08:48 | |
| *** e0ne has joined #openstack-keystone | 08:48 | |
| *** RA_ has quit IRC | 08:51 | |
| *** aj3 has joined #openstack-keystone | 08:54 | |
| *** aj3 has quit IRC | 08:54 | |
| *** martinus__ has joined #openstack-keystone | 08:57 | |
| *** jistr has joined #openstack-keystone | 09:03 | |
| *** fhubik has quit IRC | 09:08 | |
| *** ig0r_ has joined #openstack-keystone | 09:17 | |
| *** jamielennox is now known as jamielennox|away | 09:18 | |
| *** rm_work has quit IRC | 09:19 | |
| *** bigjools has quit IRC | 09:20 | |
| *** rm_work has joined #openstack-keystone | 09:20 | |
| *** bigjools has joined #openstack-keystone | 09:21 | |
| *** daemontool has joined #openstack-keystone | 09:23 | |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: Remove assignments when deleting a domain https://review.openstack.org/127433 | 09:25 |
| *** vgridnev has joined #openstack-keystone | 09:31 | |
| *** __zouyee has quit IRC | 09:37 | |
| *** oomich_away is now known as oomich | 09:39 | |
| *** ig0r_ has quit IRC | 09:41 | |
| *** markvoelker has joined #openstack-keystone | 09:44 | |
| *** mhickey has joined #openstack-keystone | 09:45 | |
| *** RA_ has joined #openstack-keystone | 09:45 | |
| *** markvoelker has quit IRC | 09:49 | |
| *** ajayaa has joined #openstack-keystone | 09:50 | |
| ktychkova | ayoung: Hi, are you around? | 09:56 |
| *** ajayaa has quit IRC | 10:00 | |
| *** ajayaa has joined #openstack-keystone | 10:01 | |
| *** jimbaker has joined #openstack-keystone | 10:01 | |
| *** jimbaker has quit IRC | 10:01 | |
| *** jimbaker has joined #openstack-keystone | 10:01 | |
| *** oomich is now known as oomich_away | 10:01 | |
| *** _zouyee has quit IRC | 10:03 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add wrapper classes for return-request-id-to-caller https://review.openstack.org/261188 | 10:04 |
| *** EinstCrazy has quit IRC | 10:10 | |
| *** ajayaa has quit IRC | 10:12 | |
| *** ajayaa has joined #openstack-keystone | 10:12 | |
| *** shoutm has quit IRC | 10:15 | |
| *** fhubik has joined #openstack-keystone | 10:17 | |
| *** fhubik has quit IRC | 10:21 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v2_0) https://review.openstack.org/267449 | 10:21 |
| *** fhubik has joined #openstack-keystone | 10:22 | |
| *** spzala has joined #openstack-keystone | 10:24 | |
| *** spzala has quit IRC | 10:29 | |
| *** aix has joined #openstack-keystone | 10:32 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3) https://review.openstack.org/267456 | 10:42 |
| *** aix has quit IRC | 10:52 | |
| *** vgridnev has quit IRC | 10:54 | |
| *** vgridnev has joined #openstack-keystone | 10:56 | |
| *** ktychkova has quit IRC | 10:56 | |
| *** _zouyee has joined #openstack-keystone | 11:04 | |
| *** dims has joined #openstack-keystone | 11:04 | |
| *** GB21 has joined #openstack-keystone | 11:05 | |
| *** RA_ has quit IRC | 11:07 | |
| *** ktychkova has joined #openstack-keystone | 11:13 | |
| *** GB21 has quit IRC | 11:15 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:25 | |
| *** roxanagh_ has joined #openstack-keystone | 11:26 | |
| *** roxanagh_ has quit IRC | 11:30 | |
| *** EinstCrazy has joined #openstack-keystone | 11:33 | |
| *** ericksonsantos has joined #openstack-keystone | 11:38 | |
| *** d0ugal has quit IRC | 11:40 | |
| *** markvoelker has joined #openstack-keystone | 11:45 | |
| *** markvoelker has quit IRC | 11:49 | |
| *** davechen has joined #openstack-keystone | 11:50 | |
| *** d0ugal has joined #openstack-keystone | 11:58 | |
| *** pauloewerton has joined #openstack-keystone | 12:11 | |
| *** vgridnev has quit IRC | 12:11 | |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 12:11 |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystone: API support for project cascade delete https://review.openstack.org/244248 | 12:13 |
| *** vgridnev has joined #openstack-keystone | 12:14 | |
| *** ajayaa has quit IRC | 12:16 | |
| *** ajayaa has joined #openstack-keystone | 12:16 | |
| *** fhubik is now known as fhubik_brb | 12:20 | |
| *** aix has joined #openstack-keystone | 12:22 | |
| *** raildo-afk is now known as raildo | 12:22 | |
| openstackgerrit | Dina Belova proposed openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 12:26 |
| *** davechen1 has joined #openstack-keystone | 12:41 | |
| *** davechen has quit IRC | 12:42 | |
| *** markvoelker has joined #openstack-keystone | 12:45 | |
| *** markvoelker has quit IRC | 12:50 | |
| openstackgerrit | Dina Belova proposed openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 12:57 |
| *** vgridnev has quit IRC | 12:57 | |
| *** vgridnev has joined #openstack-keystone | 12:59 | |
| *** doug-fish has joined #openstack-keystone | 13:01 | |
| *** doug-fish has quit IRC | 13:07 | |
| *** fawadkhaliq has quit IRC | 13:07 | |
| *** doug-fish has joined #openstack-keystone | 13:08 | |
| ayoung | ktychkova, http://adam.younglogic.com/2015/12/questions-about-keystone/ | 13:09 |
| *** fhubik_brb is now known as fhubik | 13:11 | |
| *** _zouyee has quit IRC | 13:12 | |
| *** doug-fish has quit IRC | 13:12 | |
| *** roxanagh_ has joined #openstack-keystone | 13:14 | |
| *** roxanagh_ has quit IRC | 13:18 | |
| ktychkova | ayoung: Could you give me more details for your comment here: https://review.openstack.org/#/c/259418/? Do you think that it is a bad idea to have another one enforcer? Could you please explain me alternative ways? | 13:21 |
| ayoung | ktychkova, I think it is a nawesome idea, just one that should not be tied to OpenStack | 13:22 |
| ayoung | ktychkova, the idea should be developed stand alone, and I would be surprised if the Apache project did not have such a library already | 13:22 |
| ktychkova | ayoung: Apache Fortress is one of possible interface here, solution is more general - OpenLDAP, AD.... | 13:24 |
| ayoung | ktychkova, and the application is also broader than just the OpenStack services | 13:24 |
| ayoung | think in terms of every single application running in the cloud and there you have it | 13:25 |
| *** markvoelker has joined #openstack-keystone | 13:25 | |
| *** browne has joined #openstack-keystone | 13:26 | |
| ktychkova | ayoung: I got your point. Could you explain in terms of architecture? So, we have permissions and they are stored in OpenLDAP. User is asking to list roles, how oslo.policy/keystone should check permissions? | 13:31 |
| *** doug-fish has joined #openstack-keystone | 13:31 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers and Projects associations https://review.openstack.org/264854 | 13:36 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Enable limiting in ldap for groups https://review.openstack.org/234849 | 13:37 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Enable limiting in ldap for users https://review.openstack.org/233070 | 13:37 |
| *** edmondsw has joined #openstack-keystone | 13:39 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Enable limiting in ldap for groups https://review.openstack.org/234849 | 13:40 |
| *** ninag has joined #openstack-keystone | 13:41 | |
| *** richm has joined #openstack-keystone | 13:42 | |
| *** dslev has joined #openstack-keystone | 13:48 | |
| *** browne has quit IRC | 13:48 | |
| *** Nirupama has quit IRC | 13:50 | |
| *** davechen1 has left #openstack-keystone | 13:52 | |
| *** dslev_ has joined #openstack-keystone | 13:54 | |
| *** dslev has quit IRC | 13:57 | |
| *** gordc has joined #openstack-keystone | 13:58 | |
| *** dslev_ has quit IRC | 14:00 | |
| *** vivekd has quit IRC | 14:06 | |
| samueldmq | ayoung: ahahaha | 14:10 |
| samueldmq | ayoung: I think I hear you talking about naked pings since I joined the community in 2013 :-) | 14:11 |
| ayoung | ktychkova, sorry...was dealing with other parts of life.... | 14:11 |
| ayoung | samueldmq, people learn by example. Some people got a bad example | 14:11 |
| samueldmq | ayoung: that's true, what I do (or try in most cases) is | 14:13 |
| samueldmq | ayoung: ping - about x,yz, let me know when you're available | 14:13 |
| ayoung | samueldmq, even that is better. | 14:13 |
| openstackgerrit | Harshada Mangesh Kakad proposed openstack/keystone-specs: Replace deprecated library function os.popen() with subprocess https://review.openstack.org/267590 | 14:14 |
| samueldmq | ayoung: because even if you're up at that time, perhaps you could be doing something different and can't change context :) | 14:14 |
| ayoung | samueldmq, at which point someone else that does know the issue at hand can answer. Bascially, ask the chat room, but put the name of the person you think knows the answer | 14:15 |
| ayoung | also, as much context as possible to help with the context switch | 14:15 |
| stevemar | nooo davechen isn't around | 14:15 |
| ayoung | samueldmq, BTW, would be good to get as many eyes as p[ossible on the Implied Roles reviews. https://review.openstack.org/#/c/264260/ espe | 14:16 |
| ayoung | especially | 14:16 |
| dstanek | ayoung: ping - i'll tell you more about it when you pong | 14:16 |
| samueldmq | dstanek: ahha | 14:16 |
| *** dslev has joined #openstack-keystone | 14:16 | |
| ayoung | dstanek, I suck at ping pong. | 14:16 |
| dstanek | ayoung: noted | 14:17 |
| samueldmq | ayoung: domain specifci roles is also in the scope for this cycle right , | 14:17 |
| ayoung | samueldmq, yes, and builds on that | 14:17 |
| ayoung | we have a long tree here, and I want to get it moving samueldmq | 14:17 |
| samueldmq | ayoung: cool, I think these 2 should be my priority for reviews | 14:17 |
| samueldmq | ayoung: as I've a good background on our assignment backend | 14:18 |
| ayoung | samueldmq, so backend, followed by API: https://review.openstack.org/#/c/242614/38 | 14:18 |
| ayoung | samueldmq, the changes are actually fairly small. | 14:18 |
| samueldmq | nice | 14:18 |
| samueldmq | btw, how do I see patches dependencies on this new gerrit ui? | 14:18 |
| ayoung | Its a crud interface, and then added to the roles backend the ability to expand the roles | 14:18 |
| ayoung | samueldmq, right side "related changes" | 14:19 |
| ayoung | "Same Topic" | 14:19 |
| samueldmq | are all of them in "related changes"? are they ordered? | 14:19 |
| ayoung | I think they are ordered properly. Sometimes it gets an older version of a patch if you are moving up the tree | 14:20 |
| samueldmq | yeah :-( | 14:20 |
| openstackgerrit | Harshada Mangesh Kakad proposed openstack/keystone-specs: Replace deprecated library function os.popen() with subprocess https://review.openstack.org/267590 | 14:21 |
| ayoung | samueldmq, I tend to just edit the URL to chop off the version number if it is specified | 14:22 |
| samueldmq | ayoung: me too, when after a couple of minutes I notice that I am looking at an older version that doesn't make sense anymore | 14:23 |
| ktychkova | ayoung: it isok :) You can answer when you have time. Please give me your vision how it should work. I'm afraid I didn't get it | 14:24 |
| ayoung | ktychkova, Are you going to the summit in Austin? | 14:25 |
| ktychkova | ayoung: I think, no, I'm not going | 14:26 |
| ayoung | ktychkova, pity...could have talked it over in depth....ok | 14:26 |
| *** dims has quit IRC | 14:26 | |
| ayoung | ktychkova, so, standard RBAC is, IIUC, not explicitly targetting "project" or any other namespace. Instead, roles are flat | 14:26 |
| ayoung | so insteaod "Admin" on "Demo" project you would end up with a role like "demo_admin" right? | 14:27 |
| ayoung | the "organization" is assumed to contain all of the roles | 14:27 |
| ktychkova | ayoung: yes, something like that | 14:28 |
| ayoung | ktychkova, so the Keystone model does not quite map to that. It is designed more for scale. The idea is that you set up "role on project" as a template, and then create a new projec.t HTne when you assign someone a role on that project, the access control is precanned | 14:29 |
| *** dims has joined #openstack-keystone | 14:30 | |
| ayoung | ktychkova, I do know that the LDAP model can support what we are doing in Keystone, as that is what the "soon to be deprcated" role assignment backend is doing now | 14:33 |
| ayoung | I think that what you are talking about would be handled via groups in the existing Identity backend. | 14:34 |
| ayoung | and could be done today by changing the binding | 14:34 |
| ktychkova | ayoung: the idea is not to replace keystone model, the idea is to have alternative for policy.json file | 14:35 |
| edmondsw | stevemar, why was https://review.openstack.org/#/c/230157/ abandoned? | 14:36 |
| ayoung | ktychkova, you could use the LDAP model you have there to generate a policy file. You still have an enforcment step required | 14:36 |
| samueldmq | FYI: keystone v3 only job for tempest is now gating; devstack already has it | 14:37 |
| *** petertr7_away is now known as petertr7 | 14:38 | |
| *** jdennis has quit IRC | 14:38 | |
| ktychkova | ayoung: yes, one opportunity is to generate a policy file. But do you think it is convinient to do it each time after changes? And BTW you have to restart keystone if you update policy.json file | 14:39 |
| ayoung | ktychkova, you would need to have a complete inventory of all the operations uploaded into LDAP...at which point you are basically doing an LDAP implementation of what I suggested with dynamic policy...which did not fly with the wider openstack community. I have another thoguth on that, but for later | 14:39 |
| *** browne has joined #openstack-keystone | 14:39 | |
| ayoung | you can releoad policy,json file without restarting Keystone, but we've not really had to work that hard at it. JSON is just the marshalling format, though. You would still need something like that for LDAP, or do an LDAP query on each access, which would kill LDAP with requests | 14:40 |
| samueldmq | stevemar: dstanek: bknudson_ regarding our "Setting up a keystone development environment" documentation | 14:40 |
| *** jistr has quit IRC | 14:40 | |
| dstanek | samueldmq: ? | 14:40 |
| samueldmq | I think https://review.openstack.org/#/c/246400 is a good improvement of it, I'd appreciate your views | 14:40 |
| samueldmq | dstanek: this ^ (you're quick) | 14:40 |
| breton | ayoung: as far as I understand the idea is to offload policy handling to LDAP | 14:40 |
| breton | > which would kill LDAP with requests | 14:40 |
| breton | why is that? 1 request to ldap per keystone request | 14:40 |
| breton | or per any request | 14:40 |
| *** jistr has joined #openstack-keystone | 14:41 | |
| ayoung | breton, any request | 14:41 |
| samueldmq | also https://review.openstack.org/#/c/253219/ should be an easy +2+A | 14:41 |
| samueldmq | ayoung: ^ | 14:41 |
| breton | ayoung: it's read operation. Shouldn't ldap work best for them? | 14:41 |
| ayoung | breton, it can be cached, but then you have the issue of cache invalidation...and all of that is what the policy mechanism is already there to perform, | 14:41 |
| ktychkova | ayoung, breton: I think I should do performance tests to be sure | 14:42 |
| *** jaosorior has quit IRC | 14:42 | |
| ayoung | breton, the real answer is that, for the vast majority of OpenStack deployements, LDAP is read only. No way to update, which means the mechanism is unusable. So we would end up reimplementing in SQL...which is the DYnamic policy proposal...but I'm not saying that is dead, just that there are pre-reqs to knock out first | 14:43 |
| dstanek | samueldmq: starred | 14:43 |
| samueldmq | dstanek: thanks | 14:43 |
| ayoung | it is really hard to have this conversation in IRC | 14:43 |
| *** jaosorior has joined #openstack-keystone | 14:43 | |
| breton | > No way to update, which means the mechanism is unusable. | 14:43 |
| breton | this | 14:43 |
| ayoung | breton, you going to Austin? I'm going to put together a future-of-policy session there (once again) | 14:43 |
| samueldmq | dstanek: btw, do you know what's all the official docs we have for keystone? | 14:43 |
| breton | why handle roles from OpenStack? | 14:43 |
| breton | ayoung: to midcycle no, to summit yes. | 14:44 |
| samueldmq | dstanek: I am aware of http://developer.openstack.org/api-ref.html and http://docs.openstack.org/developer/keystone/ | 14:44 |
| *** jaosorior has quit IRC | 14:44 | |
| ayoung | breton, so, at the summit. The short of it is that we need better policy handling, but I want to do that for the widest audience which means anything dynamic is going to have to be in SQL, not LDAP | 14:44 |
| *** jaosorior has joined #openstack-keystone | 14:45 | |
| ayoung | I also want to split policy enforcement into ROLE check whcih can be done in middleware and project-scope-check which will be done inside the Python code of the application | 14:45 |
| ayoung | so, the middleware check *could* get its data from LDAP, but I would still insist on it being transformed to JSON for that | 14:46 |
| *** GB21 has joined #openstack-keystone | 14:46 | |
| ayoung | also, the RBAC stuff as written up in that spec gets into what is in the token, not just the policy | 14:46 |
| dstanek | samueldmq: our identity-api docs too | 14:46 |
| ayoung | roles are assuigned to users, that is token stuff | 14:46 |
| breton | The idea behind handling this in LDAP is the same as with identity. If users are in LDAP, we suggest to manage them with an external tool. If roles are in LDAP, they will be managed extrenally too. | 14:46 |
| ayoung | that actualkly closely mimics what the assignement backend for LDAP does today | 14:46 |
| samueldmq | dstanek: https://specs.openstack.org/openstack/keystone-specs/ ? | 14:47 |
| stevemar | edmondsw: oct 4, 2015. i have no idea. | 14:47 |
| ayoung | breton, managed, yes, but it still needs to come through Keystone and be treated the same way as any other user, whcih means user + group. Period. You hage to understand that | 14:47 |
| ayoung | have | 14:47 |
| edmondsw | stevemar, lol... sorry, should have asked earlier | 14:48 |
| edmondsw | so... can we get it revived? | 14:48 |
| stevemar | edmondsw: i probably got frustrated | 14:48 |
| stevemar | sure | 14:48 |
| edmondsw | it was a big change, but it's also kinda important | 14:48 |
| stevemar | restored | 14:48 |
| stevemar | now to rebase... hmm | 14:48 |
| breton | stevemar: what's the problem to do that? Roles are simplier that users. | 14:49 |
| breton | oops, wrong hl | 14:49 |
| breton | ayoung: ^ | 14:49 |
| stevemar | ;) | 14:49 |
| dstanek | samueldmq: yes | 14:49 |
| breton | and there are systems that do better RBAC than we already have | 14:49 |
| ayoung | breton, ktychkova I think you guys do not really understand what Keystone is doing. You are proposing the same kuind of thing that I origianlly impklemented in Keystone 4years ago in the LDAP backend, but that is too limiting aview of things. You need to understand where Keystoen is today and then take it incrementally. | 14:49 |
| ayoung | it is the rare system that has writable access to LDAP where all of the users come out of LDAP. | 14:50 |
| ayoung | And even in those cases, you would not want assignement data coming out of LDAOP | 14:50 |
| *** jdennis has joined #openstack-keystone | 14:51 | |
| ayoung | so, while technically you could implement what you have proposed, it does not map to the problem space | 14:51 |
| breton | I am not talking about assignments and I don't understand what it has to do with write access | 14:51 |
| ayoung | add to that the fact that it only solves things for managing the openstack services, and not the applications running in the cloud, and you are targetting a vanishingly small problem | 14:52 |
| *** gordc has quit IRC | 14:52 | |
| *** links has quit IRC | 14:52 | |
| ayoung | breton, your propsal without write access you can;t change policy | 14:52 |
| breton | yep | 14:52 |
| samueldmq | dstanek: cool, thanks | 14:52 |
| breton | I don't want to change policy from OpenStack | 14:52 |
| breton | I want to change policy from external tool | 14:53 |
| breton | Apache Fortress, for example | 14:53 |
| ayoung | breton, you don't have access to that external tool | 14:53 |
| breton | why not? | 14:53 |
| ayoung | LDAP is read only. Not just friom OpenStack. F\rom an Operators perspective | 14:53 |
| ayoung | they don;'t own LDAP implementation | 14:53 |
| ayoung | they can only read it | 14:53 |
| *** gordc has joined #openstack-keystone | 14:54 | |
| ayoung | breton, 100000 person company. LDAP is managed by the HR dept and one part of IT. Openstack is owned by the devops group | 14:54 |
| ayoung | devops groups cannot write to LDAP | 14:54 |
| ayoung | thety can;t specify new object classes, trees, schemas, nor put any new data in there. It is an external resource. | 14:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 14:56 |
| breton | why would they do it if all classes, trees and schemas already there? And there is a ready RBAC system | 14:56 |
| *** Ephur has joined #openstack-keystone | 14:58 | |
| dstanek | breton: how would they get in there? | 15:00 |
| breton | dstanek: what do you mean by "there"? | 15:01 |
| openstackgerrit | Merged openstack/keystone-specs: Replace deprecated library function os.popen() with subprocess https://review.openstack.org/267590 | 15:01 |
| lbragstad | stevemar have a few minutes for oauth1 behavior questions? | 15:01 |
| stevemar | lbragstad: pfft, i haven't tried it in about a year, i'm pretty rusty, but i'll give it a go | 15:02 |
| *** roxanagh_ has joined #openstack-keystone | 15:02 | |
| lbragstad | stevemar switching the default provider to be fernet breaks 8 AuthTokenTests in test_v3_oauth1.py | 15:02 |
| dstanek | breton: you said the classes, trees and schemas might already be there | 15:02 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: document the bootstrapping process https://review.openstack.org/259730 | 15:04 |
| lbragstad | stevemar one of the ways its breaking is like this - http://cdn.pasteraw.com/iq5567jovafyyuguf0ig8tkx5bismza | 15:04 |
| breton | dstanek: by installation of Fortress | 15:04 |
| lbragstad | stevemar the strange thing is that fernet and uuid are using almost identical code paths for issuing v3 tokens | 15:05 |
| lbragstad | stevemar but - the fernet test cases fail getting the access_token_id from the auth_context here - https://github.com/openstack/keystone/blob/08ce1a504b73c3f95f60ea6fc990fbf19a8b8c0e/keystone/token/providers/common.py#L548 because oauth1 is still in the method names... where in uuid it isn't | 15:06 |
| dstanek | breton: i think ayoung's point is that the LDAP used by deployers isn't writable by them or other tools they install; and the people managing the LDAP instance don't want outside junk in it. | 15:06 |
| ayoung | dstanek, ++ | 15:07 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:07 | |
| ayoung | dstanek, to add to that idea | 15:07 |
| stevemar | lbragstad: i'm trying to remember why that line exists | 15:07 |
| breton | yes, I understood his point. | 15:07 |
| *** peter-hamilton has joined #openstack-keystone | 15:07 | |
| ayoung | if there is stuff in the LDAP server that we want to consume in OpenStack, it has to come through the existing mechanisms. | 15:07 |
| lbragstad | stevemar so I guess my question is - why the method_names don't have 'oauth1' for uuid tokens | 15:07 |
| dstanek | breton: that's why i was asking how those things would get there | 15:08 |
| *** roxanagh_ has quit IRC | 15:08 | |
| ayoung | so, if you want to manage policy from LDAP, use it to generate a policy.json file. | 15:08 |
| ayoung | If you want roles from LDAP to show up in the policy access enforcement, they have to be transformed to groups | 15:08 |
| *** mhickey has quit IRC | 15:09 | |
| stevemar | lbragstad: give me a few minutes to rethink how this all worked | 15:10 |
| dims | ayoung : breton and ktychkova are talking about a scenario where Apache Fortress is already there even before OpenStack was in the enterprise | 15:10 |
| lbragstad | stevemar ok | 15:11 |
| dims | ayoung : not that the scenario when someone is installing openstack and we ask them to install fortress because openstack needs it | 15:11 |
| breton | ayoung: > use it to generate a policy.json file | 15:11 |
| lbragstad | stevemar I assume these kinds of behaviors with fernet must be fixed before making it the default | 15:11 |
| breton | why if we can make policy check transparent for oslo.policy? | 15:11 |
| lbragstad | stevemar and - do you want a separate bug opened for each of these little things? | 15:11 |
| dims | ayoung : real life situation, there's a customer asking for it :) | 15:12 |
| breton | when oslo.policy is a thin wrapper around a REST call to Fortress which returns true/false | 15:12 |
| stevemar | lbragstad: so, looking at: http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-oauth1-ext.html#request-an-identity-api-token | 15:13 |
| *** ryanpetrello has joined #openstack-keystone | 15:13 | |
| stevemar | you set the methods block to 'oauth1' , but don't actually submit things in the body | 15:14 |
| stevemar | it's all about the headers, and everything is in there | 15:14 |
| ayoung | dims, then do what I just said | 15:14 |
| ayoung | dims, does fortress have a python library that can enforce access control? | 15:14 |
| breton | fortress has a REST api | 15:14 |
| ayoung | breton, so does my TOaster | 15:15 |
| stevemar | lbragstad: so where is this accees_token_id coming from... access_token_id = auth_context['access_token_id'] | 15:15 |
| dims | ayoung : " policy from LDAP, use it to generate a policy.json file"? | 15:15 |
| ayoung | REST API is just another way of saying "Make it some one elses problem" | 15:15 |
| ayoung | dims, or use a standard policy enforcement library, not something openstack specific | 15:15 |
| dims | ayoung : why the push back on an optional thing? esp from real world scenarios? | 15:16 |
| ayoung | dims, experience | 15:16 |
| lbragstad | stevemar it's passed in the auth_context (or built) in there somewhere | 15:16 |
| stevemar | lbragstad: here, it seems: https://github.com/openstack/keystone/blob/68b7c6c098bcec7635d3c17b7908643aad0bb638/keystone/common/authorization.py#L99 | 15:17 |
| lbragstad | stevemar the tests gets a token originally and then makes sure it can't be chained (OAuth-specific) | 15:17 |
| lbragstad | stevemar ah yes | 15:17 |
| dims | ayoung : i respect that but that's just one view | 15:17 |
| stevemar | lbragstad: whoa shouldn't 98 and 99 be indented :O | 15:18 |
| lbragstad | stevemar but when the first token (self.keystone_token_id) is received using fernet I believe the method_names = ['oauth1'] | 15:18 |
| ayoung | dims, because it shows a real lack of understanding about how the rest of Keystone and policy works. You throw something like that out there and then say "why not" when the fact is to get even the simplest thing done uin Keystoen requires a huge degree of consensus and coordination. | 15:18 |
| *** phalmos has joined #openstack-keystone | 15:19 | |
| dims | ayoung : we went all the way to dyanmic policies and then dialed it all the way back | 15:19 |
| lbragstad | stevemar when the test goes to chain self.keystone_token_id the method_names = ['oauth1', 'token'] | 15:19 |
| ayoung | dims, No. I've lived in this world exclusively for 4 years. It is \many many points of view shove into varisou of my orifii one at a time... | 15:19 |
| ayoung | dims, do you understand why? | 15:19 |
| ayoung | dims, do you understand why we dialed it back? | 15:19 |
| dims | ayoung : because no one needs it in real world | 15:19 |
| ayoung | No | 15:19 |
| * dims waits | 15:19 | |
| breton | ayoung: with REST API, yes, there is a call to enforce access control | 15:19 |
| ayoung | dims, because it did not map to how OpenStack needed it to work | 15:20 |
| stevemar | lbragstad: we should def make this change: http://paste.openstack.org/show/483894/ | 15:20 |
| lbragstad | stevemar which is different than what uuid shows - when doing that same exact thing with uuid, the method_names list doesn't actually have 'oauth1' | 15:20 |
| ayoung | the real issue with policy enforcvement is that it is doing two distinct things | 15:20 |
| ayoung | the easy part is RBAC | 15:20 |
| ayoung | but we can't even do that right now... | 15:20 |
| stevemar | lbragstad: hmm | 15:20 |
| lbragstad | stevemar let me try that quick and see what happens | 15:20 |
| ayoung | that is why I am, pushin on the implied roles spec | 15:20 |
| ayoung | without that, RBAC is hobbled | 15:20 |
| *** slberger has joined #openstack-keystone | 15:20 | |
| ayoung | but...even once we have that, we need to split the Role check from the scope check | 15:21 |
| dims | ayoung : i see | 15:21 |
| ayoung | the scope check is something that needs Nova specific knowledge in Nova, neutron in neutron and so on | 15:21 |
| breton | why reimplement RBAC when there is a system for RBAC authorization? | 15:21 |
| ayoung | so the only part that Dynamic policy can solve is the role check | 15:21 |
| ayoung | breton, because read up | 15:21 |
| ayoung | NIST RBAC assumes as sinlge organization | 15:21 |
| ayoung | OpenStack and Cloud needs something more scalable | 15:22 |
| *** doug-fish has quit IRC | 15:22 | |
| dims | ayoung : sounds like we should wait for the mid-cycle sprint :) | 15:22 |
| dims | and talk there | 15:22 |
| ayoung | and this is why you guys should have been participating in the policy discussions last summit. And if you are not in the one this summit, I will hunt you down on a hot summker day and put a fish in your collective cars. | 15:22 |
| ayoung | I can;t make it to the midcycle this year, unfortunatly | 15:22 |
| *** doug-fish has joined #openstack-keystone | 15:22 | |
| stevemar | lbragstad: give it a whirl, my brain has just started to wake up | 15:23 |
| dims | LOL, customer showed up after | 15:23 |
| *** spandhe has joined #openstack-keystone | 15:23 | |
| ayoung | dims, it is not going to happen this release anyway....AUstin at the Summit | 15:23 |
| ayoung | OK? | 15:23 |
| ayoung | dims, let me talk to him | 15:23 |
| lbragstad | stevemar fernet still fails with the key error | 15:23 |
| ayoung | or her | 15:23 |
| dims | ayoung : looking for a way forward, not necessary to be in this release | 15:23 |
| *** spzala has joined #openstack-keystone | 15:23 | |
| *** pai15 has joined #openstack-keystone | 15:23 | |
| *** mhickey has joined #openstack-keystone | 15:23 | |
| ayoung | ohm, I though you mean the customer just showed up at your site! | 15:23 |
| mnaser | some customers who are trying to create really large images in glance are failing because our the tokens are expiring during the upload. we're running the default expiration=3600 .. is there anything we should worry about if we increase it? | 15:24 |
| mnaser | and wasn't the default 1 day before, or is this me imagining things | 15:24 |
| dims | ayoung : we can setup a hangout with a couple of folks who can may be respond better :) if you are game | 15:24 |
| dolphm | mnaser: not unless your tokens are compromised | 15:24 |
| dolphm | mnaser: it was 24 hours before, yes | 15:24 |
| ayoung | dims, I'd be happy to. But you have to pay it forward | 15:25 |
| dims | ayoung : absolutely | 15:25 |
| ayoung | look at and understand what is going on with the main thrust here | 15:25 |
| ayoung | 1. implied roles | 15:25 |
| mnaser | dolphm: i see, thanks, anything to look out for if we decide to bring it back to 24 hours? | 15:25 |
| ayoung | 2. Split policy | 15:25 |
| mnaser | besides: make sure your tokens don't get compromised | 15:25 |
| ayoung | dims, and, if you can find a way to generate policy.json from apache fortress, pursue that | 15:26 |
| stevemar | mnaser: you may have to prune token table more often? dolphm can confirm | 15:26 |
| dims | ayoung : yep, we already did that prototype | 15:26 |
| mnaser | i think we have a nightly job for that already | 15:26 |
| mnaser | i think recent ubuntu packages drop something in cron.d to clean it up | 15:26 |
| ayoung | dims, but, the real benefit from fortress will be at hte App level, not at the OpenStack level. | 15:26 |
| stevemar | mnaser: then yeah, but sure they don't get compromised | 15:26 |
| *** jsavak has joined #openstack-keystone | 15:26 | |
| *** doug-fish has quit IRC | 15:27 | |
| dolphm | mnaser: stevemar: yeah, with UUID you'll have more valid tokens at once, so your token table will grow 24x | 15:27 |
| ayoung | dims, that is great. IS there a write up? Is it posted? | 15:27 |
| dims | anyone else interested in this topic? please let breton know | 15:27 |
| dolphm | if you switch back to a day | 15:27 |
| dims | ayoung : not yet. i believe ktychkova did the real work | 15:27 |
| mnaser | hmm, 4500 tokens at the moment, so it'll bring us up to 100k possibly | 15:28 |
| dims | breton : let's setup a hangout next week with folks? | 15:28 |
| breton | it was not generating of policy json, it was a rest query to fortress | 15:28 |
| ayoung | dims, So, how WOULD fortress work in a Federated deployment? | 15:28 |
| mnaser | i feel like this is a workaround and glance should have a better way of handling this issue :( | 15:28 |
| dims | ayoung : will line that up on the agenda :) | 15:28 |
| breton | it was not single call, but single call can be done too | 15:28 |
| breton | dims: yep | 15:29 |
| dims | breton : stefan mentioned generating a policy.json too | 15:29 |
| ktychkova | ayoung: https://review.openstack.org/#/c/244059/ | 15:29 |
| ktychkova | https://review.openstack.org/#/c/237521/ | 15:29 |
| ktychkova | Video demo: https://vimeo.com/143715477 | 15:29 |
| ktychkova | https://vimeo.com/146109801 | 15:29 |
| *** doug-fish has joined #openstack-keystone | 15:29 | |
| dims | ktychkova : thanks! | 15:30 |
| ayoung | dims, the short of it is that Federation is the way forward. OpenStack is a layer of policy that consumes external identity. I would love to be able to make use of Fortress in a solution based on that, but there are a lot of small steps. | 15:30 |
| *** spandhe has quit IRC | 15:30 | |
| breton | I don't see how fortress would not work in federated deployment | 15:30 |
| breton | they don't interfere at all | 15:31 |
| dims | ayoung : +1 all we are looking at is future direction | 15:31 |
| ayoung | breton, where does User_ID come from? | 15:31 |
| *** timcline has joined #openstack-keystone | 15:33 | |
| * breton thinks | 15:33 | |
| dims | breton : haha :) | 15:33 |
| dims | breton : so let's think this through before we burn up ayoung 's time :) | 15:34 |
| ayoung | ktychkova, BTW...lokingh at your WIP...can you use the HTTP check | 15:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 15:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Update v3policysample tests to use admin_project not special domain_id https://review.openstack.org/266617 | 15:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Fix indentation for oauth context https://review.openstack.org/267649 | 15:34 |
| *** doug-fish has quit IRC | 15:34 | |
| mnaser | i remember there was some performance regressions in fernet tokens in liberty.. are those still the case? | 15:34 |
| ayoung | and the REST API instead of doing wsomething LDAP specific ? | 15:34 |
| mnaser | speaking of fernet tokens.. lol | 15:34 |
| lbragstad | mnaser we did add some caching to the catalog and we have a patch up to add caching to role assignments | 15:35 |
| dolphm | lbragstad: it hasn't merged? | 15:35 |
| lbragstad | mnaser if we can land https://review.openstack.org/#/c/215715/ | 15:35 |
| mnaser | so on liberty, it's better to continue to stick uuid tokens for now | 15:35 |
| lbragstad | mnaser we should have both of those improvements in Mitaka | 15:35 |
| ayoung | https://review.openstack.org/#/c/244059/6/oslo_policy/_checks.py think about that from a dependency standpoint: you will have wired LDAP in to every service out there. If you really want this, use the HTTP check instead. It keeps things down to a single remote protocol. | 15:35 |
| dolphm | mnaser: "it depends" | 15:35 |
| dims | ayoung : good point | 15:36 |
| lbragstad | mnaser we are also actively trying to reduce the scope of revocation events - which also proved to be a painpoint of rebuilding the authorization context | 15:36 |
| mnaser | i see, and by "it depends" .. what would it depend on in that case? | 15:36 |
| dolphm | lbragstad: i'm also requesting OSIC hardware to do performance benchmarking on mitaka+fernet | 15:36 |
| mnaser | we quite rarely see things like revoked tokens on our cloud oddly enough.. people so very rarely do it | 15:36 |
| dolphm | mnaser: i think that's true for most deployments in the real world, unless it's under artificial load (i.e. tempest or some other test suite) | 15:37 |
| *** mhickey has quit IRC | 15:37 | |
| lbragstad | dolphm that would be awesome | 15:37 |
| *** EinstCrazy has quit IRC | 15:38 | |
| ktychkova | ayoung: It is possible to use http check, I am going to update patch, thank you for comment | 15:38 |
| *** pai15 has quit IRC | 15:38 | |
| mnaser | is there not another way to have glance contact/work with keystone without the token expiring (therefore maintaining our existing 1 hour token timeout)? | 15:39 |
| breton | ayoung: looks like it doesn't. And it won't work in a federated use case at all. | 15:39 |
| tjcocozz | ping stevemar | 15:40 |
| tjcocozz | stevemar, you were the first +2 on https://review.openstack.org/#/c/267590/ | 15:41 |
| * ayoung puts on Fargo accent | 15:41 | |
| ayoung | breton, well, there ya go! | 15:41 |
| stevemar | tjcocozz: what about? | 15:41 |
| * ayoung takes off Fargo accent as it does not really fit | 15:41 | |
| *** ngupta has joined #openstack-keystone | 15:41 | |
| tjcocozz | stevemar, you also +1 workflowed the patch | 15:41 |
| * dims bows to ayoung | 15:41 | |
| * ayoung leap frogs over dims back while he is bowing | 15:42 | |
| breton | yes, I haven't thought of federated use case. | 15:42 |
| stevemar | tjcocozz: saying there should have been another +2 on it? | 15:42 |
| ayoung | dims, now back to http://hairycode.org/2016/01/13/deploying-an-openstack-undercloudovercloud-on-a-single-server-from-my-laptop-with-ansible/ | 15:43 |
| tjcocozz | stevemar, I figure since everyone is have techinical problem with gerrit, i'd let you know. | 15:43 |
| *** ngupta has quit IRC | 15:44 | |
| stevemar | tjcocozz: no, i said screw it and invoked ptl powers. it's a doc change and we've had 4 of them in separate repos | 15:44 |
| stevemar | tjcocozz: 4 of the same changes | 15:44 |
| tjcocozz | stevemar, haha that makes sense. | 15:45 |
| dims | ayoung : neat thanks for the link | 15:45 |
| ayoung | dims, it is what my day job is paying me to beat on right now | 15:45 |
| stevemar | tjcocozz: the quicker these tiny patches go in, the better, as far as i'm concerned | 15:46 |
| *** ngupta has joined #openstack-keystone | 15:46 | |
| tjcocozz | stevemar, then people can't jump on the +1 bandwagon :-( | 15:46 |
| stevemar | tjcocozz: the bandwagon is leaving the station! | 15:47 |
| stevemar | tjcocozz: there are a lot more important changes to review :) | 15:47 |
| *** doug-fish has joined #openstack-keystone | 15:47 | |
| tjcocozz | stevemar, agreed! | 15:47 |
| *** phalmos has quit IRC | 15:48 | |
| *** itlinux has joined #openstack-keystone | 15:48 | |
| *** doug-fis_ has joined #openstack-keystone | 15:49 | |
| *** mhickey has joined #openstack-keystone | 15:49 | |
| *** petertr7 is now known as petertr7_away | 15:50 | |
| *** pai15 has joined #openstack-keystone | 15:50 | |
| *** ayoung has quit IRC | 15:52 | |
| *** doug-fish has quit IRC | 15:52 | |
| *** phalmos has joined #openstack-keystone | 15:59 | |
| *** GB21 has quit IRC | 16:00 | |
| *** petertr7_away is now known as petertr7 | 16:01 | |
| *** doug-fis_ has quit IRC | 16:01 | |
| *** doug-fish has joined #openstack-keystone | 16:01 | |
| *** doug-fish has quit IRC | 16:01 | |
| *** doug-fish has joined #openstack-keystone | 16:02 | |
| *** vgridnev has quit IRC | 16:03 | |
| *** phalmos has quit IRC | 16:03 | |
| *** roxanagh_ has joined #openstack-keystone | 16:04 | |
| *** vgridnev has joined #openstack-keystone | 16:04 | |
| *** vgridnev has quit IRC | 16:05 | |
| *** belmoreira has quit IRC | 16:06 | |
| *** doug-fish has quit IRC | 16:07 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity https://review.openstack.org/262045 | 16:07 |
| *** henrynash_ has joined #openstack-keystone | 16:09 | |
| *** ChanServ sets mode: +v henrynash_ | 16:09 | |
| *** roxanagh_ has quit IRC | 16:09 | |
| *** ayoung has joined #openstack-keystone | 16:09 | |
| *** ChanServ sets mode: +v ayoung | 16:09 | |
| *** petertr7 is now known as petertr7_away | 16:10 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:11 | |
| *** fawadkhaliq has quit IRC | 16:11 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:12 | |
| *** vivekd has joined #openstack-keystone | 16:12 | |
| *** tonytan4ever has joined #openstack-keystone | 16:14 | |
| *** lhinds has joined #openstack-keystone | 16:15 | |
| lbragstad | stevemar I think the access_token_id needs to be persisted in the fernet token | 16:15 |
| *** roxanagh_ has joined #openstack-keystone | 16:16 | |
| *** lhinds has quit IRC | 16:19 | |
| *** lhinds has joined #openstack-keystone | 16:20 | |
| *** lhinds is now known as LukeH | 16:20 | |
| *** LukeH has quit IRC | 16:21 | |
| *** doug-fish has joined #openstack-keystone | 16:23 | |
| *** fhubik is now known as fhubik_brb | 16:23 | |
| *** itlinux has quit IRC | 16:24 | |
| *** doug-fis_ has joined #openstack-keystone | 16:24 | |
| *** woodster_ has joined #openstack-keystone | 16:25 | |
| *** petertr7_away is now known as petertr7 | 16:25 | |
| *** vivekd has quit IRC | 16:26 | |
| *** doug-fish has quit IRC | 16:27 | |
| *** Guest77121 is now known as med_ | 16:28 | |
| *** med_ has quit IRC | 16:28 | |
| *** med_ has joined #openstack-keystone | 16:28 | |
| *** fhubik_brb is now known as fhubik | 16:28 | |
| *** doug-fis_ has quit IRC | 16:28 | |
| *** doug-fish has joined #openstack-keystone | 16:30 | |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: Remove assignments when deleting a domain https://review.openstack.org/127433 | 16:32 |
| *** spandhe has joined #openstack-keystone | 16:32 | |
| *** _zouyee has joined #openstack-keystone | 16:36 | |
| *** vivekd has joined #openstack-keystone | 16:37 | |
| stevemar | lbragstad: that'll suck | 16:38 |
| *** jorge_munoz1 has joined #openstack-keystone | 16:46 | |
| *** csoukup has joined #openstack-keystone | 16:48 | |
| jorge_munoz1 | In Keystone, in order to re-delegate a trust, whose token should be used to create the new trust? The trustee's trusted token? I get forbidden 403 when using a trustee's trusted token to create a new trust. | 16:50 |
| *** Guest99924 is now known as topol | 16:51 | |
| *** ChanServ sets mode: +v topol | 16:52 | |
| lbragstad | stevemar are access_token_id's unique to customer_ids? | 16:53 |
| stevemar | lbragstad: you mean consumer_ids? yes | 16:54 |
| *** pgbridge has joined #openstack-keystone | 16:54 | |
| *** vivekd has quit IRC | 16:54 | |
| lbragstad | stevemar yes - http://cdn.pasteraw.com/4xd2kazr2qxwlgjmj2ft05ysgouyzwl | 16:55 |
| lbragstad | i can retrieve the consumer id from the access token id? | 16:55 |
| lbragstad | i think i can? | 16:55 |
| stevemar | they are both uuids too | 16:55 |
| *** petertr7 is now known as petertr7_away | 16:57 | |
| *** pumaranikar has joined #openstack-keystone | 16:57 | |
| *** dslev has quit IRC | 16:58 | |
| *** rderose has joined #openstack-keystone | 17:00 | |
| *** spandhe has quit IRC | 17:01 | |
| *** pai15 has quit IRC | 17:04 | |
| *** dslev has joined #openstack-keystone | 17:06 | |
| *** pai15 has joined #openstack-keystone | 17:09 | |
| *** dslev has quit IRC | 17:09 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity https://review.openstack.org/262045 | 17:09 |
| *** pai15 has quit IRC | 17:10 | |
| *** pai15 has joined #openstack-keystone | 17:11 | |
| *** raildo is now known as raildo-afk | 17:12 | |
| *** pai15 has quit IRC | 17:12 | |
| *** pai15_ has joined #openstack-keystone | 17:13 | |
| *** pai15_ has quit IRC | 17:13 | |
| *** rderose has quit IRC | 17:15 | |
| *** pai15_ has joined #openstack-keystone | 17:15 | |
| *** pai15_ has quit IRC | 17:16 | |
| *** pai15_ has joined #openstack-keystone | 17:16 | |
| *** pai15_ has quit IRC | 17:17 | |
| *** pai15_ has joined #openstack-keystone | 17:18 | |
| *** pai15_ has quit IRC | 17:18 | |
| *** vgridnev has joined #openstack-keystone | 17:19 | |
| *** raildo-afk is now known as raildo | 17:20 | |
| *** gyee has joined #openstack-keystone | 17:22 | |
| *** ChanServ sets mode: +v gyee | 17:22 | |
| *** jistr has quit IRC | 17:29 | |
| *** lhinds has joined #openstack-keystone | 17:30 | |
| *** LukeH has joined #openstack-keystone | 17:31 | |
| *** jorge_munoz1 has quit IRC | 17:35 | |
| *** lhcheng has joined #openstack-keystone | 17:37 | |
| *** ChanServ sets mode: +v lhcheng | 17:37 | |
| *** e0ne has quit IRC | 17:40 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity https://review.openstack.org/262045 | 17:44 |
| *** LukeH has quit IRC | 17:46 | |
| *** ankita_wagh has joined #openstack-keystone | 17:48 | |
| dolphm | stevemar: keystone is missing deadlines on http://docs.openstack.org/releases/schedules/mitaka.html | 17:53 |
| *** jorge_munoz1 has joined #openstack-keystone | 17:54 | |
| *** tonytan4ever has quit IRC | 17:57 | |
| *** GB21 has joined #openstack-keystone | 17:59 | |
| *** mhickey has quit IRC | 18:00 | |
| lhcheng | would changing the error message on a method in backend driver require bumping up the driver? | 18:01 |
| *** daemontool has quit IRC | 18:01 | |
| lhcheng | been getting a legacy_driver test failure for a change in error message. :( | 18:01 |
| lhcheng | http://logs.openstack.org/79/265279/3/check/gate-keystone-tox-legacy_drivers/0d2d62c/console.html | 18:01 |
| stevemar | dolphm: hmm, okay, i can add | 18:03 |
| stevemar | dolphm: i figured if let empty, the defaults would apply | 18:04 |
| stevemar | dolphm: but i can make it explicit | 18:04 |
| dolphm | stevemar: there's no "default" for spec freeze, etc | 18:04 |
| stevemar | dolphm: k, i'll do it after i eat | 18:04 |
| dolphm | i don't think Cinder needed to put their feature freeze on the calendar though, for example | 18:05 |
| dolphm | (it's the same as the general feature freeze) | 18:05 |
| dolphm | stevemar: and mitaka-2 is our feature proposal freeze, right? i don't think any other projects have one on the calendar | 18:06 |
| *** fesp has joined #openstack-keystone | 18:09 | |
| *** _cjones_ has joined #openstack-keystone | 18:09 | |
| *** fesp has quit IRC | 18:09 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add release note for revert of c4723550aa95be403ff591dd132c9024549eff10 https://review.openstack.org/265024 | 18:12 |
| *** _cjones_ has quit IRC | 18:13 | |
| *** _cjones_ has joined #openstack-keystone | 18:13 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 18:15 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:19 | |
| *** jsavak has quit IRC | 18:20 | |
| *** tonytan4ever has joined #openstack-keystone | 18:20 | |
| *** spzala has quit IRC | 18:22 | |
| *** spzala has joined #openstack-keystone | 18:23 | |
| *** petertr7_away is now known as petertr7 | 18:24 | |
| openstackgerrit | Wang Bo proposed openstack/python-keystoneclient: Fix filter() returning list in python3 https://review.openstack.org/266787 | 18:25 |
| *** spzala has quit IRC | 18:27 | |
| *** _zouyee has quit IRC | 18:27 | |
| *** peter-hamilton has quit IRC | 18:32 | |
| *** jaosorior has quit IRC | 18:33 | |
| *** spandhe has joined #openstack-keystone | 18:34 | |
| *** jasonsb has joined #openstack-keystone | 18:36 | |
| *** ajayaa has quit IRC | 18:42 | |
| ayoung | If anyone wants to review Implied Roles and needs a walkthrough, I am more than willing to give it. https://review.openstack.org/#/c/264260/ | 18:45 |
| *** pnavarro has quit IRC | 18:47 | |
| *** e0ne has joined #openstack-keystone | 18:48 | |
| *** fhubik has quit IRC | 18:48 | |
| *** aix has quit IRC | 18:49 | |
| *** ankita_wagh has quit IRC | 18:50 | |
| *** ankita_wagh has joined #openstack-keystone | 18:51 | |
| *** peter-hamilton has joined #openstack-keystone | 18:53 | |
| *** Guest67265 has quit IRC | 18:54 | |
| dstanek | ayoung: you should audio (or video) record a walk through | 18:58 |
| notmorgan | dstanek: screencast! | 18:58 |
| ayoung | dstanek, notmorgan looks like you two just volunteered | 18:59 |
| dstanek | ayoung: i would if i knew all the information :-) | 18:59 |
| ayoung | dstanek, implied roles are pretty straight forwarsd | 19:00 |
| ayoung | if we create a rule that says admin implies member, when you assign someone admin, you implicitly assign them member as well | 19:00 |
| ayoung | we expand the rules when listing roles | 19:01 |
| ayoung | so, the first step was to get a migration in. I split that into a separate review to beat the race on the rebase chase | 19:01 |
| ayoung | dstanek, but pullimng up am erged revewi seems to be problematic at the moment...let me pull from git | 19:02 |
| ayoung | dstanek, http://git.openstack.org/cgit/openstack/keystone/commit/?id=008aee4789e63f3c08da7f0794276f6b5185ee77 | 19:02 |
| ayoung | its a two column table, a prior role implies an implied role | 19:03 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes KVS catalog backend https://review.openstack.org/158442 | 19:03 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removed deprecated revoke KVS backend https://review.openstack.org/267777 | 19:03 |
| *** tsymanczyk has joined #openstack-keystone | 19:04 | |
| *** tsymanczyk is now known as Guest87763 | 19:04 | |
| ayoung | dstanek, so the review https://review.openstack.org/#/c/264260/ can be thought of as two pieces, and maybe I should have split it this way. One is the driver CRD for the role inference rules. THe second is the changes to the assignment driver to expand them in the list | 19:04 |
| ayoung | dstanek, so the driver changes are pretty simple: | 19:04 |
| ayoung | https://review.openstack.org/#/c/264260/19/keystone/assignment/role_backends/sql.py | 19:04 |
| ayoung | CRD. No update required | 19:04 |
| ayoung | LDAP is not supported, so that file is no-ops | 19:05 |
| *** spandhe has quit IRC | 19:05 | |
| *** tonytan4ever has quit IRC | 19:11 | |
| *** lhcheng_ has joined #openstack-keystone | 19:11 | |
| dstanek | ayoung: i should have some time a little later to dive into that; is there prior art somewhere? | 19:11 |
| ayoung | dstanek, there is prior art, but it is not a direct map | 19:11 |
| *** lhcheng has quit IRC | 19:12 | |
| dstanek | ayoung: any references would be helpful, if any exist | 19:12 |
| *** tonytan4ever has joined #openstack-keystone | 19:12 | |
| ayoung | dstanek, http://git.openstack.org/cgit/openstack/keystone-specs/tree/specs/mitaka/implied-roles.rst see the bottom of the page | 19:13 |
| dstanek | ayoung: nice, thx | 19:14 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 19:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet work with oauth1 authentication https://review.openstack.org/267781 | 19:15 |
| *** fawadkhaliq has quit IRC | 19:17 | |
| *** Guest87763 has quit IRC | 19:17 | |
| *** spandhe has joined #openstack-keystone | 19:17 | |
| *** fawadkhaliq has joined #openstack-keystone | 19:17 | |
| *** fawadkhaliq has quit IRC | 19:19 | |
| *** tsymanczyk has joined #openstack-keystone | 19:20 | |
| *** tsymanczyk is now known as Guest29366 | 19:21 | |
| *** andrewbogott has left #openstack-keystone | 19:23 | |
| *** spzala has joined #openstack-keystone | 19:23 | |
| henrynash_ | lbragstad: feel free to +2/A https://review.openstack.org/#/c/266617/3 (especially as you need it !) | 19:27 |
| *** Guest29366 has quit IRC | 19:28 | |
| *** spzala has quit IRC | 19:29 | |
| *** roxanagh_ has quit IRC | 19:31 | |
| henrynash_ | lhcheng: what’s teh patch giving you that legacy error? | 19:31 |
| *** roxanagh_ has joined #openstack-keystone | 19:31 | |
| *** roxanagh_ has quit IRC | 19:33 | |
| *** jsavak has joined #openstack-keystone | 19:34 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Correct docstrings for federation driver interface https://review.openstack.org/264068 | 19:35 |
| *** spzala has joined #openstack-keystone | 19:36 | |
| lbragstad | henrynash_ will do - i'm working on the tests for https://review.openstack.org/#/c/267649/1 | 19:42 |
| henrynash_ | lbragstad: np, thx | 19:42 |
| lbragstad | henrynash thank you | 19:43 |
| *** tonytan4ever has quit IRC | 19:43 | |
| henrynash_ | lhchecng: ping | 19:44 |
| *** ayoung has quit IRC | 19:59 | |
| *** timcline has quit IRC | 20:00 | |
| *** spzala has quit IRC | 20:00 | |
| *** spzala has joined #openstack-keystone | 20:01 | |
| *** timcline has joined #openstack-keystone | 20:02 | |
| *** jasonsb has quit IRC | 20:03 | |
| *** spzala has quit IRC | 20:05 | |
| *** spzala has joined #openstack-keystone | 20:08 | |
| *** petertr7 is now known as petertr7_away | 20:08 | |
| *** gyee has quit IRC | 20:09 | |
| *** josecastroleon has quit IRC | 20:10 | |
| *** peter-hamilton has quit IRC | 20:10 | |
| *** henrynash_ has quit IRC | 20:11 | |
| *** josecastroleon has joined #openstack-keystone | 20:12 | |
| samueldmq | henrynash: this one https://review.openstack.org/#/c/265279/ | 20:14 |
| samueldmq | henrynash: it is the lhcheng_ 's patch failing with legacy tests | 20:14 |
| *** ayoung has joined #openstack-keystone | 20:16 | |
| *** ChanServ sets mode: +v ayoung | 20:16 | |
| *** petertr7_away is now known as petertr7 | 20:18 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 20:21 |
| stevemar | notmorgan: are you go for midcycle? | 20:21 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 20:22 |
| *** topol has quit IRC | 20:23 | |
| *** topol_ has joined #openstack-keystone | 20:25 | |
| *** topol_ is now known as Guest36370 | 20:25 | |
| *** timcline has quit IRC | 20:25 | |
| *** GB21 has quit IRC | 20:28 | |
| *** Guest36370 has quit IRC | 20:30 | |
| *** timcline has joined #openstack-keystone | 20:30 | |
| *** jsavak has quit IRC | 20:32 | |
| *** jsavak has joined #openstack-keystone | 20:32 | |
| *** spzala has quit IRC | 20:33 | |
| *** spzala has joined #openstack-keystone | 20:33 | |
| notmorgan | stevemar: haven't gotten to trying to book hotel etc | 20:35 |
| notmorgan | stevemar: still looking at it | 20:35 |
| notmorgan | stevemar: sorry | 20:35 |
| *** spzala has quit IRC | 20:38 | |
| *** spzala has joined #openstack-keystone | 20:39 | |
| *** ankita_wagh has quit IRC | 20:39 | |
| *** topol__ has joined #openstack-keystone | 20:40 | |
| *** topol__ has quit IRC | 20:41 | |
| *** zeus has quit IRC | 20:42 | |
| *** bigjools has quit IRC | 20:42 | |
| *** tsymanczyk has joined #openstack-keystone | 20:43 | |
| *** topol_ has joined #openstack-keystone | 20:44 | |
| *** ChanServ sets mode: +v topol_ | 20:44 | |
| *** tsymanczyk is now known as Guest25814 | 20:44 | |
| *** tonytan4ever has joined #openstack-keystone | 20:44 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 20:44 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Fix indentation for oauth context https://review.openstack.org/267649 | 20:44 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet work with oauth1 authentication https://review.openstack.org/267781 | 20:44 |
| stevemar | topol_: test | 20:44 |
| lbragstad | topol_ topol_ topol_ topol_ | 20:44 |
| *** _cjones_ has quit IRC | 20:44 | |
| topol_ | lbragstad: hush! | 20:44 |
| topol_ | :) | 20:44 |
| lbragstad | t | 20:45 |
| lbragstad | to | 20:45 |
| lbragstad | top | 20:45 |
| lbragstad | topol_ | 20:45 |
| lbragstad | it works! | 20:45 |
| *** bigjools has joined #openstack-keystone | 20:46 | |
| lbragstad | henrynash heads up - https://review.openstack.org/#/c/266617/3 | 20:46 |
| lbragstad | stevemar heads up - https://review.openstack.org/#/c/267649/2 | 20:46 |
| lbragstad | stevemar and - https://review.openstack.org/#/c/267781/2 | 20:46 |
| sigmavirus24 | stevemar: lbragstad what's going on with topol_ ? | 20:47 |
| lbragstad | sigmavirus24 i'm not sure what's up with topol_ | 20:47 |
| lbragstad | sigmavirus24 apparently topol_ needs testing | 20:47 |
| sigmavirus24 | lbragstad: why would topol_ need testing? | 20:47 |
| lbragstad | topol_ why do you need testing? | 20:48 |
| *** jasonsb has joined #openstack-keystone | 20:48 | |
| *** zeus has joined #openstack-keystone | 20:49 | |
| *** zeus is now known as Guest77946 | 20:50 | |
| topol_ | lbragstad stevemar your punching bag is now here online | 20:51 |
| topol_ | stevemar I'm gonna add changing my nickname to topol | 20:51 |
| *** topol_ is now known as topol | 20:52 | |
| stevemar | sigmavirus24: lbragstad maybe topol_ needs nesting? | 20:53 |
| stevemar | lbragstad: he ain't working as well as he used to :( | 20:53 |
| stevemar | lbragstad: even the best products starts showing signs of aging | 20:53 |
| stevemar | lbragstad: you'll be there one day, entering your 20s is the first step | 20:53 |
| stevemar | let me know when that happens | 20:53 |
| stevemar | topol_: do i look like i exercise with a punching bag? | 20:53 |
| stevemar | topol_: i will shutdown your VM | 20:53 |
| *** ankita_wagh has joined #openstack-keystone | 20:53 | |
| lbragstad | stevemar lol | 20:53 |
| topol | I'll be good | 20:54 |
| notmorgan | oh look topol is back | 20:55 |
| stevemar | notmorgan: please tease him relentlessly | 20:55 |
| topol | notmorgan just had a few opening night jitters | 20:56 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Bandit profile updates https://review.openstack.org/267810 | 20:57 |
| *** ngupta has quit IRC | 20:59 | |
| *** pauloewerton has quit IRC | 21:01 | |
| *** _cjones_ has joined #openstack-keystone | 21:02 | |
| *** vgridnev has quit IRC | 21:04 | |
| topol | lbragstad, notmorgan, stevemar someone in my hometown of melbourne won the powerball. Let me call my parents and see if I have to take your alls crap anymore... | 21:05 |
| topol | ... | 21:05 |
| topol | ... | 21:05 |
| lbragstad | topol are you friends with said person? ;) | 21:06 |
| topol | lbragstad, notmorgan stevemar rest easy they didnt win | 21:06 |
| *** jasonsb has quit IRC | 21:06 | |
| stevemar | lbragstad: his parents stopped being friends with him | 21:07 |
| lbragstad | awww #powerballfail | 21:07 |
| *** spzala has quit IRC | 21:07 | |
| *** spzala has joined #openstack-keystone | 21:08 | |
| topol | stevemar, lbragstad, notmorgan I believe it was someone who worked at the local publix grocery store. Im sure they are very excited | 21:08 |
| lbragstad | topol i can imagine ! | 21:09 |
| *** raildo is now known as raildo-afk | 21:09 | |
| lhcheng_ | henrynash: just got back, any idea on the legacy driver error (https://review.openstack.org/#/c/265279/) ? do I have to bump the driver version. | 21:12 |
| *** spzala has quit IRC | 21:12 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Replace deprecated library function os.popen() with subprocess https://review.openstack.org/266953 | 21:13 |
| *** ryanpetrello has quit IRC | 21:18 | |
| *** ayoung has quit IRC | 21:20 | |
| *** ryanpetrello has joined #openstack-keystone | 21:22 | |
| *** vgridnev has joined #openstack-keystone | 21:27 | |
| *** harlowja has quit IRC | 21:27 | |
| *** aix has joined #openstack-keystone | 21:28 | |
| *** Guest77946 has quit IRC | 21:28 | |
| *** zeus has joined #openstack-keystone | 21:30 | |
| *** zeus is now known as Guest16782 | 21:30 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 21:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet work with oauth1 authentication https://review.openstack.org/267781 | 21:34 |
| *** bigjools has quit IRC | 21:34 | |
| stevemar | notmorgan: ayoung? heads up that we still need to deprecate the ADMIN_TOKEN if you want to complete the bootstrapping bp | 21:35 |
| notmorgan | stevemar: when devstack change is merged | 21:35 |
| notmorgan | stevemar: otherwise i don't think we can mark it deprecated. | 21:35 |
| stevemar | notmorgan: pretty sure its gating or +2ed a bunch | 21:35 |
| notmorgan | aye | 21:35 |
| notmorgan | then yes :) | 21:35 |
| *** ankita_w_ has joined #openstack-keystone | 21:36 | |
| *** ankita_wagh has quit IRC | 21:36 | |
| *** bigjools has joined #openstack-keystone | 21:37 | |
| *** bigjools has quit IRC | 21:37 | |
| *** bigjools has joined #openstack-keystone | 21:37 | |
| *** stevemar changes topic to "Mitaka-2 Deadline Jan 19th!!!!! | Mitaka-2: https://launchpad.net/keystone/+milestone/mitaka-2 | MidCycle: https://wiki.openstack.org/wiki/Sprints/KeystoneMitakaSprint" | 21:39 | |
| *** stevemar changes topic to "Mitaka-2 deadline Jan 19th!!! | MidCycle: https://wiki.openstack.org/wiki/Sprints/KeystoneMitakaSprint | Mitaka-2: https://launchpad.net/keystone/+milestone/mitaka-2" | 21:39 | |
| stevemar | that was laggy | 21:39 |
| *** henrynash_ has joined #openstack-keystone | 21:40 | |
| *** ChanServ sets mode: +v henrynash_ | 21:40 | |
| stevemar | deadline!! review review review! | 21:40 |
| *** dims has quit IRC | 21:42 | |
| *** dims_ has joined #openstack-keystone | 21:42 | |
| notmorgan | stevemar: removing invalid bug from the milestone | 21:43 |
| notmorgan | https://bugs.launchpad.net/keystone/+bug/1276694 | 21:43 |
| openstack | Launchpad bug 1276694 in Sahara "Openstack services should support SIGHUP signal" [Medium,In progress] - Assigned to Sergey Lukjanov (slukjanov) | 21:43 |
| *** jsavak has quit IRC | 21:45 | |
| *** jamielennox|away is now known as jamielennox | 21:49 | |
| *** jsavak has joined #openstack-keystone | 21:50 | |
| *** ayoung has joined #openstack-keystone | 22:01 | |
| *** ChanServ sets mode: +v ayoung | 22:01 | |
| *** Guest25814 is now known as tsymanczyk | 22:02 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity https://review.openstack.org/262045 | 22:02 |
| tsymanczyk | In case anyone else is interested, I've written a python script to validate and clean up old role assignments. In our ~couple year old production environment running it last night ended up removing 3979 invalid role assignments. I assume we're not the only ones with that situation. | 22:03 |
| tsymanczyk | https://github.com/Symantec/KeystoneTools/tree/master/dead-role-cleanup | 22:03 |
| *** vgridnev has quit IRC | 22:08 | |
| *** spzala has joined #openstack-keystone | 22:08 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity https://review.openstack.org/262045 | 22:11 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add tests for role management with v3policy file https://review.openstack.org/261846 | 22:11 |
| *** spzala has quit IRC | 22:13 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 22:15 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add tests for role management with v3policy file https://review.openstack.org/261846 | 22:15 |
| *** e0ne has quit IRC | 22:15 | |
| *** gordc has quit IRC | 22:17 | |
| *** vgridnev has joined #openstack-keystone | 22:19 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: List assignments with names https://review.openstack.org/249958 | 22:24 |
| *** petertr7 is now known as petertr7_away | 22:24 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: List assignments with names https://review.openstack.org/249958 | 22:26 |
| *** petertr7_away is now known as petertr7 | 22:28 | |
| *** timcline has quit IRC | 22:29 | |
| *** Guest16782 is now known as zeus | 22:32 | |
| *** zeus has quit IRC | 22:32 | |
| *** zeus has joined #openstack-keystone | 22:32 | |
| *** ayoung has quit IRC | 22:37 | |
| lbragstad | dstanek did you ever pass me a diff of the notification thing you were talking about? | 22:42 |
| *** vgridnev has quit IRC | 22:42 | |
| *** petertr7 is now known as petertr7_away | 22:44 | |
| *** gildub has joined #openstack-keystone | 22:46 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for endpoint policy SQL driver https://review.openstack.org/212006 | 22:47 |
| *** harlowja has joined #openstack-keystone | 22:50 | |
| *** ninag has quit IRC | 22:53 | |
| *** ninag has joined #openstack-keystone | 22:54 | |
| *** dims_ has quit IRC | 22:54 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add CRUD support for domain specific roles https://review.openstack.org/261870 | 22:57 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules in the v3 policy sample for domain specifc roles https://review.openstack.org/262078 | 22:58 |
| *** ninag has quit IRC | 22:58 | |
| *** browne has quit IRC | 22:59 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:59 | |
| lhcheng_ | henrynash_: any idea on https://review.openstack.org/#/c/265279/ ? | 22:59 |
| henrynash_ | lhcheng_: looks to me like it is behaving as expected! You have changed the V9 driver and then written a test that checks that behavior…which will fail agains a V8 driver, which is exactly what the leagcy test failure is teilling you | 23:01 |
| *** doug-fish has quit IRC | 23:02 | |
| henrynash_ | lhcheng_: if you are Ok with your functionality not being present when running a V8 driver, then you should add an override to your test in the legacy federation test class | 23:02 |
| henrynash_ | lhcheng_: which is in tests/unit/backend/legacy_drivers/federation/V8 | 23:04 |
| *** jsavak has quit IRC | 23:05 | |
| *** e0ne has joined #openstack-keystone | 23:06 | |
| *** pumaranikar has quit IRC | 23:06 | |
| *** pumaranikar has joined #openstack-keystone | 23:06 | |
| lhcheng_ | henrynash_: great catch by the test! | 23:07 |
| *** pumaranikar has quit IRC | 23:07 | |
| henrynash_ | lhcheng_: that’s what they’re there for! | 23:07 |
| *** pumaranikar has joined #openstack-keystone | 23:07 | |
| *** jorge_munoz1 has quit IRC | 23:10 | |
| *** spzala has joined #openstack-keystone | 23:10 | |
| *** spzala has quit IRC | 23:10 | |
| *** spzala has joined #openstack-keystone | 23:10 | |
| *** ayoung has joined #openstack-keystone | 23:11 | |
| *** ChanServ sets mode: +v ayoung | 23:11 | |
| lhcheng_ | henrynash_: do you mean overriding the test method in legacy federation test class ? | 23:11 |
| *** pumaranikar has quit IRC | 23:12 | |
| lhcheng_ | henrynash_: wondering how to structure the test better for that - https://review.openstack.org/#/c/265279/3/keystone/tests/unit/test_v3_federation.py | 23:12 |
| lhcheng_ | henrynash_: perhaps would be better to add a new method that extends from test_check_idp_uniqueness(), and make it no-op for v8 driver? | 23:13 |
| henrynash_ | lhcheng_: typically what peopel have done (and we are early in this process) is have an override for the test in the legacy test class, in this case in FederatedIdentityProviderTestsV8 | 23:14 |
| lhcheng_ | henrynash_: alright, sounds good to me. | 23:16 |
| lhcheng_ | henrynash_: appreciate the help sir | 23:16 |
| henrynash_ | lhcheng_: yw….note that that there is a change in flight from me to to that legacy test file…hmm, thought it had alrady landed…..just adding tests for some of teh other fedeartion test classes | 23:17 |
| lhcheng_ | henrynash_: lets land it then :P | 23:18 |
| *** tsymanczyk has quit IRC | 23:19 | |
| henrynash_ | lhcheng_: np..it’s already landed | 23:20 |
| lhcheng_ | henrynash_: excellent | 23:20 |
| *** gyee has joined #openstack-keystone | 23:21 | |
| *** ChanServ sets mode: +v gyee | 23:21 | |
| *** henrynash_ has quit IRC | 23:22 | |
| *** dims has joined #openstack-keystone | 23:27 | |
| *** ninag has joined #openstack-keystone | 23:28 | |
| *** slberger has left #openstack-keystone | 23:29 | |
| *** ninag has quit IRC | 23:32 | |
| *** spzala has quit IRC | 23:36 | |
| *** spzala has joined #openstack-keystone | 23:36 | |
| *** tsymanczyk has joined #openstack-keystone | 23:39 | |
| *** tsymanczyk is now known as Guest93687 | 23:40 | |
| *** spzala has quit IRC | 23:41 | |
| *** henrynash_ has joined #openstack-keystone | 23:46 | |
| *** ChanServ sets mode: +v henrynash_ | 23:46 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify implied roles to honor domain specific roles https://review.openstack.org/263064 | 23:48 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules for domain specific role assignments https://review.openstack.org/263549 | 23:48 |
| *** e0ne has quit IRC | 23:49 | |
| henrynash_ | gyee: if you have a moment, could you take a look at: https://review.openstack.org/#/c/260335/ relatvely simple | 23:57 |
| *** csoukup has quit IRC | 23:59 | |
| *** Guest93687 has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!