| *** su_zhang has quit IRC | 00:04 | |
| *** su_zhang has joined #openstack-keystone | 00:05 | |
| *** roxanaghe has joined #openstack-keystone | 00:08 | |
| *** jamielennox is now known as jamielennox|away | 00:10 | |
| *** doug-fis_ has joined #openstack-keystone | 00:10 | |
| *** su_zhang has quit IRC | 00:12 | |
| *** su_zhang has joined #openstack-keystone | 00:12 | |
| *** daemontool_ has joined #openstack-keystone | 00:14 | |
| *** doug-fish has quit IRC | 00:15 | |
| *** daemontool has quit IRC | 00:15 | |
| *** dan_nguyen has joined #openstack-keystone | 00:16 | |
| *** nekrodesk has joined #openstack-keystone | 00:19 | |
| *** nekrodesk has quit IRC | 00:19 | |
| *** nekrodesk has joined #openstack-keystone | 00:21 | |
| *** nekrodesk has quit IRC | 00:21 | |
| lbragstad | dstanek yep - one sec | 00:21 |
|---|---|---|
| *** shoutm_ has joined #openstack-keystone | 00:26 | |
| *** shoutm has quit IRC | 00:28 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 00:29 |
| *** aginwala has quit IRC | 00:29 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 00:30 |
| *** csoukup_ has quit IRC | 00:30 | |
| *** nekrodesk has joined #openstack-keystone | 00:32 | |
| *** aginwala has joined #openstack-keystone | 00:32 | |
| *** aginwala has quit IRC | 00:33 | |
| *** aginwala has joined #openstack-keystone | 00:33 | |
| *** diazjf1 has quit IRC | 00:34 | |
| *** jasonsb has joined #openstack-keystone | 00:39 | |
| *** browne has quit IRC | 00:50 | |
| *** browne has joined #openstack-keystone | 00:52 | |
| *** shoutm has joined #openstack-keystone | 00:52 | |
| *** shoutm_ has quit IRC | 00:53 | |
| *** shoutm has quit IRC | 01:00 | |
| *** shoutm has joined #openstack-keystone | 01:01 | |
| *** ayoung has joined #openstack-keystone | 01:02 | |
| *** ChanServ sets mode: +v ayoung | 01:02 | |
| *** lhcheng has quit IRC | 01:09 | |
| *** aginwala has quit IRC | 01:10 | |
| *** aginwala has joined #openstack-keystone | 01:14 | |
| *** aginwala has quit IRC | 01:15 | |
| *** aginwala has joined #openstack-keystone | 01:15 | |
| *** alex_xu_ has quit IRC | 01:17 | |
| *** hideme has quit IRC | 01:18 | |
| *** gildub has quit IRC | 01:18 | |
| *** gildub has joined #openstack-keystone | 01:18 | |
| *** gildub has quit IRC | 01:19 | |
| *** browne has quit IRC | 01:20 | |
| *** gyee has joined #openstack-keystone | 01:21 | |
| *** ChanServ sets mode: +v gyee | 01:21 | |
| *** su_zhang has quit IRC | 01:24 | |
| *** alex_xu has joined #openstack-keystone | 01:25 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds warning when no domain configs were uploaded https://review.openstack.org/214287 | 01:25 |
| openstackgerrit | David Stanek proposed openstack/keystone: Extracts logic for finding domain configs https://review.openstack.org/279352 | 01:25 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds better logging to the domain config finder https://review.openstack.org/279353 | 01:25 |
| openstackgerrit | David Stanek proposed openstack/keystone: WIP refactor domain config upload https://review.openstack.org/279354 | 01:25 |
| dolphm | bknudson_: yes on catalog | 01:26 |
| dolphm | stevemar: there's not much yet, and there probably won't be too much ever | 01:26 |
| stevemar | dstanek: ty! | 01:27 |
| *** browne has joined #openstack-keystone | 01:28 | |
| dstanek | did someone add a turbo charger to the gate? | 01:32 |
| dstanek | it's almost like someone went ahead and pressed the NOS button | 01:33 |
| stevemar | dstanek: someone pushed the old turbo button on the server | 01:34 |
| stevemar | dstanek: http://i.imgur.com/NMary6v.png | 01:34 |
| *** jamielennox|away is now known as jamielennox | 01:34 | |
| stevemar | pokes bknudson_ | 01:37 |
| stevemar | bknudson_: i'm trying out your uwsgi patch, getting "-s/--socket option is missing and stdin is not a socket" problems | 01:37 |
| stevemar | omg uwsgi help output is so long, i think it's actually longer than osc's | 01:39 |
| dstanek | stevemar: i was thinking more like http://www.12voltguy.com/images/D/G61.JPG | 01:40 |
| *** aginwala has quit IRC | 01:43 | |
| *** drjones has quit IRC | 01:44 | |
| *** aginwala has joined #openstack-keystone | 01:50 | |
| *** harlowja has quit IRC | 01:55 | |
| *** clenimar has joined #openstack-keystone | 01:57 | |
| *** edmondsw has quit IRC | 01:57 | |
| *** clenimar has quit IRC | 01:57 | |
| *** Guest47583 has quit IRC | 02:06 | |
| *** jbell8 has joined #openstack-keystone | 02:22 | |
| *** spandhe has quit IRC | 02:23 | |
| *** aginwala has quit IRC | 02:26 | |
| *** aginwala has joined #openstack-keystone | 02:30 | |
| *** r-daneel has quit IRC | 02:32 | |
| *** browne has quit IRC | 02:33 | |
| *** shoutm_ has joined #openstack-keystone | 02:47 | |
| *** diazjf has joined #openstack-keystone | 02:48 | |
| *** shoutm has quit IRC | 02:48 | |
| *** dave-mccowan has quit IRC | 02:54 | |
| *** aginwala has quit IRC | 02:57 | |
| *** jbell8 has quit IRC | 02:57 | |
| *** aginwala has joined #openstack-keystone | 03:00 | |
| *** diazjf has quit IRC | 03:01 | |
| *** aginwala has quit IRC | 03:02 | |
| *** mylu has quit IRC | 03:03 | |
| *** su_zhang has joined #openstack-keystone | 03:09 | |
| *** gyee has quit IRC | 03:09 | |
| *** dan_nguyen has quit IRC | 03:09 | |
| *** dims has quit IRC | 03:11 | |
| *** dims has joined #openstack-keystone | 03:11 | |
| *** nekrodesk has quit IRC | 03:13 | |
| *** andrewbogott has quit IRC | 03:15 | |
| *** andrewbogott has joined #openstack-keystone | 03:15 | |
| *** mylu has joined #openstack-keystone | 03:15 | |
| openstackgerrit | Merged openstack/keystone-specs: Change token method https://review.openstack.org/277908 | 03:17 |
| *** doug-fis_ has quit IRC | 03:19 | |
| ayoung | jamielennox, ok, so I have found that if I do not explicitly set OS_IDENTITY_API_VERSION, I can't run `openstack domain list` | 03:19 |
| ayoung | I can use a versions AUTH URL but need to specify the version. Is that what you would expect? | 03:20 |
| *** doug-fish has joined #openstack-keystone | 03:21 | |
| *** doug-fish has quit IRC | 03:21 | |
| stevemar | ayoung: that's expected behavior | 03:24 |
| jamielennox | ayoung: right, so consider the IDENTITY_API_VERSION independant of the auth plugin | 03:26 |
| jamielennox | you can use a v3 token to do v2 operations etc | 03:26 |
| ayoung | jamielennox, I did not specify an auth plugin | 03:27 |
| ayoung | I specified OS_PASSWORD | 03:27 |
| ayoung | I'm guessing that does it implicitly? | 03:27 |
| stevemar | ayoung: is this bug still valid? https://bugs.launchpad.net/keystone/+bug/1539766 | 03:27 |
| openstack | Launchpad bug 1539766 in OpenStack Identity (keystone) "trust redelegation allows trustee to create a trust (with impersonation set to true) from a redelegated trust (with impersonation set to false)" [High,In progress] - Assigned to Jorge Munoz (jorge-munoz) | 03:27 |
| jamielennox | ayoung: so OSC does a bunch of hacks depending on what you give it | 03:27 |
| stevemar | or did we decide that it's working as expected | 03:27 |
| jamielennox | ayoung: i think it's using the password plugin underneath so it's doing discovery on whatever url you give it | 03:27 |
| jamielennox | so if you give it a /v2.0 url it will do v2 auth | 03:28 |
| ayoung | stevemar, gah...can't parse | 03:28 |
| ayoung | I gave it a versionless URL | 03:28 |
| ayoung | export OS_AUTH_URL=http://192.0.2.18:5000/ | 03:28 |
| ayoung | does it then use the service catalog? | 03:28 |
| jamielennox | yep, so it'd do discovery and do the best it can | 03:28 |
| jamielennox | ayoung: no, GET $OS_AUTH_URL | 03:28 |
| ayoung | and we default to V2? | 03:28 |
| stevemar | jamielennox: let me know when you have a few minutes, wanted to chat about the keystone libraries | 03:29 |
| jamielennox | ayoung: OS_IDENTITY_API_VERSION defaults to "2" | 03:29 |
| jamielennox | stevemar: sure | 03:29 |
| jamielennox | stevemar: whenever | 03:29 |
| stevemar | jamielennox: wanted to go over the open changes and bugs of the libraries in preparation for mitaka-3 | 03:30 |
| stevemar | so... ksc open changes: https://review.openstack.org/#/q/project:openstack/python-keystoneclient+status:open | 03:30 |
| ayoung | OK | 03:30 |
| jamielennox | ooo, we +2ed deprecate session | 03:31 |
| jamielennox | +Aed | 03:31 |
| ayoung | Your welcome | 03:31 |
| *** dims has quit IRC | 03:31 | |
| ayoung | did I do that? | 03:31 |
| ayoung | I meant to, anyway | 03:31 |
| stevemar | oh samuel did | 03:31 |
| *** links has joined #openstack-keystone | 03:32 | |
| stevemar | hmm, jamielennox i thought we wanted to deprecate in newton | 03:32 |
| *** csoukup has joined #openstack-keystone | 03:32 | |
| ayoung | deprecate early and often | 03:32 |
| *** roxanaghe has quit IRC | 03:32 | |
| stevemar | ayoung: well, i'm thinking from the pov of a consuming service, we *just* got folks moved over to session | 03:33 |
| jamielennox | i like it samueldmq, get the controversial stuff through :) | 03:33 |
| stevemar | now they have to move over the auth | 03:33 |
| jamielennox | stevemar: it's possibly going to raise some warnings in unexpected places | 03:33 |
| ayoung | I'm still wondering about the whole Puppet Nova V3 thing, WHy it worked before they moved to KSA but not after | 03:33 |
| stevemar | novaclient and neutronclient moved over | 03:33 |
| stevemar | those are the two big guys | 03:34 |
| jamielennox | stevemar: i was thinking more about the things using like session.load_from_conf_options etc | 03:34 |
| ayoung | stevemar, looking at the trust bug you posted above looks like a valid bug, and a nasty one | 03:34 |
| jamielennox | like nova and neutron rather than the clients | 03:34 |
| *** dave-mccowan has joined #openstack-keystone | 03:35 | |
| jamielennox | stevemar: regarding https://review.openstack.org/#/c/278027 | 03:35 |
| stevemar | jamielennox: y, thoughts? | 03:36 |
| jamielennox | stevemar: i think the best thing we can do there is not print non-str data, there have been versions of this patch before | 03:36 |
| jamielennox | but there are lots of subtle py2/py3 issues | 03:36 |
| jamielennox | but an example of binary data you might be posting would be an ISO image to glance | 03:36 |
| jamielennox | and you're going to come across problems if you try to log it to disk | 03:36 |
| jamielennox | i think we should do if headers.get('Content-Type') in ('application/json', 'text/html'): logger.debug(data) | 03:37 |
| jamielennox | otherwise just don't log it | 03:38 |
| stevemar | jamielennox: i'm coming at all of these from a "is it going to mess things up late in the game" point of view | 03:38 |
| stevemar | if it's even a little contentious, and unnecessary, it's not getting in | 03:38 |
| jamielennox | i don't think that ones dangerous, i just think people are trying to be too clever in maintaining behaviour | 03:38 |
| stevemar | ah | 03:38 |
| stevemar | yeah, that's a lot of debug calls | 03:39 |
| jamielennox | the old behaviour's not that good, just fix it | 03:39 |
| ayoung | Does anyone know how to use puppet-keystone to add a user without also setting up Keystone at the same time? | 03:39 |
| stevemar | ayoung: puppet people will know | 03:39 |
| jamielennox | no idea | 03:39 |
| ayoung | stevemar, You;d think so | 03:39 |
| * stevemar looks at the tests of that patch | 03:40 | |
| ayoung | I am really getting tired of puppet's spooky actions at a distance approach | 03:40 |
| *** gildub has joined #openstack-keystone | 03:40 | |
| stevemar | jamielennox: it looks safe | 03:40 |
| stevemar | jamielennox: i'm +2 | 03:41 |
| openstackgerrit | Merged openstack/python-keystoneclient: Deprecate Session https://review.openstack.org/258692 | 03:41 |
| openstackgerrit | Merged openstack/python-keystoneclient: Deprecate auth plugins from keystoneclient https://review.openstack.org/258693 | 03:42 |
| stevemar | jamielennox: the request id bits is a lot to look at right now, so skip taht for now | 03:42 |
| openstackgerrit | Merged openstack/python-keystoneclient: Deprecate adapter https://review.openstack.org/258742 | 03:42 |
| ayoung | mfisch, do you know how to use Keystone Puppet module in "apply" mode to add a user without also setting up Keystone, or destroying and existing install? | 03:42 |
| stevemar | jamielennox: what about https://review.openstack.org/#/c/254154/ ? | 03:42 |
| stevemar | jamielennox: all the ones older than feb 5 can wait and bit rot :) | 03:43 |
| ayoung | I have the same problem with the Apache module. I want to add the Federation information for /etc/httpd/ Added class('apache:') and the pup[pet apply wiped out all the old config | 03:44 |
| stevemar | jamielennox: err we need a release note for the deprecations | 03:45 |
| *** browne has joined #openstack-keystone | 03:45 | |
| *** dan_nguyen has joined #openstack-keystone | 03:45 | |
| stevemar | i'll write something up | 03:46 |
| jamielennox | stevemar: ok, +A | 03:46 |
| *** woodster_ has quit IRC | 03:46 | |
| jamielennox | stevemar: for https://review.openstack.org/#/c/254154/ - what were they doing that they hit that? | 03:48 |
| openstackgerrit | Merged openstack/keystonemiddleware: Remove except Exception handler https://review.openstack.org/268553 | 03:48 |
| jamielennox | like i get the problem - but why on earth would you have a character like that in a key value? | 03:48 |
| stevemar | jamielennox: that's what i asked (refer to my only comment) | 03:49 |
| stevemar | jamielennox: i'll make a release note and release ksc on monday, i don't anticipate any more work going into it for this release | 03:50 |
| stevemar | this should give us runway in case something funky happens | 03:50 |
| *** ebalduf has joined #openstack-keystone | 03:51 | |
| *** csoukup has quit IRC | 03:51 | |
| jamielennox | stevemar: ok, i put on a similar comment | 03:52 |
| jamielennox | yea, i'm scared by all these request-id changes | 03:53 |
| jamielennox | i've never seen someone pull of a complete across all clients change like that successfully | 03:53 |
| stevemar | jamielennox: yeah, i don't want to be the guinea pig | 03:54 |
| stevemar | that can wait til N imo | 03:54 |
| jamielennox | stevemar: what happens to revocations when PKI goes away? | 03:56 |
| jamielennox | stevemar: see https://review.openstack.org/#/c/260196/4/keystoneclient/v3/tokens.py | 03:56 |
| jamielennox | stevemar: also this should be fine: https://review.openstack.org/#/c/271120/ | 03:57 |
| *** nekrodesk has joined #openstack-keystone | 03:58 | |
| *** nekrodesk has quit IRC | 03:58 | |
| stevemar | jamielennox: i'm not ready for the revoke one just yet | 03:59 |
| stevemar | that one scares me | 03:59 |
| *** Nirupama has joined #openstack-keystone | 03:59 | |
| stevemar | +W on the endpoint override | 03:59 |
| jamielennox | stevemar: i'm not looking for code, just conceptually - does it just go away? | 03:59 |
| jamielennox | ayoung: 6 | 03:59 |
| jamielennox | ayoung: ^ | 03:59 |
| ayoung | 6! | 04:00 |
| ayoung | reading | 04:00 |
| ayoung | jamielennox, " happens to revocations when PKI goes away?" | 04:00 |
| jamielennox | ayoung: yea | 04:00 |
| ayoung | jamielennox, OK, so the revocation list can go away, too | 04:00 |
| ayoung | the events are used for fernet | 04:00 |
| ayoung | and we can drop 90% of them | 04:00 |
| jamielennox | ayoung: why do we care about publishing events for fernet? | 04:01 |
| ayoung | because instead of revoking upone, say, domain deactivate, we just won;t mark those tokens as valid | 04:01 |
| jamielennox | ayoung: _publishing_ | 04:01 |
| ayoung | jamielennox, passsword change, explicit token revoke. Need to persist those | 04:01 |
| ayoung | no publishing required | 04:01 |
| *** nekrodesk has joined #openstack-keystone | 04:01 | |
| ayoung | only used inside Keystone | 04:01 |
| jamielennox | ayoung: keystone will need to track events, but i don't see that we need to publish revocation events | 04:01 |
| *** shoutm has joined #openstack-keystone | 04:01 | |
| ayoung | right | 04:02 |
| ayoung | all that can stop | 04:02 |
| jamielennox | sweet | 04:02 |
| ayoung | jamielennox, oh yes | 04:02 |
| jamielennox | it just seems to remove so much pain for like 2 years i can't believe it just goes away | 04:02 |
| jamielennox | i thought i was overlooking something | 04:02 |
| ayoung | jamielennox, we went a different direction | 04:02 |
| ayoung | PKI was going to do what we ended up doing with SAML for K2K | 04:03 |
| ayoung | Of course, K2K doesn't have revoations | 04:03 |
| ayoung | and PKI never should have either | 04:03 |
| ayoung | but, whatever | 04:03 |
| *** shoutm_ has quit IRC | 04:03 | |
| jamielennox | ayoung: right - but that's not our fault :) the best part about standards | 04:03 |
| ayoung | I've learned a thing or two about delegation since then. Best to check it live. | 04:03 |
| ayoung | Authentication can be long lived, so long as the delegation check is synchronos | 04:04 |
| jamielennox | ok, i'm pretty sure auth_token middleware has been doing revocation wrong all along | 04:04 |
| ayoung | and you check delegation/authorization when the action occurs | 04:04 |
| ayoung | Heh | 04:04 |
| ayoung | almost certainly | 04:04 |
| openstackgerrit | Merged openstack/keystone: Enables token_data_helper tests for Python3 https://review.openstack.org/278055 | 04:04 |
| jamielennox | yep, cause we check and fetch revocations regardless of type or anything | 04:05 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: add release notes for deprecated auth bits https://review.openstack.org/279374 | 04:05 |
| stevemar | jamielennox: https://review.openstack.org/#/c/279374/ | 04:05 |
| stevemar | jamielennox: anything in ksa you think are a must for mitaka? https://review.openstack.org/#/q/project:openstack/keystoneauth+status:open | 04:05 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 04:06 |
| jamielennox | stevemar: nope, even the endpoint_override expansion is a nice-to-have | 04:06 |
| stevemar | jamielennox: yeah, not much went in since last release: https://github.com/openstack/keystoneauth/compare/2.2.0...master | 04:06 |
| stevemar | would still be nice to have it out | 04:07 |
| jamielennox | stevemar: yep - that doesn't mean you can't release | 04:07 |
| jamielennox | stevemar: https://review.openstack.org/#/c/255661/ should be a safe change | 04:09 |
| jamielennox | stevemar, ayoung: and i would really like https://review.openstack.org/#/c/267277/ to go in before a middleware release | 04:10 |
| *** su_zhang has quit IRC | 04:11 | |
| stevemar | jamielennox: what about https://review.openstack.org/#/c/220509/ | 04:13 |
| stevemar | jamielennox: okay | 04:14 |
| stevemar | we can get those in | 04:14 |
| stevemar | jamielennox: middleware has A LOT of commits | 04:14 |
| jamielennox | stevemar: put a -1 on https://review.openstack.org/#/c/220509 | 04:16 |
| stevemar | jamielennox: well, not a lot, but ... a lot of changes that could cause issues | 04:16 |
| jamielennox | stevemar: we removed all my good issue changing commits | 04:17 |
| jamielennox | issue causing | 04:17 |
| stevemar | jamielennox: bknudson_ -1'ed https://review.openstack.org/#/c/255661/ | 04:18 |
| jamielennox | stevemar: yep, but it was over the need for a bug number, i replied but it hasn't moved | 04:18 |
| jamielennox | stevemar: i don't mind waiting for bknudson_ to clear it | 04:19 |
| stevemar | oh, meh | 04:19 |
| *** dan_nguyen has quit IRC | 04:21 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/278907 | 04:23 |
| *** mylu has quit IRC | 04:24 | |
| openstackgerrit | Tin Lam proposed openstack/keystone: Removing H405 violations from keystone https://review.openstack.org/278190 | 04:26 |
| *** dave-mccowan has quit IRC | 04:28 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Handle exception on UnicodeDecodError in logging of request https://review.openstack.org/278027 | 04:37 |
| openstackgerrit | Merged openstack/keystoneauth: Allow parameter expansion in endpoint_override https://review.openstack.org/271120 | 04:42 |
| *** spandhe has joined #openstack-keystone | 04:45 | |
| *** mylu has joined #openstack-keystone | 04:48 | |
| jamielennox | stevemar: so stevemar about the OSC proposal - i'm not trying to remove things from the root namespace | 04:52 |
| jamielennox | well, not entirely | 04:52 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Dynamic RBAC Policy https://review.openstack.org/279379 | 04:57 |
| *** jbell8 has joined #openstack-keystone | 04:58 | |
| *** mylu_ has joined #openstack-keystone | 05:05 | |
| *** jbell8 has joined #openstack-keystone | 05:08 | |
| *** browne has quit IRC | 05:08 | |
| *** browne has joined #openstack-keystone | 05:08 | |
| *** charz_ has quit IRC | 05:09 | |
| *** mylu has quit IRC | 05:09 | |
| *** pumaranikar has quit IRC | 05:09 | |
| *** ebalduf has quit IRC | 05:09 | |
| *** dtroyer has quit IRC | 05:09 | |
| *** comstud has quit IRC | 05:10 | |
| *** mgagne has quit IRC | 05:10 | |
| *** hockeynut has quit IRC | 05:10 | |
| *** roxanaghe has joined #openstack-keystone | 05:10 | |
| *** roxanaghe has quit IRC | 05:10 | |
| *** nekrodesk has quit IRC | 05:10 | |
| *** dtroyer has joined #openstack-keystone | 05:11 | |
| *** rm_work has quit IRC | 05:11 | |
| *** stevemar has quit IRC | 05:11 | |
| *** hughsaunders has quit IRC | 05:11 | |
| *** hockeynut has joined #openstack-keystone | 05:12 | |
| *** roxanaghe has joined #openstack-keystone | 05:12 | |
| *** pumaranikar has joined #openstack-keystone | 05:12 | |
| *** charz has joined #openstack-keystone | 05:12 | |
| *** mgagne has joined #openstack-keystone | 05:12 | |
| *** mgagne is now known as Guest3687 | 05:12 | |
| *** stevemar has joined #openstack-keystone | 05:13 | |
| *** ChanServ sets mode: +o stevemar | 05:14 | |
| *** hughsaunders has joined #openstack-keystone | 05:17 | |
| *** rm_work has joined #openstack-keystone | 05:18 | |
| *** comstud has joined #openstack-keystone | 05:18 | |
| *** chlong has quit IRC | 05:19 | |
| *** jaosorior has joined #openstack-keystone | 05:20 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Deprecate class AuthTokenPlugin properly https://review.openstack.org/220509 | 05:23 |
| *** boris-42 has quit IRC | 05:24 | |
| *** vgridnev has joined #openstack-keystone | 05:24 | |
| *** su_zhang has joined #openstack-keystone | 05:25 | |
| *** aginwala has joined #openstack-keystone | 05:25 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: update deprecation message to indicate when deprecations were made https://review.openstack.org/220509 | 05:30 |
| stevemar | jamielennox: ^ if you're inclined | 05:31 |
| *** chlong has joined #openstack-keystone | 05:33 | |
| *** shoutm has quit IRC | 05:39 | |
| *** chlong has quit IRC | 05:42 | |
| *** shoutm has joined #openstack-keystone | 05:45 | |
| *** roxanaghe has quit IRC | 05:48 | |
| openstackgerrit | Merged openstack/keystone: refactor: Remove unused test method https://review.openstack.org/255559 | 05:51 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 05:53 |
| *** chlong has joined #openstack-keystone | 05:54 | |
| *** mylu_ has quit IRC | 05:57 | |
| *** aginwala has quit IRC | 06:01 | |
| *** mylu has joined #openstack-keystone | 06:01 | |
| *** mylu has quit IRC | 06:03 | |
| *** aginwala has joined #openstack-keystone | 06:04 | |
| *** jaosorior has quit IRC | 06:06 | |
| *** jaosorior has joined #openstack-keystone | 06:06 | |
| stevemar | jamielennox: heads up: https://bugs.launchpad.net/keystonemiddleware/+bug/1542486 | 06:06 |
| openstack | Launchpad bug 1542486 in OpenStack Compute (nova) "nova-compute stack traces with BadRequest: Specifying 'tenant_id' other than authenticated tenant in request requires admin privileges" [Undecided,Incomplete] | 06:06 |
| openstackgerrit | Merged openstack/keystone: Deprecate admin_token_auth https://review.openstack.org/275443 | 06:06 |
| *** jaosorior has quit IRC | 06:06 | |
| *** jaosorior has joined #openstack-keystone | 06:11 | |
| *** chlong has quit IRC | 06:11 | |
| stevemar | tjcocozz: i have a job for you tomorrow, fix this backport: https://review.openstack.org/#/c/265019/ | 06:19 |
| *** nekrodesk has joined #openstack-keystone | 06:24 | |
| *** nekrodesk has quit IRC | 06:24 | |
| *** aginwala has quit IRC | 06:25 | |
| stevemar | dstanek: easy one for bug squash day tomorrow: https://review.openstack.org/#/c/265797/ | 06:26 |
| stevemar | dstanek: another for tomorrow: https://review.openstack.org/#/c/275706/6 | 06:27 |
| *** med_ has quit IRC | 06:28 | |
| *** jbell8 has quit IRC | 06:28 | |
| *** jbell8 has joined #openstack-keystone | 06:30 | |
| *** nekrodesk has joined #openstack-keystone | 06:30 | |
| *** nekrodesk has quit IRC | 06:30 | |
| *** lhcheng has joined #openstack-keystone | 06:33 | |
| *** ChanServ sets mode: +v lhcheng | 06:33 | |
| *** chlong has joined #openstack-keystone | 06:34 | |
| *** aginwala has joined #openstack-keystone | 06:35 | |
| *** nekrodesk has joined #openstack-keystone | 06:36 | |
| *** nekrodesk has quit IRC | 06:36 | |
| *** nekrodesk has joined #openstack-keystone | 06:39 | |
| *** nekrodesk has quit IRC | 06:39 | |
| *** nekrodesk has joined #openstack-keystone | 06:41 | |
| *** med_ has joined #openstack-keystone | 06:43 | |
| *** med_ is now known as Guest76507 | 06:43 | |
| *** gildub has quit IRC | 06:55 | |
| *** su_zhang has quit IRC | 06:57 | |
| *** aginwala has quit IRC | 06:58 | |
| *** aginwala has joined #openstack-keystone | 07:00 | |
| *** boris-42 has joined #openstack-keystone | 07:02 | |
| *** chlong has quit IRC | 07:03 | |
| openstackgerrit | Merged openstack/keystonemiddleware: update deprecation message to indicate when deprecations were made https://review.openstack.org/220509 | 07:08 |
| openstackgerrit | Steve Martinelli proposed openstack/pycadf: Add docstring validation https://review.openstack.org/230257 | 07:15 |
| *** lhcheng_ has joined #openstack-keystone | 07:15 | |
| openstackgerrit | Steve Martinelli proposed openstack/pycadf: Add docstring validation https://review.openstack.org/230257 | 07:17 |
| *** lhcheng has quit IRC | 07:17 | |
| *** jbell8 has quit IRC | 07:20 | |
| *** jbell8 has joined #openstack-keystone | 07:20 | |
| *** jbell8 has quit IRC | 07:23 | |
| *** jbell8 has joined #openstack-keystone | 07:23 | |
| *** jbell8 has quit IRC | 07:27 | |
| *** jbell8 has joined #openstack-keystone | 07:28 | |
| *** belmoreira has joined #openstack-keystone | 07:28 | |
| *** tomoiaga has joined #openstack-keystone | 07:30 | |
| *** henrynash has joined #openstack-keystone | 07:30 | |
| *** ChanServ sets mode: +v henrynash | 07:30 | |
| *** jbell8 has quit IRC | 07:30 | |
| *** jbell8 has joined #openstack-keystone | 07:31 | |
| tomoiaga | I am writing a keystoneauth plugin and was wondering where I can find more info on what get_cache_id_elements is used for (it is explained a bit but I have some troubles understanding at what type of caching does the author reffer to). Thank you! | 07:34 |
| *** jbell8 has quit IRC | 07:34 | |
| *** jbell8 has joined #openstack-keystone | 07:35 | |
| *** jbell8 has quit IRC | 07:40 | |
| *** jbell8 has joined #openstack-keystone | 07:40 | |
| *** lhcheng_ has quit IRC | 07:47 | |
| *** su_zhang has joined #openstack-keystone | 07:49 | |
| *** spandhe has quit IRC | 07:52 | |
| *** vgridnev has quit IRC | 07:58 | |
| *** su_zhang has quit IRC | 08:11 | |
| *** aginwala has quit IRC | 08:17 | |
| *** pnavarro has joined #openstack-keystone | 08:19 | |
| *** nekrodesk has quit IRC | 08:21 | |
| *** aginwala has joined #openstack-keystone | 08:31 | |
| *** aginwala has quit IRC | 08:36 | |
| *** shoutm has quit IRC | 08:43 | |
| *** browne has quit IRC | 08:44 | |
| *** e0ne has joined #openstack-keystone | 08:49 | |
| *** vgridnev has joined #openstack-keystone | 08:50 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules in the v3 policy sample for domain specifc roles https://review.openstack.org/262078 | 08:51 |
| *** fhubik has joined #openstack-keystone | 08:54 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify implied roles to honor domain specific roles https://review.openstack.org/263064 | 08:56 |
| *** pnavarro has quit IRC | 09:01 | |
| *** mhickey has joined #openstack-keystone | 09:07 | |
| *** mhickey has quit IRC | 09:08 | |
| *** mhickey has joined #openstack-keystone | 09:09 | |
| *** aginwala has joined #openstack-keystone | 09:14 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules for domain specific role assignments https://review.openstack.org/263549 | 09:16 |
| *** aginwala has quit IRC | 09:18 | |
| *** mvk has joined #openstack-keystone | 09:25 | |
| openstackgerrit | Merged openstack/python-keystoneclient: add release notes for deprecated auth bits https://review.openstack.org/279374 | 09:25 |
| *** nekrodesk has joined #openstack-keystone | 09:26 | |
| *** nekrodesk has quit IRC | 09:26 | |
| *** rvba has quit IRC | 09:26 | |
| *** rvba has joined #openstack-keystone | 09:27 | |
| *** rvba has quit IRC | 09:27 | |
| *** rvba has joined #openstack-keystone | 09:27 | |
| *** nekrodesk has joined #openstack-keystone | 09:29 | |
| *** nekrodesk has quit IRC | 09:29 | |
| *** nekrodesk has joined #openstack-keystone | 09:32 | |
| *** nekrodesk has quit IRC | 09:32 | |
| *** nekrodesk has joined #openstack-keystone | 09:33 | |
| *** nekrodesk has quit IRC | 09:33 | |
| *** nekrodesk has joined #openstack-keystone | 09:36 | |
| *** nekrodesk has quit IRC | 09:36 | |
| *** nekrodesk has joined #openstack-keystone | 09:39 | |
| *** nekrodesk has quit IRC | 09:39 | |
| *** nekrodesk has joined #openstack-keystone | 09:41 | |
| *** pnavarro has joined #openstack-keystone | 09:48 | |
| openstackgerrit | Merged openstack/keystone: Extracts logic for finding domain configs https://review.openstack.org/279352 | 09:54 |
| *** pnavarro has quit IRC | 09:54 | |
| openstackgerrit | Merged openstack/keystone: Adds better logging to the domain config finder https://review.openstack.org/279353 | 09:55 |
| *** mvk has quit IRC | 09:59 | |
| *** rudolfvriend has joined #openstack-keystone | 10:04 | |
| *** pnavarro has joined #openstack-keystone | 10:08 | |
| *** daemontool has joined #openstack-keystone | 10:28 | |
| *** daemontool_ has quit IRC | 10:31 | |
| *** openstackgerrit has quit IRC | 10:32 | |
| *** openstackgerrit has joined #openstack-keystone | 10:32 | |
| *** mvk has joined #openstack-keystone | 10:32 | |
| *** aginwala has joined #openstack-keystone | 10:35 | |
| jamielennox | tomoiaga: at the moment it's not really used for much at all | 10:39 |
| jamielennox | but it's referring to the elements of that plugin that make it unique | 10:39 |
| *** aginwala has quit IRC | 10:40 | |
| *** pnavarro has quit IRC | 10:40 | |
| tomoiaga | jamielennox: thank you. I've created the function since it was "required" and I am using my own token cache. I am waiting for the possibility to serialize an entire accessInfo object :) Right now I access the ._data to cache the catalog and other details :) | 10:40 |
| jamielennox | so if you hash all the elements in the get_cache_id_elements dictionary it will be unique and you can reuse an existing token if the elements are the same | 10:40 |
| jamielennox | tomoiaga: it shouldn't be 'required', if you don't fill anything in it will return None and it's assumed you can't cache that plugin | 10:41 |
| *** dims has joined #openstack-keystone | 10:41 | |
| jamielennox | but yes, the intention is/was to add it to openstackclient so that it could reuse authentication across calls | 10:42 |
| jamielennox | i'ts still planned but the transition from keystoneclient to keystoneauth is more difficult than expected | 10:42 |
| jamielennox | the functionality is all there though if you want to use it in your own application | 10:43 |
| tomoiaga | jamielennox: yes, "required" may be too much. I thought I might use it to cache auth, I guess in the future it will be possible (it will be great :) ). Right now I have my own code. | 10:43 |
| tomoiaga | jamielennox: I switched to keystoneauth for my project a few days ago. I had some small issues with the AccessInfo objects (it was a nice thing you guys documented the change) | 10:44 |
| tomoiaga | jamielennox: keystoneauth and the session were great things so thank you for your work on this! | 10:46 |
| jamielennox | tomoiaga: excellent! i'm glad it made things easier for you. and yes i thought that almost no-one would notice the accessinfo changes but it has caught a few people now | 10:47 |
| jamielennox | let me know of anything that doesn't work as you expect | 10:47 |
| jamielennox | and particularly the caching as i thought it was going to get a lot of testing from OSC and as yet it hasn't | 10:48 |
| jamielennox | (i don't know anything that would be wrong just i was expecting it to be used a lot by now) | 10:48 |
| tomoiaga | jamielennox: I'll look at it and try to implement it on my project. Until now I went with the lazy approach and saved the entire accessinfo in a request session. Worked well since it was a dict :) | 10:51 |
| tomoiaga | serializable dict that it | 10:51 |
| jamielennox | tomoiaga: so get_cache_id gives you a unique hash value to the plugin state | 10:52 |
| jamielennox | get_auth_state gives you a string and set_auth_state takes it back | 10:52 |
| jamielennox | https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/plugin.py#L201-L246 | 10:52 |
| jamielennox | they call the cache_id_elements internally | 10:52 |
| jamielennox | that should be really easily combined to cache to either memcache or keyring or whatever you use | 10:53 |
| jamielennox | this is why there's no mention of what type of caching it will be - because it can be anything | 10:54 |
| jamielennox | as per doc string you should only call get_auth_state/set_auth_state if get_cache_id gives you a non-none value | 10:55 |
| *** josecastroleon has quit IRC | 10:56 | |
| jamielennox | and with that - goodnight | 10:58 |
| tomoiaga | jamielennox: thank you very much! That helps a lot | 10:58 |
| tomoiaga | jamielennox: have a good night! | 10:59 |
| *** nekrodesk has quit IRC | 11:07 | |
| *** sileht has quit IRC | 11:20 | |
| *** Ephur has quit IRC | 11:24 | |
| *** alex_xu has quit IRC | 11:27 | |
| *** alex_xu has joined #openstack-keystone | 11:28 | |
| *** sileht has joined #openstack-keystone | 11:39 | |
| *** baffle___ is now known as baffle | 11:45 | |
| samueldmq | jamielennox: stevemar: hey, it went through the gate | 11:49 |
| samueldmq | jamielennox: stevemar: my understanding was that we got more things moved over ksa and since Morgan removed his -1, it was time! | 11:50 |
| *** aginwala has joined #openstack-keystone | 11:53 | |
| *** aginwala has quit IRC | 11:58 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 11:58 |
| samueldmq | jamielennox: stevemar: also I agree with ayoung, why not deprecate ? ksa is stable so let's make the move :) | 11:58 |
| *** pnavarro has joined #openstack-keystone | 12:02 | |
| *** dave-mccowan has joined #openstack-keystone | 12:08 | |
| *** links has quit IRC | 12:10 | |
| *** raildo-afk is now known as raildo | 12:11 | |
| *** vgridnev has quit IRC | 12:25 | |
| *** jbell8 has quit IRC | 12:34 | |
| *** jbell8 has joined #openstack-keystone | 12:35 | |
| *** aginwala has joined #openstack-keystone | 12:35 | |
| *** vgridnev has joined #openstack-keystone | 12:36 | |
| *** daemontool has quit IRC | 12:36 | |
| *** aginwala has quit IRC | 12:39 | |
| *** edmondsw has joined #openstack-keystone | 12:40 | |
| *** vgridnev has quit IRC | 12:41 | |
| *** jbell8 has quit IRC | 12:42 | |
| *** jbell8 has joined #openstack-keystone | 12:43 | |
| *** vgridnev has joined #openstack-keystone | 12:47 | |
| *** aginwala has joined #openstack-keystone | 12:48 | |
| *** daemontool has joined #openstack-keystone | 12:50 | |
| *** aginwala has quit IRC | 12:53 | |
| *** pnavarro has quit IRC | 13:09 | |
| *** mhickey has quit IRC | 13:12 | |
| samueldmq | htruta: just left a comment in 244149 | 13:17 |
| samueldmq | henrynash: there is unrelated code (for update) there | 13:17 |
| samueldmq | henrynash: not you,, but htruta :) | 13:17 |
| samueldmq | htruta: it's all good other than that | 13:18 |
| htruta | samueldmq: thanks. will look | 13:19 |
| *** clenimar has joined #openstack-keystone | 13:19 | |
| henrynash | samueldmq: when you have a moment, take a look at https://review.openstack.org/#/c/264533/24 would be good to start getting some of this in | 13:27 |
| *** alex_xu has quit IRC | 13:28 | |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: API support for project cascade update https://review.openstack.org/243585 | 13:29 |
| *** alex_xu has joined #openstack-keystone | 13:30 | |
| samueldmq | henrynash: looking now | 13:33 |
| samueldmq | henrynash: so domain_id of is-domain projs is null | 13:33 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 13:36 |
| htruta | samueldmq: just addressed one of your comments and replied the other | 13:36 |
| samueldmq | htruta: oh, you're correct | 13:38 |
| *** ninag has joined #openstack-keystone | 13:40 | |
| *** aginwala has joined #openstack-keystone | 13:40 | |
| samueldmq | htruta: left another comment/question there, this time more interesting than a nit :) | 13:43 |
| samueldmq | htruta: no vote, just wan't to think about that with you | 13:43 |
| samueldmq | henrynash: ^ would be nice to see your view on it too | 13:43 |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: API support for project cascade update https://review.openstack.org/243585 | 13:44 |
| *** aginwala has quit IRC | 13:44 | |
| *** petertr7_away is now known as petertr7 | 13:49 | |
| *** Nirupama has quit IRC | 13:50 | |
| *** vgridnev has quit IRC | 13:51 | |
| *** vgridnev has joined #openstack-keystone | 13:52 | |
| *** edmondsw has quit IRC | 13:53 | |
| htruta | samueldmq: in this case, as we already have all of the projects disabled, I don't think it'll be much harm doing that | 13:53 |
| *** edmondsw has joined #openstack-keystone | 13:54 | |
| samueldmq | htruta: I think it's bad, if the delete_projects fail later for some reason, lots of things were deleted (assignments) | 13:59 |
| samueldmq | htruta: and notifications were sent, making other system using them understand the prjects were deleted (when it's a lie) | 14:00 |
| *** clayton has quit IRC | 14:00 | |
| samueldmq | htruta: we should be able to easily put that behavior after the delete, exactly as it was before, and do not change this behavior | 14:01 |
| htruta | samueldmq: if we do that, the delete list will not be atomic, once we'll have to go through each project at a time | 14:01 |
| htruta | samueldmq: If I already disabled all the projects, and tried to delete them, I don't think I'll care about the assignments any longer | 14:03 |
| samueldmq | htruta: deleting porjects + cleaning them up is not atomic anyways | 14:06 |
| samueldmq | htruta: as they're 2 steps and may fail separately | 14:06 |
| *** jaosorior has quit IRC | 14:06 | |
| *** jaosorior has joined #openstack-keystone | 14:06 | |
| samueldmq | htruta: in the old code there are 2 cleanups, things happening prior and after calling the driver to delete | 14:07 |
| samueldmq | htruta: what I am proposing is to keep the bhehavior | 14:07 |
| samueldmq | for prj in project_list: | 14:08 |
| henrynash | samueldmq: at the manager and above level, yes, the domain_id of a project acting as a domain is null…but under the hood it actually points to the “root of all domains" | 14:08 |
| samueldmq | self._INITIAL_cleanup_project(prj['id'], prj, initiator) | 14:08 |
| samueldmq | ret = self.driver.delete_projects_from_ids(projects_ids) | 14:08 |
| samueldmq | for prj in project_list: | 14:08 |
| *** sshen has quit IRC | 14:08 | |
| samueldmq | self._cleanup_project_AFTER_DELETE(prj['id'], prj, initiator) | 14:08 |
| samueldmq | something like this | 14:08 |
| samueldmq | henrynash: yes, nice | 14:08 |
| samueldmq | henrynash: could we get your view on https://review.openstack.org/#/c/244149/29/keystone/resource/core.py ? | 14:09 |
| henrynash | samueldmq: looking now | 14:09 |
| *** jsavak has joined #openstack-keystone | 14:12 | |
| *** clayton- has joined #openstack-keystone | 14:12 | |
| *** daemontool has quit IRC | 14:16 | |
| htruta | samueldmq: I guess that would reduce the problem, but not eliminate it. If a fail occurs at the pre_cleanup, it'd already receive notifications to invalidate tokens | 14:17 |
| htruta | thinking about that, does it even make sense? since this project should already been disabled? | 14:18 |
| henrynash | samueldmq, htruta: I thought we supproted cascade for update (of the enabled flag) and delete? | 14:19 |
| htruta | henrynash: this patch does the delete cascade. there is another one doing the update | 14:20 |
| henrynash | htruta: ah, ok | 14:20 |
| samueldmq | htruta: maybe, but we should keep the current behavior | 14:20 |
| samueldmq | htruta: and if it's broken, fix it as separate patch if needed | 14:21 |
| samueldmq | henrynash: did you see my point there ? | 14:21 |
| henrynash | samuedlmq: of the cleanup before/after the delete? | 14:21 |
| samueldmq | henrynash: yes, my point is that we keep the process exactly as it happens now | 14:22 |
| samueldmq | henrynash: but do for multi-project | 14:23 |
| henrynash | smueldmq; agreed | 14:23 |
| *** petertr7 is now known as petertr7_away | 14:23 | |
| samueldmq | henrynash: nice, htruta ^ | 14:24 |
| samueldmq | henrynash: btw, few questions regarding 264533 | 14:24 |
| henrynash | sure | 14:24 |
| samueldmq | henrynash: so, what if someone does GET /domains/<<special.thing>> | 14:24 |
| henrynash | samueldmq: they should get not found | 14:25 |
| henrynash | samuedlmq: see line 38 of backends/sql.py | 14:25 |
| samueldmq | henrynash: cool, same for get_projects_in_domain(<<special.thing>>) | 14:26 |
| henrynash | samuedlmq: yep | 14:26 |
| samueldmq | henrynash: so there a couple of methods to take care of it yet | 14:26 |
| samueldmq | henrynash: will leave a comment in a minute | 14:27 |
| henrynash | samueldmq: you could be right…. | 14:27 |
| htruta | samueldmq, henrynash: by "do for multi-project", you mean keeping the pre and post delete cleanup? | 14:27 |
| *** dansmith is now known as superdan | 14:28 | |
| samueldmq | htruta: yes exactly how it happens, but with a for before and after | 14:29 |
| samueldmq | htruta: and atomic multi-project deletion i nthe middle, see a code I pasted a few lines above | 14:29 |
| htruta | samueldmq: ++ | 14:29 |
| *** knikolla has joined #openstack-keystone | 14:31 | |
| *** igornsa has joined #openstack-keystone | 14:31 | |
| henrynash | samuedlmq: see teh tests in test_backend_sql.py for hidden….I *thought* I caught them all | 14:31 |
| samueldmq | henrynash: just left a review | 14:32 |
| samueldmq | henrynash: most of occurences are specially in the wrapper, yes that's a lot of work in thtat wrapper | 14:32 |
| samueldmq | henrynash: let me know if you agree | 14:32 |
| *** sshen has joined #openstack-keystone | 14:37 | |
| henrynash | samuedlmq: for the v8 wrapper….that driver won’t have the hidden rows…..so tehy won’t be found.... | 14:38 |
| samueldmq | henrynash: can't I apply the migration and keep using my version of v8 driver ? | 14:40 |
| samueldmq | henrynash: I think that's the point of the wrapper isn't it ? | 14:40 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 14:40 |
| htruta | samueldmq, henrynash: fixed ^ | 14:40 |
| *** daemontool has joined #openstack-keystone | 14:40 | |
| samueldmq | htruta: perfect, will run the tests :) | 14:41 |
| *** pauloewerton has joined #openstack-keystone | 14:41 | |
| *** su_zhang has joined #openstack-keystone | 14:41 | |
| henrynash | samueldmq: no, we don’t support our V8 driver anymore (at M), we only support teh V8 interface - and you are on your own with the migration…which does rsise the issue of how we stop people getting themselves into trouble | 14:42 |
| samueldmq | henrynash: so what's the point of modifying some methods in ResourceDriverV9 ? | 14:44 |
| henrynash | samueldmq: the assumption is that if you have your own driver, it’s using it’s own tables (and maybe not SQL)…..but I am a bit worried how we stop a migration stamoing all over their tables if they ARE usring modifed version of our SQL tables….this is a more general issue outside o fthis patch | 14:44 |
| samueldmq | henrynash: I meant V9ResourceWrapperForV8Driver | 14:44 |
| samueldmq | henrynash: for example, why did we change create_project in V9ResourceWrapperForV8Driver ? | 14:45 |
| samueldmq | henrynash: in their custom storage, they don't know about hidden_domain, why do we add this to new created projects ? | 14:46 |
| henrynash | samueldmq: its for teh new domain_id field (of course) and the manager thinks teh table has the attribute, but a v8 driver backend will not | 14:46 |
| samueldmq | henrynash: if the old ones there don't even know about it ? (if they haven't applied migration) | 14:46 |
| *** igornsa has quit IRC | 14:46 | |
| henrynash | samueldmq; sorry, I mean that domain_id can be none | 14:46 |
| samueldmq | henrynash: okay so the only thing we want to support in the wrapper is the ability to create a project with domain_id = None | 14:47 |
| henrynash | samueldmq: exactly (and decode it when we read etc.) | 14:48 |
| samueldmq | henrynash: why do we want to do this ? do we need to ? | 14:48 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Allow project_id in catalog substitutions https://review.openstack.org/279576 | 14:49 |
| henrynash | samueldmq: we are changing the expected values of domain_id at the upgrade, and I can’t assume that old drivers know how to handle that | 14:49 |
| samueldmq | henrynash: yes you might be correct, I will think more about it | 14:50 |
| samueldmq | henrynash: I need to go afk for bit now, will be back in ~1 hour | 14:50 |
| henrynash | samueldmq: I agree, it’s a but subtle | 14:50 |
| henrynash | samueldmq: ok | 14:50 |
| samueldmq | henrynash: I will ping you later to discuss further, sorry | 14:51 |
| *** clayton- is now known as clayton | 14:55 | |
| henrynash | samueldmq: no problem | 14:57 |
| henrynash | htruta: so on the FK issue with the reverse project list….do mean the delete_using_ids method in the backend has problems? | 14:59 |
| *** doug-fish has joined #openstack-keystone | 15:01 | |
| *** dave-mccowan has quit IRC | 15:01 | |
| *** pushkaru has joined #openstack-keystone | 15:02 | |
| *** jbell8 has quit IRC | 15:02 | |
| openstackgerrit | Steve Martinelli proposed openstack/pycadf: Add docstring validation https://review.openstack.org/230257 | 15:03 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Allow project_id in catalog substitutions https://review.openstack.org/279576 | 15:04 |
| stevemar | nice patch bknudson_ ^ | 15:08 |
| bknudson_ | stevemar: should have been a 1 line change but that substitution code is copy-pasted all over. | 15:09 |
| bknudson_ | still on my list of things to do | 15:09 |
| *** gordc has joined #openstack-keystone | 15:13 | |
| *** jbell8 has joined #openstack-keystone | 15:13 | |
| *** jaosorior has quit IRC | 15:13 | |
| *** jaosorior has joined #openstack-keystone | 15:14 | |
| *** dave-mccowan has joined #openstack-keystone | 15:17 | |
| *** doug-fish has quit IRC | 15:21 | |
| *** doug-fish has joined #openstack-keystone | 15:22 | |
| *** fhubik has quit IRC | 15:27 | |
| *** nkinder has joined #openstack-keystone | 15:28 | |
| *** phalmos has joined #openstack-keystone | 15:31 | |
| *** belmoreira has quit IRC | 15:35 | |
| *** mjblack has joined #openstack-keystone | 15:38 | |
| *** tomoiaga has quit IRC | 15:39 | |
| *** rudolfvriend has quit IRC | 15:41 | |
| *** slberger has joined #openstack-keystone | 15:41 | |
| *** petertr7_away is now known as petertr7 | 15:45 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:48 | |
| *** phalmos has quit IRC | 15:49 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Time-based One-time Password https://review.openstack.org/274901 | 15:52 |
| *** aginwala has joined #openstack-keystone | 15:54 | |
| *** aginwala has quit IRC | 15:58 | |
| *** phalmos has joined #openstack-keystone | 15:59 | |
| htruta | henrynash: not exactly. That method is only supposed to traverse the list and delete one by one. I gave the Manager the responsibility of passing the proper list | 16:08 |
| samueldmq | henrynash: so should an upgraded keystone (with a v8 driver) support the creation of is_domain projects) ? | 16:16 |
| samueldmq | henrynash: what if we just didn't allow it ? perhaps that would make sense too | 16:16 |
| *** phalmos has quit IRC | 16:20 | |
| *** tsymanczyk has joined #openstack-keystone | 16:22 | |
| *** tsymanczyk is now known as Guest65333 | 16:22 | |
| *** roxanaghe has joined #openstack-keystone | 16:22 | |
| *** links has joined #openstack-keystone | 16:23 | |
| *** phalmos has joined #openstack-keystone | 16:24 | |
| *** e0ne has quit IRC | 16:24 | |
| arunkant | stevemar : hi..any suggestion to deal with audit middleware issue. https://bugs.launchpad.net/keystonemiddleware/+bug/1544840 | 16:27 |
| openstack | Launchpad bug 1544840 in keystonemiddleware "Audit Middleware driver config issue with Nova, Neutron" [Undecided,New] | 16:27 |
| henrynash | samueldmq: I don’t see how we can without supporting two managers….since the Mitaka manager expects to be able to store domains as projects….and the goal of our wrapper is that the manaager level shouldn’t have to have sepreate code paths for current and deprecated driver interfaces | 16:36 |
| *** browne has joined #openstack-keystone | 16:36 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 16:37 |
| *** araji has joined #openstack-keystone | 16:37 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 16:39 |
| *** woodster_ has joined #openstack-keystone | 16:39 | |
| *** spzala has joined #openstack-keystone | 16:45 | |
| *** jaosorior has quit IRC | 16:48 | |
| mjblack | not sure if this is the right place to ask, I'm trying to figure out how to do saml authentication with keystone and the cli client, can the openstack cli client do saml authentication? | 16:48 |
| *** su_zhang has quit IRC | 16:56 | |
| *** spandhe has joined #openstack-keystone | 16:56 | |
| *** vgridnev has quit IRC | 16:57 | |
| stevemar | arunkant: i saw that last night and didn't really know what the issue was | 16:58 |
| openstackgerrit | henry-nash proposed openstack/keystone: Allow project domain_id to be nullable at the manager level https://review.openstack.org/264533 | 17:00 |
| openstackgerrit | henry-nash proposed openstack/keystone: Verify project unique constraints for projects acting as domains https://review.openstack.org/158372 | 17:00 |
| arunkant | stevemar: The issue is around services which are already using oslo messaging notification capabilites like neutron. They use 'messaging' as driver. | 17:00 |
| arunkant | stevemar: If someone want to use 'log' as notification driver for auditing events, it cause problems..as now audit log file will also have neutron legular events logged in log file | 17:01 |
| *** haneef_ has joined #openstack-keystone | 17:03 | |
| arunkant | stevemar : The reason is that audit middleware is using common oslo messaging configuration | 17:04 |
| *** jaosorior has joined #openstack-keystone | 17:04 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add tests in preparation of projects acting as a domain https://review.openstack.org/272369 | 17:04 |
| arunkant | stevemar: Does it make sense? | 17:05 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add is_domain filter to v3 list_projects https://review.openstack.org/158398 | 17:05 |
| samueldmq | henrynash: simply not suprting domain as projects at all in v8 drivers ? | 17:05 |
| openstackgerrit | henry-nash proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 17:05 |
| stevemar | arunkant: something like this: http://paste.openstack.org/show/486851/ | 17:05 |
| henrynash | samuedlmq: but what the manager code look like? | 17:05 |
| samueldmq | henrynash: as it is today | 17:05 |
| samueldmq | henrynash: only the driver would handle domain_key | 17:06 |
| stevemar | arunkant: so you're saying we can't have two separate mechanisms for notification events | 17:06 |
| henrynash | samueldmq: we don’t have duplcaite managers…we only have the “new” manager….that’s the point of the wrapper | 17:06 |
| stevemar | gordc: quickie https://review.openstack.org/#/c/230257/ | 17:07 |
| gordc | stevemar: done | 17:07 |
| gordc | ... awkward transaction without context | 17:08 |
| arunkant | stevemar: we can configure two notification driver..'messaging' and 'log' as MultiOpt conf property ..but then notifications are sent to both which makes them useless from auditing contect. | 17:08 |
| henrynash | samueldmq: I guess you could write a wrapper that split projects as a domain out to teh domain table again! | 17:08 |
| henrynash | samuedlmq: ouch! | 17:08 |
| samueldmq | henrynash: if the mitaka manager has a v8 (liberty?) driver, it can't create a project with domain_id = Null | 17:08 |
| henrynash | samueldmq: so how will it creeate a domain? | 17:09 |
| arunkant | stevemar: If it will ideal if audit middleware can have it own configuration to specify notification driver. | 17:09 |
| openstackgerrit | Clenimar Sousa proposed openstack/keystone: Avoid wrong deletion of domain assignments https://review.openstack.org/275706 | 17:10 |
| stevemar | arunkant: i don't know how possible this is, let's see what dhellmann or dims thinks? | 17:10 |
| * stevemar pokes dims and/or dhellmann | 17:10 | |
| *** dan_nguyen has joined #openstack-keystone | 17:10 | |
| henrynash | samueldmq: I gotta head out for a bit…..we can disucss later, but I think our options are a) as I have coded it, or b) the wrapper has to do the inverse and turn all project API requests for projecst as a domain back to teh domain table. | 17:11 |
| dims | notification driver is for the whole service i think | 17:11 |
| dims | in mitaka we at least separated out the rpc and notification drivers | 17:12 |
| henrynash | samueldmq: and I’m not sure I fancy b) !!!!! | 17:12 |
| *** henrynash has quit IRC | 17:12 | |
| *** clenimar has quit IRC | 17:12 | |
| *** mvk has quit IRC | 17:12 | |
| stevemar | dims: so, would it be possible to have the notification driver be one thing for the nova events, and another for the keystone audit stuff? | 17:13 |
| arunkant | stevemar, dims: Yes as it uses DEFAULT or oslo_messaging_notifications config values. If there is separate config ..then audit middleware can use instance of that driver only | 17:13 |
| stevemar | since they need to be defined in the same file... | 17:13 |
| dims | stevemar : not currently, always possible :) it's just code | 17:14 |
| stevemar | arunkant: sounds like you have a fix in mind? | 17:14 |
| *** gyee has joined #openstack-keystone | 17:14 | |
| *** ChanServ sets mode: +v gyee | 17:14 | |
| arunkant | stevemar: Yes...I can make a quick patch to show the fix. | 17:14 |
| *** pgbridge has quit IRC | 17:15 | |
| *** _cjones_ has joined #openstack-keystone | 17:16 | |
| *** openstackgerrit has quit IRC | 17:17 | |
| *** openstackgerrit has joined #openstack-keystone | 17:17 | |
| arunkant | stevemar: Will add patch today and add you as reviewer. | 17:17 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 17:19 |
| *** browne has quit IRC | 17:20 | |
| *** mylu has joined #openstack-keystone | 17:24 | |
| *** aginwala has joined #openstack-keystone | 17:25 | |
| *** mylu has quit IRC | 17:34 | |
| *** jsavak has quit IRC | 17:34 | |
| *** jsavak has joined #openstack-keystone | 17:35 | |
| *** pgbridge has joined #openstack-keystone | 17:38 | |
| *** aginwala has quit IRC | 17:39 | |
| samueldmq | htruta: is clenimar around ? | 17:41 |
| htruta | samueldmq: not anymore. Why? | 17:41 |
| samueldmq | htruta: was going to ask if he ran the tests for 275706 | 17:42 |
| *** jaosorior has quit IRC | 17:44 | |
| *** spzala has quit IRC | 17:45 | |
| *** mylu has joined #openstack-keystone | 17:48 | |
| openstackgerrit | John Dennis proposed openstack/keystone: Convert assignment.root_role config option to list of strings https://review.openstack.org/279703 | 17:49 |
| htruta | samueldmq: I believe he has ran. Anyway, you can +A the patch, jenkins will recheck again if it fails | 17:50 |
| *** jbell8 has quit IRC | 17:52 | |
| *** Guest65333 has quit IRC | 17:58 | |
| *** jasonsb has quit IRC | 17:58 | |
| *** links has quit IRC | 17:58 | |
| ayoung | samueldmq, https://review.openstack.org/#/c/279703/ is a trivial one | 17:59 |
| *** browne has joined #openstack-keystone | 17:59 | |
| ayoung | Already! | 17:59 |
| *** mylu has quit IRC | 18:02 | |
| *** mylu has joined #openstack-keystone | 18:05 | |
| *** su_zhang has joined #openstack-keystone | 18:06 | |
| *** jsavak has quit IRC | 18:06 | |
| stevemar | ayoung: yay for jdennis | 18:06 |
| *** jsavak has joined #openstack-keystone | 18:07 | |
| ayoung | stevemar, yeah, he's back focused on Keystone. | 18:09 |
| ayoung | specifically Federation stuff for now. | 18:09 |
| stevemar | ayoung: awesome, the more the merrier | 18:09 |
| dolphm | Nice! | 18:10 |
| *** petertr7 is now known as petertr7_away | 18:11 | |
| *** aginwala has joined #openstack-keystone | 18:12 | |
| *** lhcheng has joined #openstack-keystone | 18:15 | |
| *** ChanServ sets mode: +v lhcheng | 18:15 | |
| *** jbell8 has joined #openstack-keystone | 18:16 | |
| *** tsymanczyk has joined #openstack-keystone | 18:17 | |
| *** tsymanczyk is now known as Guest77004 | 18:17 | |
| *** gordc has quit IRC | 18:19 | |
| htruta | stevemar: will we break the world even more if we change this: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_identity.py#L182 ? | 18:20 |
| *** e0ne has joined #openstack-keystone | 18:20 | |
| *** jsavak has quit IRC | 18:22 | |
| *** mhickey has joined #openstack-keystone | 18:24 | |
| *** aginwala has quit IRC | 18:24 | |
| *** openstack has joined #openstack-keystone | 18:24 | |
| *** jsavak has joined #openstack-keystone | 18:25 | |
| *** aginwala has joined #openstack-keystone | 18:28 | |
| samueldmq | ayoung: looking | 18:33 |
| ayoung | samueldmq, you;'ve already reviewed. THanks | 18:34 |
| samueldmq | ayoung: yeah :) | 18:34 |
| *** aginwala has quit IRC | 18:35 | |
| openstackgerrit | Sean Perry proposed openstack/keystonemiddleware: argparse expects a list not a dictionary https://review.openstack.org/279718 | 18:35 |
| samueldmq | htruta: you updating 244149 ? should be an easy approval after addressing tjcocozz 's comments | 18:36 |
| *** aginwala has joined #openstack-keystone | 18:37 | |
| htruta | samueldmq: ow. haven't seen it. will fix it | 18:38 |
| htruta | stevemar: will treat this as a long term goal. For a while, I'll try to make some v3 service tokens by default. | 18:40 |
| stevemar | htruta: ++ | 18:40 |
| stevemar | dstanek: around for squashing some bugs | 18:40 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 18:40 |
| htruta | stevemar: have you (or anyone else) tackle something out of the v3 only etherpad? | 18:40 |
| dstanek | stevemar: sure, send me some links boss. i'm a little slow today though. | 18:41 |
| stevemar | htruta: not yet, been focused on mitaka-3 for now | 18:43 |
| stevemar | dstanek: hmm | 18:43 |
| htruta | stevemar: nice. thanks | 18:43 |
| *** e0ne has quit IRC | 18:44 | |
| htruta | tjcocozz: are you around? | 18:44 |
| stevemar | dstanek: oh, the ones i wanted to send are now gating | 18:44 |
| htruta | samueldmq: just answered tjcocozz 's comments. I guess you're good to go there | 18:46 |
| *** openstackgerrit has quit IRC | 18:47 | |
| *** openstackgerrit has joined #openstack-keystone | 18:47 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: add a test that uses trusts and implies roles https://review.openstack.org/277319 | 18:47 |
| stevemar | dstanek: ^ | 18:47 |
| tjcocozz | htruta, hey | 18:47 |
| htruta | tjcocozz: just answered your comments in 244149. Please, take a look | 18:48 |
| stevemar | dstanek: oh right, this one too: https://review.openstack.org/#/c/265797/ | 18:48 |
| * tjcocozz is looking now | 18:48 | |
| tjcocozz | htruta, that test is calling update_project not delete_project | 18:49 |
| htruta | tjcocozz: it first disables, but then it calls the delete in L3436 | 18:49 |
| tjcocozz | htruta, for some reason i didn't see that. thanks for pointing that out. so where is the forbiddenaction in update_project tested? | 18:52 |
| htruta | tjcocozz: update_project does not raise exception. It successfully disables project2. The problem is that I can't delete the root_project, once project1 is enabled | 18:53 |
| tjcocozz | htruta, on line327 in resource/core.py | 18:53 |
| *** mylu has quit IRC | 18:53 | |
| htruta | tjcocozz: we are not cascadely updating. Is a simple update of project2, which have no children | 18:54 |
| *** mylu has joined #openstack-keystone | 18:55 | |
| tjcocozz | htruta, sorry i think i may be asking the wrong thing. I think there should be a test for https://review.openstack.org/#/c/244149/30/keystone/resource/core.py | 18:56 |
| *** mhickey has quit IRC | 18:56 | |
| tjcocozz | htruta, my first comment in the above link | 18:57 |
| htruta | tjcocozz: we are keeping the same behavior as before. the method was just refactored. The test already existed (test_disable_hierarchical_not_leaf_project) | 18:59 |
| gyee | stevemar, would you be mad at me if I tag this one for backport to liberty? https://bugs.launchpad.net/keystone/+bug/1535878 | 19:00 |
| openstack | Launchpad bug 1535878 in OpenStack Identity (keystone) "A user with a role on a project should be able to issue a GET /project call" [Medium,Fix released] - Assigned to Ajaya Agrawal (ajayaa) | 19:00 |
| tjcocozz | htruta, cool! oh i see what your doing now. thanks for pointing that out. let me take a look at the test but i think this will be good to go | 19:00 |
| htruta | tjcocozz: cool! | 19:00 |
| *** Guest77004 has quit IRC | 19:03 | |
| stevemar | gyee: yes | 19:05 |
| stevemar | gyee: it's mostly a change in the json file, the deployer can change that to their liking | 19:06 |
| stevemar | gyee: i don't see the point, but feel free to convince me :) | 19:06 |
| bknudson_ | I wrote up a spec for supporting YAML in oslo.policy -- https://review.openstack.org/#/c/279725/ | 19:07 |
| bknudson_ | I don't know if we use oslo specs for oslo.policy or keystone-specs. | 19:07 |
| stevemar | bknudson_: it's mostly the keystone team that looks at the patches, so i said keystone-specs | 19:08 |
| stevemar | bknudson_: poke for https://review.openstack.org/#/c/279718/ | 19:08 |
| *** mhickey has joined #openstack-keystone | 19:10 | |
| gyee | stevemar, alrighty, I am fine with deployer customization on this one | 19:10 |
| *** Ephur has joined #openstack-keystone | 19:16 | |
| *** petertr7_away is now known as petertr7 | 19:17 | |
| *** araji has left #openstack-keystone | 19:20 | |
| *** aginwala has quit IRC | 19:22 | |
| *** jdennis has quit IRC | 19:22 | |
| *** jdennis has joined #openstack-keystone | 19:23 | |
| *** vgridnev has joined #openstack-keystone | 19:27 | |
| *** jdennis has quit IRC | 19:30 | |
| *** jsavak has quit IRC | 19:30 | |
| *** esp has joined #openstack-keystone | 19:33 | |
| *** aginwala has joined #openstack-keystone | 19:36 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 19:37 |
| *** esp has quit IRC | 19:40 | |
| *** jsavak has joined #openstack-keystone | 19:40 | |
| *** jdennis has joined #openstack-keystone | 19:43 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone-specs: oslo.policy file in YAML https://review.openstack.org/279748 | 19:43 |
| samueldmq | ayoung: stevemar: https://review.openstack.org/#/c/244149/ | 19:44 |
| samueldmq | easy one | 19:44 |
| *** mylu has quit IRC | 19:44 | |
| bknudson_ | samueldmq: potentially long-running operations like this are scary | 19:45 |
| *** mylu has joined #openstack-keystone | 19:45 | |
| *** edmondsw has quit IRC | 19:46 | |
| samueldmq | htruta: only an improvement in tests here: 243584 | 19:47 |
| ayoung | samueldmq, +2A | 19:48 |
| stevemar | bknudson_: true | 19:48 |
| ayoung | HMT FTW | 19:48 |
| samueldmq | bknudson_: stevemar: hierarchy height is limited in config | 19:48 |
| stevemar | bknudson_: it's kinda expected with a "cascade" option | 19:48 |
| samueldmq | bknudson_: stevemar: default is 5 iirc | 19:48 |
| stevemar | ++ | 19:48 |
| stevemar | true day | 19:48 |
| samueldmq | stevemar: ++ | 19:48 |
| stevemar | dat | 19:49 |
| bknudson_ | the height is limited but the width isn't | 19:49 |
| stevemar | bknudson_: hey, did you see my comments about the uwsgi patch? | 19:50 |
| bknudson_ | stevemar: which? | 19:50 |
| ayoung | samueldmq, https://review.openstack.org/#/c/279379/ radical reworking of Dynamic Policy. I took your name off, since this is a new approach, but, I suspect, knowing you, it will end up getting added again. This, though, I think is a palatable approach. We should prep this for the summit | 19:50 |
| * stevemar really wants uwsgi so we can rip out eventlet | 19:50 | |
| ayoung | stevemar, just for testing? | 19:50 |
| stevemar | bknudson_: hmm, i couldn't get it to complete a devstack run with the config you have posted | 19:50 |
| bknudson_ | stevemar: oh, right. I was getting failures locally too. | 19:51 |
| bknudson_ | wasn't sure what the deal was. | 19:51 |
| stevemar | ayoung: yes, we can't remove eventlet until we prove it can run with something else | 19:51 |
| *** alex_xu has quit IRC | 19:51 | |
| bknudson_ | seems like uwsgi should default to values that work! | 19:51 |
| openstackgerrit | John Dennis proposed openstack/keystone: Convert assignment.root_role config option to list of strings https://review.openstack.org/279703 | 19:52 |
| ayoung | we use a lite server in IPA... | 19:52 |
| ayoung | let me see what it is | 19:52 |
| *** browne has quit IRC | 19:52 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 19:52 |
| ayoung | stevemar, it was the paste server | 19:52 |
| ayoung | from paste import httpserver | 19:53 |
| stevemar | ayoung: take a quick look at https://review.openstack.org/#/c/277319/ too please :) | 19:53 |
| ayoung | stevemar, will do | 19:53 |
| *** mylu has quit IRC | 19:53 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 19:53 |
| stevemar | bknudson_: so, i had to add "iniset "$KEYSTONE_PUBLIC_UWSGI_FILE" uwsgi plugins python" to even get it to respond to a request | 19:53 |
| *** alex_xu has joined #openstack-keystone | 19:54 | |
| ayoung | stevemar, so shouldb't that be a WIP test? | 19:54 |
| bknudson_ | stevemar: oh, wow. why would you have to have a "python" plugin for a python library like uwsgi. | 19:54 |
| stevemar | and then it died upon the first request, cause the buffer-size is only 4096 by default | 19:54 |
| stevemar | ayoung: adding @wip makes it pass no? | 19:55 |
| stevemar | rather, skip? | 19:55 |
| ayoung | stevemar, yes, but just do it for the failing part | 19:55 |
| ayoung | test_trust_expands_implied_roles | 19:55 |
| ayoung | stevemar, the way you have it, it passes | 19:55 |
| stevemar | ayoung: it does | 19:56 |
| ayoung | I think WIP means :run it but expect it to fail, right dstanek ? | 19:56 |
| samueldmq | ayoung: looking | 19:56 |
| stevemar | ayoung: i'll add it | 19:56 |
| dstanek | ayoung: yep | 19:57 |
| ayoung | stevemar, I;ve been deep in Puppet land. Trying to figure out how to enable Federation. THe puppet providers right now are K2K specific. And I don't think they support mapping or protocol | 19:58 |
| ayoung | DO we need Mapping or Protocol for K2K? | 19:58 |
| stevemar | ayoung: give me 1 minute to add wip | 19:58 |
| stevemar | ayoung: yep | 19:58 |
| ayoung | If not, I can claim that the existing provider does not work and change its intention | 19:58 |
| ayoung | Federation should be straight federation, and K2K should be its own | 19:59 |
| *** aginwala has quit IRC | 20:00 | |
| openstackgerrit | Merged openstack/keystone: AuthContextMiddleware admin token handling https://review.openstack.org/198931 | 20:01 |
| *** aginwala has joined #openstack-keystone | 20:02 | |
| *** aginwala has quit IRC | 20:03 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 20:04 |
| ayoung | jdennis, thanks. Looks good | 20:04 |
| *** aginwala has joined #openstack-keystone | 20:07 | |
| *** aginwala has quit IRC | 20:12 | |
| *** aginwala has joined #openstack-keystone | 20:13 | |
| samueldmq | ayoung: stevemar: you working on 1543318 ? | 20:14 |
| samueldmq | bug #1543318 | 20:14 |
| openstack | bug 1543318 in OpenStack Identity (keystone) "Token for trust does not expand implied roles" [Medium,New] https://launchpad.net/bugs/1543318 - Assigned to Adam Young (ayoung) | 20:14 |
| stevemar | samueldmq: yes | 20:15 |
| stevemar | posting in 1 second | 20:15 |
| samueldmq | stevemar: perfect | 20:15 |
| ayoung | stevemar, Um...cool. Glad I was not working on that | 20:15 |
| ayoung | Or are you just working on the test? | 20:16 |
| raildo | stevemar: 1 mississippi, 2 mississippi... | 20:16 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: add a test that uses trusts and implies roles https://review.openstack.org/277319 | 20:16 |
| stevemar | ayoung: just the test | 20:16 |
| ayoung | stevemar, OK | 20:16 |
| stevemar | ayoung: you got the bug, you talked about this 2 days ago :) | 20:16 |
| stevemar | we* talked | 20:17 |
| ayoung | stevemar, yeah. Its not a huge change to make it work | 20:17 |
| stevemar | yeah, but i figured you would know faster than i would | 20:17 |
| samueldmq | ayoung: I don't understand why trust backend isn't simply using the assignment backend to get the roles | 20:19 |
| bknudson_ | unittest has expected failure support built-in https://docs.python.org/2/library/unittest.html#unittest.expectedFailure | 20:19 |
| ayoung | samueldmq, it has its own list of roles | 20:19 |
| ayoung | samueldmq, the trust has an explicit subset of the roles for the end user | 20:19 |
| bknudson_ | unfortunately it doesn't support a descriptive message | 20:20 |
| ayoung | and I was debating whether to make all roles in a trust explicit or not | 20:20 |
| samueldmq | bknudson_: yes, ours support a description | 20:20 |
| ayoung | but I think implied role expansion is the correct approach | 20:20 |
| ayoung | say you take member and make it into two roles, reader and writer, and then make memn | 20:20 |
| ayoung | member imply those two roles | 20:20 |
| bknudson_ | but it properly reports that the test was expected to fail (rather than that the test passed) | 20:21 |
| ayoung | if you had a trust that inlcuded member in the past, it would break in the future once you split the roles (and policy) | 20:21 |
| samueldmq | ayoung: yes, trusts should work the same | 20:21 |
| samueldmq | ayoung: that's only about relegation, not about how roles are expanded, etc | 20:21 |
| ayoung | So, I need the "expand implied roles" function to be called for each role in the trust | 20:21 |
| *** edmondsw has joined #openstack-keystone | 20:21 | |
| samueldmq | bknudson_: is it a function? otherwise we could inherit from it ? | 20:22 |
| openstackgerrit | Merged openstack/keystone: Avoid wrong deletion of domain assignments https://review.openstack.org/275706 | 20:22 |
| samueldmq | bknudson_: or perhaps re-use it somehow in our implementation | 20:22 |
| ayoung | we put it in the assignment controller, which is separate from where the trusts roles are expanded | 20:22 |
| bknudson_ | samueldmq: it's a decorator. I tried to see if I could re-use it but it was too complicated | 20:22 |
| samueldmq | bknudson_: ++ | 20:22 |
| samueldmq | ayoung: why do trsuts maintain its own list of roles ? | 20:23 |
| ayoung | samueldmq, because trusts are a delegation mechanism, designed to allow a user to delegate subset of their roles | 20:23 |
| samueldmq | ayoung: yes and that could rely on the assignment backend for knowing what the roles really are | 20:24 |
| samueldmq | ayoung: what a role X in a project Y really means (project and group expansion, implied roles, etc) | 20:25 |
| ayoung | samueldmq, so the logic right now (pre implied roels is) | 20:26 |
| ayoung | get the list of roles from the trust | 20:26 |
| ayoung | ensure that the user still has those roles assigned | 20:26 |
| ayoung | add them to the token | 20:26 |
| ayoung | and I was trying to think how to do that efficiently | 20:27 |
| *** tsymanczyk has joined #openstack-keystone | 20:28 | |
| samueldmq | ayoung: why do the trust contain roles at all? | 20:28 |
| *** tsymanczyk is now known as Guest7667 | 20:28 | |
| ayoung | samueldmq, I am going to make you answer that | 20:28 |
| ayoung | you tell me | 20:29 |
| samueldmq | ayoung: the trust should be just the "confidence" user A has on user B on projec X, hmm, with a initial set of roles | 20:29 |
| ayoung | " with a initial set of roles" | 20:29 |
| samueldmq | ayoung: that set of roles need to be effetive when user B get a token | 20:29 |
| samueldmq | ayoung: yes | 20:29 |
| ayoung | samueldmq, so If I have both admin and member, I only want a trust to have the member role | 20:30 |
| samueldmq | ayoung: how does trust work with inherited roles ? | 20:30 |
| ayoung | inherited roles will be expanded | 20:30 |
| samueldmq | ayoung: in the trust backend ? | 20:30 |
| ayoung | I could see an option to not do that, but I think that would never get used | 20:30 |
| samueldmq | ayoung: so it's duplicating the logic if so, while it should be just using: | 20:30 |
| ayoung | nah, we'll expand the roles when creating a token | 20:30 |
| ayoung | samueldmq, the current expansion is done on "list roles for user on project" | 20:31 |
| samueldmq | ayoung: k, I need to look at the code .. sorry I need to run to be a dad for a bit :) | 20:31 |
| samueldmq | ayoung: will be back in a bit | 20:31 |
| ayoung | samueldmq, NP. | 20:31 |
| ayoung | I'll try to make it work | 20:31 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/providers/common.py#n404 right there. Need to expand before the check | 20:33 |
| *** daemontool has quit IRC | 20:33 | |
| *** daemontool has joined #openstack-keystone | 20:33 | |
| *** daemontool has quit IRC | 20:34 | |
| stevemar | bknudson_: i should mention that my suggested changes to uwsgi got me to almost done with the keystone setup | 20:34 |
| *** Guest3687 is now known as mgagne | 20:34 | |
| stevemar | bknudson_: it kept crapping out on me, and timing out requests | 20:35 |
| *** mgagne has quit IRC | 20:35 | |
| *** mgagne has joined #openstack-keystone | 20:35 | |
| bknudson_ | stevemar: uwsgi is a turd | 20:35 |
| *** daemontool has joined #openstack-keystone | 20:35 | |
| stevemar | bknudson_: then why are we suggesting it as an alternative to eventlet :( | 20:35 |
| bknudson_ | Maybe somebody has figured out how to get it to work? | 20:35 |
| bknudson_ | there sure are a lot of config options. | 20:35 |
| bknudson_ | maybe gunicorn is better? | 20:38 |
| bknudson_ | how hard is it to write a web server that doesn't time out and fail all the time? | 20:38 |
| stevemar | bknudson_: apparently very difficult | 20:38 |
| stevemar | bknudson_: i guess that's why everyone sticks to apache :) | 20:38 |
| bknudson_ | apache has it figured out! | 20:38 |
| stevemar | we should totes use it for keystone | 20:39 |
| bknudson_ | we could start another apache instance. kind of heavyweight | 20:39 |
| stevemar | bknudson_ let's use iHS | 20:39 |
| bknudson_ | stevemar: websphere | 20:40 |
| stevemar | bknudson_: IHS should be more than good enough: https://en.wikipedia.org/wiki/IBM_HTTP_Server | 20:41 |
| bknudson_ | at least they based it on httpd rather than uwsgi | 20:41 |
| bknudson_ | stevemar: I ran it and this time it gets: openstack endpoint list --service identity --interface public --region RegionOne -c ID -f value -> Unable to establish connection to http://192.168.122.239:35357/v3/services?type=identity | 20:45 |
| bknudson_ | `openstack service create identity --name keystone '--description=Keystone Identity Service' -f value -c id` happened first and this worked | 20:45 |
| bknudson_ | so not sure why it can't connect for the next operation. | 20:45 |
| stevemar | thanks jdennis | 20:45 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 20:46 |
| stevemar | bknudson_: mine failed in the same spot | 20:46 |
| bknudson_ | maybe it's not so random after all. | 20:46 |
| stevemar | or... wait, mine got a bit farther along | 20:46 |
| bknudson_ | ah, it is totally random | 20:46 |
| stevemar | let me try again | 20:47 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 20:47 |
| *** dave-mccowan has quit IRC | 20:48 | |
| bknudson_ | every once in a while it says -- Failed to contact the endpoint at http://192.168.122.239:35357/v2.0 for discovery. Fallback to using that endpoint as the base url. | 20:48 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 20:49 |
| stevemar | bknudson_: it works for me when i have enabled_services=key,rabbit,sql,horizon | 20:52 |
| stevemar | it is up and running, and responding to requests | 20:53 |
| bknudson_ | stevemar: my keystone always starts but then some requests fail randomly | 20:53 |
| stevemar | bknudson_: y, which is why i thought increasing buffer_size would help :( | 20:53 |
| bknudson_ | stevemar: I think it's correct to increase buffer_size since the headers can get pretty big (e.g., for pki) | 20:54 |
| stevemar | yep | 20:54 |
| stevemar | gonna try keystone+horizon+swift | 20:55 |
| *** henrynash has joined #openstack-keystone | 20:56 | |
| *** ChanServ sets mode: +v henrynash | 20:56 | |
| *** aginwala has quit IRC | 20:57 | |
| stevemar | bknudson_: it's almost as if the requests are lagging? | 20:57 |
| stevemar | get_or_add_group_project_role:L960: openstack role add 44501ab6faff420e960335e7ffefb938 --group f7785a9993994462b34547ac70b38f5d --project ee8637c3725045e1abc209f5b18c589c | 20:58 |
| stevemar | No project with a name or ID of 'ee8637c3725045e1abc209f5b18c589c' exists. | 20:58 |
| stevemar | but... | 20:58 |
| stevemar | according to mysql... ee8637c3725045e1abc209f5b18c589c | demo | {} | | 20:58 |
| bknudson_ | the server must be saying that it doesn't exist? | 20:58 |
| bknudson_ | so how would the server not be able to find it? | 20:58 |
| stevemar | yep | 20:58 |
| stevemar | that's why i think theres some lag going on | 20:59 |
| *** aginwala has joined #openstack-keystone | 20:59 | |
| stevemar | i know they are async requests, but *shrug* | 20:59 |
| henrynash | ayoung, samueldmq: how are we feeling about https://review.openstack.org/#/c/262078/18 ? If we like this pattern, I still think we should do it manually like this for now, maybe refactor to use a router class or direct call to enforce later | 21:00 |
| ayoung | henrynash, that is my feeling | 21:00 |
| bknudson_ | stevemar: I'm able to recreate using openstack CLI but not with a simple curl... | 21:00 |
| *** raildo is now known as raildo-afk | 21:00 | |
| bknudson_ | probably has to do with multiple requests coming in. | 21:00 |
| ayoung | henrynash, has everything up to that merged? I better get a move on | 21:00 |
| bknudson_ | e.g., for discovery and get token. | 21:01 |
| stevemar | bknudson_: yeah, i think so | 21:01 |
| *** ericksonsantos has quit IRC | 21:01 | |
| stevemar | ayoung: slacking, pfft | 21:01 |
| stevemar | :] | 21:01 |
| ayoung | stevemar, oh yeah | 21:01 |
| stevemar | i kid, i kid | 21:02 |
| henrynash | ayoung: yep, that’s next in line | 21:02 |
| ayoung | henrynash, just realized instead of method_template=None): you could have done method_template='%s'): but I don;'t think I would suggest it | 21:03 |
| henrynash | ayoung: did consider that…but I know some folks don;t like default literals | 21:03 |
| ayoung | henrynash, still looking but I think it looks fine so far | 21:04 |
| stevemar | bknudson_: nothing obvious here: http://uwsgi-docs.readthedocs.org/en/latest/ThingsToKnow.html | 21:04 |
| ayoung | henrynash, so...can we agree to clean up the cloudsample file in the future, so that it is clear where the role section is on each rule? | 21:05 |
| ayoung | I'm not going to insist on it for this patch but I think your verbosity got away from you there | 21:05 |
| ayoung | henrynash, what I would like to see is reusable rules for matching scope, for admin over ride, and then on each line: | 21:06 |
| ayoung | say | 21:06 |
| henrynash | ayoung: i’m certainly open for suggestions on a better way | 21:07 |
| bknudson_ | stevemar: at least I'm able to recreate this pretty easily now, just openstack user list and it fails every once in a while. | 21:07 |
| bknudson_ | I'll mess with config options and see if anything helps. maybe no threads or something | 21:07 |
| ayoung | "identity:get_domain_role": 'rule:admin_override or (rule:domain_matches and role:domain_admin)" | 21:07 |
| ayoung | henrynash, although, I would settle for getting this through first: https://review.openstack.org/#/c/279379/ | 21:08 |
| ayoung | That is the split RBAC from scope thing | 21:08 |
| henrynash | ayoung: :-) | 21:08 |
| stevemar | bknudson_: ++ | 21:09 |
| henrynash | ayoung: will study over the seekend | 21:09 |
| ayoung | henrynash, so if we do that, then the policy files can pretty much stay as is | 21:09 |
| ayoung | henrynash, tear it apart, please | 21:09 |
| *** pauloewerton has quit IRC | 21:12 | |
| stevemar | bknudson_: there are a few suggestions here: http://stackoverflow.com/questions/14962289/bad-django-uwsgi-performance | 21:12 |
| *** jbell8 has quit IRC | 21:14 | |
| *** petertr7 is now known as petertr7_away | 21:15 | |
| *** petertr7_away is now known as petertr7 | 21:16 | |
| stevemar | ayoung: samueldmq poke for https://review.openstack.org/#/c/277319/ | 21:17 |
| ayoung | stevemar, was just messing with that now | 21:17 |
| ayoung | it had a rebase issue with henrynash 's patch on Domain specific | 21:18 |
| stevemar | ayoung: should be cleared up now, jenkins just +1ed me | 21:18 |
| ayoung | stevemar, the WIP made that happen | 21:18 |
| ayoung | expand out the diff | 21:18 |
| ayoung | it was added to the wrong test | 21:18 |
| ayoung | its under class DomainSpecificRoleTests(test_v3.RestfulTestCase, unit.TestCase): now | 21:19 |
| ayoung | move the test above line 2583 | 21:19 |
| stevemar | oh doh! | 21:19 |
| ayoung | stevemar, also, you left it as 1 and not checking that all the roles were in the token, but I'll get that when I fix | 21:20 |
| ayoung | yours passes as is right now, but it should not | 21:20 |
| stevemar | ayoung: yeah, the @wip skips the test | 21:20 |
| ayoung | stevemar, I was going to suggest a different check: | 21:20 |
| ayoung | but I'll do that when I fix the test. for now, just remove the line | 21:21 |
| ayoung | self.assertEqual(self.role_list[0]['id'], token['roles'][0]['id']) | 21:21 |
| ayoung | as that assumes the roles will be in the same order | 21:21 |
| ayoung | and bump | 21:21 |
| ayoung | self.assertThat(token['roles'], matchers.HasLength(1)) to self.assertThat(token['roles'], matchers.HasLength(3)) | 21:21 |
| ayoung | or bettter yet | 21:21 |
| ayoung | self.assertThat(token['roles'], matchers.HasLength(len( self.role_list))) | 21:21 |
| stevemar | ++ | 21:23 |
| stevemar | running pep8... | 21:23 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: add a test that uses trusts and implies roles https://review.openstack.org/277319 | 21:25 |
| stevemar | ayoung: there we go, in the right section this time :) | 21:25 |
| *** jorge_munoz has joined #openstack-keystone | 21:28 | |
| *** mhickey has quit IRC | 21:28 | |
| *** aginwala has quit IRC | 21:31 | |
| ayoung | stevemar, OK, added two more lines to the check. Its a two way confirmation that the lists match. Comment one out, and the test will pass today | 21:33 |
| ayoung | Probably should be an equals, though | 21:33 |
| ayoung | stevemar, meh. its ok as is..I will change the test when I fix | 21:33 |
| *** rodrigods has quit IRC | 21:34 | |
| *** rodrigods has joined #openstack-keystone | 21:34 | |
| *** jsavak has quit IRC | 21:34 | |
| stevemar | ayoung: \o/ | 21:35 |
| stevemar | henrynash: want to take a quick peek at that one? ^ | 21:35 |
| stevemar | henrynash: we'll have one less bug and ayoung and work on the actual fix | 21:35 |
| *** jsavak has joined #openstack-keystone | 21:35 | |
| -openstackstatus- NOTICE: The infrastructure team is taking gerrit offline for maintenance this afternoon, beginning at 22:00 utc. We should have it back online around 23:00 utc. http://lists.openstack.org/pipermail/openstack-dev/2016-February/086195.html | 21:46 | |
| openstackgerrit | Merged openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 21:53 |
| *** aginwala has joined #openstack-keystone | 21:54 | |
| *** jorge_munoz has quit IRC | 21:55 | |
| openstackgerrit | Merged openstack/keystone: Convert assignment.root_role config option to list of strings https://review.openstack.org/279703 | 21:55 |
| *** jorge_munoz has joined #openstack-keystone | 21:56 | |
| *** jorge_munoz has quit IRC | 21:56 | |
| *** daemontool has quit IRC | 21:58 | |
| *** knikolla has quit IRC | 21:58 | |
| stevemar | lbragstad: around? | 22:02 |
| lbragstad | stevemar o/ | 22:02 |
| stevemar | lbragstad: i'm not smart, and i'm also very lazy. what was the result of the trust discussion from tuesday's meeting? | 22:03 |
| stevemar | lbragstad: i wanted to clean up any patches/bugs that jorge hasn't yet | 22:03 |
| lbragstad | stevemar this was essentially the direction https://review.openstack.org/#/c/274850/ | 22:04 |
| lbragstad | which merged - but that's only part of it | 22:04 |
| stevemar | lbragstad: right | 22:04 |
| stevemar | lbragstad: what about the bit with redelegation and impersonation | 22:04 |
| lbragstad | stevemar that only removes support for "validating" trust-scoped tokens against v2 | 22:04 |
| lbragstad | stevemar oh... | 22:04 |
| stevemar | i meant that part :) | 22:04 |
| lbragstad | jorge_munoz worked that out with amakarov_away | 22:04 |
| -openstackstatus- NOTICE: Gerrit is offline for maintenacne until 23:00 utc | 22:04 | |
| *** ChanServ changes topic to "Gerrit is offline for maintenacne until 23:00 utc" | 22:04 | |
| stevemar | not the fernet part | 22:04 |
| stevemar | lbragstad: what was the outcome o_O | 22:05 |
| lbragstad | stevemar the outcome was that we need to actually define what the behavior is that we want out of trusts | 22:05 |
| lbragstad | stevemar so i started https://etherpad.openstack.org/p/keystone-trust-behavior for people to start jotting down use-cases and behaviors | 22:06 |
| *** browne has joined #openstack-keystone | 22:06 | |
| *** phalmos has quit IRC | 22:08 | |
| stevemar | lbragstad: blargh | 22:10 |
| lbragstad | stevemar sorry | 22:10 |
| lbragstad | :) | 22:10 |
| stevemar | lbragstad: i guess non are mitaka-3 blockers | 22:10 |
| *** jsavak has quit IRC | 22:10 | |
| *** petertr7 is now known as petertr7_away | 22:10 | |
| lbragstad | stevemar not that I am aware of - but i know it was brought up because of the revocation event stuff (that's what led jorge_munoz down the trust rabbit hole initially) | 22:11 |
| stevemar | lbragstad: i've got 2 open right now https://bugs.launchpad.net/keystone/+bug/1539766 and https://bugs.launchpad.net/keystone/+bug/1538626 | 22:11 |
| openstack | Launchpad bug 1539766 in OpenStack Identity (keystone) "trust redelegation allows trustee to create a trust (with impersonation set to true) from a redelegated trust (with impersonation set to false)" [High,In progress] - Assigned to Jorge Munoz (jorge-munoz) | 22:11 |
| openstack | Launchpad bug 1538626 in OpenStack Identity (keystone) "Fix trust test cases for redelegation and add test for impersonation" [Low,In progress] - Assigned to Jorge Munoz (jorge-munoz) | 22:11 |
| lbragstad | stevemar those make sense | 22:11 |
| *** lhcheng has quit IRC | 22:14 | |
| *** lhcheng has joined #openstack-keystone | 22:15 | |
| *** ChanServ sets mode: +v lhcheng | 22:15 | |
| bknudson_ | stevemar: I think I figured it out. Adding add-header "Connection: close" seems to help. Tells the client not to try to re-use the connection or something. | 22:19 |
| bknudson_ | there was a mention of it here: https://github.com/TechEmpower/FrameworkBenchmarks/issues/114 | 22:20 |
| *** lhcheng has quit IRC | 22:20 | |
| bknudson_ | I'd post it to gerrit but... | 22:20 |
| *** vgridnev has quit IRC | 22:21 | |
| stevemar | bknudson_: is that added to CLI only, or to the ini file? | 22:21 |
| bknudson_ | stevemar: I put it in the ini file. the ini file and uwsgi cmd line options are equivalent | 22:22 |
| stevemar | bknudson_: just "connection = close" | 22:22 |
| stevemar | or add-header = "connection: close" | 22:22 |
| bknudson_ | add-header = Connection: close | 22:22 |
| stevemar | otay | 22:22 |
| bknudson_ | I'm also going to add some other options: thunder-lock = true | 22:23 |
| bknudson_ | master = true | 22:23 |
| stevemar | bknudson_: just cause it sounds cool? | 22:23 |
| bknudson_ | enable-threads = true | 22:23 |
| stevemar | THUNDER LOCK ENGAGE! | 22:23 |
| bknudson_ | stevemar: y, just because it sounds cool | 22:23 |
| bknudson_ | it has to do with thundering herd problem when you have multiple listeners on a socket. | 22:24 |
| bknudson_ | not that it's going to be a big deal when there's only a few threads. | 22:24 |
| bknudson_ | "Uwsgi is not a "frontend" HTTP server. Keep-alive support is weak." -- y, uwsgi is a turd. | 22:25 |
| bknudson_ | eventually we'll be able to make apache the frontend and have it talk uwsgi protocol to this uwsgi process. | 22:25 |
| bknudson_ | and we'll probably go that way pretty soon, I just thought it would be easier to have uwsgi do http at first. | 22:26 |
| stevemar | bknudson_: giving it a whirl now | 22:29 |
| *** RichardRaseley has joined #openstack-keystone | 22:32 | |
| bknudson_ | I'm kicking myself for not using gunicorn | 22:34 |
| *** roxanaghe has quit IRC | 22:35 | |
| stevemar | bknudson_: ++, that seems to be the option that was needed | 22:36 |
| bknudson_ | ok. I'll post it up when gerrit is back. | 22:36 |
| stevemar | bknudson_: it's still early... we can switch to gunicorn | 22:37 |
| stevemar | or both | 22:37 |
| bknudson_ | I'll post it as a follow-on | 22:37 |
| stevemar | bknudson_: ++ | 22:37 |
| stevemar | bknudson_: the point is to move away from eventlet and toward real http servers | 22:37 |
| *** aginwala has quit IRC | 22:38 | |
| stevemar | if we can support apache/gunicorn/uwsgi, then i'm all for it | 22:38 |
| *** aginwala has joined #openstack-keystone | 22:42 | |
| *** edmondsw has quit IRC | 22:43 | |
| *** mylu has joined #openstack-keystone | 22:48 | |
| *** lhcheng has joined #openstack-keystone | 22:57 | |
| *** ChanServ sets mode: +v lhcheng | 22:57 | |
| *** richm has joined #openstack-keystone | 22:58 | |
| *** RichardRaseley has quit IRC | 23:04 | |
| -openstackstatus- NOTICE: Gerrit is offline for maintenance, ETA updated to 23:30 utc | 23:05 | |
| *** ChanServ changes topic to "Gerrit is offline for maintenance, ETA updated to 23:30 utc" | 23:06 | |
| *** aginwala has quit IRC | 23:13 | |
| *** roxanaghe has joined #openstack-keystone | 23:14 | |
| ayoung | stevemar, well, I have a fix for the implied roles in the trust token, but I can;t post to gerrit as it is down | 23:17 |
| *** aginwala has joined #openstack-keystone | 23:19 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:22 | |
| ayoung | https://mariadb.com/blog/recent-release-mariadb-10111-contains-two-new-authentication-plugins | 23:27 |
| *** pushkaru has quit IRC | 23:39 | |
| *** pushkaru has joined #openstack-keystone | 23:40 | |
| -openstackstatus- NOTICE: Gerrit is offline for maintenance, ETA updated to 23:59 utc | 23:40 | |
| *** ChanServ changes topic to "Gerrit is offline for maintenance, ETA updated to 23:59 utc" | 23:40 | |
| *** pushkaru has quit IRC | 23:41 | |
| *** pushkaru has joined #openstack-keystone | 23:41 | |
| *** markvoelker has quit IRC | 23:41 | |
| *** lhcheng has quit IRC | 23:46 | |
| *** richm has quit IRC | 23:46 | |
| *** lhcheng has joined #openstack-keystone | 23:47 | |
| *** ChanServ sets mode: +v lhcheng | 23:47 | |
| *** richm has joined #openstack-keystone | 23:49 | |
| *** slberger has left #openstack-keystone | 23:54 | |
| *** pushkaru has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
