| *** clenimar has joined #openstack-keystone | 00:02 | |
| *** dims has quit IRC | 00:04 | |
| *** dan_nguyen has joined #openstack-keystone | 00:06 | |
| *** mylu has quit IRC | 00:06 | |
| *** su_zhang has joined #openstack-keystone | 00:07 | |
| *** dims has joined #openstack-keystone | 00:11 | |
| *** clenimar has quit IRC | 00:11 | |
| *** gildub has joined #openstack-keystone | 00:12 | |
| *** mylu has joined #openstack-keystone | 00:13 | |
| *** mylu has quit IRC | 00:15 | |
| *** mylu has joined #openstack-keystone | 00:22 | |
| *** EinstCra_ has quit IRC | 00:31 | |
| *** su_zhang has quit IRC | 00:32 | |
| *** markvoelker has joined #openstack-keystone | 00:35 | |
| *** markvoelker has quit IRC | 00:39 | |
| *** gildub has quit IRC | 00:40 | |
| *** spzala has quit IRC | 00:47 | |
| *** spzala has joined #openstack-keystone | 00:47 | |
| *** su_zhang has joined #openstack-keystone | 00:47 | |
| *** aginwala has quit IRC | 00:51 | |
| *** spzala has quit IRC | 00:51 | |
| *** spzala has joined #openstack-keystone | 00:53 | |
| *** gildub has joined #openstack-keystone | 00:56 | |
| *** spzala_ has joined #openstack-keystone | 00:58 | |
| *** spzala has quit IRC | 00:58 | |
| *** spzala has joined #openstack-keystone | 01:01 | |
| *** spzala_ has quit IRC | 01:02 | |
| *** dims has quit IRC | 01:04 | |
| *** spzala has quit IRC | 01:05 | |
| *** jorge_munoz has joined #openstack-keystone | 01:05 | |
| *** dims has joined #openstack-keystone | 01:08 | |
| *** davechen has joined #openstack-keystone | 01:08 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Consolidate TestTrustRedelegation and TestTrustAuth tests https://review.openstack.org/280447 | 01:10 |
|---|---|---|
| *** jorge_munoz has quit IRC | 01:12 | |
| *** csoukup has joined #openstack-keystone | 01:12 | |
| openstackgerrit | Tin Lam proposed openstack/keystone: Removing H405 violations from keystone https://review.openstack.org/278190 | 01:14 |
| *** csoukup has quit IRC | 01:14 | |
| *** aginwala has joined #openstack-keystone | 01:17 | |
| *** mylu has quit IRC | 01:17 | |
| *** spzala has joined #openstack-keystone | 01:23 | |
| *** david-lyle has joined #openstack-keystone | 01:23 | |
| *** spzala has quit IRC | 01:27 | |
| *** diazjf has joined #openstack-keystone | 01:38 | |
| *** diazjf has quit IRC | 01:39 | |
| *** dan_nguyen has quit IRC | 01:43 | |
| *** mylu has joined #openstack-keystone | 01:48 | |
| *** jasonsb has quit IRC | 01:56 | |
| *** edmondsw_ has quit IRC | 01:56 | |
| openstackgerrit | ayoung proposed openstack/keystone: Disable Admin tokens set to None https://review.openstack.org/280467 | 01:56 |
| *** jasonsb has joined #openstack-keystone | 01:57 | |
| *** spzala has joined #openstack-keystone | 01:57 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 02:06 |
| *** su_zhang has quit IRC | 02:26 | |
| *** su_zhang has joined #openstack-keystone | 02:26 | |
| *** shoutm_ has joined #openstack-keystone | 02:31 | |
| *** shoutm has quit IRC | 02:33 | |
| *** markvoelker has joined #openstack-keystone | 02:36 | |
| openstackgerrit | Merged openstack/keystone: Avoid `None` as a redundant argument to dict.get() https://review.openstack.org/280319 | 02:36 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/280477 | 02:39 |
| *** markvoelker has quit IRC | 02:40 | |
| *** su_zhang has quit IRC | 02:43 | |
| *** dan_nguyen has joined #openstack-keystone | 02:44 | |
| *** mylu has quit IRC | 02:44 | |
| *** mylu has joined #openstack-keystone | 02:48 | |
| *** mylu has quit IRC | 02:52 | |
| *** mylu has joined #openstack-keystone | 02:55 | |
| *** gildub has quit IRC | 02:59 | |
| *** xavier_ has joined #openstack-keystone | 03:12 | |
| xavier_ | good night everyone | 03:13 |
| xavier_ | I'm facing an error when restarting keystone on devstack: ArgsAlreadyParsedError: arguments already parsed: cannot register CLI option | 03:15 |
| openstackgerrit | Merged openstack/keystone: Fix terms from patch 275706 https://review.openstack.org/280436 | 03:15 |
| xavier_ | do you have any idea why this is happening? | 03:15 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/280477 | 03:16 |
| *** neophy has joined #openstack-keystone | 03:17 | |
| *** aginwala has quit IRC | 03:19 | |
| openstackgerrit | Merged openstack/keystone: Avoid "non-Pythonic" method names https://review.openstack.org/280309 | 03:22 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/280477 | 03:24 |
| *** gildub has joined #openstack-keystone | 03:28 | |
| stevemar | xavier_: any other information? | 03:29 |
| *** ccard__ has joined #openstack-keystone | 03:31 | |
| *** xavier_ has quit IRC | 03:32 | |
| *** ccard_ has quit IRC | 03:34 | |
| *** shoutm_ has quit IRC | 03:34 | |
| *** ccard_ has joined #openstack-keystone | 03:35 | |
| *** ccard__ has quit IRC | 03:36 | |
| *** dims has quit IRC | 03:37 | |
| *** xavier_ has joined #openstack-keystone | 03:38 | |
| *** aginwala has joined #openstack-keystone | 03:38 | |
| *** spzala has quit IRC | 03:38 | |
| xavier_ | @stevemar: https://etherpad.openstack.org/p/bug | 03:39 |
| *** spzala has joined #openstack-keystone | 03:39 | |
| xavier_ | @stevemar: thats all | 03:39 |
| davechen | xavier_: how do you restart keystone? | 03:40 |
| *** shoutm has joined #openstack-keystone | 03:40 | |
| openstackgerrit | Merged openstack/keystone: Allow project_id in catalog substitutions https://review.openstack.org/279576 | 03:41 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/280477 | 03:42 |
| davechen | xavier_: sometimes, the service is not acutally stopped before started if you typing 'restart', try to stop it at first and them start it again. | 03:44 |
| *** spzala has quit IRC | 03:44 | |
| xavier_ | I was trying to kill the processes on rejoin-stack.sh | 03:47 |
| xavier_ | devechen: I was trying to kill the processes on rejoin-stack.sh* | 03:47 |
| xavier_ | devechen: crtl + c on 'key' (rejoin-stack.sh) | 03:49 |
| davechen | xavier_: i was facing this issue like this, the workaroud is making sure the service is really stopped and start it again, this might be a bug and could be fixed in keystone. | 03:49 |
| davechen | xavier_: crtl + c on 'key' doesn't work | 03:50 |
| xavier_ | devechen: so, how to make sure the service is stopped? | 03:51 |
| davechen | xavier_: keytone is running with apache, you cannot stop the service by ctrl + c | 03:51 |
| davechen | xavier_: the easy way is restart apache2 instead. | 03:51 |
| xavier_ | devechen: roger that, trying it now | 03:52 |
| davechen | xavier_: good luck | 03:52 |
| *** davechen is now known as davechen_afk | 03:52 | |
| *** xavier_ has quit IRC | 03:58 | |
| *** daemontool has quit IRC | 04:02 | |
| *** Nirupama has joined #openstack-keystone | 04:03 | |
| *** david-lyle has quit IRC | 04:03 | |
| stevemar | jamielennox: poke | 04:04 |
| jamielennox | stevemar: hmm | 04:04 |
| stevemar | jamielennox: gotta bug you about this bug (pun not intended) | 04:05 |
| stevemar | https://bugs.launchpad.net/keystonemiddleware/+bug/1542486 | 04:05 |
| openstack | Launchpad bug 1542486 in OpenStack Compute (nova) "nova-compute stack traces with BadRequest: Specifying 'tenant_id' other than authenticated tenant in request requires admin privileges" [Undecided,Incomplete] | 04:05 |
| *** gildub has quit IRC | 04:09 | |
| jamielennox | stevemar: i'm not sure what the issue is | 04:10 |
| openstackgerrit | Merged openstack/pycadf: Add docstring validation https://review.openstack.org/230257 | 04:11 |
| stevemar | jamielennox: me either! | 04:12 |
| *** mylu has quit IRC | 04:16 | |
| jamielennox | stevemar: added comment - it's kind of a guess based on the error message, but i don't know what to do without the environment | 04:16 |
| *** mylu has joined #openstack-keystone | 04:17 | |
| *** mylu has quit IRC | 04:19 | |
| stevemar | jamielennox: review https://review.openstack.org/#/c/279872/ if you can, it's an easy requirements clean up | 04:20 |
| stevemar | jamielennox: gonna release ksa/ksm tomorrow (today for you) | 04:20 |
| jamielennox | stevemar: done | 04:21 |
| *** dan_nguyen has quit IRC | 04:22 | |
| *** dan_nguyen has joined #openstack-keystone | 04:26 | |
| *** mylu has joined #openstack-keystone | 04:28 | |
| *** mylu has quit IRC | 04:29 | |
| *** mylu has joined #openstack-keystone | 04:31 | |
| *** k-ishii_ has joined #openstack-keystone | 04:31 | |
| *** anzen has joined #openstack-keystone | 04:33 | |
| *** hid-kanetoshi has joined #openstack-keystone | 04:33 | |
| *** r-mizuno has joined #openstack-keystone | 04:33 | |
| *** hid-kanetoshi has quit IRC | 04:34 | |
| *** k-ishii_ has quit IRC | 04:34 | |
| *** gildub has joined #openstack-keystone | 04:34 | |
| stevemar | ty! | 04:34 |
| *** anzen has quit IRC | 04:35 | |
| *** markvoelker has joined #openstack-keystone | 04:36 | |
| *** spzala has joined #openstack-keystone | 04:39 | |
| *** markvoelker has quit IRC | 04:41 | |
| *** dan_nguyen has quit IRC | 04:41 | |
| *** r-mizuno has quit IRC | 04:42 | |
| *** spzala has quit IRC | 04:45 | |
| *** dave-mccowan has quit IRC | 04:47 | |
| *** fawadkhaliq has joined #openstack-keystone | 04:52 | |
| *** david-lyle has joined #openstack-keystone | 04:55 | |
| *** jasonsb has quit IRC | 05:09 | |
| *** subscope has joined #openstack-keystone | 05:09 | |
| *** jasonsb_ has joined #openstack-keystone | 05:10 | |
| openstackgerrit | Merged openstack/keystoneauth: Cleanup test-requirements.txt https://review.openstack.org/279872 | 05:11 |
| stevemar | davechen_afk: poke: https://review.openstack.org/#/c/280435/ | 05:13 |
| *** davechen_afk is now known as davechen | 05:18 | |
| davechen | stevemar: done :) | 05:19 |
| *** mylu has quit IRC | 05:24 | |
| stevemar | \o/ | 05:24 |
| *** mylu has joined #openstack-keystone | 05:25 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: wsgi: fix base_url finding https://review.openstack.org/226464 | 05:33 |
| *** spzala has joined #openstack-keystone | 05:41 | |
| *** mylu has quit IRC | 05:42 | |
| *** spzala has quit IRC | 05:46 | |
| *** mylu has joined #openstack-keystone | 05:51 | |
| *** Ephur has joined #openstack-keystone | 05:53 | |
| *** wanghua has quit IRC | 05:54 | |
| *** mylu has quit IRC | 05:54 | |
| *** su_zhang has joined #openstack-keystone | 06:03 | |
| openstackgerrit | Merged openstack/keystone: Updating sample configuration file https://review.openstack.org/280477 | 06:05 |
| *** neophy has quit IRC | 06:15 | |
| *** gildub has quit IRC | 06:20 | |
| *** jaosorior has joined #openstack-keystone | 06:20 | |
| *** vgridnev_ has joined #openstack-keystone | 06:23 | |
| *** subscope has quit IRC | 06:34 | |
| *** markvoelker has joined #openstack-keystone | 06:37 | |
| *** aginwala has quit IRC | 06:38 | |
| *** david-lyle has quit IRC | 06:39 | |
| *** david-lyle has joined #openstack-keystone | 06:40 | |
| *** spzala has joined #openstack-keystone | 06:41 | |
| *** markvoelker has quit IRC | 06:42 | |
| *** GB21 has joined #openstack-keystone | 06:43 | |
| *** zzzeek has quit IRC | 06:44 | |
| *** spzala has quit IRC | 06:47 | |
| openstackgerrit | Merged openstack/keystone: Fixes parameter in duplicate project name creation https://review.openstack.org/280448 | 06:50 |
| *** subscope has joined #openstack-keystone | 06:52 | |
| openstackgerrit | javeme proposed openstack/python-keystoneclient: Encode the url parameters for base.CrudManager https://review.openstack.org/254154 | 06:53 |
| *** subscope has quit IRC | 06:55 | |
| *** e0ne has joined #openstack-keystone | 07:02 | |
| *** _cjones_ has joined #openstack-keystone | 07:04 | |
| *** _cjones_ has quit IRC | 07:06 | |
| *** _cjones_ has joined #openstack-keystone | 07:06 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: wsgi: fix base_url finding https://review.openstack.org/226464 | 07:20 |
| *** kiranr_ has joined #openstack-keystone | 07:32 | |
| *** kiranr_ is now known as kiran-r | 07:33 | |
| *** rcernin has joined #openstack-keystone | 07:37 | |
| *** GB21 has quit IRC | 07:40 | |
| *** lhcheng has joined #openstack-keystone | 07:41 | |
| *** ChanServ sets mode: +v lhcheng | 07:41 | |
| *** spzala has joined #openstack-keystone | 07:44 | |
| *** ekarlso has quit IRC | 07:44 | |
| *** Anticimex has quit IRC | 07:45 | |
| *** kragniz has quit IRC | 07:46 | |
| *** kragniz has joined #openstack-keystone | 07:46 | |
| *** Anticimex has joined #openstack-keystone | 07:46 | |
| *** spzala has quit IRC | 07:48 | |
| *** fawadkhaliq has quit IRC | 07:51 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:52 | |
| *** fawadkhaliq has quit IRC | 07:52 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:52 | |
| *** fawadkhaliq has quit IRC | 07:53 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:53 | |
| *** ekarlso has joined #openstack-keystone | 07:57 | |
| *** jed56 has joined #openstack-keystone | 08:08 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: encode user id for notifications https://review.openstack.org/280542 | 08:13 |
| *** e0ne has quit IRC | 08:13 | |
| *** subscope has joined #openstack-keystone | 08:21 | |
| openstackgerrit | Merged openstack/keystone: sensible default for secure_proxy_ssl_header https://review.openstack.org/280435 | 08:22 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/280545 | 08:24 |
| *** su_zhang has quit IRC | 08:27 | |
| *** _cjones_ has quit IRC | 08:29 | |
| *** shoutm has quit IRC | 08:31 | |
| *** shoutm has joined #openstack-keystone | 08:33 | |
| *** vgridnev_ has quit IRC | 08:33 | |
| *** vgridnev has joined #openstack-keystone | 08:34 | |
| *** henrynash has joined #openstack-keystone | 08:37 | |
| *** ChanServ sets mode: +v henrynash | 08:37 | |
| *** vgridnev has quit IRC | 08:38 | |
| *** vgridnev_ has joined #openstack-keystone | 08:39 | |
| *** GB21 has joined #openstack-keystone | 08:41 | |
| *** vgridnev_ has quit IRC | 08:42 | |
| *** vgridnev has joined #openstack-keystone | 08:43 | |
| *** vgridnev has quit IRC | 08:44 | |
| *** subscope has quit IRC | 08:50 | |
| *** fhubik has joined #openstack-keystone | 08:53 | |
| *** fhubik is now known as fhubik_brb | 08:53 | |
| *** fhubik_brb is now known as fhubik | 09:03 | |
| *** subscope has joined #openstack-keystone | 09:04 | |
| *** kiran-r has quit IRC | 09:08 | |
| *** kiran-r has joined #openstack-keystone | 09:09 | |
| *** mhickey has joined #openstack-keystone | 09:11 | |
| *** e0ne has joined #openstack-keystone | 09:16 | |
| *** d0ugal has quit IRC | 09:21 | |
| *** d0ugal has joined #openstack-keystone | 09:21 | |
| *** lhcheng has quit IRC | 09:26 | |
| *** mvk has quit IRC | 09:27 | |
| *** shoutm_ has joined #openstack-keystone | 09:31 | |
| *** shoutm has quit IRC | 09:32 | |
| *** akscram has quit IRC | 09:33 | |
| *** akscram has joined #openstack-keystone | 09:33 | |
| *** subscope has quit IRC | 09:40 | |
| *** spzala has joined #openstack-keystone | 09:45 | |
| *** subscope has joined #openstack-keystone | 09:47 | |
| *** fawadkhaliq has quit IRC | 09:48 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:48 | |
| *** davechen has left #openstack-keystone | 09:49 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v2_0) https://review.openstack.org/267449 | 09:50 |
| *** fawadkhaliq has quit IRC | 09:50 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:50 | |
| *** spzala has quit IRC | 09:50 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3) https://review.openstack.org/267456 | 09:51 |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3/contrib) https://review.openstack.org/268003 | 09:53 |
| *** mvk has joined #openstack-keystone | 09:54 | |
| *** fawadkhaliq has quit IRC | 09:54 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:55 | |
| *** GB21 has quit IRC | 10:08 | |
| *** GB21 has joined #openstack-keystone | 10:09 | |
| *** fhubik is now known as fhubik_brb | 10:21 | |
| *** fhubik_brb is now known as fhubik | 10:21 | |
| *** GB21 has quit IRC | 10:24 | |
| openstackgerrit | Merged openstack/keystone: Updating sample configuration file https://review.openstack.org/280545 | 10:26 |
| *** GB21 has joined #openstack-keystone | 10:26 | |
| *** GB21 has quit IRC | 10:33 | |
| *** spzala has joined #openstack-keystone | 10:46 | |
| samueldmq | morning keystoners | 10:46 |
| *** GB21 has joined #openstack-keystone | 10:47 | |
| *** subscope has quit IRC | 10:47 | |
| *** pece has joined #openstack-keystone | 10:50 | |
| *** spzala has quit IRC | 10:50 | |
| *** dims has joined #openstack-keystone | 10:51 | |
| *** dave-mccowan has joined #openstack-keystone | 11:04 | |
| henrynash | samuedlmq: mornin | 11:04 |
| henrynash | samueldmq: hey, got a random question for you if you have a moment | 11:04 |
| samueldmq | henrynash: hi, sure | 11:05 |
| henrynash | samueldmq: trusts…..take a look at https://bugs.launchpad.net/keystone/+bug/1546039 | 11:05 |
| openstack | Launchpad bug 1546039 in OpenStack Identity (keystone) "If one trustor role is removed, the trust cannot be used" [Undecided,New] | 11:05 |
| henrynash | samueldmq: I just raised this….how do you think it is meant to work | 11:06 |
| henrynash | ? | 11:06 |
| samueldmq | henrynash: it may work both way, it depends on what the use cases/preferences are | 11:07 |
| henrynash | samueldmq: I know exacly how ro fix this (patch on its way)…but just want to make sure what the expected rsult shoul dbe | 11:07 |
| samueldmq | henrynash: both may make sense, for example: | 11:08 |
| samueldmq | i) if you have project_admin and project_member and admin has been remove, maybe you can get a token with member only and do things that will be useful | 11:08 |
| samueldmq | ii) if you have nova_create and glance_read and glance_read has been revoked, it doesn't matter to have nova_create anyways if you can't read the image for a vm | 11:09 |
| samueldmq | maybe the default could be 'get all or fail', but a special query_param in the request allow it ? (since both cases above make sense and it would be up to the caller ? ) ^ | 11:10 |
| samueldmq | (this is a third option) | 11:10 |
| henrynash | so sure, I can imagine the user scenarios being different…..I guess it is more should our code issue a “partial token” if it finds some of the roles of the trustor have been removed | 11:10 |
| henrynash | maybe, indeed | 11:10 |
| henrynash | so I’ll post the patches, and then get ayoung on teh case later! | 11:11 |
| *** dims has quit IRC | 11:12 | |
| samueldmq | henrynash: nice | 11:13 |
| openstackgerrit | henry-nash proposed openstack/keystone: Demonstrate defect in trusts if a role is unassigned https://review.openstack.org/280610 | 11:14 |
| *** fhubik has quit IRC | 11:14 | |
| samueldmq | henrynash: do you see a trust as a delegation or a set of delegations ? | 11:15 |
| samueldmq | if it's *a delegation* of a set of roles, then it should be revoked too upon assignment revocation | 11:17 |
| samueldmq | if it's a set of role delegations, then the set doesn't disappear when one of the delegations are removed from the set | 11:17 |
| samueldmq | henrynash: makes sense ? I really can see it either way :) | 11:18 |
| *** subscope has joined #openstack-keystone | 11:18 | |
| *** dims has joined #openstack-keystone | 11:24 | |
| *** GB21 has quit IRC | 11:25 | |
| *** d0ugal has quit IRC | 11:36 | |
| *** rodrigods has quit IRC | 11:38 | |
| henrynash | samueldmq: rght | 11:38 |
| *** rodrigods has joined #openstack-keystone | 11:38 | |
| henrynash | samueldmq: right, agreed | 11:38 |
| *** dims has quit IRC | 11:38 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Fix defect in trusts if a role is unassigned https://review.openstack.org/280621 | 11:41 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules in the v3 policy sample for domain specifc roles https://review.openstack.org/262078 | 11:43 |
| *** GB21 has joined #openstack-keystone | 11:45 | |
| *** fawadkhaliq has quit IRC | 11:45 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:45 | |
| *** fawadkhaliq has quit IRC | 11:46 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:46 | |
| *** spzala has joined #openstack-keystone | 11:47 | |
| *** fawadkhaliq has quit IRC | 11:47 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:47 | |
| *** fawadkhaliq has quit IRC | 11:47 | |
| *** rodrigods has quit IRC | 11:47 | |
| *** rodrigods has joined #openstack-keystone | 11:48 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:48 | |
| *** spzala has quit IRC | 11:51 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify implied roles to honor domain specific roles https://review.openstack.org/263064 | 11:54 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules for domain specific role assignments https://review.openstack.org/263549 | 11:55 |
| *** d0ugal has joined #openstack-keystone | 12:00 | |
| *** d0ugal has quit IRC | 12:00 | |
| *** d0ugal has joined #openstack-keystone | 12:00 | |
| *** GB21 has quit IRC | 12:02 | |
| *** sdake has quit IRC | 12:06 | |
| *** fawadkhaliq has quit IRC | 12:06 | |
| *** fawadk has joined #openstack-keystone | 12:06 | |
| *** sdake has joined #openstack-keystone | 12:06 | |
| *** raildo-afk is now known as raildo | 12:11 | |
| *** fawadk has quit IRC | 12:11 | |
| *** mvk has quit IRC | 12:13 | |
| *** ericksonsantos has joined #openstack-keystone | 12:13 | |
| *** mvk has joined #openstack-keystone | 12:15 | |
| *** raildo is now known as raildo-afk | 12:16 | |
| *** pcaruana has joined #openstack-keystone | 12:18 | |
| *** raildo-afk is now known as raildo | 12:20 | |
| *** raildo is now known as raildo-afk | 12:25 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Enable support for posixGroups in LDAP https://review.openstack.org/258528 | 12:29 |
| *** raildo-afk is now known as raildo | 12:31 | |
| *** archers has joined #openstack-keystone | 12:41 | |
| *** archers has quit IRC | 12:43 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Enable support for posixGroups in LDAP https://review.openstack.org/258528 | 12:46 |
| *** spzala has joined #openstack-keystone | 12:47 | |
| *** gordc has joined #openstack-keystone | 12:51 | |
| *** annasort has quit IRC | 12:52 | |
| *** spzala has quit IRC | 12:52 | |
| *** boris-42 has joined #openstack-keystone | 12:56 | |
| *** davechen has joined #openstack-keystone | 12:59 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Enable support for posixGroups in LDAP https://review.openstack.org/258528 | 13:01 |
| openstackgerrit | David Stanek proposed openstack/keystone: Enables the notification tests in py3 https://review.openstack.org/280671 | 13:01 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fix keystone.common.wsgi to explicitly use bytes https://review.openstack.org/280672 | 13:01 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes the templated backend tests for Python3 https://review.openstack.org/280673 | 13:01 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes to get cert tests running in Py3 https://review.openstack.org/280674 | 13:01 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes hacking for Py3 tests https://review.openstack.org/280675 | 13:01 |
| *** mvk has quit IRC | 13:02 | |
| *** edmondsw has joined #openstack-keystone | 13:03 | |
| samueldmq | dstanek: wow | 13:05 |
| *** mvk has joined #openstack-keystone | 13:05 | |
| dstanek | samueldmq: howdy | 13:07 |
| *** bdossant has joined #openstack-keystone | 13:07 | |
| samueldmq | dstanek: hey :) | 13:08 |
| samueldmq | dstanek: so files removed from tests-py3-blacklist.txt are automaticlly ran against py3 | 13:08 |
| dstanek | i had some stuff that's been sitting around for a bit | 13:08 |
| dstanek | samueldmq: yes | 13:09 |
| dstanek | samueldmq: i have lots more tests working! but the code change is awful right now. i have to fix when i have the time | 13:09 |
| samueldmq | dstanek: cool, will look at it | 13:10 |
| samueldmq | dstanek: yes, this is the type of things that need quick review/merge | 13:10 |
| samueldmq | dstanek: otherwise is a bit painful to maintain | 13:10 |
| dstanek | yup. | 13:11 |
| *** doug-fish has joined #openstack-keystone | 13:14 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Allow project domain_id to be nullable at the manager level https://review.openstack.org/264533 | 13:15 |
| openstackgerrit | henry-nash proposed openstack/keystone: Verify project unique constraints for projects acting as domains https://review.openstack.org/158372 | 13:20 |
| samueldmq | henrynash: +2'ed ^ | 13:21 |
| henrynash | samueldmq: thx! | 13:21 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add tests in preparation of projects acting as a domain https://review.openstack.org/272369 | 13:21 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add is_domain filter to v3 list_projects https://review.openstack.org/158398 | 13:22 |
| henrynash | ayoung: ping | 13:26 |
| *** davechen1 has joined #openstack-keystone | 13:28 | |
| *** davechen has quit IRC | 13:31 | |
| *** spzala has joined #openstack-keystone | 13:31 | |
| *** doug-fish has quit IRC | 13:34 | |
| marekd | dolphm: hi | 13:35 |
| dolphm | marekd: o/ | 13:35 |
| marekd | dolphm: you wanted to chat on pysaml in keystone | 13:35 |
| dolphm | marekd: i was wondering if you'll have time to start making traction on a PoC for Newton? | 13:36 |
| marekd | dolphm: I am unsure on my priorities for next release. If so, that would probably become my highest priority and majority of my time. | 13:37 |
| *** davechen has joined #openstack-keystone | 13:37 | |
| dolphm | marekd: that would be awesome if so :) | 13:38 |
| dolphm | marekd: is it something you want to work on? | 13:38 |
| *** markvoelker has joined #openstack-keystone | 13:39 | |
| marekd | dolphm: since this time that would not be as interchangeable as with apache modules i'd first kick off some discussion (user survey?) on which protocol we sohuld work on - saml or oidc. | 13:39 |
| *** davechen1 has quit IRC | 13:40 | |
| marekd | does Rackspace have preferences? | 13:40 |
| dolphm | marekd: i imagine SAML - i have yet to hear of anyone interested in OIDC beyond IBM (?) | 13:40 |
| dolphm | marekd: SAML was the clear preference before we went down the shibboleth route too | 13:41 |
| marekd | aha | 13:41 |
| marekd | ok | 13:41 |
| marekd | well, it was 'let's make protocol agnostic solution first' and I was more like referring to SAML always as it's something I have here. | 13:42 |
| *** EinstCrazy has joined #openstack-keystone | 13:42 | |
| dolphm | marekd: true | 13:42 |
| openstackgerrit | henry-nash proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 13:44 |
| *** dims has joined #openstack-keystone | 13:45 | |
| *** StefanPaetowJisc has joined #openstack-keystone | 13:46 | |
| anteaya | StefanPaetowJisc: | 13:46 |
| anteaya | hi | 13:46 |
| anteaya | so hey keysstone folks | 13:46 |
| anteaya | this is StefanPaetowJisc | 13:46 |
| StefanPaetowJisc | Hi! :-) | 13:47 |
| anteaya | stefan is at the ops meetup in manchester with me | 13:47 |
| anteaya | StefanPaetowJisc: works with an educational group in the uk | 13:47 |
| StefanPaetowJisc | Correct... I work for the UK equivalent of Internet2 | 13:47 |
| anteaya | and would like to learn how to contribute to keystone | 13:47 |
| anteaya | he has a specific functionality that he feels would be useful in keystone | 13:48 |
| anteaya | and would like to learn how to communicate that to folks | 13:48 |
| StefanPaetowJisc | Indeed... in the EU there's a lot of focus on federation and some of our collaborators (like the University of Kent through David Chadwick) have already contributed some changes to make that happen. | 13:50 |
| *** dims has quit IRC | 13:51 | |
| StefanPaetowJisc | The one thing that's sort-of the holy grail I suppose is making that work on the command-line. We'd like to see how we can help with this through GSSAPI support in Keystone, or any other modules that use GSSAPI. | 13:52 |
| *** subscope has quit IRC | 13:53 | |
| dstanek | StefanPaetowJisc: it would probably be a good idea to write up a short summary for what you are thinking so that is can be discussed. | 13:53 |
| anteaya | dstanek: would something on an etherpad be sufficient as a beginning? | 13:54 |
| anteaya | dstanek: and good morning | 13:54 |
| dstanek | StefanPaetowJisc: just don't get caught up too much in the details | 13:54 |
| StefanPaetowJisc | *nod* Is there any specific format you need it in? | 13:54 |
| dstanek | anteaya: probably at first. the end result should probably be a spec | 13:54 |
| anteaya | awesome | 13:54 |
| dstanek | anteaya: good morning! | 13:54 |
| anteaya | :) | 13:55 |
| anteaya | StefanPaetowJisc: I've created this for you: https://etherpad.openstack.org/p/JISC-GSSAPI | 13:55 |
| dstanek | StefanPaetowJisc: we have a spec template if you want to submit as a spec, but if you do i would say not to stress on filling out all of the sections. | 13:55 |
| StefanPaetowJisc | Ahh, thank you very much. | 13:55 |
| anteaya | StefanPaetowJisc: start by getting the rough draft in the etherpad | 13:56 |
| anteaya | then you can transfer to a spec | 13:56 |
| StefanPaetowJisc | Ok. | 13:56 |
| dstanek | StefanPaetowJisc: also note that depending on the implementation some logic may be ksc and some osc | 13:56 |
| *** davechen has left #openstack-keystone | 13:57 | |
| StefanPaetowJisc | osc? Pardon my ignorance, please. | 13:57 |
| dstanek | StefanPaetowJisc: oh, and welcome! | 13:57 |
| anteaya | I'll add the keystone-spec template to the etherpad | 13:57 |
| StefanPaetowJisc | Thank you. :-) | 13:57 |
| dstanek | openstack client - this is the actual command line interface for openstack services | 13:57 |
| StefanPaetowJisc | Ahhh. Of course. Thanks. | 13:57 |
| StefanPaetowJisc | That's the 'new' client, yes? | 13:57 |
| dstanek | the keystone client is losing it's ability to be a standalone command line client | 13:58 |
| anteaya | StefanPaetowJisc: yes the openstack client is the way of the future | 13:58 |
| anteaya | it actually is older than some of the clients but it is the selected point of convergence | 13:58 |
| anteaya | now we just have to converge | 13:59 |
| StefanPaetowJisc | Ok. Thanks for the clarification :-) | 14:00 |
| dstanek | StefanPaetowJisc: once you are done, the best way to get a consensus is to get on the meeting agenda to talk through your idea | 14:02 |
| *** doug-fish has joined #openstack-keystone | 14:02 | |
| StefanPaetowJisc | Ok. To do that, subscription to a mailing list? | 14:02 |
| *** raildo is now known as raildo-afk | 14:03 | |
| anteaya | StefanPaetowJisc: http://eavesdrop.openstack.org/#Keystone_Team_Meeting | 14:03 |
| anteaya | you should see the details about the keystone team meeting there | 14:03 |
| StefanPaetowJisc | Ahh, thanks Anita. | 14:03 |
| anteaya | attending a few prior to you wanting to discuss your spec will help you understand the workflow | 14:03 |
| anteaya | StefanPaetowJisc: welcome :) | 14:03 |
| StefanPaetowJisc | *nod* Understood | 14:04 |
| anteaya | the team meeting happens today in 4 hours | 14:05 |
| *** shoutm_ has quit IRC | 14:08 | |
| *** kiran-r has quit IRC | 14:08 | |
| *** StefanPaetowJisc has quit IRC | 14:08 | |
| *** mvk has quit IRC | 14:09 | |
| *** StefanPaetowJisc has joined #openstack-keystone | 14:09 | |
| *** raildo-afk is now known as raildo | 14:11 | |
| *** Guest76507 is now known as med_ | 14:12 | |
| *** med_ has quit IRC | 14:12 | |
| *** med_ has joined #openstack-keystone | 14:12 | |
| *** Nirupama has quit IRC | 14:13 | |
| StefanPaetowJisc | Yes... I'll have to try and attend the one next week... I've got the 'other' Openstack meeting in town to attend :-) | 14:14 |
| anteaya | fair enough | 14:14 |
| *** jaosorior has quit IRC | 14:16 | |
| *** jaosorior has joined #openstack-keystone | 14:17 | |
| *** petertr7_away is now known as petertr7 | 14:18 | |
| *** ninag has joined #openstack-keystone | 14:20 | |
| *** mvk has joined #openstack-keystone | 14:21 | |
| *** henrynash_ has joined #openstack-keystone | 14:22 | |
| *** ChanServ sets mode: +v henrynash_ | 14:22 | |
| *** subscope has joined #openstack-keystone | 14:22 | |
| StefanPaetowJisc | Ok, I'll jot some thoughts down on the Etherpad, and then see whether we can bash that into a reasonable version of a spec? :-) | 14:22 |
| *** henrynash has quit IRC | 14:23 | |
| *** henrynash_ is now known as henrynash | 14:23 | |
| *** EinstCra_ has joined #openstack-keystone | 14:25 | |
| *** EinstCrazy has quit IRC | 14:28 | |
| dstanek | StefanPaetowJisc: also you may want to get ayoung's feedback specifically because he is all about kerberos and related things | 14:35 |
| StefanPaetowJisc | Ok. Will do. | 14:35 |
| *** zzzeek has joined #openstack-keystone | 14:35 | |
| *** shoutm has joined #openstack-keystone | 14:40 | |
| *** eandersson has joined #openstack-keystone | 14:51 | |
| eandersson | Silly question, but did 5000/v3/tenants ever work? | 14:53 |
| eandersson | or was it always 5000/v3/projects? | 14:53 |
| edmondsw | eandersson I believe it's always been /v3/projects | 14:53 |
| eandersson | Thats what I thought, but just wanted to double check. | 14:54 |
| eandersson | Thanks | 14:54 |
| edmondsw | eandersson maybe I should let someone that was actually working on keystone back then answer, though :) | 14:55 |
| edmondsw | notmorgan ^ | 14:55 |
| notmorgan | V3 has always been projects | 14:55 |
| notmorgan | V2 was tenants | 14:56 |
| eandersson | thanks notmorgan | 14:56 |
| eandersson | I was mostly thinking in case tenants was previously supported for some weird backwards compatibility or something | 14:57 |
| eandersson | Basically just wanted to make sure this silly error wasn't just because of an upgrade to Liberty =] | 14:57 |
| edmondsw | I was using keystone v3 in havana, and it was /v3/projects there :) | 14:58 |
| *** subscope has quit IRC | 14:59 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Tidy up configuration documentation for inherited assignments https://review.openstack.org/280747 | 14:59 |
| eandersson | I didn't dare to try v3 until Kilo haha =] | 14:59 |
| openstackgerrit | henry-nash proposed openstack/keystone: Tidy up configuration documentation for inherited assignments https://review.openstack.org/280747 | 15:01 |
| openstackgerrit | henry-nash proposed openstack/keystone: Tidy up configuration documentation for inherited assignments https://review.openstack.org/280747 | 15:03 |
| *** EinstCra_ has quit IRC | 15:04 | |
| *** EinstCrazy has joined #openstack-keystone | 15:04 | |
| *** shoutm has quit IRC | 15:05 | |
| *** subscope has joined #openstack-keystone | 15:06 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Enable support for posixGroups in LDAP https://review.openstack.org/258528 | 15:07 |
| openstackgerrit | Chaozhe Chen(ccz) proposed openstack/keystone: Trivial: Cleanup unused conf variables https://review.openstack.org/280752 | 15:09 |
| openstackgerrit | henry-nash proposed openstack/keystone: Clean up configuration documentataion on v2 user CRUD https://review.openstack.org/280755 | 15:10 |
| openstackgerrit | henry-nash proposed openstack/keystone: Tidy up configuration documentation for inherited assignments https://review.openstack.org/280747 | 15:11 |
| *** EinstCrazy has quit IRC | 15:12 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:13 | |
| stevemar | morning all | 15:13 |
| henrynash | stevemar: morning | 15:14 |
| *** EinstCrazy has joined #openstack-keystone | 15:14 | |
| stevemar | marekd: dolphm PoC? | 15:15 |
| stevemar | marekd: dolphm plenty of ibm'ers interested in oidc :) | 15:15 |
| dolphm | stevemar: ? | 15:15 |
| openstackgerrit | henry-nash proposed openstack/keystone: Don't describe trusts as an extension in configuration doc https://review.openstack.org/280761 | 15:15 |
| stevemar | dolphm: you and marekd were talking about something -- hours ago, saml and oidc | 15:16 |
| dolphm | stevemar: yes? | 15:16 |
| stevemar | dolphm: ohhh nvm "anyone interested in OIDC beyond IBM (?)" | 15:16 |
| *** mkoderer__ has quit IRC | 15:16 | |
| stevemar | *beyond* | 15:16 |
| *** mkoderer__ has joined #openstack-keystone | 15:17 | |
| dstanek | marekd: stevemar: with federation the assertion headers always have a prefix right? like SAML_, PFX_ or something | 15:19 |
| dstanek | Oh, I Don't Care? | 15:19 |
| marekd | dstanek: at which lever? | 15:20 |
| marekd | level | 15:20 |
| dstanek | stevemar: finishing up some work on https://review.openstack.org/#/c/279908 | 15:20 |
| *** su_zhang has joined #openstack-keystone | 15:20 | |
| marekd | dstanek: are you talking input for mapping engine? | 15:20 |
| dstanek | marekd: i'm looking at the keystone.federation.utils.get_assertion_params_from_env | 15:20 |
| marekd | dstanek: so the prefix is configurable | 15:20 |
| dstanek | marekd: it looks like there would always be a prefix of some sort | 15:20 |
| dstanek | does it ever get stripped off? | 15:21 |
| StefanPaetowJisc | Funny you should mention OIDC... someone has brought this up | 15:21 |
| marekd | dstanek: what do you mean stripped off? | 15:21 |
| marekd | dstanek: the name of the parameters are actually dictated by mod_shib configuration | 15:22 |
| marekd | but, for clarity they should have some prefix - easier to actually distinguish from rest of the variables from the environment. | 15:22 |
| dstanek | marekd: the tests all use UserName, LastName, etc. in the assertion data and I'm wondering if in real life it would look more like SAML_USERNAME | 15:22 |
| marekd | dstanek: test use random names, and yes in reality that should be more like SAML_IDP, SAML_EMAIL, SAML_USERNAME, SAML_SOMETHING | 15:23 |
| dstanek | marekd: ok, that's what i thought. the test_utils tests and mapping_fixtures made me thing i was wrong | 15:24 |
| dstanek | marekd: thanks | 15:24 |
| stevemar | dstanek: the apache modules usually have a configurable setting, something like "Assertion prefix", that let you define a header prefix | 15:24 |
| marekd | dstanek: yw | 15:24 |
| marekd | stevemar: ++ | 15:24 |
| stevemar | dstanek: were you asking me a question about https://review.openstack.org/#/c/279908 or looking at it? | 15:24 |
| dstanek | stevemar: fixing the issue. the tests were just throwing me off | 15:25 |
| *** EinstCrazy has quit IRC | 15:25 | |
| *** slberger has joined #openstack-keystone | 15:25 | |
| *** StefanPaetowJisc has quit IRC | 15:26 | |
| *** StefanPaetowJisc has joined #openstack-keystone | 15:27 | |
| stevemar | dstanek: \o/ | 15:27 |
| marekd | stevemar: sorry, didn't read up enough. | 15:27 |
| dstanek | stevemar: i have no idea how to test this for real though | 15:28 |
| marekd | stevemar: dolph was asking on future plans for native SP code in Keystone. | 15:28 |
| stevemar | marekd: ah cool | 15:29 |
| henrynash | ayoung: ping | 15:29 |
| stevemar | dstanek: if we handle the single case described in the bug, i'm happy | 15:30 |
| henrynash | notmorgan: are you OK with https://review.openstack.org/#/c/264533/28 with the commit fixed? | 15:30 |
| notmorgan | henrynash: my.concern is addressed but I have not reviewed in depth | 15:31 |
| henrynash | notmorgan: ok, np | 15:31 |
| *** fawadkhaliq has joined #openstack-keystone | 15:34 | |
| StefanPaetowJisc | Thanks for the help so far, guys. I'll try to shape this Etherpad into something resembling a spec and will dial in next week if I can. :-) | 15:34 |
| *** jorge_munoz has joined #openstack-keystone | 15:34 | |
| *** fawadkhaliq has quit IRC | 15:34 | |
| *** fawadkhaliq has joined #openstack-keystone | 15:35 | |
| *** StefanPaetowJisc has quit IRC | 15:37 | |
| ayoung | henrynash, I'm here | 15:38 |
| dstanek | stevemar: for the record, i had text/unicode/bytes - ascii ftw | 15:38 |
| ayoung | stevemar, I am saving the Closes tag on Bug: 1545761 for when we finally deprecate and remove it. | 15:39 |
| openstack | bug 1545761 in OpenStack Identity (keystone) "admin_token_auth 'deprecation' actually removes it from the pipelines" [High,In progress] https://launchpad.net/bugs/1545761 - Assigned to Adam Young (ayoung) | 15:39 |
| *** EinstCrazy has joined #openstack-keystone | 15:39 | |
| ayoung | notmorgan, can you bless https://review.openstack.org/#/c/280467/ and the predecessor? | 15:39 |
| ayoung | https://review.openstack.org/#/c/280329/8 | 15:39 |
| henrynash | ayoung: sorry, on phone, will be abck soon | 15:40 |
| stevemar | ayoung: i suggest not doing that, we will use blueprints to actually remove content (like we did with "removed_as_of_mitaka_ | 15:40 |
| stevemar | ayoung: also, henry nash found a cool bug with trusts and posted a fix in record timing :O https://review.openstack.org/#/c/280621/1 | 15:41 |
| ayoung | stevemar, ok, I'll modify the commit message | 15:41 |
| notmorgan | ayoung: 2 comments - release not | 15:41 |
| stevemar | ayoung: thank you | 15:41 |
| henrynash | ayoung: was going to ask you views on: https://review.openstack.org/#/c/280621/1 | 15:41 |
| notmorgan | Note* and add comment to the config help to say if it isn't set | 15:42 |
| notmorgan | Of the new behavior | 15:42 |
| notmorgan | ayoung: otherwise lgtm | 15:42 |
| ayoung | henrynash, good question. I think that, if the role is explicitly part of the trust, executing the trust should fail | 15:42 |
| ayoung | the idea is that a trust is "what you need to get a job done" | 15:42 |
| ayoung | so if a service user executes a trust, and there is a missing role, it is likely that the job cannot be done | 15:43 |
| ayoung | that was deliberate | 15:43 |
| ayoung | notmorgan, ++ | 15:43 |
| ayoung | henrynash, make sense? | 15:43 |
| henrynash | ayoung: brb | 15:45 |
| *** pushkaru has joined #openstack-keystone | 15:51 | |
| stevemar | dstanek: i love your python3 fixes <3 | 15:52 |
| dstanek | stevemar: i almost have all the tests working :-) | 15:53 |
| stevemar | dstanek: the ipv6 ones should be removed when we remove eventlet | 15:53 |
| stevemar | which i'm beginning to think is gonna happen in newton... | 15:53 |
| *** dave-mccowan has quit IRC | 15:53 | |
| dstanek | every time i see newton i think of cookies | 15:54 |
| dstanek | http://static.caloriecount.about.com/images/medium/newtons-fruit-chewy-cookies-59696.jpg | 15:55 |
| *** wanghua has joined #openstack-keystone | 15:56 | |
| *** su_zhang has quit IRC | 16:00 | |
| dstanek | stevemar: good call on asking for a better commit message. that is a strange py2 vs. py3 behavior | 16:00 |
| stevemar | dstanek: \o/ | 16:01 |
| stevemar | dstanek: N release reminds me of how cam newton failed me :( | 16:01 |
| dstanek | stevemar: seems he doesn't like to lose | 16:03 |
| raildo | stevemar: lol | 16:03 |
| dstanek | stevemar: i was rooting for the roid/perv | 16:04 |
| dstanek | *alleged | 16:04 |
| stevemar | dstanek: the guy who won because his defense got all the points for him? | 16:04 |
| *** tcline has joined #openstack-keystone | 16:05 | |
| dstanek | yup, but to be fair points were now easy to come by for either team | 16:05 |
| *** tcline has quit IRC | 16:06 | |
| henrynash | ayoung: (back) | 16:06 |
| henrynash | ayoung: but that gets murky with implied roles. I.e. so the trustor still has the prior role (that was part of the trust), but one of the implied roles has been removed….should the trustee still get a token (with reduced roles)? | 16:07 |
| *** timcline has joined #openstack-keystone | 16:07 | |
| *** timcline has quit IRC | 16:07 | |
| *** timcline has joined #openstack-keystone | 16:09 | |
| henrynash | ayoung: seems to me that a more logical situation is that the trustee gets whatever roles are still valid at teh point they ask for a token…..and if it isn’t enough to do the job, then that’s no different than some removing a regualr role from the user….something they may try and do will fail | 16:10 |
| ayoung | henrynash, implied roles are going to be tightly managed. THey are admin only. Yeah, an admin can break things, but more likely they are going to be making things more fine grained | 16:12 |
| ayoung | the assumption with implied roles is that the two together mean something: if on is no longer imp;lied by the other, what does that mean? uits a change of overall system policy | 16:12 |
| *** dave-mccowan has joined #openstack-keystone | 16:12 | |
| *** su_zhang has joined #openstack-keystone | 16:13 | |
| *** EinstCrazy has quit IRC | 16:15 | |
| *** EinstCrazy has joined #openstack-keystone | 16:16 | |
| henrynash | ayoung: just seems like we are making assumptions about the meaning (for the admin) of a trust….. | 16:16 |
| *** clenimar has joined #openstack-keystone | 16:16 | |
| ayoung | henrynash, I'd like to leave it for now. We can make it a topic of discussion at the summit. I'd like to have a serious session on unfied delegation, and this would be part of it | 16:16 |
| * stevemar waves at bknudson_ | 16:18 | |
| *** pcaruana has quit IRC | 16:18 | |
| * bknudson_ waves back at stevemar | 16:18 | |
| stevemar | bknudson_: i need to bug you today about 3 bugs :P | 16:19 |
| bknudson_ | stevemar: what are the bugs? and what's the question? | 16:19 |
| stevemar | bknudson_: privileges of being oslo core right? | 16:19 |
| stevemar | bknudson_: bug: https://bugs.launchpad.net/keystone/+bug/1517037 | 16:20 |
| openstack | Launchpad bug 1517037 in OpenStack Identity (keystone) "API-based Domain specific config does not check for type of option" [Low,New] | 16:20 |
| *** EinstCrazy has quit IRC | 16:20 | |
| stevemar | bknudson_: the config options for domain specific configs in SQL come in looking like {'some_ldap_config_option': 'some_value'} | 16:21 |
| henrynash | ayoung: how come the exception was 'Trustee has no delegated roles.”…kind of implied that it only be raised if none of the roles was valid anymore | 16:21 |
| *** mvk has quit IRC | 16:21 | |
| stevemar | bknudson_: how easy is it to look up 'some_ldap_config_option' in CONF.ldap..., and check what it's "type" is (boolean/string/port....) and evaluate the new option? | 16:22 |
| bknudson_ | stevemar: there's probably a way to get the option type and try to convert it. | 16:22 |
| bknudson_ | this must happen during config parsing already | 16:22 |
| stevemar | bknudson_: i looked through olso.config and couldn't could only half-way do it using private classes | 16:22 |
| bknudson_ | stevemar: you should be Opt.type(option_value) | 16:23 |
| *** diazjf has joined #openstack-keystone | 16:23 | |
| bknudson_ | http://git.openstack.org/cgit/openstack/oslo.config/tree/oslo_config/cfg.py#n644 | 16:23 |
| *** su_zhang has quit IRC | 16:24 | |
| stevemar | bknudson_: want to dish this one out to tjcocozz? | 16:24 |
| bknudson_ | so CONF.ldap.whatever.type(whatever) | 16:24 |
| bknudson_ | stevemar: I want to dish all sorts of stuff to tjcocozz but I know he's busy with other stuff. | 16:24 |
| *** su_zhang has joined #openstack-keystone | 16:25 | |
| stevemar | bknudson_: hmm.. CONF.ldap.url.type should give StringOpt? | 16:25 |
| *** su_zhang has quit IRC | 16:25 | |
| henrynash | ayoung: the reason I’m looking at all this, is that it mucks up domain roles | 16:27 |
| ayoung | henrynash, trusts? | 16:27 |
| bknudson_ | stevemar: if you don't pass a type to the constructor then it's types.String | 16:27 |
| ayoung | henrynash, how? | 16:27 |
| bknudson_ | stevemar: types.String is http://git.openstack.org/cgit/openstack/oslo.config/tree/oslo_config/types.py#n62 | 16:27 |
| bknudson_ | types.String does all sorts of validation -- see http://git.openstack.org/cgit/openstack/oslo.config/tree/oslo_config/types.py#n124 | 16:28 |
| stevemar | bknudson_: i know the types.Whatever do validation there, just wasn't sure about how they link up together | 16:28 |
| *** bdossant has quit IRC | 16:29 | |
| henrynash | ayoung: just a matter of code….but on create token, we ge the roles the trustor has now (which strips OUT the domain role).. so if the trust wwas for the domain role, the check throws out the trust since the roles don’t “match” | 16:29 |
| stevemar | bknudson_: okay, i'll try it out in a minute, one more question | 16:29 |
| ayoung | henrynash, hmmm. | 16:29 |
| bknudson_ | I assume CONF.ldap.url is a StringOpt and CONF.ldap.url.type is types.String | 16:29 |
| ayoung | henrynash, ok, ignore everything else and answer this: should it be possible to make a trust on just a domain role? | 16:30 |
| stevemar | bknudson_: was poking around with setting up bluepages and ldap last night and ran into this bug: https://bugs.launchpad.net/keystone/+bug/1545960 | 16:30 |
| openstack | Launchpad bug 1545960 in OpenStack Identity (keystone) "authenticating with ldap user fails due to notification" [High,In progress] - Assigned to Steve Martinelli (stevemar) | 16:30 |
| ayoung | I think that it should | 16:30 |
| ayoung | so the real issue is that the way that we list roles for a user should not strip the domain role until the trust compares the two | 16:30 |
| *** agireud has quit IRC | 16:31 | |
| dstanek | stevemar: marekd: what is the term for what mod_shib actually is? it's not an IdP, but what is it? | 16:31 |
| stevemar | dstanek: it's an apache module? | 16:31 |
| ayoung | its not a question of the user not having the role, but of us stripping it out before the check. | 16:31 |
| dstanek | stevemar: i was hoping that there was a generic term for it | 16:31 |
| dstanek | maybe there's not | 16:31 |
| ayoung | So, leave the assignment logic as is. Make sure the trust roles are all valid, then strip domain specific | 16:32 |
| stevemar | dstanek: i've always described it as: it performs the handshake between the user and the identity provider, so we don't have to. | 16:32 |
| henrynash | ayoung: I also think you should…. | 16:32 |
| *** agireud has joined #openstack-keystone | 16:32 | |
| stevemar | bknudson_: i tossed up https://review.openstack.org/#/c/280542/ -- but if you look at the comment, theres already a test for this | 16:33 |
| henrynash | ayoung: agreed…I already had to do this to make trust creation work, | 16:33 |
| dstanek | stevemar: i'm going to call it a 'web server plugin' | 16:33 |
| stevemar | dstanek: ++ | 16:33 |
| *** boris-42 has quit IRC | 16:34 | |
| henrynash | ayoung: please comment on my “fix for the bug” with our views, then I’ll abandon, and we can bring it back in the future if we want | 16:34 |
| ayoung | henrynash, just do not do the additional logic of allowing a token with a subset of roles from the trust. THat would be a mistake, I think | 16:34 |
| bknudson_ | stevemar: which comment? | 16:34 |
| ayoung | henrynash, will do | 16:34 |
| stevemar | bknudson_: "not sure what's going on here, since it looks like this should have been covered by this test: https://github.com/openstack/keystone/blob/master/keystone/tests/unit/common/test_utils.py#L45-L46" | 16:34 |
| bknudson_ | stevemar: what was the string that couldn't be converted? | 16:35 |
| stevemar | bknudson_: that's in comment #2 in the bug | 16:36 |
| stevemar | bknudson_: "2165702f085e15ff59308d8723df016d75fdd07e9af527a881b87812278e5068" | 16:36 |
| openstackgerrit | Pandiyan proposed openstack/keystone: Add driver details in architecture doc https://review.openstack.org/280802 | 16:36 |
| bknudson_ | stevemar: the exception is saying that the value was chr(0xec) | 16:36 |
| stevemar | bknudson_: "Found existing mapping to public ID: 2165702f085e15ff59308d8723df016d75fdd07e9af527a881b87812278e5068" | 16:36 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Use the right driver to get limits https://review.openstack.org/266989 | 16:37 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Fallback to list_limit from default config https://review.openstack.org/280804 | 16:37 |
| bknudson_ | stevemar: 'ascii' codec can't decode byte 0xec in position 2: ordinal not in range(128) | 16:37 |
| *** rcernin has quit IRC | 16:37 | |
| stevemar | bknudson_: maybe it's getting mucked up when it's retrieved from the database? | 16:39 |
| openstackgerrit | David Stanek proposed openstack/keystone: WIP handle unicode names for federated users https://review.openstack.org/279908 | 16:39 |
| dstanek | stevemar: ^ that's what i came up with | 16:39 |
| stevemar | dstanek: looking now | 16:40 |
| dstanek | be back in 30. going to shovel the driveway | 16:41 |
| htruta | henrynash: addressed your changes in https://review.openstack.org/#/c/207218/ looks like it's ready to +A | 16:41 |
| henrynash | htruta: done! | 16:44 |
| htruta | henrynash: you rock! | 16:45 |
| ayoung | dstanek, henrynash can one of you move https://review.openstack.org/#/c/280329/ on, and I will work on getting the follow on patch to address notmorgan 's feedback | 16:45 |
| htruta | henrynash: I was thinking here... is there a place for is_domain in the token still in M ? The patches are pretty simple, but they depend on the projects acting as domains | 16:45 |
| henrynash | htruta: we’re trying to get projects acting as a domain in for M still! | 16:46 |
| openstackgerrit | ayoung proposed openstack/keystone: Re-enable and undeprecate admin_token_auth https://review.openstack.org/280329 | 16:46 |
| *** dmsimard has joined #openstack-keystone | 16:47 | |
| openstackgerrit | ayoung proposed openstack/keystone: Disable Admin tokens set to None https://review.openstack.org/280467 | 16:47 |
| dmsimard | Hi #openstack-keystone. Could we get the necessary +2/+A on https://review.openstack.org/#/c/280329/ ? Thanks. | 16:47 |
| htruta | henrynash: I see... that's why I think I'd make sense to have the "is_domain" in the token before that, even though we don't use it in the policy | 16:48 |
| htruta | s/I'd/it'd | 16:48 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Enable support for posixGroups in LDAP https://review.openstack.org/258528 | 16:51 |
| henrynash | htruta: if we can make teh patch independant, then why noy | 16:51 |
| henrynash | not | 16:51 |
| htruta | henrynash: we can. We just need to rebase it to master, instead of basing it into the projects acting as domains. | 16:52 |
| htruta | henrynash: we are now able to create projects with is_domain=True (although they don't act like that in fact), so the changes in the token can be tested | 16:53 |
| henrynash | htruta: ok, let’s do it | 16:55 |
| *** subscope has quit IRC | 16:56 | |
| *** rderose has joined #openstack-keystone | 17:01 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules in the v3 policy sample for domain specifc roles https://review.openstack.org/262078 | 17:01 |
| dmsimard | stevemar: thanks <3 | 17:02 |
| *** e0ne has quit IRC | 17:04 | |
| openstackgerrit | Pandiyan proposed openstack/keystone: Add driver details in architecture doc https://review.openstack.org/280802 | 17:05 |
| *** gyee has joined #openstack-keystone | 17:05 | |
| *** ChanServ sets mode: +v gyee | 17:05 | |
| arunkant | stevemar: Can you look into this review..https://review.openstack.org/#/c/279828/ | 17:05 |
| *** dan_nguyen has joined #openstack-keystone | 17:07 | |
| stevemar | nkinder & ayoung: can you take a quick look at: https://review.openstack.org/#/c/258528/ | 17:09 |
| *** aginwala has joined #openstack-keystone | 17:09 | |
| *** rcernin has joined #openstack-keystone | 17:09 | |
| stevemar | arunkant: i'll add dims too, it'll be good to get oslo ptl eyes on it | 17:09 |
| arunkant | stevemar: okay. thanks. | 17:10 |
| *** d0ugal has quit IRC | 17:11 | |
| *** mylu has joined #openstack-keystone | 17:13 | |
| ayoung | stevemar, so, the only objection i have is that this has nothing to do with posix | 17:13 |
| stevemar | amakarov ^ | 17:14 |
| ayoung | I need to think about the right term, but it is something more like "attribute" | 17:14 |
| stevemar | ayoung: explains | 17:14 |
| ayoung | amakarov, posix groups are something different | 17:14 |
| *** gordc has quit IRC | 17:14 | |
| ayoung | its a field on a group whether to treat the group as a posix group or not, not how the users are stored | 17:14 |
| ayoung | that being said, the logic of the patch is good. | 17:15 |
| ayoung | stevemar, would like to have some of our more LDAP savvy people look at it, though. | 17:15 |
| *** roxanaghe has joined #openstack-keystone | 17:15 | |
| amakarov | ayoung, tbh, I've just goolge'd it: https://www.rainingpackets.com/ldap-posixgroup-groupofnames/ | 17:15 |
| ayoung | amakarov, yeah...that is the object class... | 17:16 |
| ayoung | and, I know we do the same kind of thing in IPA | 17:16 |
| ayoung | which leads me to wonder if we need to be able to mix the two together. | 17:17 |
| *** mylu has quit IRC | 17:18 | |
| gyee | stevemar, is totp a go or no-go, I am planning on working on keystoneauth1 today. But if it's a no-go, I need to reprioritize | 17:18 |
| stevemar | gyee: i'm still waiting on docs and tests for the server side | 17:19 |
| gyee | stevemar, lemme help out on the server side first | 17:19 |
| gyee | should have a patch sometime today | 17:19 |
| amakarov | ayoung, any suggestion? | 17:19 |
| stevemar | gyee: alrighty | 17:19 |
| stevemar | gyee: also, bknudson_ had issues with that patch :( | 17:19 |
| stevemar | gyee: the url fix patch | 17:20 |
| gyee | stevemar, yeah, working on it as well | 17:20 |
| ayoung | amakarov, I'mn tempted to leave this patch as is. I think it is OK | 17:20 |
| amakarov | ayoung, ack | 17:20 |
| *** su_zhang has joined #openstack-keystone | 17:21 | |
| ayoung | amakarov, I actually am not that smart about LDAP stuff. | 17:21 |
| amakarov | ayoung, me neither :) | 17:21 |
| gyee | stevemar, I should've known don't start celebrating till bknudson_ sings :) | 17:21 |
| *** lhcheng has joined #openstack-keystone | 17:21 | |
| *** ChanServ sets mode: +v lhcheng | 17:21 | |
| ayoung | stevemar, I'm willing to +2. If you up yours to 2, I'll +A | 17:22 |
| gyee | ayoung, that posix patch works, I tested it locally as well | 17:23 |
| stevemar | ayoung: i'd feel better if you get nkinder to take a look too :P | 17:24 |
| stevemar | ayoung: or gyee can vouch for it :P | 17:24 |
| gyee | only thing it won't do is walk the nested groups | 17:24 |
| *** jbell8 has joined #openstack-keystone | 17:24 | |
| gyee | we don't support nested groups anyway | 17:24 |
| nkinder | stevemar: I have it open. Just waiting for a meeting to end so I can give it some attention. | 17:24 |
| stevemar | nkinder: you're the best! | 17:24 |
| *** su_zhang has quit IRC | 17:26 | |
| *** su_zhang has joined #openstack-keystone | 17:26 | |
| *** su_zhang has quit IRC | 17:27 | |
| *** su_zhang has joined #openstack-keystone | 17:29 | |
| *** tqtran has joined #openstack-keystone | 17:30 | |
| *** phalmos has joined #openstack-keystone | 17:30 | |
| *** mylu has joined #openstack-keystone | 17:31 | |
| *** aginwala has quit IRC | 17:34 | |
| *** petertr7 is now known as petertr7_away | 17:34 | |
| *** dims has joined #openstack-keystone | 17:34 | |
| notmorgan | ayoung: hmm | 17:35 |
| *** _cjones_ has joined #openstack-keystone | 17:35 | |
| *** aginwala has joined #openstack-keystone | 17:36 | |
| *** spandhe has joined #openstack-keystone | 17:37 | |
| *** d0ugal has joined #openstack-keystone | 17:38 | |
| dstanek | sigmavirus24: thoughts on https://review.openstack.org/#/c/279908 ? specifically header encoding.... | 17:40 |
| *** roxanaghe has quit IRC | 17:42 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Reduce revoke events for disabled domains and projects. https://review.openstack.org/253273 | 17:43 |
| sigmavirus24 | dstanek: looking | 17:43 |
| sigmavirus24 | dstanek: the comment that stevemar made is probably inspired by my recent mailing list post about swift being silly with their headers | 17:44 |
| dstanek | sigmavirus24: what comment? | 17:44 |
| sigmavirus24 | in federation/utils.py | 17:45 |
| dstanek | sigmavirus24: ah, yeah. that was me. i didn't see your post, but maybe i should go look for it | 17:45 |
| sigmavirus24 | dstanek: it was a reply to Victor's emails about Py3 support in swift | 17:46 |
| sigmavirus24 | (from last week) | 17:46 |
| sigmavirus24 | But yeah, I'm not sure any service in OpenStack actually *cares* about the HTTP RFCs because they all violate them in numerous ways (sometimes forcibly) | 17:46 |
| sigmavirus24 | So take my concerns with a grain of salt. Also, what framework does keystone use? Straight wsgi? Webob? something else? | 17:47 |
| dstanek | sigmavirus24: i care! i you have a list of what keystone screws up i'd love to hear it | 17:47 |
| sigmavirus24 | Because webob would be a good place for this, but I think always decoding a bytes object to ISO-8859-1 will cause more headaches | 17:47 |
| sigmavirus24 | dstanek: I stopped looking after I went through glance and swift. I can dig through keystone though | 17:47 |
| sigmavirus24 | (Just not anytime soon) | 17:47 |
| *** e0ne has joined #openstack-keystone | 17:47 | |
| sigmavirus24 | dstanek: one thing most services don't do correctly is implement JSON Patch completely and so those implementations are *always* broken | 17:48 |
| sigmavirus24 | (Regardless of the fact that there are appropriately licensed libraries for handling that) | 17:48 |
| dstanek | sigmavirus24: i'm in no rush as there is lots of other stuff i need to get done :-) thanks! | 17:49 |
| sigmavirus24 | dstanek: requests plans to stop unconditionally decoding headers to ISO-8859-1 when we can | 17:50 |
| stevemar | apparently nothing on the agenda today | 17:50 |
| notmorgan | stevemar: no meeting then! | 17:51 |
| notmorgan | :P | 17:51 |
| sigmavirus24 | Because so many servers return data that is not encodeable to latin-1, you'll get confusing data from the headers | 17:51 |
| sigmavirus24 | (That said, on Python 3 we have to fight httplib because httplib/http.client unconditionally does that encoding for us -_-) | 17:51 |
| notmorgan | sigmavirus24: i hope that is going to be optional. /me is a fan of being really clear when that breaks. | 17:52 |
| sigmavirus24 | notmorgan: you mean not unconditionally decoding headers? | 17:52 |
| notmorgan | sigmavirus24: basically allow for unconditional decoding behavior to continue | 17:52 |
| sigmavirus24 | If the team continues to agree that this is the best way forward, it'll happen in 3.0.0, but I don't think we'll have anyway to turn it back on because the only encoding we handle is when the user uses `r.text` and I could also be misremembering the discussion we had | 17:53 |
| notmorgan | i'm a little disappointed by this. then again i approve that requests is opinionated. just means i might need to use urllib directly instead for my things. | 17:54 |
| *** petertr7_away is now known as petertr7 | 17:54 | |
| *** phalmos has quit IRC | 17:54 | |
| * notmorgan wishes openstack could be a little more opinionated | 17:54 | |
| notmorgan | not as much as requests but.. still closer. | 17:55 |
| *** browne has joined #openstack-keystone | 17:56 | |
| dstanek | sigmavirus24: that's sort of why i only decode the federation headers. i'm leaving everything else alone | 17:57 |
| sigmavirus24 | dstanek: fair | 17:57 |
| topol | stevemar, no meeting today? | 17:58 |
| sigmavirus24 | notmorgan: again, I could be thinking of a different issue, but I think what we do now is a bit harder on people who need the headers encoded in a different way since forcibly encoding the bytes causes data loss | 17:58 |
| notmorgan | sigmavirus24: sure | 17:58 |
| stevemar | topol: still gonna have one | 17:58 |
| notmorgan | sigmavirus24: thats why i said "maybe" :) | 17:58 |
| stevemar | topol: short one | 17:58 |
| topol | stevemar I thought Raleigh being snowed in was impacting you as well | 17:59 |
| sigmavirus24 | notmorgan: we might be able to convince urllib3 to do this and then the "requests" way to access the original headers as bytes would be via the stored urllib3 response | 17:59 |
| * sigmavirus24 shrugs | 17:59 | |
| topol | stevemar a vicious dusting. Chick-Filet closed early last night | 17:59 |
| *** tsymanczyk has joined #openstack-keystone | 18:00 | |
| samueldmq | stevemar: hey, no meeting today? | 18:00 |
| stevemar | keystone meeting reminder ping: ajayaa, amakarov, ayoung, breton, browne, davechen, david8hu, dolphm, dstanek, ericksonsantos, geoffarnold, gyee, henrynash, hogepodge, htruta, jamielennox, joesavak, lbragstad, lhcheng, marekd, morganfainberg, nkinder, raildo, rodrigods, roxanaghe, samueldmq, shaleh, stevemar, tsymanczyk, topol, vivekd, wanghong, claudiub, rderose, samleon, xek, MaxPC, tjcocozz, jorge_munoz | 18:00 |
| samueldmq | oops | 18:00 |
| *** vgridnev has joined #openstack-keystone | 18:04 | |
| *** subscope has joined #openstack-keystone | 18:07 | |
| *** spzala has quit IRC | 18:07 | |
| *** spzala has joined #openstack-keystone | 18:08 | |
| *** spzala has quit IRC | 18:12 | |
| *** phalmos has joined #openstack-keystone | 18:13 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Sub projects acting as domains https://review.openstack.org/235544 | 18:14 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf: Updated from global requirements https://review.openstack.org/280864 | 18:17 |
| *** spzala has joined #openstack-keystone | 18:22 | |
| *** spandhe has quit IRC | 18:23 | |
| *** mylu has quit IRC | 18:24 | |
| *** spandhe has joined #openstack-keystone | 18:26 | |
| *** david-lyle has quit IRC | 18:27 | |
| *** jasonsb_ has quit IRC | 18:28 | |
| *** d0ugal has quit IRC | 18:28 | |
| *** d0ugal has joined #openstack-keystone | 18:29 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify implied roles to honor domain specific roles https://review.openstack.org/263064 | 18:29 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules for domain specific role assignments https://review.openstack.org/263549 | 18:30 |
| *** e0ne has quit IRC | 18:33 | |
| breton | dolphm: right now for mapping api there is 1 query to database per user | 18:34 |
| *** ebalduf has joined #openstack-keystone | 18:34 | |
| breton | dolphm: 1000 users in ldap -> 1000 queries to database | 18:34 |
| dolphm | breton: are you seeing 1,000 queries being made to handle a single API request? | 18:35 |
| *** david-lyle has joined #openstack-keystone | 18:35 | |
| breton | dolphm: I have not checked yet, but it looks like it from the code. identity.core:_set_domain_id_and_mapping, see the part inside `elif isinstance(ref, list):` | 18:39 |
| dolphm | breton: link? i'm not sure i understand your concern | 18:40 |
| breton | dolphm: https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L582, it calls https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L604 | 18:42 |
| breton | dolphm: _set_domain_id_and_mapping is called to the result of list_users: https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L865 | 18:44 |
| *** petertr7 is now known as petertr7_away | 18:44 | |
| dolphm | breton: is there a MEMOIZE decorator on the lookup? | 18:45 |
| breton | dolphm: I don't know. Still not an option at all, because the API request fails | 18:46 |
| breton | dolphm: because without cache it takes more than timeout to complete | 18:47 |
| breton | dolphm: that's something I'm going to tackle in this and next release | 18:47 |
| dolphm | breton: if all it's missing is a caching decorator, that's an easy backport as well | 18:48 |
| breton | dolphm: or will join rderose to ensure that this problem is gone with shadow users | 18:48 |
| dolphm | breton: both! | 18:48 |
| breton | caching decorator is not an option. Cache expiration is too expensive. | 18:48 |
| *** roxanaghe has joined #openstack-keystone | 18:48 | |
| breton | it's not 10, 15 or 20 seconds for cache miss. 300 might be not enough for large amount of users. | 18:49 |
| *** roxanaghe has quit IRC | 18:51 | |
| *** spandhe has quit IRC | 18:51 | |
| dolphm | breton: can you explain what you mean by "cache expiration is too expensive"? ... and 300 what, seconds? | 18:51 |
| breton | dolphm: on cache miss it takes 300 seconds to fetch 10k ldap users. | 18:52 |
| dolphm | breton: okay | 18:54 |
| *** eandersson has quit IRC | 18:55 | |
| *** spandhe has joined #openstack-keystone | 18:56 | |
| dolphm | rderose: stevemar: dstanek: shadow users? | 18:59 |
| dstanek | dolphm: ? | 18:59 |
| dolphm | dstanek: #topic | 18:59 |
| lbragstad | ayoung some of the fernet default work hangs on this -= https://review.openstack.org/#/c/278802/ | 19:00 |
| *** jbell8 has quit IRC | 19:00 | |
| henrynash | samueldmq: could you see if you are OK with https://review.openstack.org/#/c/262078/21 now? | 19:00 |
| rderose | I'm here, but need 10 min | 19:00 |
| dstanek | breton: fetching that many users from ldap is just bad design | 19:00 |
| lbragstad | ayoung and that is passing except one test - I'd like to get your feedback on it | 19:00 |
| dstanek | dolphm: shore | 19:00 |
| ayoung | lbragstad, what is failing? | 19:00 |
| samueldmq | henrynash: oh sure, domain specific roles, 3 patches and bp implemented ? | 19:00 |
| henrynash | ayoung: I fixed up the doman roles with trusts….see if you are Ok with it….https://review.openstack.org/#/c/263064/19 | 19:00 |
| henrynash | samueldmq: yep | 19:01 |
| rderose | dolphm: be right back | 19:01 |
| ayoung | test_delete_tokens_for_user_invalidates_tokens_from_trust | 19:01 |
| rderose | dolphm: are you in a room? | 19:01 |
| dolphm | rderose: bookstore | 19:01 |
| lbragstad | ayoung the test makes an assertion around the fact tokens are stored somewhere - http://logs.openstack.org/02/278802/1/check/gate-keystone-python27/875f2ca/testr_results.html.gz | 19:01 |
| lbragstad | ayoung so it coded to assume UUID | 19:01 |
| dolphm | rderose: in a booth | 19:01 |
| breton | dstanek: I agree. And is pointless in fact. | 19:01 |
| stevemar | dolphm: can you wait 20 minutes for me to get food? | 19:01 |
| * ayoung going to have to open an Etherpad just to track conversations... | 19:01 | |
| dolphm | stevemar: maybe | 19:01 |
| ayoung | lbragstad, OK let me thing... | 19:01 |
| henrynash | ayoung: of split brains | 19:01 |
| ayoung | think | 19:01 |
| dolphm | stevemar: make it 10 | 19:01 |
| stevemar | dolphm: rather, do you mind if i quickly get food, no need to wait for me | 19:01 |
| dolphm | stevemar: =) | 19:01 |
| stevemar | dolphm: if you're doing a hangout gmail chat me the link | 19:02 |
| ayoung | lbragstad, what is supposed to trigger that? | 19:03 |
| dolphm | dstanek: rderose: we can do a hangout if y'all prefer ^ | 19:03 |
| ayoung | delete_tokens_for_user | 19:03 |
| ayoung | self.token_provider_api._persistence.delete_tokens_for_user( | 19:04 |
| ayoung | self.trustee['id']) | 19:04 |
| samueldmq | henrynash: my idea was to use this order : http://paste.openstack.org/show/487161/ | 19:04 |
| samueldmq | henrynash: check if it makes sense | 19:04 |
| ayoung | that was a provider call. lbragstad does anything in the outside world call .delete_tokens_for_user | 19:04 |
| ayoung | lets see... | 19:04 |
| dstanek | dolphm: rderose: doens't matter. i'm just making some tea now and then i can talk about whatever | 19:05 |
| samueldmq | henrynash: rules only use other rules that are above, not any that is below itself | 19:05 |
| lbragstad | ayoung https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_auth.py#L1136 | 19:05 |
| *** mhickey has quit IRC | 19:05 | |
| henrynash | samueldmq: although I had othre reviews say they wanted it exaclt the otehr way round…and wanted to see them used first, and then follow the chain | 19:05 |
| dolphm | now i feel obligated to go get caffeine too | 19:05 |
| dolphm | be back in 5ish | 19:05 |
| ayoung | lbragstad, that test should only be run on a persisted backend. With revocation events, it should be a revoke_by_user_id call | 19:06 |
| ayoung | lbragstad, so..let's see waht actaully is failing./... | 19:06 |
| ayoung | testtools.matchers._impl.MismatchError: 1 != 0 | 19:07 |
| samueldmq | henrynash: okay that shouldn't block the patch anyway | 19:07 |
| lbragstad | ayoung it fails this assertion https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_auth.py#L1135 | 19:08 |
| lbragstad | ayoung because this isn't a token - we're using fernet | 19:08 |
| ayoung | lbragstad, the test needs to pass, I think, if we keep the API around. But is list tokens even a valid api with the Fernet tokens? | 19:08 |
| ayoung | it seems like these APIs should be no-oped | 19:08 |
| lbragstad | ayoung so the assertion is coded to assume that there is always going to be a token written to the backned | 19:08 |
| ayoung | list tokens for user should return 0 for Fernet | 19:09 |
| ayoung | no? | 19:09 |
| lbragstad | ayoung right | 19:09 |
| henrynash | samueldmq: ok | 19:09 |
| notmorgan | ooooh update your glibc https://googleonlinesecurity.blogspot.ca/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html | 19:10 |
| lbragstad | ayoung I don't think that API makes sense for Fernet | 19:10 |
| notmorgan | lbragstad: list tokens is invalid for fernet | 19:11 |
| notmorgan | ayoung: ^ cc | 19:11 |
| *** mylu has joined #openstack-keystone | 19:11 | |
| notmorgan | the correct response is afaict w/o breaking the API spec, returning a [] | 19:11 |
| dstanek | dolphm: back | 19:11 |
| notmorgan | in fact, list_tokens should, i hope, never leak out to the actual REST api, if id did, we did something horribly wrong | 19:12 |
| notmorgan | but with fernet, there is no way to list the tokens, therefore, there is nothing to do if you require a list of all tokens. | 19:12 |
| ayoung | lbragstad, talk with henrynash about what we need to do to deal with stable driver interface, but the option there might be just to no-op those calls for Fernet. Just make sure the revocation events get triggered for them | 19:13 |
| *** daemontool has joined #openstack-keystone | 19:14 | |
| *** vgridnev has quit IRC | 19:14 | |
| samueldmq | henrynash: in https://review.openstack.org/#/c/262078/21/doc/source/policy_mapping.rst | 19:14 |
| samueldmq | henrynash: I think adding "where role.domain_id is not null" makes it ahrd to read, and is different from the patter being used | 19:14 |
| samueldmq | henrynash: anyone asked for it ? | 19:14 |
| lbragstad | ayoung in that case - a revocation event should be triggered when a trust is deleted, right? | 19:15 |
| henrynash | samuedlmq: well we have to have an entry for each policy line…and wanted to distinquish from teh gloabl lines above..any suggestions | 19:16 |
| lbragstad | ayoung i'm not seeing the revoke_api used in the trust API at all. | 19:16 |
| samueldmq | henrynash: maybe a comment before that block ? | 19:16 |
| *** daemontool_ has joined #openstack-keystone | 19:16 | |
| samueldmq | henrynash: APIs for domain roles below require role.domain_id is not None | 19:17 |
| samueldmq | henrynash: rather than putting in every API entry ? | 19:17 |
| henrynash | samueldmq: could try that…ok, thx | 19:17 |
| samueldmq | henrynash: I may also leave a comment (it's nit) that can be fixed later ? | 19:17 |
| henrynash | samueldmq: let’s get it in if we can, I’l happily fix that later | 19:18 |
| samueldmq | henrynash: ++ | 19:18 |
| dolphm | dstanek: lbragstad: rderose: stevemar: i'm back - digging into https://review.openstack.org/#/c/278570/ first | 19:19 |
| *** daemontool has quit IRC | 19:19 | |
| *** mylu has quit IRC | 19:20 | |
| *** mylu has joined #openstack-keystone | 19:21 | |
| dstanek | dolphm: what is happening in the 089 migration? that is totally different | 19:23 |
| dolphm | dstanek: L46 | 19:24 |
| dolphm | dstanek: it's repurposing the table | 19:24 |
| dstanek | dolphm: but why bother renaming? | 19:24 |
| dolphm | dstanek: no data to migrate? | 19:24 |
| dolphm | to a new table | 19:24 |
| openstackgerrit | Merged openstack/keystone: Restricting domain_id update https://review.openstack.org/207218 | 19:24 |
| dstanek | but if you don't rename then you don't do all those other destructive things | 19:25 |
| dolphm | dstanek: like constraints? | 19:25 |
| dstanek | yes | 19:25 |
| dolphm | dstanek: so drop L31-38, L48-54? | 19:26 |
| ayoung | lbragstad, trying to think this through....yeah, if a trust is deleted , there should be a revocation event. If that is not happening now, it needs to be done. Add a bug for that, but shouildn't hold up this | 19:26 |
| ayoung | lbragstad, beyond that, make sure list tokens for user always returns 0 for fernet. The fact that it is not in that test is bothering me | 19:27 |
| stevemar | dolphm: dstanek back | 19:27 |
| dstanek | dolphm: tbh, i think i have to go over this again it's all completely different :-( | 19:27 |
| *** rderose has quit IRC | 19:29 | |
| *** rderose has joined #openstack-keystone | 19:29 | |
| stevemar | dstanek: what's so destructive about it? | 19:29 |
| dstanek | actually it literally is... did rderose submit a brand new change id? | 19:29 |
| stevemar | dstanek: yes | 19:29 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/280896 | 19:30 |
| dolphm | o, boo | 19:30 |
| stevemar | dolphm: dstanek yeah, abandoned old one, probably for the usual reasons :P | 19:30 |
| dstanek | stevemar: well, it seems much harder than it need to be and it appears that the only reason to do that is to reuse the 'user' name for a new table | 19:31 |
| * stevemar continues to scarf down a banh mi | 19:31 | |
| dstanek | i actually don't like the identity - user - password breakdown | 19:31 |
| notmorgan | stevemar: just had bacon here. Sadly, peppered bacon < maple bacon < normal bacon | 19:31 |
| lbragstad | ayoung agreed - let me open a bug | 19:31 |
| ayoung | jamielennox, you still awake? I need guidance on how to make the implied roles Client API not be stupid | 19:32 |
| stevemar | dstanek: we could have "user" be the OTTRTA (one table to rule them all), and create a new one "sql/local" for the others? | 19:32 |
| dolphm | dstanek: the 3 tables was necessary to avoid duplicate users | 19:32 |
| dstanek | dolphm: i don't mind the 3 but i don't like the 3 picked | 19:32 |
| lbragstad | ayoung actually - what's the case we're working for here? | 19:32 |
| dolphm | dstanek: ? | 19:32 |
| lbragstad | ayoung a trust is create, a user gets a trust-scoped token, the trust is deleted, and the token is no longer valid? | 19:33 |
| lbragstad | created* | 19:33 |
| dstanek | for example, instead of 'user' is't really more like 'profile' (or something else since i suck at naming) because it's the same user. user and identity to me are the same | 19:33 |
| *** su_zhang has quit IRC | 19:33 | |
| *** roxanaghe has joined #openstack-keystone | 19:34 | |
| lbragstad | ayoung we protect against that here - https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L733-L734 | 19:34 |
| dolphm | dstanek: stevemar: rderose: this seems like it would be easier with voice - someone start a hangout or something? | 19:34 |
| dstanek | dolphm: stevemar: i may need to read the rest of this patch to see what's happening | 19:35 |
| dolphm | dstanek: yeah, i figure we can talk through it and review together, with Ron available to answer questions, etc | 19:35 |
| lbragstad | ayoung so the trust is validated online when we validate the token | 19:35 |
| dolphm | remote midcycle reviewing | 19:35 |
| ayoung | lbragstad, if a trust is deleted, there will be no need to look fro a revocation event. | 19:36 |
| ayoung | but that is new logic | 19:36 |
| *** roxanaghe has quit IRC | 19:36 | |
| ayoung | it was not that way when I orangutan lee wrote it | 19:37 |
| ayoung | OK, I cheated, that was not really an autocorrect error. | 19:37 |
| lbragstad | ayoung is that case what we are trying to use revocation events + trusts for though? | 19:37 |
| lbragstad | if a trust is deleted, a user shouldn't be able to use their trust-scoped fernet token anymore | 19:37 |
| ayoung | lbragstad, right. And with jorge_munoz 's work, we'll get that check done during validation if it is not done alreauyd | 19:38 |
| ayoung | lbragstad, look through his patches, please | 19:39 |
| ayoung | better if you can review them as well. | 19:39 |
| dolphm | dstanek: stevemar: rderose: https://hangouts.google.com/call/bsrs4bla7rx6tryxtx2qozaprua | 19:39 |
| lbragstad | ayoung we already check that we fernet when we validate a token | 19:39 |
| *** rderose has quit IRC | 19:39 | |
| lbragstad | with fernet* | 19:39 |
| ayoung | right...so, do you have everything you need? | 19:39 |
| lbragstad | ayoung I think so - but I wanted to double check that is the case we were solving for | 19:40 |
| lbragstad | ayoung so I won't open a bug | 19:40 |
| *** mylu has quit IRC | 19:40 | |
| *** rderose has joined #openstack-keystone | 19:40 | |
| ayoung | Yeah, we should be good | 19:40 |
| *** petertr7_away is now known as petertr7 | 19:41 | |
| dolphm | stevemar: are we still pursuing minimal downtime at all for mitaka? | 19:42 |
| *** roxanaghe has joined #openstack-keystone | 19:42 | |
| *** mylu has joined #openstack-keystone | 19:43 | |
| ayoung | henrynash, ok, I know we were talking about something I had been reviewing... | 19:46 |
| ayoung | let me pop it off the stack | 19:46 |
| dolphm | lbragstad: (on shadow users) do you expect the same migration to ever be run more than once?) | 19:47 |
| lbragstad | ayoung thanks | 19:48 |
| lbragstad | dolphm I don't *think* so? | 19:48 |
| samueldmq | henrynash: approved, will look at the others later today | 19:48 |
| lbragstad | dolphm rderose protects against that case I believe by checking the existence of the table | 19:48 |
| dolphm | lbragstad: makes sense in a dev environment, but we don't need to do that in the final release | 19:49 |
| dolphm | lbragstad: extra behavior / complexity risks introducing bugs | 19:49 |
| lbragstad | dolphm makes sense | 19:49 |
| lbragstad | dolphm OSA never runs into a case where they run a migration twice do they? | 19:49 |
| dolphm | lbragstad: no one should | 19:49 |
| ayoung | henrynash, so in https://review.openstack.org/#/c/263064/19/keystone/token/providers/common.py I think that maybe the logic should not be in the token controller for expanding out the roles. | 19:50 |
| dolphm | they're just not designed to | 19:50 |
| ayoung | henrynash, I know I had it there, too | 19:50 |
| stevemar | dolphm: no, bumped that to N | 19:50 |
| lbragstad | dolphm makes sense | 19:50 |
| lbragstad | dolphm in that case - make it simple as possible :) | 19:50 |
| dolphm | lbragstad: "if you need to run a migration again, you restore from a database back first" - rderose | 19:50 |
| dolphm | lbragstad: ++ | 19:50 |
| lbragstad | dolphm rderose completely agree | 19:50 |
| *** petertr7 is now known as petertr7_away | 19:51 | |
| dstanek | dolphm: ok, did a quick pass without executing the code | 19:51 |
| dstanek | so as a cloud customer i have a single identity and multiple users? | 19:52 |
| dstanek | that seems backward. i have a single user(profile) that i can access through multiple identities | 19:53 |
| dstanek | dolphm: stevemar: ^ | 19:53 |
| *** mylu has quit IRC | 19:53 | |
| dolphm | dstanek: stevemar: i made a hangout if you want to join | 19:53 |
| dstanek | sure | 19:54 |
| dolphm | dstanek: stevemar: https://talkgadget.google.com/hangouts/_/bsrs4bla7rx6tryxtx2qozaprua?authuser=0&hl=en | 19:54 |
| stevemar | dolphm: yes please | 19:54 |
| openstackgerrit | ayoung proposed openstack/keystone: Disable Admin tokens set to None https://review.openstack.org/280467 | 19:54 |
| henrynash | samueldmq: thx | 19:56 |
| *** spandhe has quit IRC | 19:59 | |
| openstackgerrit | ayoung proposed openstack/keystone: Disable Admin tokens set to None https://review.openstack.org/280467 | 20:00 |
| notmorgan | ayoung: lgtm | 20:01 |
| *** e0ne has joined #openstack-keystone | 20:02 | |
| *** spandhe has joined #openstack-keystone | 20:03 | |
| *** petertr7_away is now known as petertr7 | 20:04 | |
| dolphm | integrated with what | 20:05 |
| *** e0ne has quit IRC | 20:05 | |
| *** aginwala has quit IRC | 20:05 | |
| *** aginwala has joined #openstack-keystone | 20:08 | |
| *** jaosorior has quit IRC | 20:09 | |
| ayoung | edmondsw, I'm stuck on how to do the keystoneclient part of implied roles and I blame you | 20:14 |
| *** arunkant has quit IRC | 20:14 | |
| edmondsw | ayoung, do you have a reason? ;) | 20:14 |
| ayoung | if it was a separate object, including the resource name, It would be simple, but NOOOO~! you had to go all RESTFUL on me | 20:14 |
| edmondsw | ha | 20:14 |
| ayoung | edmondsw, actually, I just needed an excuise to talk it over with someone | 20:15 |
| ayoung | and jamielennox is asleep | 20:15 |
| edmondsw | i wasn't your first choice? I'm hurt now... I think... | 20:15 |
| ayoung | so...here is the role.py file starting point: http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/v3/roles.py | 20:15 |
| ayoung | edmondsw, you should not be | 20:15 |
| edmondsw | lol | 20:15 |
| *** sdake_ has joined #openstack-keystone | 20:15 | |
| ayoung | everyone knows that jamielennox is the king of all things client | 20:15 |
| edmondsw | tru dat | 20:16 |
| ayoung | So...the thing that is wonky here is that the clinet kindof has this pattern where you have a resource and all of the methods mnatch the HTTP methods | 20:16 |
| ayoung | for example | 20:16 |
| ayoung | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/v3/roles.py#n88 is GET | 20:16 |
| ayoung | for implied roles, we need to do things around these methods. | 20:17 |
| ayoung | Not sure if it should be a separate python method or not, | 20:17 |
| *** sdake has quit IRC | 20:17 | |
| edmondsw | not all of them line up with HTTP methods... e.g. http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/v3/roles.py#n135 | 20:17 |
| *** arunkant has joined #openstack-keystone | 20:17 | |
| ayoung | http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3.rst#n5155 is the create. | 20:18 |
| ayoung | right...grant is a create for the role assignments. | 20:18 |
| ayoung | edmondsw, this needs to flow down to the CLI, too, which is in a separate project... | 20:18 |
| *** david-lyle has quit IRC | 20:18 | |
| ayoung | so if there are mechanisms that automate the mapping from CLI params to calls I want to honor them | 20:19 |
| *** ebalduf has quit IRC | 20:19 | |
| ayoung | openstack help role gives | 20:19 |
| ayoung | role add role create role delete role list role remove role show | 20:19 |
| ayoung | and then ^^ is kindof hidden | 20:19 |
| ayoung | it would be | 20:19 |
| ayoung | role add vs role create | 20:20 |
| ayoung | so...lets start at this end | 20:20 |
| ayoung | would it be role imply? | 20:20 |
| ayoung | don;t want to confuse things with add | 20:21 |
| edmondsw | you're trying to tie two roles together, saying role x implies role y? | 20:22 |
| edmondsw | I would think that should be "role update" | 20:22 |
| edmondsw | this was one of my original comments... that the way you create an implied role shouldn't be PUT /roles/{id}/implies/{id}, it should be PUT /roles/{id} | 20:23 |
| ayoung | true...we don't have a nupdate | 20:23 |
| edmondsw | the role implications should be data represented on the role... drop that "implies" json block into a PUT /roles/{id} along with anything else you want to update about the role (e.g. could change its name at the same time if you wanted) | 20:25 |
| ayoung | excpet that roles were supposed to be immutable | 20:26 |
| edmondsw | why? | 20:26 |
| ayoung | this is an association between two roles | 20:26 |
| edmondsw | links are put into entities all the time | 20:26 |
| ayoung | why immutable? | 20:26 |
| edmondsw | yeah | 20:26 |
| ayoung | a role is little more than a string. Having the role Id in there was always strange | 20:27 |
| edmondsw | we could say some characteristics of roles are immutable, without saying they all are | 20:27 |
| ayoung | edmondsw, you don't think like a relational database person, do you? | 20:28 |
| edmondsw | ayoung you don't think like a REST guy, do you? | 20:28 |
| ayoung | edmondsw, I guess not | 20:28 |
| edmondsw | before I did security, I was the API lead for our product | 20:28 |
| ayoung | edmondsw, its the whole hierarchical versus relational argument all over again | 20:29 |
| edmondsw | it takes some getting used to | 20:29 |
| ayoung | you want to be able to vary the relationships separate from the objects they relate. Favor immutable is actually more a programming construct, although the "never erase anything from the database" approach also falls in there | 20:30 |
| ayoung | the reason what you suggest works here is because inference rules form a DAG, which works well in a hierarchical scheme such as REST | 20:31 |
| *** sdake_ has quit IRC | 20:32 | |
| edmondsw | I gave you that option as well in my comments on patch 61: https://review.openstack.org/#/c/242614/61/keystone/assignment/routers.py | 20:32 |
| edmondsw | POST /role_inferences | 20:32 |
| *** sdake has joined #openstack-keystone | 20:32 | |
| ayoung | edmondsw, yeah, I was more prone to go with that...forget now who talked me out of it... | 20:32 |
| ayoung | edmondsw, so what you are saying is that I have only myself to Blame? | 20:33 |
| *** mylu has joined #openstack-keystone | 20:33 | |
| edmondsw | weelll... you said it... ;) | 20:33 |
| ayoung | OK...I'm going to go with a new verb, and we can argue it out in the review | 20:34 |
| edmondsw | btw, you'd love the conversation on policy going on in #openstack-nova | 20:36 |
| edmondsw | ayoung ^ | 20:36 |
| *** spzala has quit IRC | 20:36 | |
| *** ebalduf has joined #openstack-keystone | 20:38 | |
| *** trevorjay has quit IRC | 20:40 | |
| *** mylu has quit IRC | 20:41 | |
| *** subscope has quit IRC | 20:42 | |
| openstackgerrit | guang-yee proposed openstack/keystone: wsgi: fix base_url finding https://review.openstack.org/226464 | 20:44 |
| dolphm | stevemar: https://review.openstack.org/#/c/278570/14/keystone/common/sql/migrate_repo/versions/089_rename_user_table_to_identity_table.py,unified L43 | 20:45 |
| *** aginwala has quit IRC | 20:46 | |
| *** aginwala has joined #openstack-keystone | 20:49 | |
| dolphm | stevemar: dstanek: https://etherpad.openstack.org/p/keystone-shadow-users | 20:49 |
| *** gyee has quit IRC | 20:54 | |
| *** clenimar has quit IRC | 20:55 | |
| *** gordc has joined #openstack-keystone | 20:55 | |
| *** jsavak has joined #openstack-keystone | 20:58 | |
| *** spandhe has quit IRC | 21:00 | |
| *** raildo is now known as raildo-afk | 21:01 | |
| *** spandhe has joined #openstack-keystone | 21:04 | |
| *** jbell8 has joined #openstack-keystone | 21:05 | |
| *** jorge_munoz has quit IRC | 21:07 | |
| *** mhickey has joined #openstack-keystone | 21:10 | |
| henrynash | ayoung: sorry to bug you on this one, but could you take a look at https://review.openstack.org/#/c/263064/ to see if you are OK with how I am handling trusts | 21:10 |
| ayoung | henrynash, bug away. | 21:10 |
| ayoung | henrynash, so...I kindof feel my code that is based on was a bit of a hack | 21:11 |
| ayoung | didn't think it would go through unchallenged | 21:11 |
| ayoung | henrynash, and the explicit assignment_list = self.assignment_api.list_role_assignments afterwards adds to the badness | 21:12 |
| *** jorge_munoz has joined #openstack-keystone | 21:12 | |
| ayoung | henrynash, so...can we somehow tag those interfaces as private even though they are called between two different controllers? | 21:12 |
| ayoung | henrynash, I think it is good as is | 21:13 |
| ayoung | henrynash, you see what I did in the previous patch, though, right? Using the refs = [{'role_id': role['id']} for role in trust['roles']] is really clunky | 21:14 |
| *** jsavak has quit IRC | 21:14 | |
| henrynash | ayoung: so I do think we may want to refactor some of this….I agree….but maybe that is for us to come back in and do | 21:14 |
| ayoung | agreed | 21:14 |
| ayoung | lets get this in. | 21:14 |
| ayoung | the damage was done in a committed patch | 21:15 |
| ayoung | henrynash, suspect we should expand implied roles in the trust driver, but./..unified delagation | 21:16 |
| ayoung | henrynash, also tomorrow, can we discuss the client interface for DSRs and Implied ROles? | 21:16 |
| *** daemontool__ has joined #openstack-keystone | 21:17 | |
| henrynash | ayoung: sure | 21:17 |
| ayoung | henrynash, cool. I have to go pick up my kids here in aminute, or I'd subject you to it now | 21:18 |
| ayoung | vacation week...camps | 21:18 |
| *** fawadkhaliq has quit IRC | 21:18 | |
| *** daemontool_ has quit IRC | 21:20 | |
| henrynash | ayoung: :-) | 21:20 |
| *** roxanaghe has quit IRC | 21:23 | |
| *** sdake_ has joined #openstack-keystone | 21:24 | |
| openstackgerrit | Merged openstack/pycadf: Updated from global requirements https://review.openstack.org/280864 | 21:25 |
| *** sdake has quit IRC | 21:25 | |
| *** rderose has quit IRC | 21:26 | |
| *** su_zhang has joined #openstack-keystone | 21:26 | |
| *** rderose has joined #openstack-keystone | 21:26 | |
| *** mhickey has quit IRC | 21:34 | |
| *** dims has quit IRC | 21:37 | |
| openstackgerrit | Merged openstack/keystone: Clean up configuration documentataion on v2 user CRUD https://review.openstack.org/280755 | 21:38 |
| *** daemontool has joined #openstack-keystone | 21:38 | |
| openstackgerrit | Merged openstack/keystone: Don't describe trusts as an extension in configuration doc https://review.openstack.org/280761 | 21:39 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/280896 | 21:41 |
| *** daemontool__ has quit IRC | 21:42 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/280896 | 21:43 |
| *** smurke has joined #openstack-keystone | 21:47 | |
| dolphm | jamielennox: any idea why this code https://github.com/sumantmurke/rally/blob/gnocchi_gclient_using_v3_api/rally/osclients.py#L425-L442 would bail with http://cdn.pasteraw.com/arum9e2repugrmltuieh8fwe5gtcfsu ? (why is it looking for v3 stuff it's pretty explicitly using v2 everywhere? cc- smurke | 21:47 |
| dolphm | jamielennox: if you change it back to v3, then you'll also need to provide a project_domain_name (or project_domain_id) similar to this line https://github.com/sumantmurke/rally/blob/gnocchi_gclient_using_v3_api/rally/osclients.py#L439 | 21:50 |
| *** dims has joined #openstack-keystone | 21:50 | |
| dolphm | smurke: ^ sorry jamielennox | 21:50 |
| *** gyee has joined #openstack-keystone | 21:50 | |
| *** ChanServ sets mode: +v gyee | 21:50 | |
| jamielennox | dolphm: no i can't think of any reason for that | 21:52 |
| dolphm | smurke: try project_domain_id='default' with v3 | 21:53 |
| jamielennox | or you can do the Password plugin, no versioned url and use default_domain_id='default' | 21:54 |
| dolphm | smurke: so: username + password + user_domain_name + project_name + project_domain_id='default' | 21:54 |
| smurke | dolphm: Thanx | 21:54 |
| dolphm | jamielennox: please can the plugins please assume a user_domain_id and project_domain_id of 'default' unless a user_domain_* or project_domain_* is specified, please? | 21:55 |
| *** roxanaghe has joined #openstack-keystone | 21:55 | |
| jamielennox | dolphm: for a couple of reasons, not really, but that's what default_domain_id is for | 21:55 |
| dolphm | jamielennox: you *can* pass a versioned URL to a Password plugin though, right? it doesn't have to be unversioned | 21:55 |
| jamielennox | dolphm: just export OS_DEFAULT_DOMAIN_ID='default' in bashrc and never think about it again | 21:56 |
| dolphm | jamielennox: default_domain_id in keystone.conf? | 21:56 |
| jamielennox | dolphm: no client side | 21:56 |
| dolphm | jamielennox: why force users to do that if it's going to be the case for 90% ? | 21:56 |
| *** roxanaghe has quit IRC | 21:56 | |
| jamielennox | dolphm: OSC does do that, so for the 90% it's ok | 21:56 |
| dolphm | that forces everyone to do busy work all the time, and it's just another hurdle to debug - resulting in crappy UX | 21:56 |
| dolphm | jamielennox: *everything* should assume the 'default' domain for user & project context though, unless one is specified. why just OSC? | 21:57 |
| *** roxanaghe has joined #openstack-keystone | 21:57 | |
| jamielennox | but given that we still can't have service users in the non-default domain i know a lot of deployments put customers in non-default domain | 21:57 |
| dolphm | also, OSC does not assume anything if you still have to specify it separately | 21:57 |
| jamielennox | dolphm: no, OSC will assume default_domain_id='default' if the user doesn't specify anything else | 21:58 |
| jamielennox | i don't think they do it in exactly that way but it boils down to the same thing | 21:58 |
| dolphm | jamielennox: okay, so what's different about plugins? | 22:01 |
| dolphm | slash, why should plugins behave differently? | 22:02 |
| *** notmorgan changes topic to "mitaka-3 feature freeze on FEB 29 - please prioritize reviews accordingly! | Mitaka-3: https://launchpad.net/keystone/+milestone/mitaka-3" | 22:03 | |
| *** ebalduf has quit IRC | 22:03 | |
| *** spandhe has quit IRC | 22:05 | |
| *** daemontool has quit IRC | 22:05 | |
| ayoung | dolphm, what if we made that something that could be queried, and part of the negotiate response? | 22:06 |
| *** mylu has joined #openstack-keystone | 22:07 | |
| ayoung | GET /v2.0/domain returns {'name': 'Default', 'id' : 'default'} | 22:07 |
| *** spandhe has joined #openstack-keystone | 22:08 | |
| *** aginwala has quit IRC | 22:08 | |
| jamielennox | dolphm: i guess it grew out of not trying to hide domains as a v3 concept, times before where i've tried to cut down on the amount of auth information i've been told it doesn't matter because it's either configured via some CM system or provided by an accrc/clouds.yaml file where the provider can influence the variables | 22:09 |
| jamielennox | i know the clouds i've seen here do a domain per customer (customer != user) | 22:10 |
| jamielennox | so specifying a accrc with the default_domain_id/name of the user is going to eliminate almost all the user dealing with domains | 22:10 |
| jamielennox | as it's rare that a user will be dealing with projects outside their domain | 22:11 |
| jamielennox | though i guess this doesn't help for v2/v3 | 22:11 |
| jamielennox | ayoung: i don't really want to add anything to /v2 | 22:11 |
| ayoung | jamielennox, neither do I, but this is the outcome of the cross-project meeting | 22:12 |
| ayoung | this has been a thorn in our side for a while, dolphm is right here, and this is the cleanest way to expose the domain data to the client. | 22:12 |
| ayoung | Guessing that it is "default" will break when the users change the config | 22:13 |
| ayoung | that might be a rare occurance, but I can actually see it happening in this scenario: | 22:13 |
| ayoung | 1. Use installer to get thing srunning | 22:13 |
| ayoung | 2. Add in LDAp support into a domain specific backend | 22:13 |
| ayoung | 3. change default domain to be the LDAP backed domain | 22:13 |
| ayoung | 4. Break everything and have pissed off operators | 22:13 |
| ayoung | dolphm, if the client could query the value from the Keystone server, would that serve your needs? | 22:14 |
| *** mylu has quit IRC | 22:14 | |
| *** petertr7 is now known as petertr7_away | 22:17 | |
| *** dave-mccowan has quit IRC | 22:26 | |
| dolphm | ayoung: i don't need / want a query for that | 22:31 |
| dolphm | i'm in general super opposed to GET /service-configuration type calls | 22:31 |
| *** mylu has joined #openstack-keystone | 22:32 | |
| ayoung | dolphm, OK. I'm not going to go to bat for it. But I don't like the "assume it is default" approach either | 22:32 |
| ayoung | dolphm, any suggesting how to fix it, or do we just full-press to get people to V3 and wash our hands of it? | 22:34 |
| ayoung | I'm not 100% certain that we can't work around my use case now | 22:34 |
| ayoung | if the whole install is done V3, you could probably hack the database to move the service users out of "default" and into some Dom Specifi Backe End | 22:35 |
| jamielennox | ayoung: not as far as i'm aware, there are still some services that expect and auth with v2 so you have to have those in the default domain | 22:38 |
| jamielennox | there aren't many though | 22:38 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 22:38 |
| *** henrynash has quit IRC | 22:40 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 22:41 |
| *** gordc has quit IRC | 22:43 | |
| *** dims has quit IRC | 22:47 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: wsgi: fix base_url finding https://review.openstack.org/226464 | 22:48 |
| *** daemontool has joined #openstack-keystone | 22:48 | |
| *** Nakato has quit IRC | 22:50 | |
| *** Nakato has joined #openstack-keystone | 22:50 | |
| *** diazjf has quit IRC | 22:55 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Update websso doc with WEBSSO_KEYSTONE_URL option https://review.openstack.org/280974 | 22:55 |
| *** ninag has quit IRC | 22:57 | |
| *** pece has quit IRC | 22:57 | |
| ayoung | jamielennox, so, you, me and dolphm have a mutually exclusive set of requirements here | 23:00 |
| *** aginwala has joined #openstack-keystone | 23:00 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:00 | |
| *** spandhe has quit IRC | 23:03 | |
| rderose | dstanek: are you still on? | 23:07 |
| *** sdake_ has quit IRC | 23:09 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Implied Roles https://review.openstack.org/280983 | 23:10 |
| ayoung | jamielennox, does ^^ looks sane? | 23:10 |
| jamielennox | ayoung: english or not i don't like that you switch from X_implied to delete_implication - otherwise at first glance it looks fine | 23:12 |
| samueldmq | ayoung: I was going to ask: "hasn't this merged already?!?' | 23:17 |
| *** slberger has left #openstack-keystone | 23:17 | |
| *** rcernin has quit IRC | 23:18 | |
| samueldmq | ayoung: I thought it was a server patch | 23:18 |
| *** rderose has quit IRC | 23:18 | |
| ayoung | jamielennox, I'm open to suggestions. What would be the preffered language there> | 23:19 |
| ayoung | ? | 23:19 |
| jamielennox | just delete_implied i think | 23:19 |
| samueldmq | ayoung: commented there | 23:19 |
| * samueldmq 's afk for a bit, brbr | 23:20 | |
| *** pushkaru has quit IRC | 23:20 | |
| ayoung | and yes, I know it needs tests. I am about to try it on a Kolla setup...lets' see what happens. | 23:20 |
| *** pushkaru has joined #openstack-keystone | 23:20 | |
| *** phalmos has quit IRC | 23:20 | |
| *** spandhe has joined #openstack-keystone | 23:20 | |
| *** mylu has quit IRC | 23:24 | |
| *** jbell8_ has joined #openstack-keystone | 23:28 | |
| *** jbell8_ has quit IRC | 23:29 | |
| *** DuncanT_ has joined #openstack-keystone | 23:30 | |
| *** gyee_ has joined #openstack-keystone | 23:30 | |
| *** andrewbogott_ has joined #openstack-keystone | 23:30 | |
| *** dave-mccowan has joined #openstack-keystone | 23:31 | |
| *** tpeoples_ has joined #openstack-keystone | 23:31 | |
| *** mylu has joined #openstack-keystone | 23:31 | |
| *** BrAsS_mO- has joined #openstack-keystone | 23:35 | |
| *** EmilienM_ has joined #openstack-keystone | 23:35 | |
| *** cburgess has joined #openstack-keystone | 23:35 | |
| *** wasmum- has joined #openstack-keystone | 23:35 | |
| *** clayton_ has joined #openstack-keystone | 23:36 | |
| *** gyee has quit IRC | 23:37 | |
| *** jbell8 has quit IRC | 23:37 | |
| *** ekarlso has quit IRC | 23:37 | |
| *** wasmum has quit IRC | 23:37 | |
| *** clayton has quit IRC | 23:37 | |
| *** andrewbogott has quit IRC | 23:37 | |
| *** tpeoples has quit IRC | 23:37 | |
| *** EmilienM has quit IRC | 23:37 | |
| *** dobson has quit IRC | 23:37 | |
| *** jrist has quit IRC | 23:37 | |
| *** mdavidson has quit IRC | 23:37 | |
| *** cburgess_ has quit IRC | 23:37 | |
| *** BrAsS_mOnKeY has quit IRC | 23:37 | |
| *** DuncanT has quit IRC | 23:37 | |
| *** johnthetubaguy has quit IRC | 23:37 | |
| *** clayton_ is now known as clayton | 23:37 | |
| *** EmilienM_ is now known as EmilienM | 23:37 | |
| *** EmilienM is now known as Guest28836 | 23:37 | |
| *** dobson has joined #openstack-keystone | 23:37 | |
| *** roxanaghe has quit IRC | 23:38 | |
| *** andrewbogott_ is now known as andrewbogott | 23:40 | |
| *** tpeoples_ is now known as tpeoples | 23:40 | |
| *** Guest28836 has quit IRC | 23:41 | |
| *** Guest28836 has joined #openstack-keystone | 23:41 | |
| *** roxanaghe has joined #openstack-keystone | 23:41 | |
| *** Guest28836 is now known as EmilienM | 23:42 | |
| *** mdavidson has joined #openstack-keystone | 23:43 | |
| *** DuncanT_ is now known as DuncanT | 23:43 | |
| *** dims_ has joined #openstack-keystone | 23:44 | |
| *** pushkaru has quit IRC | 23:44 | |
| *** jrist has joined #openstack-keystone | 23:44 | |
| *** andrewbogott has quit IRC | 23:45 | |
| *** andrewbogott has joined #openstack-keystone | 23:45 | |
| *** mylu has quit IRC | 23:47 | |
| *** ekarlso has joined #openstack-keystone | 23:47 | |
| *** johnthetubaguy has joined #openstack-keystone | 23:47 | |
| *** ekarlso has quit IRC | 23:48 | |
| *** ekarlso has joined #openstack-keystone | 23:48 | |
| *** mylu has joined #openstack-keystone | 23:50 | |
| *** sdake has joined #openstack-keystone | 23:53 | |
| *** browne has quit IRC | 23:56 | |
| *** mylu has quit IRC | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
