| *** boris-42 has joined #openstack-keystone | 00:04 | |
| *** EinstCra_ has joined #openstack-keystone | 00:05 | |
| *** EinstCrazy has quit IRC | 00:06 | |
| *** EinstCra_ has quit IRC | 00:07 | |
| *** subscope has quit IRC | 00:27 | |
| *** fpatwa has quit IRC | 00:29 | |
| *** fpatwa has joined #openstack-keystone | 00:32 | |
| *** markvoelker has joined #openstack-keystone | 01:09 | |
| *** markvoelker has quit IRC | 01:13 | |
| *** fpatwa has quit IRC | 01:32 | |
| *** shoutm has joined #openstack-keystone | 01:36 | |
| *** mylu has quit IRC | 01:48 | |
| *** EinstCrazy has joined #openstack-keystone | 01:48 | |
| *** mylu has joined #openstack-keystone | 01:51 | |
| *** davechen2 has joined #openstack-keystone | 02:01 | |
| *** davechen2 is now known as davechen | 02:04 | |
| *** mylu has quit IRC | 02:24 | |
| *** vivekd has joined #openstack-keystone | 03:07 | |
| *** markvoelker has joined #openstack-keystone | 03:09 | |
| stevemar | davechen: yeah, but we need to fix the bug before we release mitaka-3 :\ | 03:13 |
|---|---|---|
| bigjools | stevemar: hey! | 03:14 |
| stevemar | bigjools: hola | 03:14 |
| *** markvoelker has quit IRC | 03:14 | |
| bigjools | stevemar: would you mind doing me a huge favour and checking what I am doing here is not insane please? https://bugs.launchpad.net/python-keystoneclient/+bug/1547331 | 03:15 |
| openstack | Launchpad bug 1547331 in python-keystoneclient "AuthorizationFailure: Authorization failed: Cannot authenticate without an auth_url" [Undecided,New] | 03:15 |
| *** mylu has joined #openstack-keystone | 03:17 | |
| stevemar | bigjools: hmm, looks like jamie already commented (that makes my life easier) | 03:17 |
| bigjools | stevemar: indeed, but the last thing I'm doing specifically to make service_catalog available | 03:17 |
| davechen | stevemar: sure, it will be cool to update the testcase, maybe amakarov_away is working on that. :) | 03:22 |
| davechen | stevemar: any other patches need immediate attention? | 03:25 |
| stevemar | davechen: just this stuff: https://launchpad.net/keystone/+milestone/mitaka-3 | 03:25 |
| stevemar | davechen: the shadow user patches? | 03:26 |
| davechen | stevemar: but it always WIP :( | 03:26 |
| stevemar | davechen: i need to talk to ron about that :) | 03:26 |
| stevemar | davechen: i think review it regardless | 03:26 |
| davechen | stevemar: and I feel that SP filtering is defer to N by default? | 03:27 |
| stevemar | davechen: yep, i said that at the last meeting, sorry for not updating you :\ | 03:27 |
| davechen | stevemar: glad to know that. | 03:27 |
| davechen | stevemar: no need to rush. | 03:27 |
| *** mylu has quit IRC | 03:29 | |
| *** mylu has joined #openstack-keystone | 03:30 | |
| stevemar | davechen: also https://review.openstack.org/#/c/277436/ - but also WIP | 03:31 |
| patchbot | stevemar: patch 277436 - keystone - Return 404 instead of 401 for tokens w/o roles | 03:31 |
| stevemar | davechen: also this one.. https://review.openstack.org/#/c/231289/54 | 03:31 |
| patchbot | stevemar: patch 231289 - keystone - Projects acting as domains | 03:31 |
| davechen | stevemar: i will take a look at both of them. | 03:32 |
| *** fpatwa has joined #openstack-keystone | 03:33 | |
| *** fpatwa has quit IRC | 03:37 | |
| *** davechen is now known as davechen_afk | 03:45 | |
| *** links has joined #openstack-keystone | 03:57 | |
| *** diazjf has joined #openstack-keystone | 04:16 | |
| *** mylu has quit IRC | 04:16 | |
| *** mylu has joined #openstack-keystone | 04:19 | |
| *** mylu has quit IRC | 04:20 | |
| stevemar | bigjools: finally looking at your bug, family stuff before | 04:23 |
| bigjools | no worries | 04:23 |
| bigjools | it's still sunday for you | 04:23 |
| stevemar | bigjools: yep | 04:24 |
| *** dave-mcc_ has joined #openstack-keystone | 04:24 | |
| stevemar | bigjools: so you're using keystone auth or keystoneclient's old deprecated auth bits? | 04:24 |
| *** dave-mccowan has quit IRC | 04:25 | |
| bigjools | I am trying to get Rally doing something sane with its clients. First up is to get it using sessions, but I end up with the problem described. | 04:25 |
| *** mylu has joined #openstack-keystone | 04:25 | |
| bigjools | so the old auth stuff is no more | 04:26 |
| bigjools | but - with it seems to go the service_catalog | 04:26 |
| *** dave-mcc_ has quit IRC | 04:28 | |
| stevemar | bigjools: got some paste code? | 04:30 |
| bigjools | stevemar: even better: https://review.openstack.org/#/c/282918/1 | 04:30 |
| patchbot | bigjools: patch 282918 - rally - Make Rally cope with unversioned keystone URL | 04:30 |
| stevemar | bigjools: oh that is even better | 04:31 |
| bigjools | the old code was doing all its own discovery and crazy things | 04:31 |
| bigjools | I only found out that client.authenticate() doesn't work with sessions when someone tried to use an endpoint override | 04:32 |
| bigjools | and jamie pointed out authenticate() is deprecated for sessions | 04:32 |
| *** mylu has quit IRC | 04:38 | |
| *** mylu has joined #openstack-keystone | 04:40 | |
| *** davechen_afk has quit IRC | 04:40 | |
| *** dave-mccowan has joined #openstack-keystone | 04:40 | |
| *** davechen has joined #openstack-keystone | 04:41 | |
| *** Nirupama has joined #openstack-keystone | 04:42 | |
| jamielennox | bigjools: use full irc nicks - i would have joined in earlier | 04:50 |
| jamielennox | what's up? | 04:50 |
| bigjools | jamielennox: see my last question on https://bugs.launchpad.net/python-keystoneclient/+bug/1547331 | 04:50 |
| openstack | Launchpad bug 1547331 in python-keystoneclient "AuthorizationFailure: Authorization failed: Cannot authenticate without an auth_url" [Undecided,New] | 04:50 |
| bigjools | sorry didn't think you were on and then realised my client sorted you into the voiced section at the top of the list... d'oh | 04:51 |
| jamielennox | bigjools: np | 04:51 |
| jamielennox | bigjools: do you need to iterate the catalog or just know if something is present | 04:52 |
| bigjools | it's iterating it and collecting service_types | 04:52 |
| bigjools | hang on I'll find the code | 04:52 |
| jamielennox | session.get_endpoint is none if nothing matches so you can do like if session.get_endpoint(service_type='identity', version=(3,0)) | 04:52 |
| jamielennox | but there isn't normally a list exposed | 04:53 |
| bigjools | yeah | 04:53 |
| bigjools | https://github.com/openstack/rally/blob/master/rally/osclients.py#L702 | 04:53 |
| *** fpatwa has joined #openstack-keystone | 04:53 | |
| bigjools | that is the problematic code | 04:53 |
| stevemar | jamielennox: be telepathic instead :P | 04:54 |
| jamielennox | stevemar: ever more reasonable requests from our PTL | 04:55 |
| jamielennox | bigjools: so two options | 04:55 |
| stevemar | jamielennox: i ask for so little | 04:56 |
| bigjools | Problematic Telepathy Lead | 04:56 |
| jamielennox | bigjools: rally has a predefined list of services: https://github.com/openstack/rally/blob/master/rally/consts.py#L114 so you can loop through those and do the get_endpoitn check | 04:56 |
| jamielennox | the request is cached but it's not the fastest way | 04:56 |
| jamielennox | otherwise i'd do like | 04:56 |
| jamielennox | try: | 04:57 |
| jamielennox | hmm | 04:57 |
| bigjools | there's also myriad call sites using client.service_catalog.url_for() | 04:57 |
| jamielennox | if hasattr(auth, 'get_access'): | 04:57 |
| jamielennox | auth.get_access(session).service_catalog.url_for(...) | 04:58 |
| jamielennox | bigjools: all identity plugins (things that talk to keystone) should implement get_access | 04:58 |
| bigjools | right - that's what I've tried to use in my hack | 04:58 |
| jamielennox | bigjools: which is realistically everything you would want to use rally for | 04:58 |
| jamielennox | but you should make sure anyway | 04:58 |
| bigjools | so how greasy is my hack that copies the result of get_access into the auth_ref? | 04:59 |
| jamielennox | oh, you install it back onto the client? | 04:59 |
| jamielennox | that's greasy | 04:59 |
| bigjools | I figured :) | 04:59 |
| bigjools | it just saved changing a ton of code | 04:59 |
| jamielennox | any reason not to do it from the auth object? | 04:59 |
| bigjools | and the tests in Rally suck | 04:59 |
| jamielennox | yea i can imagine | 04:59 |
| boris-42 | bigjools: why they suck lol? | 05:00 |
| bigjools | boris-42: hey :) | 05:00 |
| jamielennox | what most services like this lack is like a current context object | 05:00 |
| bigjools | boris-42: too many mocks | 05:00 |
| boris-42 | bigjools: you mean unit tests ?) | 05:00 |
| jamielennox | they assume that the keystoneclient is authenticated and then pass that around | 05:00 |
| bigjools | boris-42: yes | 05:00 |
| boris-42 | bigjools: so we have to mock services | 05:00 |
| jamielennox | using it for state rather than as an entry point for requests | 05:00 |
| boris-42 | bigjools: in unit tests | 05:00 |
| boris-42 | bigjools: otherwise they would be intergration tests (which we have) | 05:01 |
| boris-42 | bigjools: but if you have any ideas how to do the better testing of scenarios/oslicents you are very welocme | 05:01 |
| jamielennox | boris-42: i wish rally didn't encorporate a database | 05:01 |
| bigjools | jamielennox: right. If I save the identity object on the rally client object I can use it to get the auth object | 05:01 |
| bigjools | and hence service_catalog | 05:01 |
| boris-42 | jamielennox: you mean db less mode? | 05:02 |
| bigjools | boris-42: fakes implemented as fixtures | 05:02 |
| jamielennox | boris-42: that's a thing? (it's not mentioned in any docs i read) | 05:02 |
| bigjools | boris-42: re-implementing a function should not involve re-writing its test | 05:02 |
| boris-42 | jamielennox: so I heard that request before | 05:02 |
| boris-42 | jamielennox: like just run rally task and get report | 05:02 |
| boris-42 | jamielennox: in one line | 05:02 |
| boris-42 | jamielennox: it sound like a very interesting idea | 05:03 |
| jamielennox | boris-42: yep, you can wrap something that stores result in a db around that runner | 05:03 |
| jamielennox | but for me i want to automatic deploy to a vm, run tests get results | 05:03 |
| boris-42 | jamielennox: so I am thinking about it | 05:03 |
| boris-42 | jamielennox: however I didn't find a nice solution yet | 05:03 |
| jamielennox | and it's a pain to have to go through the process of registering environments into a db | 05:03 |
| jamielennox | rather than just provide ENV vars like the other clients | 05:03 |
| bigjools | ^ +1 | 05:03 |
| boris-42 | jamielennox: hm one just question | 05:03 |
| boris-42 | jamielennox: why not next: "rally deployment create --fromenv --name any" | 05:04 |
| boris-42 | jamielennox: rally task start <your_file> | 05:04 |
| boris-42 | jamielennox: if you have in env variables (it will be just few commands) | 05:04 |
| boris-42 | jamielennox: instead of one | 05:04 |
| jamielennox | i more or less have, but it's not idempotent for ansible | 05:04 |
| jamielennox | i've currently got | 05:04 |
| bigjools | I'd like to be able to specify multiple task files as well | 05:05 |
| boris-42 | bigjools: but why not putting everything in single file?) | 05:05 |
| bigjools | boris-42: same reason the samples aren't | 05:05 |
| boris-42 | bigjools: seems like people is willing to have this multi file stuff (we will need to implement it) | 05:05 |
| boris-42 | bigjools: rally/certification/ ? | 05:06 |
| boris-42 | bigjools: single file https://github.com/openstack/rally/tree/master/certification/openstack | 05:06 |
| jamielennox | http://paste.openstack.org/show/487717/ | 05:06 |
| bigjools | boris-42: samples/tasks/ | 05:06 |
| boris-42 | bigjools: those are samples | 05:06 |
| boris-42 | bigjools: this one is the thing that you should run =) | 05:06 |
| boris-42 | jamielennox: reading | 05:07 |
| bigjools | also same reason you don't put all your code in the same file | 05:07 |
| bigjools | :) | 05:07 |
| boris-42 | jamielennox: so you are trying to use rally as a lib | 05:07 |
| boris-42 | jamielennox: this is pain in the neck I know, we are almost done with refactoring this part and making it sexy | 05:07 |
| jamielennox | boris-42: there i am because it was proving difficult to parse CLI output | 05:08 |
| boris-42 | jamielennox: andreykuriling is hardworking on it | 05:08 |
| boris-42 | bigjools: ok | 05:08 |
| jamielennox | boris-42: anyway i think if you extract the part that is a test runner and have that take only CLI or env vars or even be called only as a python entry point | 05:09 |
| jamielennox | then you can wrap the rally database stuff around it | 05:09 |
| boris-42 | jamielennox: yep yep | 05:09 |
| jamielennox | but it would mean for those of us who don't have a long running rally deployment i could just take my output and feed it back to my own analysis | 05:09 |
| boris-42 | jamielennox: I agree that it is valid case (you don't need to convince me+) | 05:10 |
| *** markvoelker has joined #openstack-keystone | 05:10 | |
| boris-42 | jamielennox: so we will need to do some magic around rally.task.engine | 05:10 |
| *** GB21 has joined #openstack-keystone | 05:10 | |
| jamielennox | boris-42: no worries, i just haven't seen you around since i started playing with rally, that's been my big pain so far | 05:10 |
| jamielennox | and then writing the ansible tasks it's very tied into the db | 05:10 |
| boris-42 | jamielennox: btw we have feature reuqest | 05:11 |
| boris-42 | jamielennox: https://rally.readthedocs.org/en/latest/feature_requests.html | 05:11 |
| boris-42 | jamielennox: so please if you are facing troubles just put them all there and we will find the way to address those things | 05:11 |
| boris-42 | jamielennox: it's hard to see the project like new users are seeing it after 3 years=) | 05:12 |
| jamielennox | boris-42: completely understand that | 05:12 |
| *** markvoelker has quit IRC | 05:15 | |
| bigjools | I'd love to see a KeystoneFixture provided by keystone itself, such that other projects can use it in tests | 05:16 |
| bigjools | can run it up as a fixtureresource | 05:16 |
| boris-42 | bigjools: yep that will be nice (we would use that in rally) | 05:17 |
| bigjools | boris-42: yeah - can then get rid of all those nasty mocks :) | 05:17 |
| bigjools | which I am sure are hiding bugs :( | 05:17 |
| boris-42 | bigjools: they are not hidding bugs (cause we are covering almost all by integration tests) | 05:18 |
| boris-42 | bigjools: take a look at the amount of jobs that we have in gates https://review.openstack.org/#/c/269958/ | 05:18 |
| patchbot | boris-42: patch 269958 - rally - Using 'dt' as alias for datetime imports | 05:18 |
| bigjools | boris-42: choose_version returns "None" as a string. That's a hidden bug :) | 05:18 |
| bigjools | what I mean is, traps that are waiting when stuff gets changed | 05:19 |
| bigjools | jamielennox: thanks for the advice BTW. I'll try to implement it, sadly not easy because of the way the code is currently organised but it's all a challenge... | 05:21 |
| *** EinstCra_ has joined #openstack-keystone | 05:23 | |
| *** EinstCrazy has quit IRC | 05:25 | |
| *** diazjf has quit IRC | 05:33 | |
| *** dave-mccowan has quit IRC | 05:37 | |
| *** mylu has quit IRC | 05:41 | |
| *** rdo has quit IRC | 05:45 | |
| *** rdo has joined #openstack-keystone | 05:47 | |
| *** ChengKun has joined #openstack-keystone | 05:50 | |
| *** mylu has joined #openstack-keystone | 05:55 | |
| *** roxanaghe has joined #openstack-keystone | 05:58 | |
| *** jaosorior has joined #openstack-keystone | 06:11 | |
| *** Guest61736 is now known as mariusv | 06:27 | |
| *** mariusv has joined #openstack-keystone | 06:27 | |
| *** fpatwa has quit IRC | 06:37 | |
| *** EinstCrazy has joined #openstack-keystone | 06:38 | |
| *** roxanaghe has quit IRC | 06:39 | |
| *** EinstCra_ has quit IRC | 06:39 | |
| *** vivekd_ has joined #openstack-keystone | 06:43 | |
| *** vivekd has quit IRC | 06:46 | |
| *** vivekd_ is now known as vivekd | 06:46 | |
| *** mylu has quit IRC | 06:49 | |
| *** jasonsb has joined #openstack-keystone | 06:52 | |
| *** josecastroleon has joined #openstack-keystone | 07:00 | |
| *** belmoreira has joined #openstack-keystone | 07:11 | |
| *** markvoelker has joined #openstack-keystone | 07:11 | |
| breton | stevemar: 55 | 07:14 |
| *** markvoelker has quit IRC | 07:15 | |
| *** chlong_ has quit IRC | 07:30 | |
| *** jasonsb has quit IRC | 07:33 | |
| *** tomoiaga has joined #openstack-keystone | 07:35 | |
| *** jasonsb has joined #openstack-keystone | 07:36 | |
| *** subscope has joined #openstack-keystone | 07:51 | |
| *** su_zhang has quit IRC | 07:51 | |
| *** subscope has quit IRC | 07:51 | |
| *** jamielennox is now known as jamielennox|away | 07:52 | |
| *** su_zhang has joined #openstack-keystone | 07:52 | |
| *** iurygregory has quit IRC | 07:56 | |
| *** su_zhang has quit IRC | 07:56 | |
| *** ericksonsantos has quit IRC | 07:57 | |
| *** wolsen has quit IRC | 07:57 | |
| *** wolsen has joined #openstack-keystone | 08:00 | |
| *** jamielennox|away is now known as jamielennox | 08:02 | |
| *** pcaruana has joined #openstack-keystone | 08:05 | |
| *** subscope has joined #openstack-keystone | 08:07 | |
| *** raildo is now known as raildo-afk | 08:08 | |
| *** subscope has quit IRC | 08:17 | |
| *** vivekd_ has joined #openstack-keystone | 08:26 | |
| *** subscope has joined #openstack-keystone | 08:26 | |
| *** vivekd has quit IRC | 08:28 | |
| *** vivekd_ is now known as vivekd | 08:28 | |
| *** martinus___ has joined #openstack-keystone | 08:29 | |
| *** jistr has joined #openstack-keystone | 08:37 | |
| *** fpatwa has joined #openstack-keystone | 08:38 | |
| *** subscope has quit IRC | 08:40 | |
| *** tomoiaga has quit IRC | 08:40 | |
| *** fpatwa has quit IRC | 08:42 | |
| *** tomoiaga has joined #openstack-keystone | 08:48 | |
| *** fhubik has joined #openstack-keystone | 08:57 | |
| *** subscope has joined #openstack-keystone | 09:00 | |
| *** rvba has quit IRC | 09:03 | |
| *** davechen has left #openstack-keystone | 09:05 | |
| *** spring_ is now known as davechen_afk | 09:06 | |
| *** markvoelker has joined #openstack-keystone | 09:12 | |
| *** henrynash has joined #openstack-keystone | 09:15 | |
| *** ChanServ sets mode: +v henrynash | 09:15 | |
| *** markvoelker has quit IRC | 09:16 | |
| *** rvba has joined #openstack-keystone | 09:22 | |
| *** rvba has quit IRC | 09:23 | |
| *** rvba has joined #openstack-keystone | 09:23 | |
| *** subscope has quit IRC | 09:25 | |
| *** subscope has joined #openstack-keystone | 09:29 | |
| *** fhubik has quit IRC | 09:30 | |
| *** fhubik has joined #openstack-keystone | 09:31 | |
| *** fhubik is now known as fhubik_brb | 09:32 | |
| *** mvk has joined #openstack-keystone | 09:38 | |
| *** wanghua has quit IRC | 09:54 | |
| *** fhubik_brb is now known as fhubik | 09:54 | |
| *** daemontool has joined #openstack-keystone | 10:01 | |
| samueldmq | morning keystoners | 10:01 |
| samueldmq | henrynash: hello, let me know when you have a momento to discuss 243585 | 10:01 |
| henrynash | samuedlmq: hi | 10:02 |
| samueldmq | henrynash: I saw your latest comments there | 10:02 |
| henrynash | samueldmq: ok | 10:02 |
| samueldmq | henrynash: are you okay with checking the policy for each project in the tree? | 10:03 |
| henrynash | samueldmq: I’m not sure having a role on ecery project givens them any more or less right to be able to modify it | 10:03 |
| samueldmq | henrynash: I think that's correct, since what we provide is a shortcut for not doing them separately | 10:03 |
| henrynash | samueldmq: so an “observer” has more rights to edit than someone who has no role? | 10:04 |
| henrynash | samuedlmq: I don’t see why that should be so | 10:04 |
| samueldmq | henrynash: if he has observer on every project | 10:04 |
| samueldmq | henrynash: AND observer is allowed to PATCH a proejct | 10:05 |
| samueldmq | henrynash: it hsould be able to do it, but I don't think observer will be able to update a project | 10:05 |
| henrynash | samueldmq: and the PATCH policy endpoint is the same for cascase and not cascade? | 10:05 |
| samueldmq | henrynash: yes | 10:06 |
| *** chlong_ has joined #openstack-keystone | 10:06 | |
| henrynash | samueldmq: did we consider what we have done for other “tree operations” and have a separate policy endpoint for the regular vs tree-version of the API? | 10:07 |
| samueldmq | henrynash: if you see it as a shortcut for not doing each update separately, that makes sense ? | 10:07 |
| samueldmq | henrynash: okay, what are the other operations? | 10:07 |
| samueldmq | (an example) | 10:07 |
| henrynash | samueldmq: list tree assignment | 10:07 |
| samueldmq | henrynash: list_role_assignments? | 10:08 |
| henrynash | samueldmq: yes, so you can pass it ?include_sub_tree and it then returns all the assignments for the subtree below the project specified | 10:09 |
| samueldmq | henrynash: hmm, I see list_role_assignments_for_tree in the policy | 10:09 |
| henrynash | samueldmq: yep | 10:10 |
| henrynash | sameldmq: like to be a specifially granted role maybe and/or require a domain scoped token perhaps | 10:10 |
| henrynash | samueldmq: we don’t know, it’s up to how the deployer (or domain admin) wants to allow such an operation | 10:11 |
| samueldmq | henrynash: if we allowed tree checks in the policy somehow life would be easier | 10:11 |
| samueldmq | henrynash: but they can do that today | 10:12 |
| samueldmq | henrynash: if you do identity:update_project: domain_id:%(target.domain_id)s | 10:13 |
| samueldmq | henrynash: that rule would pass for every project in the tree, as they have the same domain_id | 10:13 |
| henrynash | samueldmq: maybe…although I have a feeling that tree-operations will always be considered something special | 10:13 |
| henrynash | samueldmq: either that, we we need to basically re-issuse the actual policy check for each node | 10:15 |
| samueldmq | henrynash: I think checking policy for every node in the tree mkes it more secure | 10:15 |
| samueldmq | henrynash: but notice that update/delete are write operations in the tree | 10:15 |
| henrynash | samueldmq: are you actually doing that…or just checking they have a role on each node? | 10:15 |
| samueldmq | henrynash: while list assignments is a read-only | 10:15 |
| *** EinstCrazy has quit IRC | 10:16 | |
| samueldmq | henrynash: I am pretty sure we check the policy, let me recheck | 10:17 |
| henrynash | samueldmq: no…we are just looking to see if the user has any role on each project in the tree | 10:18 |
| samueldmq | henrynash: yes 'The policy rule might want to inspect if the user have access for every project in the subtree.' | 10:18 |
| henrynash | samueldmq: ah, you are right…OK, so that’s much better…sorry missed that bit | 10:19 |
| samueldmq | henrynash: if it was only checking any role assignments in the node | 10:20 |
| samueldmq | that was pretty bad, I agree | 10:20 |
| samueldmq | henrynash: so I'd expand the comment in the test to say it needs an ADMIN inherited role assginment, because that will make every nodepass against policy | 10:21 |
| henrynash | samueldmq: yes, likelythat inherited roles will be the ones to use here…. | 10:21 |
| samueldmq | henrynash: let me do it right now (add that comment) | 10:22 |
| samueldmq | henrynash: yes they will | 10:22 |
| samueldmq | henrynash: and perhaps your second point about using a wrapper in that controller, as we did for dommain role assingments | 10:22 |
| henrynash | samueldmq: the other thing is that I’d liek us not to call @filterproetcted and @protected | 10:22 |
| samueldmq | henrynash: maybe addressed in a followup | 10:22 |
| samueldmq | henrynash: perhaps we could extract the logic from the annotation in a method that can also be called separately? | 10:23 |
| samueldmq | henrynash: in addition to the annotation itself | 10:23 |
| henrynash | samueldmq: I think we’re only useing filterprotected to extract the ‘cascade’ bit so we know whether to to that logic or nor…. | 10:25 |
| samueldmq | henrynash: yes | 10:25 |
| samueldmq | henrynash: so that can definitely be refactored to be done as you did in domain roles with wrappers | 10:25 |
| henrynash | ok | 10:26 |
| samueldmq | henrynash: I will leave a todo there | 10:26 |
| samueldmq | henrynash: maybe as a followup? | 10:26 |
| samueldmq | henrynash: okay I will add a TODO and expand the comments in the tests for now | 10:26 |
| henrynash | samueldmq: just trying to think through whether there is any negative consquence of teh filter and protected version….and whether we need to change it now, before the patch goes in | 10:27 |
| samueldmq | henrynash: I will update it now | 10:27 |
| henrynash | samueldmq: ok…I’ll check back in a while…and am now happy with the principle of what we are doing…maybe add doc string or something to the check_proetction method making it clear what the algorithim is | 10:29 |
| samueldmq | henrynash: ++ will do in bit | 10:31 |
| henrynash | samueldmq: I still wonder if _check_user_has_access_to_subtree() is needed….maybe the policy rule might want to not require a cascade operation to have a role on each proejct…but that certainly fits more with our previous techniques | 10:32 |
| *** henrynash has quit IRC | 10:33 | |
| *** fpatwa has joined #openstack-keystone | 10:39 | |
| *** lhcheng has quit IRC | 10:40 | |
| *** fpatwa has quit IRC | 10:43 | |
| *** ChengKun has quit IRC | 10:56 | |
| *** subscope has quit IRC | 10:57 | |
| *** markvoelker has joined #openstack-keystone | 11:12 | |
| *** markvoelker has quit IRC | 11:17 | |
| *** subscope has joined #openstack-keystone | 11:30 | |
| *** henrynash has joined #openstack-keystone | 11:32 | |
| *** ChanServ sets mode: +v henrynash | 11:32 | |
| *** martinus___ has quit IRC | 11:34 | |
| *** mgagne has quit IRC | 11:39 | |
| *** andrewbogott has quit IRC | 11:39 | |
| *** sigmavirus24_awa has quit IRC | 11:39 | |
| *** wasmum has quit IRC | 11:39 | |
| *** errr has quit IRC | 11:40 | |
| *** ryanpetrello has quit IRC | 11:40 | |
| *** BlackDex has quit IRC | 11:40 | |
| *** raorn has quit IRC | 11:40 | |
| *** eglute has quit IRC | 11:40 | |
| *** zigo has quit IRC | 11:40 | |
| *** mhu has quit IRC | 11:40 | |
| *** d34dh0r53 has quit IRC | 11:40 | |
| *** dhellmann has quit IRC | 11:41 | |
| *** zigo has joined #openstack-keystone | 11:41 | |
| *** DuncanT has quit IRC | 11:41 | |
| *** raorn has joined #openstack-keystone | 11:42 | |
| *** DuncanT has joined #openstack-keystone | 11:42 | |
| *** BlackDex has joined #openstack-keystone | 11:42 | |
| *** andrewbogott has joined #openstack-keystone | 11:43 | |
| *** subscope has quit IRC | 11:45 | |
| *** eglute has joined #openstack-keystone | 11:45 | |
| *** subscope has joined #openstack-keystone | 11:45 | |
| *** mgagne has joined #openstack-keystone | 11:45 | |
| *** ryanpetrello has joined #openstack-keystone | 11:46 | |
| *** mhu has joined #openstack-keystone | 11:46 | |
| *** mgagne is now known as Guest51435 | 11:46 | |
| *** wasmum has joined #openstack-keystone | 11:46 | |
| *** dhellmann has joined #openstack-keystone | 11:46 | |
| *** sigmavirus24_awa has joined #openstack-keystone | 11:46 | |
| *** d34dh0r53 has joined #openstack-keystone | 11:46 | |
| *** links has quit IRC | 11:53 | |
| *** fpatwa has joined #openstack-keystone | 11:53 | |
| *** errr has joined #openstack-keystone | 11:54 | |
| *** rodrigods has quit IRC | 11:57 | |
| *** rodrigods has joined #openstack-keystone | 11:57 | |
| *** fpatwa has quit IRC | 12:00 | |
| *** links has joined #openstack-keystone | 12:07 | |
| *** henrynash has quit IRC | 12:09 | |
| *** chlong_ has quit IRC | 12:17 | |
| *** raildo-afk is now known as raildo | 12:19 | |
| *** fhubik is now known as fhubik_brb | 12:20 | |
| *** fhubik_brb is now known as fhubik | 12:20 | |
| *** fhubik is now known as fhubik_brb | 12:25 | |
| *** fhubik_brb is now known as fhubik | 12:25 | |
| *** lhcheng has joined #openstack-keystone | 12:28 | |
| *** ChanServ sets mode: +v lhcheng | 12:28 | |
| *** lhcheng has quit IRC | 12:33 | |
| *** henrynash has joined #openstack-keystone | 12:38 | |
| *** ChanServ sets mode: +v henrynash | 12:38 | |
| *** Nirupama has left #openstack-keystone | 12:39 | |
| *** fhubik is now known as fhubik_brb | 12:39 | |
| *** raildo is now known as raildo-afk | 12:40 | |
| samueldmq | henrynash: | 12:41 |
| samueldmq | henrynash: so, if I don't use @filterprotected, we will need to call chack_protection explicitely | 12:42 |
| samueldmq | check* | 12:42 |
| samueldmq | henrynash: which means we will need to create the internal protection_info param, which is bizarre | 12:43 |
| *** markvoelker has joined #openstack-keystone | 12:43 | |
| henrynash | samueldmq: let me take a quick look….. | 12:45 |
| *** raildo-afk is now known as raildo | 12:46 | |
| samueldmq | henrynash: sure | 12:46 |
| samueldmq | henrynash: an alternative I was thinking was: 1) we check the cascade in a wrapper (similar to in domain roles) | 12:46 |
| samueldmq | henrynash: 2) 2 different methods called by the wrapper (also as in domain roles), but they have diffrent wrappers | 12:47 |
| samueldmq | @protected and @tree_protected | 12:47 |
| *** markvoelker has quit IRC | 12:47 | |
| samueldmq | but that would require them to receive a method name, as they will both point to the same 'update_project' policy entry | 12:48 |
| *** jaosorior has quit IRC | 12:49 | |
| henrynash | samueldmq: hmm, have to think abou this…sorry, I’m actually off sick today, so not sure my brain is firing on all cylnders!] | 12:49 |
| *** jaosorior has joined #openstack-keystone | 12:50 | |
| samueldmq | henrynash: that's okay, you may look once you're better :) | 12:50 |
| *** jaosorior has quit IRC | 12:50 | |
| *** henrynash has quit IRC | 12:50 | |
| *** jaosorior has joined #openstack-keystone | 12:51 | |
| *** gordc has joined #openstack-keystone | 12:54 | |
| *** iurygregory has joined #openstack-keystone | 12:55 | |
| *** clenimar has joined #openstack-keystone | 12:56 | |
| *** pauloewerton has joined #openstack-keystone | 13:02 | |
| *** links has quit IRC | 13:08 | |
| *** vivekd has quit IRC | 13:16 | |
| *** martinus___ has joined #openstack-keystone | 13:17 | |
| openstackgerrit | David Stanek proposed openstack/keystoneauth: Adds a TOTP authentication method https://review.openstack.org/283076 | 13:17 |
| *** links has joined #openstack-keystone | 13:22 | |
| *** fhubik_brb is now known as fhubik | 13:25 | |
| *** jdennis has joined #openstack-keystone | 13:27 | |
| openstackgerrit | Chaozhe Chen(ccz) proposed openstack/keystone: Deprecate logger.WritableLogger https://review.openstack.org/283078 | 13:28 |
| *** markvoelker has joined #openstack-keystone | 13:29 | |
| *** edmondsw has joined #openstack-keystone | 13:35 | |
| *** esp has joined #openstack-keystone | 13:50 | |
| *** links has quit IRC | 13:50 | |
| *** rk4n has joined #openstack-keystone | 13:53 | |
| *** jsavak has joined #openstack-keystone | 13:55 | |
| *** andrewbogott has quit IRC | 13:55 | |
| *** andrewbogott has joined #openstack-keystone | 13:55 | |
| *** subscope has quit IRC | 13:56 | |
| *** petertr7_away is now known as petertr7 | 13:58 | |
| *** annasort has joined #openstack-keystone | 13:58 | |
| *** esp has quit IRC | 13:58 | |
| *** richm has joined #openstack-keystone | 14:02 | |
| *** ninag has joined #openstack-keystone | 14:05 | |
| *** chlong_ has joined #openstack-keystone | 14:06 | |
| *** jistr has quit IRC | 14:06 | |
| *** jistr has joined #openstack-keystone | 14:07 | |
| *** subscope has joined #openstack-keystone | 14:09 | |
| *** vivekd has joined #openstack-keystone | 14:10 | |
| *** dave-mccowan has joined #openstack-keystone | 14:14 | |
| *** openstackgerrit has quit IRC | 14:17 | |
| *** openstackgerrit has joined #openstack-keystone | 14:17 | |
| *** sdake has joined #openstack-keystone | 14:21 | |
| *** raildo is now known as raildo-afk | 14:26 | |
| *** bdossant has joined #openstack-keystone | 14:28 | |
| *** raildo-afk is now known as raildo | 14:29 | |
| *** superdan is now known as dansmith | 14:30 | |
| *** shoutm has quit IRC | 14:37 | |
| *** doug-fish has joined #openstack-keystone | 14:39 | |
| *** belmoreira has quit IRC | 14:40 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone-specs: Fix cascade operations documentation https://review.openstack.org/274836 | 14:43 |
| *** bdossant has quit IRC | 14:43 | |
| *** bdossant_ has joined #openstack-keystone | 14:44 | |
| *** su_zhang has joined #openstack-keystone | 14:45 | |
| *** josecastroleon has quit IRC | 14:46 | |
| *** rderose has joined #openstack-keystone | 14:47 | |
| *** roxanaghe has joined #openstack-keystone | 14:48 | |
| *** bdossant_ has quit IRC | 14:52 | |
| *** vivekd has quit IRC | 14:57 | |
| *** bdossant has joined #openstack-keystone | 14:58 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:59 | |
| *** diazjf has joined #openstack-keystone | 14:59 | |
| *** slberger has joined #openstack-keystone | 15:00 | |
| *** vivekd has joined #openstack-keystone | 15:11 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 15:14 |
| *** diazjf1 has joined #openstack-keystone | 15:18 | |
| *** ayoung has joined #openstack-keystone | 15:19 | |
| *** ChanServ sets mode: +v ayoung | 15:19 | |
| *** diazjf has quit IRC | 15:21 | |
| *** timcline_ has joined #openstack-keystone | 15:23 | |
| *** bdossant has quit IRC | 15:23 | |
| *** phalmos has joined #openstack-keystone | 15:24 | |
| *** bdossant has joined #openstack-keystone | 15:27 | |
| *** jorge_munoz has joined #openstack-keystone | 15:32 | |
| *** woodster_ has joined #openstack-keystone | 15:34 | |
| *** tomoiaga has quit IRC | 15:42 | |
| *** jaugustine has joined #openstack-keystone | 15:48 | |
| *** roxanaghe has quit IRC | 15:49 | |
| *** Gage has joined #openstack-keystone | 15:49 | |
| *** Gage has quit IRC | 15:50 | |
| *** nkinder has joined #openstack-keystone | 15:50 | |
| *** phalmos_ has joined #openstack-keystone | 15:52 | |
| *** phalmos has quit IRC | 15:55 | |
| *** jsavak has quit IRC | 16:03 | |
| marekd | rderose: hi, i just submited a comment on your federated users patch. | 16:03 |
| *** jsavak has joined #openstack-keystone | 16:04 | |
| marekd | rderose: let me know if you see my point | 16:04 |
| rderose | marekd okay, working on that now | 16:04 |
| marekd | rderose: thanks. | 16:05 |
| *** belmoreira has joined #openstack-keystone | 16:07 | |
| *** vivekd has quit IRC | 16:08 | |
| rderose | marekd, agree with your comment regarding not creating a foreign key relationship with federation_protocol | 16:10 |
| *** Oku_OS has joined #openstack-keystone | 16:10 | |
| rderose | marekd regarding adding protocol_id to the unqiue constraint (currently idp_id and unqiue_id), I'm still not getting it. if your coming in from an IDP one time using SAML and another time using OpenID, it's still the same federated user. | 16:11 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fix/refactor policy check for cascade operations https://review.openstack.org/283145 | 16:11 |
| rderose | marekd, the scenario you commented on is covered by the unique constraint of idp_id and unique_id, right? | 16:12 |
| marekd | which scenario? | 16:13 |
| rderose | marekd "Ron: If you are using same e-mail address in two trusted IdPs you may end up with unique_id equal to same email address. But coming from more than one IdP means there are two users." | 16:14 |
| marekd | unique_id would be an attribute coming from the IdP, right? | 16:14 |
| rderose | right | 16:14 |
| marekd | so, you cannot simply put this value in the user_id in token. | 16:15 |
| rderose | no, will map this user to a local user (shadow federated user) and user_id will be a local user id | 16:16 |
| marekd | rderose: is there any code that does that mapping so far? | 16:17 |
| marekd | so I could look and try to understand | 16:17 |
| *** browne has joined #openstack-keystone | 16:17 | |
| *** jsavak has quit IRC | 16:19 | |
| rderose | marekd only my current patch, take a look at keystone/identity/core.py ln 1213 and follow down to keystone/identity/shadow_backends/sql.py | 16:19 |
| rderose | marekd, but working on this now, so will submit another patch soon | 16:19 |
| marekd | rderose: i will | 16:20 |
| *** jsavak has joined #openstack-keystone | 16:20 | |
| marekd | let's sync later on (or tomorrow) | 16:20 |
| rderose | marekd, cool | 16:20 |
| marekd | because i might be missing some things :-) | 16:20 |
| marekd | and then I would need your guidance :-) | 16:20 |
| rderose | marekd you and me both :) | 16:20 |
| marekd | rderose: we'll figure something out! | 16:21 |
| rderose | marekd: yeah, hopefully :) | 16:22 |
| *** vivekd has joined #openstack-keystone | 16:22 | |
| *** mvk has quit IRC | 16:22 | |
| *** pushkaru has joined #openstack-keystone | 16:22 | |
| *** bdossant has quit IRC | 16:26 | |
| *** belmoreira has quit IRC | 16:26 | |
| *** vivekd_ has joined #openstack-keystone | 16:27 | |
| *** pcaruana has quit IRC | 16:27 | |
| *** ericksonsantos has joined #openstack-keystone | 16:29 | |
| *** josecastroleon has joined #openstack-keystone | 16:29 | |
| *** vivekd has quit IRC | 16:29 | |
| *** vivekd_ is now known as vivekd | 16:29 | |
| *** jsavak has quit IRC | 16:31 | |
| *** jsavak has joined #openstack-keystone | 16:31 | |
| *** wolsen has quit IRC | 16:34 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 16:36 |
| *** wolsen has joined #openstack-keystone | 16:42 | |
| *** martinus___ has quit IRC | 16:42 | |
| *** gyee has joined #openstack-keystone | 16:45 | |
| *** ChanServ sets mode: +v gyee | 16:45 | |
| *** fhubik is now known as fhubik_brb | 16:53 | |
| *** daemontool has quit IRC | 16:53 | |
| *** fhubik_brb is now known as fhubik | 16:57 | |
| *** rderose has quit IRC | 16:58 | |
| *** josecastroleon has quit IRC | 16:59 | |
| bknudson_ | I guess patchbot is no more. | 17:01 |
| *** browne has quit IRC | 17:02 | |
| *** rderose has joined #openstack-keystone | 17:02 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: API support for project cascade delete https://review.openstack.org/244248 | 17:06 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fix/refactor policy check for cascade operations https://review.openstack.org/283145 | 17:06 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: API support for project cascade update https://review.openstack.org/243585 | 17:06 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Expose bug in cascade policy enforcement https://review.openstack.org/283168 | 17:06 |
| samueldmq | stevemar: htruta: raildo: change 283145 should address Henry Nash's concerns on the update/delete cascade patches | 17:07 |
| samueldmq | I've added it as a followup | 17:07 |
| samueldmq | however I've found a bug, and it's exposed via patch 283168 | 17:07 |
| patchbot | samueldmq: https://review.openstack.org/#/c/283168/ - keystone - Expose bug in cascade policy enforcement | 17:07 |
| samueldmq | so I am -1'ing them | 17:07 |
| *** daemontool has joined #openstack-keystone | 17:08 | |
| raildo | samueldmq: I just didn't understand why we are exposing a bug in a code that wasn't merged yet. why not just fix it in the patch? | 17:09 |
| *** dan_nguyen has joined #openstack-keystone | 17:09 | |
| samueldmq | raildo: because I don't know how to fix it now, and I have already put a ton of effort fixing henrynash's comments | 17:10 |
| samueldmq | raildo: also the tests are already done, making the life much easier for the authr | 17:11 |
| samueldmq | raildo: I don't want the patch exposing the bug to be merged | 17:12 |
| samueldmq | raildo: I want that to serve as guidance to the author to fix it in the proposed code | 17:12 |
| *** mylu has joined #openstack-keystone | 17:12 | |
| samueldmq | raildo: makes sense? | 17:13 |
| raildo | samueldmq: got it, I'll work to fix this issue before we have the code merged.. btw I'll push your cascade wrapper to inside the update cascade and reuse on the delete | 17:16 |
| *** rderose has quit IRC | 17:16 | |
| *** rderose has joined #openstack-keystone | 17:16 | |
| samueldmq | raildo: perfect, also pull the tests exposing the bugs | 17:17 |
| samueldmq | raildo: they should all be together in the 2 proposed patches | 17:18 |
| raildo | samueldmq: ++ | 17:18 |
| *** fawadkhaliq has joined #openstack-keystone | 17:18 | |
| morgan | bknudson_: i still see patchbot | 17:19 |
| morgan | patch 283168 | 17:19 |
| patchbot | morgan: https://review.openstack.org/#/c/283168/ - keystone - Expose bug in cascade policy enforcement | 17:19 |
| morgan | bknudson_: ^ see | 17:19 |
| *** fawadkhaliq has quit IRC | 17:19 | |
| bknudson_ | oh, notmyname said it was disabled | 17:19 |
| morgan | was that requested? | 17:20 |
| * morgan still thinks it's useful. | 17:20 | |
| morgan | it doesn't respond to the openstackgerrit account for sure. | 17:20 |
| bknudson_ | morgan: http://git.openstack.org/cgit/openstack/keystone/tree/.testr.conf#n10 | 17:20 |
| bknudson_ | oops | 17:20 |
| bknudson_ | (10:59:55 AM) notmyname: bknudson_: FYI, I was asked to remove patchbot from community channels since -infra doesn't run it | 17:21 |
| morgan | bknudson_: /me rolls eyes | 17:21 |
| morgan | now we can't have 3rd party run bots in our channels. | 17:21 |
| * morgan shrugs. | 17:23 | |
| morgan | whatever. | 17:23 |
| *** morgan sets mode: -o morgan | 17:24 | |
| morgan | anyway. | 17:25 |
| dhellmann | stevemar, morgan : I'm having some trouble making a change to oslo.config, because of http://git.openstack.org/cgit/openstack/keystoneauth/tree/keystoneauth1/loading/opts.py being used and not complying with the new api change (there's an attribute missing). Do you have a few minutes to go over the history there? | 17:26 |
| rderose | dolphm Regarding the constraint for the federated_user table (idp_id, protocol_id, unique_id), why include the protocol_id? It's the same user regardless of how they came in, right? What's your thinking here? | 17:28 |
| morgan | dhellmann: happy to rush a fix through | 17:29 |
| morgan | dhellmann: fwiw | 17:29 |
| *** jsavak has quit IRC | 17:29 | |
| morgan | dhellmann: but basically ksa cannot have oslo_config as a dep | 17:29 |
| dhellmann | morgan : I'm going to have to work around the situation regardless. The question I have is why not? | 17:29 |
| *** jsavak has joined #openstack-keystone | 17:29 | |
| morgan | dhellmann: since we are lining up for inclusion in swift and swiftclient | 17:29 |
| morgan | dhellmann: among other "general" non-openstack cases. | 17:30 |
| *** jasonsb has quit IRC | 17:30 | |
| *** fhubik has quit IRC | 17:30 | |
| *** daemontool has quit IRC | 17:33 | |
| dhellmann | morgan : the issue I'm having is in neutron generating its sample config. I don't know yet why it's returning the wrong class there. http://logs.openstack.org/35/282435/5/check/gate-tempest-dsvm-neutron-src-oslo.config/77044c6/logs/devstacklog.txt.gz | 17:36 |
| morgan | dhellmann: weird | 17:37 |
| *** josecastroleon has joined #openstack-keystone | 17:38 | |
| *** spandhe has joined #openstack-keystone | 17:39 | |
| *** su_zhang has quit IRC | 17:40 | |
| *** su_zhang has joined #openstack-keystone | 17:41 | |
| *** petertr7 is now known as petertr7_away | 17:41 | |
| *** fawadkhaliq has joined #openstack-keystone | 17:42 | |
| *** su_zhang has quit IRC | 17:44 | |
| *** rderose has quit IRC | 17:45 | |
| *** timcline_ has quit IRC | 17:46 | |
| *** subscope has quit IRC | 17:47 | |
| morgan | dhellmann: so, i'm happy to push through any fix really needed [honestly, KSA should be doing an explicit convert to an oslo opt, but... eh that ship may have sailed] | 17:49 |
| *** jsavak has quit IRC | 17:49 | |
| morgan | dhellmann: little distracted today, so writing the code may not happen until later today/tomorrow if you need me to step in for that bit, but pushing a change through is easy if you have a fix. | 17:49 |
| dhellmann | morgan: https://bugs.launchpad.net/keystoneauth/+bug/1548433 | 17:50 |
| openstack | Launchpad bug 1548433 in neutron "neutron returns objects other than oslo_config.cfg.Opt instances from list_opts" [Undecided,New] | 17:50 |
| morgan | dhellmann: /me nods. | 17:51 |
| *** fawadkhaliq has quit IRC | 17:51 | |
| morgan | it's like i said, likely just a missed ._to_oslo_opt call, we have that kind of thing | 17:51 |
| *** mylu has quit IRC | 17:54 | |
| *** jistr has quit IRC | 17:55 | |
| *** Guest45731 is now known as tsymanczyk | 17:56 | |
| *** jsavak has joined #openstack-keystone | 17:57 | |
| stevemar | morgan: thanks for answering dhellmann's question -- yes, there is a _to_oslo_opt call that might have been missed, let me poke aroun | 18:01 |
| stevemar | d | 18:01 |
| dhellmann | stevemar : take a look at the neutron code linked from the bug report | 18:02 |
| openstackgerrit | Merged openstack/keystone: Tidy up configuration documentation for inherited assignments https://review.openstack.org/280747 | 18:05 |
| *** browne has joined #openstack-keystone | 18:07 | |
| *** josecastroleon has quit IRC | 18:10 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/283197 | 18:13 |
| *** mylu has joined #openstack-keystone | 18:13 | |
| *** timcline_ has joined #openstack-keystone | 18:15 | |
| *** su_zhang has joined #openstack-keystone | 18:16 | |
| *** rderose has joined #openstack-keystone | 18:19 | |
| *** Ephur has joined #openstack-keystone | 18:20 | |
| *** josecastroleon has joined #openstack-keystone | 18:23 | |
| *** mylu has quit IRC | 18:24 | |
| *** petertr7_away is now known as petertr7 | 18:24 | |
| *** david-lyle_ has quit IRC | 18:34 | |
| dolphm | rderose: sorry, stepped away unexpectedly. we can't say for sure that a user exposed to keystone from the same idp ID using two different protocols (which could be mapped different) are necessarily the same user. further, we treat them as distinct users today, and we shouldn't change that assumption with this patch. finally, if they are the same user, then we can link them back together in newton with account linking. | 18:40 |
| morgan | stevemar: email sent. | 18:40 |
| morgan | dolphm: ++ | 18:41 |
| *** ChanServ sets mode: +v morgan | 18:41 | |
| *** ChanServ sets mode: +v morgan | 18:41 | |
| *** ChanServ sets mode: +v morgan | 18:42 | |
| rderose | dolpm: reading... | 18:45 |
| rderose | * dolphm | 18:45 |
| rderose | dolphm: okay, I'll treat them as separate users then and add the constraint | 18:46 |
| rderose | dolphm: Regarding the foreign key relationship from federated_user to the federation_protocol table, the federation_protocol table has the following columns: id, idp_id, and mapping_id. | 18:47 |
| rderose | dolphm: I'm not clear how the mapping_id is being used. And if the idp_id is in this table, then I wouldn't needed it in the federated_user table. But to be honest, I think I'd simply rather not create a relationship to this table if I don't have to. | 18:47 |
| *** josecastroleon has quit IRC | 18:52 | |
| dolphm | rderose: it determines which mapping is applied to the SAML payload, and thus how the user is identified by the idp + protocol + mapping | 18:53 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add tests for fetching the revocation list https://review.openstack.org/271071 | 18:55 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Parameter to return audit ids only in revocation list https://review.openstack.org/260153 | 18:55 |
| *** vivekd has quit IRC | 18:56 | |
| rderose | dolphm: hmm... okay, so do you still feel like we need a foreign key relationship to this table? if so, then I don't think I need the idp_id in the federated_user table since it is in the federation_protocol table | 18:57 |
| *** sdake has quit IRC | 18:58 | |
| dolphm | rderose: remind me what the schema of the federation protocl table is? | 18:58 |
| dolphm | link? | 18:58 |
| rderose | id, idp_id, mapping_id | 18:59 |
| rderose | * dolphm: | 18:59 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Fix trust chain tests https://review.openstack.org/278163 | 19:00 |
| dolphm | rderose: what's the PK in that table? just id? | 19:01 |
| rderose | yeah, just id | 19:01 |
| *** jsavak has quit IRC | 19:02 | |
| dolphm | stevemar: can you not have two federation endpoints using "saml2" as their protocol ID? | 19:02 |
| *** sdake has joined #openstack-keystone | 19:03 | |
| *** subscope has joined #openstack-keystone | 19:04 | |
| *** jsavak has joined #openstack-keystone | 19:04 | |
| rderose | dolphm: sorry, don't know how I missed this but PK is id and idp_id | 19:05 |
| *** josecastroleon has joined #openstack-keystone | 19:10 | |
| rderose | dolphm: okay, so does a composite foreignkey relationship make sense then? | 19:11 |
| *** vivekd has joined #openstack-keystone | 19:11 | |
| rderose | dolphm: federated_user (protocol_id, idp_id) -> federation_protocol (id, idp_id) | 19:11 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Switch to configless bandit https://review.openstack.org/278136 | 19:13 |
| *** mylu has joined #openstack-keystone | 19:13 | |
| *** vgridnev has joined #openstack-keystone | 19:13 | |
| openstackgerrit | Brant Knudson proposed openstack/oslo.policy: Support policy file in YAML https://review.openstack.org/278513 | 19:17 |
| openstackgerrit | Brant Knudson proposed openstack/oslo.policy: Deprecate load_json() in favor of load() https://review.openstack.org/280373 | 19:17 |
| openstackgerrit | Brant Knudson proposed openstack/oslo.policy: Change default behavior for YAML https://review.openstack.org/280384 | 19:17 |
| *** vivekd_ has joined #openstack-keystone | 19:19 | |
| *** su_zhang has quit IRC | 19:19 | |
| *** su_zhang has joined #openstack-keystone | 19:19 | |
| *** vivekd has quit IRC | 19:20 | |
| *** vivekd_ is now known as vivekd | 19:21 | |
| *** su_zhang has quit IRC | 19:21 | |
| *** su_zhang has joined #openstack-keystone | 19:21 | |
| dolphm | rderose: that would work | 19:21 |
| dolphm | rderose: that way you know the mapping as well, even though that field is mutable | 19:22 |
| rderose | dolphm: sounds good | 19:22 |
| rderose | dolphm stevemar do you know when the federation_protocol get's populated? does it happen when the operator configures the IdP for federation | 19:23 |
| dolphm | rderose: yes | 19:23 |
| rderose | dolphm: cool | 19:23 |
| rderose | dolphm: one last question :) I'm thinking about renaming UserType.EPHEMERAL to UserType.FEDERATED? My thought is that since federated users are linked to a local user, they are not really ephemeral any more. Does this change make sense to you? | 19:24 |
| dolphm | rderose: ++ | 19:25 |
| *** ninag has quit IRC | 19:27 | |
| *** ninag has joined #openstack-keystone | 19:28 | |
| *** ninag_ has joined #openstack-keystone | 19:29 | |
| *** ninag_ has quit IRC | 19:29 | |
| *** ninag_ has joined #openstack-keystone | 19:29 | |
| *** mvk has joined #openstack-keystone | 19:29 | |
| *** neophy has joined #openstack-keystone | 19:30 | |
| *** jsavak has quit IRC | 19:32 | |
| *** ninag has quit IRC | 19:32 | |
| *** jsavak has joined #openstack-keystone | 19:33 | |
| *** ninag_ has quit IRC | 19:34 | |
| *** ninag has joined #openstack-keystone | 19:34 | |
| *** ninag has quit IRC | 19:39 | |
| *** josecastroleon has quit IRC | 19:39 | |
| *** sdake_ has joined #openstack-keystone | 19:49 | |
| *** e0ne has joined #openstack-keystone | 19:50 | |
| *** jaugustine has quit IRC | 19:50 | |
| *** sdake has quit IRC | 19:50 | |
| *** vivekd_ has joined #openstack-keystone | 19:51 | |
| *** vivekd has quit IRC | 19:53 | |
| *** vivekd_ is now known as vivekd | 19:54 | |
| *** jsavak has quit IRC | 19:54 | |
| *** jsavak has joined #openstack-keystone | 19:55 | |
| *** mylu has quit IRC | 19:58 | |
| *** maxabidi has joined #openstack-keystone | 19:59 | |
| *** mylu has joined #openstack-keystone | 20:01 | |
| *** vivekd__ has joined #openstack-keystone | 20:04 | |
| *** belmoreira has joined #openstack-keystone | 20:05 | |
| *** vivekd has quit IRC | 20:06 | |
| *** vivekd__ is now known as vivekd | 20:06 | |
| *** vivekd__ has joined #openstack-keystone | 20:07 | |
| *** fpatwa has joined #openstack-keystone | 20:07 | |
| *** su_zhang has quit IRC | 20:08 | |
| *** su_zhang has joined #openstack-keystone | 20:09 | |
| *** vivekd_ has joined #openstack-keystone | 20:09 | |
| *** vivekd has quit IRC | 20:11 | |
| *** vivekd_ is now known as vivekd | 20:11 | |
| *** vivekd__ has quit IRC | 20:12 | |
| *** su_zhang has quit IRC | 20:13 | |
| *** e0ne has quit IRC | 20:16 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove migration_helpers.get_default_domain https://review.openstack.org/282049 | 20:18 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: db_sync doesn't create default domain https://review.openstack.org/282042 | 20:18 |
| *** vivekd has quit IRC | 20:18 | |
| *** mylu has quit IRC | 20:18 | |
| *** belmoreira has quit IRC | 20:20 | |
| *** dstanek has quit IRC | 20:20 | |
| *** lbragstad_ has quit IRC | 20:20 | |
| *** ngupta has quit IRC | 20:20 | |
| *** patchbot has quit IRC | 20:20 | |
| *** mnaser has quit IRC | 20:20 | |
| *** SpamapS has quit IRC | 20:20 | |
| *** _fortis has quit IRC | 20:20 | |
| *** topol has quit IRC | 20:20 | |
| *** davechen_afk has quit IRC | 20:20 | |
| *** sileht has quit IRC | 20:20 | |
| *** Guest40848 has quit IRC | 20:20 | |
| *** Daviey has quit IRC | 20:20 | |
| *** dulek has quit IRC | 20:20 | |
| *** opilotte- has quit IRC | 20:20 | |
| *** ekarlso has quit IRC | 20:20 | |
| *** akscram has quit IRC | 20:20 | |
| *** bknudson_ has quit IRC | 20:20 | |
| *** amakarov_away has quit IRC | 20:20 | |
| *** dulek has joined #openstack-keystone | 20:20 | |
| *** bknudson has joined #openstack-keystone | 20:20 | |
| *** ChanServ sets mode: +v bknudson | 20:20 | |
| *** opilotte- has joined #openstack-keystone | 20:20 | |
| *** Daviey has joined #openstack-keystone | 20:20 | |
| *** lbragstad_ has joined #openstack-keystone | 20:20 | |
| *** akscram has joined #openstack-keystone | 20:21 | |
| *** davechen_afk has joined #openstack-keystone | 20:21 | |
| *** ekarlso has joined #openstack-keystone | 20:21 | |
| *** Guest40848 has joined #openstack-keystone | 20:21 | |
| *** dstanek has joined #openstack-keystone | 20:21 | |
| *** ngupta has joined #openstack-keystone | 20:21 | |
| *** topol_ has joined #openstack-keystone | 20:21 | |
| *** mnaser has joined #openstack-keystone | 20:21 | |
| *** sileht has joined #openstack-keystone | 20:21 | |
| *** ChanServ sets mode: +v dstanek | 20:22 | |
| *** SpamapS has joined #openstack-keystone | 20:22 | |
| *** ninag has joined #openstack-keystone | 20:22 | |
| *** amakarov_away has joined #openstack-keystone | 20:22 | |
| *** patchbot has joined #openstack-keystone | 20:23 | |
| *** bknudson has quit IRC | 20:26 | |
| *** mylu has joined #openstack-keystone | 20:27 | |
| *** jsavak has quit IRC | 20:28 | |
| openstackgerrit | Merged openstack/keystone: Updating sample configuration file https://review.openstack.org/283197 | 20:29 |
| *** jsavak has joined #openstack-keystone | 20:30 | |
| *** _fortis has joined #openstack-keystone | 20:31 | |
| *** spzala has joined #openstack-keystone | 20:32 | |
| *** timclin__ has joined #openstack-keystone | 20:33 | |
| *** timcline_ has quit IRC | 20:33 | |
| *** sdake_ is now known as sdake | 20:35 | |
| *** bknudson has joined #openstack-keystone | 20:36 | |
| *** ChanServ sets mode: +v bknudson | 20:36 | |
| *** samueldmq has quit IRC | 20:37 | |
| *** krotscheck has quit IRC | 20:37 | |
| *** anteaya has quit IRC | 20:38 | |
| *** lhcheng has joined #openstack-keystone | 20:41 | |
| *** ChanServ sets mode: +v lhcheng | 20:41 | |
| *** mylu has quit IRC | 20:42 | |
| *** jaosorior has quit IRC | 20:43 | |
| *** doug-fish has quit IRC | 20:45 | |
| *** rk4n_ has joined #openstack-keystone | 20:46 | |
| *** rk4n_ has quit IRC | 20:46 | |
| *** krotscheck has joined #openstack-keystone | 20:46 | |
| *** rk4n_ has joined #openstack-keystone | 20:47 | |
| *** openstackgerrit has quit IRC | 20:47 | |
| *** openstackgerrit has joined #openstack-keystone | 20:47 | |
| *** neophy has quit IRC | 20:48 | |
| *** rk4n_ has quit IRC | 20:48 | |
| *** anteaya has joined #openstack-keystone | 20:48 | |
| *** samueldmq has joined #openstack-keystone | 20:48 | |
| *** doug-fish has joined #openstack-keystone | 20:48 | |
| *** rk4n has quit IRC | 20:49 | |
| *** mylu has joined #openstack-keystone | 20:52 | |
| *** doug-fish has quit IRC | 20:53 | |
| *** raildo is now known as raildo-afk | 20:56 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Stop using oslotest.BaseTestCase https://review.openstack.org/281579 | 21:00 |
| *** vgridnev has quit IRC | 21:01 | |
| *** ayoung has quit IRC | 21:06 | |
| *** clenimar has quit IRC | 21:08 | |
| *** ayoung has joined #openstack-keystone | 21:12 | |
| *** ChanServ sets mode: +v ayoung | 21:12 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 21:13 |
| *** Nakato has quit IRC | 21:17 | |
| *** jamielennox has quit IRC | 21:19 | |
| *** Nakato has joined #openstack-keystone | 21:19 | |
| *** darrenc is now known as darrenc_afk | 21:20 | |
| *** jamielennox has joined #openstack-keystone | 21:20 | |
| *** ChanServ sets mode: +v jamielennox | 21:20 | |
| *** pauloewerton has quit IRC | 21:22 | |
| *** doug-fish has joined #openstack-keystone | 21:22 | |
| *** jsavak has quit IRC | 21:24 | |
| *** jsavak has joined #openstack-keystone | 21:24 | |
| *** su_zhang has joined #openstack-keystone | 21:27 | |
| *** darrenc_afk is now known as darrenc | 21:28 | |
| *** doug-fish has quit IRC | 21:31 | |
| *** mylu has quit IRC | 21:33 | |
| *** mylu has joined #openstack-keystone | 21:33 | |
| *** rk4n has joined #openstack-keystone | 21:34 | |
| *** rk4n has quit IRC | 21:37 | |
| *** rk4n has joined #openstack-keystone | 21:38 | |
| *** mylu has quit IRC | 21:40 | |
| *** ChanServ sets mode: +v samueldmq | 21:41 | |
| *** mylu has joined #openstack-keystone | 21:41 | |
| *** timclin__ has quit IRC | 21:42 | |
| *** bdossant has joined #openstack-keystone | 21:42 | |
| *** porunov has joined #openstack-keystone | 21:43 | |
| *** sileht_ has joined #openstack-keystone | 21:43 | |
| *** phalmos_ has quit IRC | 21:43 | |
| *** bdossant has quit IRC | 21:44 | |
| *** sileht has quit IRC | 21:46 | |
| *** maxabidi has quit IRC | 21:47 | |
| *** edmondsw has quit IRC | 21:48 | |
| *** sileht_ has quit IRC | 21:49 | |
| *** petertr7 is now known as petertr7_away | 21:49 | |
| *** sileht has joined #openstack-keystone | 21:51 | |
| morgan | stevemar: you know what I dislike? finding shards of crystal from a wine glass that was shattered 2 weeks ago... 3 rooms over *ouch* | 21:53 |
| *** rk4n_ has joined #openstack-keystone | 21:53 | |
| *** sdake has quit IRC | 21:57 | |
| *** rk4n has quit IRC | 21:57 | |
| *** mylu has quit IRC | 21:59 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 22:00 |
| rderose | ahhhhhh!!!! I made a bunch of code changes under the wrong branch, how to I revert? | 22:02 |
| rderose | anyone know the git commit to remove the last patch? | 22:03 |
| *** mylu has joined #openstack-keystone | 22:03 | |
| *** rloo has joined #openstack-keystone | 22:04 | |
| *** sileht has quit IRC | 22:05 | |
| *** rk4n_ has quit IRC | 22:05 | |
| *** sileht has joined #openstack-keystone | 22:05 | |
| *** mylu has quit IRC | 22:05 | |
| *** rk4n has joined #openstack-keystone | 22:07 | |
| *** rk4n has quit IRC | 22:09 | |
| bknudson | rderose: git revert , or git rebase -i HEAD~3, or git reset --hard HEAD^ | 22:10 |
| bknudson | git reflog | 22:10 |
| rderose | bknudson so if I want to go back to a specific patch set, which one would I use | 22:11 |
| rderose | ? | 22:11 |
| rderose | actually, it would be the last patch | 22:12 |
| bknudson | rderose: if you want to check out a patch set then you can do git-review -d review-id,patch-set | 22:12 |
| rderose | bknudson: ah, cool | 22:12 |
| rderose | thx | 22:12 |
| *** sdake has joined #openstack-keystone | 22:13 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 22:14 |
| rderose | bknudson: you are a life saver, thx again :) | 22:15 |
| bknudson | rderose: no problem. | 22:15 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 22:18 |
| *** mylu has joined #openstack-keystone | 22:20 | |
| dolphm | rderose: https://review.openstack.org/#/c/278570/ is exactly the same as patchset 37? | 22:22 |
| patchbot | dolphm: patch 278570 - keystone - Shadow users - Separate user identities | 22:22 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Simplify use of secure_proxy_ssl_header https://review.openstack.org/283288 | 22:32 |
| *** Adis has joined #openstack-keystone | 22:32 | |
| Adis | hellooouuu | 22:32 |
| *** Adis has left #openstack-keystone | 22:38 | |
| *** mylu has quit IRC | 22:42 | |
| *** mylu has joined #openstack-keystone | 22:43 | |
| *** sdake has quit IRC | 22:44 | |
| *** rk4n has joined #openstack-keystone | 22:53 | |
| *** ayoung has quit IRC | 22:54 | |
| *** jorge_munoz has quit IRC | 23:00 | |
| *** jorge_munoz has joined #openstack-keystone | 23:01 | |
| *** jsavak has quit IRC | 23:02 | |
| *** lhcheng has quit IRC | 23:03 | |
| *** dims has joined #openstack-keystone | 23:04 | |
| *** lhcheng has joined #openstack-keystone | 23:04 | |
| *** ChanServ sets mode: +v lhcheng | 23:04 | |
| *** ninag has quit IRC | 23:05 | |
| *** rloo has quit IRC | 23:07 | |
| morgan | . | 23:09 |
| samueldmq | .. | 23:09 |
| morgan | ... | 23:09 |
| samueldmq | :) | 23:09 |
| morgan | a | 23:09 |
| morgan | oh hai | 23:09 |
| samueldmq | b? | 23:09 |
| * samueldmq waves at morgan | 23:10 | |
| *** sdake has joined #openstack-keystone | 23:10 | |
| *** spzala has quit IRC | 23:13 | |
| morgan | stevemar: let me know if you got me email. | 23:14 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:14 | |
| *** spzala has joined #openstack-keystone | 23:14 | |
| morgan | stevemar: and if it worked. if not i'll dig up other way to getting you photos | 23:14 |
| stevemar | morgan: it worked :) | 23:18 |
| morgan | stevemar: cool | 23:18 |
| *** spzala has quit IRC | 23:18 | |
| *** spzala has joined #openstack-keystone | 23:19 | |
| rderose | dolphm yeah, I accidently push a bad patch (38) and had to revert back | 23:20 |
| rderose | dolphm it should be correct | 23:20 |
| rderose | now | 23:20 |
| dolphm | rderose: got everything sorted? last patchset i pulled of the federation patch was failing py27 | 23:20 |
| *** lhcheng has quit IRC | 23:20 | |
| *** lhcheng has joined #openstack-keystone | 23:21 | |
| *** ChanServ sets mode: +v lhcheng | 23:21 | |
| dolphm | rderose: looks like the check job passed on 39 | 23:21 |
| dolphm | err 40 | 23:21 |
| rderose | dolphm okay, comparing 39 to 40 now | 23:22 |
| *** lhcheng has quit IRC | 23:23 | |
| *** lhcheng has joined #openstack-keystone | 23:23 | |
| *** ChanServ sets mode: +v lhcheng | 23:23 | |
| *** spzala has quit IRC | 23:23 | |
| *** pushkaru has quit IRC | 23:24 | |
| *** pushkaru has joined #openstack-keystone | 23:25 | |
| openstackgerrit | guang-yee proposed openstack/keystone: Create notification when invalid user name provided https://review.openstack.org/280994 | 23:25 |
| rderose | dolphm: 39 and 40 should be exactly the same | 23:25 |
| rderose | dolphm: after I reverted "Separate user identities" back and did a rebase on "Shadow federated users" patch | 23:26 |
| rderose | dolphm: but I'm not seeing any differences | 23:26 |
| dolphm | rderose: cool | 23:26 |
| *** pushkaru has quit IRC | 23:30 | |
| *** mylu has quit IRC | 23:30 | |
| *** rderose has quit IRC | 23:32 | |
| stevemar | bknudson: you're always a life saver | 23:32 |
| *** gordc has quit IRC | 23:35 | |
| *** rk4n has quit IRC | 23:37 | |
| stevemar | gyee: yeah, the test failures are related to deprecations | 23:37 |
| stevemar | gyee: let's just fix the tests like we did in https://review.openstack.org/#/c/261706/ | 23:38 |
| patchbot | stevemar: patch 261706 - keystonemiddleware (stable/liberty) - ignore deprecation calls in test_audit_middleware (MERGED) | 23:38 |
| stevemar | gyee: can you relay that to haneef -- oh there he is o/ | 23:38 |
| gyee | stevemar, sure, thanks for looking into it | 23:39 |
| *** mylu has joined #openstack-keystone | 23:39 | |
| gyee | stevemar, if you haven't start, I can work on fix the test failures | 23:40 |
| stevemar | gyee: sure | 23:40 |
| stevemar | gyee: haven't started yet | 23:40 |
| gyee | they are all mind baby! | 23:40 |
| stevemar | gyee: i just saw the test output and saw "deprecations fail", i just commented | 23:41 |
| *** slberger has left #openstack-keystone | 23:42 | |
| bknudson | we can disable the deprecation check in stable branches | 23:43 |
| *** jorge_munoz has quit IRC | 23:48 | |
| *** jorge_munoz has joined #openstack-keystone | 23:49 | |
| *** subscope has quit IRC | 23:50 | |
| *** roxanaghe has joined #openstack-keystone | 23:53 | |
| *** mylu has quit IRC | 23:54 | |
| *** mylu has joined #openstack-keystone | 23:56 | |
| *** jorge_munoz has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!