| *** mylu has quit IRC | 00:04 | |
| *** mylu has joined #openstack-keystone | 00:07 | |
| *** mylu has quit IRC | 00:10 | |
| *** mylu has joined #openstack-keystone | 00:11 | |
| *** mylu has quit IRC | 00:13 | |
| *** mylu has joined #openstack-keystone | 00:13 | |
| *** fedruantine has quit IRC | 00:15 | |
| *** sdake has quit IRC | 00:15 | |
| *** sdake has joined #openstack-keystone | 00:32 | |
| *** sdake_ has joined #openstack-keystone | 00:42 | |
| *** sdake has quit IRC | 00:44 | |
| *** jasonsb has joined #openstack-keystone | 00:49 | |
| *** stingaci has quit IRC | 00:50 | |
| *** markvoelker has joined #openstack-keystone | 00:51 | |
| *** jasonsb has quit IRC | 00:54 | |
| *** markvoelker has quit IRC | 00:56 | |
| *** stingaci has joined #openstack-keystone | 01:01 | |
| *** stingaci has quit IRC | 01:06 | |
| *** stingaci has joined #openstack-keystone | 01:07 | |
| *** fedruantine has joined #openstack-keystone | 01:10 | |
| *** stingaci has quit IRC | 01:25 | |
| *** ekarlso has quit IRC | 01:33 | |
| *** zqfan has joined #openstack-keystone | 01:51 | |
| *** markvoelker has joined #openstack-keystone | 01:52 | |
| *** ekarlso has joined #openstack-keystone | 01:53 | |
| *** markvoelker has quit IRC | 01:57 | |
| *** mylu has quit IRC | 01:59 | |
| *** mylu has joined #openstack-keystone | 02:02 | |
| *** mylu has quit IRC | 02:03 | |
| *** mylu has joined #openstack-keystone | 02:04 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/311536 | 02:13 |
|---|---|---|
| *** morgan is now known as notmorgan | 02:17 | |
| *** stingaci has joined #openstack-keystone | 02:18 | |
| openstackgerrit | ayoung proposed openstack/keystone: WIP replace revoke tree with linear search https://review.openstack.org/311652 | 02:25 |
| *** mylu has quit IRC | 02:25 | |
| *** mylu has joined #openstack-keystone | 02:44 | |
| *** markvoelker has joined #openstack-keystone | 02:49 | |
| *** jasonsb has joined #openstack-keystone | 02:51 | |
| *** jasonsb has quit IRC | 02:55 | |
| *** stingaci has quit IRC | 03:16 | |
| *** stingaci has joined #openstack-keystone | 03:16 | |
| *** edtubill has joined #openstack-keystone | 03:25 | |
| *** mylu has quit IRC | 03:25 | |
| *** stingaci has quit IRC | 03:25 | |
| *** mylu has joined #openstack-keystone | 03:26 | |
| *** raginbaji is now known as raginbajin | 03:28 | |
| *** edtubill has quit IRC | 03:34 | |
| *** mylu has quit IRC | 03:39 | |
| *** mylu has joined #openstack-keystone | 03:40 | |
| *** mylu has quit IRC | 03:42 | |
| *** mylu has joined #openstack-keystone | 03:54 | |
| *** mylu has quit IRC | 03:58 | |
| *** BigDogStl has joined #openstack-keystone | 03:58 | |
| *** dave-mccowan has quit IRC | 04:01 | |
| *** BigDogStl has quit IRC | 04:02 | |
| *** mylu has joined #openstack-keystone | 04:02 | |
| *** edtubill has joined #openstack-keystone | 04:03 | |
| *** links has joined #openstack-keystone | 04:07 | |
| *** edtubill has quit IRC | 04:08 | |
| *** mylu has quit IRC | 04:17 | |
| *** mylu has joined #openstack-keystone | 04:19 | |
| *** mylu has quit IRC | 04:21 | |
| *** mylu has joined #openstack-keystone | 04:34 | |
| *** mylu has quit IRC | 04:45 | |
| *** mylu has joined #openstack-keystone | 04:45 | |
| *** mylu has quit IRC | 04:47 | |
| *** mylu has joined #openstack-keystone | 04:48 | |
| *** markvoelker has quit IRC | 04:49 | |
| *** rcernin has joined #openstack-keystone | 05:05 | |
| *** vnogin1 has quit IRC | 05:12 | |
| *** mylu has quit IRC | 05:12 | |
| *** mylu has joined #openstack-keystone | 05:19 | |
| *** mylu has quit IRC | 05:22 | |
| *** mylu has joined #openstack-keystone | 05:27 | |
| *** mylu has quit IRC | 05:32 | |
| *** yolanda has joined #openstack-keystone | 05:32 | |
| *** yolanda has quit IRC | 05:34 | |
| *** yolanda has joined #openstack-keystone | 05:34 | |
| *** fedruantine has quit IRC | 05:45 | |
| *** sdake_ has quit IRC | 05:47 | |
| *** markvoelker has joined #openstack-keystone | 05:50 | |
| *** sdake has joined #openstack-keystone | 05:52 | |
| *** jasonsb has joined #openstack-keystone | 05:53 | |
| *** mylu has joined #openstack-keystone | 05:54 | |
| *** markvoelker has quit IRC | 05:55 | |
| *** jasonsb has quit IRC | 05:58 | |
| *** josecastroleon has joined #openstack-keystone | 06:02 | |
| *** mylu has quit IRC | 06:11 | |
| *** stingaci has joined #openstack-keystone | 06:26 | |
| *** roxanaghe has joined #openstack-keystone | 06:28 | |
| *** roxanaghe has quit IRC | 06:29 | |
| *** fedruantine has joined #openstack-keystone | 06:43 | |
| *** markvoelker has joined #openstack-keystone | 06:51 | |
| *** markvoelker has quit IRC | 06:55 | |
| *** daemontool has joined #openstack-keystone | 07:11 | |
| *** mylu has joined #openstack-keystone | 07:12 | |
| *** yolanda has quit IRC | 07:12 | |
| *** mylu has quit IRC | 07:18 | |
| *** daemontool has quit IRC | 07:21 | |
| *** daemontool has joined #openstack-keystone | 07:21 | |
| *** jed56 has joined #openstack-keystone | 07:23 | |
| *** roxanaghe has joined #openstack-keystone | 07:29 | |
| *** daemontool has quit IRC | 07:33 | |
| *** tesseract has joined #openstack-keystone | 07:33 | |
| *** tesseract is now known as Guest37590 | 07:34 | |
| *** roxanaghe has quit IRC | 07:35 | |
| *** yolanda has joined #openstack-keystone | 07:36 | |
| *** daemontool has joined #openstack-keystone | 07:37 | |
| *** stingaci has quit IRC | 07:39 | |
| *** stingaci has joined #openstack-keystone | 07:40 | |
| *** stingaci has quit IRC | 07:45 | |
| *** markvoelker has joined #openstack-keystone | 07:51 | |
| *** markvoelker has quit IRC | 07:56 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** dmk0202 has joined #openstack-keystone | 08:06 | |
| *** henrynash has joined #openstack-keystone | 08:08 | |
| *** ChanServ sets mode: +v henrynash | 08:08 | |
| *** permalac has joined #openstack-keystone | 08:12 | |
| *** jistr has joined #openstack-keystone | 08:26 | |
| *** stingaci has joined #openstack-keystone | 08:41 | |
| *** stingaci has quit IRC | 08:46 | |
| *** markvoelker has joined #openstack-keystone | 08:52 | |
| *** daemontool has quit IRC | 08:54 | |
| *** markvoelker has quit IRC | 08:57 | |
| *** belmoreira has joined #openstack-keystone | 09:42 | |
| *** pnavarro has joined #openstack-keystone | 09:48 | |
| *** markvoelker has joined #openstack-keystone | 09:53 | |
| *** markvoelker has quit IRC | 09:58 | |
| *** pnavarro has quit IRC | 10:37 | |
| *** Guest68119 has quit IRC | 10:37 | |
| *** zeus- has joined #openstack-keystone | 10:38 | |
| *** pnavarro has joined #openstack-keystone | 10:38 | |
| *** chlong has joined #openstack-keystone | 10:38 | |
| *** stingaci has joined #openstack-keystone | 10:43 | |
| *** stingaci has quit IRC | 10:47 | |
| *** mylu has joined #openstack-keystone | 10:47 | |
| *** yolanda has quit IRC | 10:47 | |
| *** yolanda has joined #openstack-keystone | 10:51 | |
| *** markvoelker has joined #openstack-keystone | 10:54 | |
| *** jasonsb has joined #openstack-keystone | 10:57 | |
| *** zeus- is now known as zeus | 10:58 | |
| *** zeus is now known as Guest25915 | 10:59 | |
| *** markvoelker has quit IRC | 10:59 | |
| *** jasonsb has quit IRC | 11:02 | |
| *** roxanaghe has joined #openstack-keystone | 11:06 | |
| *** josecastroleon has quit IRC | 11:09 | |
| *** roxanaghe has quit IRC | 11:10 | |
| *** yolanda has quit IRC | 11:16 | |
| *** josecastroleon has joined #openstack-keystone | 11:16 | |
| *** yolanda has joined #openstack-keystone | 11:16 | |
| *** BigDogStl has joined #openstack-keystone | 11:21 | |
| *** BigDogStl has quit IRC | 11:26 | |
| *** yolanda has quit IRC | 11:29 | |
| *** yolanda has joined #openstack-keystone | 11:30 | |
| *** e0ne has joined #openstack-keystone | 11:44 | |
| *** woodster_ has joined #openstack-keystone | 11:49 | |
| *** raginbajin has quit IRC | 11:50 | |
| *** markvoelker has joined #openstack-keystone | 11:55 | |
| *** mylu has quit IRC | 11:56 | |
| *** markvoelker has quit IRC | 11:59 | |
| *** markvoelker has joined #openstack-keystone | 12:06 | |
| *** e0ne has quit IRC | 12:14 | |
| *** Ephur has joined #openstack-keystone | 12:16 | |
| *** edmondsw has joined #openstack-keystone | 12:33 | |
| *** ninag has joined #openstack-keystone | 12:43 | |
| *** stingaci has joined #openstack-keystone | 12:44 | |
| *** gordc has joined #openstack-keystone | 12:45 | |
| *** stingaci has quit IRC | 12:49 | |
| *** dave-mccowan has joined #openstack-keystone | 12:53 | |
| *** jasonsb has joined #openstack-keystone | 13:00 | |
| *** sdake has quit IRC | 13:00 | |
| *** sdake has joined #openstack-keystone | 13:01 | |
| *** jdennis has joined #openstack-keystone | 13:03 | |
| *** sdake_ has joined #openstack-keystone | 13:04 | |
| *** jasonsb has quit IRC | 13:05 | |
| *** richm has joined #openstack-keystone | 13:05 | |
| *** sdake has quit IRC | 13:06 | |
| *** rderose has joined #openstack-keystone | 13:08 | |
| *** julim has joined #openstack-keystone | 13:19 | |
| *** arunkant__ has joined #openstack-keystone | 13:19 | |
| *** julim has quit IRC | 13:20 | |
| *** c_soukup has joined #openstack-keystone | 13:25 | |
| *** arunkant__ has quit IRC | 13:26 | |
| *** belmoreira has quit IRC | 13:29 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the resource abstract base class out of core https://review.openstack.org/302826 | 13:30 |
| *** jaosorior has joined #openstack-keystone | 13:32 | |
| *** yolanda has quit IRC | 13:32 | |
| *** doug-fish has joined #openstack-keystone | 13:33 | |
| *** TxGVNN has joined #openstack-keystone | 13:34 | |
| *** links has quit IRC | 13:35 | |
| *** yolanda has joined #openstack-keystone | 13:36 | |
| *** jaosorior has quit IRC | 13:41 | |
| *** tonytan4ever has joined #openstack-keystone | 13:44 | |
| *** EinstCrazy has joined #openstack-keystone | 13:46 | |
| stevemar | mornin! o/ | 13:53 |
| dims | hey stevemar | 13:54 |
| *** Guest25915 is now known as zeus` | 13:54 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:54 | |
| *** e0ne has joined #openstack-keystone | 13:56 | |
| bknudson | stevemar: dims: almost time to remove keystone cli. | 13:58 |
| dims | bknudson : the pypi mirroring is broke we'll need to wait for it | 13:59 |
| stevemar | bknudson: true that | 13:59 |
| *** edtubill has joined #openstack-keystone | 13:59 | |
| *** josecastroleon has quit IRC | 14:00 | |
| *** stingaci has joined #openstack-keystone | 14:02 | |
| *** ametts has joined #openstack-keystone | 14:02 | |
| *** TxGVNN has quit IRC | 14:05 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the catalog abstract base class and common code out of core https://review.openstack.org/309238 | 14:06 |
| *** EinstCrazy has quit IRC | 14:10 | |
| *** ngupta has joined #openstack-keystone | 14:10 | |
| *** pgbridge has joined #openstack-keystone | 14:10 | |
| *** EinstCrazy has joined #openstack-keystone | 14:11 | |
| *** sdake_ is now known as sdake | 14:11 | |
| *** e0ne has quit IRC | 14:13 | |
| *** e0ne has joined #openstack-keystone | 14:14 | |
| *** EinstCrazy has quit IRC | 14:16 | |
| notmorgan | stevemar, bknudson: yay | 14:28 |
| notmorgan | dims: boo :( | 14:28 |
| *** EinstCrazy has joined #openstack-keystone | 14:32 | |
| *** jorge_munoz has joined #openstack-keystone | 14:32 | |
| lbragstad | o/ | 14:35 |
| *** EinstCrazy has quit IRC | 14:40 | |
| *** nkinder has joined #openstack-keystone | 14:48 | |
| *** ayoung has joined #openstack-keystone | 14:50 | |
| *** ChanServ sets mode: +v ayoung | 14:50 | |
| *** raddaoui has joined #openstack-keystone | 14:51 | |
| *** slberger has joined #openstack-keystone | 14:53 | |
| *** ebalduf_ has joined #openstack-keystone | 14:55 | |
| *** ebalduf_ has quit IRC | 14:59 | |
| *** phalmos has joined #openstack-keystone | 15:00 | |
| *** timcline has joined #openstack-keystone | 15:00 | |
| *** timcline has quit IRC | 15:00 | |
| *** timcline has joined #openstack-keystone | 15:01 | |
| *** ChanServ sets mode: +v topol_ | 15:02 | |
| *** topol_ is now known as topol | 15:02 | |
| *** jorge_munoz has quit IRC | 15:04 | |
| *** dan_nguyen has joined #openstack-keystone | 15:08 | |
| *** charz_ has joined #openstack-keystone | 15:11 | |
| *** links has joined #openstack-keystone | 15:14 | |
| *** links has quit IRC | 15:14 | |
| *** josecastroleon has joined #openstack-keystone | 15:15 | |
| *** mtreinish_ has joined #openstack-keystone | 15:16 | |
| *** doug-fis_ has joined #openstack-keystone | 15:21 | |
| *** sudorandom_ has joined #openstack-keystone | 15:21 | |
| *** charz has quit IRC | 15:21 | |
| *** mancdaz has quit IRC | 15:21 | |
| *** mancdaz has joined #openstack-keystone | 15:21 | |
| *** mtreinish has quit IRC | 15:21 | |
| *** rcernin has quit IRC | 15:21 | |
| *** jrist has quit IRC | 15:21 | |
| *** phalmos has quit IRC | 15:21 | |
| *** sudorandom has quit IRC | 15:21 | |
| *** mancdaz has quit IRC | 15:21 | |
| *** jlvillal has quit IRC | 15:21 | |
| *** mtreinish_ is now known as mtreinish | 15:21 | |
| *** sudorandom_ is now known as sudorandom | 15:21 | |
| *** jlvillal has joined #openstack-keystone | 15:21 | |
| *** doug-fish has quit IRC | 15:22 | |
| *** rcernin has joined #openstack-keystone | 15:22 | |
| *** mancdaz has joined #openstack-keystone | 15:23 | |
| *** ebalduf_ has joined #openstack-keystone | 15:25 | |
| *** phalmos has joined #openstack-keystone | 15:25 | |
| *** rcernin has quit IRC | 15:30 | |
| *** Ephur has quit IRC | 15:34 | |
| *** yolanda has quit IRC | 15:35 | |
| *** jrist has joined #openstack-keystone | 15:37 | |
| *** chlong has quit IRC | 15:38 | |
| *** stingaci has quit IRC | 15:38 | |
| *** josecastroleon has quit IRC | 15:47 | |
| *** e0ne has quit IRC | 15:47 | |
| *** haplo37 has joined #openstack-keystone | 15:47 | |
| dims | notmorgan : LOL | 15:56 |
| *** ngupta has quit IRC | 15:57 | |
| *** ozialien10 has joined #openstack-keystone | 15:58 | |
| *** dmk0202 has quit IRC | 15:59 | |
| *** yolanda has joined #openstack-keystone | 15:59 | |
| *** Guest37590 has quit IRC | 15:59 | |
| *** ngupta has joined #openstack-keystone | 15:59 | |
| *** spzala has joined #openstack-keystone | 16:07 | |
| *** navidp has joined #openstack-keystone | 16:12 | |
| *** links has joined #openstack-keystone | 16:12 | |
| *** lhcheng has joined #openstack-keystone | 16:13 | |
| *** ChanServ sets mode: +v lhcheng | 16:13 | |
| *** navid_ has joined #openstack-keystone | 16:14 | |
| *** gyee has joined #openstack-keystone | 16:14 | |
| *** ChanServ sets mode: +v gyee | 16:14 | |
| *** gyee has quit IRC | 16:15 | |
| *** tqtran has joined #openstack-keystone | 16:15 | |
| *** navidp has quit IRC | 16:17 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:18 | |
| *** jistr has quit IRC | 16:23 | |
| *** haplo37 has quit IRC | 16:24 | |
| *** ebalduf_ has quit IRC | 16:25 | |
| *** gyee has joined #openstack-keystone | 16:25 | |
| *** ChanServ sets mode: +v gyee | 16:25 | |
| *** haplo37 has joined #openstack-keystone | 16:31 | |
| openstackgerrit | Navid Pustchi proposed openstack/python-keystoneclient: Fixing D301 PEP257 violation. https://review.openstack.org/311783 | 16:31 |
| *** pumaranikar has joined #openstack-keystone | 16:33 | |
| openstackgerrit | Navid Pustchi proposed openstack/python-keystoneclient: Fixing D211 PEP257 violation. https://review.openstack.org/311785 | 16:37 |
| *** roxanaghe has joined #openstack-keystone | 16:39 | |
| *** real56 has joined #openstack-keystone | 16:43 | |
| *** tonytan4ever has quit IRC | 16:44 | |
| *** harlowja has joined #openstack-keystone | 16:45 | |
| openstackgerrit | Navid Pustchi proposed openstack/python-keystoneclient: Fixing D208 PEP257 violation. https://review.openstack.org/311787 | 16:48 |
| *** daemontool has joined #openstack-keystone | 16:52 | |
| *** Ephur has joined #openstack-keystone | 17:03 | |
| *** edtubill has quit IRC | 17:13 | |
| *** roxanaghe has quit IRC | 17:24 | |
| *** daemontool_ has joined #openstack-keystone | 17:24 | |
| *** navid_ has quit IRC | 17:26 | |
| *** daemontool has quit IRC | 17:27 | |
| *** david-lyle has joined #openstack-keystone | 17:28 | |
| *** david-lyle has quit IRC | 17:29 | |
| *** david-lyle has joined #openstack-keystone | 17:30 | |
| *** links has quit IRC | 17:33 | |
| *** fangxu has joined #openstack-keystone | 17:34 | |
| *** Ephur has quit IRC | 17:35 | |
| *** fangxu has quit IRC | 17:35 | |
| *** fangxu has joined #openstack-keystone | 17:44 | |
| *** c_soukup has quit IRC | 17:46 | |
| *** fawadkhaliq has quit IRC | 17:50 | |
| *** permalac has quit IRC | 17:52 | |
| *** julim has joined #openstack-keystone | 17:52 | |
| stevemar | looks like KSC is faliing functional tests | 17:58 |
| stevemar | doh! | 17:58 |
| *** annasort has joined #openstack-keystone | 18:00 | |
| *** rbridgeman has joined #openstack-keystone | 18:00 | |
| *** agrebennikov_ has joined #openstack-keystone | 18:01 | |
| *** pnavarro has quit IRC | 18:02 | |
| *** jed56 has quit IRC | 18:04 | |
| *** roxanaghe has joined #openstack-keystone | 18:10 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove test_invalid_policy_raises_error https://review.openstack.org/311804 | 18:14 |
| *** pushkaru has joined #openstack-keystone | 18:15 | |
| ayoung | stevemar, no, not DOH! This is a good thing | 18:16 |
| bknudson | we get to figure out how easy / hard it is to debug ksc functional tests | 18:17 |
| notmorgan | bknudson: hehe | 18:17 |
| notmorgan | bknudson: always looking at the bright side of things I see | 18:17 |
| ayoung | that and we catch problems early. Function tests will break a lot. | 18:18 |
| ayoung | stevemar, BTW, post a link when you raise an alarm like this, so we are all looking at the same thing, please. | 18:18 |
| *** pumaranikar has quit IRC | 18:19 | |
| *** timcline has quit IRC | 18:22 | |
| stevemar | ayoung: i usually do, i just noticed it before lunch and then left | 18:23 |
| *** stingaci has joined #openstack-keystone | 18:23 | |
| stevemar | anyway, easy enough to find: https://review.openstack.org/#/c/311548/ | 18:23 |
| notmorgan | stevemar: commit it and quit! i mena.. wait no not that. | 18:24 |
| stevemar | no wait, that one doesn't work | 18:24 |
| patchbot | stevemar: patch 311548 - python-keystoneclient - Updated from global requirements | 18:24 |
| *** stingaci has quit IRC | 18:25 | |
| *** stingaci has joined #openstack-keystone | 18:25 | |
| *** spzala has quit IRC | 18:27 | |
| bknudson | https://review.openstack.org/#/c/311548/ has bigger problems. | 18:27 |
| patchbot | bknudson: patch 311548 - python-keystoneclient - Updated from global requirements | 18:27 |
| *** notmorgan is now known as morgan | 18:28 | |
| *** spzala has joined #openstack-keystone | 18:28 | |
| *** fawadkhaliq has joined #openstack-keystone | 18:28 | |
| stevemar | bknudson: whats the bigger problem, aside from the functional test job failing (in 2 minutes, some timeout) | 18:28 |
| *** spzala has quit IRC | 18:30 | |
| *** real56 has quit IRC | 18:30 | |
| *** spzala has joined #openstack-keystone | 18:30 | |
| bknudson | think it's the change to fernet that caused the functional tests to fail? | 18:30 |
| *** lhcheng has quit IRC | 18:30 | |
| bknudson | I assumed it was one of the new tests but this is really old. | 18:30 |
| bknudson | the test is showing that the audit ID chain isn't consistent. | 18:31 |
| *** lhcheng has joined #openstack-keystone | 18:31 | |
| *** ChanServ sets mode: +v lhcheng | 18:31 | |
| *** mkoderer__ has quit IRC | 18:32 | |
| bknudson | I'd prefer not to revert the change to make fernet the default. | 18:32 |
| *** roxanaghe has quit IRC | 18:33 | |
| bknudson | lbragstad dolphm: do you know if this is expected ^ ? | 18:34 |
| *** navid_ has joined #openstack-keystone | 18:35 | |
| lbragstad | bknudson what link? | 18:35 |
| lbragstad | or which link? | 18:35 |
| bknudson | lbragstad: that the audit ID chain isn't consistent with fernet and v2 tokens | 18:37 |
| lbragstad | hmm - that's strange | 18:40 |
| lbragstad | bknudson which tests are you seeing this in? | 18:40 |
| bknudson | lbragstad: http://logs.openstack.org/87/311787/1/check/gate-keystoneclient-dsvm-functional/5ba3799/console.html#_2016-05-02_17_08_55_602 | 18:41 |
| bknudson | lbragstad: here's the line http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/tests/functional/test_access.py#n47 | 18:41 |
| bknudson | pretty simple test | 18:41 |
| bknudson | looks like it just rescopes a token and validates the chain. | 18:42 |
| *** roxanaghe has joined #openstack-keystone | 18:42 | |
| *** stingaci has quit IRC | 18:43 | |
| kfox1111 | is there a simple api to validate if a scoped token is valid, and get the user_id and project_id? | 18:46 |
| kfox1111 | need to do that from some go code. | 18:47 |
| bknudson | V2 fernet doesn't preserve the audit IDs according to my test. | 18:47 |
| lbragstad | bknudson ah ha - digging in the fernet code now | 18:47 |
| kfox1111 | looks like /v3/auth/tokens? | 18:48 |
| kfox1111 | hmm.... do you need to have an admin token to use it? | 18:48 |
| *** roxanagh_ has joined #openstack-keystone | 18:50 | |
| bknudson | lbragstad: it's strange because the child token has 2 audit_ids, it's just the audit_ids in the child are unrelated to the parent. | 18:51 |
| lbragstad | bknudson ok - going to push something that I'm working on and I'll see if I can recreate | 18:53 |
| lbragstad | bknudson we don't have a test in keystone somewhere that tests this? | 18:53 |
| lbragstad | I feel like that should have been caught by the server | 18:53 |
| *** timcline has joined #openstack-keystone | 18:54 | |
| *** timcline has quit IRC | 18:54 | |
| *** edtubill has joined #openstack-keystone | 18:54 | |
| *** timcline has joined #openstack-keystone | 18:55 | |
| *** alejandrito has joined #openstack-keystone | 18:55 | |
| *** roxanagh_ has quit IRC | 18:55 | |
| *** alejandrito has quit IRC | 18:56 | |
| *** alejandrito has joined #openstack-keystone | 18:57 | |
| *** alejandrito has quit IRC | 18:57 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make keystone exit when fernet keys don't exist https://review.openstack.org/311811 | 18:58 |
| *** pushkaru has quit IRC | 19:00 | |
| stevemar | ayoung: theres the faliure! http://logs.openstack.org/48/311548/1/check/gate-keystoneclient-dsvm-functional/e8920ef/console.html#_2016-05-02_18_47_52_811 | 19:01 |
| ayoung | test_access_audit_id | 19:02 |
| ayoung | V2 | 19:02 |
| stevemar | ayoung: fails here: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/tests/functional/test_access.py#L46-L47 | 19:03 |
| ayoung | stevemar, so two hypotheses | 19:04 |
| ayoung | 1. Keystone server is not honoring the Audit chain from the unscoped token | 19:05 |
| morgan | ayoung: uhm. wait what? /me looks at the link | 19:05 |
| ayoung | 2. this test is no properly using the unscoped token to get the scoped token | 19:05 |
| *** pumaranikar has joined #openstack-keystone | 19:05 | |
| ayoung | morgan, IIUC the test gets an unscoped, grabs the audit ID, then uses the unscoped to get a scoped, and confirms that the audit ID from unscoped is in the scoped as well | 19:05 |
| morgan | when did this magicaally break? | 19:05 |
| ayoung | morgan, https://review.openstack.org/#/c/311548/ | 19:06 |
| patchbot | ayoung: patch 311548 - python-keystoneclient - Updated from global requirements | 19:06 |
| morgan | *blink* | 19:06 |
| morgan | oh | 19:06 |
| morgan | uhm | 19:06 |
| ayoung | what is iso8601? Is that from Les Mis? | 19:06 |
| morgan | i think this is session weirdness | 19:07 |
| ayoung | Oh, that was 24601 | 19:07 |
| morgan | so, if you used a new session vs self.session, i bet this would succeed | 19:07 |
| morgan | leading me to see an issue with ksc.Session or KSA.session | 19:07 |
| ayoung | and thus we see the value of functional tests! | 19:08 |
| morgan | but i almost guarantee you're going to see this is related to that and not that the server is doing something wrong | 19:08 |
| morgan | it is almost 100% assuredly not (since we test that explicitly in the server) | 19:08 |
| ayoung | morgan, that sounds like a good working hypothesis. How do we test? | 19:09 |
| morgan | ayoung: fix the test (synthentically) to use a new session with no credentials in it | 19:09 |
| morgan | and re-run | 19:10 |
| morgan | that way you cannot run through the normal auth path. | 19:11 |
| lbragstad | bknudson ok - I think I can recreate what you're seeing | 19:11 |
| lbragstad | bknudson I add a test to test_auth.py | 19:11 |
| morgan | since the new session has never seen unscoped_plugin | 19:11 |
| lbragstad | which should be specific to v2 | 19:11 |
| lbragstad | auth | 19:11 |
| ayoung | morgan, so...no | 19:12 |
| ayoung | I think that what this does is a legitimate use case, and would not be done in a session | 19:13 |
| ayoung | unscoped in one session, but grab the auth plugin and create a second | 19:13 |
| *** yolanda has quit IRC | 19:14 | |
| ayoung | the audit ID should be generated by the server, and should match that of the original, but I would think that, in the scoped token, it would be a list, not a single value? | 19:14 |
| * ayoung does not quite understand our audit approach here | 19:14 | |
| lbragstad | ayoung yeah - you're right | 19:14 |
| ayoung | audit_chain_id can only be a single value? | 19:14 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Expose bug in Fernet v2 audit ids https://review.openstack.org/311816 | 19:16 |
| edtubill | Hi, I had a quick question -currently, there's no way to use the k2k federation auth plugin when using the CLI right? | 19:17 |
| lbragstad | ayoung I'm not sure about audit_chain_id but I know that when you get an unscoped token you should have one audit_id in the list of audit_ids of the response | 19:18 |
| lbragstad | if you use that unscoped token to get a project scoped token the audit_id from the unscoped token should be one of the two audit ids in the project scoped token response | 19:18 |
| morgan | ayoung: no i was saying how we confirm the issue | 19:19 |
| morgan | ayoung: not that is how you fix it | 19:19 |
| ayoung | morgan, so you think that there are two sessions in play here, and the second one is doing...what? | 19:21 |
| *** jaosorior has joined #openstack-keystone | 19:22 | |
| edtubill | ping rodrigods | 19:25 |
| *** mylu has joined #openstack-keystone | 19:28 | |
| ayoung | morgan, ok, I think I had what you said exactly backwards. | 19:28 |
| morgan | ayoung: yep. | 19:29 |
| morgan | ayoung: 1 session in play, and a bug associated to that | 19:29 |
| *** fawadkhaliq has quit IRC | 19:29 | |
| *** mylu has quit IRC | 19:30 | |
| ayoung | so instead of self.session create a new session on line 41 and it should pass. But that is just a workaround, and the use case as shown by this test failure is still legit. DO I read that right? | 19:30 |
| *** lhcheng has quit IRC | 19:31 | |
| roxanaghe | morgan, ayoung: we now have a mock strategy in ldap3: https://github.com/cannatag/ldap3/blob/dev/ldap3/strategy/mockSync.py | 19:31 |
| roxanaghe | or at least in a branch that will be released soon :) | 19:31 |
| *** fawadkhaliq has joined #openstack-keystone | 19:31 | |
| roxanaghe | knikolla: ^^ | 19:31 |
| ayoung | roxanaghe, so....we had a discussion at the summit about python3 | 19:32 |
| roxanaghe | ayoung, ok.. | 19:32 |
| ayoung | roxanaghe, one thing we have IDed is that the pyldap port of python-ldap to python3 is the bettter approach | 19:32 |
| ayoung | roxanaghe, but, that is all the old, crappy code | 19:32 |
| ayoung | and I like what we have with ldap3. So, I think we need to figure out what we are going to do with the current code. | 19:33 |
| *** jaosorior has quit IRC | 19:33 | |
| ayoung | But, we really should not be using ldap3, as it does a lot of stuff in Python that is hard to get right, and the openldap libraries have worked long and hard to nail that down | 19:33 |
| *** lhcheng has joined #openstack-keystone | 19:33 | |
| *** ChanServ sets mode: +v lhcheng | 19:33 | |
| *** jaosorior has joined #openstack-keystone | 19:33 | |
| ayoung | the whole LDAP wire protocol is non-trivial, and reimplementing in Python is likely to introduce errors | 19:34 |
| ayoung | roxanaghe, there was a fork of python-ldap done to just get the code to python3 | 19:34 |
| ayoung | https://github.com/pyldap/pyldap | 19:34 |
| roxanaghe | ayoung, hmmm, why do you think ldap3 code is risky? | 19:35 |
| roxanaghe | it is used by other companies that deal with ldap | 19:35 |
| gyee | lets just use JNDI :-) | 19:36 |
| dims | gyee : LOL | 19:36 |
| *** dan_nguyen has quit IRC | 19:37 | |
| stevemar | ayoung: ah the failure is cause we switched devstack to run fernet by default | 19:40 |
| stevemar | nice | 19:40 |
| stevemar | ayoung: that's a nice catch, yay func. tests | 19:40 |
| ayoung | Whoa | 19:41 |
| ayoung | roxanaghe, so...I'm ok with completing the work on ldap3, but don't be surprised if we end up having to go to pyldap with the old driver | 19:41 |
| *** mylu has joined #openstack-keystone | 19:42 | |
| stevemar | roxanaghe: i was wondering about that over the weekend | 19:42 |
| ayoung | stevemar, and I like the new code and the new approach | 19:42 |
| roxanaghe | ayoung, sorry I was just surprised so I am glad I opened the convo | 19:42 |
| ayoung | so it might be OK. | 19:43 |
| ayoung | stevemar, I kindof want to do this: | 19:43 |
| ayoung | 1. get the new driver working (complete the task as is) | 19:43 |
| stevemar | i'm wondering why we don't use pyldap + ldappool (but a py3 friendly version of it) | 19:43 |
| * morgan very much prefers ldap3 | 19:43 | |
| ayoung | 2. start hammering on it | 19:43 |
| morgan | very very much | 19:43 |
| ayoung | 3. be prepared to rework the existing code to pyldap if required | 19:43 |
| ayoung | morgan, I am not the right person to judge, as I hate the original LDAP code so so much | 19:44 |
| morgan | ayoung: not our code | 19:44 |
| morgan | the library | 19:44 |
| *** mylu has quit IRC | 19:44 | |
| morgan | having used both, i would NEVER write anything with the old lib/a py3 version of it | 19:44 |
| morgan | ever | 19:44 |
| ayoung | morgan, but I do prefer using openldap to using a reimplementation...ldap is a beast | 19:44 |
| morgan | unless the interfaces massively change | 19:45 |
| ayoung | morgan, one of my earliest blog posts: http://adam.younglogic.com/2008/08/openldap-api-is-somewhat-hostile/ | 19:45 |
| kfox1111 | if you auth with project_id, you don't need a project domain right? | 19:45 |
| ayoung | kfox1111, um....no you still need it. But you shouldn;t | 19:46 |
| ayoung | kfox1111, which should probably be filed as a bug. IDs are unique, and should not need to be scoped to domains | 19:47 |
| kfox1111 | k. just trying to document some things for the kubernetes folks. | 19:47 |
| roxanaghe | ayoung, morgan in my opinion I don't think we do any extraordinary things with ldap so that this new ldap3 wouldn't support it | 19:48 |
| kfox1111 | they have most of a keystone plugin written, but it doesn't support tokens. just usernames/passwords, which I think is not what we would want. | 19:48 |
| *** lamt has joined #openstack-keystone | 19:48 | |
| roxanaghe | it is both scary and exciting that the library is stil in very much development but I guess that's just open source | 19:48 |
| roxanaghe | morgan, and I very much love the code, since I've been reading ldap3 code more in depth by trying to help on this mock strategy | 19:49 |
| ayoung | roxanaghe, so one other thing learnt at the summit: we had a presentation on Active Directory, and the presentor tested all his changes against Sambe. So we can use that for functio9nal/integration tests | 19:49 |
| ayoung | nkinder, I think we want to pursue the ldap3 approach. We can treat pyldaop as a fallback, but we've put enough work into the new driver, and the code is much, much prettier. Is that a deal breaker? | 19:50 |
| roxanaghe | ayoung, do you have a link on that? | 19:50 |
| ayoung | roxanaghe, not sure if the presentations are up yet, but I can find the session link, and it should be off that soonish | 19:50 |
| roxanaghe | ayoung, cool thanks | 19:51 |
| nkinder | ayoung: I think we should look at performance under load, and also ensure crypto is working properly | 19:51 |
| nkinder | ayoung: also see how it performs with LDAPS and/or startTLS | 19:51 |
| ayoung | nkinder, ++ it was SASL support that I was most worried about. It seems to be an after thought in a lot of libraries | 19:51 |
| ayoung | roxanaghe, are you comfortable setting up FreeIPA? WIth that, we can test both X509 and Kerberos based Auth. I'd be happy to help with the rough points | 19:52 |
| ayoung | and it will lead to the functional test setup | 19:52 |
| ayoung | roxanaghe, https://www.openstack.org/summit/austin-2016/summit-schedule/events/7315 was the sesssion. Martin Lopes is a tech writer here at RH, and since he is doing Keystone related things, he's affiliated with our team | 19:53 |
| ayoung | I can get him here if we need to talk to him | 19:54 |
| roxanaghe | ayoung, ok, I'm gonna take a look at it | 19:55 |
| ayoung | roxanaghe, ARGH expired...the schedule app sux | 19:55 |
| ayoung | Ah...came back...rant retracted but kept near at hand | 19:56 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP: review at own risk: switch to pyldap https://review.openstack.org/311827 | 19:56 |
| *** annasort has quit IRC | 19:57 | |
| ayoung | stevemar, you are amazing | 19:58 |
| stevemar | ayoung: i'm also pulling an entire library locally :( | 19:59 |
| stevemar | ayoung: but the library was one file :\ | 19:59 |
| ayoung | https://review.openstack.org/#/c/311827/1/keystone/common/ldap/ldappool.py stevemar ? | 20:00 |
| patchbot | ayoung: patch 311827 - keystone - WIP: review at own risk: switch to pyldap | 20:00 |
| stevemar | ayoung: that is basiclly https://github.com/mozilla-services/ldappool/blob/master/ldappool/__init__.py | 20:02 |
| stevemar | i'm not sure if we can legally use that... | 20:02 |
| ayoung | stevemar, Yep. Yep | 20:02 |
| ayoung | stevemar, I think that it depends on the license, but we should be able to annotate at the top of the file | 20:02 |
| stevemar | the library is unmaintained and hasn't accepted a pull request in years | 20:02 |
| stevemar | ayoung: thats my hope | 20:02 |
| stevemar | i wonder if the tests will pass | 20:02 |
| stevemar | prob not | 20:02 |
| ayoung | stevemar, we can fork, like pyldap, and support. My guess is that if nkinder thinks we need pyldap, we can do pyldappool | 20:02 |
| stevemar | ayoung: true, you red hatters are maintaining pyldap right? | 20:02 |
| *** dan_nguyen has joined #openstack-keystone | 20:03 | |
| ayoung | stevemar, yep | 20:04 |
| ayoung | stevemar, I think the pyldap maintainer is a FreeIPA dev | 20:04 |
| morgan | fwiw, the ldappool is less relavant for the same reasons memcachepool is | 20:04 |
| stevemar | ldappool is nice, it makes all operations we do with ldap much faster | 20:05 |
| morgan | stevemar: that was mostly the case with greenthreads and per-connection things | 20:06 |
| stevemar | ooooh | 20:06 |
| morgan | stevemar: with the no-more-eventlet path, we could simply work around that problme more directly | 20:06 |
| *** shaleh has joined #openstack-keystone | 20:06 | |
| stevemar | nice | 20:07 |
| *** maxabidi has joined #openstack-keystone | 20:07 | |
| morgan | it is easy to maintain a single ldap connection and just check status of it/etc per active process if we aren't doing threads/etc | 20:07 |
| *** shaleh has quit IRC | 20:08 | |
| *** shaleh has joined #openstack-keystone | 20:08 | |
| ayoung | morgan, I say we pursue both approaches. I know that sounds crazy, but since we have so much done on ldap3, seems a pity to throw it a way. And we can use pyldap as a migration measure. RUn them off against each other, and keep whichever is the better tool. But force the config options to be a strict subset of the original options | 20:08 |
| *** sdake_ has joined #openstack-keystone | 20:08 | |
| *** sdake has quit IRC | 20:08 | |
| morgan | ayoung: as long as if we go pyldap we commit to rolling up all the awful "common" code into the driver | 20:09 |
| morgan | ayoung: if it wins that is | 20:09 |
| stevemar | id prefer to not pursue both, but that is sound logic | 20:10 |
| morgan | stevemar: if pyldap is drop in replacement it's easy | 20:10 |
| stevemar | yep | 20:10 |
| roxanaghe | stevemar, agree with you :) | 20:10 |
| morgan | otherwise... i am pretty anti pyldap unless someone is (like roxanaghe ) committed to really doing the work. | 20:10 |
| morgan | which case, i can't stop them | 20:10 |
| morgan | but we have people comitted and actively working on ldap3 | 20:11 |
| roxanaghe | morgan, hah | 20:11 |
| shaleh | I thought ldap3 was perceived to be a better choice | 20:11 |
| shaleh | more pythonic, etc. | 20:11 |
| *** ngupta has quit IRC | 20:11 | |
| stevemar | depends on how good the port of python-ldap to pyldap is :) | 20:11 |
| stevemar | shaleh: it is, but pyldap is supposed to be a drop-in replacement | 20:11 |
| morgan | shaleh: it is for some reasons, but some of the folks at red hat are also concerned about the interfaces and crypto bits | 20:11 |
| roxanaghe | I thought that too and ldap3 code prooved to be very easy to use so far | 20:11 |
| morgan | shaleh: which are valid concerns | 20:11 |
| edtubill | Hi, I had a quick question: Is the k2k auth plugin available for the CLI? I was looking at the code/CLI options and it doesn't seem to be available. | 20:11 |
| morgan | stevemar: ^ bus, you k2k auth :P | 20:12 |
| morgan | edtubill: i recommend asking stevemar on that front :) | 20:12 |
| stevemar | edtubill: the code for that is in keystoneauth | 20:12 |
| ayoung | shaleh, so, yes, if Pythonic is the only criteria. However, it is a wire protocol, old, crufty, and temperamental we have here. And the openldap code is native and battle tested, | 20:12 |
| shaleh | so let the RH folks talk to the ldap3 owner and get it straight. He has seemed reasonable thus far. | 20:12 |
| stevemar | edtubill: but openstackclient needs to migrate to keystoneauth | 20:12 |
| morgan | shaleh: basically if we don't have folks doing work to prove out/parallel pyldap, ldap3 wins by default | 20:13 |
| stevemar | edtubill: i think... knikolla has some experience there too | 20:13 |
| morgan | shaleh: since we have people doing it. | 20:13 |
| ayoung | shaleh, the issue is that ldap3 is python impl of the LDAP protocol. | 20:13 |
| morgan | shaleh: and we can work to fix ldap3 going forward if needed | 20:13 |
| shaleh | ayoung: ah, I see. | 20:13 |
| morgan | if someone wants to run off the two, pyldap needs stake holders contributing | 20:13 |
| edtubill | morgan: oops. I also just realized I asked the question twice on accident ><. stevemar: okay thanks, I was just wondering if it was generally available. | 20:14 |
| morgan | edtubill: not a problem :) | 20:14 |
| morgan | edtubill: i just tossed you over to stevemar cause i knew he knew the answer | 20:14 |
| ayoung | morgan, if ldap3 does not support SASL that is a deal breaker | 20:14 |
| shaleh | ayoung: I had not looked that close at it. I was hoping it was just a sane layer on top of the C code. | 20:14 |
| ayoung | and that is the tricky part | 20:14 |
| ayoung | let me look | 20:14 |
| morgan | ayoung: if it doesn't support SASL, we look at how hard it is to fix it | 20:15 |
| stevemar | :) | 20:15 |
| roxanaghe | ayoung, it does support SASL | 20:15 |
| ayoung | roxanaghe, don't be so quick to say that | 20:15 |
| morgan | ayoung: i would rather see ldap3 win - pure python > c libs | 20:15 |
| roxanaghe | ayoung, hah | 20:15 |
| morgan | in this case. | 20:15 |
| morgan | in most cases. | 20:15 |
| ayoung | roxanaghe, I've seen libraries (like Rabbit) that say they do SASL, but then only implement a small subset | 20:15 |
| roxanaghe | ayoung, I see I guess testing it is the ultimate answer | 20:15 |
| ayoung | morgan, python !> native for security sensitive and perfomrnat stuff | 20:16 |
| roxanaghe | but do we support that in the current code? | 20:16 |
| ayoung | http://ldap3.readthedocs.io/bind.html#sasl | 20:16 |
| shaleh | ayoung: you are showing up pretty late to be complaining about ldap3. We have been talking about it for at least the year I have been here. | 20:16 |
| morgan | ayoung: you throw all of that out in 99% of the cases cause you use python on top of the c-libs | 20:16 |
| morgan | ayoung: i can totally buy if we weren't layering python on top. | 20:16 |
| ayoung | that looks good... | 20:16 |
| morgan | i've been *VERY* impressed with ldap3 | 20:17 |
| ayoung | shaleh, um...I've been participating. You missed the start of this discussion. | 20:17 |
| ayoung | It came up at the summit. I personally like ldap3 | 20:17 |
| bknudson | we wanted ldap3 because python-ldap + ldappool doesn't support python3. | 20:18 |
| bknudson | I don't think we wanted ldap3 just because we wanted to rewrite everything | 20:18 |
| rderose | bknudson ++ | 20:18 |
| morgan | bknudson: ldap3 being more pythonic/easier to use/understand *and* python3 support | 20:19 |
| morgan | bknudson: both peices sold us. | 20:19 |
| ayoung | shaleh, so this was my concern when we first discussed it. At that time, I did not know about pyldap, and thought we were stuck with ldap3. And I do like the ldap3 code better, but then, I hate the existing LDAP code anyway | 20:19 |
| *** mylu has joined #openstack-keystone | 20:19 | |
| shaleh | ayoung: fair points | 20:19 |
| bknudson | ldap3 isn't going to be a drop-in switch for deployers either. The config options are going to be different | 20:19 |
| shaleh | bknudson: we can't mask that? | 20:20 |
| lbragstad | bknudson do we have a bug open for the audit_id + fernet + v2 issues? | 20:20 |
| *** pnavarro has joined #openstack-keystone | 20:20 | |
| ayoung | morgan, shaleh it looks like the ldap3 SASL support is == to python-ldap as far as supported mechanisms. | 20:20 |
| bknudson | shaleh: I don't think it's worth it to try to mask it. the config options are essentially python-ldap symbols | 20:20 |
| stevemar | lbragstad: no | 20:20 |
| lbragstad | stevemar ok - i'm going to open one since I'm working on it now] | 20:21 |
| stevemar | lbragstad: ++ | 20:21 |
| ayoung | Well, except that ldap3 doesn't have to support some legacy ones like kerberos4, which we don't want to deal with anyway | 20:21 |
| ayoung | so...no, that is not true | 20:21 |
| ayoung | the config options are a case of bad coding that I cut and pasted | 20:21 |
| *** mylu has quit IRC | 20:21 | |
| ayoung | and I hated them then, and hate them more now | 20:22 |
| roxanaghe | ayoung, do we use SASL in the current keystone code? | 20:22 |
| ayoung | but we can't change those. | 20:22 |
| ayoung | roxanaghe, it is a possibility | 20:22 |
| ayoung | roxanaghe, I've tested it in the past, and it is an essential feature is some places. But the baseline does not do anything other than simple bind anywhere | 20:22 |
| ayoung | which is, TBH, a horrible Security hole | 20:22 |
| roxanaghe | ayoung, I see | 20:23 |
| ayoung | I thought LDAP could do X509 client auth somehow...let me see what the path is to that. I thought it was SASL | 20:23 |
| roxanaghe | ayoung, also no reason to have simple bind without TLS if we talk about security :) | 20:23 |
| *** notmorgan has joined #openstack-keystone | 20:24 | |
| ayoung | roxanaghe, so, right. I think X509 does not need sasl | 20:24 |
| ayoung | http://www.openldap.org/doc/admin24/tls.html | 20:24 |
| *** morgan has quit IRC | 20:24 | |
| *** notmorgan is now known as morgan | 20:24 | |
| *** maxabidi has quit IRC | 20:24 | |
| lbragstad | stevemar bknudson | 20:24 |
| lbragstad | https://bugs.launchpad.net/keystone/+bug/1577558 | 20:24 |
| openstack | Launchpad bug 1577558 in OpenStack Identity (keystone) "v2.0 fernet tokens audit ids are inconsistent" [Undecided,New] | 20:24 |
| lbragstad | cc dolphm ^ | 20:24 |
| ayoung | "The DN of a client certificate can be used directly as an authentication DN." | 20:24 |
| ayoung | roxanaghe, so, we do enable TLS, and we can specify the auth DN. But I have not tested that with X509...That would be a good one to knock out | 20:25 |
| roxanaghe | ayoung, sounds reasonable | 20:25 |
| *** sheel has quit IRC | 20:25 | |
| stevemar | lbragstad: should backport the fix | 20:25 |
| bknudson | do we have a way to specify the client cert in the ldap config? | 20:25 |
| ayoung | morgan, so, I think I want to do this: | 20:25 |
| ayoung | 1. Pursue ldap3 as the long term rewrite | 20:25 |
| ayoung | 2. hack the existing driver to use pyldap. That should support python2 and 3 | 20:26 |
| morgan | ayoung: i can't stop you. | 20:26 |
| ayoung | deprecate pyldap if the ldap3 driver stands up to testing | 20:26 |
| lbragstad | stevemar tagged it with mitaka-backport-potential | 20:26 |
| *** serverascode_ has joined #openstack-keystone | 20:26 | |
| morgan | i'd rather not move to pyldap unless you *really* need it. | 20:26 |
| morgan | i'm totally ok with current ldap code in keystone dieing | 20:26 |
| morgan | in a deprecation cycle | 20:26 |
| morgan | if it's the only code we don't test py3, i'm content | 20:27 |
| *** andreykurilin___ has joined #openstack-keystone | 20:27 | |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n1079 -- why would keystone have incoming TLS for ldap?? | 20:27 |
| *** annasort has joined #openstack-keystone | 20:27 | |
| bknudson | I don't see a config option for the ldap client cert. | 20:28 |
| *** afazekas_ has joined #openstack-keystone | 20:28 | |
| *** bapalm_ has joined #openstack-keystone | 20:28 | |
| *** bapalm has quit IRC | 20:29 | |
| *** odyssey4me has quit IRC | 20:29 | |
| *** afazekas has quit IRC | 20:29 | |
| *** dstanek has quit IRC | 20:29 | |
| *** serverascode has quit IRC | 20:29 | |
| *** fungi has quit IRC | 20:29 | |
| *** dtroyer has quit IRC | 20:29 | |
| *** andreykurilin__ has quit IRC | 20:29 | |
| bknudson | btw - dhellmann said that if there's any config of keystone that supports python3 we should say we support it in the trove classifiers. | 20:29 |
| morgan | bknudson: today, no. | 20:29 |
| bknudson | I tried running keystone under py3 but it failed in a memcache. Maybe I could disable memcache | 20:29 |
| morgan | bknudson: we have some generic code still that is not 100% python 3...but it's hard to suss out because the way our tests work. | 20:30 |
| *** dtroyer has joined #openstack-keystone | 20:30 | |
| *** andreykurilin___ is now known as andreykurilin__ | 20:30 | |
| bknudson | https://review.openstack.org/#/c/311804/ (or something like it) is needed for oslo.policy release. | 20:31 |
| patchbot | bknudson: patch 311804 - keystone - Remove test_invalid_policy_raises_error | 20:31 |
| *** dstanek has joined #openstack-keystone | 20:31 | |
| *** ChanServ sets mode: +v dstanek | 20:31 | |
| ayoung | morgan, so, I'll get back to you on that. For Tripleo and downstream, I don;t know when we are going to force A Python3 only approach. I think that, from a RH perspective, we are going to need to get another package in to Fedora, EPEL, RDO whatever, and one package is better than two. So, if we go ldap3, I need to figure out where and when. Does ldap3 support python2? I was under the impression that it does, probabl | 20:31 |
| ayoung | y via 6? | 20:31 |
| morgan | ayoung: it afaict works with py2 and py3 | 20:32 |
| morgan | ayoung: just fine | 20:32 |
| *** ngupta has joined #openstack-keystone | 20:32 | |
| *** fungi has joined #openstack-keystone | 20:34 | |
| *** serverascode_ is now known as serverascode | 20:34 | |
| *** odyssey4me has joined #openstack-keystone | 20:35 | |
| ayoung | morgan, ldap3 might be a case where my team would prefer pyldap, but I can honestly go back and say I was overruled. I see both sides. From the plaform perspective, it is better to have only one python library to support, and FreeIPA is A) not going to rewrite and B) already dependant on openldap Native libraries anyway. So there pyldap is certainly the better choice | 20:35 |
| *** adu has joined #openstack-keystone | 20:35 | |
| ayoung | For Keystone, the fact that the work is done coupled with the improved code quality is a big seller | 20:35 |
| *** rderose has quit IRC | 20:35 | |
| bknudson | Can you even have both python-ldap and python-ldap3 installed at the same time? | 20:35 |
| ayoung | bknudson, yes | 20:35 |
| ayoung | bknudson, I don;t think ldap3 sits on any of the ldap namespace | 20:35 |
| bknudson | ok, I thought maybe they both used ldap | 20:36 |
| ayoung | https://review.openstack.org/#/c/296090/ | 20:36 |
| patchbot | ayoung: patch 296090 - keystone - WIP - ldap3 Identity Driver | 20:36 |
| ayoung | import ldap3 | 20:36 |
| *** annasort has quit IRC | 20:37 | |
| bknudson | right, that's ldap3, not the python3 python-ldap | 20:37 |
| *** rderose has joined #openstack-keystone | 20:37 | |
| dstanek | i actualy like the idea of RH maintaining a port of python-ldap | 20:37 |
| bknudson | pyldap is the python3 python-ldap | 20:38 |
| bknudson | and that must use the ldap namespace | 20:38 |
| dstanek | as must as i like the cleaner interface of ldap3, it is nice to rely on the C libs | 20:38 |
| bknudson | the python C libs are also crappy. I used to maintain them for ibm's ldap. | 20:39 |
| *** sileht has quit IRC | 20:39 | |
| ayoung | dstanek, right. I'd like to keep the interface (the config) the same between the two drivers, and really give the ldap3 one a test drive, but be able to maintain the python-ldap based code for a release, using pyldap instead | 20:39 |
| bknudson | ayoung: so is redhat planning to ship pyldap rather than python-ldap? | 20:40 |
| ayoung | bknudson, yes. We need it for our IdM | 20:40 |
| ayoung | bknudson, I don;t know when, though. I can find out | 20:40 |
| bknudson | then all you need is ldappool3 | 20:40 |
| bknudson | (or whatever a python3-enabled ldappool is) | 20:40 |
| *** henrynash has quit IRC | 20:40 | |
| *** sileht has joined #openstack-keystone | 20:41 | |
| *** fangxu has quit IRC | 20:41 | |
| dstanek | ayoung: it sucks that the python-ldap maintainers doesn't was to maintain it | 20:44 |
| ayoung | dstanek, forking is fine for a case like this | 20:44 |
| dstanek | ayoung: it has to be :-) as long as the new thing is maintained then i'm happy | 20:45 |
| *** jaosorior has quit IRC | 20:45 | |
| *** stingaci has joined #openstack-keystone | 20:46 | |
| bknudson | except when pyldap mainters don't want to maintain it and we get another fork | 20:46 |
| *** mylu has joined #openstack-keystone | 20:48 | |
| openstackgerrit | ayoung proposed openstack/keystone: WIP - ldap3 Identity Driver https://review.openstack.org/296090 | 20:49 |
| *** mylu has quit IRC | 20:49 | |
| ayoung | bknudson morgan dstanek so ^^ is just a Pep 8 fix. I'm going to consider that not a sufficient change to void me from +2ing in the future | 20:50 |
| *** stingaci has quit IRC | 20:51 | |
| *** rderose has quit IRC | 20:58 | |
| *** rderose has joined #openstack-keystone | 20:59 | |
| *** dmk0202 has joined #openstack-keystone | 21:00 | |
| *** adu has quit IRC | 21:01 | |
| *** sdake_ has quit IRC | 21:03 | |
| *** sdake has joined #openstack-keystone | 21:03 | |
| morgan | ayoung: pep8 correction is fine imo | 21:04 |
| *** fangxu has joined #openstack-keystone | 21:05 | |
| *** xek_ has joined #openstack-keystone | 21:10 | |
| *** rodrigods has quit IRC | 21:10 | |
| *** rodrigods has joined #openstack-keystone | 21:10 | |
| *** xek has quit IRC | 21:11 | |
| *** dmk0202 has quit IRC | 21:12 | |
| *** jlvillal has quit IRC | 21:12 | |
| *** jlvillal has joined #openstack-keystone | 21:12 | |
| dstanek | ayoung: i'll take a look after dinner | 21:16 |
| *** haplo37 has quit IRC | 21:19 | |
| *** adu has joined #openstack-keystone | 21:21 | |
| *** julim has quit IRC | 21:26 | |
| *** pnavarro has quit IRC | 21:28 | |
| lbragstad | bknudson I noticed something else with our token model | 21:32 |
| lbragstad | bknudson this will fail when run with fernet - for the same reason you pointed out before https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_auth.py#L523 | 21:33 |
| lbragstad | when we go to get the scoped token with the unscoped token, the token_model thinks we're using a v3 model | 21:34 |
| *** roxanaghe has quit IRC | 21:35 | |
| ayoung | lbragstad, fernet does not say token version, does it? | 21:37 |
| lbragstad | ayoung as in can you tell what type of token it is from looking at a fernet token? | 21:38 |
| ayoung | lbragstad, right. We always need to assume V3, and then convert to V2, i thought | 21:38 |
| lbragstad | ayoung yeah - i think that is true... i'm just trying to figure out why the audit ids are generated/passed different for v2 uuid versus v2 fernet | 21:39 |
| lbragstad | the fernet provider code is doing the right thing with the audit ids it gets in the provider | 21:39 |
| lbragstad | but it's passed bogus audit ids from the keystone/token/controller.py:authenticate method | 21:40 |
| bknudson | the token code is way too complicated. | 21:44 |
| lbragstad | ++ | 21:44 |
| bknudson | so why does https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_auth.py#L523 pass? | 21:44 |
| lbragstad | I can't wait for the day where we have one provider | 21:45 |
| bknudson | it's only run on uuid? | 21:45 |
| bknudson | or it's v3? | 21:45 |
| lbragstad | yeah - so that passes on uuid | 21:45 |
| lbragstad | ok - I think I figured it out... | 21:54 |
| *** roxanaghe has joined #openstack-keystone | 21:54 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP: review at own risk: switch to pyldap https://review.openstack.org/311827 | 21:55 |
| lbragstad | ayoung bknudson when we execute this test https://github.com/openstack/keystone/blob/61a135cf7d76f0bf4322d44aed18312c711c1eea/keystone/tests/unit/test_auth.py#L523 | 21:56 |
| lbragstad | we get an unscoped token and then use that to get another unscoped token | 21:56 |
| ayoung | lbragstad, in the test or in the provider? | 21:56 |
| lbragstad | which means we are going to hit https://github.com/openstack/keystone/blob/61a135cf7d76f0bf4322d44aed18312c711c1eea/keystone/token/controllers.py#L183 in the v2 token controller | 21:57 |
| lbragstad | ayoung that is what the test is doing | 21:57 |
| lbragstad | but when we pass the first unscoped token to get a new unscoped token | 21:57 |
| lbragstad | we call token_data=self.token_provider_api.validate_token(old_token) | 21:57 |
| ayoung | as we should | 21:57 |
| *** ninag has quit IRC | 21:57 | |
| *** ametts has quit IRC | 21:57 | |
| lbragstad | which gets into this - https://github.com/openstack/keystone/blob/61a135cf7d76f0bf4322d44aed18312c711c1eea/keystone/token/provider.py#L204 | 21:58 |
| lbragstad | everything looks good, right? | 21:58 |
| ayoung | so far it looks right to me | 21:58 |
| lbragstad | ayoung but... | 21:58 |
| lbragstad | this happens | 21:58 |
| lbragstad | https://github.com/openstack/keystone/blob/61a135cf7d76f0bf4322d44aed18312c711c1eea/keystone/token/provider.py#L295-L298 | 21:58 |
| lbragstad | we call _validate_token(token_id) from within validate_token | 21:59 |
| bknudson | what's validation have to do with it? | 21:59 |
| bknudson | validating the original token? | 21:59 |
| lbragstad | _validate_token() validates the token as if it were a v3 token | 21:59 |
| lbragstad | and returns that v3 token reference to the TokenModel | 21:59 |
| lbragstad | what we should be doing is converting that v3 response to be a v2 response | 22:00 |
| bknudson | we seem to use TokenModel sometimes and a dict other times. | 22:00 |
| lbragstad | like this | 22:00 |
| *** tonytan4ever has joined #openstack-keystone | 22:00 | |
| lbragstad | https://github.com/openstack/keystone/blob/61a135cf7d76f0bf4322d44aed18312c711c1eea/keystone/token/provider.py#L233-L244 | 22:00 |
| bknudson | why convert to a v2 response there? that token isn't being returned it's just being used to fill in the new token. | 22:00 |
| lbragstad | bknudson I would guess that is because the keystone/token/controller.py stuff is expecting things to come back as v2.0 | 22:01 |
| lbragstad | since that is the v2.0 controller | 22:01 |
| lbragstad | for tokens | 22:01 |
| bknudson | I never tried using a v3 token as the original token | 22:03 |
| bknudson | I mean v3 unscoped -> v2 scoped | 22:03 |
| lbragstad | bknudson well - the test is v2 unscoped -> v2 unscoped | 22:05 |
| lbragstad | -> unscoped | 22:05 |
| lbragstad | so the test just gets 3 unscoped tokens | 22:06 |
| bknudson | I tried v3 unscoped -> v3 scoped and that worked. | 22:06 |
| lbragstad | yeah - that makes sense | 22:06 |
| lbragstad | bknudson I think the reason why this is broken is because we use v3 to validate v2 tokens and convert the v3 response to be a v2 response | 22:06 |
| bknudson | what doesn't make sense is that the v2 -> v2 puts a completely random parent audit ID. Where's it getting that? | 22:07 |
| lbragstad | we do that in a few difference places but I don't think we do that in all places | 22:07 |
| bknudson | both v3 and v2 have audit IDs. | 22:07 |
| lbragstad | bknudson right - but they live in difference places in the response | 22:07 |
| bknudson | so there's no reason for this to be broken | 22:07 |
| lbragstad | v2 uses ['access'] and v3 doesn't | 22:08 |
| bknudson | the TokenModel should hide the differences. | 22:08 |
| lbragstad | it should, but it doesn't because we haven't converted the v3 response to be a v2 response before passing it to the token model | 22:09 |
| lbragstad | which is why the model thinks it's dealing with the a v3 token | 22:09 |
| bknudson | v3->v2 conversion should happen in the v2 controller. | 22:10 |
| lbragstad | bknudson yeah - or the v2 controller should call part of the token provider that knows how to do the conversion | 22:10 |
| bknudson | token provider shouldn't know anything about v2 or v3. | 22:10 |
| lbragstad | yeah, it shouldn't | 22:11 |
| lbragstad | right | 22:11 |
| *** fawadkhaliq has quit IRC | 22:11 | |
| *** fawadkhaliq has joined #openstack-keystone | 22:11 | |
| *** stingaci has joined #openstack-keystone | 22:14 | |
| *** markvoelker has quit IRC | 22:15 | |
| *** furface has joined #openstack-keystone | 22:16 | |
| *** stingaci has quit IRC | 22:20 | |
| *** ngupta has quit IRC | 22:20 | |
| openstackgerrit | Julien Danjou proposed openstack/python-keystoneclient: httpclient: remove unused debug kwargs https://review.openstack.org/236739 | 22:23 |
| *** jamielennox|away is now known as jamielennox | 22:25 | |
| *** adu has quit IRC | 22:26 | |
| *** david-lyle has quit IRC | 22:28 | |
| *** navid_ has quit IRC | 22:31 | |
| *** slberger has left #openstack-keystone | 22:33 | |
| *** pgbridge has quit IRC | 22:35 | |
| *** fawadkhaliq has quit IRC | 22:38 | |
| *** fawadkhaliq has joined #openstack-keystone | 22:40 | |
| *** phalmos has quit IRC | 22:42 | |
| lbragstad | bknudson fixed part of it | 22:49 |
| lbragstad | well - at least the audit ids part | 22:49 |
| lbragstad | looks like there are still a bunch of issues with v2 tokens + fernet + revocation events | 22:49 |
| lbragstad | cc ayoung | 22:49 |
| *** edtubill has quit IRC | 22:49 | |
| *** timcline has quit IRC | 22:50 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Fix fernet audit ids for v2.0 https://review.openstack.org/311886 | 22:52 |
| lbragstad | bknudson ayoung ^ | 22:53 |
| *** rodrigods has quit IRC | 22:56 | |
| *** rodrigods has joined #openstack-keystone | 22:56 | |
| *** spzala has quit IRC | 22:59 | |
| *** spzala has joined #openstack-keystone | 23:00 | |
| *** lamt has quit IRC | 23:02 | |
| *** edtubill has joined #openstack-keystone | 23:03 | |
| *** doug-fis_ has quit IRC | 23:04 | |
| *** spzala has quit IRC | 23:04 | |
| *** doug-fish has joined #openstack-keystone | 23:05 | |
| *** pumaranikar has quit IRC | 23:07 | |
| *** nkinder has quit IRC | 23:08 | |
| *** furface has quit IRC | 23:08 | |
| *** markvoelker has joined #openstack-keystone | 23:16 | |
| *** nkinder has joined #openstack-keystone | 23:18 | |
| *** jrist has quit IRC | 23:19 | |
| *** c_soukup has joined #openstack-keystone | 23:20 | |
| *** fawadkhaliq has quit IRC | 23:20 | |
| *** markvoelker has quit IRC | 23:21 | |
| *** tonytan4ever has quit IRC | 23:23 | |
| *** mylu has joined #openstack-keystone | 23:23 | |
| *** fawadkhaliq has joined #openstack-keystone | 23:25 | |
| *** roxanaghe has quit IRC | 23:27 | |
| *** mylu has quit IRC | 23:30 | |
| *** mylu has joined #openstack-keystone | 23:30 | |
| bknudson | I thought the fernet provider says it doesn't support token binding | 23:31 |
| *** gyee has quit IRC | 23:32 | |
| *** c_soukup has quit IRC | 23:33 | |
| *** jrist has joined #openstack-keystone | 23:34 | |
| *** mylu has quit IRC | 23:36 | |
| lbragstad | bknudson it doesn't | 23:36 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Fix fernet audit ids for v2.0 https://review.openstack.org/311886 | 23:37 |
| lbragstad | ayoung ^ that might help with your make fernet default patch | 23:38 |
| bknudson | openstack CLI's version checking is crazy -- http://logs.openstack.org/94/193894/23/check/gate-tempest-dsvm-full/1400d33/logs/devstacklog.txt.gz#_2016-05-02_22_08_47_714 | 23:40 |
| *** edtubill has quit IRC | 23:40 | |
| *** sdake_ has joined #openstack-keystone | 23:41 | |
| *** edtubill has joined #openstack-keystone | 23:43 | |
| *** sdake has quit IRC | 23:43 | |
| *** gordc has quit IRC | 23:43 | |
| *** edtubill has quit IRC | 23:46 | |
| *** doug-fish has quit IRC | 23:46 | |
| *** doug-fish has joined #openstack-keystone | 23:47 | |
| *** doug-fis_ has joined #openstack-keystone | 23:51 | |
| bknudson | apparently you can't have a number anywhere in the path | 23:51 |
| *** mylu has joined #openstack-keystone | 23:51 | |
| *** chlong has joined #openstack-keystone | 23:52 | |
| *** doug-fish has quit IRC | 23:52 | |
| bknudson | hopefully I can use "two" rather than "2" | 23:52 |
| bknudson | I tried it. It's too smart. | 23:54 |
| *** doug-fis_ has quit IRC | 23:55 | |
| *** sdake_ has quit IRC | 23:55 | |
| *** sdake has joined #openstack-keystone | 23:56 | |
| *** sdake has quit IRC | 23:56 | |
| *** sdake has joined #openstack-keystone | 23:57 | |
| *** doug-fish has joined #openstack-keystone | 23:58 | |
| *** sdake has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!