| *** pumarani__ has quit IRC | 00:00 | |
| morgan | bknudson: are we running bandit on keystoneauth because i notices patch 311133 set a mutable default argument | 00:00 |
|---|---|---|
| patchbot | morgan: https://review.openstack.org/#/c/311133/ - keystoneauth - Use betamax hooks to mask fixture results | 00:00 |
| ayoung | jamielennox, erm, maybe language to that effect. I was setting up Keycloak using that, but the older commits should still be working | 00:00 |
| jamielennox | ayoung: yea, i was just browsing to see if i could remember how to pull it apart because i don't need packstack just ipa, ipsilon and keystone | 00:01 |
| ayoung | jamielennox, I really want to think about moving the kerberos enable to the session and then use a generic federation auth plugin | 00:01 |
| jamielennox | i don't want to figure out keycloak | 00:01 |
| ayoung | keycloak is...meh. | 00:01 |
| jamielennox | ayoung: i don't know how we indicate that from CLI without overloading the session params | 00:01 |
| ayoung | john is still working on the installer. Its a clone of the ipsilon one | 00:02 |
| jamielennox | i agree i would like to deprecate the straight kerberos plugin | 00:02 |
| *** julim has joined #openstack-keystone | 00:02 | |
| jamielennox | https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/extras/kerberos.py#L51-L67 | 00:02 |
| jamielennox | i think you should always be using the MappedKerberos one | 00:02 |
| jamielennox | i haven't tested using kerberos as an actual token method for ages | 00:03 |
| ayoung | jamielennox, what if it is a flag on the auth plugin that, when set, does a lazy load of python-gssapi for the associated session? | 00:03 |
| jamielennox | ayoung: the auth plugin is in extras so requires you to have additional stuff installed anyway | 00:03 |
| jamielennox | so it's more explicitly lazy | 00:04 |
| jamielennox | what i would like is to revive https://review.openstack.org/#/c/255056/ and contribute the requests part up as requests-saml | 00:05 |
| patchbot | jamielennox: patch 255056 - keystoneauth - Use SAML2 requests plugin | 00:05 |
| jamielennox | because there is then a really simple base class which does federation but assumes the requests plugin will do all the hard work | 00:05 |
| jamielennox | so kerberos, saml etc would all just be the base "do keystone federation with this requests plugin" | 00:05 |
| jamielennox | but i need to get a saml provider running again for proper testing, and find some people capable of reviewing it | 00:06 |
| *** spzala has quit IRC | 00:07 | |
| *** spandhe has quit IRC | 00:07 | |
| *** pgbridge has quit IRC | 00:11 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Return default value for pkg_version if missing https://review.openstack.org/222042 | 00:15 |
| jamielennox | morgan: that ^ just fixed the merge conflict, can you re +A (when jenkins passes) | 00:16 |
| morgan | jamielennox: feel free to re+a for me. | 00:17 |
| morgan | If it was just a conflict resolve. | 00:17 |
| morgan | jamielennox: done. | 00:19 |
| jamielennox | morgan: i'm looking at the betamax review | 00:20 |
| jamielennox | (and i don't know yolanda's nick) | 00:20 |
| morgan | jamielennox: yolanda she might not be in this channel ATM. | 00:21 |
| *** chlong_ has joined #openstack-keystone | 00:22 | |
| *** chlong_ has quit IRC | 00:22 | |
| jamielennox | i'm trying to figure out what is happening with this prerecord, i'm not a fan of the guessing at creds | 00:23 |
| jamielennox | the find_credentials defaults are v2 terms | 00:23 |
| morgan | Yeah. It's a little odd | 00:24 |
| jamielennox | my feeling is we should know exactly what to add as placeholders | 00:24 |
| jamielennox | for auth we just take out everything in the auth blocks | 00:24 |
| jamielennox | so methods:['password'] remain, but the 'password' section goes entirely | 00:25 |
| jamielennox | safer that guessing for plugins | 00:25 |
| jamielennox | but taking out like project name etc seems dodgy to me, shouldn't you want to keep that? | 00:26 |
| jamielennox | it's going to affect how all subsequent requests are handled | 00:26 |
| *** chlong_ has joined #openstack-keystone | 00:27 | |
| *** chlong_ has quit IRC | 00:28 | |
| jamielennox | oh, well, commented - just i'm not sure where it's going | 00:30 |
| jamielennox | ayoung or stevemar: can you add https://review.openstack.org/#/c/268662/ to your review list for today? will let me move onto the next bit which is always in merge conflict | 00:32 |
| patchbot | jamielennox: patch 268662 - keystonemiddleware - Handle cache invalidate outside cache object | 00:32 |
| *** stingaci has quit IRC | 00:37 | |
| *** lhcheng has quit IRC | 00:49 | |
| *** Ephur has joined #openstack-keystone | 00:53 | |
| *** Ephur has joined #openstack-keystone | 00:53 | |
| *** Ephur has quit IRC | 00:54 | |
| *** ozialien10 has quit IRC | 00:59 | |
| openstackgerrit | Merged openstack/keystoneauth: Refactor variables for fixture and service https://review.openstack.org/311216 | 00:59 |
| *** crinkle has joined #openstack-keystone | 01:03 | |
| *** spzala has joined #openstack-keystone | 01:08 | |
| *** lhcheng has joined #openstack-keystone | 01:08 | |
| *** ChanServ sets mode: +v lhcheng | 01:08 | |
| openstackgerrit | Merged openstack/keystonemiddleware: s3token config with auth URI https://review.openstack.org/312260 | 01:09 |
| *** tqtran has quit IRC | 01:12 | |
| *** spzala has quit IRC | 01:13 | |
| *** Raildo_ has quit IRC | 01:14 | |
| *** EinstCrazy has joined #openstack-keystone | 01:18 | |
| *** edtubill has joined #openstack-keystone | 01:26 | |
| ayoung | jamielennox, looks fine, but I don't understand the need for it. | 01:27 |
| ayoung | Is it roughly that you are making things more like oslo.cache? | 01:27 |
| jamielennox | ayoung: it mimics the oslo.cache interface so we can swap that in later | 01:27 |
| ayoung | jamielennox, and that includes having the invalidation external? | 01:28 |
| jamielennox | ayoung: yea, auth_token's cache was always too opinionated. it told you things like tokeninvalid rather than just being a set/get layer | 01:28 |
| jamielennox | like most other caches | 01:28 |
| ayoung | jamielennox, looks good, +2a | 01:29 |
| jamielennox | ayoung: making that cache a pure get/set layer makes it easier to do the follow on oslo.cache change | 01:29 |
| * jamielennox is getting heaps of +A today | 01:29 | |
| ayoung | jamielennox, I was just noticing that. | 01:31 |
| jamielennox | and they seem to be things that have been open for months | 01:31 |
| ayoung | jamielennox, this is just moving from client to ksa right https://review.openstack.org/#/c/314401/2 | 01:33 |
| patchbot | ayoung: patch 314401 - keystoneauth - Add oauth plugin to keystoneauth | 01:33 |
| jamielennox | ayoung: yea, the base of that was supported in ksc though there was no loading section there | 01:33 |
| jamielennox | ayoung: there's a test script there if you want to play with it | 01:34 |
| ayoung | jamielennox, no desire whatsoever | 01:34 |
| jamielennox | lol, yep | 01:34 |
| ayoung | it makes sense, and if it is not new code, I'm ok with it moving over | 01:34 |
| ayoung | we won't really know if it is broken until someone deploys it in anger, which really means it needs tempest tests | 01:35 |
| jamielennox | there was discussion at summit from dolphm and others how oauth should be used to do self delegation with lesser roles | 01:35 |
| ayoung | or something | 01:35 |
| jamielennox | based on https://gist.github.com/jamielennox/013bbc9e32cfc886fd7b211d191a8909#file-create-oauth-py i'm not sure it's a good fit | 01:35 |
| ayoung | jamielennox, https://review.openstack.org/#/c/314409/ should probably have reused my change id | 01:35 |
| patchbot | ayoung: patch 314409 - keystoneauth - Expose is_admin_project in AccessInfo | 01:35 |
| jamielennox | ayoung: right, if it didn't transfer properly then someone will file a bug which is better than having no implementation at all | 01:35 |
| stevemar | jamielennox: why the sudden use of oauth these days? :) | 01:36 |
| jamielennox | ayoung: which change-id? i didn't know of another implementation | 01:36 |
| ayoung | https://review.openstack.org/#/c/295870/ | 01:36 |
| patchbot | ayoung: patch 295870 - oslo.context - Add is_admin_project check | 01:36 |
| jamielennox | stevemar: because my sub-credential idea was shut down because of it | 01:36 |
| ayoung | aj different one | 01:36 |
| ayoung | that is ksa | 01:36 |
| ayoung | jamielennox, you have one for context too, though | 01:36 |
| jamielennox | and i might have mentioned to murano (or someone) that they existed and could be used instead of trusts for long running auth | 01:37 |
| *** raddaoui has quit IRC | 01:37 | |
| stevemar | jamielennox: makes sense | 01:37 |
| *** lhcheng has quit IRC | 01:37 | |
| stevemar | jamielennox: i was thinking something at ibm needed it *shrugs* | 01:37 |
| jamielennox | stevemar: no, but i do need to do some more learning on oidc | 01:38 |
| jamielennox | ayoung: oh - that's going to be needed and can probably go in as is, but i would like to have the corresponding X_IS_ADMIN_PROJECT bit in from_environ which requires auth_token which requires keystoneauth | 01:39 |
| ayoung | jamielennox, I thought context was what was passed to policy | 01:39 |
| stevemar | jamielennox: leaning oauth1 won't help with oidc :P | 01:39 |
| ayoung | so we need changes in everything | 01:39 |
| jamielennox | stevemar: yea, that was me going through ksa bugs and seeing it removed from docs | 01:39 |
| jamielennox | ayoung: :) | 01:39 |
| jamielennox | ayoung: i think i can fudge the auth_token one so we don't have to wait for a ksa version bump | 01:40 |
| jamielennox | possibly the oslo.context one as well | 01:40 |
| ayoung | jamielennox, does not really matter. lets get all the changes to land, then we can start tackling policies | 01:40 |
| stevemar | man, how am i behind on so many reviews! | 01:40 |
| jamielennox | i'm guessing it'd be kwargs.setdefault('X_IS_ADMIN_PROJECT', True) in from_environ | 01:40 |
| jamielennox | but i'd at least like to get the X_IS_ADMIN_PROJECT bit committed in auth_token in case someone tries to change the name | 01:41 |
| jamielennox | stevemar: also you and i are still not friends for this f*g cold that will not die | 01:42 |
| *** haplo37 has joined #openstack-keystone | 01:44 | |
| morgan | jamielennox: so I made the right choice not hanging out in keystone ;) | 01:44 |
| morgan | jamielennox: infra saved me the Martinelli plague. | 01:44 |
| *** agrebennikov has quit IRC | 01:44 | |
| *** pdardeau has left #openstack-keystone | 01:45 | |
| *** edtubill has quit IRC | 01:45 | |
| jamielennox | morgan: gah, seriously, that thing should go on the border protection watchlist | 01:45 |
| jamielennox | morgan: want to handle https://review.openstack.org/#/c/314409/ - then i can do the auth_token bit | 01:46 |
| patchbot | jamielennox: patch 314409 - keystoneauth - Expose is_admin_project in AccessInfo | 01:46 |
| stevemar | jamielennox: LOL! | 01:47 |
| stevemar | jamielennox: i think topol is just getting over the 'martinellifluenza' | 01:48 |
| stevemar | i kept telling you guys that *i* don't get sick easy, and if something takes *me* out, it's bad times | 01:48 |
| jamielennox | stevemar: i don't get sick easily either, i actually think i managed to carry it, give it to jayne, then that prolonged exposure got me - but that still makes it your fault | 01:51 |
| *** haplo37 has quit IRC | 01:55 | |
| *** haplo37 has joined #openstack-keystone | 01:56 | |
| *** spzala has joined #openstack-keystone | 01:57 | |
| *** phalmos has joined #openstack-keystone | 02:02 | |
| *** TxGVNN has joined #openstack-keystone | 02:02 | |
| openstackgerrit | Ryosuke Mizuno proposed openstack/keystone: Disable user lists without a filter https://review.openstack.org/314829 | 02:02 |
| *** phalmos has quit IRC | 02:07 | |
| jamielennox | stevemar: i think morgan's gone, can you have a look at https://review.openstack.org/#/c/314409/ i don't want to submit the auth_token patch until i know that's going through with those parameter names | 02:13 |
| patchbot | jamielennox: patch 314409 - keystoneauth - Expose is_admin_project in AccessInfo | 02:13 |
| morgan | Oh hi | 02:13 |
| morgan | What's up? | 02:13 |
| jamielennox | morgan: ksa review | 02:14 |
| morgan | Ah | 02:14 |
| jamielennox | morgan: generally not urgent, but it fits in the keystone -> ksa -> auth_token -> oslo.context chain | 02:14 |
| morgan | Right. | 02:14 |
| *** haplo37 has quit IRC | 02:14 | |
| morgan | I will review post dinner for sure. | 02:14 |
| morgan | Chatting with thingee and cburgess over drinks ATM. | 02:15 |
| jamielennox | morgan: oh, then really don't worry about it | 02:15 |
| jamielennox | priorities | 02:15 |
| morgan | Haha. Will def review tonight though. | 02:15 |
| morgan | Kind of on a review kick today. | 02:15 |
| *** phalmos has joined #openstack-keystone | 02:16 | |
| *** spandhe has joined #openstack-keystone | 02:19 | |
| *** gyee has quit IRC | 02:20 | |
| ayoung | jamielennox, still chewing this is_admin_project approach over. What is your rationale that the defaulting logic should be in the ksa instead of keystone server? | 02:22 |
| jamielennox | ayoung: well the logic is that ksa has to handle tokens that are not from a completely up to date keystone, so it has to handle the case where is_admin_project is unset anyway | 02:23 |
| jamielennox | ayoung: so if clients are handling the default in the same way as the server then it doesn't really matter | 02:24 |
| jamielennox | and from the other service perspective the only thing they should ever care about is what auth_token middleware tells them | 02:25 |
| ayoung | jamielennox, so, here's my concern: the default "unset means True" is useful now, but is not a good security default. When we want to move away from that assumption, to tighten things up, it means a change in a library code as opposed to the server defaults. And people might be dependant on that default, and stick with old version of the library | 02:26 |
| ayoung | its not hugem just a sense that Keystone server should really be driving this | 02:27 |
| jamielennox | agreed it's a bad default | 02:27 |
| jamielennox | and i would completely agree that we at some point want to transition people to always setting an admin project | 02:28 |
| jamielennox | but it doesn't change the fact that today ksa _must_ default to True | 02:28 |
| lbragstad | morgan feel like doing another stable/liberty review? https://review.openstack.org/#/c/314728/1 | 02:28 |
| patchbot | lbragstad: patch 314728 - keystone (stable/liberty) - Remove test_invalid_policy_raises_error | 02:29 |
| jamielennox | regardless of what we want to do in future | 02:29 |
| morgan | lbragstad: in a few. | 02:29 |
| lbragstad | morgan thanks | 02:29 |
| jamielennox | so it's then just that we need to deprecate keystone running without admin project defined and start putting False in the token | 02:29 |
| jamielennox | but that would still be reflected correctly by KSA | 02:30 |
| *** EinstCrazy has quit IRC | 02:30 | |
| *** EinstCrazy has joined #openstack-keystone | 02:31 | |
| *** fangxu has quit IRC | 02:31 | |
| *** EinstCrazy has quit IRC | 02:40 | |
| *** EinstCrazy has joined #openstack-keystone | 02:48 | |
| *** richm has quit IRC | 02:52 | |
| *** sheel has joined #openstack-keystone | 02:53 | |
| *** jorge_munoz has quit IRC | 02:53 | |
| openstackgerrit | Merged openstack/keystoneauth: Add oauth plugin to keystoneauth https://review.openstack.org/314401 | 02:54 |
| *** jorge_munoz has joined #openstack-keystone | 02:57 | |
| *** EinstCrazy has quit IRC | 02:59 | |
| *** EinstCrazy has joined #openstack-keystone | 03:07 | |
| *** spzala has quit IRC | 03:12 | |
| *** spzala has joined #openstack-keystone | 03:12 | |
| *** spzala has quit IRC | 03:17 | |
| *** erhudy has quit IRC | 03:21 | |
| *** links has joined #openstack-keystone | 03:21 | |
| *** EinstCra_ has joined #openstack-keystone | 03:24 | |
| *** ankur has joined #openstack-keystone | 03:27 | |
| *** EinstCrazy has quit IRC | 03:28 | |
| *** haplo37 has joined #openstack-keystone | 03:34 | |
| *** phalmos has quit IRC | 03:41 | |
| lbragstad | morgan why did we abandon this change again? https://review.openstack.org/#/c/271536/ | 03:58 |
| patchbot | lbragstad: patch 271536 - keystone - Apply invalidation proxy to the catalog cache region (ABANDONED) | 03:58 |
| lbragstad | morgan looks like the osa folks were waiting on that for a fix (https://github.com/openstack/openstack-ansible-os_keystone/blob/master/templates/keystone.conf.j2#L102-L108) | 03:58 |
| lbragstad | morgan I thought I remember us addressing that shortly after the mid-cycle though | 03:59 |
| *** pcaruana has joined #openstack-keystone | 04:02 | |
| *** edtubill has joined #openstack-keystone | 04:06 | |
| *** spzala has joined #openstack-keystone | 04:13 | |
| *** spzala has quit IRC | 04:18 | |
| morgan | lbragstad: maybe? | 04:19 |
| morgan | lbragstad: no. | 04:20 |
| *** markvoelker_ has joined #openstack-keystone | 04:50 | |
| stevemar | morgan: want to punt https://review.openstack.org/#/c/314728/1 through? | 04:51 |
| patchbot | stevemar: patch 314728 - keystone (stable/liberty) - Remove test_invalid_policy_raises_error | 04:51 |
| morgan | Sec. | 04:52 |
| morgan | Done | 04:53 |
| *** rcernin has joined #openstack-keystone | 04:58 | |
| *** spzala has joined #openstack-keystone | 05:02 | |
| *** jaosorior has joined #openstack-keystone | 05:04 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:05 | |
| *** spzala has quit IRC | 05:07 | |
| *** sdake has quit IRC | 05:08 | |
| *** raddaoui has joined #openstack-keystone | 05:17 | |
| *** furface has quit IRC | 05:18 | |
| *** furface has joined #openstack-keystone | 05:19 | |
| *** roxanaghe has joined #openstack-keystone | 05:25 | |
| *** roxanaghe has quit IRC | 05:39 | |
| *** roxanaghe has joined #openstack-keystone | 05:48 | |
| openstackgerrit | Ryosuke Mizuno proposed openstack/keystone: Disable user lists without a filter https://review.openstack.org/314829 | 05:51 |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/python-keystoneclient: Trivial: ignore openstack/common in flake8 exclude list https://review.openstack.org/314871 | 05:53 |
| *** edtubill has quit IRC | 05:56 | |
| *** roxanaghe has quit IRC | 05:57 | |
| *** roxanaghe has joined #openstack-keystone | 05:57 | |
| *** roxanaghe has quit IRC | 06:01 | |
| *** spandhe has quit IRC | 06:03 | |
| *** spzala has joined #openstack-keystone | 06:03 | |
| *** ankur has quit IRC | 06:07 | |
| *** spzala has quit IRC | 06:09 | |
| *** itlinux has joined #openstack-keystone | 06:18 | |
| *** david-lyle has quit IRC | 06:23 | |
| *** david-lyle has joined #openstack-keystone | 06:26 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Improve docs for v3 users https://review.openstack.org/305796 | 06:28 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Federation Identity Provider functional tests https://review.openstack.org/203258 | 06:33 |
| stevemar | morgan: punted a few others through, and set a few others to be ready-to-merge once the gate is fixed | 06:35 |
| *** naresh_ has joined #openstack-keystone | 06:38 | |
| *** woodster_ has quit IRC | 06:38 | |
| *** naresh_ is now known as Guest77591 | 06:39 | |
| *** haplo37 has quit IRC | 06:39 | |
| *** fawadkhaliq has quit IRC | 06:44 | |
| *** fawadkhaliq has joined #openstack-keystone | 06:44 | |
| *** Guest77591 has quit IRC | 06:48 | |
| *** henrynash has joined #openstack-keystone | 06:48 | |
| *** ChanServ sets mode: +v henrynash | 06:48 | |
| *** naresht has joined #openstack-keystone | 06:49 | |
| naresht | Hi Keystoners | 06:49 |
| naresht | I am trying to do Keystone2Keystone authentication. One Keystone acting as an Identity Provider(Ks-IdP) and the another one acting as a Service Provider(Ks-SP) | 06:50 |
| naresht | I am getting an error while ks-sp asking for user attributes here is the log file http://paste.openstack.org/show/496650/ | 06:53 |
| naresht | This log file from keystone sp | 06:53 |
| *** vgridnev has quit IRC | 06:54 | |
| *** vgridnev has joined #openstack-keystone | 06:56 | |
| naresht | ooopss ...This log file from keystone IdP here is keystone Idp http://paste.openstack.org/show/496653/ | 06:57 |
| naresht | Anyone has experienced such kind of configuration with Keystone/shibboleth/Apache? | 06:57 |
| naresht | Any help will be very appreciated | 06:57 |
| naresht | This is error from Horizon http://paste.openstack.org/show/496654/ | 06:59 |
| *** lhcheng has joined #openstack-keystone | 07:02 | |
| *** ChanServ sets mode: +v lhcheng | 07:02 | |
| *** spzala has joined #openstack-keystone | 07:04 | |
| -openstackstatus- NOTICE: pip 8.1.2 broke our local python mirror, some jobs will fail with "No matching distribution found". We're investigating. Do not "recheck" until the issue is solved | 07:06 | |
| *** ChanServ changes topic to "pip 8.1.2 broke our local python mirror, some jobs will fail with "No matching distribution found". We're investigating. Do not "recheck" until the issue is solved" | 07:06 | |
| *** rcernin has quit IRC | 07:09 | |
| *** furface has quit IRC | 07:09 | |
| *** spzala has quit IRC | 07:09 | |
| *** rcernin has joined #openstack-keystone | 07:10 | |
| *** belmoreira has joined #openstack-keystone | 07:11 | |
| openstackgerrit | Merged openstack/keystoneauth: Expose is_admin_project in AccessInfo https://review.openstack.org/314409 | 07:13 |
| *** fhubik has joined #openstack-keystone | 07:24 | |
| *** daemontool_ has joined #openstack-keystone | 07:26 | |
| *** lhcheng has quit IRC | 07:28 | |
| *** markvoelker_ has quit IRC | 07:30 | |
| *** yolanda has joined #openstack-keystone | 07:37 | |
| *** chlong has quit IRC | 07:49 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** fhubik has quit IRC | 08:02 | |
| *** fhubik has joined #openstack-keystone | 08:03 | |
| *** fhubik has quit IRC | 08:04 | |
| *** fhubik has joined #openstack-keystone | 08:05 | |
| *** spzala has joined #openstack-keystone | 08:05 | |
| *** dmk0202 has joined #openstack-keystone | 08:08 | |
| *** spzala has quit IRC | 08:10 | |
| *** fawadkhaliq has quit IRC | 08:14 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:15 | |
| *** daemontool_ has quit IRC | 08:18 | |
| *** daemontool_ has joined #openstack-keystone | 08:20 | |
| *** vgridnev has quit IRC | 08:22 | |
| *** vgridnev has joined #openstack-keystone | 08:24 | |
| *** fawadkhaliq has quit IRC | 08:25 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:25 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Improve docs for v3 users https://review.openstack.org/305796 | 08:32 |
| *** mhickey has joined #openstack-keystone | 08:32 | |
| naresht | Hi Keystoners I am trying to do Keystone2Keystone authentication. One Keystone acting as an Identity Provider(Ks-IdP) and the another one acting as a Service Provider(Ks-SP) | 08:37 |
| naresht | Hi Keystoners I am trying to do Keystone2Keystone authentication. One Keystone acting as an Identity Provider(Ks-IdP) and the another one acting as a Service Provider(Ks-SP) | 08:37 |
| naresht | I am getting an error while ks-sp asking for user attributes here is the log file http://paste.openstack.org/show/496653/ | 08:37 |
| naresht | This is error from Horizon http://paste.openstack.org/show/496654/ | 08:37 |
| *** jistr has joined #openstack-keystone | 08:38 | |
| *** vgridnev has quit IRC | 08:39 | |
| *** rha has quit IRC | 08:44 | |
| *** markvoelker has joined #openstack-keystone | 08:48 | |
| *** markvoelker has quit IRC | 08:55 | |
| *** spzala has joined #openstack-keystone | 09:07 | |
| *** spzala has quit IRC | 09:11 | |
| *** tesseract has joined #openstack-keystone | 09:20 | |
| *** daemontool_ has quit IRC | 09:21 | |
| *** daemontool_ has joined #openstack-keystone | 09:22 | |
| *** raddaoui has quit IRC | 09:27 | |
| *** fawadkhaliq has quit IRC | 09:32 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:32 | |
| *** daemontool_ has quit IRC | 09:40 | |
| *** daemontool_ has joined #openstack-keystone | 09:40 | |
| *** daemontool_ has quit IRC | 09:40 | |
| *** daemontool_ has joined #openstack-keystone | 09:40 | |
| *** dolphm has quit IRC | 09:50 | |
| *** dolphm has joined #openstack-keystone | 09:51 | |
| *** ChanServ sets mode: +o dolphm | 09:51 | |
| *** naresht has quit IRC | 09:58 | |
| *** spzala has joined #openstack-keystone | 10:08 | |
| *** daemontool_ has quit IRC | 10:08 | |
| *** daemontool_ has joined #openstack-keystone | 10:08 | |
| *** markvoelker has joined #openstack-keystone | 10:10 | |
| *** stevemar has quit IRC | 10:13 | |
| *** spzala has quit IRC | 10:13 | |
| *** tsufiev has joined #openstack-keystone | 10:14 | |
| *** markvoelker has quit IRC | 10:15 | |
| *** stevemar has joined #openstack-keystone | 10:15 | |
| tsufiev | morning, folks! | 10:16 |
| tsufiev | recently the failure rate for Horizon integration tests has increased significantly, after reading the logs I got an impression that Keystone may be involved | 10:16 |
| tsufiev | the specific part that looks suspiciously to me is http://logs.openstack.org/42/236042/62/check/gate-horizon-dsvm-integration/d8d590e/logs/apache/keystone.txt.gz#_2016-05-10_18_10_43_036 | 10:17 |
| tsufiev | which was traced back from http://logs.openstack.org/42/236042/62/check/gate-horizon-dsvm-integration/d8d590e/logs/apache/horizon_error.txt.gz#_2016-05-10_18_10_43_932655 which in turn traced back from http://logs.openstack.org/42/236042/62/check/gate-horizon-dsvm-integration/d8d590e/console.html#_2016-05-10_18_26_13_342 | 10:17 |
| *** daemontool_ has quit IRC | 10:17 | |
| *** daemontool has joined #openstack-keystone | 10:18 | |
| *** chaithu has joined #openstack-keystone | 10:18 | |
| tsufiev | could someone advice if the first ^^^ fragment in Keystone logs is an expected behavior, or something that should be dug into? | 10:19 |
| *** jed56 has quit IRC | 10:44 | |
| *** EinstCra_ has quit IRC | 10:46 | |
| *** daemontool has quit IRC | 10:48 | |
| *** jistr is now known as jistr|mtg | 11:00 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Trivial: ignore openstack/common in flake8 exclude list https://review.openstack.org/314871 | 11:03 |
| *** markvoelker has joined #openstack-keystone | 11:04 | |
| *** ChanServ sets mode: +o stevemar | 11:04 | |
| *** tellesnobrega is now known as tellesnobrega_af | 11:08 | |
| *** spzala has joined #openstack-keystone | 11:09 | |
| *** markvoelker has quit IRC | 11:09 | |
| samueldmq | morning keystone | 11:12 |
| *** spzala has quit IRC | 11:14 | |
| *** rodrigods has quit IRC | 11:20 | |
| *** rodrigods has joined #openstack-keystone | 11:20 | |
| *** jaosorior has quit IRC | 11:22 | |
| *** jaosorior has joined #openstack-keystone | 11:22 | |
| samueldmq | tsufiev: hi, good morning | 11:26 |
| tsufiev | hi! | 11:26 |
| samueldmq | tsufiev: looking at the logs, there was a call to change that user's password just above | 11:27 |
| samueldmq | tsufiev: http://logs.openstack.org/42/236042/62/check/gate-horizon-dsvm-integration/d8d590e/logs/apache/keystone.txt.gz#_2016-05-10_18_10_42_995 | 11:27 |
| tsufiev | yes, that's true - we're testing that change password works | 11:27 |
| tsufiev | the problem is that we cannot login back with the password we changed | 11:27 |
| tsufiev | with the _new_ password | 11:27 |
| samueldmq | tsufiev: are you sure the new password is the one used ? | 11:28 |
| tsufiev | samueldmq, yes, because if it weren't that way, the test would fail permanently | 11:29 |
| samueldmq | tsufiev: is this always failing ? or does it pass sometimes ? | 11:29 |
| tsufiev | but it is intermittent | 11:29 |
| * samueldmq nods | 11:29 | |
| samueldmq | tsufiev: this is on master branch right? | 11:30 |
| tsufiev | yep | 11:30 |
| tsufiev | I got an impression that we may have hit https://bugs.launchpad.net/keystone/+bug/1473567 | 11:30 |
| openstack | Launchpad bug 1473567 in tempest "Fernet tokens fail tempest runs" [Undecided,Fix released] - Assigned to Lance Bragstad (lbragstad) | 11:30 |
| *** yiorgos_272 has joined #openstack-keystone | 11:30 | |
| *** belmoreira has quit IRC | 11:31 | |
| samueldmq | tsufiev: there was a tempest test failing recently | 11:32 |
| samueldmq | tsufiev: it was related to token invalidation | 11:32 |
| samueldmq | tsufiev: in your case you are not able to use the new credentials, which is odd | 11:32 |
| tsufiev | samueldmq, so you think that it's not related to above bug? | 11:33 |
| samueldmq | tsufiev: maybe it is | 11:34 |
| samueldmq | tsufiev: are you able to reproduce the error locally? | 11:34 |
| tsufiev | samueldmq, not yet | 11:36 |
| samueldmq | how can I run that test in a devstack? | 11:41 |
| chaithu | Hi All | 11:42 |
| chaithu | We are trying to do keystone to keystone federation. We are following this blog http://rodrigods.com/it-is-time-to-play-with-keystone-to-keystone-federation-in-kilo/ | 11:42 |
| samueldmq | tsufiev: do I need to add openstack_dashboard to LIBS_FROM_GIT in devstack? | 11:43 |
| chaithu | We got unscoped token. When we are trying to get the list of federated projects using unscoped token. We got an error http://paste.openstack.org/show/496702/ | 11:43 |
| chaithu | This is how we are trying to get the list of federated projects http://paste.openstack.org/show/496701/ | 11:44 |
| tsufiev | samueldmq, that's more complicated | 11:44 |
| tsufiev | samueldmq, you would need to run https://github.com/openstack/horizon/blob/master/openstack_dashboard/test/integration_tests/tests/test_user_settings.py#L64 | 11:46 |
| *** fawadkhaliq has quit IRC | 11:46 | |
| *** jamie_h has quit IRC | 11:46 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:47 | |
| tsufiev | samueldmq, https://github.com/openstack/horizon/blob/master/tox.ini#L105 - here is tox command for running integration tests | 11:48 |
| chaithu | Any help will be highly appreciated. | 11:48 |
| tsufiev | 1. clone horizon repo. 2. tox -epy27integration -- openstack_dashboard.test.integration_tests.tests.test_user_settings:TestPasswordChange.test_show_message_after_logout | 11:49 |
| * samueldmq nods | 11:50 | |
| *** ChanServ changes topic to "Keystone Midcycle Update: http://lists.openstack.org/pipermail/openstack-dev/2016-May/094574.html | Hosted By Cicso, July 20-22, 170 W Tasman Dr, San Jose, CA 95134" | 11:57 | |
| -openstackstatus- NOTICE: We have a workaround for our mirrors to attempt to translate package names if a match isn't immediately obvious. A more complete fix is yet to come. It is now safe to 'recheck' any jobs that failed due to "No matching distribution found". Please join #openstack-infra if you discover more problems. | 11:57 | |
| *** markvoelker has joined #openstack-keystone | 11:58 | |
| *** markvoelker has quit IRC | 12:03 | |
| *** EinstCrazy has joined #openstack-keystone | 12:04 | |
| *** EinstCrazy has quit IRC | 12:05 | |
| *** raildo-afk is now known as raildo | 12:08 | |
| *** spzala has joined #openstack-keystone | 12:10 | |
| *** jistr|mtg is now known as jistr | 12:11 | |
| *** amrith has joined #openstack-keystone | 12:11 | |
| amrith | stevemar, yt? | 12:12 |
| *** spzala has quit IRC | 12:15 | |
| *** richm has joined #openstack-keystone | 12:30 | |
| rodrigods | stevemar, there? or morgan | 12:31 |
| *** EinstCrazy has joined #openstack-keystone | 12:32 | |
| *** openstackgerrit has quit IRC | 12:33 | |
| *** openstackgerrit has joined #openstack-keystone | 12:33 | |
| *** EinstCrazy has quit IRC | 12:35 | |
| *** ayoung has quit IRC | 12:36 | |
| *** EinstCrazy has joined #openstack-keystone | 12:40 | |
| *** jamielennox is now known as jamielennox|away | 12:45 | |
| *** belmoreira has joined #openstack-keystone | 12:46 | |
| rodrigods | chaithu, can you paste the code your are using? seems you haven't configured an IdP | 12:48 |
| *** daemontool has joined #openstack-keystone | 12:51 | |
| *** edtubill has joined #openstack-keystone | 12:51 | |
| *** links has quit IRC | 12:52 | |
| *** markvoelker has joined #openstack-keystone | 12:52 | |
| *** daemontool has quit IRC | 12:53 | |
| *** jamielennox|away is now known as jamielennox | 12:53 | |
| *** daemontool has joined #openstack-keystone | 12:53 | |
| *** erhudy has joined #openstack-keystone | 12:54 | |
| *** sdake has joined #openstack-keystone | 12:55 | |
| *** gagehugo has joined #openstack-keystone | 12:55 | |
| *** jamie_h has joined #openstack-keystone | 12:56 | |
| *** markvoelker has quit IRC | 12:57 | |
| *** pauloewerton has joined #openstack-keystone | 12:58 | |
| *** sdake_ has joined #openstack-keystone | 12:58 | |
| chaithu | rodrigods: We got unscoped token. When we are trying to get the list of federated projects using unscoped token. We got an error http://paste.openstack.org/show/496702/ | 12:59 |
| rodrigods | chaithu, did you add role assignments for the group/user in the mapping? | 13:00 |
| chaithu | rodrigods: This is how we are trying to get the list of federated projects http://paste.openstack.org/show/496701/ | 13:00 |
| *** jaugustine has joined #openstack-keystone | 13:00 | |
| chaithu | rodrigods:http://paste.openstack.org/show/496720/ | 13:01 |
| *** sdake has quit IRC | 13:02 | |
| *** zqfan has quit IRC | 13:03 | |
| *** mou has joined #openstack-keystone | 13:03 | |
| *** edmondsw has joined #openstack-keystone | 13:04 | |
| chaithu | rodrigods: I think No. This is the mapping file http://paste.openstack.org/show/496720/ . | 13:05 |
| chaithu | rodrigods: could you review the mapping once ? | 13:06 |
| *** Nakato has quit IRC | 13:08 | |
| *** Nakato has joined #openstack-keystone | 13:08 | |
| *** dave-mccowan has quit IRC | 13:09 | |
| rodrigods | chaithu, did you create the group and user? | 13:10 |
| *** spzala has joined #openstack-keystone | 13:11 | |
| chaithu | rodrigods: Yes created in SP http://paste.openstack.org/show/496723/ | 13:12 |
| *** gordc has joined #openstack-keystone | 13:13 | |
| rodrigods | chaithu, and added mapped_user to federated group | 13:13 |
| rodrigods | and added a role assignment for federated group in a project? | 13:14 |
| *** jsavak has joined #openstack-keystone | 13:14 | |
| *** spzala has quit IRC | 13:16 | |
| chaithu | rodrigods: Yes we added | 13:19 |
| *** spzala has joined #openstack-keystone | 13:20 | |
| rodrigods | chaithu, need to investigate the logs and etc, it might be a bug, not sure | 13:21 |
| *** edtubill has quit IRC | 13:25 | |
| chaithu | rodrigods: Here is the keystone.log in IdP http://paste.openstack.org/show/496727/ might be helpfull | 13:25 |
| chaithu | sorry here is the link http://paste.openstack.org/show/496725/ | 13:26 |
| rodrigods | chaithu, you need to check the keystone SP log, since is the one who is denying the call | 13:26 |
| *** BAKfr has quit IRC | 13:26 | |
| chaithu | rodrigods: It seems good in log file. This is the SP log shibd.log http://paste.openstack.org/show/496727/ | 13:27 |
| rodrigods | chaithu, keystone SP, i meant, sorry :) | 13:27 |
| *** dave-mccowan has joined #openstack-keystone | 13:28 | |
| *** BAKfr has joined #openstack-keystone | 13:28 | |
| chaithu | Here is the Keystone SP log http://paste.openstack.org/show/496728/ | 13:29 |
| lbragstad | morgan do you remember why we didn't merge/continue with that? (re: https://review.openstack.org/#/c/271536/) | 13:30 |
| patchbot | lbragstad: patch 271536 - keystone - Apply invalidation proxy to the catalog cache region (ABANDONED) | 13:30 |
| rodrigods | chaithu, invalid token? that's odd | 13:31 |
| rodrigods | chaithu, need to dig in the code to understand what's going on | 13:32 |
| morgan | lbragstad: nope | 13:32 |
| rodrigods | can you print the token? i can check later | 13:33 |
| chaithu | Unscoped token id: f6e8ba81393841a7953566e2d28ec4bf | 13:33 |
| rodrigods | morgan, there you are... i don't think we want to add more stuff in this folder: https://review.openstack.org/#/c/203258/ | 13:33 |
| patchbot | rodrigods: patch 203258 - keystone - Federation Identity Provider functional tests | 13:33 |
| rodrigods | chaithu, not the ID, the content | 13:33 |
| rodrigods | morgan, see my comment | 13:34 |
| *** daemontool has quit IRC | 13:34 | |
| chaithu | rodrigods: http://paste.openstack.org/show/496731/ Is that you are asking | 13:35 |
| *** rderose has joined #openstack-keystone | 13:35 | |
| rodrigods | chaithu, what happens if you try to list the domains? OS-FEDERATION/domains | 13:36 |
| samueldmq | tsufiev: you still around ? | 13:36 |
| samueldmq | tsufiev: when have those failures started appearing ? | 13:37 |
| tsufiev | samueldmq, yes. I'm going to apply the same fix as tempest folks did | 13:37 |
| tsufiev | I think a week or two ago | 13:37 |
| samueldmq | tsufiev: what was the fix ? | 13:37 |
| chaithu | rodrigods: The same error http://paste.openstack.org/show/496732/ | 13:37 |
| morgan | rodrigods: yeah that was why I did +2 not +A before, didn't know where/if it ran. | 13:37 |
| tsufiev | but that may be simply a result of faster hardware | 13:37 |
| morgan | rodrigods: we can bug stevemar about this today. | 13:37 |
| tsufiev | samueldmq, time.sleep(1) after logout | 13:38 |
| rodrigods | morgan, ok | 13:38 |
| *** jed56 has joined #openstack-keystone | 13:38 | |
| *** chlong has joined #openstack-keystone | 13:38 | |
| samueldmq | tsufiev: ok, not sure about this approach, better to check with lbragstad and dolphm | 13:38 |
| tsufiev | well, it wouldn't hurt anyways | 13:38 |
| *** tonytan4ever has joined #openstack-keystone | 13:38 | |
| samueldmq | tsufiev: it shouldn't be related to the token type (uuid, fernet, whatever) | 13:39 |
| rodrigods | chaithu, hmm try /v3/auth/projects | 13:39 |
| samueldmq | tsufiev: since it's the passwd that has changed, and the auth workflow should just work :( | 13:39 |
| rodrigods | instead of OS-FEDERATION/projects | 13:40 |
| tsufiev | samueldmq, then why did tempest test fail in the first place? | 13:40 |
| tsufiev | I'm talking about https://bugs.launchpad.net/horizon/+bug/1473567 | 13:41 |
| openstack | Launchpad bug 1473567 in OpenStack Dashboard (Horizon) "Fernet tokens fail tempest runs" [High,New] - Assigned to Timur Sufiev (tsufiev-x) | 13:41 |
| rodrigods | chaithu, btw, which version are you using? the token has "saml2" method, which is kind of "old" | 13:41 |
| samueldmq | tsufiev: I don't know about that one | 13:43 |
| samueldmq | tsufiev: there was another recent failure that started appearing when fernet were made the default | 13:44 |
| chaithu | rodrigods: with /v3/auth/projects same error | 13:45 |
| tsufiev | samueldmq, I'm all ears | 13:46 |
| *** markvoelker has joined #openstack-keystone | 13:46 | |
| bknudson | we're going to have to revert the change to switch to fernet as the devstack if we can't figure out these bugs quickly. | 13:47 |
| samueldmq | tsufiev: I need to check with lbragstad | 13:47 |
| samueldmq | bknudson: I agree with you, we need to solve that somehow, and putting sleep() everywhere shouldn't be the solution | 13:47 |
| lbragstad | bknudson I'm rechecking patches that have more logging proposed to tempest - hoping to get more information since I'm unable to recreate it locally | 13:48 |
| samueldmq | lbragstad: you have links for such tests ? I am also unable to reproduce locally | 13:48 |
| bknudson | ok, as long as someone's working on it. I don't have time lately. | 13:48 |
| lbragstad | https://review.openstack.org/#/c/314330/ | 13:48 |
| patchbot | lbragstad: patch 314330 - tempest - Do not merge - add logging for bug 1578866 | 13:48 |
| openstack | bug 1578866 in OpenStack Identity (keystone) "test_user_update_own_password failing intermittently" [High,Confirmed] https://launchpad.net/bugs/1578866 | 13:48 |
| samueldmq | lbragstad: such tests/such patches | 13:48 |
| lbragstad | and jordanP has one up too https://review.openstack.org/#/c/314121/ | 13:49 |
| patchbot | lbragstad: patch 314121 - tempest - WIP : also log Auth-Token | 13:49 |
| chaithu | rodrigods: We are using "saml2" | 13:49 |
| samueldmq | tsufiev: this is the other error I was talking about ^(see bug aboce) | 13:49 |
| samueldmq | above* | 13:49 |
| rodrigods | chaithu, openstack version i meant | 13:49 |
| chaithu | rodrigods: Both are liberty | 13:50 |
| *** fawadkhaliq has quit IRC | 13:50 | |
| *** fawadkhaliq has joined #openstack-keystone | 13:50 | |
| tsufiev | samueldmq, thanks! added the bug reference to my patch https://review.openstack.org/#/c/315050/ | 13:55 |
| patchbot | tsufiev: patch 315050 - horizon - In integration tests wait 1 second after changing ... | 13:55 |
| *** markvoelker has quit IRC | 13:55 | |
| *** kfox1111 has joined #openstack-keystone | 13:56 | |
| kfox1111 | v3 validate token question.... | 13:56 |
| kfox1111 | the is_admin bit. is that returned in the json doc somewhere too? | 13:56 |
| *** ametts has joined #openstack-keystone | 13:56 | |
| *** spzala has quit IRC | 13:57 | |
| samueldmq | tsufiev: hmm nice description in the commit | 13:57 |
| *** spzala has joined #openstack-keystone | 13:57 | |
| samueldmq | lbragstad: maybe all these errors are related to the fact fernet doesn't support subsecond precision? | 13:57 |
| *** daemontool has joined #openstack-keystone | 13:58 | |
| kfox1111 | I see is_admin referenced in the V2TokenDataHelper, but nothing in v3. | 13:59 |
| tsufiev | I did my best :D | 14:00 |
| *** ayoung has joined #openstack-keystone | 14:01 | |
| *** ChanServ sets mode: +v ayoung | 14:01 | |
| *** links has joined #openstack-keystone | 14:01 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:01 | |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add helper methods for generating policy info https://review.openstack.org/314774 | 14:01 |
| *** spzala has quit IRC | 14:02 | |
| *** jed56 has quit IRC | 14:04 | |
| *** jed56 has joined #openstack-keystone | 14:05 | |
| *** rderose has quit IRC | 14:06 | |
| *** jed56 has quit IRC | 14:07 | |
| *** jed56 has joined #openstack-keystone | 14:07 | |
| ayoung | henrynash, what if, as a precursor to https://review.openstack.org/#/c/310048/7 we create a mechanism (config option) that says the name of a project is the full path of that project, from domain, through all partend. So if I have Domain D and create a project with name=P, the name as reported will be D/P and if I add a child Q I get D/P/Q as the project name? Or, if the / is going to mess people up, we could do it Python style D.P.Q | 14:07 |
| patchbot | ayoung: patch 310048 - keystone-specs - Relax the project name uniqueness constraints | 14:07 |
| *** rderose has joined #openstack-keystone | 14:07 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add identity providers integration tests https://review.openstack.org/302299 | 14:07 |
| ayoung | Heh...we could have P, add D, then add Q, then add Bach and get P.D.Q.Bach | 14:08 |
| *** jed56 has quit IRC | 14:08 | |
| *** jed56 has joined #openstack-keystone | 14:09 | |
| chaithu | rodrigods: You are referring to liberty or openstack 2.0.0 ? | 14:09 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 14:09 |
| *** fawadkhaliq has quit IRC | 14:10 | |
| *** fawadkhaliq has joined #openstack-keystone | 14:10 | |
| *** daemontool has quit IRC | 14:13 | |
| *** jed56 has quit IRC | 14:15 | |
| *** jed56 has joined #openstack-keystone | 14:15 | |
| *** fawadkhaliq has quit IRC | 14:15 | |
| *** woodburn has quit IRC | 14:15 | |
| *** jaosorior has quit IRC | 14:16 | |
| *** jed56 has quit IRC | 14:18 | |
| *** jed56 has joined #openstack-keystone | 14:18 | |
| *** TxGVNN has quit IRC | 14:22 | |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add policy registration https://review.openstack.org/313141 | 14:27 |
| *** sdake_ has quit IRC | 14:28 | |
| *** sdake has joined #openstack-keystone | 14:29 | |
| *** spzala has joined #openstack-keystone | 14:29 | |
| *** woodburn has joined #openstack-keystone | 14:30 | |
| *** jsavak has quit IRC | 14:30 | |
| *** jsavak has joined #openstack-keystone | 14:30 | |
| *** daemontool has joined #openstack-keystone | 14:31 | |
| *** jed56 has quit IRC | 14:31 | |
| *** jed56 has joined #openstack-keystone | 14:32 | |
| *** rderose has quit IRC | 14:32 | |
| *** sdake has quit IRC | 14:35 | |
| *** gagehugo has quit IRC | 14:36 | |
| *** TxGVNN has joined #openstack-keystone | 14:41 | |
| *** gagehugo has joined #openstack-keystone | 14:42 | |
| *** navidp has joined #openstack-keystone | 14:42 | |
| *** jaosorior has joined #openstack-keystone | 14:43 | |
| *** slberger has joined #openstack-keystone | 14:44 | |
| *** edtubill has joined #openstack-keystone | 14:44 | |
| *** daemontool has quit IRC | 14:45 | |
| *** jed56 has quit IRC | 14:47 | |
| *** jed56 has joined #openstack-keystone | 14:47 | |
| *** pgbridge has joined #openstack-keystone | 14:49 | |
| *** woodster_ has joined #openstack-keystone | 14:50 | |
| *** timcline has joined #openstack-keystone | 14:51 | |
| *** raddaoui has joined #openstack-keystone | 14:52 | |
| *** spzala has quit IRC | 14:53 | |
| *** spzala has joined #openstack-keystone | 14:53 | |
| *** links has quit IRC | 14:54 | |
| *** fhubik has quit IRC | 14:55 | |
| *** daemontool has joined #openstack-keystone | 14:55 | |
| ayoung | morgan, as I work to reduce the number of revocation events, I'm starting to bump into the detailed caching we have on the token. For exmaple, right now, I have Broken the TokenCacheInvalidation set, as now checking a token validation needs to check that the project is not disabled in the backend | 14:56 |
| *** jaosorior has quit IRC | 14:57 | |
| ayoung | Should I treat the whole thing as cached, and put the project and user ids into the caches, somehow, or create real proejct and user objects in the backends? | 14:58 |
| morgan | ayoung: hmm | 14:58 |
| morgan | Don't validate project enabled in the token creation/validation. Assert its enabled from above the token system maybe and pass the ID down. We already (if caching is enabled at all) never check the back end more than once for users or projects. | 15:00 |
| dstanek | bknudson: what do you think we should do merge identity and shadow users? | 15:01 |
| morgan | Maybe? | 15:01 |
| bknudson | we've done this in the past when we split assignment from identity | 15:01 |
| *** pgbridge has quit IRC | 15:01 | |
| bknudson | dstanek: rather than using foreign keys notifications were used to tell the other managers/drivers that things were deleted (for example) | 15:02 |
| *** sdake has joined #openstack-keystone | 15:03 | |
| dstanek | bknudson: iirc, i asked why we just didn't update the identity driver and that was to save other driver implementation (like LDAP) from having to implement shadow users. and i think the compromise was that we wanted to reuse the existing user table to prevent unnecessary churn | 15:03 |
| *** navidp has quit IRC | 15:04 | |
| dstanek | lbragstad: is ron in the office? it would be useful to have time in here | 15:05 |
| *** haplo37 has joined #openstack-keystone | 15:05 | |
| *** slberger1 has joined #openstack-keystone | 15:05 | |
| lbragstad | dstanek he is | 15:05 |
| lbragstad | dstanek i manually pinged him | 15:05 |
| lbragstad | dstanek he's on his way | 15:06 |
| *** rderose has joined #openstack-keystone | 15:06 | |
| *** slberger has quit IRC | 15:07 | |
| lbragstad | fyi - this is the patch in question https://review.openstack.org/#/c/292611/ | 15:07 |
| patchbot | lbragstad: patch 292611 - keystone - Move identity.backends.sql model code to sql_model.py | 15:07 |
| rderose | dstanek, bknudson: just getting on, any new thoughts on this? | 15:07 |
| dstanek | rderose: i'll repeat my last statement so that you can comment on it's accuracy | 15:08 |
| bknudson | I'm in a meeting for a while so won't be able to have a conversation here. | 15:08 |
| *** spandhe has joined #openstack-keystone | 15:08 | |
| dstanek | iirc, i asked why we just didn't update the identity driver and that was to save other driver implementation (like LDAP) from having to implement shadow users. and i think the compromise was that we wanted to reuse the existing user table to prevent unnecessary churn | 15:08 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add authorize method to Enforcer https://review.openstack.org/313142 | 15:08 |
| dstanek | bknudson: np, we can discuss a little and you can chime in when you have time | 15:09 |
| rderose | dstanek: agree and to me it just made sense to reuse the user table. Essentially, wanted to create a model that unified all identities. | 15:10 |
| frickler | are there plans to release keystoneauth1 for stable/[lm]*? | 15:10 |
| * frickler would like to finally get rid of the username deprecation messages everywhere | 15:11 | |
| rderose | dstanek: and I don't see an issue with having shadow users and the identity sql backends both depending on the same sql model | 15:11 |
| rderose | dstanek bknudson: anyway, I posted a comment, I'm open to suggestions. | 15:12 |
| *** dan_nguyen has joined #openstack-keystone | 15:13 | |
| dstanek | rderose: ok, when bknudson is back we should have a little design pow-wow here | 15:13 |
| rderose | dstanek: cool. I have a 10:30, but should be free afterwards | 15:13 |
| *** jistr has quit IRC | 15:13 | |
| dstanek | it would be nice to get this all figured out to make some progress here | 15:13 |
| rderose | dstanek: yep, for sure | 15:13 |
| dstanek | rderose: are you central today? | 15:14 |
| rderose | dstanek: yes | 15:14 |
| dstanek | cool, thx | 15:14 |
| *** pgbridge has joined #openstack-keystone | 15:20 | |
| *** fawadkhaliq has joined #openstack-keystone | 15:22 | |
| *** edtubill has quit IRC | 15:22 | |
| *** edtubill has joined #openstack-keystone | 15:23 | |
| *** spandhe has quit IRC | 15:23 | |
| *** EinstCrazy has quit IRC | 15:23 | |
| *** spandhe has joined #openstack-keystone | 15:24 | |
| arunkant | dstanek: Can you review this ..https://review.openstack.org/#/c/279828/ ? | 15:25 |
| patchbot | arunkant: patch 279828 - keystonemiddleware - Adding audit middleware specific notification driv... | 15:25 |
| *** jsavak has quit IRC | 15:27 | |
| *** AJaeger has joined #openstack-keystone | 15:28 | |
| dstanek | arunkant: yeah, it's on my list of todos, but i've got lots of todos unfortunately | 15:28 |
| *** tonytan_brb has joined #openstack-keystone | 15:28 | |
| *** jsavak has joined #openstack-keystone | 15:28 | |
| AJaeger | keystone team, with publishing of the generated config file at http://docs.openstack.org/developer/keystone/sample_config.html do you still need to have the proposal job for the in-tree file? Or can we remove job and file? | 15:29 |
| *** mou has quit IRC | 15:29 | |
| AJaeger | stevemar: I think you set the initial job up ^ | 15:29 |
| *** mou has joined #openstack-keystone | 15:29 | |
| *** jsavak has quit IRC | 15:30 | |
| arunkant | dstanek, okay..hopefully you will look into this soon. I have been trying to get it reviewed and approved from keystoners for quite some time. | 15:30 |
| *** jsavak has joined #openstack-keystone | 15:30 | |
| stevemar | frickler: i'll be releasing a whole bunch of L and M stuff soon | 15:31 |
| *** amrith is now known as _amrith_ | 15:31 | |
| *** tonytan4ever has quit IRC | 15:31 | |
| *** jistr has joined #openstack-keystone | 15:31 | |
| stevemar | AJaeger: i think people like the compiled etc/keystone.conf.sample in-tree | 15:32 |
| AJaeger | stevemar: and we prefer not to have these proposal jobs ;) | 15:32 |
| dstanek | stevemar: AJaeger: if ours tests don't require it then i'm not tied to it | 15:32 |
| rodrigods | stevemar, can you take a look in my comment at https://review.openstack.org/#/c/203258/ ? i don't think we want to put things in that folder anymore | 15:32 |
| patchbot | rodrigods: patch 203258 - keystone - Federation Identity Provider functional tests | 15:32 |
| AJaeger | it would free you from approving them ;) | 15:33 |
| *** _amrith_ is now known as amrith | 15:33 | |
| *** jistr has quit IRC | 15:33 | |
| stevemar | AJaeger: looks like i am over-ruled on this one | 15:33 |
| henrynash | ayoung: so to your suggestion of having a config switch that would return nams as paths... | 15:33 |
| *** jistr has joined #openstack-keystone | 15:33 | |
| stevemar | we can periodically check in new sample configs i guess | 15:33 |
| AJaeger | stevemar, dstanek feel free t odiscuss in your next IRC meeting on what to do... | 15:34 |
| stevemar | AJaeger: i guess you can remove the job, seems no one but me likes it | 15:34 |
| stevemar | bknudson: did you have any strong feelings on this one? | 15:34 |
| *** belmoreira has quit IRC | 15:34 | |
| bknudson | stevemar: no strong feelings | 15:34 |
| AJaeger | stevemar: let me propose something and add you to the change for review, so that you can think a bit more... | 15:34 |
| AJaeger | thanks! | 15:34 |
| ayoung | henrynash, Ideally it would be triggered by the "strict" option we already have, but that might be too much to backport. It should depend on "strict" though | 15:35 |
| henrynash | ayoung: …and so what would this give us? | 15:35 |
| ayoung | henrynash, a step closer to the uniqueness | 15:36 |
| henrynash | ayoung: we could also allow the use of paths in auth, but would be optional | 15:36 |
| ayoung | this way, even if we have two [project that get named "London" one would be London/England and the other London/Massachusetts | 15:36 |
| ayoung | henrynash, maybe drop the domain name from my suggestion, though, as that would break exisitng top level | 15:37 |
| henrynash | ayoung: yes, agreed. | 15:37 |
| ayoung | and we don't say projet names haveto be globally unque, just within domains, right? | 15:37 |
| henrynash | ayoung: correct | 15:38 |
| *** spandhe has quit IRC | 15:38 | |
| AJaeger | https://review.openstack.org/315130 is the change to remove the proposal job, stevemar | 15:38 |
| ayoung | Lets call this HMT naming | 15:38 |
| henrynash | ayoung: ….and would you be able to use HMT naming in auth? | 15:39 |
| ayoung | henrynash, yes | 15:39 |
| ayoung | henrynash, that is the point. the project.name would be the HMT naming, even if created with just the segment | 15:40 |
| ayoung | keeps the letter of the law, gives us the new intent | 15:40 |
| henrynash | ayoung: what if auth just has: project name = “test” | 15:40 |
| henrynash | ayoung: do we assume it is at the top level…or can be anywhere (this is the rub with the current proposal) | 15:41 |
| henrynash | ayoung: (anywhere in the domain) | 15:41 |
| ayoung | if test is at the top level, no change. if tet is under nash, then its new name is nahs/test | 15:41 |
| henrynash | ayoung: which breaks today’s call semantics | 15:42 |
| ayoung | henrynash, it is an explicit change made by a domain admin...maybe we could do this on a per domain basis? | 15:42 |
| henrynash | ayoung: eek | 15:42 |
| ayoung | henrynash, have aglobal default. but with a domain level config you could override | 15:43 |
| henrynash | ayoung: we could certainly do that.... | 15:43 |
| *** ramishra has quit IRC | 15:44 | |
| henrynash | ayoung: One issue I have is that from domain admin point of view, what’s their advantage of them turning this on? Not sure it let’s them do anything they can’t do today.... | 15:44 |
| ayoung | henrynash, it would have to be opt in to start, or we would break everyone. why not opt in per domain? | 15:44 |
| henrynash | ayoung: (I know why WE like it….but) | 15:44 |
| ayoung | henrynash, clone: | 15:45 |
| ayoung | we want a templte that has: | 15:45 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add identity providers integration tests https://review.openstack.org/302299 | 15:45 |
| ayoung | top level dev/qa/live under each we want 3 projects frontend/appserver/database | 15:45 |
| *** ramishra has joined #openstack-keystone | 15:46 | |
| henrynash | ayoung: ok, so tree operations | 15:47 |
| ayoung | at each level, the project name is unique, but it forces them to be consistent | 15:47 |
| *** lhcheng has joined #openstack-keystone | 15:47 | |
| *** ChanServ sets mode: +v lhcheng | 15:47 | |
| ayoung | if you do it by naming convention, then you could have wordpress/dev/frontend under etherpad/stage/database | 15:47 |
| *** rcernin has quit IRC | 15:47 | |
| henrynash | ayoung: ah, right (light bulb….I see where you are going with this) | 15:48 |
| ayoung | henrynash, and if you change a project name (we allow that, right?)then all the child project names change, too | 15:49 |
| ayoung | but we still enforce global uniqeness | 15:49 |
| henrynash | ayoung: interesting…. | 15:49 |
| henrynash | ayoung: off to mull….(thinking….not the Isle Of….) | 15:51 |
| ayoung | henrynash, and not preparing beverages for the colder months, either unfortunately | 15:52 |
| henrynash | ayoung: never to early.... | 15:52 |
| ayoung | henrynash, play with the idea. I think it is what you are looking for, maybe with additional tweaking | 15:53 |
| henrynash | ayoung: could be indeed, sir….nice thinking | 15:54 |
| *** jsavak has quit IRC | 16:01 | |
| *** jsavak has joined #openstack-keystone | 16:02 | |
| *** fawadkhaliq has quit IRC | 16:02 | |
| *** roxanaghe has joined #openstack-keystone | 16:03 | |
| *** ninag has joined #openstack-keystone | 16:05 | |
| *** rderose has quit IRC | 16:06 | |
| *** dmk0202 has quit IRC | 16:07 | |
| *** pgbridge has quit IRC | 16:07 | |
| *** ninag has quit IRC | 16:08 | |
| *** lhcheng has quit IRC | 16:09 | |
| *** jaugustine has quit IRC | 16:09 | |
| *** pushkaru has joined #openstack-keystone | 16:09 | |
| *** rderose has joined #openstack-keystone | 16:10 | |
| *** ninag has joined #openstack-keystone | 16:11 | |
| *** gyee has joined #openstack-keystone | 16:13 | |
| *** ChanServ sets mode: +v gyee | 16:13 | |
| *** amrith has left #openstack-keystone | 16:17 | |
| *** agrebennikov has joined #openstack-keystone | 16:17 | |
| morgan | henrynash: i am thinking project=test *is* only top lev3l | 16:18 |
| morgan | fwiw | 16:18 |
| morgan | ayoung: the other thing to keep in mind... the name can't exceed 255 characters in total due to the schema we use | 16:18 |
| henrynash | morgan: in my origional proposal………or what adam is suggesting? | 16:19 |
| morgan | this is sounding more and more like HMT needs love and microversions can get us there. | 16:19 |
| morgan | basically we force a microversion that makes subprojects have restricted characters and end up with the X.Y.Z.Q nameing | 16:19 |
| morgan | or something | 16:19 |
| morgan | and you always reference the whole path for the name? | 16:19 |
| morgan | that way name can be consistent. | 16:19 |
| * morgan has been sleeping on this issue fwiw | 16:20 | |
| henrynash | morgan: on microversioning…..in general, do we want a linear increasing version…or two we want a “capability map” accessible pre-auth? | 16:21 |
| morgan | henrynash: monotonic increasing version | 16:21 |
| morgan | not semver/capabilities. | 16:21 |
| *** rderose has quit IRC | 16:21 | |
| henrynash | morgan: is that a cross-project decision? | 16:21 |
| morgan | and we will need to move auth out from under the <versioned> CRUD api generally for sanity. | 16:21 |
| morgan | henrynash: it's the way nova does it, the way ironic does. | 16:22 |
| morgan | i'm inclined to say we should follow in suit | 16:22 |
| morgan | it is much much much simpler than needing to make a capabilities graph | 16:22 |
| henrynash | morgan: do they have any config settings that modify the meaning of APIs? | 16:23 |
| morgan | outside of the versions, not that i am aware of | 16:23 |
| morgan | which is the right answer | 16:23 |
| morgan | afaiac | 16:23 |
| henrynash | morgan: ok, understand the proposal.... | 16:23 |
| morgan | using API version XXX means you get features/responses of XXX | 16:23 |
| *** chaithu has quit IRC | 16:24 | |
| morgan | if we work to improve HMT and change the APIs so the real featuresets are based in the new microversion(s) so we can say to do the proper naming, we now reserve characterset [.,/], and you must be using the new version to be able to do the proper nested projects with auth capabilities. | 16:25 |
| *** ninag has quit IRC | 16:25 | |
| morgan | it also means some people might need to rename projects long term for support in HMT things | 16:25 |
| morgan | e.g. if a project uses a reserved char in the name we don't allow HMT things with it | 16:26 |
| *** ninag has joined #openstack-keystone | 16:26 | |
| morgan | simple changes, microversion based. gets us to where you want to be. | 16:26 |
| morgan | if you don't specify the path, it's a top-level "today" project | 16:26 |
| morgan | and we can work on improving auth things to be smarter as we version auth (once it's split from CRUD apis) | 16:26 |
| ayoung | morgan, so one backward compat issue is if a project is nested today, but the name is flat, we will break them if we force name to be the path. I was trying to avoid that | 16:27 |
| morgan | henrynash: and GET / (or [prefix]/) on keystone can say "we support version X -> Y of the microversions | 16:27 |
| ayoung | microversions won't fix that | 16:27 |
| morgan | ayoung: we basically leave it as is today and don't try and solve that issue. it's semi-broken today | 16:28 |
| morgan | ayoung: and we document how it is broken make sure it's clear <this is the correct way forward with new microversion thing> | 16:28 |
| ayoung | morgan, then how do we co-existg with the brokeness is a way that lets us move forward, too? | 16:28 |
| morgan | ayoung: it is a little sucky for end users, but we're providing a clear path forward that will be better | 16:28 |
| ayoung | morgan, that is why I like per-domain | 16:29 |
| morgan | ayoung: i'd flag projects that need "fixing" | 16:29 |
| morgan | and anything flagged as such, can't work with the nested bits (even provide a reporting tool so an operator can cleanup/fix) and/or proper responses from the API for end users to indicate what is wrong | 16:30 |
| ayoung | morgan, I'd rather not have to get things to 100% clean before a deployer can move forward, otherwise, they are never going to move | 16:30 |
| morgan | ayoung: i also am fine with leaving it "unique names per domain" long term | 16:30 |
| morgan | ayoung: and you don't get nested name collisions. | 16:30 |
| *** ninag has quit IRC | 16:30 | |
| ayoung | morgan, so, if the whole path is the name, then, yes, names stay unique | 16:30 |
| morgan | ayoung: i'm trying to offer a way to unwind this if we're loosening the restrictions | 16:30 |
| morgan | ayoung: personally, i'd just keep it as is. | 16:31 |
| ayoung | morgan, yeah, I think there is a path through here that makes use of all the tools | 16:31 |
| morgan | ayoung: and say "sorry names are unique per domain" | 16:31 |
| morgan | let people deal with that in how they name things | 16:31 |
| ayoung | morgan, but that way I can't retrocatively win an argument I lost 3 years ago. | 16:31 |
| morgan | ayoung: i'm not here for your retroactive argument winnings. | 16:31 |
| morgan | :P | 16:32 |
| *** rderose has joined #openstack-keystone | 16:32 | |
| ayoung | morgan, you are not? I was mislead. | 16:32 |
| ayoung | seriously, though, I think we can make this work. I wanted the full path for the project name for a while anyway | 16:32 |
| morgan | ayoung: the only concern is we cannnnnnnnot have a name that exceeds 255 | 16:32 |
| morgan | and right now, you could (with full path) be x*255.Y*255.Z*255.<maxnestdepth> | 16:33 |
| ayoung | morgan, that was due to the database column | 16:33 |
| morgan | ayoung: and it's a behavior in our API we can't break... microversion *can* be used here. | 16:33 |
| ayoung | not due to any other concern. If we build the name from parent then the restriction should be 255 per segment | 16:33 |
| morgan | but the baseline would not work with those new names. | 16:33 |
| ayoung | morgan, you mean because of the JSON scheme enforcement> | 16:34 |
| ayoung | ? | 16:34 |
| morgan | yep. | 16:34 |
| morgan | don't change the behavior of a non-experimental API | 16:34 |
| morgan | until microversions, then microversions would be a version bumpt to fix things. | 16:34 |
| * morgan had a conversation with lifeless that convinced me microversions are not as evil as originally thought. | 16:35 | |
| *** ninag has joined #openstack-keystone | 16:35 | |
| morgan | and it does back us out of a corner we're in. | 16:35 |
| *** mhickey has quit IRC | 16:35 | |
| morgan | but we need to be *very* strict about not breaking API contracts otherwise. (and i'll continue to be strict on that front here as much as I can) | 16:36 |
| ayoung | morgan, to be blunt, who cares? What is making things less restrictive than origianlly published going to break? I'm all for supporting end users, but this is pedantry for its own sake. I mean, I'm not against microversions (at all, I think I want them) , but that is not the standard we should judge this by. If a change is not going to break backwards compat, the worst that I could se happening is that people would have bult tooling that rest | 16:36 |
| ayoung | ricts what they can entr to the old rules. | 16:36 |
| ayoung | But I don't thnk microversions are a saviour here. They are, again, pedantically correct, and should be used for these kind of changes, but we've been doing that, just not ultra strcitly | 16:37 |
| ayoung | strictly. | 16:37 |
| *** fangxu has joined #openstack-keystone | 16:38 | |
| *** ninag has quit IRC | 16:38 | |
| *** ninag has joined #openstack-keystone | 16:38 | |
| ayoung | We've made lots of behavior changes over time, and only now do we have a rule in place "we can't be less strict than in the past." | 16:39 |
| ayoung | I mean, yeah, I could see it being tricky for WebUI. | 16:39 |
| ayoung | morgan, how about this | 16:39 |
| ayoung | I think this is a backwards compat change. | 16:39 |
| ayoung | We create a new field for projects (optional) | 16:40 |
| ayoung | called name_segment | 16:40 |
| ayoung | On a per domain basis, we allow that to be used in place of name for editing. | 16:40 |
| ayoung | If that value is set, the name becomes the full path....gah,that hits the JSON scheme restriction.... | 16:40 |
| *** tellesnobrega_af is now known as tellesnobrega | 16:41 | |
| ayoung | maybe not, actually. If you can never set the name IFF it is in segments, then the JSON schema is still valid when accepting a new project or changed project | 16:42 |
| ayoung | We would overflow the schema only on reads, but I don't think that is validated | 16:42 |
| ayoung | and, what we are discussing doing here would still require webUI changes in order to take advantage of it anyway | 16:43 |
| ayoung | morgan, OK, lets talk microversions for a moment. What would it take for Keystone to implement microversions? | 16:43 |
| ayoung | lets say we want to allow name-segments. Lets say the API microversion to do that is 3.8, and anything less does not do nested. | 16:44 |
| *** phalmos has joined #openstack-keystone | 16:44 | |
| morgan | ayoung: sec. doing something need to ask you a question off channel | 16:44 |
| *** fawadkhaliq has joined #openstack-keystone | 16:53 | |
| openstackgerrit | Merged openstack/keystone: Make keystone exit when fernet keys don't exist https://review.openstack.org/311811 | 16:53 |
| *** jorge_munoz_ has joined #openstack-keystone | 16:57 | |
| *** jorge_munoz has quit IRC | 16:57 | |
| *** jorge_munoz_ is now known as jorge_munoz | 16:57 | |
| *** belmoreira has joined #openstack-keystone | 16:58 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/315058 | 17:00 |
| ayoung | morgan, backto the microversion thing. If you do the nested version of a project name (MV>=7.8 = S.P.Q.R ... something longer than 255 chars. What would I get if I tried to query it with MV < 7.8? Error code? | 17:01 |
| morgan | ayoung: ok. | 17:01 |
| ayoung | 7.8 should read 3.8 but you get it | 17:01 |
| morgan | bad request | 17:01 |
| ayoung | OK....I can deal with that | 17:01 |
| ayoung | I think.... | 17:01 |
| *** jistr has quit IRC | 17:02 | |
| morgan | and the error should communicate why | 17:02 |
| ayoung | morgan, so, I think I would still want it on a per domain basis. Just thinking like a sysadmin here, they are not going to want to force all of their users to change. So we would need some degree of granularity to say "this is where it is OK to do that" | 17:03 |
| *** AJaeger has left #openstack-keystone | 17:03 | |
| ayoung | morgan, lets call this Full Path Naming, and what we have now as segment only naming (for this discussion only) and so I would want to say that if a site has 10000 projects, of which say, 30% are nested via HMT, we can't break those 30 to enable Full path naming. | 17:05 |
| ayoung | So we could say: ok, this domain is 98% of the way there, we can enable it, and then break those 2 projects that need to be updated | 17:05 |
| ayoung | hmmm | 17:05 |
| *** stingaci has joined #openstack-keystone | 17:06 | |
| ayoung | list projects for user is not going to work though, is it? | 17:06 |
| ayoung | Ah! | 17:06 |
| morgan | yeah | 17:06 |
| ayoung | OK so if MV < 3.8 it gets the safe names. if MV >= 3.8 it gets the full list, with the names in path format | 17:06 |
| morgan | yes | 17:06 |
| morgan | exactly | 17:07 |
| morgan | you're starting to get it. | 17:07 |
| ayoung | morgan, and to start, we say the default mv is < 3.8 so we don't break existing, and people that want to use it request 3.8 | 17:08 |
| *** BAKfr has quit IRC | 17:08 | |
| ayoung | or "latest" | 17:08 |
| ayoung | default ==stable. "latest" =new hotness | 17:08 |
| ayoung | morgan, can you drop your -2 to a -1 and I | 17:09 |
| morgan | basically default is "before microversions" | 17:09 |
| morgan | comment on the way forward on the review and i'll drop my -2. | 17:10 |
| morgan | just so we have it recorded there. | 17:10 |
| *** BjoernT has joined #openstack-keystone | 17:10 | |
| morgan | vs. just in IRC :) | 17:10 |
| ayoung | actually, lets get a spec for microversions (even a placeholder) up first | 17:10 |
| ayoung | want me to dothat? | 17:10 |
| *** spzala has quit IRC | 17:10 | |
| morgan | please do. | 17:10 |
| *** roxanaghe has quit IRC | 17:10 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 17:10 |
| ayoung | OK...I'll get that up | 17:10 |
| *** BAKfr has joined #openstack-keystone | 17:10 | |
| morgan | aslo ping sdague and maybe nova folks to 2x check the microversion spec. | 17:10 |
| morgan | make sure we're not wildly off-base from their general approach | 17:11 |
| morgan | we want to follow in suit to keep things as common as we can in openstack :) | 17:11 |
| *** ninag has quit IRC | 17:11 | |
| *** fawadkhaliq has quit IRC | 17:12 | |
| *** ninag has joined #openstack-keystone | 17:12 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the assignment abstract base class out of core https://review.openstack.org/299635 | 17:14 |
| *** jed56 has quit IRC | 17:14 | |
| *** spzala has joined #openstack-keystone | 17:14 | |
| *** roxanaghe has joined #openstack-keystone | 17:15 | |
| *** ninag has quit IRC | 17:16 | |
| *** tqtran has joined #openstack-keystone | 17:18 | |
| *** rderose has quit IRC | 17:18 | |
| *** henrynash has quit IRC | 17:18 | |
| *** rderose has joined #openstack-keystone | 17:19 | |
| *** ninag has joined #openstack-keystone | 17:19 | |
| *** spzala has quit IRC | 17:19 | |
| *** ninag has quit IRC | 17:21 | |
| *** simondodsley has joined #openstack-keystone | 17:23 | |
| *** jsavak has quit IRC | 17:23 | |
| *** ninag has joined #openstack-keystone | 17:23 | |
| *** ninag has quit IRC | 17:24 | |
| *** ninag_ has joined #openstack-keystone | 17:25 | |
| *** stingaci has quit IRC | 17:25 | |
| *** stingaci has joined #openstack-keystone | 17:26 | |
| *** ninag__ has joined #openstack-keystone | 17:27 | |
| morgan | dstanek, stevemar: ping re @wip | 17:29 |
| dstanek | morgan: pong | 17:29 |
| morgan | dstanek, stevemar: we should make @wip take "expected exception" and bugid=<id> | 17:29 |
| *** ninag_ has quit IRC | 17:30 | |
| dstanek | i wouldn't have any issue with that | 17:30 |
| morgan | so we can optionally track the exception expected *and* what bug it's blocking on if possible | 17:30 |
| morgan | would generally be better. | 17:30 |
| * morgan will propose this in a few moments. | 17:30 | |
| morgan | dstanek: just doing massive code review and realizing @wip needs to be better. | 17:30 |
| *** openstackgerrit has quit IRC | 17:33 | |
| *** openstackgerrit has joined #openstack-keystone | 17:33 | |
| dstanek | morgan: no argument from me :-) | 17:34 |
| *** sileht has quit IRC | 17:37 | |
| ayoung | morgan, placeholder spec https://review.openstack.org/315180 Microversions | 17:38 |
| *** timcline has quit IRC | 17:41 | |
| *** spzala has joined #openstack-keystone | 17:43 | |
| *** sileht has joined #openstack-keystone | 17:44 | |
| dstanek | hmm... so what is the difference between Higgins and Magnum? | 17:45 |
| *** rbridgeman has joined #openstack-keystone | 17:46 | |
| *** TxGVNN has quit IRC | 17:46 | |
| *** henrynash has joined #openstack-keystone | 17:47 | |
| *** ChanServ sets mode: +v henrynash | 17:47 | |
| *** timcline has joined #openstack-keystone | 17:48 | |
| *** rbridgeman has quit IRC | 17:48 | |
| *** rbridgeman has joined #openstack-keystone | 17:48 | |
| rodrigods | dstanek, morgan, http://docs.openstack.org/developer/tempest/HACKING.html#test-skips-because-of-known-bugs | 17:53 |
| morgan | dstanek: higgens is more COE abstraction | 17:54 |
| dstanek | rodrigods: that's not the saw as wip | 17:54 |
| morgan | (generalized) i think. | 17:54 |
| *** belmoreira has quit IRC | 17:54 | |
| rodrigods | dstanek, so i think we need to differ between wip and skip_due_a_bug | 17:54 |
| dstanek | morgan: looks like i need to look at how openstack does container things | 17:55 |
| dstanek | rodrigods: what do you mean? | 17:55 |
| rodrigods | dstanek, sometimes we want to skip things to fix the bug in a follow up patch | 17:55 |
| rodrigods | and sometimes is indeed a wip | 17:56 |
| rodrigods | right? | 17:56 |
| dstanek | rodrigods: wip has a very specific purpose in that it is test code that you expect to fail. in the case where you fix the code in a follow up patch you would just need to remove the @wip | 17:57 |
| dstanek | in that case wip or skip are both fine | 17:57 |
| dstanek | wip's real value is that it'll fail the test if it accidentally succeeds | 17:58 |
| zzzeek | morgan: this is kind of a bad week for me to get aroudn to dogpile reviews since we're moving to a new house next week. but the reviews are in my inbox for when i get through it | 17:58 |
| morgan | zzzeek: wfm | 17:58 |
| morgan | zzzeek: also, enjoy the new house! | 17:59 |
| zzzeek | morgan: oh also my gerrit just passed. hm. guess that bug went away. | 17:59 |
| * zzzeek runs it again | 17:59 | |
| zzzeek | err my jenkins build | 17:59 |
| zzzeek | morgan: thanks! | 17:59 |
| rodrigods | dstanek, hmm thought this skip_because would do the same | 18:00 |
| rodrigods | but yeah, it needs to fail if passes | 18:00 |
| rodrigods | not just "skip" | 18:00 |
| morgan | dstanek: i should have this patch posted for review shortly | 18:01 |
| morgan | dstanek: this is 1st pass, not added testing, will do testing if you like the new @wip | 18:02 |
| *** stingaci has quit IRC | 18:05 | |
| amakarov | morgan, can you please comment on this one: https://review.openstack.org/#/c/309146/ ? Why can't we cache that way? | 18:18 |
| patchbot | amakarov: patch 309146 - keystone - Pre-cache new tokens | 18:18 |
| morgan | amakarov: yes will do | 18:20 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add new functionality to @wip https://review.openstack.org/315198 | 18:20 |
| morgan | dstanek: ^ | 18:20 |
| *** jsavak has joined #openstack-keystone | 18:22 | |
| *** spandhe has joined #openstack-keystone | 18:25 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Switch to use `new_domain_ref` for testcases https://review.openstack.org/284510 | 18:25 |
| *** dan_nguyen has quit IRC | 18:26 | |
| stevemar | morgan: ^ ... in about 2 seconds when the next one is uploaded | 18:28 |
| *** krotscheck_ has joined #openstack-keystone | 18:30 | |
| dstanek | morgan: nice | 18:31 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Switch to use `new_domain_ref` for testcases https://review.openstack.org/284510 | 18:31 |
| *** krotscheck has quit IRC | 18:31 | |
| dstanek | amakarov: i'm guessing line 281 at least | 18:32 |
| *** jsavak has quit IRC | 18:32 | |
| *** krotscheck_ is now known as krotscheck | 18:33 | |
| *** jsavak has joined #openstack-keystone | 18:34 | |
| *** belmoreira has joined #openstack-keystone | 18:34 | |
| *** dave-mccowan has quit IRC | 18:35 | |
| *** tonytan_brb has quit IRC | 18:36 | |
| *** spandhe has quit IRC | 18:36 | |
| *** jorge_munoz has quit IRC | 18:36 | |
| *** stingaci has joined #openstack-keystone | 18:37 | |
| amakarov | dstanek, were you talking to me? :) | 18:38 |
| dstanek | amakarov: yes, for that cache review | 18:38 |
| amakarov | dstanek, oh, I see... | 18:39 |
| dstanek | amakarov: i'm guessing that there is some login in there that isn't supposed to be cached | 18:39 |
| *** jorge_munoz has joined #openstack-keystone | 18:40 | |
| *** jorge_munoz has quit IRC | 18:41 | |
| *** jorge_munoz has joined #openstack-keystone | 18:42 | |
| amakarov | dstanek, so the logic is to be token type aware, isn't it? | 18:42 |
| dstanek | amakarov: i'd have to really take a look at it to see what logic isn't cachable | 18:45 |
| *** jorge_munoz_ has joined #openstack-keystone | 18:46 | |
| amakarov | dstanek, I wonder why can't we use token_id as a cache key if we pass it around anyway... | 18:46 |
| amakarov | dstanek, OTOH 8Kb cache key in case of PKI is a bit insane | 18:47 |
| *** jorge_munoz has quit IRC | 18:47 | |
| *** jorge_munoz_ is now known as jorge_munoz | 18:47 | |
| *** sdake has quit IRC | 18:48 | |
| *** tesseract has quit IRC | 18:51 | |
| *** edtubill has quit IRC | 18:52 | |
| *** dave-mccowan has joined #openstack-keystone | 18:53 | |
| *** dan_nguyen has joined #openstack-keystone | 18:54 | |
| *** mou1 has joined #openstack-keystone | 18:56 | |
| *** vgridnev_ has joined #openstack-keystone | 18:57 | |
| *** vgridnev_ has quit IRC | 18:57 | |
| *** mou has quit IRC | 18:59 | |
| *** tonytan4ever has joined #openstack-keystone | 18:59 | |
| *** roxanaghe has quit IRC | 19:00 | |
| *** vgridnev_ has joined #openstack-keystone | 19:00 | |
| morgan | stevemar: rebase? | 19:00 |
| stevemar | morgan: yes, but a hell of one, so double check it... | 19:01 |
| morgan | stevemar: because it looks pretty much the same? | 19:01 |
| morgan | stevemar: yeah 2x reading | 19:01 |
| morgan | stevemar: it looks ok to me | 19:02 |
| morgan | nothing looks wrong, lets see what jenkins says | 19:02 |
| stevemar | morgan: alrighty | 19:02 |
| stevemar | yep | 19:02 |
| morgan | stevemar: also https://review.openstack.org/315198 eyes would be nice. | 19:02 |
| stevemar | morgan: rgr | 19:02 |
| morgan | just see if you like the direction | 19:02 |
| stevemar | morgan: i like it, just one thing for readability | 19:04 |
| stevemar | morgan: so https://review.openstack.org/#/c/302299/ vs https://review.openstack.org/#/c/203258/ | 19:04 |
| patchbot | stevemar: patch 302299 - keystone - Add identity providers integration tests | 19:04 |
| patchbot | stevemar: patch 203258 - keystone - Federation Identity Provider functional tests | 19:04 |
| stevemar | morgan: i think we should abandon marek's in favor of rodrigods patch | 19:06 |
| stevemar | since umm, one runs tests in the gate :) | 19:06 |
| morgan | stevemar: wfm | 19:06 |
| stevemar | rodrigods: let me know if you need eyes on that patch | 19:07 |
| morgan | stevemar: also the lack of space was intentional, look at line 78 on that patch | 19:07 |
| morgan | stevemar: it would be readable with the bugid added | 19:07 |
| stevemar | morgan: yeah, i see that | 19:07 |
| morgan | stevemar: trying to avoid variable space/non-space/whatevers | 19:08 |
| * morgan shrugs. | 19:08 | |
| stevemar | morgan: i get ya | 19:10 |
| stevemar | morgan: ready for https://review.openstack.org/#/c/279828/ ? | 19:10 |
| patchbot | stevemar: patch 279828 - keystonemiddleware - Adding audit middleware specific notification driv... | 19:10 |
| stevemar | i'm on the fence for this one :O | 19:11 |
| morgan | stevemar: i don't like the guessing | 19:11 |
| morgan | i really don't | 19:11 |
| gyee | ayoung, I think I am just about to give up on certmonger | 19:14 |
| morgan | stevemar: but i could see it going either way | 19:15 |
| *** edtubill has joined #openstack-keystone | 19:15 | |
| stevemar | rodrigods: crinkle if you have time: https://review.openstack.org/#/c/279828/ wouldn't mind a few opinions on it | 19:17 |
| patchbot | stevemar: patch 279828 - keystonemiddleware - Adding audit middleware specific notification driv... | 19:17 |
| gyee | ayoung, I'll send you an email on the reasons, but basically, in a nutshell | 19:17 |
| gyee | 1) doc does not match reality | 19:17 |
| gyee | 2) extremely difficult to troubleshoot | 19:17 |
| gyee | 3) certmonger-session is unstable | 19:18 |
| stevemar | gyee: sounds like openstack | 19:18 |
| morgan | gyee: oooh are you debugging openstack? | 19:18 |
| gyee | stevemar, certmonger is worst, believe me! | 19:18 |
| morgan | :P | 19:18 |
| gyee | morgan, at least openstack has logs and code is easier to follow | 19:18 |
| gyee | certmonger have no good logs | 19:19 |
| *** vgridnev_ has quit IRC | 19:19 | |
| bknudson | we can put that on the advertising -- openstack: better than certmonger | 19:19 |
| gyee | hellyeah! | 19:19 |
| gyee | bknudson, try to troubleshoot dbus once in your life and see how you feel :-) | 19:20 |
| crinkle | stevemar: i don't have a lot to offer on that, i don't know much about auditing | 19:23 |
| stevemar | crinkle: darn, was trying to get a few opinions on it, i'm not super warm on it, but for no particular reason | 19:24 |
| *** jsavak has quit IRC | 19:33 | |
| *** jsavak has joined #openstack-keystone | 19:33 | |
| openstackgerrit | Merged openstack/oslo.policy: Trivial: ignore openstack/common in flake8 exclude list https://review.openstack.org/315009 | 19:33 |
| *** jaosorior has joined #openstack-keystone | 19:34 | |
| *** dmk0202 has joined #openstack-keystone | 19:38 | |
| *** edtubill has quit IRC | 19:41 | |
| *** jsavak has quit IRC | 19:46 | |
| *** jsavak has joined #openstack-keystone | 19:46 | |
| *** r-daneel has joined #openstack-keystone | 19:49 | |
| *** jaosorior has quit IRC | 19:51 | |
| ayoung | gyee, did you follow my blog post? | 20:02 |
| ayoung | https://adam.younglogic.com/2016/05/logging-certmonger/ | 20:02 |
| ayoung | you should not need to look at dbus, if you get enough logging from certmonger itself | 20:03 |
| *** jsavak has quit IRC | 20:03 | |
| gyee | ayoung, my helper got the cert back from Anchor | 20:04 |
| *** jsavak has joined #openstack-keystone | 20:04 | |
| gyee | I returned it as is, which according to the doc, it should work | 20:04 |
| *** sdake has joined #openstack-keystone | 20:05 | |
| gyee | but keep getting NEED_GUILDANCE, which means it choke on parsing the output | 20:05 |
| gyee | but it didn't tell me what does it choke on | 20:05 |
| rodrigods | stevemar, same as crinkle, but will try to figure out later tonight | 20:06 |
| gyee | carriage returns, new lines, or what | 20:06 |
| gyee | ayoung, according to the doc, I should be enable to return the entire PEM content as output | 20:06 |
| ayoung | gyee, yes, and return 0 | 20:07 |
| ayoung | as the exit code | 20:07 |
| gyee | right, the script exited with 0 status | 20:07 |
| ayoung | hmmm | 20:07 |
| gyee | NEED_GUILDANCE means it can't parse the PEM content | 20:07 |
| ayoung | gyee, did the log give any data? | 20:08 |
| gyee | is 15 the highest log level? | 20:08 |
| gyee | let me restart it again | 20:08 |
| *** nalind has joined #openstack-keystone | 20:09 | |
| nalind | ayoung: you rang? | 20:09 |
| gyee | certmonger-session tend to wrote over my changes on restart | 20:09 |
| ayoung | you were running nalind we have gyee here trying to build a certmonger helper | 20:09 |
| gyee | so I had to kill it first, then make changes | 20:09 |
| ayoung | he's getting a pem back, and exit 0, but get NEED_GUIDANCE | 20:09 |
| nalind | what's the output? | 20:09 |
| ayoung | gyee, right, but you then ran | 20:09 |
| ayoung | /usr/libexec/certmonger/certmonger-session -n -d 15 | 20:09 |
| ayoung | right? | 20:09 |
| *** daemontool has quit IRC | 20:09 | |
| gyee | nalind, I keep getting NEED_GUILDANCE | 20:10 |
| nalind | that'd work. the -n is implied by -d, but it's not an error | 20:10 |
| gyee | as far as I can tell, I return the entire PEM content | 20:10 |
| nalind | do you have a captured copy of it? | 20:10 |
| ayoung | gyee, if you kill the one that dbus kicks off, then run it as per above, it finds the debus connection and grabs iut | 20:10 |
| ayoung | gyee, I had the same thing happening, and when I kickedit off that way, I found out what certmonger was complaining about | 20:11 |
| gyee | ayoung, nalind, I logged it to syslog and here's what the output look like | 20:12 |
| gyee | http://paste.openstack.org/show/496814/ | 20:12 |
| *** vgridnev has joined #openstack-keystone | 20:12 | |
| *** vgridnev has quit IRC | 20:12 | |
| ayoung | gyee, were you skiping right to certmonger, or using session? | 20:13 |
| stevemar | rodrigods: that's all i ask :P | 20:13 |
| gyee | ayoung, I am using getcert -s | 20:13 |
| nalind | are the #012 sequences escaping for the log message, or was it in the data that the daemon got back, too? | 20:13 |
| ayoung | gyee, ok, so try this | 20:13 |
| ayoung | killall certmonger-session | 20:13 |
| ayoung | /usr/libexec/certmonger/certmonger-session -n -d 15 | 20:14 |
| ayoung | and from another windwo | 20:14 |
| gyee | nalind, I logged it as is from http response | 20:14 |
| ayoung | getcert -s list | 20:14 |
| ayoung | you should then see a slew of logging from the first window, certmonger-session | 20:14 |
| *** daemontool has joined #openstack-keystone | 20:14 | |
| ayoung | that is the logging you need | 20:14 |
| ayoung | gyee, can you paste the output from calling your helper script directly? | 20:15 |
| gyee | one sec | 20:16 |
| stevemar | morgan: another backport: https://review.openstack.org/#/c/314727/ | 20:17 |
| patchbot | stevemar: patch 314727 - keystone (stable/mitaka) - Remove test_invalid_policy_raises_error | 20:17 |
| gyee | ayoung, how do I make getcert split out the CSR so I can set it in CERTMONGER_CSR? | 20:19 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add policy registration https://review.openstack.org/313141 | 20:21 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add authorize method to Enforcer https://review.openstack.org/313142 | 20:21 |
| ayoung | gyee, um, you shouldn't need to do that explicitly, it should be set already in the environment when certmonger calls your app | 20:21 |
| gyee | I know, you asking for running the script directly | 20:21 |
| ayoung | gyee, try it out: in your app, you should be able to dump the value from getenv | 20:21 |
| gyee | nm, I found it in ~/.config/certmonger/requests/2... | 20:21 |
| nalind | for troubleshooting cases, it's handy to have the helper able to read a CSR on stdin if there isn't one in the environment | 20:22 |
| stevemar | rderose: please create the bp pci-dss :) | 20:22 |
| ayoung | nalind, he's got the helper working well enough to see the PEM. The issue is the handshake between certmonger and the helper that is not clear | 20:22 |
| ayoung | I need to run home here, gyee. Got a birthday dinner for my 10 year old. | 20:24 |
| ayoung | gyee, write up what you have working, and I'll give it a go. Do you have you helper app in a public repo yet? | 20:25 |
| stevemar | ayoung: happy birthday to the little person | 20:25 |
| ayoung | TYVM stevemar | 20:25 |
| gyee | ayoung, nalind, http://paste.openstack.org/show/496819/ | 20:28 |
| gyee | the script works fine by itself | 20:28 |
| *** jorge_munoz has quit IRC | 20:29 | |
| gyee | ayoung, sure, will push my help to my github account, assume the corp lawyers are OK with it :-) | 20:29 |
| nalind | hmm, that looks like expected output, and if the status is 0, i'm not sure what it doesn't like. got the debug log from the session daemon? | 20:31 |
| gyee | nalind, give me a sec, I'll paste the debug logs | 20:31 |
| arunkant | stevemar: I saw you posted message on ldappool repo. Are you using it somewhere? I remember adding it in keystone, not sure if its still used. | 20:34 |
| gyee | nalind, http://paste.openstack.org/show/496820/ | 20:34 |
| nalind | exit status was 1? | 20:35 |
| gyee | wth? | 20:36 |
| ayoung | OK, I think you guyus are tracking. Send me an email with the final story, would you gyee ? | 20:36 |
| gyee | ayoung, sure | 20:37 |
| SpamapS | I think bootstrap may have been broken recently | 20:37 |
| SpamapS | It's failing with this in our CI update path: | 20:37 |
| SpamapS | Conflict project: (pymysql.err.IntegrityError) (1062, u\"Duplicate entry 'default-admin' for key 'ixu_project_name_domain_id'\") [SQL: u'INSERT INTO project (id, name, domain_id, description, enabled, extra, parent_id, is_domain) VALUES (%(id)s, %(name)s, %(domain_id)s, %(description)s, %(enabled)s, %(extra)s, %(parent_id)s, %(is_domain)s)'] [parameters: {'is_domain': 0, 'description': 'Bootstrap | 20:38 |
| SpamapS | project for initializing the cloud.', 'extra': '{}', 'enabled': 1, 'domain_id': 'default', 'parent_id': 'default', 'id': | 20:38 |
| SpamapS | in the past, re-running it just exitted cleanly on duplicate key | 20:38 |
| *** roxanaghe has joined #openstack-keystone | 20:38 | |
| nalind | gyee: is it attempting to read anything from stdin? or expecting anything in the environment? | 20:39 |
| gyee | nalind, works now | 20:40 |
| nalind | did something change? | 20:40 |
| gyee | I changed to print(pem); exit(0) at the end | 20:41 |
| gyee | now it works fine | 20:41 |
| gyee | its now in MONITORING state | 20:41 |
| nalind | what was it doing before? | 20:41 |
| *** fangxu has quit IRC | 20:41 | |
| gyee | it was doing "return pem" | 20:41 |
| *** ayoung has quit IRC | 20:41 | |
| gyee | I thought I just return it | 20:41 |
| gyee | but I left out the rest of the code I copied over from IPA | 20:42 |
| nalind | ah. no idea what the python interpreter does when you return a string from main | 20:42 |
| gyee | it interpret as non-zero :-) | 20:42 |
| nalind | looks like. that's a relief | 20:42 |
| *** pcaruana has quit IRC | 20:42 | |
| gyee | nalind, ok, now lets see if it does auto renewal | 20:43 |
| gyee | shall find out in an hour | 20:43 |
| gyee | nalind, thanks for the help! | 20:43 |
| nalind | glad to be of help | 20:43 |
| *** rcernin has joined #openstack-keystone | 20:44 | |
| morgan | SpamapS: it should just exit on dupe | 20:45 |
| SpamapS | oh! | 20:47 |
| SpamapS | that's INFO level | 20:47 |
| *** jorge_munoz has joined #openstack-keystone | 20:47 | |
| SpamapS | I think it's the order of our deploy tooling | 20:47 |
| SpamapS | keystone-manage is exitting because there's no fernet keys | 20:47 |
| SpamapS | which seems.... | 20:47 |
| bknudson | there was a fix just put in that was supposed to shut down keystone if there are no fernet keys | 20:47 |
| SpamapS | right | 20:48 |
| SpamapS | that's the thing | 20:48 |
| SpamapS | it should shut down _keystone_, not keystone-manage. | 20:48 |
| lbragstad | https://github.com/openstack/keystone/commit/61873caef93bbadfc52fe4cedd836cd75df14c17 | 20:48 |
| SpamapS | Right, Ok, so I think there's a fix here | 20:48 |
| SpamapS | just to catch that error in manage | 20:48 |
| *** jsavak has quit IRC | 20:49 | |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add sample file generation script https://review.openstack.org/314244 | 20:50 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add helper methods for generating policy info https://review.openstack.org/314774 | 20:50 |
| *** fangxu has joined #openstack-keystone | 20:52 | |
| SpamapS | hm | 20:54 |
| SpamapS | no this is not that | 20:54 |
| SpamapS | red herring | 20:54 |
| stevemar | arunkant: it's still being used, morgan and i are talking to the repo owner about taking over the repo | 20:55 |
| bknudson | I wonder how this passed the gate? Do the devstack nodes have fernet keys pre-installed? | 20:55 |
| bknudson | Maybe it's the order that keystone-manage runs in the gate. | 20:55 |
| stevemar | arunkant: currently it's unmaintained and forgotten about :) | 20:55 |
| stevemar | arunkant: the goal is to make it py3 compatible, release a new version and then change python-ldap to pyldap, and voila... py3 support in keystone \o/ | 20:56 |
| *** fangxu has quit IRC | 20:56 | |
| SpamapS | bknudson: no it works fine | 20:57 |
| arunkant | stevemar: yes, that was the situation when I added ldappool in keystone..i have one issue which was better addressed in pool library, then handling it in keystone side, did not get any response | 20:57 |
| SpamapS | bknudson: red herring. Our deploy tooling was not restarting uwsgi | 20:57 |
| bknudson | SpamapS: oh, got it. | 20:57 |
| bknudson | there was just a confusing or useless message printed? | 20:58 |
| stevemar | arunkant: when we bring it under the keystone umbrella i was planning on looking at the the open PRs for ldappool | 21:00 |
| *** raildo is now known as raildo-afk | 21:00 | |
| SpamapS | bknudson: a lot of logs yeah | 21:00 |
| *** nalind has quit IRC | 21:01 | |
| *** gagehugo has quit IRC | 21:01 | |
| arunkant | stevemar: Okay..I can provide more details on my issue logged on ldappool side. | 21:01 |
| *** pushkaru has quit IRC | 21:02 | |
| *** pushkaru has joined #openstack-keystone | 21:02 | |
| edmondsw | stevemar, I made some further changes in https://review.openstack.org/#/c/311206/ , please reiterate your +1 if you're still on board there | 21:08 |
| patchbot | edmondsw: patch 311206 - python-openstackclient - Use resource id when name given for identity show | 21:08 |
| morgan | SpamapS: phew. | 21:08 |
| *** tonytan4ever has quit IRC | 21:10 | |
| *** ekarlso has quit IRC | 21:11 | |
| edmondsw | is there an IRC channel for openstackclient? | 21:11 |
| rderose | stevemar: okay | 21:11 |
| stevemar | edmondsw: #openstack-sdks | 21:11 |
| edmondsw | tx | 21:11 |
| *** ekarlso has joined #openstack-keystone | 21:14 | |
| openstackgerrit | Clenimar Filemon proposed openstack/keystone: Add is_domain in token response https://review.openstack.org/197331 | 21:14 |
| *** ayoung has joined #openstack-keystone | 21:15 | |
| *** ChanServ sets mode: +v ayoung | 21:15 | |
| *** pauloewerton has quit IRC | 21:15 | |
| rderose | stevemar: #link https://blueprints.launchpad.net/keystone/+spec/pci-dss | 21:17 |
| edmondsw | stevemar, I added the mitaka-backport-potential tag on https://bugs.launchpad.net/keystone/+bug/1577804 | 21:18 |
| openstack | Launchpad bug 1577804 in OpenStack Identity (keystone) "/v3/users?name=<name> bypasses user_filter for LDAP" [Undecided,In progress] - Assigned to Matthew Edmonds (edmondsw) | 21:18 |
| edmondsw | if you're looking for more things to review, the fix for that is at https://review.openstack.org/#/c/312126/ | 21:18 |
| patchbot | edmondsw: patch 312126 - keystone - Honor ldap_filter on filtered user list | 21:18 |
| edmondsw | ;) | 21:18 |
| openstackgerrit | Merged openstack/keystone: Update documentation to remove keystone-all https://review.openstack.org/314628 | 21:18 |
| *** slberger has joined #openstack-keystone | 21:19 | |
| *** slberger1 has quit IRC | 21:21 | |
| openstackgerrit | Merged openstack/keystone: Always add is_admin_project if admin project defined https://review.openstack.org/312323 | 21:21 |
| morgan | stevemar: i'll start putting together the import ldappool patches. | 21:23 |
| *** rderose has quit IRC | 21:24 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 21:27 |
| *** belmoreira has quit IRC | 21:30 | |
| *** haplo37 has quit IRC | 21:30 | |
| openstackgerrit | ayoung proposed openstack/keystone: Add is_domain in token response https://review.openstack.org/197331 | 21:32 |
| *** rderose has joined #openstack-keystone | 21:34 | |
| *** edmondsw has quit IRC | 21:34 | |
| rodrigods | stevemar, regarding the idp tests, would be great to have more ppl taking a look on it! :) | 21:47 |
| *** julim has quit IRC | 21:47 | |
| *** gordc has quit IRC | 21:47 | |
| *** lhcheng has joined #openstack-keystone | 21:51 | |
| *** ChanServ sets mode: +v lhcheng | 21:51 | |
| *** jsavak has joined #openstack-keystone | 21:55 | |
| *** slberger has left #openstack-keystone | 21:59 | |
| *** gagehugo has joined #openstack-keystone | 22:00 | |
| morgan | stevemar: https://review.openstack.org/315267 | 22:02 |
| rodrigods | stevemar, i guess i understood https://review.openstack.org/#/c/279828/11, but would be good to check it working in a real env with transport_url | 22:11 |
| patchbot | rodrigods: patch 279828 - keystonemiddleware - Adding audit middleware specific notification driv... | 22:11 |
| *** rderose has quit IRC | 22:12 | |
| *** jsavak has quit IRC | 22:12 | |
| *** gagehugo has quit IRC | 22:18 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:19 | |
| *** ozialien10 has joined #openstack-keystone | 22:21 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Handle cache invalidate outside cache object https://review.openstack.org/268662 | 22:24 |
| openstackgerrit | Clenimar Filemon proposed openstack/keystoneauth: Add is_domain to keystoneauth token https://review.openstack.org/282377 | 22:33 |
| *** fangxu has joined #openstack-keystone | 22:33 | |
| openstackgerrit | Merged openstack/keystonemiddleware: use the same context across a request https://review.openstack.org/216889 | 22:34 |
| *** roxanaghe has quit IRC | 22:34 | |
| *** gagehugo has joined #openstack-keystone | 22:34 | |
| *** gagehugo has quit IRC | 22:35 | |
| *** pumarani__ has joined #openstack-keystone | 22:36 | |
| *** pushkaru has quit IRC | 22:36 | |
| *** gagehugo has joined #openstack-keystone | 22:36 | |
| *** roxanaghe has joined #openstack-keystone | 22:37 | |
| *** phalmos has quit IRC | 22:39 | |
| jamielennox | stevemar: has the gate pip issue been fixed? | 22:44 |
| *** ninag__ has quit IRC | 22:46 | |
| *** xek has quit IRC | 22:46 | |
| *** xek has joined #openstack-keystone | 22:47 | |
| *** dmk0202 has quit IRC | 22:47 | |
| *** gagehugo has quit IRC | 22:56 | |
| *** dan_nguyen has quit IRC | 22:59 | |
| *** gagehugo has joined #openstack-keystone | 23:00 | |
| *** jamielennox is now known as jamielennox|away | 23:02 | |
| *** pumarani__ has quit IRC | 23:02 | |
| *** pushkaru has joined #openstack-keystone | 23:02 | |
| *** agrebennikov has quit IRC | 23:03 | |
| *** ninag has joined #openstack-keystone | 23:06 | |
| *** pushkaru has quit IRC | 23:08 | |
| *** r-daneel has quit IRC | 23:08 | |
| openstackgerrit | Merged openstack/keystone: Restructure endpoint policy abstract driver https://review.openstack.org/307373 | 23:08 |
| *** ninag has quit IRC | 23:11 | |
| *** zigo has quit IRC | 23:14 | |
| *** Daviey has quit IRC | 23:15 | |
| *** dan_nguyen has joined #openstack-keystone | 23:15 | |
| *** Daviey has joined #openstack-keystone | 23:15 | |
| *** zigo has joined #openstack-keystone | 23:15 | |
| *** cburgess has quit IRC | 23:15 | |
| *** cburgess has joined #openstack-keystone | 23:16 | |
| *** furface has joined #openstack-keystone | 23:22 | |
| *** pushkaru has joined #openstack-keystone | 23:23 | |
| *** roxanaghe has quit IRC | 23:24 | |
| *** ninag has joined #openstack-keystone | 23:26 | |
| *** timcline has quit IRC | 23:26 | |
| *** ozialien10 has quit IRC | 23:27 | |
| *** pushkaru has quit IRC | 23:27 | |
| *** ozialien10 has joined #openstack-keystone | 23:28 | |
| *** ozialien10 has quit IRC | 23:37 | |
| *** ozialien10 has joined #openstack-keystone | 23:38 | |
| *** gagehugo has left #openstack-keystone | 23:46 | |
| *** ninag has quit IRC | 23:49 | |
| *** BjoernT has quit IRC | 23:50 | |
| *** simondodsley has quit IRC | 23:50 | |
| *** erhudy has quit IRC | 23:51 | |
| *** jamielennox|away is now known as jamielennox | 23:51 | |
| *** timcline has joined #openstack-keystone | 23:57 | |
| *** jsavak has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!