| *** sdake_ has joined #openstack-keystone | 00:00 | |
| jlk | okay, I'm getting an unuthorized | 00:01 |
|---|---|---|
| jamielennox | but looking through i'm not exactly sure of where and why it's set | 00:02 |
| david-lyle | jlk you likely don't have a role on the domain, or one that doesn't allow you to list domains or get a domain | 00:02 |
| jlk | I do | 00:02 |
| jlk | but tracing will show what's up | 00:02 |
| *** sdake has quit IRC | 00:02 | |
| jlk | 2016-05-27 00:04:21.680 30991 DEBUG keystone.token.providers.common [req-c6b99462-aaac-4031-86aa-b7dd601cd892 5dae4b7c2b76439d8419bc0956fbcb00 - - default -] User 5dae4b7c2b76439d8419bc0956fbcb00 has no access to domain default _populate_roles /opt/openstack/current/keystone/local/lib/python2.7/site-packages/keystone/token/providers/common.py:454 | 00:05 |
| jlk | well that's weird. | 00:05 |
| jlk | well then. | 00:09 |
| david-lyle | expired token? | 00:11 |
| david-lyle | wrong file :( | 00:11 |
| jlk | "_get_roles_for_user" is coming up empty I think | 00:11 |
| jlk | in keystone | 00:12 |
| jlk | and raising that error | 00:12 |
| david-lyle | you need a project role and a domain role | 00:12 |
| jlk | interesting... | 00:12 |
| *** ddieterly is now known as ddieterly[away] | 00:12 | |
| david-lyle | it's a pain, but how it is | 00:12 |
| jamielennox | project role and a domain role? | 00:13 |
| david-lyle | yup | 00:13 |
| david-lyle | or just a domain role | 00:13 |
| *** dims has quit IRC | 00:13 | |
| david-lyle | to do identity operations such as listing domains | 00:14 |
| jlk | yeah maybe we can switch to just applying roles at domain | 00:14 |
| jamielennox | that's related to how django_o_a sets fetches tokens or a keystone thing? | 00:14 |
| david-lyle | keystone | 00:14 |
| david-lyle | admin on default domain == keystone v2 admin | 00:14 |
| jlk | bingo. | 00:15 |
| david-lyle | jlk: I have to run, if you run into more issues, feel free to PM me or leave a ping in one of the rooms. I'm unfortunately responsible for a lot of that in horizon. | 00:17 |
| jlk | well that lets me see the Domain stab now | 00:17 |
| jlk | david-lyle: just real quick, what's the purpose of the "domains" drop down box on the top nav bar? | 00:17 |
| david-lyle | that's mostly just informative | 00:18 |
| david-lyle | the project and region switcher live in there | 00:18 |
| jlk | am I supposed to be able to select a different domain from there? | 00:18 |
| david-lyle | but you can't switch domains without logging out | 00:18 |
| jlk | or is that all through the "set domain context" in the Domains panel? | 00:18 |
| david-lyle | set domain context is a filter | 00:18 |
| *** itlinux has joined #openstack-keystone | 00:18 | |
| jlk | ah | 00:18 |
| david-lyle | so you can set the domain context to a particular domain then see only users, groups, project in that domain | 00:18 |
| jlk | I see | 00:19 |
| david-lyle | it makes it less confusing to edit things | 00:19 |
| david-lyle | then you can clear it back on the domains view | 00:19 |
| jlk | so we add our "admin" user with keystone-manage bootstrap, which lets me set a user, password, project name, and role name | 00:19 |
| jlk | but it doesn't seem to set the domain role, guess I have to do that separately | 00:19 |
| *** browne has quit IRC | 00:19 | |
| david-lyle | not sure about the keystone-manage part | 00:20 |
| david-lyle | I do it manually usually, but I'm sure there's a better way | 00:20 |
| jlk | We can add automation for it, just getting a handle on it | 00:20 |
| *** ddieterly[away] is now known as ddieterly | 00:21 | |
| david-lyle | ping me if you run into other stuff, got to run | 00:21 |
| jlk | thanks! | 00:22 |
| jamielennox | notmorgan, stevemar: have you seen this: https://review.openstack.org/#/c/289405/8/specs/newton/approved/discoverable-policy-cli.rst ? | 00:23 |
| patchbot | jamielennox: patch 289405 - nova-specs - Adds Nova discoverable policy CLI spec | 00:23 |
| jamielennox | and anyone particularly interested in policy ^ | 00:24 |
| jlk | that's just fronting through the oslo.policy tools I thought | 00:27 |
| jlk | but doing it through the API, which is nice, since consumers don't have access to policy files | 00:28 |
| jamielennox | yep, i'm just not sure about nova deciding to go ahead and expose it like that because i haven't heard anyone talk about it from an oslo.policy/cross-project perspective | 00:28 |
| jamielennox | discovering what you can do with a token has been a long running problem | 00:28 |
| jamielennox | and not nova specific | 00:28 |
| jlk | yeah, I was in two sessions at summit about this | 00:29 |
| jlk | the nova one, and the cross project one | 00:29 |
| jlk | maybe this is another case of "one project shows the way, other projects follow" | 00:29 |
| *** markvoelker has joined #openstack-keystone | 00:29 | |
| jlk | just the first part of registering all the policy calls, that's pretty important across all projects. | 00:29 |
| jamielennox | it was hoped it would be one of the wins of centralized policy but that doesn't seem to be on the table any more | 00:30 |
| jlk | the idea of registering policy up with keystone somewhere in the catalog? | 00:30 |
| jamielennox | the oslo.policy syntax sucks, annoying that is what's going to be displayed | 00:31 |
| jamielennox | yea, that keystone would manage policy and then push it to other services | 00:31 |
| *** lhcheng has quit IRC | 00:32 | |
| jlk | is that the on-disk policy that sucks, or otherwise? Because there is also work going to allow policy in YAML with comments and such | 00:33 |
| *** markvoelker has quit IRC | 00:36 | |
| *** ddieterly is now known as ddieterly[away] | 00:40 | |
| *** browne has joined #openstack-keystone | 00:46 | |
| *** browne has quit IRC | 00:46 | |
| jamielennox | mostly i don't like the naming, without reading code there's no way to know that get_user_list is GET /v3/users | 00:50 |
| jamielennox | i mean it's hopefully a little intuitive | 00:50 |
| jamielennox | yaml would be better but not solve that problem | 00:51 |
| jamielennox | i was kind of hoping jsonhome might have been a saviour here, but it seems like that's being abandoned | 00:52 |
| *** ddieterly[away] is now known as ddieterly | 00:54 | |
| *** lhcheng has joined #openstack-keystone | 00:56 | |
| *** ChanServ sets mode: +v lhcheng | 00:56 | |
| *** dims has joined #openstack-keystone | 00:56 | |
| *** itlinux has quit IRC | 00:57 | |
| *** ddieterly is now known as ddieterly[away] | 00:57 | |
| *** lhcheng_ has joined #openstack-keystone | 00:57 | |
| *** diazjf has joined #openstack-keystone | 00:58 | |
| *** itlinux has joined #openstack-keystone | 00:58 | |
| *** rderose has joined #openstack-keystone | 00:58 | |
| *** lhcheng has quit IRC | 01:00 | |
| *** ddieterly[away] is now known as ddieterly | 01:00 | |
| *** diazjf1 has joined #openstack-keystone | 01:02 | |
| *** gyee has quit IRC | 01:03 | |
| *** itlinux has quit IRC | 01:03 | |
| *** diazjf has quit IRC | 01:04 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystoneauth: Make the kerberos plugin loadable https://review.openstack.org/321814 | 01:04 |
| *** spzala has quit IRC | 01:09 | |
| *** spzala has joined #openstack-keystone | 01:10 | |
| *** spzala has quit IRC | 01:14 | |
| *** diazjf1 has quit IRC | 01:34 | |
| *** EinstCrazy has joined #openstack-keystone | 01:41 | |
| *** sdake has joined #openstack-keystone | 01:45 | |
| *** sdake_ has quit IRC | 01:48 | |
| *** amrith is now known as _amrith_ | 01:51 | |
| *** _amrith_ is now known as amrith | 01:52 | |
| *** spzala has joined #openstack-keystone | 01:57 | |
| *** itlinux has joined #openstack-keystone | 01:59 | |
| *** amrith is now known as _amrith_ | 02:04 | |
| *** itlinux has quit IRC | 02:04 | |
| *** _amrith_ is now known as amrith | 02:06 | |
| *** amrith is now known as _amrith_ | 02:08 | |
| *** nkinder has quit IRC | 02:08 | |
| *** _amrith_ is now known as amrith | 02:09 | |
| *** ddieterly is now known as ddieterly[away] | 02:10 | |
| *** amrith is now known as _amrith_ | 02:11 | |
| *** _amrith_ is now known as amrith | 02:11 | |
| jlk | jamielennox: ah. I think part of of the work on Nova's side was to be way more descriptive about what the policy does. and even link to where the policy is used in the code itself. | 02:12 |
| *** spzala has quit IRC | 02:12 | |
| *** sdake_ has joined #openstack-keystone | 02:26 | |
| *** amrith is now known as _amrith_ | 02:27 | |
| *** sdake has quit IRC | 02:28 | |
| *** _amrith_ is now known as amrith | 02:29 | |
| *** buhman has quit IRC | 02:31 | |
| *** rderose has quit IRC | 02:32 | |
| *** josdotso has quit IRC | 02:36 | |
| *** openstackgerrit has quit IRC | 02:36 | |
| *** hockeynut has quit IRC | 02:36 | |
| *** hockeynut has joined #openstack-keystone | 02:37 | |
| *** openstackgerrit has joined #openstack-keystone | 02:42 | |
| *** agrebennikov has quit IRC | 02:42 | |
| *** spzala has joined #openstack-keystone | 02:43 | |
| *** spzala has quit IRC | 02:50 | |
| *** openstackgerrit has quit IRC | 02:56 | |
| *** woodster_ has quit IRC | 02:58 | |
| -openstackstatus- NOTICE: Gerrit is going offline briefly to check possible filesystem corruption | 03:01 | |
| *** ChanServ changes topic to "Gerrit is going offline briefly to check possible filesystem corruption" | 03:01 | |
| *** jamielennox is now known as jamielennox|away | 03:01 | |
| *** hockeynut has quit IRC | 03:04 | |
| *** TxGVNN has joined #openstack-keystone | 03:06 | |
| *** sdake has joined #openstack-keystone | 03:07 | |
| *** hockeynut has joined #openstack-keystone | 03:08 | |
| *** ddieterly[away] has quit IRC | 03:10 | |
| *** sdake_ has quit IRC | 03:11 | |
| *** richm has quit IRC | 03:12 | |
| *** code-R has joined #openstack-keystone | 03:16 | |
| *** code-R_ has joined #openstack-keystone | 03:17 | |
| *** openstackgerrit has joined #openstack-keystone | 03:18 | |
| *** sheel has joined #openstack-keystone | 03:19 | |
| *** ChanServ changes topic to "Newton Deadlines: http://releases.openstack.org/newton/schedule.html | Keystone Midcycle RSVP: http://goo.gl/forms/NfFMpJe6MSCXSNhr2 (Hosted By Cicso, July 20-22, 170 W Tasman Dr, San Jose, CA 95134) | Keystone Midcycle wiki https://wiki.openstack.org/wiki/Sprints/KeystoneNewtonSprint" | 03:20 | |
| -openstackstatus- NOTICE: after a quick check, gerrit and its filesystem have been brought back online and should be working again | 03:20 | |
| *** code-R has quit IRC | 03:21 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Support encryption of credentials in Keystone https://review.openstack.org/317169 | 03:21 |
| *** iurygregory has quit IRC | 03:22 | |
| *** dave-mccowan has quit IRC | 03:22 | |
| *** mvk_ has joined #openstack-keystone | 03:32 | |
| *** mkrcmari__ has quit IRC | 03:36 | |
| *** code-R_ has quit IRC | 03:44 | |
| *** links has joined #openstack-keystone | 03:46 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystoneauth: Make the kerberos plugin loadable https://review.openstack.org/321814 | 03:48 |
| *** code-R has joined #openstack-keystone | 03:48 | |
| *** buhman has joined #openstack-keystone | 03:52 | |
| *** lhcheng has joined #openstack-keystone | 03:58 | |
| *** ChanServ sets mode: +v lhcheng | 03:58 | |
| *** lhcheng_ has quit IRC | 03:58 | |
| *** rbridgeman has joined #openstack-keystone | 04:00 | |
| *** fawadkhaliq has joined #openstack-keystone | 04:04 | |
| *** diazjf has joined #openstack-keystone | 04:05 | |
| *** diazjf has quit IRC | 04:05 | |
| *** fawadkhaliq has quit IRC | 04:07 | |
| *** sdake_ has joined #openstack-keystone | 04:25 | |
| *** code-R has quit IRC | 04:26 | |
| *** edtubill has joined #openstack-keystone | 04:26 | |
| *** edtubill has quit IRC | 04:27 | |
| *** sdake has quit IRC | 04:27 | |
| *** sdake has joined #openstack-keystone | 04:31 | |
| *** markvoelker has joined #openstack-keystone | 04:32 | |
| *** sdake_ has quit IRC | 04:33 | |
| *** markvoelker has quit IRC | 04:37 | |
| *** adu has joined #openstack-keystone | 04:37 | |
| *** itlinux has joined #openstack-keystone | 04:45 | |
| *** roxanaghe has joined #openstack-keystone | 04:48 | |
| *** itlinux has quit IRC | 04:48 | |
| *** jaosorior has joined #openstack-keystone | 04:50 | |
| *** code-R has joined #openstack-keystone | 04:55 | |
| *** flwang1 has quit IRC | 04:56 | |
| *** roxanaghe has quit IRC | 05:14 | |
| *** code-R has quit IRC | 05:16 | |
| *** adu has quit IRC | 05:20 | |
| *** cheran has quit IRC | 05:24 | |
| *** itlinux has joined #openstack-keystone | 05:29 | |
| *** lhcheng has quit IRC | 05:31 | |
| *** lhcheng has joined #openstack-keystone | 05:34 | |
| *** ChanServ sets mode: +v lhcheng | 05:34 | |
| *** lhcheng has quit IRC | 05:38 | |
| *** rbridgeman has quit IRC | 05:41 | |
| *** sdake_ has joined #openstack-keystone | 05:53 | |
| *** sdake_ has quit IRC | 05:53 | |
| *** sdake_ has joined #openstack-keystone | 05:53 | |
| *** sdake has quit IRC | 05:56 | |
| *** sdake_ has quit IRC | 05:59 | |
| *** rk4n has joined #openstack-keystone | 06:00 | |
| *** rcernin has joined #openstack-keystone | 06:05 | |
| *** rcernin has quit IRC | 06:15 | |
| *** rcernin has joined #openstack-keystone | 06:20 | |
| *** dancn has quit IRC | 06:21 | |
| *** markvoelker has joined #openstack-keystone | 06:33 | |
| *** markvoelker has quit IRC | 06:38 | |
| *** daemontool has joined #openstack-keystone | 06:44 | |
| *** code-R has joined #openstack-keystone | 06:49 | |
| *** itlinux has quit IRC | 06:51 | |
| *** dancn has joined #openstack-keystone | 06:54 | |
| *** code-R_ has joined #openstack-keystone | 06:54 | |
| *** code-R has quit IRC | 06:57 | |
| openstackgerrit | Kanika Singh proposed openstack/keystone: Add a condition for 'region' parameter https://review.openstack.org/304489 | 07:02 |
| *** rha has quit IRC | 07:04 | |
| *** TxGVNN has quit IRC | 07:05 | |
| *** belmoreira has joined #openstack-keystone | 07:06 | |
| *** TxGVNN has joined #openstack-keystone | 07:08 | |
| *** frickler has quit IRC | 07:10 | |
| -openstackstatus- NOTICE: zuul required a restart due to network outages. If your change is not listed on http://status.openstack.org/zuul/ and is missing results, please issue a 'recheck'. | 07:13 | |
| *** code-R_ has quit IRC | 07:19 | |
| *** frickler has joined #openstack-keystone | 07:31 | |
| *** daemontool has quit IRC | 07:32 | |
| *** pnavarro has joined #openstack-keystone | 07:34 | |
| *** tesseract has joined #openstack-keystone | 07:36 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** belmoreira has quit IRC | 08:02 | |
| *** afazekas|sick is now known as afazekas | 08:03 | |
| *** TxGVNN has quit IRC | 08:12 | |
| *** fhubik has joined #openstack-keystone | 08:24 | |
| openstackgerrit | Kanika Singh proposed openstack/keystone: Add a condition for 'region' parameter https://review.openstack.org/304489 | 08:28 |
| *** dmk0202 has joined #openstack-keystone | 08:46 | |
| *** amrith is now known as _amrith_ | 08:47 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Document supported query option for list projects https://review.openstack.org/322010 | 08:52 |
| *** jaosorior is now known as jaosorior_lunch | 08:59 | |
| *** flwang1 has joined #openstack-keystone | 09:01 | |
| *** rha has joined #openstack-keystone | 09:01 | |
| *** belmoreira has joined #openstack-keystone | 09:03 | |
| *** belmoreira has quit IRC | 09:05 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: Let Oidc* auth plugins accept scope parameters as kwargs https://review.openstack.org/322027 | 09:17 |
| *** daemontool has joined #openstack-keystone | 09:18 | |
| *** zzzeek has quit IRC | 09:20 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: Let Oidc* auth plugins accept scope parameters as kwargs https://review.openstack.org/322027 | 09:23 |
| *** belmoreira has joined #openstack-keystone | 09:25 | |
| *** code-R has joined #openstack-keystone | 09:31 | |
| *** code-R has quit IRC | 09:40 | |
| openstackgerrit | Kanika Singh proposed openstack/keystone: Add a condition for 'region' parameter https://review.openstack.org/304489 | 09:43 |
| *** rk4n has quit IRC | 09:52 | |
| *** permalac has joined #openstack-keystone | 09:54 | |
| *** permalac has quit IRC | 09:54 | |
| *** permalac has joined #openstack-keystone | 09:54 | |
| *** permalac has quit IRC | 09:55 | |
| *** permalac has joined #openstack-keystone | 09:55 | |
| *** rk4n has joined #openstack-keystone | 10:00 | |
| *** EinstCrazy has quit IRC | 10:07 | |
| *** code-R has joined #openstack-keystone | 10:08 | |
| *** aloga has quit IRC | 10:18 | |
| *** aloga has joined #openstack-keystone | 10:18 | |
| *** jaosorior_lunch is now known as jaosorior | 10:22 | |
| *** code-R_ has joined #openstack-keystone | 10:23 | |
| *** code-R has quit IRC | 10:26 | |
| *** markvoelker has joined #openstack-keystone | 10:34 | |
| *** markvoelker has quit IRC | 10:39 | |
| sheel | henrynash: hi | 10:41 |
| sheel | henrynash: I was looking into one patch, its failing keystone-coverage-db tests... | 10:41 |
| sheel | henrynash: could you give a brief idea about these tests..what they actually tests? | 10:41 |
| sheel | patch reference : https://review.openstack.org/#/c/304489/4 | 10:42 |
| patchbot | sheel: patch 304489 - keystone - Add a condition for 'region' parameter | 10:42 |
| *** openstackgerrit has quit IRC | 10:47 | |
| *** openstackgerrit has joined #openstack-keystone | 10:48 | |
| samueldmq | morning all | 10:57 |
| samueldmq | OS-KDS has been a keystone thing in the past, but has been completely removed | 10:58 |
| samueldmq | is this correct ? | 10:58 |
| samueldmq | "Key Distribution Server (KDS) extension" | 10:58 |
| yolanda | samueldmq, how can i get a new release cut of keystoneauth? | 11:06 |
| *** _amrith_ is now known as amrith | 11:13 | |
| *** TxGVNN has joined #openstack-keystone | 11:16 | |
| openstackgerrit | Julien Danjou proposed openstack/keystone: Simplify & fix configuration file copy in setup.cfg https://review.openstack.org/322086 | 11:19 |
| *** ddieterly has joined #openstack-keystone | 11:22 | |
| *** amakarov has joined #openstack-keystone | 11:23 | |
| *** henrynash has quit IRC | 11:28 | |
| openstackgerrit | Kanika Singh proposed openstack/keystone: Handling of 'region' parameter as None https://review.openstack.org/304489 | 11:30 |
| samueldmq | yolanda: hi | 11:30 |
| breton_ | samueldmq: yes, that's correct | 11:30 |
| samueldmq | yolanda: stevemar is the one who does it | 11:30 |
| samueldmq | stevemar: yolanda would like to have a release cut of keystoneauth | 11:30 |
| samueldmq | breton_: ++ thanks for confirming | 11:30 |
| yolanda | thx | 11:31 |
| *** openstackgerrit has quit IRC | 11:47 | |
| *** openstackgerrit has joined #openstack-keystone | 11:48 | |
| *** ddieterly is now known as ddieterly[away] | 11:48 | |
| *** daemontool has quit IRC | 11:51 | |
| *** daemontool has joined #openstack-keystone | 11:51 | |
| *** TxGVNN has quit IRC | 11:54 | |
| *** jaosorior has quit IRC | 12:01 | |
| *** jaosorior has joined #openstack-keystone | 12:01 | |
| *** yolanda has quit IRC | 12:04 | |
| *** yolanda has joined #openstack-keystone | 12:06 | |
| *** daemontool has quit IRC | 12:08 | |
| *** markvoelker has joined #openstack-keystone | 12:08 | |
| *** amrith is now known as _amrith_ | 12:08 | |
| *** daemontool has joined #openstack-keystone | 12:08 | |
| *** ddieterly[away] is now known as ddieterly | 12:12 | |
| *** henrynash has joined #openstack-keystone | 12:12 | |
| *** ChanServ sets mode: +v henrynash | 12:12 | |
| *** daemontool has quit IRC | 12:18 | |
| *** daemontool has joined #openstack-keystone | 12:18 | |
| *** dmellado is now known as dmellado|lunch | 12:20 | |
| *** dmellado|lunch is now known as dmellado | 12:20 | |
| *** itlinux has joined #openstack-keystone | 12:22 | |
| *** mkrcmari__ has joined #openstack-keystone | 12:23 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Migrate identity /v3-ext docs from api-ref repo https://review.openstack.org/322131 | 12:26 |
| *** mvk_ has quit IRC | 12:26 | |
| *** rk4n has quit IRC | 12:26 | |
| *** rk4n has joined #openstack-keystone | 12:27 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Migrate identity /v3-ext docs from api-ref repo https://review.openstack.org/322131 | 12:27 |
| *** mkrcmari__ has quit IRC | 12:30 | |
| *** mkrcmari__ has joined #openstack-keystone | 12:30 | |
| *** daemontool has quit IRC | 12:31 | |
| *** daemontool has joined #openstack-keystone | 12:32 | |
| *** rodrigods has quit IRC | 12:34 | |
| *** rodrigods has joined #openstack-keystone | 12:34 | |
| *** mkrcmari__ has quit IRC | 12:40 | |
| *** aurelien__ has joined #openstack-keystone | 12:41 | |
| *** yolanda has quit IRC | 12:41 | |
| *** daemontool has quit IRC | 12:42 | |
| *** daemontool has joined #openstack-keystone | 12:42 | |
| *** doug-fish has joined #openstack-keystone | 12:43 | |
| *** clenimar has joined #openstack-keystone | 12:44 | |
| *** itlinux has quit IRC | 12:45 | |
| *** itlinux has joined #openstack-keystone | 12:47 | |
| *** openstackgerrit has quit IRC | 12:48 | |
| *** openstackgerrit has joined #openstack-keystone | 12:48 | |
| *** yolanda has joined #openstack-keystone | 12:48 | |
| *** edmondsw has joined #openstack-keystone | 12:49 | |
| *** code-R_ has quit IRC | 12:53 | |
| *** code-R has joined #openstack-keystone | 12:54 | |
| *** ddieterly has quit IRC | 13:04 | |
| *** henrynash has quit IRC | 13:05 | |
| *** mkrcmari__ has joined #openstack-keystone | 13:08 | |
| *** henrynash has joined #openstack-keystone | 13:09 | |
| *** ChanServ sets mode: +v henrynash | 13:09 | |
| *** _amrith_ is now known as amrith | 13:11 | |
| *** dave-mccowan has joined #openstack-keystone | 13:14 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Document supported query option for list projects https://review.openstack.org/322010 | 13:15 |
| *** iury_afk is now known as iurygregory | 13:15 | |
| *** henrynash has quit IRC | 13:15 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Migrate identity /v2 docs from api-ref repo https://review.openstack.org/322173 | 13:17 |
| *** henrynash has joined #openstack-keystone | 13:18 | |
| *** ChanServ sets mode: +v henrynash | 13:18 | |
| samueldmq | henrynash: shouldn't this be partial-bug ? ^ | 13:20 |
| samueldmq | henrynash: this doesn't solve the issue with osc | 13:20 |
| henrynash | samueldmq: yep, you are right…I only discovered the osc missing piece after I wrote the first draft of this! | 13:21 |
| henrynash | I’ll ammend | 13:21 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Document supported query option for list projects https://review.openstack.org/322010 | 13:21 |
| *** ayoung has joined #openstack-keystone | 13:22 | |
| *** ChanServ sets mode: +v ayoung | 13:22 | |
| samueldmq | henrynash: thanks | 13:22 |
| *** richm has joined #openstack-keystone | 13:25 | |
| *** aurelien__ has quit IRC | 13:26 | |
| *** aurelien__ has joined #openstack-keystone | 13:27 | |
| *** ddieterly has joined #openstack-keystone | 13:29 | |
| *** bknudson has left #openstack-keystone | 13:33 | |
| *** itlinux has quit IRC | 13:33 | |
| *** aurelien__ has quit IRC | 13:34 | |
| *** aurelien__ has joined #openstack-keystone | 13:34 | |
| edmondsw | bknudson, ayoung looking for a second +2 on this backport to mitaka: https://review.openstack.org/#/c/321812/ | 13:35 |
| patchbot | edmondsw: patch 321812 - keystone (stable/mitaka) - Honor ldap_filter on filtered user list | 13:35 |
| *** bknudson has joined #openstack-keystone | 13:36 | |
| *** ChanServ sets mode: +v bknudson | 13:36 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: Added app for policy enforcement https://review.openstack.org/317529 | 13:37 |
| *** ayoung has quit IRC | 13:40 | |
| *** henrynash has quit IRC | 13:41 | |
| openstackgerrit | Merged openstack/keystone-specs: Document supported query option for list projects https://review.openstack.org/322010 | 13:44 |
| *** aurelien__ has quit IRC | 13:47 | |
| *** zzzeek has joined #openstack-keystone | 13:48 | |
| *** daemontool has quit IRC | 13:48 | |
| *** zzzeek has quit IRC | 13:49 | |
| *** zzzeek has joined #openstack-keystone | 13:49 | |
| *** mfisch has quit IRC | 13:49 | |
| *** daemontool has joined #openstack-keystone | 13:49 | |
| *** rk4n_ has joined #openstack-keystone | 13:50 | |
| *** rk4n has quit IRC | 13:52 | |
| *** jaugustine has joined #openstack-keystone | 14:02 | |
| *** johnthetubaguy_ has joined #openstack-keystone | 14:02 | |
| *** darosale has joined #openstack-keystone | 14:02 | |
| *** daemontool has quit IRC | 14:03 | |
| *** daemontool has joined #openstack-keystone | 14:04 | |
| *** johnthetubaguy has quit IRC | 14:04 | |
| *** johnthetubaguy_ is now known as johnthetubaguy | 14:05 | |
| *** aurelien__ has joined #openstack-keystone | 14:09 | |
| *** tonytan4ever has joined #openstack-keystone | 14:13 | |
| *** ddieterly is now known as ddieterly[away] | 14:16 | |
| *** openstackgerrit has quit IRC | 14:18 | |
| *** openstackgerrit has joined #openstack-keystone | 14:18 | |
| knikolla | when doing federation, why does the 302 redirect after shibboleth point to <hostip>:5000 instead of <hostip>:5000/v3/OS-FEDERATION/identity_providers/<idp_id>/protocols/saml2/auth ? | 14:20 |
| *** rderose has joined #openstack-keystone | 14:21 | |
| *** spzala has joined #openstack-keystone | 14:23 | |
| *** jaugustine has quit IRC | 14:24 | |
| *** raddaoui has joined #openstack-keystone | 14:25 | |
| knikolla | rodrigods: ^^ | 14:26 |
| *** code-R has quit IRC | 14:26 | |
| *** woodster_ has joined #openstack-keystone | 14:29 | |
| *** wxy has quit IRC | 14:30 | |
| *** aurelien__ has quit IRC | 14:30 | |
| *** jaosorior has quit IRC | 14:34 | |
| *** ddieterly[away] is now known as ddieterly | 14:34 | |
| *** dmk0202 has quit IRC | 14:35 | |
| *** henrynash has joined #openstack-keystone | 14:37 | |
| *** ChanServ sets mode: +v henrynash | 14:37 | |
| samueldmq | bknudson: hi, you around ? I'd like to get your view on an issue I am facing while migrating v2 docs from api-ref | 14:39 |
| bknudson | samueldmq: I am around. | 14:39 |
| bknudson | just get it working and we can clean it up | 14:39 |
| bknudson | eventually we should have everything in 1 place. | 14:40 |
| samueldmq | bknudson: yes, and the issue is to get it working | 14:40 |
| samueldmq | bknudson: we define API doc as : ".. rest_method:: GET /v2.0/tenants" | 14:40 |
| *** TxGVNN has joined #openstack-keystone | 14:40 | |
| samueldmq | bknudson: and the docs emit a warning (treated as error) if you define the same rest method twice | 14:40 |
| *** amrith is now known as _amrith_ | 14:41 | |
| samueldmq | bknudson: and that happens in v2 because we define the (usueal) v2.0 and v2.0 admin | 14:41 |
| samueldmq | and some APIs like /v2.0/tenants are described in both | 14:41 |
| bknudson | yes, they work differently depending on if you use public or admin | 14:41 |
| samueldmq | bknudson: I was thinking about appending adding path alias to them... does that look correct? | 14:42 |
| *** nkinder has joined #openstack-keystone | 14:42 | |
| samueldmq | s/appending adding/appending | 14:42 |
| bknudson | I don't know what a path alias is | 14:42 |
| bknudson | like identity/ and identity_v2_admin/ ? | 14:43 |
| samueldmq | bknudson: yes | 14:43 |
| bknudson | I'm fine with that | 14:43 |
| samueldmq | bknudson: cool, that way the tool won't take them as repeated definitions | 14:43 |
| samueldmq | bknudson: I have patches that finish migrating v3 and one that migrate /v2 | 14:44 |
| samueldmq | bknudson: I am working on the last one to migrate v2-admin and v2-ext | 14:44 |
| samueldmq | thanks | 14:44 |
| *** _amrith_ is now known as amrith | 14:44 | |
| bknudson | these will all have to be consolidated | 14:44 |
| samueldmq | bknudson: when specifying "/identity_v2_admin", is the version still needed ? | 14:49 |
| samueldmq | bknudson: like '/identity_v2_admin/v2.0/tenants' | 14:49 |
| bknudson | samueldmq: yes, identity_v2_admin/v3 works too | 14:50 |
| bknudson | but the only reason there's an identity_v2_admin is because of v2 | 14:50 |
| *** phalmos has joined #openstack-keystone | 14:51 | |
| samueldmq | bknudson: kk identity_v2_admin/v3 looks weird, looks like identity_admin/[ | 14:51 |
| samueldmq | identity_admin/[v2.0|v3] makes more sense; but anyways | 14:52 |
| *** belmoreira has quit IRC | 14:52 | |
| *** timcline has joined #openstack-keystone | 14:52 | |
| bknudson | use whatever you want in the doc | 14:53 |
| bknudson | just say it's whatever endpoint is hosting the admin api | 14:53 |
| *** ayoung has joined #openstack-keystone | 14:54 | |
| *** ChanServ sets mode: +v ayoung | 14:54 | |
| *** fhubik has quit IRC | 14:59 | |
| *** mou has joined #openstack-keystone | 15:00 | |
| *** jistr is now known as jistr|call | 15:01 | |
| *** tesseract has quit IRC | 15:11 | |
| *** arunkant has quit IRC | 15:14 | |
| *** amrith is now known as _amrith_ | 15:17 | |
| *** rbridgeman has joined #openstack-keystone | 15:19 | |
| *** EinstCrazy has joined #openstack-keystone | 15:19 | |
| *** _amrith_ is now known as amrith | 15:19 | |
| *** darosale has quit IRC | 15:20 | |
| *** KevinE has joined #openstack-keystone | 15:20 | |
| *** rcernin has quit IRC | 15:24 | |
| *** jistr|call is now known as jistr | 15:25 | |
| *** rk4n has joined #openstack-keystone | 15:29 | |
| *** links has quit IRC | 15:29 | |
| *** rk4n has quit IRC | 15:29 | |
| *** rk4n has joined #openstack-keystone | 15:30 | |
| *** rk4n_ has quit IRC | 15:30 | |
| *** pnavarro has quit IRC | 15:33 | |
| rodrigods | knikolla, because mod_shib points back to keystone | 15:35 |
| rodrigods | it doesn't know keystone's specific endpoint to treat that idp | 15:35 |
| knikolla | rodrigods: understood. wasted some hours debugging tempest before figuring out that they've recently moved to urllib3 for requests. and it automatically followed the redirect to the :5000/ | 15:37 |
| KevinE | How do you tie a bug to a proposed change? | 15:37 |
| dstanek | KevinE: the propsed change you tag the bug in the commit message | 15:38 |
| KevinE | dstanek: how do you change your commit message again? Yes I'm that bad lol | 15:40 |
| * rodrigods knows this feeling | 15:40 | |
| dstanek | KevinE: if you 'git commit --amend' it'll let you edit it | 15:40 |
| KevinE | rodrigods: we in this cloud together friend haha | 15:40 |
| dstanek | KevinE: no worries. everybody has to learn sometime. we | 15:40 |
| dstanek | we're pretty friendly here :-) | 15:40 |
| KevinE | dstanek: thanks!! | 15:40 |
| rodrigods | KevinE, :) | 15:41 |
| *** d34dh0r53 is now known as h0m3r | 15:41 | |
| *** roxanaghe has joined #openstack-keystone | 15:41 | |
| dstanek | KevinE: here is an example https://review.openstack.org/#/c/214287/ | 15:41 |
| patchbot | dstanek: patch 214287 - keystone - Adds warning when no domain configs were uploaded | 15:41 |
| KevinE | ahh great. However I tried to edit my commit message and it wasn't my commit message, it was someone else's.. | 15:42 |
| dstanek | KevinE: checkout the 'Including external references' section here: https://wiki.openstack.org/wiki/GitCommitMessages | 15:42 |
| dstanek | KevinE: git ammending will change on last commit on the branch you are on | 15:42 |
| *** ddieterly is now known as ddieterly[away] | 15:43 | |
| dstanek | KevinE: you could 'git review -d ####' if nothing else to pull down your change | 15:43 |
| *** sigmavirus24 is now known as m3du5a | 15:43 | |
| *** h0m3r is now known as d34dh0r53 | 15:43 | |
| *** m3du5a is now known as sigmavirus24 | 15:44 | |
| *** ddieterly[away] is now known as ddieterly | 15:45 | |
| KevinE | dstanek: okay I ammended it, now another git review -R? | 15:46 |
| *** pgbridge has joined #openstack-keystone | 15:47 | |
| dstanek | KevinE: just 'git review' would be fine - no reason to avoid the rebase in this case | 15:47 |
| openstackgerrit | Kevin Esensoy proposed openstack/python-keystoneclient: OS_INTERFACE ignored when determining endpoint_type https://review.openstack.org/321809 | 15:47 |
| KevinE | whelp hey there gerrit | 15:48 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Change password requirements https://review.openstack.org/320156 | 15:48 |
| KevinE | kind of annoying that Jenkins has to re-check your stuff for just a commit change | 15:48 |
| KevinE | commit message change * | 15:48 |
| *** itlinux has joined #openstack-keystone | 15:52 | |
| *** KevinE has quit IRC | 15:56 | |
| *** KevinE has joined #openstack-keystone | 15:56 | |
| *** dave-mccowan has quit IRC | 15:57 | |
| *** ddieterly is now known as ddieterly[away] | 15:57 | |
| dstanek | KevinE: yes. i think it helps when things change under your patch | 15:58 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Migrate identity /v2-admin docs from api-ref repo https://review.openstack.org/322247 | 15:58 |
| *** spzala has quit IRC | 15:58 | |
| KevinE | dstanek: you're saying you like it? | 15:59 |
| dstanek | KevinE: no, i'm indifferent. i don't think it happens all the time though | 16:00 |
| KevinE | dstanek: For our Liberty installation, this is absolutely mandatory for anything that touches keystone, even though it shouldn't matter to most other people | 16:00 |
| KevinE | dstanek: I had a hell of a time getting to this though because like, no not EVERYONE's keystone is broken right now lol | 16:01 |
| KevinE | How do you get people to review a change? Is it like a magical "they will come" type thing or? | 16:02 |
| *** mkrcmari__ has quit IRC | 16:04 | |
| notmorgan | KevinE: is this also affecting keystoneauth? https://github.com/openstack/keystoneauth/blob/80b58cc2f2aa73e2d3fc88ef2e27fa3db6ed0025/keystoneauth1/access/service_catalog.py most of the code dealiung with sessions and catalog etc is all deprecated in keystoneclient | 16:04 |
| *** lhcheng has joined #openstack-keystone | 16:04 | |
| *** ChanServ sets mode: +v lhcheng | 16:04 | |
| notmorgan | KevinE: keep in mind the CLI from keystoneclient is deprecated for a long time, (and removed in 3.0.0) - does this affect modern openstackclients as well? | 16:05 |
| notmorgan | KevinE: (which implies keystoneauth being affected). | 16:06 |
| samueldmq | KevinE: dstanek: commit messages may include Depends-On :) | 16:06 |
| *** code-R has joined #openstack-keystone | 16:06 | |
| notmorgan | KevinE: also... does that answer your question on people looking at code? ;) | 16:06 |
| KevinE | I don't believe so, but I'm not sure how I could check it anyways. I'm 110% noob assigned a big boy project haha | 16:06 |
| *** itlinux has quit IRC | 16:06 | |
| notmorgan | KevinE: no worries then :) | 16:06 |
| KevinE | yes oh magic reviewer man | 16:06 |
| notmorgan | KevinE: so what version of keystoneclient are you using and i assume you're doing | 16:07 |
| notmorgan | "keystone XXXX" command ? | 16:07 |
| KevinE | notmorgan: I'm lost what? | 16:07 |
| notmorgan | when you see this error | 16:07 |
| notmorgan | what command are you typing? or where is the error appearing | 16:07 |
| *** pece has joined #openstack-keystone | 16:08 | |
| KevinE | notmorgan: I do a rally keystone user-create-and-delete just for testing purposes, but it's present for every single keystone task | 16:08 |
| notmorgan | ok | 16:08 |
| *** aurelien__ has joined #openstack-keystone | 16:08 | |
| dstanek | KevinE: reviewers are like wizards. we show up at just the right time (for us) | 16:09 |
| notmorgan | hmmm. wonder what rally is using under the hood there. | 16:10 |
| notmorgan | dstanek: i'm going to guess this is something we'll need to look at for keystoneauth as well | 16:11 |
| notmorgan | i'm looking at the keystoneauth code. | 16:12 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Migrate identity /v3-ext docs from api-ref repo https://review.openstack.org/322131 | 16:12 |
| KevinE | notmorgan: you're just suggesting that my code could extend, rather than it being incorrect.. correct? | 16:12 |
| notmorgan | KevinE: right. your code likely needs to go in the new common auth library vs just in keystoneclient | 16:12 |
| notmorgan | KevinE: we're trying to remove all the session/catalog/discovery code from keystoneclient and keep it isolated in our common auth library (most everything is using now) | 16:14 |
| notmorgan | KevinE: it doesn't look like your code is inherantly wrong... Where do you see OS_INTERFACE as a ENV var documented? | 16:15 |
| bknudson | our libraries shouldn't be magically changing their behavior based on env vars. It should be up to the application to setup the library. | 16:15 |
| notmorgan | bknudson: this is something that should be passed in via OSC | 16:15 |
| notmorgan | bknudson: honestly | 16:16 |
| notmorgan | bknudson: the fact that KSC does magic in both places because of historical mixing of CRUD, CLi, and SESSION is another issue | 16:16 |
| notmorgan | bknudson: and/or this should be coming from RALLY. | 16:16 |
| notmorgan | bknudson: maybe it belongs is OCC which iirc does things like reading ENVs | 16:17 |
| notmorgan | ? | 16:17 |
| bknudson | yes, rally should be configuring keystoneclient correctly (assuming keystoneclient can be configured for this... if that's the problem then make keystoneclient configurable) | 16:17 |
| notmorgan | bknudson: also, i think modern rally doesn't use KSC anymore. | 16:17 |
| notmorgan | oh, wow, wait a sec. this is V2-isms. | 16:18 |
| notmorgan | because it's assuming public vs admin split. | 16:18 |
| *** ddieterly[away] is now known as ddieterly | 16:19 | |
| KevinE | fyi I'm here but I have no clue what y'all are talking about :) | 16:19 |
| notmorgan | KevinE: no worries, we're def off in the weeds looking at details around this. | 16:19 |
| *** code-R_ has joined #openstack-keystone | 16:19 | |
| notmorgan | KevinE: in summary, you're not wrong, this is an issue. it is a bit more involved than it appears at face value. | 16:20 |
| *** amrith is now known as _amrith_ | 16:20 | |
| KevinE | notmorgan: Awesome, this is the first time in 2 weeks of trying to fix this that someone saw a problem I was trying to fix <3 | 16:20 |
| notmorgan | KevinE: the code may need to go into a different place/project, but being able to do what you're describing in the bug is correct behavior. | 16:20 |
| KevinE | notmorgan: I'd be happy to test it against our env | 16:20 |
| notmorgan | KevinE: and we'll do what we can to help you get it in the right place | 16:20 |
| KevinE | notmorgan: when it comes to that * | 16:21 |
| notmorgan | what version of openstack are you running? | 16:21 |
| notmorgan | out of curiosity | 16:21 |
| *** code-R has quit IRC | 16:22 | |
| *** gagehugo has joined #openstack-keystone | 16:22 | |
| KevinE | I think we have 1 Icehouse and 1 Liberty? and I think Liberty is the one in question | 16:23 |
| notmorgan | ok | 16:23 |
| notmorgan | cool. | 16:23 |
| dstanek | no/b 27 | 16:24 |
| dstanek | grabbing some lunch and then some keystone reviews! what an exciting day ahead of me | 16:25 |
| notmorgan | dstanek: hehe | 16:25 |
| notmorgan | dstanek: i am going to grab breakfast and keep working on making nodepool py3 compat! *fun* | 16:25 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Change password requirements https://review.openstack.org/320156 | 16:26 |
| zzzeek | notmorgan: do you have any insight on what's going to happen when someone has dogpile.core installed as a namespace package and they now install the bundled version of both ? | 16:26 |
| notmorgan | zzzeek: hhm ok so this is the oslo namespace issue. whichever is installed last wins. - i need to check something | 16:28 |
| zzzeek | notmorgan: yup, and in oslo we changed all the names to oslo_foo | 16:28 |
| notmorgan | zzzeek: i think the way we need to do this... is | 16:29 |
| notmorgan | zzzeek: dogpile.core needs a new release with nothing in the packaged except a requires on dogpile.cache. | 16:29 |
| zzzeek | notmorgan: if we need to do full blown oslo, then i sort of know what's involved (and it sucks) | 16:29 |
| zzzeek | notmorgan: hmmmmmm | 16:29 |
| notmorgan | zzzeek: if we can cross depend, dogpile.cache depends on new dogpile.core with nothing in it | 16:29 |
| notmorgan | else... | 16:29 |
| notmorgan | we release this new merged lib as "dogpile" | 16:30 |
| *** atiwari has joined #openstack-keystone | 16:30 | |
| notmorgan | and make dogpile.cache and dogpile.core "empty" projects that depend on dogpile | 16:30 |
| zzzeek | notmorgan: oh so "from dogpile import foo, bar" | 16:30 |
| notmorgan | in requirements.txt | 16:30 |
| *** atiwari has quit IRC | 16:30 | |
| notmorgan | i wouldn't do any importing | 16:30 |
| notmorgan | can python packages cross depend? aka XXX depends on YYY and YYY depends on XXX? | 16:31 |
| notmorgan | or does that just explode the dep solver? | 16:31 |
| zzzeek | notmorgan: i doubt that works | 16:31 |
| notmorgan | because that would make this easy. | 16:31 |
| notmorgan | zzzeek: hm. | 16:32 |
| zzzeek | notmorgan: assumption #1 im making is, nobody has "dogpile.core" in their deps | 16:32 |
| notmorgan | i am ok with that assumption. | 16:32 |
| notmorgan | OH! wait i know | 16:33 |
| *** diazjf has joined #openstack-keystone | 16:33 | |
| notmorgan | no wait nvm | 16:33 |
| notmorgan | ok so i think this is what we do: | 16:33 |
| *** pushkaru has joined #openstack-keystone | 16:33 | |
| notmorgan | dogpile.core gets to be an empty python package with a requirements.txt that says dogpile.cache>=<new release with merged things> | 16:33 |
| notmorgan | and dogpile.cache is the merged thing. | 16:34 |
| notmorgan | you know... i have an idea | 16:34 |
| *** spzala has joined #openstack-keystone | 16:34 | |
| *** diazjf has quit IRC | 16:35 | |
| zzzeek | but then it installs dogpile.cache, which overwrites dogpile.core, then it puts dogpile.core in there and overwrites it as blank..this highly dependson which install tool is used | 16:35 |
| zzzeek | if you are installing as .eggs or whatnot | 16:35 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Migrate identity /v2-admin docs from api-ref repo https://review.openstack.org/322247 | 16:35 |
| notmorgan | zzzeek: i *think* we can blacklist older dogpile.core in dogpile.cache. even if core depends on cache? | 16:35 |
| notmorgan | zzzeek: so.. the easiest solution | 16:36 |
| notmorgan | zzzeek: simply release the new dogpile.cache as "dogpile" | 16:36 |
| notmorgan | on pypi/egg/whatever | 16:36 |
| notmorgan | and make new dogpile.cache and new dogpile.core depend on it. | 16:36 |
| notmorgan | with empty packages and just requirements | 16:36 |
| notmorgan | if someone goes out of their way to install old dogpile.cache/core on top of dogpile they're really stretching | 16:37 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Migrate identity /v2-admin docs from api-ref repo https://review.openstack.org/322247 | 16:37 |
| zzzeek | notmorgan: but doesnt that mean just to install dogpile.cache, it ends up installing two packages | 16:37 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Migrate identity /v2-admin docs from api-ref repo https://review.openstack.org/322247 | 16:37 |
| notmorgan | only if you use dogpile.cache as the installer (this is for the upgrade case) | 16:38 |
| zzzeek | notmorgan: we could just do total name change here. dogpile-cache. no more dots. we're done | 16:38 |
| notmorgan | zzzeek: true. | 16:38 |
| notmorgan | zzzeek: or dogpile_cache :P | 16:38 |
| notmorgan | or whatever. | 16:38 |
| zzzeek | well for pypi package name arent dashes a little more legit than underscores | 16:38 |
| notmorgan | right | 16:38 |
| notmorgan | personally, i think we should just release it as "dogpile" | 16:38 |
| *** spzala has quit IRC | 16:39 | |
| zzzeek | notmorgan: sure, but there is still the dotted issue | 16:39 |
| *** EinstCrazy has quit IRC | 16:39 | |
| notmorgan | hold on looking at something. | 16:39 |
| notmorgan | ugh. i wish python's dep solver had a clean "conflicts-with" construct | 16:40 |
| notmorgan | zzzeek: so, lets say we release this as dogpile 1.0 | 16:41 |
| notmorgan | zzzeek: and we release dogpile.cache 1.0, and dogpile.core 1.0 [argument sake, numbers don't matter] | 16:41 |
| *** aurelien__ has quit IRC | 16:41 | |
| notmorgan | dogpile.cache and core are just empty (no code) | 16:41 |
| notmorgan | dogpile depends on dogpile.core/cache >=1.0 | 16:41 |
| notmorgan | ugh. we break people who do quiet upgrades | 16:42 |
| notmorgan | nvm | 16:42 |
| KevinE | notmorgan: I guess I should put this here: https://review.openstack.org/#/c/320056/ this may be interesting, as this was my other fix I proposed, but was unable to figure out | 16:42 |
| patchbot | KevinE: patch 320056 - rally - Tie endpoint_type to interface | 16:42 |
| notmorgan | KevinE: that is possibly it | 16:42 |
| notmorgan | zzzeek: ok, we need to use a new namespace. dogpile-cache and dogpile_cache are *probably* the most correct. | 16:43 |
| KevinE | notmorgan: but we couldn't figure out what was going on, so we debugged here: https://review.openstack.org/#/c/320118/ | 16:43 |
| patchbot | KevinE: patch 320118 - rally - [DO NOT MERGE] Disable osresources.py (ABANDONED) | 16:43 |
| KevinE | notmorgan: for when you get your coffee ;) | 16:43 |
| notmorgan | zzzeek: boo. | 16:43 |
| zzzeek | notmorgan: oslo did all this w/o changing the package names | 16:43 |
| notmorgan | zzzeek: we can keep dogpile.cache package name fwiw, that isn't too hard. | 16:44 |
| zzzeek | notmorgan: they provide an oslo_foo and oslo.foo module inside of foo | 16:44 |
| zzzeek | notmorgan: right and it just has dogpile_cache, dogpile_core, and dogpile.cache internally, right | 16:44 |
| notmorgan | zzzeek: yeah i think we're doing the oslo_thing. | 16:44 |
| notmorgan | yep. | 16:44 |
| notmorgan | or well we don't even need dogpile_core, it could be dogpile_cache.core | 16:45 |
| zzzeek | doh | 16:45 |
| zzzeek | notmorgan: how about this. assumption #2. everyone uses pip to install | 16:45 |
| notmorgan | but yeah in either case. | 16:45 |
| notmorgan | LOL | 16:45 |
| zzzeek | no more "python setup.py install" | 16:45 |
| notmorgan | i am good with that | 16:45 |
| zzzeek | b.c. thats when setuptools gets in there and does crazy egg shit | 16:46 |
| KevinE | I third this movement | 16:46 |
| zzzeek | i mean, obviously that will still work, but just if you have an exsiting install, that'll break | 16:46 |
| notmorgan | i assume that people will either use pip *or* distro packages | 16:46 |
| notmorgan | and distropackages are going to be magic compared to this | 16:46 |
| zzzeek | notmorgan: so we just make sure this works w/ pip. we can even have setup.py require a minimum version of pip | 16:47 |
| *** can8dnSix has joined #openstack-keystone | 16:47 | |
| notmorgan | so i think dogpile_cache.cache and dogpile_cache.core works fine, (and dogpile.cache -> dogpile_cache.cache). and then dogpile.core can depend on dogpile_cache and dogpile.core -> dogpile_cache.core | 16:47 |
| notmorgan | zzzeek: and pip does all the work for you | 16:48 |
| notmorgan | zzzeek: in either case. | 16:48 |
| notmorgan | you get some wonkyness still with the namespace if people do eggs. | 16:48 |
| zzzeek | notmorgan: i was thinking of just brute forcing this. just leave it as dogpile.cache | 16:48 |
| notmorgan | but thats going to be mostly edge-case. | 16:48 |
| notmorgan | oh | 16:48 |
| notmorgan | sure. | 16:48 |
| zzzeek | if you're doing pip | 16:48 |
| notmorgan | hmmm | 16:48 |
| zzzeek | do people run pip in some way that it makes .egg files? | 16:48 |
| notmorgan | don't think so. | 16:49 |
| notmorgan | so dogpile.cache wins, owns the namespace | 16:50 |
| notmorgan | and leave dogpile.core to ... bitrot? | 16:50 |
| zzzeek | notmorgan: i just need to see what happens if, someone has dogpile.core installed already, and i say "import dogpile.core" | 16:51 |
| notmorgan | or release new dogpile.core that simply says "install dogpile.cache <new version>" | 16:51 |
| zzzeek | notmorgan: i think pip w/ namespace packages puts them in the same directory doesnt it | 16:51 |
| notmorgan | uhm... | 16:51 |
| notmorgan | as long as you don't use -e | 16:51 |
| * notmorgan checks this | 16:51 | |
| *** sdake has joined #openstack-keystone | 16:52 | |
| *** spzala has joined #openstack-keystone | 16:52 | |
| zzzeek | brb | 16:53 |
| *** rk4n has quit IRC | 16:55 | |
| notmorgan | zzzeek: ok so if dogpile.cache (new) is installed over dogpile.core | 16:55 |
| notmorgan | you get the new dogpile.cache files. | 16:55 |
| *** agrebennikov has joined #openstack-keystone | 16:55 | |
| notmorgan | uninstalling old dogpile.core seems to not break dogpile.cache | 16:56 |
| notmorgan | (interestingly) | 16:56 |
| notmorgan | oh nvm it does | 16:56 |
| *** spzala has quit IRC | 16:57 | |
| notmorgan | and installing dogpile.core after new dogpile.cache breaks things | 16:57 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Change password requirements https://review.openstack.org/320156 | 16:59 |
| *** rk4n has joined #openstack-keystone | 17:00 | |
| *** rk4n_ has joined #openstack-keystone | 17:01 | |
| samueldmq | reading the existing api-ref docs, I assume OS-KSCATALOG, OS-KSS3 and OS-KSVALIDATE are things that existed in keystone somewhen | 17:04 |
| samueldmq | but have been removed sometime (long time?) ago | 17:04 |
| *** spzala has joined #openstack-keystone | 17:04 | |
| samueldmq | notmorgan: ^ you can confirm that ? | 17:05 |
| notmorgan | uhm | 17:05 |
| notmorgan | yeah possibly? | 17:05 |
| notmorgan | predates me afaik | 17:05 |
| *** rk4n has quit IRC | 17:05 | |
| notmorgan | cactus? | 17:05 |
| *** gyee has joined #openstack-keystone | 17:05 | |
| *** ChanServ sets mode: +v gyee | 17:05 | |
| samueldmq | notmorgan: nice, I can't find them in the code; that means they have gone | 17:06 |
| samueldmq | notmorgan: just want to check they've been there somewhen :) | 17:06 |
| samueldmq | notmorgan: cactus => long time ago | 17:06 |
| notmorgan | oh no looks like keystone first released in essex | 17:07 |
| notmorgan | april 2012 | 17:07 |
| samueldmq | anyway, that can give us an idea of how updated identity api-ref docs are | 17:07 |
| samueldmq | :-) | 17:07 |
| samueldmq | notmorgan: thanks | 17:08 |
| notmorgan | oh no thats just WADL things | 17:08 |
| notmorgan | not headers | 17:08 |
| notmorgan | response examples | 17:08 |
| notmorgan | https://github.com/openstack/api-site/tree/master/api-ref/src/wadls/identity-api/src/v2.0/samples | 17:08 |
| *** code-R_ has quit IRC | 17:08 | |
| *** spzala has quit IRC | 17:09 | |
| *** tonytan4ever has quit IRC | 17:10 | |
| henrynash | ayoung: hi….you objected to the copying of the sql driver for testing purposes in https://review.openstack.org/#/c/305315/ - this was discussed at the irc meeting on Tuesday, with the general view that this was a necessary evil. Are you OK with it, given that discussion? | 17:12 |
| patchbot | henrynash: patch 305315 - keystone - Create V9 driver for identity backend | 17:12 |
| ayoung | henrynash, not really | 17:13 |
| ayoung | it pretty much sucks | 17:13 |
| henrynash | ayoung: so what’s the alternative? | 17:13 |
| henrynash | ayoung: (and it only such for the 2 depreacted releases, since we delete the code then) | 17:13 |
| ayoung | henrynash, I won't hold it up...but think long and hard if there is a better approach, I'm sure theres is | 17:14 |
| ayoung | henrynash, gotta meeting now | 17:14 |
| henrynash | ayoung: ok, thx | 17:14 |
| notmorgan | henrynash: if we want to drop the whole versioned backends thing i'm fine with it. | 17:16 |
| henrynash | notmorgan: :-) | 17:16 |
| *** clenimar has quit IRC | 17:17 | |
| *** rk4n has joined #openstack-keystone | 17:17 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Return 404 instead of 401 for tokens w/o roles https://review.openstack.org/322280 | 17:17 |
| notmorgan | henrynash: but eh *shrug* | 17:17 |
| *** gyee has quit IRC | 17:18 | |
| *** ayoung has quit IRC | 17:20 | |
| *** rk4n_ has quit IRC | 17:20 | |
| *** gyee has joined #openstack-keystone | 17:20 | |
| *** ChanServ sets mode: +v gyee | 17:20 | |
| KevinE | notmorgan: Jenkins just gave me a +1 ! | 17:21 |
| notmorgan | KevinE: ok so you found the other place or that was on the keystoneclient one? | 17:22 |
| notmorgan | KevinE: sorry i'm being pulled a little bit all over.:P | 17:22 |
| *** code-R has joined #openstack-keystone | 17:22 | |
| *** pushkaru has quit IRC | 17:23 | |
| *** henrynash has quit IRC | 17:23 | |
| KevinE | notmorgan: no problem lol. That's just the original python-keystoneclient one. As far as the second 2 that I sent you, I just will not be able to see anything, that's just for your viewing pleasure when you get a chance to look into it | 17:23 |
| *** code-R has quit IRC | 17:23 | |
| amakarov | rderose, hi! | 17:23 |
| *** code-R has joined #openstack-keystone | 17:23 | |
| notmorgan | KevinE: ah ok. | 17:24 |
| rderose | amakarov: hey | 17:24 |
| KevinE | brb | 17:24 |
| amakarov | rderose, I've thought about account locking - I have to admit that the best way to do that is store unsuccessfull attempts in KVS | 17:24 |
| amakarov | rderose, sql will be a bad choice | 17:25 |
| rderose | amakarov: why? | 17:25 |
| amakarov | rderose, imagine db load if we will log unsuccessfull attempts | 17:26 |
| amakarov | during brute force attack | 17:26 |
| notmorgan | amakarov: i'm going to -2 anything that tries to re-introduce "KVS" backends. | 17:26 |
| notmorgan | amakarov: as an FYI. | 17:27 |
| rderose | :) | 17:27 |
| amakarov | notmorgan, I know that | 17:27 |
| notmorgan | ;) | 17:27 |
| *** tqtran has joined #openstack-keystone | 17:27 | |
| bknudson | insert a rate limiter | 17:27 |
| notmorgan | bknudson: known pattern. | 17:27 |
| rderose | amakarov: hmm... | 17:28 |
| amakarov | notmorgan, so I think I'll have to do a pluggable sql backend | 17:28 |
| *** ddieterly is now known as ddieterly[away] | 17:28 | |
| amakarov | notmorgan, considering kvs as a customization ;) | 17:28 |
| rderose | amakarov: pluggable? | 17:28 |
| notmorgan | amakarov: don't expect kvs support upstream though - thats all. | 17:28 |
| amakarov | rderose, it's the most obvious way now | 17:29 |
| notmorgan | it also depends on how you're tracking failures. | 17:29 |
| amakarov | notmorgan, I will not introduce kvs in keystone, of course | 17:29 |
| notmorgan | fwiw, KVS is going to suffer from a ton of similar problems that SQL will | 17:29 |
| amakarov | notmorgan, it should be a log-shaped table with inserts | 17:30 |
| rderose | amakarov: we can manage db load for unsuccessful attempts, just truncate every so often | 17:30 |
| notmorgan | amakarov: correct | 17:30 |
| samueldmq | notmorgan: there is docs too https://github.com/openstack/api-site/tree/master/api-ref/src/wadls/identity-api/src/v2.0/wadl | 17:30 |
| amakarov | rderose, ++ as an option | 17:30 |
| notmorgan | amakarov: KVS is a bad pattern where queries of lots of related things need to be grouped together because of housekeeping/locking overhead | 17:31 |
| amakarov | rderose, notmorgan and yet another bit of ... to the fan: account locking opens up MANY opportunities for attacker: https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks#Locking_Accounts | 17:32 |
| notmorgan | amakarov: this is an argument for API keys and/or signed requests | 17:32 |
| amakarov | notmorgan, ++ | 17:32 |
| notmorgan | amakarov: if you're authing with passwords and support locking of accounts you're doing it wrong (for public RESTful API things) | 17:33 |
| amakarov | notmorgan, totally agree and I will personally recommend requesting customer to disable this :) | 17:33 |
| amakarov | locking, I mean | 17:34 |
| bknudson | I think it's funny that account lockout applies to every user except superuser. | 17:34 |
| notmorgan | bknudson: hehe | 17:34 |
| amakarov | bknudson, it's even more funny: I wasn't ask about admin exception ;) | 17:35 |
| *** ayoung has joined #openstack-keystone | 17:35 | |
| *** ChanServ sets mode: +v ayoung | 17:35 | |
| amakarov | s/ask/asked/ | 17:35 |
| *** spzala has joined #openstack-keystone | 17:36 | |
| amakarov | notmorgan, so what's you suggestion? store attempts in sql? | 17:37 |
| notmorgan | amakarov: not sure. probably, but you can structure it in a more sane way - i also think moving towards an api-key or whatever thing so username/password is ony used for managing api-keys would be needed. | 17:39 |
| *** rk4n has quit IRC | 17:39 | |
| amakarov | notmorgan, well, I'll start with something and we shall see what will it come to. | 17:41 |
| *** rk4n has joined #openstack-keystone | 17:42 | |
| *** amakarov is now known as amakarov_away | 17:45 | |
| *** rk4n has quit IRC | 17:46 | |
| *** roxanaghe has quit IRC | 17:46 | |
| *** roxanaghe has joined #openstack-keystone | 17:48 | |
| *** links has joined #openstack-keystone | 17:49 | |
| *** sdake_ has joined #openstack-keystone | 17:52 | |
| *** sdake has quit IRC | 17:55 | |
| *** julim has quit IRC | 17:56 | |
| *** mou has quit IRC | 18:03 | |
| *** TxGVNN has quit IRC | 18:03 | |
| *** sdake_ is now known as sdake | 18:06 | |
| stevemar | notmorgan: clean backport: https://review.openstack.org/#/c/321812/ | 18:07 |
| patchbot | stevemar: patch 321812 - keystone (stable/mitaka) - Honor ldap_filter on filtered user list | 18:07 |
| notmorgan | nice | 18:07 |
| rodrigods | stevemar, notmorgan make it voting? https://review.openstack.org/#/c/321890/ | 18:08 |
| patchbot | rodrigods: patch 321890 - openstack-infra/project-config - Make keystone functional tests job voting | 18:08 |
| rodrigods | think it needs a +1 from stevemar | 18:09 |
| rodrigods | thanks stevemar | 18:09 |
| dstanek | stevemar, stevemar! | 18:10 |
| stevemar | rodrigods: np ;) | 18:10 |
| stevemar | dstanek: :O :O | 18:10 |
| notmorgan | rodrigods: yes. | 18:10 |
| *** links has quit IRC | 18:10 | |
| *** gagehugo has quit IRC | 18:14 | |
| *** spzala has quit IRC | 18:17 | |
| *** spzala has joined #openstack-keystone | 18:18 | |
| *** rderose has quit IRC | 18:18 | |
| *** spzala_ has joined #openstack-keystone | 18:20 | |
| *** spzala has quit IRC | 18:22 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add protocols integration tests https://review.openstack.org/307508 | 18:23 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add mapping rules integration tests https://review.openstack.org/305444 | 18:23 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add service providers integration tests https://review.openstack.org/303502 | 18:23 |
| *** spzala_ has quit IRC | 18:25 | |
| *** georgem1 has joined #openstack-keystone | 18:25 | |
| *** ddieterly[away] has quit IRC | 18:28 | |
| *** rderose has joined #openstack-keystone | 18:28 | |
| openstackgerrit | Merged openstack/keystone: Add the validation rules when create token https://review.openstack.org/315894 | 18:34 |
| *** code-R has quit IRC | 18:41 | |
| *** roxanaghe has quit IRC | 18:44 | |
| *** pradk has joined #openstack-keystone | 18:46 | |
| *** spzala has joined #openstack-keystone | 18:46 | |
| *** spzala has quit IRC | 18:46 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Migrate identity /v2 docs from api-ref repo https://review.openstack.org/322173 | 18:49 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Migrate identity /v3-ext docs from api-ref repo https://review.openstack.org/322131 | 18:50 |
| *** code-R has joined #openstack-keystone | 18:51 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Migrate identity /v2-admin docs from api-ref repo https://review.openstack.org/322247 | 18:51 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Migrate identity /v2-ext docs from api-ref repo https://review.openstack.org/322301 | 18:52 |
| *** ayoung has quit IRC | 19:03 | |
| *** ayoung has joined #openstack-keystone | 19:03 | |
| *** ChanServ sets mode: +v ayoung | 19:03 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Migrate identity /v2-ext docs from api-ref repo https://review.openstack.org/322301 | 19:08 |
| *** sdake_ has joined #openstack-keystone | 19:09 | |
| samueldmq | ok; we should have enough to migrate the docs from api-ref | 19:09 |
| *** itlinux has joined #openstack-keystone | 19:09 | |
| samueldmq | :) | 19:09 |
| *** sdake has quit IRC | 19:10 | |
| notmorgan | samueldmq: uhm. sure? | 19:14 |
| notmorgan | samueldmq: i dunno what the plan on that is | 19:14 |
| notmorgan | tbh | 19:14 |
| *** ddieterly has joined #openstack-keystone | 19:17 | |
| *** rderose has quit IRC | 19:17 | |
| *** sdake has joined #openstack-keystone | 19:18 | |
| *** daemontool has quit IRC | 19:18 | |
| *** sdake_ has quit IRC | 19:19 | |
| knikolla | anybody wants me to review anything while waiting for stack.sh ? | 19:20 |
| *** itlinux has quit IRC | 19:22 | |
| KevinE | https://review.openstack.org/#/c/321809/ maybe | 19:22 |
| patchbot | KevinE: patch 321809 - python-keystoneclient - OS_INTERFACE ignored when determining endpoint_type | 19:22 |
| KevinE | There's a debate whether this should go here or in keystoneauth | 19:23 |
| *** nkinder has quit IRC | 19:23 | |
| samueldmq | notmorgan: there is an effort to migrate api-ref docs from /api-ref repo to projects repo | 19:30 |
| samueldmq | notmorgan: I volunteered to do the work for keystone | 19:30 |
| notmorgan | samueldmq: ahh | 19:30 |
| *** ddieterly has quit IRC | 19:31 | |
| *** openstack has joined #openstack-keystone | 21:42 | |
| *** gordc has quit IRC | 21:46 | |
| *** code-R has joined #openstack-keystone | 21:47 | |
| *** amrith is now known as _amrith_ | 21:53 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!