| *** raddaoui has quit IRC | 00:07 | |
| *** dan_nguyen has quit IRC | 00:16 | |
| *** r-daneel has quit IRC | 00:19 | |
| *** roxanaghe has quit IRC | 00:22 | |
| *** adrian_otto has quit IRC | 00:26 | |
| *** pgbridge has joined #openstack-keystone | 00:29 | |
| *** sdake has quit IRC | 00:42 | |
| notmorgan | rderose: it wasn't about upgrading without testing/changing, it was about committing to a contract for the driver interface so it was easier to see what was changed. | 00:44 |
|---|---|---|
| notmorgan | rderose: i've had many operators complain about the volume of change in the driver interfaces between releases. this was an effort to avoid that complaint. | 00:44 |
| notmorgan | rderose: especially when the operator was chasing closer to master (like some do) | 00:45 |
| rderose | notmorgan: I see. But we can show what changed through release notes, documentation... | 00:45 |
| notmorgan | rderose: not really sufficient with the volume to change we've done in the past | 00:46 |
| *** pgbridge has quit IRC | 00:46 | |
| notmorgan | rderose: it turned into days-weeks of effort every time just to get the interfaces "working" let alone acceptance testing | 00:46 |
| notmorgan | rderose: but i don't think many deployers are custom drivering it anymore. | 00:47 |
| rderose | notmorgan: ah, I see the reasoning then. hopefully, there is not still a need. thanks for clarifying. | 00:47 |
| *** rderose has quit IRC | 00:53 | |
| *** browne has quit IRC | 01:15 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/327368 | 01:23 |
| *** roxanaghe has joined #openstack-keystone | 01:23 | |
| *** roxanaghe has quit IRC | 01:28 | |
| samueldmq | jamielennox: hi | 01:48 |
| jamielennox | samueldmq: howdy | 01:48 |
| samueldmq | jamielennox: regarding patch 309038 | 01:48 |
| patchbot | samueldmq: https://review.openstack.org/#/c/309038/ - keystone - Added X-Forwarding-For support. | 01:48 |
| samueldmq | jamielennox: looks like there is already the support for X-FORWARDED-FOR in https://github.com/openstack/oslo.middleware/blob/master/oslo_middleware/http_proxy_to_wsgi.py | 01:48 |
| jamielennox | samueldmq: not for _FOR | 01:49 |
| samueldmq | jamielennox: I can see it treating the HTTP_FORWARDED header.. or is that a different thing ? | 01:49 |
| samueldmq | jamielennox: kk they're different things | 01:49 |
| jamielennox | samueldmq: umm, sec | 01:49 |
| samueldmq | jamielennox: sure | 01:50 |
| jamielennox | https://en.wikipedia.org/wiki/List_of_HTTP_header_fields#Common_non-standard_request_fields | 01:50 |
| jamielennox | so it looks like the standards are X-Forwarded-[Host|Proto|For] | 01:50 |
| jamielennox | but the whole thing has been replaced by rfc7239 which uses Forwarded: | 01:51 |
| jamielennox | so the oslo.middleware is looking for Forwarded first and if that's not found falling back to the X-Forwarded headers | 01:52 |
| samueldmq | jamielennox: so X-Forwarded-For treats the client original IP address | 01:52 |
| jamielennox | yep, which is the initial bug gyee filed | 01:53 |
| jamielennox | bug 1550127 | 01:53 |
| openstack | bug 1550127 in OpenStack Identity (keystone) "Wrong IP Address for error message in keystone.log" [Low,In progress] https://launchpad.net/bugs/1550127 - Assigned to Guang Yee (guang-yee) | 01:53 |
| samueldmq | jamielennox: I was confused because of X-Forwarded-Host (which seems to be the load balancer public address | 01:53 |
| jamielennox | samueldmq: yea, that's why i found the wikipedia entry as it's the only place i've seen that explains all the different headers | 01:53 |
| samueldmq | jamielennox: nice, it already Proto and Host, just needs someone to implement For | 01:54 |
| samueldmq | jamielennox: ++ | 01:54 |
| jamielennox | samueldmq: i think the middleware is really good - it's just a shame it defaults to disabled | 01:54 |
| jamielennox | samueldmq: i really don't understand that decision, it's middleware if you wanted to disable it you'd remove it from the pipeline | 01:54 |
| samueldmq | jamielennox: yes that's a good thing, I didn't even know about it before last week :( | 01:54 |
| jamielennox | and for everyone else it's going to make no difference | 01:55 |
| samueldmq | jamielennox: agreed, no change on behavior for those who simply don't use it | 01:55 |
| lbragstad | dolphm http://cdn.pasteraw.com/iuuf0wmct68xr0utm4o8e9kkwf72wd8 should check https://review.openstack.org/#/c/265455/1 out from gerrit - right? | 02:00 |
| patchbot | lbragstad: patch 265455 - keystone - Expose bug with fernet and trusts | 02:00 |
| lbragstad | dolphm or am i just missing something? | 02:00 |
| *** dan_nguyen has joined #openstack-keystone | 02:09 | |
| *** ayoung has quit IRC | 02:17 | |
| *** lhcheng has joined #openstack-keystone | 02:19 | |
| *** ChanServ sets mode: +v lhcheng | 02:19 | |
| *** alex_xu has quit IRC | 02:21 | |
| *** alex_xu has joined #openstack-keystone | 02:23 | |
| openstackgerrit | ayoung proposed openstack/keystone: IAM Models https://review.openstack.org/184651 | 02:23 |
| *** TxGVNN has joined #openstack-keystone | 02:24 | |
| *** ayoung has joined #openstack-keystone | 02:25 | |
| *** ChanServ sets mode: +v ayoung | 02:25 | |
| stevemar | notmorgan: dolphm stable patch https://review.openstack.org/#/c/327381/1 | 02:26 |
| patchbot | stevemar: patch 327381 - keystone (stable/mitaka) - Revert to caching fernet tokens the same way we do... | 02:26 |
| notmorgan | oh hai | 02:26 |
| notmorgan | whats up stevemar ? | 02:26 |
| stevemar | notmorgan: just looking for someone that has +2 on stable :) | 02:26 |
| jamielennox | unable to take leave | 02:27 |
| notmorgan | stevemar: thats a big changeset... | 02:27 |
| *** dan_nguyen has quit IRC | 02:27 | |
| notmorgan | jamielennox: lol | 02:27 |
| stevemar | jamielennox: i was out all day! | 02:27 |
| jamielennox | i was looking at that patch, i'm really unhappy with how many caching edge cases there are throughout there | 02:28 |
| notmorgan | stevemar: OMG............. I've almost got a massive amount of encode/decode/encode/decode/encode/decode logic done in zuul... | 02:28 |
| notmorgan | stevemar: sooooooo close.... | 02:28 |
| *** woodster_ has quit IRC | 02:28 | |
| jamielennox | i think MEMOIZE is dangerous through there and we might just want to replace it with an actual cache object that they all share | 02:29 |
| notmorgan | woooooooooooo FAILED (id=0, failures=34) | 02:29 |
| *** ayoung has quit IRC | 02:29 | |
| notmorgan | jamielennox: 90% of the time someone does @MEMOIZE wrong the first 5 times. | 02:30 |
| * notmorgan pulls statistics out of thin air | 02:30 | |
| jamielennox | yea, i'd love to see the maths on that | 02:30 |
| *** lhcheng has quit IRC | 02:30 | |
| jamielennox | i think there are simple cases where memoize is really useful but it gets overused and makes invalidation painful | 02:30 |
| notmorgan | jamielennox: unfortunately, the way keystone is built, standard cache objects would also ... just fail. | 02:31 |
| notmorgan | jamielennox: for the same exact reasons. | 02:31 |
| notmorgan | jamielennox: people don't understand invalidations regardless of how it's executed. | 02:31 |
| notmorgan | "mycache.get(thing)" | 02:31 |
| jamielennox | notmorgan: right invalidation a known hard problem | 02:31 |
| jamielennox | but having different caches on _validate_token, _validate_v2_token, _validate_v3_token and validate_non_persistent_token could surely be replaced with just one caching layer | 02:32 |
| notmorgan | jamielennox: yes. i would love to drop caching in keystone because i don't have energy to keep on top of all the cache addition/changing patches and i think maybe you and steve are the other people in keystone who can debug it consistently | 02:32 |
| notmorgan | jamielennox: that is a problem with our stupid (REALLY STUPID) token validator pipeline | 02:33 |
| jamielennox | notmorgan: i turn it off more than i should | 02:33 |
| notmorgan | we should validate tokens exactly one way. | 02:33 |
| jamielennox | i've always wanted to refactor that but it's just a really dangerous spot and the times i've tried always get too complicated to follow | 02:33 |
| notmorgan | jamielennox: at this point with (exception of pki/pkiz) we could move everything to fernet if the performance is even close (with this patch it's closer) | 02:34 |
| notmorgan | jamielennox: i think i'm going to propose a change inc. a migration to store the fernet equiv payload in the token table. | 02:34 |
| notmorgan | and then we can do "reconstruct" (ignore pki(z)) | 02:34 |
| notmorgan | and i am inclined to make pki(z) non-persistent if we're not ditching it. | 02:35 |
| lbragstad | jamielennox i'm still working through the performance CI - should have something by tomorrow | 02:35 |
| jamielennox | notmorgan: i'm actually really keen to see with the auth_token middleware being used from keystone if we can do PKI from middleware | 02:35 |
| notmorgan | since we could just decode the pki-data | 02:35 |
| notmorgan | jamielennox: yes. | 02:35 |
| jamielennox | notmorgan: there's a bunch of stuff i just think we should no longer have to do | 02:35 |
| notmorgan | jamielennox: even if not, it would be easy to do now. | 02:35 |
| jamielennox | but i made the stupid decision to refactor everything to use request rather than our context object and so am a bit stuck | 02:35 |
| notmorgan | we could make .validate_non-persistent_token -> .validate_reconstructable_token | 02:35 |
| notmorgan | jamielennox: and merge a ton of logic back in. | 02:36 |
| notmorgan | we just need to split pack/unpack into proper parts that aren't built into .validate_thing | 02:36 |
| notmorgan | that replace ._persistence.get_token_data | 02:36 |
| jamielennox | lbragstad: will be good to see. are you wiping the worker between runs or just checking out again? | 02:36 |
| notmorgan | and ._persistence.save | 02:37 |
| lbragstad | jamielennox no - everything is green field install | 02:37 |
| jamielennox | lbragstad: i saw your ansible snippet - i didn't even know we pushed changeset refs to git.openstack.org so i'm no help | 02:37 |
| * notmorgan mutters about things he'd like to do but he's almost 100% successfully context switched to zuul for the moment | 02:37 | |
| lbragstad | jamielennox here is an example of what the current perf runs look like on master | 02:38 |
| lbragstad | http://cdn.pasteraw.com/lh3vhhhp42by03vpyi60espctimwoh0 | 02:38 |
| jamielennox | lbragstad: other than returning to jenkins are you pushing that data somewhere? | 02:38 |
| lbragstad | jamielennox not yet - what i have locally is kind of a mess | 02:38 |
| lbragstad | just looking for mvp currently | 02:39 |
| jamielennox | lbragstad: yep | 02:39 |
| lbragstad | the last step is to get the patch pulled down from gerrit | 02:39 |
| lbragstad | installed and rekick apache | 02:39 |
| lbragstad | then rerun the benchmark | 02:39 |
| jamielennox | so i've never tried doing ansible with gerrit changes, but we have come across places where the ansible git module does things in different ways to just running git cmdline | 02:40 |
| lbragstad | interesting | 02:40 |
| notmorgan | jamielennox: oh just wait... Gerrit => Zuul => Ansible is a thing! | 02:40 |
| jamielennox | like if you clone with a branch name then try and try and do submodule tasks it seems to have pulled some weird limited set of the repo, not what you'd get with a git clone | 02:41 |
| jamielennox | lbragstad: so it's worth replacing it with a command: git <do stuff> and if that works just skip the git module | 02:42 |
| notmorgan | stevemar: look at the cache thing | 02:42 |
| lbragstad | jamielennox i might have to resort to that | 02:42 |
| jamielennox | notmorgan: i'm definitely waiting | 02:42 |
| lbragstad | jamielennox but dolphm got it working here - https://github.com/dolph/keystone-deploy/blob/master/playbooks/roles/keystone/tasks/main.yaml#L12-L21 | 02:42 |
| lbragstad | and we were using that to check out patches up for review and testing them | 02:42 |
| notmorgan | jamielennox: zuulv3 will be good. but at least as a POC zuulv25 (with zuulansiblelauncher) is a thing we're getting up and running. | 02:43 |
| jamielennox | lbragstad: obvious difference, he's using review.openstack.org and you're using git.openstack.org | 02:43 |
| notmorgan | jamielennox: use git.openstack.org in all cases if you're doing http transport | 02:43 |
| notmorgan | lbragstad: ^ | 02:43 |
| jamielennox | i'm not sure if they're backed to the same thing | 02:43 |
| notmorgan | jamielennox: they are | 02:43 |
| stevemar | notmorgan: what about the cache thing? | 02:43 |
| notmorgan | stevemar: my comment | 02:43 |
| jamielennox | notmorgan: i thought git was just the published branches behind load balancers, but ok | 02:44 |
| notmorgan | jamielennox: git fetch https://git.openstack.org/openstack/keystone refs/changes/81/327381/1 && git checkout FETCH_HEAD [for example] | 02:44 |
| notmorgan | all the refs are there for pending patches too | 02:44 |
| notmorgan | that is https://review.openstack.org/#/c/327381/1 | 02:44 |
| patchbot | notmorgan: patch 327381 - keystone (stable/mitaka) - Revert to caching fernet tokens the same way we do... | 02:44 |
| notmorgan | ftr. | 02:44 |
| notmorgan | jamielennox: if you click "download" and select "anonymous http" you can use git.openstack.org instead of ssh://<user>@review.openstack.org | 02:45 |
| notmorgan | .... | 02:45 |
| jamielennox | notmorgan: yea, i saw that | 02:45 |
| notmorgan | :) | 02:45 |
| notmorgan | basically, don't use review.openstack.org unless you *need* to imo | 02:45 |
| jamielennox | so IMO, if you're constantly redeploying the whole machine i think i'd write the setup in bash and not ansible | 02:46 |
| lbragstad | jamielennox we have some of that saved away because we're using lxd | 02:50 |
| lbragstad | so we built an ubuntu image with basic things that quicken the process a bit | 02:50 |
| *** sheel has joined #openstack-keystone | 02:52 | |
| jamielennox | lbragstad: yea, ok, makes sense | 02:52 |
| *** browne has joined #openstack-keystone | 02:57 | |
| *** gyee has quit IRC | 03:01 | |
| * notmorgan looks... omg. down to ~3 py3 failures in zuul... | 03:02 | |
| *** sdake has joined #openstack-keystone | 03:10 | |
| *** richm has quit IRC | 03:14 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/327369 | 03:15 |
| *** iurygregory_ has quit IRC | 03:17 | |
| *** iurygregory_ has joined #openstack-keystone | 03:17 | |
| *** roxanaghe has joined #openstack-keystone | 03:24 | |
| stevemar | notmorgan: i should send a ML post about making cache and messaging always there in ksm | 03:24 |
| *** sdake has quit IRC | 03:26 | |
| *** roxanaghe has quit IRC | 03:29 | |
| *** adrian_otto has joined #openstack-keystone | 03:34 | |
| jamielennox | stevemar: i have a patch that makes cache a direct requirement anyway so that one is going to be required anyway | 03:35 |
| *** iurygregory_ has quit IRC | 03:35 | |
| stevemar | jamielennox: is the patch posted? | 03:41 |
| jamielennox | stevemar: yea, that's an old one: https://review.openstack.org/#/c/268664/ | 03:42 |
| patchbot | jamielennox: patch 268664 - keystonemiddleware - Use oslo_cache in auth_token middleware | 03:42 |
| jamielennox | hmm, didn't know it was failing | 03:42 |
| jamielennox | but it looks like all its dependencies have merged now | 03:42 |
| *** lhcheng has joined #openstack-keystone | 03:45 | |
| *** ChanServ sets mode: +v lhcheng | 03:45 | |
| *** links has joined #openstack-keystone | 03:46 | |
| *** lhcheng_ has joined #openstack-keystone | 03:49 | |
| stevemar | jamielennox: well, if we're going to make things required, lets do it early in the cycle | 03:51 |
| stevemar | its a pretty big dependency to bring in | 03:51 |
| *** lhcheng has quit IRC | 03:52 | |
| jamielennox | stevemar: i'll fix up that review then, i haven't looked at it in a while | 03:52 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add docstring to delete_project https://review.openstack.org/280446 | 04:01 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add docstring to delete_project https://review.openstack.org/280446 | 04:08 |
| *** TxGVNN has quit IRC | 04:14 | |
| *** roxanaghe has joined #openstack-keystone | 04:26 | |
| *** roxanaghe has quit IRC | 04:30 | |
| notmorgan | stevemar: yeah | 04:30 |
| notmorgan | stevemar: possibly. | 04:30 |
| jamielennox | notmorgan: how would you feel about taking the memorycache into oslo.cache? | 04:40 |
| notmorgan | jamielennox: uhm.. the crap on in ksm? | 04:44 |
| notmorgan | jamielennox: it's already there. | 04:44 |
| jamielennox | notmorgan: oh, really? | 04:44 |
| notmorgan | jamielennox: yeah | 04:45 |
| jamielennox | so i found the problem with my oslo.cache review was i wrote it back when we changed the default to a noop and removed the memory cache | 04:45 |
| jamielennox | is there a way i can tell oslo.cache/dogpile to default to the crappy memory one if nothing else is defined? | 04:45 |
| notmorgan | jamielennox: https://github.com/openstack/oslo.cache/blob/master/oslo_cache/backends/dictionary.py | 04:46 |
| notmorgan | jamielennox: you just need to tell the config to use that one by default. | 04:46 |
| notmorgan | in the config override. | 04:46 |
| jamielennox | oh, via like CONF.set_default() or something | 04:47 |
| jamielennox | hmm | 04:47 |
| *** jaosorior has joined #openstack-keystone | 04:47 | |
| notmorgan | uh... something like that | 04:47 |
| notmorgan | there is a way to override the default for config generation too | 04:47 |
| jamielennox | there doesn't seem to be a way i can set the default via oslo_cache.configure() | 04:48 |
| notmorgan | i have a horrible hack in keystone for it | 04:48 |
| notmorgan | oslo_cache needs to get the .set_default matic | 04:48 |
| notmorgan | magic* | 04:48 |
| jamielennox | notmorgan: is there a reason oslo.cache is using a static _BACKENDS list instead of entrypoints? | 04:49 |
| notmorgan | jamielennox: haven't updated it | 04:49 |
| notmorgan | jamielennox: need to get around to fixing that | 04:49 |
| jamielennox | ok, so you'd take that? | 04:49 |
| notmorgan | yeah. dogpile *should* suppot entrypoints natively | 04:49 |
| notmorgan | btw | 04:49 |
| jamielennox | notmorgan: where would you prefer it to go? i'm more comfortable getting it into oslo.cache | 04:50 |
| jamielennox | but i'll leave it if dogpile is the better location | 04:50 |
| notmorgan | oslo_cache should just make sure we're consuming appropriate entrypoints via dogpile | 04:51 |
| notmorgan | but we can do it eithe rway | 04:51 |
| * notmorgan would be fine with it. | 04:51 | |
| jamielennox | i think we would still need to do oslo_config opts via oslo_cache entrypoints? | 04:51 |
| jamielennox | that option dict building nonsense | 04:51 |
| jamielennox | notmorgan: so it looks like dogpile does support backends via entrypoint | 04:55 |
| jamielennox | it just chooses to register them manually for plugins in tree | 04:55 |
| notmorgan | jamielennox: yeah | 04:56 |
| *** GB21 has joined #openstack-keystone | 04:57 | |
| notmorgan | stevemar, jamielennox: this makes me rediculously happy: http://i.imgur.com/qtUqN8y.png?1 | 05:05 |
| jamielennox | notmorgan: congrats | 05:05 |
| notmorgan | jamielennox: the patch chain is... kindof insane. | 05:05 |
| jamielennox | that would have been painful | 05:05 |
| jamielennox | py3 conversion is mostly X didn't work, ok .encode(), nope .decode() | 05:06 |
| jamielennox | :) | 05:06 |
| notmorgan | jamielennox: https://review.openstack.org/#/q/status:open+project:openstack-infra/zuul+branch:master+topic:v25+owner:%22Morgan+Fainberg+%253Cmorgan.fainberg%2540gmail.com%253E%22 | 05:06 |
| notmorgan | jamielennox: and https://review.openstack.org/#/c/327310/ | 05:07 |
| patchbot | notmorgan: patch 327310 - openstack-infra/gear - Do not encode the type (b) in the job name | 05:07 |
| notmorgan | jamielennox: and that is the second fix to gear needed for this. | 05:07 |
| jamielennox | notmorgan: on the upside the 2 or 3 i've clicked on are mostly obvious +As | 05:08 |
| jamielennox | first oslo.cache bug | 05:09 |
| jamielennox | https://github.com/openstack/oslo.cache/blob/master/oslo_cache/backends/mongo.py#L164 doesn't exist | 05:09 |
| notmorgan | jamielennox: it has been a lot of splitting it apart because dumping an 800line "fix py3" just felt wrong | 05:09 |
| notmorgan | jamielennox: this was the worst one to deal with: https://review.openstack.org/#/c/327435/ | 05:10 |
| patchbot | notmorgan: patch 327435 - openstack-infra/zuul - Python 3 Fixes: More encode/decode fixes | 05:10 |
| notmorgan | jamielennox: lol mongo missing | 05:11 |
| notmorgan | ahahaha clearly no one is using that. | 05:11 |
| jamielennox | notmorgan: oh, i think maybe he moved that with 0.6 | 05:12 |
| jamielennox | which is ugh | 05:12 |
| notmorgan | oh yeah maybe | 05:12 |
| notmorgan | actually might be my fault | 05:13 |
| notmorgan | i did a ton of the work in 0.6 to roll in dogpile.core | 05:13 |
| jamielennox | notmorgan: yea, it's a 0.5->0.6 thing | 05:14 |
| notmorgan | sorry :( | 05:14 |
| jamielennox | notmorgan: it went from dogpile.cache.util.memorized_property to dogpile.util.memoized_property | 05:14 |
| notmorgan | ahh | 05:14 |
| notmorgan | doh | 05:14 |
| *** roxanaghe has joined #openstack-keystone | 05:15 | |
| notmorgan | if that is the extent we broke people though... | 05:15 |
| notmorgan | wow not too shappy | 05:15 |
| notmorgan | shabby | 05:15 |
| jamielennox | notmorgan: maybe, that whole util dir seems wrong | 05:15 |
| notmorgan | and ultimately fixable with a pointer in dogpile.cache | 05:15 |
| notmorgan | the old util dir was bad | 05:15 |
| *** rcernin|off has joined #openstack-keystone | 05:15 | |
| notmorgan | the new one is more "correct" | 05:15 |
| notmorgan | the reason it was in dogpile.cache.util was because dogpile.core owned dogpile and dogpile.core namespaces | 05:15 |
| notmorgan | so it had to be isolated | 05:16 |
| jamielennox | ok, so creating dogpile.util was intentional | 05:16 |
| notmorgan | jamielennox: yes | 05:21 |
| *** jed56 has quit IRC | 05:23 | |
| *** lamt_ has quit IRC | 05:23 | |
| *** tpeoples has quit IRC | 05:24 | |
| *** DuncanT has quit IRC | 05:24 | |
| *** sheel has quit IRC | 05:24 | |
| *** jraim has quit IRC | 05:24 | |
| *** andreykurilin__ has quit IRC | 05:25 | |
| *** serverascode has quit IRC | 05:25 | |
| *** ctracey has quit IRC | 05:25 | |
| *** briancurtin has quit IRC | 05:25 | |
| *** boris-42 has quit IRC | 05:25 | |
| *** zhiyan has quit IRC | 05:25 | |
| *** nikhil has quit IRC | 05:25 | |
| *** andrewbogott has quit IRC | 05:25 | |
| *** rcernin|off has quit IRC | 05:26 | |
| *** lamt has joined #openstack-keystone | 05:27 | |
| *** DuncanT has joined #openstack-keystone | 05:27 | |
| *** sheel has joined #openstack-keystone | 05:29 | |
| *** briancurtin has joined #openstack-keystone | 05:30 | |
| *** jed56 has joined #openstack-keystone | 05:31 | |
| jamielennox | notmorgan: i take it the sqlalchemy gerrit works for you? | 05:31 |
| *** jraim has joined #openstack-keystone | 05:32 | |
| *** andrewbogott has joined #openstack-keystone | 05:32 | |
| *** tpeoples has joined #openstack-keystone | 05:32 | |
| *** andreykurilin__ has joined #openstack-keystone | 05:32 | |
| *** ctracey has joined #openstack-keystone | 05:33 | |
| *** zhiyan has joined #openstack-keystone | 05:33 | |
| *** serverascode has joined #openstack-keystone | 05:34 | |
| *** boris-42 has joined #openstack-keystone | 05:34 | |
| *** nikhil has joined #openstack-keystone | 05:35 | |
| jamielennox | notmorgan, zzzeek: https://bitbucket.org/zzzeek/dogpile.cache/pull-requests/51/link-moved-functions-in-dogpilecacheutil/diff | 05:41 |
| notmorgan | jamielennox: it does. | 05:41 |
| notmorgan | jamielennox: i do not have merge access in it, but it does work. | 05:42 |
| notmorgan | jamielennox: you should propose the fix to sql-a gerrit ;) | 05:42 |
| jamielennox | notmorgan: it doesn't seem to want to connect at all | 05:42 |
| notmorgan | jamielennox: awww. | 05:42 |
| notmorgan | sec | 05:42 |
| jamielennox | i added ssh keys and everything | 05:42 |
| notmorgan | jamielennox: hmm works for me. | 05:42 |
| notmorgan | are you trying to use git-review? | 05:42 |
| notmorgan | cause.... | 05:43 |
| notmorgan | hm | 05:43 |
| notmorgan | it should work | 05:43 |
| notmorgan | *shrug* | 05:43 |
| notmorgan | i haven't proposed code to it yet though | 05:43 |
| jamielennox | notmorgan: he can figure it out tomorrow | 05:44 |
| jamielennox | notmorgan: i don't really want to debug our own gerrit let along someone elses | 05:44 |
| notmorgan | hehe | 05:46 |
| jamielennox | zzzeek: for later, ssh works with ssh -p 29418 jamielennox@gerrit.sqlalchemy.org | 05:47 |
| jamielennox | zzzeek: i can successfully clone with: git clone ssh://jamielennox@gerrit.sqlalchemy.org:29418/zzzeek/dogpile.cache.git | 05:47 |
| jamielennox | zzzeek: but i think you need to turn on some form of push acl for registered users to let them propose a patch | 05:48 |
| *** fawadkhaliq has joined #openstack-keystone | 05:50 | |
| *** fawadkhaliq has quit IRC | 05:50 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:51 | |
| *** itisha has quit IRC | 06:00 | |
| *** GB21 has quit IRC | 06:03 | |
| *** yolanda has joined #openstack-keystone | 06:05 | |
| *** nikhil has quit IRC | 06:07 | |
| *** nikhil has joined #openstack-keystone | 06:09 | |
| *** yolanda has quit IRC | 06:10 | |
| *** yolanda has joined #openstack-keystone | 06:10 | |
| *** rcernin|off has joined #openstack-keystone | 06:15 | |
| *** yolanda has quit IRC | 06:16 | |
| *** yolanda has joined #openstack-keystone | 06:18 | |
| *** GB21 has joined #openstack-keystone | 06:19 | |
| *** rcernin|off is now known as rcernin | 06:21 | |
| *** fawadkhaliq has quit IRC | 06:24 | |
| *** pnavarro has joined #openstack-keystone | 06:35 | |
| *** belmoreira has joined #openstack-keystone | 06:38 | |
| *** welldannit has quit IRC | 06:41 | |
| *** GB21 has quit IRC | 06:42 | |
| *** belmoreira has quit IRC | 06:48 | |
| *** welldannit has joined #openstack-keystone | 06:50 | |
| *** roxanaghe has quit IRC | 06:53 | |
| *** jbell8 has joined #openstack-keystone | 06:54 | |
| *** GB21 has joined #openstack-keystone | 07:00 | |
| *** belmoreira has joined #openstack-keystone | 07:07 | |
| *** pcaruana has joined #openstack-keystone | 07:09 | |
| *** browne has quit IRC | 07:14 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:25 | |
| *** fawadkhaliq has quit IRC | 07:31 | |
| openstackgerrit | Ryosuke Mizuno proposed openstack/keystone: Add validation rules for create token using a JSON schema https://review.openstack.org/325086 | 07:32 |
| *** hoonetorg has quit IRC | 07:47 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:47 | |
| *** tesseract has joined #openstack-keystone | 07:56 | |
| *** hoonetorg has joined #openstack-keystone | 07:58 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** openstackgerrit has quit IRC | 08:03 | |
| *** openstackgerrit has joined #openstack-keystone | 08:03 | |
| *** adrian_otto has quit IRC | 08:11 | |
| *** permalac has joined #openstack-keystone | 08:21 | |
| *** alex_xu has quit IRC | 08:22 | |
| openstackgerrit | Merged openstack/oslo.policy: Add helper scripts for generating policy info https://review.openstack.org/321243 | 08:22 |
| *** alex_xu has joined #openstack-keystone | 08:25 | |
| *** daemontool has joined #openstack-keystone | 08:25 | |
| *** jaosorior has quit IRC | 08:28 | |
| *** jaosorior has joined #openstack-keystone | 08:28 | |
| *** henrynash_ has joined #openstack-keystone | 08:40 | |
| *** ChanServ sets mode: +v henrynash_ | 08:40 | |
| *** EinstCrazy has joined #openstack-keystone | 08:42 | |
| *** TxGVNN has joined #openstack-keystone | 08:44 | |
| *** rdo has quit IRC | 08:51 | |
| *** rdo has joined #openstack-keystone | 08:53 | |
| *** jbell8 has quit IRC | 09:17 | |
| *** jbell8 has joined #openstack-keystone | 09:18 | |
| *** lhcheng_ has quit IRC | 09:18 | |
| *** jbell8 has quit IRC | 09:22 | |
| *** jbell8 has joined #openstack-keystone | 09:22 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Add docstring to delete_project https://review.openstack.org/280446 | 09:23 |
| samueldmq | morning keystone | 09:23 |
| samueldmq | henrynash_: ^ | 09:23 |
| samueldmq | henrynash_: just fixed the typo | 09:24 |
| henrynash_ | dome | 09:24 |
| henrynash_ | oops, thx, +2’d | 09:24 |
| *** dmk0202 has joined #openstack-keystone | 09:28 | |
| *** rmizuno has quit IRC | 09:30 | |
| *** shewless has quit IRC | 09:30 | |
| *** nisha_ has joined #openstack-keystone | 09:43 | |
| *** mvk_ has quit IRC | 09:46 | |
| *** nisha_ has quit IRC | 09:50 | |
| *** nisha_ has joined #openstack-keystone | 09:56 | |
| *** henrynash_ has quit IRC | 10:02 | |
| *** fawadkhaliq has quit IRC | 10:03 | |
| *** fawadkhaliq has joined #openstack-keystone | 10:03 | |
| *** rk4n has joined #openstack-keystone | 10:10 | |
| *** rk4n has quit IRC | 10:16 | |
| *** mvk_ has joined #openstack-keystone | 10:17 | |
| *** _amrith_ is now known as amrith | 10:20 | |
| *** rk4n has joined #openstack-keystone | 10:26 | |
| *** rk4n has quit IRC | 10:26 | |
| *** rk4n has joined #openstack-keystone | 10:26 | |
| *** belmoreira has quit IRC | 10:31 | |
| *** nisha__ has joined #openstack-keystone | 10:32 | |
| *** nisha_ has quit IRC | 10:32 | |
| *** nisha__ is now known as nisha_ | 10:42 | |
| *** TxGVNN has quit IRC | 10:50 | |
| *** josecastroleon has quit IRC | 10:51 | |
| *** josecastroleon has joined #openstack-keystone | 10:57 | |
| *** nisha__ has joined #openstack-keystone | 11:01 | |
| *** nisha_ has quit IRC | 11:01 | |
| *** fawadk has joined #openstack-keystone | 11:20 | |
| *** fawadkhaliq has quit IRC | 11:21 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:21 | |
| *** shoutm has joined #openstack-keystone | 11:23 | |
| *** fawadk has quit IRC | 11:25 | |
| *** nisha__ is now known as nisha_ | 11:30 | |
| *** GB21 has quit IRC | 11:37 | |
| *** gordc has joined #openstack-keystone | 11:45 | |
| *** pauloewerton has joined #openstack-keystone | 11:45 | |
| *** sdake has joined #openstack-keystone | 11:56 | |
| *** GB21 has joined #openstack-keystone | 11:57 | |
| *** EinstCrazy has quit IRC | 12:04 | |
| *** markvoelker has joined #openstack-keystone | 12:04 | |
| *** agireud has quit IRC | 12:08 | |
| *** agireud has joined #openstack-keystone | 12:09 | |
| *** fawadk has joined #openstack-keystone | 12:14 | |
| *** GB21 has quit IRC | 12:16 | |
| *** fawadkhaliq has quit IRC | 12:18 | |
| *** belmoreira has joined #openstack-keystone | 12:20 | |
| *** EinstCrazy has joined #openstack-keystone | 12:24 | |
| *** fawadk has quit IRC | 12:31 | |
| stevemar | samueldmq: thanks for following up | 12:36 |
| *** TxGVNN has joined #openstack-keystone | 12:39 | |
| *** sdake has quit IRC | 12:48 | |
| *** julim has joined #openstack-keystone | 12:51 | |
| openstackgerrit | Merged openstack/keystone: Add docstring to delete_project https://review.openstack.org/280446 | 12:52 |
| openstackgerrit | Merged openstack/keystone: Honor ldap_filter on filtered group list https://review.openstack.org/325939 | 12:53 |
| samueldmq | stevemar: yw | 12:55 |
| *** links has quit IRC | 12:57 | |
| *** nisha__ has joined #openstack-keystone | 13:04 | |
| *** nisha_ has quit IRC | 13:05 | |
| *** ayoung has joined #openstack-keystone | 13:11 | |
| *** ChanServ sets mode: +v ayoung | 13:11 | |
| *** amrith is now known as _amrith_ | 13:12 | |
| *** links has joined #openstack-keystone | 13:17 | |
| *** edmondsw has joined #openstack-keystone | 13:22 | |
| *** links has quit IRC | 13:23 | |
| *** nisha__ is now known as nisha_ | 13:23 | |
| bknudson | Does anyone know what data is gathered when osprofiler is enabled? Has anybody used it? | 13:29 |
| *** nisha_ has quit IRC | 13:29 | |
| bknudson | I'll have have to try it out | 13:30 |
| dolphm | i know we deploy it to production because it's in every single default upstream pipeline *grumble* | 13:36 |
| *** henrynash_ has joined #openstack-keystone | 13:37 | |
| *** ChanServ sets mode: +v henrynash_ | 13:37 | |
| amakarov | Colleagues, please pay attention to cache invalidation issue: https://bugs.launchpad.net/oslo.cache/+bug/1590779 | 13:38 |
| openstack | Launchpad bug 1590779 in oslo.cache "Cache region invalidation works for local CacheRegion object only" [Undecided,New] | 13:38 |
| *** sdake has joined #openstack-keystone | 13:39 | |
| *** jaosorior has quit IRC | 13:42 | |
| *** nisha_ has joined #openstack-keystone | 13:42 | |
| *** nisha_ has quit IRC | 13:43 | |
| *** nisha_ has joined #openstack-keystone | 13:43 | |
| *** itisha has joined #openstack-keystone | 13:44 | |
| knikolla | o/ | 13:46 |
| *** fawadkhaliq has joined #openstack-keystone | 13:46 | |
| zzzeek | jamielennox: the system right now is, people just send me PRs because that's what they do anyway, I pull them into gerrit, then I add them to the "contributors" group so they can work on them. I havent solved the problem of allowing anyone to register and push code that runs on my own CI environment yet | 13:46 |
| zzzeek | jamielennox: I've added you to "Contributors" which has push access | 13:47 |
| *** ametts has joined #openstack-keystone | 13:49 | |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: fix ldap delete_user group member cleanup https://review.openstack.org/327358 | 13:52 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Refactor shadow users https://review.openstack.org/323596 | 13:55 |
| *** shoutm has quit IRC | 13:57 | |
| *** richm has joined #openstack-keystone | 13:59 | |
| *** ddieterly has joined #openstack-keystone | 14:01 | |
| *** henrynash_ has quit IRC | 14:04 | |
| *** _amrith_ is now known as amrith | 14:06 | |
| *** rodrigods has quit IRC | 14:06 | |
| *** rodrigods has joined #openstack-keystone | 14:07 | |
| *** henrynash_ has joined #openstack-keystone | 14:07 | |
| *** henrynash_ has quit IRC | 14:07 | |
| *** adrian_otto has joined #openstack-keystone | 14:08 | |
| *** fawadkhaliq has quit IRC | 14:08 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/323602 | 14:08 |
| *** GB21 has joined #openstack-keystone | 14:11 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix ValidationError exception name in docstring https://review.openstack.org/327696 | 14:11 |
| rodrigods | henrynash, samueldmq ^ a remaining nit from https://review.openstack.org/#/c/280446/ | 14:12 |
| patchbot | rodrigods: patch 280446 - keystone - Add docstring to delete_project (MERGED) | 14:12 |
| samueldmq | rodrigods: done | 14:14 |
| rodrigods | samueldmq, thx | 14:14 |
| *** agireud has quit IRC | 14:19 | |
| *** josdotso has joined #openstack-keystone | 14:20 | |
| dstanek | dolphm: i seriously dislike that | 14:20 |
| *** agireud has joined #openstack-keystone | 14:20 | |
| bknudson | Looks like osprofiler is disabled by default : http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n1672 | 14:21 |
| *** GB21 has quit IRC | 14:21 | |
| *** adrian_otto has quit IRC | 14:21 | |
| dolphm | dstanek: the osprofile thing? | 14:21 |
| dstanek | bknudson: it's disabled, but in the pipeline | 14:21 |
| dstanek | dolphm: yep | 14:22 |
| dolphm | bknudson: our default configuration is supposed to be production oriented | 14:22 |
| josdotso | OpenID Connect question: If CLI auth with python-openstack client requires the end-user to download an openrc.sh or similar which contains an OIDC client id and secret, does that design not compromise OIDC's protection of man in the middle attacks? http://salesforce.stackexchange.com/questions/14009/whats-the-benefit-of-the-client-secret-in-oauth2 | 14:22 |
| *** pushkaru has joined #openstack-keystone | 14:22 | |
| bknudson | we've been asked by our performance people to set this up on our production systems. | 14:23 |
| dolphm | bknudson: you should provide your performance people with their own lab | 14:23 |
| josdotso | I guess rather than MiM, it's rogue lookalike APIs | 14:24 |
| edmondsw | not sure why the bot didn't announce it, but I just cherry-picked this back to mitaka: https://review.openstack.org/#/c/327703/ | 14:26 |
| patchbot | edmondsw: patch 327703 - keystone (stable/mitaka) - Honor ldap_filter on filtered group list | 14:26 |
| dstanek | josdotso: what MiM prevention would be compromised? | 14:27 |
| dolphm | josdotso: doesn't that depend on where and how you get the secret? how does that differ than any other side band transfer of secrets? | 14:27 |
| *** gagehugo has joined #openstack-keystone | 14:28 | |
| josdotso | I was incorrect. I believe the concern is as follows: " | 14:29 |
| josdotso | 14:29 | |
| josdotso | Web apps use client secrets because they represent huge attack vectors. Let us say that someone poisons a DNS entry and sets up a rogue app "lookalike", the juxtapose might not be noticed for months, with this intermediary sucking up tons of data. Client secrets are supposed to mitigate this attack vector. For single user clients, compromise has to come one device at a time, which is horribly inefficient in comparison. While true that they | 14:29 |
| josdotso | are marginally less secure, they're still required to use TLS (avoids man-in-the-middle) and request-body posting (avoids logs)." http://salesforce.stackexchange.com/questions/14009/whats-the-benefit-of-the-client-secret-in-oauth2#comment20111_14013 | 14:29 |
| josdotso | It's my understanding that this is why client id and secret are typically behind a website, not downloaded | 14:30 |
| dolphm | josdotso: "Web apps use client secrets because they represent huge attack vectors." wait, typo? why would you use something *because* it's an attack vector? | 14:30 |
| dstanek | dolphm: the 'web app' is the attack vector in that example - the post talks about DNS poisoning, etc | 14:31 |
| dstanek | josdotso: so what's your concern? | 14:31 |
| josdotso | Sure thing... (cont.) | 14:31 |
| dolphm | ooh, definitely misread | 14:31 |
| dstanek | josdotso: client ID isn't included in all oauth flows because it's easy to get and spoof | 14:32 |
| dstanek | imagine a desktop twitter client that includes a client ID. you could very easily that that and use it in your own client | 14:32 |
| *** jorge_munoz has joined #openstack-keystone | 14:33 | |
| dstanek | my understanding of client ID in the oauth2 send is that it's nothing to do with the user - it's to make sure only authorized clients can access an api | 14:33 |
| josdotso | My concern is that client ID and secret are obtained from user's host, where client ID and secret must match the client ID and secret configured in Keystone, no? So there is only the one client id and one client secret configured at IDP for the whole openstack cloud it would seem. If bad actor / actual user knows the client id and secret, can they not spoof Keystone itself? | 14:33 |
| josdotso | still learning on this topic, so i appreciate the help | 14:34 |
| josdotso | dstanek: agree | 14:35 |
| dstanek | josdotso: they can only spoof keystone if they spoof the SSL certs or the client doesn't validate them | 14:35 |
| rodrigods | dstanek, ++ | 14:35 |
| rodrigods | josdotso, besides that, all cryptography techniques assumes the keys are "secure" | 14:36 |
| dstanek | josdotso: i could spoof keystone right now by just setting up my own one. the trick is to get you to use it instead of your own | 14:36 |
| rodrigods | so... they assume the user host is not compromised | 14:36 |
| josdotso | agreed on the spoofing and validation. client computer would likely store client-id and secret in plain text. | 14:36 |
| josdotso | True true. Ok cool. | 14:37 |
| josdotso | So sharing the single client-id and client-secret with every user is okay | 14:37 |
| dstanek | the client id protects the server against unauthorized clients (not sure openstack cares about it) - it doens't protect the client from unauthorized servers | 14:37 |
| josdotso | Yes, that's becoming clear now. Hmm... | 14:37 |
| josdotso | So SSL is what's making it a sound idea. Works for me. | 14:38 |
| josdotso | (validation) | 14:38 |
| josdotso | Thanks! | 14:39 |
| *** woodburn has joined #openstack-keystone | 14:39 | |
| *** woodburn1 has quit IRC | 14:39 | |
| *** pushkaru has quit IRC | 14:41 | |
| *** pcaruana has quit IRC | 14:41 | |
| *** pushkaru has joined #openstack-keystone | 14:42 | |
| *** timcline has joined #openstack-keystone | 14:42 | |
| *** raddaoui has joined #openstack-keystone | 14:44 | |
| *** rderose has joined #openstack-keystone | 14:44 | |
| *** rdo has quit IRC | 14:45 | |
| josdotso | So yeah. Looks like the only thing of concern would be phishing sites, but that's no less possible using non-OIDC, so no complaints from me: http://homakov.blogspot.com/2012/08/oauth2-one-accesstoken-to-rule-them-all.html?showComment=1413191400799#c4692320422916164133 | 14:48 |
| *** slberger has joined #openstack-keystone | 14:53 | |
| *** josdotso has quit IRC | 14:53 | |
| samueldmq | rderose: hi | 14:54 |
| rderose | samueldmq: hi | 14:54 |
| samueldmq | rderose: you've separated the driver option deprecation from that change right? | 14:54 |
| samueldmq | rderose: have you submitted it to gerrit yet ? | 14:55 |
| rderose | samueldmq: I think so, let me see | 14:55 |
| *** ddieterly is now known as ddieterly[away] | 14:57 | |
| rderose | samueldmq: give me a few, in a meeting | 14:57 |
| breton | where is notmorgan | 14:59 |
| *** fawadkhaliq has joined #openstack-keystone | 15:00 | |
| *** nisha_ has quit IRC | 15:01 | |
| *** woodburn has quit IRC | 15:01 | |
| *** woodburn1 has joined #openstack-keystone | 15:01 | |
| *** ddieterly[away] is now known as ddieterly | 15:01 | |
| samueldmq | rderose: sure | 15:02 |
| samueldmq | rderose: take your time | 15:02 |
| *** rdo has joined #openstack-keystone | 15:02 | |
| *** nisha_ has joined #openstack-keystone | 15:03 | |
| *** henrynash_ has joined #openstack-keystone | 15:05 | |
| *** ChanServ sets mode: +v henrynash_ | 15:05 | |
| *** EinstCrazy has quit IRC | 15:05 | |
| *** rk4n has quit IRC | 15:06 | |
| *** rk4n has joined #openstack-keystone | 15:07 | |
| *** KevinE has joined #openstack-keystone | 15:07 | |
| *** andrewbogott has quit IRC | 15:08 | |
| *** andrewbogott has joined #openstack-keystone | 15:08 | |
| *** julim has quit IRC | 15:09 | |
| *** rk4n has quit IRC | 15:15 | |
| *** rk4n has joined #openstack-keystone | 15:16 | |
| *** rk4n has quit IRC | 15:23 | |
| *** dan_nguyen has joined #openstack-keystone | 15:28 | |
| *** belmoreira has quit IRC | 15:29 | |
| *** browne has joined #openstack-keystone | 15:30 | |
| *** tesseract has quit IRC | 15:30 | |
| *** adrian_otto has joined #openstack-keystone | 15:32 | |
| *** rcernin has quit IRC | 15:32 | |
| *** GB21 has joined #openstack-keystone | 15:33 | |
| *** woodster_ has joined #openstack-keystone | 15:34 | |
| *** woodburn1 has quit IRC | 15:34 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Refactor shadow users https://review.openstack.org/323596 | 15:35 |
| rderose | samueldmq: Based on dolphm and dstanek comments, I'm removing the deprecation part from the refactor | 15:35 |
| *** woodburn has joined #openstack-keystone | 15:36 | |
| samueldmq | rderose: sure | 15:36 |
| samueldmq | rderose: would you mind to put lazy='subquery' in a separate patch too ? | 15:36 |
| samueldmq | rderose: that's changing the behavior somehow... not the behavior of the API provided itself, but ... | 15:37 |
| samueldmq | rderose: it doesn't hurt, should be an easy approval, just to get a dedicated commit message and explanation of the change | 15:37 |
| rderose | samueldmq: true | 15:38 |
| dolphm | samueldmq: that's a whitespace change, isn't it? | 15:38 |
| rderose | dolphm: changing lazy loading to eager loading | 15:38 |
| rderose | dolphm: so not a whitespace change | 15:39 |
| *** agireud has quit IRC | 15:40 | |
| samueldmq | dolphm: what rderose said ^ | 15:40 |
| *** dmk0202 has quit IRC | 15:41 | |
| *** pgbridge has joined #openstack-keystone | 15:41 | |
| rderose | samueldmq dolphm dstanek: will make this 2 commits | 15:41 |
| *** agireud has joined #openstack-keystone | 15:42 | |
| *** rk4n has joined #openstack-keystone | 15:43 | |
| samueldmq | rderose: ++ | 15:44 |
| *** KevinE_ has joined #openstack-keystone | 15:45 | |
| *** KevinE has quit IRC | 15:46 | |
| *** henrynash_ has quit IRC | 15:46 | |
| *** ddieterly is now known as ddieterly[away] | 15:47 | |
| *** aloga has quit IRC | 15:48 | |
| *** aloga has joined #openstack-keystone | 15:49 | |
| *** TxGVNN has quit IRC | 15:52 | |
| *** ddieterly[away] is now known as ddieterly | 16:10 | |
| *** GB21 has quit IRC | 16:12 | |
| notmorgan | breton: i was sleeping | 16:18 |
| *** gyee has joined #openstack-keystone | 16:19 | |
| *** ChanServ sets mode: +v gyee | 16:19 | |
| breton | notmorgan: good. I have a question about this thing: https://github.com/openstack/keystone/blob/stable/mitaka/keystone/common/cache/core.py#L71 | 16:20 |
| breton | notmorgan: how did you make sure that it works? | 16:21 |
| notmorgan | breton: direct testing, with a hack that lets it work underneath | 16:21 |
| breton | it seems that it got broken | 16:21 |
| breton | but i cannot figure out why | 16:22 |
| notmorgan | breton: *shrug* | 16:22 |
| notmorgan | breton: i would rather just revert it. | 16:22 |
| breton | setter is never called for example. | 16:22 |
| breton | let me check the getters now... | 16:23 |
| notmorgan | it works it may not be applied everywhere | 16:23 |
| notmorgan | it also may have been broken in a recent dogpile release | 16:24 |
| *** sdake has quit IRC | 16:25 | |
| breton | notmorgan: for me it doesn't work for COMPUTED_CATALOG_REGION | 16:25 |
| *** sheel has quit IRC | 16:25 | |
| * notmorgan shrugs | 16:26 | |
| notmorgan | honestly, i am kindof over caring about the caching stuff. | 16:26 |
| notmorgan | i'm rapidly feeling like we should just rip it all out | 16:26 |
| notmorgan | and delete it. | 16:26 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Refactor shadow users https://review.openstack.org/323596 | 16:32 |
| notmorgan | breton: i also missed applying it to one of the cache regions. our manager architecture is awful to cache and even if we didn't use @memoize, we'd run into the same issues with people failing to understand invalidations | 16:32 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/323602 | 16:35 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/323602 | 16:35 |
| *** edtubill has joined #openstack-keystone | 16:38 | |
| *** sdake has joined #openstack-keystone | 16:38 | |
| *** daemontool has quit IRC | 16:41 | |
| *** adrian_otto has quit IRC | 16:43 | |
| *** d0ugal has quit IRC | 16:43 | |
| *** d0ugal has joined #openstack-keystone | 16:44 | |
| *** sdake_ has joined #openstack-keystone | 16:45 | |
| *** sdake has quit IRC | 16:45 | |
| *** tonytan4ever has joined #openstack-keystone | 16:48 | |
| *** ddieterly is now known as ddieterly[away] | 16:49 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Change LocalUser sql model to eager loading https://review.openstack.org/327817 | 16:49 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Change LocalUser sql model to eager loading https://review.openstack.org/327817 | 16:51 |
| *** ddieterly[away] is now known as ddieterly | 16:52 | |
| *** sdake_ has quit IRC | 16:52 | |
| bknudson | what do you think about having fernet use user name / project name rather than IDs? | 16:55 |
| lbragstad | bknudson that would require packing domain id/name in the payload too then | 16:55 |
| bknudson | so that I can pass a token to another data center that has users with another ID | 16:55 |
| bknudson | yes, the domain name for user / project would also be in the token | 16:56 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Change LocalUser sql model to eager loading https://review.openstack.org/327817 | 16:56 |
| lbragstad | bknudson so - you have a user named jsmith in two different datacenters but they aren't the same user? | 16:56 |
| bknudson | they are, but they were created in each datacenter so they've got a different id | 16:57 |
| notmorgan | bknudson: usernames are mutable | 16:58 |
| notmorgan | bknudson: so i am against it | 16:58 |
| lbragstad | so the user_id returned in the authentication response from each datacenter is going to change? | 16:58 |
| bknudson | yes | 16:58 |
| lbragstad | i authenticate against one and it says my user_id is 1234 and i authenticate in another datacenter and it says my user id is 4567 | 16:59 |
| notmorgan | if usernames become immutable, i'd support it, but as long as the name can change, i'd say it is a terrible idea | 16:59 |
| *** mvk_ has quit IRC | 16:59 | |
| *** roxanaghe has joined #openstack-keystone | 17:00 | |
| *** nisha_ has quit IRC | 17:01 | |
| *** nisha_ has joined #openstack-keystone | 17:02 | |
| bknudson | notmorgan: are you worried because a user might spoof another user? if the name doesn't exist anymore the token becomes invalid. | 17:03 |
| *** slberger has quit IRC | 17:04 | |
| bknudson | the token would still be valid for the cache period | 17:08 |
| notmorgan | bknudson: because we should not be relying on mutable values for authz. even the cache period is wrong to rely on. | 17:09 |
| notmorgan | for that | 17:09 |
| *** slberger has joined #openstack-keystone | 17:09 | |
| notmorgan | i'm all for fixing usability (though this whole cross dc thing without replication still makes me think someone is doing somerhing horribly wrong) | 17:10 |
| *** shewless has joined #openstack-keystone | 17:10 | |
| shewless | dstanek: hi. I'm back for more federation punishment! | 17:11 |
| notmorgan | "I want to take an authz from an authoritative source and use it against a different source that didn't issue it and that isn't in sync with the issuing installation" | 17:11 |
| notmorgan | this is screaming in the back of my head a CVE waiting to happen | 17:12 |
| dstanek | shewless: how goes it? | 17:12 |
| notmorgan | using federated auth, so the token for install (remote) is authoritative from that installation is the accepted model for security | 17:12 |
| breton | yep, setters don't work in _RegionInvalidator. | 17:13 |
| shewless | dstanek: getting there... sort of.. I'm attempting to get keystone to be an SP to my enterprise IDP. On the IDP end I'm seeing this error: "The request specified an Assertion Consumer Service URL 'http://foo.com:5000/Shibboleth.sso/SAML2/POST' that is not configured on the relying party 'https://foo.com/shibboleth' | 17:13 |
| *** julim has joined #openstack-keystone | 17:13 | |
| notmorgan | you can't take a oauth session or oidc session and just use it without re-verifying/re-authing | 17:13 |
| shewless | What I don't understand is where this is even coming from: http://foo.com:5000/Shibboleth.sso/SAML2/POST | 17:14 |
| notmorgan | so, i'm going to just go out on a limb and say that this request is broken from a security model. | 17:14 |
| *** lhcheng has joined #openstack-keystone | 17:14 | |
| *** ChanServ sets mode: +v lhcheng | 17:14 | |
| dstanek | notmorgan: lbragstad: bknudson: if sync is not an option then why not federation? | 17:14 |
| notmorgan | dstanek: basically that is my argument | 17:15 |
| bknudson | dstanek: who's going to fix all the users to support federation? | 17:15 |
| dstanek | shewless: that is in your metadata | 17:15 |
| dstanek | bknudson: what do you mean by fix the users? | 17:16 |
| bknudson | all the applications that are working today that don't support the federation flow? | 17:16 |
| bknudson | today the applications work by passing their existing tokens between data centers and there's no extra work that they're doing | 17:17 |
| bknudson | to swap tokens | 17:17 |
| dstanek | bknudson: can the client not handle doing that in a federated world? | 17:18 |
| bknudson | I wish I knew what all the applications are but I don't. We just provide the service that they use. | 17:19 |
| notmorgan | bknudson: so... sounds to me like they should be syncing the backend so it's one system that the tokens were authoritatively issued for | 17:19 |
| bknudson | Maybe in the future we can push clients to do this. | 17:19 |
| notmorgan | bknudson: and if that deployment choice doesn't work, fix your app for federation | 17:19 |
| shewless | dstanek: how is that metadata generated? | 17:19 |
| bknudson | right, then we need to figure out how to sync the backend and this is going to require mucking with the db | 17:20 |
| shewless | dstanek: like I know how to get it from the URL but how are the values determined? | 17:20 |
| notmorgan | bknudson: i don't get it, how db sync hard? | 17:20 |
| dstanek | shewless: this is the metadata that you get from the SP's /Shibboleth.sso/Metadata. mod_shib generates it based on your configuration | 17:20 |
| notmorgan | bknudson: passing a bearer token between two unconnected auth systems is insane. | 17:21 |
| notmorgan | and expecting the authz to work | 17:21 |
| dstanek | bknudson: what is the usecase? multiple regions, different clouds, or something else? | 17:22 |
| shewless | dstanek: mob_shib generates it from /etc/keystone.conf or /etc/apache2/ or somewhere in /etc/shibboleth? | 17:22 |
| notmorgan | dstanek: different deployments owned by one company, unconnected, with user account data created in each separately. is my understranding | 17:22 |
| notmorgan | dstanek: and they want to just take a token and use it from one on the other | 17:22 |
| dstanek | shewless: /etc/shibboleth i would imagine. shib knows nothing about keystone | 17:23 |
| notmorgan | dstanek: without re-auth/federation/etc. | 17:23 |
| dstanek | isn't this why oauth was invented? | 17:24 |
| notmorgan | dstanek: this is why <SSO auth of any kind> was made | 17:25 |
| shewless | dstanek: if I look at my metadata its: https://foo.com/shibboleth/SAML2/POST and not https://foo.com:5000/shibboleth/SAML2/POST. do you know where the 5000 comes from? | 17:25 |
| *** TxGVNN has joined #openstack-keystone | 17:25 | |
| notmorgan | and i really really am against keystone implementing it's own SSO thing with bearer tokens | 17:25 |
| dstanek | shewless: that must be in the saml request going out. do you have that port in any of you configs? | 17:26 |
| *** jtp92 has joined #openstack-keystone | 17:26 | |
| shewless | dstanek: not intentionally | 17:27 |
| *** rderose has quit IRC | 17:27 | |
| *** scarlisle has joined #openstack-keystone | 17:27 | |
| *** ddieterly is now known as ddieterly[away] | 17:28 | |
| shewless | dstanek: It's part of my OPENSTACK_KEYSTONE_URL in local_settings.py | 17:28 |
| shewless | dstanek: do you know if it should be? | 17:28 |
| jtp92 | I need help with integrating OpenStack and Active Directory, I can't seem to find any decent documentation | 17:28 |
| openstackgerrit | Merged openstack/keystone: Fix ValidationError exception name in docstring https://review.openstack.org/327696 | 17:29 |
| dstanek | jtp92: as an ldap backend? | 17:29 |
| scarlisle | Hello! If my Keystone public and internal endpoints are using v3, but my admin endpoint is v2, will that affect multi-domain? If so, how? | 17:29 |
| shewless | jtp92: I found this to be useful: http://docs.openstack.org/developer/keystone/configuration.html | 17:29 |
| scarlisle | this is liberty, sorry for not clarifying | 17:30 |
| dstanek | shewless: the keystone url should have the port | 17:30 |
| *** josecastroleon has quit IRC | 17:31 | |
| *** lmiccini has quit IRC | 17:31 | |
| shewless | that's the only reference to 5000 in local_settings.py, /etc/keystone, and /etc/shibboleth :( | 17:31 |
| *** permalac has quit IRC | 17:31 | |
| *** sdake has joined #openstack-keystone | 17:31 | |
| dstanek | shewless: have you tried to upload the metadata again after confirming that the port isn't in it? | 17:31 |
| shewless | dstanek: I can do that. I did have a look at the metadata I sent and didn't see it but it's worth a shot | 17:32 |
| bknudson | dstanek: yes, it's distributing keystone across multiple regions where the database is not shared due to latency. | 17:32 |
| shewless | dstanek: does it matter that this part of the config in in the VirtualHost *.5000> section: WSGIScriptAliasMatch ^(/v3/OS-FEDERATION/identity_providers/.*?/protocols/.*?/auth)$ /var/www/keystone/main/$1 | 17:34 |
| shewless | dstanek: it was in your example too | 17:34 |
| *** sdake_ has joined #openstack-keystone | 17:35 | |
| *** aginwala has joined #openstack-keystone | 17:35 | |
| *** rderose has joined #openstack-keystone | 17:36 | |
| *** sdake has quit IRC | 17:37 | |
| *** lmiccini has joined #openstack-keystone | 17:38 | |
| dstanek | shewless: yes, my example works | 17:40 |
| dstanek | right now you seem to be dealing with a situation where you're tell the IdP one thing and the metadata is saying something else | 17:41 |
| shewless | dstanek: yeah I just don't know where that 5000 is coming from. I'll try to reupload the metadata to see if that helps | 17:42 |
| dstanek | shewless: what IdP are you using? | 17:46 |
| shewless | dstanek: it's adfs 2.0 | 17:48 |
| shewless | dstanek: not by my choice! | 17:48 |
| shewless | dstanek: I'm told it talks "SAML 2" though | 17:48 |
| *** vgridnev has joined #openstack-keystone | 17:50 | |
| *** tonytan4ever has quit IRC | 17:52 | |
| *** browne has quit IRC | 17:52 | |
| dstanek | shewless: i've been trying to figure out how to test adfs | 17:53 |
| shewless | dstanek: I can tell you that the idp metadata is usually here: /FederationMetadata/2007-06/FederationMetadata.xml and that my IT guy doesn't really understand federation that well.. otherwise I can at least try some thing to get this setup working.. | 17:55 |
| *** nisha__ has joined #openstack-keystone | 17:56 | |
| *** chris_hultin has quit IRC | 17:57 | |
| *** chris_hultin has joined #openstack-keystone | 17:57 | |
| *** tpeoples has quit IRC | 17:57 | |
| *** serverascode has quit IRC | 17:58 | |
| *** nisha_ has quit IRC | 17:58 | |
| *** lhcheng has quit IRC | 18:00 | |
| *** lhcheng has joined #openstack-keystone | 18:00 | |
| *** ChanServ sets mode: +v lhcheng | 18:00 | |
| *** serverascode has joined #openstack-keystone | 18:00 | |
| *** timburke has quit IRC | 18:00 | |
| *** tpeoples has joined #openstack-keystone | 18:00 | |
| *** aginwala has quit IRC | 18:01 | |
| *** aginwala has joined #openstack-keystone | 18:02 | |
| dstanek | shewless: since nothing ever 'just works' we're all in the same boat | 18:02 |
| *** itisha has quit IRC | 18:02 | |
| *** yolanda has quit IRC | 18:02 | |
| *** timburke has joined #openstack-keystone | 18:02 | |
| *** itisha has joined #openstack-keystone | 18:03 | |
| *** mtreinish has quit IRC | 18:03 | |
| *** mtreinish has joined #openstack-keystone | 18:03 | |
| *** roxanaghe has quit IRC | 18:04 | |
| jtp92 | dstanek: Yes | 18:06 |
| jtp92 | shewless: Thanks, i'll take a look! | 18:06 |
| dstanek | jtp92: yeah, the docs talk a lot about that. i'm sure there's some gaps though, so if you find any don't be afraid to create bugs | 18:07 |
| *** roxanaghe has joined #openstack-keystone | 18:09 | |
| *** mtreinish has quit IRC | 18:10 | |
| *** rk4n has quit IRC | 18:12 | |
| *** mtreinish has joined #openstack-keystone | 18:13 | |
| *** pnavarro has quit IRC | 18:13 | |
| KevinE_ | can someone help me with a python question? | 18:14 |
| * notmorgan tosses dstanek at KevinE_ :P | 18:14 | |
| notmorgan | KevinE_: ask away, we might be able to help | 18:15 |
| notmorgan | we might not | 18:15 |
| * dstanek is terrified | 18:15 | |
| notmorgan | but asking the question is likely easier to net an answer than asking if you can ask the question | 18:15 |
| *** mgagne has quit IRC | 18:16 | |
| bknudson | notmorgan: watch it'll be some odd difference between py2 and py3 | 18:16 |
| bknudson | what happens if I do 11 / 2 ? | 18:16 |
| *** clayton has quit IRC | 18:17 | |
| *** mgagne has joined #openstack-keystone | 18:17 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Revert "Add caching to role assignments" https://review.openstack.org/327848 | 18:17 |
| amakarov | notmorgan, hi! I'm about the cache bug you and breton discussed above | 18:17 |
| *** clayton has joined #openstack-keystone | 18:17 | |
| amakarov | notmorgan, he pointed me to your code, and I'm trying to fix the issue in oslo_cache | 18:18 |
| dstanek | bknudson: from __future__ import division | 18:18 |
| amakarov | notmorgan, what is the better place to do that as we were able to figure out how to fix yours? | 18:18 |
| amakarov | In my opinion fix to keystone is a hack, but fix in oslo.cache is terrifying :) | 18:19 |
| notmorgan | bknudson: i'm... no. NO | 18:20 |
| notmorgan | amakarov: fix it in dogpile.cache so hard/soft invalidate is propagated to the backend vs being a property on the region object | 18:20 |
| notmorgan | amakarov: don't fix it in oslo_cache OR in keystone | 18:20 |
| amakarov | zzzeek, are you around? | 18:21 |
| notmorgan | amakarov: btw, i am also a maintainer on dogpile.cache | 18:21 |
| *** rderose has quit IRC | 18:21 | |
| amakarov | notmorgan, cool. then you know the workflow, right? | 18:21 |
| shewless | dstanek: it appears my "entityID" isn't accessible for some reason.. "https://foo.com/shibboleth" - so I need to figure that out | 18:22 |
| notmorgan | amakarov: gerrit.sqlalchemy.org | 18:22 |
| notmorgan | amakarov: :) | 18:22 |
| KevinE_ | notmorgan: dstanek: there's always some sass in this room :p here: http://pastebin.com/nPkTLnqw I commented way out the little steps to explain my issue including the error I'm getting. It should be easy :) | 18:22 |
| notmorgan | amakarov: the source code is on bitbucket (for you to clone) | 18:22 |
| dstanek | KevinE_: what's the question? | 18:22 |
| amakarov | notmorgan, why sqlalchemy? 0_o | 18:22 |
| amakarov | that's surprising | 18:23 |
| KevinE_ | dstanek: I'm getting error TypeError: _generate_random_name() takes exactly 1 argument (2 given) and I don't know what 2 argumements I'm "giving" | 18:23 |
| notmorgan | amakarov: because zzzeek is the sqlalchemy maintainer | 18:23 |
| *** dan_nguyen has quit IRC | 18:23 | |
| notmorgan | amakarov: so dogpile goes with him there. since he wrote dogpile as well | 18:23 |
| notmorgan | s/maintainer/author | 18:23 |
| dstanek | KevinE_: Python passes the instance as self automatically and you are not expected another param, but passing one in | 18:24 |
| *** tqtran has joined #openstack-keystone | 18:24 | |
| dstanek | KevinE_: vm_name_prefix | 18:24 |
| *** fawadkhaliq has quit IRC | 18:24 | |
| KevinE_ | dstanek: I thought so, but when I remove that and just make it name=self.scenario_instance._generate_random_name(), I get error TypeError: unbound method generate_random_name() must be called with VMPerf instance as first argument (got nothing instead) | 18:25 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Revert "Add caching to role assignments" https://review.openstack.org/327848 | 18:26 |
| *** ddieterly[away] has quit IRC | 18:28 | |
| notmorgan | breton: sorry -2, unless you address why this cannot be fixed | 18:28 |
| notmorgan | breton: a wholesale revert needs more justification | 18:29 |
| notmorgan | breton: and i'm fine with the revert, just make sure it isn't (as it sounds now, and i know you don't mean it this way) "oh error, lets revert" | 18:30 |
| *** ddieterly has joined #openstack-keystone | 18:30 | |
| notmorgan | breton: also what version of dogpile.cache are you seeing this issue with | 18:30 |
| breton | notmorgan: cache invalidation never worked for regions in catalog and assignments. It still doesn't work in stable/mitaka. Fixing it in stable/mitaka means adding a lot of calls to memcache, which i would rather not do in stable branch. | 18:31 |
| breton | notmorgan: it never worked because https://github.com/openstack/keystone/blob/stable/mitaka/keystone/common/cache/core.py#L123 does not set setter and deleter to _hard_invalidated | 18:31 |
| notmorgan | i'm going to -2 ripping out caching at this level | 18:32 |
| notmorgan | breton: it clearly did work at some point | 18:32 |
| notmorgan | breton: so what has changed. | 18:32 |
| dstanek | KevinE_: is self.scenario_instance an actual instance? | 18:32 |
| notmorgan | breton: also, create a test that shows it doesn't work. and what we can do to fix it. | 18:32 |
| breton | notmorgan: setattr(region, '_hard_invalidated', invalidator.hard_invalidated) does not set setters and getters. | 18:33 |
| *** rk4n has joined #openstack-keystone | 18:33 | |
| *** ayoung has quit IRC | 18:33 | |
| dstanek | KevinE_: or are you saying you removed self too? | 18:33 |
| *** rk4n has joined #openstack-keystone | 18:33 | |
| notmorgan | breton: so.. fix it so it does ;) | 18:33 |
| breton | notmorgan: do you think the fix where it does should go to mitaka? | 18:33 |
| notmorgan | breton: i actually know how to fix this, it's just something i wanted to avoid doing. | 18:34 |
| notmorgan | breton: yes. this can be backported. | 18:34 |
| notmorgan | breton: it's private interfaces. | 18:34 |
| shewless | dstanek: I set my entityID to "https://foo.com/shibboleth" but that page is not accessible. Do you know how I determine what my entityID is? Where is it configured? | 18:34 |
| notmorgan | breton: the other option is to convert @memoize to using the .get/set methods on the dogpile region | 18:34 |
| notmorgan | also backportable | 18:34 |
| notmorgan | breton: cache fixes are almost always backportable. | 18:35 |
| breton | notmorgan: my biggest concern is that it adds a huge amount of calls to memcache. And this huge amount was not tested during the cycle. | 18:35 |
| notmorgan | breton: not a concern really | 18:35 |
| notmorgan | breton: the added load to calculating everything else is/will be much worse | 18:36 |
| dstanek | shewless: does it actually need to talk to that url? by convention i use http://keystone_host/shibboleth | 18:36 |
| breton | notmorgan: ok then, i'll propose a fix in 20. | 18:36 |
| notmorgan | breton: :) wfm | 18:36 |
| notmorgan | breton: don't abandon the revert | 18:36 |
| notmorgan | leave that as a patchset separate | 18:36 |
| KevinE_ | dstanek: Um I'm not sure how to answer that question but I'd guess yes, just because the description of that method says "Function to create an instance" lol | 18:37 |
| notmorgan | so if we can't fix it we can just push that through | 18:37 |
| notmorgan | but i'd rather a real fix because i know the caching *is* in-fact important | 18:37 |
| *** nisha__ has quit IRC | 18:37 | |
| KevinE_ | dstanek: I just don't know what the error message is telling me at all with your proposed removal of that var | 18:37 |
| *** sdake_ has quit IRC | 18:38 | |
| shewless | dstanek: it looks like it uses that "relying party" | 18:39 |
| dstanek | KevinE_: you may have to debug it to see what it is. that error message sounds like the one you get from "Class.method()" | 18:39 |
| shewless | dstanek: and I think if you try and hit "http://keystone_host/shibboleth" it'll accept your connection.. mine doesn't for some reason | 18:40 |
| dstanek | shewless: right. it uses that to look up the meatadata. i don't think it queries it directly | 18:40 |
| *** TxGVNN has quit IRC | 18:40 | |
| zzzeek | Amakarov: am at lunch. If not a quick q maybe get me in a couple hours ... | 18:40 |
| notmorgan | zzzeek: mostly its just a "make _hard/_soft invalidate" work across processes. | 18:40 |
| notmorgan | zzzeek: enjoy lunch. | 18:41 |
| dstanek | shewless: in my keysotne that returns a 404. it's not a real resource | 18:41 |
| amakarov | zzzeek, I've discussed the issue with notmorgan - I'm preparing a patch for dogpile.cache | 18:41 |
| notmorgan | zzzeek: i'll keep my eyes on it once it's on your gerrit. | 18:41 |
| shewless | dstanek: oh | 18:42 |
| notmorgan | breton: the real fix might be making a descriptor object instead of a @property | 18:42 |
| shewless | dstanek: maybe that's not the problem then?' | 18:42 |
| breton | notmorgan: that's what i do | 18:42 |
| zzzeek | Amakarov: tricky to generalize unless you have regions communicate thru some magic value in the cache . That would be an extension point. Not sure if there's a recipe for something like that | 18:43 |
| notmorgan | breton: cool. also the alternative is to subclass region and make keystone use that with _hard/_soft invalidate fixed. | 18:43 |
| notmorgan | zzzeek: i think the easiest thing is to make _hard/_soft invalidate functions that can be passed in like keygen | 18:43 |
| notmorgan | amakarov: ^ | 18:43 |
| notmorgan | zzzeek: with the default action being the one we have today | 18:44 |
| amakarov | zzzeek, having issues sending CR to your gerrit :) | 18:44 |
| zzzeek | Notmorgan: I've always felt that the total key space needs to be specified. That is, never assume some other system isn't also using your cache. Therefore you have to log all the keys. There's a recipe that does something like this in the docs | 18:44 |
| dstanek | shewless: the message you are getting is what i got when the metadata i registered didn't match the things in the SAML doc | 18:45 |
| notmorgan | zzzeek: correct. | 18:45 |
| notmorgan | zzzeek: i am just saying we should allow the hard/soft region invalidates to be passed in as functions, so you can say "use the driver to check the last invalidatate" or some such. | 18:45 |
| notmorgan | zzzeek: the same as we do for things like should_cache_fn. anyway go lunch | 18:46 |
| notmorgan | zzzeek: we can chat after that | 18:46 |
| shewless | dstanek: okay. I checked the metadata I sent and it definitely does not include the port 5000. I think that maybe my system is using that port for some reason. Maybe adfs is more picky if it comes in on a different port then, say, a shibboleth idp? | 18:46 |
| zzzeek | Of course . I'm all for pushing responsibility outside :) | 18:46 |
| dstanek | shewless: i think a shib IdP is just as picky. try to find out what the SAML looks like. maybe debug level in mod_shib? | 18:47 |
| amakarov | notmorgan, is there some step-by-step guide how to set up git-review to work with gerrit.sqlalchemy.org? | 18:47 |
| *** ayoung has joined #openstack-keystone | 18:47 | |
| *** ChanServ sets mode: +v ayoung | 18:47 | |
| notmorgan | amakarov: it shouod work if the .git-review file is right | 18:47 |
| amakarov | notmorgan, and it is not in a fresh clone :) | 18:48 |
| notmorgan | https://bitbucket.org/zzzeek/dogpile.cache/src/c6fc55cd04f3a9e7e1301c21fa54c2e17d918c8b/.gitreview?fileviewer=file-view-default | 18:48 |
| notmorgan | looks like it needs a port | 18:49 |
| notmorgan | unless gerrit is listening on 22 for that host | 18:49 |
| notmorgan | https://github.com/openstack/keystone/blob/master/.gitreview [for comparison] | 18:49 |
| shewless | dstanek: would the SAML show up in keystone.log? | 18:50 |
| KevinE_ | dstanek: I think it was just because I had @classmethod above the method ?? | 18:50 |
| shewless | dstanek: likely /var/log/shibboleth/ I guess | 18:50 |
| amakarov | notmorgan, yes, it tries to get to 29418 port and .git-review doesn't help | 18:54 |
| notmorgan | .gitreview | 18:54 |
| notmorgan | amakarov: and did you setup your account there? | 18:54 |
| notmorgan | amakarov: you need to login (github sso), and add ssh-key etc | 18:54 |
| amakarov | I've used openid and added an rsa key | 18:54 |
| notmorgan | i just pushed this change https://gerrit.sqlalchemy.org/#/c/106/ | 18:54 |
| dstanek | shewless: no. keystone doesn't do anything with the saml in the usecase. it's between mod_shib and the IdP | 18:54 |
| notmorgan | and it worked | 18:54 |
| dstanek | KevinE_: sure a classmethod means that instead of an instance for the first arg you will get the class | 18:55 |
| dstanek | KevinE_: that is almost certainly not what you want unless you are creating alternative constructors | 18:55 |
| KevinE_ | dstanek: so I think that was just leftover from the older code I'm modifying :) | 18:56 |
| *** gordc has quit IRC | 18:57 | |
| dstanek | KevinE_: i'm not sure what the original code was and what your changes work, but i'm guessing that the method was not supposed to be a classmethod since it expects self and used it to call an instance method. it's also broken because _generate_random_name doesn't accept any arguments | 18:58 |
| *** sdake has joined #openstack-keystone | 18:59 | |
| shewless | dstanek: I think I found the saml: <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="http://mycloud.foo.com:5000/Shibboleth.sso/SAML2/POST" Destination="https://saml.foo.com/adfs/ls/" ID="fsdgf16d6a2fdc5db35" IssueInstant="2016-06-09T18:59:48Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2. | 19:01 |
| KevinE_ | dstanek: http://pastebin.com/XzjHZi7E Right before the ~~ you can see the original method. Andrey told me that due to the new updates to generate_random_name method, I would need to change that method to call self.generate_random_name from scenario instead of utils.generate_random_name. He said I should pass nothing to the latests generate_random_name method. | 19:02 |
| shewless | dstanek: the "AssertionConsumerServiceURL" has 5000 in it. I think that's the problem.. I don't think this is coming from the metadata.. do you? | 19:02 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Fix cache invalidation https://review.openstack.org/327885 | 19:02 |
| KevinE_ | dstanek: basically I just took his advice and changed it to the super short version you saw, and I suppose you're telling me that I did it in an incorrect way. Do you know what I was supposed to do? | 19:02 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Fix cache invalidation https://review.openstack.org/327885 | 19:03 |
| amakarov | notmorgan, it denies me: Please make sure you have the correct access rights and the repository exists. | 19:03 |
| amakarov | notmorgan, fatal: Upload denied for project 'zzzeek/dogpile.cache' | 19:03 |
| *** rderose has joined #openstack-keystone | 19:04 | |
| *** tonytan4ever has joined #openstack-keystone | 19:04 | |
| breton | notmorgan: ^ | 19:05 |
| *** lhcheng has quit IRC | 19:06 | |
| breton | i am actually surprised that it works... | 19:06 |
| notmorgan | breton: nah i'm not | 19:07 |
| *** darosale has joined #openstack-keystone | 19:07 | |
| breton | notmorgan: i am because it didn't work in my sandbox and i had to do things with .__class__ | 19:08 |
| amakarov | notmorgan, only launchpad sso works there or github will go? | 19:08 |
| notmorgan | breton: inline comments on that | 19:08 |
| amakarov | notmorgan, oh, you've told about github | 19:08 |
| notmorgan | amakarov: bitbucket. | 19:09 |
| notmorgan | amakarov: for the code, github for the SSO login | 19:09 |
| notmorgan | on gerrit.sqla | 19:09 |
| dstanek | KevinE_: what are you trying to do? | 19:10 |
| amakarov | notmorgan, well, I've used github sso to log it, cloned a project from there, manually added gerrit remote and get "Upload denied" | 19:10 |
| amakarov | while I'm able to ssh there (without session of course) | 19:11 |
| dstanek | shewless: so i think that's generated in mod_shib. after you removed the :5000 from the metadata did you restart shibd and apache? | 19:11 |
| amakarov | so my key works | 19:11 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Fix cache invalidation https://review.openstack.org/327885 | 19:11 |
| notmorgan | breton: so we are going to need a subclass i think for this to work. | 19:11 |
| *** aginwala has quit IRC | 19:11 | |
| notmorgan | breton: local test is showing wrong behavior still. | 19:11 |
| notmorgan | descriptors are part of the class object not instantiated object | 19:12 |
| *** harlowja has quit IRC | 19:12 | |
| dstanek | notmorgan: descriptors...tasty | 19:12 |
| notmorgan | dstanek: yeah | 19:13 |
| breton | notmorgan: yes, that's why i was surprised | 19:13 |
| notmorgan | breton: you might be able to just set the hard_invalidate, etc on the region class itself before we do the first instantiation | 19:13 |
| KevinE_ | dstanek: I have scenario files I'm trying to merge up. In testing, I'm tracing errors around because it's set in a pretty old version of rally. I had an issue where a custom plugin was trying to generate a name using said old version, and I guess my I can't update it to work with the new code | 19:14 |
| notmorgan | you also may be able to just apply it to the region class itself directly even post instantiation | 19:14 |
| notmorgan | breton: yep | 19:15 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Fix cache invalidation https://review.openstack.org/327885 | 19:15 |
| breton | notmorgan: ^ | 19:15 |
| notmorgan | breton: just setattr it on the region object itself | 19:15 |
| notmorgan | even post instantiation, all childern will get it | 19:15 |
| dstanek | KevinE_: i don't know much about rally, but i can say that you can't have class method call an instance method like that since it doesn't have access to the instance | 19:15 |
| *** aginwala has joined #openstack-keystone | 19:15 | |
| notmorgan | breton: /me just tested this | 19:15 |
| breton | notmorgan: yep, i've changed that to do things with classes | 19:15 |
| *** aginwala has quit IRC | 19:16 | |
| *** aginwala has joined #openstack-keystone | 19:16 | |
| * breton testing on the env | 19:16 | |
| shewless | dstanek: I've restarted apache and shibd many times.. :) but I never had :5000 in my metadata.. that's what's confusing me.. it wasn't there and it's not there | 19:16 |
| notmorgan | breton: nope, you don't want to do it that way | 19:17 |
| notmorgan | you want to do the apply one time | 19:17 |
| notmorgan | and do it before we instantiate a region | 19:17 |
| *** ctracey has quit IRC | 19:17 | |
| dstanek | shewless: this issue seems not that it was in the metadata, but that it's being used in th authn request | 19:17 |
| notmorgan | basically do the apply_patch thing once during import of common.cache | 19:17 |
| breton | got it | 19:18 |
| notmorgan | breton: and just do it to the dogpile.cache region object directly, delete the unbound _hard/soft invalidated and apply these descriptors | 19:18 |
| *** itlinux has joined #openstack-keystone | 19:18 | |
| shewless | dstanek: right. I couldn't find anything in any configs that reference 5000 | 19:18 |
| notmorgan | breton: ooooor just monkey patch the unbound properties directy before instantiation | 19:18 |
| notmorgan | breton: and don't bother with descriptors (either works) -- also... lets make sure we get a test of this. | 19:19 |
| *** sdake has quit IRC | 19:19 | |
| KevinE_ | dstanek: I know and I always feel bad for asking in this room, however I do get helpful information and I guess that's the real point of it all. I've found myself to a new totally Rally error so I'll just assume it's progress :) | 19:19 |
| *** ctracey has joined #openstack-keystone | 19:20 | |
| shewless | dstanek: right. I couldn't find anything in any configs that reference port 5000. Accept that local_settings.py, glance, heat, etc for auth | 19:20 |
| dstanek | KevinE_: i don't mind answering non-keystone questions :-) in this case i can tell you why your Python code doesn't work, but not what it should be | 19:21 |
| notmorgan | breton: also you might need to reference obj not "self" in the descriptor | 19:21 |
| *** lhcheng has joined #openstack-keystone | 19:22 | |
| *** ChanServ sets mode: +v lhcheng | 19:22 | |
| breton | notmorgan: got it | 19:22 |
| amakarov | zzzeek, do I need some special permissions to upload change request to zzzeek/dogpile.cache? | 19:22 |
| *** rderose has quit IRC | 19:22 | |
| openstackgerrit | Merged openstack/keystone: Refactor shadow users https://review.openstack.org/323596 | 19:22 |
| notmorgan | breton: lots of comments to this effect too help make sure it's on the review as to why it's being done a specific way | 19:24 |
| *** roxanaghe has quit IRC | 19:25 | |
| *** rderose has joined #openstack-keystone | 19:27 | |
| shewless | dstanek: are you sure your request doesn't also add a 5000 but shibboleth is okay with that? I've tried everything I can think of.. I don't know what's putting the :5000 there | 19:28 |
| breton | notmorgan: won't other regions, like the one @MEMOIZE is using, be affected if i monkey-patch before instantiating things? | 19:30 |
| *** aginwala has quit IRC | 19:30 | |
| notmorgan | breton: we don't actually care :) | 19:30 |
| breton | notmorgan: why not? | 19:30 |
| notmorgan | breton: we really want all hard/soft invalidates in keystone to back to the cache | 19:30 |
| notmorgan | the setattr was just a cheap way of doing that w/o getting into descriptors/metaprogramming | 19:30 |
| notmorgan | breton: and we applied it only where we wanted it. in this case we apply it everywhere | 19:31 |
| zzzeek | AMakarov: yes | 19:31 |
| notmorgan | and it's just fine to do so | 19:31 |
| amakarov | notmorgan, are you sure you are not granted some special permissions to push CR's ? | 19:31 |
| openstackgerrit | Merged openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/323602 | 19:31 |
| zzzeek | amakarov: send a PR and i can pull it into gerrit and give you perms | 19:31 |
| notmorgan | amakarov: ah. ok so zzzeek has that setup like that. | 19:32 |
| amakarov | zzzeek, PR? | 19:32 |
| notmorgan | amakarov: on bitbucket | 19:32 |
| notmorgan | amakarov: send the change as pull-request | 19:32 |
| dstanek | shewless: are you able to query the IdP and get back the metadata it's using? | 19:32 |
| dstanek | shewless: i can give it a try and see | 19:32 |
| zzzeek | amakarov: notmorgan should have perms also | 19:33 |
| shewless | dstanek: I have it's generic "idp" metadata.. | 19:33 |
| shewless | dstanek: but do you mean the metadata it's using for me? | 19:33 |
| shewless | dstanek: I've seen the "assertion url" stuff on the idp end and none of it has port 5000 | 19:34 |
| notmorgan | zzzeek: i have perms to push to dogpile.cache :) | 19:34 |
| *** rderose has quit IRC | 19:34 | |
| * notmorgan proved that with a recent patch. | 19:35 | |
| dstanek | shewless: my metadata uses :5000 for all URLs | 19:35 |
| shewless | dstanek: interesting... like actually in your metadata or just in your SAML? | 19:36 |
| dstanek | in metadata | 19:36 |
| shewless | dstanek: okay that might be an easier problem... I suppose I could "hack" the metadata but I'd prefer to figure out how that part of the metadata is generated. | 19:37 |
| dstanek | shewless: the shibboleth2.xml i posted yesterday uses 500 in the urls | 19:42 |
| shewless | dstanek: I lost my history from yestreday would you be able to repost the link? | 19:43 |
| bknudson | shewless: irc logs are here: http://eavesdrop.openstack.org/irclogs/ | 19:44 |
| *** rderose has joined #openstack-keystone | 19:44 | |
| amakarov | zzzeek, done | 19:45 |
| shewless | bknudson: thanks.. cool! | 19:46 |
| shewless | dstanek: I had the apache configuration you posted but I can't see the shibboleth2.xml paste anywhere from yesterday | 19:46 |
| dstanek | shewless: jas i'll post again | 19:48 |
| *** harlowja has joined #openstack-keystone | 19:49 | |
| *** amakarov is now known as amakarov_away | 19:50 | |
| dstanek | shewless: http://paste.openstack.org/show/509301/ | 19:51 |
| shewless | dstanek: thanks.. I'll give that a try | 19:52 |
| *** pnavarro has joined #openstack-keystone | 19:53 | |
| *** rderose_ has joined #openstack-keystone | 19:54 | |
| *** rderose has quit IRC | 19:54 | |
| *** roxanaghe has joined #openstack-keystone | 19:55 | |
| dolphm | nonameentername: any progress on that transient? | 19:56 |
| *** jtp92 has quit IRC | 19:57 | |
| nonameentername | Yeah, I believe I fixed the issue. I'm running it on my machine right now | 19:57 |
| dstanek | shewless: let me know if that works | 19:58 |
| *** tonytan4ever has quit IRC | 19:58 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 19:59 |
| *** amrith is now known as _amrith_ | 20:05 | |
| *** gordc has joined #openstack-keystone | 20:06 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Fix cache invalidation https://review.openstack.org/327885 | 20:07 |
| nonameentername | dolphm: is there a bug for that change? | 20:08 |
| breton | notmorgan: ^ it doesn't work though | 20:08 |
| breton | notmorgan: > an alternative is to directly monkeypatch the hard/soft invalidated properties/methods/whatever with new code without being a descriptor | 20:08 |
| breton | how's that? | 20:08 |
| breton | ooh, so just set dogpile.cache.CacheRegion._soft_invalidated? | 20:09 |
| notmorgan | breton: yes | 20:09 |
| notmorgan | breton: that is basically what you're going to do patching the region object at import time | 20:10 |
| *** dan_nguyen has joined #openstack-keystone | 20:10 | |
| breton | yep | 20:10 |
| shewless | dstanek: after I udpate the entityID to have port 5000 when I download the metadata I can see the change in the entityID but not in the "md:AssertaionConsumerService" line in the metadata | 20:10 |
| shewless | dstanek: do all of your md:AsserationConsumerService Binding" in your metadata have :5000 in them? | 20:11 |
| dstanek | shewless: yes, all URLs have the port in my configuration | 20:11 |
| breton | notmorgan: so the patch ^ does the logic, and i see in the logs a lot of checks of _RegionExpiration.hard.None. However, the cache doesn't work properly. | 20:11 |
| breton | i am figuring out why | 20:11 |
| shewless | dstanek: the <MetadataProvider is for the IDP right? | 20:12 |
| notmorgan | breton: ++ but you see how the MRO falls through to the class object | 20:12 |
| *** ddieterly is now known as ddieterly[away] | 20:12 | |
| dstanek | shewless: in my case yes | 20:12 |
| notmorgan | breton: you're def. on the path i'd be using to fix this fwiw. | 20:13 |
| notmorgan | breton: so looking good, and this is 100% backportable. | 20:13 |
| breton | what's MRO? | 20:13 |
| notmorgan | Method Resolution Order | 20:13 |
| breton | oh ok. | 20:13 |
| notmorgan | how python determins how to call what | 20:13 |
| notmorgan | breton: i could go into a lot of detail that would be generally boring on IRC on how MRO is handled. | 20:14 |
| notmorgan | breton: but :) | 20:14 |
| breton | i know, thanks ^) | 20:14 |
| notmorgan | in short... if it's not in __dict__, not on the parent (you need to delattr the thing from the region still), it falls through to the class_obj | 20:15 |
| notmorgan | i think. | 20:15 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS change password requirements - Password table changes https://review.openstack.org/314284 | 20:15 |
| notmorgan | anyway i need to chase a different bug. thanks for working on this. | 20:15 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS change password requirements: SQL changes https://review.openstack.org/314284 | 20:16 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements - SQL changes https://review.openstack.org/314284 | 20:16 |
| *** dan_nguyen has quit IRC | 20:19 | |
| *** adrian_otto has joined #openstack-keystone | 20:20 | |
| shewless | dstanek: I cannot for the life of me get the md: lines to have :5000 in them. Is there some other xml file in your /etc/shibboleth/ that would be doing that for you? | 20:21 |
| shewless | dstanek: or maybe it inherits from the entityID? | 20:21 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 20:22 |
| dstanek | shewless: what do you mean? | 20:23 |
| shewless | dstanek: when I generate my metadata, only the entityID has port 5000.. the md:assertion stuff at the end does not say port 5000 | 20:23 |
| dstanek | shewless: i just have those urls in my shibboleth2.xml file | 20:23 |
| shewless | dstanek: in my metadata I have this: <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://mycloud.foo.com/Shibboleth.sso/SAML2/POST" index="1"/> | 20:24 |
| shewless | dstanek: I don't see any such line in your shibboleth2.xml file | 20:24 |
| shewless | dstanek: but it's missing the :5000 | 20:24 |
| dstanek | shewless: metadata != shibboleth2.xml | 20:25 |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Fix TOTP transient test failure https://review.openstack.org/327922 | 20:25 |
| dstanek | shewless: 162.242.221.169:5000/Shibboleth.sso/Metadata | 20:25 |
| *** adrian_otto1 has joined #openstack-keystone | 20:25 | |
| nonameentername | dolphm: https://review.openstack.org/#/c/327922/ | 20:26 |
| patchbot | nonameentername: patch 327922 - keystone - Fix TOTP transient test failure | 20:26 |
| dolphm | nonameentername: awesome, looking | 20:26 |
| shewless | dstanek: but that is your idp isn't it? | 20:26 |
| dstanek | no, i'm using testshib as an idp | 20:27 |
| shewless | dstanek: you have 3 lines that say "MetadataProvider" .. I didn't udnerstand that part | 20:27 |
| dstanek | i've been experimenting with dynamic federations so there is some lingering cruft in there | 20:28 |
| *** aginwala has joined #openstack-keystone | 20:28 | |
| *** adrian_otto1 has quit IRC | 20:28 | |
| *** adrian_otto has quit IRC | 20:28 | |
| dolphm | nonameentername: is it the delta between _generate_totp_passcode() and v3_create_token() that causes the issue? or what two methods | 20:29 |
| *** adrian_otto has joined #openstack-keystone | 20:30 | |
| dstanek | shewless: for now just try to upload the corrected metadata and see if it works | 20:31 |
| nonameentername | dolphm: yes, there is a change that totp gets created and by the time it gets to the server it is no longer valid. | 20:31 |
| shewless | dstanek: yes good idea.. just waiting for my IT guy to do it.. | 20:31 |
| nonameentername | *chance | 20:31 |
| dstanek | shewless: :-( that's a bummer | 20:32 |
| shewless | dstanek: yup. luckily this adfs server is pretty much the only thing I don't have control over.. so it should be better after this | 20:32 |
| *** jdennis has quit IRC | 20:33 | |
| *** jdennis has joined #openstack-keystone | 20:34 | |
| shewless | dstanek: btw none of the instructions say port 5000 as far as I can tell: http://docs.openstack.org/developer/keystone/federation/shibboleth.html | 20:34 |
| shewless | dstanek: probably because that's where keystone is listening I guess | 20:34 |
| dolphm | nonameentername: left a comment - you might have missed one? | 20:35 |
| *** ddieterly[away] is now known as ddieterly | 20:35 | |
| *** rcernin has joined #openstack-keystone | 20:36 | |
| nonameentername | dolphm: that call expects a failure. I didn't think it was necessary. | 20:36 |
| dolphm | nonameentername: ah, gotcha | 20:37 |
| dolphm | nonameentername: how easy is the race condition to reproduce? i tried running that test suite about 10 times and it passed every time | 20:37 |
| breton | notmorgan: i found why it doesn't work. On get() the key doesn't get hashed and on set() it does. | 20:37 |
| dolphm | i.e. how frequently does it fail | 20:37 |
| nonameentername | dolphm: I had to set a break point to see it fail | 20:38 |
| nonameentername | I couldn't reproduce otherwise | 20:38 |
| breton | notmorgan: oooh, i know why. | 20:40 |
| dolphm | nonameentername: while we wait for jenkins, i'm going to run those two tests in a loop (without your patch) and see if i can get a failure | 20:40 |
| *** adrian_otto1 has joined #openstack-keystone | 20:41 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 20:43 |
| *** adrian_otto has quit IRC | 20:44 | |
| dolphm | nonameentername: failed on attempt #127 | 20:48 |
| dolphm | nonameentername: with a 401 | 20:48 |
| nonameentername | dolphm: can you check to see if it fails with the patch | 20:49 |
| shewless | dstanek: didn't work.. adfs is still expecting the "assertion" stuff without port 5000 | 20:49 |
| notmorgan | breton: i knew you could do it! | 20:49 |
| shewless | dstanek: for now I have downloaded the metadata and manually added the port 5000 stuff. I will get that uploaded to the idp and see if that works. | 20:50 |
| shewless | dstanek: BTW these guys had to do the same thing (manually edit to port 5000...) http://www.ibm.com/developerworks/cloud/library/cl-keystone-tfim/ | 20:50 |
| *** neophy has joined #openstack-keystone | 20:52 | |
| *** ametts has quit IRC | 20:52 | |
| *** aginwala has quit IRC | 20:56 | |
| *** jbell8 has quit IRC | 20:56 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Fix cache invalidation https://review.openstack.org/327885 | 20:57 |
| *** adrian_otto1 has left #openstack-keystone | 20:58 | |
| *** pauloewerton has quit IRC | 20:58 | |
| breton | mordred: could you please test ^ on your env? Don't forget to restart memcached before testing. | 20:58 |
| breton | mordred: oops, not you | 21:00 |
| breton | notmorgan: ^ you | 21:00 |
| *** aginwala has joined #openstack-keystone | 21:00 | |
| *** aginwala has quit IRC | 21:01 | |
| *** aginwala has joined #openstack-keystone | 21:07 | |
| notmorgan | breton: it will be a bit, i don't have a canned env to work from atm. | 21:09 |
| notmorgan | breton: and trying to watch a zuul bug down. | 21:09 |
| *** vgridnev has quit IRC | 21:11 | |
| *** rcernin has quit IRC | 21:15 | |
| *** lhcheng has quit IRC | 21:25 | |
| *** gagehugo has quit IRC | 21:25 | |
| *** pushkaru has quit IRC | 21:28 | |
| *** pushkaru has joined #openstack-keystone | 21:29 | |
| *** edmondsw has quit IRC | 21:29 | |
| *** _amrith_ is now known as amrith | 21:31 | |
| *** ayoung has quit IRC | 21:34 | |
| *** ayoung has joined #openstack-keystone | 21:35 | |
| *** ChanServ sets mode: +v ayoung | 21:35 | |
| breton | notmorgan: take your time, thank you. | 21:36 |
| *** lhcheng has joined #openstack-keystone | 21:38 | |
| *** ChanServ sets mode: +v lhcheng | 21:38 | |
| *** aginwala has quit IRC | 21:38 | |
| notmorgan | breton: fwiw, that looks good to me pre-testing | 21:39 |
| breton | i think we could use our functional tests to run it. | 21:41 |
| notmorgan | breton: we could easily test it with the fake caching tests | 21:42 |
| notmorgan | breton: you create a cache region, and inspect the dict afdter setting hard-invalidate | 21:42 |
| notmorgan | and confirm ._hard_invalidated is the descriptor object | 21:43 |
| notmorgan | this is purely-unit testable :) | 21:43 |
| notmorgan | since it doesn't matter what the backend for dogpile is, just that the backend gets the value on the appropriate key | 21:43 |
| *** BjoernT has joined #openstack-keystone | 21:46 | |
| notmorgan | breton: does invalidated = region.backend.get(self._get_region_key(region)) need the keymangler wrapper? | 21:47 |
| notmorgan | or are we at the point the keymangler has been applied already ... | 21:47 |
| notmorgan | on a get? | 21:47 |
| *** roxanaghe has quit IRC | 21:49 | |
| breton | notmorgan: is seems that i broke something in the last minutes | 21:53 |
| breton | or uploaded the wrong patch... | 21:53 |
| *** gordc has quit IRC | 21:53 | |
| notmorgan | breton: hehe happens to the best of us, i think this is a sign a unit test is needed :) | 21:54 |
| breton | yep, uploaded the wrong patch | 21:55 |
| *** ddieterly is now known as ddieterly[away] | 21:58 | |
| *** rderose_ has quit IRC | 22:03 | |
| *** pushkaru has quit IRC | 22:04 | |
| *** ayoung has quit IRC | 22:05 | |
| *** pushkaru has joined #openstack-keystone | 22:05 | |
| *** pushkaru has quit IRC | 22:07 | |
| *** pumarani__ has joined #openstack-keystone | 22:07 | |
| *** pumarani__ has quit IRC | 22:08 | |
| *** jamielennox is now known as jamielennox|away | 22:09 | |
| *** KevinE_ has quit IRC | 22:11 | |
| *** roxanaghe has joined #openstack-keystone | 22:11 | |
| *** darosale has quit IRC | 22:15 | |
| *** timcline has quit IRC | 22:18 | |
| *** timcline has joined #openstack-keystone | 22:19 | |
| *** timcline has quit IRC | 22:23 | |
| *** pnavarro has quit IRC | 22:29 | |
| *** ddieterly[away] is now known as ddieterly | 22:29 | |
| *** edtubill has quit IRC | 22:30 | |
| dstanek | shewless: any luck? | 22:33 |
| *** ddieterly is now known as ddieterly[away] | 22:34 | |
| *** neophy has quit IRC | 22:37 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Fix cache invalidation https://review.openstack.org/327885 | 22:44 |
| *** edtubill has joined #openstack-keystone | 22:47 | |
| *** BjoernT has quit IRC | 22:52 | |
| *** iurygregory_ has joined #openstack-keystone | 22:52 | |
| lbragstad | dstanek bknudson henrynash notmorgan dolphm see last few comments - https://review.openstack.org/#/c/265455/ | 22:57 |
| patchbot | lbragstad: patch 265455 - keystone - Expose bug with fernet and trusts | 22:57 |
| lbragstad | very much the first iteration | 22:57 |
| lbragstad | so improvements can be made, but this is what I have so far | 22:58 |
| *** ddieterly[away] is now known as ddieterly | 22:58 | |
| *** ddieterly has quit IRC | 22:59 | |
| *** edtubill has quit IRC | 22:59 | |
| *** ddieterly has joined #openstack-keystone | 23:00 | |
| *** ddieterly has quit IRC | 23:00 | |
| *** edtubill has joined #openstack-keystone | 23:01 | |
| bknudson | lbragstad: osic performance bot! | 23:02 |
| bknudson | lbragstad: this is really going to run the tests twice for every patch set? | 23:03 |
| bknudson | seems like the master link could point to the tests that were run before. | 23:04 |
| bknudson | also, when posting results for "master", should include the commit hash | 23:04 |
| bknudson | the performance results might be affected by changes in libraries, too... | 23:16 |
| *** raddaoui has quit IRC | 23:27 | |
| kfox1111 | we're seeing quite a bit more overhead in sql vs ldap token creation and validation. | 23:28 |
| kfox1111 | on the ldap side. | 23:28 |
| kfox1111 | I think that's somewhat to be expected on the creation case. | 23:28 |
| kfox1111 | but on validation too? | 23:28 |
| kfox1111 | maybe group related? | 23:29 |
| kfox1111 | does it reach out to ldap ever for validation? | 23:29 |
| lbragstad | bknudson yeah - all good points | 23:31 |
| lbragstad | things that we can add it if you want to great github issues for them | 23:31 |
| lbragstad | in* | 23:31 |
| lbragstad | bknudson right now the bot will only schedule changes that a comment left saying 'check performance' | 23:32 |
| lbragstad | i have to hook up the last couple bits end to end though | 23:32 |
| *** jamielennox|away is now known as jamielennox | 23:37 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Drop EPHEMERAL user type https://review.openstack.org/296639 | 23:44 |
| *** chlong has quit IRC | 23:45 | |
| jamielennox | bknudson: hey if you're here can you do a quick look at an oslo patch for me? https://review.openstack.org/#/c/326782/ | 23:52 |
| patchbot | jamielennox: patch 326782 - oslo.middleware - Expose sample config opts for http-proxy-to-wsgi | 23:52 |
| jamielennox | super simple but i'm pushing the middleware out to services so i want to know it's not going to change underneath me | 23:53 |
| *** roxanaghe has quit IRC | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
