| *** tqtran has quit IRC | 00:03 | |
| *** nkinder has quit IRC | 00:03 | |
| *** dan_nguyen has joined #openstack-keystone | 00:05 | |
| *** lmiccini has joined #openstack-keystone | 00:07 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 00:08 |
|---|---|---|
| *** lucas____ has joined #openstack-keystone | 00:09 | |
| *** lucas____ has quit IRC | 00:10 | |
| *** lucas____ has joined #openstack-keystone | 00:10 | |
| *** dan_nguyen has quit IRC | 00:12 | |
| *** stevemar has quit IRC | 00:13 | |
| *** stevemar has joined #openstack-keystone | 00:14 | |
| *** ChanServ sets mode: +o stevemar | 00:14 | |
| *** lucas____ has quit IRC | 00:15 | |
| *** raddaoui has quit IRC | 00:17 | |
| *** stevemar has quit IRC | 00:18 | |
| *** stevemar has joined #openstack-keystone | 00:29 | |
| *** ChanServ sets mode: +o stevemar | 00:29 | |
| *** roxanaghe has quit IRC | 00:35 | |
| *** EinstCrazy has joined #openstack-keystone | 00:44 | |
| *** ddieterly has quit IRC | 00:44 | |
| *** spandhe has quit IRC | 00:45 | |
| *** ddieterly has joined #openstack-keystone | 00:47 | |
| *** ddieterly has quit IRC | 00:48 | |
| *** mkoderer___ has quit IRC | 00:48 | |
| *** stevemar has quit IRC | 00:49 | |
| *** clenimar_ has joined #openstack-keystone | 00:49 | |
| *** mkoderer__ has joined #openstack-keystone | 00:50 | |
| *** stevemar has joined #openstack-keystone | 00:50 | |
| *** ChanServ sets mode: +o stevemar | 00:50 | |
| *** EinstCrazy has quit IRC | 00:53 | |
| *** mhu has quit IRC | 00:54 | |
| *** samueldmq has quit IRC | 00:57 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Concrete role assignments for federated users https://review.openstack.org/284943 | 00:57 |
| *** stevemar has quit IRC | 01:00 | |
| *** stevemar has joined #openstack-keystone | 01:00 | |
| *** ChanServ sets mode: +o stevemar | 01:00 | |
| *** henrynash has joined #openstack-keystone | 01:01 | |
| *** ChanServ sets mode: +v henrynash | 01:01 | |
| *** jaugustine has joined #openstack-keystone | 01:04 | |
| *** spandhe has joined #openstack-keystone | 01:05 | |
| *** stevemar has quit IRC | 01:05 | |
| *** henrynash has quit IRC | 01:05 | |
| *** ddieterly has joined #openstack-keystone | 01:09 | |
| *** jaugustine has quit IRC | 01:09 | |
| *** mhu has joined #openstack-keystone | 01:12 | |
| *** stevemar has joined #openstack-keystone | 01:13 | |
| *** ChanServ sets mode: +o stevemar | 01:13 | |
| *** daminate has joined #openstack-keystone | 01:14 | |
| *** spandhe has quit IRC | 01:16 | |
| *** agireud has quit IRC | 01:26 | |
| *** agireud has joined #openstack-keystone | 01:30 | |
| *** ddieterly has quit IRC | 01:31 | |
| *** browne1 has quit IRC | 01:31 | |
| *** agireud has quit IRC | 01:39 | |
| *** stevemar has quit IRC | 01:40 | |
| *** stevemar has joined #openstack-keystone | 01:40 | |
| *** ChanServ sets mode: +o stevemar | 01:40 | |
| *** agireud has joined #openstack-keystone | 01:41 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 01:48 |
| *** TxGVNN has joined #openstack-keystone | 01:50 | |
| *** jefrite has quit IRC | 01:50 | |
| daminate | looking into possibility to leverage keystone outside of openstack for auth/rbac for set of custom apps/services. does this seem feasible? | 01:51 |
| stevemar | daminate: it's probably feasible but there are probably better solutions out there | 01:55 |
| stevemar | keystone is pretty openstack-y | 01:55 |
| openstackgerrit | Merged openstack/keystonemiddleware: Config: no need to set default=None https://review.openstack.org/333068 | 01:56 |
| *** afred312 has quit IRC | 02:00 | |
| *** tqtran has joined #openstack-keystone | 02:01 | |
| *** afred312 has joined #openstack-keystone | 02:04 | |
| *** tqtran has quit IRC | 02:05 | |
| *** nkinder has joined #openstack-keystone | 02:09 | |
| *** jbell8 has quit IRC | 02:11 | |
| *** stevemar has quit IRC | 02:14 | |
| *** spandhe has joined #openstack-keystone | 02:15 | |
| daminate | one thiking was that if services were bundled to be deployed on openstack environments for premise solution, could just extend the keystone deployment and give end users single rbac system | 02:23 |
| daminate | will do bit more reading and look at some alternatives | 02:23 |
| *** spandhe_ has joined #openstack-keystone | 02:27 | |
| *** spandhe has quit IRC | 02:28 | |
| *** spandhe_ is now known as spandhe | 02:28 | |
| *** stevemar has joined #openstack-keystone | 02:34 | |
| *** ChanServ sets mode: +o stevemar | 02:34 | |
| *** browne has joined #openstack-keystone | 02:38 | |
| *** stevemar has quit IRC | 02:39 | |
| *** iurygregory_ has quit IRC | 02:56 | |
| *** stevemar has joined #openstack-keystone | 02:57 | |
| *** ChanServ sets mode: +o stevemar | 02:57 | |
| *** rderose has quit IRC | 02:57 | |
| *** richm has quit IRC | 03:03 | |
| *** spzala has quit IRC | 03:11 | |
| *** davechen has joined #openstack-keystone | 03:11 | |
| *** browne has quit IRC | 03:14 | |
| *** stevemar has quit IRC | 03:20 | |
| *** daminate has left #openstack-keystone | 03:23 | |
| *** stevemar has joined #openstack-keystone | 03:28 | |
| *** ChanServ sets mode: +o stevemar | 03:28 | |
| *** stevemar has quit IRC | 03:32 | |
| *** stevemar has joined #openstack-keystone | 03:35 | |
| *** ChanServ sets mode: +o stevemar | 03:35 | |
| *** stevemar has quit IRC | 03:35 | |
| *** stevemar has joined #openstack-keystone | 03:36 | |
| *** ChanServ sets mode: +o stevemar | 03:36 | |
| *** topol_ has joined #openstack-keystone | 03:36 | |
| stevemar | yiiiiiis my VM is back online! | 03:37 |
| *** links has joined #openstack-keystone | 03:51 | |
| *** josecastroleon has joined #openstack-keystone | 03:58 | |
| *** lucas____ has joined #openstack-keystone | 04:08 | |
| *** lucas____ has quit IRC | 04:10 | |
| *** lucas____ has joined #openstack-keystone | 04:10 | |
| *** lucas____ has quit IRC | 04:16 | |
| *** lucas____ has joined #openstack-keystone | 04:18 | |
| *** GB21 has joined #openstack-keystone | 04:18 | |
| *** lucas____ has quit IRC | 04:32 | |
| *** davechen has quit IRC | 04:36 | |
| *** lucas____ has joined #openstack-keystone | 04:36 | |
| *** dan_nguyen has joined #openstack-keystone | 04:37 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Replace keystone.common.config with keystone.conf package https://review.openstack.org/325604 | 04:40 |
| *** dave-mccowan has quit IRC | 04:41 | |
| *** jaosorior has joined #openstack-keystone | 04:55 | |
| stevemar | dolphm: what record are you going for? | 04:57 |
| *** dan_nguyen has quit IRC | 04:59 | |
| *** lucas____ has quit IRC | 05:15 | |
| *** lucas____ has joined #openstack-keystone | 05:19 | |
| *** GB21 has quit IRC | 05:21 | |
| *** jdennis1 has joined #openstack-keystone | 05:24 | |
| *** jdennis has quit IRC | 05:24 | |
| *** lucas____ has quit IRC | 05:28 | |
| *** lucas____ has joined #openstack-keystone | 05:33 | |
| *** GB21 has joined #openstack-keystone | 05:37 | |
| *** lucas____ has quit IRC | 05:43 | |
| *** roxanaghe has joined #openstack-keystone | 05:44 | |
| *** roxanaghe has quit IRC | 05:45 | |
| *** lucas____ has joined #openstack-keystone | 05:47 | |
| *** yolanda has joined #openstack-keystone | 05:56 | |
| *** lucas____ has quit IRC | 05:56 | |
| *** lucas____ has joined #openstack-keystone | 06:01 | |
| *** tqtran has joined #openstack-keystone | 06:02 | |
| *** tqtran has quit IRC | 06:06 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Add create_plugin to loader https://review.openstack.org/333119 | 06:07 |
| *** henrynash has joined #openstack-keystone | 06:07 | |
| *** ChanServ sets mode: +v henrynash | 06:07 | |
| *** lucas____ has quit IRC | 06:10 | |
| *** spzala has joined #openstack-keystone | 06:11 | |
| *** henrynash has quit IRC | 06:12 | |
| *** rcernin has joined #openstack-keystone | 06:15 | |
| *** lucas____ has joined #openstack-keystone | 06:15 | |
| *** spzala has quit IRC | 06:15 | |
| *** lucas____ has quit IRC | 06:24 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Allow registering additional plugin loaders https://review.openstack.org/333126 | 06:28 |
| *** lucas____ has joined #openstack-keystone | 06:29 | |
| *** yolanda has quit IRC | 06:30 | |
| *** sdake has joined #openstack-keystone | 06:34 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Allow registering additional plugin loaders https://review.openstack.org/333126 | 06:34 |
| *** davechen has joined #openstack-keystone | 06:35 | |
| *** jbell8 has joined #openstack-keystone | 06:35 | |
| jamielennox | bknudson_: guess that answers that: https://github.com/kennethreitz/requests/issues/3360 | 06:36 |
| *** TxGVNN has quit IRC | 06:40 | |
| *** TxGVNN has joined #openstack-keystone | 06:40 | |
| *** lucas____ has quit IRC | 06:42 | |
| *** lucas____ has joined #openstack-keystone | 06:47 | |
| *** jamielennox is now known as jamielennox|away | 06:48 | |
| *** belmoreira has joined #openstack-keystone | 06:49 | |
| *** lucas____ has quit IRC | 06:56 | |
| *** lucas____ has joined #openstack-keystone | 06:57 | |
| *** rcernin has quit IRC | 07:02 | |
| *** lucas____ has quit IRC | 07:06 | |
| *** lucas____ has joined #openstack-keystone | 07:11 | |
| *** tesseract- has joined #openstack-keystone | 07:13 | |
| *** tesseract- has quit IRC | 07:14 | |
| *** ebarrera has joined #openstack-keystone | 07:14 | |
| *** tesseract- has joined #openstack-keystone | 07:14 | |
| *** rcernin has joined #openstack-keystone | 07:17 | |
| *** woodster_ has quit IRC | 07:18 | |
| *** lucas____ has quit IRC | 07:21 | |
| *** sdake_ has joined #openstack-keystone | 07:21 | |
| *** josecastroleon has quit IRC | 07:23 | |
| *** ChanServ sets mode: +v topol_ | 07:23 | |
| *** topol_ is now known as topol | 07:23 | |
| *** sdake has quit IRC | 07:24 | |
| openstackgerrit | Bhagyashri Shewale proposed openstack/keystonemiddleware: Fix typo 'olso' to 'oslo' https://review.openstack.org/333148 | 07:24 |
| *** lucas____ has joined #openstack-keystone | 07:25 | |
| *** pnavarro has joined #openstack-keystone | 07:38 | |
| *** henrynash has joined #openstack-keystone | 07:40 | |
| *** ChanServ sets mode: +v henrynash | 07:40 | |
| *** amoralej|off is now known as amoralej | 07:43 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: WIP - oidc: fix OpenID Connect authorization code grant_type https://review.openstack.org/330006 | 07:46 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: move scope into _OidcBase https://review.openstack.org/330463 | 07:46 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: refactor unit tests https://review.openstack.org/330966 | 07:46 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: add discovery document support https://review.openstack.org/330464 | 07:46 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: remove grant_type argument https://review.openstack.org/330465 | 07:46 |
| *** henrynash has quit IRC | 07:47 | |
| *** lucas____ has quit IRC | 07:48 | |
| *** spandhe has quit IRC | 07:52 | |
| *** lucas____ has joined #openstack-keystone | 07:52 | |
| *** gus has quit IRC | 07:57 | |
| *** gus has joined #openstack-keystone | 07:57 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:01 | |
| *** lucas____ has quit IRC | 08:02 | |
| *** yolanda has joined #openstack-keystone | 08:04 | |
| *** markvoel_ has quit IRC | 08:05 | |
| *** lucas____ has joined #openstack-keystone | 08:06 | |
| *** luca_____ has joined #openstack-keystone | 08:10 | |
| *** lucas____ has quit IRC | 08:11 | |
| *** mvk_ has quit IRC | 08:21 | |
| *** aloga has quit IRC | 08:23 | |
| *** davechen has left #openstack-keystone | 08:24 | |
| *** luca_____ has quit IRC | 08:24 | |
| openstackgerrit | Martin Schuppert proposed openstack/keystone: Verify domain_id when create_user is being called https://review.openstack.org/331567 | 08:28 |
| *** lucas____ has joined #openstack-keystone | 08:29 | |
| *** aloga has joined #openstack-keystone | 08:29 | |
| *** josecastroleon has joined #openstack-keystone | 08:30 | |
| *** daemontool has joined #openstack-keystone | 08:31 | |
| *** GB21 has quit IRC | 08:37 | |
| *** lucas____ has quit IRC | 08:42 | |
| *** GB21 has joined #openstack-keystone | 08:46 | |
| *** lucas____ has joined #openstack-keystone | 08:47 | |
| *** rcernin has quit IRC | 08:50 | |
| *** lucas____ has quit IRC | 08:56 | |
| *** yolanda has quit IRC | 09:01 | |
| *** rcernin has joined #openstack-keystone | 09:02 | |
| *** tqtran has joined #openstack-keystone | 09:03 | |
| *** markvoelker has joined #openstack-keystone | 09:05 | |
| *** tqtran has quit IRC | 09:08 | |
| *** henrynash has joined #openstack-keystone | 09:08 | |
| *** ChanServ sets mode: +v henrynash | 09:08 | |
| *** dmk0202 has joined #openstack-keystone | 09:09 | |
| *** markvoelker has quit IRC | 09:10 | |
| *** jaosorior has quit IRC | 09:11 | |
| *** mvk_ has joined #openstack-keystone | 09:11 | |
| *** jaosorior has joined #openstack-keystone | 09:11 | |
| *** lucas____ has joined #openstack-keystone | 09:20 | |
| *** mvk_ has quit IRC | 09:24 | |
| *** lucas____ has quit IRC | 09:29 | |
| *** lucas____ has joined #openstack-keystone | 09:33 | |
| *** clenimar_ has quit IRC | 09:37 | |
| *** henrynash has quit IRC | 09:40 | |
| *** sdake_ has quit IRC | 09:42 | |
| *** lucas____ has quit IRC | 09:43 | |
| *** mvk_ has joined #openstack-keystone | 09:43 | |
| *** jamielennox|away is now known as jamielennox | 09:43 | |
| *** nisha_ has joined #openstack-keystone | 09:44 | |
| *** lucas____ has joined #openstack-keystone | 09:47 | |
| *** pcaruana has joined #openstack-keystone | 09:51 | |
| *** GB21 has quit IRC | 09:54 | |
| *** samueldmq has joined #openstack-keystone | 09:59 | |
| *** ChanServ sets mode: +v samueldmq | 09:59 | |
| *** daemontool has quit IRC | 10:00 | |
| samueldmq | morning keystone | 10:00 |
| *** lucas____ has quit IRC | 10:01 | |
| *** sdake has joined #openstack-keystone | 10:01 | |
| nisha_ | samueldmq, morning | 10:06 |
| *** markvoelker has joined #openstack-keystone | 10:07 | |
| samueldmq | nisha_: hi, morning | 10:07 |
| samueldmq | jamielennox: hi, you around ? | 10:08 |
| samueldmq | jamielennox: in keystonemiddleware, keystoneauth1.identity.v3.oidc.OidcPassword is a public symbol | 10:09 |
| samueldmq | jamielennox: do we need to be concerned about others using it ? (it's being proposed to rename a __init__ argument) | 10:10 |
| samueldmq | jamielennox: https://review.openstack.org/#/c/330463/4/keystoneauth1/identity/v3/oidc.py | 10:10 |
| patchbot | samueldmq: patch 330463 - keystoneauth - oidc: move scope into _OidcBase | 10:10 |
| samueldmq | jamielennox: I've added you as a reviewer there | 10:10 |
| *** markvoelker has quit IRC | 10:11 | |
| *** spzala has joined #openstack-keystone | 10:12 | |
| *** spzala has quit IRC | 10:16 | |
| *** nisha_ has quit IRC | 10:22 | |
| *** nisha_ has joined #openstack-keystone | 10:22 | |
| *** GB21 has joined #openstack-keystone | 10:24 | |
| *** lucas____ has joined #openstack-keystone | 10:25 | |
| *** sdake_ has joined #openstack-keystone | 10:28 | |
| *** dmk0202 has quit IRC | 10:29 | |
| *** TxGVNN has quit IRC | 10:29 | |
| *** sdake has quit IRC | 10:32 | |
| *** lucas____ has quit IRC | 10:34 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add project functional tests https://review.openstack.org/332871 | 10:36 |
| nisha_ | samueldmq, please have a look ^ | 10:38 |
| *** lucas____ has joined #openstack-keystone | 10:39 | |
| *** nisha__ has joined #openstack-keystone | 10:46 | |
| *** bjornar_ has joined #openstack-keystone | 10:47 | |
| *** nisha_ has quit IRC | 10:47 | |
| aloga | samueldmq: regarding https://review.openstack.org/#/c/330463/4/keystoneauth1/identity/v3/oidc.py | 10:47 |
| patchbot | aloga: patch 330463 - keystoneauth - oidc: move scope into _OidcBase | 10:47 |
| aloga | samueldmq: the patches was rebased as I rebased the parent commit | 10:48 |
| aloga | s/patches/patchset/ | 10:48 |
| *** josecastroleon has quit IRC | 10:48 | |
| aloga | samueldmq: but I share your concerns regarding the argument renaming | 10:49 |
| aloga | samueldmq: but I am more concerned about the option renaming that already happened with the switch from keystoneclient ("--scope") and keystoneauth1 ("--openid-scope") | 10:50 |
| aloga | samueldmq: so to be honest I do not know that is the best option, I am happy to implement whatever it is | 10:51 |
| jamielennox | samueldmq: @positional() saves you there | 10:51 |
| jamielennox | samueldmq: i'm more concerned about renaming scope -> openid_scope | 10:52 |
| aloga | jamielennox: that was my concern a well | 10:53 |
| aloga | jamielennox: on the one hand "scope" is a terrible name IMO | 10:53 |
| samueldmq | nisha__: reviewed, see comments | 10:54 |
| aloga | jamielennox: as I think this causes confusion (i.e. Keystone scope VS OpenID scope) | 10:54 |
| aloga | jamielennox: on the other hand, previous keystoneclient plugin used "scope" as its option | 10:54 |
| aloga | jamielennox: causing users headackes when the switch to keystoneauth1 was done (see https://bugs.launchpad.net/keystoneauth/+bug/1582774/comments/19 and https://bugs.launchpad.net/keystoneauth/+bug/1582774/comments/20 ) | 10:55 |
| openstack | Launchpad bug 1582774 in python-openstackclient "OidcPassword auth plugin should accept Keystone scope parameters" [Undecided,Fix released] - Assigned to Alvaro Lopez (aloga) | 10:55 |
| samueldmq | aloga: jamielennox: yes I am concerned about the rename as well | 10:55 |
| aloga | so, :-? | 10:56 |
| nisha__ | samueldmq, thanks | 10:56 |
| *** ramishra has joined #openstack-keystone | 10:56 | |
| aloga | both options are bad \o/ | 10:56 |
| samueldmq | jamielennox: if someone else is calling the __init__ with scope='somethin', that's just going to be ignored with the patch | 10:56 |
| *** jistr is now known as jistr|mtg | 10:56 | |
| samueldmq | because it renames scope to something else | 10:56 |
| jamielennox | samueldmq: yep, i think i misread first time, you need to keep the scope name, but you can move it to the upper class and rely on **kwargs because of posiitonal | 11:00 |
| *** nisha_ has joined #openstack-keystone | 11:01 | |
| samueldmq | jamielennox: ++, but that doesn't fix the bug :( | 11:02 |
| jamielennox | samueldmq: oh, i haven't read or looked at the bug or even the rest of the review yet | 11:02 |
| samueldmq | jamielennox: sure, take your time, I added you as a reviewer because I know you'll have a good suggestion on how to proceed in that case | 11:03 |
| jamielennox | samueldmq: so based on quickly reading the bug, you need to have the option in the loader.get_options() have Opt('openid-scope', dest='scope') | 11:04 |
| samueldmq | jamielennox: that's what I was thinking about and suggesting | 11:04 |
| samueldmq | jamielennox: to map it somehow | 11:04 |
| samueldmq | aloga: ^ | 11:04 |
| jamielennox | that will maintain the --os-openid-scope parameter and set the right value in **kwargs | 11:04 |
| samueldmq | exactly | 11:05 |
| *** ddieterly has joined #openstack-keystone | 11:05 | |
| *** nisha__ has quit IRC | 11:05 | |
| *** markvoelker has joined #openstack-keystone | 11:07 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Allow registering additional plugin loaders https://review.openstack.org/333126 | 11:09 |
| *** josecastroleon has joined #openstack-keystone | 11:12 | |
| *** markvoelker has quit IRC | 11:13 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: WIP - oidc: fix OpenID Connect authorization code grant_type https://review.openstack.org/330006 | 11:15 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: move scope into _OidcBase https://review.openstack.org/330463 | 11:15 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: add discovery document support https://review.openstack.org/330464 | 11:15 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: remove grant_type argument https://review.openstack.org/330465 | 11:15 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: fix OpenID Connect scope option https://review.openstack.org/333261 | 11:15 |
| aloga | there it goes | 11:16 |
| *** amrith has quit IRC | 11:16 | |
| *** amrith has joined #openstack-keystone | 11:17 | |
| aloga | samueldmq, jamielennox thanks for the input | 11:18 |
| *** amoralej is now known as amoralej|lunch | 11:19 | |
| *** lucas____ has quit IRC | 11:20 | |
| *** sdake_ has quit IRC | 11:21 | |
| samueldmq | aloga: sure, yw | 11:23 |
| *** lucas____ has joined #openstack-keystone | 11:25 | |
| *** ekarlso has quit IRC | 11:26 | |
| *** henrynash has joined #openstack-keystone | 11:27 | |
| *** ChanServ sets mode: +v henrynash | 11:27 | |
| *** daemontool has joined #openstack-keystone | 11:28 | |
| *** lucas____ has quit IRC | 11:29 | |
| *** lucas____ has joined #openstack-keystone | 11:30 | |
| *** ddieterly has quit IRC | 11:31 | |
| *** henrynash has quit IRC | 11:31 | |
| *** dmk0202 has joined #openstack-keystone | 11:33 | |
| *** lucas____ has quit IRC | 11:34 | |
| *** lucas____ has joined #openstack-keystone | 11:34 | |
| *** ddieterly has joined #openstack-keystone | 11:35 | |
| *** TxGVNN has joined #openstack-keystone | 11:38 | |
| *** ddieterly has quit IRC | 11:38 | |
| *** GB21 has quit IRC | 11:40 | |
| *** GB21 has joined #openstack-keystone | 11:42 | |
| *** lucas____ has quit IRC | 11:43 | |
| *** lucas____ has joined #openstack-keystone | 11:48 | |
| *** ekarlso has joined #openstack-keystone | 11:51 | |
| *** ddieterly has joined #openstack-keystone | 11:51 | |
| *** lucas____ has quit IRC | 11:54 | |
| *** lucas____ has joined #openstack-keystone | 11:54 | |
| *** daemontool_ has joined #openstack-keystone | 11:54 | |
| *** daemontool has quit IRC | 11:55 | |
| *** amakarov_away is now known as amakarov | 11:57 | |
| *** ddieterly has quit IRC | 11:59 | |
| *** markvoelker has joined #openstack-keystone | 11:59 | |
| *** jdennis1 has quit IRC | 12:03 | |
| *** jdennis has joined #openstack-keystone | 12:03 | |
| *** lucas____ has quit IRC | 12:03 | |
| *** GB21 has quit IRC | 12:07 | |
| *** lucas____ has joined #openstack-keystone | 12:08 | |
| *** ramishra has quit IRC | 12:19 | |
| *** nisha_ has quit IRC | 12:22 | |
| *** nisha_ has joined #openstack-keystone | 12:23 | |
| *** GB21 has joined #openstack-keystone | 12:24 | |
| *** ddieterly has joined #openstack-keystone | 12:24 | |
| *** amoralej|lunch is now known as amoralej | 12:25 | |
| *** lucas____ has quit IRC | 12:26 | |
| *** ramishra has joined #openstack-keystone | 12:30 | |
| *** lucas____ has joined #openstack-keystone | 12:31 | |
| *** ddieterly has quit IRC | 12:32 | |
| *** M00nr41n has quit IRC | 12:37 | |
| *** GB21 has quit IRC | 12:37 | |
| *** lucas____ has quit IRC | 12:40 | |
| *** ramishra has quit IRC | 12:41 | |
| *** ametts has joined #openstack-keystone | 12:43 | |
| *** lucas___ has joined #openstack-keystone | 12:45 | |
| *** sdake has joined #openstack-keystone | 12:48 | |
| amakarov | samueldmq, hi! Can you please suggest, how problem description should look like? :) I've written what I consider a problem in the spec | 12:51 |
| *** edmondsw has joined #openstack-keystone | 12:57 | |
| *** pauloewerton has joined #openstack-keystone | 12:58 | |
| *** real56 has joined #openstack-keystone | 12:59 | |
| *** lucas___ has quit IRC | 13:03 | |
| samueldmq | amakarov: hi | 13:06 |
| samueldmq | amakarov: in the problem description I expect to see what's the issue with the current code | 13:07 |
| samueldmq | amakarov: and why it's an issue | 13:07 |
| amakarov | samueldmq, this is a spec - not a bug | 13:07 |
| samueldmq | amakarov: then in the proposed change you'll propose how to fix that | 13:07 |
| samueldmq | amakarov: it depends | 13:08 |
| samueldmq | amakarov: specs are also for big refactoring and API changes | 13:08 |
| *** lucas___ has joined #openstack-keystone | 13:08 | |
| amakarov | samueldmq, I'm proposing a workflow that will allow to implement RBAC3 | 13:08 |
| samueldmq | amakarov: are you introducing something completely new ? | 13:08 |
| amakarov | samueldmq, and remove bearer tokens | 13:08 |
| samueldmq | amakarov: why we need to remove bearer tokens ? | 13:09 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:09 | |
| samueldmq | amakarov: what's wrong with it ? | 13:09 |
| samueldmq | amakarov: I understand what you're willing to do, I just don't get a why | 13:09 |
| amakarov | samueldmq, it generates load by issue/validation | 13:09 |
| samueldmq | amakarov: and you consider this an issue, this is why you want the new proposal | 13:10 |
| samueldmq | amakarov: so put that in the problem description, it's your motivation to implement a new approach | 13:10 |
| amakarov | samueldmq, partially | 13:10 |
| samueldmq | amakarov: add other things too | 13:10 |
| amakarov | and I've described it | 13:10 |
| *** BjoernT has joined #openstack-keystone | 13:11 | |
| samueldmq | amakarov: see my comments | 13:13 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Complete RBAC in keystone https://review.openstack.org/325326 | 13:16 |
| amakarov | samueldmq, ^^ | 13:16 |
| samueldmq | amakarov: it might be interesting to take a look at Jamie's spec for reservations https://review.openstack.org/#/c/330329/ | 13:18 |
| patchbot | samueldmq: patch 330329 - keystone-specs - Reservations (a working title) | 13:18 |
| samueldmq | amakarov: he mentions keystone having the option to validate that a user can perform an operation in the deployment (i.e rbac centralized in keystone) | 13:19 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Support nested domains to provide additional project namespaces https://review.openstack.org/332940 | 13:20 |
| *** lucas___ has quit IRC | 13:22 | |
| amakarov | samueldmq, this looks an ad-hoc solution to me. My propose is a conceptual change | 13:23 |
| amakarov | proposal | 13:23 |
| samueldmq | amakarov: it changes a lot of how openstack does today for issuance/validation of tokens, I think it deserves a topic meeting so we get more attention to it | 13:26 |
| *** lucas___ has joined #openstack-keystone | 13:26 | |
| *** lucas___ has quit IRC | 13:27 | |
| amakarov | samueldmq, I believe it does, and I also believe we should at least give it a try, otherwise we'll end up using stale model drowning in patches | 13:27 |
| samueldmq | amakarov: and IMO it isn't worth it when we compare the benefits VS the complexity of the change | 13:27 |
| *** lucas___ has joined #openstack-keystone | 13:27 | |
| samueldmq | amakarov: but I really want to see other's input on it | 13:27 |
| amakarov | samueldmq, ok | 13:27 |
| amakarov | unfortunately, I'll not be on mid-cycle in person | 13:28 |
| samueldmq | :( | 13:28 |
| amakarov | so I think it may be a meeting | 13:28 |
| amakarov | samueldmq, is the spec clear now? I mean about problem description and what I'm proposing? | 13:30 |
| *** spzala has joined #openstack-keystone | 13:31 | |
| *** jistr|mtg is now known as jistr | 13:31 | |
| samueldmq | amakarov: I think it's better | 13:32 |
| *** david-lyle_ has joined #openstack-keystone | 13:32 | |
| *** catintheroof has joined #openstack-keystone | 13:32 | |
| *** ddieterly has joined #openstack-keystone | 13:33 | |
| amakarov | samueldmq, thank you. I definitely have to detail use cases, but I want to validate the idea first. | 13:33 |
| *** richm has joined #openstack-keystone | 13:34 | |
| *** yolanda has joined #openstack-keystone | 13:34 | |
| *** david-lyle has quit IRC | 13:36 | |
| *** rderose has joined #openstack-keystone | 13:41 | |
| *** timcline has joined #openstack-keystone | 13:44 | |
| *** dave-mccowan has joined #openstack-keystone | 13:55 | |
| *** itisha has joined #openstack-keystone | 13:55 | |
| *** ddieterly is now known as ddieterly[away] | 13:56 | |
| *** yolanda has quit IRC | 13:56 | |
| *** topol_ has joined #openstack-keystone | 13:56 | |
| *** ChanServ sets mode: +v topol_ | 13:56 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements https://review.openstack.org/333360 | 13:58 |
| *** ddieterly[away] is now known as ddieterly | 13:59 | |
| *** mwheckmann has joined #openstack-keystone | 14:00 | |
| *** rderose_ has joined #openstack-keystone | 14:01 | |
| *** rderose has quit IRC | 14:04 | |
| *** dan_nguyen has joined #openstack-keystone | 14:06 | |
| *** lucas___ has quit IRC | 14:06 | |
| *** dan_nguyen has quit IRC | 14:09 | |
| *** walharthi has joined #openstack-keystone | 14:11 | |
| *** lucas___ has joined #openstack-keystone | 14:11 | |
| *** woodster_ has joined #openstack-keystone | 14:12 | |
| *** zqfan has quit IRC | 14:13 | |
| *** sdake has quit IRC | 14:13 | |
| *** bjornar_ has quit IRC | 14:13 | |
| *** lucas___ has quit IRC | 14:15 | |
| *** sdake has joined #openstack-keystone | 14:16 | |
| *** kfox1111 is now known as kfox1111_away | 14:17 | |
| *** TxGVNN has quit IRC | 14:21 | |
| *** TxGVNN has joined #openstack-keystone | 14:22 | |
| *** nisha__ has joined #openstack-keystone | 14:23 | |
| *** darosale has joined #openstack-keystone | 14:24 | |
| *** josecastroleon has quit IRC | 14:26 | |
| *** nisha_ has quit IRC | 14:26 | |
| *** raddaoui has joined #openstack-keystone | 14:30 | |
| *** lucas___ has joined #openstack-keystone | 14:34 | |
| amakarov | ayoung, g'day! | 14:37 |
| *** ayoung has quit IRC | 14:37 | |
| *** jefrite has joined #openstack-keystone | 14:38 | |
| *** jistr is now known as jistr|mtg | 14:38 | |
| *** lucas___ has quit IRC | 14:38 | |
| amakarov | samueldmq, can you please review this chain? https://review.openstack.org/#/c/291318/ | 14:38 |
| patchbot | amakarov: patch 291318 - keystone - Unified delegation assignment driver | 14:38 |
| amakarov | it's about unified delegations | 14:39 |
| *** links has quit IRC | 14:41 | |
| *** josecastroleon has joined #openstack-keystone | 14:41 | |
| *** pcaruana has quit IRC | 14:41 | |
| *** jrist has quit IRC | 14:43 | |
| *** KevinE has joined #openstack-keystone | 14:44 | |
| *** edtubill has joined #openstack-keystone | 14:47 | |
| *** pnavarro has quit IRC | 14:48 | |
| *** timcline has quit IRC | 14:51 | |
| *** GB21 has joined #openstack-keystone | 14:51 | |
| *** timcline has joined #openstack-keystone | 14:51 | |
| *** jaosorior has quit IRC | 14:53 | |
| *** timcline has quit IRC | 14:55 | |
| *** jrist has joined #openstack-keystone | 14:55 | |
| *** phalmos has joined #openstack-keystone | 14:57 | |
| *** david-lyle_ is now known as david-lyle | 14:59 | |
| *** mvk_ has quit IRC | 15:02 | |
| *** dave-mccowan has quit IRC | 15:02 | |
| *** markvoelker_ has joined #openstack-keystone | 15:03 | |
| *** markvoelker has quit IRC | 15:03 | |
| *** amit213 has quit IRC | 15:04 | |
| *** tqtran has joined #openstack-keystone | 15:06 | |
| *** ebarrera has quit IRC | 15:08 | |
| *** darosale has quit IRC | 15:08 | |
| *** tqtran has quit IRC | 15:10 | |
| *** josecastroleon has quit IRC | 15:11 | |
| *** josecastroleon has joined #openstack-keystone | 15:12 | |
| samueldmq | amakarov: yes I will review it later | 15:13 |
| openstackgerrit | Merged openstack/keystonemiddleware: Fix typo 'olso' to 'oslo' https://review.openstack.org/333148 | 15:14 |
| *** sdake_ has joined #openstack-keystone | 15:14 | |
| *** sheel has quit IRC | 15:15 | |
| *** sdake has quit IRC | 15:16 | |
| *** darosale has joined #openstack-keystone | 15:19 | |
| *** dave-mccowan has joined #openstack-keystone | 15:19 | |
| *** sdake_ has quit IRC | 15:20 | |
| *** dan_nguyen has joined #openstack-keystone | 15:20 | |
| *** ddieterly is now known as ddieterly[away] | 15:21 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password SQL model changes https://review.openstack.org/314284 | 15:22 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password SQL model changes https://review.openstack.org/314284 | 15:22 |
| *** belmoreira has quit IRC | 15:23 | |
| *** ddieterly[away] is now known as ddieterly | 15:24 | |
| mwheckmann | Can someone tell me to what extented Mitaka Horizon is identity v3 Domain aware? | 15:26 |
| mwheckmann | When I'm logged in as a user with domain admin creds (role=admin) + using sample v3 Keystone policy.json, I can't list projects within domain. It seems that Horizon is trying to list all projects in the whole cloud and not just the domain | 15:27 |
| *** timcline has joined #openstack-keystone | 15:30 | |
| *** sdake has joined #openstack-keystone | 15:31 | |
| *** samueldmq has quit IRC | 15:33 | |
| *** lucas___ has joined #openstack-keystone | 15:33 | |
| *** sdake_ has joined #openstack-keystone | 15:34 | |
| *** luca_____ has joined #openstack-keystone | 15:35 | |
| *** lucas___ has quit IRC | 15:36 | |
| *** sdake has quit IRC | 15:36 | |
| *** luca_____ has quit IRC | 15:37 | |
| *** ayoung has joined #openstack-keystone | 15:37 | |
| *** ChanServ sets mode: +v ayoung | 15:37 | |
| *** josecastroleon has quit IRC | 15:42 | |
| ayoung | henrynash_, notmorgan I wonder if we could somehow optimize the LDAP code path for a token, by linking the bind and query for a user into a single lookup. I know that groups might be a problem, as that is currently coded as a separate lookup, but that actually is not the norm. Usually, groups as available as a field inside the user object | 15:42 |
| amakarov | ayoung, g'day! can you please review this chain? https://review.openstack.org/#/c/291318/ | 15:43 |
| patchbot | amakarov: patch 291318 - keystone - Unified delegation assignment driver | 15:43 |
| david-lyle | mwheckmann, which domain are you admin on? if the default domain, then yes, you are cloud admin not domain admin | 15:43 |
| ayoung | amakarov, will do | 15:43 |
| david-lyle | mwheckmann, so the project list would be all rather than just the one domain | 15:43 |
| david-lyle | mwheckmann, if you want to list the projects for a single domain as cloud admin, just set the domain context on the domains panel and then visit the projects panel | 15:44 |
| *** slberger has joined #openstack-keystone | 15:45 | |
| *** dmk0202 has quit IRC | 15:46 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password SQL model changes https://review.openstack.org/314284 | 15:48 |
| mwheckmann | david-lyle: problem is that the user is not Cloud-admin. I'm testing a user that is admin of a single domain (let's ignore the fact that other projects like Nova are not aware of the Cloud admin concept yet) | 15:50 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password SQL model changes https://review.openstack.org/314284 | 15:50 |
| mwheckmann | david-lyle: my domain context is set correctly. But if I check my Keystone logs, it's still trying to list projects for all domains | 15:51 |
| *** spandhe has joined #openstack-keystone | 15:57 | |
| *** josecastroleon has joined #openstack-keystone | 15:58 | |
| *** anush__ has joined #openstack-keystone | 16:00 | |
| ayoung | amakarov, reveiwed the first few in the chain. First one ready to go. Second and third should probably be merged | 16:00 |
| *** slberger has quit IRC | 16:00 | |
| amakarov | ayoung, thank you, will fix | 16:01 |
| ayoung | amakarov, last one still needs the fix I suggested, but good progress | 16:01 |
| *** TxGVNN has quit IRC | 16:01 | |
| *** slberger has joined #openstack-keystone | 16:01 | |
| *** GB21 has quit IRC | 16:02 | |
| nisha__ | Can anyone please help me out please? | 16:02 |
| nisha__ | I am writing functional test for projects | 16:02 |
| *** spandhe has quit IRC | 16:02 | |
| nisha__ | getting an error | 16:02 |
| nisha__ | here's the test and error, http://paste.openstack.org/show/521677/ | 16:02 |
| *** markvoelker has joined #openstack-keystone | 16:03 | |
| amakarov | ayoung, please suggest me what test cases are needed for assignment driver. I'm just applying existing assignment to be sure that the thing works as the original. | 16:03 |
| *** markvoelker_ has quit IRC | 16:04 | |
| *** anush__ has quit IRC | 16:04 | |
| amakarov | ayoung, and one more thing. I wonder if this can remove bearer tokens: https://review.openstack.org/#/c/325326/ | 16:05 |
| patchbot | amakarov: patch 325326 - keystone-specs - Complete RBAC in keystone | 16:05 |
| ayoung | amakarov, the function you pulled out does not have a cller in the patch: | 16:05 |
| ayoung | amakarov, gah | 16:06 |
| amakarov | ayoung, which one? | 16:06 |
| ayoung | don't tease me... | 16:06 |
| ayoung | amakarov, ok so | 16:06 |
| ayoung | https://review.openstack.org/#/c/291318/ is good to go | 16:06 |
| patchbot | ayoung: patch 291318 - keystone - Unified delegation assignment driver | 16:06 |
| ayoung | next up was | 16:06 |
| ayoung | https://review.openstack.org/#/c/330573/6 which needs to be merged into the patch after it, or have tests or something | 16:07 |
| patchbot | ayoung: patch 330573 - keystone - Delegation parent discovery function | 16:07 |
| ayoung | https://review.openstack.org/#/c/291318/21 is ok-ish | 16:07 |
| patchbot | ayoung: patch 291318 - keystone - Unified delegation assignment driver | 16:07 |
| ayoung | But I want to see how you rework things with 330573 before reviewing | 16:08 |
| ayoung | existing tests should be sufficient | 16:08 |
| raildo | nisha__: this test are creating the project with parent_id=default, I'm not sure it'll be the same if that parent_project | 16:09 |
| ayoung | amakarov, lets get throguh those 3, and then rebase the rest of the chain. Make sense? | 16:09 |
| amakarov | ayoung, yes. do you want me to squash assignment driver and discovery function? | 16:10 |
| nisha__ | raildo, hi | 16:10 |
| ayoung | amakarov, I think so. probably the easiest way to handle those | 16:10 |
| ayoung | nisha__, looking | 16:10 |
| nisha__ | raildo, but I modified the client_fixture.py to take an optional argument 'parent' | 16:10 |
| amakarov | ayoung, I've pulled it out because it's quite complicated and the driver is big already | 16:10 |
| nisha__ | ayoung, thanks | 16:10 |
| ayoung | nisha__, so tests are "expecte" "actual" | 16:11 |
| ayoung | and in your expected you have one project come back, but theactual has none...do I read that rihgt? | 16:11 |
| raildo | ayoung: it's right, my guess it is that the project_red.parents was not created properly | 16:12 |
| ayoung | nisha__, it is hard to tell from your paste: which check is failing? | 16:12 |
| nisha__ | ayoung, self.assertItemsEqual([parent_project.entity], project_ret.parents) | 16:13 |
| nisha__ | self.assertItemsEqual([child_project.entity], project_ret.subtree) | 16:13 |
| ayoung | so no hierarchy. | 16:13 |
| ayoung | nisha__, run it with a breakpoint, prior to the check, but after the fetch | 16:13 |
| ayoung | then, take a look in the database using SQL and see if the data is as you expect | 16:14 |
| ayoung | nisha__, use this http://adam.younglogic.com/2015/02/debugging-openstack-with-rpdb/ | 16:14 |
| amakarov | yes | 16:14 |
| ayoung | always a good idea to step through your code | 16:14 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation assignment driver https://review.openstack.org/291318 | 16:14 |
| nisha__ | ayoung, looking thanks | 16:14 |
| raildo | ayoung: ++ | 16:14 |
| ayoung | amakarov, this is good stuff . You are on track. Ask sam to look at that first patch (the one I +2ed) and we can start making progress up the chain | 16:15 |
| amakarov | ayoung, ^^ | 16:15 |
| amakarov | ayoung, ack, will ask him once he is online | 16:15 |
| *** tesseract- has quit IRC | 16:17 | |
| nisha__ | ayoung, raildo thanks a lot for help :) | 16:18 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 16:18 |
| raildo | nisha__: good luck :) | 16:18 |
| *** sdake_ is now known as sdake | 16:21 | |
| *** sheel has joined #openstack-keystone | 16:22 | |
| *** nisha__ has quit IRC | 16:22 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 16:23 |
| *** nisha__ has joined #openstack-keystone | 16:24 | |
| *** nisha__ has quit IRC | 16:27 | |
| *** josecastroleon has quit IRC | 16:31 | |
| *** roxanaghe has joined #openstack-keystone | 16:32 | |
| *** josecastroleon has joined #openstack-keystone | 16:36 | |
| *** jistr|mtg is now known as jistr | 16:42 | |
| *** ddieterly is now known as ddieterly[away] | 16:44 | |
| *** lucas____ has joined #openstack-keystone | 16:44 | |
| *** luca_____ has joined #openstack-keystone | 16:46 | |
| *** ddieterly[away] is now known as ddieterly | 16:48 | |
| *** lucas____ has quit IRC | 16:48 | |
| *** luca_____ has quit IRC | 16:51 | |
| *** topol_ has quit IRC | 16:52 | |
| *** lucas____ has joined #openstack-keystone | 16:54 | |
| *** lucas____ has quit IRC | 16:55 | |
| *** luca_____ has joined #openstack-keystone | 16:55 | |
| *** browne has joined #openstack-keystone | 16:56 | |
| openstackgerrit | Rudolf Vriend proposed openstack/keystone: Do not spam the log with uncritical stacktraces https://review.openstack.org/333490 | 16:57 |
| *** luca_____ has quit IRC | 16:59 | |
| *** real56 has quit IRC | 17:00 | |
| *** M00nr41n has joined #openstack-keystone | 17:02 | |
| *** josecastroleon has quit IRC | 17:05 | |
| *** daemontool_ has quit IRC | 17:06 | |
| *** lucas___ has joined #openstack-keystone | 17:07 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 17:08 |
| *** M00nr41n has quit IRC | 17:09 | |
| *** tqtran has joined #openstack-keystone | 17:13 | |
| *** ddieterly is now known as ddieterly[away] | 17:20 | |
| *** pushkaru has joined #openstack-keystone | 17:21 | |
| *** M00nr41n has joined #openstack-keystone | 17:22 | |
| *** raildo is now known as raildo-afk | 17:22 | |
| *** mlbiam has joined #openstack-keystone | 17:22 | |
| *** sdake has quit IRC | 17:22 | |
| *** GB21 has joined #openstack-keystone | 17:26 | |
| *** ayoung has quit IRC | 17:28 | |
| *** josecastroleon has joined #openstack-keystone | 17:28 | |
| *** anush__ has joined #openstack-keystone | 17:33 | |
| *** timcline has quit IRC | 17:35 | |
| *** timcline has joined #openstack-keystone | 17:36 | |
| *** gabriel-bezerra has quit IRC | 17:37 | |
| *** rcernin has quit IRC | 17:38 | |
| *** gabriel-bezerra has joined #openstack-keystone | 17:39 | |
| *** timcline has quit IRC | 17:40 | |
| *** anush__ has quit IRC | 17:44 | |
| *** pushkaru has quit IRC | 17:46 | |
| mwheckmann | david-lyle: according to Horizon Mitaka release notes, it's supposed to support the concept of Domain admin vs. Cloud admin, but I can't get that to work. Neither with Federated nor non-federated users with admin role on domain. Do I have to update a keystone_policy.json or something? | 17:46 |
| *** anush__ has joined #openstack-keystone | 17:46 | |
| mwheckmann | david-lyle: I'm already using the policy.v3cloudsample.json in Keystone, but maybe Horizon needs a copy of that as well.... will try | 17:49 |
| *** mwheckmann_ has joined #openstack-keystone | 17:50 | |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: Allow user to get themself and their domain https://review.openstack.org/333516 | 17:50 |
| *** mwheckmann has quit IRC | 17:51 | |
| *** mwheckmann_ is now known as mwheckmann | 17:51 | |
| *** anush__ has quit IRC | 17:51 | |
| *** mwheckmann_ has joined #openstack-keystone | 17:54 | |
| *** mwheckmann has quit IRC | 17:54 | |
| *** mwheckmann_ is now known as mwheckmann | 17:54 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 17:55 |
| *** shaleh has joined #openstack-keystone | 17:55 | |
| shaleh | re: newton midcycle. There is a restaurant near Cisco called "Darda" that is worth a stop. It is a Muslim Chinese place. Really good. Decent prices. It has been a South Bay standard for the 15+ years I have been here. | 17:57 |
| shaleh | homemade noodles with lamb | 17:57 |
| shaleh | makes me hungry thinking about them | 17:57 |
| *** josecastroleon has quit IRC | 17:58 | |
| *** dave-mccowan has quit IRC | 17:58 | |
| *** mwheckmann has quit IRC | 17:59 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 18:00 |
| *** spandhe has joined #openstack-keystone | 18:01 | |
| *** GB21 has quit IRC | 18:04 | |
| *** BjoernT is now known as Bjoern_zZzZzZzZ | 18:04 | |
| *** mwheckmann has joined #openstack-keystone | 18:07 | |
| *** mwheckmann has quit IRC | 18:10 | |
| *** pauloewerton has quit IRC | 18:11 | |
| *** sdake has joined #openstack-keystone | 18:11 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/328339 | 18:15 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 18:15 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/328339 | 18:15 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 18:16 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements https://review.openstack.org/333360 | 18:16 |
| *** timcline has joined #openstack-keystone | 18:16 | |
| mlbiam | is there a way to determine what groups a user is a member of other then iterating through all the groups and seeing if the user is a member? | 18:18 |
| *** dave-mccowan has joined #openstack-keystone | 18:19 | |
| *** ddieterly[away] has quit IRC | 18:21 | |
| *** amoralej is now known as amoralej|lunch | 18:21 | |
| *** amoralej|lunch is now known as amoralej|off | 18:21 | |
| shaleh | mlbiam: inside Keystone or via the REST API? | 18:22 |
| *** ddieterly has joined #openstack-keystone | 18:24 | |
| mlbiam | shaleh: in the REST api | 18:24 |
| shaleh | mlbiam: https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3.rst#list-groups-of-which-a-user-is-a-member | 18:24 |
| shaleh | mlbiam: when in doubt, read the specs :-) | 18:25 |
| mlbiam | shaleh: perfect! I didn't see this on the keystone website | 18:26 |
| shaleh | mlbiam: which website? | 18:28 |
| *** M00nr41n has quit IRC | 18:29 | |
| mlbiam | shaleh: http://docs.openstack.org/developer/keystone/ i think that was the first thing that came up when I googled OpenStack Keystone | 18:30 |
| dstanek | mlbiam: google for 'openstack identity api' | 18:30 |
| shaleh | mlbiam: http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3.html#list-groups-of-which-a-user-is-a-member | 18:31 |
| shaleh | mlbiam: I just followed the links and leads right there | 18:31 |
| mlbiam | shaleh: perfect, thanks! | 18:32 |
| shaleh | dstanek: I have 2 interns here at the moment. They seem incapable of deep reading. Goole search -> (usually) Stack Overflow -> hmm, is that it? -> lost. | 18:33 |
| dstanek | shaleh: sounds like fun :-) | 18:33 |
| shaleh | dstanek: I (re)introduced them to dir() and cli hacking with help() Tuesday | 18:33 |
| dstanek | i need an intern. that way i don't need to get up to get coffee | 18:34 |
| shaleh | dstanek: caffeine drone? | 18:34 |
| shaleh | magnetic topped karafe | 18:34 |
| shaleh | dstanek: you know the mantra, when in doubt use more arduinos. When that is not enough use more RPis. | 18:35 |
| shaleh | I do have a Keystone hacking question/issue though | 18:35 |
| stevemar | shaleh: ? | 18:35 |
| shaleh | we are getting reports of hitting deadlocks on token revoke | 18:35 |
| shaleh | I found that Nova is using oslo.db to perform db retries | 18:36 |
| shaleh | is there a reason we are not? | 18:36 |
| shaleh | before i submitted a patch I wanted to ask about history | 18:36 |
| stevemar | shaleh: not to my knwledge | 18:36 |
| dstanek | how would a retry fix a deadlock? | 18:36 |
| dstanek | no reason i can think of to not do that | 18:36 |
| shaleh | dstanek: they are momentary right? Once the db finishes the work | 18:37 |
| dstanek | so not really a deadlock, just a glitch somehow? | 18:37 |
| shaleh | dstanek: https://bugs.launchpad.net/nova/+bug/1439067 that is the nova issue | 18:37 |
| openstack | Launchpad bug 1439067 in OpenStack Compute (nova) "use db retry decorator from oslo.db" [Low,Fix released] - Assigned to Eugene Nikanorov (enikanorov) | 18:37 |
| dstanek | shaleh: did you create a bug yet? | 18:38 |
| shaleh | dstanek: it is a MySQL deadlock not a traditional locking style deadlock | 18:38 |
| dstanek | shaleh: do you know what is happening? | 18:38 |
| *** Bjoern_zZzZzZzZ is now known as BjoernT | 18:39 | |
| shaleh | dstanek: the usual. Too many revokes in the table and a simultaneous update occurs | 18:39 |
| shaleh | dstanek: as usual for these issues it is not easy to reproduce | 18:39 |
| dstanek | shaleh: what is the update doing? | 18:40 |
| shaleh | I see mentions off it from people on line | 18:40 |
| shaleh | dstanek: I do not have enough insight into what else was happening. Bad logs provided )-: | 18:40 |
| dstanek | to me a retry is a bandaid. i'd rather fix the issue if there is one | 18:40 |
| *** rodrigods has quit IRC | 18:40 | |
| *** rodrigods has joined #openstack-keystone | 18:40 | |
| shaleh | The user was attempting a glance operation which did a token validation which triggered a revocation clearing which deadlocked | 18:40 |
| *** anush__ has joined #openstack-keystone | 18:41 | |
| shaleh | dstanek: strong possibility this was after a tempest test which artificially filled the revocation table | 18:41 |
| *** Ephur has joined #openstack-keystone | 18:41 | |
| shaleh | Keystone has zero handling for this and just emits a server 500 | 18:42 |
| dstanek | shaleh: that's why i want to figure out why it locks :-) | 18:42 |
| shaleh | dstanek: understood | 18:42 |
| dstanek | multiple things accessing the same table record? | 18:42 |
| shaleh | dstanek: concurrent token validation attempts perhaps? | 18:43 |
| bknudson_ | mysqld has deadlock detection? | 18:43 |
| shaleh | 24390 (keystone.common.wsgi): 2016-05-13 14:43:01,804 ERROR wsgi __call__ (_mysql_exceptions.OperationalError) (1213, 'Deadlock found when trying to get lock; try restarting transaction') [SQL: u'DELETE FROM revocation_event WHERE revocation_event.revoked_at < %s'] [parameters: (datetime.datetime(2016, 5, 13, 10, 13, 1, 772294),)] | 18:44 |
| shaleh | dstanek: in typical user fashion that is ALL I was given | 18:45 |
| bknudson_ | for uuid tokens we required an external cleanup job... I think for revocation events we made it part of the request handling. | 18:46 |
| shaleh | so like I said, before I submit a patch with oslo.db retry decorator I wanted to ask here | 18:46 |
| shaleh | bknudson_: there is a cron job on the system to keep the table in check. However, tempest can flood the table and it will not drain fast enough. | 18:47 |
| bknudson_ | tempest should reuse tokens. | 18:47 |
| *** anush__ has quit IRC | 18:48 | |
| dstanek | shaleh: i wonder if ordering that delete would help http://stackoverflow.com/questions/2332768/how-to-avoid-mysql-deadlock-found-when-trying-to-get-lock-try-restarting-trans | 18:49 |
| shaleh | dstanek: yeah, we talked about that yesterday internally. | 18:49 |
| *** tonytan4ever has joined #openstack-keystone | 18:49 | |
| shaleh | dstanek: seems like a good idea anyways | 18:49 |
| shaleh | dstanek: I was planning on applying that fix too. Double bandaid :-) | 18:50 |
| *** Raildo has joined #openstack-keystone | 18:50 | |
| dstanek | shaleh: i'd try that first and see if it stops your issue | 18:51 |
| dstanek | shaleh: what environment where you getting that on? | 18:51 |
| shaleh | dstanek: notice the comment about retrying in there pulled from the mysql docs | 18:51 |
| bknudson_ | bandaids | 18:51 |
| dstanek | shaleh: on a really busy server i would expect retrys to also fail | 18:52 |
| shaleh | dstanek: it was a test environment. They had done some experiments then tried to run another set of playbooks and the error occurred. Like I said, I was not provided a ton of detail. | 18:52 |
| shaleh | dstanek: yeah, me too. Which is why mysql recommends 3+ of them :-) | 18:52 |
| dstanek | err...and make the problem worse | 18:52 |
| bknudson_ | the only way that this should happen is if you have 2 connections holding transactions over 2 tables, where one of them is the revocation event table | 18:53 |
| shaleh | I will start with the smarter delete query | 18:53 |
| bknudson_ | the revocation events should be cleaned up in their own transaction | 18:53 |
| dstanek | bknudson_: according to that post it could happen on a single table | 18:53 |
| shaleh | bknudson_: doesn't token validation satisfy your requirement? | 18:54 |
| dstanek | based on the sort order of the dataset | 18:54 |
| bknudson_ | that is nuts. | 18:54 |
| dstanek | so is mysql :-( | 18:54 |
| shaleh | dstanek: ++ | 18:54 |
| shaleh | I lost the postgres v. mysql argument years ago. Marketing at OReilly won that. | 18:54 |
| *** dan_nguyen has quit IRC | 18:55 | |
| bknudson_ | in our case we could just ignore a deadlock there since the next op will "retry" it. | 18:55 |
| dstanek | bknudson_: that's actually a really good point | 18:56 |
| shaleh | we do ignore it. Which triggers the server 500....... | 18:56 |
| bknudson_ | I mean discard the exception and continue the operation | 18:56 |
| *** gordc has quit IRC | 18:57 | |
| shaleh | bknudson_: ah. | 19:00 |
| shaleh | bknudson_: I could add that logic in as well. Do the sort to try and avoid it and drop it anyways assuming the next go round will handle it. | 19:01 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 19:01 |
| bknudson_ | sure. sorting can be expensive, but this table shouldn't be too big. | 19:01 |
| shaleh | define "too big" | 19:02 |
| bknudson_ | the time to sort will depend on your deployment. | 19:04 |
| *** sheel has quit IRC | 19:05 | |
| *** josecastroleon has joined #openstack-keystone | 19:10 | |
| jdennis | in Gerrit how do you dismiss a comment box in a patch review diff? It's obscuring the lines of code I want to look at but I can't make it go away | 19:10 |
| *** lucas___ has quit IRC | 19:14 | |
| *** lucas___ has joined #openstack-keystone | 19:15 | |
| *** timcline has quit IRC | 19:16 | |
| *** timcline has joined #openstack-keystone | 19:16 | |
| openstackgerrit | Merged openstack/keystone: PCI-DSS Password SQL model changes https://review.openstack.org/314284 | 19:17 |
| *** roxanaghe has quit IRC | 19:17 | |
| *** shaleh is now known as shaleh|away | 19:18 | |
| *** lucas___ has quit IRC | 19:20 | |
| *** ddieterly is now known as ddieterly[away] | 19:20 | |
| stevemar | jdennis: esc? | 19:20 |
| stevemar | oh wait | 19:20 |
| stevemar | i didn't understand the question, don't think you can | 19:20 |
| *** timcline has quit IRC | 19:21 | |
| *** htruta is now known as henrique | 19:22 | |
| *** lucas___ has joined #openstack-keystone | 19:23 | |
| *** henrique is now known as Guest78419 | 19:23 | |
| *** Guest78419 is now known as htruta | 19:23 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Pre-cache new tokens https://review.openstack.org/309146 | 19:25 |
| jdennis | stevemar: https://jdennis.fedorapeople.org/images/Screenshot%20from%202016-06-23%2015-21-40.png | 19:26 |
| jdennis | stevemar: the comment from Lance is obscuring the code, I want to hide it, make sense? | 19:27 |
| *** lucas___ has quit IRC | 19:27 | |
| *** henrynash has joined #openstack-keystone | 19:27 | |
| *** ChanServ sets mode: +v henrynash | 19:27 | |
| dstanek | jdennis: i don't think you can. or at least i've never been able to figure it out. in the past i've use the developertools to make it go away | 19:27 |
| dstanek | but i don't do that much | 19:27 |
| dstanek | jdennis: if you find a real way to do it pls post it here :-) | 19:28 |
| jdennis | ok, that stinks, oh well | 19:28 |
| *** lucas___ has joined #openstack-keystone | 19:28 | |
| *** ayoung has joined #openstack-keystone | 19:31 | |
| *** ChanServ sets mode: +v ayoung | 19:31 | |
| *** lucas___ has quit IRC | 19:33 | |
| bknudson_ | if "domain" goes away in favor of projects, do we change user/project domain_id attribute to project_id ? | 19:34 |
| *** lucas___ has joined #openstack-keystone | 19:35 | |
| *** lucas___ has quit IRC | 19:36 | |
| *** lucas___ has joined #openstack-keystone | 19:36 | |
| *** josecastroleon has quit IRC | 19:40 | |
| *** dan_nguyen has joined #openstack-keystone | 19:42 | |
| *** ddieterly[away] is now known as ddieterly | 19:44 | |
| *** mwheckmann has joined #openstack-keystone | 19:44 | |
| stevemar | jdennis: yep, don't think you can :( | 19:46 |
| stevemar | bknudson_: that'll be awful confusing... | 19:46 |
| stevemar | project: { id: x, project_id: y} | 19:46 |
| bknudson_ | project has parent_project_id so that was a bad example | 19:48 |
| *** mwheckmann has quit IRC | 19:48 | |
| dstanek | bknudson_: any reason the term domain would need to go away? | 19:49 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 20:00 |
| *** rderose has joined #openstack-keystone | 20:03 | |
| *** timcline has joined #openstack-keystone | 20:03 | |
| *** ayoung has quit IRC | 20:04 | |
| *** rderose_ has quit IRC | 20:05 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Replace keystone.common.config with keystone.conf package https://review.openstack.org/325604 | 20:06 |
| *** timcline has quit IRC | 20:07 | |
| *** timcline has joined #openstack-keystone | 20:09 | |
| *** rderose has quit IRC | 20:11 | |
| *** gyee has joined #openstack-keystone | 20:16 | |
| *** ChanServ sets mode: +v gyee | 20:16 | |
| *** lucas___ has quit IRC | 20:16 | |
| *** rderose has joined #openstack-keystone | 20:17 | |
| *** ayoung has joined #openstack-keystone | 20:18 | |
| *** ChanServ sets mode: +v ayoung | 20:18 | |
| *** rderose_ has joined #openstack-keystone | 20:20 | |
| *** gordc has joined #openstack-keystone | 20:20 | |
| *** phalmos has quit IRC | 20:21 | |
| *** rderose has quit IRC | 20:22 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 20:25 |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: Allow user to get themself and their domain https://review.openstack.org/333516 | 20:26 |
| *** tonytan4ever has quit IRC | 20:27 | |
| *** itisha has quit IRC | 20:27 | |
| *** jdennis has quit IRC | 20:27 | |
| *** mkoderer__ has quit IRC | 20:27 | |
| *** hugokuo has quit IRC | 20:27 | |
| *** notmorgan has quit IRC | 20:27 | |
| *** chris_hultin has quit IRC | 20:27 | |
| *** ctracey has quit IRC | 20:27 | |
| *** Daviey has quit IRC | 20:27 | |
| *** freerunner has quit IRC | 20:27 | |
| *** Anticimex has quit IRC | 20:27 | |
| *** ericksonsantos has quit IRC | 20:27 | |
| *** dobson has quit IRC | 20:27 | |
| *** zigo has quit IRC | 20:27 | |
| *** DuncanT has quit IRC | 20:27 | |
| *** mgagne has quit IRC | 20:27 | |
| *** cburgess has quit IRC | 20:27 | |
| *** _fortis has quit IRC | 20:27 | |
| *** dutsmoc has quit IRC | 20:27 | |
| *** odyssey4me has quit IRC | 20:27 | |
| *** lbragstad has quit IRC | 20:27 | |
| *** jamielennox has quit IRC | 20:27 | |
| *** evrardjp has quit IRC | 20:27 | |
| *** lbragstad_ has joined #openstack-keystone | 20:27 | |
| *** evrardjp has joined #openstack-keystone | 20:27 | |
| *** Anticimex has joined #openstack-keystone | 20:27 | |
| *** hugokuo has joined #openstack-keystone | 20:27 | |
| *** notmorgan has joined #openstack-keystone | 20:27 | |
| *** notmorgan has joined #openstack-keystone | 20:27 | |
| *** cburgess has joined #openstack-keystone | 20:27 | |
| *** ericksonsantos has joined #openstack-keystone | 20:27 | |
| *** chris_hultin has joined #openstack-keystone | 20:28 | |
| *** jdennis has joined #openstack-keystone | 20:28 | |
| *** tonytan4ever has joined #openstack-keystone | 20:28 | |
| *** freerunner has joined #openstack-keystone | 20:28 | |
| *** mkoderer__ has joined #openstack-keystone | 20:28 | |
| *** odyssey4me has joined #openstack-keystone | 20:28 | |
| *** dobson has joined #openstack-keystone | 20:28 | |
| *** zigo has joined #openstack-keystone | 20:29 | |
| *** ctracey has joined #openstack-keystone | 20:29 | |
| *** woodster_ has quit IRC | 20:29 | |
| *** mgagne has joined #openstack-keystone | 20:30 | |
| *** mgagne is now known as Guest20454 | 20:30 | |
| *** tonytan4ever has quit IRC | 20:30 | |
| *** DuncanT has joined #openstack-keystone | 20:31 | |
| *** itisha has joined #openstack-keystone | 20:31 | |
| *** comstud has joined #openstack-keystone | 20:32 | |
| *** jefrite has quit IRC | 20:32 | |
| *** Daviey has joined #openstack-keystone | 20:34 | |
| *** lbragstad_ is now known as lbragstad | 20:35 | |
| *** tonytan4ever has joined #openstack-keystone | 20:36 | |
| *** isd has joined #openstack-keystone | 20:37 | |
| *** jamielennox has joined #openstack-keystone | 20:38 | |
| *** ChanServ sets mode: +v jamielennox | 20:38 | |
| *** jefrite has joined #openstack-keystone | 20:45 | |
| *** mwheckmann has joined #openstack-keystone | 20:48 | |
| *** adu has joined #openstack-keystone | 20:50 | |
| *** ayoung has quit IRC | 20:51 | |
| *** mwheckmann has quit IRC | 20:51 | |
| *** browne has quit IRC | 20:57 | |
| *** woodster_ has joined #openstack-keystone | 21:01 | |
| *** mvk_ has joined #openstack-keystone | 21:02 | |
| *** ozialien10 has quit IRC | 21:08 | |
| edmondsw | stevemar or jamielennox... don't most clients retry automatically, so we don't have to do things like https://review.openstack.org/#/c/332485/ ? | 21:13 |
| patchbot | edmondsw: patch 332485 - nova-powervm - Some VM deploys fail from expired keystone token | 21:13 |
| edmondsw | wondering if the better fix there is to address the issue in swiftclient rather than in the nova-powervm driver | 21:14 |
| edmondsw | do we have a preferred way of doing this that could be copied? | 21:14 |
| jamielennox | edmondsw: it depends on the error type | 21:16 |
| jamielennox | oh - swift - yea swift does things completly differently | 21:16 |
| edmondsw | jamielennox, I think it was just token expired | 21:16 |
| jamielennox | edmondsw: so swift kinda uses ksa to do auth, but it doesn't use the session directly so it won't benefit from anything liek that | 21:17 |
| edmondsw | ideally the client would realize the token is about to expire and get a new one before it does, but even just retrying would be an improvement | 21:17 |
| edmondsw | jamielennox, I think you're telling me I'm right, but that it would be a lot of work to fix up swiftclient? | 21:18 |
| jamielennox | anything uses ksa session does that to an extent. i think it will only use tokens with at least 30 sec of expiration | 21:18 |
| jamielennox | edmondsw: yep - for anything other than swift you're right and it happens now, swift only just started accepting a session at all and doesn't use it the way everyone else does | 21:20 |
| *** catintheroof has quit IRC | 21:21 | |
| *** lmtaylor1 has joined #openstack-keystone | 21:22 | |
| *** lmtaylor1 has left #openstack-keystone | 21:22 | |
| *** AndyWojo has joined #openstack-keystone | 21:23 | |
| timburke | jamielennox: sadly patch 298968 still hasn't landed yet, so it *still* doesn't accept sessions | 21:24 |
| patchbot | timburke: https://review.openstack.org/#/c/298968/ - python-swiftclient - Adding keystoneauth sessions support | 21:24 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Replace keystone.common.config with keystone.conf package https://review.openstack.org/325604 | 21:24 |
| *** adu has quit IRC | 21:26 | |
| timburke | edmondsw: i would have expected swiftclient to have automatically re-authed, though, if the username, etc. were passed to it (which it *looks like* they are, but i'm not familiar with nova-powervm) | 21:26 |
| *** ddieterly is now known as ddieterly[away] | 21:28 | |
| bknudson_ | it would be nice if clients weren't required to use keystoneauth and could instead take my own request session. maybe I don't want to do keystone auth (see the -dev mailing list about mistral not using keystone) | 21:28 |
| jdennis | Is there a policy on the format of value in JSON vs. config options? e.g. int, "True", "False", and is the JSON generators smart enough to realize Python booleans can be represented as integers yet are logically boolean? | 21:28 |
| bknudson_ | if I was able to auth using standard HTTP methods like TLS client cert or normal http auth then there's no need for keystoneauth | 21:30 |
| edmondsw | lmtaylor1, can you verify what timburke thought he saw? | 21:30 |
| *** henrynash has quit IRC | 21:31 | |
| *** sdake has quit IRC | 21:38 | |
| *** darosale has quit IRC | 21:39 | |
| *** sdake has joined #openstack-keystone | 21:42 | |
| jamielennox | bknudson_: so keystoneauth handles the service catalog and token refresh with tokens, i don't know any way we could generalize that | 21:52 |
| jamielennox | bknudson_: also there is no reason the plugins have to actually talk to keystone, the token_endpoint plugin is really simple and uses pre-existing things | 21:52 |
| jamielennox | so you can use keystoneauth without keystone there | 21:52 |
| *** pnavarro has joined #openstack-keystone | 21:53 | |
| jamielennox | jdennis: i'm not entirely sure what you're asking but the json will be converted back into the python equivalent and the logical boolean happen in python | 21:53 |
| *** tonytan4ever has quit IRC | 21:54 | |
| *** roxanaghe has joined #openstack-keystone | 21:58 | |
| jdennis | jamielennox: so if an attribute in a JSON struct has a zero value how does that become a Python False value, equivalently in Python code are we rigorous to always use Python booleans (such that json converts it to true or false) because otherwise storing 0 or 1 in a Python value has the same truth semantics and worse I believe isinstnace(x, int) and isinstnace(x, boolean) both return true | 21:59 |
| jdennis | make more sense? | 21:59 |
| *** edtubill has quit IRC | 22:00 | |
| *** ddieterly[away] is now known as ddieterly | 22:00 | |
| jamielennox | jdennis: a 1 in json will become a 1 in python and bool(1) == True | 22:01 |
| jdennis | jamielennox: I'm trying to chase down a bug where logically a config value is boolean but when JSON is exchanged it's demanding an int | 22:01 |
| jdennis | as opposed to JSON true or false | 22:01 |
| jamielennox | what's failing? the jsonschema? | 22:01 |
| *** ametts has quit IRC | 22:02 | |
| *** pnavarro has quit IRC | 22:02 | |
| jdennis | jamielennox: https://bugzilla.redhat.com/show_bug.cgi?id=1347394 | 22:02 |
| openstack | bugzilla.redhat.com bug 1347394 in openstack-keystone "keystone LDAP configuration chase_referrals is only accepted as integer when using domain_configurations_from_database" [Unspecified,New] - Assigned to jdennis | 22:02 |
| jdennis | jamielennox: I'm just trying to get a handle on what is permitted in JSON | 22:04 |
| jamielennox | so json should be just a serialization format, it supports str, int/float, true, false and null | 22:04 |
| jamielennox | + list and dicts of | 22:05 |
| jdennis | jamielennox: and more to the point how do we know what type a value should be, is there a schema for every piece of JSON? | 22:05 |
| *** roxanaghe_ has joined #openstack-keystone | 22:05 | |
| jamielennox | our APIs have a jsonschema for validation, but that's all | 22:06 |
| jdennis | jdennis: in this particular case the question is a value an int or a boolean? | 22:06 |
| jamielennox | jdennis: the serialize/deserialize should be able to easily interpret that, you should get the same in as out | 22:08 |
| jamielennox | i really doubt the json serializer (assuming the standard python ones) is making a mistake on that | 22:08 |
| jdennis | jamielennox: there is a difference between int and boolean | 22:09 |
| jamielennox | however - for historical quirk reasons i think | 22:09 |
| jamielennox | isinstance(True, int) == True | 22:09 |
| jdennis | right | 22:09 |
| jamielennox | True == 1 is True as well, which i guess follows on from the above, but i never realized | 22:11 |
| dstanek | the json serializer uses 'true' for True | 22:11 |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: Allow user to get themself and their domain https://review.openstack.org/333516 | 22:12 |
| *** isd has left #openstack-keystone | 22:13 | |
| dstanek | python is a little strange in that bool is a subclass of int; that's why True is equal to 1 | 22:14 |
| *** edtubill has joined #openstack-keystone | 22:14 | |
| *** KevinE has quit IRC | 22:15 | |
| *** rderose_ has quit IRC | 22:16 | |
| *** edmondsw has quit IRC | 22:16 | |
| *** ddieterly has quit IRC | 22:18 | |
| *** walharthi has quit IRC | 22:19 | |
| *** timcline has quit IRC | 22:19 | |
| *** roxanaghe has quit IRC | 22:24 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 22:25 |
| *** roxanaghe_ has quit IRC | 22:29 | |
| *** slberger has left #openstack-keystone | 22:29 | |
| *** shaleh|away has quit IRC | 22:31 | |
| *** spzala has quit IRC | 22:33 | |
| *** spzala has joined #openstack-keystone | 22:33 | |
| *** roxanaghe has joined #openstack-keystone | 22:34 | |
| *** spzala has quit IRC | 22:38 | |
| *** timcline has joined #openstack-keystone | 22:38 | |
| jamielennox | gyee: i don't understand how you think reservations is any more cumbersome? it's completely transparent and is exactly the same number of requests | 22:38 |
| *** timcline_ has joined #openstack-keystone | 22:39 | |
| *** Raildo has quit IRC | 22:42 | |
| *** timcline has quit IRC | 22:43 | |
| *** jbell8 has quit IRC | 22:43 | |
| *** roxanaghe has quit IRC | 22:46 | |
| *** roxanaghe has joined #openstack-keystone | 22:48 | |
| *** timcline_ has quit IRC | 22:49 | |
| *** timcline has joined #openstack-keystone | 22:50 | |
| *** timcline has quit IRC | 22:54 | |
| *** jbell8 has joined #openstack-keystone | 22:54 | |
| *** gordc has quit IRC | 22:59 | |
| *** phalmos has joined #openstack-keystone | 22:59 | |
| *** phalmos_ has joined #openstack-keystone | 23:00 | |
| *** phalmos has quit IRC | 23:04 | |
| *** jbell8 has quit IRC | 23:14 | |
| *** rcernin has joined #openstack-keystone | 23:16 | |
| *** zqfan has joined #openstack-keystone | 23:16 | |
| gyee | jamielennox, cumbersome for deployers | 23:28 |
| *** sheel has joined #openstack-keystone | 23:29 | |
| jamielennox | gyee: how so? | 23:30 |
| gyee | 1) they can't be persisted; 2) they can't be cached; 3) require centralized policy; 4) support yet another token-ish format; 5) more effort to trace/audit the call | 23:31 |
| *** phalmos_ has quit IRC | 23:31 | |
| gyee | if glance is using Swift backend to store the images | 23:31 |
| *** sdake_ has joined #openstack-keystone | 23:31 | |
| gyee | we now required Keystone to know the entire chain of authorization | 23:31 |
| gyee | and those configurations changes from deployer to deployer | 23:32 |
| gyee | how do they setup the *right* reservation policies? | 23:32 |
| jamielennox | 1) non-persisted is exactly the idea 2) caching does get more misses 3) not immediately, but hopefully we can figure that out 4) what do deployers care about that 5) why would that be any different? | 23:33 |
| gyee | I am still having hard time understanding the details | 23:33 |
| jamielennox | gyee: so there's no way we can do the policy changes immediately, but i'm definetly trying to leave that door open | 23:33 |
| jamielennox | gyee: but the how of that is the same conversation we were going to have to have for any attempt at centralizing policy, for now i just want to make a mechanism that solves the expiry problem and we can extend in future | 23:34 |
| gyee | we already have this thing called PKI token, where the data is signed and encrypted, and can be verify *independently* | 23:34 |
| gyee | why re-inventing the wheel? | 23:34 |
| *** spzala has joined #openstack-keystone | 23:34 | |
| jamielennox | gyee: we deprecated PKI tokens - and for a reason | 23:34 |
| gyee | jamielennox, with revoke by audit_id, don't we have a mitigation in place? | 23:34 |
| *** sdake has quit IRC | 23:35 | |
| jamielennox | we deprecated the whole concept of PKI tokens | 23:35 |
| jamielennox | valid options today are fernet and UUID because there are some things fernet can't do yet | 23:35 |
| gyee | I know that, that doesn't mean its not useful in certain situations | 23:35 |
| jamielennox | useful deprecated features are a bad mix | 23:36 |
| gyee | just forget about the name "PKI token" for a moment, and concentrate on the use case | 23:36 |
| jamielennox | ok | 23:37 |
| gyee | we need <something> that can be trusted by all services | 23:37 |
| gyee | we need <something> that can be verified independently | 23:37 |
| gyee | we need <something> that need no be persisted | 23:37 |
| gyee | we need <something> that can be cached | 23:38 |
| gyee | we need <something> which does not required the complexity of centralized policies | 23:38 |
| gyee | now what would that <something> look like? :-) | 23:39 |
| jamielennox | so i think we need to figure out the complexity of centralized policy one way or another and theres been a number of attempts on that, i'm also not convinced on independant verification - just trusted verification is sufficient | 23:40 |
| *** adu has joined #openstack-keystone | 23:40 | |
| *** spzala has quit IRC | 23:40 | |
| gyee | if service can't trust each other, we need something that can be trusted by both parties | 23:40 |
| jamielennox | like keystone? | 23:41 |
| gyee | that's the essence of PKI | 23:41 |
| gyee | to establish mutual trust | 23:41 |
| gyee | besides, policy can only tell you whether you can call an API | 23:42 |
| jamielennox | so signed reservations was defintely something i put into the spec, i just expected people to want to go for fernet instead | 23:42 |
| gyee | it does not authorize the resource itself | 23:42 |
| jamielennox | afaik keystone is the only service to put that logic into policy | 23:43 |
| gyee | policy can only tell you to whether you can perform an action, it can't tell you whether you can perform an action on a given resource | 23:43 |
| jamielennox | there are probably others i just don't know them | 23:43 |
| gyee | we even consider query params in the policies | 23:44 |
| gyee | so it is quite complex, just to comprehend the polices | 23:44 |
| gyee | now imagine admins having to design policies on reservation | 23:45 |
| jamielennox | yea, i think that trend is going the other way | 23:45 |
| jamielennox | nova for example is trying to pull most of that back into code | 23:45 |
| gyee | right, resource authorization is in the code | 23:45 |
| gyee | which reservation would need to know in advance isn't it? | 23:46 |
| gyee | that's why I would like to see what a reservation will actually look like in the spec | 23:46 |
| jamielennox | i don't claim to know how the policy enforcement would work there | 23:46 |
| jamielennox | centralized policy is going to be hard | 23:46 |
| jamielennox | i need to run for about an hour - sorry | 23:46 |
| gyee | k, lets chat more later | 23:47 |
| *** agrebennikov has joined #openstack-keystone | 23:52 | |
| *** sdake_ has quit IRC | 23:53 | |
| *** daemontool has joined #openstack-keystone | 23:53 | |
| *** BjoernT has quit IRC | 23:53 | |
| *** dan_nguyen has quit IRC | 23:54 | |
| *** edtubill has quit IRC | 23:56 | |
| *** sdake has joined #openstack-keystone | 23:58 | |
| *** dan_nguyen has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
