| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Extract oslo_messaging specific audit tests https://review.openstack.org/334296 | 00:09 |
|---|---|---|
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Refactor API tests to not run middleware https://review.openstack.org/334294 | 00:09 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Use a test notifier to record notifications https://review.openstack.org/334295 | 00:09 |
| *** sdake has quit IRC | 00:15 | |
| *** spzala has joined #openstack-keystone | 00:20 | |
| *** julim has joined #openstack-keystone | 00:26 | |
| *** gyee has quit IRC | 00:29 | |
| *** dan_nguyen has joined #openstack-keystone | 00:39 | |
| *** richm has quit IRC | 00:40 | |
| *** julim has quit IRC | 00:52 | |
| *** dan_nguyen has quit IRC | 00:59 | |
| *** ddieterly has joined #openstack-keystone | 01:01 | |
| *** tqtran has quit IRC | 01:01 | |
| *** rcernin has quit IRC | 01:11 | |
| *** fawadkhaliq has joined #openstack-keystone | 01:20 | |
| *** fawadkhaliq has quit IRC | 01:24 | |
| *** EinstCrazy has joined #openstack-keystone | 01:30 | |
| *** ddieterly is now known as ddieterly[away] | 01:33 | |
| *** ddieterly[away] is now known as ddieterly | 01:34 | |
| *** davechen has joined #openstack-keystone | 01:37 | |
| *** rderose has quit IRC | 01:38 | |
| *** tqtran has joined #openstack-keystone | 01:59 | |
| *** EinstCra_ has joined #openstack-keystone | 02:00 | |
| *** spzala has quit IRC | 02:00 | |
| *** spzala has joined #openstack-keystone | 02:00 | |
| openstackgerrit | Fangzhou Xu proposed openstack/keystone: Make getting token revocation list 9x faster on Mysql https://review.openstack.org/283902 | 02:00 |
| *** fawadkhaliq has joined #openstack-keystone | 02:01 | |
| *** tqtran has quit IRC | 02:03 | |
| *** EinstCrazy has quit IRC | 02:03 | |
| *** spzala has quit IRC | 02:05 | |
| *** fawadkhaliq has quit IRC | 02:05 | |
| *** mwheckmann has joined #openstack-keystone | 02:06 | |
| *** ddieterly has quit IRC | 02:08 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:22 | |
| *** fawadkhaliq has quit IRC | 02:26 | |
| *** GB21 has quit IRC | 02:26 | |
| *** mtreinish has quit IRC | 02:36 | |
| *** mtreinish has joined #openstack-keystone | 02:36 | |
| *** chlong has quit IRC | 02:37 | |
| *** woodburn has quit IRC | 02:37 | |
| *** spzala has joined #openstack-keystone | 02:37 | |
| *** woodburn has joined #openstack-keystone | 02:38 | |
| *** iurygregory_ has quit IRC | 02:39 | |
| *** sdake has joined #openstack-keystone | 02:40 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:43 | |
| *** fawadkhaliq has quit IRC | 02:46 | |
| *** chlong has joined #openstack-keystone | 02:50 | |
| *** iurygregory_ has joined #openstack-keystone | 02:52 | |
| *** sdake has quit IRC | 02:56 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Additional logging when authenticating https://review.openstack.org/333490 | 03:03 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Do not spam the log with uncritical stacktraces https://review.openstack.org/334742 | 03:03 |
| *** sheel has joined #openstack-keystone | 03:07 | |
| *** sdake has joined #openstack-keystone | 03:08 | |
| *** jorge_munoz has quit IRC | 03:10 | |
| *** jorge_munoz has joined #openstack-keystone | 03:14 | |
| *** iurygregory_ has quit IRC | 03:21 | |
| *** sdake has quit IRC | 03:27 | |
| *** woodster_ has quit IRC | 03:29 | |
| *** davechen has quit IRC | 03:30 | |
| *** links has joined #openstack-keystone | 03:50 | |
| *** TxGVNN has joined #openstack-keystone | 03:54 | |
| *** spzala has quit IRC | 03:57 | |
| *** tqtran has joined #openstack-keystone | 04:01 | |
| *** TxGVNN has quit IRC | 04:02 | |
| openstackgerrit | Merged openstack/keystone: Improve keystone.conf [assignment] documentation https://review.openstack.org/334667 | 04:05 |
| *** tqtran has quit IRC | 04:06 | |
| openstackgerrit | Merged openstack/keystone: Improve keystone.conf [auth] documentation https://review.openstack.org/334668 | 04:29 |
| *** zqfan has joined #openstack-keystone | 04:33 | |
| *** GB21 has joined #openstack-keystone | 04:40 | |
| *** fawadkhaliq has joined #openstack-keystone | 04:46 | |
| *** rcernin has joined #openstack-keystone | 04:47 | |
| *** phalmos has joined #openstack-keystone | 04:49 | |
| *** fawadkhaliq has quit IRC | 04:50 | |
| tonyb | stevemar: I hope you don't mind me doing the online edit thing | 04:54 |
| stevemar | tonyb: not at all, did i muck something up? i was also using the online editor | 04:55 |
| stevemar | tonyb: i was also replying to a mailing list post, so ... typo? | 04:55 |
| stevemar | tonyb: doh, commit message lol | 04:56 |
| tonyb | stevemar: the yaml was fine but the commit message still said 9.0.3 | 04:56 |
| stevemar | brain fart | 04:56 |
| tonyb | stevemar: my instinct is that it'd take longer and waste your time to -1 and respin than to just edit it | 04:56 |
| stevemar | tonyb: no worries, i do the same to patches i review | 04:57 |
| stevemar | i don't mind one bit, for the exact reason you mention | 04:57 |
| tonyb | stevemar: cool. It's a kinda new workflow so I get nervous | 04:57 |
| *** spzala has joined #openstack-keystone | 04:57 | |
| *** spzala has quit IRC | 05:05 | |
| notmorgan | it's been a quiet day eh stevemar | 05:10 |
| *** nisha_ has joined #openstack-keystone | 05:10 | |
| stevemar | notmorgan: everyday can be a quiet day if you ignore stuff | 05:11 |
| notmorgan | stevemar: ignore stuff? nevar | 05:11 |
| *** phalmos has quit IRC | 05:12 | |
| openstackgerrit | Merged openstack/keystone: Do not spam the log with uncritical stacktraces https://review.openstack.org/334742 | 05:12 |
| stevemar | notmorgan: feel like looking at a caching patch: https://review.openstack.org/#/c/328820/5 :P | 05:13 |
| patchbot | stevemar: patch 328820 - keystone - Added cache for sql id mapping driver | 05:13 |
| *** M00nr41n has quit IRC | 05:13 | |
| *** ayoung has quit IRC | 05:14 | |
| notmorgan | stevemar: uhm sure... | 05:15 |
| notmorgan | stevemar: let me order some food... | 05:15 |
| stevemar | dstanek: you lied! i asked if https://review.openstack.org/#/c/317169/ was related to fernet keys and you said it was related to totp | 05:15 |
| patchbot | stevemar: patch 317169 - keystone - Support encryption of credentials in Keystone | 05:15 |
| stevemar | dstanek: it's both1 | 05:15 |
| stevemar | ! | 05:15 |
| stevemar | notmorgan: sure thing big wig | 05:15 |
| notmorgan | stevemar: bofh! | 05:16 |
| notmorgan | i mean... | 05:16 |
| notmorgan | stevemar: commented on caching patch | 05:32 |
| *** fawadkhaliq has joined #openstack-keystone | 05:34 | |
| *** GB21 has quit IRC | 05:35 | |
| *** fawadkhaliq has quit IRC | 05:36 | |
| *** fawadk has joined #openstack-keystone | 05:36 | |
| *** rcernin has quit IRC | 05:37 | |
| *** GB21 has joined #openstack-keystone | 05:38 | |
| *** nkinder has joined #openstack-keystone | 05:48 | |
| *** davechen has joined #openstack-keystone | 05:50 | |
| *** nkinder has quit IRC | 05:55 | |
| *** markvoelker has quit IRC | 05:58 | |
| *** mkoderer__ has joined #openstack-keystone | 06:01 | |
| *** spzala has joined #openstack-keystone | 06:02 | |
| *** GB21 has quit IRC | 06:05 | |
| *** spzala has quit IRC | 06:06 | |
| *** M00nr41n has joined #openstack-keystone | 06:07 | |
| *** rcernin has joined #openstack-keystone | 06:09 | |
| *** GB21 has joined #openstack-keystone | 06:16 | |
| *** dan_nguyen has joined #openstack-keystone | 06:19 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 roles https://review.openstack.org/334546 | 06:35 |
| *** lujinluo has joined #openstack-keystone | 06:40 | |
| *** dan_nguyen has quit IRC | 06:40 | |
| *** nisha_ has quit IRC | 06:40 | |
| *** TxGVNN has joined #openstack-keystone | 06:42 | |
| *** jamielennox is now known as jamielennox|away | 06:44 | |
| *** pcaruana has joined #openstack-keystone | 06:46 | |
| *** markvoelker has joined #openstack-keystone | 06:58 | |
| *** tesseract- has joined #openstack-keystone | 06:59 | |
| *** spzala has joined #openstack-keystone | 07:02 | |
| *** daemontool has joined #openstack-keystone | 07:04 | |
| *** markvoelker has quit IRC | 07:04 | |
| *** mwheckmann has quit IRC | 07:05 | |
| *** bjornar_ has joined #openstack-keystone | 07:07 | |
| *** spzala has quit IRC | 07:07 | |
| *** amoralej|off is now known as amoralej | 07:15 | |
| *** bjornar_ has quit IRC | 07:19 | |
| *** belmoreira has joined #openstack-keystone | 07:35 | |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/keystone: Config: no need to set default=None https://review.openstack.org/334814 | 07:42 |
| *** pnavarro has joined #openstack-keystone | 07:59 | |
| *** markvoelker has joined #openstack-keystone | 08:00 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:01 | |
| *** spzala has joined #openstack-keystone | 08:03 | |
| *** wangqun has joined #openstack-keystone | 08:04 | |
| *** markvoelker has quit IRC | 08:04 | |
| *** dmk0202 has joined #openstack-keystone | 08:06 | |
| *** spzala has quit IRC | 08:08 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Pass request back into wsgi render_reponse https://review.openstack.org/330720 | 08:08 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| openstackgerrit | henry-nash proposed openstack/keystone: WIP - Add framework for supporting microversions https://review.openstack.org/330674 | 08:16 |
| *** mvk_ has quit IRC | 08:19 | |
| *** raddaoui has quit IRC | 08:27 | |
| *** daemontool has quit IRC | 08:40 | |
| *** pnavarro has quit IRC | 08:49 | |
| *** pnavarro has joined #openstack-keystone | 08:49 | |
| *** mvk_ has joined #openstack-keystone | 08:51 | |
| *** lujinluo has quit IRC | 08:57 | |
| *** markvoelker has joined #openstack-keystone | 09:00 | |
| *** davechen has left #openstack-keystone | 09:03 | |
| *** jistr is now known as jistr|mtg | 09:04 | |
| *** spzala has joined #openstack-keystone | 09:04 | |
| *** markvoelker has quit IRC | 09:05 | |
| *** spzala has quit IRC | 09:09 | |
| *** GB21 has quit IRC | 09:31 | |
| *** jistr|mtg is now known as jistr | 09:31 | |
| *** david-lyle has quit IRC | 09:44 | |
| *** david-lyle has joined #openstack-keystone | 09:46 | |
| *** mvk_ has quit IRC | 09:48 | |
| openstackgerrit | Andreas Jaeger proposed openstack/python-keystoneclient: List system dependencies for running common tests https://review.openstack.org/334886 | 09:50 |
| *** GB21 has joined #openstack-keystone | 09:51 | |
| *** henrynash has quit IRC | 09:53 | |
| *** TxGVNN has quit IRC | 09:59 | |
| *** markvoelker has joined #openstack-keystone | 10:01 | |
| *** mvk_ has joined #openstack-keystone | 10:01 | |
| *** spzala has joined #openstack-keystone | 10:05 | |
| *** nisha_ has joined #openstack-keystone | 10:05 | |
| *** markvoelker has quit IRC | 10:06 | |
| *** spzala has quit IRC | 10:10 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Follow up patch for Improve docs for v3 projects https://review.openstack.org/334071 | 10:13 |
| *** wangqun has quit IRC | 10:14 | |
| *** bjornar_ has joined #openstack-keystone | 10:19 | |
| *** itsuugo has joined #openstack-keystone | 10:20 | |
| *** fawadk has quit IRC | 10:47 | |
| *** daemontool has joined #openstack-keystone | 10:48 | |
| *** spzala has joined #openstack-keystone | 10:53 | |
| *** EinstCra_ has quit IRC | 10:57 | |
| *** samueldmq has joined #openstack-keystone | 11:01 | |
| *** ChanServ sets mode: +v samueldmq | 11:01 | |
| samueldmq | morning keystone | 11:02 |
| *** markvoelker has joined #openstack-keystone | 11:02 | |
| *** markvoelker has quit IRC | 11:07 | |
| nisha_ | samueldmq, good morning | 11:08 |
| *** nisha__ has joined #openstack-keystone | 11:11 | |
| *** nisha_ has quit IRC | 11:14 | |
| samueldmq | nisha__: morning | 11:16 |
| *** amakarov_away is now known as amakarov | 11:18 | |
| *** ddieterly has joined #openstack-keystone | 11:19 | |
| *** nisha__ is now known as nisha_ | 11:21 | |
| amakarov | samueldmq, g'day! please look at line 1067 in https://review.openstack.org/#/c/285521/25/keystone/tests/unit/test_sql_upgrade.py | 11:23 |
| patchbot | amakarov: patch 285521 - keystone - Closure table for HMT | 11:23 |
| amakarov | samueldmq, that's what my patch https://review.openstack.org/#/c/334568/ for | 11:23 |
| patchbot | amakarov: patch 334568 - keystone - Allow test migration by module name | 11:23 |
| *** wanghua has quit IRC | 11:25 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:25 | |
| *** gordc has joined #openstack-keystone | 11:30 | |
| *** rodrigods has quit IRC | 11:32 | |
| *** rodrigods has joined #openstack-keystone | 11:32 | |
| samueldmq | amakarov: kk will look | 11:35 |
| *** GB21 has quit IRC | 11:37 | |
| *** GB21 has joined #openstack-keystone | 11:43 | |
| *** gordc has quit IRC | 11:45 | |
| *** raildo-afk is now known as raildo | 11:53 | |
| *** sdake has joined #openstack-keystone | 11:58 | |
| *** sdake_ has joined #openstack-keystone | 12:00 | |
| *** sdake has quit IRC | 12:03 | |
| *** fawadkhaliq has quit IRC | 12:04 | |
| *** real56 has joined #openstack-keystone | 12:05 | |
| *** raddaoui has joined #openstack-keystone | 12:08 | |
| *** spzala has quit IRC | 12:08 | |
| *** spzala has joined #openstack-keystone | 12:08 | |
| *** amoralej is now known as amoralej|lunch | 12:09 | |
| *** nisha_ has quit IRC | 12:11 | |
| *** gordc has joined #openstack-keystone | 12:12 | |
| *** spzala has quit IRC | 12:12 | |
| *** GB21 has quit IRC | 12:14 | |
| *** GB21 has joined #openstack-keystone | 12:18 | |
| *** jamielennox|away is now known as jamielennox | 12:21 | |
| jamielennox | amakarov: are you going to the midcycle? | 12:21 |
| amakarov | jamielennox, hi! no, I'm not going this time | 12:22 |
| *** ddieterly has quit IRC | 12:22 | |
| jamielennox | amakarov: ah, damn, i wanted to figure out where we differ on the reservations and the policy stuff | 12:22 |
| amakarov | jamielennox, I think it can co-exist | 12:24 |
| *** markvoelker has joined #openstack-keystone | 12:24 | |
| jamielennox | amakarov: i think they can to - i was just thinking that reservatins would largely solve the policy problem you're trying to solve as well | 12:25 |
| amakarov | jamielennox, even more: policy on keystone side can work in parallel with existing model | 12:25 |
| jamielennox | and i want to see if i was missing anything to rolling this all into one solution | 12:25 |
| jamielennox | amakarov: i'll find some time to talk to you about it later, just wanted to see if it could be the midcycle | 12:27 |
| *** GB21 has quit IRC | 12:27 | |
| jamielennox | but i'm going to bed - meeting early tomorrow | 12:27 |
| *** fawadkhaliq has joined #openstack-keystone | 12:28 | |
| *** daemontool has quit IRC | 12:28 | |
| amakarov | jamielennox, we can arrange hangout meeting or something like this | 12:28 |
| jamielennox | ++ | 12:28 |
| *** danpawlik has joined #openstack-keystone | 12:30 | |
| aloga | samueldmq: regarding your comment about the oidc scope in https://review.openstack.org/#/c/330463/ | 12:30 |
| patchbot | aloga: patch 330463 - keystoneauth - oidc: move scope into _OidcBase | 12:30 |
| aloga | samueldmq: I already commented there, but if you want some clarification I'm here | 12:31 |
| stevemar | o/ | 12:31 |
| aloga | samueldmq: the oidc scope is not related with the grant type, but with the claims that the auth server is returning | 12:31 |
| *** fawadkhaliq has quit IRC | 12:32 | |
| aloga | samueldmq: so this should work regardless of the grant_type | 12:32 |
| aloga | samueldmq: *however* the specification states that an authN request sent to a server must contain (it is a required parameter) a scope | 12:33 |
| aloga | samueldmq: and that scope MUST contain the "openid" scope value | 12:33 |
| raildo | jamielennox: hey :) about our v2-v3 stuffs, I was thinking in send an email to the operators list, to ask if Otaca is a good deadline. | 12:33 |
| aloga | samueldmq: so the code is wrong atm, since we're doing "scope='profile'" and it should be "scope='openid profile'" or "scope='profile'" | 12:34 |
| *** daemontool has joined #openstack-keystone | 12:36 | |
| *** links has quit IRC | 12:40 | |
| *** aloga has quit IRC | 12:40 | |
| *** aloga has joined #openstack-keystone | 12:40 | |
| aloga | wow, a nice weechat crash | 12:40 |
| *** ddieterly has joined #openstack-keystone | 12:44 | |
| *** pnavarro has quit IRC | 12:46 | |
| *** amoralej|lunch is now known as amoralej | 12:47 | |
| *** ddieterly has quit IRC | 12:49 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/333448 | 12:50 |
| *** spzala has joined #openstack-keystone | 12:51 | |
| *** edmondsw has joined #openstack-keystone | 12:52 | |
| *** links has joined #openstack-keystone | 12:53 | |
| shewless | Hi dstanek. Just thought I'd give you an update on my experience using ADFS as my IdP | 12:55 |
| *** shewless has quit IRC | 12:55 | |
| *** shewless has joined #openstack-keystone | 12:55 | |
| shewless | Hi dstanek. Just thought I'd give you an update on my experience using ADFS as my IdP | 12:55 |
| shewless | dstanek: Really the only difference I found is that microsoft forces "https" for the metadata and the consumer assertions. It'll support the port 5000 thing (for keystone) but you still have to enable SSL in apache for the virtual host 5000 and change local_settings.py to point to https:// v3 auth.. | 12:56 |
| *** daemontool has quit IRC | 12:57 | |
| shewless | dstanek: just FYI | 12:57 |
| shewless | dstanek: Otherwise shibboleth told me which attributes were being served up with ADFS and I just mapped them and it works | 12:57 |
| *** TxGVNN has joined #openstack-keystone | 13:00 | |
| *** pauloewerton has joined #openstack-keystone | 13:03 | |
| *** M00nr41n has quit IRC | 13:05 | |
| *** jsavak has joined #openstack-keystone | 13:06 | |
| breton_ | knikolla: i am thinking about https://review.openstack.org/#/c/320623/11/devstack/README.rst | 13:10 |
| patchbot | breton_: patch 320623 - keystone - Devstack plugin for Federation | 13:10 |
| openstackgerrit | Andreas Jaeger proposed openstack/python-keystoneclient: List system dependencies for running common tests https://review.openstack.org/334886 | 13:10 |
| breton_ | knikolla: so the main reason why we are doing this thing is to test federation in the gates | 13:10 |
| dstanek | shewless: nice. that's good news. glad you were able to fight through it | 13:11 |
| breton_ | knikolla: the line i'm thinking about is "After the setup is done, register the federated Keystone service providers" | 13:11 |
| breton_ | knikolla: how should it be done in the gates? | 13:12 |
| *** daemontool has joined #openstack-keystone | 13:13 | |
| *** nisha_ has joined #openstack-keystone | 13:13 | |
| breton_ | knikolla: lets register sp in the plugin, reading SP_URL from the environment variables | 13:15 |
| *** sdake_ has quit IRC | 13:23 | |
| *** EinstCrazy has joined #openstack-keystone | 13:23 | |
| *** sdake has joined #openstack-keystone | 13:24 | |
| *** jamielennox has quit IRC | 13:25 | |
| *** daemontool has quit IRC | 13:25 | |
| *** richm has joined #openstack-keystone | 13:26 | |
| *** ddieterly has joined #openstack-keystone | 13:30 | |
| *** henrynash has joined #openstack-keystone | 13:31 | |
| *** ChanServ sets mode: +v henrynash | 13:31 | |
| samueldmq | aloga: hi | 13:34 |
| samueldmq | aloga: "we're doing "scope='profile'" and it should be "scope='openid profile'"" | 13:35 |
| samueldmq | aloga: so is it wrong setting scope=profile as the default for all those 3 classe s? | 13:35 |
| samueldmq | stevemar: o/ | 13:36 |
| *** pnavarro has joined #openstack-keystone | 13:39 | |
| *** daemontool has joined #openstack-keystone | 13:41 | |
| *** timcline has joined #openstack-keystone | 13:41 | |
| *** ddieterly is now known as ddieterly[away] | 13:41 | |
| *** henrynash has quit IRC | 13:42 | |
| *** timcline has quit IRC | 13:42 | |
| *** fifieldt has joined #openstack-keystone | 13:43 | |
| *** timcline has joined #openstack-keystone | 13:43 | |
| *** henrynash has joined #openstack-keystone | 13:44 | |
| *** ChanServ sets mode: +v henrynash | 13:44 | |
| openstackgerrit | Merged openstack/keystone: Config: no need to set default=None https://review.openstack.org/334814 | 13:45 |
| *** ddieterly[away] is now known as ddieterly | 13:48 | |
| *** ayoung has joined #openstack-keystone | 13:52 | |
| *** ChanServ sets mode: +v ayoung | 13:52 | |
| *** rderose has joined #openstack-keystone | 13:53 | |
| knikolla | breton_: hi | 13:53 |
| *** mwheckmann has joined #openstack-keystone | 13:55 | |
| knikolla | breton_: that step can be easily included in devstack.sh as part of the automation, it can as easily be included in the shell script which runs stack.sh after it runs stack.sh | 13:56 |
| rderose | breton_: regarding concrete role assignments, what do you mean all tests passed after you removed that particular line. All that line should do is remove the duplicates. | 13:56 |
| knikolla | breton_: i just left it outside because it's the only step in the Identity Provider setup that requires knowledge about the service providers. So it kind of made the install more flexible. | 13:56 |
| *** ametts has joined #openstack-keystone | 13:57 | |
| knikolla | breton_: have you got the plugin working with generic federation? | 13:57 |
| rderose | breton_: what test didn't pass? | 13:57 |
| breton_ | knikolla: almost, i will push it today or tomorrow | 13:59 |
| knikolla | breton_: i'm fine with having the registration step as part of the plugin. | 14:00 |
| knikolla | breton_: cool. | 14:00 |
| breton_ | rderose: 5 mins | 14:01 |
| rderose | breton_: cool | 14:01 |
| *** rderose_ has joined #openstack-keystone | 14:04 | |
| *** woodster_ has joined #openstack-keystone | 14:05 | |
| rodrigods | knikolla, breton_, can you check the setup here https://review.openstack.org/#/c/324769/8/keystone_tempest_plugin/tests/scenario/test_federated_authentication.py | 14:06 |
| patchbot | rodrigods: patch 324769 - keystone - WIP: Federated authentication via ECP functional t... | 14:06 |
| rodrigods | knikolla, breton_, so the plugin provides the necessary configs | 14:06 |
| rodrigods | I tried to reduce the number of configs needed as much as possible | 14:06 |
| *** rderose has quit IRC | 14:07 | |
| breton_ | rodrigods: lets stop using word "plugin" and use either "devstack plugin" or "tempest plugin" | 14:07 |
| rodrigods | breton_, sure, "devstack plugin" | 14:08 |
| rodrigods | provides the needed configs for the "tempest plugin" | 14:08 |
| *** KevinE has joined #openstack-keystone | 14:09 | |
| knikolla | rodrigods: looking | 14:09 |
| knikolla | rodrigods: btw, did you also include the k2k tests to your review? | 14:09 |
| rodrigods | knikolla, not yet, the k2k tests should be in a follow up patch anyway | 14:10 |
| breton_ | knikolla: that's the issue: i removed that line and tests still pass | 14:10 |
| breton_ | knikolla: wrong hl, sorru | 14:10 |
| breton_ | rderose_: that's the issue: i removed that line and tests still pass | 14:10 |
| breton_ | *sorry, dammit | 14:11 |
| breton_ | fat fingers today | 14:11 |
| knikolla | breton_: no worries | 14:11 |
| rderose_ | breton_: oh, I see | 14:11 |
| rderose_ | breton_: that's just because the tests are introducing any duplicates | 14:12 |
| rodrigods | breton_, rderose_, removing the line and having the tests passing is not an issue | 14:12 |
| rderose_ | * are not | 14:12 |
| lbragstad | dstanek https://review.openstack.org/#/c/334061/4 | 14:12 |
| patchbot | lbragstad: patch 334061 - keystone - Group test_backend_ldap skips for readability | 14:12 |
| lbragstad | dstanek I left a comment there | 14:12 |
| breton_ | rodrigods: yes it is. It indicates lack of test. | 14:12 |
| lbragstad | dstanek and removed my -1 | 14:12 |
| rodrigods | rderose_, maybe add a test to check that are no duplicates | 14:12 |
| rodrigods | breton_, is not a "functional" issue | 14:13 |
| *** KevinE has quit IRC | 14:13 | |
| *** BjoernT has joined #openstack-keystone | 14:13 | |
| rodrigods | breton_, or wait... | 14:13 |
| rodrigods | it is | 14:13 |
| rodrigods | since it is the return of an API | 14:13 |
| dstanek | lbragstad: nice. working through those other tests now | 14:14 |
| lbragstad | dstanek if the goal is to approach consolidating/refactoring those tests in pieces because there are so many of them, i'm fine with that | 14:14 |
| lbragstad | i just wanted to make sure we weren't forgetting about those tests | 14:14 |
| dstanek | some of them override tests defined in the test_backend_ldap module and not from the general test modules | 14:14 |
| samueldmq | dstanek: I couldn't understand why test_list_projects_filtered_and_limited could be removed from the skip list, and still pass | 14:14 |
| lbragstad | ah | 14:14 |
| samueldmq | dstanek: since we don't even support resoruce LDAP anymore :( | 14:14 |
| knikolla | rodrigods: looked at the tempest test, the info is available as env variables | 14:14 |
| rderose_ | rodrigods breton_: you want a test for that one line to show that duplicates were removed? | 14:14 |
| dstanek | samueldmq: :-) magic | 14:14 |
| dstanek | some of those test use SQL backends for certain things | 14:15 |
| knikolla | rodrigods: one question, you're registering the idp in the test? | 14:15 |
| lbragstad | dstanek that's fun | 14:15 |
| samueldmq | dstanek: I guess it's running against SQL, which make me think the setup is wrong ? | 14:15 |
| dstanek | this all started as a way for me to understand the LDAP code better | 14:15 |
| samueldmq | dstanek: or the tests are in the wrong place, and shouldn't be inherited by LDAP setup | 14:15 |
| dstanek | samueldmq: no, we setup SQL on purpose there for some of the tests | 14:16 |
| samueldmq | dstanek: agreed, but we don't need to test test_list_projects_filtered_and_limited there again I guess | 14:16 |
| rodrigods | rderose_, yeah, should have a test with duplicates in groups/users assignments and check the return don't have duplicates | 14:16 |
| rderose_ | rodrigods: okay, on it | 14:16 |
| rodrigods | knikolla, via env vars? it needs to write to tempest conf somehow | 14:16 |
| samueldmq | dstanek: I mean, I suspect the smae test is running against SQL several times (with slightly different setups, but all using SQL) | 14:16 |
| stevemar | back in an hour or two | 14:17 |
| dstanek | samueldmq: maybe. the issue right now is that we subclass all the tests and run them against different setups. i want to fix this over time, incrementally | 14:17 |
| rodrigods | knikolla, i have a review that does that, just a sec | 14:17 |
| breton_ | rderose_: yep | 14:17 |
| ayoung | WHy do we not have a simple CLI for actually seeing the auth data in the token? | 14:17 |
| dstanek | we are running the same tests over and over again in there | 14:17 |
| ayoung | Its like this #1 thing needed for debugging auth problems | 14:17 |
| samueldmq | dstanek: ++ | 14:17 |
| breton_ | ayoung: because nobody wrote it | 14:17 |
| knikolla | rodrigods: the tempest.conf can be templated from the env vars, a simple script with sed should work | 14:17 |
| samueldmq | dstanek: while we just need to run specific subsets when the setup change | 14:18 |
| ayoung | breton_, used to be in the debug output. Someone hid it. | 14:18 |
| rodrigods | knikolla, sure, i mean, devstack already have something that does that | 14:18 |
| dstanek | samueldmq: something like that | 14:18 |
| knikolla | rodrigods: i asked because the devstack plugin registeres the identity provider after setting up shibboleth. | 14:18 |
| lbragstad | dstanek how come subclassing the tests and running them with different tests is an issue? | 14:18 |
| rodrigods | knikolla, https://review.openstack.org/#/c/293497/6/lib/tempest | 14:18 |
| patchbot | rodrigods: patch 293497 - openstack-dev/devstack - Tempest: add a Keystone reseller feature flag | 14:18 |
| lbragstad | running them with different setups* | 14:18 |
| rodrigods | knikolla, think it should be created/removed by the test | 14:18 |
| samueldmq | dstanek: ok, given we will keep improving that .. I am fine with running that test (again) for that setup :) | 14:18 |
| *** nisha_ has quit IRC | 14:19 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Line removed, tests pass https://review.openstack.org/335061 | 14:19 |
| samueldmq | lbragstad: you fine with that patch right ? | 14:19 |
| dstanek | lbragstad: the issue is that the same tests run multiple times when the setup is not meaningful to them | 14:19 |
| samueldmq | exactly | 14:19 |
| lbragstad | dstanek but we do that kind of stuff with all the token providers | 14:20 |
| rodrigods | knikolla, we might want more elaborated scenarios, so depending on the setup made by the "devstack plugin" can be tricky | 14:20 |
| knikolla | rodrigods: so the devstack plugin should handle only shibboleth and dependencies? i can make that configurable | 14:20 |
| dstanek | lbragstad: if we are then it's likely useless, but i'd have to look deeper to see the value | 14:20 |
| knikolla | rodrigods: if SKIP_REGISTRATION (or something), don't register, just do shibboleth | 14:20 |
| rodrigods | knikolla, i think so, as minimum as possible so the rest is done by the test setup | 14:20 |
| dstanek | lbragstad: a lot of this is case-by-case | 14:20 |
| lbragstad | dstanek for example, we have a class with all of our token api behavior then we inherit that test class and run it against uuid, pki, pkiz, fernet... | 14:21 |
| knikolla | rodrigods: i'm ok with that. will work on it. | 14:21 |
| samueldmq | dstanek: agreed, I think for token providers it makes more sense | 14:21 |
| dstanek | lbragstad: that is fine | 14:21 |
| samueldmq | lbragstad: that's right | 14:21 |
| *** gagehugo has joined #openstack-keystone | 14:21 | |
| lbragstad | dstanek it sounded like you were against that pattern? | 14:21 |
| rodrigods | knikolla, cool, some more elaborated scenarios can be: create/delete idp and try to use the token of it - so depending on the environment is not ideal | 14:21 |
| dstanek | lbragstad: in this case we have a class that has all identity, assignment and resource tests cases together and runs them over and over | 14:21 |
| knikolla | rodrigods: right, yeah. that makes complete sense. | 14:22 |
| dstanek | lbragstad: if the setup doesn't change how we expect the tests to work then it may not be worth keeping them | 14:22 |
| lbragstad | dstanek ah - so the setup is the same? | 14:22 |
| samueldmq | lbragstad: issue there is that, let's say we have a test that runs against project SQL, then we run it with keystone using only sql, identity LDAP and resource backend SQL, and so on | 14:23 |
| *** ravelar159 has joined #openstack-keystone | 14:23 | |
| dstanek | lbragstad: yes. we setup identity in different ways, so we don't always have to run the resource tests, for instance | 14:23 |
| samueldmq | but that's all the same for that test's purpose: resoruce sql | 14:23 |
| bknudson_ | we are running a lot of backend tests 6 times which is useless. | 14:23 |
| lbragstad | got it | 14:24 |
| lbragstad | ok - i'm good with that then | 14:24 |
| bknudson_ | I started working on it a little with https://review.openstack.org/#/c/283822/ | 14:24 |
| patchbot | bknudson_: patch 283822 - keystone - Move resource manager tests out of test_backend | 14:24 |
| bknudson_ | but haven't had time to finish it up | 14:24 |
| dstanek | lbragstad: samueldmq: i have one more stash related to that module that i want to get out of my stash list | 14:25 |
| samueldmq | bknudson_: nice, I remember to have split test_v3_identity, which was huge | 14:25 |
| dstanek | bknudson_: i've been doing some similar work. was able to cut the runtime of test_backend_ldap in half | 14:25 |
| samueldmq | bknudson_: but there is also a need to split test_backend | 14:25 |
| lbragstad | samueldmq stevemar so I will go ahead and get dstanek's first patch geting | 14:25 |
| lbragstad | gating* | 14:25 |
| bknudson_ | the test time has gotten too long. | 14:26 |
| lbragstad | samueldmq dstanek this one https://review.openstack.org/#/c/334061/4 | 14:26 |
| patchbot | lbragstad: patch 334061 - keystone - Group test_backend_ldap skips for readability | 14:26 |
| bknudson_ | but then I'm running the opportunistic sql tests. | 14:26 |
| samueldmq | lbragstad: sure, just +2ed | 14:26 |
| *** M00nr41n has joined #openstack-keystone | 14:27 | |
| openstackgerrit | Andreas Jaeger proposed openstack/python-keystoneclient: List system dependencies for running common tests https://review.openstack.org/334886 | 14:29 |
| *** tonytan4ever has joined #openstack-keystone | 14:30 | |
| dstanek | bknudson_: my goal was to get my local full test runtimes down about 50%. i was able to get it down 40% so far. just have to submit the rest of the stashed changes | 14:32 |
| *** darosale has joined #openstack-keystone | 14:32 | |
| *** nisha_ has joined #openstack-keystone | 14:33 | |
| *** ravelar159 has quit IRC | 14:35 | |
| *** jamielennox has joined #openstack-keystone | 14:36 | |
| *** ChanServ sets mode: +v jamielennox | 14:36 | |
| *** aloga_ has joined #openstack-keystone | 14:36 | |
| *** aloga_ has quit IRC | 14:36 | |
| bknudson_ | dstanek: how did you get the runtime down? | 14:36 |
| ayoung | I really want to gut the LDAP code | 14:37 |
| *** ravelar159 has joined #openstack-keystone | 14:37 | |
| bknudson_ | we should push to having the web server handle the LDAP. | 14:38 |
| bknudson_ | this is what people are using already so it has to work. | 14:38 |
| *** links has quit IRC | 14:38 | |
| *** diazjf has joined #openstack-keystone | 14:38 | |
| *** aloga_ has joined #openstack-keystone | 14:39 | |
| ayoung | bknudson_, looked in to it | 14:40 |
| *** nkinder has joined #openstack-keystone | 14:40 | |
| ayoung | the mod_auth_ldap code is too static | 14:40 |
| ayoung | it is just "yes or no" for a given URL | 14:40 |
| *** diazjf1 has joined #openstack-keystone | 14:40 | |
| ayoung | need mod_lookup_identity for the way we need | 14:40 |
| bknudson_ | right, for the v3/auth/tokens URL | 14:40 |
| ayoung | but that is SSSD based | 14:40 |
| *** EinstCrazy has quit IRC | 14:40 | |
| ayoung | bknudson_, it does not pass through the groups | 14:41 |
| ayoung | mod_auth_ldap does not pass through the groups | 14:41 |
| ayoung | its why we ended up writing mod_lookup_id | 14:41 |
| bknudson_ | oh... that would cause problems for us. | 14:41 |
| bknudson_ | so apache auth handlers can pass groups, but the ldap one doesn't? | 14:41 |
| ayoung | bknudson_, mod_lookup_identity and mod_authn_saml pass groups. X509 Client cert passes generic attributes, which can work as groups. mod_auth_sql and mod_authLdap do the group mathcing in the apache layer, but do not pass them on | 14:42 |
| bknudson_ | weird | 14:43 |
| ayoung | bknudson_, https://www.freeipa.org/page/Environment_Variables is a pretty good overview of what provides what | 14:43 |
| *** ravelar159 has quit IRC | 14:43 | |
| *** diazjf has quit IRC | 14:43 | |
| ayoung | https://www.freeipa.org/page/Environment_Variables#LDAP_authentication is the LDAP constraints | 14:43 |
| ayoung | Hmmmm | 14:44 |
| ayoung | "Attributes can be specified in the AuthLDAPURL value such that those values are set as environment variables of the form "AUTHENTICATE_", so any arbitrary list of values may be provided. " | 14:44 |
| ayoung | bknudson_, that sounds promising | 14:44 |
| *** ravelar159 has joined #openstack-keystone | 14:44 | |
| ayoung | we could do a mapping like we do for X509 tokenless. | 14:45 |
| ayoung | instead of REMOTE_GROUPS we would get AUTHENTICATE_GROUPS but it should work | 14:45 |
| *** KevinE has joined #openstack-keystone | 14:46 | |
| *** timcline has quit IRC | 14:46 | |
| *** timcline has joined #openstack-keystone | 14:47 | |
| *** slberger has joined #openstack-keystone | 14:48 | |
| bknudson_ | "Although RFC 2255 allows a comma-separated list of attributes, only the first attribute will be used, no matter how many are provided. If no attributes are provided, the default is to use uid. It's a good idea to choose an attribute that will be unique across all entries in the subtree you will be using. All attributes listed will be put into the environment with an AUTHENTICATE_ prefix for use by other modules." | 14:48 |
| bknudson_ | So I guess you could specify multiple attributes and only the first would be used but they'd all go into AUTHENTICATE_ vars | 14:48 |
| *** EinstCrazy has joined #openstack-keystone | 14:48 | |
| lbragstad | ravelar159 o/ | 14:48 |
| *** krotscheck_dcm is now known as krotscheck | 14:48 | |
| bknudson_ | Not sure that you could put "groups" in there | 14:49 |
| bknudson_ | maybe another attribute that can be mapped to groups like dept or something. | 14:49 |
| ayoung | groups use show up in an attributes "assigned_groups" | 14:50 |
| ayoung | bknudson_, I'm not certain mod_authz_ldap is maintained anymore, either | 14:51 |
| ayoung | docs I found are Centos 5 | 14:51 |
| *** timcline has quit IRC | 14:51 | |
| ayoung | ah, not it merged main | 14:51 |
| ayoung | https://httpd.apache.org/docs/2.4/mod/mod_authnz_ldap.html | 14:51 |
| bknudson_ | that's what I was looking at | 14:51 |
| ayoung | bknudson_, yeah, I was confusing myself. I was initially looking at the 2.0 docs, but the URL is different | 14:53 |
| bknudson_ | mod_auth_ldap (without the nz) went to old docs | 14:53 |
| ayoung | bknudson_, so, this whole mess drove the approach in our group. Its why we use SSSD for everything | 14:54 |
| ayoung | it means you don't need to configure this for each individual service. | 14:54 |
| *** EinstCrazy has quit IRC | 14:54 | |
| dstanek | rderose_: can you ping me when your push that patch with the added test? | 14:55 |
| *** EinstCrazy has joined #openstack-keystone | 14:55 | |
| *** timcline has joined #openstack-keystone | 14:55 | |
| rderose_ | dstanek: sure | 14:55 |
| *** dan_nguyen has joined #openstack-keystone | 14:58 | |
| dstanek | bknudson_: what's the point of this test? http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/test_backend_ldap.py#n930 | 14:58 |
| dstanek | bknudson_: later that test is skipped in a different setup saying that it only works with fakeldap | 14:58 |
| *** ravelar159 has quit IRC | 14:59 | |
| bknudson_ | good question... I don't remember off the top of my head what that was about. Maybe checking that DN handling code works. | 15:02 |
| *** itisha has joined #openstack-keystone | 15:02 | |
| *** slberger1 has joined #openstack-keystone | 15:04 | |
| *** slberger has quit IRC | 15:04 | |
| *** nkinder has quit IRC | 15:07 | |
| dstanek | bknudson_: i'll leave that one in the stash for now then :-) | 15:08 |
| *** M00nr41n has quit IRC | 15:08 | |
| *** M00nr41n has joined #openstack-keystone | 15:10 | |
| *** diazjf1 has quit IRC | 15:12 | |
| *** jistr is now known as jistr|mtg | 15:13 | |
| *** M00nr41n has quit IRC | 15:14 | |
| *** M00nr41n has joined #openstack-keystone | 15:20 | |
| *** fawadkhaliq has joined #openstack-keystone | 15:20 | |
| *** M00nr41n has quit IRC | 15:24 | |
| *** fawadkhaliq has quit IRC | 15:25 | |
| shewless | dstanek: only 1 thing remains I think. Right now my idp admin is sharing the "UPN" which is username@email.com. Is there a way to strip off the @email.com part in the mapping? Keystone barfs on the @ sign. | 15:26 |
| *** M00nr41n has joined #openstack-keystone | 15:29 | |
| *** jsavak has quit IRC | 15:30 | |
| *** belmoreira has quit IRC | 15:31 | |
| dstanek | i need some naming help... i created an alternative method for skipTest and called it skip_test_in_subclass. this method makes sure that if you are explicity skipping a test because it won't work in a subclass that the method actually exists | 15:32 |
| *** danpawlik has quit IRC | 15:32 | |
| dstanek | this is because the ldap backend tests were skipping stuff that had long since been removed | 15:32 |
| dstanek | so...what is the right name for this? | 15:32 |
| *** jistr|mtg is now known as jistr | 15:32 | |
| *** slberger1 has quit IRC | 15:35 | |
| *** TxGVNN has quit IRC | 15:36 | |
| bknudson_ | in Java you can mark a method with @overrides , so might want to pick that | 15:38 |
| *** jsavak has joined #openstack-keystone | 15:38 | |
| bknudson_ | skip_test_overrides ? | 15:38 |
| *** slberger has joined #openstack-keystone | 15:38 | |
| *** alex_xu has quit IRC | 15:40 | |
| *** darosale has quit IRC | 15:41 | |
| *** dmk0202 has quit IRC | 15:42 | |
| *** SamYaple has joined #openstack-keystone | 15:42 | |
| openstackgerrit | Merged openstack/keystone: Group test_backend_ldap skips for readability https://review.openstack.org/334061 | 15:43 |
| *** alex_xu has joined #openstack-keystone | 15:44 | |
| *** diazjf has joined #openstack-keystone | 15:45 | |
| *** nisha__ has joined #openstack-keystone | 15:46 | |
| *** diazjf has quit IRC | 15:47 | |
| *** diazjf has joined #openstack-keystone | 15:47 | |
| *** browne has joined #openstack-keystone | 15:49 | |
| *** ddieterly is now known as ddieterly[away] | 15:49 | |
| *** pnavarro has quit IRC | 15:49 | |
| dstanek | bknudson_: i'd be fine with that | 15:50 |
| *** nisha_ has quit IRC | 15:50 | |
| *** darosale has joined #openstack-keystone | 15:53 | |
| *** sdake_ has joined #openstack-keystone | 15:54 | |
| *** tesseract- has quit IRC | 15:56 | |
| *** sdake has quit IRC | 15:57 | |
| *** daemontool_ has joined #openstack-keystone | 16:00 | |
| *** ddieterly[away] is now known as ddieterly | 16:02 | |
| *** aloga_ has quit IRC | 16:03 | |
| *** dan_nguyen has quit IRC | 16:03 | |
| *** daemontool has quit IRC | 16:03 | |
| *** nisha__ is now known as nisha_ | 16:05 | |
| *** gyee has joined #openstack-keystone | 16:17 | |
| *** ChanServ sets mode: +v gyee | 16:17 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add role functional tests https://review.openstack.org/335118 | 16:21 |
| nisha_ | samueldmq, please have a look when you get time ^ | 16:24 |
| *** timcline has quit IRC | 16:24 | |
| *** timcline has joined #openstack-keystone | 16:25 | |
| *** nisha_ has quit IRC | 16:28 | |
| *** timcline has quit IRC | 16:29 | |
| *** nisha_ has joined #openstack-keystone | 16:29 | |
| *** EinstCrazy has quit IRC | 16:32 | |
| *** zqfan has quit IRC | 16:33 | |
| *** daemontool_ has quit IRC | 16:35 | |
| *** bjornar_ has quit IRC | 16:36 | |
| *** nisha_ has quit IRC | 16:37 | |
| *** tonytan4ever has quit IRC | 16:39 | |
| *** permalac has joined #openstack-keystone | 16:43 | |
| *** permalac_ has quit IRC | 16:45 | |
| *** dulek has quit IRC | 16:49 | |
| *** pcaruana has quit IRC | 16:49 | |
| *** rcernin has quit IRC | 16:51 | |
| *** timcline has joined #openstack-keystone | 16:52 | |
| *** dan_nguyen has joined #openstack-keystone | 16:53 | |
| *** jed56 has quit IRC | 16:55 | |
| *** tonytan4ever has joined #openstack-keystone | 16:56 | |
| *** timcline has quit IRC | 16:57 | |
| *** timcline has joined #openstack-keystone | 16:57 | |
| *** tqtran has joined #openstack-keystone | 16:59 | |
| *** aloga_ has joined #openstack-keystone | 17:01 | |
| *** timcline has quit IRC | 17:01 | |
| *** gyee has quit IRC | 17:03 | |
| *** henrynash has quit IRC | 17:05 | |
| roxanaghe | bknudson_, or dolphm could you approve this stable/mitaka backport https://review.openstack.org/#/c/332956/ ? | 17:06 |
| patchbot | roxanaghe: patch 332956 - keystone (stable/mitaka) - /services?name=<name> API fails when using list_limit | 17:06 |
| roxanaghe | bknudson_, dolphm it has too many +1s and not enough +2s :) | 17:06 |
| *** fawadkhaliq has joined #openstack-keystone | 17:07 | |
| openstackgerrit | Fangzhou Xu proposed openstack/keystone: Make getting token revocation list 9x faster on Mysql https://review.openstack.org/283902 | 17:07 |
| *** fangxu has joined #openstack-keystone | 17:08 | |
| mfisch | is there some magic needed to delete an endpoint? The call tells me that the endpoint isn't found although it's clearly listed | 17:11 |
| samueldmq | mfisch: there shouldn't be | 17:12 |
| samueldmq | mfisch: trying to delete gives you an error ? | 17:12 |
| shewless | Hello.. I've got SSO working.. I'm wondering if there is a way to skip the horizon landing page.. the one that allows you to click "connect" | 17:12 |
| mfisch | openstack endpoint show 775fa420984048beb30b264a5b2c158d works | 17:12 |
| mfisch | openstack endpoint delete 775fa420984048beb30b264a5b2c158d | 17:12 |
| mfisch | Could not find endpoint: 775fa420984048beb30b264a5b2c158d (HTTP 404) (Request-ID: req-5f251426-18c6-4eb1-9293-5789123db828) | 17:13 |
| mfisch | nothing much in the lgos | 17:13 |
| mfisch | logs | 17:13 |
| shewless | that would be good.. in local_settings.py I see SSO_CHOICES but the comment says to leave "local credentials" | 17:13 |
| samueldmq | mfisch: it may be a bug in the endpoint_api cache (perhaps that endpoint is still cached ?) | 17:13 |
| *** aloga_ has quit IRC | 17:13 | |
| samueldmq | mfisch: or is it giving 404 from the very first time you run delete ? | 17:14 |
| *** diazjf has quit IRC | 17:14 | |
| mfisch | its still in the db | 17:14 |
| mfisch | colleague did the first delete but I think it failed too | 17:14 |
| mfisch | and its still in the db like I mentioned | 17:14 |
| samueldmq | mfisch: using v2 or v3 ? | 17:14 |
| dstanek | mfisch: anything in the logs? | 17:14 |
| mfisch | not much but I just quiesced the rest of the cluster to zoom in a bit, so give me a sc | 17:15 |
| mfisch | sec | 17:15 |
| mfisch | dstanek: nothing really just this " Could not find endpoint: 775fa420984048beb30b264a5b2c158d" | 17:17 |
| mfisch | let me turn on debug | 17:18 |
| samueldmq | mfisch: dstanek: looks like if the endpoint was created in v3 and is being deleted with v2 it won't work ? | 17:18 |
| samueldmq | see https://github.com/openstack/keystone/blob/master/keystone/catalog/controllers.py#L186-L199 | 17:18 |
| mfisch | oh maybe this | 17:18 |
| mfisch | Deprecated: delete_endpoint of the v2 API is deprecated as of Mitaka in favor of a similar function in the v3 API and may be removed in Q. | 17:18 |
| mfisch | thats it | 17:18 |
| mfisch | its a v3 endpoint | 17:18 |
| * mfisch shakes fist | 17:19 | |
| mfisch | thanks guys | 17:19 |
| *** ddieterly is now known as ddieterly[away] | 17:19 | |
| dstanek | samueldmq: yes, this is true | 17:19 |
| samueldmq | we got it | 17:19 |
| *** hoonetorg has quit IRC | 17:19 | |
| EmilienM | hey, I found something weird with latest openstackclient (running trunk) and keystone | 17:19 |
| EmilienM | http://logs.openstack.org/52/334852/1/check/gate-puppet-openstack-integration-3-scenario001-tempest-centos-7/014af3f/console.html#_2016-06-28_09_09_13_992128 | 17:19 |
| samueldmq | mfisch: thanks for reporting it | 17:19 |
| EmilienM | Conflict occurred attempting to store user - Duplicate Entry (HTTP 409) | 17:19 |
| samueldmq | dstanek: is this documented behavior ? (v3 endpoint can't be deleted in v2) | 17:19 |
| dstanek | samueldmq: i think so, but not sure where | 17:20 |
| mfisch | samueldmq: yeah kinda | 17:20 |
| *** timcline has joined #openstack-keystone | 17:20 | |
| mfisch | there's some weirdness with v2/v3 endpoints | 17:20 |
| *** timcline has quit IRC | 17:20 | |
| samueldmq | mfisch: ++ in the migration we create 3 v3 endpoints for 1 v2 endpoint, and the former's ID is stored as legacy_endpoint_id | 17:21 |
| *** timcline has joined #openstack-keystone | 17:21 | |
| mfisch | yep | 17:21 |
| mfisch | all mine are v3 endpoints | 17:21 |
| mfisch | in this environment anyway | 17:21 |
| samueldmq | nice | 17:22 |
| samueldmq | EmilienM: yes that's weird, looks like it's conflicting when creating a new user | 17:22 |
| samueldmq | EmilienM: perhaps unique constraints are being violated ? let me check into the code | 17:23 |
| mfisch | samueldmq: it used to be that endpoint list didnt work with v2 api and v3 endpoints, but that seems to work now | 17:23 |
| EmilienM | samueldmq: it's something in osclient probably, that merged the last 20 days | 17:23 |
| mfisch | EmilienM: can you repro with curl? | 17:23 |
| mfisch | --debug will show it | 17:23 |
| EmilienM | mfisch: it's in puppet ci | 17:23 |
| EmilienM | yeah, we can trick provider | 17:24 |
| EmilienM | oh in fact it's not idempotent | 17:24 |
| mfisch | thats no bueno | 17:25 |
| mfisch | is user list failing? | 17:25 |
| EmilienM | http://logs.openstack.org/52/334852/1/check/gate-puppet-openstack-integration-3-scenario001-tempest-centos-7/014af3f/console.html#_2016-06-28_09_06_18_093551 | 17:25 |
| EmilienM | it's failing during second puppet run | 17:25 |
| EmilienM | so openstackclient tries to create the user again while is already exist | 17:25 |
| samueldmq | maybe user creation is called twice with the pair ('domain_id', 'name') | 17:26 |
| samueldmq | that is expected to be unique | 17:26 |
| dstanek | EmilienM: the puppet module isn't idempotent? | 17:26 |
| samueldmq | EmilienM: is it always failing ? or is it intermittent ? | 17:26 |
| EmilienM | dstanek: it currently is | 17:27 |
| EmilienM | dstanek: when using openstackclient latest tag | 17:27 |
| EmilienM | but when using trunk, it's not | 17:27 |
| EmilienM | samueldmq: always. | 17:27 |
| EmilienM | samueldmq: at second puppet run | 17:27 |
| EmilienM | so when admin user already exist | 17:27 |
| EmilienM | let me dig puppet | 17:27 |
| stevemar | EmilienM: that seems correct to me | 17:27 |
| dstanek | EmilienM: openstackclient isn't idempotent | 17:27 |
| samueldmq | EmilienM: so it makes sense to be in the second run | 17:27 |
| samueldmq | EmilienM: it may be trying to recreate the user | 17:28 |
| stevemar | EmilienM: we have an argument --or-show, which makes it idempotent (kinda) | 17:28 |
| stevemar | EmilienM: where it'll return the user if a conflict is caught | 17:28 |
| *** imcsk8 has joined #openstack-keystone | 17:28 | |
| EmilienM | right, we check here https://github.com/openstack/puppet-keystone/blob/master/lib/puppet/provider/keystone_user/openstack.rb#L83 | 17:29 |
| *** jpena has joined #openstack-keystone | 17:30 | |
| *** julim has joined #openstack-keystone | 17:30 | |
| EmilienM | and https://github.com/openstack/puppet-keystone/blob/master/lib/puppet/provider/keystone.rb#L163 | 17:30 |
| EmilienM | we show openstack user show to determine if it's already here | 17:30 |
| EmilienM | but with latest osclient, it seems like it returns false so it tries to create it again | 17:31 |
| *** jsavak has quit IRC | 17:32 | |
| stevemar | EmilienM: hmm, maybe of the keystoneauth conversion? it'll toss up keystoneauth1.NotFound instead of keystoneclient.NotFound | 17:32 |
| *** jsavak has joined #openstack-keystone | 17:33 | |
| SamYaple | if i set an inherited role on a domain, will the project inherit that role as well since domains are projects in mitaka? | 17:35 |
| samueldmq | SamYaple: good question... henrynash_ ^ | 17:37 |
| *** d0ugal has quit IRC | 17:37 | |
| *** d0ugal has joined #openstack-keystone | 17:37 | |
| *** d0ugal has quit IRC | 17:37 | |
| *** d0ugal has joined #openstack-keystone | 17:37 | |
| samueldmq | SamYaple: I'd expect that if you pass domain_id when creating the inherited role, it won't be applied to the current node | 17:37 |
| EmilienM | stevemar: I wonder if https://review.openstack.org/#/c/311206/ caused our issue | 17:37 |
| patchbot | EmilienM: patch 311206 - python-openstackclient - Use resource id when name given for identity show (MERGED) | 17:37 |
| samueldmq | SamYaple: howver if you use project_id it will | 17:37 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Performance oriented functional test for HMT https://review.openstack.org/335144 | 17:38 |
| samueldmq | SamYaple: this way backwards compat is kept | 17:38 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Closure table for HMT https://review.openstack.org/285521 | 17:38 |
| stevemar | EmilienM: hmm, that only impact `os user show` | 17:39 |
| EmilienM | stevemar: yes, and we use user show to determine is whether or not user exist in our puppet catalog | 17:39 |
| EmilienM | so maybe it returns false, and puppet tries to create it and fails before user actually exist already | 17:40 |
| SamYaple | samueldmq: i think youre right. i just did a test and a user with a domain role wont allow me to get a token scoped for a project | 17:40 |
| *** fawadkhaliq has quit IRC | 17:40 | |
| samueldmq | SamYaple: cool | 17:40 |
| EmilienM | stevemar: we're investigating our puppet provider now, I'll let you know progress | 17:41 |
| EmilienM | stevemar, samueldmq: thx folks | 17:41 |
| *** d0ugal has quit IRC | 17:41 | |
| samueldmq | EmilienM: you're welcome, thanks for reporting | 17:41 |
| *** d0ugal has joined #openstack-keystone | 17:42 | |
| *** d0ugal has quit IRC | 17:42 | |
| *** d0ugal has joined #openstack-keystone | 17:42 | |
| SamYaple | I am attempting to create a policy rule that says if user has 'domainadmin' role in domain the user can list all the projects in that domain. its... not working well. | 17:43 |
| SamYaple | I have this "role:domainadmin and domain_id:%(token.domain.id)s" | 17:43 |
| SamYaple | but i think the list_projects doesnt pass target information. havent confirmed that | 17:43 |
| *** rcernin has joined #openstack-keystone | 17:45 | |
| *** mvk_ has quit IRC | 17:45 | |
| amoralej | EmilienM, jpena discovered something interesting | 17:50 |
| EmilienM | amoralej: what? | 17:50 |
| amoralej | if you do openstack user show admin it works fine | 17:50 |
| amoralej | but if you do "openstack user show admin --domain Default" it fails | 17:50 |
| EmilienM | the warning might screw our parsing up | 17:50 |
| EmilienM | oh? | 17:50 |
| EmilienM | nice | 17:50 |
| amoralej | CommandError: No user with a name or ID of '454ad1c743e24edcad846d1118837cac' exists. | 17:50 |
| EmilienM | it sounds super related to https://review.openstack.org/#/c/311206/ | 17:51 |
| patchbot | EmilienM: patch 311206 - python-openstackclient - Use resource id when name given for identity show (MERGED) | 17:51 |
| EmilienM | stevemar: hey it's us again | 17:51 |
| amoralej | and that seems to be relationed with a strange log in apache in your jobs | 17:51 |
| rodrigods | amoralej, EmilienM what is the user domain? | 17:51 |
| amoralej | ::1 - - [28/Jun/2016:09:09:11 +0000] "GET /v3/users?domain_id=default&name=cc754e6a839742c3a3d07c523f5afce1 HTTP/1.1" 200 149 "-" | 17:51 |
| amoralej | default | 17:51 |
| EmilienM | default | 17:51 |
| rodrigods | that name is incorrect | 17:52 |
| EmilienM | how's that? It worked until now | 17:52 |
| amoralej | EmilienM, let me try with a version before https://review.openstack.org/#/c/311206/ | 17:52 |
| patchbot | amoralej: patch 311206 - python-openstackclient - Use resource id when name given for identity show (MERGED) | 17:52 |
| EmilienM | amoralej: yeah or just revert the patch locally ^ | 17:53 |
| rodrigods | EmilienM, taking a look in osc code, think "user_str" is the ID, not the name | 17:53 |
| rodrigods | and it is passing the wrong argument to the utils.find_resource | 17:53 |
| *** jaugustine has joined #openstack-keystone | 17:54 | |
| amoralej | but what surprised me is that in my environment, i don't reproduce it with keystone_user resource | 17:55 |
| *** diazjf has joined #openstack-keystone | 17:57 | |
| stevemar | EmilienM: damn, that sucks | 17:58 |
| stevemar | EmilienM: keystone meeting in 2 minutes, i may not reply | 17:59 |
| EmilienM | stevemar: ack | 17:59 |
| *** jorge_munoz_ has joined #openstack-keystone | 18:00 | |
| stevemar | meeting reminder ajayaa, amakarov, ayoung, breton, browne, crinkle, claudiub, davechen, david8hu, dolphm, dstanek, edmondsw, gyee, henrynash, hogepodge, htruta, jamielennox, joesavak, jorge_munoz, knikolla, lbragstad, lhcheng, marekd, MaxPC, morgan, nkinder, notmorgan, raildo, rodrigods, rderose, roxanaghe, samleon, samueldmq, shaleh, stevemar, tjcocozz, tsymanczyk, topol, vivekd, wanghong, xek | 18:00 |
| *** jsavak has quit IRC | 18:01 | |
| amoralej | EmilienM, it's confirmed, https://review.openstack.org/#/c/311206/ broke openstack user show admin --domain Default | 18:02 |
| patchbot | amoralej: patch 311206 - python-openstackclient - Use resource id when name given for identity show (MERGED) | 18:02 |
| amoralej | but not for all users, | 18:02 |
| *** jpena is now known as jpena|off | 18:02 | |
| *** jorge_munoz has quit IRC | 18:03 | |
| *** jorge_munoz_ is now known as jorge_munoz | 18:03 | |
| *** gyee has joined #openstack-keystone | 18:08 | |
| *** ChanServ sets mode: +v gyee | 18:08 | |
| *** henrynash has joined #openstack-keystone | 18:09 | |
| *** ChanServ sets mode: +v henrynash | 18:09 | |
| *** bjornar_ has joined #openstack-keystone | 18:09 | |
| *** ddieterly[away] is now known as ddieterly | 18:11 | |
| *** real56 has quit IRC | 18:14 | |
| *** ddieterly is now known as ddieterly[away] | 18:15 | |
| *** dan_nguyen has quit IRC | 18:18 | |
| *** jsavak has joined #openstack-keystone | 18:20 | |
| *** mvk_ has joined #openstack-keystone | 18:20 | |
| *** pcaruana has joined #openstack-keystone | 18:25 | |
| *** mvk_ has quit IRC | 18:26 | |
| raildo | jamielennox: hey :) about our v2-v3 stuffs, I was thinking in send an email to the operators list, to ask if Otaca is a good deadline. what do you think? | 18:28 |
| jamielennox | raildo: damn i still haven't written that :) umm, i don't think that operators are out target - mostly who we're interested here are developers because we want to move the gate forward | 18:29 |
| jamielennox | we're not going to be able to actually deprecate v3 for a while | 18:29 |
| raildo | jamielennox: sure | 18:29 |
| jamielennox | at the moment the plan is just to move the gate forward | 18:29 |
| *** PsionTheory has joined #openstack-keystone | 18:29 | |
| raildo | jamielennox: so, everything that you need, just ping me :D | 18:30 |
| raildo | jamielennox: I updated the etherpad https://etherpad.openstack.org/p/v3-only-devstack | 18:31 |
| raildo | jamielennox: we only have a few jobs to fix/test right now | 18:31 |
| *** rderose has joined #openstack-keystone | 18:33 | |
| *** rderose_ has quit IRC | 18:34 | |
| *** pauloewerton has quit IRC | 18:37 | |
| *** ddieterly[away] is now known as ddieterly | 18:37 | |
| *** ravelar159 has joined #openstack-keystone | 18:39 | |
| *** PsionTheory has quit IRC | 18:39 | |
| *** pauloewerton has joined #openstack-keystone | 18:41 | |
| *** amoralej is now known as amoralej|lunch | 18:42 | |
| *** amoralej|lunch is now known as amoralej|off | 18:43 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Use request.params instead of context['query_string'] https://review.openstack.org/330822 | 18:47 |
| lbragstad | ravelar159 are you in #osic ? | 18:48 |
| ayoung | gyee, https://copr.fedorainfracloud.org/coprs/admiyo/ | 18:49 |
| gyee | ayoung, good! we need to figure out getting it into devstack | 18:49 |
| *** mvk has joined #openstack-keystone | 18:49 | |
| ayoung | gyee, ++ | 18:50 |
| ayoung | gyee, and Tripleo, I think | 18:50 |
| gyee | indeed | 18:51 |
| ayoung | gyee, so, yeah, first up is adding Anchor to devstack, and I think we do it in the core repo. | 18:51 |
| *** mvk has quit IRC | 18:52 | |
| gyee | ayoung, yeah, that part should be pretty trivial | 18:52 |
| gyee | I just need to find some time to do it | 18:52 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Migrate identity /v2-ext docs from api-ref repo https://review.openstack.org/322301 | 18:52 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Migrate identity /v2 docs from api-ref repo https://review.openstack.org/322173 | 18:52 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Migrate identity /v2-admin docs from api-ref repo https://review.openstack.org/322247 | 18:53 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Migrate identity /v2-ext docs from api-ref repo https://review.openstack.org/322301 | 18:53 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Migrate identity /v3-ext docs from api-ref repo https://review.openstack.org/322131 | 18:53 |
| *** sheel has quit IRC | 18:55 | |
| *** fifieldt has quit IRC | 19:01 | |
| ayoung | notmorgan, I'd like troubleshooting to be less formal than Gerrit reviews, and more open to Operator contribs | 19:01 |
| stevemar | notmorgan: hmm, i like the idea of a repo to hold everything... install guides, faq, moved blogs | 19:01 |
| notmorgan | so ayoung i've long thought we should have people who make cool blog posts also propose officially docs (if they are like a howto) for federation | 19:01 |
| notmorgan | ayoung: so we don't need to do the search always for "who wrote this when" | 19:02 |
| notmorgan | i see the troubleshooting guide being exactly in that category | 19:02 |
| *** henrynash has quit IRC | 19:02 | |
| ayoung | notmorgan, is this a dagger I se before me? | 19:02 |
| ayoung | heh | 19:02 |
| *** sdake has joined #openstack-keystone | 19:02 | |
| *** sdake_ has quit IRC | 19:03 | |
| ayoung | I kindof want it to be like the Ask openstack site | 19:03 |
| notmorgan | ayoung: :) i would start with the troubleshooting doc here. adding a repo and publishing isn't terrifying. | 19:03 |
| ayoung | https://ask.openstack.org/en/questions/ but with more like Stack overflow operations | 19:03 |
| notmorgan | ayoung: contribute more to ask.openstack? | 19:03 |
| ayoung | notmorgan, I do all the time.. but It seems to lack organization | 19:03 |
| jamielennox | ayoung: maybe we can get an anonymous ask.o.o account and just feed you the softball questions | 19:03 |
| ayoung | we have a keystone tag | 19:03 |
| notmorgan | jamielennox: lol | 19:04 |
| ayoung | we need more structure than that | 19:04 |
| notmorgan | so stack overflow isn't exactly organised.. | 19:04 |
| ayoung | jamielennox, hell, I want to post all the questions I get in PM IRC and email | 19:04 |
| ayoung | notmorgan, agreed | 19:04 |
| ayoung | notmorgan, its really a wiki I want | 19:04 |
| ayoung | cross linking | 19:04 |
| ayoung | have a troubleshooting page with a list of quesitons | 19:04 |
| ayoung | click on the link that is closest... | 19:05 |
| *** aloga_ has joined #openstack-keystone | 19:05 | |
| notmorgan | so i think if we want an official doc, we should just get it in a repo - wikis have... well look at wiki.o.o conversations | 19:05 |
| jamielennox | so whilst that was a joke, i think in future when you help someone you should make them post it to ask.o.o and help them there so it can be referred to next time | 19:05 |
| notmorgan | and the spam issues. | 19:05 |
| ayoung | notmorgan, I don't want an official doc so much as I want a living doc | 19:05 |
| * jamielennox goes back to bed | 19:05 | |
| notmorgan | ayoung: openstack has issues with spammers at this point since we page-rank well. it has to have some level of control - or just be ask.o.o | 19:06 |
| lbragstad | jamielennox o/ | 19:06 |
| ayoung | every try to search ask.o.o? | 19:06 |
| ayoung | searc h the Keystone tag and I get 1,141 questions | 19:07 |
| *** spzala has quit IRC | 19:07 | |
| ayoung | notmorgan, is that why the wiki is shut down? | 19:07 |
| notmorgan | i think you're going to find the troubleshooting doc in a repo is going to b the easiest | 19:07 |
| *** spzala has joined #openstack-keystone | 19:07 | |
| notmorgan | ayoung: it isn't shutdown, it is locked down a lot more, no new accounts, weird captcha questions, and still getting spam | 19:07 |
| ayoung | notmorgan, that is what I meant...the no-new-accounts | 19:08 |
| notmorgan | yep | 19:08 |
| notmorgan | we have had massive spam issues, 1000s of pages a day | 19:08 |
| notmorgan | etc | 19:08 |
| ayoung | What is the platform for Ask.o.o? | 19:08 |
| notmorgan | some custom code [php] i think. | 19:08 |
| notmorgan | it's iirc managed by the foundation. | 19:09 |
| *** amakarov is now known as amakarov_away | 19:09 | |
| notmorgan | maybe it's askbot? | 19:10 |
| notmorgan | https://github.com/ASKBOT | 19:10 |
| notmorgan | http://askbot.org/en/questions/ | 19:11 |
| *** aloga_ has quit IRC | 19:12 | |
| *** spzala has quit IRC | 19:12 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Concrete role assignments for federated users https://review.openstack.org/284943 | 19:13 |
| ayoung | Heh...lots of unanswered questions there, too | 19:13 |
| rderose | stevemar rodrigods dstanek: added a test to test for domain duplicates ^ | 19:14 |
| rodrigods | rderose, awesome, will take a look back tonight | 19:14 |
| rderose | rodrigods: cool, thx | 19:15 |
| *** tonytan4ever has quit IRC | 19:15 | |
| *** fifieldt has joined #openstack-keystone | 19:16 | |
| *** sdake_ has joined #openstack-keystone | 19:16 | |
| *** sdake has quit IRC | 19:20 | |
| *** dan_nguyen has joined #openstack-keystone | 19:21 | |
| stevemar | ayoung: i think putting it in keystone proper right now is easiest | 19:23 |
| *** tonytan4ever has joined #openstack-keystone | 19:24 | |
| *** gyee has quit IRC | 19:25 | |
| ayoung | stevemar, maybe | 19:28 |
| ayoung | stevemar, depends on if it should be part of a larger openstack troubleshooting effort | 19:28 |
| stevemar | ayoung: it's easy enough to put a redirect in our docs if we move to a larger repo | 19:28 |
| ayoung | so many things start with "keystone is broken" and it ends up being a config to talk to keystone that is broken | 19:29 |
| ayoung | stevemar, how do people submit new questions | 19:29 |
| ayoung | its the wrong place. | 19:29 |
| ayoung | its keystone server, client, middleware, cli, horizon | 19:29 |
| ayoung | but...I'll chew on it. | 19:30 |
| *** ayoung has quit IRC | 19:35 | |
| *** raddaoui has quit IRC | 19:37 | |
| *** aloga_ has joined #openstack-keystone | 19:38 | |
| *** ametts has quit IRC | 19:40 | |
| stevemar | samueldmq: any link to the patch on making the api-ref use keystone instead of openstack-manuals? | 19:42 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 19:45 |
| *** hoonetorg has joined #openstack-keystone | 19:54 | |
| EmilienM | stevemar: I have to leave now but we found out that https://review.openstack.org/#/c/311206 was the root cause | 19:56 |
| *** ametts has joined #openstack-keystone | 19:56 | |
| EmilienM | it causes issue when user show with a default domain it returns 1 | 19:56 |
| *** bjornar_ has quit IRC | 19:57 | |
| EmilienM | I need to leave now but I'll give details later, feel free to look if you see something wrong | 19:57 |
| * EmilienM afk | 19:57 | |
| stevemar | EmilienM: ack | 19:57 |
| stevemar | also leaving for a few | 19:57 |
| openstackgerrit | Joao Targino proposed openstack/python-keystoneclient: Update README to comply with Identity V3 https://review.openstack.org/335210 | 20:00 |
| *** ddieterly is now known as ddieterly[away] | 20:00 | |
| *** jsavak has quit IRC | 20:01 | |
| *** jsavak has joined #openstack-keystone | 20:02 | |
| *** ntpttr has joined #openstack-keystone | 20:02 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Use extras for oslo.messaging dependency https://review.openstack.org/274400 | 20:02 |
| *** jaugustine has quit IRC | 20:04 | |
| *** jorge_munoz has quit IRC | 20:04 | |
| *** slberger1 has joined #openstack-keystone | 20:04 | |
| *** spzala has joined #openstack-keystone | 20:05 | |
| *** jorge_munoz has joined #openstack-keystone | 20:05 | |
| *** slberger has quit IRC | 20:05 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Line removed, tests pass https://review.openstack.org/335061 | 20:06 |
| *** ravelar159 has quit IRC | 20:08 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Update README to comply with Identity V3 https://review.openstack.org/335210 | 20:08 |
| *** ddieterly[away] is now known as ddieterly | 20:24 | |
| *** ayoung has joined #openstack-keystone | 20:29 | |
| *** ChanServ sets mode: +v ayoung | 20:29 | |
| *** jorge_munoz_ has joined #openstack-keystone | 20:32 | |
| *** jorge_munoz has quit IRC | 20:32 | |
| *** jorge_munoz_ is now known as jorge_munoz | 20:32 | |
| *** lucas___ has joined #openstack-keystone | 20:36 | |
| *** jbell8 has joined #openstack-keystone | 20:36 | |
| *** gyee has joined #openstack-keystone | 20:39 | |
| *** ChanServ sets mode: +v gyee | 20:39 | |
| *** ddieterly is now known as ddieterly[away] | 20:40 | |
| *** ddieterly[away] is now known as ddieterly | 20:40 | |
| mfisch | lbragstad: FYI from my tester: https://bugs.launchpad.net/keystone/+bug/1597077 | 20:45 |
| openstack | Launchpad bug 1597077 in OpenStack Identity (keystone) "Mitaka token 'expires' padding differs between POST and GET/HEAD on Fernet tokens" [Undecided,New] | 20:45 |
| mfisch | thats minor I believe | 20:45 |
| bknudson_ | Probably fixed with https://review.openstack.org/#/c/332493/ | 20:46 |
| patchbot | bknudson_: patch 332493 - keystone - Correct use of isotime | 20:46 |
| lbragstad | bknudson_ oh - good point | 20:47 |
| *** ametts has quit IRC | 20:49 | |
| *** slberger1 has quit IRC | 20:49 | |
| *** samueldmq has quit IRC | 20:51 | |
| *** samueldmq has joined #openstack-keystone | 20:52 | |
| *** ChanServ sets mode: +v samueldmq | 20:52 | |
| *** lucas___ has quit IRC | 21:01 | |
| *** sdake has joined #openstack-keystone | 21:01 | |
| *** rderose has quit IRC | 21:02 | |
| *** slberger has joined #openstack-keystone | 21:03 | |
| *** jsavak has quit IRC | 21:03 | |
| *** jsavak has joined #openstack-keystone | 21:04 | |
| *** sdake_ has quit IRC | 21:04 | |
| *** lucas___ has joined #openstack-keystone | 21:04 | |
| *** lucas___ has quit IRC | 21:06 | |
| *** lucas____ has joined #openstack-keystone | 21:06 | |
| *** lucas____ has quit IRC | 21:10 | |
| *** dmk0202 has joined #openstack-keystone | 21:11 | |
| *** vgridnev_ has joined #openstack-keystone | 21:12 | |
| *** lucas___ has joined #openstack-keystone | 21:17 | |
| *** harlowja has quit IRC | 21:19 | |
| *** chrisshattuck has joined #openstack-keystone | 21:22 | |
| *** lucas___ has quit IRC | 21:22 | |
| ayoung | notmorgan, stevemar http://docs.openstack.org/developer/keystone/ is generated from git keystone/docs. Right? How often? | 21:22 |
| notmorgan | ayoung: uhm. | 21:23 |
| notmorgan | ayoung: every commit | 21:24 |
| ayoung | When,...did we split config out? I totally missed that | 21:25 |
| ayoung | I like, but it means I have a lot of dead links... | 21:25 |
| *** gagehugo has quit IRC | 21:26 | |
| notmorgan | ayoung: hmm? into docs? | 21:26 |
| notmorgan | ayoung: earlier this cycle. | 21:26 |
| ayoung | notmorgan, yeah...could not hae been that long ago | 21:27 |
| notmorgan | ayoung: next step is to delete the sample config from the git repo | 21:27 |
| notmorgan | since it's pretty much out of date now/not maintained | 21:27 |
| *** ravelar159 has joined #openstack-keystone | 21:28 | |
| *** samueldmq has quit IRC | 21:29 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove the sample config from the git tree https://review.openstack.org/335236 | 21:29 |
| *** ddieterly is now known as ddieterly[away] | 21:31 | |
| *** ravelar_159 has joined #openstack-keystone | 21:32 | |
| *** fangxu has quit IRC | 21:32 | |
| *** ravelar159 has quit IRC | 21:35 | |
| *** pauloewerton has quit IRC | 21:36 | |
| *** ravelar_159 has quit IRC | 21:37 | |
| *** jsavak has quit IRC | 21:38 | |
| *** fangxu has joined #openstack-keystone | 21:39 | |
| *** sdake has quit IRC | 21:39 | |
| *** dmk0202 has quit IRC | 21:42 | |
| *** jsavak has joined #openstack-keystone | 21:47 | |
| ntpttr | ayoung: hey, I see your name in this code so maybe you can help me answer this :). Is there a way to tell if a project is 'admin project' when you just get the project object itself, or is that info just stored in the token here? https://github.com/openstack/keystone/blob/d9c6b50a3ae514e640fa13a344e59fe3649ee0ef/keystone/token/providers/common.py#L269-L285 | 21:49 |
| *** itisha has quit IRC | 21:50 | |
| *** aloga_ has quit IRC | 21:50 | |
| ayoung | ntpttr, it is majik | 21:51 |
| ayoung | ntpttr, what version of Keystone are you running? | 21:51 |
| ntpttr | ayoung: 3 - I'm trying to work out this bug in cinder hierarchical quota showing https://bugs.launchpad.net/cinder/+bug/1597045 | 21:51 |
| openstack | Launchpad bug 1597045 in Cinder "Admin cannot show/set quotas in projects where they are not a member or in hierarchy" [Undecided,New] - Assigned to Nate Potter (ntpttr) | 21:51 |
| ntpttr | ayoung: basically I think we want the 'admin' project for a domain to be able to view and set quotas for all the users in that domain, but right now that's not what's happening | 21:52 |
| ntpttr | so if there was an easy way to tell if a project was the admin project, that would probably be a good way to fix that. Right now it's checking to see if the target project is in the subtree of the context project, but the admin project doesn't always have all the other projects in a domain in its subtree | 21:53 |
| ntpttr | I'm not too familiar w/ keystone, so this is blowing my mind a bit :) | 21:53 |
| *** darosale has quit IRC | 21:54 | |
| ayoung | ntpttr, 3 is a keystona API version. Which version of the Keystone server are you running with? Master? Mitaka? | 21:54 |
| ntpttr | ayoung: I'm using a fresh devstack, does that default to 2 or 3? The person who reported the bug is running mitaka I believe | 21:55 |
| ntpttr | oops I understand your question, it's master | 21:55 |
| ayoung | ntpttr, OK. every keystone server has v2 and a v3 api support | 21:55 |
| ayoung | from Cinder's perspective, I think the question might be this: | 21:56 |
| *** jbell8 has quit IRC | 21:56 | |
| ayoung | "certain tokens are supposed to be used by administrators to fix things across all of cinder. When we get one of those, itt might not match the project for the quota. How do we tell?" | 21:57 |
| *** ddieterly[away] is now known as ddieterly | 21:57 | |
| ayoung | ntpttr, ah....more than that, now that I read the bug report | 21:58 |
| *** spzala has quit IRC | 21:58 | |
| ayoung | ntpttr, where did you see my name in the code, out of curiousity? I wasn't doing the hierarchical stuff...but... | 21:58 |
| *** spzala has joined #openstack-keystone | 21:58 | |
| *** vgridnev_ has quit IRC | 21:59 | |
| ayoung | ntpttr, you need henrynash_ raildo or someone that has worked on the hierarchical stuff. | 21:59 |
| ayoung | raildo in particular is our quota guru | 21:59 |
| ntpttr | ayoung: well I was talking to dolphm about this, and he suggested figuring out if the project has admin scope for the project based on is_admin_project in the token, and mentioned you might know about that I think. Your nick is in the code for this docstring https://github.com/openstack/keystone/blob/d9c6b50a3ae514e640fa13a344e59fe3649ee0ef/keystone/token/providers/common.py#L269-L274 | 21:59 |
| ayoung | as far as "admin token" we are working on making it easer to specify a token as "admin in the admin project" which went in to Keystone last release, but is not exposed in oslo-context yet | 22:00 |
| *** diazjf has quit IRC | 22:00 | |
| ayoung | ntpttr, he's right | 22:00 |
| ayoung | the reviews for that are still pending... | 22:00 |
| ayoung | https://review.openstack.org/#/c/331374/ that merged | 22:01 |
| patchbot | ayoung: patch 331374 - keystonemiddleware - Pass X_IS_ADMIN_PROJECT header from auth_token (MERGED) | 22:01 |
| ayoung | ntpttr, so...you should be able to check for that header | 22:01 |
| ntpttr | ayoung: ah cool, does that header exist whenever any request to keystone is made? | 22:02 |
| ayoung | ntpttr, that is not the question you need to ask | 22:03 |
| *** spzala has quit IRC | 22:03 | |
| ayoung | ntpttr, the question is "does cinder have access to that header after the token is validated " and the answer should be "yes" | 22:03 |
| ayoung | the header is created by keystonemiddleware | 22:03 |
| ayoung | ntpttr, so, any token validation respoonse has the data in it to generate that header, but not every web server out there would generate it...but you don't care, right? | 22:04 |
| *** fangxu has quit IRC | 22:04 | |
| ntpttr | ayoung: I don't think so? What I do know is that we're making the request to get the project here based on the project ID from a keystone client that we generate with our context, is there a way to get that info out of the data there? https://github.com/openstack/cinder/blob/master/cinder/quota_utils.py#L106-L108 | 22:06 |
| ntpttr | ayoung: thanks for your help btw, sorry I'm pretty green with the keystone stuff | 22:06 |
| ayoung | ntpttr, you should have it cinder by that point | 22:06 |
| ayoung | ntpttr, test it out | 22:07 |
| ayoung | you have a devstack setup? | 22:07 |
| ayoung | there are a few config options to look at... | 22:07 |
| ntpttr | ayoung: yeah I do, I was just walking through the code there in pdb after making a quota show request as admin | 22:08 |
| ayoung | ntpttr, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/conf/resource.py#n50 | 22:08 |
| ayoung | and | 22:08 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/conf/resource.py#n56 | 22:08 |
| ayoung | if you set those, then only tokens from those projects should have the X_IS_ADMIN_PROJECT header | 22:09 |
| ntpttr | ayoung: ah okay, I need to manually put those in keystone.comf? does devstack not set up an admin project by default? | 22:10 |
| ayoung | ntpttr, not yet | 22:10 |
| ntpttr | ayoung: this is the response I was getting before when the get was called, I don't see the header so that's probably because those options aren't there http://paste.openstack.org/show/523841/ | 22:10 |
| ayoung | ntpttr, so jamielennox took this effort over from me. I did not sync up with him as far as the state. He's probably asleep right now | 22:10 |
| ayoung | I had an approach that we were going to take, but he was going for soemthing different, and there might still be a missing piece. I'd sync with him when he is back | 22:11 |
| ayoung | he's in Australia, and was up early for the Keystone meeting ,so...a few more hours probably | 22:11 |
| ntpttr | ayoung: gotcha, thanks. It looks like devstack actually has set up those values | 22:12 |
| ntpttr | http://paste.openstack.org/show/523845/ | 22:12 |
| ayoung | Yay! | 22:12 |
| *** ddieterly is now known as ddieterly[away] | 22:12 | |
| *** ddieterly[away] is now known as ddieterly | 22:12 | |
| ayoung | ntpttr, I've been lost in Tripleo land this release..its been kicking my tuchas | 22:12 |
| *** ddieterly has quit IRC | 22:13 | |
| ntpttr | ayoung: good luck! | 22:14 |
| ayoung | ntpttr, too late | 22:14 |
| ntpttr | thanks for your time | 22:14 |
| *** jbell8 has joined #openstack-keystone | 22:16 | |
| *** harlowja has joined #openstack-keystone | 22:16 | |
| *** harlowja has quit IRC | 22:23 | |
| *** lucas___ has joined #openstack-keystone | 22:24 | |
| *** jsavak has quit IRC | 22:28 | |
| *** lucas___ has quit IRC | 22:28 | |
| *** gordc has quit IRC | 22:38 | |
| *** BjoernT has quit IRC | 22:40 | |
| *** jorge_munoz has quit IRC | 22:41 | |
| *** tonytan4ever has quit IRC | 22:45 | |
| *** KevinE has quit IRC | 22:46 | |
| *** ddieterly has joined #openstack-keystone | 22:48 | |
| *** ddieterly is now known as ddieterly[away] | 22:49 | |
| *** mwheckmann has quit IRC | 22:49 | |
| *** ddieterly[away] has quit IRC | 22:52 | |
| *** fangxu has joined #openstack-keystone | 22:56 | |
| *** dan_nguyen has quit IRC | 22:57 | |
| *** lucas__ has joined #openstack-keystone | 22:58 | |
| *** jbell8 has quit IRC | 22:58 | |
| *** spzala has joined #openstack-keystone | 22:59 | |
| *** lucas___ has joined #openstack-keystone | 22:59 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Update README to comply with Identity V3 https://review.openstack.org/335210 | 23:00 |
| *** lucas____ has joined #openstack-keystone | 23:02 | |
| *** lucas___ has quit IRC | 23:03 | |
| *** lucas__ has quit IRC | 23:03 | |
| *** rcernin has quit IRC | 23:03 | |
| *** lucas__ has joined #openstack-keystone | 23:03 | |
| *** spzala has quit IRC | 23:04 | |
| *** lucas___ has joined #openstack-keystone | 23:05 | |
| *** lucas____ has quit IRC | 23:06 | |
| *** lucas____ has joined #openstack-keystone | 23:07 | |
| *** lucas__ has quit IRC | 23:08 | |
| *** lucas___ has quit IRC | 23:09 | |
| *** lucas____ has quit IRC | 23:11 | |
| *** BjoernT has joined #openstack-keystone | 23:12 | |
| *** harlowja has joined #openstack-keystone | 23:12 | |
| *** BjoernT has quit IRC | 23:17 | |
| *** slberger has left #openstack-keystone | 23:18 | |
| *** tonytan4ever has joined #openstack-keystone | 23:22 | |
| *** timcline has quit IRC | 23:22 | |
| *** tonytan4ever has quit IRC | 23:27 | |
| *** rderose has joined #openstack-keystone | 23:31 | |
| rderose | rodrigods: you're killing me, gooooooooodnesssss | 23:32 |
| rderose | rodrigods: :) | 23:32 |
| jamielennox | ayoung, ntpttr: hmm? yea, slept in | 23:47 |
| jamielennox | rderose: hey, i'm looking at your inactive users DSS, it has a database write on every activate. How do i not do that? | 23:50 |
| rderose | jamielennox: it sets last_active_at on every authentication if you have the "disable_user_account_days_inactive" config set | 23:52 |
| rderose | jamielennox: if "disable_user_account_days_inactive" is set to none, it won't do the database write | 23:53 |
| jamielennox | rderose: oh, you put it in the sql_backend. i was expecting it in the controller/manager and not seeing it | 23:54 |
| rderose | jamielennox: yeah, this feature is only supported via the sql backend identity | 23:55 |
| jamielennox | i guess it has to go there to make the enabled property work like that | 23:56 |
| *** roxanaghe has quit IRC | 23:56 | |
| jamielennox | ok, thanks | 23:56 |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Use extras for oslo.messaging dependency https://review.openstack.org/274400 | 23:56 |
| *** ddieterly has joined #openstack-keystone | 23:57 | |
| rderose | jamielennox: np | 23:57 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!