| openstackgerrit | Merged openstack/python-keystoneclient: Add credential functional tests https://review.openstack.org/348557 | 00:00 |
|---|---|---|
| *** markvoelker has joined #openstack-keystone | 00:00 | |
| *** ninag has joined #openstack-keystone | 00:01 | |
| *** ninag has quit IRC | 00:01 | |
| *** spzala has joined #openstack-keystone | 00:03 | |
| *** tqtran has quit IRC | 00:09 | |
| *** spzala has quit IRC | 00:12 | |
| *** woodster_ has quit IRC | 00:29 | |
| *** iurygregory_ has joined #openstack-keystone | 00:32 | |
| *** jamielennox is now known as jamielennox|away | 00:48 | |
| *** spzala has joined #openstack-keystone | 00:49 | |
| *** jamielennox|away is now known as jamielennox | 00:49 | |
| *** tonytan4ever has joined #openstack-keystone | 00:50 | |
| *** roxanaghe has quit IRC | 00:51 | |
| *** gyee has quit IRC | 00:59 | |
| *** tqtran has joined #openstack-keystone | 01:09 | |
| *** julim has joined #openstack-keystone | 01:10 | |
| *** adrian_otto has quit IRC | 01:11 | |
| *** tqtran has quit IRC | 01:13 | |
| *** BjoernT has joined #openstack-keystone | 01:14 | |
| *** BjoernT has quit IRC | 01:18 | |
| *** asettle has joined #openstack-keystone | 01:22 | |
| *** haplo37__ has joined #openstack-keystone | 01:24 | |
| *** spzala has quit IRC | 01:29 | |
| *** spzala has joined #openstack-keystone | 01:30 | |
| *** asettle has quit IRC | 01:32 | |
| *** spzala has quit IRC | 01:34 | |
| *** EinstCrazy has joined #openstack-keystone | 01:34 | |
| *** dkehn has quit IRC | 01:34 | |
| *** wangqun has joined #openstack-keystone | 01:37 | |
| *** davechen has joined #openstack-keystone | 01:43 | |
| *** dkehn_ has joined #openstack-keystone | 01:47 | |
| *** adriant_ has joined #openstack-keystone | 01:50 | |
| *** haplo37__ has quit IRC | 01:53 | |
| *** su_zhang has quit IRC | 01:54 | |
| *** EinstCrazy has quit IRC | 01:59 | |
| *** EinstCrazy has joined #openstack-keystone | 02:03 | |
| stevemar | adriant_: o/ | 02:06 |
| stevemar | adriant_: i'm still playing catch up :( | 02:06 |
| *** jamielennox is now known as jamielennox|away | 02:07 | |
| adriant_ | stevemar: yeah, i assumed as much, hence the follow up email :) | 02:08 |
| adriant_ | stevemar: am submitting the bug report now. I sadly don't have time to dig into the KeystoneAuth code myself, but hopefully the pastes I've added help show the issue. | 02:09 |
| stevemar | adriant_: yes, i'm hoping so :\ | 02:09 |
| stevemar | adriant_: maybe i can sucker jamielennox|away into looking at it :P | 02:10 |
| adriant_ | main jist seems to be, token auth isn't fetching a catalog | 02:10 |
| stevemar | sadly i have no carrot, only a stick | 02:10 |
| adriant_ | and everything expects it to fetch one | 02:10 |
| *** EinstCra_ has joined #openstack-keystone | 02:11 | |
| stevemar | adriant_: so with a project scoped token -- you should be able to (as far as the API is concerned) either a) get a new token with the same scope, or b) supply it with a new scope and possibly get a new token with that scope | 02:11 |
| adriant_ | stevemar: yeah, doing stuff directly with Keystone via curl seems to work fine for me | 02:12 |
| adriant_ | but the problem is the client tools all assume token auth returns a catalog | 02:12 |
| adriant_ | stevemar: So either they are in the wrong, or KeystoneAuth should when doing token auth fetch a catalog same as it does with password auth | 02:13 |
| adriant_ | bug: https://bugs.launchpad.net/keystoneauth/+bug/1613498 | 02:14 |
| openstack | Launchpad bug 1613498 in keystoneauth "Token Auth does not work (not fetching catalog)" [Undecided,New] | 02:14 |
| *** EinstCrazy has quit IRC | 02:14 | |
| stevemar | adriant_: danke | 02:15 |
| adriant_ | stevemar: welcome :) | 02:16 |
| *** jamielennox|away is now known as jamielennox | 02:26 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add key_hash column to credential table https://review.openstack.org/355618 | 02:27 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add create and update methods to credential Manager https://review.openstack.org/355056 | 02:27 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Create a fernet credential provider https://review.openstack.org/354496 | 02:27 |
| jamielennox | adriant_: using Token like that is really for rescoping | 02:28 |
| jamielennox | there's nothing there that will fetch the current information - i don't know if we even have the ability for that | 02:29 |
| jamielennox | if you do a project_id= in there it should fetch you a new token based on the old one | 02:29 |
| jamielennox | and then work | 02:29 |
| adriant_ | jamielennox: I thought the Keystone API supported asking for a catalog with token auth? | 02:31 |
| jamielennox | adriant_: yea, but you need a bit more than that because you need to find like current project id and user id | 02:32 |
| jamielennox | so you really need the whole token data | 02:32 |
| adriant_ | jamielennox: although do look at how heatclient is using it. That isn't rescoping, it expects the token to authenticate and then use the new token/catalog. Unless I'm reading it wrong. | 02:32 |
| *** asettle has joined #openstack-keystone | 02:33 | |
| jamielennox | adriant_: so it looks like it depends how you're creating the heatclient | 02:35 |
| jamielennox | if you pass session it doesn't seem to be doing anything too crazy | 02:35 |
| adriant_ | sec | 02:35 |
| adriant_ | jamielennox: https://github.com/openstack/python-heatclient/blob/master/heatclient/shell.py#L515 | 02:36 |
| adriant_ | the openstackclient does something similar | 02:36 |
| jamielennox | adriant_: oh, shell | 02:36 |
| adriant_ | if token is present, try and auth with it | 02:36 |
| jamielennox | god i hate the shells | 02:36 |
| adriant_ | I'm using heatclient as an example as it's easier to dig into than openstackclient | 02:37 |
| adriant_ | and the same principle applies | 02:37 |
| jamielennox | so it can be useful because most services allow --os-endpoint-override or something similar | 02:37 |
| adriant_ | But that's painful | 02:38 |
| jamielennox | yea | 02:38 |
| *** asettle has quit IRC | 02:40 | |
| adriant_ | and: http://docs.openstack.org/developer/python-openstackclient/authentication.html | 02:40 |
| adriant_ | if you look there, the token authentication as listed there seems to expect token auth to fetch a catalog | 02:41 |
| adriant_ | without the need for explicitly setting the endpoint | 02:41 |
| jamielennox | the new osc is phasing out token | 02:41 |
| jamielennox | it was really only used for ADMIN_TOKEN stuff | 02:41 |
| adriant_ | But it's actually useful if you want to auth with a token as you can't password auth all the time. | 02:42 |
| adriant_ | if that's gone then MFA via the shell is really painful... | 02:42 |
| adriant_ | stevemar, jamielennox: So what's the way forward here? Because it seems like what you're saying is "this is expected functionality". | 02:46 |
| jamielennox | sorry, tuned out briefly | 02:47 |
| adriant_ | jamielennox: no problem. I'm just trying to figure out what I can do around all this. :( | 02:47 |
| jamielennox | so i don't know if there's an MFA aspect here | 02:48 |
| *** code-R has joined #openstack-keystone | 02:48 | |
| adriant_ | with the MFA solution I'm trying to get working, you need to append a passcode to your password. | 02:49 |
| adriant_ | with CLI, that means entering a passcode EVERY call. | 02:49 |
| adriant_ | which is daft | 02:49 |
| adriant_ | so what I want to do is this: http://paste.openstack.org/show/553325/ | 02:49 |
| adriant_ | fetch a token, and for the duration of that token, use the shell tools. | 02:50 |
| jamielennox | adriant_: so maybe more what you want is caching right? | 02:50 |
| adriant_ | maybe? I'd just expect when authenticating with a token it fetches the catalog and uses the scope of the old token. | 02:51 |
| adriant_ | that would solve it | 02:51 |
| jamielennox | the ideal case would be though from a shell you shouldn't have to fetch a token specifically and then use it | 02:53 |
| jamielennox | that case i have a bunch of stuff set up for we're just waiting for osc-lib and osc 3 to be finished | 02:53 |
| jamielennox | for token in general - i don't know how we go from what we have today to future | 02:54 |
| adriant_ | Does it cache your token and catalog locally? | 02:54 |
| jamielennox | yes | 02:54 |
| adriant_ | ok, then yes that might solve my issue | 02:54 |
| jamielennox | keyring would be the default implementation but i've left that up to the implementation | 02:54 |
| jamielennox | adriant_: see https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/plugin.py#L207-L252 for caching functions | 02:55 |
| stevemar | jamielennox: but we don't cache things today AFAIK | 02:55 |
| stevemar | whuaa | 02:55 |
| jamielennox | stevemar: no we don't do it today, i had a POC but it kept getting refactored with OSC3 | 02:56 |
| stevemar | yeah | 02:56 |
| stevemar | jamielennox: shouldn't this work with our APIs though? we can get a token from a token today | 02:56 |
| jamielennox | stevemar: we can rescope sure | 02:57 |
| stevemar | but we can't seem to do that with keystoneauth today | 02:57 |
| adriant_ | yeah, I'm not sure why keystoneauth doesn't fetch a catalog with token auth | 02:57 |
| jamielennox | stevemar: i'm not sure we have the retrieve current token data | 02:57 |
| jamielennox | adriant_: it just wasn't the use case we had | 02:58 |
| jamielennox | particularly from shell | 02:58 |
| jamielennox | because it doesn't implement get_user_id and get_project_id either | 02:58 |
| adriant_ | jamielennox: but some shells seem to expect that | 02:59 |
| adriant_ | see heat :P | 02:59 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Improve docs for v3 ec2 https://review.openstack.org/350173 | 02:59 |
| jamielennox | yea, lots of things in this space are implemented because someone needed something for some side case | 02:59 |
| adriant_ | So can we expand token auth in Keystoneauth to fetch the catalog? | 03:01 |
| openstackgerrit | Merged openstack/keystone: Move fernet utils into keystone/common/ https://review.openstack.org/353707 | 03:01 |
| *** code-R has quit IRC | 03:01 | |
| adriant_ | Still not as nice as caching, as we are still asking for a token+catalog every time, but it is no worse than doing so with username+password | 03:02 |
| jamielennox | does https://github.com/openstack/keystone/blob/master/etc/policy.json#L106 mean that you can GET /auth/tokens with the same token data? | 03:03 |
| *** iurygregory has quit IRC | 03:05 | |
| *** iurygregory has joined #openstack-keystone | 03:06 | |
| jamielennox | i'd be ok with extending token to fetch the data if get_endpoint, get_project_id or get_user_id is called | 03:07 |
| jamielennox | i don't think a rescoing scenario should trigger that | 03:07 |
| *** adriat has joined #openstack-keystone | 03:10 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Make a FernetUtils class https://review.openstack.org/353761 | 03:10 |
| *** adriat is now known as adriant | 03:10 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Pass key_repository and max_active_keys to FernetUtils https://review.openstack.org/353762 | 03:11 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add credential encryption exception https://review.openstack.org/354494 | 03:11 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add conf to support credential encryption https://review.openstack.org/354495 | 03:11 |
| adriant | jamielennox: sorry, network trouble. | 03:11 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Create a fernet credential provider https://review.openstack.org/354496 | 03:11 |
| adriant | so is the token auth in Keystoneauth explicitly for rescoping? | 03:11 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add create and update methods to credential Manager https://review.openstack.org/355056 | 03:11 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add key_hash column to credential table https://review.openstack.org/355618 | 03:11 |
| *** esp has joined #openstack-keystone | 03:11 | |
| *** adriant_ has quit IRC | 03:12 | |
| stevemar | lbragstad rebased as far as i could | 03:12 |
| wangqun | ping stevemar | 03:16 |
| jamielennox | adriant: i don't want to say explicitly, you can use it for whatever but it was the intention | 03:17 |
| adriant | jamielennox: the API seems to support what I am expecting keystoneauth to do: http://developer.openstack.org/api-ref/identity/v3/?expanded=token-authentication-with-scoped-authorization-detail#token-authentication-with-scoped-authorization | 03:18 |
| jamielennox | adriant: POST creates a new token | 03:18 |
| stevemar | wangqun: pong | 03:19 |
| adriant | isn't that what keystoneauth is doing anyway? | 03:19 |
| wangqun | I want to make the keystone member role have the permissions that can access the keystone user list. Do I only modify the /etc/keystone/policy.json? | 03:19 |
| jamielennox | adriant: it's what you do when you rescope a token | 03:19 |
| wangqun | Thanks stevemar to answer me. | 03:19 |
| jamielennox | adriant: GET is what we use to retrieve the data for a current token | 03:19 |
| stevemar | wangqun: yes, that should be all you need to do. just add " or role:member" | 03:20 |
| stevemar | wangqun: please note that policy is *only evaluated with v3!* | 03:20 |
| stevemar | wangqun: if you are using v2.0 APIs it's a straight "are you admin" call for most APIs | 03:20 |
| stevemar | wangqun: see http://lists.openstack.org/pipermail/openstack-dev/2016-July/099596.html for details | 03:21 |
| *** haplo37__ has joined #openstack-keystone | 03:22 | |
| wangqun | stevemar, I use the v2.0 APIs. Can't it realize? | 03:22 |
| wangqun | I try to modify the policy.json. | 03:23 |
| wangqun | grep list_users policy.json | 03:23 |
| wangqun | "identity:list_users": "", | 03:23 |
| wangqun | "identity:list_users_in_group": "", | 03:23 |
| wangqun | RROR: openstack You are not authorized to perform the requested action: admin_required | 03:23 |
| adriant | jamielennox: Ok, this is where I'm confused. Keystoneauth with a password does a POST to get a token, while token auth is just getting the token to validate it, and not fetching a new one+catalog, correct? | 03:23 |
| wangqun | It doesn't work indeed . | 03:24 |
| jamielennox | adriant: it depends, there's different ways you can do stuff | 03:24 |
| jamielennox | adriant: yes, password does a POSt to get a token | 03:24 |
| jamielennox | when you rescope you are getting a new token with an old token so that's a POST as well | 03:24 |
| *** su_zhang has joined #openstack-keystone | 03:24 | |
| jamielennox | validation like auth_token middleware is just validating an incoming token so thats a GET | 03:24 |
| adriant | yeah, what I'm mainly concerned with is this: https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/identity/generic/token.py | 03:25 |
| jamielennox | keystoneauth isn't doing any validation | 03:25 |
| adriant | I assume that is a get? | 03:25 |
| stevemar | wangqun: unfortunately, no, the v2.0 APIs all using a function called "assert_admin" --> https://github.com/openstack/keystone/blob/master/keystone/identity/controllers.py#L42-L52 and https://github.com/openstack/keystone/blob/3f32423241bff496da5ff35616aeafd096f5f951/keystone/common/wsgi.py#L283-L314 | 03:25 |
| stevemar | wangqun: it is one of the main reasons we highly recommend everyone use v3 | 03:26 |
| jamielennox | adriant: generic is just a wrapper around selecting v2 or v3 depending on what's available | 03:26 |
| jamielennox | that involves a GET / | 03:26 |
| wangqun | Ok, I got it, and Thanks stevemar. | 03:26 |
| adriant | assume v3 :) | 03:26 |
| jamielennox | yep, generic is what happens when you do auth_url=https://keystone:5000/ VERSION=3 so it uses the discovery page | 03:27 |
| jamielennox | but that has nothing to do with actually validating the token | 03:27 |
| adriant | I'm aware, I was just linking it as an example of the process I was refering to | 03:28 |
| jamielennox | adriant: https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/identity/v3/token.py#L27 | 03:28 |
| adriant | ok, so once you are authed like that, asking for a given endpoint fails as you don't have a catalog | 03:28 |
| jamielennox | adriant: so there is not actual lookup | 03:28 |
| adriant | would it be possible to, if asked for an endpoint, fetch a catalog? | 03:29 |
| adriant | and yes, I realise this is not a usecase that this was written for | 03:30 |
| adriant | jamielennox: also, i apologise as I haven't dug into the Keystoneauth codebase too much yet. | 03:31 |
| adriant | so expect partially stupid questions. | 03:31 |
| jamielennox | adriant: i'm just looking how that would work | 03:31 |
| adriant | Basically, I seems silly that you can create an auth with a token, and then asking for an endpoint just throws errors. | 03:32 |
| jamielennox | https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/identity/v3/base.py#L112 | 03:32 |
| jamielennox | get_auth_ref is designed to fetch a new token | 03:32 |
| adriant | then what is this meant to do?: https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/identity/base.py#L75 | 03:34 |
| jamielennox | so the flow when the plugin needs to know something about its auth will fetch a newtoken rather than evaluate the current one | 03:34 |
| adriant | ah | 03:34 |
| jamielennox | get_token -> get_access -> get_auth_ref | 03:34 |
| adriant | so is there a way to in the service catalog, to if it is empty, to attempt to get a new one, or ask for a new token at the same scope with a catalog? | 03:36 |
| jamielennox | i'm not sure how you'd make it use the current token instead in a backwards compatible way | 03:36 |
| adriant | using a new token is fine, my issue is that when trying to use the catalog it falls over | 03:37 |
| jamielennox | a new token with the same scope will work | 03:37 |
| jamielennox | but there's no way to know the current scope, you'd have to provide that as a user | 03:37 |
| adriant | ok | 03:37 |
| jamielennox | you might be able to fix it to say if there's no scope provided fetch rather than rescope | 03:37 |
| jamielennox | going from scoped->unscoped token shouldn't be allowed (whether it works i can't remember) | 03:38 |
| adriant | yeah, but using a token you can get a catalog | 03:38 |
| adriant | so maybe just use the existing token to fill it. As currently password auth relies on the catalog coming with a token | 03:38 |
| jamielennox | yea - there's no catalog with an unscoped anyway | 03:39 |
| jamielennox | so if you provide a --os-token and --os-project-id it should work today | 03:39 |
| jamielennox | it'll just do a rescope to the same thing | 03:39 |
| *** iurygregory_ has quit IRC | 03:40 | |
| adriant | But that would mean explicitly using keystoneauth to do that? As the way all the shell stuff works currently is to pass just the token and auth url through. | 03:42 |
| *** julim has quit IRC | 03:42 | |
| *** roxanaghe has joined #openstack-keystone | 03:43 | |
| *** roxanaghe has quit IRC | 03:43 | |
| adriant | jamielennox: Could we stick something in here that fetches a catalog using the current token if one isn't present?: https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/identity/base.py#L159 | 03:47 |
| *** roxanaghe has joined #openstack-keystone | 03:48 | |
| *** code-R has joined #openstack-keystone | 03:56 | |
| *** asettle has joined #openstack-keystone | 03:56 | |
| *** code-R_ has joined #openstack-keystone | 03:59 | |
| *** GB21 has joined #openstack-keystone | 04:01 | |
| *** asettle has quit IRC | 04:01 | |
| stevemar | jamielennox: your view BP impl isn't getting much traction | 04:02 |
| stevemar | views* | 04:02 |
| *** code-R has quit IRC | 04:03 | |
| stevemar | jamielennox: would you be totally miffed if it was bumped? just trying to be realistic about it | 04:03 |
| jamielennox | adriant: well that's the way some of the heat shell stuff works, ideally we want this to use the keystoneauth stuff as much as possibl e | 04:08 |
| jamielennox | stevemar: not really - it's not an urgent change | 04:08 |
| jamielennox | stevemar: and it has the potential to change output at the last minute | 04:09 |
| *** tqtran has joined #openstack-keystone | 04:10 | |
| stevemar | jamielennox: yeah, rather worried about that | 04:12 |
| *** code-R_ has quit IRC | 04:12 | |
| stevemar | all of a sudden a "links" goes missing or some nonsense | 04:12 |
| *** code-R has joined #openstack-keystone | 04:12 | |
| jamielennox | yep | 04:12 |
| stevemar | jamielennox: OK, i'm going to keep it targeted for N, if it gets reviews then all the power to you and it can go in; otherwise it'll be bumped to O -- cool? | 04:13 |
| jamielennox | yep | 04:13 |
| *** tqtran has quit IRC | 04:14 | |
| *** ravelar has quit IRC | 04:16 | |
| *** GB21 has quit IRC | 04:17 | |
| *** links has joined #openstack-keystone | 04:20 | |
| *** code-R has quit IRC | 04:22 | |
| adriant | jamielennox: just wrote this to try something out with token auth: http://paste.openstack.org/show/558037/ | 04:27 |
| *** tonytan4ever has quit IRC | 04:27 | |
| adriant | I'm assuming if valid password auth, auth.get_token(session) returns your current token, yes? | 04:27 |
| jamielennox | yep | 04:28 |
| jamielennox | if you pass project_name and project_domain_name to v3.Token that should work though | 04:28 |
| adriant | ok, let me try | 04:28 |
| adriant | ok, that does work. So should the fix be to update the client tools to correctly pass those values along to keystone auth as well? | 04:30 |
| adriant | Or can keystoneauth, if the token is valid, just fetch a new catalog on it's own? | 04:30 |
| adriant | without needing to pass project (since the old token is already correctly scoped) | 04:31 |
| *** ravelar has joined #openstack-keystone | 04:31 | |
| jamielennox | so the client tools should be able to do that already | 04:32 |
| adriant | Well, not heat, but heat is special. Not sure yet on openstackclient | 04:32 |
| jamielennox | you could fix heatclient, but gah | 04:32 |
| adriant | How far away is version 3? | 04:32 |
| jamielennox | openstackclient should be able to do it | 04:32 |
| jamielennox | --os-auth-type token --os-project-name proj --os-project-domain-name dom | 04:33 |
| jamielennox | --os-token token | 04:33 |
| adriant | openstackclient 2.6 does not pass along the projectname and such to the token auth I don't think | 04:33 |
| adriant | can double check, but I think I played with that a couple of weeks back | 04:33 |
| jamielennox | if you do --os-auth-type this stuff should be dynamic rather than something that OSC has to do | 04:34 |
| adriant | jamielennox: just tried this bash against OS-Client 2.6: http://paste.openstack.org/show/558043/ | 04:39 |
| adriant | error: ":__init__() got an unexpected keyword argument 'user_domain_name'" | 04:40 |
| adriant | just tried doing a project list | 04:40 |
| jamielennox | lol - that's notgood | 04:41 |
| adriant | you can see my frustration :( | 04:42 |
| adriant | Will wait for 3.0 and check again I guess. But if setting the envvar for those works in 3, then yes that also fixes my problem :) | 04:43 |
| jamielennox | do you know where user_domain_name is failing? | 04:44 |
| jamielennox | if you add --debug it prints tracebacks | 04:44 |
| adriant | sorry yeah, should have pasted a debug | 04:44 |
| adriant | jamielennox: http://paste.openstack.org/show/558045/ | 04:45 |
| adriant | token plugin itself it seem | 04:45 |
| jamielennox | adriant: oh, so yea you can't have user_domain_name there | 04:46 |
| jamielennox | you need project_domain_name not user_domain_name | 04:46 |
| adriant | so the client is being stupid | 04:46 |
| jamielennox | there's no user infromation in token plugin | 04:46 |
| adriant | I'm not passing in that value, it's something with how the OSclient is trying to do it | 04:46 |
| jamielennox | yep, it'd depend if it was osc or keystoneauth at fault, if it's ksa we'd fix it, but i doubt it | 04:47 |
| jamielennox | OSC has had various attempts at making auth "more intuitive" that fail in some weird edge cases | 04:47 |
| adriant | Nah, it looks like OSC is passing in extra parameters. | 04:47 |
| adriant | maybe because it expects the same parameters needed for token auth as password auth? | 04:48 |
| adriant | what is the mechanism that is used to figure out which parameters to pass along dynamically? | 04:50 |
| adriant | because it could be that OSC is throwing in a large set of kwargs and expecting keystoneauth to use the ones it needs. | 04:50 |
| jamielennox | adriant: yea, it makes a number of assumptions, this is part of what the osc-lib and osc 3 is supposed to figure out | 04:51 |
| jamielennox | the mechanism is in keystoneuaht and generally called loaders | 04:52 |
| adriant | Yeah, I'll wait for osc3 and play with that. Any clue when they'll be done with it? | 04:53 |
| adriant | or at least have a test version we can grab | 04:53 |
| adriant | jamielennox: Also, thanks a hell of a lot for helping me work this out. :) | 04:55 |
| *** esp has quit IRC | 04:55 | |
| jamielennox | adriant: i think the test version is probably master | 04:56 |
| jamielennox | dtroyer: in #openstack-sdks is the person leading that | 04:56 |
| jamielennox | i know he intended to get it done for the newton release - but i'm skeptical that is realistic | 04:56 |
| adriant | so pull master for both OSC and OS-lib and install? | 04:57 |
| adriant | or osc-lib, whatever that second library is called | 04:57 |
| adriant | as I know they needs to be synced up | 04:57 |
| jamielennox | yea, i'd pull master of both | 04:59 |
| jamielennox | master of OSC should rely on osc-lib today, but i don't know where he is with getting things released | 04:59 |
| *** tonytan4ever has joined #openstack-keystone | 05:03 | |
| *** GB21 has joined #openstack-keystone | 05:03 | |
| *** code-R has joined #openstack-keystone | 05:15 | |
| *** su_zhang has quit IRC | 05:16 | |
| openstackgerrit | Thomas Bechtold proposed openstack/keystone: Fix tempest.conf generation https://review.openstack.org/355723 | 05:19 |
| openstackgerrit | Merged openstack/python-keystoneclient: Improve docs for v3 ec2 https://review.openstack.org/350173 | 05:25 |
| *** jaosorior has joined #openstack-keystone | 05:30 | |
| *** code-R has quit IRC | 05:39 | |
| *** haplo37__ has quit IRC | 05:41 | |
| *** david_cu has joined #openstack-keystone | 05:43 | |
| *** roxanaghe has quit IRC | 05:45 | |
| *** tonytan4ever has quit IRC | 05:46 | |
| *** dkehn_ has quit IRC | 05:48 | |
| *** tonytan4ever has joined #openstack-keystone | 05:54 | |
| *** markvoelker has quit IRC | 05:58 | |
| *** dkehn_ has joined #openstack-keystone | 06:01 | |
| *** jpena|off has quit IRC | 06:02 | |
| *** akrzos has quit IRC | 06:02 | |
| *** akrzos has joined #openstack-keystone | 06:02 | |
| *** jpena|off has joined #openstack-keystone | 06:04 | |
| *** tonytan4ever has quit IRC | 06:04 | |
| *** jpena|off has quit IRC | 06:10 | |
| *** jpena|off has joined #openstack-keystone | 06:11 | |
| *** tqtran has joined #openstack-keystone | 06:11 | |
| *** rcernin has joined #openstack-keystone | 06:14 | |
| *** tqtran has quit IRC | 06:15 | |
| *** wangqun_ has joined #openstack-keystone | 06:18 | |
| *** wangqun has quit IRC | 06:21 | |
| *** adriant has quit IRC | 06:26 | |
| *** ravelar has quit IRC | 06:26 | |
| *** maestropandy has joined #openstack-keystone | 06:28 | |
| *** spzala has joined #openstack-keystone | 06:31 | |
| *** maestropandy has quit IRC | 06:32 | |
| *** maestropandy has joined #openstack-keystone | 06:32 | |
| *** maestropandy has left #openstack-keystone | 06:33 | |
| *** spzala has quit IRC | 06:35 | |
| *** EinstCra_ has quit IRC | 06:38 | |
| *** EinstCrazy has joined #openstack-keystone | 06:42 | |
| *** ravelar has joined #openstack-keystone | 06:46 | |
| *** markvoelker has joined #openstack-keystone | 06:51 | |
| *** maestropandy1 has joined #openstack-keystone | 07:05 | |
| *** jpena|off is now known as jpena | 07:07 | |
| *** maestropandy1 has quit IRC | 07:17 | |
| *** maestropandy has joined #openstack-keystone | 07:17 | |
| *** pnavarro has joined #openstack-keystone | 07:19 | |
| openstackgerrit | henry-nash proposed openstack/keystone: POC of data migration using database triggers https://review.openstack.org/354343 | 07:19 |
| *** tonytan4ever has joined #openstack-keystone | 07:22 | |
| *** maestropandy has left #openstack-keystone | 07:22 | |
| *** tonytan4ever has quit IRC | 07:26 | |
| *** GB21 has quit IRC | 07:28 | |
| *** dkehn_ has quit IRC | 07:43 | |
| *** belmoreira has joined #openstack-keystone | 07:46 | |
| *** chlong has quit IRC | 07:50 | |
| *** GB21 has joined #openstack-keystone | 07:50 | |
| *** code-R has joined #openstack-keystone | 07:52 | |
| *** code-R has quit IRC | 07:57 | |
| *** josecastroleon has joined #openstack-keystone | 07:58 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** markvoelker has quit IRC | 08:01 | |
| *** dkehn_ has joined #openstack-keystone | 08:02 | |
| *** afred312 has quit IRC | 08:05 | |
| *** afred312 has joined #openstack-keystone | 08:06 | |
| openstackgerrit | Hawh YnL proposed openstack/keystone: a https://review.openstack.org/355774 | 08:09 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** asettle has joined #openstack-keystone | 08:20 | |
| *** tonytan4ever has joined #openstack-keystone | 08:23 | |
| *** wangqun_ has quit IRC | 08:27 | |
| *** tonytan4ever has quit IRC | 08:28 | |
| *** mvk has quit IRC | 08:29 | |
| *** dikonoor has joined #openstack-keystone | 08:35 | |
| *** maestropandy has joined #openstack-keystone | 08:35 | |
| *** maestropandy1 has joined #openstack-keystone | 08:36 | |
| *** maestropandy has quit IRC | 08:40 | |
| *** maestropandy1 has left #openstack-keystone | 08:49 | |
| *** dkehn_ has quit IRC | 08:51 | |
| *** davechen has left #openstack-keystone | 08:55 | |
| *** mvk has joined #openstack-keystone | 08:55 | |
| *** markvoelker has joined #openstack-keystone | 09:02 | |
| *** dkehn_ has joined #openstack-keystone | 09:04 | |
| *** markvoelker has quit IRC | 09:07 | |
| *** GB21 has quit IRC | 09:18 | |
| *** ravelar has quit IRC | 09:33 | |
| breton | stevemar: hey. Why doesn't OSC backport bugfixes? I am wondering in context of https://review.openstack.org/#/c/354271/ | 09:37 |
| patchbot | breton: patch 354271 - python-openstackclient (stable/mitaka) - Fix SSL/TLS verification for network commands (ABANDONED) | 09:37 |
| samueldmq | morning keystone | 09:43 |
| *** nkinder has quit IRC | 09:44 | |
| *** jpena has quit IRC | 09:46 | |
| *** dmellado has quit IRC | 09:46 | |
| *** amoralej has quit IRC | 09:46 | |
| *** jpena has joined #openstack-keystone | 09:47 | |
| *** GB21 has joined #openstack-keystone | 09:51 | |
| *** code-R has joined #openstack-keystone | 09:53 | |
| *** dmellado has joined #openstack-keystone | 09:56 | |
| *** code-R has quit IRC | 09:58 | |
| *** EinstCrazy has quit IRC | 10:01 | |
| *** markvoelker has joined #openstack-keystone | 10:03 | |
| *** jed56 has joined #openstack-keystone | 10:03 | |
| breton | samueldmq: o/ | 10:03 |
| *** EinstCrazy has joined #openstack-keystone | 10:04 | |
| *** markvoelker has quit IRC | 10:08 | |
| *** tqtran has joined #openstack-keystone | 10:12 | |
| *** nkinder has joined #openstack-keystone | 10:13 | |
| *** mnikolaenko_ has joined #openstack-keystone | 10:14 | |
| *** tqtran has quit IRC | 10:17 | |
| *** dikonoor has quit IRC | 10:20 | |
| *** asettle has quit IRC | 10:22 | |
| *** tonytan4ever has joined #openstack-keystone | 10:24 | |
| *** mvk has quit IRC | 10:25 | |
| *** mvk has joined #openstack-keystone | 10:26 | |
| *** tonytan4ever has quit IRC | 10:28 | |
| *** ntpttr has quit IRC | 10:30 | |
| *** spzala has joined #openstack-keystone | 10:31 | |
| *** ntpttr has joined #openstack-keystone | 10:35 | |
| *** spzala has quit IRC | 10:36 | |
| *** josecastroleon has quit IRC | 10:40 | |
| *** dikonoor has joined #openstack-keystone | 10:44 | |
| *** EinstCrazy has quit IRC | 10:44 | |
| *** EinstCrazy has joined #openstack-keystone | 10:45 | |
| *** dikonoor has quit IRC | 10:47 | |
| *** dikonoor has joined #openstack-keystone | 10:47 | |
| *** EinstCrazy has quit IRC | 10:50 | |
| *** dikonoor has quit IRC | 10:50 | |
| *** markvoelker has joined #openstack-keystone | 11:04 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Add prepare_ldap command https://review.openstack.org/343028 | 11:07 |
| *** markvoelker has quit IRC | 11:08 | |
| *** asettle has joined #openstack-keystone | 11:09 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Add prepare_ldap command https://review.openstack.org/343028 | 11:09 |
| *** haplo37__ has joined #openstack-keystone | 11:20 | |
| *** dikonoor has joined #openstack-keystone | 11:23 | |
| *** GB21 has quit IRC | 11:24 | |
| *** josecastroleon has joined #openstack-keystone | 11:28 | |
| *** GB21 has joined #openstack-keystone | 11:29 | |
| *** asettle has quit IRC | 11:30 | |
| *** haplo37__ has quit IRC | 11:31 | |
| openstackgerrit | henry-nash proposed openstack/keystone: POC of data migration using database triggers https://review.openstack.org/354343 | 11:33 |
| *** jaosorior has quit IRC | 11:35 | |
| *** jaosorior has joined #openstack-keystone | 11:35 | |
| *** sdake has joined #openstack-keystone | 11:36 | |
| *** GB21 has quit IRC | 11:37 | |
| *** asettle has joined #openstack-keystone | 11:44 | |
| stevemar | breton: we should probably revisit that stance | 11:47 |
| *** rodrigods has quit IRC | 11:51 | |
| *** asettle has quit IRC | 11:51 | |
| *** rodrigods has joined #openstack-keystone | 11:51 | |
| *** asettle has joined #openstack-keystone | 11:52 | |
| *** tonytan4ever has joined #openstack-keystone | 11:55 | |
| *** jpena is now known as jpena|lunch | 11:57 | |
| *** tonytan4ever has quit IRC | 11:59 | |
| *** markvoelker has joined #openstack-keystone | 12:05 | |
| *** sigmavirus|away is now known as sigmavirus | 12:05 | |
| amakarov | zzzeek, hi! Can you please upload dogpile.cache 0.6.2 to pypi? | 12:06 |
| *** haplo37__ has joined #openstack-keystone | 12:09 | |
| *** markvoelker has quit IRC | 12:09 | |
| *** haplo37__ has quit IRC | 12:13 | |
| *** su_zhang has joined #openstack-keystone | 12:16 | |
| *** mnikolaenko_ has quit IRC | 12:19 | |
| *** manous has joined #openstack-keystone | 12:21 | |
| *** gordc has joined #openstack-keystone | 12:24 | |
| *** markvoelker has joined #openstack-keystone | 12:26 | |
| stevemar | o/ | 12:37 |
| *** pauloewerton has joined #openstack-keystone | 12:44 | |
| *** raildo has joined #openstack-keystone | 12:45 | |
| *** itisha has quit IRC | 12:50 | |
| amakarov | stevemar, good day! | 12:54 |
| *** mnikolaenko_ has joined #openstack-keystone | 12:55 | |
| amakarov | stevemar, what can we do for https://review.openstack.org/#/c/351260/ ? | 12:55 |
| patchbot | amakarov: patch 351260 - keystone - Trust controller refactoring | 12:55 |
| *** asettle has quit IRC | 12:55 | |
| amakarov | ayoung, greetings, can you please review? ^^ | 12:56 |
| *** jpena|lunch is now known as jpena | 12:56 | |
| *** asettle has joined #openstack-keystone | 12:58 | |
| *** julim has joined #openstack-keystone | 13:00 | |
| *** guoshan has joined #openstack-keystone | 13:00 | |
| *** woodster_ has joined #openstack-keystone | 13:04 | |
| *** nishaYadav has joined #openstack-keystone | 13:05 | |
| nishaYadav | o/ | 13:06 |
| nishaYadav | samueldmq, good morning | 13:06 |
| amakarov | ayoung, thank you | 13:07 |
| samueldmq | nishaYadav: hey | 13:07 |
| *** edmondsw has joined #openstack-keystone | 13:11 | |
| *** lifeless has quit IRC | 13:11 | |
| *** spzala_ has joined #openstack-keystone | 13:19 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Add prepare_ldap command https://review.openstack.org/343028 | 13:24 |
| *** su_zhang has quit IRC | 13:24 | |
| *** su_zhang has joined #openstack-keystone | 13:25 | |
| *** lifeless has joined #openstack-keystone | 13:29 | |
| *** su_zhang has quit IRC | 13:29 | |
| *** ashyoung has joined #openstack-keystone | 13:32 | |
| *** jpena is now known as jpena|brb | 13:33 | |
| lbragstad | dolphm I did some thinking about the max_active_keys default for credential encryption - here is what i came up with - https://review.openstack.org/#/c/354495/3 | 13:33 |
| patchbot | lbragstad: patch 354495 - keystone - Add conf to support credential encryption | 13:33 |
| lbragstad | dolphm i left a comment there explain my thought process, but I would appreciate any holes that could be poked | 13:34 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add ec2 functional tests https://review.openstack.org/350245 | 13:36 |
| *** catintheroof has joined #openstack-keystone | 13:36 | |
| nishaYadav | samueldmq, rodrigods please have a look, the tests are failing in my VM | 13:37 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Replace the content type with correct one https://review.openstack.org/349249 | 13:40 |
| *** ashyoung has quit IRC | 13:43 | |
| *** catintheroof has quit IRC | 13:43 | |
| dstanek | lbragstad: i'm going to punt on te uuid vs. fernet behavior for right now | 13:46 |
| lbragstad | dstanek for the 403 versus 401? | 13:47 |
| *** erhudy has joined #openstack-keystone | 13:48 | |
| dstanek | lbragstad: yeah, i can work on that after the cching bug...just going to override the test if i can | 13:48 |
| lbragstad | dstanek I have a patch for that | 13:48 |
| dstanek | lbragstad: oh, nice. what's the gerrit #? | 13:48 |
| lbragstad | dstanek https://review.openstack.org/#/c/350704/2/keystone/tests/unit/test_auth.py | 13:49 |
| patchbot | lbragstad: patch 350704 - keystone - Make all token provider behave the same with trusts | 13:49 |
| lbragstad | dstanek feel free to steal that if you want to | 13:49 |
| lbragstad | I spent a good day trying to figure all that out a couple weeks ago - i left as much of a description in the comments as i could | 13:49 |
| lbragstad | dstanek which is pretty much what we talked about last week | 13:49 |
| *** ashyoung has joined #openstack-keystone | 13:50 | |
| dstanek | lbragstad: once these tests are done running i'll rebase on top of that and see what happens | 13:51 |
| *** amoralej has joined #openstack-keystone | 13:51 | |
| lbragstad | dstanek cool | 13:51 |
| lbragstad | dstanek I'm not sure how much of that patch you'll need but - feel free to incorporate it into your if that's easier | 13:52 |
| lbragstad | yours* | 13:52 |
| *** tonytan4ever has joined #openstack-keystone | 13:53 | |
| *** permalac has joined #openstack-keystone | 13:53 | |
| *** haplo37__ has joined #openstack-keystone | 13:55 | |
| *** ashyoung has quit IRC | 13:56 | |
| *** jpena|brb is now known as jpena | 13:58 | |
| *** ashyoung has joined #openstack-keystone | 14:00 | |
| *** guoshan has quit IRC | 14:02 | |
| *** jistr is now known as jistr|debug | 14:03 | |
| dstanek | yeah, not good http://paste.openstack.org/show/558396/ | 14:05 |
| lbragstad | ooo - ouch | 14:05 |
| dstanek | that's what happens when you misplace a comma | 14:06 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add conf to support credential encryption https://review.openstack.org/354495 | 14:06 |
| stevemar | amakarov: yay it was approved | 14:11 |
| amakarov | stevemar, cool! I can continue with trust using delegation! | 14:12 |
| *** su_zhang has joined #openstack-keystone | 14:13 | |
| amakarov | stevemar, there is a problem there: tons of logic is performed in controller and uses request context. Should I tear it out and move to the manager or leave it be and make delegation changes in the controller? | 14:14 |
| *** tqtran has joined #openstack-keystone | 14:14 | |
| openstackgerrit | Merged openstack/keystone: Make a FernetUtils class https://review.openstack.org/353761 | 14:14 |
| *** BjoernT has joined #openstack-keystone | 14:14 | |
| * amakarov wishes to do the former | 14:15 | |
| *** jaosorior has quit IRC | 14:17 | |
| *** asettle has quit IRC | 14:18 | |
| *** su_zhang has quit IRC | 14:18 | |
| *** tqtran has quit IRC | 14:18 | |
| *** asettle has joined #openstack-keystone | 14:18 | |
| *** edtubill has joined #openstack-keystone | 14:19 | |
| *** asettle has quit IRC | 14:23 | |
| *** edtubill has quit IRC | 14:23 | |
| *** su_zhang has joined #openstack-keystone | 14:26 | |
| stevemar | amakarov: it should probably go in the manager, try refactoring it, if it gets ugly... use your best judgement :) | 14:28 |
| *** mnikolaenko_ has quit IRC | 14:29 | |
| *** ravelar has joined #openstack-keystone | 14:29 | |
| lbragstad | stevemar words of wisdom right there | 14:30 |
| *** ravelar has quit IRC | 14:30 | |
| *** ravelar has joined #openstack-keystone | 14:30 | |
| *** edtubill has joined #openstack-keystone | 14:31 | |
| *** spedione|AWAY is now known as spedione | 14:31 | |
| *** michauds has joined #openstack-keystone | 14:35 | |
| *** jed56 has quit IRC | 14:35 | |
| *** asettle has joined #openstack-keystone | 14:35 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 auth https://review.openstack.org/355980 | 14:36 |
| nishaYadav | samueldmq, rodrigods please have a look ^ | 14:37 |
| *** links has quit IRC | 14:39 | |
| robcresswell | stevemar: We ran into some oddities with testing in d_o_a and keystoneclient due to requests 2.11.0. It appears to just be an incomplete mock on our side, but I wanted to flag it in case you see any similar issues. | 14:43 |
| robcresswell | https://bugs.launchpad.net/django-openstack-auth/+bug/1613740 | 14:43 |
| openstack | Launchpad bug 1613740 in django-openstack-auth "All test are broken" [Critical,In progress] - Assigned to Rob Cresswell (robcresswell) | 14:43 |
| robcresswell | As I said, got a fix up, but just in case anyone finds something strange it might be useful as a reference. | 14:44 |
| openstackgerrit | David Stanek proposed openstack/keystone: WIP: Removes extra verbose revocation logging https://review.openstack.org/355989 | 14:44 |
| *** jistr|debug is now known as jistr | 14:50 | |
| *** hatTip has joined #openstack-keystone | 14:50 | |
| *** hatTip has left #openstack-keystone | 14:51 | |
| *** hatTip has joined #openstack-keystone | 14:51 | |
| *** ashyoung has quit IRC | 14:52 | |
| *** woodburn has joined #openstack-keystone | 14:52 | |
| *** LamT_ has joined #openstack-keystone | 14:53 | |
| zzzeek | amakarov: looking | 14:54 |
| *** permalac has quit IRC | 14:58 | |
| *** su_zhang has quit IRC | 15:03 | |
| *** su_zhang has joined #openstack-keystone | 15:04 | |
| *** su_zhang_ has joined #openstack-keystone | 15:05 | |
| *** su_zhang has quit IRC | 15:06 | |
| *** itisha has joined #openstack-keystone | 15:09 | |
| *** hockeynut has joined #openstack-keystone | 15:10 | |
| *** dikonoor has quit IRC | 15:11 | |
| *** michauds has quit IRC | 15:15 | |
| *** josecastroleon has quit IRC | 15:15 | |
| *** hockeynu_ has joined #openstack-keystone | 15:15 | |
| *** mfisch has joined #openstack-keystone | 15:15 | |
| *** mfisch has quit IRC | 15:15 | |
| *** mfisch has joined #openstack-keystone | 15:15 | |
| *** belmoreira has quit IRC | 15:17 | |
| *** hockeynut has quit IRC | 15:18 | |
| *** hatTip has quit IRC | 15:20 | |
| openstackgerrit | Sean Dague proposed openstack/keystone: Revert "Add debug logging to revocation event checking" https://review.openstack.org/356010 | 15:24 |
| *** michauds has joined #openstack-keystone | 15:30 | |
| stevemar | robcresswell: thanks for sharing! | 15:32 |
| stevemar | robcresswell: we were hit with one bug with requests 2.11.0, user agent string is now validated against a schema, it broke us | 15:33 |
| *** roxanaghe has joined #openstack-keystone | 15:35 | |
| *** su_zhang_ has quit IRC | 15:35 | |
| zzzeek | amakarov: done | 15:36 |
| amakarov | zzzeek, thanks! That blocks oslo.cache fix ) | 15:36 |
| *** su_zhang has joined #openstack-keystone | 15:38 | |
| *** edtubill has quit IRC | 15:38 | |
| *** slberger has joined #openstack-keystone | 15:39 | |
| *** andreykurilin has quit IRC | 15:41 | |
| robcresswell | stevemar:\o/ | 15:45 |
| *** rcernin has quit IRC | 15:46 | |
| *** haplo37__ has quit IRC | 15:47 | |
| dstanek | lbragstad: even with your patch keystone.tests.unit.test_auth.FernetAuthWithTrust.test_trust_get_token_fails_if_trustee_disabled seems to fail | 15:49 |
| dstanek | lbragstad: bot not working https://review.openstack.org/#/c/349704/ | 15:51 |
| patchbot | dstanek: patch 349704 - keystone - WIP: region namespace POC for cache invalidation | 15:51 |
| lbragstad | dstanek bot not working? | 15:52 |
| dstanek | i updated a change, but didn't see it show up here | 15:52 |
| lbragstad | dstanek oh | 15:53 |
| crinkle | for https://review.openstack.org/#/c/347543/ since this only needs to exist for one release should I propose it only to stable/mitaka or keep it in master and leave a TODO to remove it? | 15:53 |
| patchbot | crinkle: patch 347543 - keystone - Add dummy domain_id column to cached role | 15:53 |
| samueldmq | crinkle: fair question, perhaps master+TODO+backport is safer ? | 15:54 |
| crinkle | samueldmq: sounds good to me | 15:54 |
| samueldmq | dolphm: bknudson: stevemar ^ | 15:54 |
| dstanek | breton: https://review.openstack.org/#/c/349704/ has some updates | 15:54 |
| patchbot | dstanek: patch 349704 - keystone - WIP: region namespace POC for cache invalidation | 15:54 |
| samueldmq | crinkle: nice, just want to get someone else's opinion :) | 15:55 |
| bknudson | samueldmq: crinkle: if the bug doesn't exist on master then no need to propose a change there. | 15:56 |
| breton | dstanek: thanks, will have a look | 15:56 |
| stevemar | crinkle: i was going to get back to you about that tody | 15:56 |
| stevemar | crinkle: so i'm of bknudson's opinion, if it only needs to belong in mitaka, then let's just fix it there | 15:57 |
| dolphm | crinkle: can you not solve that issue by restarting memcache as part of the upgrade process? | 15:57 |
| *** wolsen has joined #openstack-keystone | 15:57 | |
| dstanek | breton: still a failing test that i need to fix | 15:57 |
| crinkle | dolphm: you can, i don't think it's desireable to add more upgrade steps though | 15:57 |
| stevemar | dolphm: would restarting memcache empty the cache? | 15:58 |
| crinkle | yes it does | 15:58 |
| bknudson | dolphm: memcache isn't the only dogpile backend. what about redis? | 15:58 |
| wolsen | stevemar, re: https://review.openstack.org/#/c/348040/4 - if there is little to no interest in this change, I'm happy to abandon it and free it from review queues | 15:58 |
| patchbot | wolsen: patch 348040 - keystone - Maintain ordered list for KVS token persistence | 15:58 |
| bknudson | also, this probably does need to be there for master to fix the problem, since the deployer might quickly go from mitaka to n. | 15:59 |
| breton | wolsen: the problem with that one is that very few people use kvs for tokens | 15:59 |
| stevemar | wolsen: let's see what dolphm thinks of it ^ i think there may be little to no interest in it (sorry!) | 15:59 |
| wolsen | breton, completely agreed that few people use it | 15:59 |
| breton | wolsen: and they generally are happy with it | 15:59 |
| stevemar | wolsen: i hope we don't discourage you from contributing other patches | 15:59 |
| breton | wolsen: because their load is not that big | 15:59 |
| wolsen | stevemar, oh don't be apologetic - I don't want to waste anyones time | 15:59 |
| crinkle | bknudson: the problem is only for liberty -> mitaka and i thought it was resolved yesterday that we only support n -1 -> n | 15:59 |
| stevemar | wolsen: comes with being canadian | 16:00 |
| breton | lol | 16:00 |
| wolsen | stevemar, bah that'd never discourage me :-) time is precious | 16:00 |
| bknudson | crinkle: you can go from n-1 -> n and then n -> n+1 . | 16:00 |
| stevemar | crinkle: that is correct, only n-1. so it would be going into liberty then | 16:00 |
| wolsen | ftr, the environment I was working with originally for that is moving to fernet tokens anyways, so its little and less value for us as well, but I thought someone might benefit | 16:01 |
| bknudson | crinkle: that's what deployers do. | 16:01 |
| crinkle | bknudson: ah yeah and then the cache would still have the wrong thing in it if you do it quickly | 16:01 |
| crinkle | gotcha | 16:01 |
| bknudson | it's not like you have to stop at m if you were at l. | 16:01 |
| *** edtubill has joined #openstack-keystone | 16:04 | |
| *** spedione is now known as spedione|AWAY | 16:06 | |
| *** sdake has quit IRC | 16:09 | |
| *** hockeynu_ has quit IRC | 16:10 | |
| *** asettle has quit IRC | 16:13 | |
| stevemar | crinkle: alright, let's get back to your patch | 16:15 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add auth functional tests https://review.openstack.org/356041 | 16:15 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 16:16 |
| stevemar | crinkle: should we add a note about removing the function in P or some non-sense, or let it live indefinitely | 16:16 |
| crinkle | ¯\_(ツ)_/¯ | 16:17 |
| stevemar | crinkle: :) | 16:17 |
| stevemar | crinkle: have you validated it manually? | 16:19 |
| stevemar | crinkle: maybe we can get mfisch to give it a ticky mark | 16:19 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 16:19 |
| mfisch | ? | 16:20 |
| stevemar | mfisch: https://bugs.launchpad.net/keystone/+bug/1592169 | 16:20 |
| openstack | Launchpad bug 1592169 in OpenStack Identity (keystone) "cached tokens break Liberty to Mitaka upgrade" [High,In progress] - Assigned to Colleen Murphy (krinkle) | 16:20 |
| crinkle | stevemar: yes it works on my machine but would be great to have someone double check | 16:20 |
| mfisch | yes thats annoying | 16:20 |
| mfisch | I have to shell into every node and run cache invalidation in a loop over and over during the upgrade | 16:20 |
| stevemar | mfisch: crinkle has a fix https://review.openstack.org/#/c/347543/ | 16:20 |
| patchbot | stevemar: patch 347543 - keystone - Add dummy domain_id column to cached role | 16:20 |
| *** adrian_otto has joined #openstack-keystone | 16:21 | |
| mfisch | ok if the fix works I'm on board | 16:21 |
| stevemar | mfisch: if you could test that out, it would be awesome. this one would be tricky to unit test | 16:21 |
| mfisch | I can but it might not be until tomorrow | 16:22 |
| mfisch | I'll get an L environment setup today | 16:22 |
| stevemar | mfisch: on a separate note, dstanek is working his butt off to fix the caching issues | 16:22 |
| mfisch | +1 | 16:22 |
| mfisch | +beer when I see him ;) | 16:22 |
| stevemar | crinkle: mfisch: the fix would only go into stable/mitaka IIUC | 16:22 |
| mfisch | yep | 16:22 |
| stevemar | since it's the upgrade process | 16:23 |
| stevemar | okay cool | 16:23 |
| stevemar | crinkle: i'll +2 and -W it so it doesn't get accidentally merged, but as soon as mfisch verifies, i'll pull the trigger | 16:23 |
| mfisch | ok | 16:23 |
| crinkle | cool | 16:23 |
| mfisch | I will start on the env now that will take a few hours but I'm out of the office all afternoon | 16:23 |
| stevemar | mfisch: s'all good, we have a good chunk of runway on our side still | 16:24 |
| mfisch | ok | 16:25 |
| mfisch | thx | 16:25 |
| stevemar | mfisch: it was all crinkle | 16:25 |
| mfisch | besides you guys should just trust all the code she writes | 16:25 |
| crinkle | lol | 16:25 |
| stevemar | mfisch: oh man, i totally do | 16:26 |
| stevemar | i've never seen a crinkle patch that isn't awesome | 16:26 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 16:26 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Create a fernet credential provider https://review.openstack.org/354496 | 16:27 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make KeyRepository shareable https://review.openstack.org/356053 | 16:27 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add create and update methods to credential Manager https://review.openstack.org/355056 | 16:28 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add key_hash column to credential table https://review.openstack.org/355618 | 16:38 |
| *** nishaYadav has quit IRC | 16:39 | |
| *** nishaYadav has joined #openstack-keystone | 16:39 | |
| *** hockeynut has joined #openstack-keystone | 16:40 | |
| *** thumpba has joined #openstack-keystone | 16:43 | |
| dstanek | lbragstad: two different test runs with two different exceptions for the same test. no code changes in between runs. http://paste.ubuntu.com/23062173/ | 16:43 |
| lbragstad | dstanek was that with my patch? | 16:46 |
| lbragstad | dstanek sync up after lunch? | 16:47 |
| *** esp has joined #openstack-keystone | 16:47 | |
| *** su_zhang has quit IRC | 16:48 | |
| *** nishaYadav has quit IRC | 16:49 | |
| *** nishaYadav has joined #openstack-keystone | 16:49 | |
| *** nishaYadav has quit IRC | 16:50 | |
| *** su_zhang has joined #openstack-keystone | 16:50 | |
| henrynash | rderose: hi | 16:55 |
| rderose | henrynash: hi | 16:55 |
| henrynash | rderose: so when you say the expand cycle should have its own repo...do you mean separate from the existing main repo? | 16:56 |
| openstackgerrit | Thomas Bechtold proposed openstack/keystone: Fix tempest.conf generation https://review.openstack.org/355723 | 16:57 |
| rderose | henrynash: yes | 16:57 |
| henrynash | rderose: what would go in the main one, as opposed to the otehr ones? | 16:58 |
| rderose | henrynash: so that expand migrate and contract all start with the same number | 16:58 |
| rderose | henrynash: main one from this point forward would just be around for a couple releases; then go away | 16:58 |
| henrynash | rderose: what's the advantage (given that most expand changes don't have migrate or contract equivilents) | 17:00 |
| *** edtubill has quit IRC | 17:00 | |
| *** su_zhang has quit IRC | 17:00 | |
| *** su_zhang has joined #openstack-keystone | 17:01 | |
| stevemar | dstanek you're looking fancy here: https://www.openstack.org/community/members/profile/10097 | 17:01 |
| rderose | henrynash: hmm... if they do though, then this will keep them together | 17:02 |
| *** hockeynut has quit IRC | 17:03 | |
| henrynash | rderose: ...and except for Newton...since our one contract is already in the main repo | 17:03 |
| henrynash | (the expand for our one contract....) | 17:03 |
| stevemar | henrynash: thanks for accepting my bikeshed comments :) | 17:04 |
| *** jaugustine has joined #openstack-keystone | 17:04 | |
| henrynash | rderose: I'm not sure it's worth trying to align them...in the latest patch I renamed the main repo to be the expand repo | 17:04 |
| henrynash | stevemar: just painting it red now, sir | 17:04 |
| rderose | henrynash: yeah, I saw that | 17:04 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Password expires ignore user list https://review.openstack.org/351749 | 17:05 |
| rderose | henrynash: I just think for debugging purpose, we'd want to keep the 3 changes in lock step | 17:05 |
| rderose | henrynash: don't you think? | 17:06 |
| rderose | henrynash: if you are making a change that requires expand, migrate, and contract, wouldn't you want them to all be the same version number? | 17:06 |
| stevemar | dolphm: abandon https://review.openstack.org/#/c/355095/ and look at the last 2 pci patches in https://review.openstack.org/#/q/topic:bp/pci-dss ? | 17:08 |
| patchbot | stevemar: patch 355095 - keystone - Fix nits in PCI-DSS Minimum password age requirements | 17:08 |
| henrynash | rderose: while that might be nice, it just seems like (given the history of changes) end up with lots of null migrations. Further, after experimenting with triggers, I suspect we'll have 2 migration numbers for an expand change that needs them (one to do the change and one to add the triggers) | 17:09 |
| *** david-lyle_ has joined #openstack-keystone | 17:09 | |
| *** tonytan4ever has quit IRC | 17:11 | |
| henrynash | ..since the triggers probably need to be written in raw sql, while the table changes can stay in a python migrate file...further complicating it | 17:11 |
| rderose | henrynash: good point | 17:11 |
| henrynash | (which you could of course also have null migrations for in the other repos) | 17:12 |
| henrynash | I was also trying to not change the migration version number of the main/expand repo for continuity, simplicity and backporting ease | 17:12 |
| *** david-lyle has quit IRC | 17:13 | |
| rderose | henrynash: still do it in one file though, if 'mysql': stmt = 'create trigger...' session.execute(stmt) | 17:13 |
| rderose | henrynash: but I see your point | 17:13 |
| stevemar | breton: still around? | 17:13 |
| *** david-lyle_ is now known as david-lyle | 17:13 | |
| henrynash | rderose: you can, although multiple (sql) statement lines can get tricky... | 17:14 |
| rderose | :) | 17:14 |
| henrynash | rderose: I started out that way, and had to revert to raw sql | 17:14 |
| *** amoralej is now known as amoralej|off | 17:15 | |
| rderose | henrynash: I see, yeah I imagine the triggers are going to be tricky. haven't got into postgres triggers yet. | 17:16 |
| henrynash | rderose: see: https://review.openstack.org/#/c/354343/ ...and the postgresql ones are still not working yet | 17:17 |
| patchbot | henrynash: patch 354343 - keystone - POC of data migration using database triggers | 17:17 |
| rderose | henrynash: okay | 17:17 |
| *** spedione|AWAY is now known as spedione | 17:19 | |
| *** tqtran has joined #openstack-keystone | 17:19 | |
| breton | stevemar: yes | 17:21 |
| stevemar | breton: added comments to your prep-ldap patch, it's looking close | 17:21 |
| breton | stevemar: thanks, will address after the meeting | 17:22 |
| *** esp has quit IRC | 17:23 | |
| *** tonytan4ever has joined #openstack-keystone | 17:26 | |
| dolphm | stevemar: abandoned - i meant to abandon it earlier | 17:26 |
| *** gyee has joined #openstack-keystone | 17:30 | |
| *** ChanServ sets mode: +v gyee | 17:30 | |
| *** Gorian|work has joined #openstack-keystone | 17:32 | |
| breton | dstanek: your patch works! | 17:34 |
| dolphm | henrynash: what is your concern with having empty migration scripts? | 17:35 |
| breton | dstanek: i even understood how it works | 17:35 |
| breton | dstanek: could you please add some comments? | 17:35 |
| dolphm | henrynash: we have them today, and we have empty downgrades today -- i see above you pointed out that they could cause confusion, but the ones we have today don't seem to cause any confusion. | 17:36 |
| dolphm | henrynash: furthermore, having expand, migrate, and contract repos that have related (usually equal) version numbers should actually eliminate more confusion for deployers than empty migrations would ever cause | 17:37 |
| henrynash | dolphm: nothing in particular (other than we'll have a lot of them)...I also didn't really want to change the migrate version of the main/expand repo | 17:37 |
| breton | dstanek: also, my biggest concern is that it overrides all the stuff related to "invalidation strategies" pushed by amakarov to dogpile. But it will work for us for master and should be safe to backport to mitaka | 17:37 |
| dolphm | henrynash: you shouldn't have to touch the legacy repository for any of this work | 17:37 |
| breton | dstanek: nice work, i will comment on the review in a couple of hours | 17:37 |
| dolphm | henrynash: why would you have to change the migration version there? | 17:37 |
| dolphm | henrynash: keeping the 3 new repos essentially in lock step with each other allows us to trivially prevent deployers from shooting themselves in the foot, by accidentally running repositories out of order | 17:38 |
| henrynash | dolphm: what I mean is that "version" is the Newton DB? | 17:38 |
| dolphm | henrynash: ? | 17:38 |
| henrynash | dolphm: it would have a main_repo version and an expand repo version (which would be 0), since all teh "expand" changes for Newton are in the main repo | 17:39 |
| *** pnavarro has quit IRC | 17:40 | |
| dolphm | henrynash: so, the legacy repository would stop at whatever version we last landed a migration at, and the expand, migrate, and contract repos would start at 0 (or 1, with the first migration there) | 17:40 |
| breton | stevemar: https://bugs.launchpad.net/oslo.cache/+bug/1590779 is fixed by patch https://review.openstack.org/#/c/349704/. | 17:40 |
| openstack | Launchpad bug 1590779 in oslo.cache "Cache region invalidation works for local CacheRegion object only" [Undecided,In progress] - Assigned to Alexander Makarov (amakarov) | 17:40 |
| patchbot | breton: patch 349704 - keystone - WIP: region namespace POC for cache invalidation | 17:40 |
| breton | i like how the bots work together | 17:41 |
| henrynash | dolphm: I was trying to be cautious for Newton and basically treat the main repo as the expand repo | 17:42 |
| henrynash | (since that's what it is_ | 17:42 |
| dolphm | henrynash: how is that cautious? | 17:42 |
| henrynash | ) | 17:42 |
| dolphm | henrynash: i must not understand the issue you're trying to prevent? | 17:42 |
| henrynash | It's just less change (well it would have been if a certain someone didn't want me to change the name of it! | 17:43 |
| dolphm | henrynash: why did you need to rename it? | 17:44 |
| *** esp has joined #openstack-keystone | 17:44 | |
| henrynash | dolphm: I didn't *have* to rename it....but assuming we were treating it as the expand repo, then there is an arguemnt to call to something tahat describes that | 17:45 |
| henrynash | dolphm: which I do undestand is not something you want to do anywya | 17:46 |
| dolphm | henrynash: okay, so why do we have to repurpose the repo at all? there are substantial benefits to creating 3 new repos to replace the existing one, and it's more complicated to try to repurpose the old repo | 17:46 |
| dolphm | henrynash: i'm skimming back through the last day of review comments on https://review.openstack.org/#/c/349939/ -- is there one i missed that has some reasoning? | 17:48 |
| patchbot | dolphm: patch 349939 - keystone - Add data migration and contract schema logic to ke... | 17:48 |
| henrynash | dolphm: was just trying to change as little conceptually as possible...especially as Newton is almost entirely additive | 17:48 |
| *** ravelar has quit IRC | 17:48 | |
| henrynash | dolphm: I certainly considered doing exactly what you (and rderose) is suggesting....and am OK with doing it, if people would prefer that balance of changes | 17:49 |
| dolphm | henrynash: so, to avoid change, you've changed the purpose of the legacy repo? :P | 17:49 |
| henrynash | dolpm: since we only allow additive changes in it....it is indeed the expand repo! | 17:50 |
| henrynash | dolphm: remember that for Newton, we have restricted the changes we allow in it | 17:51 |
| dolphm | henrynash: but that's only true by coincidence, we can't rewrite our migration history, and we can introduce a changeover to the new repositories at literally any moment - we don't have to wait for a major release to cut over | 17:52 |
| *** gagehugo has joined #openstack-keystone | 17:52 | |
| henrynash | dolphm: (agree to all that).....and so having said all this, if people feel strongly that they would prefer the the 3 (new) repo approach, I'm OK with that...the change are not that hard | 17:53 |
| dolphm | henrynash: does anyone feel strongly otherwise? if so, what is the reasoning? | 17:53 |
| *** sdake has joined #openstack-keystone | 17:55 | |
| *** tqtran has quit IRC | 17:55 | |
| henrynash | stevemar, dstanek: you're probably both the closest to this (I know rderose's view already) ^ | 17:56 |
| *** ravelar has joined #openstack-keystone | 17:56 | |
| * breton will miss the meeting unfortunatelly, but will catch up | 17:56 | |
| henrynash | stevemar, dstanek: the question being do we close the main repo and restart with new expand repo | 17:57 |
| *** shaleh has joined #openstack-keystone | 17:57 | |
| stevemar | breton: thanks for the heads up | 17:57 |
| *** tqtran has joined #openstack-keystone | 17:58 | |
| *** tonytan4ever has quit IRC | 17:59 | |
| stevemar | henrynash: sorry, was on a call, i will weigh-in in the code review | 17:59 |
| henrynash | stevemar:ok | 17:59 |
| stevemar | ajayaa, amakarov, ayoung, breton, browne, crinkle, claudiub, davechen, david8hu, dolphm, dstanek, edmondsw, gagehugo, gyee, henrynash, hogepodge, htruta, jamielennox, jaugustine, joesavak, jorge_munoz, knikolla, lbragstad, MaxPC, morgan, nkinder, notmorgan, raildo, rodrigods, rderose, roxanaghe, samleon, samueldmq, shaleh, stevemar, tsymanczyk, topol, vivekd, wanghong, xek goto meeting! | 17:59 |
| rderose | stevemar should be a politician | 17:59 |
| stevemar | rderose: oh? | 18:00 |
| stevemar | rderose: you calling me a liar?! (or a spy :) ) | 18:00 |
| rderose | stevemar: both! | 18:00 |
| rderose | jk | 18:00 |
| stevemar | rderose: zing! | 18:00 |
| *** ravelar has quit IRC | 18:01 | |
| *** ravelar has joined #openstack-keystone | 18:01 | |
| *** rcernin has joined #openstack-keystone | 18:01 | |
| *** tqtran has quit IRC | 18:03 | |
| dolphm | henrynash: if you're interested, i put together a demo of a real 3-phase migration using sqlite, and two application scripts that read and write to two completely different schemas during the migration phase https://gist.github.com/dolph/72dae9391ec4e13444498f977bc92ad9 | 18:03 |
| *** code-R has joined #openstack-keystone | 18:06 | |
| *** tqtran has joined #openstack-keystone | 18:12 | |
| *** code-R has quit IRC | 18:14 | |
| *** tqtran has quit IRC | 18:19 | |
| *** jaosorior has joined #openstack-keystone | 18:21 | |
| openstackgerrit | Merged openstack/keystone: Revert "Add debug logging to revocation event checking" https://review.openstack.org/356010 | 18:24 |
| openstackgerrit | Merged openstack/keystone: api-ref: Document implied roles API https://review.openstack.org/355219 | 18:24 |
| *** jaosorior has quit IRC | 18:25 | |
| *** tqtran has joined #openstack-keystone | 18:32 | |
| *** michauds has quit IRC | 18:34 | |
| *** mvk has quit IRC | 18:38 | |
| *** michauds has joined #openstack-keystone | 18:46 | |
| *** su_zhang has quit IRC | 18:49 | |
| stevemar | amakarov: ping | 18:50 |
| amakarov | stevemar, o/ | 18:50 |
| stevemar | amakarov: i'm not sure why the peformance bot is showing an improvement for precaching tokens | 18:51 |
| stevemar | amakarov: do you have another way of showing that caching improves perf? | 18:51 |
| stevemar | rather, pre-caching ... | 18:51 |
| stevemar | amakarov: just want to set the expectation that unless we can get some metrics, i may bump this to ocata. are you okay with that? | 18:52 |
| amakarov | stevemar, I have only manual tests | 18:52 |
| stevemar | amakarov: :( | 18:52 |
| stevemar | amakarov: the code is fine, i just don't want to merge things that are on critical paths so late in the cycle | 18:53 |
| stevemar | without firm results saying that things are improved | 18:53 |
| stevemar | i hope you understand :) | 18:53 |
| amakarov | stevemar, I understand | 18:53 |
| amakarov | stevemar, Just how firm results may look like? ) | 18:54 |
| stevemar | amakarov: anything, a script folks can run, the perf bot, i assumed you would use rally or something *shrugs* | 18:54 |
| amakarov | stevemar, the only difference is in first validation | 18:54 |
| knikolla | so maybe a script that gets a token, and then calls validate on it, repeat 1000 times? | 18:55 |
| amakarov | btw, a script... | 18:55 |
| knikolla | and time it | 18:55 |
| amakarov | knikolla, that I can do | 18:55 |
| stevemar | something repeatable | 18:55 |
| amakarov | stevemar, are you ok if I prepare a gist with a script tomorrow? | 18:55 |
| stevemar | amakarov: of course! | 18:56 |
| amakarov | stevemar, it's 10PM for me now )) | 18:56 |
| stevemar | amakarov: go to bed ! :) | 18:56 |
| henrynash | dolphm: cool...my POC used different tables, and there are some additional issues (like not creating an infinite loop), but all seem solveable | 18:56 |
| * amakarov goes to bed :) | 18:56 | |
| *** amakarov is now known as amakarov_away | 18:56 | |
| henrynash | dolphm: postgresql trigger syntax is a bit non-standard as well, so we will probably end up with writing separate .sql files for each db type | 18:57 |
| *** tonytan4ever has joined #openstack-keystone | 18:58 | |
| *** gagehugo has quit IRC | 19:00 | |
| *** edtubill has joined #openstack-keystone | 19:02 | |
| *** ezpz has joined #openstack-keystone | 19:02 | |
| *** edtubill has quit IRC | 19:04 | |
| *** fifieldt has quit IRC | 19:06 | |
| knikolla | in a multitenant application, if i want to cache keystone tokens received from a service provider (k2k) to avoid doing saml exchange again within a short period of time, what would be the most sensible way? barbican? | 19:09 |
| stevemar | knikolla: leave that up to the application, osc should use keyring and local cache, horizon does what it does | 19:10 |
| stevemar | rderose: oh btw, you owe me a ton of release notes and docs for PCI | 19:12 |
| stevemar | like a metric ton | 19:12 |
| knikolla | stevemar: does the keystoneauth library do any kind of caching? | 19:12 |
| stevemar | knikolla: it provides abstraction layers for others to implement | 19:12 |
| stevemar | knikolla: i just spoke with jamielennox about this last night | 19:13 |
| rderose | stevemar: docs, okay | 19:13 |
| rderose | stevemar: and release notes | 19:13 |
| *** edtubill has joined #openstack-keystone | 19:13 | |
| stevemar | rderose: ya damn straight | 19:13 |
| rderose | stevemar: dam | 19:13 |
| *** sdake_ has joined #openstack-keystone | 19:14 | |
| *** asettle has joined #openstack-keystone | 19:14 | |
| *** sdake has quit IRC | 19:14 | |
| rderose | stevemar: yes sir | 19:14 |
| knikolla | stevemar: cool. can you point me to any kind of documentation? the service i'm writing is basically a proxy which sits in front of the cinder/glance endpoints and may forward the requests to cinder/glance in service providers federated through k2k (swapping the token in the header) | 19:15 |
| *** sdake_ has quit IRC | 19:15 | |
| ayoung | does run_test.sh have any reason to continue to exist? | 19:16 |
| *** sdake has joined #openstack-keystone | 19:16 | |
| stevemar | ayoung: *you* were the one that wanted it around! :) | 19:17 |
| stevemar | ayoung: but no | 19:17 |
| stevemar | it can die | 19:17 |
| ayoung | stevemar, I wanted it to continue to document how to run the tests | 19:17 |
| ayoung | but it does not seem to work anymore | 19:17 |
| stevemar | knikolla: whatever happened to your k2k patch for osc | 19:17 |
| stevemar | ayoung: rip er our | 19:17 |
| stevemar | out | 19:17 |
| knikolla | stevemar: i was waiting for the osc_libs patches to merge | 19:18 |
| *** edtubill has quit IRC | 19:18 | |
| ayoung | stevemar, ah...must be just in older code. Looks like it is gone in master | 19:18 |
| stevemar | knikolla: thats mostly done | 19:18 |
| knikolla | stevemar: this is to get nova to attach remote volumes. as the nova guys didn't really like our changes to be in nova. so we made a proxy. | 19:18 |
| *** fifieldt has joined #openstack-keystone | 19:18 | |
| knikolla | stevemar: cool. then i'll also update the patch for osc. | 19:20 |
| stevemar | knikolla: you could add caching support to osc :P | 19:20 |
| openstackgerrit | Merged openstack/keystone: Pass key_repository and max_active_keys to FernetUtils https://review.openstack.org/353762 | 19:20 |
| openstackgerrit | Merged openstack/keystone: Add credential encryption exception https://review.openstack.org/354494 | 19:20 |
| *** asettle has quit IRC | 19:21 | |
| ayoung | dstanek what uis the least overhead, bestest way to run unit tests agaisnt our Keystone repo. Specifically, I want to run only one test keystone.tests.test_v3_identity.IdentityTestCase.test_delete_user_and_check_role_assignment_fails | 19:21 |
| knikolla | stevemar: for the k2k tokens? sure | 19:21 |
| ayoung | I have the py27 venv activated | 19:21 |
| ayoung | testr? some other tool? | 19:21 |
| stevemar | knikolla: osc lacks caching in general | 19:22 |
| stevemar | :( | 19:22 |
| ayoung | python -m unittest ? | 19:22 |
| knikolla | stevemar: hmmmm ok. any pointers on the abstraction keystoneauth provides for caching? | 19:24 |
| *** roxanaghe has quit IRC | 19:25 | |
| ayoung | Ah... old oslo-utils | 19:25 |
| ayoung | knikolla, Um I think caching is not done in auth | 19:26 |
| ayoung | it is done in the client | 19:26 |
| ayoung | look in the code repo, though | 19:26 |
| *** edtubill has joined #openstack-keystone | 19:27 | |
| knikolla | ayoung: from the keystoneauth docs | 19:28 |
| ayoung | knikolla, read the code, not the docs | 19:28 |
| knikolla | ~keystoneauth1.plugin.BaseAuthPlugin.get_token` is called to retrieve the string token from a plugin. It is intended that a plugin will cache a received token and so if the token is still valid then it should be re-used rather than fetching a new one. | 19:28 |
| ayoung | but you should have learned by now that I lie | 19:28 |
| *** edtubill has quit IRC | 19:28 | |
| ayoung | knikolla, in that case, the auth plugin just maintains a pointer to the python object | 19:28 |
| ayoung | that is what is meant by caching there, not something like memcache | 19:29 |
| knikolla | ayoung: well, it didn't say it does cache. it said the plugin should. i assume it doesn't. | 19:29 |
| *** gagehugo has joined #openstack-keystone | 19:29 | |
| ayoung | knikolla, start here http://git.openstack.org/cgit/openstack/keystoneauth/tree/keystoneauth1/identity/base.py#n89 | 19:30 |
| *** edtubill has joined #openstack-keystone | 19:30 | |
| *** code-R has joined #openstack-keystone | 19:30 | |
| *** gagehugo has quit IRC | 19:30 | |
| ayoung | knikolla, and know that it won't be called a :token: it will be an auth_ref | 19:31 |
| ayoung | or access_info | 19:31 |
| knikolla | ayoung: thanks. i'll have a look. | 19:31 |
| ayoung | or whatever you want to call the wrapper around the data returned from the token...the token will be there, as a blob, somewhere ,too | 19:31 |
| *** code-R_ has joined #openstack-keystone | 19:32 | |
| ayoung | knikolla, for example, from the session | 19:32 |
| ayoung | http://git.openstack.org/cgit/openstack/keystoneauth/tree/keystoneauth1/session.py#n749 | 19:32 |
| stevemar | knikolla: honestly i'd bug jamielennox and dtroyer i think both of them have planned out the whole thing in their head, they just need time (or someone else) to implement it | 19:33 |
| stevemar | knikolla: want me to reach out to them for ya? | 19:33 |
| *** tqtran has quit IRC | 19:34 | |
| knikolla | stevemar: sure. if they want to spec out something i can go ahead and implement it. and that would solve the osc case. | 19:34 |
| knikolla | ayoung: thanks, i'll do a deep dive into keystonauth and see. | 19:34 |
| ayoung | Use the source! | 19:34 |
| knikolla | ayoung: my main concern was securely caching tokens to service providers in a multitenant proxy. | 19:35 |
| *** code-R has quit IRC | 19:35 | |
| ayoung | stevemar, BTW, I am probably going to be pushing a Fernet key sync strategy using a technology called Custodia. It is something our team has been developing for dealing with shared secrets. At some level, I suspect it will look a lot like Barbican, but Barbican needs Keystone...chicken/egg | 19:36 |
| ayoung | knikolla, the more I parse that statement, the more scared I get. | 19:36 |
| knikolla | ayoung: i kind of agree. but nova makes 4 successive calls to cinder to attach a volume. it would be preferable to not do SAML exchange to the remote service provider and token scoping 4 times to do a call to the remote cinder. | 19:38 |
| *** manous has quit IRC | 19:40 | |
| dtroyer | knikolla: are those nova calls from a long-running service or from a client that re-loads, like a CLI might? | 19:40 |
| knikolla | dtroyer: the calls are from nova itself, but they go through a proxy. the proxy figures out in which service provider the volume/image is, gets a SAML assertion and a token for the remote cinder/glance and forwards the original request and the response back to the callee. | 19:42 |
| dtroyer | so the calls are stateless? ie, you can't keep the Session object around long enough to maintain the auth_ref? | 19:43 |
| knikolla | dtroyer: they are different calls from nova (is volume available, set attaching, set attached, etc), so they are stateless. the only thing they have in common is the x-auth-token and therefore user,project,etc. | 19:44 |
| openstackgerrit | Merged openstack/keystone: Add support for rolling upgrades to keystone-manage https://review.openstack.org/349716 | 19:46 |
| dtroyer | so ya, you would have to do the caching of Session yourself, but that's really all you need to do, keep the Session around long enough to find it later, and have enough info to validate that you're not using the wrong one or that it has expired, which you'll get the first time | 19:46 |
| *** tqtran has joined #openstack-keystone | 19:47 | |
| dtroyer | this essentially is what we'll do in OSC to cache auth between CLI invocations. the hard part for us is securing the bits on disk; you can do it in memory so that should be easier | 19:47 |
| *** hockeynut has joined #openstack-keystone | 19:48 | |
| knikolla | dtroyer: true. an in-memory structure would work in my case. as for osc, i'd like to help when you start working on it. | 19:49 |
| dtroyer | great! It'll definately be post-3.0, I've been saying Real Soon Now for far too ling, so I'm not going to say that now | 19:50 |
| *** hockeynut has quit IRC | 19:53 | |
| knikolla | dtroyer: cool. | 19:53 |
| *** gagehugo has joined #openstack-keystone | 19:53 | |
| *** hockeynut has joined #openstack-keystone | 19:54 | |
| *** su_zhang has joined #openstack-keystone | 19:55 | |
| bknudson | Is there a reason why "Loaded 2 encryption keys (max_active_keys=3) from: /etc/keystone/fernet-keys/" needs to be info? | 19:55 |
| *** asettle has joined #openstack-keystone | 19:59 | |
| *** asettle has quit IRC | 19:59 | |
| *** tqtran has quit IRC | 19:59 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make KeyRepository shareable https://review.openstack.org/356053 | 20:01 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add conf to support credential encryption https://review.openstack.org/354495 | 20:01 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add key_hash column to credential table https://review.openstack.org/355618 | 20:01 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add create and update methods to credential Manager https://review.openstack.org/355056 | 20:01 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Create a fernet credential provider https://review.openstack.org/354496 | 20:01 |
| *** julim has quit IRC | 20:03 | |
| *** tqtran has joined #openstack-keystone | 20:05 | |
| *** edtubill has quit IRC | 20:07 | |
| *** slberger has quit IRC | 20:09 | |
| *** Trixboxer has quit IRC | 20:09 | |
| *** slberger has joined #openstack-keystone | 20:14 | |
| *** tqtran has quit IRC | 20:16 | |
| lbragstad | samueldmq added an explanation here - https://review.openstack.org/#/c/356053/1 | 20:19 |
| patchbot | lbragstad: patch 356053 - keystone - Make KeyRepository shareable | 20:19 |
| lbragstad | samueldmq let me know if that makes sense | 20:19 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add conf to support credential encryption https://review.openstack.org/354495 | 20:20 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Add prepare_ldap command https://review.openstack.org/343028 | 20:22 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make KeyRepository shareable https://review.openstack.org/356053 | 20:26 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add key_hash column to credential table https://review.openstack.org/355618 | 20:26 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add create and update methods to credential Manager https://review.openstack.org/355056 | 20:26 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Create a fernet credential provider https://review.openstack.org/354496 | 20:26 |
| *** Trixboxer has joined #openstack-keystone | 20:26 | |
| stevemar | dolphm: your -1 in this patch was after it merged :( https://review.openstack.org/#/c/349716/14 | 20:30 |
| patchbot | stevemar: patch 349716 - keystone - Add support for rolling upgrades to keystone-manage (MERGED) | 20:30 |
| *** tqtran has joined #openstack-keystone | 20:31 | |
| *** tqtran has quit IRC | 20:34 | |
| stevemar | henrynash: thanks :) | 20:35 |
| *** tqtran has joined #openstack-keystone | 20:42 | |
| *** roxanaghe has joined #openstack-keystone | 20:44 | |
| *** tqtran has quit IRC | 20:48 | |
| *** edtubill has joined #openstack-keystone | 20:52 | |
| samueldmq | lbragstad: replied. I agree with you | 20:55 |
| samueldmq | lbragstad: but does not max_active_keys need to be put in the config_fixture? In this case at least for the fernet case? | 20:57 |
| *** tonytan4ever has quit IRC | 20:59 | |
| *** raildo has quit IRC | 21:01 | |
| *** erhudy has quit IRC | 21:02 | |
| *** tqtran has joined #openstack-keystone | 21:07 | |
| *** mdurrant_ has joined #openstack-keystone | 21:09 | |
| *** pauloewerton has quit IRC | 21:12 | |
| *** mdurrant has quit IRC | 21:12 | |
| lbragstad | samueldmq it doesn't need to be in the config fixture - we will just make sure that when we do rotations we always set max_active_keys to 3 when dealing with credentials | 21:15 |
| *** gyee has quit IRC | 21:20 | |
| *** edtubill has quit IRC | 21:20 | |
| *** gagehugo has quit IRC | 21:22 | |
| *** mvk has joined #openstack-keystone | 21:23 | |
| *** spzala_ has quit IRC | 21:23 | |
| *** spzala has joined #openstack-keystone | 21:23 | |
| *** gyee has joined #openstack-keystone | 21:23 | |
| *** ChanServ sets mode: +v gyee | 21:23 | |
| jamielennox | knikolla: from a keystoneauth perspective the docs are basically https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/plugin.py#L207-L252 | 21:25 |
| jamielennox | knikolla: the first gives you a static ID to use, then there's a get and set state function | 21:25 |
| jamielennox | so get the ID for the plugin, check if state exists in your store under that plugin ID if so set it | 21:26 |
| jamielennox | when finished get the state and update your store | 21:26 |
| *** code-R_ has quit IRC | 21:26 | |
| *** rcernin has quit IRC | 21:27 | |
| knikolla | jamielennox: i see, thanks. that was really helpful. | 21:27 |
| *** spzala has quit IRC | 21:28 | |
| jamielennox | knikolla: also you should only need this really for CLI, anything else where you use the same session it will do the right thing with reusing tokens | 21:28 |
| knikolla | jamielennox: thats what i was planning to do. but eventually this stuff needs to be built for OSC, so it's good to know how it is expected to work. | 21:30 |
| *** spedione is now known as spedione|AWAY | 21:37 | |
| *** tqtran has quit IRC | 21:37 | |
| *** tqtran has joined #openstack-keystone | 21:37 | |
| *** adriant has joined #openstack-keystone | 21:37 | |
| *** tqtran has quit IRC | 21:42 | |
| *** ravelar has quit IRC | 21:43 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 21:47 |
| *** roxanaghe has quit IRC | 21:50 | |
| *** tqtran has joined #openstack-keystone | 21:54 | |
| *** edmondsw has quit IRC | 21:58 | |
| *** tqtran has quit IRC | 21:59 | |
| *** spzala has joined #openstack-keystone | 22:00 | |
| *** michauds has quit IRC | 22:02 | |
| *** tqtran has joined #openstack-keystone | 22:10 | |
| *** chrichip has quit IRC | 22:13 | |
| lbragstad | hmm - for some reason hints.add_filter('key', None) seems to be broken | 22:15 |
| lbragstad | if you're asking a backend for all entries where a specific key is None, it doesn't seem to work | 22:16 |
| lbragstad | yet - we seem to have places in keystone that use it https://github.com/openstack/keystone/blob/0b4f6ebdcc866388e1c6788f45f270414b45aeef/keystone/assignment/controllers.py#L437 | 22:17 |
| lbragstad | and here - https://github.com/openstack/keystone/blob/0b4f6ebdcc866388e1c6788f45f270414b45aeef/keystone/tests/unit/test_backend_sql.py#L506 | 22:18 |
| *** tqtran has quit IRC | 22:20 | |
| *** gordc has quit IRC | 22:22 | |
| bknudson | maybe it's different on sqlite than other dbs? | 22:24 |
| *** tqtran has joined #openstack-keystone | 22:27 | |
| *** sdake has quit IRC | 22:27 | |
| *** sdake has joined #openstack-keystone | 22:28 | |
| *** tqtran has quit IRC | 22:36 | |
| *** roxanaghe has joined #openstack-keystone | 22:37 | |
| *** adrian_otto has quit IRC | 22:38 | |
| *** tqtran has joined #openstack-keystone | 22:39 | |
| *** tqtran has quit IRC | 22:43 | |
| *** thumpba has quit IRC | 22:46 | |
| *** thumpba has joined #openstack-keystone | 22:49 | |
| *** thumpba has quit IRC | 22:49 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Faster id mapping lookup https://review.openstack.org/339294 | 22:49 |
| *** hockeynut has quit IRC | 22:55 | |
| *** chrichip has joined #openstack-keystone | 22:58 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add expand, data migration and contract logic to keystone-manage https://review.openstack.org/349939 | 22:59 |
| *** thumpba has joined #openstack-keystone | 22:59 | |
| *** spzala has quit IRC | 23:01 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add expand, data migration and contract logic to keystone-manage https://review.openstack.org/349939 | 23:01 |
| *** spzala has joined #openstack-keystone | 23:01 | |
| *** LamT_ has quit IRC | 23:01 | |
| *** ezpz has quit IRC | 23:03 | |
| *** asettle has joined #openstack-keystone | 23:05 | |
| *** tqtran has joined #openstack-keystone | 23:05 | |
| *** spzala has quit IRC | 23:06 | |
| *** chrichip has quit IRC | 23:07 | |
| *** asettle has quit IRC | 23:09 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Tidy up for late-breaking review comments on keystone-manage https://review.openstack.org/356158 | 23:10 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Set default value for [saml]/idp_contact_surname https://review.openstack.org/356160 | 23:12 |
| *** tqtran has quit IRC | 23:19 | |
| *** Gorian|work has quit IRC | 23:27 | |
| *** thumpba_ has joined #openstack-keystone | 23:37 | |
| *** thumpba has quit IRC | 23:39 | |
| *** shaleh has quit IRC | 23:39 | |
| *** tqtran has joined #openstack-keystone | 23:46 | |
| *** BjoernT has quit IRC | 23:47 | |
| *** tqtran has quit IRC | 23:51 | |
| *** tqtran has joined #openstack-keystone | 23:54 | |
| *** slberger has left #openstack-keystone | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!