| *** dikonoor has joined #openstack-keystone | 00:02 | |
| *** arunkant_ has quit IRC | 00:07 | |
| *** itisha has joined #openstack-keystone | 00:08 | |
| *** xenogear has joined #openstack-keystone | 00:10 | |
| *** jamielennox is now known as jamielennox|away | 00:33 | |
| *** jamielennox|away is now known as jamielennox | 00:46 | |
| *** su_zhang has quit IRC | 00:47 | |
| *** gyee has quit IRC | 00:48 | |
| *** Ephur has joined #openstack-keystone | 00:50 | |
| *** tqtran has quit IRC | 00:54 | |
| *** spzala has joined #openstack-keystone | 01:18 | |
| *** wangqun has joined #openstack-keystone | 01:20 | |
| *** spzala has quit IRC | 01:23 | |
| *** chlong has joined #openstack-keystone | 01:24 | |
| *** code-R has joined #openstack-keystone | 01:31 | |
| *** EinstCrazy has joined #openstack-keystone | 01:32 | |
| *** richm has quit IRC | 01:35 | |
| *** lamt_ has left #openstack-keystone | 01:57 | |
| *** lamt has joined #openstack-keystone | 01:59 | |
| *** davechen has joined #openstack-keystone | 02:03 | |
| *** jamielennox is now known as jamielennox|away | 02:04 | |
| *** code-R_ has joined #openstack-keystone | 02:10 | |
| *** EinstCrazy has quit IRC | 02:11 | |
| *** EinstCrazy has joined #openstack-keystone | 02:12 | |
| *** code-R has quit IRC | 02:13 | |
| stevemar | breton: thanks for the new patch! | 02:18 |
|---|---|---|
| *** EinstCra_ has joined #openstack-keystone | 02:19 | |
| *** EinstCrazy has quit IRC | 02:23 | |
| *** jamielennox|away is now known as jamielennox | 02:26 | |
| *** chlong has quit IRC | 02:29 | |
| *** asettle has joined #openstack-keystone | 02:30 | |
| *** asettle has quit IRC | 02:35 | |
| *** chlong has joined #openstack-keystone | 02:46 | |
| *** spzala has joined #openstack-keystone | 02:51 | |
| *** code-R_ has quit IRC | 03:01 | |
| *** code-R has joined #openstack-keystone | 03:01 | |
| *** ayoung has quit IRC | 03:22 | |
| *** woodster_ has quit IRC | 03:29 | |
| *** eandersson_ has joined #openstack-keystone | 03:30 | |
| *** spzala has quit IRC | 03:34 | |
| *** eandersson_ has quit IRC | 03:37 | |
| *** chlong has quit IRC | 03:39 | |
| *** code-R has quit IRC | 03:40 | |
| *** code-R has joined #openstack-keystone | 03:48 | |
| *** su_zhang has joined #openstack-keystone | 03:49 | |
| *** chlong has joined #openstack-keystone | 03:52 | |
| *** chlong has quit IRC | 04:10 | |
| *** links has joined #openstack-keystone | 04:15 | |
| *** chlong has joined #openstack-keystone | 04:23 | |
| *** code-R has quit IRC | 04:26 | |
| *** dims has quit IRC | 04:38 | |
| stevemar | rderose: hmm, are the ldap users supposed to be shadowed now? | 04:42 |
| stevemar | is it only on auth? | 04:42 |
| stevemar | probably, makes sense | 04:42 |
| *** dims has joined #openstack-keystone | 04:43 | |
| *** code-R has joined #openstack-keystone | 04:46 | |
| *** awayne_ has joined #openstack-keystone | 04:50 | |
| *** awayne has quit IRC | 04:50 | |
| *** awayne_ is now known as awayne | 04:50 | |
| *** GB21 has joined #openstack-keystone | 04:57 | |
| *** chlong has quit IRC | 05:12 | |
| mrhillsman | can someone help me understand why openstack client is trying to use http when i have set the endpoint to https? | 05:15 |
| *** code-R_ has joined #openstack-keystone | 05:16 | |
| mrhillsman | openstack endpoint list always comes back saying it cannot hit the http url | 05:16 |
| *** code-R has quit IRC | 05:19 | |
| *** sdake_ has quit IRC | 05:24 | |
| *** chlong has joined #openstack-keystone | 05:26 | |
| *** GB21 has quit IRC | 05:29 | |
| *** Ephur has quit IRC | 05:34 | |
| *** Ephur has joined #openstack-keystone | 05:34 | |
| *** Ephur has quit IRC | 05:39 | |
| *** GB21 has joined #openstack-keystone | 05:47 | |
| *** chlong has quit IRC | 05:52 | |
| *** sdake has joined #openstack-keystone | 05:59 | |
| *** su_zhang has quit IRC | 06:05 | |
| *** sdake has quit IRC | 06:08 | |
| *** ravelar has joined #openstack-keystone | 06:18 | |
| *** chlong has joined #openstack-keystone | 06:21 | |
| *** ravelar has quit IRC | 06:22 | |
| *** adriant has quit IRC | 06:35 | |
| *** itisha has quit IRC | 06:40 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Allow specifying client and service info to user_agent https://review.openstack.org/357633 | 06:40 |
| *** rcernin has joined #openstack-keystone | 06:41 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Allow specifying client and service info to user_agent https://review.openstack.org/357633 | 06:44 |
| *** jaosorior has joined #openstack-keystone | 06:55 | |
| *** tesseract- has joined #openstack-keystone | 06:56 | |
| *** marekd2 has joined #openstack-keystone | 07:16 | |
| *** jaosorior has quit IRC | 07:17 | |
| *** marekd2_ has joined #openstack-keystone | 07:18 | |
| *** marekd2_ has quit IRC | 07:18 | |
| *** marekd2_ has joined #openstack-keystone | 07:19 | |
| *** marekd2 has quit IRC | 07:20 | |
| *** jaosorior has joined #openstack-keystone | 07:22 | |
| *** GB21 has quit IRC | 07:28 | |
| *** pnavarro has joined #openstack-keystone | 07:42 | |
| *** dkehn_ has quit IRC | 07:46 | |
| *** zhangjl has joined #openstack-keystone | 07:57 | |
| *** zhangjl has left #openstack-keystone | 07:58 | |
| *** dkehn_ has joined #openstack-keystone | 07:59 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v2_0) https://review.openstack.org/267449 | 08:00 |
| *** openstackgerrit has quit IRC | 08:03 | |
| *** openstackgerrit has joined #openstack-keystone | 08:03 | |
| *** GB21 has joined #openstack-keystone | 08:04 | |
| *** aloga has quit IRC | 08:30 | |
| *** aloga has joined #openstack-keystone | 08:30 | |
| *** markvoelker has quit IRC | 08:30 | |
| *** asettle has joined #openstack-keystone | 08:36 | |
| *** Trixboxer has quit IRC | 08:40 | |
| *** eandersson_ has joined #openstack-keystone | 08:41 | |
| *** hoonetorg has quit IRC | 08:43 | |
| *** asettle has quit IRC | 08:53 | |
| *** hoonetorg has joined #openstack-keystone | 08:53 | |
| *** asettle has joined #openstack-keystone | 08:53 | |
| *** chlong has quit IRC | 09:03 | |
| *** davechen has left #openstack-keystone | 09:03 | |
| *** EinstCra_ has quit IRC | 09:08 | |
| *** EinstCrazy has joined #openstack-keystone | 09:10 | |
| samueldmq | jamielennox: hi, you around ? | 09:12 |
| samueldmq | jamielennox: nisha and I want to test the tokens manager (https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/tokens.py) | 09:14 |
| samueldmq | jamielennox: but we are not sure what's the best way to get a token _id or accessinfo for an arbitrary user (given its username/passwd) and a v3 client instance | 09:14 |
| samueldmq | do you have any recommendation? | 09:14 |
| samueldmq | jamielennox: I was thinking about instantiating another client using the passwd plugin, then get the token_id or accessinfo from there somehow | 09:19 |
| samueldmq | but maybe there is a easier way | 09:19 |
| samueldmq | stevemar: you might know something too ^ | 09:19 |
| samueldmq | :-) | 09:19 |
| breton | stevemar: shadow users get shadowed only on auth, yes | 09:19 |
| *** markvoelker has joined #openstack-keystone | 09:31 | |
| *** markvoelker has quit IRC | 09:36 | |
| *** jaosorior has quit IRC | 09:54 | |
| *** GB21 has quit IRC | 09:58 | |
| *** EinstCra_ has joined #openstack-keystone | 10:00 | |
| *** EinstCrazy has quit IRC | 10:02 | |
| *** EinstCra_ has quit IRC | 10:07 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 10:10 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 10:10 |
| *** jaosorior has joined #openstack-keystone | 10:14 | |
| *** markvoelker has joined #openstack-keystone | 10:32 | |
| *** mnikolaenko_ has joined #openstack-keystone | 10:32 | |
| odyssey4me | We're looking for a backport review urgently which is blocking upgrade tests from Liberty to Mitaka. Anyone around other than stevemar (who's already voted) to review? https://review.openstack.org/#/c/357415 | 10:34 |
| patchbot | odyssey4me: patch 357415 - keystone (stable/mitaka) - Add dummy domain_id column to cached role | 10:34 |
| *** markvoelker has quit IRC | 10:36 | |
| Jehane | Hi, I'm trying to setup an ldap domain for keystone and I have an issue with groups | 11:03 |
| Jehane | we are using groupOfMembers as describe in https://tools.ietf.org/html/draft-howard-rfc2307bis-02 | 11:03 |
| Jehane | is this supported ? The primary group is set by an attribute in the user DN | 11:04 |
| *** wangqun has quit IRC | 11:06 | |
| -openstackstatus- NOTICE: Precise tests on OSIC provider are currently failing, please stop your checks until the issue is resolved. | 11:16 | |
| -openstackstatus- NOTICE: DSVM jobs on OSIC currently failing because of IP collisions, fix is in the gate - https://review.openstack.org/#/c/357764/ - please hold rechecks until merged | 11:21 | |
| *** woodburn has quit IRC | 11:25 | |
| *** woodburn has joined #openstack-keystone | 11:26 | |
| *** code-R_ has quit IRC | 11:28 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Fix issue of password created_at being left as nullable https://review.openstack.org/357789 | 11:31 |
| *** markvoelker has joined #openstack-keystone | 11:32 | |
| *** markvoelker has quit IRC | 11:37 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Fix issue of password created_at being left as nullable https://review.openstack.org/357789 | 11:38 |
| *** jaosorior has quit IRC | 11:41 | |
| *** jaosorior has joined #openstack-keystone | 11:42 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Add mapping_populate command https://review.openstack.org/343028 | 11:48 |
| -openstackstatus- NOTICE: OSIC has burned through the problematic IP range with failures, things should be back to normal now. | 11:49 | |
| *** lamt has quit IRC | 11:51 | |
| *** julim has quit IRC | 11:57 | |
| *** amoralej is now known as amoralej|lunch | 11:58 | |
| *** dmellado is now known as dmellado|lunch | 12:02 | |
| *** dmellado|lunch is now known as dmellado | 12:02 | |
| *** jpena is now known as jpena|lunch | 12:05 | |
| *** rodrigods has quit IRC | 12:08 | |
| *** rodrigods has joined #openstack-keystone | 12:08 | |
| *** edmondsw has joined #openstack-keystone | 12:08 | |
| *** code-R has joined #openstack-keystone | 12:17 | |
| *** raildo has joined #openstack-keystone | 12:23 | |
| jamielennox | samueldmq: i'm just quickly checking this on my way to bed, but i wouldn't use the token manager for that at all | 12:23 |
| jamielennox | if you do auth_plugin.get_auth_ref(session) it'll give you an access info | 12:24 |
| jamielennox | auth_plugin.get_token_id() as well | 12:24 |
| *** lamt has joined #openstack-keystone | 12:24 | |
| *** gordc has joined #openstack-keystone | 12:24 | |
| jamielennox | the only thing i know that uses the token manager is the auth_token middleware doing a validate - but even that i want to just make a direct call | 12:25 |
| jamielennox | anyway - hope that helps | 12:25 |
| jamielennox | night | 12:25 |
| *** asettle has quit IRC | 12:26 | |
| *** mordred_ has joined #openstack-keystone | 12:27 | |
| *** asettle has joined #openstack-keystone | 12:28 | |
| *** pauloewerton has joined #openstack-keystone | 12:31 | |
| *** mordred_ is now known as sadmordred | 12:31 | |
| *** markvoelker has joined #openstack-keystone | 12:33 | |
| *** sdake has joined #openstack-keystone | 12:35 | |
| lbragstad | morning | 12:35 |
| dikonoor | dstanek:hi | 12:37 |
| *** markvoelker has quit IRC | 12:38 | |
| dikonoor | dstanek:I checked on what we discussed yesterday and for ldap/custom users (and I feel this should be happening for federated and sql users) there are entries made to 3 tables | 12:38 |
| dstanek | dikonoor: ? | 12:39 |
| dolphm | rderose: ^ | 12:39 |
| dstanek | dikonoor: what are you seeing happening and what are you expecting? | 12:41 |
| dikonoor | dstanek: I didnot really follow your ? ..so let me proceed..This is on the shadow user discussion we had yesterday. When a user is authenticated, the authenticate method tries to insert the user entry into the nolocal_user table and then calls this >> https://github.com/openstack/keystone/blob/master/keystone/identity/shadow_backends/sql.py#L91-L104 | 12:41 |
| dikonoor | dstanek: From the model of the User table , (if you see the setter method for domain_id) >>https://github.com/openstack/keystone/blob/master/keystone/identity/backends/sql_model.py#L28 | 12:42 |
| *** amakarov_away is now known as amakarov | 12:42 | |
| dikonoor | dstanek: it looks like the user table keeps only id and project_id info , the nonlocal_user table keeps the domain_id, user_id etc..However, as per what you mentioned yesterday, for ldap/custom users there should be entries only in user and nonlocal_user tables and not in the local_user table | 12:43 |
| dstanek | are you getting records in local_user for ldap authentications? | 12:44 |
| dikonoor | dstanek: yes | 12:44 |
| dstanek | i would not expect that. maybe a bug? | 12:45 |
| dstanek | i'll have to wait for rderose to comment since he has been implementing this. not sure it that's intentional or not. | 12:46 |
| dikonoor | dstanek: all 3 tables are populated. I think whenever one inserts an entry into the User table, there would be an entry added in the local_user table as well ..https://github.com/openstack/keystone/blob/master/keystone/identity/backends/sql_model.py#L147 | 12:46 |
| dolphm | dikonoor: that should depend on the type of authentication | 12:46 |
| dolphm | henrynash: around? | 12:47 |
| dstanek | dolphm: it looks to me like accessing certain properties of User will always cause a local_user to be created if we are using a write cursor | 12:49 |
| *** lamt has quit IRC | 12:49 | |
| dikonoor | dstanek: I took a look at rderose's changesets and he has not made any changes to cause this..meaning the code around User and it's orm relationship with local_user table has probably been existing for a long time. | 12:49 |
| *** markvoelker has joined #openstack-keystone | 12:49 | |
| dstanek | dikonoor: no, that is all his code from last cycle | 12:49 |
| dolphm | shadow users (and most of those tables) were introduced in mitaka | 12:50 |
| dikonoor | dstanek:dolphm: I think this is the changeset https://review.openstack.org/#/c/323602/ | 12:50 |
| patchbot | dikonoor: patch 323602 - keystone - Shadow LDAP and custom driver users (MERGED) | 12:50 |
| dolphm | dikonoor: that patch will be new for newton | 12:51 |
| nk2527 | Good morning all...I registered my first blueprint (https://blueprints.launchpad.net/keystone/+spec/x-auth-region-header) but not sure what next steps are. Can anyone point me in the right direction? | 12:52 |
| dikonoor | dolphm: Let me pull the mitaka patch. | 12:52 |
| dolphm | nk2527: sure, because blueprints are basically useless on their own :) | 12:52 |
| dolphm | nk2527: is this something you wanted to work on? | 12:52 |
| dolphm | nk2527: or a feature you wanted to request / make a use case for? | 12:53 |
| nk2527 | something I wanted to work on | 12:53 |
| dikonoor | dolphm:dstanek: https://review.openstack.org/#/c/279162/ | 12:53 |
| patchbot | dikonoor: patch 279162 - keystone - Shadow users - Shadow federated users (MERGED) | 12:53 |
| dolphm | nk2527: okay, then you'll need a blueprint, but first... | 12:54 |
| dolphm | nk2527: new features are proposed and documented here first: http://specs.openstack.org/openstack/keystone-specs/ | 12:54 |
| nk2527 | Gotcha...assuming this would go in backlog then? | 12:54 |
| dikonoor | dolphm:dstanek: I see only one change for mitaka which is the above..and that's primarily for the federated users | 12:55 |
| dolphm | nk2527: usually you'll propose to the next release (ocata), but you can also propose to backlog if it's not something you want to work on immediately (or aren't going to work on yourself) | 12:55 |
| *** nishaYadav has joined #openstack-keystone | 12:55 | |
| dstanek | nk2527: that's interesting. so in that model regions can't validate each others tokens? | 12:55 |
| dikonoor | dolphm:dstanek: and the one merged for Newton is for ldap and custom driver users | 12:55 |
| dolphm | nk2527: the actual repo you'll propose a spec against https://github.com/openstack/keystone-specs/ | 12:55 |
| nk2527 | great, thank you! | 12:55 |
| dstanek | nk2527: it would be useful to pitch your idea at one of the keystone meetings too | 12:55 |
| nk2527 | got it | 12:55 |
| nishaYadav | O/ | 12:56 |
| dolphm | dstanek: nk2527: ++ the more you can socialize it, and find other people that might be interested in the same feature, the better | 12:57 |
| nk2527 | understood, thanks for the tip | 12:58 |
| dstanek | nk2527: when you write the spec talk about where the data lives. it sounds like each region is it's own self contained cluster, but i'm not sure after reading the blueprint | 12:59 |
| nk2527 | will do | 12:59 |
| dikonoor | dstanek:dolphm:None of the specs - both in Mitaka or Newton are very specific about into which tables the entries are going to be in .. so I am trying to understand if the current behavior is as expected or a bug | 13:00 |
| dstanek | dikonoor: i've not see extra local records created, but i can test for it later this weekend | 13:01 |
| dikonoor | dstanek: sure. I tried it multiple times and I see it every time. | 13:03 |
| dolphm | dikonoor: in the mean time, can you file a bug against keystone with steps to reproduce? direct queries showing the result would be appreciated | 13:04 |
| dolphm | dikonoor: https://bugs.launchpad.net/keystone | 13:04 |
| dikonoor | dolphm: yeah..Let me do that.Thanks | 13:04 |
| *** fifieldt has quit IRC | 13:07 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Pre-cache new tokens https://review.openstack.org/309146 | 13:08 |
| *** jpena|lunch is now known as jpena | 13:10 | |
| *** amoralej|lunch is now known as amoralej | 13:12 | |
| *** asettle has quit IRC | 13:13 | |
| *** asettle has joined #openstack-keystone | 13:14 | |
| *** fifieldt has joined #openstack-keystone | 13:17 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Follow up patch for Improve docs for v3 domains https://review.openstack.org/357867 | 13:20 |
| *** pauloewerton has quit IRC | 13:20 | |
| *** BjoernT has joined #openstack-keystone | 13:21 | |
| *** pauloewerton has joined #openstack-keystone | 13:26 | |
| henrynash | dolphm: hi | 13:27 |
| *** ayoung has joined #openstack-keystone | 13:28 | |
| *** ChanServ sets mode: +v ayoung | 13:28 | |
| *** julim has joined #openstack-keystone | 13:31 | |
| stevemar | o/ | 13:34 |
| *** gagehugo_ has joined #openstack-keystone | 13:38 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Follow up patch for Improve docs for v3 services https://review.openstack.org/357885 | 13:39 |
| breton | stevemar: > the lookup eventually timed out but that was expected | 13:41 |
| breton | stevemar: re: https://review.openstack.org/#/c/343028/ | 13:41 |
| patchbot | breton: patch 343028 - keystone - Add mapping_populate command | 13:41 |
| breton | stevemar: did you get any error? | 13:41 |
| stevemar | breton: yeah, same one i normally get when i call list_users | 13:42 |
| stevemar | + your message' | 13:42 |
| henrynash | dolphm: be back on later | 13:42 |
| dolphm | henrynash: ack | 13:42 |
| breton | stevemar: what message? And what error do you normally get on list_users? | 13:46 |
| stevemar | breton: http://paste.openstack.org/show/561337/ | 13:52 |
| *** woodster_ has joined #openstack-keystone | 13:53 | |
| *** catintheroof has joined #openstack-keystone | 13:54 | |
| *** catintheroof has quit IRC | 14:01 | |
| rderose | stevemar: working on PCI docs, will have them by Newton-3; most likely sooner | 14:01 |
| stevemar | rderose: ;) | 14:01 |
| dolphm | rderose: scroll back to the discussion with dikonoor | 14:02 |
| breton | stevemar: huh. Have you tried enabling paging? "[ldap]page_size = 10000" for example | 14:02 |
| rderose | dikonoor | 14:03 |
| rderose | that was supposed to be a find :) | 14:03 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Follow up patch for Improve docs for v3 policies https://review.openstack.org/357901 | 14:03 |
| stevemar | breton: nope, i think you need username/password for that? | 14:03 |
| stevemar | breton: and the user must have privileges | 14:04 |
| breton | stevemar: :( i don't understand why fetching users is much slower than using ldapsearch | 14:04 |
| stevemar | breton: you and me both :( | 14:04 |
| dstanek | rderose: is the extra local_user intentional? | 14:04 |
| rderose | dstanek: duplicate local_user? | 14:07 |
| rderose | dstanek: what's the error? | 14:07 |
| *** eandersson_ has quit IRC | 14:07 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Reuse Domain and Project resouce definitions https://review.openstack.org/357367 | 14:08 |
| *** eandersson_ has joined #openstack-keystone | 14:08 | |
| stevemar | dolphm: want to give https://review.openstack.org/#/c/343028/ a look at? i've reviewed it for 12 patch sets and tried it on my own ldap | 14:08 |
| patchbot | stevemar: patch 343028 - keystone - Add mapping_populate command | 14:08 |
| dolphm | stevemar: interesting | 14:09 |
| dolphm | rderose: should check that out too ^ | 14:09 |
| dstanek | rderose: dikonoor found that when authenticating with an ldap account that a record is created in user, remote_user and local_user. | 14:10 |
| dstanek | i didn't expect the local_user record | 14:10 |
| openstackgerrit | Merged openstack/python-keystoneclient: Add auth functional tests https://review.openstack.org/356041 | 14:11 |
| *** chlong has joined #openstack-keystone | 14:13 | |
| *** nishaYadav has quit IRC | 14:14 | |
| rderose | dstanek: yeah, that shouldn't happen | 14:14 |
| rderose | dolphm: yeah, saw that patch, just haven't had a chance to review it. I'll take a look today. | 14:17 |
| *** richm has joined #openstack-keystone | 14:21 | |
| *** afred312_ has quit IRC | 14:21 | |
| dstanek | rderose: that's what i thought. i'm going to look into it this weekend | 14:22 |
| rderose | dstanek: so this was running against master? | 14:23 |
| *** afred312 has joined #openstack-keystone | 14:23 | |
| dolphm | rderose: i believe so | 14:24 |
| *** ankur-gupta-f has left #openstack-keystone | 14:24 | |
| rderose | dolphm dstanek: I think the error is here: https://github.com/openstack/keystone/blob/master/keystone/identity/shadow_backends/sql.py#L74 | 14:26 |
| dolphm | rderose: that might do it | 14:26 |
| dolphm | dstanek: is that the attribute you were looking at earlier? | 14:26 |
| rderose | dolphm dstanek: he must have turned on PCI disable inactive users though | 14:26 |
| edmondsw | stevemar I see keystone and python-keystoneclient at https://translate.openstack.org/project/list but not keystonemiddleware or keystoneauth... were these overlooked? | 14:27 |
| dolphm | dikonoor: are you using [security_compliance] disable_user_account_days_inactive ? | 14:27 |
| dstanek | rderose: for the local_user problem? | 14:27 |
| rderose | dolphm dstanek: otherwise, it wouldn't have set local_user | 14:27 |
| dolphm | dstanek: yes | 14:27 |
| dstanek | that's not creating a LocalUser though | 14:27 |
| dstanek | rderose: dolphm: https://github.com/openstack/keystone/blob/master/keystone/identity/backends/sql_model.py#L147 | 14:28 |
| dolphm | isn't last_active_at on local users... | 14:28 |
| stevemar | edmondsw: hmm | 14:28 |
| dstanek | set User.domain_id and get a LocalUser | 14:28 |
| rderose | dstanek dolphm: yeah, that is what I was thinking | 14:29 |
| edmondsw | stevemar noticed that this isn't being translated, for example... and thought we could just add _() there but now I'm thinking there will be more to it https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L573-L582 | 14:29 |
| stevemar | edmondsw: we probably dont want keystoneauth translated, that brings in oslo stuff | 14:29 |
| dolphm | dstanek: or a name | 14:29 |
| stevemar | edmondsw: some stuff in ksm is translated https://github.com/openstack/keystonemiddleware/blob/0f426e7f9e86385cab698f73d6ecb1d8e6b4898a/keystonemiddleware/auth_token/_signing_dir.py#L34 | 14:30 |
| stevemar | well, MARKED for translation anyway | 14:30 |
| stevemar | just no zanata job | 14:30 |
| edmondsw | stevemar right | 14:30 |
| stevemar | edmondsw: you can certainly add it | 14:30 |
| dstanek | dolphm: for some things like name i can understand, but we should have domain_id set for ldap and federated users without a local record | 14:31 |
| edmondsw | stevemar how? not really familiar with zanata | 14:31 |
| stevemar | edmondsw: i was hoping your eagerness meant that you are :) | 14:31 |
| edmondsw | I can add the _() :) | 14:31 |
| rderose | dstanek dolphm: you are right, it's updating the user table (surprised... I thought for sure this was in the local_user table...) | 14:31 |
| openstackgerrit | Graham Hayes proposed openstack/keystone: Get ready for os-api-ref sphinx theme change https://review.openstack.org/357923 | 14:33 |
| rderose | dolphm dstanek: I think the error must be happening here then: https://github.com/openstack/keystone/blob/master/keystone/identity/shadow_backends/sql.py#L100 | 14:35 |
| *** michauds has joined #openstack-keystone | 14:36 | |
| rderose | dolphm dstanek: when it creates a user from dict, the local user is getting created (I think) | 14:36 |
| rderose | dolphm dstanek: I'll prove this out and if that is the case, put in a fix | 14:36 |
| dolphm | rderose: appreciated! | 14:36 |
| rderose | dolphm dstanek: is there a bug filed? | 14:36 |
| dolphm | rderose: i hope this isn't an issue in mitaka :-/ | 14:36 |
| dikonoor | dolphm:No | 14:36 |
| dolphm | rderose: not yet | 14:36 |
| dolphm | dikonoor: i'm keeping an eye out though :) | 14:37 |
| dstanek | rderose: so, should nonlocal_user have a dommain_id, should user have a domain_id or something else? | 14:38 |
| rderose | nonlocal_user would have a domain_id; not user | 14:38 |
| dstanek | what about federated user? | 14:38 |
| dstanek | i'm guessing that there is probably something similar there | 14:39 |
| rderose | dstanek: yes, thought of that too | 14:39 |
| *** ezpz has joined #openstack-keystone | 14:39 | |
| rderose | dstanek: will check that as well | 14:39 |
| stevemar | edmondsw: sure :) | 14:40 |
| dstanek | rderose: sounds great....now i need to keep pushing on | 14:40 |
| rderose | dstanek: cool and thanks :) | 14:40 |
| stevemar | edmondsw: you could work with ajaeger to set things up, he knows the details | 14:40 |
| *** tonytan4ever has joined #openstack-keystone | 14:40 | |
| stevemar | https://wiki.openstack.org/wiki/Translations | 14:41 |
| edmondsw | tx | 14:42 |
| *** asettle has quit IRC | 14:42 | |
| dstanek | rderose: dikonoor did the research and i think filed a bug. | 14:43 |
| dikonoor | dstanek: just in the process of filing.. | 14:44 |
| dstanek | dikonoor: thanks! | 14:44 |
| stevemar | edmondsw: i think you just need to do a change like: https://review.openstack.org/#/c/182998/ | 14:45 |
| patchbot | stevemar: patch 182998 - openstack-infra/project-config - Switch on docs and publish jobs for magnum (MERGED) | 14:45 |
| odyssey4me | stevemar how do we progress https://review.openstack.org/357415 ? | 14:45 |
| stevemar | edmondsw: http://paste.openstack.org/show/561351/ | 14:46 |
| stevemar | edmondsw: Setup of projects in Zanata is done automatically after adding in the file gerrit/projects.yaml the with the "translate" option to the repository. | 14:46 |
| stevemar | so just one change and we're done | 14:46 |
| stevemar | odyssey4me: lookin | 14:46 |
| edmondsw | cool | 14:46 |
| stevemar | odyssey4me: you need the change merged for a deployment? | 14:46 |
| edmondsw | dikonoor do you want to do this or should I? | 14:47 |
| odyssey4me | stevemar It doesn't need to be force merged or anything - we just need an ETA for when it may merge... and ideally it should be by the end of next week. | 14:47 |
| dikonoor | edmondsw: just opened https://bugs.launchpad.net/keystone/+bug/1614994 for the translation thing | 14:47 |
| openstack | Launchpad bug 1614994 in OpenStack Identity (keystone) "keystonemiddleware 401 authentication string is not translated" [Undecided,New] - Assigned to Divya K Konoor (dikonoor) | 14:47 |
| stevemar | odyssey4me: i'm but one lowly stable reviewer, you should contact our buddy dolphm about it :D | 14:47 |
| dikonoor | edmondsw: now opening for the local_user problem | 14:48 |
| * stevemar pokes dolphm aggressively | 14:48 | |
| odyssey4me | stevemar It was an issue that came up in terms of Liberty->Mitaka deployments... so the sooner the better :) | 14:48 |
| * dolphm shanks stevemar gently | 14:48 | |
| stevemar | odyssey4me: i understand, it should be merged soon | 14:48 |
| stevemar | it was affecting a lot of folks, tricky bug to resolve | 14:48 |
| rderose | dikonoor: thanks! | 14:48 |
| * dolphm is reading back | 14:49 | |
| odyssey4me | lol, ok I'm out - thanks all - have a great weekend! | 14:49 |
| stevemar | odyssey4me: enjoy the weekend | 14:49 |
| dolphm | oh, this issue - didn't know we had a fix in review | 14:49 |
| dolphm | odyssey4me: ++ | 14:49 |
| stevemar | dolphm: aye, merged to master and everything, verified by mfisch | 14:50 |
| *** spedione|AWAY is now known as spedione | 14:51 | |
| dolphm | odyssey4me: stevemar: clean backport, gating! | 14:51 |
| stevemar | yay | 14:51 |
| stevemar | dikonoor: edmondsw meh, i have a few minutes, i'll pump it out | 14:53 |
| edmondsw | stevemar, if you like... tx | 14:53 |
| rderose | dstanek: just an fyi, this wouldn't be an error with federated users | 14:55 |
| stevemar | edmondsw: dikonoor https://review.openstack.org/#/c/357949/ | 14:55 |
| patchbot | stevemar: patch 357949 - openstack-infra/project-config - setup translation job for keystonemiddleware | 14:55 |
| stevemar | edmondsw: dikonoor oh i meant only adding the job... not marking the strings, you can still do that :P | 14:56 |
| edmondsw | stevemar sure :) | 14:56 |
| rderose | dikonoor: let me know when you open the bug for the local_user problem, I'll take that one | 14:57 |
| dikonoor | rderose: https://bugs.launchpad.net/keystone/+bug/1615000 | 14:57 |
| openstack | Launchpad bug 1615000 in OpenStack Identity (keystone) "Entry to User table creates entries in local_user table for ldap and custom driver users" [Undecided,New] | 14:57 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix credential update to ec2 type https://review.openstack.org/357950 | 14:57 |
| rderose | dikonoor: thanks! | 14:57 |
| lbragstad | dolphm ok - i think i hacked around the cases where a credential blob is a dict | 14:58 |
| lbragstad | dolphm i'll push a new patch of all the encrypted cred stuff to get some eyes on it | 14:58 |
| dolphm | lbragstad: link? | 14:58 |
| lbragstad | dolphm running tests now | 14:58 |
| lbragstad | dolphm correct me if I'm wrong but, I think the blob can't only be a dictionary if credential type is ec2 | 14:59 |
| dolphm | lbragstad: can't? | 14:59 |
| lbragstad | dolphm sorry - can* | 14:59 |
| lbragstad | the blob can only be a dictionary if the credential type is ec2 | 14:59 |
| dolphm | lbragstad: there's an open bug that you can mutate the credential type after the fact, so ... it wouldn't be a safe assumption | 15:00 |
| lbragstad | awwww | 15:00 |
| lbragstad | damn | 15:00 |
| *** hockeynut has joined #openstack-keystone | 15:00 | |
| dolphm | lbragstad: you can create a dict via the ec2 api, then change the credential type to "make-lbragstad's-life-harder" | 15:00 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix credential update to ec2 type https://review.openstack.org/357950 | 15:00 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Add mapping_populate command https://review.openstack.org/343028 | 15:00 |
| *** nishaYadav has joined #openstack-keystone | 15:00 | |
| dolphm | lbragstad: or vice versa, create a regular credential, then change the type to "ec2" | 15:00 |
| lbragstad | dolphm can we make credential type immutable? | 15:00 |
| dolphm | lbragstad: that was my thought too -- i don't know why you'd want to mutate it | 15:01 |
| dolphm | lbragstad: it'd be a 2 cycle deprecation policy though | 15:01 |
| rodrigods | dolphm, really? | 15:01 |
| rodrigods | ^ tried to fix that with the patch above | 15:01 |
| dolphm | rodrigods: we'd be changing a public API, so ... yes | 15:02 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: WIP: Devstack plugin for Federation https://review.openstack.org/320623 | 15:02 |
| dolphm | rodrigods: and, actually, permanently breaking a currently-working API path | 15:02 |
| rodrigods | thought this would be considered a bug? like you said... mutate is very unlikely | 15:02 |
| *** hockeynut has quit IRC | 15:02 | |
| dolphm | rodrigods: never underestimate users | 15:02 |
| rodrigods | that's true | 15:03 |
| rodrigods | what happens if i update to ec2 and then try to use it? | 15:03 |
| dolphm | rodrigods: perhaps unlikely to have a reasonable use case, but not unlikely to abuse the API | 15:03 |
| dolphm | rodrigods: i assume you'll get a 500 from the ec2 controller | 15:03 |
| rodrigods | dolphm, so is a broken API path anyway? | 15:03 |
| dolphm | lbragstad: in case you missed it, https://review.openstack.org/#/c/357950/ | 15:03 |
| patchbot | dolphm: patch 357950 - keystone - Fix credential update to ec2 type | 15:03 |
| *** dikonoor has quit IRC | 15:05 | |
| dolphm | rodrigods: i'd suggest making a release note at the very least | 15:05 |
| lbragstad | ah - nice | 15:05 |
| rodrigods | dolphm, yeah, considered that yoo | 15:05 |
| rodrigods | too* | 15:05 |
| rodrigods | think we can go by failing the request and then making it immutable | 15:05 |
| rodrigods | with the proper release cycle | 15:06 |
| rodrigods | makes sense? | 15:06 |
| *** su_zhang has joined #openstack-keystone | 15:06 | |
| dolphm | i'll punt to stevemar | 15:07 |
| lbragstad | dolphm I got a NoSuchTableError when running - keystone.tests.unit.test_sql_banned_operations.TestKeystoneExpandSchemaMigrationsSQLite.test_walk_versions | 15:10 |
| rodrigods | dolphm, writing this down in the bug | 15:10 |
| lbragstad | is that related to the upgrade issues henrynash was seeing? | 15:10 |
| rodrigods | lbragstad, btw, not related: i've added a PR to your keystone-perf repo | 15:10 |
| dolphm | lbragstad: i don't think so -- what happens when you run the whole class? | 15:10 |
| dolphm | lbragstad: sqlite? | 15:10 |
| lbragstad | dolphm not sure - checking... it failed the first time when running the whole test suits locally | 15:11 |
| dolphm | lbragstad: bad pyc files or something? | 15:11 |
| lbragstad | dolphm hmm - nope... | 15:12 |
| lbragstad | dolphm let me push for review and mark as wip | 15:13 |
| stevemar | aru? | 15:13 |
| stevemar | dolphm: what i miss now? | 15:14 |
| dolphm | stevemar: keystone is broken | 15:14 |
| rodrigods | lol | 15:14 |
| *** nishaYadav has quit IRC | 15:14 | |
| rodrigods | https://review.openstack.org/#/c/357950/ | 15:14 |
| patchbot | rodrigods: patch 357950 - keystone - Fix credential update to ec2 type | 15:14 |
| stevemar | dolphm: duh | 15:14 |
| rodrigods | stevemar, ^ | 15:14 |
| dolphm | stevemar: we're waiting for you to fix it | 15:15 |
| stevemar | it's *how* is it broken today? | 15:15 |
| stevemar | tires falling off is much worse than your a broken headlight | 15:15 |
| rodrigods | stevemar, check the bug description/comments | 15:16 |
| dolphm | stevemar: it's appreciably broken | 15:16 |
| stevemar | credential without project id, okay, that seems bad already | 15:16 |
| rodrigods | my comment makes sense? | 15:16 |
| *** Ephur has joined #openstack-keystone | 15:17 | |
| *** ravelar has joined #openstack-keystone | 15:18 | |
| stevemar | ah the bug makes sense | 15:18 |
| stevemar | didn't we just introduce the credentials schema last release? | 15:18 |
| stevemar | so before i could: create non-ec2 cred with no project, and update it to ec2 and now its project-less and not usable | 15:20 |
| stevemar | now we'll block the update | 15:20 |
| rodrigods | stevemar, correct | 15:20 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement encryption of credentials at rest https://review.openstack.org/355618 | 15:20 |
| stevemar | could the user ever *create* an ec2 cred with no project? | 15:20 |
| stevemar | i think the schema stops that correct? | 15:21 |
| rodrigods | yes, the schema prevents that | 15:21 |
| stevemar | and is the credential usable (in the old scenario)? | 15:21 |
| lbragstad | dolphm new patch ^ | 15:21 |
| rodrigods | stevemar, usable with the ec2 type and without a project? | 15:22 |
| stevemar | yes | 15:22 |
| rodrigods | don't think so? | 15:22 |
| rodrigods | dolphm's guess is that would fail with a 500 or something | 15:22 |
| stevemar | rodrigods: then let's block that nonsense | 15:22 |
| stevemar | rodrigods: include a release note | 15:23 |
| rodrigods | ++ | 15:23 |
| rodrigods | going to have lunch and will update the patch once i'm back | 15:23 |
| *** rcernin has quit IRC | 15:24 | |
| *** jed56 has joined #openstack-keystone | 15:26 | |
| *** pcaruana has quit IRC | 15:26 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: WIP: Devstack plugin for Federation https://review.openstack.org/320623 | 15:29 |
| *** ezpz has quit IRC | 15:31 | |
| *** gyee has joined #openstack-keystone | 15:31 | |
| *** marekd2_ has quit IRC | 15:33 | |
| *** woodburn has quit IRC | 15:34 | |
| *** tonytan_brb has joined #openstack-keystone | 15:34 | |
| *** haplo37__ has joined #openstack-keystone | 15:34 | |
| *** ezpz has joined #openstack-keystone | 15:35 | |
| *** tonytan4ever has quit IRC | 15:37 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: WIP: Devstack plugin for Federation https://review.openstack.org/320623 | 15:37 |
| *** ayoung has quit IRC | 15:39 | |
| *** woodburn has joined #openstack-keystone | 15:40 | |
| *** ametts has joined #openstack-keystone | 15:41 | |
| *** ametts has quit IRC | 15:47 | |
| *** links has quit IRC | 15:49 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadowing a nonlocal_user incorrectly creates a local_user https://review.openstack.org/357979 | 15:49 |
| stevemar | keystoners, did you all want more fishbowl or meeting rooms at the next summit? | 15:51 |
| *** code-R_ has joined #openstack-keystone | 15:51 | |
| *** ametts has joined #openstack-keystone | 15:51 | |
| stevemar | i was thinking of having the same amount 5 fishbowls, 8 working rooms -- for the contributor meetup i am on the fence for a full day meetup | 15:53 |
| dolphm | stevemar: it's a 4 day summit, right? | 15:53 |
| dolphm | stevemar: do we have 3 days for design summit, or 4? | 15:53 |
| *** code-R has quit IRC | 15:53 | |
| henrynash | dolphm: thanks for adding those bugs on upgrades - I was going to grab them all and work on them (unless you were already doing them)? | 15:54 |
| stevemar | dolphm: like 2.5 :\ | 15:54 |
| dolphm | henrynash: i'm not planning to tackle them at the moment - but that's all i was going to poke you about, just wanted to let you know i was opening them | 15:54 |
| openstackgerrit | Graham Hayes proposed openstack/keystone: Get ready for os-api-ref sphinx theme change https://review.openstack.org/357923 | 15:54 |
| henrynash | dolphm: cool...I'm on them | 15:54 |
| dolphm | henrynash: awesome, happy to provide reviews when you're ready | 15:55 |
| stevemar | - Ops summit on Tuesday morning until 4pm | 15:55 |
| stevemar | - Cross-project workshops from Tuesday 4pm to Wednesday 4pm | 15:55 |
| stevemar | - Fishbowl/Workroom sessions from Wednesday 4pm to Friday noon | 15:55 |
| stevemar | - Contributors meetups on Friday afternoon | 15:55 |
| stevemar | One consequence of the squeeze is that "contributors meetups" will be maximum half-a-day long and will be on Friday *afternoon*. | 15:55 |
| stevemar | i question if it's worth having the meetup at all if its going to be on a friday afternoon | 15:56 |
| breton | stevemar: what's next sammit? Barcelona? | 15:56 |
| stevemar | breton: yep | 15:56 |
| dolphm | stevemar: well, that's fast | 15:56 |
| stevemar | dolphm: yeah, it's also a much shorter dev cycle | 15:56 |
| dolphm | stevemar: i could go either way on the full contributor meetup, too. lots of people will be traveling early, i'm sure, due to international | 15:57 |
| stevemar | so don't expect many large features to be approved :S | 15:57 |
| dolphm | stevemar: but it's also a cramped schedule otherwise, so maybe we'll want the time | 15:57 |
| dolphm | stevemar: that's true | 15:57 |
| dolphm | stevemar: maybe just say a full day is a nice-to-have, but not necessary for us? | 15:58 |
| stevemar | dolphm: well we can ask for it | 15:58 |
| dolphm | stevemar: in case there ends up being space & time constraints for other groups | 15:58 |
| stevemar | dolphm: the maximum is a half way | 15:58 |
| dolphm | stevemar: oh, we can't get a full day anyway? | 15:58 |
| stevemar | dolphm: correcet | 15:58 |
| dolphm | stevemar: oh, well then what's the question? | 15:58 |
| stevemar | One consequence of the squeeze is that "contributors meetups" will be maximum half-a-day long and will be on Friday *afternoon*. | 15:58 |
| dolphm | stevemar: 0 or 0.5 day contributor meetup? | 15:58 |
| stevemar | dolphm: if we even want *that* | 15:58 |
| stevemar | 0 or 0.5 day (in the afternoon) | 15:59 |
| *** nishaYadav has joined #openstack-keystone | 15:59 | |
| dolphm | stevemar: maybe poll the people that have already made travel plans and see if they'll even be around for it? | 15:59 |
| stevemar | i guess we can ask for it anyway, worse case scenario is that it's just me hanging out in a giant room :P | 15:59 |
| stevemar | we basically have thursday and friday morning for design summit stuff | 16:00 |
| dolphm | stevemar: do you need to know before the tuesday meeting? could hold a quick #poll then to check for friday afternoon attendance | 16:00 |
| stevemar | for *keystone* specific design summit stuff | 16:00 |
| stevemar | dolphm: we have time | 16:00 |
| stevemar | response needed by end of month | 16:01 |
| dolphm | stevemar: cool | 16:01 |
| * dolphm goes to lunch | 16:01 | |
| stevemar | if the last few summits have been any indicator, everyone bails on friday afternoon | 16:01 |
| stevemar | enjoy | 16:01 |
| *** jaosorior has quit IRC | 16:04 | |
| *** su_zhang has quit IRC | 16:05 | |
| *** su_zhang has joined #openstack-keystone | 16:06 | |
| amakarov | stevemar, good day! What release pre-cached tokens will be targeted to? The thing looks working and I have a demo gist... | 16:07 |
| *** su_zhang has quit IRC | 16:10 | |
| *** ezpz has quit IRC | 16:13 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix credential update to ec2 type https://review.openstack.org/357950 | 16:14 |
| *** nisha_ has joined #openstack-keystone | 16:16 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadowing a nonlocal_user incorrectly creates a local_user https://review.openstack.org/357979 | 16:17 |
| *** nishaYadav has quit IRC | 16:19 | |
| openstackgerrit | Alexander Oughton proposed openstack/keystoneauth: Disables setting of TCP_KEEPCNT when running under the Windows Subsystem for Linux. https://review.openstack.org/357452 | 16:21 |
| openstackgerrit | Merged openstack/python-keystoneclient: Follow up patch for Add ec2 functional tests https://review.openstack.org/357420 | 16:21 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix credential update to ec2 type https://review.openstack.org/357950 | 16:23 |
| *** tonytan_brb has quit IRC | 16:25 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Faster id mapping lookup https://review.openstack.org/339294 | 16:26 |
| *** tonytan4ever has joined #openstack-keystone | 16:26 | |
| *** spedione is now known as spedione|AWAY | 16:27 | |
| *** nisha_ is now known as nishaYadav | 16:27 | |
| stevemar | amakarov: i was going to test it out today, it's still targetted for N unless someone says otherwise :) | 16:38 |
| amakarov | stevemar, got it, thanks! | 16:39 |
| * stevemar goes to refuel (aka get some lunch) | 16:39 | |
| *** krotscheck is now known as the_other_clarkb | 16:42 | |
| *** the_other_clarkb is now known as krotscheck | 16:43 | |
| *** ayoung has joined #openstack-keystone | 16:44 | |
| *** ChanServ sets mode: +v ayoung | 16:44 | |
| *** roxanaghe has joined #openstack-keystone | 16:51 | |
| *** tesseract- has quit IRC | 16:53 | |
| *** julim has quit IRC | 16:56 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix credential update to ec2 type https://review.openstack.org/357950 | 16:59 |
| krotscheck | Anyone have a sec to explain an auth request for me? | 17:02 |
| krotscheck | Tl/DR: I'm using the clouds.yaml file from devstack, to auth against devstack. | 17:02 |
| krotscheck | A basic password auth request, using the provided username, passwor, and domainId works like a charm. | 17:02 |
| krotscheck | Also, an unscoped request works. | 17:02 |
| krotscheck | However, as soon as I add the scope, it fails | 17:03 |
| *** Ephur has quit IRC | 17:03 | |
| krotscheck | Ah wait, figured it out. I was passing the project name in the 'id' parameter. | 17:04 |
| krotscheck | Sorry for bothering everyone | 17:04 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Document the fernet credential provider https://review.openstack.org/354497 | 17:05 |
| *** su_zhang has joined #openstack-keystone | 17:06 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Document credential encryption https://review.openstack.org/354497 | 17:07 |
| *** roxanaghe has quit IRC | 17:07 | |
| *** roxanaghe has joined #openstack-keystone | 17:15 | |
| dstanek | do we have anywhere in our code where we mockout entrypoints? | 17:18 |
| *** Ephur has joined #openstack-keystone | 17:25 | |
| *** spedione|AWAY is now known as spedione | 17:26 | |
| *** jaugustine has joined #openstack-keystone | 17:31 | |
| *** Gorian|work has joined #openstack-keystone | 17:34 | |
| *** BjoernT is now known as Bjoern_zZzZzZzZ | 17:35 | |
| lbragstad | alright - breaking for lunch | 17:38 |
| *** amoralej is now known as amoralej|pto | 17:39 | |
| stevemar | dstanek: not sure | 17:42 |
| dstanek | i think i found a way around it | 17:42 |
| *** su_zhang has quit IRC | 17:45 | |
| *** su_zhang has joined #openstack-keystone | 17:46 | |
| *** su_zhang has quit IRC | 17:49 | |
| *** su_zhang has joined #openstack-keystone | 17:49 | |
| *** julim has joined #openstack-keystone | 17:50 | |
| *** amakarov is now known as amakarov_away | 17:54 | |
| *** tqtran has joined #openstack-keystone | 18:01 | |
| *** Bjoern_zZzZzZzZ is now known as BjoernT | 18:05 | |
| *** BjoernT is now known as Bjoern_zZzZzZzZ | 18:05 | |
| *** tonytan4ever has quit IRC | 18:06 | |
| *** Bjoern_zZzZzZzZ is now known as BjoernT | 18:06 | |
| *** tonytan4ever has joined #openstack-keystone | 18:06 | |
| *** tonytan4ever has quit IRC | 18:08 | |
| *** tonytan4ever has joined #openstack-keystone | 18:16 | |
| *** sadmordred has quit IRC | 18:18 | |
| *** nisha_ has joined #openstack-keystone | 18:22 | |
| *** nishaYadav has quit IRC | 18:23 | |
| *** nisha_ is now known as nishaYadav | 18:23 | |
| *** tqtran has quit IRC | 18:29 | |
| *** tonytan4ever has quit IRC | 18:30 | |
| *** code-R_ has quit IRC | 18:30 | |
| *** tonytan4ever has joined #openstack-keystone | 18:31 | |
| *** tqtran has joined #openstack-keystone | 18:33 | |
| stevemar | amakarov_away: hmm not seeing much of an improvement! | 18:37 |
| stevemar | amakarov_away: oh wait | 18:38 |
| stevemar | duh | 18:38 |
| stevemar | bknudson: interested in testing out https://review.openstack.org/#/c/309146/ ? | 18:39 |
| patchbot | stevemar: patch 309146 - keystone - Pre-cache new tokens | 18:39 |
| bknudson | stevemar: we're switching our performance testing to a different system and so I have no means of doing performance testing at this point. | 18:40 |
| stevemar | bknudson: okie doke | 18:41 |
| bknudson | I left my comment on patch set 4 and was not addressed - This code needs to be refactored before we do this. We need to have a single path so that if they use v2 or v3 or fernet the token gets cached. | 18:41 |
| bknudson | we continue adding technical debt on top of technical debt and this is leading to bugs. | 18:42 |
| *** jdennis has quit IRC | 18:47 | |
| nishaYadav | stevemar, can you please review this if you get time, https://review.openstack.org/#/c/357136/ | 18:51 |
| patchbot | nishaYadav: patch 357136 - python-keystoneclient - Improve docs for v3 tokens | 18:51 |
| *** su_zhang has quit IRC | 18:54 | |
| nishaYadav | thanks stevemar :) | 18:55 |
| stevemar | nishaYadav: np | 18:55 |
| *** tqtran has quit IRC | 18:59 | |
| *** jed56 has quit IRC | 19:05 | |
| *** fifieldt has quit IRC | 19:07 | |
| *** tqtran has joined #openstack-keystone | 19:13 | |
| *** fifieldt has joined #openstack-keystone | 19:18 | |
| *** nishaYadav has quit IRC | 19:18 | |
| *** su_zhang has joined #openstack-keystone | 19:24 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add key repository uniqueness check to doctor https://review.openstack.org/358083 | 19:27 |
| *** asettle has joined #openstack-keystone | 19:27 | |
| *** spzala has joined #openstack-keystone | 19:28 | |
| openstackgerrit | Merged openstack/keystone: Replace the content type with correct one https://review.openstack.org/349249 | 19:28 |
| lbragstad | dolphm ^ | 19:28 |
| *** su_zhang has quit IRC | 19:29 | |
| *** roxanaghe has quit IRC | 19:32 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Follow up patch for Improve docs for v3 domains https://review.openstack.org/357867 | 19:32 |
| *** roxanaghe has joined #openstack-keystone | 19:36 | |
| *** asettle has quit IRC | 19:38 | |
| *** sdake has quit IRC | 19:41 | |
| *** pnavarro has quit IRC | 19:41 | |
| rderose | rodrigods: just responded to 357950 | 19:43 |
| rderose | rodrigods: take a look and let me know if you still disagree | 19:44 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/356872 | 19:47 |
| *** gordc has left #openstack-keystone | 19:47 | |
| *** ametts has quit IRC | 19:48 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/356940 | 19:52 |
| *** gagehugo_ has quit IRC | 19:55 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Follow up patch for Improve docs for v3 services https://review.openstack.org/357885 | 19:57 |
| stevemar | bknudson: well you will get your wish next release | 20:04 |
| stevemar | bknudson: it's so short that no features will land | 20:04 |
| stevemar | we can pay down all sorts of techincal debt | 20:05 |
| bknudson | I want features to land | 20:05 |
| bknudson | seems like the only way to get developers to work on t.d. is to force it to be done for features. | 20:06 |
| bknudson | without features to land there will be no t.d. work done either. | 20:06 |
| *** jdennis has joined #openstack-keystone | 20:09 | |
| *** ravelar has quit IRC | 20:15 | |
| *** edmondsw has quit IRC | 20:15 | |
| *** su_zhang has joined #openstack-keystone | 20:16 | |
| *** roxanaghe has quit IRC | 20:17 | |
| *** jdennis has quit IRC | 20:18 | |
| *** ravelar has joined #openstack-keystone | 20:21 | |
| bknudson | also, this is why I think keystone should switch from the integrated release to release on demand. Then we can land features whenever we want. | 20:22 |
| *** jdennis has joined #openstack-keystone | 20:25 | |
| stevemar | we can propose that for the next release | 20:25 |
| stevemar | we should make a list of technical debt we want to pay down next release | 20:25 |
| stevemar | i'm more than happy to not land any big features for O since it's a short release | 20:26 |
| openstackgerrit | Merged openstack/python-keystoneclient: Follow up patch for Improve docs for v3 policies https://review.openstack.org/357901 | 20:26 |
| openstackgerrit | Merged openstack/python-keystoneclient: Improve docs for v3 tokens https://review.openstack.org/357136 | 20:26 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement encryption of credentials at rest https://review.openstack.org/355618 | 20:28 |
| openstackgerrit | Alexander Oughton proposed openstack/keystoneauth: Disables setting of TCP_KEEPCNT when running under the Windows Subsystem for Linux. https://review.openstack.org/357452 | 20:33 |
| *** roxanaghe has joined #openstack-keystone | 20:38 | |
| gsilvis | I just asked a question in #openstack-oslo about oslo.cache that some keystone core may be able to help with---it looks like keystone is one of the biggest oslo.cache users, and I think you must have run into the problem | 20:39 |
| dstanek | gsilvis: what's the problem? i've been working on fixing several issues with it | 20:45 |
| gsilvis | dstanek: when we run 'get_memoization_decorator' before we've loaded our config file, the decorator doesn't respect the options in the config file | 20:45 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Relax the requirement for mappings to result in group memberships. https://review.openstack.org/358111 | 20:46 |
| dstanek | gsilvis: are you calling configure_region at some point? | 20:47 |
| gsilvis | dstanek: yup | 20:47 |
| *** spzala has quit IRC | 20:47 | |
| dstanek | that's very odd. is it code i can look at? | 20:47 |
| gsilvis | sure | 20:47 |
| knikolla | dstanek: this is wat our conf looks like http://paste.openstack.org/show/bvRWmnJ4DoD3bY5WXIVN/ | 20:47 |
| *** lamt has joined #openstack-keystone | 20:47 | |
| *** spzala has joined #openstack-keystone | 20:48 | |
| dstanek | keystone used get_memoization_decorator before it calls configure_region | 20:48 |
| dstanek | s/used/uses/ | 20:48 |
| gsilvis | huh, I thought you had to do that in the other order | 20:48 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Relax the requirement for mappings to result in group memberships https://review.openstack.org/358111 | 20:48 |
| * gsilvis tries it | 20:48 | |
| gsilvis | yup, that sure works | 20:49 |
| gsilvis | thanks! | 20:49 |
| dstanek | :-) | 20:49 |
| dstanek | np | 20:49 |
| gsilvis | and now to modify the docuemntation update that I proposed for oslo.cache ... | 20:49 |
| dstanek | keystone creates the decorators at import time and later configures the region right before teh server starts | 20:49 |
| *** spzala has quit IRC | 20:51 | |
| *** spzala has joined #openstack-keystone | 20:51 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Document credential encryption https://review.openstack.org/354497 | 20:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add key repository uniqueness check to doctor https://review.openstack.org/358083 | 20:59 |
| *** pnavarro has joined #openstack-keystone | 21:01 | |
| bknudson | dstanek: luckily they don't know about all the bugs. | 21:04 |
| *** raildo has quit IRC | 21:04 | |
| *** clenimar has quit IRC | 21:05 | |
| dstanek | bknudson: then i'll not say any more | 21:06 |
| *** su_zhang has quit IRC | 21:12 | |
| *** jdennis has quit IRC | 21:15 | |
| *** haplo37__ has quit IRC | 21:19 | |
| *** lamt has quit IRC | 21:22 | |
| *** michauds has quit IRC | 21:30 | |
| *** marekd2 has joined #openstack-keystone | 21:31 | |
| *** roxanaghe has quit IRC | 21:32 | |
| *** roxanaghe has joined #openstack-keystone | 21:35 | |
| *** sdake has joined #openstack-keystone | 21:35 | |
| *** sdake has quit IRC | 21:37 | |
| *** sdake has joined #openstack-keystone | 21:38 | |
| *** code-R has joined #openstack-keystone | 21:40 | |
| *** marekd2 has quit IRC | 21:41 | |
| *** su_zhang has joined #openstack-keystone | 21:41 | |
| *** code-R_ has joined #openstack-keystone | 21:41 | |
| *** marekd2 has joined #openstack-keystone | 21:41 | |
| rodrigods | rderose, hmm, yeah, makes sense to put in the manager since we do that in other places | 21:44 |
| rodrigods | with that change, adding tests to verify the exception raised makes sense | 21:44 |
| *** code-R has quit IRC | 21:44 | |
| *** marekd2 has quit IRC | 21:46 | |
| *** code-R_ has quit IRC | 21:46 | |
| *** code-R has joined #openstack-keystone | 21:46 | |
| *** roxanaghe has quit IRC | 21:47 | |
| *** spzala has quit IRC | 21:53 | |
| *** spzala has joined #openstack-keystone | 21:54 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Flag to bypass expiry and revocation check on token validation https://review.openstack.org/358131 | 21:54 |
| *** pnavarro has quit IRC | 21:55 | |
| *** spzala has quit IRC | 21:58 | |
| *** BjoernT has quit IRC | 21:59 | |
| *** code-R has quit IRC | 22:02 | |
| *** spedione is now known as spedione|AWAY | 22:26 | |
| *** Ephur has quit IRC | 22:32 | |
| *** spzala has joined #openstack-keystone | 22:48 | |
| *** spzala has quit IRC | 22:49 | |
| *** spzala has joined #openstack-keystone | 22:49 | |
| *** jdennis has joined #openstack-keystone | 22:54 | |
| *** sshen has quit IRC | 23:00 | |
| *** spzala has quit IRC | 23:00 | |
| *** sshen has joined #openstack-keystone | 23:00 | |
| *** jdennis has quit IRC | 23:01 | |
| *** asettle has joined #openstack-keystone | 23:02 | |
| *** asettle has quit IRC | 23:06 | |
| *** AndyWojo has quit IRC | 23:12 | |
| *** boris-42 has quit IRC | 23:12 | |
| *** raddaoui has quit IRC | 23:12 | |
| *** dkehn_ has quit IRC | 23:17 | |
| *** ravelar has quit IRC | 23:18 | |
| *** raddaoui has joined #openstack-keystone | 23:18 | |
| *** boris-42 has joined #openstack-keystone | 23:19 | |
| *** AndyWojo has joined #openstack-keystone | 23:20 | |
| *** Gorian|work has quit IRC | 23:30 | |
| *** dkehn_ has joined #openstack-keystone | 23:30 | |
| rderose | rodrigods: cool, have a nice weekend | 23:30 |
| *** jdennis has joined #openstack-keystone | 23:34 | |
| *** jdennis has quit IRC | 23:35 | |
| *** BlackDex has quit IRC | 23:39 | |
| *** dkehn_ has quit IRC | 23:42 | |
| *** gyee has quit IRC | 23:48 | |
| *** su_zhang has quit IRC | 23:50 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!