| *** woodster_ has quit IRC | 00:09 | |
| mordred | jamielennox, notmorgan: I marked them WIP for now ... digging in to respond to jamielennox makes me think now isn't the right time to poke at this | 00:14 |
|---|---|---|
| *** sdake has joined #openstack-keystone | 00:14 | |
| notmorgan | ok | 00:14 |
| notmorgan | i'll circle back on them then. didn't see much that stood out as "Wrong" beyond agreeing with some of jamielennox's comments | 00:14 |
| *** spzala has quit IRC | 00:25 | |
| *** spzala has joined #openstack-keystone | 00:25 | |
| *** spzala has quit IRC | 00:30 | |
| *** browne has quit IRC | 00:30 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes migration where password created_at is nullable https://review.openstack.org/362501 | 00:37 |
| *** su_zhang has quit IRC | 00:48 | |
| *** su_zhang has joined #openstack-keystone | 00:48 | |
| *** su_zhang has quit IRC | 00:49 | |
| *** su_zhang has joined #openstack-keystone | 00:53 | |
| *** edtubill has joined #openstack-keystone | 00:57 | |
| *** su_zhang has quit IRC | 00:57 | |
| *** adu has quit IRC | 01:06 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes migration issue where password created_at is nullable before fix https://review.openstack.org/362510 | 01:07 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes migration where password created_at is nullable https://review.openstack.org/362501 | 01:11 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes migration where password created_at is nullable before 105 fix https://review.openstack.org/362510 | 01:12 |
| *** gyee has quit IRC | 01:14 | |
| *** sdake has quit IRC | 01:14 | |
| *** edtubill has quit IRC | 01:17 | |
| *** sdake has joined #openstack-keystone | 01:21 | |
| *** davechen has joined #openstack-keystone | 01:27 | |
| *** wangqun has joined #openstack-keystone | 01:32 | |
| *** EinstCrazy has joined #openstack-keystone | 01:38 | |
| *** code-R has joined #openstack-keystone | 01:40 | |
| *** code-R has quit IRC | 01:57 | |
| *** spzala has joined #openstack-keystone | 02:01 | |
| *** EinstCra_ has joined #openstack-keystone | 02:03 | |
| *** EinstCrazy has quit IRC | 02:06 | |
| *** spzala has quit IRC | 02:12 | |
| *** tqtran has quit IRC | 02:15 | |
| *** namnh has joined #openstack-keystone | 02:24 | |
| davechen | rderose: Is it possible for password_expires_days or minimum_password_age be a negative value? | 02:25 |
| rderose | davechen: no | 02:25 |
| davechen | rderose: when I read the 'If' block I think about the 'else' as well. | 02:26 |
| rderose | davechen: well, else simply returns False | 02:26 |
| davechen | rderose: what does return false mean? | 02:27 |
| davechen | rderose: no symptom or warning message, right? | 02:27 |
| rderose | exactly | 02:27 |
| *** code-R has joined #openstack-keystone | 02:27 | |
| rderose | if true, return check else return False | 02:28 |
| davechen | rderose: so why check the condition that always true? | 02:28 |
| *** EinstCrazy has joined #openstack-keystone | 02:28 | |
| *** code-R_ has joined #openstack-keystone | 02:30 | |
| rderose | (min_age > 0 and expires > 0) is always true? | 02:30 |
| davechen | rderose: I think only the else could happen, it's necessary to be 'If' there. | 02:30 |
| davechen | how it could be false? | 02:31 |
| rderose | if min_age is 0 it could be false | 02:31 |
| davechen | what we do it's false? | 02:31 |
| rderose | if the condition is False, such as min age is zero, then we return False | 02:31 |
| rderose | it's essentially do this: | 02:32 |
| rderose | if (both are enabled) return the symptom check | 02:32 |
| *** EinstCra_ has quit IRC | 02:32 | |
| rderose | else return false | 02:32 |
| davechen | why not just check if it is zero instead | 02:32 |
| *** magic has joined #openstack-keystone | 02:32 | |
| *** magic is now known as Guest33431 | 02:32 | |
| rderose | because if I check if zero, then that means min_age is disabled and I only want to return the symptom check if both are enabled | 02:33 |
| rderose | davechen: tell me what you would return | 02:33 |
| *** code-R has quit IRC | 02:33 | |
| rderose | just code it up really quick | 02:33 |
| rderose | I mean give me the return | 02:34 |
| *** xiaoyang has quit IRC | 02:35 | |
| davechen | yep, the min_age could be zero and this is also check the do that check, right? | 02:36 |
| davechen | sorry, also need to do the check. | 02:36 |
| davechen | rderose: on need to toss up a review. | 02:37 |
| rderose | davechen: sorry, not following... to check if enabled, I need to check that min_age and expires are both greater than zero | 02:37 |
| rderose | davechen: it's okay, I'm just not getting what your concern is. and I"m probably not explaining it very well. anyway, let me know if you have an alternative or a suggestion on how to improve it | 02:39 |
| *** jefrite has quit IRC | 02:39 | |
| rderose | davechen: I appreciate you reviewing it | 02:39 |
| davechen | The only vlaue that condition could be false is min_age is zero, I think. | 02:39 |
| rderose | because password_expires_days min is 1? | 02:40 |
| davechen | password_expires_days always >= 1 and min_age is always >0 | 02:42 |
| davechen | that is what you defined. | 02:42 |
| rderose | davechen: actually password_expires_days could be None, which wouldn't be greater than zero | 02:42 |
| davechen | min_age >=0 | 02:42 |
| davechen | I mean if they are enabled. | 02:43 |
| rderose | and minimum_password_age default is 0 | 02:43 |
| rderose | oh | 02:43 |
| *** jefrite has joined #openstack-keystone | 02:43 | |
| rderose | davechen: correct! if enabled, both would be > 0 | 02:44 |
| rderose | davechen: and if enabled, now check if min_age > password_expires | 02:44 |
| rderose | :) | 02:45 |
| rderose | right? | 02:45 |
| *** code-R_ has quit IRC | 02:46 | |
| davechen | rderose: you beat me :) | 02:46 |
| *** code-R has joined #openstack-keystone | 02:46 | |
| rderose | davechen: hahaha | 02:46 |
| rderose | I think we are just going around in circles | 02:46 |
| rderose | it's probably my fault ;) | 02:47 |
| davechen | rderose: so i still think min_age > 0 and expires > 1 would be better. | 02:48 |
| openstackgerrit | Merged openstack/keystone: Adds check that minimum password age is less than password expires days https://review.openstack.org/360737 | 02:48 |
| davechen | min_age >= 0 and expires >= 1 | 02:50 |
| rderose | davechen: true | 02:50 |
| rderose | I was thinking that the password_expires_days default was zero (and probably should be) | 02:51 |
| rderose | davechen: but it still will work | 02:51 |
| davechen | yes, i think so, just need think more about margin value. | 02:52 |
| openstackgerrit | Merged openstack/keystone: Adds password regular expression checks to doctor https://review.openstack.org/360757 | 02:55 |
| *** daemontool has quit IRC | 03:07 | |
| openstackgerrit | Nam Nguyen Hoai proposed openstack/keystone: Fix formatting strings when using multiple variables https://review.openstack.org/361882 | 03:08 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement encryption of credentials at rest https://review.openstack.org/355618 | 03:08 |
| *** roxanagh_ has joined #openstack-keystone | 03:09 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Document credential encryption https://review.openstack.org/354497 | 03:10 |
| *** daemontool has joined #openstack-keystone | 03:11 | |
| *** tqtran has joined #openstack-keystone | 03:13 | |
| *** tqtran has quit IRC | 03:18 | |
| *** tonytan_brb has quit IRC | 03:21 | |
| *** code-R has quit IRC | 03:44 | |
| *** code-R_ has joined #openstack-keystone | 03:44 | |
| *** links has joined #openstack-keystone | 03:51 | |
| openstackgerrit | Nam Nguyen Hoai proposed openstack/keystone: Fix formatting strings in LOG.debug https://review.openstack.org/361895 | 03:56 |
| openstackgerrit | Nam Nguyen Hoai proposed openstack/keystone: Fix formatting strings in LOG.warning https://review.openstack.org/361882 | 04:03 |
| *** akrzos_ has quit IRC | 04:07 | |
| *** roxanag__ has joined #openstack-keystone | 04:08 | |
| *** roxanagh_ has quit IRC | 04:09 | |
| *** akrzos has joined #openstack-keystone | 04:09 | |
| *** code-R_ has quit IRC | 04:10 | |
| *** tonytan4ever has joined #openstack-keystone | 04:22 | |
| *** tonytan4ever has quit IRC | 04:26 | |
| *** code-R has joined #openstack-keystone | 04:30 | |
| *** jrist has quit IRC | 04:33 | |
| *** jrist has joined #openstack-keystone | 04:34 | |
| *** ntpttr- has quit IRC | 04:36 | |
| *** code-R_ has joined #openstack-keystone | 04:38 | |
| *** ntpttr- has joined #openstack-keystone | 04:40 | |
| *** code-R has quit IRC | 04:41 | |
| *** ntpttr- is now known as ntpttr | 04:41 | |
| *** ntpttr has quit IRC | 04:44 | |
| *** ayoung has quit IRC | 04:58 | |
| *** code-R_ has quit IRC | 05:03 | |
| *** code-R has joined #openstack-keystone | 05:03 | |
| *** jaosorior has joined #openstack-keystone | 05:10 | |
| openstackgerrit | Ukesh Kumar proposed openstack/keystone: check for user existence, for role add to user https://review.openstack.org/362606 | 05:13 |
| *** lifeless_ is now known as lifeless | 05:15 | |
| *** agrebennikov has joined #openstack-keystone | 05:32 | |
| *** code-R_ has joined #openstack-keystone | 05:34 | |
| *** code-R has quit IRC | 05:38 | |
| *** richm has quit IRC | 05:38 | |
| *** code-R_ has quit IRC | 05:40 | |
| *** code-R has joined #openstack-keystone | 05:41 | |
| *** sdake has quit IRC | 05:47 | |
| *** sdake has joined #openstack-keystone | 05:50 | |
| *** agrebennikov has quit IRC | 05:53 | |
| *** su_zhang has joined #openstack-keystone | 05:56 | |
| *** su_zhang has quit IRC | 06:13 | |
| *** akrzos has quit IRC | 06:13 | |
| *** su_zhang has joined #openstack-keystone | 06:14 | |
| *** akrzos has joined #openstack-keystone | 06:15 | |
| *** su_zhang has quit IRC | 06:18 | |
| *** rcernin has joined #openstack-keystone | 06:19 | |
| *** pcaruana has joined #openstack-keystone | 06:26 | |
| *** akanksha_ has joined #openstack-keystone | 06:27 | |
| *** akanksha_ has left #openstack-keystone | 06:28 | |
| *** sdake has quit IRC | 06:44 | |
| *** roxanag__ has quit IRC | 06:50 | |
| *** roxanagh_ has joined #openstack-keystone | 06:51 | |
| *** roxanagh_ has quit IRC | 06:56 | |
| *** tesseract- has joined #openstack-keystone | 07:07 | |
| *** sheel has joined #openstack-keystone | 07:08 | |
| *** jpena|off is now known as jpena | 07:12 | |
| *** tqtran has joined #openstack-keystone | 07:16 | |
| *** code-R has quit IRC | 07:18 | |
| *** tqtran has quit IRC | 07:20 | |
| *** rkrum has quit IRC | 07:21 | |
| *** roxanagh_ has joined #openstack-keystone | 07:52 | |
| *** code-R has joined #openstack-keystone | 07:55 | |
| *** roxanagh_ has quit IRC | 07:56 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** lhinds_ has joined #openstack-keystone | 08:02 | |
| *** zzzeek has joined #openstack-keystone | 08:02 | |
| *** lhinds_ has left #openstack-keystone | 08:04 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** magic has joined #openstack-keystone | 08:18 | |
| *** magic is now known as Guest99973 | 08:19 | |
| *** Guest33431 has quit IRC | 08:22 | |
| *** tonytan4ever has joined #openstack-keystone | 08:23 | |
| *** tonytan4ever has quit IRC | 08:28 | |
| *** markd_ has joined #openstack-keystone | 08:40 | |
| *** asettle has joined #openstack-keystone | 08:46 | |
| *** daemontool has quit IRC | 08:46 | |
| *** daemontool has joined #openstack-keystone | 08:49 | |
| *** code-R_ has joined #openstack-keystone | 09:00 | |
| *** links has quit IRC | 09:00 | |
| *** code-R has quit IRC | 09:03 | |
| *** jaosorior is now known as jaosorior_lunch | 09:08 | |
| *** links has joined #openstack-keystone | 09:16 | |
| *** joerch has joined #openstack-keystone | 09:29 | |
| *** roxanagh_ has joined #openstack-keystone | 09:40 | |
| *** jaosorior_lunch is now known as jaosorior | 09:42 | |
| *** roxanagh_ has quit IRC | 09:45 | |
| *** GB21 has joined #openstack-keystone | 10:03 | |
| samueldmq | morning | 10:04 |
| *** wangqun has quit IRC | 10:08 | |
| *** daemontool has quit IRC | 10:09 | |
| *** daemontool has joined #openstack-keystone | 10:09 | |
| *** richm has joined #openstack-keystone | 10:12 | |
| breton | o/ | 10:22 |
| *** tonytan4ever has joined #openstack-keystone | 10:24 | |
| *** tonytan4ever has quit IRC | 10:28 | |
| *** EinstCrazy has quit IRC | 10:31 | |
| *** EinstCrazy has joined #openstack-keystone | 10:31 | |
| *** EinstCrazy has quit IRC | 10:36 | |
| *** GB21 has quit IRC | 10:49 | |
| *** itisha has joined #openstack-keystone | 10:49 | |
| *** namnh has quit IRC | 10:49 | |
| *** GB21 has joined #openstack-keystone | 10:50 | |
| *** namnh has joined #openstack-keystone | 10:50 | |
| *** amakarov_away is now known as amakarov | 11:05 | |
| *** mdurrant_ has joined #openstack-keystone | 11:10 | |
| *** mdurrant has quit IRC | 11:13 | |
| *** tqtran has joined #openstack-keystone | 11:17 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Do not check that fernet keys exist on startup https://review.openstack.org/362785 | 11:19 |
| *** tqtran has quit IRC | 11:22 | |
| marekd | a question: With Identity API V2 being deprecated, do we assume that services should use port 5000 while talking with keystone? | 11:22 |
| marekd | samueldmq: breton ^^ any ideas? | 11:24 |
| breton | marekd: that's a long discussion and afaik there is no opinion we agreed on | 11:27 |
| *** roxanagh_ has joined #openstack-keystone | 11:29 | |
| breton | marekd: also stevemar was for 5000 some time ago. Also, in devstack keystone runs on 80. | 11:30 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 11:33 |
| *** roxanagh_ has quit IRC | 11:33 | |
| *** asettle has quit IRC | 11:35 | |
| *** asettle has joined #openstack-keystone | 11:36 | |
| *** asettle has quit IRC | 11:51 | |
| *** namnh has quit IRC | 11:51 | |
| *** jpena is now known as jpena|lunch | 12:00 | |
| *** jaosorior has quit IRC | 12:04 | |
| *** namnh has joined #openstack-keystone | 12:04 | |
| *** jaosorior has joined #openstack-keystone | 12:04 | |
| *** namnh has quit IRC | 12:05 | |
| *** jaosorior has quit IRC | 12:11 | |
| *** jaosorior has joined #openstack-keystone | 12:12 | |
| *** afred312_ has joined #openstack-keystone | 12:12 | |
| *** tonytan4ever has joined #openstack-keystone | 12:13 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Update developer docs for new rolling upgrade repos https://review.openstack.org/359383 | 12:13 |
| *** afred312 has quit IRC | 12:14 | |
| *** iurygregory has quit IRC | 12:15 | |
| *** clenimar has quit IRC | 12:15 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation assignment driver https://review.openstack.org/291318 | 12:24 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Move dependency-related trust logic to manager https://review.openstack.org/360735 | 12:24 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation trust driver https://review.openstack.org/291871 | 12:25 |
| dstanek | marekd: breton: 443 using SSL would be ideal imo | 12:25 |
| dstanek | it looks like i just don't understand the cloud policy example | 12:26 |
| dstanek | what is admin_domain_id? | 12:27 |
| dstanek | just whatever you want right? | 12:27 |
| marekd | dstanek: breton even on mitaka? | 12:29 |
| dstanek | marekd: i don't see why not | 12:30 |
| marekd | dstanek: ok, thanks! | 12:31 |
| breton | dstanek: yes, you need to type it there manually | 12:31 |
| *** su_zhang has joined #openstack-keystone | 12:31 | |
| breton | dstanek: uuid of a domain | 12:31 |
| dstanek | breton: yeah, that's what i thought. i must have something else wrong | 12:32 |
| dstanek | breton: thanks for the confirmation | 12:32 |
| *** adu has joined #openstack-keystone | 12:38 | |
| *** EinstCrazy has joined #openstack-keystone | 12:44 | |
| *** davechen has left #openstack-keystone | 12:47 | |
| henrynash | dstanek: yes, so that was provided prior to us having the is_admin_project thing.....which in theory should be able to usurp the admin_domain_id requirement....although not sure if all the dots are joined up for is_admin_project (I think they are) | 12:49 |
| breton | henrynash: they are | 12:50 |
| henrynash | breton: yep, excellent | 12:51 |
| breton | henrynash: could you please review https://review.openstack.org/#/c/339294/ ? | 12:52 |
| henrynash | breton: sure | 12:52 |
| breton | henrynash: "Faster id mapping lookup" | 12:52 |
| *** markvoelker has joined #openstack-keystone | 12:52 | |
| *** jpena|lunch is now known as jpena | 12:59 | |
| *** clenimar has joined #openstack-keystone | 13:00 | |
| *** iurygregory has joined #openstack-keystone | 13:00 | |
| *** guoshan has joined #openstack-keystone | 13:02 | |
| *** guoshan has quit IRC | 13:02 | |
| *** guoshan has joined #openstack-keystone | 13:03 | |
| *** guoshan has quit IRC | 13:03 | |
| *** GB21 has quit IRC | 13:04 | |
| *** guoshan has joined #openstack-keystone | 13:04 | |
| henrynash | breton: added a question on testing...but otherwise looks good. | 13:04 |
| *** agrebennikov has joined #openstack-keystone | 13:05 | |
| *** agrebennikov has quit IRC | 13:06 | |
| *** su_zhang has quit IRC | 13:07 | |
| *** asettle has joined #openstack-keystone | 13:07 | |
| *** su_zhang has joined #openstack-keystone | 13:07 | |
| *** rodrigods has quit IRC | 13:09 | |
| *** rodrigods has joined #openstack-keystone | 13:09 | |
| *** david-lyle has quit IRC | 13:10 | |
| *** pauloewerton has joined #openstack-keystone | 13:10 | |
| *** su_zhang has quit IRC | 13:11 | |
| *** sfilatov has joined #openstack-keystone | 13:13 | |
| *** roxanagh_ has joined #openstack-keystone | 13:14 | |
| *** sheel has quit IRC | 13:16 | |
| *** markvoelker has quit IRC | 13:17 | |
| *** david-lyle has joined #openstack-keystone | 13:18 | |
| *** roxanagh_ has quit IRC | 13:19 | |
| *** sfilatov has quit IRC | 13:20 | |
| *** adu has quit IRC | 13:21 | |
| *** afaranha has joined #openstack-keystone | 13:21 | |
| *** GB21 has joined #openstack-keystone | 13:23 | |
| *** daemontool has quit IRC | 13:25 | |
| *** daemontool has joined #openstack-keystone | 13:27 | |
| *** raildo has joined #openstack-keystone | 13:28 | |
| *** EinstCrazy has quit IRC | 13:31 | |
| *** su_zhang has joined #openstack-keystone | 13:31 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/python-keystoneclient: Fix missing service_catalog parameter in Client object https://review.openstack.org/339150 | 13:37 |
| rodrigods | henrynash, available time to revisit https://review.openstack.org/#/c/358770/ ? | 13:39 |
| *** markvoelker has joined #openstack-keystone | 13:40 | |
| *** markvoelker has quit IRC | 13:45 | |
| *** woodburn has left #openstack-keystone | 13:46 | |
| *** afaranha has quit IRC | 13:47 | |
| *** daemontool has quit IRC | 13:49 | |
| *** daemontool has joined #openstack-keystone | 13:50 | |
| *** ayoung has joined #openstack-keystone | 13:52 | |
| *** ChanServ sets mode: +v ayoung | 13:52 | |
| henrynash | rodigods: sure, will take a look shortly | 13:57 |
| *** zzzeek has quit IRC | 14:00 | |
| rodrigods | thanks henrynash | 14:01 |
| *** esp has quit IRC | 14:01 | |
| *** su_zhang has quit IRC | 14:03 | |
| *** zzzeek has joined #openstack-keystone | 14:03 | |
| *** hockeynut has joined #openstack-keystone | 14:03 | |
| *** su_zhang has joined #openstack-keystone | 14:04 | |
| *** zzzeek has quit IRC | 14:04 | |
| *** zzzeek has joined #openstack-keystone | 14:05 | |
| *** browne has joined #openstack-keystone | 14:07 | |
| *** sdake has joined #openstack-keystone | 14:08 | |
| *** su_zhang has quit IRC | 14:08 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes migration where password created_at is nullable https://review.openstack.org/362501 | 14:11 |
| *** woodburn has joined #openstack-keystone | 14:11 | |
| *** sdake_ has joined #openstack-keystone | 14:12 | |
| *** sdake has quit IRC | 14:13 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes migration where password created_at is nullable before 105 fix https://review.openstack.org/362510 | 14:13 |
| lbragstad | dstanek dolphm did we ever figure out what we wanted to do about notification payloads? I remember we were talking about adding more stuff to them for a while there | 14:16 |
| lbragstad | implementing soft deletes was another option | 14:16 |
| lbragstad | for solving the same problem | 14:17 |
| dolphm | lbragstad: are you blocked by that issue / do you need a solution right now? | 14:17 |
| lbragstad | dolphm no not at all... I was just looking at one of my stale reviews | 14:17 |
| dolphm | henrynash: breton: does that mean we should be able to more easily switch to the new default policy file soon? | 14:18 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes migration where password created_at is nullable before 105 fix https://review.openstack.org/362510 | 14:18 |
| dolphm | henrynash: i just noticed the Partial-Bug on this one - what's missing? https://review.openstack.org/#/c/358723/ | 14:19 |
| henrynash | dolphm: don't support (checking for) update, indexes or trigger | 14:20 |
| dolphm | henrynash: ah, triggers will be particularly hard (if not impossible) to test for | 14:20 |
| dolphm | henrynash: indexes might be doable? and we can't add update without dropping support for sqlite, right? | 14:20 |
| henrynash | dolphm: yeah, agreed, not sure how to do that | 14:21 |
| dolphm | henrynash: sounds like i should be filing 3 more bugs then :) | 14:21 |
| henrynash | dolphm: I think update is a an issue across all DBs, since when they chaneg the migration version, you get an update! | 14:21 |
| dolphm | henrynash: is that detected by those tests? | 14:22 |
| henrynash | dolphm: so the migration version update would trigger the banned check (whcih is why we don't check for update right now) | 14:22 |
| dolphm | henrynash: ooh | 14:22 |
| dolphm | henrynash: is there a complication with indexes? | 14:23 |
| henrynash | dolphm: really need to do something like "inspect the table being updated and if its the migration version then let it go through"....but not sure we can really do that with the current monkeypatching approach | 14:23 |
| henrynash | dolphm: I have not check for indexes yet | 14:24 |
| henrynash | dolphm: do don't know how easy/hard that is | 14:24 |
| dolphm | hmm, k | 14:24 |
| dolphm | henrynash: aaand last question i wanted to pester you with - did you see my comment on https://review.openstack.org/#/c/357789/ ? | 14:25 |
| *** spedione|AWAY is now known as spedione | 14:26 | |
| henrynash | dolphm: so I think rderose was re-writing this patch entirely (at least that was my understanding as of yesterday)....although interested to undestand what is "simpler" about master now? | 14:28 |
| *** daemontool has quit IRC | 14:28 | |
| *** daemontool has joined #openstack-keystone | 14:28 | |
| rderose | henrynash dolphm: yeah, stevemar asked me to do an alternative patch to fix the password created_at issue based on Michael Bayer's comments | 14:29 |
| dolphm | henrynash: i landed a patch to master that allows the sql upgrade test module to control all 4 repositories at once, which A) means you can write a single test that covers each step of the 3 phase rolling upgrade, and B) means that we can test edge cases, like things running out of order, etc | 14:29 |
| henrynash | dolphm: ah, right, that patch...Ok, udnerstand yes | 14:30 |
| henrynash | dolphm: and a fine patch it was, too | 14:30 |
| *** jdennis1 has joined #openstack-keystone | 14:30 | |
| rodrigods | henrynash, do we have tests for our Hints() implementation? | 14:31 |
| *** jdennis has quit IRC | 14:31 | |
| *** michauds has joined #openstack-keystone | 14:32 | |
| *** ravelar has joined #openstack-keystone | 14:32 | |
| dolphm | henrynash: lol. between mike's suggestion and the patch i landed, i hope your patch should be a little easier :) | 14:32 |
| *** su_zhang has joined #openstack-keystone | 14:34 | |
| *** dikonoor has joined #openstack-keystone | 14:34 | |
| rodrigods | henrynash, hmm test_driver_hints? | 14:34 |
| *** woodster_ has joined #openstack-keystone | 14:34 | |
| *** su_zhang has quit IRC | 14:36 | |
| *** su_zhang has joined #openstack-keystone | 14:37 | |
| *** tonytan_brb has joined #openstack-keystone | 14:37 | |
| *** tonytan4ever has quit IRC | 14:40 | |
| *** su_zhang has quit IRC | 14:41 | |
| *** tonytan_brb has quit IRC | 14:42 | |
| *** daemontool has quit IRC | 14:42 | |
| *** tonytan4ever has joined #openstack-keystone | 14:42 | |
| *** david-lyle has quit IRC | 14:43 | |
| dolphm | rodrigods: the answer to "do we have tests for this?" is always to break the thing and see what tests fail ;) | 14:43 |
| rodrigods | dolphm, right! :) | 14:44 |
| rodrigods | dolphm, trying to fix https://bugs.launchpad.net/keystone/+bug/1614154 here | 14:44 |
| openstack | Launchpad bug 1614154 in OpenStack Identity (keystone) "Hints with values of None seem to be broken" [Medium,Confirmed] - Assigned to Abhishek Kumar Tiwary (aktiwary) | 14:44 |
| rodrigods | dolphm, not fix, but trying to prove a concept | 14:44 |
| henrynash | rodigods: do test_driver_hints tests the underlying mechanism, but that bug appears to indicate a problem with the processing of hints in sql core | 14:44 |
| dolphm | rodrigods: i was thinking we needed to replace the default values (None) with a NOVALUE constant so we could distinguish between them? | 14:45 |
| *** jaosorior is now known as jaosorior_away | 14:45 | |
| rodrigods | dolphm, that's an alternative, it would also work for indexes using nullable values | 14:45 |
| rodrigods | think that's how we do for the project table when a domain_id is null | 14:46 |
| *** adrian_otto has joined #openstack-keystone | 14:46 | |
| *** sdake_ has quit IRC | 14:47 | |
| *** guoshan has quit IRC | 14:47 | |
| *** david-lyle has joined #openstack-keystone | 14:48 | |
| *** adrian_otto has quit IRC | 14:53 | |
| dstanek | dolphm: rodrigods: ++ NOVALUE = object()" | 14:54 |
| dstanek | that's a common keystone pattern already 'grep -r "= object()" keystone' and you'll find a bunch | 14:55 |
| *** asettle has quit IRC | 14:56 | |
| *** asettle has joined #openstack-keystone | 14:57 | |
| rodrigods | dstanek, dolphm my idea to fix the bug was to improve the Hints() to handle None values, but I guess the "object()" approach is cleaner | 15:00 |
| dolphm | rodrigods: by changing the defaults to something other than None, you're doing exactly that -- adding the ability to handle incoming None values | 15:00 |
| rodrigods | dolphm, yes, and with the benefit of using them in indexes if desired | 15:02 |
| *** david-lyle has quit IRC | 15:02 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/362928 | 15:02 |
| *** roxanagh_ has joined #openstack-keystone | 15:04 | |
| dstanek | rodrigods: using in an index? | 15:06 |
| *** tonytan_brb has joined #openstack-keystone | 15:07 | |
| *** roxanagh_ has quit IRC | 15:09 | |
| *** sdake has joined #openstack-keystone | 15:09 | |
| *** spedione is now known as spedione|AWAY | 15:11 | |
| *** tonytan4ever has quit IRC | 15:11 | |
| *** Michaellaneous has joined #openstack-keystone | 15:12 | |
| Michaellaneous | Hey, I got some questions about ldap integrations. | 15:12 |
| Michaellaneous | I wanna use it for my dashboard. | 15:12 |
| Michaellaneous | I am new to LDAP so...it's all a bit confusing. | 15:12 |
| *** nkinder has quit IRC | 15:12 | |
| openstackgerrit | Merged openstack/keystone: Add man page info for credential setup command https://review.openstack.org/362453 | 15:14 |
| openstackgerrit | Merged openstack/keystone: Remove unnecessary try/except from token provider https://review.openstack.org/362352 | 15:14 |
| dstanek | Michaellaneous: feel free to just ask your questions here any likely someone will eventually be around to help | 15:14 |
| Michaellaneous | Well, I followed this guide | 15:15 |
| Michaellaneous | http://docs.openstack.org/admin-guide/keystone-integrate-with-ldap.html | 15:15 |
| Michaellaneous | Kinda. I think, the whole backends, multiple ones is confusing. | 15:15 |
| Michaellaneous | I also have my little ldap setup | 15:15 |
| Michaellaneous | https://i.imgur.com/pJadq34.png | 15:15 |
| Michaellaneous | It works I tried it out on a linux machine. | 15:15 |
| *** spedione|AWAY is now known as spedione | 15:16 | |
| Michaellaneous | Just the...configuration is confusing. | 15:16 |
| dstanek | Michaellaneous: did you get it working? | 15:17 |
| Michaellaneous | No. | 15:17 |
| Michaellaneous | I tried logging into the dashboard and it said nop.e | 15:17 |
| dstanek | Michaellaneous: which part is confusing? | 15:17 |
| Michaellaneous | Well there is integrate identity, identify backend and assignment. | 15:18 |
| Michaellaneous | What does what? | 15:18 |
| dstanek | Michaellaneous: have you looked in your keystone log to see error messages or maybe event the ldap query run? | 15:18 |
| dstanek | you really only want to use ldap for identity (where the user info/auth/etc comes from) | 15:18 |
| dstanek | assignment is saying what a user can do | 15:18 |
| *** tqtran has joined #openstack-keystone | 15:19 | |
| dstanek | everything in keystone is based on backends that can be configured for a particular cloud | 15:19 |
| *** zzzeek has quit IRC | 15:19 | |
| dstanek | for instance you want your users from ldap, but i like mine from sql | 15:19 |
| Michaellaneous | Okay, hold on. | 15:20 |
| Michaellaneous | Where is the difference between Identiy and Identity backend then? | 15:21 |
| *** david-lyle has joined #openstack-keystone | 15:22 | |
| dstanek | identity is the system that deals with information for users/groups/etc and the identity backend if the specific storage mechanism for that data (sql, ldap, whatever) | 15:22 |
| *** ddieterly has joined #openstack-keystone | 15:23 | |
| *** tqtran has quit IRC | 15:23 | |
| dstanek | Michaellaneous: does that make sense? | 15:23 |
| Michaellaneous | Kinda...I think? | 15:24 |
| Michaellaneous | Not really becuase both seem the same to me still. | 15:24 |
| Michaellaneous | If I use ldap for authentification isn't that also my storage mechanism? | 15:24 |
| dstanek | ldap is a backend | 15:24 |
| dstanek | saying identity is really talking about the concept of user/groups/etc. nothing more than than. we have a user, we can auth a user, users are in groups etc. | 15:25 |
| Michaellaneous | Okay. | 15:25 |
| dstanek | the backend is the implemenation of where that data comes from | 15:25 |
| *** nkinder has joined #openstack-keystone | 15:25 | |
| Michaellaneous | Well I want them coming from LDAP. | 15:26 |
| dstanek | then use the ldap backend :-) | 15:26 |
| Michaellaneous | Okay. | 15:27 |
| *** links has quit IRC | 15:28 | |
| dstanek | Michaellaneous: did you have trouble configuring ldap? | 15:29 |
| Michaellaneous | Yeah. | 15:30 |
| Michaellaneous | http://pastebin.com/yaQmdyA2 | 15:30 |
| Michaellaneous | This is my config. | 15:30 |
| Michaellaneous | keystone.conf to be exact. | 15:30 |
| *** sdake has quit IRC | 15:31 | |
| dstanek | Michaellaneous: is that just the ldap portion? | 15:31 |
| dstanek | of the whole file? | 15:31 |
| Michaellaneous | Just the ldap portion. | 15:31 |
| Michaellaneous | The rest of openstack works perfectly. | 15:32 |
| dstanek | so what is the problem you are having? | 15:32 |
| *** mdurrant_ is now known as mdurrant | 15:32 | |
| Michaellaneous | When I try to login into dashboard it says user does not exist. | 15:33 |
| Michaellaneous | syslog doesnt really say anything. | 15:33 |
| Michaellaneous | Lemme check the keystone specific logs | 15:33 |
| Michaellaneous | .Wait. | 15:34 |
| Michaellaneous | ERROR keystone ImportError: No module named ldap.filter | 15:34 |
| Michaellaneous | That could certainly be the issue. | 15:34 |
| dstanek | if i were to guess i would say that the ldap python libraries are not installed | 15:34 |
| Michaellaneous | Installed that and another one that was missing. | 15:37 |
| Michaellaneous | Lemme quickly write that down for the docu.. | 15:38 |
| stevemar | o/ | 15:38 |
| *** zzzeek has joined #openstack-keystone | 15:40 | |
| rodrigods | dstanek, yeah... nullable columns don't work in indexes | 15:40 |
| rodrigods | dstanek, http://stackoverflow.com/questions/9175591/index-for-nullable-column | 15:40 |
| *** david-lyle has quit IRC | 15:40 | |
| *** zzzeek has quit IRC | 15:41 | |
| *** gyee has joined #openstack-keystone | 15:42 | |
| *** akscram has quit IRC | 15:42 | |
| dstanek | rodrigods: hmmm... we used to do it with oracle, but i have no idea about mysql | 15:42 |
| Michaellaneous | So. | 15:42 |
| Michaellaneous | Now keystone says that the address is already in use. | 15:42 |
| Michaellaneous | Trying to bind to. | 15:42 |
| dstanek | having <<null>> in columns look terrible | 15:42 |
| dstanek | Michaellaneous: how are you running keystone? | 15:42 |
| Michaellaneous | 35357 | 15:42 |
| Michaellaneous | automatically on startup. | 15:42 |
| *** zzzeek has joined #openstack-keystone | 15:43 | |
| Michaellaneous | Appearently apache2 is running on 35357 | 15:44 |
| dstanek | Michaellaneous: to restart keystone did you restart apache? | 15:45 |
| Michaellaneous | nope | 15:45 |
| Michaellaneous | service keystone restart | 15:45 |
| dstanek | if apache is on 35357 then that means you have apache configured to run keystone. try restarting that | 15:46 |
| Michaellaneous | Okay done that. | 15:47 |
| Michaellaneous | Now I can't login at all. | 15:47 |
| Michaellaneous | Neither with original admin nor ldap | 15:47 |
| *** awayne has quit IRC | 15:48 | |
| *** akscram has joined #openstack-keystone | 15:49 | |
| *** david-lyle has joined #openstack-keystone | 15:50 | |
| dstanek | Michaellaneous: bad config? what is in the log files? | 15:50 |
| *** itisha has quit IRC | 15:50 | |
| Michaellaneous | Keystone logs are silent. | 15:51 |
| dstanek | in /var/log/apache2/keystone.log? | 15:51 |
| Michaellaneous | Hold on. | 15:51 |
| Michaellaneous | Could not find domain: 36d024eae7ea4865b87d1e29bd73cef5 | 15:52 |
| *** ddieterly is now known as ddieterly[away] | 15:53 | |
| Michaellaneous | INVALID_CREDENTIALS: {'desc': 'Invalid credentials'} | 15:53 |
| *** chrisshattuck has joined #openstack-keystone | 15:54 | |
| dstanek | do you have debug logging on? | 15:55 |
| dstanek | if so, i'm hoping that you have some ldap stuff in there | 15:55 |
| Michaellaneous | I set it to 0 | 15:56 |
| Michaellaneous | what should Is et it to | 15:56 |
| dstanek | 'debug = true' | 15:57 |
| Michaellaneous | Wait, where? | 15:57 |
| dstanek | you probably also want debug_level set to a reasonable number | 15:58 |
| *** ddieterly[away] is now known as ddieterly | 15:58 | |
| dstanek | [DEFAULT]/debug and [ldap]/debug_level | 15:59 |
| dstanek | Michaellaneous: also does that domain exist? | 16:00 |
| Michaellaneous | Well no. | 16:01 |
| Michaellaneous | It's not my domain. | 16:01 |
| Michaellaneous | My domain is named differently. | 16:01 |
| dstanek | where is that id coming from? | 16:01 |
| Michaellaneous | No idea. | 16:01 |
| dstanek | maybe that's the if for one of your domains? | 16:02 |
| Michaellaneous | if? | 16:03 |
| Michaellaneous | ID | 16:03 |
| Michaellaneous | not sure how to figure that out tho. | 16:03 |
| dstanek | since keystone isn't working yet you'd have to look in the database | 16:04 |
| rderose | stevemar: https://review.openstack.org/#/c/362501/ and https://review.openstack.org/#/c/362510/ | 16:04 |
| dstanek | once you set debugging you should get more information to help you | 16:04 |
| stevemar | thanks rderose | 16:04 |
| rderose | stevemar: np | 16:05 |
| rderose | stevemar: that is, if I can get it through the gate | 16:06 |
| *** adrian_otto has joined #openstack-keystone | 16:06 | |
| *** adrian_otto has quit IRC | 16:06 | |
| rderose | stevemar: getting a strange error | 16:06 |
| *** adrian_otto has joined #openstack-keystone | 16:06 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement encryption of credentials at rest https://review.openstack.org/355618 | 16:07 |
| *** ravelar has quit IRC | 16:07 | |
| *** ravelar1 has joined #openstack-keystone | 16:07 | |
| *** adrian_otto has quit IRC | 16:09 | |
| *** adrian_otto has joined #openstack-keystone | 16:09 | |
| *** tonytan_brb has quit IRC | 16:17 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Validate mapping exists when creating/updating a protocol https://review.openstack.org/362397 | 16:21 |
| *** david-lyle has quit IRC | 16:21 | |
| *** krotscheck has joined #openstack-keystone | 16:23 | |
| *** david-lyle has joined #openstack-keystone | 16:23 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Do not check that fernet keys exist on startup https://review.openstack.org/362785 | 16:27 |
| krotscheck | Hey everyone, devstack question. When reading the service catalog from the clouds.yaml file created for devstack, the inital URL is http://HOST/identity_v2_admin, which eventually ends up pointing at http://HOST/identity/ (if you follow all the various links). However, http://HOST:5000/ is also available. Is there a particular reason that the devstack keystone service is registered as a proxy via port 80, rather than 5000? | 16:29 |
| *** adrian_otto has quit IRC | 16:31 | |
| breton | krotscheck: the reason to support 80 is to have everything on a single domain. Also easier to SSL. | 16:32 |
| *** hockeynut has quit IRC | 16:33 | |
| *** adrian_otto has joined #openstack-keystone | 16:33 | |
| *** code-R_ has quit IRC | 16:34 | |
| dstanek | breton: single domain on ssl is hard | 16:35 |
| *** joerch has quit IRC | 16:35 | |
| *** david-lyle_ has joined #openstack-keystone | 16:36 | |
| *** tqtran has joined #openstack-keystone | 16:36 | |
| Michaellaneous | If I have ldap and use apache2 as auth provider. | 16:36 |
| Michaellaneous | What do I have to config? | 16:36 |
| Michaellaneous | keystone.conf or somethig else? | 16:37 |
| dstanek | Michaellaneous: what do you mean by auth provider? | 16:37 |
| krotscheck | breton: Thanks, I guess I can't change that. I'm trying to brainstorm how to sanely extract the root version endpoint, given that a service in keystone may be registered as the root resource, a specific version resource (like nova), something with a token in it, etc.... http://paste.openstack.org/show/564857/ | 16:38 |
| *** david-lyle has quit IRC | 16:39 | |
| *** roxanaghe has quit IRC | 16:40 | |
| *** roxanaghe has joined #openstack-keystone | 16:41 | |
| Michaellaneous | Well, then I restart keystone it says address already in use. | 16:41 |
| Michaellaneous | Because apache is running on that address. | 16:41 |
| dstanek | Michaellaneous: that's because apache is runnning keystone | 16:42 |
| Michaellaneous | Yeah. | 16:42 |
| Michaellaneous | Appearently. | 16:42 |
| Michaellaneous | So what config do I have to edit? | 16:42 |
| *** joerch has joined #openstack-keystone | 16:42 | |
| Michaellaneous | keystone.conf still? | 16:42 |
| dstanek | service keystone start - is the old way that didn't use apache - it's no longer supported in newer releases | 16:42 |
| dstanek | yes, keystone.conf | 16:43 |
| Michaellaneous | Okay. | 16:43 |
| Michaellaneous | Thanks. | 16:43 |
| *** roxanaghe_ has joined #openstack-keystone | 16:44 | |
| *** esp has joined #openstack-keystone | 16:46 | |
| *** ddieterly is now known as ddieterly[away] | 16:47 | |
| *** roxanaghe has quit IRC | 16:47 | |
| *** roxanaghe__ has joined #openstack-keystone | 16:47 | |
| *** roxanaghe_ has quit IRC | 16:51 | |
| *** jaosorior_away has quit IRC | 16:51 | |
| *** ddieterly[away] is now known as ddieterly | 16:52 | |
| *** gyee has quit IRC | 16:53 | |
| *** joerch has quit IRC | 16:53 | |
| Michaellaneous | I don't quite get this: | 16:54 |
| Michaellaneous | user = dc=Manager,dc=example,dc=org | 16:54 |
| Michaellaneous | dc=user | 16:54 |
| Michaellaneous | What is a dc=user | 16:54 |
| Michaellaneous | I only have my cn=admin | 16:54 |
| *** gyee has joined #openstack-keystone | 16:55 | |
| *** jpena is now known as jpena|off | 16:58 | |
| *** su_zhang has joined #openstack-keystone | 17:01 | |
| *** su_zhang has quit IRC | 17:03 | |
| *** su_zhang has joined #openstack-keystone | 17:04 | |
| *** su_zhang has quit IRC | 17:04 | |
| *** su_zhang has joined #openstack-keystone | 17:05 | |
| *** su_zhang has quit IRC | 17:11 | |
| *** su_zhang has joined #openstack-keystone | 17:11 | |
| *** rcernin has quit IRC | 17:12 | |
| *** amakarov is now known as amakarov_away | 17:12 | |
| *** tesseract- has quit IRC | 17:14 | |
| *** su_zhang has quit IRC | 17:16 | |
| *** asettle has quit IRC | 17:16 | |
| *** asettle has joined #openstack-keystone | 17:17 | |
| *** shaleh has joined #openstack-keystone | 17:17 | |
| *** tonytan4ever has joined #openstack-keystone | 17:18 | |
| dstanek | where are you seeing that? | 17:22 |
| *** tonytan4ever has quit IRC | 17:23 | |
| *** tesseract- has joined #openstack-keystone | 17:24 | |
| *** pcaruana has quit IRC | 17:25 | |
| *** ddieterly is now known as ddieterly[away] | 17:27 | |
| *** sdake has joined #openstack-keystone | 17:27 | |
| *** tesseract- has quit IRC | 17:28 | |
| *** tonytan4ever has joined #openstack-keystone | 17:29 | |
| Michaellaneous | I think I am getting closer to the issue. | 17:29 |
| Michaellaneous | When I don't use any ldap config. | 17:29 |
| Michaellaneous | I can see use openstack domain list | 17:29 |
| Michaellaneous | If i switch to ldap he said "Domain not available". | 17:29 |
| Michaellaneous | I also can't create new domains. | 17:29 |
| rderose | zzzeek: having an issue when trying to add a default datetime value here: https://review.openstack.org/#/c/362501/3/keystone/common/sql/migrate_repo/versions/105_add_password_date_columns.py | 17:31 |
| zzzeek | rderose: did you mean server_default ? | 17:32 |
| rderose | zzzeek: not necessarily | 17:32 |
| zzzeek | rderose: if you are using the python function here, then you'd use default and it doesnt matter if you're on sqlite | 17:32 |
| zzzeek | rderose: also SQLite supports datetime server default | 17:32 |
| *** su_zhang has joined #openstack-keystone | 17:32 | |
| rderose | zzzeek: hmm... well tests fail when trying to run it via sqlite | 17:33 |
| rderose | currently, I'm seeing the following error in this log file: http://logs.openstack.org/01/362501/3/check/gate-grenade-dsvm-neutron-ubuntu-trusty/ed5469f/logs/grenade.sh.txt.gz | 17:33 |
| rderose | zzzeek: (pymysql.err.InternalError) (1292, u"Incorrect datetime value: '0000-00-00 00:00:00' for column 'created_at' at row 1") [SQL: u'\nALTER TABLE password ADD created_at DATETIME NOT NULL'] | 17:33 |
| zzzeek | rderose: that's a mysql error | 17:34 |
| rderose | zzzeek: when it runs locally using mysql it works | 17:34 |
| rderose | zzzeek: what am I doing wrong? | 17:34 |
| *** su_zhang has quit IRC | 17:35 | |
| *** adrian_otto has quit IRC | 17:35 | |
| *** su_zhang has joined #openstack-keystone | 17:36 | |
| rderose | zzzeek: my understanding of server_default is that it is for table creates | 17:37 |
| *** asettle has quit IRC | 17:37 | |
| rderose | zzzeek: this is an existing table where I'm adding a new column | 17:38 |
| zzzeek | rderose: when you add a column to a table that has lots of rows in it, if you say NOT NULL, you need to give a server default, else the operation makes no sense | 17:38 |
| zzzeek | mysql is nice enough to make a guess but like all guesses, it is tragically wrong | 17:38 |
| zzzeek | it probably works locally because your local table has no data in it | 17:38 |
| *** NishaYadav has joined #openstack-keystone | 17:39 | |
| rderose | zzzeek: ah, okay. so server_default=datetime.datetime.utcnow should work | 17:39 |
| rderose | ? | 17:39 |
| zzzeek | rderose: unfortuanely no, because utcnow is a Python function | 17:39 |
| zzzeek | a SQL databse server default is computed by the databse iself | 17:39 |
| zzzeek | so... func.now() in this case | 17:39 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone-specs: Target Fernet key store to Ocata https://review.openstack.org/363065 | 17:39 |
| rderose | zzzeek: okay, I think I've tried func.now(), but will try it again here | 17:40 |
| rderose | zzzeek: thanks | 17:40 |
| zzzeek | rderose: good luck | 17:40 |
| *** hockeynut has joined #openstack-keystone | 17:42 | |
| *** jaugustine_ has joined #openstack-keystone | 17:43 | |
| *** jaugustine has quit IRC | 17:44 | |
| *** jaugustine_ is now known as jaugustine | 17:44 | |
| * NishaYadav waves hello o/ | 17:44 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes migration where password created_at is nullable https://review.openstack.org/362501 | 17:45 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes migration where password created_at is nullable https://review.openstack.org/362501 | 17:45 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes migration where password created_at is nullable before 105 fix https://review.openstack.org/362510 | 17:45 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes migration where password created_at is nullable before 105 fix https://review.openstack.org/362510 | 17:48 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone-specs: Target Fernet key store to Ocata https://review.openstack.org/363065 | 17:48 |
| *** michauds has quit IRC | 17:52 | |
| *** markvoelker has joined #openstack-keystone | 17:54 | |
| breton | stevemar: how short is ocata? | 17:55 |
| *** afred312_ has quit IRC | 17:58 | |
| *** roxanaghe_ has joined #openstack-keystone | 17:59 | |
| *** asettle has joined #openstack-keystone | 17:59 | |
| stevemar | breton: https://review.openstack.org/#/c/357214/ | 18:00 |
| *** su_zhang has quit IRC | 18:00 | |
| *** roxanaghe has joined #openstack-keystone | 18:01 | |
| stevemar | breton: there are 12 weeks between the summit and milestone 3, that includes christmas and new years and all that | 18:01 |
| *** roxanaghe__ has quit IRC | 18:02 | |
| *** roxanaghe_ has quit IRC | 18:04 | |
| *** tesseract- has joined #openstack-keystone | 18:05 | |
| *** tesseract- has quit IRC | 18:05 | |
| *** tesseract- has joined #openstack-keystone | 18:06 | |
| *** nisha_ has joined #openstack-keystone | 18:07 | |
| *** NishaYadav has quit IRC | 18:07 | |
| *** nisha_ is now known as nishaYadav | 18:07 | |
| *** spzala has joined #openstack-keystone | 18:07 | |
| *** tesseract- has quit IRC | 18:08 | |
| *** michauds has joined #openstack-keystone | 18:09 | |
| *** tesseract- has joined #openstack-keystone | 18:10 | |
| *** tonytan4ever has quit IRC | 18:13 | |
| *** tonytan4ever has joined #openstack-keystone | 18:14 | |
| *** dikonoor has quit IRC | 18:15 | |
| *** dikonoor has joined #openstack-keystone | 18:16 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Filter data when deserializing RevokeEvents https://review.openstack.org/358872 | 18:18 |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/362928 | 18:21 |
| *** markvoelker has quit IRC | 18:22 | |
| *** tqtran has quit IRC | 18:24 | |
| *** su_zhang has joined #openstack-keystone | 18:25 | |
| *** tqtran has joined #openstack-keystone | 18:25 | |
| *** su_zhang has quit IRC | 18:26 | |
| *** ddieterly[away] has quit IRC | 18:27 | |
| *** asettle has quit IRC | 18:27 | |
| *** tqtran has quit IRC | 18:28 | |
| *** tqtran has joined #openstack-keystone | 18:28 | |
| *** tesseract- has quit IRC | 18:30 | |
| *** tesseract- has joined #openstack-keystone | 18:30 | |
| *** tesseract- has quit IRC | 18:30 | |
| *** tesseract- has joined #openstack-keystone | 18:31 | |
| *** ddieterly has joined #openstack-keystone | 18:35 | |
| *** itisha has joined #openstack-keystone | 18:35 | |
| *** tesseract- has quit IRC | 18:37 | |
| *** tonytan_brb has joined #openstack-keystone | 18:42 | |
| *** GB21 has quit IRC | 18:43 | |
| *** su_zhang has joined #openstack-keystone | 18:43 | |
| *** su_zhang has quit IRC | 18:45 | |
| *** tonytan4ever has quit IRC | 18:45 | |
| *** tqtran has quit IRC | 18:46 | |
| *** tqtran has joined #openstack-keystone | 18:46 | |
| *** tonytan4ever has joined #openstack-keystone | 18:47 | |
| *** NikitaKonovalov has quit IRC | 18:50 | |
| *** topol has quit IRC | 18:50 | |
| *** afred312 has joined #openstack-keystone | 18:50 | |
| *** tonytan_brb has quit IRC | 18:50 | |
| *** bknudson has quit IRC | 18:51 | |
| *** ianw has quit IRC | 18:51 | |
| *** jrist has quit IRC | 18:52 | |
| *** basilAB has quit IRC | 18:52 | |
| *** bknudson has joined #openstack-keystone | 18:56 | |
| *** ChanServ sets mode: +v bknudson | 18:56 | |
| *** NikitaKonovalov has joined #openstack-keystone | 18:57 | |
| *** bknudson has left #openstack-keystone | 18:57 | |
| *** ddieterly is now known as ddieterly[away] | 18:58 | |
| *** topol_ has joined #openstack-keystone | 18:59 | |
| *** bknudson has joined #openstack-keystone | 18:59 | |
| *** ChanServ sets mode: +v bknudson | 18:59 | |
| stevemar | henrynash: lbragstad dolphm o/ | 19:00 |
| dolphm | stevemar: o/ | 19:00 |
| rderose | zzzeek: now getting (pymysql.err.InternalError) (1067, u"Invalid default value for 'created_at'") [SQL: u'\nALTER TABLE password ADD created_at DATETIME NOT NULL DEFAULT now()'] | 19:00 |
| lbragstad | henrynash yeah - i'm just saying that if we delay the trigger decision it is unlikely that we are going to have R/W upgrades for newton | 19:00 |
| *** basilAB has joined #openstack-keystone | 19:01 | |
| rderose | zzzeek: server_default=sql.func.now() | 19:01 |
| dolphm | did i miss anything in the keystone meeting? | 19:01 |
| henrynash | rderose: I would think you have to update any rows first that are already null | 19:01 |
| stevemar | dolphm: a whole lot | 19:01 |
| lbragstad | dolphm discussing the path for triggers and encrypted credentials | 19:01 |
| rderose | henrynash: that's the point of server_default | 19:01 |
| rderose | to automatically update existing rows | 19:01 |
| dolphm | oh noes | 19:01 |
| stevemar | dolphm: lbragstad i thought you can do a RW upgrade now? no? | 19:01 |
| dolphm | stevemar: with triggers, yes | 19:02 |
| lbragstad | henrynash stevemar mentioned holding off on the trigger decision until O | 19:02 |
| rderose | zzzeek: any ideas what I'm doing wrong here: https://review.openstack.org/#/c/362501/5/keystone/common/sql/migrate_repo/versions/105_add_password_date_columns.py | 19:02 |
| stevemar | since there aren't any table or column deletions / alters up to migration 110 | 19:02 |
| samueldmq | what is a RW upgrade? | 19:02 |
| henrynash | rderose: I always assumed it didn't work for existing rows...i | 19:02 |
| samueldmq | RW ? | 19:02 |
| lbragstad | henrynash which would also bump R/W upgrades - since the current implementation leverages triggers | 19:02 |
| dolphm | samueldmq: read/write | 19:02 |
| stevemar | samueldmq: read/write | 19:02 |
| dolphm | samueldmq: rather than downtime or read-only | 19:02 |
| bknudson | I thought server_default was the value that got set when a row is inserted | 19:02 |
| henrynash | samueldmq: a no downtime upgrade that lets new and old code cersions continue to R and W during the upgrade process | 19:03 |
| samueldmq | dolphm: stevemar: ok, allowing to read and write during the upgrade process | 19:03 |
| henrynash | bknudson: ++ | 19:03 |
| dolphm | stevemar: what is the benefit of waiting - and what are we waiting *for*, exactly? what do we expect to learn between now and then? | 19:03 |
| zzzeek | rderose: what mysql is that? | 19:03 |
| rderose | henrynash: that doesn't seem to be the problem, it's complaining about the default value | 19:03 |
| samueldmq | henrynash: thx | 19:03 |
| henrynash | rderose: oh | 19:03 |
| rderose | zzzeek: it's pymysql | 19:03 |
| rderose | zzzeek: are you asking which version? | 19:03 |
| zzzeek | rderose: mysql version | 19:04 |
| *** ddieterly[away] is now known as ddieterly | 19:04 | |
| rderose | henrynash: do you know which version? | 19:04 |
| stevemar | dolphm: theres a few things in play here | 19:04 |
| henrynash | lbragstad, stevemar, dolphm: I say put in the mfa changes, with triggers - noya bad thing to use as our guinea pig, anyway | 19:04 |
| rderose | henrynash zzzeek here is the log: http://logs.openstack.org/01/362501/5/check/gate-grenade-dsvm-neutron-ubuntu-trusty/ab6ce83/logs/grenade.sh.txt.gz | 19:04 |
| stevemar | 1 - mfa and totp depends on credential encryption | 19:05 |
| *** david-lyle_ is now known as david-lyle | 19:05 | |
| stevemar | 2 - credential encryption depends on triggers | 19:05 |
| samueldmq | stevemar: are they targeted to m3? | 19:05 |
| stevemar | 3 - everyone hates triggers | 19:05 |
| rderose | anyone know the mysql version used by grenade? | 19:05 |
| stevemar | samueldmq: no - totp was done in M, and MFA is targeted for O | 19:06 |
| zzzeek | rderose: your statement works so far in mysql 5.7, mariadb 10.1 | 19:06 |
| zzzeek | rderose: will try mysql 5.5 | 19:06 |
| samueldmq | stevemar: if totp was done in M, how does it depend on cred encryption? | 19:06 |
| rderose | zzzeek: okay, thanks | 19:06 |
| stevemar | dolphm: theres also a devstack patch, a grenade patch, both need to land in the next day | 19:06 |
| lbragstad | samueldmq the current implementation of TOTP puts user secrets in the keystone backend | 19:06 |
| stevemar | samueldmq: they are currently unencrypted | 19:06 |
| lbragstad | samueldmq so while it works, it is insecure | 19:06 |
| samueldmq | k gotcha | 19:07 |
| dolphm | stevemar: lbragstad: has there been any traction on the grenade patch today? | 19:07 |
| samueldmq | and we have agreed to support rolling upgrades in M, right ? | 19:07 |
| lbragstad | samueldmq if keystone accepts supporting TOTP, we should also support secure storage of use secrets | 19:07 |
| *** jrist has joined #openstack-keystone | 19:07 | |
| lbragstad | dolphm I socialized it in -qa | 19:07 |
| lbragstad | no additional reviews yet | 19:08 |
| dolphm | stevemar: credential encryption does not depend on triggers-- triggers only facilitate the *rolling* upgrade | 19:08 |
| lbragstad | the devstack change has one +2 | 19:08 |
| henrynash | rderose: I am using: Server version: 5.5.49-0ubuntu0.14.04.1 (Ubuntu) | 19:08 |
| samueldmq | dolphm: how can we do it without triggers ? | 19:08 |
| lbragstad | i already reworked the entire thing to support triggers | 19:08 |
| rderose | henrynash: do you know which version of mysql we support? | 19:08 |
| dolphm | stevemar: if we have the option to "opt out" of setting triggers, then everyone wins? https://review.openstack.org/#/c/360723/ | 19:09 |
| dolphm | samueldmq: the triggers simply protect a live upgrade process, they don't prevent anyone from doing a boring upgrade | 19:09 |
| zzzeek | rderose: fails in 5.5.42 | 19:10 |
| samueldmq | dolphm: exactly, my question is: do we say we support rolling upgrades in M? | 19:10 |
| rderose | zzzeek: :) | 19:10 |
| henrynash | samueldmq: YES....and we commited to it at teh summit and the midcycle | 19:10 |
| rderose | zzzeek: what would you suggest? change to timestamp maybe? | 19:10 |
| samueldmq | if not, let's just do in the old way , and support rolling upgrqdes next release | 19:10 |
| samueldmq | henrynash: ok | 19:10 |
| zzzeek | rderose: on mysql use the datatype TIMESTAMP | 19:10 |
| dolphm | samueldmq: "here's a new feature, here's how to consume it, here's how to opt out if you don't think they'll work for you (insert instructions for boring upgrade process)" | 19:10 |
| zzzeek | rderose: or, lets get off mysql 5.5 | 19:11 |
| *** adrian_otto has joined #openstack-keystone | 19:11 | |
| samueldmq | dolphm: the most right to me (since we don't have a decision on triggers yet), if we really want cred encryption in | 19:11 |
| henrynash | dolphm: ...but have no problem with not running things we don't need to do when running the offline (aka boring) upgrade rpocess | 19:12 |
| samueldmq | would be to get thqt in without triggers | 19:12 |
| stevemar | henrynash: dolphm: doesn't a rolling upgrade work now? if we were to cut using current master? | 19:12 |
| dolphm | i apparently need to go read the meeting logs - i don't understand what decision we're lacking | 19:12 |
| henrynash | stevema: yes | 19:12 |
| henrynash | stevemar: yes | 19:12 |
| *** gyee has quit IRC | 19:12 | |
| rderose | zzzeek: so is it func.current_timestamp()? | 19:12 |
| zzzeek | rderose: no. replace sqlalchemy.DateTime with sqlalchemy.TIMESTAMP | 19:13 |
| lbragstad | dolphm the question at hand is whether or not to include encrypted credentials in this release | 19:13 |
| zzzeek | rderose: TIMESTAMP is a magic datatype in MySQL that allows for server defaults | 19:13 |
| dolphm | lbragstad: is that a question related to trigger or a question regarding encrypted credentials? | 19:13 |
| samueldmq | stevemar: have we got to a decision on use vs do not use triggers ? | 19:13 |
| rderose | zzzeek: will it automatically set the current timestamp? | 19:13 |
| zzzeek | rderose: they've improved this stupid design but if we are stuck supporting 5.5 (can we really check on that? ) then we can't use it | 19:13 |
| lbragstad | dolphm maybe both, but i'll let stevemar clarify | 19:13 |
| rderose | zzzeek stevemar dolphm: how hard would it be to stop supporting mysql 5.5 | 19:14 |
| rderose | henrynahs: ^ | 19:14 |
| zzzeek | rderose: I would advise specifying server_default=func.current_timestamp(), it is kind of magical on their end but it accepts it. but also note, there can only be one such column in 5.5: ncorrect table definition; there can be only one TIMESTAMP column with CURRENT_TIMESTAMP in DEFAULT or ON UPDATE clause | 19:15 |
| henrynash | rderose: not really sure.......more worried about customer base, rather then dev environments | 19:15 |
| rderose | zzzeek: would this work with postgresql? | 19:16 |
| zzzeek | rderose: the other way to do this is: | 19:16 |
| samueldmq | lbragstad: what is the alternative with versioned objects ? | 19:16 |
| zzzeek | 1. add new DAteTime column, make it NULL | 19:16 |
| samueldmq | lbragstad: anywhere I can read from ? | 19:16 |
| lbragstad | samueldmq i have no idea | 19:16 |
| samueldmq | lbragstad: I didn't see anything about that in the meeting | 19:16 |
| zzzeek | 2. populate the column with date values | 19:16 |
| zzzeek | 3. alter again, set NOT NULL | 19:16 |
| lbragstad | samueldmq we would have to start incorporating versioned objects from scratch | 19:16 |
| rderose | zzzeek: problem with that approach is rolling upgrades | 19:16 |
| rderose | :) | 19:16 |
| zzzeek | rderose: yeah then yuo have to leave it NULL | 19:16 |
| zzzeek | rderose: if it wre me, Id just do the UPDATE right there | 19:17 |
| zzzeek | rderose: because it will run in a blink. | 19:17 |
| rderose | henrynash: ^ what do you think? | 19:17 |
| samueldmq | lbragstad: how would we do it without triggers ? (and without versioned obejcts either) | 19:17 |
| zzzeek | rderose: but I'm not in charge of any decisions here. all the things to be afraid of w/ migrations, and things to be not afraid of, are detemined by other people who know more than me | 19:17 |
| samueldmq | lbragstad: I guess it is what we had at the first patchsets? | 19:18 |
| rderose | zzzeek: :) | 19:18 |
| lbragstad | samueldmq well - that didn't support rolling upgrades either | 19:18 |
| rderose | zzzeek: let me try the timestamp approach | 19:18 |
| lbragstad | samueldmq that was a much different implementation as far as the migration goes | 19:18 |
| zzzeek | rderose: for POstgresql , sqlite others you need to stick with the DateTime + server_default=func.now() | 19:18 |
| lbragstad | samueldmq credentials would be migrated manually and orchestrated through configuration changes | 19:18 |
| henrynash | rderose: is it 100% safe, no, is it 99.9% safe, probably....but you could surely write a pathalogica test that would show the issue | 19:18 |
| rderose | zzzeek: okay, I can do that | 19:19 |
| rderose | henrynash: I knew you were going to say that ;) | 19:19 |
| zzzeek | rderose: I might check for MySQL version here too | 19:19 |
| zzzeek | rderose: for 5.6 and up do the better thing | 19:19 |
| henrynash | rderose: ..and I didn't want to disappoint you.... | 19:19 |
| zzzeek | rderose: though need to see where 5.6 is at | 19:19 |
| samueldmq | henrynash: are you going to remove triggers from that created_at review you posted? | 19:20 |
| samueldmq | I read somewhere it was not needed | 19:20 |
| rderose | zzzeek: okay, this could be tricky | 19:20 |
| zzzeek | rderose: how does it even make sense to put "NOW" into existing timestamp columns? | 19:20 |
| henrynash | samueldmq: so we are waiting to see if rderose and zzzeek come up with a "more traditional" solution using server defaults (i.e. correct the original issue)....of not, then triggers it is | 19:21 |
| zzzeek | rderose: if this is expand/contract, you'd make the coumn NULL and then in contract make it NOT NULL | 19:21 |
| samueldmq | henrynash: kk thanks | 19:21 |
| *** adrian_otto has quit IRC | 19:21 | |
| samueldmq | henrynash: let me know and I can review it (given we want it for tomorrow) | 19:21 |
| zzzeek | henrynash: why not leave it as NULL. also known as, please give me an example for clint on the mailng list :) | 19:21 |
| rderose | zzzeek: I'm not using the new expand/contract repos | 19:21 |
| rderose | zzzeek: I'm using our existing repo | 19:21 |
| zzzeek | rderose: if you arent doing expand/contract then this is not an "online" upgrade, do the UPDATE :) | 19:22 |
| * stevemar needs coffee | 19:22 | |
| rderose | zzzeek: hmm... | 19:23 |
| zzzeek | rderose: how many rows in this table for a huge customer ? | 19:23 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Document credential encryption https://review.openstack.org/354497 | 19:23 |
| henrynash | rderose: so you should really put this in the expand phase, with null data migration and contracts | 19:24 |
| rderose | henrynash: well, was just trying to fix the existing 105 migration | 19:24 |
| henrynash | zzzeek: ...although where rderose is putting it right now will still be run autaomatically in the exapnd phase, since we run any legacy migtations first | 19:24 |
| rderose | henrynash: how many rows for a huge customer would you estimate? thousands? | 19:25 |
| henrynash | rderose: so this will be only local users, or will it be populated for any federatted user that authenticates | 19:26 |
| rderose | henrynash: currently only local users | 19:26 |
| zzzeek | people, here is the thing: if you add a NULL column to a table, that has like 10K rows, then do "UPDATE table SET new_column=now()", then set it up as NOT NULL. this is a *very* fast operation. nobody is going to see their clusters go down waiting for that | 19:26 |
| zzzeek | all of these migration horror stories apply to: facebook | 19:27 |
| henrynash | rderose: have to still assume 1000s....that was the drive to add things like mfa beacuse people ARE using local sql users | 19:27 |
| zzzeek | with ten kabillion rows | 19:27 |
| zzzeek | openstack doesn't have that | 19:27 |
| rderose | zzzeek: true | 19:27 |
| *** ianw_ has joined #openstack-keystone | 19:28 | |
| *** ccneill has joined #openstack-keystone | 19:28 | |
| bknudson | I hope our cloud winds up having more than thousands of users. | 19:28 |
| bknudson | although if that was the case I expect we'd have a different solution than the sql backend. | 19:28 |
| ccneill | hi, all. can anyone here tell me about typical use cases for keystone's "credentials" endpoints? I'm specifically curious what kinds of things typically get used as "access" keys in EC2 credential creation requests | 19:29 |
| ccneill | i.e. http://developer.openstack.org/api-ref/identity/v3/?expanded=assign-role-to-user-on-projects-owned-by-domain-detail,create-policy-detail,show-credential-details-detail,list-credentials-detail,create-credential-detail#list-credentials | 19:29 |
| ccneill | this documentation seems to show MD5s and tenant IDs(?), but then AWS seems to use a different format for access/secret: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSGettingStartedGuide/AWSCredentials.html | 19:29 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Only create triggers during a rolling upgrade https://review.openstack.org/360723 | 19:31 |
| dolphm | stevemar: rderose: henrynash: ^ this skips lbragstad's trigger create / drops when you do a plain ol' db_sync | 19:32 |
| dolphm | stevemar: so, if you opt into the rolling upgrade process, you get triggers. if you don't, you don't get triggers. the same upgrade code applies, otherwise. | 19:32 |
| henrynash | zzzeek: the problem with just doing the update and setting it to not NULL is that since we still ahve old code runnig, we need the server default to be working...or any inserts from old code will fail | 19:33 |
| samueldmq | dolphm: what is the effect if triggers are not used ? | 19:33 |
| dolphm | samueldmq: there's no effect... you just can't write to the database during the upgrade process | 19:34 |
| dolphm | samueldmq: which means, you're not doing a rolling upgrade | 19:34 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Only create triggers during a rolling upgrade https://review.openstack.org/360723 | 19:34 |
| samueldmq | dolphm: got it | 19:35 |
| henrynash | dolphm: not so easy if we have written the 3 separate raw sql scripts...would need to pull the trigger code into the .py file (which I don't see any real reason against) | 19:35 |
| breton | > [24;2~WARNING: document isn't included in any toctree | 19:35 |
| breton | what does it want from me? | 19:35 |
| dolphm | henrynash: oh yeah, i guess this wouldn't cover your approach :-/ | 19:35 |
| zzzeek | henrynash: yeah, so, mailing list wisdom == new code just deals with it :) | 19:36 |
| dolphm | (which i think is better when you've got more complicated triggers to write) | 19:36 |
| dstanek | breton: it's in linked from anywhere | 19:36 |
| henrynash | dolphm: agreed, but needs must | 19:36 |
| dstanek | breton: i think that's what happens when you add a new file, but don't link to it | 19:36 |
| samueldmq | dolphm: lbragstad if we made the code write to both columns, then writes would be possible too | 19:36 |
| dolphm | samueldmq: welcome to the rabbit hole of versionedobjects | 19:37 |
| breton | dstanek: yeah, looks like it. Thanks! | 19:37 |
| zzzeek | henrynash: if you'd like to clarify your case here on the mailing list discussion that woudl be very helpful. | 19:37 |
| samueldmq | dolphm: ah now I know what versioned objects are | 19:37 |
| samueldmq | dolphm: but what is the issue with that? | 19:38 |
| henrynash | zzzeek: so when you run --expand, there is still old code running. This old code knows nothing about the new column....so that column is NOT NULL, it had better have a server default | 19:38 |
| henrynash | (....so IF that column is NOT NULL...) | 19:39 |
| *** rcernin has joined #openstack-keystone | 19:39 | |
| dolphm | samueldmq: ask neutron https://review.openstack.org/#/q/topic:bp/adopt-oslo-versioned-objects-for-db | 19:39 |
| zzzeek | henrynash: preaching to the choir :) | 19:39 |
| samueldmq | dolphm: thanks for the link | 19:40 |
| *** chianingwang has joined #openstack-keystone | 19:40 | |
| dstanek | breton: thank you for offering to do the backport :-) now i can continue with what i was working on this morngin | 19:40 |
| henrynash | dstanek: don't ya just love morngins, | 19:43 |
| *** su_zhang has joined #openstack-keystone | 19:43 | |
| bknudson | python-memcache has a SERVER_MAX_VALUE_LENGTH constant | 19:44 |
| bknudson | amakarov_away: ^ | 19:45 |
| *** su_zhang has quit IRC | 19:48 | |
| *** hockeynut has quit IRC | 19:49 | |
| stevemar | dstanek: take a quick look at https://review.openstack.org/#/c/359383/ you had a few comments on it, should only take a minute or two :P | 19:52 |
| *** tqtran has quit IRC | 19:54 | |
| *** tqtran has joined #openstack-keystone | 19:56 | |
| *** harlowja has quit IRC | 19:58 | |
| *** su_zhang has joined #openstack-keystone | 19:58 | |
| stevemar | amakarov_away: ETA on the precache config option? | 20:01 |
| *** su_zhang has quit IRC | 20:02 | |
| *** afred312 has quit IRC | 20:04 | |
| Michaellaneous | yeah I still don't know what's wrong | 20:07 |
| Michaellaneous | when LDAP is disabled I can see my default domains | 20:07 |
| Michaellaneous | when I enable it it tells me my domains don't exist anymore | 20:07 |
| Michaellaneous | and I can't create a new one | 20:07 |
| *** tqtran has quit IRC | 20:08 | |
| *** ddieterly is now known as ddieterly[away] | 20:09 | |
| *** tqtran has joined #openstack-keystone | 20:09 | |
| *** dikonoor has quit IRC | 20:10 | |
| *** nishaYadav has quit IRC | 20:10 | |
| *** su_zhang has joined #openstack-keystone | 20:10 | |
| *** sdake has quit IRC | 20:11 | |
| *** tqtran has quit IRC | 20:12 | |
| *** sdake has joined #openstack-keystone | 20:12 | |
| *** ddieterly[away] is now known as ddieterly | 20:15 | |
| *** ddieterly is now known as ddieterly[away] | 20:19 | |
| *** tqtran has joined #openstack-keystone | 20:21 | |
| bknudson | dstanek: notmorgan: Adding tracing statements to python-memcached so that it prints out the data read from the server. | 20:22 |
| bknudson | http://paste.openstack.org/show/564886/ | 20:22 |
| notmorgan | bknudson: *nod* | 20:22 |
| bknudson | There's some of the output. So looking for the place where there's a problem (based on the keystone log) | 20:22 |
| bknudson | "VALUE 1921523d6734d44e88ed58dfc76ef681a36b8e9b 1 6020" -- is good | 20:22 |
| bknudson | "VALUE 1921523d6734d44e88ed5" -- is not good | 20:22 |
| notmorgan | yep | 20:22 |
| notmorgan | w.t.f | 20:23 |
| bknudson | so note that "VALUE 1921523d6734d44e88ed5" happened to be some of the last value read | 20:23 |
| notmorgan | oh is this some magic overflow slab thing? | 20:23 |
| dstanek | that's strange | 20:23 |
| notmorgan | where memcache is sending more data back than a packet handles? | 20:23 |
| notmorgan | and the memcache library is unable to cope? | 20:23 |
| bknudson | Here's the code: https://github.com/linsomniac/python-memcached/blob/master/memcache.py | 20:24 |
| bknudson | (without my logging) | 20:24 |
| notmorgan | yeah not super interested in that. this looks like something the memache server is sending | 20:24 |
| notmorgan | wondering why VALUE format is different all of a sudden | 20:24 |
| notmorgan | also.. if we were using the binary protocol it might be better. | 20:25 |
| bknudson | y, it probably is the server since the next recv should have gotten the rest of the line. | 20:25 |
| notmorgan | (not possible in python-memcache | 20:25 |
| *** gyee has joined #openstack-keystone | 20:25 | |
| *** ChanServ sets mode: +v gyee | 20:25 | |
| *** chrisshattuck has quit IRC | 20:26 | |
| bknudson | oh, I did this wrong. | 20:28 |
| dstanek | is it possible that the rest of that line appears later in the output? | 20:28 |
| bknudson | will recreate with better data | 20:28 |
| notmorgan | ? | 20:28 |
| bknudson | I wanted to have it log every recv but I missed it. | 20:28 |
| notmorgan | ah | 20:28 |
| *** spedione is now known as spedione|AWAY | 20:29 | |
| notmorgan | bknudson: afaict that response is a violation of the text protocol: https://github.com/memcached/memcached/blob/master/doc/protocol.txt#L228-L247 | 20:30 |
| notmorgan | at least the spec for the protocol | 20:30 |
| notmorgan | afaict it should *always* have flags and bytes | 20:30 |
| dstanek | notmorgan: I'm wondering if the steam was logged out of order | 20:32 |
| bknudson | here's a new one: 2016-08-30 20:32:23.262 5770 ERROR keystone.common.wsgi ValueError: day is out of range for month | 20:32 |
| notmorgan | dstanek: well, bknudson has said he's seen this issue mostly with uwsgi and threading. | 20:33 |
| bknudson | I changed keystone so that there's a single process and thread. | 20:33 |
| bknudson | it's still uwsgi | 20:33 |
| notmorgan | hm | 20:33 |
| bknudson | so I should not be able to see things out of order | 20:33 |
| notmorgan | and not using the memcachepool | 20:33 |
| *** rcernin has quit IRC | 20:33 | |
| notmorgan | just to be sure | 20:33 |
| notmorgan | because... gross. | 20:33 |
| *** rcernin has joined #openstack-keystone | 20:33 | |
| bknudson | yes, I remembered to change to dogpile.cache.memcached | 20:34 |
| notmorgan | dstanek: i mean the output really does look like it's just flat missing flags/bytes | 20:34 |
| notmorgan | not seeing flags/bytes in some other line erroneously | 20:34 |
| *** awayne has joined #openstack-keystone | 20:37 | |
| ccneill | sorry for the spam, but if anyone has a sec to look over this potential keystone bug and give your thoughts, I'd greatly appreciate it: https://bugs.launchpad.net/keystone/+bug/1618615 | 20:38 |
| openstack | ccneill: Error: malone bug 1618615 not found | 20:38 |
| ccneill | (currently marked as a potential security issue) | 20:38 |
| notmorgan | ccneill: yep | 20:38 |
| notmorgan | ccneill: i just saw it /me puts VMT hat on | 20:38 |
| notmorgan | ccneill: reading it and will get people subscribed | 20:38 |
| ccneill | notmorgan: thanks! | 20:39 |
| *** ianw_ is now known as ianw | 20:39 | |
| notmorgan | ccneill: keystone-coresec has been subscribed (etc) and the VMT process has been started | 20:41 |
| ccneill | awesome, ty notmorgan ! | 20:41 |
| notmorgan | ccneill: i'm also reading the bug (hard to read via email because the way LP formats it) | 20:41 |
| notmorgan | so, i might also have a comment on it | 20:41 |
| *** ddieterly[away] is now known as ddieterly | 20:46 | |
| *** asettle has joined #openstack-keystone | 20:49 | |
| *** raildo has quit IRC | 20:49 | |
| bknudson | dstanek: notmorgan: http://paste.openstack.org/show/564889/ | 20:50 |
| bknudson | here you can see it's not working right | 20:50 |
| bknudson | it does readline which should be "VALUE 3487474327a81e31a4ce383688d6c132f23276dd 1 5801" -- so that's good | 20:50 |
| bknudson | then it does "*** recv data:" to get the rest of the data | 20:51 |
| bknudson | (if the data is more than 4096 bytes it's not in the buffer) | 20:51 |
| bknudson | I'm going to improve my logging to include the # bytes requested for the recv data. | 20:52 |
| bknudson | because it should have done readline, recv ; not readline, recv, recv | 20:53 |
| notmorgan | ccneill: responded on the bug. | 20:54 |
| notmorgan | bknudson: ah | 20:55 |
| notmorgan | bknudson: so it is a socket issue it looks like. | 20:55 |
| *** chrisshattuck has joined #openstack-keystone | 20:55 | |
| notmorgan | ccneill: also thanks for the report. | 20:58 |
| ccneill | notmorgan: np! sorry I forgot to mention that it was only EC2 creds >_< | 20:59 |
| lbragstad | stevemar https://gist.github.com/lbragstad/ddfb10f9f9048414d1f781ba006e95d1#file-migration-md | 21:00 |
| bknudson | this is starting to look a little fishy from the client side. we'll see. | 21:00 |
| Michaellaneous | wait | 21:00 |
| Michaellaneous | does the domain name for LDAP need to be openstack.org? | 21:00 |
| lbragstad | stevemar docs on doing a rolling upgrade with limited read-only and no downtime and triggers | 21:00 |
| lbragstad | s/docs/documented live example/ | 21:01 |
| lbragstad | cc dolphm dstanek rderose henrynash ^ in case you want to review | 21:01 |
| lbragstad | fwiw - the upgrade is actually from stable/mitaka to my patch up for review (so not official master) | 21:02 |
| dolphm | Michaellaneous: no? | 21:04 |
| Michaellaneous | yeah I thought so. I am just trying to debug right now. | 21:05 |
| dolphm | lbragstad: did you write all that? | 21:05 |
| lbragstad | dolphm yeah - that's what i've been working on today | 21:05 |
| *** jamielennox is now known as jamielennox|away | 21:06 | |
| lbragstad | dolphm I wanted to test the rolling upgrade process with multiple nodes anyway | 21:06 |
| dolphm | lbragstad: ++ | 21:06 |
| lbragstad | figured it would serve as a good upgrade document | 21:06 |
| lbragstad | for folks with existing credentials | 21:07 |
| *** pauloewerton has quit IRC | 21:09 | |
| *** spzala has quit IRC | 21:12 | |
| *** tqtran has quit IRC | 21:15 | |
| *** tqtran has joined #openstack-keystone | 21:15 | |
| *** harlowja has joined #openstack-keystone | 21:17 | |
| *** hockeynut has joined #openstack-keystone | 21:17 | |
| *** ayoung has quit IRC | 21:19 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes migration where password created_at is nullable https://review.openstack.org/362501 | 21:21 |
| dstanek | lbragstad: those instructions look great | 21:21 |
| lbragstad | dstanek thanks | 21:21 |
| lbragstad | dolphm dstanek the only thing I found is the 500 that is issued when running both a mitaka node and newton node is this - http://cdn.pasteraw.com/a8iojjp1a2qxvf3qprd3ogs2unzoo31 | 21:22 |
| lbragstad | it's a 500, which blocks the write to the credential table | 21:22 |
| lbragstad | but it's not because of the trigger | 21:22 |
| lbragstad | it's because the blob attribute is None and it can't be | 21:22 |
| lbragstad | (otherwise i'm assuming the trigger would block that write) | 21:23 |
| dstanek | can you relax the constraint in the expand? | 21:23 |
| lbragstad | but I'm not sure how much we can do about it since the blob attribute would be defined as nullable=False already | 21:23 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes migration where password created_at is nullable before 105 fix https://review.openstack.org/362510 | 21:24 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes migration where password created_at is nullable before 105 fix https://review.openstack.org/362510 | 21:24 |
| lbragstad | dstanek why would we want to relax it? | 21:24 |
| lbragstad | dstanek relax the trigger? | 21:24 |
| dstanek | no, the constaint on blob...don't we remove it anyway when contracting? | 21:24 |
| lbragstad | dstanek is it possible to make blob nullable in the expand when it has data in it? | 21:25 |
| bknudson | dstanek: python-memcached has a constant for the max key length: https://github.com/linsomniac/python-memcached/blob/master/memcache.py#L205 | 21:25 |
| bknudson | which is 250 | 21:25 |
| dstanek | lbragstad: yeah, it just means that new rows don't need a value | 21:25 |
| lbragstad | dstanek ah - i can try that quick | 21:26 |
| dstanek | bknudson: that's why we sha256 our keys | 21:26 |
| bknudson | dstanek: sha1 | 21:26 |
| *** sdake has quit IRC | 21:26 | |
| bknudson | or did that change? | 21:26 |
| dstanek | bknudson: oh, maybe sha1. who can remember the details :-P | 21:27 |
| bknudson | somebody who's been staring at this for a few weeks | 21:27 |
| dstanek | i think that's the problem | 21:28 |
| dstanek | bknudson: i'm going to build an env based off of those instructions and see what happens | 21:30 |
| bknudson | dstanek: once you | 21:30 |
| *** hockeynut has quit IRC | 21:31 | |
| bknudson | you've got it running I've got a test program | 21:31 |
| *** sdake has joined #openstack-keystone | 21:32 | |
| stevemar | rderose: i don't think you want to tinker around with migration 105 | 21:33 |
| stevemar | some folks running on mater have already run it | 21:34 |
| *** ddieterly is now known as ddieterly[away] | 21:34 | |
| dstanek | mater? like to tow truck from Cars? | 21:35 |
| *** ddieterly[away] is now known as ddieterly | 21:37 | |
| *** adriant has joined #openstack-keystone | 21:37 | |
| lbragstad | dstanek ++ | 21:37 |
| Michaellaneous | dolphm, when I have LDAP enabled, do I need to change the domain_name in my little export file? | 21:39 |
| *** spzala has joined #openstack-keystone | 21:40 | |
| dstanek | bknudson: post the test script somewhere? | 21:41 |
| *** jdennis1 has quit IRC | 21:42 | |
| dolphm | Michaellaneous: i'm not sure what export file you're referring to :-/ but domain names should be entirely up to you | 21:43 |
| Michaellaneous | The admin-openrc file | 21:43 |
| dstanek | dolphm: Michaellaneous: likely openrc? | 21:43 |
| Michaellaneous | The one you source when you wanna do stuff. | 21:43 |
| Michaellaneous | Yeah. | 21:43 |
| bknudson | dstanek: https://github.com/brantlk/keystone_samples/blob/master/revocation_event_test.py | 21:43 |
| Michaellaneous | I just don't know why it stops recognizing my domains. | 21:44 |
| dstanek | that shouldn't change unless you changed the keystone domain data | 21:44 |
| *** spzala has quit IRC | 21:44 | |
| dstanek | bknudson: gracyas | 21:44 |
| dstanek | my Spanish is a bit rusty | 21:44 |
| dolphm | Michaellaneous: oh, that needs to match whatever domain your user / credentials belong to in keystone | 21:44 |
| Michaellaneous | Yeah it does. | 21:44 |
| Michaellaneous | but I switch to LDAP and it says "Domain does not exist: <ID of default domain> | 21:44 |
| Michaellaneous | Do I need to...make my own domain for LDAP? | 21:44 |
| bknudson | dstanek: so what I do is go into the vagrant env and change the uwsgi config for keystone to listen on http | 21:45 |
| bknudson | dstanek: then run this on the host: python ./revocation_event_test.py --url http://10.10.0.11:5008/ --insecure --password <whatever> | 21:45 |
| dolphm | Michaellaneous: is LDAP configured to serve your default domain? | 21:46 |
| Michaellaneous | I...I don't know. | 21:46 |
| Michaellaneous | How do I set that up? | 21:46 |
| dolphm | Michaellaneous: is LDAP configured in keystone.conf or in a domain-specific manner? /etc/keystone/domains/ (i think) or via the API? | 21:46 |
| Michaellaneous | It is configured in keystone.conf | 21:47 |
| dstanek | Michaellaneous: what is the id of your default domain? | 21:47 |
| dolphm | Michaellaneous: then i believe you need to use the 'default' domain in openrc in order to authenticate via LDAP | 21:47 |
| Michaellaneous | 36d024eae7ea4865b87d1e29bd73cef5 | 21:48 |
| Michaellaneous | Yes I have that set up but as soon as I actually activate ldap | 21:48 |
| Michaellaneous | It says "Domain does not exist: 36d024eae7ea4865b87d1e29bd73cef5" | 21:48 |
| dolphm | the LDAP backend does not support non-default domains... unless you use domain-specific identity backends, right? | 21:48 |
| dstanek | Michaellaneous: check to make sure that is actually your default domain. it is usually just 'default' | 21:48 |
| Michaellaneous | | 36d024eae7ea4865b87d1e29bd73cef5 | default | True | Default Domain | | 21:49 |
| dolphm | Michaellaneous: how do you have a domain ID other than 'default', and what does that domain have to do with LDAP, exactly? | 21:49 |
| *** chrichip has joined #openstack-keystone | 21:49 | |
| Michaellaneous | Nah I have only the default domain | 21:49 |
| Michaellaneous | And I am not changing my OpenRC. | 21:49 |
| Michaellaneous | But when I activate it and do an openstack command it tells me that my default domain does not exist. | 21:49 |
| *** asettle has quit IRC | 21:51 | |
| browne | Michaellaneous: you should use keystone-manage bootstrap | 21:51 |
| browne | it'll create the default domain with an id of "default" | 21:51 |
| *** asettle has joined #openstack-keystone | 21:51 | |
| Michaellaneous | Okay hold on. | 21:52 |
| Michaellaneous | Getting some errors. | 21:52 |
| browne | this works best. creating the default domain later via api will create a UUID which means you need to add that back into keystone.conf and restart it | 21:52 |
| Michaellaneous | Oh I need a password for it? | 21:53 |
| Michaellaneous | But wait...if I delete the default domain now.C | 21:53 |
| Michaellaneous | Can I still bootstrap? | 21:53 |
| browne | yeah, believe it should still bootstrap | 21:53 |
| *** tonytan4ever has quit IRC | 21:54 | |
| *** jdennis has joined #openstack-keystone | 21:54 | |
| Michaellaneous | Just trying to figure out how I can disable the other one | 21:56 |
| *** asettle has quit IRC | 21:56 | |
| Michaellaneous | Oh fuck. | 22:00 |
| Michaellaneous | I disabled it. | 22:00 |
| Michaellaneous | Now I can't delete or reenable it. | 22:01 |
| Michaellaneous | Or bootstrap one. | 22:01 |
| Michaellaneous | Fuuuuck | 22:03 |
| *** michauds has quit IRC | 22:03 | |
| *** chrichip has quit IRC | 22:06 | |
| lbragstad | dstanek yep - that worked | 22:07 |
| openstackgerrit | Chris Spencer proposed openstack/keystone: Add documentation on how to set a user's tenant. https://review.openstack.org/363292 | 22:07 |
| *** ddieterly is now known as ddieterly[away] | 22:08 | |
| *** ddieterly[away] has quit IRC | 22:08 | |
| *** topol_ is now known as topol | 22:09 | |
| *** ChanServ sets mode: +v topol | 22:09 | |
| openstackgerrit | Chris Spencer proposed openstack/keystone: Add documentation on how to set a user's tenant. https://review.openstack.org/363292 | 22:11 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement encryption of credentials at rest https://review.openstack.org/355618 | 22:12 |
| lbragstad | dstanek fixed ^ | 22:13 |
| lbragstad | stevemar dolphm most recent and correct draft with the implementation that is up for review - https://gist.github.com/lbragstad/ddfb10f9f9048414d1f781ba006e95d1#migrating-credentials-from-mitaka-to-newton | 22:17 |
| lbragstad | which updates the example to show that the triggers make keystone read only for both mitaka and newton | 22:19 |
| *** su_zhang has quit IRC | 22:22 | |
| openstackgerrit | Chris Spencer proposed openstack/keystone: Add documentation on how to set a user's tenant. https://review.openstack.org/363292 | 22:23 |
| *** spzala has joined #openstack-keystone | 22:24 | |
| *** ravelar1 has quit IRC | 22:25 | |
| *** ianw has quit IRC | 22:26 | |
| *** jrist has quit IRC | 22:32 | |
| *** su_zhang has joined #openstack-keystone | 22:34 | |
| *** chrisshattuck has quit IRC | 22:35 | |
| *** chrisshattuck has joined #openstack-keystone | 22:35 | |
| *** sdake has quit IRC | 22:36 | |
| *** chrisshattuck has quit IRC | 22:37 | |
| *** spzala has quit IRC | 22:38 | |
| *** spzala has joined #openstack-keystone | 22:38 | |
| *** jrist has joined #openstack-keystone | 22:39 | |
| *** spzala has quit IRC | 22:43 | |
| dstanek | lbragstad: nice! | 22:45 |
| lbragstad | dstanek :) | 22:48 |
| lbragstad | let me know if it doesn't make sense - everything is still in review | 22:48 |
| *** erhudy has quit IRC | 22:52 | |
| *** ianw has joined #openstack-keystone | 22:57 | |
| *** ayoung has joined #openstack-keystone | 22:59 | |
| *** ChanServ sets mode: +v ayoung | 22:59 | |
| bknudson | dstanek: notmorgan: check this out : http://paste.openstack.org/show/564910/ | 23:00 |
| *** roxanaghe has quit IRC | 23:00 | |
| bknudson | the first line is the statement | 23:00 |
| bknudson | how is len(data) only 149?? | 23:00 |
| bknudson | there's definitely more than 149 chars in that str | 23:00 |
| dolphm | lbragstad: awesome! | 23:02 |
| dolphm | bknudson: does data have a __len__ definition? | 23:02 |
| bknudson | dolphm: https://github.com/linsomniac/python-memcached/blob/master/memcache.py#L1459 is the source of data | 23:05 |
| bknudson | I hope socket.recv just returns a regular str with no special methods | 23:06 |
| *** chrisshattuck has joined #openstack-keystone | 23:08 | |
| bknudson | check out the junk at the bottom -- http://paste.openstack.org/show/564915/ | 23:08 |
| bknudson | that shouldn't be possible I've only got the 1 thread. | 23:08 |
| *** tqtran has quit IRC | 23:09 | |
| *** chrisshattuck has quit IRC | 23:10 | |
| *** rkrum has joined #openstack-keystone | 23:12 | |
| bknudson | wondering if someone can provide their python version in devstack or some working system? | 23:13 |
| bknudson | ii python 2.7.5-5ubuntu3 amd64 interactive high-level object-oriented language (default version) | 23:13 |
| bknudson | that's probably not good. | 23:13 |
| *** tqtran has joined #openstack-keystone | 23:14 | |
| bknudson | browne: what version of python are you running keystone under? | 23:14 |
| bknudson | Python 2.7.6 | 23:14 |
| bknudson | python --version says 2.7.6 | 23:14 |
| bknudson | ii python2.7 2.7.6-8ubuntu0.2 amd64 Interactive high-level object-oriented language (version 2.7) | 23:15 |
| browne | we use ubuntu 14.04, but with upgraded Python 2.7.10 | 23:15 |
| browne | python 2.7.6 doesn't support TLS 1.1/1.2 | 23:15 |
| bknudson | we've got apache in front of keystone | 23:16 |
| browne | Python 2.7.6 mostly useless for ldap support | 23:16 |
| browne | apache doesn't matter | 23:16 |
| notmorgan | bknudson: yeah something odd there | 23:17 |
| browne | most AD servers nowadays close down TLS 1.0 to comply with PCI-DSS | 23:17 |
| notmorgan | bknudson: i'm about to revisit just writing a dogpile driver for pymemcache | 23:18 |
| notmorgan | bknudson: it might solve the issue - or i can revisit taking over python-memcache and fixing it | 23:19 |
| lbragstad | dolphm i'm making more edits :( | 23:23 |
| *** su_zhang has quit IRC | 23:23 | |
| lbragstad | dolphm my wife is proof reading | 23:23 |
| dolphm | lbragstad: hopefully not to your patch :P | 23:32 |
| *** jaugustine has quit IRC | 23:34 | |
| *** rcernin has quit IRC | 23:35 | |
| lbragstad | dolphm ok - i'm done | 23:35 |
| * lbragstad https://gist.github.com/lbragstad/ddfb10f9f9048414d1f781ba006e95d1#file-migration-md | 23:35 | |
| *** tonytan4ever has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
