| *** dikonoor has joined #openstack-keystone | 00:07 | |
| *** catintheroof has joined #openstack-keystone | 00:11 | |
| *** jerrygb has quit IRC | 00:18 | |
| *** david-lyle has joined #openstack-keystone | 00:19 | |
| *** thorst has joined #openstack-keystone | 00:19 | |
| *** thorst has quit IRC | 00:21 | |
| *** jerrygb has joined #openstack-keystone | 00:34 | |
| *** jose-phillips has quit IRC | 00:40 | |
| *** hoangcx has joined #openstack-keystone | 00:41 | |
| *** david-lyle has quit IRC | 00:43 | |
| *** chris_hultin is now known as chris_hultin|AWA | 00:48 | |
| stevemar | jamielennox: we did, to keystoneauth-saml2, and keystoneclient :) | 00:49 |
|---|---|---|
| stevemar | gagehugo: damn! | 00:49 |
| stevemar | jamielennox: oh ffs... http://logs.openstack.org/40/420940/2/check/gate-rally-dsvm-neutron-existing-users-rally/d62a957/console.html#_2017-01-16_21_49_37_644183 | 00:54 |
| stevemar | "Content-Type is set to application/json; charset=UTF-8. Only application/json responses" | 00:54 |
| jamielennox | stevemar: wtf requests should handle trimming the charset away from content type. | 01:04 |
| jamielennox | Though maybe it should be starts with so you can get json+xyz | 01:07 |
| *** catintheroof has quit IRC | 01:09 | |
| *** edtubill has joined #openstack-keystone | 01:11 | |
| stevemar | jamielennox: yeah, or "in" | 01:11 |
| *** chris_hultin|AWA is now known as chris_hultin | 01:12 | |
| stevemar | eh, startswith is probably better | 01:12 |
| *** jerrygb has quit IRC | 01:13 | |
| *** edtubill has quit IRC | 01:15 | |
| *** thorst has joined #openstack-keystone | 01:22 | |
| *** trananhkma has quit IRC | 01:24 | |
| *** thorst has quit IRC | 01:27 | |
| *** chris_hultin is now known as chris_hultin|AWA | 01:37 | |
| *** thorst has joined #openstack-keystone | 01:42 | |
| *** thorst has quit IRC | 01:43 | |
| *** chris_hultin|AWA is now known as chris_hultin | 01:55 | |
| *** chris_hultin is now known as chris_hultin|AWA | 01:58 | |
| *** dikonoor has quit IRC | 02:01 | |
| *** nicolasbock has quit IRC | 02:03 | |
| *** jerrygb has joined #openstack-keystone | 02:14 | |
| *** stingaci has joined #openstack-keystone | 02:22 | |
| *** jamielennox is now known as jamielennox|away | 02:25 | |
| *** stingaci has quit IRC | 02:26 | |
| *** tqtran has quit IRC | 02:33 | |
| *** edtubill has joined #openstack-keystone | 02:42 | |
| *** thorst has joined #openstack-keystone | 02:44 | |
| *** thorst has quit IRC | 02:48 | |
| *** woodster_ has quit IRC | 02:55 | |
| *** spzala has quit IRC | 02:57 | |
| *** jamielennox|away is now known as jamielennox | 03:03 | |
| *** jose-phillips has joined #openstack-keystone | 03:13 | |
| *** jose-phillips has quit IRC | 03:14 | |
| *** jose-phillips has joined #openstack-keystone | 03:14 | |
| *** jose-phillips has quit IRC | 03:17 | |
| *** jose-phillips has joined #openstack-keystone | 03:18 | |
| *** jose-phillips has quit IRC | 03:19 | |
| *** jose-phillips has joined #openstack-keystone | 03:20 | |
| *** diazjf has quit IRC | 03:20 | |
| *** jose-phillips has quit IRC | 03:21 | |
| *** jose-phillips has joined #openstack-keystone | 03:21 | |
| *** jose-phillips has quit IRC | 03:27 | |
| *** edmondsw has joined #openstack-keystone | 03:31 | |
| *** links has joined #openstack-keystone | 03:32 | |
| *** edmondsw has quit IRC | 03:36 | |
| *** v1k0d3n has joined #openstack-keystone | 04:07 | |
| *** v1k0d3n has quit IRC | 04:11 | |
| *** sheel has joined #openstack-keystone | 04:13 | |
| *** antwash has quit IRC | 04:20 | |
| *** jlwhite has quit IRC | 04:21 | |
| *** jrist has quit IRC | 04:27 | |
| *** jrist has joined #openstack-keystone | 04:39 | |
| *** thorst has joined #openstack-keystone | 04:45 | |
| *** thorst has quit IRC | 04:50 | |
| *** jerrygb has quit IRC | 05:08 | |
| *** v1k0d3n has joined #openstack-keystone | 05:14 | |
| *** jlwhite has joined #openstack-keystone | 05:20 | |
| *** antwash has joined #openstack-keystone | 05:20 | |
| *** stingaci has joined #openstack-keystone | 05:20 | |
| openstackgerrit | Tin Lam proposed openstack/python-keystoneclient: Fix response body being omitted in debug mode incorrectly https://review.openstack.org/421076 | 05:22 |
| *** v1k0d3n has quit IRC | 05:25 | |
| *** stingaci has quit IRC | 05:25 | |
| *** dikonoor has joined #openstack-keystone | 05:26 | |
| *** dikonoor has quit IRC | 05:31 | |
| *** david-lyle has joined #openstack-keystone | 05:33 | |
| *** david-lyle has quit IRC | 05:44 | |
| *** Jack_I has joined #openstack-keystone | 05:45 | |
| *** david-lyle has joined #openstack-keystone | 05:53 | |
| *** Jack_V has joined #openstack-keystone | 05:53 | |
| *** Jack_I has quit IRC | 05:57 | |
| *** david-lyle has quit IRC | 06:24 | |
| *** tqtran has joined #openstack-keystone | 06:33 | |
| *** edtubill has quit IRC | 06:35 | |
| *** tqtran has quit IRC | 06:35 | |
| openstackgerrit | Merged openstack/keystone: Drop type in filters https://review.openstack.org/419451 | 06:41 |
| *** richm has quit IRC | 06:42 | |
| openstackgerrit | Merged openstack/keystoneauth: Use comma as separator in ECP Accept HTTP header https://review.openstack.org/420970 | 06:43 |
| *** thorst has joined #openstack-keystone | 06:46 | |
| openstackgerrit | Tin Lam proposed openstack/python-keystoneclient: Fix response body being omitted in debug mode incorrectly https://review.openstack.org/421076 | 06:47 |
| *** thorst has quit IRC | 06:50 | |
| *** tesseract has joined #openstack-keystone | 07:16 | |
| *** voelzmo has joined #openstack-keystone | 07:25 | |
| *** voelzmo has quit IRC | 07:25 | |
| *** voelzmo has joined #openstack-keystone | 07:27 | |
| *** edtubill has joined #openstack-keystone | 07:35 | |
| *** stingaci has joined #openstack-keystone | 08:01 | |
| *** dmellado has quit IRC | 08:02 | |
| *** dmellado has joined #openstack-keystone | 08:04 | |
| *** thorst has joined #openstack-keystone | 08:47 | |
| *** Jack_I has joined #openstack-keystone | 08:48 | |
| *** Jack_V has quit IRC | 08:49 | |
| *** thorst has quit IRC | 08:52 | |
| *** Jack_V has joined #openstack-keystone | 08:52 | |
| *** Jack_I has quit IRC | 08:56 | |
| openstackgerrit | bighnaraj mishra proposed openstack/python-keystoneclient: added oslo_log removing logging library https://review.openstack.org/421140 | 08:56 |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:00 | |
| *** rha has quit IRC | 09:03 | |
| *** mvk has quit IRC | 09:30 | |
| *** mvk has joined #openstack-keystone | 10:06 | |
| *** hoangcx has quit IRC | 10:10 | |
| *** jose-phillips has joined #openstack-keystone | 10:15 | |
| *** haplo37_ has quit IRC | 10:19 | |
| *** haplo37_ has joined #openstack-keystone | 10:19 | |
| *** mvk has quit IRC | 10:32 | |
| *** mvk has joined #openstack-keystone | 10:47 | |
| *** thorst has joined #openstack-keystone | 10:48 | |
| *** thorst has quit IRC | 10:52 | |
| *** pnavarro has joined #openstack-keystone | 10:58 | |
| *** ayoung has joined #openstack-keystone | 11:12 | |
| *** ChanServ sets mode: +v ayoung | 11:12 | |
| *** richm has joined #openstack-keystone | 11:13 | |
| *** aloga has quit IRC | 11:20 | |
| *** aloga has joined #openstack-keystone | 11:20 | |
| *** rha has joined #openstack-keystone | 11:27 | |
| *** mvk has quit IRC | 11:28 | |
| *** jose-phillips has quit IRC | 11:39 | |
| *** jose-phillips has joined #openstack-keystone | 11:40 | |
| *** mvk has joined #openstack-keystone | 11:41 | |
| asettle | Hey - is there anyone here that can help me triage a proposed bug in the manuals setup for keystone? | 11:56 |
| asettle | The Newton installation guide refers to delete the sqlite keystone.db file | 11:56 |
| asettle | But the reportee advises to hash "connection = sqlite:////var/lib/keystone/keystone.db" line in [database] in kesytone.conf before populating sql. | 11:56 |
| asettle | THere has been other references to this solution too | 11:56 |
| asettle | Unfortunately I concede defeat - I don't know enough to triage this appropriately | 11:56 |
| asettle | If anyone can help: https://bugs.launchpad.net/openstack-manuals/+bug/1654701?comments=all | 11:56 |
| openstack | Launchpad bug 1654701 in openstack-manuals "connection = sqlite line in [database] section in keystone.conf" [Undecided,New] | 11:56 |
| stevemar | asettle: why is someone using sqlite for their install *confused* | 11:57 |
| asettle | stevemar: well... to be fair, I don't know! But not the only one: https://github.com/AJNOURI/COA/issues/31 | 11:58 |
| asettle | I've never seen anything like it before, hence why conceding defeat. | 11:58 |
| stevemar | asettle: oh, i think i get it | 12:01 |
| asettle | \o/ yes?! | 12:01 |
| *** nicolasbock has joined #openstack-keystone | 12:01 | |
| stevemar | asettle: i think by "hash" he means "comment out" -- to literally put a '#' in front of the sample connection string? | 12:01 |
| stevemar | "i've tried positioning the ** connection= sql...etc ** line above the ** connection = sqlite..etc **" | 12:01 |
| stevemar | but that may not work since oslo.config may take the last argument you use | 12:02 |
| stevemar | :) | 12:02 |
| asettle | Right, so he's suggesting commenting it out, and then populate sql. | 12:02 |
| stevemar | yeah | 12:02 |
| asettle | So, this isn't really something we should be suggesting in the manuals. I wonder - have you seen any suggest something like this before?? | 12:03 |
| stevemar | i thought by "hash" he meant to encrypt or sign the password | 12:03 |
| stevemar | asettle: nope :\ | 12:03 |
| asettle | Might have to request further info. He's basically suggesting that leaving the sqlite line in affects keystone db. | 12:04 |
| asettle | He's continuously just receiving internal server errors. | 12:04 |
| *** rdopiera has left #openstack-keystone | 12:05 | |
| stevemar | hmm, we don't default it to https://github.com/openstack/keystone/blob/stable/mitaka/etc/keystone.conf.sample#L549 | 12:05 |
| stevemar | to anything* | 12:05 |
| stevemar | asettle: getting an internal server error makes sense, he's specifying to connect to a database that ain't there | 12:06 |
| asettle | I'm guessing (wildly) that it's an isolated issue on his personal setup. | 12:06 |
| stevemar | (i'm assuming the install guide says to use mysql instead of sqlite?) | 12:06 |
| asettle | (Let me check) | 12:06 |
| asettle | (because I don't trust hte off the top of my head approach rn) | 12:07 |
| stevemar | looks like it: http://docs.openstack.org/newton/install-guide-ubuntu/keystone-install.html | 12:07 |
| asettle | Wow you fast | 12:07 |
| stevemar | step1 `mysql -u root -p ` :P | 12:07 |
| stevemar | my google fu! | 12:07 |
| asettle | In that case, yes. | 12:07 |
| asettle | Hahhaha | 12:07 |
| stevemar | pardon, screaming child | 12:07 |
| asettle | All yours. | 12:07 |
| stevemar | back | 12:08 |
| stevemar | mornings are fun | 12:08 |
| asettle | Said no one ever. | 12:08 |
| stevemar | "connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone " | 12:08 |
| stevemar | hmmm | 12:08 |
| stevemar | asettle: maybe one of the packages he installed is defaulting the the value to sqlite? | 12:09 |
| stevemar | cause we dont, and the install guide doesn't mention to do that | 12:09 |
| asettle | I'm guessing so, I might just comment and ask. | 12:09 |
| stevemar | i can ask in the bug i guess | 12:09 |
| asettle | Thanks for helping me out, stevemar :) | 12:09 |
| asettle | Actually, yeah - if you're okay with commenting on that one stevemar that would be really helpful | 12:10 |
| stevemar | hmm, ubuntu install guide too | 12:10 |
| stevemar | sure | 12:10 |
| asettle | Thanks for your help :) I appreciate you helping me. | 12:10 |
| asettle | My keystone knowledge is pretty sad. dolphm and lbragstad have tried to help me a few times :P | 12:10 |
| stevemar | asettle: those two are good sources for keystone knowledge :) | 12:11 |
| asettle | They areeee :) | 12:11 |
| asettle | I am a federation master!* (terms and conditions may apply) | 12:11 |
| *** links has quit IRC | 12:12 | |
| *** iurygregory has joined #openstack-keystone | 12:13 | |
| *** jose-phillips has quit IRC | 12:14 | |
| *** tesseract has quit IRC | 12:23 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Fix response body being omitted in debug mode incorrectly https://review.openstack.org/421076 | 12:30 |
| stevemar | jamielennox: https://review.openstack.org/#/c/421076/ | 12:31 |
| stevemar | asettle: good good, i can redirect all my federationy questions to you :) | 12:32 |
| *** catintheroof has joined #openstack-keystone | 12:32 | |
| stevemar | breton: is https://review.openstack.org/#/c/294535/ fully baked? | 12:32 |
| stevemar | i know nothing of osprofiler | 12:33 |
| stevemar | breton: i +2'ed it, if you are confident about it you may +W it, the code won't interfere with keystone, but i don't know if the osprofiler/rally bits are 100% correct | 12:34 |
| *** lamt has quit IRC | 12:41 | |
| *** Jack_I has joined #openstack-keystone | 12:46 | |
| *** thorst has joined #openstack-keystone | 12:46 | |
| *** Jack_V has quit IRC | 12:48 | |
| asettle | stevemar: don't hold your breath for amazing responses :p | 12:56 |
| *** links has joined #openstack-keystone | 12:58 | |
| *** links has quit IRC | 13:01 | |
| *** dave-mccowan has joined #openstack-keystone | 13:02 | |
| *** edmondsw has joined #openstack-keystone | 13:03 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Fix response body being omitted in debug mode incorrectly https://review.openstack.org/421076 | 13:05 |
| *** lamt has joined #openstack-keystone | 13:11 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystoneauth: Add test for header in Saml2 plugin https://review.openstack.org/421265 | 13:18 |
| asettle | stevemar: I have another one if you have the time? A posed question within a bug that I cannot answer :( | 13:18 |
| breton | stevemar: it looks correct, it doesn't break me, but i am not sure that it produces the results a user expects. | 13:18 |
| asettle | https://bugs.launchpad.net/openstack-manuals/+bug/1655853 | 13:18 |
| openstack | Launchpad bug 1655853 in openstack-manuals ""systemd:openstack-keystone" resource agent seems not exist" [Undecided,New] | 13:18 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystoneauth: Add test for header in Saml2 plugin https://review.openstack.org/421265 | 13:19 |
| breton | stevemar: > So I am wondering if "systemd:httpd" is the correct resource agent for HA keystone here. | 13:19 |
| breton | oh | 13:19 |
| breton | asettle: > So I am wondering if "systemd:httpd" is the correct resource agent for HA keystone here. | 13:19 |
| breton | asettle: it probably is. | 13:19 |
| rodrigods | stevemar, ^ tests for the keystoneauth saml2 bug in the headers | 13:19 |
| breton | asettle: we use httpd for running keystone | 13:20 |
| asettle | breton: did you file this bug? :) | 13:21 |
| breton | asettle: nope | 13:21 |
| asettle | COincidence? | 13:21 |
| breton | asettle: i have just opened in the browser and looked at the contents :) | 13:22 |
| asettle | Hahaha oh right, sorry. I was just super confused for a second. | 13:22 |
| asettle | Don't mind me. | 13:22 |
| asettle | httpd it is. | 13:22 |
| asettle | Thank you for responding breton :) | 13:23 |
| stevemar | asettle: yeah, as breton said "systemd:httpd" is probably the right value instead of "systemd:openstack-keystone" | 13:23 |
| asettle | :) thanks team | 13:24 |
| stevemar | i think "systemd:openstack-keystone" is from when we were using eventlet? i think the HA guide was the guide that needed the most updates iirc | 13:24 |
| stevemar | so it would make sense that it had an old eventlet value | 13:24 |
| asettle | I'll have a look | 13:25 |
| asettle | It doesn't ref, from a cursory glance: http://docs.openstack.org/ha-guide/ | 13:26 |
| stevemar | asettle: may have to bug someone from red hat or who knows systemd / pacemaker a bit more | 13:32 |
| asettle | ... hmmmm jamielennox is an ex-hatter ;) | 13:33 |
| asettle | Thanks stevemar - appreciate it. | 13:34 |
| asettle | Getting a tonne of random bugs lately. | 13:34 |
| stevemar | asettle: you're more than welcomed to bug us here | 13:39 |
| stevemar | pun intened | 13:39 |
| stevemar | heyooo | 13:39 |
| asettle | Hurr hurrr :p | 13:39 |
| asettle | Don't give up your day job aye :p | 13:39 |
| stevemar | jamielennox: another one for you: https://review.openstack.org/#/c/419724/2 | 13:41 |
| stevemar | asettle: womp womp | 13:41 |
| asettle | Lucky jamielennox | 13:41 |
| asettle | My gosh I have another. | 13:43 |
| asettle | Keystone is *popular* today | 13:43 |
| stevemar | :D | 13:43 |
| asettle | https://bugs.launchpad.net/openstack-manuals/+bug/1632983 | 13:43 |
| openstack | Launchpad bug 1632983 in openstack-manuals "improvement in Checklist in Security Guide" [Undecided,New] | 13:43 |
| asettle | There was a subsequent patch: https://review.openstack.org/#/c/413398/2 which was shot down in flames | 13:43 |
| stevemar | asettle: yeah, before i could even comment on it, it was abandoned | 13:44 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystoneauth: Add test for header in Saml2 plugin https://review.openstack.org/421265 | 13:44 |
| asettle | As Stanek noted, I have absolutely no idea why this change is being made stevemar | 13:44 |
| rodrigods | stevemar, ^ minor fix | 13:44 |
| asettle | It's a question, 'is it recommended' so, guessing the short answer was 'no'. | 13:45 |
| *** markvoelker has joined #openstack-keystone | 13:45 | |
| stevemar | asettle: with my bug smashing hat on, if the patch was abandoned then i'd mark the bug as invalid / wontfix | 13:46 |
| asettle | Coolio hoolio | 13:46 |
| asettle | WE GOT THIS | 13:46 |
| stevemar | asettle: with my bug reporter hat on, maybe they think root is always more secure than a 'keystone' user? what if i don't have root :O | 13:47 |
| asettle | *gasp* | 13:47 |
| asettle | What IF | 13:47 |
| * asettle closes as a wont fix :p | 13:47 | |
| stevemar | smash those bugs | 13:48 |
| asettle | Since we're on this train, I wasn't able to replicate this guys problem: https://bugs.launchpad.net/openstack-manuals/+bug/1636965 | 13:48 |
| openstack | Launchpad bug 1636965 in openstack-manuals "Install and configure in Installation Guide" [Medium,New] | 13:48 |
| asettle | Maybe you guys have seen it before | 13:48 |
| asettle | Keystone, again. | 13:48 |
| stevemar | asettle: that looks liberty and older | 13:51 |
| stevemar | the whole "admin_" bits in the auth token section is old skool | 13:51 |
| stevemar | now we use the non prefixed ones, cause we're sane | 13:52 |
| asettle | Definitely is liberty and older. | 13:52 |
| asettle | That branch is deadsies. | 13:53 |
| asettle | But just wanted to check this wasn't an issue further along. | 13:53 |
| asettle | In *open* branches | 13:53 |
| stevemar | asettle: nah | 13:54 |
| asettle | Coolio hoolio :) will be closing. THanks for that :D | 13:54 |
| asettle | This has been most productive! THank you stevemar and breton | 13:54 |
| asettle | We get a lot of bugs that are configuration questions that I simply do not have the expertise to answer. | 13:55 |
| stevemar | np :) | 13:58 |
| *** dikonoor has joined #openstack-keystone | 14:11 | |
| dikonoor | stevemar: Hi Steve..This is around https://review.openstack.org/#/c/391405/ | 14:13 |
| *** jperry has joined #openstack-keystone | 14:13 | |
| *** jerrygb has joined #openstack-keystone | 14:14 | |
| dikonoor | stevemar: Can't find Eric Brown around..As part of this, few revocation attributes like check_revocations_for_cached and revocation_cache_time have been deprecated | 14:16 |
| dikonoor | stevemar: These were deprecated because PKI is not longer supported but I am not completely sure if this flow is associated only with PKI. | 14:17 |
| stevemar | dikonoor: oh? you can propose a revert or undeprecate the options | 14:17 |
| breton | dikonoor: where do you see the messages that you posted in https://bugs.launchpad.net/bugs/1657014 ? | 14:17 |
| openstack | Launchpad bug 1657014 in keystonemiddleware "Incorrect deprecation warning for revocations" [Undecided,New] | 14:17 |
| stevemar | at least they are not removed :) | 14:17 |
| dikonoor | stevemar: I have opened https://bugs.launchpad.net/keystonemiddleware/+bug/1657014 for this. | 14:17 |
| stevemar | dikonoor: he's usually online as browne | 14:18 |
| dikonoor | stevemar: They come from keystonemiddleware at the time of token validation | 14:18 |
| dikonoor | stevemar: ok..Let me talk to browne and check with him if I am missing something | 14:19 |
| breton | dikonoor: i still think that we deprecated them correctly | 14:20 |
| breton | dikonoor: for example, check_revocations_for_cached is used only to check revocations that were fetched from keystone, which happens only for PKI | 14:20 |
| breton | dikonoor: revocation_cache_time is used to cache revocations lists, which exist only for PKI | 14:22 |
| dikonoor | breton : but there's nothing in the keystonemiddleware that specifically checks if the tokens are of PKI formats.. So the revocation flows gets invoked for other token formats as well..like fernet | 14:23 |
| breton | dikonoor: you are right. However, no revocation lists are generated for non-PKI tokens. So if a deployment uses Fernet, revocation lists will always be empty. | 14:24 |
| breton | dikonoor: and that revocation check flow will always return that the token is valid | 14:25 |
| dikonoor | breton: ok..I was under the impression that the revoked tokens gets cached for all token formats. Also, in our performance tests we found that increasing the revocation cache time value from 10 to 30 with fernet token improved the performance significantly | 14:29 |
| dikonoor | breton: sorry..if was not fernet..it was uuid | 14:30 |
| breton | dikonoor: hmmmm | 14:34 |
| breton | so what happens is that revocation lists are fetched anyway | 14:34 |
| breton | and always are empty | 14:34 |
| breton | but the request still happens and takes some time | 14:35 |
| breton | dikonoor: you should file a bugreport about this. Or modify the existing one | 14:35 |
| dikonoor | breton: ok..so setting it from 10 to 30 just increases the time interval and thus the performance.. | 14:36 |
| *** tqtran has joined #openstack-keystone | 14:36 | |
| *** lucasagomes has joined #openstack-keystone | 14:37 | |
| *** lucasagomes has left #openstack-keystone | 14:37 | |
| *** tqtran has quit IRC | 14:38 | |
| dikonoor | breton: modify the existing one so that keystonemiddleware revocation flow doesn't happen for non-pki ? | 14:38 |
| breton | hmm... | 14:39 |
| breton | dikonoor: actually, if check_revocations_for_cached is False the call to keystone should not happen | 14:40 |
| breton | dikonoor: and it is False by default | 14:40 |
| breton | dikonoor: what is it in your config? | 14:40 |
| dikonoor | breton: check_revocations_for_cache is set to True in my config :) | 14:41 |
| breton | dikonoor: try commenting it out | 14:42 |
| dikonoor | breton: Thanks for pointing that out..Let me comment and try it out.. | 14:44 |
| *** lamt has quit IRC | 14:52 | |
| *** dikonoor has quit IRC | 14:53 | |
| *** lamt has joined #openstack-keystone | 14:58 | |
| lbragstad | stevemar I see we released our libraries last week - but I noticed that the fix from jdennis wasn't included in keystoneauth | 14:58 |
| lbragstad | is that something we want to release this week in order to include it? | 14:58 |
| *** ravelar has joined #openstack-keystone | 15:02 | |
| rodrigods | lbragstad, i would say yes | 15:05 |
| *** jaosorior has joined #openstack-keystone | 15:06 | |
| lbragstad | rodrigods yeah - thats kinda what I was thinking, too | 15:06 |
| rodrigods | lbragstad, would be nice to include this too: https://review.openstack.org/#/c/421265/ | 15:09 |
| lbragstad | rodrigods nice! I was just working on writing some tests for that | 15:10 |
| *** edtubill has quit IRC | 15:10 | |
| rodrigods | lbragstad, :) | 15:10 |
| *** jaugustine has joined #openstack-keystone | 15:10 | |
| lbragstad | rodrigods i'll review | 15:11 |
| lbragstad | rodrigods let's see if we can get this merged today | 15:11 |
| *** pcaruana has quit IRC | 15:15 | |
| dstanek | stevemar: are you still interested in https://review.openstack.org/#/c/374482/12 ? | 15:17 |
| *** david-lyle has joined #openstack-keystone | 15:24 | |
| lbragstad | rodrigods that test looks good - i had just one comment inline with my change in a diff | 15:28 |
| *** david-lyle has quit IRC | 15:29 | |
| *** david-lyle has joined #openstack-keystone | 15:29 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Fix response body being omitted in debug mode incorrectly https://review.openstack.org/421076 | 15:29 |
| *** edtubill has joined #openstack-keystone | 15:30 | |
| openstackgerrit | Samuel Pilla proposed openstack/keystoneauth: Correctly Omit Response Body in Debug Mode https://review.openstack.org/421319 | 15:30 |
| *** david-lyle has quit IRC | 15:34 | |
| stevemar | dstanek: i am, but if it doesn't get merged i won't sweat it | 15:42 |
| *** david-lyle has joined #openstack-keystone | 15:42 | |
| dstanek | stevemar: cool. i was thinking about ways to organized the tests to make it work. if i get around to it i may hack on it | 15:45 |
| stevemar | dstanek: failing to remove code isn't the worst thing for an end user | 15:45 |
| stevemar | dstanek: i would love that | 15:45 |
| stevemar | the tests made removing the code nearly impossible | 15:45 |
| rodrigods | lbragstad, are you ok to push the button there? i think you have a good suggestion but left in the way it is since the order in which the values appear is not important | 15:47 |
| *** mvk has quit IRC | 15:51 | |
| lbragstad | rodrigods yeah - I think it helps readability though for reviewers. I can propose a follow on patch | 15:53 |
| *** adrian_otto has joined #openstack-keystone | 15:55 | |
| *** david-lyle has quit IRC | 15:55 | |
| morgan | o/ | 15:58 |
| *** erhudy has joined #openstack-keystone | 15:58 | |
| *** chris_hultin|AWA is now known as chris_hultin | 15:59 | |
| *** sheel has quit IRC | 16:07 | |
| *** david-lyle has joined #openstack-keystone | 16:07 | |
| *** spzala has joined #openstack-keystone | 16:11 | |
| knikolla | o/ | 16:15 |
| *** agrebennikov has joined #openstack-keystone | 16:23 | |
| *** jaosorior has quit IRC | 16:26 | |
| *** diazjf has joined #openstack-keystone | 16:27 | |
| *** stingaci has quit IRC | 16:44 | |
| *** stingaci has joined #openstack-keystone | 16:44 | |
| *** stingaci has quit IRC | 16:44 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: WIP extend users API to add federated object https://review.openstack.org/418624 | 16:48 |
| *** diazjf has quit IRC | 16:51 | |
| *** diazjf has joined #openstack-keystone | 16:53 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Allow user to change own expired password https://review.openstack.org/404022 | 17:00 |
| morgan | stevemar: i'll be proposing the next bit for the MFA bit today | 17:03 |
| *** oomichi has joined #openstack-keystone | 17:03 | |
| morgan | which hopefully should cover the auth paths | 17:03 |
| morgan | then it'll be the API and serialization/deserialization stuff | 17:03 |
| morgan | stevemar: sorry it took so long to get going but you know... $stuff$ | 17:04 |
| morgan | and holidays | 17:04 |
| stevemar | morgan: its all good | 17:04 |
| morgan | i tried to remove AuthContext from the plugins but we did some bad design work under the hood | 17:06 |
| morgan | i'll need to add some TODOs to make auth plugins run as functional programming instead of with side-effects (like mucking with authcontext itself) | 17:06 |
| morgan | we should pass the information needed to the plugin and look at the respoinse not assume the plugin will set values | 17:07 |
| samueldmq | Hey hey keystoners | 17:07 |
| morgan | on a shared memory object | 17:07 |
| morgan | samueldmq: hey! how goes? | 17:07 |
| samueldmq | Is keystone meeting in 1 hour? | 17:07 |
| *** jaosorior has joined #openstack-keystone | 17:07 | |
| stevemar | samueldmq: yep | 17:07 |
| stevemar | better eat your lunch now | 17:07 |
| * morgan is drinking cup of coffee #4 | 17:07 | |
| samueldmq | morgan: hey, pretty good. In LCA this week | 17:07 |
| morgan | samueldmq: NICE | 17:08 |
| morgan | LCA good stuff :) | 17:08 |
| *** jrist has quit IRC | 17:08 | |
| morgan | stevemar: btw Linux Fest NW has a CFP open | 17:08 |
| *** phalmos has joined #openstack-keystone | 17:09 | |
| *** stingaci has joined #openstack-keystone | 17:09 | |
| *** voelzmo has quit IRC | 17:10 | |
| samueldmq | morgan: yeah, its my first time at LCA and I've got a talk. Pretty excited | 17:12 |
| samueldmq | Also, this conf is awesome | 17:12 |
| morgan | LCA is fun. | 17:12 |
| morgan | i honestly just don't wnat to be on a plane that long | 17:13 |
| morgan | sooooo | 17:13 |
| morgan | i don't submit papers | 17:13 |
| *** jrist has joined #openstack-keystone | 17:13 | |
| stevemar | i found out on friday last week that i have to fly out on friday of this week | 17:13 |
| stevemar | #headsup | 17:14 |
| * samueldmq waves at stevemar | 17:14 | |
| stevemar | o/ | 17:14 |
| samueldmq | o/ | 17:14 |
| stevemar | samueldmq: will you be at the meeting or at LCA? | 17:14 |
| samueldmq | stevemar: both | 17:15 |
| morgan | stevemar: where are you flying to? | 17:15 |
| stevemar | morgan: miami | 17:15 |
| samueldmq | Meeting is in 45 min (5am) | 17:15 |
| morgan | stevemar: thats not too bad | 17:15 |
| stevemar | samueldmq: hehe, enjoy the conf | 17:16 |
| morgan | stevemar: it'll be warm(ish) [you're going to be sitting on the beach with topol right? and taunting everyone with the warm weather] | 17:16 |
| stevemar | morgan: he won't be there :P | 17:16 |
| samueldmq | stevemar: and yes, this is 4 AM here and I AM jetlagged | 17:16 |
| morgan | stevemar: hah | 17:16 |
| samueldmq | stevemar: thanks | 17:16 |
| *** mvk has joined #openstack-keystone | 17:17 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement federated auto-provisioning https://review.openstack.org/415895 | 17:21 |
| *** david-lyle_ has joined #openstack-keystone | 17:26 | |
| *** stingaci has quit IRC | 17:28 | |
| *** phalmos has quit IRC | 17:33 | |
| *** david-lyle_ has quit IRC | 17:34 | |
| morgan | stevemar: ping | 17:36 |
| morgan | dolphm: ^ you too (see next line) | 17:36 |
| morgan | stevemar, dolphm: we need to figure out how to get a real threat analaysis published for keystoneauth and keystonemiddleware (preferably for this release) | 17:37 |
| morgan | stevemar, dolphm: i'm saying this with my VMT hat on. those two libraries are not covered by the VMT and really *need* to be. We should be setting the bar for other projects (since we're a security project) and leading here | 17:38 |
| morgan | this is a *really* important priority. | 17:38 |
| openstackgerrit | Merged openstack/keystoneauth: Add test for header in Saml2 plugin https://review.openstack.org/421265 | 17:38 |
| morgan | cc fungi ^ | 17:40 |
| morgan | the core of it is, we need a reputable 3rd party to do a publically publishable threat analysis | 17:40 |
| morgan | we need keystone to be done too, but that can be delayed a little | 17:40 |
| morgan | (since it is a much bigger surface area and is currently grandfathered in) | 17:40 |
| fungi | the security team has a threat analysis process/template which should make a lot of it fairly straightforward too | 17:40 |
| *** browne has joined #openstack-keystone | 17:41 | |
| fungi | http://git.openstack.org/cgit/openstack/security-analysis/ | 17:41 |
| morgan | I'm going to send an email to the -dev list shortly (once i can sign it via gpg) requesting folks to step up on this front | 17:41 |
| fungi | (and any concerns with that process can also be fixed as identified, of course) | 17:41 |
| morgan | but keystone shouldn't need that prompting and we should be able to solicit from ibm, redhat, rackspace somethingon this front | 17:41 |
| morgan | fungi: ++ | 17:41 |
| * morgan will put this on the meeting agenda for today as well. | 17:42 | |
| *** arunkant has joined #openstack-keystone | 17:42 | |
| fungi | i'll try to lurk the meeting while i'm prepping for my own | 17:43 |
| morgan | fungi: it's added i'll toss your name on it as well so you get a ping when we discuss it | 17:45 |
| fungi | thanks | 17:47 |
| * morgan is out of coffee | 17:49 | |
| morgan | mordred: do I grind more coffee and make another french press ... or suffer w/o ;) | 17:49 |
| morgan | :P | 17:49 |
| *** spilla has joined #openstack-keystone | 17:52 | |
| *** stingaci has joined #openstack-keystone | 17:55 | |
| mordred | morgan: always make another | 17:58 |
| mordred | morgan: oh, I just got a new burr grinder that I'm pretty pleased with | 17:58 |
| mordred | morgan: the Capresso Infinity - it does a good job on the grind consistency. the mechanical timer for grinding is worthless - but if you just weigh your beans before putting them in the hopper it's great | 17:59 |
| *** stingaci has quit IRC | 17:59 | |
| mordred | samueldmq: enjoy LCA! I'm sad I'm not there this year, but yes, it's my favorite conference | 18:00 |
| *** david-lyle_ has joined #openstack-keystone | 18:00 | |
| morgan | mordred: i am eyeing the Baratza Vario | 18:01 |
| morgan | mordred: it's pretty freaking awesome | 18:01 |
| morgan | mordred: i have the preciso but i don't like it a ton. | 18:01 |
| morgan | i'll also upgrade the vario to the steel burrs instead of ceramic for longevity | 18:01 |
| samueldmq | mordred: thanks, yes it's a great conference, I am loving it | 18:04 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Add domain_id to the user table https://review.openstack.org/409874 | 18:07 |
| *** Jack_I has quit IRC | 18:11 | |
| *** Jack_I has joined #openstack-keystone | 18:17 | |
| *** diazjf has quit IRC | 18:20 | |
| stevemar | zzzeek: o/ | 18:26 |
| zzzeek | stevemar: heya | 18:26 |
| stevemar | zzzeek: gagehugo has a question about autodoc + sqlalchemy + hybrid_property decorator :) | 18:26 |
| zzzeek | stevemar: hmmmm | 18:26 |
| stevemar | i'm not sure what the status of it all is? https://bitbucket.org/zzzeek/sqlalchemy/issues/3653/support-docstrings-on-hybrid-attributes i see your name all over this issue :D | 18:26 |
| gagehugo | yes | 18:27 |
| zzzeek | stevemar: http://docs.sqlalchemy.org/en/latest/changelog/migration_11.html#hybrid-properties-and-methods-now-propagate-the-docstring-as-well-as-info | 18:27 |
| stevemar | zzzeek: oh you mean just add a docstring to https://github.com/openstack/keystone/blob/8f038adac7c728d3fd2eb751cd8eb2cb6e209aff/keystone/identity/backends/sql_model.py#L55 and other hybrid properties? | 18:28 |
| *** spzala has quit IRC | 18:28 | |
| zzzeek | stevemar: yes but also you need sqlalchemy 1.1 | 18:28 |
| gagehugo | zzzeek: ah | 18:29 |
| stevemar | uh oh, are we capped at something silly | 18:29 |
| *** spzala has joined #openstack-keystone | 18:29 | |
| *** chris_hultin is now known as chris_hultin|AWA | 18:29 | |
| zzzeek | probably capped at 1.0.x still though that should change soon | 18:29 |
| stevemar | gah SQLAlchemy>=1.0.10,<1.1.0 # MIT | 18:29 |
| gagehugo | heh | 18:29 |
| stevemar | *shakes fist* | 18:29 |
| gagehugo | is there a reason we are capped? | 18:29 |
| zzzeek | gagehugo: because I break a ton of shit every 1.x :) | 18:30 |
| gagehugo | zzzeek: heh | 18:30 |
| zzzeek | gagehugo: openstack is ready for SQLA 1.1 just needs people to turn cranks | 18:30 |
| gagehugo | stevemar zzzeek: so maybe ignore the file for now with a nice detailed TODO when updated | 18:30 |
| gagehugo | zzzeek: ok | 18:30 |
| *** spzala has quit IRC | 18:33 | |
| *** edtubill has quit IRC | 18:33 | |
| stevemar | gagehugo: sure, you can also add the docstrings and test it locally with sqla 1.1 | 18:37 |
| *** tqtran has joined #openstack-keystone | 18:38 | |
| stevemar | gagehugo: or add the docstrings in a review and let other lazy people like me test it locally :D | 18:38 |
| gagehugo | stevemar: good point | 18:38 |
| *** tqtran has quit IRC | 18:40 | |
| * dstanek wishes Fedora would jump on the LXD bandwagon... | 18:41 | |
| stevemar | gagehugo: i'm playing with your doc patches now | 18:41 |
| dstanek | ayoung: ^ can you make it happen :-D | 18:42 |
| ayoung | dstanek, I'm just gettimng up to speed with all the issues. Done just enough docker and containers stuff to hurt myself so far | 18:42 |
| dstanek | ayoung: lxd is lxc+rest interface - canonical's new thing - the rpm for it isn't an official one :-( so i won't install on my laptop | 18:46 |
| ayoung | dstanek, has anyone proposed it as a Fedora package yet? | 18:46 |
| ayoung | dstanek, needs a package maintainer | 18:47 |
| *** david-lyle has quit IRC | 18:47 | |
| ayoung | "lift and shift” Heh | 18:48 |
| dstanek | ayoung: no idea - there is one on COPR that i use on VMs right now, but i usually just stick to the older style lxc | 18:48 |
| ayoung | http://noblecotactical.com/blog/difference-between-shift-fire-vs-lift-fire | 18:49 |
| ayoung | lift and shift is such a bad term | 18:49 |
| ayoung | dstanek, we are pretty much in bed with kubernetes these days | 18:49 |
| *** markvoelker has quit IRC | 18:49 | |
| ayoung | not sure the tie in between that and lxd | 18:50 |
| *** david-lyle_ has quit IRC | 18:50 | |
| *** phalmos has joined #openstack-keystone | 18:57 | |
| stevemar | zzzeek any idea what i'm not doing correctly here? http://paste.openstack.org/show/595260/ cc gagehugo | 18:58 |
| stevemar | zzzeek: i added docstrings to the properties that were mentioned, but still the same error | 18:59 |
| *** Jack_I has quit IRC | 18:59 | |
| gagehugo | stevemar: yeah, its the same issue as current | 18:59 |
| gagehugo | stevemar: only the password_* properties are having issues | 19:00 |
| *** spzala has joined #openstack-keystone | 19:00 | |
| zzzeek | stevemar: shrugs, guess it doesnt work | 19:00 |
| *** spzala has quit IRC | 19:00 | |
| *** Jack_I has joined #openstack-keystone | 19:00 | |
| zzzeek | stevemar: sphinx changes a lot which is annoying | 19:00 |
| *** spzala has joined #openstack-keystone | 19:00 | |
| lamt | gagehugo stevemar : tried it with SQLAlchemy==1.1.4 - it failed for me too | 19:00 |
| lbragstad | spilla o/ | 19:01 |
| spilla | o/ | 19:01 |
| spilla | So stevemar thats the fix, just wanted to know if its still an issue | 19:01 |
| morgan | zzzeek: yeah i agree. | 19:02 |
| spilla | launchpad searches came up dry so I wanted to see if anyone was aware of it | 19:02 |
| morgan | zzzeek: once i have some runway, i'm going to start spending some more time again on dogpile | 19:02 |
| zzzeek | stevemar: i think it's those "return None" | 19:03 |
| zzzeek | stevemar: basically, these hybrids won't work at the SQL expression level | 19:03 |
| morgan | zzzeek: i feel like we can make some cleanup and ease the interfaces up (also directly support pymemcache for many reasons) | 19:03 |
| morgan | zzzeek: anyway just a heads up i'm not ignoring it :) | 19:03 |
| zzzeek | morgan: dogpile is so way on the back burner for me :) | 19:03 |
| morgan | i know | 19:04 |
| *** tqtran has joined #openstack-keystone | 19:04 | |
| zzzeek | stevemar: sphinx docuemntation works at the class level. so here, if I say MyModel.password_created_at, that should return a SQL expression that's valid, not None | 19:04 |
| morgan | that is why i want to circle up on it and get some cleanup in | 19:04 |
| morgan | so there is just less to do in the future :) | 19:04 |
| zzzeek | stevemar: the change in 1.1 wraps SQL experssions in an object that provides __doc__ | 19:04 |
| *** Jack_V has joined #openstack-keystone | 19:05 | |
| *** Jack_I has quit IRC | 19:06 | |
| zzzeek | stevemar: change in plans. is .local_user defined at the class level ? I think your hybrid is actualyl throwing an AttributeError | 19:08 |
| *** Jack_I has joined #openstack-keystone | 19:09 | |
| *** Jack_V has quit IRC | 19:11 | |
| gagehugo | for the password_* properties yeah | 19:11 |
| *** Jack_I has quit IRC | 19:11 | |
| *** Jack_I has joined #openstack-keystone | 19:12 | |
| *** jose-phillips has joined #openstack-keystone | 19:14 | |
| *** Jack_V has joined #openstack-keystone | 19:14 | |
| *** Jack_I has quit IRC | 19:17 | |
| stevemar | zzzeek: yep, they are class level | 19:21 |
| stevemar | zzzeek: looks like its just the ones that return None | 19:22 |
| zzzeek | stevemar: I'm not able to reproduce a problem when returning None | 19:22 |
| stevemar | zzzeek: and when returning False | 19:22 |
| stevemar | hmm but the "domain_id" doesn't barf | 19:23 |
| zzzeek | stevemar: http://paste.openstack.org/show/595265/ | 19:23 |
| zzzeek | stevemar: just type User.password_ref at a pdb | 19:24 |
| zzzeek | stevemar: im installing deps so i can try | 19:24 |
| zzzeek | stevemar: http://paste.openstack.org/show/595266/ | 19:25 |
| zzzeek | stevemar: if these attrs aren't meant to be called at the class level there is no reason to use @hybrid_property, just use @property | 19:25 |
| gagehugo | adding http://paste.openstack.org/show/595267/ to User doesn't barf either | 19:26 |
| *** lamt has quit IRC | 19:27 | |
| stevemar | zzzeek: gagehugo yeah, using @property definitely works... and AFAICT we don't call it at the class level | 19:34 |
| stevemar | zzzeek: gagehugo we only use it once we get the reference | 19:34 |
| zzzeek | stevemar: the class level thing is the only point of hybrid_property :) | 19:34 |
| zzzeek | hence....."hybrid"..... | 19:35 |
| gagehugo | interesting | 19:35 |
| stevemar | zzzeek: not sure since i didn't write the code, maybe rderose knows why he used them :) maybe he had future plans? | 19:36 |
| zzzeek | stevemar: not sure, my impression is it's one of those, "saw it in X, looked idiomatic == sold" kinds of things :) | 19:36 |
| stevemar | hehe | 19:38 |
| rderose | reading... | 19:39 |
| stevemar | eek: so it's only necessary to add hybrid if using it like (in this example): User.password_expires_at ? | 19:40 |
| stevemar | ugh | 19:40 |
| stevemar | zzzeek: ^ | 19:40 |
| stevemar | failing at typing today | 19:40 |
| zzzeek | stevemar: yes. the purpose of hybrid is so that you can use your attribute at the class level in a query | 19:40 |
| zzzeek | stevemar: at the instance level, it is identical to @property | 19:40 |
| stevemar | morgan: samueldmq rodrigods lbragstad can someone punt https://review.openstack.org/#/c/421319/ through? | 19:41 |
| zzzeek | stevemar / rderose since these attributes don't even work at the class level and aren't tested for that, they should be @property | 19:41 |
| *** tqtran has quit IRC | 19:41 | |
| rodrigods | stevemar, done | 19:42 |
| morgan | rodrigods: beat me to it | 19:42 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch @hybrid_property to @property https://review.openstack.org/421468 | 19:43 |
| *** lucas has joined #openstack-keystone | 19:44 | |
| morgan | stevemar: i';m closing all kilo and liberty targeted bugs | 19:50 |
| morgan | stevemar: FYI | 19:50 |
| *** david-lyle has joined #openstack-keystone | 19:50 | |
| *** chris_hultin|AWA is now known as chris_hultin | 19:51 | |
| stevemar | morgan: there were kilo and liberty targetted bugs? | 19:52 |
| *** diazjf has joined #openstack-keystone | 19:52 | |
| morgan | yep | 19:53 |
| stevemar | morgan: did you have an opinion on https://review.openstack.org/#/c/419724/ ? | 19:53 |
| morgan | most in "fix committed" state, marking as released | 19:53 |
| morgan | oh that should be fine | 19:53 |
| stevemar | morgan: ah, thought i caught all of those | 19:53 |
| morgan | the oslo.log thing | 19:53 |
| stevemar | yeah | 19:53 |
| morgan | let me 2x check | 19:54 |
| morgan | in middleware it's fine | 19:54 |
| stevemar | morgan: already approved :P | 19:54 |
| stevemar | right, i -1'ed the client one | 19:54 |
| morgan | in ksa i would say no nope not happening, never | 19:54 |
| morgan | but for ksm it's fine | 19:54 |
| stevemar | i -2'ed the client one | 19:54 |
| morgan | wait, why does client matter? | 19:55 |
| morgan | ksc should be fine? | 19:55 |
| morgan | or was it for middleware in ksc (thought we deleted that stuff) | 19:55 |
| stevemar | morgan: while you're around: https://review.openstack.org/#/c/421411/1 | 19:55 |
| *** Jack_V has quit IRC | 19:55 | |
| stevemar | morgan: there was a separate review for adding oslo.log to ksc | 19:56 |
| morgan | ahhh | 19:56 |
| stevemar | morgan: https://review.openstack.org/#/c/421140/1 | 19:56 |
| stevemar | sorry, i skipped ahead :) | 19:56 |
| morgan | hehe | 19:56 |
| morgan | ok all kilo/liberty bugs closed | 19:57 |
| morgan | for keystone server | 19:57 |
| morgan | haven't looked at ksa/ksm/ksc bugs | 19:57 |
| morgan | looking at undecided for keystone server | 19:57 |
| morgan | most look like not RC candidtates | 19:57 |
| stevemar | morgan: one more while you're around: https://review.openstack.org/#/c/392442/ | 19:57 |
| morgan | only exception is the LDAP utf-8 one, but that could be a backport | 19:57 |
| morgan | brb | 19:58 |
| stevemar | morgan: there are two ldap ones that would be nice to fix, one for hebrew characters, another for chinese | 19:58 |
| stevemar | morgan: and... another | 19:58 |
| stevemar | https://review.openstack.org/#/c/304489/ | 19:58 |
| morgan | stevemar: same fix i think | 19:59 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add queries for federated attributes in list_users https://review.openstack.org/414720 | 20:00 |
| stevemar | morgan: prob | 20:00 |
| morgan | stevemar: -1 on the region pop one | 20:01 |
| morgan | i'll fix it | 20:01 |
| stevemar | morgan: i think one is related to user name the other is the actual dn | 20:01 |
| morgan | but it should be .pop(region, None) | 20:01 |
| morgan | not .get | 20:01 |
| morgan | we don't want that in the ref itself being passed to the api backend | 20:01 |
| stevemar | ah | 20:01 |
| morgan | will cuase some non-derministic behavior | 20:01 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Handling of 'region' parameter as None https://review.openstack.org/304489 | 20:03 |
| morgan | stevemar: ^ | 20:03 |
| *** tqtran has joined #openstack-keystone | 20:03 | |
| morgan | stevemar: we may want oslo.log in ksc fwiw | 20:04 |
| morgan | but i'm ok with the -2 for now | 20:04 |
| stevemar | morgan: i don't see a reason to pull in all that crap | 20:05 |
| *** tqtran has quit IRC | 20:05 | |
| morgan | mostly we avoided it before because session etc etc etc | 20:05 |
| morgan | but we can revisit later | 20:05 |
| *** adrian_otto has quit IRC | 20:06 | |
| stevemar | morgan: you can punt it through... | 20:06 |
| morgan | oh the one i fixed? i'll wait for CI response | 20:06 |
| morgan | want to make sure it passes, i expect it to | 20:07 |
| morgan | but yanno | 20:07 |
| stevemar | morgan: and one more since you're involved in kSA: https://review.openstack.org/#/c/392442/ | 20:08 |
| morgan | yeah i hadn't looked at the code yet | 20:09 |
| morgan | was on the open tabs list | 20:09 |
| morgan | hnmm | 20:10 |
| morgan | i would like to gate that on if logger is in debug mode | 20:10 |
| morgan | because ksa is super sensitive to extra workloads | 20:10 |
| morgan | oh wait | 20:10 |
| morgan | nvm that is in the logger i am hoping the logger isn't dumb and still does the str replace if the logger isn't in debug | 20:10 |
| morgan | ok we're good it isn't dumnb | 20:11 |
| morgan | though we could circumvent the whole logic if logger isn't in debug | 20:12 |
| morgan | stevemar: ok approved | 20:13 |
| stevemar | \o/ | 20:17 |
| morgan | stevemar: so... i think we should tag the ldap fix for chinese and hebrew | 20:19 |
| morgan | for RC otherwise the undecideds all look safe to punt on | 20:20 |
| morgan | except the security bugs need a PTL sweet (there are 2) | 20:20 |
| morgan | sweep* | 20:20 |
| morgan | also this https://bugs.launchpad.net/keystone/+bug/1644862 is an odd one | 20:20 |
| openstack | Launchpad bug 1644862 in OpenStack Identity (keystone) mitaka "domain ldap tls_cacertfile "forgotten" in multidomain configuration" [Undecided,New] | 20:20 |
| stevemar | morgan: i've wanted to fix the LDAP ones for a while | 20:20 |
| morgan | lets tag as RC potential and see if we can get some eyes on it *cough* ayoung *cough* lbragstad *cough* | 20:21 |
| morgan | also https://bugs.launchpad.net/keystone/+bug/1654409 ... another odd one | 20:21 |
| openstack | Launchpad bug 1654409 in OpenStack Identity (keystone) "Duplicate users (federated and sql) results in 401" [Undecided,New] | 20:21 |
| lbragstad | morgan will look after the TC meeting | 20:21 |
| * dstanek gets ready for another round of reviews before his next meeting | 20:22 | |
| dstanek | morgan: stevemar: lbragstad: is there anything i can help with or should i just go to next-review? | 20:24 |
| morgan | next-review is probably sufficient atm | 20:25 |
| morgan | bknudson: since you're busy i'm dropping you from coresec for now and adding lbragstad since he's going to help with security analysis | 20:27 |
| morgan | bknudson: when you're back/have more time happy to re-add you. | 20:27 |
| bknudson | morgan: ok, makes sense | 20:27 |
| bknudson | should get more people involved in security | 20:28 |
| morgan | :) | 20:28 |
| morgan | i am also dropping gyee (cc stevemar ) from coresec | 20:28 |
| bknudson | as long as we can trust them. | 20:28 |
| morgan | bknudson: ++ | 20:29 |
| morgan | well coresec should be a small group. but we should have people invovled | 20:29 |
| morgan | and interested in security | 20:29 |
| stevemar | bknudson: are you implying that lbragstad can't be trusted? cause i think you're right | 20:30 |
| morgan | lbragstad: you're now on keystone-coresec | 20:30 |
| stevemar | :) | 20:30 |
| morgan | stevemar: i'm positive lbragstad can't be trusted | 20:30 |
| morgan | stevemar: ;) | 20:30 |
| lbragstad | lol | 20:31 |
| bknudson | throw some fake vulnerability reports at him and see if they leak. | 20:31 |
| lbragstad | <.< | 20:31 |
| lbragstad | >.> | 20:31 |
| dstanek | morgan: i can vouch that lbragstad can't be trusted | 20:31 |
| morgan | dstanek: ^_^ | 20:31 |
| *** woodster_ has joined #openstack-keystone | 20:32 | |
| stevemar | bknudson: i can confirm that lbragstad is the leaker | 20:38 |
| lbragstad | stevemar it *depends* | 20:40 |
| * lbragstad slaps knee | 20:40 | |
| stevemar | lbragstad: dnc and trump team gonna be looking for you | 20:40 |
| lbragstad | well - i don't think i'm hiding | 20:41 |
| knikolla | spilla: around? | 20:45 |
| dstanek | stevemar: did he leak the pee-pee story? | 20:46 |
| spilla | hello knikolla | 20:46 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add queries for federated attributes in list_users https://review.openstack.org/414720 | 20:46 |
| morgan | stevemar: please go look at https://bugs.launchpad.net/keystoneauth/+bug/1638978 (cc lbragstad dstanek ayoung ) | 20:46 |
| openstack | morgan: Error: malone bug 1638978 not found | 20:46 |
| stevemar | FYI PTL self-nomination period starts in ~1d https://governance.openstack.org/election/ | 20:46 |
| knikolla | spilla: hi. was going through https://review.openstack.org/#/c/403898 and have a few questions | 20:46 |
| morgan | ^^ Remember what i said, don't make dolphm or myself come out of retirement! Nominate yourself for the role if you're interested! | 20:47 |
| spilla | knikolla fire away :) | 20:48 |
| knikolla | spilla: so if no operator is provided, and just the date, the syntax is password_expires_at=<date> ? | 20:51 |
| spilla | correct | 20:51 |
| *** severion has joined #openstack-keystone | 20:51 | |
| knikolla | spilla: in core.py, you're still splitting on the first ':', so that will probably not work | 20:52 |
| dstanek | morgan: would that be so bad? | 20:52 |
| morgan | dstanek: lol | 20:52 |
| knikolla | spilla: actually it will, but the try/catch structure is very confusing. | 20:53 |
| knikolla | spilla: before i posted my review i wanted to get a better understanding of it. | 20:54 |
| spilla | knikolla: I agree. It was the best I could come up with, and something lbragstad mentioned should be looked at to see if it cna be smplified | 20:55 |
| spilla | Essentially it will split on the first colon. If the timestamp at that point is not valid, it'll throw a ValueError and pass to the next try. | 20:56 |
| *** phalmos has quit IRC | 20:56 | |
| knikolla | spilla: It can be simplified, I have a few ideas on how. | 20:56 |
| spilla | knikolla yes please :D | 20:57 |
| spilla | I've been pondering it for a while, any help is appreciated | 20:57 |
| dstanek | morgan: can't discuss here other than to say 'not a big deal' | 20:59 |
| knikolla | spilla: just give me a moment to gather my thoughts. | 21:00 |
| spilla | For sure! | 21:01 |
| *** adrian_otto has joined #openstack-keystone | 21:02 | |
| morgan | dstanek: comment on the bug :) thnx | 21:03 |
| dstanek | morgan: already did | 21:04 |
| dstanek | spilla: what are you trying to do? | 21:04 |
| *** phalmos has joined #openstack-keystone | 21:04 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add queries for federated attributes in list_users https://review.openstack.org/414720 | 21:04 |
| *** adrian_otto1 has joined #openstack-keystone | 21:07 | |
| spilla | dstanek: with the try/except loveliness? | 21:07 |
| dstanek | spilla: i wasn't following the conversation. just saw the very end. what are you trying to do? | 21:08 |
| *** dave-mccowan has quit IRC | 21:09 | |
| spilla | Simplify the keystone/identity/core.py changes on t/keystoneauth/+bug/1638978 (cc lbragstad dstanek ayoung ) | 21:09 |
| spilla | <openstack> morgan: Error: malone bug 1638978 not found | 21:09 |
| spilla | <stevemar> FYI PTL self-nomination period starts in ~1d https://governance.openstack.org/election/ | 21:09 |
| spilla | <knikolla> spilla: hi. was going through https://review.openstack.org/#/c/403898 | 21:09 |
| *** adrian_otto has quit IRC | 21:09 | |
| spilla | woops | 21:09 |
| spilla | copied too much | 21:09 |
| spilla | Simplify changes on keystone/identity/core.py https://review.openstack.org/#/c/403898 | 21:10 |
| *** stewie925 has joined #openstack-keystone | 21:10 | |
| knikolla | dstanek: there's a very confusing try/catch that should be simplified. | 21:11 |
| morgan | stevemar: ok i need to run, have an appointment at 2:30 | 21:12 |
| morgan | need to take care of a couple things before going | 21:12 |
| morgan | will be back a bit later and shall continue with some triaging | 21:12 |
| morgan | ksa/ksm is almost all triaged now | 21:12 |
| stevemar | morgan: https://review.openstack.org/#/c/304489/ is ready, zuul is happy | 21:14 |
| dstanek | spilla: i commented on that review | 21:14 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch @hybrid_property to @property https://review.openstack.org/421468 | 21:14 |
| stevemar | rderose: addressed your comment in https://review.openstack.org/#/c/421468/ | 21:14 |
| dstanek | spilla: knikolla: which try is confusing? | 21:14 |
| rderose | stevemar: cool, on it | 21:15 |
| stevemar | breton: kick 304489 please | 21:15 |
| edmondsw | stevemar, has there ever been talk of moving SSH keypairs from nova into keystone? | 21:16 |
| edmondsw | seems like a much better place to keep them... | 21:16 |
| dstanek | edmondsw: not barbican? | 21:17 |
| lbragstad | dstanek ++ | 21:17 |
| stevemar | edmondsw: i'm sure someone has brought it up, along with quotas :P | 21:17 |
| edmondsw | dstanek, I'm thinking knowledge of, not storage location | 21:17 |
| edmondsw | i don't really care what the backend is | 21:17 |
| knikolla | spilla: could this work? http://paste.openstack.org/show/BctSI1UCoftoeNr4gvBb/ | 21:18 |
| edmondsw | keypairs are tied to a user, and users belong to keystone | 21:18 |
| knikolla | spilla: arrr… typo: i meant if ':' in filter_['value'][2:3] | 21:19 |
| openstackgerrit | Merged openstack/keystonemiddleware: Removes unnecessary utf-8 coding https://review.openstack.org/419420 | 21:19 |
| dstanek | edmondsw: what does knowledge of mean? | 21:19 |
| openstackgerrit | Merged openstack/keystonemiddleware: use oslo.log instead of logging https://review.openstack.org/419724 | 21:19 |
| spilla | okay, that was my first question | 21:19 |
| edmondsw | dstanek metadata | 21:20 |
| edmondsw | dstanek maybe store the keys themselves, too... could support multiple backends, one being db, one being barbican, etc. where the key is actually stored | 21:20 |
| *** chris_hultin is now known as chris_hultin|AWA | 21:20 | |
| spilla | knikolla: I think this should work, I'll give it a test. Much more understandable | 21:21 |
| dstanek | edmondsw: i would be -2 on storing any new secrets like that | 21:21 |
| *** lamt has joined #openstack-keystone | 21:21 | |
| edmondsw | if there's a reason to store in barbican... in my use case I don't have barbican, and I wouldn't want to set it up just for this | 21:21 |
| dstanek | you can store it in credentials if you are not too worried about security :-) although we do encrypt those now so it's not as bad as it used to be | 21:22 |
| edmondsw | dstanek they're not really secrets... just public keys | 21:23 |
| edmondsw | dstanek, at least that's all I'd propose we keep... nova calls it keypairs because they let you generate in nova, in which case you can download the private key, but that seems silly | 21:23 |
| edmondsw | dstanek just allow upload of the public key, make them generate the keypair separately and never tell OpenStack the private key | 21:24 |
| *** pnavarro has quit IRC | 21:24 | |
| edmondsw | I think that's what most people do with the current solution anyway | 21:24 |
| *** portdirect is now known as portdirect_away | 21:30 | |
| browne | another place to keep public keys is on the ldap server | 21:31 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add queries for federated attributes in list_users https://review.openstack.org/414720 | 21:31 |
| browne | but yes, i don't think nova should be managing public keys | 21:32 |
| *** adriant has joined #openstack-keystone | 21:32 | |
| *** severion has quit IRC | 21:39 | |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: Add password expiration queries for PCI-DSS https://review.openstack.org/403898 | 21:41 |
| spilla | knikolla: thanks for the help! :) | 21:41 |
| knikolla | spilla: anytime :) | 21:42 |
| *** spzala has quit IRC | 21:44 | |
| *** andreykurilin has joined #openstack-keystone | 21:46 | |
| *** edtubill has joined #openstack-keystone | 21:46 | |
| andreykurilin | hi folks! Can anyone help me with trying to figure out how to setup keystoneclient to use public endpoint for creating users and tenants? | 21:47 |
| andreykurilin | jamielennox ^ | 21:48 |
| jamielennox | Assuming you're using sessions it should just be passing interface='public' to client creation | 21:50 |
| breton | jamielennox: doesn't it use public by default? | 21:51 |
| jamielennox | Most clients do, we had some backwards compatibility issues initially on ksc that would use admin by default - but i did think we fixed that | 21:52 |
| andreykurilin | it is how we initialize kc - https://github.com/openstack/rally/blob/master/rally/osclients.py#L217-L323 | 21:53 |
| andreykurilin | main method create_client | 21:53 |
| andreykurilin | it calls get_session | 21:54 |
| andreykurilin | our customer said that he used "auth_url": "https://example.com:5000/v3/" with endpoint_type="public" (these variables are located in self.credential object) | 21:55 |
| jamielennox | There's some redundancy there, the password plugin knows how to handle v2/v3 differences, but shouldn't matter | 21:55 |
| andreykurilin | http://paste.openstack.org/show/595281/ see first to lines of the log | 21:55 |
| jamielennox | Endpoimt type is old, but i think it would work, i would need to check | 21:56 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Add domain_id to the user table https://review.openstack.org/409874 | 21:56 |
| jamielennox | Try changing to interface | 21:56 |
| andreykurilin | jamielennox: unfortunately, I'm not keystone guru and write it as it works for me:) | 21:56 |
| stevemar | morgan: if you've got more energy in you: https://review.openstack.org/#/q/topic:bug/1656981 | 21:57 |
| jamielennox | I'm at a conference so can't do much debugging right now, but can probably look in a couple of hours, but unfortunately because of all the compatibility stuff there are old options in client creation that are accepted but ignored | 21:58 |
| andreykurilin | I'll ask our customer to try change endpoint_type to interface.. | 21:58 |
| *** spilla has quit IRC | 21:58 | |
| *** d0ugal has quit IRC | 21:59 | |
| *** d0ugal has joined #openstack-keystone | 21:59 | |
| *** d0ugal has quit IRC | 21:59 | |
| *** d0ugal has joined #openstack-keystone | 21:59 | |
| *** thorst has quit IRC | 21:59 | |
| andreykurilin | it would be really nice if some of you, guys will help us to optimise our code about keystoneclient creation | 22:00 |
| jamielennox | Ever thought about using os-client -config? | 22:01 |
| *** harlowja has quit IRC | 22:01 | |
| jamielennox | It's certainly not perfect, but they've give through a lot of this already | 22:01 |
| andreykurilin | 1) os-client -config appeared after we use rally.osclients module for a long time 2) not sure how difficult it will be to integrate with os-client-config, since we need to provide a unified way for setting credentials for different systems(not only openstack) | 22:04 |
| *** adrian_otto1 has quit IRC | 22:04 | |
| andreykurilin | changing endpoint_type to inteface helped | 22:05 |
| *** adrian_otto has joined #openstack-keystone | 22:06 | |
| *** tqtran has joined #openstack-keystone | 22:06 | |
| jamielennox | Awesome | 22:06 |
| *** portdirect_away is now known as portdirect | 22:07 | |
| *** tqtran has quit IRC | 22:08 | |
| openstackgerrit | Merged openstack/keystoneauth: Log request-id for each api call https://review.openstack.org/392442 | 22:09 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement federated auto-provisioning https://review.openstack.org/415895 | 22:10 |
| gagehugo | samueldmq: When you get a chance, can you take another look at https://review.openstack.org/#/c/420171 | 22:12 |
| andreykurilin | jamoelennox: long time ago(at the start of the summer) I made a big change and a big number of patch-sets and rebases lost changing endpoint_type to interface:( this change was included even in commit message. `KeystoneClient uses "interface", but Rally transmits "endpoint_type" which is silently ignored by kc.` | 22:13 |
| breton | stevemar: do we really need the backports? | 22:13 |
| breton | stevemar: for response body being ommited | 22:13 |
| breton | stevemar: keystone added utf-8 bit only in Ocata | 22:14 |
| stevemar | breton: yeah, i was wondering about that, i figured it wouldn't hurt? | 22:14 |
| lbragstad | rderose i'm reading through http://docs.openstack.org/developer/keystone/federation/federated_identity.html#mapping-combinations and I think some of that might be outdated with the move towards shadow users | 22:14 |
| stevemar | breton: incase we do some weirdness with webob in mitaka/newton | 22:14 |
| stevemar | lbragstad: oh yeah, that needs to be revamped entirely | 22:15 |
| lbragstad | stevemar I assume that's probably the best place for shadow mapping examples to live, too? | 22:15 |
| samueldmq | gagehugo: done | 22:16 |
| stevemar | lbragstad: yep | 22:16 |
| rderose | lbragstad: yeah, any reference to ephemeral user is not correct | 22:16 |
| rderose | lbragstad: although I'm not seeing that in Mapping Combinations | 22:16 |
| lbragstad | hmm - there is a lot of that then ;) | 22:16 |
| rderose | lbragstad: what are you referring to? | 22:16 |
| lbragstad | rderose http://docs.openstack.org/developer/keystone/federation/federated_identity.html#output | 22:16 |
| rderose | lbragstad: gotcha | 22:17 |
| *** catintheroof has quit IRC | 22:20 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add domain_id to the user table https://review.openstack.org/409874 | 22:24 |
| *** thorst has joined #openstack-keystone | 22:24 | |
| *** thorst has quit IRC | 22:24 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add domain_id to the user table https://review.openstack.org/409874 | 22:26 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add queries for federated attributes in list_users https://review.openstack.org/414720 | 22:26 |
| *** thiagolib has quit IRC | 22:28 | |
| gagehugo | samueldmq: thanks! | 22:29 |
| *** ravelar has quit IRC | 22:33 | |
| samueldmq | gagehugo: np | 22:40 |
| gagehugo | stevemar: last check seems borked at the gate https://review.openstack.org/#/c/421319/ | 22:41 |
| gagehugo | failed both times | 22:41 |
| *** edtubill_ has joined #openstack-keystone | 22:41 | |
| *** edmondsw has quit IRC | 22:42 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add domain_id to the user table https://review.openstack.org/409874 | 22:44 |
| *** diazjf has quit IRC | 22:44 | |
| *** edtubill has quit IRC | 22:44 | |
| *** thorst has joined #openstack-keystone | 22:46 | |
| *** edtubill_ has quit IRC | 22:47 | |
| *** adrian_otto has quit IRC | 22:49 | |
| *** david-lyle has quit IRC | 22:51 | |
| *** spzala has joined #openstack-keystone | 22:52 | |
| *** thorst has quit IRC | 22:53 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add documentation for auto-provisioning https://review.openstack.org/421573 | 22:55 |
| *** spzala has quit IRC | 22:56 | |
| *** phalmos has quit IRC | 23:03 | |
| *** jaugustine has quit IRC | 23:03 | |
| *** david-lyle has joined #openstack-keystone | 23:03 | |
| *** spzala has joined #openstack-keystone | 23:04 | |
| *** jperry has quit IRC | 23:05 | |
| breton | gagehugo: 2017-01-17 22:38:01.086 3935 ERROR keystone.common.wsgi [req-fcd9a85f-7a99-4c46-9445-7e97b6700db5 a151cbd7ef60430f94252db7fb1da7e7 eb4315a00a774ca089e06f7f3048714c - default default] (pymysql.err.OperationalError) (2003, "Can't connect to MySQL server on '127.0.0.1' ([Errno 111] Connection refused)") [SQL: u'SELECT 1'] | 23:05 |
| breton | i think it is the same problem we talked about recently | 23:06 |
| lbragstad | breton yeah - it looks like an oom issue | 23:06 |
| lbragstad | breton gagehugo I've been trying to track it here - https://bugs.launchpad.net/keystone/+bug/1656850 | 23:10 |
| openstack | Launchpad bug 1656850 in OpenStack Identity (keystone) "mysql OOM: DBConnectionError while validating tokens in CI runs" [High,Confirmed] | 23:10 |
| *** david-lyle has quit IRC | 23:10 | |
| *** lamt has quit IRC | 23:15 | |
| *** chris_hultin|AWA is now known as chris_hultin | 23:19 | |
| *** asettle has quit IRC | 23:20 | |
| *** edmondsw has joined #openstack-keystone | 23:25 | |
| *** lucas has quit IRC | 23:28 | |
| *** lucas has joined #openstack-keystone | 23:28 | |
| lbragstad | stevemar what are the chances we could get henry's opinion on the mailing list post from last week? | 23:29 |
| *** edmondsw has quit IRC | 23:30 | |
| jamielennox | stevemar: did you look at the application/json printing thing? | 23:30 |
| *** lucas has quit IRC | 23:37 | |
| *** dave-mccowan has joined #openstack-keystone | 23:51 | |
| *** spzala has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!