| *** adrian_otto has quit IRC | 00:00 | |
| *** kbaegis has joined #openstack-keystone | 00:04 | |
| *** adrian_otto has joined #openstack-keystone | 00:10 | |
| *** mnaser has left #openstack-keystone | 00:12 | |
| *** adrian_otto has quit IRC | 00:18 | |
| *** jamielennox is now known as jamielennox|away | 00:20 | |
| *** catintheroof has joined #openstack-keystone | 00:26 | |
| *** catintheroof has quit IRC | 00:26 | |
| *** catintheroof has joined #openstack-keystone | 00:26 | |
| *** jamielennox|away is now known as jamielennox | 00:27 | |
| *** liujiong has joined #openstack-keystone | 00:35 | |
| *** namnh has joined #openstack-keystone | 00:42 | |
| *** guoshan has joined #openstack-keystone | 00:45 | |
| *** bkudryavtsev has joined #openstack-keystone | 00:50 | |
| *** bkudryavtsev has quit IRC | 00:50 | |
| *** bkudryavtsev has joined #openstack-keystone | 00:51 | |
| *** bkudryavtsev has quit IRC | 00:51 | |
| *** dave-mccowan has joined #openstack-keystone | 00:59 | |
| *** ravelar has joined #openstack-keystone | 01:01 | |
| *** zhurong has joined #openstack-keystone | 01:11 | |
| *** ravelar has quit IRC | 01:12 | |
| *** guoshan has quit IRC | 01:16 | |
| *** guoshan has joined #openstack-keystone | 01:19 | |
| *** Shunli has joined #openstack-keystone | 01:21 | |
| *** guoshan has quit IRC | 01:23 | |
| *** wangqun has joined #openstack-keystone | 01:34 | |
| *** guoshan has joined #openstack-keystone | 02:09 | |
| *** guoshan has quit IRC | 02:10 | |
| *** guoshan has joined #openstack-keystone | 02:10 | |
| *** catintheroof has quit IRC | 02:18 | |
| openstackgerrit | Merged openstack/oslo.policy master: Allow multiline descriptions for RuleDefaults https://review.openstack.org/441342 | 02:32 |
|---|---|---|
| *** yuvalb has quit IRC | 02:43 | |
| *** yuvalb has joined #openstack-keystone | 02:43 | |
| *** catintheroof has joined #openstack-keystone | 02:45 | |
| *** catintheroof has quit IRC | 02:45 | |
| *** catintheroof has joined #openstack-keystone | 02:45 | |
| *** Guest45610 has joined #openstack-keystone | 03:07 | |
| *** nicolasbock has quit IRC | 03:21 | |
| *** adrian_otto has joined #openstack-keystone | 03:31 | |
| *** dave-mccowan has quit IRC | 03:32 | |
| *** Guest45610 has quit IRC | 03:33 | |
| *** prashkre has joined #openstack-keystone | 03:34 | |
| *** catintheroof has quit IRC | 03:37 | |
| *** adrian_otto has quit IRC | 03:41 | |
| *** adrian_otto has joined #openstack-keystone | 03:50 | |
| *** prashkre has quit IRC | 03:54 | |
| *** frontrunner has quit IRC | 03:54 | |
| *** adrian_otto has quit IRC | 03:55 | |
| *** links has joined #openstack-keystone | 04:02 | |
| *** aojea has joined #openstack-keystone | 04:06 | |
| *** aojea has quit IRC | 04:11 | |
| *** chlong_ has quit IRC | 04:34 | |
| *** markvoelker has quit IRC | 04:35 | |
| *** aasthad has joined #openstack-keystone | 05:05 | |
| *** thorst_afk has joined #openstack-keystone | 05:19 | |
| *** thorst_afk has joined #openstack-keystone | 05:28 | |
| *** thorst_afk has quit IRC | 05:32 | |
| *** markvoelker has joined #openstack-keystone | 05:36 | |
| *** prashkre has joined #openstack-keystone | 05:40 | |
| *** markvoelker has quit IRC | 05:41 | |
| *** thorst_afk has joined #openstack-keystone | 05:43 | |
| *** thorst_afk has quit IRC | 05:47 | |
| *** tovin07 has joined #openstack-keystone | 06:00 | |
| *** h5t4 has joined #openstack-keystone | 06:09 | |
| *** adriant has quit IRC | 06:40 | |
| *** h5t4 has quit IRC | 06:54 | |
| *** YanXing_an has joined #openstack-keystone | 07:03 | |
| *** Shunli has quit IRC | 07:06 | |
| *** Shunli has joined #openstack-keystone | 07:07 | |
| *** jaybeers has quit IRC | 07:17 | |
| *** h5t4_ has joined #openstack-keystone | 07:27 | |
| *** henrynash has joined #openstack-keystone | 07:28 | |
| *** YanXing_an has quit IRC | 07:33 | |
| *** YanXing_an has joined #openstack-keystone | 07:34 | |
| *** henrynash has quit IRC | 07:43 | |
| *** Andrew_jedi has joined #openstack-keystone | 07:48 | |
| Andrew_jedi | Hello folks, can we define a role that gives a user the ability to create a project, but not to modify any of its quota settings? | 07:49 |
| *** belmoreira has joined #openstack-keystone | 07:54 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** tovin07 has quit IRC | 08:07 | |
| *** tovin07 has joined #openstack-keystone | 08:12 | |
| *** tesseract has joined #openstack-keystone | 08:13 | |
| *** tesseract has quit IRC | 08:17 | |
| *** aojea has joined #openstack-keystone | 08:17 | |
| *** openstackgerrit has quit IRC | 08:18 | |
| *** aojea has quit IRC | 08:19 | |
| *** aojea has joined #openstack-keystone | 08:19 | |
| breton | yes, we can | 08:20 |
| *** pcaruana has joined #openstack-keystone | 08:25 | |
| *** aojea_ has joined #openstack-keystone | 08:25 | |
| *** agrebennikov has joined #openstack-keystone | 08:28 | |
| *** aojea has quit IRC | 08:29 | |
| Andrew_jedi | breton: great, could you please elaborate a bit as to how can we do it ? | 08:30 |
| *** tesseract has joined #openstack-keystone | 08:32 | |
| *** agrebennikov has quit IRC | 08:33 | |
| YanXing_an | hello, folks, i want to use barbican to store fernet keys. Do you known what projects are using barbican currently? | 08:36 |
| Andrew_jedi | YanXing_an: I think magnum uses it | 08:38 |
| YanXing_an | Andrew_jedi: Thanks. I will have a look at magnum. | 08:41 |
| breton | Andrew_jedi: you probably need to modify policy.json | 08:41 |
| breton | Andrew_jedi: you probably need a role that can create_project in keystone's policy.json but cannot perform operations on quotas in nova's, neutron's and cinder's policy.json. | 08:43 |
| breton | i don't know what are the functions that do it in services other than keystone unfortunately | 08:43 |
| Andrew_jedi | breton: oh, that is useful info, thanks! | 08:44 |
| Andrew_jedi | breton: btw Is there a way to create cross-domain tenants, i.e. tenants where users/groups from different domains can hold a role in a specific tenant? | 08:44 |
| Andrew_jedi | breton: AFAIK It is not possible to create cross-domain projects but it is possible for users to have roles in multiple domains? right ? | 08:45 |
| breton | Andrew_jedi: that's right | 08:51 |
| Andrew_jedi | breton: but whats confusing me is this, if a single user can be a member of groups in different domains, and those groups are assigned roles in two different projects, then that would make them cross-domain projects, no? | 08:52 |
| *** jaosorior has joined #openstack-keystone | 08:57 | |
| *** prashkre has quit IRC | 08:57 | |
| *** pnavarro has joined #openstack-keystone | 09:00 | |
| *** prashkre has joined #openstack-keystone | 09:06 | |
| breton | Andrew_jedi: i think that a single user cannot be a member of groups in different domains | 09:08 |
| breton | Andrew_jedi: let me check what our unit tests say about this case | 09:09 |
| *** henrynash has joined #openstack-keystone | 09:09 | |
| breton | 1204 self._assert_user_and_group_in_same_backend( | 09:15 |
| breton | 1205 user_entity_id, user_driver, group_entity_id, group_driver) | 09:15 |
| Andrew_jedi | breton: I am sorry, it is not clear to me what does it mean ? | 09:17 |
| breton | Andrew_jedi: it's not clear for me either :) still checking | 09:17 |
| breton | well, it seems to be possible, ok. | 09:20 |
| Andrew_jedi | breton: great, i was also checking this post from ayoung , https://adam.younglogic.com/2016/11/keystone-domains-are-projects/ | 09:21 |
| *** aasthad has quit IRC | 09:22 | |
| Andrew_jedi | breton: It appears that we can also assign a role to a user at domain level so if i assign a role to a user in two different domains then this user will a have arole in all the projects in two domains. | 09:23 |
| breton | > then this user will a have arole in all the projects in two domains. | 09:25 |
| breton | not really | 09:25 |
| breton | Andrew_jedi: it depends on the policy used | 09:25 |
| breton | Andrew_jedi: it is possible to write a policy this way, but the one policy that goes with devstack doesn't support it | 09:26 |
| breton | Andrew_jedi: policy.v3cloudsample.json might support that, but i am not sure | 09:26 |
| Andrew_jedi | breton: Got it, I tried to look for an example keystone policy file over internet from a production deployment but the only example available is policy.v3cloudsample.json | 09:30 |
| *** henrynash has quit IRC | 09:32 | |
| *** Shunli has quit IRC | 09:35 | |
| *** tovin07 has quit IRC | 09:39 | |
| *** openstackgerrit has joined #openstack-keystone | 10:04 | |
| openstackgerrit | iswarya vakati proposed openstack/keystonemiddleware master: Pass located tests directory in oslo debug https://review.openstack.org/444795 | 10:04 |
| *** YanXing_an has left #openstack-keystone | 10:09 | |
| ayoung | breton, a single user *can* be a member of groups in different domains | 10:16 |
| ayoung | A user in one domain can belong to a group in a second domain, and by that group, get a role on a project in a third domain. | 10:18 |
| *** zhurong has quit IRC | 10:21 | |
| *** zhurong has joined #openstack-keystone | 10:22 | |
| *** nicolasbock has joined #openstack-keystone | 10:24 | |
| *** liujiong has quit IRC | 10:25 | |
| breton | ayoung: if user and group are in the same backend, yes. | 10:26 |
| ayoung | breton, Ah...yeah, that whole nastiness | 10:26 |
| ayoung | breton, talk to rich derose when he's back and find out about that. With the shadow user table should be able to be in any backend | 10:27 |
| ayoung | and with LDAP, I think it works if you use the id mapping backend, too. But in both cases you need a local entry for the user prior to assignment, which is a PITA | 10:28 |
| breton | ayoung: today there is an assertion in the code, i posted a code snippet above. So even if it's theoretically possible, it needs to be patched. | 10:29 |
| ayoung | JOy. Rapture. | 10:29 |
| ayoung | breton, right. That will mess up LDAP. | 10:30 |
| ayoung | breton, not sure how it affects Federated users | 10:30 |
| ayoung | breton, and this is why Keystone makes me sad. | 10:33 |
| breton | ayoung: how do you think we could fix this? :) | 10:34 |
| ayoung | breton, I think we can use the dhadow user stuff . Any user in there can be a member of a group anywhere. | 10:35 |
| ayoung | shadow | 10:35 |
| *** guoshan has quit IRC | 10:35 | |
| *** lifeless has quit IRC | 10:37 | |
| Andrew_jedi | ayoung: hello :). thanks for some very nice blog posts on keystone! | 10:38 |
| ayoung | Andrew_jedi, thanks for the positive feedback | 10:39 |
| Andrew_jedi | ayoung: fyi, my questions earlier were regarding this use case. We want to separate role assignments (and hence, permissions) per-tenant, we would like people whose user credentials live in separate Microsoft AD domains — which we want to map to Keystone domains — to collaborate on specific tenants. | 10:39 |
| Andrew_jedi | :) | 10:39 |
| ayoung | Yeah, try hacking out that check in the python code and see if it works if you enable the id_mapping for the AD users | 10:40 |
| *** nicolasbock has quit IRC | 10:41 | |
| *** markvoelker has joined #openstack-keystone | 10:41 | |
| breton | i think it won't work | 10:43 |
| *** zhugaoxiao has quit IRC | 10:43 | |
| breton | probably because user-group membership is done via Fk | 10:44 |
| *** prashkre_ has joined #openstack-keystone | 10:44 | |
| *** zhugaoxiao has joined #openstack-keystone | 10:44 | |
| Andrew_jedi | breton: Fk?? | 10:45 |
| *** lifeless has joined #openstack-keystone | 10:45 | |
| *** wangqun has quit IRC | 10:45 | |
| breton | Andrew_jedi: foreign key | 10:46 |
| Andrew_jedi | breton: ah, ok. thanks! | 10:46 |
| *** markvoelker has quit IRC | 10:46 | |
| *** prashkre has quit IRC | 10:47 | |
| *** namnh has quit IRC | 10:47 | |
| Andrew_jedi | ayoung: btw, Is it possible that two different users, being in two different groups, which belong to different domains, having roles in the same projects ? | 10:58 |
| ayoung | Andrew_jedi, yes | 10:58 |
| ayoung | Andrew_jedi, assuming they are all in the same backend, that is possible, and supported | 10:59 |
| openstackgerrit | iswarya vakati proposed openstack/keystonemiddleware master: Pass located tests directory in oslo debug https://review.openstack.org/444795 | 11:02 |
| Andrew_jedi | ayoung: got it, thanks! :) | 11:06 |
| *** evrardjp has joined #openstack-keystone | 11:08 | |
| *** nicolasbock has joined #openstack-keystone | 11:09 | |
| *** rodrigods has quit IRC | 11:18 | |
| *** rodrigods has joined #openstack-keystone | 11:18 | |
| Andrew_jedi | ayoung: Could you please also comment on the ability of defining (or re-defining) a role that can create projects in a domain, but not modify their quotas? earlier, breton was kind enough to suggest that this can be achieved by editing policy.json files across various OpenStack services | 11:21 |
| *** rodrigods has quit IRC | 11:23 | |
| *** rodrigods has joined #openstack-keystone | 11:23 | |
| ayoung | Andrew_jedi, Quotas for what? | 11:27 |
| breton | ]/win 27 | 11:27 |
| *** mvk has quit IRC | 11:27 | |
| breton | :( | 11:28 |
| breton | Andrew_jedi: there is no such role now. You need to create it and then modify policy.json | 11:29 |
| Andrew_jedi | breton: yep, i understood that part :) | 11:29 |
| Andrew_jedi | ayoung: Quotas for Nova, Cinder and neutron. | 11:30 |
| ayoung | Andrew_jedi, those quotas would be managed by calls to the APis in the respective projects | 11:30 |
| ayoung | policy.json for Keystone would manage who could create a project | 11:30 |
| Andrew_jedi | ayoung: Sorry ... can we define a role that gives a user the ability to create a project, but not to modify any of its quota settings? | 11:31 |
| ayoung | create a roll called "quotator" and modify the calls in Neutron et alles to check for that role | 11:31 |
| ayoung | Andrew_jedi, yep | 11:31 |
| *** henrynash has joined #openstack-keystone | 11:31 | |
| ayoung | Andrew_jedi, so long as the API calls in Neutron etc require a more stringent role (like admin) to make the quota calls | 11:32 |
| Andrew_jedi | ayoung: I am a bit confused here, just to be clear you are saying that i need to create a role and then modify the keystone policy.json accordingly. And no changes in Neutron or Nova policy.json files. | 11:33 |
| ayoung | Andrew_jedi, I really can make no statement about what you have to do on any policy file other than Keystone. | 11:34 |
| ayoung | You might have to change those files, or you might be fine. I've not looked at the API calls | 11:35 |
| ayoung | in the case of Keystone, the create_project call would require that the user making the call have a token with the appropriate role and scope | 11:35 |
| ayoung | and I am not certain what you should look at for scope, whether it needs to be domain scoped or if you can use a project scoped token. | 11:36 |
| ayoung | I don't have the time to dig into the code right now to answer that. | 11:36 |
| ayoung | And, you would have to confirm yourself anyway, because I lie. | 11:36 |
| Andrew_jedi | ayoung: understood, thanks for your time. I appreciate it :) | 11:36 |
| Andrew_jedi | lol | 11:36 |
| *** nicolasbock has quit IRC | 11:37 | |
| Andrew_jedi | ayoung: I just had a crazy idea, in the next summit, before the first day keynote is about to start, i can shout "Hey Adam, you lied to me" ... :) | 11:41 |
| Andrew_jedi | :P | 11:41 |
| ayoung | And I will respond "I told you I would" | 11:41 |
| *** nicolasbock has joined #openstack-keystone | 11:42 | |
| *** markvoelker has joined #openstack-keystone | 11:42 | |
| Andrew_jedi | ayoung: hahaha | 11:42 |
| *** markvoelker has quit IRC | 11:46 | |
| *** henrynash has quit IRC | 11:49 | |
| *** henrynash has joined #openstack-keystone | 11:49 | |
| *** erlon has joined #openstack-keystone | 11:51 | |
| *** henrynash has quit IRC | 11:54 | |
| sigmavirus | lbragstad: http://git.openstack.org/cgit/openstack/requirements/commit/global-requirements.txt?id=08b589c5ad0f0f49d8d5880f3a703cfae43b0a39 is why 2.13.0 is blocked iirc | 11:57 |
| *** henrynash has joined #openstack-keystone | 12:01 | |
| *** mvk has joined #openstack-keystone | 12:01 | |
| *** henrynash has quit IRC | 12:05 | |
| *** henrynash has joined #openstack-keystone | 12:13 | |
| *** henrynash has quit IRC | 12:14 | |
| *** markvoelker has joined #openstack-keystone | 12:16 | |
| *** henrynash has joined #openstack-keystone | 12:18 | |
| *** henrynash has quit IRC | 12:20 | |
| *** Andrew_jedi has quit IRC | 12:25 | |
| *** DuncanT has joined #openstack-keystone | 12:26 | |
| *** lamt has quit IRC | 12:28 | |
| breton | TIL about http://alembic.zzzcomputing.com/en/latest/naming.html#integration-of-naming-conventions-into-operations-autogenerate | 12:30 |
| *** edmondsw has joined #openstack-keystone | 12:31 | |
| *** guoshan has joined #openstack-keystone | 12:38 | |
| *** raildo has joined #openstack-keystone | 12:43 | |
| *** henrynash has joined #openstack-keystone | 12:43 | |
| *** henrynash has quit IRC | 12:46 | |
| *** henrynash has joined #openstack-keystone | 12:47 | |
| *** henrynash has quit IRC | 12:51 | |
| *** guoshan has quit IRC | 12:57 | |
| lbragstad | dstanek o/ | 13:01 |
| lbragstad | dstanek did you happen to see the note from dims about the keystone reviews? http://lists.openstack.org/pipermail/openstack-dev/2017-March/113813.html | 13:01 |
| *** spilla has joined #openstack-keystone | 13:01 | |
| *** zhurong has quit IRC | 13:01 | |
| *** guoshan has joined #openstack-keystone | 13:03 | |
| *** nicolasbock has quit IRC | 13:05 | |
| *** nicolasbock has joined #openstack-keystone | 13:09 | |
| *** lamt has joined #openstack-keystone | 13:09 | |
| *** Kvisle has joined #openstack-keystone | 13:13 | |
| *** Kvisle has left #openstack-keystone | 13:14 | |
| *** dakhmetov has joined #openstack-keystone | 13:20 | |
| dakhmetov | greetings, guys! | 13:20 |
| dakhmetov | Could you please clarify, was (or will be) hierarchical projects implemented in keystone? | 13:21 |
| lbragstad | dakhmetov keystone already has support for nesting projects | 13:22 |
| lbragstad | dakhmetov but there are on-going efforts to get other things working with that structure (like quotas) | 13:22 |
| dakhmetov | lbragstad: awesome! In which OpenStack release it was presented? | 13:23 |
| *** bknudson_ has joined #openstack-keystone | 13:27 | |
| lbragstad | dakhmetov hmm - it was supported a while ago (I remember talking about the implementation approach during the Atlanta design summit in 2014) | 13:30 |
| dims | dakhmetov : what exactly are you looking for? (support in horizon? CLI? what do you want to use it for) | 13:30 |
| dakhmetov | lbragstad: but Nova quota management for nested projects is not yet possible, right? | 13:30 |
| lbragstad | according to our specs repository - the server implementation landed in Juno http://specs.openstack.org/openstack/keystone-specs/specs/keystone/juno/hierarchical_multitenancy.html | 13:31 |
| raildo | dakhmetov, no, it's not, for now, we only have support no cinder | 13:31 |
| lbragstad | dakhmetov right - we are working with other projects to get that support worked into other projects consistently | 13:31 |
| raildo | on cinder* | 13:31 |
| dakhmetov | I wondering if it's possible to manage quota for subproject. | 13:31 |
| dakhmetov | Got it. Thank you, guys! | 13:31 |
| lbragstad | dakhmetov we do have a couple specs proposed to keystone that contain a bunch of good information from the PTG though | 13:32 |
| lbragstad | dakhmetov https://review.openstack.org/#/q/topic:unified-limits | 13:32 |
| lbragstad | here's a relatively straight forward keystonemiddleware review that closes a bug if anyone is interested - https://review.openstack.org/#/c/444795/2 | 13:34 |
| *** frontrunner has joined #openstack-keystone | 13:37 | |
| *** richm has joined #openstack-keystone | 13:42 | |
| *** henrynash has joined #openstack-keystone | 13:46 | |
| *** lucasxu has joined #openstack-keystone | 14:00 | |
| *** dnalezyty has joined #openstack-keystone | 14:02 | |
| *** chlong has joined #openstack-keystone | 14:11 | |
| rodrigods | lbragstad, ping... are you stable releases liaison too? :) | 14:15 |
| lbragstad | rodrigods i am | 14:16 |
| *** links has quit IRC | 14:16 | |
| rodrigods | lbragstad, i have a newton backport for a bug fixed in ocata https://review.openstack.org/#/c/420893/ | 14:16 |
| lbragstad | rodrigods or i assume i am based on some wiki somewhere? | 14:16 |
| rodrigods | you have +1 there, was wondering if we can move this forward | 14:17 |
| *** guoshan has quit IRC | 14:17 | |
| lbragstad | rodrigods cool - i'm working on another set of reviews but once i finish those I'm going to look over some stable patches, I'll add this to that list | 14:20 |
| rodrigods | thanks lbragstad | 14:21 |
| *** kbaegis has quit IRC | 14:26 | |
| knikolla | o/ | 14:31 |
| *** dtroyer_zz has quit IRC | 14:33 | |
| *** dtroyer has joined #openstack-keystone | 14:33 | |
| *** kbaegis has joined #openstack-keystone | 14:35 | |
| *** dave-mccowan has joined #openstack-keystone | 14:35 | |
| *** kbaegis has quit IRC | 14:37 | |
| *** frontrunner has quit IRC | 14:41 | |
| *** rderose has joined #openstack-keystone | 14:41 | |
| *** chris_hultin|AWA is now known as chris_hultin | 14:46 | |
| *** dakhmetov has quit IRC | 14:51 | |
| *** henrynash has quit IRC | 14:58 | |
| *** henrynash has joined #openstack-keystone | 14:59 | |
| *** adrian_otto has joined #openstack-keystone | 15:06 | |
| *** h5t4_ has quit IRC | 15:15 | |
| *** ravelar has joined #openstack-keystone | 15:16 | |
| *** prashkre_ has quit IRC | 15:23 | |
| openstackgerrit | Jose Castro Leon proposed openstack/keystone master: Skip multifactor when using LDAP identity backend https://review.openstack.org/444949 | 15:30 |
| *** ravelar has quit IRC | 15:32 | |
| *** jaugustine has joined #openstack-keystone | 15:34 | |
| *** ravelar has joined #openstack-keystone | 15:36 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add reno conventions to developer documentation https://review.openstack.org/444955 | 15:41 |
| *** knangia has joined #openstack-keystone | 15:42 | |
| *** aasthad has joined #openstack-keystone | 15:44 | |
| *** ravelar has quit IRC | 15:45 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add reno conventions to developer documentation https://review.openstack.org/444955 | 15:53 |
| lbragstad | rodrigods the fix for https://review.openstack.org/#/c/420893/ landed in ocata, right? | 15:54 |
| lbragstad | rodrigods or was it merged to master before ocata was released? | 15:54 |
| notmorgan | lbragstad: that patch is broken | 15:59 |
| notmorgan | lbragstad: it is doing the wrong thing | 15:59 |
| lbragstad | notmorgan https://review.openstack.org/#/c/420893/ you mean? | 15:59 |
| notmorgan | yep | 16:00 |
| notmorgan | you CANT have a FK between subsystems | 16:00 |
| notmorgan | ever | 16:00 |
| notmorgan | EVER | 16:00 |
| lbragstad | ohhhh | 16:00 |
| notmorgan | federated_table (FederatedUser is in Identity) | 16:00 |
| lbragstad | right | 16:00 |
| notmorgan | the protocol one is in federation | 16:00 |
| notmorgan | so, we need to just drop the FK | 16:00 |
| lbragstad | well - we must have merged that to master than | 16:00 |
| lbragstad | then* | 16:00 |
| notmorgan | welp, we need to undo that now | 16:01 |
| notmorgan | with another migration | 16:01 |
| notmorgan | and the backport has to be to drop the FK | 16:01 |
| lbragstad | well - the backport never merged | 16:01 |
| notmorgan | right | 16:01 |
| notmorgan | the backport needs to be dropping the original FK | 16:01 |
| notmorgan | and code to maintain the interdependency | 16:01 |
| notmorgan | there is already an FK . | 16:01 |
| notmorgan | this is ugly to backport fwiw | 16:02 |
| notmorgan | because we have to "fix" a merged migration too. | 16:02 |
| notmorgan | to be idempotent | 16:02 |
| notmorgan | we need to create a sql validator test that identifies what subsystems things are part of and ensure we don't FK between them | 16:02 |
| notmorgan | but anyway | 16:05 |
| notmorgan | ... | 16:05 |
| notmorgan | uhm... | 16:05 |
| notmorgan | yeah | 16:05 |
| *** h5t4 has joined #openstack-keystone | 16:05 | |
| lbragstad | hmm | 16:06 |
| lbragstad | rodrigods is this making sense? | 16:06 |
| *** belmoreira has quit IRC | 16:06 | |
| notmorgan | so, the fix is as follows: | 16:07 |
| notmorgan | merge a new migration to master than drops the FK and adds code, and fixes the previous migration to be idempoent if the FK is already removed. | 16:08 |
| notmorgan | backport the code (maintaining the relationship in managers) and dropping the original FK. | 16:08 |
| lbragstad | notmorgan question on requirements | 16:09 |
| lbragstad | OPB has this proposed to stable/ocata - https://review.openstack.org/#/c/443881/ | 16:09 |
| lbragstad | and typically when pbr changes versions - there is a change to setup.py to change the version there, too | 16:10 |
| lbragstad | but that doesn't seem to be happening with stable requirements | 16:10 |
| * lbragstad https://github.com/openstack/python-keystoneclient/blob/stable/ocata/setup.py#L28 | 16:10 | |
| *** kbaegis has joined #openstack-keystone | 16:12 | |
| rodrigods | notmorgan, lbragstad arriving late to the discussion | 16:14 |
| rodrigods | notmorgan, got your point, i wish you had participated in the initial discussion | 16:15 |
| notmorgan | rodrigods: sorry | 16:15 |
| notmorgan | i can only keep track of so many things at once | 16:15 |
| rodrigods | notmorgan, heh | 16:15 |
| *** david-lyle has joined #openstack-keystone | 16:15 | |
| rodrigods | notmorgan, lbragstad, so the correct fix is to drop the FK and delete the user in the code layer? | 16:16 |
| notmorgan | lbragstad: no idea about requirements, i saw a stable/ocata change that set <=2.0.0 that already merged afair | 16:16 |
| notmorgan | lbragstad: i might have approved it | 16:16 |
| notmorgan | rodrigods: correct. (manager layer, as managers are inter-subsystem communication tools) | 16:16 |
| notmorgan | rodrigods: but you have ick to unwind now. | 16:16 |
| notmorgan | sorry man | 16:16 |
| lbragstad | notmorgan ok - i'll head over to openstack-requirements and ask | 16:16 |
| rodrigods | no, i'm sorry | 16:17 |
| rodrigods | i should have known about this :) | 16:17 |
| *** nicolasbock has quit IRC | 16:21 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone-specs master: Add Project tags https://review.openstack.org/431785 | 16:21 |
| *** nicolasbock has joined #openstack-keystone | 16:25 | |
| *** henrynash has quit IRC | 16:26 | |
| *** pcaruana has quit IRC | 16:38 | |
| *** mvk has quit IRC | 16:45 | |
| openstackgerrit | Merged openstack/keystonemiddleware master: Pass located tests directory in oslo debug https://review.openstack.org/444795 | 16:47 |
| *** kbaegis has quit IRC | 16:49 | |
| *** dr_gogeta86 has joined #openstack-keystone | 16:59 | |
| *** kbaegis has joined #openstack-keystone | 17:00 | |
| dr_gogeta86 | hi guys | 17:01 |
| dr_gogeta86 | i'm looking for some saml specialist | 17:02 |
| *** kbaegis has quit IRC | 17:03 | |
| *** lucasxu has quit IRC | 17:03 | |
| openstackgerrit | Anthony Washington proposed openstack/oslo.policy master: Add additional param to policy.RuleDefault https://review.openstack.org/439070 | 17:04 |
| *** prashkre_ has joined #openstack-keystone | 17:05 | |
| *** chlong has quit IRC | 17:07 | |
| *** kbaegis has joined #openstack-keystone | 17:10 | |
| *** prashkre_ has quit IRC | 17:12 | |
| *** prashkre_ has joined #openstack-keystone | 17:12 | |
| openstackgerrit | Anthony Washington proposed openstack/oslo.policy master: Add additional param to policy.RuleDefault https://review.openstack.org/439070 | 17:14 |
| *** ayoung has quit IRC | 17:16 | |
| *** ayoung has joined #openstack-keystone | 17:17 | |
| *** openstackgerrit has quit IRC | 17:18 | |
| *** catintheroof has joined #openstack-keystone | 17:25 | |
| *** lucasxu has joined #openstack-keystone | 17:30 | |
| *** browne has joined #openstack-keystone | 17:35 | |
| -openstackstatus- NOTICE: restarting gerrit to address performance problems | 17:44 | |
| *** gutter has joined #openstack-keystone | 17:47 | |
| *** gutter has quit IRC | 17:47 | |
| *** jamielennox is now known as jamielennox|away | 17:53 | |
| *** nicolasbock has quit IRC | 17:54 | |
| *** aojea_ has quit IRC | 17:56 | |
| *** jaosorior has quit IRC | 17:56 | |
| *** adrian_otto has quit IRC | 17:57 | |
| *** nicolasbock has joined #openstack-keystone | 17:57 | |
| *** rderose has quit IRC | 17:57 | |
| *** ynirk has joined #openstack-keystone | 17:59 | |
| *** tesseract has quit IRC | 17:59 | |
| *** adrian_otto has joined #openstack-keystone | 18:01 | |
| *** openstackgerrit has joined #openstack-keystone | 18:04 | |
| openstackgerrit | Anusha Unnam proposed openstack/oslo.policy master: Seperate each policy rule with new line https://review.openstack.org/443332 | 18:04 |
| *** thorst_afk has joined #openstack-keystone | 18:04 | |
| *** thorst_afk has quit IRC | 18:04 | |
| *** MasterOfBugs has joined #openstack-keystone | 18:16 | |
| *** adrian_otto has quit IRC | 18:17 | |
| *** adrian_otto has joined #openstack-keystone | 18:19 | |
| openstackgerrit | Anusha Unnam proposed openstack/oslo.policy master: Seperate each policy rule with new line https://review.openstack.org/443332 | 18:19 |
| *** aojea has joined #openstack-keystone | 18:23 | |
| *** nicolasbock has quit IRC | 18:33 | |
| *** mvk has joined #openstack-keystone | 18:33 | |
| *** raildo has quit IRC | 18:39 | |
| *** nicolasbock has joined #openstack-keystone | 18:41 | |
| breton | dr_gogeta86: we all are saml specialists here. Ask away! | 18:48 |
| *** aojea has quit IRC | 18:53 | |
| *** kbaegis has quit IRC | 18:55 | |
| *** agrebennikov has joined #openstack-keystone | 18:58 | |
| *** zhugaoxiao has quit IRC | 19:04 | |
| *** zhugaoxiao has joined #openstack-keystone | 19:05 | |
| rodrigods | breton, i'm not heh | 19:08 |
| lbragstad | dr_gogeta86 dstanek is probably one of the most knowledgeable folks around about saml | 19:10 |
| lbragstad | dr_gogeta86 i do know that he is going to be out until wednesday though - put please don't hesitate to ask anyway | 19:10 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient master: Updated from global requirements https://review.openstack.org/439355 | 19:41 |
| *** h5t4 has quit IRC | 20:02 | |
| *** chlong has joined #openstack-keystone | 20:04 | |
| openstackgerrit | Anthony Washington proposed openstack/oslo.policy master: Add additional param to policy.RuleDefault https://review.openstack.org/439070 | 20:05 |
| openstackgerrit | Anthony Washington proposed openstack/oslo.policy master: Add additional param to policy.RuleDefault https://review.openstack.org/439070 | 20:07 |
| lbragstad | antwash nice work - that passes for me locally | 20:07 |
| antwash | lbragstad: thank you, I like the python properties its really cool | 20:08 |
| *** raildo has joined #openstack-keystone | 20:09 | |
| *** aojea has joined #openstack-keystone | 20:09 | |
| lbragstad | antwash yeah - makes things a little cleaner | 20:09 |
| antwash | lbragstad: def made the unittest shorter as well since checks are being taken care of at init level | 20:09 |
| *** h5t4_ has joined #openstack-keystone | 20:09 | |
| lbragstad | antwash we could add a few more negative test cases, too | 20:10 |
| *** henrynash has joined #openstack-keystone | 20:11 | |
| antwash | lbragstad: yeah, I can add some | 20:17 |
| lbragstad | antwash another thing we could do is make the exceptions more specific | 20:18 |
| lbragstad | since we know exactly what is missing in specific cases - we could pass more of that information along to the developer | 20:18 |
| lbragstad | antwash here are a few tests I have locally - http://cdn.pasteraw.com/am1zwqs3t3g8pw6a5v00uuom7o5jqer | 20:19 |
| antwash | lbragstad: I was trying to figure how I was going to compare like the raised errors, but now I see how it's suppose to be handled | 20:22 |
| antwash | thanks for that, no more time wasted lol | 20:22 |
| lbragstad | antwash yep - and we could be more specific about those too if we end up adding different exceptions for those cases | 20:23 |
| lbragstad | I wouldn't expect an end user or deployer to ever see those, since they'd be primarily to catch developer mistakes | 20:23 |
| lbragstad | antwash yeah - we should totally make those more explicit | 20:26 |
| lbragstad | antwash i just spent 10 minutes trying to figure out why test_operations_only_contain_a_method_and_a_path passed for the wrong reason ;) http://cdn.pasteraw.com/by3ff7xl44opkkzxtqqir2h5d8bxpc | 20:26 |
| lbragstad | antwash can you spot it? | 20:26 |
| *** adrian_otto has quit IRC | 20:27 | |
| * antwash let me see | 20:30 | |
| antwash | lol we don't have the check for more than two keys? | 20:31 |
| antwash | I'll have to add that back, I removed it lol | 20:32 |
| antwash | lbragstad: ^ | 20:32 |
| lbragstad | antwash nope ;) | 20:33 |
| lbragstad | antwash the way the test is written it should have failed *because* there was an extra key | 20:33 |
| lbragstad | antwash instead it that test gets a valid object back instead of an exception http://cdn.pasteraw.com/1zcr7olmz4o53nlrklpy8zjxx6ot5hk | 20:33 |
| *** raildo has quit IRC | 20:34 | |
| lbragstad | i was expecting it to fail but it passed because I wasn't passing it in as a list | 20:34 |
| lbragstad | I copy/pasted the previous tests that asserted operations must be a list | 20:35 |
| lbragstad | so it was fast failing | 20:35 |
| antwash | lbragstad: aweeee, I see! | 20:35 |
| * lbragstad facepalms | 20:35 | |
| *** jamielennox|away is now known as jamielennox | 20:37 | |
| *** aojea has quit IRC | 20:39 | |
| *** adriant has joined #openstack-keystone | 20:51 | |
| *** catinthe_ has joined #openstack-keystone | 20:56 | |
| *** catintheroof has quit IRC | 20:58 | |
| *** edmondsw has quit IRC | 20:58 | |
| *** aojea has joined #openstack-keystone | 20:59 | |
| *** bww has joined #openstack-keystone | 20:59 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone-specs master: Add Project tags https://review.openstack.org/431785 | 21:02 |
| *** pnavarro has quit IRC | 21:04 | |
| *** rderose has joined #openstack-keystone | 21:13 | |
| *** spilla has quit IRC | 21:14 | |
| *** henrynash has quit IRC | 21:16 | |
| *** catintheroof has joined #openstack-keystone | 21:31 | |
| *** chlong has quit IRC | 21:34 | |
| *** catinthe_ has quit IRC | 21:35 | |
| *** henrynash has joined #openstack-keystone | 21:38 | |
| * lbragstad rderose for the api key spec - https://review.openstack.org/#/c/438761/12 | 21:42 | |
| lbragstad | rderose wasn't there some discussion about whether or not we should all api-key scoped tokens? | 21:43 |
| lbragstad | i thought there was still some discussion on whether or not we should treat the API key as the authenticated bit of information or if we should treat it as the authentication mechanism | 21:44 |
| rderose | there was discussion about treating api-keys as a credential vs token | 21:45 |
| *** henrynash has quit IRC | 21:45 | |
| lbragstad | because with traditional API keys, it acts as a credential, right? | 21:45 |
| lbragstad | I should be able to pass it to something and it should work like a token - but the way we are using it is like a scoping mechanism | 21:46 |
| rderose | lbragstad: well, I think dstanek would argue that traditionally it acts as a token | 21:46 |
| rderose | lbragstad: yeah, I'm treating it more like a credential, where you would use it to auth and then request a scoped token | 21:46 |
| lbragstad | rderose what was the usecase for having it operate like a credential? | 21:47 |
| lbragstad | versus a token? | 21:47 |
| *** chlong has joined #openstack-keystone | 21:47 | |
| rderose | lbragstad: use case is the same either way, I want to be able to create access keys for my tools with limited scope, so that I'm not putting my username/password into config files | 21:48 |
| lbragstad | sure - i should rephrase my question, what the reason for not having the same flow like traditional API keys? | 21:49 |
| rderose | lbragstad: I think from an implementation perspective, it would be easier | 21:50 |
| lbragstad | rderose how so? | 21:50 |
| lbragstad | rderose i just want to walk through it is all | 21:50 |
| rderose | lbragstad: agree, lets do that | 21:51 |
| rderose | I think just the fact of trying to create another token type would make it more complicated. Whereas, if I treat the key as a credential type, I simply have to create a new auth plugin. | 21:52 |
| lbragstad | rderose that makes sense | 21:52 |
| rderose | The CRUD should be the same either way | 21:53 |
| lbragstad | so it would be an application specific password that would live forever | 21:53 |
| rderose | yeah, or until it expires or the client deletes it | 21:53 |
| lbragstad | right | 21:53 |
| lbragstad | so the client still has to have logic that understand the limitation of tokens | 21:54 |
| rderose | lbragstad: the client would have to know how request a new token if it expires | 21:54 |
| lbragstad | (i.e. do something, if it fails try and get a new token scoped with this thing, try again) | 21:55 |
| rderose | yeah | 21:55 |
| rderose | lbragstad: and we could always change it later to act more like a token, without having to change the CRUD API | 21:55 |
| rderose | potentially | 21:56 |
| lbragstad | yeah - i think that'd be hard to do either way we go about it | 21:56 |
| lbragstad | because it a new api | 21:56 |
| lbragstad | they both solve the same problem - which is keeping passwords out of application config files | 21:57 |
| rderose | yeah | 21:57 |
| rderose | exactly | 21:57 |
| *** prashkre_ has quit IRC | 21:57 | |
| lbragstad | if we treat this like a credential, then I think we should consider alternative names | 21:58 |
| rderose | yeah, was thinking about that | 21:58 |
| lbragstad | since it's not API keys in the way users expect them to be API keys | 21:58 |
| rderose | it shouldn't be called API keys, but more like 'access key credential' | 21:58 |
| antwash | lbragstad: when you say make more explicit, are you referring to the exception? | 21:59 |
| lbragstad | if we decide to implement a new token type and maintain the same user experience users are familiar with, then i'm all for keeping it an API key | 21:59 |
| antwash | I added a diff message, when it's raised for each case | 21:59 |
| openstackgerrit | Anthony Washington proposed openstack/oslo.policy master: Add additional param to policy.RuleDefault https://review.openstack.org/439070 | 21:59 |
| lbragstad | antwash yeah - just another thing we could do to make things easier for developers using it | 22:00 |
| lbragstad | antwash in the validation process we know *why* what they gave us failed to compute, so we can give them the exact reason | 22:00 |
| rderose | lbragstad: well, I want a name that will do both, so that it gives us flexibility should we make access keys act more like a token | 22:00 |
| antwash | lbragstad: yeah I added a diff message for each, oslo_policy/policy.py | 22:00 |
| antwash | *in | 22:00 |
| rderose | lbragstad: sort of why I named it API access keys | 22:00 |
| rderose | and not API keys | 22:01 |
| rderose | *act more like tokens later | 22:01 |
| lbragstad | rderose i'm not sure we'll be able to make application specific passwords act like API keys in the future if we ever want to merge the two | 22:01 |
| lbragstad | will we? | 22:01 |
| rderose | lbragstad: why not? if you create an access key, the value it just a long string | 22:02 |
| rderose | could be token | 22:02 |
| lbragstad | rderose right - but its a difference in how they are used | 22:02 |
| rderose | lbragstad: yeah, my point is the CRUD api would still be the same | 22:02 |
| lbragstad | oh - right | 22:02 |
| *** jamielennox is now known as jamielennox|away | 22:03 | |
| lbragstad | yeah, that makes sense | 22:03 |
| lbragstad | i was thinking about trying to make the usage the same | 22:03 |
| lbragstad | i think that'd be tough because in one case you're treating it like a password that you use to authenticate for a token and in the other case you're treating it like the token | 22:04 |
| openstackgerrit | Gage Hugo proposed openstack/keystone-specs master: Add Project tags https://review.openstack.org/431785 | 22:04 |
| rderose | lbragstad: right, so if we change this later, we'd essentially be passing a token string as the access key value | 22:04 |
| rderose | and then update the access key auth plugin and middleware | 22:05 |
| rderose | to be able to deal with it | 22:05 |
| lbragstad | yeah | 22:05 |
| rderose | lbragstad: so we could allow the access key value to be used to auth and as a token | 22:06 |
| lbragstad | so - would it be confusing to have a service that implemented both and were super similar? | 22:06 |
| rderose | lbragstad: but the API shouldn't be impacted | 22:06 |
| *** jamielennox|away is now known as jamielennox | 22:07 | |
| rderose | lbragstad: well, I'm more in favor of trust treating access keys as credential (password) because I think it's easier and completely solves the use case | 22:07 |
| lbragstad | trust treating access keys as credentials? | 22:08 |
| rderose | lbragstad: implemented both (access key credential and token)? | 22:08 |
| lbragstad | rderose right - having access key credentials and treating them like api keys | 22:08 |
| rderose | *just treating access keys as credential | 22:09 |
| lbragstad | ah | 22:09 |
| lbragstad | well - it would be flexible | 22:09 |
| lbragstad | because the flow would be something like: | 22:09 |
| rderose | lbragstad: I don't think it would be confusing, we already do this with tokens | 22:09 |
| lbragstad | 1.) create an API key (which is the CRUD API) | 22:09 |
| rderose | tokens are using to auth for another token | 22:09 |
| lbragstad | 2.) you can request a token scoped to your api key | 22:10 |
| lbragstad | 3.) or you can use the API key like you would normally us it | 22:10 |
| lbragstad | use it* | 22:10 |
| rderose | yes, and #2 we already do today with tokens | 22:10 |
| lbragstad | which might provide a better way for people to migrate their applications from using username/password authentication to API keys | 22:10 |
| rderose | yeah | 22:11 |
| lbragstad | right - i would imagine #3 is where people would want to be because they don't head to deal with the "is this token still valid problem" | 22:11 |
| lbragstad | "is this token still valid" problem * | 22:11 |
| lbragstad | in all their client/application code | 22:11 |
| rderose | yeah, true | 22:11 |
| rderose | lbragstad: however, that wasn't the main use case for access keys | 22:13 |
| *** catintheroof has quit IRC | 22:13 | |
| rderose | and treating them as credential first doesn't stop us from getting there | 22:14 |
| lbragstad | agree - but i don't want to call them API keys unless we commit to doing #3 | 22:14 |
| *** catintheroof has joined #openstack-keystone | 22:14 | |
| *** catintheroof has quit IRC | 22:14 | |
| lbragstad | only so that we don't confuse people | 22:15 |
| *** catintheroof has joined #openstack-keystone | 22:15 | |
| jamielennox | o/ | 22:15 |
| lbragstad | jamielennox o/ | 22:16 |
| lbragstad | rderose but yeah - that totally makes more sense | 22:16 |
| jamielennox | sorry, i haven't looked over the spec yet | 22:16 |
| lbragstad | rderose I'll reparse the spec now that I have this understand | 22:16 |
| lbragstad | understanding* | 22:16 |
| rderose | jamielennox: what are your thoughts on treating api keys as credentials vs tokens | 22:16 |
| jamielennox | rderose: they are definitely not tokens | 22:16 |
| rderose | jamielennox: https://review.openstack.org/#/c/438761/ | 22:16 |
| jamielennox | they should be creentials | 22:16 |
| jamielennox | the same fetch scoped token workflow should apply | 22:17 |
| rderose | yeah, that's my thought | 22:17 |
| lbragstad | jamielennox so you wouldn't want the traditional API workflow at all? | 22:17 |
| lbragstad | traditional API key workflow* | 22:17 |
| jamielennox | lbragstad: what's the traditional API workflow? | 22:17 |
| jamielennox | oh | 22:17 |
| rderose | jamielennox: All calls made using that service object will include your API key | 22:17 |
| lbragstad | it's a token that I can use to authenticate - versus an application specific password that I have to use to authenticate to get a token | 22:18 |
| jamielennox | would a api key as credential not be typical? | 22:18 |
| jamielennox | i mean you can't compare this to aws because it does everything via long lived cred ids | 22:18 |
| lbragstad | jamielennox that seems to be the million dollar question | 22:18 |
| rderose | jamielennox: agree | 22:18 |
| lbragstad | jamielennox well - api keys are not an AWS only thing | 22:18 |
| openstackgerrit | Merged openstack/pycadf master: Updated from global requirements https://review.openstack.org/445135 | 22:18 |
| lbragstad | jamielennox you can get API keys for other services | 22:19 |
| jamielennox | lbragstad: but for at least the "application specific password" concept, google for one definitiely does it as a password | 22:19 |
| jamielennox | so we've always had a bearer token problem, i think that gets larger if all of a sudden your "token" lives forever | 22:19 |
| jamielennox | (still having only glanced at the spec) | 22:19 |
| rderose | jamielennox lbragstad: https://developers.google.com/api-client-library/python/guide/aaa_apikeys | 22:20 |
| lbragstad | yeah - that is true | 22:20 |
| lbragstad | rderose that seems like a token flow | 22:21 |
| lbragstad | not a credential flow | 22:21 |
| rderose | yeah, it does | 22:21 |
| rderose | with google, the key is used to make api calls | 22:22 |
| lbragstad | yeah - so they don't do the step that would be similar to us getting a token and using that to make the API call | 22:22 |
| jamielennox | interesting, so i was thinking more of the application specific password that you use for things like IMAP access where you can't 2FA | 22:22 |
| rderose | lbragstad: google is authenticating the api_key, so still is credential | 22:25 |
| rderose | it's just your not having to go get a bearer token | 22:25 |
| lbragstad | rderose right to isn't it the same thing as a token? | 22:26 |
| lbragstad | that lives forever? | 22:26 |
| *** chlong has quit IRC | 22:26 | |
| lbragstad | so* | 22:26 |
| rderose | lbragstad: I think so, but looking | 22:27 |
| jamielennox | rderose: some comments | 22:27 |
| lbragstad | rderose i'll parse this tonight yet | 22:28 |
| jamielennox | but yea, that's more or less what i imagined, access_key -> token, not something you can use directly | 22:28 |
| lbragstad | jamielennox good to know | 22:28 |
| *** nkinder has quit IRC | 22:28 | |
| lbragstad | jamielennox they both solve the problem that we have, so i think i'm fine with either, | 22:28 |
| lbragstad | jamielennox i just don't want to call it an API key if that's not what it is | 22:28 |
| jamielennox | lbragstad: worth bringing up at a meeting, but i would vote for keeping the token flow we have including timeouts | 22:29 |
| lbragstad | jamielennox rderose makes sense | 22:29 |
| jamielennox | lbragstad: yea, can name them whatever we like | 22:29 |
| lbragstad | jamielennox rderose do you mind if I put both of you down for that topic? | 22:30 |
| rderose | lbragstad: sure | 22:30 |
| jamielennox | lbragstad: sure | 22:30 |
| *** aojea has quit IRC | 22:30 | |
| * jamielennox sets that alarm | 22:30 | |
| *** aojea has joined #openstack-keystone | 22:31 | |
| lbragstad | jamielennox rderose thanks | 22:32 |
| rderose | lbragstad: cool, thank you | 22:32 |
| lbragstad | rderose no problem - thanks for walking me through it | 22:32 |
| lbragstad | :) | 22:32 |
| * lbragstad runs to get some things done | 22:33 | |
| *** aojea has quit IRC | 22:35 | |
| *** dave-mccowan has quit IRC | 22:36 | |
| *** catintheroof has quit IRC | 22:40 | |
| *** nkinder has joined #openstack-keystone | 22:42 | |
| *** chris_hultin is now known as chris_hultin|AWA | 22:50 | |
| *** henrynash has joined #openstack-keystone | 22:52 | |
| *** henrynash has quit IRC | 23:03 | |
| *** lamt has quit IRC | 23:15 | |
| *** lucasxu has quit IRC | 23:19 | |
| openstackgerrit | Merged openstack/keystone master: Updated from global requirements https://review.openstack.org/445085 | 23:20 |
| *** jaugustine has quit IRC | 23:22 | |
| *** erlon has quit IRC | 23:25 | |
| *** henrynash has joined #openstack-keystone | 23:52 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Fix description for 204 response https://review.openstack.org/445245 | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!