| *** edmondsw has joined #openstack-keystone | 00:21 | |
| *** edmondsw has quit IRC | 00:25 | |
| *** ducttape_ has joined #openstack-keystone | 00:29 | |
| *** ducttap__ has joined #openstack-keystone | 00:30 | |
| *** ducttape_ has quit IRC | 00:30 | |
| *** ducttap__ has quit IRC | 00:34 | |
| *** harlowja has quit IRC | 00:38 | |
| *** zhurong has joined #openstack-keystone | 00:43 | |
| *** thorst_afk has joined #openstack-keystone | 00:46 | |
| *** Shunli has joined #openstack-keystone | 00:51 | |
| *** thorst_afk has quit IRC | 00:54 | |
| *** ducttape_ has joined #openstack-keystone | 00:58 | |
| *** ducttape_ has quit IRC | 01:03 | |
| *** ducttape_ has joined #openstack-keystone | 01:08 | |
| *** ducttape_ has quit IRC | 01:10 | |
| *** otleimat has quit IRC | 01:17 | |
| *** aojea has joined #openstack-keystone | 01:22 | |
| *** aojea has quit IRC | 01:26 | |
| *** ducttape_ has joined #openstack-keystone | 01:27 | |
| *** mjax has quit IRC | 01:28 | |
| *** thorst_afk has joined #openstack-keystone | 01:29 | |
| *** ducttape_ has quit IRC | 01:32 | |
| *** mjax has joined #openstack-keystone | 01:34 | |
| *** phalmos has quit IRC | 01:34 | |
| *** mjax has quit IRC | 01:36 | |
| *** thorst_afk has quit IRC | 01:38 | |
| *** thorst_afk has joined #openstack-keystone | 01:38 | |
| *** thorst_afk has quit IRC | 01:43 | |
| *** https_GK1wmSU has joined #openstack-keystone | 01:46 | |
| *** https_GK1wmSU has left #openstack-keystone | 01:47 | |
| *** mjax has joined #openstack-keystone | 01:52 | |
| *** mjax has quit IRC | 01:54 | |
| *** thorst_afk has joined #openstack-keystone | 01:55 | |
| *** thorst_afk has quit IRC | 01:55 | |
| *** rmascena has quit IRC | 01:58 | |
| *** aojea has joined #openstack-keystone | 02:07 | |
| *** thorst_afk has joined #openstack-keystone | 02:11 | |
| *** aojea has quit IRC | 02:12 | |
| *** phalmos has joined #openstack-keystone | 02:17 | |
| *** harlowja has joined #openstack-keystone | 02:22 | |
| *** ducttape_ has joined #openstack-keystone | 02:23 | |
| *** thorst_afk has quit IRC | 02:25 | |
| *** ducttape_ has quit IRC | 02:28 | |
| *** harlowja has quit IRC | 02:44 | |
| *** mjax has joined #openstack-keystone | 03:07 | |
| *** mjax has quit IRC | 03:09 | |
| *** lbragstad_ has joined #openstack-keystone | 03:14 | |
| *** lbragstad has quit IRC | 03:14 | |
| *** prashkre has joined #openstack-keystone | 03:38 | |
| *** harlowja has joined #openstack-keystone | 03:38 | |
| *** phalmos has quit IRC | 03:44 | |
| *** nicolasbock has joined #openstack-keystone | 03:45 | |
| *** ducttape_ has joined #openstack-keystone | 03:47 | |
| *** dave-mcc_ has quit IRC | 03:48 | |
| *** prashkre has quit IRC | 03:50 | |
| *** ducttape_ has quit IRC | 03:51 | |
| *** kbaegis has quit IRC | 03:59 | |
| *** phalmos has joined #openstack-keystone | 04:01 | |
| *** links has joined #openstack-keystone | 04:07 | |
| *** aselius has quit IRC | 04:18 | |
| *** thorst_afk has joined #openstack-keystone | 04:26 | |
| *** thorst_afk has quit IRC | 04:31 | |
| *** ducttape_ has joined #openstack-keystone | 04:48 | |
| *** ducttape_ has quit IRC | 04:53 | |
| *** harlowja has quit IRC | 05:10 | |
| *** ducttap__ has joined #openstack-keystone | 05:19 | |
| *** https___GK1wmSU has joined #openstack-keystone | 05:21 | |
| *** https__GK1wmSU has joined #openstack-keystone | 05:21 | |
| *** https___GK1wmSU has left #openstack-keystone | 05:23 | |
| *** https__GK1wmSU has left #openstack-keystone | 05:23 | |
| *** ducttap__ has quit IRC | 05:25 | |
| *** hoonetorg has quit IRC | 05:27 | |
| *** ducttape_ has joined #openstack-keystone | 05:30 | |
| *** ducttape_ has quit IRC | 05:35 | |
| *** hoonetorg has joined #openstack-keystone | 05:44 | |
| *** ducttape_ has joined #openstack-keystone | 05:46 | |
| *** ducttape_ has quit IRC | 05:51 | |
| *** harlowja has joined #openstack-keystone | 05:51 | |
| *** phalmos has quit IRC | 06:03 | |
| *** jaosorior has quit IRC | 06:05 | |
| *** tobberydberg has joined #openstack-keystone | 06:23 | |
| *** tobberydberg has quit IRC | 06:23 | |
| *** tobberydberg has joined #openstack-keystone | 06:24 | |
| *** jaosorior has joined #openstack-keystone | 06:24 | |
| *** prashkre has joined #openstack-keystone | 06:25 | |
| *** thorst_afk has joined #openstack-keystone | 06:28 | |
| *** thorst_afk has quit IRC | 06:32 | |
| *** ducttape_ has joined #openstack-keystone | 06:35 | |
| *** ducttape_ has quit IRC | 06:39 | |
| *** harlowja has quit IRC | 06:51 | |
| *** rcernin has joined #openstack-keystone | 06:55 | |
| *** rajalokan has joined #openstack-keystone | 07:01 | |
| *** Shunli has quit IRC | 07:03 | |
| *** Shunli has joined #openstack-keystone | 07:03 | |
| *** pcaruana has joined #openstack-keystone | 07:06 | |
| *** mjax has joined #openstack-keystone | 07:08 | |
| *** mjax has quit IRC | 07:09 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone master: Imported Translations from Zanata https://review.openstack.org/489513 | 07:39 |
|---|---|---|
| *** kukacz has joined #openstack-keystone | 07:40 | |
| *** kukacz has quit IRC | 07:41 | |
| *** kukacz has joined #openstack-keystone | 07:41 | |
| *** ioggstream has joined #openstack-keystone | 07:43 | |
| *** rcernin has quit IRC | 07:48 | |
| *** rcernin has joined #openstack-keystone | 07:50 | |
| *** clarkb has quit IRC | 08:04 | |
| *** ducttape_ has joined #openstack-keystone | 08:16 | |
| *** aloga has quit IRC | 08:17 | |
| *** aloga has joined #openstack-keystone | 08:17 | |
| *** clarkb has joined #openstack-keystone | 08:18 | |
| *** ducttape_ has quit IRC | 08:20 | |
| *** thorst_afk has joined #openstack-keystone | 08:27 | |
| *** markvoelker has quit IRC | 08:30 | |
| *** rajalokan has quit IRC | 08:30 | |
| *** aojea has joined #openstack-keystone | 08:30 | |
| *** markvoelker has joined #openstack-keystone | 08:31 | |
| *** thorst_afk has quit IRC | 08:32 | |
| *** rajalokan has joined #openstack-keystone | 08:32 | |
| *** markvoelker has quit IRC | 08:35 | |
| *** ducttape_ has joined #openstack-keystone | 09:17 | |
| *** ducttap__ has joined #openstack-keystone | 09:20 | |
| *** ducttape_ has quit IRC | 09:21 | |
| *** ducttap__ has quit IRC | 09:24 | |
| *** Shunli has quit IRC | 09:30 | |
| *** __pyokan has joined #openstack-keystone | 09:57 | |
| *** rajalokan has quit IRC | 09:58 | |
| *** __pyokan is now known as rajalokan | 09:58 | |
| *** ducttape_ has joined #openstack-keystone | 10:20 | |
| *** ducttape_ has quit IRC | 10:25 | |
| *** thorst_afk has joined #openstack-keystone | 10:28 | |
| *** markvoelker has joined #openstack-keystone | 10:31 | |
| *** thorst_afk has quit IRC | 10:32 | |
| *** markvoelker has quit IRC | 11:05 | |
| *** edmondsw has joined #openstack-keystone | 11:09 | |
| *** edmondsw has quit IRC | 11:14 | |
| *** ducttape_ has joined #openstack-keystone | 11:26 | |
| *** markvoelker has joined #openstack-keystone | 11:30 | |
| *** ducttape_ has quit IRC | 11:30 | |
| *** ioggstream has quit IRC | 11:39 | |
| *** thorst_afk has joined #openstack-keystone | 11:40 | |
| *** efried has quit IRC | 11:40 | |
| *** efried has joined #openstack-keystone | 11:52 | |
| *** hoonetorg has quit IRC | 11:54 | |
| openstackgerrit | M V P Nitesh proposed openstack/keystone master: Added support for a ``description`` attribute for V3 Identity Roles https://review.openstack.org/484348 | 12:00 |
| *** kukacz has quit IRC | 12:02 | |
| *** kukacz has joined #openstack-keystone | 12:03 | |
| *** hoonetorg has joined #openstack-keystone | 12:06 | |
| *** raildo has joined #openstack-keystone | 12:10 | |
| *** catintheroof has joined #openstack-keystone | 12:20 | |
| *** thorst_afk has quit IRC | 12:22 | |
| *** ioggstream has joined #openstack-keystone | 12:32 | |
| *** edmondsw has joined #openstack-keystone | 12:38 | |
| *** links has quit IRC | 12:40 | |
| mordred | morgan, efried: sorry was out yesterday - yes please, double-down on service-type | 12:42 |
| mordred | efried: and "service-type supplied in the conf" is a case we're trying to get away from | 12:44 |
| mordred | efried: setting non-standard service-type values is a thing we purposely want to make as hard as humanly possible, and in the fullness of time would prefer be impossible | 12:44 |
| openstackgerrit | zhiguo.li proposed openstack/keystone master: Add two steps in part 'Configure the Apache HTTP server' https://review.openstack.org/489589 | 12:50 |
| *** dave-mccowan has joined #openstack-keystone | 12:54 | |
| *** thorst_afk has joined #openstack-keystone | 12:57 | |
| openstackgerrit | zhiguo.li proposed openstack/keystone master: Add two steps in part 'Configure the Apache HTTP server' https://review.openstack.org/489589 | 13:00 |
| *** kbaegis has joined #openstack-keystone | 13:01 | |
| openstackgerrit | zhiguo.li proposed openstack/keystone master: Add two steps in part 'Configure the Apache HTTP server' https://review.openstack.org/489589 | 13:02 |
| openstackgerrit | zhiguo.li proposed openstack/keystone master: Add two steps in part 'Configure the Apache HTTP server' https://review.openstack.org/489589 | 13:06 |
| *** kukacz has quit IRC | 13:06 | |
| *** kukacz has joined #openstack-keystone | 13:06 | |
| openstackgerrit | zhiguo.li proposed openstack/keystone master: Add two steps in part 'Configure the Apache HTTP server' https://review.openstack.org/489589 | 13:08 |
| *** lucasxu has joined #openstack-keystone | 13:20 | |
| *** ducttape_ has joined #openstack-keystone | 13:22 | |
| *** ducttape_ has quit IRC | 13:25 | |
| *** ducttape_ has joined #openstack-keystone | 13:26 | |
| *** aojea has quit IRC | 13:29 | |
| *** aojea has joined #openstack-keystone | 13:29 | |
| *** ducttap__ has joined #openstack-keystone | 13:30 | |
| *** ducttape_ has quit IRC | 13:30 | |
| *** ducttap__ has quit IRC | 13:34 | |
| *** jmlowe has joined #openstack-keystone | 13:41 | |
| *** dstepanenko has joined #openstack-keystone | 13:54 | |
| *** rajalokan has quit IRC | 13:59 | |
| *** rajalokan has joined #openstack-keystone | 13:59 | |
| *** kukacz_ has joined #openstack-keystone | 14:00 | |
| *** kukacz__ has joined #openstack-keystone | 14:01 | |
| *** kukacz has quit IRC | 14:01 | |
| *** lbragstad_ is now known as lbragstad | 14:04 | |
| *** ChanServ sets mode: +o lbragstad | 14:04 | |
| *** kukacz_ has quit IRC | 14:05 | |
| *** kukacz__ has quit IRC | 14:08 | |
| *** ducttape_ has joined #openstack-keystone | 14:09 | |
| lbragstad | dstepanenko: o/ | 14:11 |
| dstepanenko | yep :) | 14:11 |
| lbragstad | dstepanenko: looks like you have some new findings on https://bugs.launchpad.net/keystone/+bug/1701324 ? | 14:11 |
| openstack | Launchpad bug 1701324 in OpenStack Identity (keystone) "Removing duplicated items doesn't work in case of federations" [Undecided,In progress] - Assigned to Dmitry Stepanenko (dstepanenko) | 14:11 |
| dstepanenko | yes, I was able to reproduce this issue with duplication of roles | 14:11 |
| prashkre | lbragstad:samueldmq: Hi. Could you please review https://review.openstack.org/#/c/485302/ once again, I have proposed a new patch addressing all review comments. | 14:12 |
| dstepanenko | there are 3 parts of code affected by the dirty code - domains, projects and roles | 14:12 |
| dstepanenko | I was able to reproduce this issue for duplication of roles and added steps to repro to the comments of this bug | 14:13 |
| lbragstad | dstepanenko: i attempted to recreate this with unit tests for domains and projects but I couldn't | 14:13 |
| lbragstad | i didn't attempt recreating it with roles | 14:14 |
| lbragstad | (i wasn't aware of the case with roles at the time) | 14:14 |
| dstepanenko | sorry, this is my bad | 14:14 |
| lbragstad | dstepanenko: nothing to be sorry about | 14:14 |
| dstepanenko | the thing is that initially I found this issue in roles duplication | 14:15 |
| dstepanenko | I debuged it a bit and found out that the mechanism of removing duplications from the list of roles was wrong | 14:15 |
| dstepanenko | then I looked through the commit where this code was added | 14:15 |
| dstepanenko | and found out that the same mechanism also used for removing duplicated domains and projects | 14:16 |
| dstepanenko | I added link to the commit where these changes were done | 14:16 |
| dstepanenko | it's in bug description | 14:16 |
| lbragstad | https://review.openstack.org/#/c/284943/ ? | 14:16 |
| dstepanenko | yes | 14:17 |
| lbragstad | sounds like we should be able to recreate this with a test then | 14:18 |
| lbragstad | the original test that I modified trying to create this didn't exercise this case | 14:18 |
| lbragstad | i was trying to recreate this by having a federated user end up with role assignments on the same project | 14:18 |
| lbragstad | via a group membership and a direct role assignment | 14:18 |
| lbragstad | because i wanted to verify that the duplicate project was being removed from the results | 14:19 |
| lbragstad | per the comment in code | 14:19 |
| lbragstad | but I didn't attempt to do it with roles | 14:19 |
| lbragstad | so a test that: | 14:19 |
| lbragstad | - creates a federated user | 14:19 |
| lbragstad | - contains a mapping that puts the user in the 'admin' group on a 'demo' project | 14:20 |
| lbragstad | - creates a direct mapping giving the user the 'admin' role on the 'demo' project | 14:20 |
| lbragstad | - the user should authenticate and should see two duplicate roles in the response | 14:20 |
| lbragstad | does ^ that sound about right to recreate the issue? | 14:21 |
| dstepanenko | yes, this sounds very similar to what I did | 14:22 |
| dstepanenko | probably this should do the trick | 14:23 |
| lbragstad | dstepanenko: ok - working on a test case locally | 14:25 |
| *** lucasxu has quit IRC | 14:27 | |
| dstepanenko | lbragstad: great! | 14:30 |
| lbragstad | rarora: o/ | 14:34 |
| lbragstad | rarora: one thing i started thinking about with https://review.openstack.org/#/c/489297/ was to register a version object and associate it to the controller - which seems to be fine | 14:34 |
| lbragstad | but we could leverage a callback for the actual version bits | 14:35 |
| *** spilla has joined #openstack-keystone | 14:35 | |
| *** prashkre has quit IRC | 14:35 | |
| lbragstad | since the application determines the version automatically (since it has to inorder to wire up the proper controller), basing the version logic on the type of the controller seems to make the most sense | 14:36 |
| lbragstad | (at least to me, but I am willing to be convinced if there is a better way) | 14:36 |
| lbragstad | rarora: the thing i was going to try next was to put the version stuff into the common/controller.py code and then supply some sort of callback that the wsgi:Application object could call to get the version info when it needs it | 14:38 |
| rarora | right I agree that it makes the most sense I am just trying to figure out a way to do the callback that makes sense | 14:38 |
| rarora | without it ending up being the same kind of thing as before | 14:38 |
| rarora | lbragstad: I am going to dig deeper into why getting to that version_object is failing right now sicne we are able to check isinstance(self, controller.V3Controller) | 14:44 |
| *** dstepanenko has quit IRC | 14:45 | |
| *** dstepanenko has joined #openstack-keystone | 14:45 | |
| lbragstad | rarora: i think it's because we specify another version object elsewhere in the code | 14:48 |
| lbragstad | rarora: so it could be bad naming on my part | 14:49 |
| *** dstepanenko has quit IRC | 14:50 | |
| rarora | lbragstad: ok cool, I should have a "working" version up and running in a minute so I can debug a bit better | 14:50 |
| lbragstad | rarora: awesome | 14:50 |
| lbragstad | rarora: don't feel obligated to use what I wrote - i was more of less just looking for a way to associate the version information needed in Application to the controller in a way that made it easy to use | 14:51 |
| rarora | lbragstad: ok sounds good, I think you have us on the right track | 14:52 |
| *** josecastroleon has joined #openstack-keystone | 15:07 | |
| *** Guest76 has joined #openstack-keystone | 15:07 | |
| *** rcernin has quit IRC | 15:14 | |
| *** Guest76 has left #openstack-keystone | 15:15 | |
| *** dstepanenko has joined #openstack-keystone | 15:19 | |
| rarora | lbragstad: from the debugging it looks like the reason it fails currently is that self doesn't always refer to the same class | 15:21 |
| lbragstad | rarora: so it's expecting something to be a part of the class but isn't? | 15:22 |
| *** pcaruana has quit IRC | 15:22 | |
| rarora | if you do project list it is keystone.version.controllers.Version whereas if you do user list it is keystone.identity.controllers.UserV3 which is a subclass of controller.V3/V2Controller | 15:22 |
| rarora | so running openstack user list would work but project list would fail with an attribute error | 15:23 |
| *** kbaegis has quit IRC | 15:24 | |
| *** kbaegis has joined #openstack-keystone | 15:24 | |
| *** aselius has joined #openstack-keystone | 15:26 | |
| rarora | lbragstad: so basically yeah what you said | 15:26 |
| *** kbaegis1 has joined #openstack-keystone | 15:28 | |
| *** tobberyd_ has joined #openstack-keystone | 15:29 | |
| *** kbaegis has quit IRC | 15:31 | |
| *** dstepanenko has quit IRC | 15:32 | |
| *** tobberydberg has quit IRC | 15:33 | |
| *** kbaegis1 has quit IRC | 15:33 | |
| *** kbaegis has joined #openstack-keystone | 15:33 | |
| *** tobberyd_ has quit IRC | 15:34 | |
| *** kbaegis has quit IRC | 15:38 | |
| *** pcaruana has joined #openstack-keystone | 15:40 | |
| *** rmascena has joined #openstack-keystone | 15:40 | |
| *** kbaegis has joined #openstack-keystone | 15:40 | |
| *** raildo has quit IRC | 15:42 | |
| *** kbaegis has quit IRC | 15:47 | |
| *** rcernin has joined #openstack-keystone | 15:49 | |
| rarora | lbragstad: is the only case for not having the version in the url when we are asking for a list of all versions? | 15:53 |
| rarora | if so that kind of solves the problems and we can just use the url to parse the version out all the time | 15:53 |
| lbragstad | rarora: that seems like the only case to me | 15:55 |
| lbragstad | rarora: but there are cases where keystone runs without a version | 15:55 |
| *** ducttape_ has quit IRC | 15:55 | |
| lbragstad | rarora: like devstack for example | 15:55 |
| lbragstad | it's something like http://localhost/identity/ | 15:55 |
| rarora | are version headers supposed to be in the response in that case? | 15:55 |
| rarora | lbragstad: bc if not, then we don't have a problem | 15:56 |
| *** lucasxu has joined #openstack-keystone | 16:04 | |
| rarora | lbragstad: also doesn't /identity/ just return the list of versions? | 16:04 |
| *** ducttape_ has joined #openstack-keystone | 16:04 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add test the exposes duplicate roles in token https://review.openstack.org/489647 | 16:09 |
| lbragstad | rarora: i want to say it might not? | 16:09 |
| lbragstad | rarora: i need to look at devstack - but i want to say there has been ongoing to work to run versionless | 16:09 |
| rarora | hmmmm | 16:09 |
| *** links has joined #openstack-keystone | 16:12 | |
| lbragstad | if there is anyone around looking to chase a super weird transient federation bug - check out https://review.openstack.org/#/c/489647/ | 16:12 |
| cmurphy | most fun kind of bug | 16:14 |
| lbragstad | cmurphy: right? | 16:14 |
| cmurphy | :P | 16:14 |
| lbragstad | kinda reminds me of the time i debugged transient token revocation bugs across multiple versions of MySQL | 16:15 |
| lbragstad | that took about 3 years off my life | 16:15 |
| cmurphy | ewww >.< | 16:16 |
| lbragstad | https://twitter.com/LanceBragstad/status/759134130860855296 | 16:17 |
| openstackgerrit | Gábor Antal proposed openstack/keystone master: Removed unnecessary setUp() calls from uinit tests https://review.openstack.org/489651 | 16:18 |
| lbragstad | stepping away to grab lunch quick | 16:18 |
| gagehugo | lbragstad https://review.openstack.org/#/c/447139/ | 16:22 |
| gagehugo | do we want to bump to pike? | 16:22 |
| *** esp has joined #openstack-keystone | 16:22 | |
| openstackgerrit | Gábor Antal proposed openstack/keystone master: Removed unnecessary setUp() calls from unit tests https://review.openstack.org/489651 | 16:24 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Have project get domain_id from parent https://review.openstack.org/489655 | 16:31 |
| *** dstepanenko has joined #openstack-keystone | 16:33 | |
| *** dstepanenko has quit IRC | 16:37 | |
| *** otleimat has joined #openstack-keystone | 16:48 | |
| *** mjax has joined #openstack-keystone | 16:49 | |
| *** ducttape_ has quit IRC | 16:55 | |
| *** pcaruana has quit IRC | 16:58 | |
| *** jistr is now known as jistr|afk | 17:00 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Prep for is_admin_project for scoped operations https://review.openstack.org/462670 | 17:04 |
| knikolla | o/ | 17:10 |
| *** ducttape_ has joined #openstack-keystone | 17:10 | |
| gagehugo | o/ | 17:14 |
| *** ducttape_ has quit IRC | 17:15 | |
| *** kbaegis has joined #openstack-keystone | 17:17 | |
| *** rajalokan has quit IRC | 17:28 | |
| *** prashkre has joined #openstack-keystone | 17:31 | |
| *** dstepanenko has joined #openstack-keystone | 17:34 | |
| lbragstad | gagehugo: sounds like that's what the security group advises? | 17:35 |
| lbragstad | based on Luke's comment | 17:35 |
| openstackgerrit | Abhishek Sharma M proposed openstack/pycadf master: Adding panko_api_audit_map.conf to pycadf https://review.openstack.org/489680 | 17:35 |
| *** dstepanenko has quit IRC | 17:38 | |
| *** lucasxu has quit IRC | 17:41 | |
| *** gyee has joined #openstack-keystone | 17:41 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add test the exposes duplicate roles in token https://review.openstack.org/489647 | 17:48 |
| gagehugo | lbragstad yeah | 17:53 |
| *** links has quit IRC | 17:57 | |
| *** markvoelker has quit IRC | 18:02 | |
| *** markvoelker has joined #openstack-keystone | 18:02 | |
| *** lucasxu has joined #openstack-keystone | 18:02 | |
| *** lucasxu has quit IRC | 18:02 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone-specs master: Update project-tags spec https://review.openstack.org/484529 | 18:12 |
| openstackgerrit | Gage Hugo proposed openstack/keystone-specs master: Move project-tags spec to backlog https://review.openstack.org/489696 | 18:13 |
| *** EmilienM is now known as emacchi | 18:14 | |
| *** emacchi is now known as EmilienM | 18:14 | |
| *** ioggstream has quit IRC | 18:14 | |
| edmondsw | lbragstad you'll want to read the comment I just added to https://bugs.launchpad.net/keystone/+bug/1696308 | 18:21 |
| openstack | Launchpad bug 1696308 in OpenStack Identity (keystone) "list revoked tokens API returns 500 when pki_setup is not run" [Wishlist,Triaged] - Assigned to Nisha Yadav (ynisha11) | 18:21 |
| lbragstad | edmondsw: noted - i'll catch up | 18:21 |
| *** ducttape_ has joined #openstack-keystone | 18:23 | |
| *** jistr|afk is now known as jistr | 18:34 | |
| *** dstepanenko has joined #openstack-keystone | 18:34 | |
| *** dstepanenko has quit IRC | 18:39 | |
| *** spilla has quit IRC | 18:44 | |
| mjax | Hi lbragstad, I talked with you the other day, and it looks like my team wants to move forward with writing the provider/trust driver/middleware auth for keystone. I am going to start with working on the external token provider and was wondering a couple things: 1. Are there any config files that I need to change other than keystone.conf in order t | 18:47 |
| mjax | o recognize the athens token? 2. I'm working on a devstack instance, is there an easy way to restart the keystone services to test changes that I make? 3. Which unit tests should I be especially concerned about to make sure my implementation doesn't break anything? 4. other than making a athens.py in the tokens/providers/ folder, are there any othe | 18:47 |
| mjax | r files that are relevant to the provider? 5. What is the difference between a credential and a token, since I saw that the credentials have a fernet folder in it as well | 18:47 |
| lbragstad | 1.) nope, the main config your going to be concerned with is `keystone.conf [token] provider` | 18:48 |
| lbragstad | but you also have to expose the entry to keystone in a way that it can find it | 18:49 |
| lbragstad | see setup.cfg if you need examples on how to do this | 18:49 |
| mjax | perfect, just what I was looking for. I'll take a look at that | 18:49 |
| lbragstad | 2.) if you're using devstack, you should be able to restart keystone using apache or uwsgi | 18:49 |
| lbragstad | 3.) there are a lot of unit tests in keystone/tests/unit/test_v3_auth.py and keystone/tests/unit/test_auth.py | 18:50 |
| lbragstad | those ^ test modules handle a lot of the token flows | 18:50 |
| lbragstad | keystone/tests/unit/token/ | 18:51 |
| lbragstad | contains unit tests for each of the providers specifically | 18:51 |
| mjax | cool, got it | 18:51 |
| lbragstad | 4.) The token provider interface in keystone/token/provider.py is essentailly the manager that is going to be calling into the implementation you provide | 18:51 |
| lbragstad | you need to implement the interface so that the token provider API can operator normally | 18:52 |
| lbragstad | other than that - there shouldn't be any other files you need to worry about | 18:52 |
| lbragstad | 5.) the credential backend is different than the token backend | 18:52 |
| lbragstad | s/backend/provider/ | 18:52 |
| lbragstad | credentials are secrets that are stored in keystone | 18:53 |
| lbragstad | tokens are things you get back when you authenticate | 18:53 |
| lbragstad | it's just happens that we use a similar encryption mechanism for each | 18:53 |
| lbragstad | which is where you see the fernet bits in keystone/credential and keystone/token | 18:53 |
| mjax | ah ok, makes sense | 18:54 |
| lbragstad | if you're supplying your own token provider - you should only be concerned about the implementation in keystone/token/providers/base.py | 18:54 |
| lbragstad | and that shouldn't be coupled in anyway to the credential backout outside the fact that they require the same key repository utility class to manage the fernet keys | 18:55 |
| lbragstad | #startmeeting keystone-office-hours | 18:58 |
| openstack | Meeting started Tue Aug 1 18:58:13 2017 UTC and is due to finish in 60 minutes. The chair is lbragstad. Information about MeetBot at http://wiki.debian.org/MeetBot. | 18:58 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 18:58 |
| openstack | The meeting name has been set to 'keystone_office_hours' | 18:58 |
| edmondsw | lbragstad let me know if you want to talk about that bug comment. Not sure I can add a whole lot more to it, been years since I looked at that | 18:59 |
| mjax | Thanks lbragstad, very helpful. I'll let you know if I have any more questions later | 18:59 |
| gagehugo | o/ | 18:59 |
| gagehugo | in a meeting, but can still look at something | 19:00 |
| cmurphy | \o | 19:01 |
| mjax | eiddccgeilrlerkbjdglujthbrrkbevkuvbulckivdih | 19:01 |
| knikolla | o/ | 19:04 |
| gagehugo | https://review.openstack.org/#/c/482971/ is close from what it looks like and it closes a bug | 19:04 |
| *** kbaegis has quit IRC | 19:08 | |
| lbragstad | mjax: anytime | 19:11 |
| lbragstad | #link https://review.openstack.org/#/c/485302/ closes a bug and is ldap related | 19:12 |
| *** zeus has quit IRC | 19:13 | |
| *** zeus has joined #openstack-keystone | 19:15 | |
| *** zeus is now known as Guest47987 | 19:15 | |
| openstackgerrit | Abhishek Sharma M proposed openstack/pycadf master: Adding panko_api_audit_map.conf to pycadf https://review.openstack.org/489680 | 19:23 |
| *** ducttape_ has quit IRC | 19:25 | |
| *** ducttape_ has joined #openstack-keystone | 19:25 | |
| knikolla | lbragstad: so is the yaml catalog also pushed for queens? | 19:32 |
| *** kbaegis has joined #openstack-keystone | 19:34 | |
| openstackgerrit | Abhishek Sharma M proposed openstack/pycadf master: Adding panko_api_audit_map.conf to pycadf https://review.openstack.org/489680 | 19:34 |
| *** dstepanenko has joined #openstack-keystone | 19:35 | |
| *** rcernin has quit IRC | 19:36 | |
| *** dstepanenko has quit IRC | 19:40 | |
| openstackgerrit | Abhishek Sharma M proposed openstack/pycadf master: Adding panko_api_audit_map.conf to pycadf https://review.openstack.org/489680 | 19:40 |
| *** nicolasbock has quit IRC | 19:45 | |
| morgan | knikolla: probably. unless someone can verify the code *and* help with tests | 19:46 |
| knikolla | morgan: what would the deadline for that merging be? i might be able to find some spare time. | 19:50 |
| *** esp has quit IRC | 19:52 | |
| morgan | not sure | 19:52 |
| morgan | ask lbragstad | 19:53 |
| knikolla | lbragstad: ^^ | 19:53 |
| morgan | https://review.openstack.org/#/c/483514 | 19:53 |
| *** esp has joined #openstack-keystone | 19:54 | |
| *** kbaegis has quit IRC | 20:14 | |
| lbragstad | knikolla: morgan since we only have two weeks for rc - we don't have much time | 20:19 |
| lbragstad | unfortunately | 20:19 |
| lbragstad | i'm not sure we'd want to merge the catalog bits two days before release (?) | 20:20 |
| morgan | i figured | 20:23 |
| *** ducttape_ has quit IRC | 20:25 | |
| *** ducttape_ has joined #openstack-keystone | 20:29 | |
| *** ioggstream has joined #openstack-keystone | 20:36 | |
| *** aojea has quit IRC | 20:39 | |
| *** jmlowe has quit IRC | 20:42 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add test the exposes duplicate roles in token https://review.openstack.org/489647 | 20:44 |
| lbragstad | this one closes *two* bugs - https://review.openstack.org/#/c/465530/ | 20:46 |
| *** aojea has joined #openstack-keystone | 20:54 | |
| *** esp has quit IRC | 21:00 | |
| *** esp has joined #openstack-keystone | 21:02 | |
| *** Guest47987 is now known as zeus` | 21:07 | |
| *** zeus` is now known as zeus | 21:07 | |
| *** zeus has quit IRC | 21:07 | |
| *** zeus has joined #openstack-keystone | 21:07 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Have project get domain_id from parent https://review.openstack.org/489655 | 21:16 |
| *** ioggstream has quit IRC | 21:27 | |
| *** dave-mccowan has quit IRC | 21:27 | |
| openstackgerrit | Merged openstack/keystonemiddleware master: strip whitespace from token https://review.openstack.org/482971 | 21:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add contributor/ directory for docs https://review.openstack.org/489755 | 21:35 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add user/ directory for documentation https://review.openstack.org/489756 | 21:35 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add cli/ directory for documentation https://review.openstack.org/489757 | 21:35 |
| lbragstad | FYI - those ^ should close https://bugs.launchpad.net/keystone/+bug/1694460 | 21:35 |
| openstack | Launchpad bug 1694460 in OpenStack Identity (keystone) "Keystone docs need to be migrated from the OpenStack-manuals" [High,In progress] - Assigned to Samriddhi (s-jain) | 21:35 |
| lbragstad | this might make for a good learning opportunity for folks if anyone is interested | 21:41 |
| lbragstad | #link http://lists.openstack.org/pipermail/openstack-dev/2017-August/120429.html | 21:41 |
| *** ducttape_ has quit IRC | 21:41 | |
| *** phalmos has joined #openstack-keystone | 21:42 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add user/ directory for documentation https://review.openstack.org/489756 | 21:44 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Have project get domain_id from parent https://review.openstack.org/489655 | 21:46 |
| *** dstepanenko has joined #openstack-keystone | 21:47 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add cli/ directory for documentation https://review.openstack.org/489757 | 21:47 |
| *** phalmos has quit IRC | 21:48 | |
| cmurphy | lbragstad: do those really close #1694460? if they're leaving the sections blank doesn't that mean there's still work to do? | 21:49 |
| *** eandersson has quit IRC | 21:50 | |
| gagehugo | or is it about being compliant with the docs migration? | 21:50 |
| *** dstepanenko has quit IRC | 21:52 | |
| lbragstad | those are just about being compliant | 21:52 |
| cmurphy | okie | 21:52 |
| lbragstad | i figured we could at least be compliant, because we've been shuffling documentation bits around for the last month | 21:53 |
| *** kbaegis has joined #openstack-keystone | 21:53 | |
| *** ducttape_ has joined #openstack-keystone | 21:59 | |
| *** rmascena has quit IRC | 22:00 | |
| *** phalmos has joined #openstack-keystone | 22:00 | |
| *** esp has quit IRC | 22:00 | |
| *** kbaegis has quit IRC | 22:01 | |
| *** esp has joined #openstack-keystone | 22:02 | |
| lbragstad | #endmeeting | 22:03 |
| openstack | Meeting ended Tue Aug 1 22:03:49 2017 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 22:03 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/keystone_office_hours/2017/keystone_office_hours.2017-08-01-18.58.html | 22:03 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/keystone_office_hours/2017/keystone_office_hours.2017-08-01-18.58.txt | 22:03 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/keystone_office_hours/2017/keystone_office_hours.2017-08-01-18.58.log.html | 22:03 |
| cmurphy | \o/ | 22:03 |
| lbragstad | cmurphy: achievement unlocked! | 22:04 |
| *** thorst_afk has quit IRC | 22:05 | |
| lbragstad | cmurphy: thanks for sticking around to kick some things through - we were able to get somethings merged today! | 22:07 |
| *** prashkre has quit IRC | 22:07 | |
| cmurphy | yep! | 22:07 |
| * cmurphy smashes all the bugs | 22:08 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add project tags api-ref documentation and reno https://review.openstack.org/472396 | 22:17 |
| *** thorst_afk has joined #openstack-keystone | 22:19 | |
| lbragstad | hah! transient! https://review.openstack.org/#/c/489647/ | 22:22 |
| *** catintheroof has quit IRC | 22:23 | |
| *** thorst_afk has quit IRC | 22:24 | |
| openstackgerrit | Merged openstack/keystone master: Fix ec2tokens validation in v2 after regression in metadata_ref removal https://review.openstack.org/465530 | 22:31 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Prep for is_admin_project scoped operations https://review.openstack.org/462670 | 22:32 |
| gagehugo | edmondsw thanks for the help with those changes! | 22:33 |
| edmondsw | gagehugo np! | 22:33 |
| *** edmondsw has quit IRC | 22:36 | |
| *** kbaegis has joined #openstack-keystone | 22:40 | |
| *** esp has left #openstack-keystone | 22:40 | |
| gagehugo | lbragstad do we want to bump https://review.openstack.org/#/c/447139/ to pike? | 22:43 |
| *** dave-mccowan has joined #openstack-keystone | 22:44 | |
| *** sjain has joined #openstack-keystone | 22:47 | |
| *** dstepanenko has joined #openstack-keystone | 22:48 | |
| *** dstepanenko has quit IRC | 22:53 | |
| *** https_GK1wmSU has joined #openstack-keystone | 22:58 | |
| *** https_GK1wmSU has left #openstack-keystone | 22:59 | |
| *** otleimat has quit IRC | 23:00 | |
| *** jmlowe has joined #openstack-keystone | 23:02 | |
| *** jmlowe has quit IRC | 23:03 | |
| *** rajalokan has joined #openstack-keystone | 23:06 | |
| *** sjain has quit IRC | 23:07 | |
| *** kbaegis has quit IRC | 23:12 | |
| *** kbaegis has joined #openstack-keystone | 23:13 | |
| *** aselius has quit IRC | 23:15 | |
| *** jmlowe has joined #openstack-keystone | 23:16 | |
| *** aojea has quit IRC | 23:33 | |
| *** aojea has joined #openstack-keystone | 23:34 | |
| *** aojea has quit IRC | 23:38 | |
| *** ducttape_ has quit IRC | 23:40 | |
| *** kbaegis has quit IRC | 23:45 | |
| -openstackstatus- NOTICE: osic nodes have been removed from nodepool due to a problem with the mirror host beginning around 22:20 UTC. please recheck any jobs with failures installing packages. | 23:47 | |
| *** dstepanenko has joined #openstack-keystone | 23:49 | |
| *** dstepanenko has quit IRC | 23:53 | |
| *** markvoelker has quit IRC | 23:53 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!