| *** masber has joined #openstack-keystone | 00:12 | |
| *** markvoelker has quit IRC | 00:36 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 00:45 | |
| *** AlexeyAbashkin has quit IRC | 00:50 | |
| *** PramodJ has joined #openstack-keystone | 00:52 | |
| *** PramodJ has quit IRC | 00:55 | |
| *** Pramod has quit IRC | 00:56 | |
| *** r-daneel has quit IRC | 01:26 | |
| *** oomichi_afk is now known as oomichi | 01:36 | |
| *** linkmark has quit IRC | 01:40 | |
| *** sapd has joined #openstack-keystone | 01:45 | |
| *** sapd has quit IRC | 01:55 | |
| *** sapd has joined #openstack-keystone | 01:57 | |
| *** sticker has quit IRC | 01:58 | |
| *** lbragstad_ has joined #openstack-keystone | 02:05 | |
| *** masber has quit IRC | 02:10 | |
| *** lbragstad_ has quit IRC | 02:14 | |
| openstackgerrit | Merged openstack/keystone master: Remove Dependency Injection https://review.openstack.org/499703 | 02:33 |
|---|---|---|
| *** markvoelker has joined #openstack-keystone | 02:37 | |
| *** annp has joined #openstack-keystone | 02:40 | |
| *** harlowja has joined #openstack-keystone | 02:41 | |
| *** harlowja has quit IRC | 02:42 | |
| *** harlowja has joined #openstack-keystone | 02:43 | |
| *** namnh has joined #openstack-keystone | 02:45 | |
| *** markvoelker has quit IRC | 03:11 | |
| *** aselius has quit IRC | 03:13 | |
| *** harlowja has quit IRC | 03:15 | |
| kmalloc | lbragstad: +2 on limits spe | 03:17 |
| kmalloc | c | 03:17 |
| kmalloc | but we have something that needs to be added/updated | 03:17 |
| *** jappleii__ has joined #openstack-keystone | 03:17 | |
| *** jappleii__ has quit IRC | 03:19 | |
| *** jappleii__ has joined #openstack-keystone | 03:19 | |
| *** threestrands_ has quit IRC | 03:20 | |
| wxy | kmalloc: Thanks!!. I'll add a new patch later. | 03:20 |
| kmalloc | wxy: you can add my suggestion in a follow-up | 03:21 |
| kmalloc | the spec as is looks good, we should just add some clarification(S) | 03:21 |
| wxy | kmalloc: sure | 03:21 |
| *** masber has joined #openstack-keystone | 03:38 | |
| *** gyee has quit IRC | 03:43 | |
| *** r-daneel has joined #openstack-keystone | 03:52 | |
| *** jappleii__ has quit IRC | 03:56 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Deprecate member_role_id and member_role_name https://review.openstack.org/522461 | 03:57 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Remove useless function https://review.openstack.org/526262 | 03:57 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Remove rolling_upgrade_password_hash_compat https://review.openstack.org/527337 | 03:57 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Expose a bug when authorize request token https://review.openstack.org/526295 | 04:01 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add schema check for authorize request token https://review.openstack.org/526296 | 04:01 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add role name support for authorize request token https://review.openstack.org/526968 | 04:01 |
| *** r-daneel has quit IRC | 04:07 | |
| *** markvoelker has joined #openstack-keystone | 04:08 | |
| *** jmlowe_ has joined #openstack-keystone | 04:12 | |
| *** jmlowe has quit IRC | 04:14 | |
| *** harlowja has joined #openstack-keystone | 04:36 | |
| *** markvoelker has quit IRC | 04:42 | |
| *** rmcall_ has joined #openstack-keystone | 04:43 | |
| *** harlowja has quit IRC | 04:45 | |
| *** rmcall_ has quit IRC | 04:49 | |
| *** zhurong has joined #openstack-keystone | 04:56 | |
| lbragstad | kmalloc: wxy awesome! | 05:13 |
| *** harlowja has joined #openstack-keystone | 05:21 | |
| *** harlowja has quit IRC | 05:22 | |
| *** harlowja has joined #openstack-keystone | 05:24 | |
| *** harlowja has quit IRC | 05:29 | |
| *** harlowja has joined #openstack-keystone | 05:38 | |
| *** markvoelker has joined #openstack-keystone | 05:39 | |
| *** sapd_ has joined #openstack-keystone | 06:01 | |
| *** sapd has quit IRC | 06:01 | |
| *** markvoelker has quit IRC | 06:11 | |
| *** links has joined #openstack-keystone | 06:18 | |
| *** harlowja has quit IRC | 06:32 | |
| *** rcernin has quit IRC | 06:47 | |
| *** magicboiz has joined #openstack-keystone | 07:08 | |
| *** markvoelker has joined #openstack-keystone | 07:09 | |
| *** magicboiz has quit IRC | 07:13 | |
| *** magicboiz has joined #openstack-keystone | 07:14 | |
| *** izombie has joined #openstack-keystone | 07:31 | |
| izombie | How do I start keystone in developer mode? | 07:31 |
| *** markvoelker has quit IRC | 07:42 | |
| *** izombie has quit IRC | 07:46 | |
| *** zhurong has quit IRC | 07:54 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:59 | |
| *** markvoelker has joined #openstack-keystone | 08:39 | |
| *** markvoelker has quit IRC | 09:13 | |
| *** magicboiz has quit IRC | 09:23 | |
| *** magicboiz has joined #openstack-keystone | 09:29 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add new tables for unified limits https://review.openstack.org/523041 | 09:37 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add db operation for unified limit https://review.openstack.org/524082 | 09:37 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add limit provider https://review.openstack.org/524109 | 09:37 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: [WIP]Expose unified limit APIs https://review.openstack.org/524110 | 09:37 |
| *** annp has quit IRC | 09:52 | |
| *** mvk has quit IRC | 09:59 | |
| *** markvoelker has joined #openstack-keystone | 10:10 | |
| openstackgerrit | Merged openstack/oslo.policy master: Fix string injection for InvalidScope https://review.openstack.org/528035 | 10:17 |
| *** mvk has joined #openstack-keystone | 10:28 | |
| *** namnh has quit IRC | 10:31 | |
| *** daidv has quit IRC | 10:39 | |
| *** daidv has joined #openstack-keystone | 10:39 | |
| *** markvoelker has quit IRC | 10:44 | |
| *** daidv has quit IRC | 10:50 | |
| *** daidv has joined #openstack-keystone | 10:51 | |
| *** daidv has quit IRC | 10:58 | |
| *** sapd_ has quit IRC | 11:28 | |
| *** sapd_ has joined #openstack-keystone | 11:28 | |
| *** markvoelker has joined #openstack-keystone | 11:41 | |
| *** iurygregory has quit IRC | 12:08 | |
| *** raildo has joined #openstack-keystone | 12:10 | |
| *** iurygregory has joined #openstack-keystone | 12:12 | |
| *** markvoelker has quit IRC | 12:13 | |
| *** dave-mccowan has joined #openstack-keystone | 12:19 | |
| *** mvenesio has joined #openstack-keystone | 12:21 | |
| *** dave-mcc_ has joined #openstack-keystone | 12:23 | |
| *** dave-mccowan has quit IRC | 12:24 | |
| *** magicboiz has quit IRC | 12:27 | |
| *** catintheroof has joined #openstack-keystone | 12:31 | |
| *** markvoelker has joined #openstack-keystone | 12:56 | |
| *** markvoelker has quit IRC | 12:58 | |
| *** melwitt has quit IRC | 13:23 | |
| *** melwitt has joined #openstack-keystone | 13:25 | |
| *** melwitt is now known as Guest75547 | 13:25 | |
| *** clayton has quit IRC | 13:29 | |
| *** clayton has joined #openstack-keystone | 14:22 | |
| lbragstad | o/ | 14:25 |
| *** links has quit IRC | 14:31 | |
| *** markvoelker has joined #openstack-keystone | 14:31 | |
| *** apuimedo has joined #openstack-keystone | 14:31 | |
| *** openstackgerrit has quit IRC | 14:48 | |
| *** rcernin has joined #openstack-keystone | 14:57 | |
| *** ayoung has joined #openstack-keystone | 14:58 | |
| *** jmlowe_ has quit IRC | 15:05 | |
| apuimedo | lbragstad: Hi. I am looking for some way to have a tenant be able to perform actions on the different endpoints but restrict some others or specific paths. Doing some research I saw that the Route object was abandoned after discussion in Denver. Do we have something in Pike/Queens that could help with what I want to do? | 15:11 |
| *** harlowja has joined #openstack-keystone | 15:11 | |
| apuimedo | Originally I though that trust tokens would allow me to restrict entire endpoints, but it seems trust tokens are for the whole role (at least the impression I get from the API). | 15:12 |
| lbragstad | apuimedo: there is an endpoint filter in keystone | 15:12 |
| lbragstad | which allows you to associate specific endpoints to certain projects | 15:12 |
| lbragstad | then when users get tokens scoped to that project, they get those endpoints in their catalog | 15:12 |
| *** harlowja has quit IRC | 15:13 | |
| lbragstad | apuimedo: https://developer.openstack.org/api-ref/identity/v3-ext/index.html#os-ep-filter-api is the API reference for using this feature | 15:13 |
| apuimedo | thanks lbragstad | 15:13 |
| apuimedo | what I'm trying to achieve is to have the following | 15:13 |
| apuimedo | Kuryr-kubernetes is an openstack controller that runs on a tenant VM and it needs to perform actions on behalf of the project, but I don't want it to have credentials for the whole range of things the project member can do | 15:14 |
| apuimedo | rather I'd like it to just be restricted to some Neutron actions | 15:15 |
| lbragstad | aha | 15:15 |
| lbragstad | so you want the controller to be able to authenticate but not have all the powers of the user that set it up, right? | 15:15 |
| apuimedo | right | 15:16 |
| lbragstad | apuimedo: this will help you | 15:16 |
| lbragstad | http://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/application-credentials.html | 15:16 |
| apuimedo | originally I was told that a trust token would help | 15:16 |
| lbragstad | it's something we're working on this release | 15:16 |
| apuimedo | and IIRC there was a list on endpoints in the token POST | 15:16 |
| lbragstad | cc mordred cmurphy ^ | 15:16 |
| apuimedo | but it seems it is not there anymore | 15:16 |
| apuimedo | application credentials seem like a good fit | 15:17 |
| apuimedo | how's the progress going on that? | 15:17 |
| lbragstad | there are patches underway | 15:17 |
| lbragstad | https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:bp/application-credentials | 15:18 |
| apuimedo | lbragstad: chances for making it to queens? | 15:18 |
| lbragstad | yeah - we're planning on implementing this for queens | 15:18 |
| lbragstad | the specification i linked above goes into detail about what we're delivering for queens and what will come in a subsequent release | 15:19 |
| lbragstad | as far as the functionality of application credentials go | 15:19 |
| apuimedo | good. Thanks lbragstad | 15:19 |
| lbragstad | yep | 15:19 |
| apuimedo | if I wanted to do it somehow now, I suppose I'd have to create a specific role and go to all the policy.json of the different services, right? | 15:20 |
| lbragstad | unfortunately, yes... | 15:20 |
| lbragstad | that'd be one way to do it | 15:20 |
| lbragstad | then you'd create a trust scoped to that role | 15:20 |
| apuimedo | lbragstad: any other way? | 15:21 |
| lbragstad | you could create a service user, but you'd likely have to create a special role for it so that you don't give it the keys to the kingdom | 15:21 |
| lbragstad | (these are exactly the cases that drove the discussion for application credentials) | 15:22 |
| *** samuelbartel has joined #openstack-keystone | 15:26 | |
| *** samuelbartel_ has joined #openstack-keystone | 15:26 | |
| apuimedo | thanks lbragstad | 15:28 |
| lbragstad | no problem | 15:28 |
| *** markvoelker has quit IRC | 15:29 | |
| *** rcernin has quit IRC | 15:41 | |
| *** aloga_ has joined #openstack-keystone | 15:49 | |
| *** phalmos has joined #openstack-keystone | 15:57 | |
| *** mvk has quit IRC | 16:05 | |
| *** samuelbartel_ has quit IRC | 16:07 | |
| kmalloc | apuimedo: what lbragstad said, we are working on the tokens/app-creds with subsets of roles. There is no way (and limited support, mostly "you can but not recommended") to lock a user from a specific endpoint (planned or implemented). recommendation: don't use the endpoint filter. | 16:17 |
| kmalloc | it doesn't add value, it just obscures some endpoints from the catalog. | 16:18 |
| *** markvoelker has joined #openstack-keystone | 16:18 | |
| *** Guest75547 is now known as melwitt | 16:18 | |
| *** aselius has joined #openstack-keystone | 16:18 | |
| *** davidalles_ has joined #openstack-keystone | 16:26 | |
| *** davidalles_ has quit IRC | 16:28 | |
| *** davidalles_ has joined #openstack-keystone | 16:28 | |
| *** davidalles__ has joined #openstack-keystone | 16:30 | |
| *** davidalles_ has quit IRC | 16:30 | |
| *** davidalles_ has joined #openstack-keystone | 16:30 | |
| davidalles__ | hello lance | 16:32 |
| lbragstad | davidalles__: o/ | 16:32 |
| davidalles__ | just synchronized with Ruan | 16:32 |
| davidalles__ | he will propose a new update of the BP; will explain that Thomas, Samuel and him will propose the code | 16:32 |
| davidalles__ | we all will be to the keystome weekly meeting next Tuesday | 16:33 |
| davidalles__ | makes sense? | 16:33 |
| lbragstad | awesome - i did run across a couple links about the GDPR stuff | 16:33 |
| lbragstad | i'll leave a comment on the review | 16:33 |
| lbragstad | to see if we can include those | 16:33 |
| *** itlinux has joined #openstack-keystone | 16:34 | |
| davidalles__ | Yep... I also requested Jamey from ATT to distribute the info on this BP to the LCOO usergroup | 16:34 |
| lbragstad | good deal | 16:34 |
| davidalles__ | have a nice weekend; time to leave in France:) | 16:35 |
| lbragstad | davidalles__: have a good one - catch up with you next week! | 16:35 |
| *** davidalles_ has quit IRC | 16:35 | |
| *** davidalles__ has quit IRC | 16:35 | |
| *** davidalles_ has joined #openstack-keystone | 16:39 | |
| *** davidalles_ has quit IRC | 16:40 | |
| *** AlexeyAbashkin has quit IRC | 16:41 | |
| *** d0ugal has quit IRC | 16:45 | |
| *** samuelbartel_ has joined #openstack-keystone | 16:51 | |
| *** samuelbartel__ has joined #openstack-keystone | 16:51 | |
| *** samuelbartel__ has quit IRC | 16:51 | |
| *** samuelbartel_ has quit IRC | 16:52 | |
| *** samuelbartel has quit IRC | 16:59 | |
| *** iurygregory has quit IRC | 17:02 | |
| *** d0ugal has joined #openstack-keystone | 17:04 | |
| *** sapd_ has quit IRC | 17:06 | |
| *** mvk has joined #openstack-keystone | 17:25 | |
| *** catintheroof has quit IRC | 18:07 | |
| *** catinthe_ has joined #openstack-keystone | 18:07 | |
| *** mvenesio has quit IRC | 18:11 | |
| *** jose-phillips has quit IRC | 18:15 | |
| *** jose-phillips has joined #openstack-keystone | 18:15 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 18:16 | |
| *** AlexeyAbashkin has quit IRC | 18:21 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 18:22 | |
| *** AlexeyAbashkin has quit IRC | 18:26 | |
| *** nicolasbock has joined #openstack-keystone | 18:29 | |
| *** jdennis has quit IRC | 18:49 | |
| *** rmcall_ has joined #openstack-keystone | 19:01 | |
| *** apuimedo has quit IRC | 19:02 | |
| *** szaher has quit IRC | 19:02 | |
| *** gyee has joined #openstack-keystone | 19:08 | |
| *** szaher has joined #openstack-keystone | 19:18 | |
| *** catinthe_ has quit IRC | 19:21 | |
| *** phalmos has quit IRC | 19:34 | |
| ayoung | samueldmq, knikolla, dstanek, rodrigods, kmalloc, cmurphy can we move along the lbragstad reviews for System scope? Start here https://review.openstack.org/#/c/507993/4 | 19:41 |
| *** jdennis has joined #openstack-keystone | 19:43 | |
| *** smatzek has joined #openstack-keystone | 19:45 | |
| lbragstad | ayoung: o/ | 20:10 |
| lbragstad | several folks are hitting holiday this week, it's been a bit slow | 20:10 |
| ayoung | lbragstad, \o\ /o/ \o/ | 20:10 |
| lbragstad | interpretive dance, i like it | 20:11 |
| ayoung | lbragstad, I didn't realize so many people celebrated Hanukah | 20:11 |
| lbragstad | who knew! | 20:11 |
| lbragstad | ayoung: i had a comment on one of my patches about how we go about the transition | 20:14 |
| lbragstad | ayoung: this bit here - https://review.openstack.org/#/c/515215/5/keystone/common/policy.py | 20:14 |
| ayoung | lbragstad, is this because we are pushing things that would have been in the policy file into the code now? | 20:16 |
| lbragstad | right - it's making keystone enforce scope on policies | 20:16 |
| ayoung | where did we put the config for is_admin_project.... | 20:16 |
| lbragstad | i also have all these up for review, too | 20:16 |
| lbragstad | https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:add-scope-types | 20:16 |
| ayoung | we really should gather a policy section in the config file....we have that? | 20:17 |
| lbragstad | we use oslo.policy's configuration option section | 20:17 |
| ayoung | I think we might need more than that, over time. Can we add on to what oslo gives us? Otherwise, hmmm | 20:17 |
| lbragstad | well - we could add a configuration option to oslo.policy | 20:18 |
| lbragstad | something like 'enforce_system_scope' | 20:18 |
| lbragstad | or whatever | 20:18 |
| lbragstad | then that would get populated in each service configuration file | 20:18 |
| ayoung | so, I think I want to make a clear distinction between oslo.policy, which is a rules engine, and oslo.context which is the common OpenStack policy data | 20:18 |
| ayoung | and I could see context being the right place to do things like a global rule to enforce scope | 20:19 |
| ayoung | and that would be across all systems, not just Keystone | 20:19 |
| lbragstad | or we create a new configuration option next to is_admin_project that toggles enforce_scope in oslo.policy | 20:19 |
| ayoung | I think that is what jamielennox was driving at with oslo context, and Now that I get it, I am 100% on board | 20:19 |
| ayoung | right...I made the mistake of doing that as a standalone option. | 20:19 |
| ayoung | its in the token, I think | 20:20 |
| ayoung | resource | 20:21 |
| ayoung | lbragstad, could we keep it in resource? Or would that be wieieieird? | 20:22 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/conf/resource.py#L59-L77 | 20:22 |
| ayoung | right | 20:22 |
| lbragstad | hmm | 20:22 |
| lbragstad | good question | 20:22 |
| lbragstad | i think it would make more sense in default? | 20:22 |
| lbragstad | since it seems to apply to more than just resource? | 20:22 |
| ayoung | lets not put things in default. The namespace helps focus the user on the set of problems being addressed | 20:23 |
| ayoung | this is policy enforcement, and a new section for that seems to be called for | 20:23 |
| lbragstad | what about token? | 20:24 |
| ayoung | we can put a comment in there about the admin_project values | 20:24 |
| ayoung | I think token is more for format | 20:24 |
| *** smatzek has quit IRC | 20:24 | |
| ayoung | like, the token is a cookie that points to auth data | 20:24 |
| ayoung | stuff in there should be fernet vs uuid type options | 20:24 |
| lbragstad | auth? | 20:25 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/conf/auth.py | 20:25 |
| ayoung | [authorization] | 20:25 |
| lbragstad | auth.enforce_system_scope? | 20:25 |
| ayoung | since it is not authentication | 20:25 |
| ayoung | could be authn for short, but I think spelled out will trip up fewer people | 20:25 |
| lbragstad | yeah | 20:26 |
| ayoung | authorization.enforce_system_scope | 20:26 |
| ayoung | I think I like how that reads | 20:26 |
| lbragstad | so we would default authorization.enforce_system_scope to False | 20:26 |
| ayoung | would that carry over to other systems? Would we add that value to context? Maybe as a next step? | 20:27 |
| lbragstad | which would all project scoped tokens to do system-level things | 20:27 |
| ayoung | If the system does not enforce it yet, it does nothing | 20:27 |
| ayoung | or is that something we need to enable system by system? I'd rather it be all or nothing | 20:27 |
| lbragstad | so the way that it works with the current code | 20:28 |
| lbragstad | if is a policy has scope_types defined, it's going to enforce scope unless overridden by the project | 20:28 |
| lbragstad | like it is here - https://review.openstack.org/#/c/515215/5/keystone/common/policy.py | 20:28 |
| lbragstad | the tough part with that is that we're not sure when it's safe for us to remove that and go with the default of enforce_scope=True | 20:28 |
| lbragstad | which is what lead me to thinking we should use a configuration option, then an operator can switch it when they have system roles in place | 20:29 |
| lbragstad | and they don't lock themselves out of APIs because they didn't set up a system administrator | 20:29 |
| rybridges | Hello. I am seeing in openstack role assignment list that we have some role assignments where the user field = None. Meaning, the only fields that are occupied are project and role. Are these roles still valid? Ideally we should have a user associated with all role assignments right? | 20:39 |
| rybridges | How can I delete the role assignments? | 20:39 |
| lbragstad | rybridges: is there a group associated with the assignments that are missing users? | 20:41 |
| lbragstad | an assignment needs to have a target (project/domain) and an actor (user/group) | 20:42 |
| *** itlinux has quit IRC | 20:59 | |
| *** jmlowe has joined #openstack-keystone | 21:11 | |
| rybridges | @lbragstadL: there is no group | 21:11 |
| rybridges | @lbragstad: there is no group | 21:11 |
| lbragstad | rybridges: interesting | 21:12 |
| rybridges | this is ocata btw | 21:12 |
| lbragstad | rybridges: how is keystone setup? | 21:12 |
| lbragstad | are the backends using sql or ldap? | 21:12 |
| rybridges | sql | 21:12 |
| lbragstad | for identity, resource, and assignment? | 21:13 |
| rybridges | what do you mean? | 21:14 |
| *** rmcall_ is now known as rmcall | 21:16 | |
| rybridges | we use mysql for everything | 21:16 |
| rybridges | no ldap anywhere | 21:16 |
| *** jmlowe has quit IRC | 21:17 | |
| lbragstad | ok | 21:18 |
| lbragstad | interesting - a role assignment should have a user or a group no matter what | 21:18 |
| rybridges | right | 21:18 |
| rybridges | otherwise it is useless | 21:18 |
| rybridges | or meaningless | 21:18 |
| lbragstad | that's a requirement in the upstream implementation | 21:18 |
| lbragstad | it's part of the primary key constraint on the backend https://github.com/openstack/keystone/blob/master/keystone/assignment/backends/sql.py#L306 | 21:19 |
| lbragstad | we also specifically require a user or a group when we validate the request - https://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L446 | 21:20 |
| rybridges | well perhaps a pertinent piece of information is that we migrated this database from juno up to ocata | 21:20 |
| rybridges | so maybe there was some left over crap | 21:20 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L403-L405 | 21:20 |
| lbragstad | oh.... | 21:21 |
| lbragstad | hmmm | 21:21 |
| rybridges | now i am wondering if it is possible to delete this thing without touching the DB directly | 21:21 |
| lbragstad | huh - i wonder.... | 21:21 |
| rybridges | if i do openstack role remove --project <project_id> <role_name> will that work? | 21:22 |
| rybridges | it wont affect the other actual users under that project, will it? | 21:22 |
| lbragstad | you could try it, but i expect you'll get a validation error | 21:22 |
| lbragstad | we did have a bug a while back where role assignments weren't cleaned up when a user was deleted | 21:22 |
| lbragstad | some i'm wondering if that might be the case here, prior to the upgrade | 21:23 |
| lbragstad | cc kmalloc | 21:23 |
| rybridges | ya i am getting Must specify either a domain or project | 21:24 |
| kmalloc | that would be odd | 21:24 |
| kmalloc | but yeah | 21:24 |
| kmalloc | that would make sense | 21:24 |
| rybridges | yea i am thinking that the user was deleted at one point | 21:24 |
| rybridges | but role assignment was not cleaned up | 21:24 |
| rybridges | that would make a lot of sense | 21:24 |
| lbragstad | i remember that being a bug a long time ago | 21:25 |
| rybridges | am i gonna have to go to the db to nuke this thing? | 21:25 |
| * lbragstad cringes | 21:25 | |
| lbragstad | possibly? | 21:25 |
| lbragstad | unless kmalloc has a better suggestion? | 21:25 |
| *** aloga_ has quit IRC | 21:32 | |
| *** rmcall has quit IRC | 21:33 | |
| *** rcernin has joined #openstack-keystone | 21:36 | |
| *** itlinux has joined #openstack-keystone | 21:40 | |
| *** jmlowe has joined #openstack-keystone | 21:44 | |
| *** jmlowe has quit IRC | 21:49 | |
| rybridges | I just deleted it from the db | 21:52 |
| rybridges | seems to be ok | 21:53 |
| lbragstad | cool | 21:53 |
| lbragstad | glad it worked | 21:53 |
| *** raildo has quit IRC | 21:53 | |
| *** itlinux has quit IRC | 22:01 | |
| *** dave-mcc_ has quit IRC | 22:10 | |
| *** nicolasbock has quit IRC | 22:11 | |
| *** phalmos has joined #openstack-keystone | 22:25 | |
| *** catintheroof has joined #openstack-keystone | 22:29 | |
| *** phalmos_ has joined #openstack-keystone | 22:34 | |
| *** phalmos has quit IRC | 22:36 | |
| *** phalmos_ has quit IRC | 22:38 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 22:42 | |
| *** AlexeyAbashkin has quit IRC | 22:47 | |
| *** efried_cya_jan has quit IRC | 23:37 | |
| *** efried_cya_jan has joined #openstack-keystone | 23:48 | |
| kmalloc | i didn't have a better option | 23:49 |
| kmalloc | =/ | 23:49 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!