| *** zhurong has joined #openstack-keystone | 00:39 | |
| *** namnh has joined #openstack-keystone | 01:00 | |
| *** aloga has joined #openstack-keystone | 01:16 | |
| *** zhurong has quit IRC | 01:57 | |
| *** d0ugal_ has quit IRC | 02:03 | |
| *** d0ugal_ has joined #openstack-keystone | 02:13 | |
| *** nkinder has joined #openstack-keystone | 02:51 | |
| idlemind | dgedia ContextualVersionConflict: (python-keystoneclient 3.15.0 (/usr/local/lib/python2.7/dist-packages), Requirement.parse('python-keystoneclient!=1.8.0,!=2.1.0,<3.0.0,>=1.6.0'), set(['keystone'])) | 02:55 |
|---|---|---|
| idlemind | Did you have python-keystoneclient installed before devstack by chance? | 02:55 |
| *** d0ugal_ has quit IRC | 03:02 | |
| *** edmondsw has joined #openstack-keystone | 03:07 | |
| *** itlinux has quit IRC | 03:10 | |
| *** edmondsw has quit IRC | 03:11 | |
| *** d0ugal_ has joined #openstack-keystone | 03:12 | |
| *** links has joined #openstack-keystone | 03:44 | |
| *** itlinux has joined #openstack-keystone | 04:02 | |
| *** d0ugal_ has quit IRC | 04:06 | |
| *** dave-mccowan has quit IRC | 04:10 | |
| *** dave-mccowan has joined #openstack-keystone | 04:11 | |
| *** d0ugal_ has joined #openstack-keystone | 04:14 | |
| *** dave-mccowan has quit IRC | 04:18 | |
| *** jmlowe has joined #openstack-keystone | 04:20 | |
| *** jmlowe_ has quit IRC | 04:22 | |
| *** itlinux has quit IRC | 04:24 | |
| *** bhagyashris has joined #openstack-keystone | 04:29 | |
| *** itlinux has joined #openstack-keystone | 04:30 | |
| *** nicolasbock has quit IRC | 04:33 | |
| *** logan- has left #openstack-keystone | 04:48 | |
| *** brad[] has quit IRC | 05:03 | |
| *** brad[] has joined #openstack-keystone | 05:05 | |
| *** links has quit IRC | 06:07 | |
| *** itlinux has quit IRC | 06:10 | |
| openstackgerrit | Deepak Mourya proposed openstack/keystoneauth master: Override support message in AuthorizationFailure class https://review.openstack.org/539166 | 06:44 |
| *** links has joined #openstack-keystone | 06:51 | |
| *** martinus__ has joined #openstack-keystone | 07:28 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:51 | |
| *** pcaruana has joined #openstack-keystone | 08:07 | |
| *** tesseract has joined #openstack-keystone | 08:18 | |
| *** rcernin has quit IRC | 08:39 | |
| *** d0ugal_ has quit IRC | 09:03 | |
| *** d0ugal has joined #openstack-keystone | 09:03 | |
| *** d0ugal has quit IRC | 09:03 | |
| *** d0ugal has joined #openstack-keystone | 09:03 | |
| *** brad[] has quit IRC | 09:20 | |
| *** brad[] has joined #openstack-keystone | 09:32 | |
| *** namnh has quit IRC | 10:08 | |
| *** wxy has quit IRC | 10:26 | |
| *** wxy has joined #openstack-keystone | 10:26 | |
| *** sambetts|afk is now known as sambetts | 11:06 | |
| *** jaosorior has joined #openstack-keystone | 11:10 | |
| *** bhagyashris has quit IRC | 11:38 | |
| *** bhagyashris has joined #openstack-keystone | 11:50 | |
| *** nicolasbock has joined #openstack-keystone | 11:53 | |
| *** dave-mccowan has joined #openstack-keystone | 12:08 | |
| *** jmlowe has quit IRC | 12:27 | |
| *** wxy has quit IRC | 12:36 | |
| *** r-daneel has joined #openstack-keystone | 12:56 | |
| *** edmondsw has joined #openstack-keystone | 13:15 | |
| *** edmondsw has quit IRC | 13:15 | |
| *** edmondsw_ has joined #openstack-keystone | 13:16 | |
| *** nkinder has quit IRC | 13:18 | |
| *** edmondsw_ is now known as edmondsw | 13:37 | |
| *** nicolasbock has quit IRC | 13:54 | |
| *** jmlowe has joined #openstack-keystone | 14:00 | |
| *** jmlowe has quit IRC | 14:05 | |
| *** panbalag has joined #openstack-keystone | 14:10 | |
| *** nkinder has joined #openstack-keystone | 14:13 | |
| *** jdennis has joined #openstack-keystone | 14:37 | |
| *** david-lyle has quit IRC | 14:38 | |
| *** edmondsw has quit IRC | 14:38 | |
| *** lbragstad has joined #openstack-keystone | 14:39 | |
| *** ChanServ sets mode: +o lbragstad | 14:39 | |
| *** r-daneel has quit IRC | 14:45 | |
| *** edmondsw has joined #openstack-keystone | 14:52 | |
| *** simondodsley has quit IRC | 14:58 | |
| *** simondodsley has joined #openstack-keystone | 14:58 | |
| *** mchlumsky has joined #openstack-keystone | 15:01 | |
| *** Exhar has quit IRC | 15:04 | |
| lbragstad | o/ | 15:07 |
| cmurphy | \o | 15:15 |
| *** belmoreira has joined #openstack-keystone | 15:23 | |
| *** jmlowe has joined #openstack-keystone | 15:23 | |
| *** jmlowe has quit IRC | 15:28 | |
| *** jmlowe has joined #openstack-keystone | 15:30 | |
| *** cloudnull has quit IRC | 15:32 | |
| *** cloudnull has joined #openstack-keystone | 15:36 | |
| *** links has quit IRC | 15:39 | |
| *** david-lyle has joined #openstack-keystone | 15:46 | |
| *** panbalag has left #openstack-keystone | 15:47 | |
| *** wolsen has quit IRC | 15:59 | |
| *** wolsen has joined #openstack-keystone | 16:00 | |
| *** Nisha_Agarwal has joined #openstack-keystone | 16:01 | |
| gagehugo | o/ | 16:02 |
| knikolla | o/ | 16:04 |
| *** pcaruana has quit IRC | 16:04 | |
| *** spilla has joined #openstack-keystone | 16:04 | |
| *** itlinux has joined #openstack-keystone | 16:08 | |
| *** itlinux has quit IRC | 16:10 | |
| *** Supun has joined #openstack-keystone | 16:19 | |
| *** kmARC has quit IRC | 16:19 | |
| *** kmARC has joined #openstack-keystone | 16:20 | |
| *** itlinux has joined #openstack-keystone | 16:22 | |
| *** itlinux has quit IRC | 16:23 | |
| *** r-daneel has joined #openstack-keystone | 16:32 | |
| *** itlinux has joined #openstack-keystone | 16:34 | |
| *** jamespage has quit IRC | 16:34 | |
| *** jamespage has joined #openstack-keystone | 16:35 | |
| lbragstad | gagehugo i'm working on a patch to remove the uuid provider and sql token storage bits | 16:39 |
| lbragstad | after that, i can take a stab at redefining the interfaces for the token providers | 16:39 |
| gagehugo | lbragstad cool | 16:40 |
| lbragstad | that should make the jwt work a lot easier | 16:40 |
| lbragstad | knikolla we might need to sync back up on the bug we talked about on friday | 16:41 |
| knikolla | lbragstad: i have a meeting in 10 minutes, let's do in the afternoon | 16:47 |
| *** links has joined #openstack-keystone | 16:47 | |
| gagehugo | lbragstad yup | 16:47 |
| kmalloc | lbragstad: o/ | 16:49 |
| lbragstad | knikolla that works for me | 16:49 |
| lbragstad | kmalloc o/ | 16:49 |
| kmalloc | lbragstad: when are we able to drop UUID tokens again? | 16:50 |
| * kmalloc checks coee. | 16:50 | |
| kmalloc | code* | 16:50 |
| kmalloc | ooh. in R. | 16:51 |
| kmalloc | nice. | 16:51 |
| kmalloc | that means *soon* | 16:51 |
| kmalloc | which will make token providers so very much easier to deal with | 16:51 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove the sql token driver and uuid token provider https://review.openstack.org/543060 | 16:52 |
| lbragstad | kmalloc ^ | 16:52 |
| lbragstad | boom - done | 16:52 |
| kmalloc | LOL NICE | 16:52 |
| kmalloc | AHA, i was just about to do that. i'll review it instead! | 16:52 |
| kmalloc | do you know how happy that change makes me. | 16:53 |
| lbragstad | wxy had a few good questions on the revocation list stuff | 16:53 |
| kmalloc | rev list pretty much dies | 16:53 |
| *** links has quit IRC | 16:53 | |
| kmalloc | we need to revisit and make it simply policied off (401) | 16:53 |
| lbragstad | kmalloc i can imagine.. i'm usually pumped to remove code... i could barely contain myself | 16:53 |
| kmalloc | since we can't drop the API | 16:53 |
| lbragstad | https://review.openstack.org/#/c/543060/2/keystone/token/provider.py | 16:54 |
| lbragstad | those were the concerns ^ | 16:54 |
| kmalloc | the fix is just make it respond with 401 | 16:54 |
| *** links has joined #openstack-keystone | 16:54 | |
| kmalloc | always | 16:54 |
| kmalloc | since 500 is busted and certs are... well dead | 16:54 |
| kmalloc | it exists but no one is allowed to see it | 16:54 |
| lbragstad | https://review.openstack.org/#/c/543060/3/keystone/token/provider.py,unified@270 | 16:54 |
| kmalloc | simple | 16:54 |
| kmalloc | i'd raise 401 explicitly | 16:55 |
| lbragstad | yeah - i had to dig up the keystone-manage pki_setup command to test that | 16:55 |
| kmalloc | a [] isn't valid | 16:55 |
| kmalloc | because it wont be signed | 16:55 |
| kmalloc | also, we should drop all the cert options. | 16:55 |
| kmalloc | that API requires the data to be signed. | 16:55 |
| kmalloc | =/ | 16:55 |
| lbragstad | kmalloc i think it is signed | 16:55 |
| lbragstad | at least when i tested it locally | 16:55 |
| lbragstad | kmalloc that's what the controller does | 16:55 |
| kmalloc | right, only when certs are configured | 16:56 |
| lbragstad | iff the certs are available | 16:56 |
| lbragstad | yeah | 16:56 |
| kmalloc | so, we drop the cert options | 16:56 |
| kmalloc | and hard raise 401 | 16:56 |
| kmalloc | hell, we just hard raise 401 regardless | 16:56 |
| lbragstad | ahh - i see what you mean | 16:56 |
| kmalloc | it's better than 500 | 16:56 |
| lbragstad | from a provider perspective, that can be done in a separate patch, no? | 16:56 |
| kmalloc | or we 403 | 16:56 |
| kmalloc | yeah we do it separately | 16:56 |
| lbragstad | cool | 16:56 |
| kmalloc | s/401/403 | 16:56 |
| kmalloc | it is def a forbidden | 16:56 |
| lbragstad | i got caught a few times going down the rabbit hole | 16:57 |
| kmalloc | it might need a tempest change. | 16:57 |
| kmalloc | but we also can drop all the cert options | 16:57 |
| kmalloc | which is a sin | 16:57 |
| kmalloc | win* | 16:57 |
| lbragstad | and removing a bunch of stuff not directly related to the removal of those two bits of code | 16:57 |
| kmalloc | aye | 16:57 |
| lbragstad | i'd like to get eyes on the list of todos in the commit message, too | 16:57 |
| lbragstad | i'm trying to document what we need to do after we remove that | 16:57 |
| kmalloc | so the order of code changes: 1) what you proposed, 2) rev list -> 403, 3) drop all cert options / keystone-manage pki-setup | 16:57 |
| kmalloc | 2/3 might be tempest changes | 16:58 |
| kmalloc | as well. | 16:58 |
| lbragstad | https://github.com/openstack/keystone/commit/928d23db022157ae24d49eb9b7772cc0e07345a4#diff-41c8207a4e9c66c80ef1576614634992 | 16:58 |
| kmalloc | ah so we can't setup the pki stuff anyway | 16:58 |
| kmalloc | good. lets drop the options and nuke it from orbit | 16:58 |
| lbragstad | right | 16:58 |
| kmalloc | it's the only sure way | 16:58 |
| kmalloc | also, it means tempest can't be testing it | 16:58 |
| lbragstad | well - people *could* have certificates still | 16:58 |
| lbragstad | since pki_setup was only a "developer tool" | 16:59 |
| kmalloc | but we don't populate the rev list anymore. | 16:59 |
| kmalloc | and if we change the API to be 403 (it is a fair way to disable the API), we don't need to sign it | 16:59 |
| kmalloc | FTR: https://github.com/openstack/keystone/blob/master/keystone/conf/signing.py#L20 Pike removal | 17:00 |
| kmalloc | if we don't lean on those options for anything | 17:01 |
| kmalloc | and almost everyone 500s on the rev list [which is no longer populated] | 17:01 |
| kmalloc | we should drop the options | 17:01 |
| kmalloc | anyway, we should be good in either case. | 17:01 |
| lbragstad | cool | 17:05 |
| lbragstad | yeah - i think that sounds like a plan | 17:05 |
| lbragstad | so long as we have a list of things to clean up | 17:05 |
| lbragstad | i know there are a lot of things that could be included in the removal patch, but that's starting to get into a refactor | 17:05 |
| lbragstad | trying to keep them separate for the sake of reviewing | 17:05 |
| kmalloc | lbragstad: nit on your patch | 17:06 |
| kmalloc | but +2 | 17:06 |
| kmalloc | and added my comment about 403 AND removing signing options | 17:06 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove the sql token driver and uuid token provider https://review.openstack.org/543060 | 17:07 |
| kmalloc | lbragstad: +2/+A for the openstack proposal/release bot reviews for stab/queens | 17:09 |
| lbragstad | awesome - we do have to cut rc2 | 17:09 |
| lbragstad | waiting on a resolution to https://bugs.launchpad.net/keystone/+bug/1658641 | 17:10 |
| openstack | Launchpad bug 1658641 in OpenStack Identity (keystone) "Moving/disabling LDAP users break Keystone queries depending on role ID" [Medium,In progress] - Assigned to Kristi Nikolla (knikolla) | 17:10 |
| lbragstad | afaik - that's the last rc potential bug we are targeting | 17:11 |
| kmalloc | that is a hard bug to fix | 17:11 |
| lbragstad | it's not a release stopper, since it wasn't introduced in queens, but it would be nice to get fixed | 17:11 |
| kmalloc | basically you're changign things behind keystone in a way it can't know | 17:11 |
| kmalloc | thats painful. | 17:11 |
| lbragstad | right | 17:11 |
| lbragstad | we had a long conversations about it on friday | 17:11 |
| kmalloc | that is expected behavior | 17:11 |
| kmalloc | ftr | 17:12 |
| kmalloc | the 404 if it disappears | 17:12 |
| lbragstad | we have a couple options to fix it | 17:12 |
| kmalloc | yeah. | 17:12 |
| kmalloc | i'd probably not hold Q up for the fix if it lags | 17:12 |
| kmalloc | we can backport the fix if needed | 17:12 |
| lbragstad | one it the current proposal, which makes the purge mapping command smart enough to clean up assignments | 17:12 |
| lbragstad | s/it/is | 17:13 |
| kmalloc | which is the best option imo | 17:13 |
| lbragstad | but... | 17:13 |
| kmalloc | but it has limitations | 17:13 |
| kmalloc | tl;dr don't hold up the release. i'm 100% sure that we can backport if needed. if we get a reasonable proposal for code, we can land it before Q ships | 17:13 |
| lbragstad | the part that tripped me up is that the solution isn't accessible to everyone | 17:13 |
| kmalloc | unfortunately, it probably wont ever be. | 17:14 |
| kmalloc | nature of LDAP integrations | 17:14 |
| kmalloc | most apps fail in this regard if you do what the bug purports | 17:14 |
| kmalloc | and some fail far less gracefully than we do | 17:14 |
| kmalloc | personally, i view this as expected behavior. | 17:14 |
| lbragstad | ok - qq | 17:15 |
| kmalloc | sure | 17:15 |
| kmalloc | (but i'll support most any fix that makes it even slightly better) | 17:15 |
| lbragstad | lets say I'm a domain administrator and i have my domain backed by ldap | 17:15 |
| lbragstad | but it's not my deployment | 17:15 |
| kmalloc | yah | 17:16 |
| lbragstad | the team that manages the ldap i'm backing to starts shuffling users around into different groups | 17:16 |
| kmalloc | i see where you're going. | 17:16 |
| lbragstad | as a result, when i call v3/role_assignments with names, the api breaks with a 404 | 17:16 |
| kmalloc | either you need to be able to update the domain config to reference the changes or bug the openstack admin | 17:16 |
| kmalloc | likely both. | 17:16 |
| lbragstad | so - open a ticket? | 17:16 |
| kmalloc | yep | 17:16 |
| lbragstad | in both cases | 17:16 |
| kmalloc | it's unfortunate | 17:17 |
| kmalloc | there *is* a long term fix | 17:17 |
| lbragstad | well - actually, i might be wrong | 17:17 |
| kmalloc | split keystone ID and <rest of the API> | 17:17 |
| kmalloc | make all ID purely federated | 17:17 |
| lbragstad | a domain admin should be able to propose changes to the domain config API | 17:17 |
| kmalloc | offer a SAML2/somethingelse option that person X can run for their domain | 17:17 |
| kmalloc | lbragstad: correct, should, but not guaranteeed | 17:18 |
| kmalloc | it is likely a ticket, but may not be needed in all cases | 17:18 |
| lbragstad | that's fair | 17:18 |
| kmalloc | but tl;dr, if we offered an ID service - and everything was federated with industry tech, we could eliminate this issue | 17:19 |
| *** belmoreira has quit IRC | 17:19 | |
| kmalloc | reconfig your local keystone-id-proxy-service that talks to ldap | 17:19 |
| kmalloc | and then it does the federated auth dance | 17:19 |
| kmalloc | when you need to talk to the deployment keystone | 17:19 |
| kmalloc | that is an ideal world | 17:19 |
| kmalloc | but... that is a biiiiig hurdle | 17:19 |
| kmalloc | it's what i'd drive towards as a general modality of managing keystone/openstack ID. hard split resource+RBAC and Identity. | 17:20 |
| kmalloc | then we can just run a id process for an LDAP domain and allow the interfacing folks manage that w/o touching the openstack deployment itself. | 17:21 |
| kmalloc | still a ticket if fundamental mapping changes, but, not as often | 17:21 |
| kmalloc | and likely most folks can move towards full SAML2/OIDC impls with exception of SQL-specific keystone-isms | 17:22 |
| kmalloc | and we can handle PII/user data in a better fashion [we can be much smarter] | 17:22 |
| *** mvk_ has quit IRC | 17:22 | |
| kmalloc | but again, this is a BIG change | 17:22 |
| kmalloc | and might be a hard sell | 17:22 |
| kmalloc | it works better if we also move to the edge-permission model. | 17:23 |
| kmalloc | so you could just talk to nova directly instead of needing to hit keystone to token to talk to nova to pass tokens to glance. | 17:23 |
| lbragstad | mmm | 17:23 |
| kmalloc | but i'd work to logically split keystone-id into it's own micro service that does federated auth w/ keystone <service> | 17:24 |
| kmalloc | again, this is waxing poetic on "designing steps forward" | 17:25 |
| lbragstad | right | 17:25 |
| lbragstad | this is probably a discussion at the PTG | 17:25 |
| kmalloc | @#$! i need to book travel | 17:25 |
| lbragstad | but we should rehash this when knikolla is available so we're all on the same page | 17:25 |
| lbragstad | then i'll go through and cut rc2 based on that discussion | 17:26 |
| kmalloc | holy hell it's $400 for the ticket?! | 17:26 |
| lbragstad | the ptg ticket? | 17:26 |
| gagehugo | kmalloc yeah they ran out | 17:26 |
| lbragstad | price bump | 17:26 |
| kmalloc | whelp, guess i'm not going. | 17:26 |
| lbragstad | last friday? | 17:26 |
| kmalloc | sorry. i'll be missing this one | 17:27 |
| kmalloc | i don't want to front that kind of cash to ask for a reimbursal for. | 17:27 |
| lbragstad | :-/ | 17:28 |
| *** Nisha_Agarwal has left #openstack-keystone | 17:30 | |
| kmalloc | it's what i get for not being able to book the trip until now. | 17:30 |
| kmalloc | [had some questions on if i'd be able to go due to personal travel/appointments] | 17:31 |
| *** AlexeyAbashkin has quit IRC | 17:36 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove the sql token driver and uuid token provider https://review.openstack.org/543060 | 17:43 |
| * lbragstad takes lunch | 17:44 | |
| *** david-lyle has quit IRC | 17:55 | |
| *** dklyle has joined #openstack-keystone | 18:07 | |
| openstackgerrit | Merged openstack/keystone master: Imported Translations from Zanata https://review.openstack.org/543087 | 18:09 |
| *** harlowja has joined #openstack-keystone | 18:14 | |
| lbragstad | kmalloc will https://review.openstack.org/#/c/543087/ need to be backported? | 18:18 |
| lbragstad | to stable/queens? | 18:18 |
| kmalloc | dunno | 18:18 |
| kmalloc | i'd ask the translation team | 18:18 |
| kmalloc | maybe? | 18:18 |
| lbragstad | https://review.openstack.org/#/c/541567/ | 18:18 |
| lbragstad | i guess that one went in, too | 18:18 |
| *** r-daneel has quit IRC | 18:27 | |
| *** dklyle has quit IRC | 18:30 | |
| *** r-daneel has joined #openstack-keystone | 18:35 | |
| cmurphy | kmalloc: could you do a stable review for me? https://review.openstack.org/#/c/542483 | 18:43 |
| *** jmlowe has quit IRC | 18:44 | |
| *** links has quit IRC | 18:45 | |
| *** itlinux has quit IRC | 18:49 | |
| *** itlinux has joined #openstack-keystone | 18:51 | |
| *** itlinux has quit IRC | 18:53 | |
| *** david-lyle has joined #openstack-keystone | 18:54 | |
| openstackgerrit | Merged openstack/keystone master: Update reno for stable/queens https://review.openstack.org/542886 | 18:54 |
| *** itlinux has joined #openstack-keystone | 18:55 | |
| *** agrebennikov has joined #openstack-keystone | 19:00 | |
| kmalloc | done | 19:01 |
| cmurphy | ty :) | 19:01 |
| cmurphy | i have one for stable/ocata too that's making its way through check https://review.openstack.org/#/c/543379 | 19:02 |
| cmurphy | it's needed for the tempest test to pass but i'm not sure it's in line with stable policy | 19:02 |
| kmalloc | let me know when it passes | 19:02 |
| cmurphy | okie | 19:02 |
| kmalloc | and i'll take a gander | 19:02 |
| *** jmlowe has joined #openstack-keystone | 19:04 | |
| *** jmlowe has quit IRC | 19:06 | |
| *** jmlowe has joined #openstack-keystone | 19:06 | |
| agrebennikov | dstanek, hi, I have a question regarding the shadow users/mapping (and you mentioned as a contributor). Essentially, I don't see any clear mentioning for shadow groups to be implemented. How do I then do group-based assignments in case of saml auth? | 19:08 |
| *** jmlowe has quit IRC | 19:08 | |
| *** jmlowe has joined #openstack-keystone | 19:09 | |
| *** gyee has joined #openstack-keystone | 19:12 | |
| *** sambetts is now known as sambetts|afk | 19:13 | |
| *** jmlowe has quit IRC | 19:15 | |
| lbragstad | kmalloc sorry - a couple more for you :) | 19:17 |
| lbragstad | https://review.openstack.org/#/c/543584/ and https://review.openstack.org/#/c/543573/ | 19:17 |
| kmalloc | lbragstad: donje | 19:18 |
| *** tesseract has quit IRC | 19:18 | |
| lbragstad | kmalloc thanks | 19:19 |
| *** jmlowe has joined #openstack-keystone | 19:22 | |
| *** jmlowe has quit IRC | 19:38 | |
| *** jmlowe has joined #openstack-keystone | 19:41 | |
| *** lbragstad_ has joined #openstack-keystone | 19:41 | |
| *** lbragstad_ has quit IRC | 19:43 | |
| *** Supun has quit IRC | 19:44 | |
| *** Supun has joined #openstack-keystone | 19:44 | |
| *** pramodrj07 has joined #openstack-keystone | 19:49 | |
| knikolla | lbragstad: o/ | 20:06 |
| lbragstad | knikolla o/ | 20:08 |
| lbragstad | around? | 20:08 |
| knikolla | lbragstad: yep... played around with ldap and keystone for a bit | 20:09 |
| knikolla | surprisingly, wasn't able to reproduce the bug. | 20:09 |
| lbragstad | really? | 20:09 |
| knikolla | yes, maybe the shadow users stuff? | 20:10 |
| knikolla | i created and deleted a user after adding permissions | 20:10 |
| knikolla | this is after i deleted the user | 20:10 |
| knikolla | http://paste.openstack.org/show/670523/ | 20:10 |
| knikolla | you can see even doing show on a user that isn't returned from the user list, works. | 20:12 |
| agrebennikov | hey folks, maybe anybody else can explain a little bit about federation mappings (except dstanek)? Is it possible to have groups assignments only and have a user assertions to contain the groups he belongs to? | 20:13 |
| knikolla | lbragstad: argh... cache got me. | 20:17 |
| lbragstad | knikolla so demo is the user you modified in ldap? | 20:17 |
| knikolla | lbragstad: no, demo is the user that was already there. i created and then deleted a different user named kristi. | 20:18 |
| knikolla | let me give you fresh output after restarting and clearing the cache | 20:18 |
| lbragstad | ack | 20:18 |
| *** Exhar has joined #openstack-keystone | 20:19 | |
| kmalloc | cache wont pop if you change the backend | 20:20 |
| lbragstad | oh... | 20:22 |
| lbragstad | i suppose | 20:22 |
| lbragstad | there isn't a way for keystone to know about that | 20:22 |
| lbragstad | what if you disable caching? | 20:22 |
| knikolla | lbragstad: http://paste.openstack.org/show/670540/ | 20:24 |
| knikolla | i just restarted the keystone service. | 20:24 |
| lbragstad | hmm - so it sounds like your fix also works for this | 20:26 |
| lbragstad | s/sounds/appears/ | 20:27 |
| lbragstad | sounds like that specific bug is resolved, but we could file an RFE to handle the left over assignments | 20:28 |
| knikolla | lbragstad: it doesn't. | 20:28 |
| knikolla | as this bug is for a different API call. | 20:28 |
| knikolla | oh, you mean the mapping_purge, yes. | 20:29 |
| lbragstad | right - we still have a problem where role assignments aren't updated | 20:29 |
| lbragstad | and according to https://bugs.launchpad.net/keystone/+bug/1658641 it was causing a 404, but based on your trace, that doesn't seem to be the case anymore | 20:30 |
| openstack | Launchpad bug 1658641 in OpenStack Identity (keystone) "Moving/disabling LDAP users break Keystone queries depending on role ID" [Medium,In progress] - Assigned to Kristi Nikolla (knikolla) | 20:30 |
| lbragstad | does that sound accurate? | 20:34 |
| *** oikiki has joined #openstack-keystone | 20:35 | |
| knikolla | lbragstad: for the most part, the only API call that I think still doesn't work is this | 20:36 |
| knikolla | http://paste.openstack.org/show/670550/ | 20:36 |
| knikolla | or wait.. i think that's my typo | 20:36 |
| * knikolla facepalm | 20:37 | |
| knikolla | lbragstad: i see. it's only the API call in openstackclient that fails. | 20:38 |
| knikolla | lbragstad: because when you do `openstack user list --project <project>` | 20:38 |
| knikolla | openstack does role_assignment?scope.project.id=<project> | 20:38 |
| knikolla | the above call works | 20:38 |
| knikolla | and then does a users/users?name=<user> for all the users returned from the above call | 20:39 |
| lbragstad | GET /v3/projects/{project_id}/users/ isn't an API we support id on't think | 20:39 |
| knikolla | lbragstad: i realized that. it's openstackclient syntactic sugar | 20:39 |
| lbragstad | mmmm | 20:39 |
| * lbragstad loves syntactic sugar | 20:39 | |
| knikolla | which makes the `openstack user list --project <project>` fail | 20:39 |
| lbragstad | yeah - so it queries role_assignments | 20:39 |
| knikolla | but i see no bug with keystone here. we could maybe have role_assignment api clean up non existing users | 20:40 |
| lbragstad | knikolla would you mind putting your pastes in the bug report? | 20:45 |
| lbragstad | those are super helpful | 20:45 |
| lbragstad | technically, the only bug is that there are users with empty names when listing users (which flags a non-existent user) | 20:48 |
| lbragstad | so - yeah, that sounds like a RFE | 20:48 |
| lbragstad | IMO | 20:48 |
| knikolla | lbragstad: posted | 20:51 |
| *** itlinux has quit IRC | 20:51 | |
| *** Supun has quit IRC | 20:55 | |
| knikolla | woohoo... just got the visa approval email for ireland. | 20:57 |
| *** ChanServ has quit IRC | 21:02 | |
| *** ChanServ has joined #openstack-keystone | 21:11 | |
| *** barjavel.freenode.net sets mode: +o ChanServ | 21:11 | |
| *** oikiki has quit IRC | 21:11 | |
| *** oikiki has joined #openstack-keystone | 21:11 | |
| gagehugo | knikolla yay | 21:12 |
| lbragstad | knikolla nice! | 21:12 |
| *** r-daneel has quit IRC | 21:17 | |
| *** r-daneel has joined #openstack-keystone | 21:17 | |
| *** oikiki has quit IRC | 21:22 | |
| *** oikiki has joined #openstack-keystone | 21:23 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Grant admin a role on the system during bootstrap https://review.openstack.org/530410 | 21:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Delete system role assignments when deleting users https://review.openstack.org/543622 | 21:25 |
| lbragstad | mtreinish ^ | 21:25 |
| lbragstad | cherry-picked the bootstrap patch onto that one | 21:25 |
| lbragstad | we should probably be taking care of those assignments anyway | 21:26 |
| mtreinish | lbragstad: hmm looking at that patch, I'm not sure I could see where that would fix things | 21:26 |
| mtreinish | definitely a good thing to do, just not sure if it's related to the failures | 21:27 |
| lbragstad | yeah - that's fair | 21:27 |
| lbragstad | the admin user is never removed through, right? | 21:27 |
| *** gagehugo has quit IRC | 21:27 | |
| lbragstad | tempest always keeps the user from bootstrap around? | 21:27 |
| *** gagehugo has joined #openstack-keystone | 21:28 | |
| *** mvk_ has joined #openstack-keystone | 21:33 | |
| *** oikiki has quit IRC | 21:36 | |
| *** edmondsw has quit IRC | 21:39 | |
| *** oikiki has joined #openstack-keystone | 21:43 | |
| lbragstad | another stable review we can kick through - https://review.openstack.org/#/c/534396/ | 22:10 |
| *** threestrands has joined #openstack-keystone | 22:12 | |
| *** jmlowe has quit IRC | 22:14 | |
| *** martinus__ has quit IRC | 22:17 | |
| *** masber has quit IRC | 22:29 | |
| *** rcernin has joined #openstack-keystone | 22:31 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add docs for application credentials https://review.openstack.org/543643 | 22:33 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Use OSC in application credential documentation https://review.openstack.org/543644 | 22:33 |
| lbragstad | has anyone see sh: 1: cannot create /sys/kernel/mm/ksm/run: Permission denied in devstack recently ? | 23:18 |
| *** AlexeyAbashkin has joined #openstack-keystone | 23:21 | |
| *** panbalag has joined #openstack-keystone | 23:21 | |
| *** oikiki has quit IRC | 23:23 | |
| *** oikiki has joined #openstack-keystone | 23:24 | |
| *** AlexeyAbashkin has quit IRC | 23:26 | |
| kmalloc | nope | 23:35 |
| kmalloc | haven't seen that | 23:35 |
| *** bhagyashris has quit IRC | 23:40 | |
| *** bhagyashris has joined #openstack-keystone | 23:41 | |
| *** spilla has quit IRC | 23:42 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!