| *** Dinesh_Bhor has joined #openstack-keystone | 00:33 | |
| *** rcernin_ has joined #openstack-keystone | 00:34 | |
| *** rcernin has quit IRC | 00:37 | |
| *** edmondsw_ has joined #openstack-keystone | 00:52 | |
| *** edmondsw has quit IRC | 00:55 | |
| *** namnh has joined #openstack-keystone | 01:05 | |
| *** germs has quit IRC | 01:24 | |
| *** germs has joined #openstack-keystone | 01:25 | |
| *** germs has quit IRC | 01:25 | |
| *** germs has joined #openstack-keystone | 01:25 | |
| *** edmondsw_ has quit IRC | 01:29 | |
| *** sapd has joined #openstack-keystone | 02:09 | |
| *** rcernin_ has quit IRC | 02:09 | |
| *** annp has joined #openstack-keystone | 02:22 | |
| *** homeski has joined #openstack-keystone | 02:36 | |
| *** edmondsw has joined #openstack-keystone | 02:44 | |
| *** edmondsw has quit IRC | 02:49 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: [WIP]Add auto increase primary key for unified limit https://review.openstack.org/576025 | 03:41 |
|---|---|---|
| *** r-daneel has joined #openstack-keystone | 04:10 | |
| *** r-daneel_ has joined #openstack-keystone | 04:13 | |
| *** germs has quit IRC | 04:14 | |
| *** r-daneel has quit IRC | 04:15 | |
| *** r-daneel_ is now known as r-daneel | 04:15 | |
| *** felipemonteiro has joined #openstack-keystone | 04:26 | |
| *** edmondsw has joined #openstack-keystone | 04:32 | |
| *** edmondsw has quit IRC | 04:37 | |
| *** links has joined #openstack-keystone | 04:37 | |
| *** mvk has joined #openstack-keystone | 04:50 | |
| *** lifeless has quit IRC | 04:52 | |
| *** felipemonteiro has quit IRC | 05:13 | |
| *** itlinux has quit IRC | 05:19 | |
| *** rcernin has joined #openstack-keystone | 05:20 | |
| *** bhagyashris has quit IRC | 05:55 | |
| *** martinus__ has joined #openstack-keystone | 06:11 | |
| *** sheel has joined #openstack-keystone | 06:14 | |
| *** bhagyashris has joined #openstack-keystone | 06:20 | |
| *** edmondsw has joined #openstack-keystone | 06:21 | |
| *** annp has quit IRC | 06:21 | |
| *** edmondsw has quit IRC | 06:26 | |
| *** pcaruana has joined #openstack-keystone | 06:35 | |
| *** dmellado has joined #openstack-keystone | 06:41 | |
| *** rcernin has quit IRC | 07:01 | |
| *** belmoreira has joined #openstack-keystone | 07:11 | |
| *** tesseract has joined #openstack-keystone | 07:22 | |
| *** links has quit IRC | 07:38 | |
| *** links has joined #openstack-keystone | 07:55 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:57 | |
| *** links has quit IRC | 08:04 | |
| *** r-daneel has quit IRC | 08:08 | |
| *** r-daneel has joined #openstack-keystone | 08:09 | |
| *** edmondsw has joined #openstack-keystone | 08:09 | |
| *** edmondsw has quit IRC | 08:14 | |
| *** links has joined #openstack-keystone | 08:18 | |
| *** slunkad has joined #openstack-keystone | 08:22 | |
| *** aojea has joined #openstack-keystone | 08:26 | |
| *** sonuk_ has joined #openstack-keystone | 08:27 | |
| *** s10 has joined #openstack-keystone | 08:27 | |
| *** sonuk has quit IRC | 08:30 | |
| *** annp has joined #openstack-keystone | 08:34 | |
| *** aojea has quit IRC | 08:36 | |
| *** amoralej has joined #openstack-keystone | 08:39 | |
| amoralej | hi | 08:39 |
| amoralej | i'm finding error when trying to create "Member" role if "member" already exist | 08:40 |
| amoralej | is this expected? | 08:40 |
| amoralej | are role names non case sensitive? | 08:41 |
| *** tosky has joined #openstack-keystone | 08:41 | |
| amoralej | hrybacki, ^ | 08:48 |
| amoralej | https://review.openstack.org/#/c/572243/ is breaking some things | 08:49 |
| tosky | amoralej: oh, we had some breakages related to keystone in sahara after that change was merged, I was not sure if it was directly related | 08:50 |
| tosky | I can share the issues, one minute... | 08:50 |
| *** lifeless has joined #openstack-keystone | 08:55 | |
| tosky | working: http://logs.openstack.org/68/571468/4/check/sahara-tests-scenario/e0471a5/controller/logs/screen-keystone.txt.gz | 08:56 |
| tosky | vs failing: http://logs.openstack.org/68/571468/4/gate/sahara-tests-scenario/699320c/controller/logs/screen-keystone.txt.gz | 08:57 |
| tosky | amoralej: does it match the error that you noticed? ^ | 08:57 |
| amoralej | tosky, let me check... | 08:57 |
| amoralej | tosky, looks a different error, but probably related to that patch too | 08:58 |
| tosky | amoralej: did you try a test revert patch already, just to verify? | 08:58 |
| tosky | or could I? | 08:58 |
| amoralej | tosky, in my case | 08:59 |
| amoralej | the error is | 08:59 |
| amoralej | " Execution of '/bin/openstack role create --format shell Member' returned 1: Conflict occurred attempting to store role - Duplicate entry found with name Member. (HTTP 409)" | 08:59 |
| amoralej | and it's clear that root cause is that patch | 08:59 |
| tosky | "Conflict: Conflict occurred attempting to store trust - Duplicate entry." | 08:59 |
| tosky | that's my error | 08:59 |
| amoralej | tosky, but i see other one too | 08:59 |
| tosky | which is a warning, but becomes an error in heat, and boom | 08:59 |
| tosky | that's later | 08:59 |
| tosky | but confusing | 09:00 |
| amoralej | ah ok | 09:00 |
| tosky | "Circular reference found role inference rules" | 09:00 |
| amoralej | in the case of puppet, that's breaking | 09:00 |
| tosky | maybe it's related too | 09:00 |
| amoralej | yeah, that's the one i referred | 09:00 |
| tosky | amoralej: so, do you think that it's worth to try a revert to pinpoint more precisely the issue, now that the gates are still not too loaded? | 09:02 |
| amoralej | tosky, now i see your error Duplicate entry found with name Member. | 09:04 |
| amoralej | it's exactly the same | 09:04 |
| amoralej | but in your case it's probably not as critical | 09:04 |
| amoralej | because it's just warning | 09:04 |
| tosky | but one of the later warning is taken by heat as an error | 09:05 |
| tosky | see http://logs.openstack.org/68/571468/4/gate/sahara-tests-scenario/699320c/controller/logs/screen-h-eng.txt.gz#_Jun_15_18_03_55_514066 | 09:06 |
| amoralej | i think this will break many things... | 09:07 |
| amoralej | tosky, it may be worthy to propose a revert at least to discuss it | 09:09 |
| amoralej | and see how to improve backwards compatibility | 09:09 |
| tosky | ok, let me try (with a depends-on patch for sahara) | 09:09 |
| openstackgerrit | Luigi Toscano proposed openstack/keystone master: Revert "Ensure default roles created during bootstrap" https://review.openstack.org/576056 | 09:11 |
| amoralej | tosky, i'm investigating to implement case insensivity in puppet-keystone | 09:13 |
| amoralej | which seems to be required according to keystone behavior | 09:13 |
| tosky | amoralej: is that the reason, a conflict between words with different cases? | 09:13 |
| amoralej | yes | 09:14 |
| amoralej | member and Member | 09:14 |
| tosky | argh | 09:14 |
| amoralej | i'm not sure in your trust | 09:14 |
| amoralej | but it's still not very clear to me if case insensitity is expected in keystone | 09:14 |
| tosky | but that review just introduced new defaults, so how did it break everything? | 09:14 |
| amoralej | in my case | 09:14 |
| amoralej | it introduced member | 09:15 |
| amoralej | we try to create Member | 09:15 |
| amoralej | and it produces error | 09:15 |
| amoralej | openstack role create Member | 09:15 |
| amoralej | returns 1 | 09:15 |
| amoralej | and puppet module thinks that the role does not exist | 09:15 |
| tosky | so keystone is not case sensitive for role names? | 09:15 |
| amoralej | nop | 09:15 |
| amoralej | and i'm afraid in everything else | 09:15 |
| tosky | nop as "keystone is not case sensitive", or nop as "it's not correct that keystone is not case sensitive"? | 09:17 |
| tosky | (sorry, just to be sure) | 09:17 |
| *** aojea_ has joined #openstack-keystone | 09:21 | |
| *** jaosorior has joined #openstack-keystone | 09:23 | |
| *** aojea_ has quit IRC | 09:26 | |
| amoralej | tosky, not as "keystone is not case sensitive" at least in my p-o-i deployment | 09:31 |
| amoralej | i found somewhere that it may be because of database is not case sensitive | 09:32 |
| amoralej | i dunno | 09:32 |
| tosky | uhm, that would be weired; sometimes we had this member vs Member thing and nothing happened | 09:33 |
| jaosorior | amoralej, tosky: What's done in the failing test? Is the admin user given the member role there? | 09:46 |
| amoralej | jaosorior, in my case it's creating Member role | 09:47 |
| jaosorior | that's it? is it not assigning it anywhere? | 09:47 |
| jaosorior | also, quite confused as why to why the role name is case insensitive :/ | 09:48 |
| tosky | jaosorior: my failing test is a full end-to-end scenario job (albeit with a fake plugin) for sahra | 09:49 |
| tosky | it's not a "test" | 09:49 |
| *** Dinesh_Bhor has quit IRC | 09:49 | |
| tosky | we do some magic with trust and so, but I can defer you to the other devs when they come back (I didn't study how that part works in depth) | 09:50 |
| amoralej | jaosorior, we may have problems in other places | 09:53 |
| amoralej | assigning user to roles, probably | 09:53 |
| amoralej | at least | 09:53 |
| jaosorior | tosky: that would be good; if you can get more info on what the test does | 09:54 |
| jaosorior | amoralej: ?? | 09:54 |
| tosky | jaosorior: I can point you to the sahara code; the job is creating a full sahara cluster | 09:57 |
| jaosorior | tosky: sure | 09:57 |
| *** pcichy has joined #openstack-keystone | 09:57 | |
| tosky | especially creating an heat template (which is bailing out) | 09:58 |
| tosky | I don't know | 09:59 |
| amoralej | tosky, that's devstack, right? | 09:59 |
| tosky | it's touching the entire provisioning code of sahara | 09:59 |
| tosky | amoralej: yes | 09:59 |
| amoralej | has devstack "Member" as role name in sahara? | 09:59 |
| tosky | do you mean if a keystone Member role is created by devstack? | 10:02 |
| amoralej | yes | 10:03 |
| *** lifeless has quit IRC | 10:03 | |
| amoralej | or used in some configuration file or something | 10:03 |
| tosky | it is used for proxy users to access swift (in order to not pass the credentials directly or so) | 10:04 |
| *** lifeless has joined #openstack-keystone | 10:04 | |
| tosky | I see that Member is the default: http://git.openstack.org/cgit/openstack/sahara/tree/sahara/utils/proxy.py#n49 | 10:04 |
| amoralej | tosky, can you do a test job changing it to "member" ? | 10:08 |
| tosky | I can, sure | 10:09 |
| amoralej | tosky, i'm checking in https://review.openstack.org/#/c/576077/ for p-o-i | 10:10 |
| tosky | but if the default is changed, would that cause a requirement bump? | 10:10 |
| amoralej | i'm not sure how to handle that | 10:11 |
| amoralej | what about upgrades? | 10:11 |
| tosky | uhm | 10:12 |
| tosky | that would mean that keystone must be always upgraded first (which is probably what's happening already? Not sure) | 10:12 |
| *** namnh has quit IRC | 10:19 | |
| *** jaosorior has quit IRC | 10:30 | |
| *** mvenesio has joined #openstack-keystone | 10:33 | |
| *** alex_xu has quit IRC | 10:49 | |
| *** alex_xu has joined #openstack-keystone | 10:49 | |
| *** mvenesio has quit IRC | 10:53 | |
| *** d0ugal has quit IRC | 10:54 | |
| *** szaher has joined #openstack-keystone | 10:54 | |
| *** d0ugal has joined #openstack-keystone | 10:56 | |
| *** lifeless has quit IRC | 11:10 | |
| tosky | the test using "member" in sahara did not work: https://review.openstack.org/#/c/576081/ | 11:11 |
| *** mvenesio has joined #openstack-keystone | 11:23 | |
| *** jaosorior has joined #openstack-keystone | 11:33 | |
| *** amoralej is now known as amoralej|lunch | 11:33 | |
| *** dave-mcc_ has joined #openstack-keystone | 11:34 | |
| *** mvenesio has quit IRC | 11:35 | |
| *** raildo has joined #openstack-keystone | 11:57 | |
| *** ispp has joined #openstack-keystone | 12:00 | |
| *** rmascena has joined #openstack-keystone | 12:04 | |
| *** raildo has quit IRC | 12:06 | |
| *** edmondsw has joined #openstack-keystone | 12:09 | |
| *** wxy has joined #openstack-keystone | 12:23 | |
| *** jistr is now known as jistr|mtg | 12:36 | |
| *** josecastroleon has joined #openstack-keystone | 12:40 | |
| tosky | ... soooo :) | 12:42 |
| *** amoralej|lunch is now known as amoralej | 12:47 | |
| hrybacki | amoralej: jaosorior -- reading up now | 12:49 |
| jaosorior | tosky, hrybacki: I'm redeploying my environment to reproduce it... taking a while : | 12:50 |
| jaosorior | :/ | 12:50 |
| hrybacki | jaosorior: ack -- thank you | 12:51 |
| tosky | thank you | 12:52 |
| jaosorior | hrybacki: in my previous environment, the _member_ role had an inherited role for some reason. And I could see the Circular dependency error log in keystone, however, that seems to be a warning more than an actual error | 12:53 |
| jaosorior | that's why I redeployed, had to check if it was something messed up in my env or if that's what results | 12:53 |
| tosky | but then why heat does not like it? | 12:53 |
| * tosky will wait | 12:53 | |
| hrybacki | yeah that seems strange | 12:53 |
| *** dklyle_ has joined #openstack-keystone | 12:57 | |
| amoralej | hrybacki, wrt keystone not being case sensitive for names, is that expected? | 12:58 |
| *** david-lyle has quit IRC | 12:59 | |
| hrybacki | amoralej: I thought it was case sensitive. cmurphy ^^ do you know if this is true? | 12:59 |
| cmurphy | i wouldn't have expected that | 13:00 |
| cmurphy | my first guess would be database configuration | 13:00 |
| *** s10 has quit IRC | 13:00 | |
| *** r-daneel has quit IRC | 13:01 | |
| hrybacki | ack thanks cmurphy | 13:01 |
| *** s10 has joined #openstack-keystone | 13:02 | |
| *** r-daneel has joined #openstack-keystone | 13:02 | |
| *** jistr|mtg is now known as jistr | 13:04 | |
| *** r-daneel has quit IRC | 13:05 | |
| *** mchlumsky has joined #openstack-keystone | 13:10 | |
| *** mvenesio has joined #openstack-keystone | 13:15 | |
| *** jmlowe has quit IRC | 13:15 | |
| *** quiquell|rover has joined #openstack-keystone | 13:16 | |
| *** tellesnobrega has joined #openstack-keystone | 13:18 | |
| *** quiquell|rover is now known as quiquell|off | 13:20 | |
| *** felipemonteiro has joined #openstack-keystone | 13:24 | |
| *** nicolasbock has joined #openstack-keystone | 13:29 | |
| *** ispp has quit IRC | 13:31 | |
| *** belmorei_ has joined #openstack-keystone | 13:33 | |
| *** josecastroleon has quit IRC | 13:33 | |
| *** belmoreira has quit IRC | 13:34 | |
| *** josecastroleon has joined #openstack-keystone | 13:35 | |
| *** ispp has joined #openstack-keystone | 13:35 | |
| *** spilla has joined #openstack-keystone | 13:35 | |
| hrybacki | jaosorior: may I ask how you are replicating that failure? | 13:37 |
| *** superdan is now known as dansmith | 13:38 | |
| jaosorior | hrybacki: by having a deployment with the new bootstrap. TripleO deploys _member_ by default, so I wanna see if the issue I saw was on my side or if it always happens | 13:45 |
| hrybacki | ack ack | 13:47 |
| hrybacki | devmode -> rdo cloud seems to be broken rn so I'm having issues getting an environmnet up myself jaosorior | 13:47 |
| *** felipemonteiro has quit IRC | 13:51 | |
| *** rmascena has quit IRC | 13:54 | |
| *** jmlowe has joined #openstack-keystone | 13:55 | |
| *** sheel has quit IRC | 13:59 | |
| frickler | oh, fun, this is already on heavy rotation it seems. this "member" vs "Member" issue is also breaking things in Horizon fyi. https://bugs.launchpad.net/horizon/+bug/1777359 | 14:04 |
| openstack | Launchpad bug 1777359 in OpenStack Dashboard (Horizon) "Unable to create a project from horizon on devstack" [Undecided,New] | 14:04 |
| *** raildo has joined #openstack-keystone | 14:05 | |
| *** felipemonteiro has joined #openstack-keystone | 14:07 | |
| lbragstad | redeploying devstack with horizion to see if i can recreate | 14:07 |
| *** felipemonteiro_ has joined #openstack-keystone | 14:08 | |
| *** links has quit IRC | 14:09 | |
| *** nicolasbock has quit IRC | 14:11 | |
| *** felipemonteiro has quit IRC | 14:12 | |
| *** jeremyfreudberg has joined #openstack-keystone | 14:12 | |
| jaosorior | hrybacki: couldn't reproduce it :/ I guess it was an issue in my env. | 14:16 |
| frickler | lbragstad: I sure can, just did it | 14:16 |
| jaosorior | hrybacki: though, for some reason, the _member_ role wasn't created :/ | 14:17 |
| hrybacki | jaosorior: weird. re-re-recreate? | 14:17 |
| hrybacki | hopefully lbragstad will have some insights wrt this as well. I'm working with RDO Cloud folks trying to get some resources | 14:18 |
| jeremyfreudberg | http://logs.openstack.org/81/576081/1/check/sahara-tests-scenario/20379dc/controller/logs/screen-keystone.txt.gz if you look at the debug statements with "sql.core" and the warning statements nearby, seems to be a mark of case sensitivty issues | 14:19 |
| lbragstad | https://stackoverflow.com/questions/5629111/how-can-i-make-sql-case-sensitive-string-comparison-on-mysql | 14:19 |
| hrybacki | lbragstad: do we want to push forward the revert to unblock folks in the interim? | 14:24 |
| hrybacki | I'm concerned that we'll not be able to debug these failures w/o it tbh. Clearly hitting non-gate covered issues | 14:25 |
| hrybacki | lbragstad: and maybe add some role specific tests here: https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_backend_sql.py#L296-L322 | 14:29 |
| lbragstad | yeah - coverage would be good, i'm not finding anything specific to why that is though (API-wise) | 14:30 |
| hrybacki | lbragstad: cmurphy said it was probably a DB configuration issue | 14:30 |
| lbragstad | that stackoverflow link says something similar | 14:31 |
| * hrybacki nods | 14:31 | |
| *** felipemonteiro_ has quit IRC | 14:31 | |
| hrybacki | I'll work on adding tests now in a separate patch | 14:31 |
| lbragstad | it depends on the character set | 14:31 |
| hrybacki | is this a behavior we can force one way or another on our end? | 14:32 |
| *** s10 has quit IRC | 14:38 | |
| lbragstad | i need to look into that a bit further - looks like we do for users and projects | 14:38 |
| lbragstad | looking at the apache access logs, horizon gets a list of roles from keystone | 14:42 |
| *** ayoung has joined #openstack-keystone | 14:45 | |
| *** aojea has joined #openstack-keystone | 14:46 | |
| *** dklyle_ has quit IRC | 14:49 | |
| *** aojea has quit IRC | 14:51 | |
| lbragstad | frickler: http://paste.openstack.org/show/723719/ fixes the horizon issue for me | 14:57 |
| hrybacki | lbragstad: I also just saw https://review.openstack.org/#/c/576077/2 | 14:58 |
| hrybacki | aligning 'Member'->'member' | 14:58 |
| lbragstad | oh - nice | 14:58 |
| frickler | lbragstad: yes, that's what I mentioned in the bug report already. I'm just worried what this may do to existing installations. | 14:59 |
| frickler | lbragstad: in the long run making horizon handle case-insensitivity like OSC does would seem safer | 14:59 |
| *** pooja_jadhav has joined #openstack-keystone | 14:59 | |
| lbragstad | frickler: yeah - i think i agree | 15:00 |
| *** dtruong_ has joined #openstack-keystone | 15:07 | |
| *** nicolasbock has joined #openstack-keystone | 15:09 | |
| *** dtruong has quit IRC | 15:12 | |
| *** belmorei_ has quit IRC | 15:12 | |
| *** ispp has quit IRC | 15:12 | |
| *** josecastroleon has quit IRC | 15:12 | |
| *** josecastroleon has joined #openstack-keystone | 15:13 | |
| lbragstad | hrybacki: did you happen to see commit 7e279d10325ca5acc767a6bcbef5a2b2798ddac8 ? | 15:13 |
| *** jeremyfreudberg has left #openstack-keystone | 15:13 | |
| * hrybacki looks | 15:13 | |
| *** itlinux has joined #openstack-keystone | 15:13 | |
| hrybacki | https://review.openstack.org/#/c/43257/ ? not before just now | 15:14 |
| *** ispp has joined #openstack-keystone | 15:15 | |
| lbragstad | yeah - just noticing the context in the commit message | 15:15 |
| *** belmoreira has joined #openstack-keystone | 15:15 | |
| hrybacki | ah hmm | 15:16 |
| lbragstad | i'm trying to figure out why we treat usernames as case sensitive | 15:16 |
| lbragstad | but we don't for other things like roles | 15:16 |
| cmurphy | maybe because ldap? | 15:17 |
| *** josecastroleon has quit IRC | 15:17 | |
| lbragstad | looks like we have tests for project names too? but it looks like this specific test has been around for a while (so we probably supported ldap backed resource backends) | 15:18 |
| *** josecastroleon has joined #openstack-keystone | 15:18 | |
| lbragstad | https://github.com/openstack/keystone/commit/7da8e67b36c75a72a9e0124799080114903a3eac#diff-5b26fc6b9bbd5f555a666acf602a8cd5R168 | 15:18 |
| lbragstad | https://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/test_backend_sql.py#n310 | 15:19 |
| lbragstad | hmm - maybe i looked a bit too far into that | 15:22 |
| lbragstad | http://paste.openstack.org/show/723725/ | 15:22 |
| *** gyee has joined #openstack-keystone | 15:27 | |
| *** dklyle has joined #openstack-keystone | 15:29 | |
| *** aojea_ has joined #openstack-keystone | 15:32 | |
| *** josecastroleon has quit IRC | 15:32 | |
| *** aojea_ has quit IRC | 15:36 | |
| *** fiddletwix has joined #openstack-keystone | 15:37 | |
| *** felipemonteiro has joined #openstack-keystone | 15:38 | |
| *** jaosorior has quit IRC | 15:38 | |
| *** ispp has quit IRC | 15:52 | |
| lbragstad | hrybacki: i'm not sure we'll be able to do much in the way of adding case-sensitivity to role names | 15:59 |
| lbragstad | we might be better off assisting other projects where we can with the trasition | 16:00 |
| lbragstad | transition* | 16:00 |
| hrybacki | lbragstad: ack -- starting team meeting now but will ping you after these are over | 16:00 |
| knikolla[m] | o/ | 16:03 |
| tosky | lbragstad: as long as there is a patch which fixes sahara, and also works in case of upgrades, I'm fine with not reverting the change | 16:06 |
| lbragstad | i was just curious where some of those other errors were | 16:07 |
| lbragstad | oh - i just saw your comment on the review | 16:08 |
| lbragstad | s/your/Alfredo's/ | 16:08 |
| *** nicolasbock has quit IRC | 16:08 | |
| lbragstad | amoralej: ^ | 16:08 |
| amoralej | lbragstad, i'm fixing issues in https://review.openstack.org/#/q/topic:fix-member+status:open | 16:10 |
| amoralej | but i know there are more | 16:10 |
| amoralej | and if we are asuming case insensivity we should also support it in puppet-keystone resources | 16:11 |
| *** AlexeyAbashkin has quit IRC | 16:11 | |
| gagehugo | o/ | 16:14 |
| *** tesseract has quit IRC | 16:19 | |
| *** pcaruana has quit IRC | 16:20 | |
| *** nicolasbock has joined #openstack-keystone | 16:20 | |
| lbragstad | amoralej: do you mind if i reuse your topic for other changes that are related? | 16:22 |
| amoralej | lbragstad, no problem, you can use it | 16:23 |
| lbragstad | awesome - thank you | 16:23 |
| lbragstad | https://review.openstack.org/#/q/topic:fix-member+(status:open+OR+status:merged) | 16:23 |
| tosky | lbragstad: if it's a problem with case sensitivity, why did my test for sahara fail? | 16:23 |
| *** nicolasbock has quit IRC | 16:24 | |
| lbragstad | tosky: do you have a link to the failure? | 16:24 |
| lbragstad | i jumped in with https://bugs.launchpad.net/horizon/+bug/1777359 | 16:24 |
| openstack | Launchpad bug 1777359 in OpenStack Dashboard (Horizon) "Unable to create a project from horizon on devstack" [Undecided,New] | 16:24 |
| *** nicolasbock has joined #openstack-keystone | 16:24 | |
| lbragstad | so i might have missed a different issue | 16:24 |
| tosky | lbragstad: http://logs.openstack.org/81/576081/1/check/sahara-tests-scenario/20379dc/ | 16:25 |
| lbragstad | tosky: http://logs.openstack.org/81/576081/1/check/sahara-tests-scenario/20379dc/job-output.txt.gz#_2018-06-18_10_51_58_814189 | 16:26 |
| lbragstad | ? | 16:26 |
| lbragstad | looks like an issue specific to implied roles - http://logs.openstack.org/81/576081/1/check/sahara-tests-scenario/20379dc/controller/logs/screen-keystone.txt.gz#_Jun_18_10_51_30_768639 | 16:27 |
| tosky | lbragstad: it's the same failure as before, if I'm not mistaken | 16:27 |
| tosky | see the error in heat: http://logs.openstack.org/81/576081/1/check/sahara-tests-scenario/20379dc/controller/logs/screen-h-eng.txt.gz#_Jun_18_10_51_20_279091 | 16:27 |
| *** jaosorior has joined #openstack-keystone | 16:27 | |
| tosky | but | 16:28 |
| *** jaosorior has quit IRC | 16:28 | |
| tosky | the error about "duplicate blabla" is not there anymore in keystone logs | 16:28 |
| tosky | the error about circular references is still there | 16:28 |
| tosky | http://logs.openstack.org/81/576081/1/check/sahara-tests-scenario/20379dc/controller/logs/screen-keystone.txt.gz?level=WARNING#_Jun_18_10_50_24_599128 | 16:28 |
| lbragstad | yeah - i just saw though | 16:28 |
| lbragstad | those* | 16:28 |
| lbragstad | http://git.openstack.org/cgit/openstack/heat/tree/heat/engine/clients/os/keystone/heat_keystoneclient.py#n216 is the part it is failing on | 16:30 |
| *** dave-mcc_ has quit IRC | 16:30 | |
| lbragstad | mapping the req id http://logs.openstack.org/81/576081/1/check/sahara-tests-scenario/20379dc/controller/logs/screen-keystone.txt.gz#_Jun_18_10_51_20_274190 | 16:31 |
| lbragstad | http://logs.openstack.org/81/576081/1/check/sahara-tests-scenario/20379dc/controller/logs/screen-keystone.txt.gz#_Jun_18_10_51_30_768639 seems to happen afterwords | 16:31 |
| *** jaosorior has joined #openstack-keystone | 16:32 | |
| *** mvenesio has quit IRC | 16:32 | |
| *** germs has joined #openstack-keystone | 16:35 | |
| *** germs has quit IRC | 16:35 | |
| *** germs has joined #openstack-keystone | 16:35 | |
| *** germs has quit IRC | 16:36 | |
| *** germs has joined #openstack-keystone | 16:36 | |
| *** germs has quit IRC | 16:36 | |
| *** germs has joined #openstack-keystone | 16:36 | |
| lbragstad | tosky: does heat attempt to clean things up if something doesn't work right when creating the trust? | 16:42 |
| *** r-daneel has joined #openstack-keystone | 16:42 | |
| lbragstad | s/heat/heat or sahara/ | 16:42 |
| kmalloc | Case sensitivity on role names? | 16:43 |
| *** felipemonteiro_ has joined #openstack-keystone | 16:43 | |
| * kmalloc reads up. | 16:43 | |
| tosky | lbragstad: ehm, I don't really know the answer - tellesnobrega: ^^ | 16:44 |
| lbragstad | it's something we don't handle because of SQL from what i can tell | 16:44 |
| lbragstad | we take the same approach with user names, project names, etc... | 16:44 |
| tosky | (or jeremyfreudberg, if you are reading the logs) | 16:44 |
| kmalloc | I want to say at some point we decided case insensitive because SQL could be configured in different ways. | 16:45 |
| kmalloc | But... | 16:45 |
| kmalloc | It also sounds like implied roles isn't FKing | 16:45 |
| lbragstad | yeah - we couldn't guarantee it, i saw some commit messages from henry taking about that | 16:45 |
| kmalloc | Yep. | 16:46 |
| kmalloc | We can correct that fwiw, but it involves some encoding magic | 16:46 |
| kmalloc | Fwiw, I prefer names be case insensitive but case remembering, where possible. | 16:47 |
| *** felipemonteiro has quit IRC | 16:47 | |
| kmalloc | Just because the abuse of PRojectName vs.ProjectName | 16:47 |
| *** mvenesio has joined #openstack-keystone | 17:00 | |
| *** jaosorior has quit IRC | 17:01 | |
| *** sonuk has joined #openstack-keystone | 17:03 | |
| lbragstad | i'm going to grab lunch but i'll send a note to the mailing list this afternoon about the change and some of the failures people are seeing | 17:04 |
| *** sonuk_ has quit IRC | 17:06 | |
| *** d0ugal has quit IRC | 17:12 | |
| *** amoralej is now known as amoralej|off | 17:13 | |
| *** aojea has joined #openstack-keystone | 17:20 | |
| *** nicolasbock has quit IRC | 17:25 | |
| *** aojea has quit IRC | 17:25 | |
| *** d0ugal has joined #openstack-keystone | 17:26 | |
| *** jeremyfreudberg has joined #openstack-keystone | 17:27 | |
| jeremyfreudberg | hi keystone, what could it mean when a list of roles contains duplicates? see here: | 17:27 |
| jeremyfreudberg | http://logs.openstack.org/81/576081/1/check/sahara-tests-scenario/20379dc/controller/logs/screen-keystone.txt.gz#_Jun_18_10_50_26_678158 | 17:27 |
| jeremyfreudberg | (this is related to sahara stuff again) | 17:27 |
| tosky | jeremyfreudberg: it may be related to the case (in)sensitivity thing discussed earlier | 17:31 |
| *** dklyle has quit IRC | 17:36 | |
| *** dklyle has joined #openstack-keystone | 17:37 | |
| ildikov | knikolla: ping | 17:46 |
| knikolla | ildikov: o/ | 17:46 |
| ildikov | knikolla: hi :) | 17:46 |
| knikolla | hi :) | 17:47 |
| ildikov | knikolla: I'm trying to find people to help out with adding more tests to this one: https://github.com/openstack/keystone-tempest-plugin/ | 17:47 |
| ildikov | the plan is still to work together with the OPNFV team, but they also have limited resources and could help more on the test environment side | 17:47 |
| ildikov | I got told that you know most about the Tempest plugin and federation test plans there :) | 17:48 |
| ildikov | so I wanted to ask if there's any roadmap or further ideas on what would be the next to add there? | 17:48 |
| knikolla | ildikov: sure, currently there some federation testing in there. | 17:49 |
| lbragstad | jeremyfreudberg: i believe that is a list populated by context | 17:49 |
| knikolla | It uses the external testshib.org service to test SAML2 | 17:49 |
| ildikov | ok, that's a little further from my testing expertise :) | 17:49 |
| lbragstad | it could be that the list is being populated because the user has 'admin' and 'member' role assignments, which could be getting expanded 'admin' -> 'admin', 'member', 'reader' and 'member' -> 'member', 'reader' | 17:50 |
| knikolla | There's no keystone to keystone federation testing yet (although i had an intern who worked on the tests for that at some point, so I might be able to find and resurrect the code as a starting point) | 17:50 |
| lbragstad | meaning the result would be 'admin', 'member', 'reader', 'member', 'reader' | 17:50 |
| ildikov | knikolla: that would be great | 17:50 |
| lbragstad | chances are role inheritance is playing a factor | 17:50 |
| lbragstad | cc hrybacki ^ | 17:51 |
| ildikov | knikolla: also, are the current tests running in any job right now? | 17:51 |
| ildikov | knikolla: if you can dig up at least the plans on test cases that would already help | 17:51 |
| knikolla | ildikov: yes, the federation test is running on the keystone-dsvm-functional-v3-only job | 17:52 |
| knikolla | ildikov: there's a spec on that, lemme fetch it :) | 17:52 |
| ildikov | knikolla: ok, cool | 17:52 |
| jeremyfreudberg | lbragstad: thanks, and that makes sense. i'll have to dig a little deeper, then, to see how it interacts with my problem | 17:52 |
| ildikov | knikolla: that job is non-voting right now, right? | 17:53 |
| knikolla | ildikov: this https://specs.openstack.org/openstack/keystone-specs/specs/keystone/ongoing/devstack-plugin.html is about the devstack plugin, but in the end there's a worklist | 17:53 |
| knikolla | ildikov: correct. | 17:53 |
| lbragstad | jeremyfreudberg: this looks like the keystone code that it responsible for that | 17:53 |
| lbragstad | https://git.openstack.org/cgit/openstack/keystone/tree/keystone/middleware/auth.py#n100 | 17:53 |
| knikolla | ildikov: since we depend on an external service, it wouldn't make sense to make it voting yet. | 17:53 |
| ildikov | knikolla: ah, I see | 17:54 |
| lbragstad | ayoung: when we validate a token that has implied roles, do we not remove duplicates? | 17:54 |
| ildikov | knikolla: are there plans to make the job voting? | 17:54 |
| ayoung | lbragstad, I thought we did | 17:54 |
| lbragstad | ayoung: check this out - http://logs.openstack.org/81/576081/1/check/sahara-tests-scenario/20379dc/controller/logs/screen-keystone.txt.gz#_Jun_18_10_50_26_678158 | 17:54 |
| ayoung | its a dictionary, I thought | 17:54 |
| lbragstad | ayoung: that's building the context object | 17:55 |
| ayoung | interesting | 17:55 |
| ildikov | knikolla: also is there any environment requirement that we should try to leverage the OPNFV labs for or we can do everything here and only the test cases are missing? | 17:55 |
| lbragstad | ayoung: which is populated here - https://git.openstack.org/cgit/openstack/keystone/tree/keystone/middleware/auth.py#n100 | 17:55 |
| lbragstad | but that logic is pretty straight forward | 17:55 |
| knikolla | ildikov: yes, we can make it voting when instead of using testshib.org, we set up some identity provider in the gate. | 17:55 |
| lbragstad | it looks like it's pulling duplicates from the token | 17:55 |
| knikolla | ildikov: I don't think. In the case of identity federation, you don't really need antyhing special in terms of resources. | 17:56 |
| lbragstad | jeremyfreudberg: do you know what role assignments that user has in that case? | 17:56 |
| knikolla | ildikov: more resources would probably make sense if we test scalability or smth like that. | 17:56 |
| ildikov | knikolla: ok, fair enough | 17:57 |
| ayoung | lbragstad, could be. But the de-dupe code should be the same as the cycles-detection code. Could the problem be that we have multiple roles and we missed the uniqueness constraint? | 17:57 |
| ildikov | knikolla: sure, I guess the job takes care of setting up two Keystones, etc | 17:57 |
| *** blake has joined #openstack-keystone | 17:57 | |
| lbragstad | ayoung: multiple roles as in defined more that once in the backend? | 17:58 |
| jeremyfreudberg | lbragstad: not sure exactly, tosky could know better, but i think that user is whatever admin user devstack makes | 17:58 |
| ildikov | knikolla: I'm not super familiar with identity providers, is there any openly available we could set up? | 17:58 |
| ayoung | lbragstad, I don't have the liberty to look right now | 17:58 |
| lbragstad | ayoung: thats fine, just curious in what sense you meant multiple | 17:59 |
| knikolla | ildikov: here, k2k tests on a tempest fork from 2 years ago https://github.com/wjdanalharthi/tempest/blob/k2k/tempest/api/identity/v3/test_k2k_tokens.py | 18:00 |
| knikolla | ildikov: keystone itself can act like one when doing keystone to keystone :) | 18:00 |
| *** dklyle has quit IRC | 18:00 | |
| ildikov | knikolla: I know it can, but we also want to test it with a separate identity provider, hence my question :) | 18:01 |
| knikolla | ha, she's probably mad i haven't pushed those upstream since 2 years ago :) | 18:01 |
| ildikov | I guess by now those are more references on what would need to be tested | 18:01 |
| * hrybacki reads up | 18:01 | |
| ildikov | and are also free to be re-used as much as possible? | 18:02 |
| knikolla | ildikov: they should probably still work fine, the API interface is the same | 18:02 |
| knikolla | ildikov: there are a few, shibboleth, keycloak, ipsilon, etc. | 18:02 |
| ildikov | ok, that overall sounds good | 18:03 |
| ildikov | so as for the OPNFV collaboration, we should look into other topics as opposed to the Keystone federation testing, if I understand correctly? | 18:03 |
| lbragstad | jeremyfreudberg: if i use the admin user provided by devstack and execute that same code path, i get this http://paste.openstack.org/raw/723734/ | 18:03 |
| lbragstad | which doesn't contain duplicates | 18:04 |
| knikolla | ildikov: what is it they want to get out of the collaboration? | 18:04 |
| knikolla | so we can find something that makes sense for both of us | 18:05 |
| jeremyfreudberg | lbragstad: it may be the sahara service user, then | 18:05 |
| knikolla | jeremyfreudberg: if you're still stuck by 3pm, ping me and we can do some high bandwidth debugging. | 18:06 |
| jeremyfreudberg | knikolla: thanks | 18:06 |
| jeremyfreudberg | lbragstad: don't quote me on that yet | 18:06 |
| lbragstad | it is a trust token | 18:07 |
| hrybacki | okay, caught up now lbragstad | 18:07 |
| ildikov | knikolla: they are looking into edge scenarios where Keystone has an important role and would like to help out in areas where it makes sense | 18:08 |
| lbragstad | hrybacki: we're trying to nail down a problem with duplicate roles while building the context object | 18:08 |
| hrybacki | fun times | 18:08 |
| ildikov | knikolla: and as OPNFV is mainly an integration and test project testing seemed like a good idea and when we didn't know that there's already some federation testing we thought to start with that | 18:08 |
| lbragstad | not sure if that is contributing to sahara's problem, but seems odd to do regardless | 18:08 |
| knikolla | ildikov: i think scenario is the keyword here. As in have a deployment which as closely resembles what they're trying to deploy, and test that. | 18:09 |
| knikolla | ildikov: i agree that simple tests may be the way to start and then make our way up from there. | 18:09 |
| ildikov | knikolla: but if there's anything else in mind that's connecting and as you say would be beneficial for both of us, it would be great to do that | 18:09 |
| knikolla | as it also helps with familiarizing with the infrastructure. | 18:09 |
| *** r-daneel has quit IRC | 18:09 | |
| *** r-daneel has joined #openstack-keystone | 18:10 | |
| ildikov | knikolla: do you mean to setup the federation testing there too and then make variations with different scenraios? | 18:10 |
| ildikov | *scenarios | 18:10 |
| knikolla | ildikov: yes. that would be one idea. | 18:11 |
| knikolla | ildikov: some time ago I was working on setting up keystone to keystone on the job, https://review.openstack.org/#/c/484121/ but haven't had time to finish it up and not sure when i'll have time to | 18:12 |
| hrybacki | lbragstad: how can I assist you at this stage? | 18:13 |
| knikolla | that might be a starting point on how to setup keystone to keystone in the job, and I also previously linked to k2k tests for reference. | 18:13 |
| knikolla | that should be a good starting point | 18:13 |
| knikolla | and then once those are done, they could probably also be used separate of the job, in their own environment. | 18:13 |
| ildikov | knikolla: ok, I got a little confused now, what is the current non-voting job doing? | 18:14 |
| ildikov | knikolla: and what's this patch doing? | 18:14 |
| ildikov | knikolla: if it's all in that spec, I can do my reading :) | 18:14 |
| jeremyfreudberg | lbragstad: it's a trust token, where the trustor is the devstack admin user, and the trustee is heat | 18:14 |
| ildikov | knikolla: BTW, would you be available on this week's or next week's OPNFV Edge Cloud call to talk this through? | 18:15 |
| knikolla | ildikov: i think the spec touches upon that. if you have more questions i feel free to ping me at anytime. | 18:15 |
| knikolla | ildikov: tomorrow right? | 18:15 |
| ildikov | knikolla: tomorrow is the Edge Computing Group call which is under our umbrella, the OPNFV one is supposed to be on Wednesday at 1300 UTC, but I will double check | 18:17 |
| *** dave-mccowan has joined #openstack-keystone | 18:17 | |
| ildikov | knikolla: I would like to help the OPNFV guys to get some initial thoughts on testing on their side, but I'm very far from being an expert and fail pretty early to answer questions :/ :) | 18:17 |
| knikolla | ildikov: yeah, i can make wednesday 1300 UTC | 18:18 |
| knikolla | send me a calendar invite | 18:18 |
| ildikov | knikolla: I need to double check, it may be next week as there were some changes due to a few recent events, etc | 18:21 |
| ildikov | knikolla: I will let you know once I figured it out whether it's this week or next week :) | 18:21 |
| knikolla | ildikov: ok sure, no prob | 18:22 |
| ildikov | knikolla: I might also come back with more people/questions shortly :) | 18:22 |
| ildikov | knikolla: thanks for all the pointers! | 18:22 |
| knikolla | ildikov: you know where to find me :) | 18:22 |
| ildikov | knikolla: sure do, thanks! :) | 18:22 |
| *** jroll has quit IRC | 18:24 | |
| *** jroll has joined #openstack-keystone | 18:24 | |
| *** pcaruana has joined #openstack-keystone | 18:25 | |
| *** dklyle has joined #openstack-keystone | 18:26 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 18:32 | |
| *** AlexeyAbashkin has quit IRC | 18:35 | |
| lbragstad | jeremyfreudberg: hmm - i wonder if i can recreate that locally | 18:37 |
| lbragstad | hrybacki: i'm not sure, just a heads up i guess (sorry for the rogue ping) | 18:38 |
| hrybacki | lbragstad: no worries -- I've got an eye on this channel. Let me know if you hit a spot that needs additional eyes | 18:38 |
| lbragstad | but we might need a patch to remove duplicates depending on what comes out of the trust + implied roles bit | 18:38 |
| *** AlexeyAbashkin has joined #openstack-keystone | 18:38 | |
| jeremyfreudberg | lbragstad: in the meantime i'm going to try switching in the sahara gate to a user with "less" roles | 18:39 |
| *** pcaruana has quit IRC | 18:39 | |
| jeremyfreudberg | it may help my problem, anyway | 18:39 |
| hrybacki | ack. Once we get these initial bumps knocked out I think the next will come from 'unexpected' role implications | 18:39 |
| *** AlexeyAbashkin has quit IRC | 18:45 | |
| *** jmlowe has quit IRC | 18:50 | |
| openstackgerrit | Gage Hugo proposed openstack/python-keystoneclient master: WIP - Remove keystoneclient session https://review.openstack.org/527800 | 18:52 |
| *** blake_ has joined #openstack-keystone | 19:00 | |
| *** blake has quit IRC | 19:02 | |
| *** aojea has joined #openstack-keystone | 19:09 | |
| *** jmlowe has joined #openstack-keystone | 19:11 | |
| *** blake_ is now known as blake | 19:11 | |
| hrybacki | going for longest time since a rebase award gagehugo ? :P | 19:12 |
| gagehugo | hrybacki yes | 19:13 |
| gagehugo | also the logs links were long dead | 19:13 |
| hrybacki | nailed it haha | 19:13 |
| *** aojea has quit IRC | 19:13 | |
| *** blake has quit IRC | 19:20 | |
| lbragstad | jeremyfreudberg: i've created a user, a trust, assigned the user and the trustor additional roles, but i can't get the context to duplicate roles like in the sahara gate | 19:21 |
| lbragstad | i was able to recreate the circular reference bit though - http://paste.openstack.org/raw/723743/ | 19:22 |
| lbragstad | but it never prevented me from actually doing what i wanted to | 19:23 |
| jeremyfreudberg | lbragstad: i don't think the circular reference bit is relevant in the sahara case either, just by doing some timestamp comparisons | 19:24 |
| lbragstad | that error is present for me when a user has a duplicate role assignment via the implied role | 19:24 |
| lbragstad | if user admin has member and admin on the admin project, i can create a trust for another user and do things as the admin user, which throws that error, but it doesn't actually prevent me from doing anything | 19:25 |
| lbragstad | looks like it's more of a thing for operators to cleanu p | 19:25 |
| jeremyfreudberg | lbragstad: "that error" is the circular reference thing? | 19:26 |
| *** lifeless has joined #openstack-keystone | 19:26 | |
| lbragstad | i see the circular reference error in the logs, but it doesn't prevent me from doing anything as the user with a circular role reference | 19:26 |
| lbragstad | (circular also seems to be the wrong term in this case, but i'm not sure about the history) | 19:27 |
| lbragstad | i guess what i'm saying is that i doubt it's actually causing problems and it may just be a red herring or false positive | 19:27 |
| lbragstad | the 409 might be causing the real issues | 19:29 |
| larsks | knikolla: if you're around, remind me how to find the url for the --remote-id argument? | 19:29 |
| jeremyfreudberg | lbragstad: i still need to do some more experimenting i guess... i tried https://review.openstack.org/#/c/576231/ but actually it didn't turn out the way i thought it would | 19:33 |
| jeremyfreudberg | lbragstad: although, wouldn't duplicates in the role cause havoc with role id being the primary key of the trust_role table? | 19:35 |
| jeremyfreudberg | duplicates in the role list, i mean | 19:35 |
| *** edmondsw has quit IRC | 19:39 | |
| lbragstad | kmalloc: did you see wxy's follow up on https://review.openstack.org/#/c/559552/17 ? | 19:42 |
| knikolla | larsks: issuer in https://sso.massopen.cloud/auth/realms/moc/.well-known/openid-configuration | 19:43 |
| larsks | knikolla: thanks, I thought that might be it. | 19:43 |
| *** germs is now known as GotOneHandCutOff | 19:50 | |
| *** GotOneHandCutOff is now known as germs | 19:50 | |
| kmalloc | On my list in the next few minutes | 19:53 |
| lbragstad | awesome | 19:54 |
| jeremyfreudberg | lbragstad: i'm bad at explaining it, but it is possible that we get duplicate role names with a "trust on top of a trust"? | 19:56 |
| lbragstad | can you define the "on top of" part a little more? | 19:58 |
| jeremyfreudberg | sahara itself creates a trust to manage a "cluster"; one of underlying resources of that cluster is a heat stack; heat creates a trust where the old trust is trustor and heat is trustee | 20:00 |
| lbragstad | who are the actors in the first trust? | 20:05 |
| kmalloc | ayoung: roles (names) are not unique by design (not my design, but by design) | 20:05 |
| jeremyfreudberg | lbragstad: in the first trust, whoever uses sahara is the trustor and the sahara service user is trustee | 20:08 |
| *** felipemonteiro_ has quit IRC | 20:08 | |
| *** felipemonteiro__ has joined #openstack-keystone | 20:08 | |
| lbragstad | ah | 20:09 |
| lbragstad | and the second trust is between sahara and heat? | 20:09 |
| lbragstad | or the user and heat? | 20:09 |
| jeremyfreudberg | the second trust appears to be the user and heat | 20:10 |
| jeremyfreudberg | (i don't know the details of how keystone works though: is it possible for the trustor of the second trust to be an impersonator?) | 20:11 |
| lbragstad | impersonation is where the trustee assumes the identity of the trustor | 20:11 |
| *** dave-mccowan has quit IRC | 20:12 | |
| jeremyfreudberg | what i mean to ask is, can the second trust really be between sahara pretending to be the user, and heat | 20:12 |
| kmalloc | lbragstad: +2 on wxy's patch update. we need indexes still and/or dropping the weird FK bits, but this is a good update and should land | 20:13 |
| lbragstad | kmalloc: ++ thanks, we should be able to start gating the clients patches, too | 20:13 |
| lbragstad | jeremyfreudberg: that's a good question | 20:14 |
| kmalloc | lbragstad: i'll spin up a patch for a new SQL_Base that errors if someone does a PK that isn't an auto-inc int UNLESS they set a special flag | 20:14 |
| kmalloc | lbragstad: so we can be more likely to catch these things. | 20:14 |
| lbragstad | i've never run into a case like that | 20:14 |
| lbragstad | kmalloc: sounds good | 20:14 |
| kmalloc | jeremyfreudberg: the only case that can be is with impersonation and... i think broken code. | 20:15 |
| *** dave-mccowan has joined #openstack-keystone | 20:15 | |
| kmalloc | afaik you can't chain trusts together in any way, if you can, that is a security bug. | 20:15 |
| kmalloc | you may have a non-impersonation trust for User->(OtherUser, Roles on Project), you may not have a User->(OtherUser->(SomeOtherUser, Roles on Project)) | 20:16 |
| kmalloc | or any variation thereof. | 20:16 |
| kmalloc | basically, trust auth is Trustee to Trustor *only*. | 20:17 |
| kmalloc | if you have it wrapped deeper than that, we have a bug that should be closed. | 20:17 |
| jeremyfreudberg | kmalloc / lbragstad : i might not actually be chaining them (need to consult the other sahara devs to understand that part) but it does seem like a way to explain how extra role entries seem to accumulate | 20:17 |
| *** aojea has joined #openstack-keystone | 20:17 | |
| kmalloc | and this isn't using implied roles? | 20:18 |
| kmalloc | because that can easily cause expansion to *other* roles | 20:18 |
| kmalloc | (though, if there are duplicates we should just set([role_list]) | 20:18 |
| jeremyfreudberg | kmalloc: if it was simply implied roles (in this case, the roles implied from admin) then i would have thought lbragstad could have replicated my issue easily | 20:19 |
| kmalloc | ah | 20:19 |
| kmalloc | sorry i'm jumping in a bit late (missed scroll back) | 20:19 |
| jeremyfreudberg | i'd like to simply remove duplicates here: https://github.com/openstack/keystone/blob/abb0d552a1a6ce6af379a68111cce8c263da2a12/keystone/trust/backends/sql.py#L78 | 20:19 |
| jeremyfreudberg | but the underlying reason would still be great to uncover | 20:20 |
| kmalloc | i'm totally ok with making added_roles a set then casting it back to a list before storing | 20:20 |
| kmalloc | to solve the immediate issur | 20:20 |
| kmalloc | issue* | 20:20 |
| kmalloc | though you'd need to make it a not-dict being added, otherwise... | 20:21 |
| jeremyfreudberg | yes, it's a list of dicts | 20:21 |
| jeremyfreudberg | i can certainly do a quick fix like that and investigate deeper later | 20:21 |
| jeremyfreudberg | i have knikolla around to do my heavy lifting :) | 20:22 |
| knikolla | what did i miss? | 20:23 |
| jeremyfreudberg | knikolla: a repeat of last summer mostly, teaching me how trusts work | 20:23 |
| jeremyfreudberg | kmalloc / lbragstad : what about "redelegation"? | 20:23 |
| jeremyfreudberg | of trusts, i mean | 20:24 |
| lbragstad | redelegation is the act of using a trust to create another trust i think | 20:24 |
| kmalloc | so, something like: | 20:25 |
| lbragstad | thus - redelegating your access to someone else | 20:25 |
| kmalloc | https://www.irccloud.com/pastebin/b1sIOydU/ | 20:25 |
| jeremyfreudberg | i believe "redelegation" may more accurately describe the user-sahara-heat relationship | 20:25 |
| lbragstad | (e.g. kmalloc gives me admin on foo via a trust, then i give someone else admin on foo would be a count on redelegation) | 20:25 |
| kmalloc | lbragstad: ++ | 20:25 |
| lbragstad | kmalloc: did you see https://review.openstack.org/#/c/576025/1 yet? | 20:26 |
| kmalloc | lbragstad: looking | 20:26 |
| lbragstad | looks like wxy already has a patch up | 20:26 |
| kmalloc | yes. | 20:26 |
| kmalloc | i saw | 20:26 |
| lbragstad | oh - nice | 20:26 |
| kmalloc | it needs work, but that's why I added +2 to the other one | 20:26 |
| kmalloc | my concerns are WIP :) | 20:26 |
| lbragstad | ++ | 20:26 |
| kmalloc | jeremyfreudberg: so, it seems like it is sane to de-dupe roles | 20:27 |
| kmalloc | jeremyfreudberg: regardless | 20:27 |
| kmalloc | so, feel free to toss up a patch to apply that change ^ (see my irccloud pastebin), but before we land it we need to figure out how to test / cause the duplication. so in parallel we should build a test case that mirrors what you're doing | 20:28 |
| kmalloc | so we can try and duplicate and figure out wth is going on. | 20:28 |
| lbragstad | i still haven't been able to recreate, but adding a test case would be good | 20:29 |
| kmalloc | lbragstad: my thought is we build the patch then build a test and rebase the patch on the test with the fix. | 20:30 |
| lbragstad | that works | 20:30 |
| kmalloc | and land it all if we can figure out wth is happening. | 20:30 |
| kmalloc | but... ftr, it is probably good to de-dupe role ids there | 20:30 |
| kmalloc | afaict the only reason it is a list is becaue JSON doesn't handle sets. | 20:30 |
| kmalloc | that is clearly not intented to contain dupes. | 20:31 |
| jeremyfreudberg | kmalloc: ack, will do | 20:31 |
| jeremyfreudberg | is there anything already in the gate that tests redelegatable trusts? | 20:31 |
| lbragstad | keystone has a bunch of various tests for trusts | 20:32 |
| kmalloc | jeremyfreudberg: oh wait you'll need to also check if role['id'] not in added_roles: before doing session.add() | 20:32 |
| jeremyfreudberg | kmalloc: yep | 20:32 |
| kmalloc | jeremyfreudberg: we don't want to populate the DB with duplicated roles (though, that... shouldn't be possible) | 20:32 |
| jeremyfreudberg | kmalloc: populating the db with duplicated roles is what's throwing the 409 now | 20:32 |
| kmalloc | ah | 20:32 |
| jeremyfreudberg | so it's already unpossible | 20:33 |
| kmalloc | good. | 20:33 |
| kmalloc | that means we did good things in the db, but anyway, easy enough to de-dup on that input. weird that you're hitting it though | 20:33 |
| kmalloc | lbragstad: ugh... Had to reset my "days since last migraine" :( | 20:33 |
| kmalloc | lbragstad: saturday night... no pain, but clearly a migraine. | 20:33 |
| kmalloc | over 2 years without one. | 20:34 |
| lbragstad | damn... | 20:34 |
| kmalloc | *sigh* | 20:34 |
| kmalloc | it was so mild i almost didn't realize what it was | 20:34 |
| kmalloc | but sure as hell, nausea and aura/loss of vision in part of my eye. | 20:34 |
| kmalloc | s/hell/poo-but-less-friendly-word. | 20:35 |
| kmalloc | :P | 20:35 |
| lbragstad | that sucks | 20:36 |
| * kmalloc tries to keep irc chat PG rated at worst. | 20:36 | |
| kmalloc | ok | 20:40 |
| kmalloc | +A'd the limit schange | 20:40 |
| kmalloc | kicked it through to gate | 20:40 |
| kmalloc | i'm going to pull down the flask stuff, re-spin the "scaffolding" update and get @protected broken apart and limits ported to flask-native | 20:41 |
| lbragstad | sounds good | 20:41 |
| kmalloc | the only question i have is... how far up the stack can i push the enforce? | 20:41 |
| kmalloc | lbragstad: are we good with using assert in non-test code? | 20:42 |
| *** jeremyfreudberg has quit IRC | 20:42 | |
| kmalloc | because it *can* be turned off (just like in C) by invocation of the interpreter | 20:43 |
| kmalloc | so in theory we could only ever hit it in tests. | 20:43 |
| kmalloc | [which is fine by me] | 20:43 |
| lbragstad | assert as in the built-in? | 20:44 |
| kmalloc | yes | 20:44 |
| kmalloc | assert <context> enforce_called | 20:44 |
| kmalloc | assert <thread_local_context>.enforce_called | 20:45 |
| kmalloc | * | 20:45 |
| lbragstad | oh - that's not something we usually do | 20:45 |
| lbragstad | at least not from what i can find | 20:45 |
| kmalloc | i plan on making it automatic in all our flask-isms that unless a method is explicitly exempted (e.g. @unenforced_api) keystone errors | 20:45 |
| kmalloc | so it isn't possible to "oops, i didn't enforce a routed path" | 20:46 |
| kmalloc | you either explicitly exempt it, or you call enforce. | 20:46 |
| kmalloc | should prevent any test from ever succeeding on an unenforced api [that is ported to flask-nbative dispatching] | 20:47 |
| kmalloc | but for performance critical stuff someone could python -o and asserts are disabled. | 20:47 |
| lbragstad | so our authorization API could be disabled? | 20:48 |
| lbragstad | s/authorization API/authorization enforcement engine | 20:49 |
| kmalloc | no, just the "assert" that checks if we called enforce | 20:49 |
| kmalloc | basically developer tool. | 20:49 |
| lbragstad | oh | 20:49 |
| kmalloc | if you run with python -o, the only thing disabled is the assert | 20:50 |
| kmalloc | but the whole stack otherwise still calls enforce | 20:50 |
| lbragstad | ah | 20:50 |
| *** dave-mcc_ has joined #openstack-keystone | 20:52 | |
| kmalloc | oooh | 20:53 |
| kmalloc | interesting | 20:53 |
| *** dave-mccowan has quit IRC | 20:54 | |
| kmalloc | lbragstad: python -O = asserts disabled, python -OO = asserts disabled and docstrings eliminated | 20:55 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Add Flask-RESTful as a requirement https://review.openstack.org/574414 | 20:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Implement scaffolding for Flask-RESTful use https://review.openstack.org/574415 | 20:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Keystone adheres to public_endpoint opt only https://review.openstack.org/574502 | 20:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert json_home and version discovery to Flask https://review.openstack.org/574736 | 20:58 |
| kmalloc | lbragstad: ^ rebased | 20:58 |
| *** raildo has quit IRC | 21:00 | |
| *** martinus__ has quit IRC | 21:10 | |
| *** lifeless has quit IRC | 21:21 | |
| *** lifeless has joined #openstack-keystone | 21:22 | |
| *** spilla has quit IRC | 21:29 | |
| *** EmilienM is now known as EmilienM_PTO | 21:45 | |
| *** dklyle has quit IRC | 21:48 | |
| *** dklyle has joined #openstack-keystone | 21:50 | |
| kmalloc | lbragstad: what are the rules on translation again? | 21:55 |
| lbragstad | what do you mean? | 21:56 |
| *** jmlowe has quit IRC | 21:56 | |
| kmalloc | lbragstad: the use of _() and _LW() or whatever | 21:57 |
| kmalloc | what are the cases we are supposed to/not supposed to use those things | 21:57 |
| *** itlinux has quit IRC | 21:59 | |
| *** jmlowe has joined #openstack-keystone | 22:00 | |
| lbragstad | i didn't think there were specific cases to not use it - only for sensitive information i think | 22:00 |
| kmalloc | because it looks like we don't use _LW anymore? | 22:00 |
| kmalloc | or any of the other hints? | 22:00 |
| lbragstad | we do have a pattern where we translate things and then reuse them in exceptions that make it to end users | 22:00 |
| kmalloc | right. but the warning/error/crit hints seem to have disappeareD? | 22:01 |
| *** felipemonteiro_ has joined #openstack-keystone | 22:01 | |
| lbragstad | i'm failing to remember if that was an initiative of some sort | 22:02 |
| kmalloc | yeah... | 22:03 |
| * kmalloc goes over to -oslo and asks questions | 22:03 | |
| *** felipemonteiro__ has quit IRC | 22:05 | |
| kmalloc | ok | 22:05 |
| kmalloc | looks like | 22:05 |
| kmalloc | Starting with the Pike series, OpenStack no longer supports log translation. It is not necessary to add translation instructions to new code, and the instructions can be removed from old code. Refer to the email thread understanding log domain change on the openstack-dev mailing list for more details. | 22:05 |
| kmalloc | so... | 22:05 |
| kmalloc | just exceptions | 22:05 |
| lbragstad | ack | 22:05 |
| lbragstad | makes sense | 22:05 |
| *** jmlowe has quit IRC | 22:17 | |
| *** aojea has quit IRC | 22:17 | |
| *** felipemonteiro_ has quit IRC | 22:25 | |
| kmalloc | lbragstad: holy crap... @protected is a rabbithole | 22:25 |
| kmalloc | annnnd.... | 22:26 |
| kmalloc | it's spagetti code that is very very based in webob | 22:26 |
| *** jmlowe has joined #openstack-keystone | 22:29 | |
| kmalloc | oookay, this is going to take a lot more time =/ | 22:30 |
| kmalloc | going to dive back into it shortly but wow... | 22:30 |
| *** mvenesio has quit IRC | 22:31 | |
| *** lifeless_ has joined #openstack-keystone | 22:32 | |
| *** lifeless has quit IRC | 22:32 | |
| *** rcernin has joined #openstack-keystone | 22:36 | |
| *** boris_42_ has joined #openstack-keystone | 22:54 | |
| *** dklyle has quit IRC | 23:01 | |
| *** lifeless_ has quit IRC | 23:05 | |
| *** lifeless has joined #openstack-keystone | 23:06 | |
| *** r-daneel has quit IRC | 23:07 | |
| *** dave-mcc_ has quit IRC | 23:16 | |
| *** tosky has quit IRC | 23:20 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone master: [WIP] Implement auth receipts spec https://review.openstack.org/572286 | 23:41 |
| *** lifeless has quit IRC | 23:43 | |
| *** lifeless has joined #openstack-keystone | 23:46 | |
| *** felipemonteiro has joined #openstack-keystone | 23:48 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!