*** Midnightmyth has quit IRC | 00:17 | |
*** keving1 has joined #openstack-swift | 00:37 | |
*** keving1 has quit IRC | 00:46 | |
*** keving1 has joined #openstack-swift | 01:42 | |
*** keving1 has quit IRC | 01:51 | |
*** keving1 has joined #openstack-swift | 02:47 | |
*** keving1 has quit IRC | 02:55 | |
*** zouguangxian has joined #openstack-swift | 03:29 | |
*** zouguangxian has joined #openstack-swift | 03:29 | |
*** sileht has quit IRC | 04:00 | |
openstackgerrit | Peter Portante proposed a change to openstack/swift: In-process swift server for functional tests https://review.openstack.org/66108 | 04:21 |
---|---|---|
*** Diddi_ has quit IRC | 04:36 | |
*** sileht has joined #openstack-swift | 04:38 | |
*** sileht has quit IRC | 04:50 | |
*** sileht has joined #openstack-swift | 04:51 | |
*** sileht has quit IRC | 04:55 | |
*** keving1 has joined #openstack-swift | 04:57 | |
*** keving1 has quit IRC | 05:02 | |
*** sileht has joined #openstack-swift | 05:05 | |
*** sileht has quit IRC | 05:09 | |
*** chandan_kumar has joined #openstack-swift | 05:14 | |
*** sileht has joined #openstack-swift | 05:25 | |
*** keving1 has joined #openstack-swift | 05:27 | |
*** keving1 has quit IRC | 05:35 | |
*** sileht has quit IRC | 05:48 | |
*** changbl has quit IRC | 06:05 | |
*** keving1 has joined #openstack-swift | 06:32 | |
*** chandan_kumar has quit IRC | 06:34 | |
*** keving1 has quit IRC | 06:40 | |
*** keving1 has joined #openstack-swift | 07:37 | |
*** keving1 has quit IRC | 07:46 | |
*** sileht has joined #openstack-swift | 08:27 | |
*** keving1 has joined #openstack-swift | 08:42 | |
*** keving1 has quit IRC | 08:51 | |
*** mlipchuk has joined #openstack-swift | 09:20 | |
*** keving1 has joined #openstack-swift | 09:47 | |
*** keving1 has quit IRC | 09:56 | |
*** Midnightmyth has joined #openstack-swift | 10:18 | |
*** keving1 has joined #openstack-swift | 10:52 | |
*** keving1 has quit IRC | 11:01 | |
*** keving1 has joined #openstack-swift | 11:57 | |
*** keving1 has quit IRC | 12:06 | |
*** keving1 has joined #openstack-swift | 13:02 | |
*** zouguangxian has quit IRC | 13:11 | |
*** keving1 has quit IRC | 13:11 | |
*** thomaschaaf has joined #openstack-swift | 13:35 | |
*** keving1 has joined #openstack-swift | 14:07 | |
*** keving1 has quit IRC | 14:16 | |
*** bada has joined #openstack-swift | 14:39 | |
*** bada__ has quit IRC | 14:41 | |
thomaschaaf | I am currently getting a lot of "unauthorized" requests. I am using the tempauth. If I request an authentication token from proxy-server1 is it also good on proxy-server2? Both have a memcache server running on them and in the proxy configutation both are listed. Could this be the cause? | 14:51 |
*** keving1 has joined #openstack-swift | 15:12 | |
*** keving1 has quit IRC | 15:21 | |
*** changbl has joined #openstack-swift | 15:32 | |
*** jamieh has joined #openstack-swift | 15:38 | |
*** jamieh is now known as Guest4340 | 15:38 | |
hugokuo | thomaschaaf: The token suppose to be ok on both proxy severs. | 15:43 |
hugokuo | thomaschaaf: you can try to retrieve token for times. Does proxy return same token for you ? | 15:44 |
thomaschaaf | let me check | 15:44 |
thomaschaaf | yea I get the same key on both. | 15:46 |
thomaschaaf | I found out how to break it :) | 15:49 |
thomaschaaf | so if I have the 2 memcache servers and one restarts for some reason the tokens are out of sync for my user | 15:49 |
thomaschaaf | It seems that tempauth breaks in a way which is not good -.- | 15:54 |
thomaschaaf | maybe its that I am using 1.10 | 15:56 |
openstackgerrit | Clay Gerrard proposed a change to openstack/swift: Make object server agressive delete capable https://review.openstack.org/80749 | 16:09 |
*** mmcardle has joined #openstack-swift | 16:17 | |
*** keving1 has joined #openstack-swift | 16:17 | |
*** keving1 has quit IRC | 16:26 | |
*** mmcardle has quit IRC | 16:33 | |
thomaschaaf | I am trying to understand the code to be able to debug. Where in the code is x-storage-token or x-auth-token ever checked? (using tempauth) I cant find a place where the token is actually checked against the database. | 16:48 |
*** keving1 has joined #openstack-swift | 17:22 | |
*** keving1 has quit IRC | 17:31 | |
openstackgerrit | paul luse proposed a change to openstack/swift: Prevent object with storage policy mismatch from being updated in a container https://review.openstack.org/79731 | 17:32 |
*** Guest4340 has quit IRC | 17:55 | |
gholt | thomaschaaf: tempauth is a small example auth implementation not really meant for production use. Though I'd guess some would argue it is for production use, but I named it "temp" for a reason when I wrote it. ;) Either way, the tokens are validated against the tokens in memcache so yeah, if you restart a memcache node you'll lose whichever tokens were on that server and those users will need to reauthenticate to establish new t | 18:01 |
gholt | okens. | 18:01 |
*** mlipchuk has quit IRC | 18:03 | |
thomaschaaf | THank you gholt. Sadly I am experiencing a situation where even a reauthentication is giving me a bad token back. I am still trying to debug this though :( | 18:04 |
gholt | That's also how some other auth systems work, though I wouldn't doubt many keep a persistent backed store for their tokens as well as caching them for speed. | 18:04 |
gholt | Gotcha, a bad token returned is not fun to debug. :/ | 18:04 |
thomaschaaf | I am not quiet sure what advantages there are from giving back tokens for a password. | 18:05 |
thomaschaaf | The swift for us is an internal data store where we only have one user per environment (dev/stage/live) and I am thinking of naively implementing a simpler authentication for this usecase. | 18:06 |
gholt | Well, the general design was that the auth system that gives back the token is/could-be completely separate from swift and that you might not want to share the password with every service the auth system could let you use. | 18:07 |
thomaschaaf | I would understand that if they persisted like an oauth token. But as I understand it is rather proof of concept for this functionality? | 18:08 |
gholt | Yeah, tempauth was originally written just to have a test harness for swift to ensure it worked with the general design. It has since grown... | 18:08 |
gholt | Developers didn't want to have to install and configure all of Keystone just to work on Swift. | 18:09 |
thomaschaaf | I'd love to write a really simple auth. With do you think that would be of interesst to others? | 18:09 |
thomaschaaf | I am thinking of stripping all the memcache stuff and keep it in a file so that I can deploy it via puppet/chef. With non changing keys. | 18:11 |
gholt | Quite likely. However, I'd caution that anything to do with security seldom ends up really simple. :) | 18:11 |
gholt | The other you might go up against is existing tooling that expects the general design to be in use. But you might be able to fake all that out by giving the password/api-key back as the token when that first step is accomplished. | 18:13 |
thomaschaaf | ah that seems like a nice idea | 18:13 |
gholt | It would also be a bit humorous -- to me at least. :) "Hey, I need a token these credentials..." "Sure, here's your credentials you gave me." | 18:14 |
gholt | Memcache is also often used for speed, but I'm sure you could cache a small user database in memory yourself sourced from a static file on each proxy. Heheh | 18:15 |
gholt | Where you start to creep into non-simple (but still simple so far) is folks would probably want that static file to reload the in-memory database when the mtime changes or something similar. | 18:16 |
thomaschaaf | mtime being the time it expires? | 18:17 |
thomaschaaf | I'd really rather just not have anything expire. If I need to change passwords I'll have to rollout an update & restart the proxys. (still thinking a bit smaller) | 18:17 |
gholt | Oh, I meant the mtime of the file. In other words, to add a user you add them to the static file and push that out the all the proxies and they notice and reload their in-memory databases. | 18:17 |
thomaschaaf | I have only done this with watchdog | 18:18 |
thomaschaaf | would you periodically poll the file? | 18:19 |
gholt | But yeah, if it's just for your use and you don't mind a restart/reload of all your proxies on user database changes you can just skip all that. | 18:19 |
thomaschaaf | Or is there a native solution with less overhead than watchdog? | 18:19 |
gholt | Well, there's a similar concept in swift/common/container_sync_realms.py that auto-reloads the container sync realm data when its config file changes. Main plus is not having to restart/reload all your proxies for what is considered a simple change. | 18:21 |
gholt | And remember that a restart of a proxy will sever all ongoing connections, mid upload/download even. A reload will let the old connections gracefully finish. | 18:22 |
thomaschaaf | I'll try and get it so that one user can have two passwords so that if I want to change the password from a to b I can have both active while I deploy the software which uses swift. | 18:24 |
thomaschaaf | sorry for mistreating your code :D | 18:24 |
gholt | Haha, no problem. It started as my code for that specific purpose and has long since grown beyond my control. Always happens it seems. :) | 18:25 |
gholt | Worse yet, before Keystone I'd written Swauth and folks still use that so I try to keep it in working condition. Auth is such fun I don't recommend it to anyone. ;) | 18:27 |
*** keving1 has joined #openstack-swift | 18:27 | |
gholt | Well, that reads weird, I did *not* write Keystone. I think a committee was involved with that one. Hehe | 18:28 |
*** keving1 has quit IRC | 18:36 | |
thomaschaaf | gholt: do you think I should fork swift or create a new repository just for the auth? | 19:01 |
gholt | thomaschaaf: Usually a separate project is best for things like that. If you want to allow others to use it, they'd just install your package and configure your middleware in their existing Swift set up. | 19:08 |
thomaschaaf | I am not familiar with the python way of doing this should I just simlink to usr/lib/python2.7/dist-packages/swift/common/middleware | 19:09 |
thomaschaaf | or do you know a plugin with a good installation guide? Writing the file is no problem but I hate just having one file in my repo without a nice guide how to install | 19:10 |
gholt | Hmm. let me see if I can find a simple example out there. | 19:10 |
gholt | Oh, https://github.com/gholt/mempeek is pretty darn simple. | 19:11 |
gholt | It has no OS packaging though, that gets "advanced" kinda quick. For mempeek, you'd just clone a copy of the repository, run "python setup.py install" and then add the middleware to your pipeline in the proxy-server.conf | 19:12 |
gholt | https://github.com/dpgoetz/sos is a more full example of middleware (It's CDN integration middleware) that has packaging for Debian-based systems. | 19:13 |
gholt | The key starting point though is the entry point in setup.py such as https://github.com/gholt/mempeek/blob/master/setup.py#L13 | 19:15 |
gholt | Swift uses paste.deploy configs to set up middleware and that line defines the paste.deploy entry point that can be used. | 19:16 |
gholt | You can then put mempeek in your proxy-server.conf pipeline and add a section to that file something like: | 19:17 |
gholt | [filter:mempeek] | 19:17 |
gholt | use = egg:mempeek:mempeek | 19:17 |
gholt | ... | 19:17 |
gholt | Err, sorry: use = egg:mempeek#mempeek | 19:17 |
thomaschaaf | okay I will try this :) thank you for your help! | 19:17 |
gholt | Yeah, you've got a bit of a learning curve, but hey, a goal is the best way learn right? | 19:18 |
*** keving1 has joined #openstack-swift | 19:32 | |
*** mkollaro has joined #openstack-swift | 19:35 | |
*** keving1 has quit IRC | 19:41 | |
*** jamieh has joined #openstack-swift | 19:52 | |
*** jamieh is now known as Guest47530 | 19:53 | |
thomaschaaf | gholt: I just looked into the code further and as far as i understand https://github.com/openstack/swift/blob/master/swift/common/middleware/tempauth.py#L274 this would not require me to create a token | 20:19 |
gholt | thomaschaaf: Ah, that well could be. It has been a while since I looked at the Authorization header part of the code. That was for S3 integration as I recall, but it may have morphed since then. | 20:30 |
thomaschaaf | I am trying to get it to work that way. Then I don't need to look after another piece of code :) | 20:31 |
gholt | It sure looks like that part of the code is still using token though... the base64 line | 20:32 |
gholt | To be perfectly honest, I don't remember how the S3 and HTTP_AUHTORIZATION stuff in there works. I probably copied that code from the previous incarnation of tempauth after some guys had added an S3 compatibility layer. | 20:35 |
gholt | What I do know about S3's auth is that you have to sign each request independently, so it's even more user-active than just getting a single token for 24hr use. | 20:36 |
gholt | But this might be faking things in some other way that is less user burdensome, I just don't remember. :/ | 20:37 |
*** keving1 has joined #openstack-swift | 20:37 | |
*** keving1 has quit IRC | 20:46 | |
*** dosaboy_ has joined #openstack-swift | 20:59 | |
*** bvandenh has quit IRC | 21:19 | |
*** dosaboy has quit IRC | 21:21 | |
*** Guest47530 has quit IRC | 21:21 | |
*** bvandenh has joined #openstack-swift | 21:21 | |
*** keving1 has joined #openstack-swift | 21:42 | |
*** keving1 has quit IRC | 21:51 | |
*** thomaschaaf has quit IRC | 22:05 | |
*** acoles- has quit IRC | 22:43 | |
*** haomaiw__ has quit IRC | 22:43 | |
*** j_king_ has quit IRC | 22:43 | |
*** mtreinish has quit IRC | 22:43 | |
*** CrackerJackMack has quit IRC | 22:43 | |
*** sudorandom has quit IRC | 22:43 | |
*** wer has quit IRC | 22:43 | |
*** chmouel has quit IRC | 22:43 | |
*** zackmdavis has quit IRC | 22:43 | |
*** zanc_ has quit IRC | 22:43 | |
*** ondergetekende has quit IRC | 22:43 | |
*** bvandenh has quit IRC | 22:43 | |
*** changbl has quit IRC | 22:43 | |
*** Midnightmyth has quit IRC | 22:43 | |
*** mkerrin1 has quit IRC | 22:43 | |
*** wkelly has quit IRC | 22:43 | |
*** pandemicsyn has quit IRC | 22:43 | |
*** EmilienM has quit IRC | 22:43 | |
*** tristanC has quit IRC | 22:43 | |
*** pconstantine_ has quit IRC | 22:43 | |
*** omame has quit IRC | 22:43 | |
*** bsdkurt has quit IRC | 22:43 | |
*** occupant has quit IRC | 22:43 | |
*** sileht has quit IRC | 22:43 | |
*** gholt has quit IRC | 22:43 | |
*** dosaboy_ has quit IRC | 22:43 | |
*** mkollaro has quit IRC | 22:43 | |
*** ccorrigan has quit IRC | 22:43 | |
*** Guest56062 has quit IRC | 22:43 | |
*** sfineberg has quit IRC | 22:43 | |
*** saschpe has quit IRC | 22:43 | |
*** swifterdarrell has quit IRC | 22:43 | |
*** clarkb has quit IRC | 22:43 | |
*** peluse has quit IRC | 22:43 | |
*** openstackgerrit has quit IRC | 22:43 | |
*** otherjon has quit IRC | 22:43 | |
*** mandarine has quit IRC | 22:43 | |
*** grapsus__ has quit IRC | 22:43 | |
*** joearnold has quit IRC | 22:43 | |
*** Alex_Gaynor has quit IRC | 22:43 | |
*** krtaylor has quit IRC | 22:43 | |
*** wayneeseguin has quit IRC | 22:43 | |
*** pberis has quit IRC | 22:43 | |
*** fbo has quit IRC | 22:43 | |
*** yuan has quit IRC | 22:43 | |
*** booi has quit IRC | 22:43 | |
*** jeblair has quit IRC | 22:43 | |
*** acorwin has quit IRC | 22:43 | |
*** tanee-away has quit IRC | 22:43 | |
*** early has quit IRC | 22:43 | |
*** redbo has quit IRC | 22:43 | |
*** notmyname has quit IRC | 22:43 | |
*** MooingLemur has quit IRC | 22:43 | |
*** rahmu has quit IRC | 22:43 | |
*** torgomatic has quit IRC | 22:43 | |
*** minnear has quit IRC | 22:43 | |
*** glange has quit IRC | 22:43 | |
*** jogo has quit IRC | 22:43 | |
*** hugokuo has quit IRC | 22:43 | |
*** ctennis has quit IRC | 22:43 | |
*** anderstj has quit IRC | 22:43 | |
*** alpha_ori has quit IRC | 22:43 | |
*** ryao has quit IRC | 22:43 | |
*** anticw has quit IRC | 22:43 | |
*** dfg has quit IRC | 22:43 | |
*** mordred has quit IRC | 22:43 | |
*** kragniz has quit IRC | 22:43 | |
*** swills has quit IRC | 22:43 | |
*** zigo has quit IRC | 22:43 | |
*** Anticimex has quit IRC | 22:43 | |
*** StevenK has quit IRC | 22:43 | |
*** creiht has quit IRC | 22:43 | |
*** mhu has quit IRC | 22:43 | |
*** russellb has quit IRC | 22:43 | |
*** greghaynes has quit IRC | 22:43 | |
*** ChanServ has quit IRC | 22:43 | |
*** briancline has quit IRC | 22:43 | |
*** akscram has quit IRC | 22:43 | |
*** rturk-away has quit IRC | 22:43 | |
*** Anju1 has quit IRC | 22:43 | |
*** ekarlso has quit IRC | 22:43 | |
*** JelleB has quit IRC | 22:43 | |
*** mlanner has quit IRC | 22:43 | |
*** amandap has quit IRC | 22:43 | |
*** therve has quit IRC | 22:43 | |
*** portante has quit IRC | 22:43 | |
*** luisbg has quit IRC | 22:43 | |
*** ahale has quit IRC | 22:43 | |
*** rpedde has quit IRC | 22:43 | |
*** clayg has quit IRC | 22:43 | |
*** bvandenh has joined #openstack-swift | 22:45 | |
*** dosaboy_ has joined #openstack-swift | 22:45 | |
*** mkollaro has joined #openstack-swift | 22:45 | |
*** changbl has joined #openstack-swift | 22:45 | |
*** Midnightmyth has joined #openstack-swift | 22:45 | |
*** sileht has joined #openstack-swift | 22:45 | |
*** peluse has joined #openstack-swift | 22:45 | |
*** openstackgerrit has joined #openstack-swift | 22:45 | |
*** Alex_Gaynor has joined #openstack-swift | 22:45 | |
*** krtaylor has joined #openstack-swift | 22:45 | |
*** ondergetekende has joined #openstack-swift | 22:45 | |
*** acoles- has joined #openstack-swift | 22:45 | |
*** mkerrin1 has joined #openstack-swift | 22:45 | |
*** wkelly has joined #openstack-swift | 22:45 | |
*** haomaiw__ has joined #openstack-swift | 22:45 | |
*** pandemicsyn has joined #openstack-swift | 22:45 | |
*** EmilienM has joined #openstack-swift | 22:45 | |
*** tristanC has joined #openstack-swift | 22:45 | |
*** j_king_ has joined #openstack-swift | 22:45 | |
*** pconstantine_ has joined #openstack-swift | 22:45 | |
*** omame has joined #openstack-swift | 22:45 | |
*** mtreinish has joined #openstack-swift | 22:45 | |
*** bsdkurt has joined #openstack-swift | 22:45 | |
*** CrackerJackMack has joined #openstack-swift | 22:45 | |
*** sudorandom has joined #openstack-swift | 22:45 | |
*** ccorrigan has joined #openstack-swift | 22:45 | |
*** wer has joined #openstack-swift | 22:45 | |
*** briancline has joined #openstack-swift | 22:45 | |
*** akscram has joined #openstack-swift | 22:45 | |
*** swills has joined #openstack-swift | 22:45 | |
*** zigo has joined #openstack-swift | 22:45 | |
*** rturk-away has joined #openstack-swift | 22:45 | |
*** Anticimex has joined #openstack-swift | 22:45 | |
*** StevenK has joined #openstack-swift | 22:45 | |
*** creiht has joined #openstack-swift | 22:45 | |
*** Anju1 has joined #openstack-swift | 22:45 | |
*** mhu has joined #openstack-swift | 22:45 | |
*** occupant has joined #openstack-swift | 22:45 | |
*** chmouel has joined #openstack-swift | 22:45 | |
*** wayneeseguin has joined #openstack-swift | 22:45 | |
*** russellb has joined #openstack-swift | 22:45 | |
*** zackmdavis has joined #openstack-swift | 22:45 | |
*** pberis has joined #openstack-swift | 22:45 | |
*** Guest56062 has joined #openstack-swift | 22:45 | |
*** greghaynes has joined #openstack-swift | 22:45 | |
*** fbo has joined #openstack-swift | 22:45 | |
*** dickson.freenode.net sets mode: +v creiht | 22:45 | |
*** zanc_ has joined #openstack-swift | 22:45 | |
*** yuan has joined #openstack-swift | 22:45 | |
*** booi has joined #openstack-swift | 22:45 | |
*** jeblair has joined #openstack-swift | 22:45 | |
*** gholt has joined #openstack-swift | 22:45 | |
*** otherjon has joined #openstack-swift | 22:45 | |
*** sfineberg has joined #openstack-swift | 22:45 | |
*** acorwin has joined #openstack-swift | 22:45 | |
*** tanee-away has joined #openstack-swift | 22:45 | |
*** saschpe has joined #openstack-swift | 22:45 | |
*** swifterdarrell has joined #openstack-swift | 22:45 | |
*** mandarine has joined #openstack-swift | 22:45 | |
*** jogo has joined #openstack-swift | 22:45 | |
*** early has joined #openstack-swift | 22:45 | |
*** grapsus__ has joined #openstack-swift | 22:45 | |
*** redbo has joined #openstack-swift | 22:45 | |
*** ekarlso has joined #openstack-swift | 22:45 | |
*** clarkb has joined #openstack-swift | 22:45 | |
*** JelleB has joined #openstack-swift | 22:45 | |
*** notmyname has joined #openstack-swift | 22:45 | |
*** dickson.freenode.net sets mode: +vvvv gholt swifterdarrell redbo notmyname | 22:45 | |
*** MooingLemur has joined #openstack-swift | 22:45 | |
*** mlanner has joined #openstack-swift | 22:45 | |
*** amandap has joined #openstack-swift | 22:45 | |
*** therve has joined #openstack-swift | 22:45 | |
*** joearnold has joined #openstack-swift | 22:45 | |
*** rahmu has joined #openstack-swift | 22:45 | |
*** torgomatic has joined #openstack-swift | 22:45 | |
*** minnear has joined #openstack-swift | 22:45 | |
*** glange has joined #openstack-swift | 22:45 | |
*** hugokuo has joined #openstack-swift | 22:45 | |
*** ctennis has joined #openstack-swift | 22:45 | |
*** anderstj has joined #openstack-swift | 22:45 | |
*** alpha_ori has joined #openstack-swift | 22:45 | |
*** portante has joined #openstack-swift | 22:45 | |
*** ryao has joined #openstack-swift | 22:45 | |
*** anticw has joined #openstack-swift | 22:45 | |
*** dfg has joined #openstack-swift | 22:45 | |
*** dickson.freenode.net sets mode: +vvvv torgomatic glange portante dfg | 22:45 | |
*** mordred has joined #openstack-swift | 22:45 | |
*** kragniz has joined #openstack-swift | 22:45 | |
*** luisbg has joined #openstack-swift | 22:45 | |
*** ahale has joined #openstack-swift | 22:45 | |
*** rpedde has joined #openstack-swift | 22:45 | |
*** ChanServ has joined #openstack-swift | 22:45 | |
*** clayg has joined #openstack-swift | 22:45 | |
*** dickson.freenode.net sets mode: +ov ChanServ clayg | 22:45 | |
*** keving1 has joined #openstack-swift | 22:47 | |
*** mkollaro has quit IRC | 22:55 | |
*** keving1 has quit IRC | 22:57 | |
*** sungju has joined #openstack-swift | 23:08 | |
*** mlipchuk has joined #openstack-swift | 23:11 | |
*** fifieldt has joined #openstack-swift | 23:16 | |
*** h6w has joined #openstack-swift | 23:28 | |
h6w | Morning all! | 23:42 |
h6w | Is there a ca_file option in /etc/swift/proxy-server.conf or perhaps a ca_bundle? | 23:43 |
*** keving1 has joined #openstack-swift | 23:52 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!