| *** marcoemorais has quit IRC | 00:05 | |
| *** nkinder has joined #openstack-keystone | 00:05 | |
| *** browne has quit IRC | 00:05 | |
| *** derek_c has joined #openstack-keystone | 00:14 | |
| openstackgerrit | A change was merged to openstack/keystone: Correct `nullable` values in models and migrations https://review.openstack.org/84446 | 00:25 |
|---|---|---|
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Compressed Signature and Validation https://review.openstack.org/71181 | 00:25 |
| *** praneshp has quit IRC | 00:31 | |
| *** richm has quit IRC | 00:33 | |
| openstackgerrit | A change was merged to openstack/keystone: Redundant unique constraint https://review.openstack.org/84447 | 00:43 |
| openstackgerrit | A change was merged to openstack/keystone: Migration DB_INIT_VERSION in common place https://review.openstack.org/88016 | 00:43 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Set proper DB_INIT_VERSION on db_version command https://review.openstack.org/91123 | 00:47 |
| *** theocean154 has joined #openstack-keystone | 01:00 | |
| *** daneyon has quit IRC | 01:16 | |
| *** theocean154 is now known as theocean154_zzZZ | 01:23 | |
| *** david-lyle has joined #openstack-keystone | 01:32 | |
| *** Daviey has quit IRC | 01:33 | |
| *** theocean154_zzZZ is now known as theocean154 | 01:43 | |
| *** david-lyle has quit IRC | 01:57 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Add endpoint handling to Token/Endpoint auth https://review.openstack.org/91216 | 02:03 |
| *** diegows has quit IRC | 02:11 | |
| *** zhiyan_ is now known as zhiyan | 02:12 | |
| *** mberlin has joined #openstack-keystone | 02:20 | |
| *** mberlin1 has quit IRC | 02:21 | |
| *** harlowja is now known as harlowja_away | 02:27 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/91225 | 02:40 |
| *** praneshp has joined #openstack-keystone | 02:41 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/91240 | 02:46 |
| *** sbfox has quit IRC | 02:54 | |
| *** gyee has quit IRC | 02:55 | |
| *** dstanek is now known as dstanek_zzz | 02:59 | |
| *** dstanek_zzz is now known as dstanek | 03:00 | |
| *** sbfox has joined #openstack-keystone | 03:05 | |
| *** amcrn has joined #openstack-keystone | 03:07 | |
| *** RockKuo_Office has joined #openstack-keystone | 03:14 | |
| *** chandan_kumar has joined #openstack-keystone | 03:21 | |
| *** stevemar has joined #openstack-keystone | 03:30 | |
| *** chandan_kumar has quit IRC | 03:32 | |
| *** bach has joined #openstack-keystone | 03:34 | |
| *** stevemar has quit IRC | 03:43 | |
| *** chandan_kumar has joined #openstack-keystone | 03:51 | |
| *** shakamunyi has quit IRC | 04:05 | |
| *** praneshp has quit IRC | 04:17 | |
| *** praneshp_ has joined #openstack-keystone | 04:17 | |
| *** sbfox has quit IRC | 04:26 | |
| *** stevemar has joined #openstack-keystone | 04:41 | |
| *** sbfox has joined #openstack-keystone | 04:49 | |
| *** cp16net has left #openstack-keystone | 04:54 | |
| *** dstanek is now known as dstanek_zzz | 05:10 | |
| *** morganfainberg is now known as morganfainberg_Z | 05:10 | |
| *** zhiyan is now known as zhiyan_ | 05:20 | |
| *** bach has quit IRC | 05:20 | |
| *** dstanek_zzz is now known as dstanek | 05:31 | |
| *** dstanek is now known as dstanek_zzz | 05:40 | |
| *** dstanek_zzz is now known as dstanek | 05:49 | |
| *** amcrn has quit IRC | 05:54 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/90288 | 06:01 |
| marekd | dstanek: hi! | 06:22 |
| marekd | dstanek: still around? | 06:22 |
| marekd | stevemar: o/ you here? | 06:24 |
| stevemar | o/ | 06:24 |
| stevemar | hi | 06:24 |
| stevemar | marekd, ^ | 06:24 |
| marekd | i know it's lat in Canada so a quick thing. did you have a chance to read my question about migration scripts and mapping_id FKness? | 06:25 |
| marekd | stevemar: ^ | 06:25 |
| *** Chicago has joined #openstack-keystone | 06:25 | |
| *** Chicago has joined #openstack-keystone | 06:25 | |
| marekd | stevemar: to rephrase i was asking whether we are still allowed to play with 001_*, 002_* migration scripts and change them or we should leave them and add 003_* migration script that would alter protocols table and and make mapping_id a FK | 06:26 |
| stevemar | marekd, hmm, was it posted in this channel? can you repeat it? i don't recall reading it | 06:26 |
| stevemar | marekd, ah | 06:26 |
| stevemar | marekd, i think we are screwed | 06:26 |
| stevemar | marekd, we shouldn't alter 001_* or 002_* | 06:27 |
| marekd | ok | 06:27 |
| stevemar | and bknudson seemed very doubtful about adding a FK | 06:27 |
| marekd | stevemar: why?! | 06:27 |
| stevemar | since, if the user downgrades, what do you place in there? | 06:27 |
| marekd | hm, he reluctant to add a FK right now (because it was not added from the very begining) or in general? | 06:28 |
| stevemar | marekd, since it wasn't added from the beginning | 06:30 |
| marekd | oh maaaan ;/ i checked the patches history yesterday | 06:31 |
| marekd | and i saw bknudson was looking at nullness/fkness of that parameter | 06:31 |
| stevemar | :( | 06:32 |
| marekd | but since mappings and idps with protocols were added in different patches i think that was the reasong of not making mapping_id a fk from the beginning... | 06:32 |
| marekd | do you think it's worth spending few minutes and submit a patch as a starting point for kind of discussion? | 06:33 |
| marekd | i guess top contributors could got involved in that (dolph, morgan, dstanek, adam , bknudson ofc etc) | 06:33 |
| *** ukalifon has joined #openstack-keystone | 06:33 | |
| stevemar | marekd, couldn't hurt | 06:34 |
| marekd | stevemar: ok | 06:34 |
| stevemar | the upgrade path is easy | 06:34 |
| marekd | yep | 06:34 |
| marekd | stevemar: ok, thanks. | 06:36 |
| marekd | now, go to bed, i think it's like 2:30am? | 06:36 |
| stevemar | marekd, it is, but i'm learning about factory functions... and how i can use them to solve my import problem | 06:37 |
| *** dstanek is now known as dstanek_zzz | 06:46 | |
| marekd | stevemar: hmm, just pulled newest keystone master and the nullable patch went in... | 06:48 |
| stevemar | marekd, yes, it did | 06:49 |
| *** theocean154 has quit IRC | 06:53 | |
| *** skb has joined #openstack-keystone | 07:07 | |
| *** skb has left #openstack-keystone | 07:08 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Add request/access token and consumer support for keystoneclient https://review.openstack.org/81980 | 07:11 |
| *** ekarlso has joined #openstack-keystone | 07:17 | |
| stevemar | marekd, alright, now i'm out | 07:17 |
| stevemar | marekd, see you tomorrow / later today | 07:17 |
| marekd | stevemar: good night! | 07:18 |
| *** sbfox has quit IRC | 07:20 | |
| *** stevemar has quit IRC | 07:22 | |
| *** Daviey has joined #openstack-keystone | 07:25 | |
| *** amcrn has joined #openstack-keystone | 07:30 | |
| *** ThomasCrowe1 has quit IRC | 07:34 | |
| *** praneshp_ has quit IRC | 07:38 | |
| *** leseb has joined #openstack-keystone | 07:39 | |
| *** dstanek_zzz is now known as dstanek | 07:47 | |
| *** zigo_ is now known as zigo | 07:55 | |
| *** dstanek is now known as dstanek_zzz | 07:57 | |
| *** topol has joined #openstack-keystone | 08:05 | |
| *** topol has quit IRC | 08:06 | |
| *** topol has joined #openstack-keystone | 08:06 | |
| *** derek_c has quit IRC | 08:07 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Code which gets and deletes elements of tree was moved to one method https://review.openstack.org/86578 | 08:23 |
| *** theocean154 has joined #openstack-keystone | 08:30 | |
| *** theocean154 has quit IRC | 08:34 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Make FederationProtocolModel.mapping_id a FK https://review.openstack.org/91295 | 08:37 |
| *** topol has quit IRC | 09:01 | |
| *** sphoorti has joined #openstack-keystone | 09:09 | |
| sphoorti | Hello folks, I ran a test coverage command in python-keystoneclient. I get the error:- No handlers found for Logger. paste.openstack.org/show/77920. What possibly could be going wrong? | 09:12 |
| sphoorti | http://paste.openstack.org/show/77920 | 09:13 |
| sphoorti | And running the same command on /opt/stack/keystone leads to following error: - http://paste.openstack.org/show/77927. No changes have been made to any codebase. I am running the test commands on freshly cloned devstack | 09:30 |
| sphoorti | What could be going wrong ? | 09:30 |
| *** andreaf has joined #openstack-keystone | 09:30 | |
| *** leseb has quit IRC | 09:53 | |
| *** leseb has joined #openstack-keystone | 09:53 | |
| *** leseb has quit IRC | 09:58 | |
| *** theocean154 has joined #openstack-keystone | 10:19 | |
| *** theocean154 has quit IRC | 10:23 | |
| *** openstackgerrit has quit IRC | 10:51 | |
| *** leseb has joined #openstack-keystone | 10:53 | |
| *** leseb has quit IRC | 10:58 | |
| *** RockKuo_Office has quit IRC | 11:03 | |
| *** leseb has joined #openstack-keystone | 11:04 | |
| ukalifon | Hello. How can I find the list of protocols that federation can work with? I know that saml2 is supported but are there other protocols besides that one? | 11:05 |
| *** leseb has quit IRC | 11:08 | |
| *** tomoiaga has joined #openstack-keystone | 11:17 | |
| marekd | ukalifon: hi | 11:22 |
| marekd | ukalifon: currently this will be only saml | 11:22 |
| marekd | ukalifon: Is there any specific federation protocol you were looking for? | 11:24 |
| *** leseb has joined #openstack-keystone | 11:25 | |
| ukalifon | marekd: thanks for your reply. I am not looking for something specific, just looking to test the federation API and I don't currently have a saml provider... | 11:25 |
| marekd | ukalifon: ok, so I suggest sticking to the SAML2 for now :-) | 11:26 |
| marekd | ukalifon: besides, it's keystone who acts as a Service Provider | 11:26 |
| marekd | ukalifon: and if you don't have a working IdP you can try out testshib.org | 11:26 |
| marekd | testshib.org | 11:27 |
| marekd | as an Identity Provider | 11:27 |
| ukalifon | marekd: I will look into testshib, thanks. | 11:28 |
| marekd | there is ongoing review process for the federated-keystone documentation (https://review.openstack.org/#/c/89220/) and here you can find drafted 'tutorial' for setting up federated-keystone with testshib (http://goo.gl/Ahzwq6) | 11:29 |
| marekd | also feel free to ping me if you have any problems. | 11:30 |
| marekd | ukalifon: what tz are you? | 11:31 |
| ukalifon | GMT+2 | 11:31 |
| marekd | same for me. | 11:31 |
| * dolphm NEIGHBORS! | 11:35 | |
| marekd | dolphm: ? | 11:37 |
| dolphm | marekd: ukalifon and yourself | 11:37 |
| marekd | dolphm: yeah, very few stackers are in my tz :( | 11:37 |
| boris-42 | dolphm hi | 11:47 |
| boris-42 | dolphm could we speak about performance job in keystone | 11:50 |
| boris-42 | dolphm actually this one patch https://review.openstack.org/#/c/90404/ | 11:51 |
| dolphm | boris-42: lgtm | 11:56 |
| boris-42 | dolphm nice thanks | 11:59 |
| boris-42 | dolphm I will make some email to share common workflow how to work with rally in gates | 11:59 |
| boris-42 | dolphm I mean a better way to work on patches related to the performance | 12:00 |
| *** sphoorti has quit IRC | 12:02 | |
| gabriel-bezerra | marekd: is it possible to use federation with LDAP? Can Shibboleth's IdP use LDAP as a backend, for example? | 12:07 |
| *** theocean154 has joined #openstack-keystone | 12:07 | |
| marekd | gabriel-bezerra: hey. I think this is the most common way of federation configuration. but it's specific to IdP which is completely independent piece of software. | 12:08 |
| marekd | gabriel-bezerra: what we do with OpenStack is rather Service Provider side. | 12:09 |
| *** tomoiaga has left #openstack-keystone | 12:09 | |
| gabriel-bezerra | I got that. I was just wondering if it would be possible to integrate with LDAP in any way. | 12:11 |
| marekd | gabriel-bezerra: for sure. | 12:11 |
| *** theocean154 has quit IRC | 12:11 | |
| gabriel-bezerra | ..without having to change keystone's code | 12:12 |
| marekd | gabriel-bezerra: hm, wait. | 12:12 |
| rodrigods | anyone available to review https://blueprints.launchpad.net/python-keystoneclient/+spec/roles-assignment-support and https://blueprints.launchpad.net/python-openstackclient/+spec/roles-assignment-list? | 12:13 |
| marekd | gabriel-bezerra: normally, in a typical federation use-case keystone has nothing in common with IdP. | 12:13 |
| marekd | gabriel-bezerra: well ok, it does, but not directly. Keystone will communicate IdP via the SAML protocol. | 12:14 |
| marekd | gabriel-bezerra: but this is a matter of confguration, not changes in the code. | 12:15 |
| gabriel-bezerra | What I got is: Keystone[SP]<--->[IdP]Shibboleth---LDAP. | 12:15 |
| marekd | gabriel-bezerra: correct. | 12:16 |
| gabriel-bezerra | good | 12:16 |
| marekd | gabriel-bezerra: so now, Keystone[SP]<--->[IdP]Shibboleth happens via the SAML protocol. | 12:16 |
| gabriel-bezerra | right | 12:17 |
| *** erecio has joined #openstack-keystone | 12:20 | |
| gabriel-bezerra | just a beginners question: My change got a +2. What should happen now? https://review.openstack.org/90771 | 12:32 |
| *** erecio_1 has joined #openstack-keystone | 12:36 | |
| *** erecio has quit IRC | 12:38 | |
| *** dstanek_zzz is now known as dstanek | 12:43 | |
| *** bada has quit IRC | 13:05 | |
| *** dstanek is now known as dstanek_zzz | 13:15 | |
| *** joesavak has joined #openstack-keystone | 13:16 | |
| ayoung | ukalifon, don't bother testing the internal events...that BP was written in support of the revocation events | 13:19 |
| ayoung | תודה | 13:19 |
| *** bknudson has joined #openstack-keystone | 13:22 | |
| boris-42 | woot https://review.openstack.org/#/c/90405/ | 13:23 |
| boris-42 | ayoung ^ | 13:23 |
| boris-42 | ayoung now it works in keystone | 13:23 |
| boris-42 | ayoung should wait a bit for results | 13:23 |
| ayoung | boris-42, edit the commit message: preformance | 13:24 |
| ayoung | but now you can do that right in gerrit! | 13:24 |
| boris-42 | ayoung heh | 13:24 |
| boris-42 | ayoung yep nice thing=) | 13:24 |
| *** dstanek_zzz is now known as dstanek | 13:24 | |
| boris-42 | ayoung so now we should wait tempest | 13:25 |
| ayoung | ++ let me find the RH perf guy and clue him in | 13:25 |
| boris-42 | ayoung and we will see pretty graphs in check-rally-dsvm-keystone | 13:25 |
| boris-42 | ayoung nick? | 13:25 |
| ayoung | I like this. A lot | 13:25 |
| marekd | ayoung: what Identity Provider do you use at RH? Is it some homemade software, something open sourced, commercial (lol) ? | 13:25 |
| ayoung | one sec...I have his email | 13:25 |
| ayoung | boris-42, his real name is Neependra Khare | 13:26 |
| boris-42 | ayoung actually he wrote all tests=) | 13:26 |
| ayoung | boris-42, it might be his nighttime...I think he's in Pune | 13:27 |
| boris-42 | ayoung benchmarks for keystone in rally=) | 13:27 |
| boris-42 | ayoung so I know that guy=) | 13:27 |
| ayoung | boris-42, yeah, once he caught on to the upstream effort, he stopped bothering me and started talking with people who actually knew what they were doing, like you | 13:28 |
| ayoung | hint hint ukalifon .... | 13:28 |
| boris-42 | ayoung thanks i will ) | 13:32 |
| *** stevemar has joined #openstack-keystone | 13:34 | |
| boris-42 | ayoung yep systematization of benchmarks is key of success=) | 13:34 |
| boris-42 | benchmarking* | 13:34 |
| *** erecio_1 has quit IRC | 13:39 | |
| *** dstanek is now known as dstanek_zzz | 13:53 | |
| *** theocean154 has joined #openstack-keystone | 13:55 | |
| *** stevemar has quit IRC | 13:55 | |
| *** openstackgerrit has joined #openstack-keystone | 13:56 | |
| *** erecio_1 has joined #openstack-keystone | 13:57 | |
| *** theocean154 has quit IRC | 13:59 | |
| *** ukalifon has quit IRC | 14:02 | |
| *** daneyon has joined #openstack-keystone | 14:04 | |
| marekd | ayoung: what Identity Provider do you use at RH? Is it some homemade software, something open sourced, commercial (lol) ? | 14:06 |
| ayoung | marekd, you are kidding, right? | 14:08 |
| ayoung | http://www.freeipa.org/page/Main_Page | 14:08 |
| ayoung | marekd, Simo Sorce also has a project burning to get a saml front end to this and the whole sssd infrastructure: https://git.fedorahosted.org/git/ipsilon.git | 14:11 |
| *** sbfox has joined #openstack-keystone | 14:11 | |
| *** tomoiaga has joined #openstack-keystone | 14:11 | |
| *** diegows has joined #openstack-keystone | 14:12 | |
| gabriel-bezerra | ayoung: I tried applying the patch 4 of your change 90476, but the problem when trying to the token is still happening | 14:13 |
| ayoung | bwah? | 14:13 |
| gabriel-bezerra | is there any conflict between that and federation? | 14:13 |
| marekd | ayoung: i recall our talk about ipsilon not. | 14:13 |
| gabriel-bezerra | I turned federation on | 14:14 |
| marekd | s/not/now/ | 14:14 |
| gabriel-bezerra | I mean, it is in my keystone's pipeline | 14:14 |
| ayoung | gabriel-bezerra, um...my first thought is "are you sure you applied it" | 14:14 |
| ayoung | there should be no relationship between that patch and Federation | 14:14 |
| ayoung | the token is signed in the client and returned in unicode...my guess is that last version of the patch should be reverted to the one bfore that does the explixct str() | 14:15 |
| gabriel-bezerra | ... | 14:15 |
| ayoung | gabriel-bezerra, try just editing it by hand and see if the fix works...I've been using it in a Proof of concept I'm working on. THe old version, though | 14:16 |
| gabriel-bezerra | TypeError: expected byte string object for header value, value of type unicode found | 14:16 |
| gabriel-bezerra | this is the error in my /var/log/apache2/keystone | 14:16 |
| gabriel-bezerra | this is the patch 4 | 14:16 |
| gabriel-bezerra | I'll change to the patch 3 | 14:17 |
| gabriel-bezerra | a service apache2 restart is enough to reload the code, isn't it/ | 14:17 |
| gabriel-bezerra | ? | 14:17 |
| gabriel-bezerra | I changed the line six.text_type to str | 14:18 |
| gabriel-bezerra | by hand | 14:18 |
| gabriel-bezerra | as it is on patch 3 | 14:18 |
| gabriel-bezerra | it worked | 14:18 |
| gabriel-bezerra | so the patch 4 has that error ^ | 14:19 |
| ayoung | gabriel-bezerra, please comment on that in the code review...and I'll revert as well | 14:20 |
| *** wchrisj has joined #openstack-keystone | 14:21 | |
| *** wchrisj has left #openstack-keystone | 14:21 | |
| boris-42 | ayoung so here is the result https://review.openstack.org/#/c/90405/ | 14:26 |
| boris-42 | ayoung take look at check-rally-sdvm-keystone | 14:26 |
| ayoung | boris-42, you mean http://logs.openstack.org/05/90405/3/check/check-rally-dsvm-keystone/81a809d/rally-plot/results.html.gz ? | 14:27 |
| boris-42 | ayoung yep it is the result | 14:27 |
| ayoung | think it just crashed my browser | 14:27 |
| boris-42 | ayoung of this task https://review.openstack.org/#/c/90405/3/rally-scenarios/keystone.yaml | 14:27 |
| boris-42 | ayoung hehe=) | 14:28 |
| boris-42 | ayoung 2500 iterations to much info on graphs | 14:28 |
| ayoung | I'm sure it has nothing to do with the fact that I hacve something like 60 tabs open | 14:28 |
| boris-42 | ayoung too much* | 14:28 |
| boris-42 | ayoung hmmm I don't know I haven't any problems with opening it | 14:28 |
| boris-42 | ayoung it takes a couple of seconds to render it | 14:29 |
| boris-42 | ayoung but after it it wors just fine | 14:29 |
| ayoung | nah...too much open in my browser. THis was the cinder block that broke the camels back | 14:29 |
| *** david-lyle has joined #openstack-keystone | 14:29 | |
| boris-42 | ayoung actually I am thinking about tuning graph | 14:29 |
| boris-42 | ayoung to reduce amount of points | 14:30 |
| boris-42 | ayoung e.g. to don't show more then 1 points | 14:30 |
| boris-42 | 1k points | 14:30 |
| ayoung | boris-42, are you doing the rendering in the browser for that? | 14:31 |
| ayoung | I closed all tabs, closed the browser, reopened, and it is still crawling | 14:33 |
| ayoung | lemme try chrome | 14:33 |
| boris-42 | ayoung yep | 14:33 |
| boris-42 | ayoung rendering is done online | 14:33 |
| boris-42 | ayoung graphics are not static | 14:33 |
| ayoung | that is a contradiction. | 14:33 |
| ayoung | rendering is done in the browser, not online, right? | 14:34 |
| ayoung | chrome is much smoother | 14:34 |
| ayoung | OK, I have to admit, I have no idea what Iam looking at here | 14:34 |
| *** stevemar has joined #openstack-keystone | 14:36 | |
| *** erecio_1 has quit IRC | 14:37 | |
| *** sbfox has quit IRC | 14:37 | |
| *** bach_ has joined #openstack-keystone | 14:45 | |
| *** bach_ has quit IRC | 14:45 | |
| *** bach_ has joined #openstack-keystone | 14:46 | |
| boris-42 | ayoung lol=) | 14:48 |
| boris-42 | ayoung it's in browser not online | 14:48 |
| ayoung | gabriel-bezerra, I'm battling Federation as well. I am having trouble with my mapping: | 14:48 |
| ayoung | boris-42, so, what is it showing me? | 14:48 |
| boris-42 | ayoung so benchmark scenario is next | 14:49 |
| boris-42 | create user and then delete user | 14:49 |
| boris-42 | we are running 60 such scenarios simultaneously | 14:49 |
| ayoung | and? | 14:49 |
| boris-42 | total amount of scenario runs is 2.5k | 14:49 |
| boris-42 | we are seeing that after 2k something wired is happaning | 14:50 |
| boris-42 | as well you can analyze the duration of operation to create_user and delete_user | 14:50 |
| boris-42 | that are actually quite huge | 14:51 |
| boris-42 | especially creating user | 14:51 |
| boris-42 | then you are able to analyze keystone logs | 14:51 |
| boris-42 | and see in them what you already saw | 14:51 |
| boris-42 | that eventlet should be used at all in production | 14:51 |
| boris-42 | ^ ayoung | 14:51 |
| ayoung | boris-42, my eye looks like things change at the 1800 mark? | 14:52 |
| boris-42 | ayoung it depends =) | 14:52 |
| boris-42 | ayoung on performance of node | 14:52 |
| ayoung | yeah, makes it hard to nail things down if you can't hold otherthings fixed | 14:53 |
| boris-42 | ayoung in this run it was at 1.8 but usually at 2k in my local installation it's about 3k | 14:53 |
| ayoung | boris-42, what is the RAM size of the various machines? | 14:53 |
| boris-42 | ayoung oh I don't know what we have in gates | 14:54 |
| boris-42 | ayoung in my case it's was 4GB ram | 14:54 |
| ayoung | boris-42, might be simple memory exhaustion | 14:54 |
| boris-42 | ayoung you are trying to find the reason why eventlet failed? | 14:55 |
| ayoung | boris-42, well, not going to go crazy trying to figure out if something is wrong if its that we are trying to carry 10 lbs of stone in a 5lb bucket | 14:55 |
| boris-42 | ayoung imho | 14:56 |
| boris-42 | ayoung if first 2k iteration works well | 14:56 |
| *** andreaf has quit IRC | 14:56 | |
| boris-42 | ayoung other 10k should works well as well | 14:56 |
| boris-42 | ayoung http://logs.openstack.org/05/90405/3/check/check-rally-dsvm-keystone/81a809d/logs/dstat.txt.gz | 14:58 |
| boris-42 | ayoung dstat | 14:58 |
| boris-42 | ayoung there is less and less memory | 14:58 |
| boris-42 | ayoung but minimal value is about 240 mb | 14:59 |
| boris-42 | ayoung so I don't think that memory is issue | 14:59 |
| boris-42 | ayoung any way why it uses so much memory? | 15:00 |
| *** dstanek_zzz is now known as dstanek | 15:00 | |
| boris-42 | ayoung it will be interesting to see the results for HTTPs | 15:02 |
| boris-42 | HTTPd | 15:02 |
| ayoung | ++ | 15:02 |
| boris-42 | ayoung if it's evenetlet crap we should get rid of it asap=) | 15:02 |
| stevemar | dstanek, i am seeing a weird error when running python3 tests for keystoneclient, have you seen this before? http://logs.openstack.org/80/81980/10/check/gate-python-keystoneclient-python33/b411a3e/console.html ctrl+f import error | 15:04 |
| stevemar | dstanek, ... running python3 tests for my patch, not in master or anything (sorry about the wording of the last msg :P) | 15:04 |
| dstanek | stevemar I think it's an import error | 15:07 |
| openstackgerrit | Matthieu Huin proposed a change to openstack/keystone: More random values for oAuth1 verifier https://review.openstack.org/89612 | 15:11 |
| *** theocean154 has joined #openstack-keystone | 15:12 | |
| *** thedodd has joined #openstack-keystone | 15:19 | |
| *** doddstack has joined #openstack-keystone | 15:20 | |
| *** erecio_1 has joined #openstack-keystone | 15:22 | |
| *** thedodd has quit IRC | 15:23 | |
| gabriel-bezerra | ayoung: I haven't even gotten to retrieve the identity_providers | 15:27 |
| gabriel-bezerra | it is complaining about authentication | 15:28 |
| marekd | gabriel-bezerra: federation ? | 15:28 |
| gabriel-bezerra | curl -H "X-Auth-Token: $ADMIN_TOKEN" -H "Content-type: application/json" http://10.1.0.48:5000/v3/OS-FEDERATION/identity_providers | 15:29 |
| gabriel-bezerra | yes, marekd | 15:29 |
| gabriel-bezerra | admin token is really a token, i echoed it to check | 15:30 |
| *** klrmn has left #openstack-keystone | 15:30 | |
| marekd | gabriel-bezerra: ah, i thought you have some auth/saml2 problems, but it looks like general auth problem :P | 15:31 |
| marekd | gabriel-bezerra: is it related to this: https://review.openstack.org/#/c/90476 ? | 15:32 |
| gabriel-bezerra | 401: Unauthorized | 15:32 |
| gabriel-bezerra | I applied the patch 3 | 15:32 |
| gabriel-bezerra | you can see my comment about patch 4 there | 15:33 |
| gabriel-bezerra | so.. the error is no longer 500, now it is 401 | 15:33 |
| marekd | and logs? | 15:34 |
| marekd | gabriel-bezerra: did you have a chance the line of code that raised that exception ? | 15:34 |
| marekd | trace the line of code that raised that exception* | 15:34 |
| gabriel-bezerra | the 401 or the 500? | 15:35 |
| marekd | 401 | 15:35 |
| marekd | gabriel-bezerra: btw are you running standalone keystone or w/ apache ? | 15:35 |
| gabriel-bezerra | apache | 15:36 |
| gabriel-bezerra | I haven't enabled ssl nor shib on keystone.conf, it is just as the template created by devstack | 15:37 |
| gabriel-bezerra | i mean apache2/sites-available/keystone.conf | 15:37 |
| *** topol has joined #openstack-keystone | 15:37 | |
| gabriel-bezerra | but I enabled federation on /etc/keystone/keystone.conf and /etc/keystone/keystone-paste.ini | 15:38 |
| *** topol has quit IRC | 15:38 | |
| *** topol_ has joined #openstack-keystone | 15:38 | |
| *** topol_ is now known as topol | 15:38 | |
| gabriel-bezerra | hey, how to cat the log with colors? | 15:39 |
| gabriel-bezerra | neither tail nor cat did it | 15:39 |
| gabriel-bezerra | I want to get the message without the color codes to copy/paste | 15:39 |
| *** gyee has joined #openstack-keystone | 15:40 | |
| marekd | gabriel-bezerra: so with or without ? | 15:40 |
| gabriel-bezerra | I want it to print with colors so the color codes aren't shown | 15:40 |
| marekd | not sure if it supports shell color-codes but you can try: ave some auth/saml2 problems, but it looks like general auth problem :P | 15:44 |
| marekd | not sure if it supports shell color-codes but you can try: http://pygments.org/ | 15:45 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Add request/access token and consumer support for keystoneclient https://review.openstack.org/81980 | 15:45 |
| *** erecio_1 has quit IRC | 15:46 | |
| ayoung | gabriel-bezerra, sorry...got redirected for a little bit. Something about my rule is not matching the groups | 15:48 |
| ayoung | marekd, if we are going to let Domain admins manage their own rules...we are going to need some tooling or better output support. | 15:49 |
| marekd | ayoung: something in the API or better logs? | 15:50 |
| gabriel-bezerra | ayoung: Regarding this https://review.openstack.org/90631 : Should I create a new change and abandon this or just remake my commit, commit message and so to just change the README.md? | 15:50 |
| ayoung | marekd, marekd can't be logs, as domain admins won't see them...I don't know the answer. Maybe something like a way to test auth, and get back a subset of the logging data? | 15:50 |
| stevemar | dstanek, ahh, apparently import exceptions blows up in python3 | 15:51 |
| marekd | ayoung: you probably now thinking about something like "rule X didn't match so i didn't assign this group" ? | 15:51 |
| ayoung | gabriel-bezerra, it looks basically good, just fix and resubmit, I think. I haven't looked at it too closely, though | 15:51 |
| ayoung | marekd, yeah....but only for admins | 15:52 |
| *** serverascode has quit IRC | 15:52 | |
| ayoung | marekd, something like: "here is a request, minus the secret. Assuming the secret were correct, what kind of auth response would Keystone give me?" | 15:52 |
| gabriel-bezerra | ayoung: I asked it because of the comment of Sean Dague. | 15:53 |
| ayoung | gabriel-bezerra, ah... | 15:53 |
| ayoung | gabriel-bezerra, I have to admit, I kinda like your patch | 15:53 |
| ayoung | as we get more and more devstacked services, making things explicit will be better documenting... | 15:53 |
| ayoung | but, he's right in this case, better to make the docs match | 15:54 |
| *** tomoiaga has left #openstack-keystone | 15:54 | |
| ayoung | key is the normal trigger for all of devstack, and your fix would only work for the apache side of it, | 15:54 |
| *** serverascode has joined #openstack-keystone | 15:54 | |
| ayoung | for example, in ENABLED_SERVICES=+keystone would not work | 15:55 |
| marekd | ayoung: hah, this basicaly means writing/reusing another SAML2 parser...i'd say writing, as we would be presenting invalid (w/o secret) assertion. | 15:55 |
| gabriel-bezerra | my comment for that is (I'm still going to post it): "Ok. I would change things to get closer to its ideal way (keystone instead of key), but it seems reasonable to fix only the documentation for now and change key->keystone everywhere on a single commit down the road." | 15:55 |
| ayoung | marekd, I would think something more like returning a trace of the rules evaluation | 15:56 |
| marekd | ayoung: right, but what's the input? If XMLized assertion, than we need to parse it like SAML-soft does it, if just a set of 'already' parsed env_variables then..domain admins might need some info from mod_shib configuration. | 15:57 |
| marekd | ayoung: if we do that, I would go for option two either way. | 15:58 |
| *** jayh has joined #openstack-keystone | 15:58 | |
| gabriel-bezerra | but my question is: should I create a new change just touching the doc and abandon this, or should I reuse the Change-Id with a totally new commit message and content? | 15:59 |
| *** KurtMartin is now known as kmartin | 15:59 | |
| *** erecio_1 has joined #openstack-keystone | 15:59 | |
| *** jsavak has joined #openstack-keystone | 16:00 | |
| *** packet has joined #openstack-keystone | 16:01 | |
| ayoung | jayh, yeah, this is the right place to discuss things about Keystone.... | 16:01 |
| ayoung | gabriel-bezerra, new change, I think, as this one may have a life of its own. | 16:02 |
| *** joesavak has quit IRC | 16:02 | |
| ayoung | marekd, ah...I was thinking post parse: | 16:02 |
| gabriel-bezerra | ayoung: ok. I'll do that. | 16:02 |
| ayoung | marekd, I want the parsing-etc to be handled by APache modules, so not our problem | 16:02 |
| *** packet has quit IRC | 16:03 | |
| ayoung | marekd, for example, I am using mod_identity_lookup to populate my groups list. If I hit a simple WSGI app, I can see the REMOTE_GROUPS env var | 16:03 |
| ayoung | REMOTE_GROUPS = admins;hawk;osprey;eagle | 16:03 |
| *** chandan_kumar has quit IRC | 16:03 | |
| ayoung | Now I try this set of rules; | 16:03 |
| marekd | ayoung: ah, so you want to do the saml2 authn, but instead to go and obtain unscoped token you would rather get some feedback - this rule matched, this didn't. | 16:03 |
| *** sbfox has joined #openstack-keystone | 16:04 | |
| ayoung | http://paste.openstack.org/show/78007/ | 16:04 |
| ayoung | marekd, that is my current pain point, so, yeah, that woulkd be swell | 16:04 |
| *** packet has joined #openstack-keystone | 16:05 | |
| *** packet has quit IRC | 16:05 | |
| marekd | ayoung: i think you want to squeeze this into one 'local' object and one 'remote' object. | 16:05 |
| ayoung | ? | 16:06 |
| marekd | and in fact make it one rule. | 16:06 |
| *** packet has joined #openstack-keystone | 16:06 | |
| ayoung | marekd, ah...lemme try that | 16:06 |
| ayoung | so | 16:06 |
| marekd | ayoung: what's your business case - assign keystone group osprey if osprey is in REMOTE_GROUPS, right? | 16:07 |
| ayoung | marekd, I want REMOTE_USER to become userid and REMOTE_GROUPS to be the set of group assignments | 16:07 |
| *** marcoemorais has joined #openstack-keystone | 16:08 | |
| ayoung | I was trying to cut it down to a single group, | 16:08 |
| ayoung | so, yes, assign keystone group osprey if osprey is in REMOTE_GROUPS plus the REMOTE_USER thing | 16:09 |
| marekd | ayoung: http://paste.openstack.org/show/78010/ | 16:10 |
| marekd | try this (after checking on syntax) | 16:10 |
| *** gabriel-bezerra has quit IRC | 16:10 | |
| *** rodrigods has quit IRC | 16:10 | |
| marekd | ayoung: first of all: every local object need a "user", without that you endup with HTTP 401 | 16:11 |
| *** afaranha has quit IRC | 16:11 | |
| marekd | what i pasted will simply map REMOTE_USER to user['name'] and do the matching on REMOTE_GROUPS env variable. | 16:12 |
| marekd | there should be '}' between lines 23 and 24 | 16:12 |
| ayoung | {"error": {"message": "Could not map user", "code": 401, "title": "Unauthorized"}} | 16:14 |
| ayoung | so I need user id | 16:14 |
| marekd | ayoung: do quick test: replace "{0}" with some const string. | 16:14 |
| marekd | and see if it works. | 16:14 |
| ayoung | OK | 16:15 |
| ayoung | marekd, nope, no difference | 16:15 |
| *** andreaf has joined #openstack-keystone | 16:18 | |
| marekd | ayoung: this is the rule that worked for me: http://paste.openstack.org/show/78013/ | 16:19 |
| ayoung | marekd, I suspect my problem is that I still have the LDAP backend wired up. | 16:20 |
| marekd | https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/utils.py#L224 -> this is where you get into troubles. can you somehow check what's in REMOTE_USER ? | 16:21 |
| marekd | ayoung: ^^ | 16:21 |
| marekd | ayoung: because after you specified some fixed string you should not get http 401 :( | 16:22 |
| ayoung | marekd, 1 sec...trying with no groups specified on either side... | 16:22 |
| ayoung | OK: "Unable to find valid groups while using mapping cloudlab" | 16:22 |
| ayoung | "User ayoung has no access to project 5d15013cbebd4b1e95ad3b5785c866f7", | 16:23 |
| ayoung | that looks good.... | 16:23 |
| ayoung | it is the group matching that was messing me up. | 16:23 |
| ayoung | I wonder if the parsing is wrong, and it is not getting any groups? | 16:23 |
| *** gabriel-bezerra has joined #openstack-keystone | 16:23 | |
| marekd | what if you specify group id instead of it's name? | 16:24 |
| ayoung | I did | 16:25 |
| *** rodrigods has joined #openstack-keystone | 16:25 | |
| *** rodrigods has quit IRC | 16:25 | |
| *** rodrigods has joined #openstack-keystone | 16:25 | |
| ayoung | "group": { "id": "osprey" } | 16:25 |
| ayoung | marekd, I might inject some more tracing in the Mapping plugin. | 16:26 |
| marekd | pity pdb cannot be used when running with apache :( | 16:26 |
| *** afaranha has joined #openstack-keystone | 16:26 | |
| marekd | this would speed up things. | 16:26 |
| ayoung | marekd, so I have a thought a bout that | 16:26 |
| ayoung | what if we ran apache with one thread | 16:26 |
| ayoung | and allowed attaching a remote debugger | 16:27 |
| ayoung | marekd, look in keystone-all: there is a switch in there for the eventlet case | 16:28 |
| ayoung | setup_remote_pydev_debug() | 16:28 |
| ayoung | its in commit: git show 0f225743e8644416df2f200d710912c40b7acd47 | 16:28 |
| ayoung | marekd, it wouldn't be pdb, but it would be a remote debugger. I use pydev, albeit on a separate machine. But it probably would work | 16:30 |
| marekd | i don't care as long i can stop and check what it's in my variables... | 16:30 |
| gabriel-bezerra | ayoung: https://review.openstack.org/91412. Is there any way to tie these changes as related on Gerrit? | 16:31 |
| marekd | ayoung: i have some guests here and need to run away for now. If you find something drop me an e-mail. I will try to be back in next couple of hours. | 16:31 |
| ayoung | gabriel-bezerra, not direcly, but put in a comment that includes the link and that should be sufficient | 16:31 |
| ayoung | ++ | 16:31 |
| *** marekd is now known as marekd|away | 16:31 | |
| *** erecio_1 has quit IRC | 16:31 | |
| *** richm has joined #openstack-keystone | 16:34 | |
| dstanek | stevemar: did you get it figured out? | 16:40 |
| stevemar | dstanek, yep! put up a patch for oauth support on keystoneclient | 16:40 |
| stevemar | dstanek, i think i managed to get the factory function working, if you could take a look (no rush on it), that would be awesome | 16:41 |
| dstanek | stevemar: link? there are so many reviews | 16:41 |
| stevemar | dstanek, of course sir: https://review.openstack.org/#/c/81980/ | 16:42 |
| *** chandan_kumar has joined #openstack-keystone | 16:43 | |
| *** browne has joined #openstack-keystone | 16:43 | |
| *** joesavak has joined #openstack-keystone | 16:43 | |
| *** thiagop has joined #openstack-keystone | 16:44 | |
| *** jsavak has quit IRC | 16:46 | |
| *** topol has quit IRC | 16:46 | |
| *** Chicago has quit IRC | 16:48 | |
| *** andreaf has quit IRC | 16:51 | |
| *** harlowja_away is now known as harlowja | 16:54 | |
| dstanek | stevemar: i didn't review the whole thing yet, but i left you some early feedback on the factory | 16:54 |
| stevemar | dstanek, cool | 16:55 |
| *** erecio_1 has joined #openstack-keystone | 16:55 | |
| *** theocean154 has quit IRC | 16:58 | |
| *** praneshp has joined #openstack-keystone | 16:59 | |
| *** theocean154 has joined #openstack-keystone | 17:00 | |
| *** jamielennox is now known as jamielennox|away | 17:00 | |
| *** sbfox has quit IRC | 17:01 | |
| *** sbfox has joined #openstack-keystone | 17:01 | |
| *** andreaf has joined #openstack-keystone | 17:01 | |
| *** praneshp_ has joined #openstack-keystone | 17:02 | |
| *** praneshp has quit IRC | 17:04 | |
| *** praneshp_ is now known as praneshp | 17:04 | |
| *** ukalifon1 has joined #openstack-keystone | 17:04 | |
| *** chandan_kumar has quit IRC | 17:06 | |
| *** andreaf has quit IRC | 17:11 | |
| *** leseb has quit IRC | 17:11 | |
| *** bada has joined #openstack-keystone | 17:13 | |
| *** bada has quit IRC | 17:14 | |
| *** Ju has joined #openstack-keystone | 17:14 | |
| *** Ju has quit IRC | 17:19 | |
| *** Ju has joined #openstack-keystone | 17:21 | |
| *** sbfox has quit IRC | 17:23 | |
| gabriel-bezerra | marekd|away: RBAC: Invalid token | 17:26 |
| gabriel-bezerra | is there anything I should put in policy.json to access the federation api? | 17:27 |
| gabriel-bezerra | ayoung: ^ | 17:30 |
| ayoung | gabriel-bezerra, I didn't add anything | 17:30 |
| gabriel-bezerra | are you using the v3sample? | 17:30 |
| ayoung | gabriel-bezerra, um...not sure | 17:30 |
| gabriel-bezerra | or v2 is ok? | 17:30 |
| *** amcrn has quit IRC | 17:31 | |
| ayoung | gabriel-bezerra, looks like default policy.json | 17:31 |
| ayoung | gabriel-bezerra, look for rules like this: | 17:31 |
| *** leseb has joined #openstack-keystone | 17:31 | |
| ayoung | "identity:create_identity_provider": "rule:admin_required", | 17:31 |
| *** leseb has quit IRC | 17:31 | |
| *** leseb has joined #openstack-keystone | 17:32 | |
| ayoung | gabriel-bezerra, ah...do you mean for authentication? | 17:33 |
| ayoung | I'm cheating, and using the SAML plugin, but you need to enable that in conf and pipeline | 17:33 |
| *** abhirc has joined #openstack-keystone | 17:34 | |
| gabriel-bezerra | this is what is happening: | 17:35 |
| gabriel-bezerra | 1 - I applied the patch 3 from your review on the code | 17:36 |
| *** leseb has quit IRC | 17:36 | |
| gabriel-bezerra | 2 - I'm running keystone on Apache | 17:36 |
| boris-42 | gabriel-bezerra ooo | 17:36 |
| boris-42 | gabriel-bezerra could you benchmark it?) | 17:36 |
| boris-42 | gabriel-bezerra just interesting will it fail as with event et or not | 17:36 |
| boris-42 | eventlet* | 17:37 |
| gabriel-bezerra | 3 - I configured federation according to the docs (some changes in keystone.conf and keystone-paste.ini) | 17:37 |
| gabriel-bezerra | 4 - I put policy.v3sample.json as my policy.json I got a token for admin on project demo, domain Default. The token comes with the role admin | 17:38 |
| gabriel-bezerra | sorry.. | 17:38 |
| gabriel-bezerra | 4 - I put policy.v3sample.json as my policy.json | 17:38 |
| gabriel-bezerra | 5 - I got a token for admin on project demo, domain Default. The token comes with the role admin | 17:38 |
| gabriel-bezerra | 6 - when I do: curl -si -H "X-Auth-Token: $ADMIN_TOKEN" -H "Content-type: application/json" http://10.1.0.48:5000/v3/OS-FEDERATION/identity_providers, I get an 401 Unauthorized | 17:39 |
| gabriel-bezerra | and the log shows RBAC: Invalid token | 17:39 |
| gabriel-bezerra | boris-42: I can't do it now. Do you need any help making it run on apache? | 17:40 |
| boris-42 | gabriel-bezerra heh do you have locarc for it? | 17:40 |
| boris-42 | gabriel-bezerra or some script | 17:41 |
| gabriel-bezerra | yes, I do | 17:41 |
| gabriel-bezerra | are you on Ubuntu? | 17:41 |
| boris-42 | gabriel-bezerra yep I am running stack in ubuntu | 17:41 |
| gabriel-bezerra | boris-42: please see: https://review.openstack.org/90771 and https://review.openstack.org/91412 | 17:42 |
| boris-42 | gabriel-bezerra ahh thanks | 17:42 |
| boris-42 | gabriel-bezerra okay I'll try | 17:42 |
| boris-42 | gabriel-bezerra and I'll benchmark apache one | 17:42 |
| boris-42 | ayoung ^ | 17:42 |
| gabriel-bezerra | boris-42: with that you will have keystone running on apache. But you will still have to configure federation | 17:43 |
| *** david-lyle has quit IRC | 17:45 | |
| *** erecio_1 has quit IRC | 17:45 | |
| ayoung | gabriel-bezerra, $ADMIN_TOKEN might not have access to what you need for that. I'd create a real token for a real user and see if that works. I've been doing this via the python api, and I can post my changes | 17:46 |
| ayoung | gabriel-bezerra, I've made afew tweak, so don't be surprised, and I've pulled in some of jamielennox's recent changes | 17:47 |
| gabriel-bezerra | admin token is a project scoped token: project=demo, domain=Default, user=admin | 17:47 |
| ayoung | gabriel-bezerra, https://github.com/admiyo/python-keystoneclient/tree/federation_script | 17:48 |
| gabriel-bezerra | pardon me. I didn't get | 17:48 |
| gabriel-bezerra | ohhh | 17:48 |
| ayoung | gabriel-bezerra, so you need to set some env vars to run that. Source keystone.rc plus the location of the CA cert (since I do SSL) | 17:49 |
| *** david-lyle has joined #openstack-keystone | 17:51 | |
| gabriel-bezerra | ayoung: but that's just the client, right? | 17:52 |
| ayoung | gabriel-bezerra, yeah | 17:53 |
| gabriel-bezerra | I'll try another method of the api | 17:53 |
| gabriel-bezerra | can you list identity providers? | 17:53 |
| gabriel-bezerra | with your client | 17:53 |
| *** amcrn has joined #openstack-keystone | 17:53 | |
| gabriel-bezerra | ayoung: You will develop it on your own fork; how then you get that merged into the main branch? Do you create a review for each commit of your fork? | 17:57 |
| gabriel-bezerra | and set as depends-on relation between them? | 17:58 |
| ayoung | gabriel-bezerra, most of those are jamielennox's patches, and will get merged before I submit...I'll wait until the upstream tree is in a stable enough state before submitting, as some of those don't really depend on each other | 18:00 |
| *** doddstack has quit IRC | 18:00 | |
| ayoung | I'm still working through things. Until I get something working, no need to submit. I have some other sample_script work I need t otighten up, as well as some other client code that needs to address reviewers comments. | 18:01 |
| *** bach_ has quit IRC | 18:03 | |
| *** bach_ has joined #openstack-keystone | 18:03 | |
| *** leseb has joined #openstack-keystone | 18:09 | |
| *** bach_ has quit IRC | 18:11 | |
| *** morganfainberg_Z is now known as morganfainberg | 18:14 | |
| *** erecio has joined #openstack-keystone | 18:27 | |
| *** sbfox has joined #openstack-keystone | 18:31 | |
| morganfainberg | ayoung, we can't use six.text_type to convert unicode (text) to byte_str | 18:35 |
| morganfainberg | ayoung, this is a case where str() was more correct https://review.openstack.org/#/c/90476/ probably with a TODO to fix for py33 (if six.PY3) | 18:36 |
| morganfainberg | ayoung, do you want me to upload a quick fix for that back to STR w/ a todo comment? | 18:36 |
| *** abhirc has quit IRC | 18:48 | |
| morganfainberg | dstanek, dolphm, ayoung, stevemar, https://review.openstack.org/#/c/90405/ the rally job is in via infra (zuul) now we need this one to make rally actually run | 18:53 |
| morganfainberg | bknudson, ^ (missed ya on the last line as well) | 18:53 |
| *** david-lyle has quit IRC | 18:57 | |
| *** bach_ has joined #openstack-keystone | 19:01 | |
| *** Manishanker has joined #openstack-keystone | 19:01 | |
| *** bach_ has quit IRC | 19:05 | |
| bknudson | morganfainberg: how do we know if it's correct? | 19:07 |
| *** bach_ has joined #openstack-keystone | 19:07 | |
| morganfainberg | bknudson, http://logs.openstack.org/05/90405/3/check/check-rally-dsvm-keystone/81a809d/ http://logs.openstack.org/05/90405/3/check/check-rally-dsvm-keystone/81a809d/rally-plot/results.html.gz | 19:08 |
| morganfainberg | bknudson, the actual job ran and passed, there are the responses | 19:08 |
| morganfainberg | bknudson, there will likely be tuning/future changes but it gets us started | 19:08 |
| bknudson | this can't be correct... takes 40 seconds to create and delete a user?? | 19:09 |
| bknudson | and it fails 13% of the time? | 19:09 |
| morganfainberg | bknudson, there are issues boris-42 is seeing after ~2000 events with eventlet | 19:09 |
| morganfainberg | boris-42, might be memory starvation on the test nodes, might be a number of other things | 19:09 |
| *** chandan_kumar has joined #openstack-keystone | 19:09 | |
| morganfainberg | bknudson, ^ | 19:09 |
| morganfainberg | there was a convo ayoung and boris-42 had earlier | 19:10 |
| morganfainberg | bknudson, there is also a concurrency of 60 it looks like | 19:13 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Add request/access token and consumer support for keystoneclient https://review.openstack.org/81980 | 19:13 |
| bknudson | morganfainberg: I hope he's running about 60 instances of keystone. | 19:13 |
| morganfainberg | bknudson, nope. single instance. but that mirrors what people really do in production | 19:14 |
| morganfainberg | bknudson, unfortunately | 19:14 |
| bknudson | if that were the case then wouldn't we be getting bugs about auth timeout? | 19:14 |
| morganfainberg | bknudson, well we may not see people doing 60 concurrency and a tight loop create/delete | 19:15 |
| ayoung | morganfainberg, yeah, was fixing that up...just ran the test...then moved on and forgot to resubmit | 19:16 |
| morganfainberg | ayoung, ah, hehe, happens to all of us. | 19:16 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Ensure token is a string https://review.openstack.org/90476 | 19:17 |
| morganfainberg | bknudson, but it's expected we will be adding more test scenarios and tuning current ones as we expand what we want rally to test. there are also plugins soon, so we can change how rally test works w/o needing to submit a patch to rally | 19:17 |
| bknudson | morganfainberg: I like the plugins idea! | 19:18 |
| morganfainberg | bknudson, yeah they that the patch up for review and it's just waiting documentation last i heard (yesterday) from boris-42 | 19:18 |
| bknudson | I'd prefer if our initial tests actually worked. | 19:18 |
| bknudson | we can crank up the concurrency as we improve the performance | 19:19 |
| morganfainberg | bknudson, i think there is value in having a graph that shows where things tip over vs a clean run as well. perhaps we should have both? | 19:20 |
| morganfainberg | bknudson, if we don't have something demonstrating where it falls over how do we know if we're fixing that issue. | 19:21 |
| bknudson | we shouldn't need rally to show us that there's an issue... add a test | 19:21 |
| bknudson | if there's a bug we should be gating on it | 19:22 |
| morganfainberg | bknudson, but tipping over due to concurrency/number of ops is not something our tests can really show at the moment. | 19:22 |
| bknudson | is it keystone tipping over or is it rally? | 19:22 |
| morganfainberg | bknudson, let me look at the logs, but it looks like keystone. | 19:23 |
| morganfainberg | bknudson, http://logs.openstack.org/05/90405/3/check/check-rally-dsvm-keystone/81a809d/logs/screen-key.txt.gz#_2014-04-30_14_05_58_030 | 19:24 |
| morganfainberg | greenio buffering issues | 19:25 |
| morganfainberg | and socket limitations it looks like | 19:25 |
| bknudson | morganfainberg: that might be because the client disconnects? | 19:26 |
| rodrigods | stevemar, ping | 19:26 |
| morganfainberg | bknudson, http://logs.openstack.org/05/90405/3/check/check-rally-dsvm-keystone/81a809d/console.html#_2014-04-30_14_04_47_046 perhaps | 19:26 |
| bknudson | I wonder if keystoneclient has a default timeout or if rally is setting it | 19:27 |
| stevemar | rodrigods, 64 bytes from stevemar: icmp_seq=1 ttl=64 time=0.024 ms | 19:27 |
| stevemar | rodrigods, pong :) | 19:28 |
| morganfainberg | bknudson, i think it's worth looking into. 30seconds between iter start and failure on 2417: (Start) http://logs.openstack.org/05/90405/3/check/check-rally-dsvm-keystone/81a809d/console.html#_2014-04-30_14_04_47_046 (end) http://logs.openstack.org/05/90405/3/check/check-rally-dsvm-keystone/81a809d/console.html#_2014-04-30_14_04_47_046 to | 19:29 |
| morganfainberg | oh sec | 19:29 |
| morganfainberg | sorry | 19:29 |
| morganfainberg | bknudson, start was http://logs.openstack.org/05/90405/3/check/check-rally-dsvm-keystone/81a809d/console.html#_2014-04-30_14_04_17_017 | 19:29 |
| morganfainberg | wonder if we're hitting FD max on the system. | 19:30 |
| morganfainberg | or something | 19:30 |
| bknudson | taking 40 sec to get a token is too long | 19:30 |
| morganfainberg | bknudson, agree. | 19:30 |
| bknudson | 14:04:16.999 - 14:04:47.029 -- 30 sec | 19:30 |
| bknudson | but maybe setting the timeout longer would allow the test to pass | 19:31 |
| bknudson | we'll still get the rally results, it'll just show a bunch of tests taking > 30 sec | 19:31 |
| morganfainberg | bknudson, well, we have a start, we can playwith all the settings / changes / etc now :) | 19:31 |
| *** gaud has joined #openstack-keystone | 19:31 | |
| bknudson | morganfainberg: ok, so how do we speed up getting token / creating user? | 19:32 |
| bknudson | remove the sleeps? | 19:32 |
| bknudson | no logging? | 19:32 |
| *** david-lyle has joined #openstack-keystone | 19:32 | |
| morganfainberg | bknudson, hm. less logging (or smarter logging) will help. reduce trips to the DB | 19:33 |
| morganfainberg | bknudson, db/backing store | 19:33 |
| bknudson | cache the catalog rather than regen it all the time? | 19:33 |
| morganfainberg | bknudson, ++ yes | 19:33 |
| morganfainberg | bknudson, work to lighten the tokens up (id only discussion) less data to muck with, handle on each request | 19:34 |
| morganfainberg | bknudson, try under mod_wsgi vs eventlet. | 19:34 |
| openstackgerrit | Andreas Jaeger proposed a change to openstack/identity-api: Replace non-breaking space https://review.openstack.org/91440 | 19:34 |
| bknudson | I wonder what the diff in performance is between the templated catalog and the sql catalog | 19:35 |
| morganfainberg | bknudson, templated is probably significantly faster | 19:35 |
| *** sbfox has quit IRC | 19:36 | |
| *** sbfox has joined #openstack-keystone | 19:37 | |
| *** derek_c has joined #openstack-keystone | 19:38 | |
| morganfainberg | bknudson, revocation events vs. TRL | 19:41 |
| *** doddstack has joined #openstack-keystone | 19:41 | |
| bknudson | morganfainberg: I doubt that these tests are revoking any tokens. | 19:42 |
| bknudson | morganfainberg: or is it deleting the user as the user? that would revoke a lot of tokens | 19:43 |
| *** chandan_kumar has quit IRC | 19:43 | |
| *** leseb has quit IRC | 19:44 | |
| *** leseb has joined #openstack-keystone | 19:51 | |
| *** leseb has quit IRC | 19:55 | |
| *** sbfox1 has joined #openstack-keystone | 20:03 | |
| *** sbfox has quit IRC | 20:04 | |
| *** sbfox1 has quit IRC | 20:14 | |
| ayoung | something wrong with role_assignements and Federation | 20:23 |
| ayoung | If I use "external" Kerberos and get a token: I get | 20:23 |
| ayoung | well I get a token....specifically requesting for Demo project | 20:23 |
| ayoung | lemme make sure that is correct. But doing it via Federation I get: | 20:24 |
| ayoung | "User ayoung has no access to project 5d15013cbebd4b1e95ad3b5785c866f7" | 20:24 |
| ayoung | I see the relationship in mysql | 20:24 |
| morganfainberg | bknudson, if there are tokens for the user, yes | 20:24 |
| ayoung | UserProject | ayoung | 5d15013cbebd4b1e95ad3b5785c866f7 | a5ba1b4809c9471db77402446a5170ee | 0 | 20:24 |
| morganfainberg | bknudson, not sure how it all works atm, but we should look | 20:24 |
| ayoung | what could be messing that up? | 20:24 |
| -openstackstatus- NOTICE: the gate is backed up due to broken nodepool images, fix in progress (eta 22:00 utc) | 20:25 | |
| *** ChanServ changes topic to "the gate is backed up due to broken nodepool images, fix in progress (eta 22:00 utc)" | 20:25 | |
| bknudson | I thought federation only used group assignments? | 20:25 |
| ayoung | ah...that must be it | 20:26 |
| ayoung | bknudson, that would explain it...let me test | 20:26 |
| ayoung | what is the magic incantation to get groups in the CLI? | 20:27 |
| *** Manishanker has quit IRC | 20:31 | |
| bknudson | ayoung: --os-identity-api-version=3 | 20:34 |
| ayoung | bknudson, thanks. I gave up on the CLI and went right to the API. That seems to be the norm for me these days | 20:34 |
| bknudson | the cli is getting better. maybe needs to do version discovery? | 20:35 |
| bknudson | or just switch to v3 if someone uses group | 20:35 |
| *** bach_ has quit IRC | 20:36 | |
| ayoung | bknudson, nah, we need to make better use of the Python API. | 20:36 |
| ayoung | I need to clean up my example scripts patches and resubmit, among other things | 20:36 |
| ayoung | CHA CHING | 20:37 |
| ayoung | bknudson, thanks. That was the last hump | 20:37 |
| *** marekd|away is now known as marekd | 20:39 | |
| *** bach has joined #openstack-keystone | 20:40 | |
| marekd | gabriel-bezerra: hi. | 20:41 |
| marekd | so what's up with the token? | 20:41 |
| *** Chicago has joined #openstack-keystone | 20:45 | |
| *** Chicago has joined #openstack-keystone | 20:45 | |
| gabriel-bezerra | marekd: I don't know yet. | 20:46 |
| gabriel-bezerra | ayoung is getting it to work with his fork of python-keystoneclient | 20:46 |
| gabriel-bezerra | I was trying to use the REST api | 20:46 |
| *** bach has quit IRC | 20:47 | |
| boris-42 | morganfainberg | 20:47 |
| morganfainberg | boris-42, hi | 20:47 |
| marekd | and you had problem with listing idp, right? | 20:47 |
| ayoung | gabriel-bezerra, I win. | 20:47 |
| boris-42 | morganfainberg bknudson the issues is not in rally | 20:47 |
| gabriel-bezerra | my only clue was that RBAC: Invalid token | 20:47 |
| boris-42 | morganfainberg bknudson it's eventlet | 20:47 |
| *** bach has joined #openstack-keystone | 20:47 | |
| boris-42 | morganfainberg bknudson let me just show from logs of keystone | 20:47 |
| marekd | gabriel-bezerra: but when listing idps, right? | 20:47 |
| ayoung | gabriel-bezerra, I gots me a token. Needed the group-role assignemtn | 20:47 |
| ayoung | assignment | 20:47 |
| ayoung | gabriel-bezerra, you're useing the cloudsample policy file, right? | 20:48 |
| morganfainberg | boris-42, i found the events in the keystone log corresponding to the greenio/buffer issues | 20:48 |
| gabriel-bezerra | yes, I am. | 20:48 |
| morganfainberg | boris-42, we discussed that :) | 20:48 |
| marekd | ayoung: are you using SAML2 itself? | 20:48 |
| morganfainberg | boris-42, we were also talking about the places to aim to fix that stuff. | 20:48 |
| ayoung | gabriel-bezerra, OK, so this is the rule that should be executing | 20:48 |
| boris-42 | morganfainberg so this stuff http://paste.openstack.org/show/78075/ =) | 20:48 |
| ayoung | "identity:list_identity_providers": "rule:admin_required", | 20:48 |
| morganfainberg | boris-42, yep. | 20:49 |
| ayoung | "admin_required": "role:admin", | 20:49 |
| boris-42 | morganfainberg btw about base configuration for keystone.yaml | 20:49 |
| ayoung | and you said that the token you got had that role in it? | 20:49 |
| boris-42 | morganfainberg it can be any actually | 20:49 |
| boris-42 | morganfainberg cause now we know that we have this bug | 20:49 |
| boris-42 | morganfainberg and when fix will be ready we can change together with fix keystone.yaml | 20:50 |
| boris-42 | morganfainberg to show that everything works | 20:50 |
| morganfainberg | boris-42, i think we have a lot of tuning we need to work on to give us multiple views and a number of metrics | 20:50 |
| morganfainberg | boris-42, but .. yes i agree. | 20:50 |
| ayoung | gabriel-bezerra, when you fetch the token, you can look at the body of the response and see the roles in it. I assume you saw "admin" in there? | 20:50 |
| bknudson | boris-42: I think keystone is just telling us that the client disconnected so it failed to write the response | 20:50 |
| ayoung | marekd, I used the SAML auth plugin, but I use mod_identity_lookup and sssd | 20:50 |
| morganfainberg | boris-42, it might be a timeout was part of the discussion | 20:51 |
| boris-42 | bknudson I can try just to change configuration of rally | 20:51 |
| marekd | ayoung: interesting! | 20:51 |
| boris-42 | bknudson to make timeout bigger | 20:51 |
| ayoung | marekd, one of the goals for our group at RH is to make the LDAP and general Identity stuff consumable to all webapps | 20:51 |
| morganfainberg | bknudson, actually i can tell you if it's a timeout i think. | 20:51 |
| boris-42 | bknudson morganfainberg but imho it's still bug | 20:51 |
| ayoung | marekd, link in a sec... | 20:51 |
| boris-42 | morganfainberg bknudson why anything changed?? | 20:51 |
| morganfainberg | bknudson, let me see when the io error comes from. | 20:51 |
| morganfainberg | bknudson, if it happens immidiately, it's not a timeout. | 20:51 |
| gabriel-bezerra | ayoung: Yes, I did. | 20:52 |
| boris-42 | morganfainberg bknudson we don't change at all load | 20:52 |
| ayoung | http://www.adelton.com/apache/mod_lookup_identity/ | 20:52 |
| boris-42 | morganfainberg bknudson load is always the same | 20:52 |
| ayoung | gabriel-bezerra, that is weeeeeird | 20:52 |
| morganfainberg | boris-42, right. but that doesn't mean the client isn't disconnecting due to load. load issue with a disconnect is a different issue to try and solve | 20:52 |
| marekd | ayoung: gabriel-bezerra: https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#request-an-unscoped-os-federation-token-getpost-os-federationidentity_providersidentity_providerprotocolsprotocolauth i dont think you are getting roles in your token. | 20:52 |
| morganfainberg | disconnect due to timeout that is | 20:53 |
| marekd | unless we are talking about different tokens... | 20:53 |
| boris-42 | morganfainberg let me explain how rally works | 20:53 |
| ayoung | marekd, that may very well be true | 20:53 |
| boris-42 | morganfainberg every time when we are running iteration we are doing authentifiction | 20:53 |
| gabriel-bezerra | I get a project scoped token | 20:53 |
| ayoung | I didn't look at the token itself | 20:53 |
| boris-42 | morganfainberg and then create/delete | 20:53 |
| gabriel-bezerra | project=demo, domain=Default, user=admin | 20:53 |
| marekd | ayoung: no roles, just groups... | 20:53 |
| boris-42 | morganfainberg so why we are getting timeout in this case? | 20:53 |
| marekd | groups are linked internally... | 20:53 |
| boris-42 | morganfainberg and why after ~ 2k iteration=) | 20:54 |
| marekd | gabriel-bezerra: let me try with my federated keystone.... | 20:54 |
| marekd | gabriel-bezerra: i was more interested in federated authn and rules mappings. | 20:54 |
| morganfainberg | bknudson, yep error occurs at ~the point where the ITER is marked as failed | 20:54 |
| morganfainberg | bknudson, it does look like it's timeout | 20:54 |
| morganfainberg | boris-42, right. not disputing an issue with keystone or eventlet here | 20:55 |
| boris-42 | morganfainberg could you explain me | 20:55 |
| boris-42 | morganfainberg cause it's not clear to me | 20:55 |
| boris-42 | morganfainberg for every iteration we are using own client with own authentification | 20:55 |
| boris-42 | morganfainberg it's not one client all iterations | 20:55 |
| morganfainberg | boris-42, but if we're disconnecting due to timeout and then getting an error the issue could be due to other things (GC?) working in the server and binding up the response | 20:55 |
| ayoung | marekd, I got a scoped token back from the federated auth call | 20:56 |
| morganfainberg | boris-42, it could also be bad co-routine-like logic selection on what connection to service via eventlet | 20:56 |
| marekd | ayoung: cool. | 20:56 |
| marekd | ayoung: i think i did it too, some time ago :-) | 20:56 |
| morganfainberg | boris-42, it looks like we're hitting the timeout of the keystoneclient, keystoneclient disconnects, and we raise a buffer error in the server because the socket is no longer valid | 20:56 |
| marekd | ayoung: i am wondering... | 20:57 |
| boris-42 | morganfainberg but why we are facing timeout? | 20:57 |
| ayoung | marekd, I need to write this whole thing up. | 20:57 |
| boris-42 | morganfainberg some GC things? | 20:57 |
| boris-42 | morganfainberg slows down keystone? | 20:57 |
| boris-42 | morganfainberg okay lemme put 240 timeout instead of 30 | 20:58 |
| marekd | ayoung: does freeipa handle ECP extension? | 20:58 |
| morganfainberg | boris-42, could be. this info just tells us we need to look at why ekystone is slow. | 20:58 |
| *** marcoemorais has quit IRC | 20:58 | |
| marekd | ayoung: i think not really. | 20:58 |
| boris-42 | morganfainberg okay I will put timeout to 240 | 20:58 |
| *** erecio has quit IRC | 20:58 | |
| boris-42 | morganfainberg and run 3k iterations ok? | 20:58 |
| morganfainberg | boris-42, it also means we aren't hitting a memory limit or file-descriptor limitation. :) | 20:58 |
| ayoung | marekd, FreeIPA does not do SAML. But I am not really doing SAML | 20:58 |
| morganfainberg | boris-42, don't change the current review. it's gating :) | 20:58 |
| boris-42 | morganfainberg nope I have to to this in rally | 20:59 |
| marekd | ayoung: so what does SAML in RH? :-) | 20:59 |
| ayoung | marekd, the question is whether ipsalon will support it, and I think the answer is yes, | 20:59 |
| boris-42 | morganfainberg like a do not merge patch | 20:59 |
| boris-42 | morganfainberg cause it's setup of rally | 20:59 |
| morganfainberg | boris-42, ah right | 20:59 |
| morganfainberg | boris-42, sure. | 20:59 |
| boris-42 | morganfainberg but seems like I should put it on top | 20:59 |
| morganfainberg | boris-42, lets try 240+3k iter | 20:59 |
| marekd | ayoung: since it's open and you have something to say: please do. | 20:59 |
| boris-42 | morganfainberg one sec | 20:59 |
| ayoung | marekd, I'm not really doing SAML. I'm using Kerberos and ... | 20:59 |
| marekd | ayoung: right now... | 20:59 |
| ayoung | mod_lookup_identity | 20:59 |
| morganfainberg | boris-42, looking forward to the plugin stuff :) | 20:59 |
| marekd | ayoung: but i am asking a general question.. | 21:00 |
| boris-42 | morganfainberg yep yep it will be quite soon | 21:00 |
| ayoung | mod_lookup_identity does the LDAP call for me. So I will be able to drop the LDAP backend, put a SQL in there, but still consume LDAP. | 21:00 |
| morganfainberg | bknudson, the iter 2417 failure happend a few ... miliseconds i think before this error in the keystone log http://logs.openstack.org/05/90405/3/check/check-rally-dsvm-keystone/81a809d/logs/screen-key.txt.gz#_2014-04-30_14_04_48_157 so i'm inclinded to agree it's a timeout. | 21:00 |
| ayoung | marekd, so We have saml.redhat.com, and I have no idea what that is runnning. It is run by our IT. | 21:00 |
| boris-42 | morganfainberg btw you can take samples of benchmarks from here | 21:00 |
| boris-42 | morganfainberg https://github.com/stackforge/rally/tree/master/doc/samples/tasks | 21:00 |
| morganfainberg | boris-42, awesome! | 21:00 |
| boris-42 | morganfainberg for keystone stuff https://github.com/stackforge/rally/tree/master/doc/samples/tasks/keystone | 21:00 |
| ayoung | can you even see that, or is it just internal? | 21:00 |
| morganfainberg | boris-42, thanks for the info | 21:01 |
| boris-42 | morganfainberg https://github.com/stackforge/rally/tree/master/doc/samples/tasks/authenticate authentification | 21:01 |
| * ayoung would have to kill VPN to check | 21:01 | |
| marekd | ayoung: checking. | 21:01 |
| morganfainberg | boris-42, and this does in-fact indicate a problem in keystone, i'm just trying to narrow down where to look. | 21:01 |
| boris-42 | morganfainberg yep yep | 21:01 |
| marekd | ayoung: some "redhat internal sso" showing up. | 21:01 |
| *** derek_c has quit IRC | 21:01 | |
| boris-42 | morganfainberg I understand so I am trying to help you=) | 21:01 |
| ayoung | marekd, marekd yep, that is it | 21:01 |
| boris-42 | morganfainberg to find the reason | 21:02 |
| bknudson | morganfainberg: ran a little test here and templated backend isn't any faster. | 21:02 |
| ayoung | marekd, it gives me shivers that it says "Username (Kerberos ID)" | 21:02 |
| morganfainberg | bknudson, :( boo | 21:02 |
| marekd | ayoung: hehe | 21:02 |
| ayoung | Like NO IT SHOULD JUST BE KERBEROS! | 21:02 |
| bknudson | I wonder where the slowness is. | 21:02 |
| gabriel-bezerra | ayoung, marekd: I got the same 401-Unauthorized when trying to get /v3/services | 21:02 |
| morganfainberg | bknudson, ok so we should layer caching in on it in both cases --- but that is odd are we string subbing on every request? | 21:02 |
| gabriel-bezerra | ayoung, marekd: with that very token | 21:03 |
| marekd | gabriel-bezerra: so there is problem somewhere not related to the federation? | 21:03 |
| ayoung | marekd, I had an intern last summer that worked on a proxy that let Kerberos work over port 443, so you could get tokens across the public internet. He submitted it to MIT, but then went back to school. I really wanted that in for RHEL7 | 21:03 |
| ayoung | Butit will probably be more like 7.1 or .2 | 21:03 |
| gabriel-bezerra | ayoung, marekd: I'll remove federation from the pipeline and check if the problem still happens | 21:03 |
| ayoung | and Fedora 22 probably | 21:03 |
| marekd | gabriel-bezerra: ok! | 21:03 |
| ayoung | gabriel-bezerra, where in the pipeline did you put it? | 21:03 |
| ayoung | You might have put it before hte auth stuff... | 21:04 |
| ayoung | not that it should matter for the other services though | 21:04 |
| boris-42 | morganfainberg https://review.openstack.org/#/c/91463/ | 21:04 |
| ayoung | mine looks like this | 21:04 |
| morganfainberg | boris-42, i'll keep my eye on the review | 21:04 |
| ayoung | [pipeline:api_v3] | 21:04 |
| ayoung | pipeline = sizelimit url_normalize build_auth_context token_auth admin_token_auth xml_body_v3 json_body ec2_extension_v3 s3 | 21:04 |
| ayoung | _extension simple_cert_extension federation_extension service_v3 | 21:04 |
| ayoung | no break between s2 and _extension | 21:05 |
| ayoung | marekd, so say I want to map a user to multiple groups...what would that look like? | 21:05 |
| openstackgerrit | Kevin Kirkpatrick proposed a change to openstack/keystone: Keystone doc change Added warning for keystone auth module is only supported in v3.0 * bug/1311324 https://review.openstack.org/91464 | 21:05 |
| gabriel-bezerra | pipeline = sizelimit url_normalize build_auth_context token_auth admin_token_auth xml_body_v3 json_body ec2_extension_v3 s3_extension simple_cert_extension federation_extension service_v3 | 21:06 |
| *** afaranha has left #openstack-keystone | 21:06 | |
| ayoung | looks right | 21:07 |
| gabriel-bezerra | it didn't work even without federation on the pipeline | 21:08 |
| marekd | gabriel-bezerra: is it normal openstack installation, some devstack or what? | 21:09 |
| marekd | ayoung: ah, ha, don't remember at the moment. | 21:09 |
| rodrigods | stevemar, =) | 21:09 |
| ayoung | marekd, so there will be a few things I need to clear up. One is how to match multiple groups, where a user can be in any specfic subset of them ,adn get each group to become a separate group assignment in Keystone. | 21:10 |
| ayoung | so sya I have 3 groups: osprey, eagle, hawk | 21:10 |
| rodrigods | stevemar, asking you to review the blueprints again, if possible | 21:10 |
| bknudson | "POST /v2.0/tokens HTTP/1.1" 200 0 37.324760 | 21:10 |
| rodrigods | stevemar, https://blueprints.launchpad.net/python-openstackclient/+spec/roles-assignment-list and https://blueprints.launchpad.net/python-keystoneclient/+spec/roles-assignment-support | 21:10 |
| gabriel-bezerra | marekd: devstack | 21:10 |
| ayoung | and I want users that are in each of those groups in LDAP to be in the corresponding group in Keystone | 21:10 |
| bknudson | "POST /v2.0/users HTTP/1.1" 200 302 1.373178 | 21:11 |
| marekd | ayoung: try with multiple {"group": "gid"} in the local object in the rule. | 21:11 |
| ayoung | marekd, yep, that was my first thought. Tryin now | 21:12 |
| bknudson | "POST /v2.0/tokens HTTP/1.1" 200 0 55.890097 -- that was a slow one | 21:13 |
| *** marcoemorais has joined #openstack-keystone | 21:13 | |
| ayoung | marekd, nope....think we have some work to do... | 21:15 |
| ayoung | and now I have to go play dad | 21:15 |
| *** ayoung is now known as ayoung_DadMode | 21:15 | |
| marekd | ayoung_DadMode: spitted out only first group? | 21:16 |
| marekd | gabriel-bezerra: let me share my configs with you.. | 21:16 |
| marekd | gabriel-bezerra: or just reinstall your devstack... | 21:16 |
| marekd | it should work out of the box. | 21:17 |
| *** bach has quit IRC | 21:18 | |
| *** bach has joined #openstack-keystone | 21:18 | |
| gabriel-bezerra | marekd: I'll try that later. I have to go for now. | 21:21 |
| gabriel-bezerra | thank you guys for the hand today. | 21:21 |
| *** sbfox has joined #openstack-keystone | 21:22 | |
| *** sbfox has quit IRC | 21:25 | |
| *** derek_c has joined #openstack-keystone | 21:26 | |
| *** bach has quit IRC | 21:27 | |
| *** bach_ has joined #openstack-keystone | 21:27 | |
| *** thiagop has quit IRC | 21:29 | |
| *** sbfox has joined #openstack-keystone | 21:34 | |
| *** sbfox has quit IRC | 21:35 | |
| *** sbfox has joined #openstack-keystone | 21:38 | |
| *** stevemar has quit IRC | 21:56 | |
| *** gaud has quit IRC | 22:07 | |
| *** stevemar has joined #openstack-keystone | 22:09 | |
| *** bach_ has quit IRC | 22:09 | |
| *** bach has joined #openstack-keystone | 22:10 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: auth_token configurable check of revocations for cached https://review.openstack.org/90472 | 22:12 |
| *** leseb has joined #openstack-keystone | 22:13 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Remove unused AdjustedBaseAuthTokenMiddlewareTest https://review.openstack.org/90618 | 22:16 |
| *** bach has quit IRC | 22:17 | |
| *** stevemar has quit IRC | 22:19 | |
| *** gaud has joined #openstack-keystone | 22:20 | |
| *** marekd is now known as marekd|away | 22:21 | |
| *** bknudson has quit IRC | 22:29 | |
| *** amerine has joined #openstack-keystone | 22:37 | |
| *** gyee has quit IRC | 22:39 | |
| *** doddstack has quit IRC | 22:40 | |
| amerine | Did I read somewhere that XML Content-Type support was going away? I'm having a hard time finding where I might have read that | 22:40 |
| *** bach has joined #openstack-keystone | 22:44 | |
| *** bach has quit IRC | 22:46 | |
| *** bknudson has joined #openstack-keystone | 22:49 | |
| *** bach has joined #openstack-keystone | 22:50 | |
| *** amerine has quit IRC | 22:51 | |
| *** bknudson has quit IRC | 22:54 | |
| *** david-lyle has quit IRC | 22:58 | |
| *** david-lyle has joined #openstack-keystone | 22:58 | |
| *** david-lyle has quit IRC | 22:58 | |
| *** amerine has joined #openstack-keystone | 23:01 | |
| *** jamielennox|away is now known as jamielennox | 23:01 | |
| *** diegows has quit IRC | 23:08 | |
| *** bknudson has joined #openstack-keystone | 23:09 | |
| bknudson | looks like during devstack heat setup it tries to create a domain | 23:22 |
| bknudson | which doesn't work with ldap? | 23:22 |
| jamielennox | bknudson: is the mailing list thread you are referring to? | 23:23 |
| bknudson | jamielennox: I haven't seen a mailing list thread, just tried to run devstack with ldap config | 23:23 |
| jamielennox | bknudson: ah ok - there is a topic & bug to do with heat and the way it creates domains, wasn't sure where the problem was exactly | 23:24 |
| bknudson | jamielennox: I see the mailing list... hopefully they don't try it with ldap, they'll go ballistic. | 23:25 |
| bknudson | they'll trash keystone at the developer conference again. | 23:25 |
| jamielennox | yea - there's no way the devstack ldap code is correct with the one idp per domain model | 23:25 |
| jamielennox | meh, identity should be slower moving than the other projects | 23:26 |
| bknudson | looks like the post to create the domain worked but then get domain failed. weird | 23:27 |
| *** diegows has joined #openstack-keystone | 23:36 | |
| *** gaud has quit IRC | 23:38 | |
| *** joesavak has quit IRC | 23:40 | |
| *** gaud has joined #openstack-keystone | 23:41 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixed the size limit tests in Python 3 https://review.openstack.org/84053 | 23:58 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixed the policy tests in Python 3 https://review.openstack.org/84054 | 23:58 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds several more tests to the Python 3 test run https://review.openstack.org/84055 | 23:58 |
| *** bach has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!