| *** xianghui has joined #openstack-keystone | 01:19 | |
| *** mattinator has quit IRC | 01:21 | |
| *** diegows has joined #openstack-keystone | 01:45 | |
| *** diegows has quit IRC | 01:51 | |
| *** dstanek_zzz is now known as dstanek | 02:08 | |
| *** lbragstad has joined #openstack-keystone | 02:41 | |
| *** stevemar has joined #openstack-keystone | 02:43 | |
| *** mberlin1 has joined #openstack-keystone | 02:45 | |
| *** mberlin has quit IRC | 02:47 | |
| *** dstanek is now known as dstanek_zzz | 03:14 | |
| *** lnxnut has joined #openstack-keystone | 03:30 | |
| *** dstanek_zzz is now known as dstanek | 03:32 | |
| *** lnxnut has quit IRC | 03:57 | |
| *** Abhijeet has joined #openstack-keystone | 04:04 | |
| *** dstanek is now known as dstanek_zzz | 04:46 | |
| *** dstanek_zzz is now known as dstanek | 04:50 | |
| *** dstanek is now known as dstanek_zzz | 05:20 | |
| *** dstanek_zzz is now known as dstanek | 05:30 | |
| *** dstanek is now known as dstanek_zzz | 05:51 | |
| *** dims has quit IRC | 05:54 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/90288 | 06:05 |
|---|---|---|
| *** daneyon has quit IRC | 06:08 | |
| *** ajayaa has joined #openstack-keystone | 06:10 | |
| *** lbragstad has quit IRC | 06:18 | |
| *** jaosorior has joined #openstack-keystone | 06:32 | |
| *** andreaf has joined #openstack-keystone | 06:46 | |
| *** dstanek_zzz is now known as dstanek | 06:53 | |
| *** leseb has joined #openstack-keystone | 07:01 | |
| *** dstanek is now known as dstanek_zzz | 07:03 | |
| *** d0ugal has joined #openstack-keystone | 07:06 | |
| *** BAKfr has joined #openstack-keystone | 07:07 | |
| openstackgerrit | Marcos FermÃn Lobo proposed a change to openstack/keystone: Unimplemented get roles by group for project list https://review.openstack.org/76470 | 07:07 |
| *** stevemar has quit IRC | 07:21 | |
| *** andreaf has quit IRC | 07:26 | |
| *** andreaf has joined #openstack-keystone | 07:27 | |
| *** praneshp_ has quit IRC | 07:33 | |
| *** jkappert has quit IRC | 07:37 | |
| *** jkappert has joined #openstack-keystone | 07:39 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Refactor tests regarding required attributes https://review.openstack.org/92535 | 07:49 |
| *** john3213 has joined #openstack-keystone | 08:25 | |
| *** john3213 has left #openstack-keystone | 08:30 | |
| *** leseb has quit IRC | 08:53 | |
| *** leseb has joined #openstack-keystone | 09:15 | |
| *** leseb has quit IRC | 09:20 | |
| *** Abhijeet has quit IRC | 09:22 | |
| *** leseb has joined #openstack-keystone | 09:25 | |
| jaosorior | ping bknudson | 09:55 |
| *** leseb has quit IRC | 10:12 | |
| *** leseb has joined #openstack-keystone | 10:14 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/identity-api: Trusted Attributes Policy for External Identity Providers (Federation pt 4) https://review.openstack.org/60489 | 10:19 |
| *** leseb has quit IRC | 10:46 | |
| *** lnxnut has joined #openstack-keystone | 11:13 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Refactor driver_hints https://review.openstack.org/93992 | 11:14 |
| *** lbragstad has joined #openstack-keystone | 11:23 | |
| *** lnxnut has quit IRC | 11:24 | |
| *** leseb has joined #openstack-keystone | 11:52 | |
| *** diegows has joined #openstack-keystone | 12:00 | |
| *** JuanManuelOlle has joined #openstack-keystone | 12:05 | |
| *** dims_ has joined #openstack-keystone | 12:07 | |
| *** askb has joined #openstack-keystone | 12:07 | |
| *** askb has quit IRC | 12:12 | |
| *** askb has joined #openstack-keystone | 12:13 | |
| *** dstanek_zzz is now known as dstanek | 12:22 | |
| *** askb is now known as abelur | 12:24 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: debug level logs should not be translated https://review.openstack.org/93013 | 12:24 |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: all non debug log messages should be translated https://review.openstack.org/94184 | 12:24 |
| *** abelur is now known as askb | 12:25 | |
| *** askb is now known as abelur | 12:26 | |
| *** abelur is now known as abelurs | 12:27 | |
| *** abelurs is now known as askb | 12:28 | |
| *** askb has quit IRC | 12:28 | |
| *** leseb has quit IRC | 12:31 | |
| *** dhellmann is now known as dhellmann_ | 12:31 | |
| *** askb has joined #openstack-keystone | 12:32 | |
| *** leseb has joined #openstack-keystone | 12:33 | |
| *** leseb has quit IRC | 12:35 | |
| *** leseb has joined #openstack-keystone | 12:35 | |
| *** dstanek is now known as dstanek_zzz | 12:38 | |
| *** henrynash has joined #openstack-keystone | 12:40 | |
| openstackgerrit | Emilien Macchi proposed a change to openstack/keystone: sql migration: ensure using innodb utf8 for assignment table https://review.openstack.org/94187 | 12:43 |
| *** ayoung has joined #openstack-keystone | 12:43 | |
| *** leseb has quit IRC | 12:47 | |
| *** mberlin1 is now known as mberlin | 12:47 | |
| *** leseb has joined #openstack-keystone | 12:47 | |
| *** xianghui has quit IRC | 12:57 | |
| *** pliniker has quit IRC | 12:58 | |
| *** dstanek_zzz is now known as dstanek | 13:12 | |
| *** ayoung has quit IRC | 13:16 | |
| *** ayoung has joined #openstack-keystone | 13:17 | |
| *** leseb has quit IRC | 13:22 | |
| *** leseb has joined #openstack-keystone | 13:22 | |
| *** leseb has quit IRC | 13:27 | |
| *** leseb has joined #openstack-keystone | 13:29 | |
| *** ChanServ sets mode: +o dolphm | 13:29 | |
| afaranha | Hello, does someone know how to add an user using the v3 API? There is the POST /user in V2 but I didn't found in V3. | 13:30 |
| *** henrynash has quit IRC | 13:31 | |
| dims_ | afaranha, see http://adam.younglogic.com/2013/09/keystone-v3-api-examples/ | 13:31 |
| afaranha | dims_: Thankz, It's just a missing documentation then :) | 13:33 |
| openstackgerrit | Diane Fleming proposed a change to openstack/identity-api: Clean up files for identity v2.0 reference https://review.openstack.org/94194 | 13:33 |
| JuanManuelOlle | afaranha: this is what you are lookinf for? https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#create-user-post-users | 13:36 |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: all non debug log messages should be translated https://review.openstack.org/94184 | 13:39 |
| afaranha | JuanManuelOlle: Yes, it is. I always look at this one http://developer.openstack.org/api-ref-identity-v3.html, thankz | 13:39 |
| *** leseb has quit IRC | 13:41 | |
| *** leseb has joined #openstack-keystone | 13:41 | |
| *** nkinder has joined #openstack-keystone | 14:02 | |
| *** rwsu has joined #openstack-keystone | 14:06 | |
| *** anteaya has joined #openstack-keystone | 14:09 | |
| anteaya | I see this acl file creates a new group keystone-specs-core, I just want to confirm that this is intentional and you do want a new gerrit group: https://review.openstack.org/#/c/94119/2/modules/openstack_project/files/gerrit/acls/openstack/keystone-specs.config | 14:10 |
| anteaya | there is some copy/pastaing happening and some project do not in fact want a separate group for specs admin | 14:10 |
| anteaya | s/project/projects | 14:11 |
| *** lnxnut has joined #openstack-keystone | 14:14 | |
| *** morganfainberg_Z is now known as morganfainberg | 14:19 | |
| dolphm | anteaya: i agree with the concern, but am not aware of a desire to have a new *-core group or not | 14:19 |
| dolphm | afaranha: POST /v3/users https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md | 14:19 |
| morganfainberg | dolphm, anteaya, that was my original intention, smae core group as we have | 14:20 |
| anteaya | dolphm: okay, right now morganfainberg's acl patch depends on a new gerrit group | 14:20 |
| morganfainberg | had an issue with substitution in that file. | 14:20 |
| anteaya | okay so remove the -specs part of the group in the acl file on the next patchset | 14:20 |
| morganfainberg | dolphm, anteaya, going to fix that right now actually. the other questions is should it be identity-specs or keystone-specs? | 14:20 |
| anteaya | that should get you what you want | 14:20 |
| anteaya | right, I saw that | 14:20 |
| morganfainberg | dolphm, anteaya, I'm inclined to use program. | 14:20 |
| anteaya | and dolphm raises a good point | 14:21 |
| dolphm | anteaya: is the consensus to name these repos as "{program}-specs" or "{project}-specs"? | 14:21 |
| morganfainberg | dolphm, i actually flipped that 3-4 times before submitting it the first time :P | 14:21 |
| anteaya | technically it would be more correct to do {program}-specs | 14:21 |
| diegows | hi | 14:21 |
| anteaya | but the crowd is doing {project}-specs | 14:21 |
| dolphm | anteaya: even though clients don't follow the release naming process? | 14:21 |
| diegows | I'm trying to write a custom authentication method using v3 api | 14:21 |
| diegows | v3 api works for me using the stanard password method | 14:21 |
| anteaya | though it is implied that the {project}-specs repo encompases the program | 14:22 |
| morganfainberg | dolphm, anteaya, {program}-specs also future proofs if we add new projects | 14:22 |
| diegows | but when I add a new one, horizon always uses the password method name | 14:22 |
| dolphm | anteaya: that is not implied at all to me, unless it's {program}-specs | 14:22 |
| morganfainberg | dolphm, ++ | 14:22 |
| anteaya | I don't get the sense that programs will be creating a per project specs repo | 14:22 |
| diegows | is there a negotiation instance, config or something so the clients can use a specific method? | 14:22 |
| dolphm | anteaya: i'd specs {project}client-specs explicitly, or {program}-specs if there was client inclusion | 14:23 |
| anteaya | dolphm: that is fair, but I think each program is only creating one specs repo | 14:23 |
| morganfainberg | anteaya, dolphm, then since it seems mixed, unless there is a reason not to, i'd prefer identity-specs | 14:23 |
| morganfainberg | anteaya, assuming 1 spec repo per program | 14:23 |
| dolphm | morganfainberg: i'm fine with {program} -- but we'll need to communicate the release process will vary when there's client impact | 14:23 |
| morganfainberg | dolphm, ++ | 14:24 |
| morganfainberg | dolphm, i was planning a separate directory for ksc in the specs repo | 14:24 |
| dolphm | morganfainberg: the patch just needs to be made consistent then :) | 14:24 |
| morganfainberg | dolphm, yeah fixing it now :) | 14:25 |
| *** dstanek is now known as dstanek_zzz | 14:26 | |
| ajayaa | ayoung: The concept of domains (new things) are only specific to keystone. Why do we need to change other components to use keystone v3? | 14:32 |
| ayoung | morganfainberg, dolphm BTW... https://github.com/admiyo/identity-api/ | 14:32 |
| ayoung | since I am sure you have not cleared your inboexes to actually get to my mail about it. | 14:33 |
| ayoung | ah. dolphm did...shoulda guessed | 14:33 |
| * ayoung still clearing email | 14:33 | |
| morganfainberg | ayoung, saw the email. | 14:33 |
| ayoung | 21643 unread to go.... | 14:33 |
| morganfainberg | ayoung, but i haven't cleared email yet :P | 14:33 |
| ayoung | ok, not that many | 14:34 |
| ayoung | only 2164 unread to go.... | 14:34 |
| morganfainberg | ayoung, https://review.openstack.org/#/c/94119/ cc dolphm - should be consistent now | 14:34 |
| morganfainberg | identity-specs repo | 14:34 |
| ayoung | ajayaa, so we don't really. I mean, we probably want Horizon to be able to use Domains as part of hte login, but for the other components, they should be able to work with the existing contracts. | 14:34 |
| ayoung | ajayaa, Heat, is different, in that it actually needs to call in to Keytone to do work (Mistral will too) | 14:35 |
| ayoung | ajayaa, but for things like Nova and Glance, they will make minor modifications for the Hierarchical Multitenacy Blueprint, but beyond that, should be able to handle V2/V3 from Keystone without any real changes. | 14:35 |
| morganfainberg | anteaya, should be fixed for not creating a new core team now and should be consitent. thanks! | 14:36 |
| anteaya | morganfainberg: okay thanks | 14:39 |
| anteaya | and jenkins likes it, will review | 14:39 |
| dolphm | morganfainberg: question inline https://review.openstack.org/#/c/94119/ | 14:41 |
| morganfainberg | dolphm, answer in-line. i was using nova-specs... iirc as the template for this | 14:42 |
| morganfainberg | dolphm, since they did it first. | 14:42 |
| morganfainberg | dolphm, let me go take a closer look at that today when I get to the office. | 14:43 |
| openstackgerrit | Rodrigo Duarte Sousa proposed a change to openstack/python-keystoneclient: Add /role_assignments endpoint support https://review.openstack.org/91578 | 14:44 |
| *** lnxnut is now known as hipster | 14:45 | |
| *** packet has joined #openstack-keystone | 14:47 | |
| lbragstad | dolphm: morganfainberg it doesn't look like anyone flagged the glance-spec commit for 27 jobs... https://review.openstack.org/#/c/90461/2 | 14:48 |
| morganfainberg | lbragstad, there is a test that some repos use to check headings | 14:48 |
| morganfainberg | etc | 14:48 |
| morganfainberg | https://github.com/openstack/tripleo-specs/blob/master/tests/test_titles.py | 14:48 |
| morganfainberg | i plan on stealing that test | 14:48 |
| lbragstad | gotcha, | 14:49 |
| morganfainberg | lbragstad, means we can be sure all the specs have some semblance of consistency | 14:49 |
| lbragstad | morganfainberg: cool, I agree with that | 14:50 |
| lbragstad | I was digging up the glance and qa spec commits to see if anyone had commented on not including the 27 jobs | 14:50 |
| morganfainberg | lbragstad, tripleo has them :) | 14:50 |
| lbragstad | along with nova, neutron and oslo | 14:51 |
| dolphm | morganfainberg: anteaya: lbragstad: +1 | 14:53 |
| lbragstad | nice | 14:53 |
| morganfainberg | dolphm, for KSC releases are we going to want to "archive" implemented BPs somehow? | 14:53 |
| *** dstanek_zzz is now known as dstanek | 14:54 | |
| morganfainberg | dolphm, since we wont have the nice /juno /k<something> etc dirs | 14:54 |
| dolphm | morganfainberg: i can move implented specs into versioned directories at release time | 14:55 |
| morganfainberg | dolphm, ++ woks for me. | 14:55 |
| *** thedodd has joined #openstack-keystone | 14:56 | |
| ayoung | dolphm, say someone wants to use Facebook Oauth to connect to Horizon. What is our path forward to that? | 14:56 |
| ayoung | Would it be: | 14:56 |
| ayoung | hoirzon/auth connects to the Federation extension, and then does the redirect? | 14:56 |
| morganfainberg | ayoung, besides cringing? :P (I know it's a valid approach) | 14:56 |
| ayoung | morganfainberg, Trystack | 14:56 |
| morganfainberg | ayoung, yeah. like i said, i know it's valid | 14:57 |
| ayoung | morganfainberg, they already do it, but then cache a local password for Keystone, so its extra ugly | 14:57 |
| morganfainberg | ayoung, oh ick | 14:57 |
| ayoung | yup | 14:58 |
| dstanek | ayoung: really? where do they put the password? | 14:58 |
| morganfainberg | dstanek, do you _really_ want to know? :P [I am sure I don't] | 14:58 |
| ayoung | dstanek, extra table | 14:58 |
| ayoung | specific to Horizon. | 14:59 |
| dstanek | how does that get by a security review? | 14:59 |
| morganfainberg | ayoung, that redirection seems fine if it works, it's how i'd assume any oauth would work w/ horizon | 14:59 |
| ayoung | dstanek, trystack is short lived "Demo openstack" | 14:59 |
| ayoung | http://trystack.org/ | 14:59 |
| ayoung | "Rule No. 1: Remember that TryStack is designed exclusively as a testing sandbox. " | 15:00 |
| ayoung | The second rule of TryStack is that you don;t talk...sorry, wrong movie | 15:00 |
| *** browne has joined #openstack-keystone | 15:01 | |
| morganfainberg | ayoung, making soap are we? | 15:01 |
| ayoung | only the finest | 15:01 |
| ayoung | morganfainberg, so, unless we expose Keystone to the outside world as a web UI, we need some sort of way to pass through from Hoirzon that the oauth provider approved the call | 15:05 |
| morganfainberg | ayoung, that was the general thought I had when discussing it with some coworkers. | 15:05 |
| ayoung | morganfainberg, its kindof like the S4U2 Proxy thing for Kerberos | 15:06 |
| morganfainberg | ayoung, yeah. | 15:06 |
| ayoung | morganfainberg, what if we ran a limited Keystone on the same machine as the Horizon server, mounted under /auth and responding to HTML content requests? | 15:06 |
| ayoung | we need something to either trigger REMOTE_USER or.....what? | 15:07 |
| morganfainberg | ayoung, sounds like a dirty hack. this _probably_ should be written as part of openstack_django_auth module (or whatever the name is) | 15:07 |
| ayoung | morganfainberg, right, but what would that pass to Keystone?> | 15:08 |
| ayoung | I assume it would be something like this: | 15:08 |
| ayoung | go to horizon/auth. THat calls to the fedreation extension | 15:08 |
| *** hipster has quit IRC | 15:08 | |
| ayoung | but that would do a redirect...no? | 15:08 |
| ayoung | it needs to be enough to say "go to Facebook, and hand me back soemthing" | 15:08 |
| ayoung | we need stevemar here for this conversation | 15:09 |
| morganfainberg | ayoung, or marekd|away | 15:09 |
| ayoung | yep | 15:09 |
| *** leseb has quit IRC | 15:09 | |
| dstanek | once facebook redirects back to horizon couldn't it just forward the data to keystone? | 15:09 |
| *** leseb has joined #openstack-keystone | 15:10 | |
| ayoung | dstanek, but it only has the "facebook has authorized this data" at that point | 15:10 |
| morganfainberg | dstanek, i think it can, but I don't know what that data actually looks like tbh | 15:10 |
| ayoung | not enough to authenticate with Keystone. | 15:10 |
| morganfainberg | ayoung, does it? it should have some user info as well | 15:10 |
| ayoung | oauth is not authenitcation. but delegation and info sharing | 15:10 |
| morganfainberg | ayoung, platform data is more than "authorized" alone | 15:10 |
| *** radez has joined #openstack-keystone | 15:10 | |
| ayoung | what I mean is that it could not get anything that couldn't be faked out by a direct call, I think. | 15:11 |
| ayoung | there are no "secrets" in that handshake. | 15:11 |
| morganfainberg | ayoung, but isn't that what the secret tokens in oauth are for? | 15:11 |
| dstanek | ayoung: it should have something like an oauth verifier | 15:11 |
| ayoung | If Keystone did it directly, it could trust thr response, though. | 15:11 |
| dstanek | i'm not 100% familiar with the FB flow, but that last step should have more data | 15:12 |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: use logging function parameters instead of string format arguments https://review.openstack.org/94205 | 15:13 |
| morganfainberg | dstanek, that is my understanding | 15:13 |
| morganfainberg | dstanek, ayoung, though there might be restrictions on what data can be kept that needs to be handled differently for FB specifically | 15:13 |
| ayoung | short of the mapping API, we have no way of saying "this user maps to that IdP remote user." so we need a new auth plugin, or need to modify the SAML auth plugin to accept something. BNutright now that needs REMOTE_USER | 15:14 |
| ayoung | we need an auth plugin that can accept what oauth is going to output. Then horizon would use that to make a token request, right? | 15:15 |
| ayoung | methods = ["oauth"] in the token | 15:15 |
| dstanek | ayoung, morganfainberg: so if we get an access token we have have a really simple plugin to pull user data instead of an Apache plugin | 15:16 |
| morganfainberg | ayoung, i think we should bring this back up with stevemar around. will be better. i feel like we have some gaps here. | 15:16 |
| morganfainberg | he might be able to fill in and make this easier to figure out | 15:16 |
| dstanek | it's actually really easy except establishing a trust relationship with the oauth provider (but that's because I haven't looked into the federation details) | 15:17 |
| morganfainberg | ayoung, or some extra research to fill in the gaps (e.g. FB data provided, etc) | 15:17 |
| ayoung | dstanek, yeah...I suspect it will tie in with out oauth stuff. | 15:17 |
| radez | morganfainberg: here's the way that trystack does it now in a django auth plugin | 15:17 |
| radez | https://github.com/trystack/python-django-horizon-facebook/blob/master/horizon/facebook/backend.py | 15:17 |
| ayoung | radez, that is using the "shadow" table, right? | 15:18 |
| radez | correct | 15:18 |
| morganfainberg | ayoung, https://developers.facebook.com/docs/facebook-login/login-flow-for-web/v2.0 FB connect right? | 15:19 |
| ayoung | dstanek, right now, we can use an oauth token issued by Keystone in order to get a token. Seems to me that we need a way to use an oauth token issued by Facebook to get a token | 15:19 |
| ayoung | and a way to link the Facebook and Keystone accounts. | 15:20 |
| morganfainberg | ayoung, looks like we would get userID, auth success, access token (oauth?), and signed data bout the user | 15:20 |
| ayoung | yeah, access token is the oauth thing | 15:20 |
| dstanek | ayoung: yes, a plugin to take the authtoken from the final step and use it to query FB | 15:20 |
| ayoung | could keystone verify that? | 15:20 |
| ayoung | ah..signed data | 15:21 |
| dstanek | s/authtoken/access token/ | 15:21 |
| morganfainberg | ayoung, should eb able to with the standard oauth stuff we have | 15:21 |
| ayoung | so it should be just linke the cms verify | 15:21 |
| morganfainberg | similar | 15:21 |
| morganfainberg | ayoung, but... | 15:21 |
| morganfainberg | ayoung, FB Connect is Oauth2 | 15:22 |
| morganfainberg | ayoung, not 1.1 | 15:22 |
| morganfainberg | we, iirc, only support 1.1 | 15:22 |
| ayoung | morganfainberg, so what. | 15:22 |
| ayoung | this is new noi matter what | 15:22 |
| ayoung | https://developers.facebook.com/docs/graph-api/securing-requests | 15:22 |
| morganfainberg | ayoung, not new, just something to add functionality for if we need 2.0 | 15:23 |
| ayoung | morganfainberg, keystone would need to generate app_secret_proof. | 15:23 |
| morganfainberg | ayoung, hm. yeah. | 15:24 |
| ayoung | So go to Keystone, request a request token for facebook with an app secret proof....Keystone generates it, and gets beack the access token with the proof in it. | 15:24 |
| morganfainberg | ayoung, i'll be back in a bit. need to go head into the office. | 15:24 |
| ayoung | Heh. Good morning | 15:24 |
| morganfainberg | ayoung, that looks like one mechanism to me. | 15:24 |
| dstanek | ayoung: yeah, the keystone FB plugin would need to do that | 15:25 |
| ayoung | dstanek, ++ | 15:25 |
| ayoung | https://developers.facebook.com/docs/facebook-login/security/ | 15:25 |
| morganfainberg | all looks reasonable | 15:25 |
| morganfainberg | and not awful to implement | 15:25 |
| dstanek | i dont' know how this will work in trystack because the initiate the flow trystack will have to be registered and i think that means each instance will need to do that | 15:26 |
| ayoung | so it looks like they did what we thought about doing with Keystone tokens. use a private key to sign your request, and have the public key avaialbe. That way, it isn't a bearer token | 15:26 |
| morganfainberg | ayoung, dstanek, that looks like FB app vs FB connect though? | 15:26 |
| morganfainberg | ayoung, dstanek, FB Connect is more traditional OAuth iirc | 15:26 |
| ayoung | morganfainberg, go to the office. I promise we won';t implement until we hear from you again | 15:26 |
| morganfainberg | ayoung, LOL i'd be ok if you implemented it before I got to the office . in fact, I'd be really impressed | 15:27 |
| dstanek | ...or will he... | 15:27 |
| morganfainberg | that app_secret_proof looks like it would be used for a FB platform app, not the external FB connect auth mechanism | 15:28 |
| morganfainberg | i don't think we want this to be a platform app | 15:28 |
| morganfainberg | and with that... | 15:28 |
| ayoung | radez, https://developers.facebook.com/docs/facebook-login/access-tokens/#sizes | 15:33 |
| ayoung | radez, so we need to figure out how to split that middle tier | 15:34 |
| ayoung | I think it would be passed through to Keystone to generate app secret. | 15:35 |
| ayoung | long lived token would live in Horizon | 15:35 |
| *** wwriverrat has joined #openstack-keystone | 15:35 | |
| ayoung | But..I think that would mean that Trystack would have to be a registered app with Facebook. | 15:35 |
| ayoung | and...my head asplode | 15:36 |
| *** morganfainberg is now known as morganfainberg_Z | 15:38 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: replace string format arguments with function parameters https://review.openstack.org/94205 | 15:40 |
| *** askb has quit IRC | 15:43 | |
| *** jsavak has joined #openstack-keystone | 15:47 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: replace string format arguments with function parameters https://review.openstack.org/94205 | 15:49 |
| jsavak | dolphm - looking at doing md for https://blueprints.launchpad.net/keystone/+spec/keystone-to-keystone-federation/ but noticed new BP review repo (keystone-specs). Should i still submit agianst identity-api until keystone-specs is there? | 15:49 |
| *** henrynash has joined #openstack-keystone | 15:58 | |
| *** henrynash has quit IRC | 16:01 | |
| *** gabriel-bezerra has joined #openstack-keystone | 16:01 | |
| *** BAKfr has quit IRC | 16:05 | |
| *** marcoemorais has joined #openstack-keystone | 16:13 | |
| *** praneshp_ has joined #openstack-keystone | 16:14 | |
| *** ericvw has joined #openstack-keystone | 16:15 | |
| *** marcoemorais has quit IRC | 16:17 | |
| *** hipster has joined #openstack-keystone | 16:18 | |
| rodrigods | the failing tests at https://review.openstack.org/#/c/91578/ don't seem to be related with my changes, does anyone have a hint of what's the problem there? | 16:21 |
| *** leseb has quit IRC | 16:22 | |
| ayoung | dolphm, so what is our policy on upgradinbg keystone-paste.api from release to release? In icehouse we have the simple cert extension, but it is not in previous ones, and Grenade asploeds on it | 16:22 |
| *** afazekas_ has joined #openstack-keystone | 16:22 | |
| *** leseb has joined #openstack-keystone | 16:22 | |
| afazekas_ | ayoung: | 16:23 |
| afazekas_ | ayoung: probably this is the right place for adding extra upgrade steps: https://github.com/openstack-dev/grenade/blob/master/from-havana/upgrade-keystone | 16:23 |
| *** afazekas_ is now known as afazekas | 16:24 | |
| ayoung | afazekas, yep | 16:24 |
| ayoung | afazekas, if devstack doesn't touch any of the values in the paste api, we could probably get away with a swap of the file | 16:25 |
| *** leseb has quit IRC | 16:25 | |
| *** leseb has joined #openstack-keystone | 16:26 | |
| afazekas | ayoung: is it a normally recommended upgrade step ? | 16:27 |
| ayoung | afazekas, that is what I am trying to ascertain. We don't have a keystone specific tool for upgrading changes to paste-api | 16:27 |
| ayoung | but if an end user modified theirs, then their changes would be overwritten by a blind replace of the file, and I think we treat it as a config file, not code | 16:28 |
| *** david-lyle has joined #openstack-keystone | 16:29 | |
| *** leseb has quit IRC | 16:29 | |
| *** leseb has joined #openstack-keystone | 16:30 | |
| afazekas | ayoung: what are the exact changes required If I want those https://bugs.launchpad.net/keystone/+bug/1320670 calls working ? | 16:30 |
| uvirtbot | Launchpad bug 1320670 in tempest "404 on GET /v3/OS-SIMPLE-CERT/ca at grenade" [Undecided,New] | 16:30 |
| *** wwriverrat has left #openstack-keystone | 16:31 | |
| ayoung | afazekas, add in the filter: | 16:31 |
| afazekas | iniset <config_file> <section> <option> <value> | 16:31 |
| ayoung | [filter:simple_cert_extension] | 16:31 |
| ayoung | paste.filter_factory = keystone.contrib.simple_cert:SimpleCertExtension.factory | 16:31 |
| ayoung | that usually goes right after [filter:endpoint_filter_extension] | 16:31 |
| ayoung | paste.filter_factory = keystone.contrib.endpoint_filter.routers:EndpointFilterExtension.factory | 16:31 |
| ayoung | which should be there in havana | 16:31 |
| ayoung | and then | 16:31 |
| ayoung | in [pipeline:api_v3] add | 16:31 |
| ayoung | simple_cert_extension right before service_v3 | 16:32 |
| afazekas | I guess the ordering for [filter:simple_cert_extension] does not matters. | 16:33 |
| ayoung | afazekas, nope, just has to come before the pipeline that uses it | 16:38 |
| *** marcoemorais has joined #openstack-keystone | 16:39 | |
| ayoung | afazekas, you could potentially apply the diff patch bbetween havana and icehouse, and then in the downgrade, unapply it | 16:40 |
| ayoung | afazekas, http://paste.fedoraproject.org/103149/05176971/ | 16:42 |
| ayoung | afazekas, I got that from git diff origin/stable/havana:etc/keystone-paste.ini origin/stable/icehouse:etc/keystone-paste.ini | 16:43 |
| afazekas | Creating a patch.. | 16:43 |
| *** morganfainberg_Z is now known as morganfainberg | 16:44 | |
| ayoung | afazekas, ++ let me know if you need anything else | 16:44 |
| afazekas | ayoung: first version: https://review.openstack.org/94226 | 16:46 |
| *** harlowja has joined #openstack-keystone | 16:48 | |
| afazekas | ayoung: I would like to see typo related comments before jenkins finishes :) | 16:49 |
| ayoung | afazekas, lets see... | 16:49 |
| ayoung | afazekas, can you past a before and after foto? | 16:50 |
| *** leseb has quit IRC | 16:53 | |
| *** leseb has joined #openstack-keystone | 16:53 | |
| *** leseb_ has joined #openstack-keystone | 16:57 | |
| afazekas | ayoung: http://www.fpaste.org/103157/40051864/ | 16:57 |
| *** leseb has quit IRC | 16:57 | |
| ayoung | afazekas, thanks, cuz my machine is spinning on yum search iniset | 16:58 |
| ayoung | afazekas, looks like that puts the filter at the bottom. Not sure if that will work. Is suspect not. | 16:59 |
| afazekas | ayoung: you need to source the devstack/functions | 16:59 |
| ayoung | ah | 16:59 |
| afazekas | ayoung: it is similar to crudini or openstack-config | 16:59 |
| ayoung | morganfainberg, does order matter in paste config? | 16:59 |
| morganfainberg | ayoung, iirc it shouldn't | 17:00 |
| afazekas | AFAIK it does not matter in any python conf | 17:00 |
| ayoung | afazekas, cool. I can confiurm in a devstack I have running.... | 17:00 |
| *** gyee has joined #openstack-keystone | 17:01 | |
| ayoung | looks like it works | 17:01 |
| *** jaosorior has quit IRC | 17:01 | |
| ayoung | afazekas what is local pipeline? | 17:02 |
| ayoung | and...it is 1PM. | 17:04 |
| afazekas | ayoung: limits the variable scope to the function | 17:04 |
| *** BAKfr has joined #openstack-keystone | 17:04 | |
| ayoung | ++ | 17:04 |
| * ayoung a little rusty on bashisms | 17:04 | |
| *** leseb_ has quit IRC | 17:07 | |
| *** amcrn has joined #openstack-keystone | 17:26 | |
| *** thedodd has quit IRC | 17:29 | |
| *** jaosorior has joined #openstack-keystone | 17:30 | |
| jaosorior | lbragstad, what do you think of my suggestion as put in this change? https://review.openstack.org/#/c/92535/ | 17:35 |
| lbragstad | jaosorior: checking | 17:37 |
| lbragstad | jaosorior: I don't think it would be that big of a deal, I was just thinking it could save an extra method.. since we have _require_attribute and _require_attributes, both of what are used by assert_attribute and assert_attributes, that way the assert method would determine which _require method to call. | 17:39 |
| lbragstad | either way would be fine by me now that I think about it | 17:39 |
| jaosorior | alright, tomorrow I'll upload it with decorators | 17:39 |
| lbragstad | jaosorior: cool! I'll be sure to check it out | 17:40 |
| jaosorior | it's 9pm here and I forgot my work laptop (haven't managed to set up an environment for keystone in my home computer with ArchLinux) | 17:40 |
| lbragstad | gotcha | 17:40 |
| *** dims_ has quit IRC | 17:42 | |
| *** afazekas has quit IRC | 17:46 | |
| *** harlowja has quit IRC | 17:50 | |
| *** harlowja has joined #openstack-keystone | 17:50 | |
| *** rodrigods_ has joined #openstack-keystone | 17:55 | |
| *** rodrigods_ has quit IRC | 17:57 | |
| *** harlowja has quit IRC | 18:00 | |
| *** harlowja has joined #openstack-keystone | 18:00 | |
| *** rodrigods_ has joined #openstack-keystone | 18:02 | |
| *** rodrigods_ has quit IRC | 18:04 | |
| *** thedodd has joined #openstack-keystone | 18:08 | |
| *** hipster has quit IRC | 18:15 | |
| *** andreaf has quit IRC | 18:18 | |
| *** atmark has quit IRC | 18:18 | |
| *** rodrigods_ has joined #openstack-keystone | 18:23 | |
| *** gokrokve has joined #openstack-keystone | 18:38 | |
| openstackgerrit | Diane Fleming proposed a change to openstack/identity-api: Clean up files for identity v2.0 reference https://review.openstack.org/94194 | 18:41 |
| *** hipster has joined #openstack-keystone | 18:47 | |
| *** hipster has quit IRC | 18:51 | |
| *** andreaf has joined #openstack-keystone | 18:55 | |
| *** rodrigods_ has quit IRC | 19:01 | |
| *** marcoemorais has quit IRC | 19:04 | |
| *** marcoemorais has joined #openstack-keystone | 19:10 | |
| *** dstanek is now known as dstanek_zzz | 19:12 | |
| *** dstanek_zzz is now known as dstanek | 19:14 | |
| *** hipster has joined #openstack-keystone | 19:18 | |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Make sure scoping to the project of a disabled domain result in 401. https://review.openstack.org/94251 | 19:21 |
| *** hipster has quit IRC | 19:23 | |
| *** praneshp_ has quit IRC | 19:29 | |
| *** dims has joined #openstack-keystone | 19:34 | |
| *** ajayaa has quit IRC | 19:41 | |
| *** marcoemorais has quit IRC | 19:42 | |
| *** marcoemorais has joined #openstack-keystone | 19:42 | |
| *** radez is now known as radez_g0n3 | 19:43 | |
| *** hipster has joined #openstack-keystone | 19:47 | |
| *** jaosorior has quit IRC | 19:51 | |
| ayoung | morganfainberg, we want to put user or group into the hash when we do https://etherpad.openstack.org/p/juno-keystone-user-ids | 19:52 |
| *** hipster has quit IRC | 19:52 | |
| ayoung | othewise user ids and group ids that are the same will hash to the same value | 19:52 |
| *** amcrn has quit IRC | 19:54 | |
| *** jraim has quit IRC | 19:54 | |
| *** browne has quit IRC | 19:55 | |
| *** browne has joined #openstack-keystone | 19:55 | |
| *** jraim has joined #openstack-keystone | 19:57 | |
| *** henrynash has joined #openstack-keystone | 19:57 | |
| *** packet has quit IRC | 19:58 | |
| *** browne1 has joined #openstack-keystone | 19:58 | |
| *** erecio has quit IRC | 19:59 | |
| *** browne has quit IRC | 19:59 | |
| *** praneshp_ has joined #openstack-keystone | 20:00 | |
| *** praneshp_ has quit IRC | 20:00 | |
| *** amcrn has joined #openstack-keystone | 20:00 | |
| *** harlowja has quit IRC | 20:01 | |
| *** marcoemorais has quit IRC | 20:01 | |
| *** marcoemorais has joined #openstack-keystone | 20:02 | |
| *** harlowja has joined #openstack-keystone | 20:02 | |
| *** erecio has joined #openstack-keystone | 20:04 | |
| *** rodrigods has quit IRC | 20:06 | |
| *** henrynash has quit IRC | 20:07 | |
| openstackgerrit | David Stanek proposed a change to openstack/python-keystoneclient: Fixes an erroneous type check in a test https://review.openstack.org/94256 | 20:08 |
| *** praneshp_ has joined #openstack-keystone | 20:10 | |
| *** dims has quit IRC | 20:11 | |
| *** dims has joined #openstack-keystone | 20:12 | |
| *** dims has quit IRC | 20:18 | |
| *** daneyon has joined #openstack-keystone | 20:19 | |
| *** atmark has joined #openstack-keystone | 20:28 | |
| *** atmark is now known as Guest82130 | 20:28 | |
| *** dstanek is now known as dstanek_zzz | 20:30 | |
| *** amcrn has quit IRC | 20:36 | |
| *** bobt has joined #openstack-keystone | 20:37 | |
| *** amcrn has joined #openstack-keystone | 20:42 | |
| morganfainberg | ayoung, good point | 20:42 |
| ayoung | morganfainberg, you responding to what I said in -dev? | 20:43 |
| morganfainberg | ayoung, no the group thing | 20:43 |
| morganfainberg | ayoung, with hashing | 20:43 |
| ayoung | ah, yep | 20:43 |
| morganfainberg | hadn't cycled over to -dev yet | 20:43 |
| *** hipster has joined #openstack-keystone | 20:47 | |
| *** amcrn has quit IRC | 20:51 | |
| *** hipster has quit IRC | 20:52 | |
| *** JuanManuelOlle has quit IRC | 20:53 | |
| *** ayoung is now known as ayoung_dad_mode | 20:59 | |
| *** browne has joined #openstack-keystone | 21:04 | |
| *** browne1 has quit IRC | 21:04 | |
| *** rodrigods has joined #openstack-keystone | 21:14 | |
| *** dstanek_zzz is now known as dstanek | 21:14 | |
| *** dstanek is now known as dstanek_zzz | 21:24 | |
| *** harlowja has quit IRC | 21:32 | |
| *** harlowja has joined #openstack-keystone | 21:33 | |
| *** jsavak has quit IRC | 21:43 | |
| *** dims has joined #openstack-keystone | 21:44 | |
| *** dstanek_zzz is now known as dstanek | 21:45 | |
| *** hipster has joined #openstack-keystone | 21:47 | |
| *** hipster has quit IRC | 21:52 | |
| *** andreaf has quit IRC | 21:55 | |
| *** dstanek is now known as dstanek_zzz | 21:55 | |
| *** andreaf has joined #openstack-keystone | 21:55 | |
| *** rodrigods has quit IRC | 21:58 | |
| *** rodrigods has joined #openstack-keystone | 21:59 | |
| *** rodrigods has quit IRC | 22:15 | |
| *** browne has quit IRC | 22:15 | |
| *** rodrigods has joined #openstack-keystone | 22:15 | |
| *** rodrigods has joined #openstack-keystone | 22:15 | |
| *** BAKfr has quit IRC | 22:22 | |
| *** rodrigods has quit IRC | 22:28 | |
| *** nkinder has quit IRC | 22:28 | |
| *** dims has quit IRC | 22:30 | |
| *** thedodd has quit IRC | 22:38 | |
| *** dstanek_zzz is now known as dstanek | 22:40 | |
| *** rodrigods has joined #openstack-keystone | 22:41 | |
| *** browne has joined #openstack-keystone | 22:42 | |
| *** hipster has joined #openstack-keystone | 22:42 | |
| *** hipster_ has joined #openstack-keystone | 22:44 | |
| *** afaranha has quit IRC | 22:44 | |
| *** gabriel-bezerra has quit IRC | 22:46 | |
| *** hipster has quit IRC | 22:47 | |
| *** hipster has joined #openstack-keystone | 22:47 | |
| bknudson | is keystoneclient broken now? | 22:47 |
| *** rodrigods has quit IRC | 22:47 | |
| *** hipster_ has quit IRC | 22:49 | |
| *** r-daneel has joined #openstack-keystone | 22:49 | |
| morganfainberg | bknudson, is it? | 22:49 |
| bknudson | morganfainberg: https://review.openstack.org/#/c/91240/ | 22:50 |
| bknudson | morganfainberg: looks like dstanek might have a fix -- https://review.openstack.org/#/c/94256/ | 22:50 |
| bknudson | or a workaround | 22:50 |
| *** stevemar has joined #openstack-keystone | 22:50 | |
| morganfainberg | did httpretty change? | 22:50 |
| bknudson | requests | 22:51 |
| morganfainberg | oh | 22:51 |
| morganfainberg | boo | 22:51 |
| dstanek | bknudson: yeah, it was breaking my environment - i always run the latest :-( | 22:51 |
| morganfainberg | wonder how bad this will break everything else... | 22:51 |
| morganfainberg | is ksc the only affected client? | 22:52 |
| *** hipster has quit IRC | 22:52 | |
| morganfainberg | do we need to cap requests until it's fixed everywhere? | 22:52 |
| dstanek | morganfainberg: probably - the test there was being dumb | 22:52 |
| bknudson | history is a list and not a tuple... I hope no clients were expecting a tuple rather than a list. | 22:52 |
| *** gokrokve has quit IRC | 22:52 | |
| morganfainberg | bknudson, ++ | 22:52 |
| dstanek | morganfainberg: s/probably/probably not/ | 22:53 |
| morganfainberg | dstanek,. yeah looks ok elsewhere | 22:53 |
| bknudson | so req_resp is a list now but ses_resp is a tuple? | 22:54 |
| morganfainberg | bknudson, thats what it looks like | 22:54 |
| bknudson | I'm wondering if ses_resp should be a list | 22:54 |
| morganfainberg | bknudson, they should probably match | 22:54 |
| bknudson | ses_resp.history | 22:55 |
| morganfainberg | bknudson, but i don't know if we should gate on those matching type wise | 22:55 |
| *** gokrokve_ has joined #openstack-keystone | 22:55 | |
| *** browne has quit IRC | 22:55 | |
| dstanek | bknudson, morganfainberg: either way our code shouldn't care | 22:56 |
| bknudson | there's a NOTE in the code says we set .history to a tuple so it matches the requests library | 22:56 |
| bknudson | so that note isn't valid anymore. | 22:56 |
| morganfainberg | bknudson, dstanek, i'm fine with us not caring about the mismatch (fixing the test in this case). | 22:58 |
| bknudson | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/session.py#n259 | 22:58 |
| morganfainberg | bknudson, ack | 22:58 |
| morganfainberg | i think it's fair to either fix the code or remove the comment, though we might want to ask jamielennox|away if there is any other concerns about a mismatch there. | 22:59 |
| *** gokrokve_ has quit IRC | 22:59 | |
| *** r-daneel has quit IRC | 23:03 | |
| *** browne has joined #openstack-keystone | 23:03 | |
| *** r-daneel has joined #openstack-keystone | 23:04 | |
| *** dstanek is now known as dstanek_zzz | 23:04 | |
| *** dstanek_zzz is now known as dstanek | 23:05 | |
| *** r-daneel has quit IRC | 23:07 | |
| *** amcrn has joined #openstack-keystone | 23:11 | |
| dstanek | morganfainberg, bknudson: i'm thinking i want to delete those three lines as a part of my patch | 23:13 |
| bknudson | dstanek: which 3 lines? | 23:13 |
| dstanek | bknudson: http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/session.py#n259 | 23:14 |
| bknudson | dstanek: works for me. | 23:15 |
| *** rodrigods has joined #openstack-keystone | 23:15 | |
| *** rodrigods has joined #openstack-keystone | 23:15 | |
| dstanek | i'm going to create a bug then since that's in production code | 23:15 |
| *** jamielennox|away is now known as jamielennox | 23:17 | |
| *** stevemar has quit IRC | 23:17 | |
| jamielennox | bknudson, morganfainberg: what happened? | 23:20 |
| openstackgerrit | David Stanek proposed a change to openstack/python-keystoneclient: Fixes an erroneous type check in a test https://review.openstack.org/94256 | 23:21 |
| jamielennox | dstanek: oh, yea - cool i'm happy to have that be a list, i never understood why requests forced it to a tuple | 23:21 |
| *** david-lyle has quit IRC | 23:23 | |
| dstanek | jamielennox: yeah, it doesn't seems to make much sense, but that's probably why it was undone | 23:24 |
| *** afaranha has joined #openstack-keystone | 23:30 | |
| *** gabriel-bezerra has joined #openstack-keystone | 23:34 | |
| rodrigods | dstanek, did you see my comment over there? gave a 0 because I wasn't sure about the outcome | 23:35 |
| *** nkinder has joined #openstack-keystone | 23:41 | |
| *** daneyon has quit IRC | 23:46 | |
| *** hipster has joined #openstack-keystone | 23:47 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Remove _factory methods from auth plugins https://review.openstack.org/81985 | 23:47 |
| jamielennox | dolphm: please review your comment on https://review.openstack.org/#/c/91216/ when you get a chance | 23:48 |
| jamielennox | or my reply to your comment | 23:48 |
| *** hipster has quit IRC | 23:52 | |
| *** gokrokve has joined #openstack-keystone | 23:53 | |
| *** dstanek is now known as dstanek_zzz | 23:54 | |
| morganfainberg | rodrigods, i think the comparison assert shouldn't matter on that patchset. | 23:55 |
| morganfainberg | rodrigods, i'd rather not have to verify we're returning the same type - especially if the types act (for the most part) the same in the consuming method | 23:56 |
| rodrigods | morganfainberg, makes sense, but i thought that removing a check isn't necessary after the returned type was fixed | 23:58 |
| *** bobt has quit IRC | 23:58 | |
| morganfainberg | rodrigods, it isn't, but i'd argue that the test was incorrect to begin with | 23:58 |
| morganfainberg | rodrigods, so i'd rather remove it at the same time we fix | 23:58 |
| rodrigods | morganfainberg, fair enough. | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!