| *** kun_huang has joined #openstack-keystone | 00:06 | |
| *** kun_huang has quit IRC | 00:09 | |
| *** packet has quit IRC | 00:18 | |
| *** diegows has quit IRC | 00:25 | |
| *** diegows has joined #openstack-keystone | 00:25 | |
| *** ncoghlan has joined #openstack-keystone | 00:30 | |
| *** zhiyan_ is now known as zhiyan | 00:38 | |
| *** xianghui has joined #openstack-keystone | 00:44 | |
| *** stevemar has joined #openstack-keystone | 00:45 | |
| *** gokrokve_ has quit IRC | 00:51 | |
| *** gokrokve has joined #openstack-keystone | 00:52 | |
| *** diegows has quit IRC | 00:53 | |
| *** gokrokve has quit IRC | 00:56 | |
| *** lbragstad has joined #openstack-keystone | 01:06 | |
| *** sbfox has quit IRC | 01:12 | |
| *** ncoghlan is now known as ncoghlan_afk | 01:24 | |
| *** ncoghlan_afk is now known as ncoghlan | 01:25 | |
| *** david-lyle has quit IRC | 01:30 | |
| *** gokrokve has joined #openstack-keystone | 01:44 | |
| *** gokrokve has quit IRC | 01:48 | |
| *** ncoghlan is now known as ncoghlan_afk | 02:14 | |
| openstackgerrit | A change was merged to openstack/keystone: Fix spelling mistakes in docs https://review.openstack.org/95564 | 02:27 |
|---|---|---|
| openstackgerrit | A change was merged to openstack/keystone: Replace assertTrue and assertFalse with more suitable asserts https://review.openstack.org/95492 | 02:27 |
| *** zhiyan is now known as zhiyan_ | 02:29 | |
| *** david-lyle has joined #openstack-keystone | 02:31 | |
| *** david-lyle has quit IRC | 02:35 | |
| *** mberlin has joined #openstack-keystone | 02:36 | |
| *** mberlin1 has quit IRC | 02:37 | |
| *** gokrokve has joined #openstack-keystone | 02:41 | |
| *** gokrokve has quit IRC | 02:46 | |
| *** zhiyan_ is now known as zhiyan | 02:46 | |
| *** zhiyan is now known as zhiyan_ | 02:52 | |
| *** zhiyan_ is now known as zhiyan | 02:52 | |
| *** dims has quit IRC | 03:16 | |
| *** ncoghlan_afk is now known as ncoghlan | 03:27 | |
| *** david-lyle has joined #openstack-keystone | 03:32 | |
| *** david-lyle has quit IRC | 03:36 | |
| *** david-lyle has joined #openstack-keystone | 03:38 | |
| *** gokrokve has joined #openstack-keystone | 03:42 | |
| *** david-lyle has quit IRC | 03:43 | |
| *** gokrokve has quit IRC | 03:46 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:07 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: add docstr to v2 shell module regarding CLI deprecation https://review.openstack.org/93457 | 04:12 |
| *** zhiyan is now known as zhiyan_ | 04:14 | |
| *** zhiyan_ is now known as zhiyan | 04:21 | |
| *** david-lyle has joined #openstack-keystone | 04:24 | |
| *** gokrokve has joined #openstack-keystone | 04:43 | |
| *** gokrokve has quit IRC | 04:48 | |
| *** gokrokve has joined #openstack-keystone | 04:48 | |
| *** praneshp has joined #openstack-keystone | 04:50 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:55 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:57 | |
| *** xianghui has quit IRC | 05:17 | |
| *** gokrokve has quit IRC | 05:17 | |
| *** gokrokve has joined #openstack-keystone | 05:18 | |
| *** ncoghlan_afk is now known as ncoghlan | 05:21 | |
| *** gokrokve has quit IRC | 05:22 | |
| openstackgerrit | A change was merged to openstack/keystone: remove a few backslash line continuations https://review.openstack.org/93446 | 05:26 |
| *** zhiyan is now known as zhiyan_ | 05:40 | |
| *** zhiyan_ is now known as zhiyan | 05:41 | |
| *** sbfox has joined #openstack-keystone | 05:46 | |
| *** gokrokve has joined #openstack-keystone | 05:48 | |
| *** gokrokve has quit IRC | 05:54 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Check that the user is dumb moved to the common method https://review.openstack.org/88517 | 05:58 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/90288 | 06:00 |
| *** dstanek_zzz is now known as dstanek | 06:24 | |
| *** stevemar has quit IRC | 06:34 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Fixed wrong behavior when updating tenant with LDAP backends https://review.openstack.org/93386 | 06:42 |
| *** bvandenh has joined #openstack-keystone | 06:46 | |
| *** leseb has joined #openstack-keystone | 06:48 | |
| *** gokrokve has joined #openstack-keystone | 06:49 | |
| *** gokrokve has quit IRC | 06:54 | |
| *** david-lyle has quit IRC | 06:54 | |
| *** dstanek is now known as dstanek_zzz | 07:00 | |
| *** boris-42 has quit IRC | 07:03 | |
| *** tomoiaga has joined #openstack-keystone | 07:04 | |
| *** tomoiaga has left #openstack-keystone | 07:05 | |
| *** leseb_ has joined #openstack-keystone | 07:07 | |
| *** leseb has quit IRC | 07:08 | |
| *** afazekas has joined #openstack-keystone | 07:08 | |
| *** boris-42 has joined #openstack-keystone | 07:11 | |
| *** BAKfr has joined #openstack-keystone | 07:13 | |
| openstackgerrit | Andre Naehring proposed a change to openstack/keystone: Add information regarding HTTPS for SSL enabled endpoints https://review.openstack.org/95545 | 07:17 |
| *** bvandenh has quit IRC | 07:21 | |
| *** xianghui has joined #openstack-keystone | 07:25 | |
| *** d0ugal_ has quit IRC | 07:25 | |
| *** praneshp has quit IRC | 07:28 | |
| *** gokrokve has joined #openstack-keystone | 07:49 | |
| *** gokrokve has quit IRC | 07:54 | |
| *** ajayaa has joined #openstack-keystone | 07:55 | |
| *** tomoiaga has joined #openstack-keystone | 08:15 | |
| *** ncoghlan has quit IRC | 08:16 | |
| tomoiaga | trying to use the V3 client will always end up calling the v2 url (which is in the service catalog) regardless of what endpoint/auth_url I set for that client. Does anyone have any experience using the v3 client ? | 08:17 |
| *** Ju has joined #openstack-keystone | 08:19 | |
| *** sbfox has quit IRC | 08:20 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Plugin loading from config objects https://review.openstack.org/79542 | 08:25 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Session loading from conf https://review.openstack.org/95015 | 08:25 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Session loading from CLI options https://review.openstack.org/95678 | 08:25 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow loading auth plugins from CLI https://review.openstack.org/95679 | 08:25 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert keystone CLI to use auth plugins https://review.openstack.org/95680 | 08:25 |
| *** jamielennox is now known as jamielennox|away | 08:40 | |
| *** mberlin1 has joined #openstack-keystone | 08:49 | |
| *** gokrokve has joined #openstack-keystone | 08:49 | |
| openstackgerrit | Ihar Hrachyshka proposed a change to openstack/keystone: Synced jsonutils from oslo-incubator https://review.openstack.org/91054 | 08:51 |
| *** mberlin has quit IRC | 08:51 | |
| openstackgerrit | Ihar Hrachyshka proposed a change to openstack/python-keystoneclient: Synced jsonutils from oslo-incubator https://review.openstack.org/95697 | 08:53 |
| *** gokrokve has quit IRC | 08:53 | |
| *** andreaf has joined #openstack-keystone | 08:59 | |
| *** henrynash has joined #openstack-keystone | 09:11 | |
| *** kun_huang has joined #openstack-keystone | 09:38 | |
| *** zhiyan is now known as zhiyan_ | 09:39 | |
| *** gokrokve has joined #openstack-keystone | 09:49 | |
| *** gokrokve_ has joined #openstack-keystone | 09:51 | |
| *** gokrokve has quit IRC | 09:53 | |
| *** gokrokve_ has quit IRC | 09:55 | |
| *** leseb_ has quit IRC | 10:12 | |
| *** bvandenh has joined #openstack-keystone | 10:31 | |
| *** gokrokve has joined #openstack-keystone | 10:49 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: replaced unicode() with six.text_type() https://review.openstack.org/95719 | 10:51 |
| *** gokrokve has quit IRC | 10:53 | |
| *** leseb has joined #openstack-keystone | 11:03 | |
| *** zhiyan_ is now known as zhiyan | 11:17 | |
| *** diegows has joined #openstack-keystone | 11:17 | |
| ajayaa | dolphm: hi, are the policies not enforced at all in v2 api? | 11:19 |
| *** rushiagr has joined #openstack-keystone | 11:21 | |
| ajayaa | I am trying different policies in policy.json and I am using v2 api. None of the policies are enforced. | 11:22 |
| ajayaa | Even in the code everywhere there is self.assert_admin() in v2 apis. When I remove them any user can do anything. | 11:24 |
| *** dims has joined #openstack-keystone | 11:28 | |
| *** leseb has quit IRC | 11:48 | |
| *** gokrokve has joined #openstack-keystone | 11:49 | |
| *** xianghui has quit IRC | 11:51 | |
| *** gokrokve has quit IRC | 11:53 | |
| *** bvandenh has quit IRC | 11:54 | |
| openstackgerrit | Rodrigo Duarte Sousa proposed a change to openstack/python-keystoneclient: Add /role_assignments endpoint support https://review.openstack.org/91578 | 11:56 |
| *** rodrigods has joined #openstack-keystone | 11:58 | |
| *** rodrigods has joined #openstack-keystone | 11:58 | |
| *** leseb has joined #openstack-keystone | 11:59 | |
| *** bvandenh has joined #openstack-keystone | 12:04 | |
| *** afazekas has quit IRC | 12:07 | |
| openstackgerrit | Rodrigo Duarte Sousa proposed a change to openstack/python-keystoneclient: Add /role_assignments endpoint support https://review.openstack.org/91578 | 12:13 |
| *** dstanek_zzz is now known as dstanek | 12:14 | |
| *** dims has quit IRC | 12:20 | |
| *** afazekas has joined #openstack-keystone | 12:21 | |
| openstackgerrit | A change was merged to openstack/keystone-specs: Updated gitreview file for repo rename https://review.openstack.org/95298 | 12:26 |
| *** afazekas is now known as _afazekas_mtg | 12:31 | |
| *** dstanek is now known as dstanek_zzz | 12:41 | |
| *** jaosorior has joined #openstack-keystone | 12:41 | |
| *** dims has joined #openstack-keystone | 12:45 | |
| *** gokrokve has joined #openstack-keystone | 12:49 | |
| *** dstanek_zzz is now known as dstanek | 12:50 | |
| *** gokrokve has quit IRC | 12:54 | |
| *** radez_g0n3 is now known as radez | 12:56 | |
| *** _afazekas_mtg has quit IRC | 13:04 | |
| *** mberlin1 has quit IRC | 13:12 | |
| *** _afazekas_mtg has joined #openstack-keystone | 13:16 | |
| *** ericvw has joined #openstack-keystone | 13:19 | |
| *** _afazekas_mtg is now known as afazekas | 13:19 | |
| *** jdennis has quit IRC | 13:23 | |
| *** mberlin has joined #openstack-keystone | 13:24 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Fixed a problem with creating user with empty description in LDAP https://review.openstack.org/95762 | 13:30 |
| henrynash | ajayaa: I think we only introduced RBAC for keystone APIs with the v3 calls | 13:33 |
| henrynash | ajayaa: For v2, you need to be admin to do almost anything | 13:34 |
| ajayaa | henrynash: I need to define a concept of tenant admin . If RBAC is not supported in v2 and v3 is not yet supported by all the components, then I am stuck I believe. :( | 13:36 |
| henrynash | ajayaa: so nova v2 calls are fine…it’s only keystone v2 calls that are not…..and other components won’t call the keystone v2 API calls in general | 13:37 |
| henrynash | ajayaa: can you give me an example of a keystone v2 call you think will be a problem? | 13:38 |
| ajayaa | henrynash: sorry for digressing a bit but the keystone_authtoken middleware still uses v2 apis. So I would need both v2 and v3 api, right? | 13:40 |
| henrynash | ajayaa: well, I think it only uses the v2 apis for things behind the scenes, but it will correctly validate v3 calls | 13:42 |
| *** ayoung has joined #openstack-keystone | 13:42 | |
| henrynash | ajayaa: the keystone_client pyhon library, authtoken_middleware and the openstack client CLi all support v3 | 13:43 |
| tomoiaga | henrynash: authtoken_middleware supports keystone v3 as of icehouse, or with some new additions recently ? | 13:44 |
| ajayaa | https://review.openstack.org/#/c/88620/ | 13:44 |
| henrynash | ajayaa: it’s true that other projects still call the keystone v2 api in places….but those are token/region/enpoint type things…not the APIs that manipulate keystone objects | 13:45 |
| tomoiaga | henrynash: I'll have to check and make sure, I have the same "problem", however I can deal with most issues, just the service catalog needs to have the v2 keystone url, otherwise auth may not work (for nova for example) | 13:45 |
| ajayaa | henrynash: Everybody says keystone v3 is not supported by all the components yet. How safe is it to use keystone v3 as of now? | 13:46 |
| henrynash | ajayaa: yes, it’s true authtoekn uses the v2 keystone token validation API…(which we are fixing), but again that doesn’t mean that yuo will bypass any RBAC on v3 calls | 13:46 |
| henrynash | ajayaa: …and yes you do need to be careful of the v2/v3 url issue…. | 13:47 |
| henrynash | ajayaa: jamie from the keystone team is working on that bit | 13:47 |
| tomoiaga | ajayaa: keystone v3 is safe to use, however, I found some minor issues when creating domains or other stuff, where the keystone client library tries the service catalog url (which should be v2 for now) and things break. This is regardless of whay endpoint or auth_url you set. You will have to specify the base_url property. All this if you are using the python client library to do stuff. | 13:48 |
| ajayaa | henrynash: also things like domain are going to be deprecated in future according to the hierarchical multitenancy. So it seems that v3 is not yet stable enough. | 13:49 |
| *** gokrokve has joined #openstack-keystone | 13:49 | |
| henrynash | ajayaa: v3 is stable | 13:50 |
| henrynash | ajayaa: domains will stil be supported even with hierachical multitenancy (even if they are essentially a view onto a top level project) | 13:50 |
| ajayaa | henrynash: thanks for your help. | 13:51 |
| henrynash | ajayaa: np | 13:51 |
| *** gokrokve has quit IRC | 13:53 | |
| *** tomoiaga has quit IRC | 13:54 | |
| *** nkinder has joined #openstack-keystone | 13:56 | |
| *** sbfox has joined #openstack-keystone | 13:57 | |
| *** zhiyan is now known as zhiyan_ | 13:57 | |
| ajayaa | henrynash: When someone says v3 api is not yet supported by all the openstack services yet, what do they mean? I have heard this multiple times. for e.g. https://ask.openstack.org/en/question/26805/what-is-the-major-difference-between-keystone-v2-and-v3/ | 14:04 |
| *** gordc has joined #openstack-keystone | 14:06 | |
| *** Camisa has quit IRC | 14:06 | |
| *** gokrokve has joined #openstack-keystone | 14:07 | |
| *** gokrokve_ has joined #openstack-keystone | 14:08 | |
| openstackgerrit | Rodrigo Duarte Sousa proposed a change to openstack/python-keystoneclient: Add /role_assignments endpoint support https://review.openstack.org/91578 | 14:08 |
| ajayaa | henrynash: If I understand things clearly, I could work on the blueprint "migrating from v2 to v3" | 14:09 |
| *** gokrokve has quit IRC | 14:11 | |
| bknudson | ajayaa: some operations will fail if given a v3 token because the catalog format is different and the service doesn't parse it correctly | 14:12 |
| bknudson | I think this is what jamielennox|away is working on | 14:13 |
| ajayaa | bknudson: perhaps jamielennox|away can throw some light on things that don't work. :) | 14:19 |
| *** jdennis has joined #openstack-keystone | 14:20 | |
| *** stevemar has joined #openstack-keystone | 14:23 | |
| *** david-lyle has joined #openstack-keystone | 14:30 | |
| *** gokrokve has joined #openstack-keystone | 14:33 | |
| *** gokrokve_ has quit IRC | 14:36 | |
| *** vhoward has left #openstack-keystone | 14:39 | |
| *** vhoward has joined #openstack-keystone | 14:39 | |
| *** sbfox has quit IRC | 14:46 | |
| *** ajayaa has quit IRC | 14:49 | |
| *** thedodd has joined #openstack-keystone | 14:53 | |
| dstanek | stevemar: if lbragstad's jsonschema validation gets in will we need https://review.openstack.org/#/c/87849 ? | 14:55 |
| lbragstad | I don't *think* so? | 14:56 |
| stevemar | dstanek, i imagine his stuff is done in chunks, and may not hit the federation pieces any time soon | 14:56 |
| lbragstad | we could use the jsonschema validator for federation... I could get a WIP patch up for it | 14:56 |
| henrynash | ajayaa: (sorry was AFK)…so there is lots of work going on in Juno for “keystone v3 everywhere” as dicussed at the design summit | 14:58 |
| henrynash | ajayaa: all help gratefully reveived :-) | 14:58 |
| henrynash | ajayaa: as per the comment on the link you sent me, the keystone_client CLI will never be upgraded (it is being deprecated in favor of teh stanadard openstack client - which support keystone v3 already) | 15:00 |
| *** leseb has quit IRC | 15:02 | |
| *** leseb has joined #openstack-keystone | 15:02 | |
| *** bvandenh has quit IRC | 15:04 | |
| *** nkinder has quit IRC | 15:04 | |
| *** kun_huan_ has joined #openstack-keystone | 15:04 | |
| *** morganfainberg_Z is now known as morganfainberg | 15:04 | |
| *** zhiyan_ is now known as zhiyan | 15:05 | |
| *** kun_huang has quit IRC | 15:05 | |
| morganfainberg | dstanek, lbragstad, which jsonschema patch? | 15:05 |
| lbragstad | morganfainberg: https://review.openstack.org/#/c/86483/ https://review.openstack.org/#/c/86484/ https://review.openstack.org/#/c/92031/ | 15:06 |
| morganfainberg | lbragstadb, nice. | 15:06 |
| * morganfainberg swears he can type | 15:06 | |
| *** leseb has quit IRC | 15:07 | |
| morganfainberg | lbragstad, I was actually about to start working on something similar for the tokens | 15:07 |
| morganfainberg | lbragstad, but... if you already did awesome work... yay! | 15:07 |
| openstackgerrit | Juan Manuel Ollé proposed a change to openstack/keystone: Adding Role for an unexisting user should fail. https://review.openstack.org/93982 | 15:07 |
| lbragstad | morganfainberg: :) go ahead and leverage it if you can, or let me know if there is something else that needs to be done for you to use it | 15:08 |
| morganfainberg | lbragstad, plan to. :) | 15:08 |
| lbragstad | what were you going to do with token validation? | 15:08 |
| morganfainberg | lbragstad, basically an easy way to verify the token itself | 15:08 |
| lbragstad | morganfainberg: cool | 15:09 |
| morganfainberg | lbragstad, need to be able to easily convert a token to a standard structure so we don't need silly logic to know if it's v2, v3, vOver9000 token version | 15:09 |
| lbragstad | right, that makes sense | 15:10 |
| morganfainberg | it's part of the chnages needed to fully implment non-persistent tokens | 15:10 |
| *** jdennis has quit IRC | 15:14 | |
| *** zhiyan is now known as zhiyan_ | 15:14 | |
| *** kun_huan_ has quit IRC | 15:16 | |
| *** kun_huang has joined #openstack-keystone | 15:17 | |
| *** afazekas has quit IRC | 15:18 | |
| *** nkinder has joined #openstack-keystone | 15:20 | |
| *** gyee has joined #openstack-keystone | 15:23 | |
| morganfainberg | lbragstad, i think we'll need to add a datestamp validator in the long run as well | 15:25 |
| lbragstad | ++ good idea | 15:25 |
| lbragstad | we could add that in the inital commit | 15:27 |
| lbragstad | or wait until we start using the validator on tokens and add it then | 15:27 |
| *** kun_huang has quit IRC | 15:32 | |
| *** leseb has joined #openstack-keystone | 15:33 | |
| *** rodrigods_ has joined #openstack-keystone | 15:34 | |
| stevemar | bknudson, can you take a look at: | 15:36 |
| stevemar | https://review.openstack.org/#/c/93982/ - i think it's undoing some of the work you did to separate out identity and assignment | 15:36 |
| bknudson | stevemar: y, it's undoing a change that I made, but it turned out it was wrong to make that change | 15:37 |
| morganfainberg | lbragstad, yeah we can def add it after | 15:37 |
| bknudson | since it's groups that are assigned for federated users and not users. | 15:37 |
| stevemar | bknudson, gotcha, i was putting up a fight for nothing! | 15:37 |
| *** leseb has quit IRC | 15:37 | |
| *** zhiyan_ is now known as zhiyan | 15:39 | |
| *** leseb has joined #openstack-keystone | 15:41 | |
| *** zhiyan is now known as zhiyan_ | 15:51 | |
| *** rodrigods_ has quit IRC | 15:52 | |
| *** shakamunyi has joined #openstack-keystone | 15:56 | |
| *** nkinder has quit IRC | 15:57 | |
| *** sbfox has joined #openstack-keystone | 16:00 | |
| ayoung | lbragstad, my god it feels like Struts all over again | 16:01 |
| lbragstad | ayoung: the validations stuff? | 16:02 |
| ayoung | lbragstad, yep | 16:02 |
| *** leseb has quit IRC | 16:02 | |
| *** leseb has joined #openstack-keystone | 16:02 | |
| ayoung | lbragstad, I know why we need it, it just feels like a regression to me. I have type-unsafe programming...it leads to validators | 16:03 |
| lbragstad | it will be nice when we have it to the point where it's all done with the same tool | 16:05 |
| morganfainberg | lbragstad, ++ | 16:05 |
| dstanek | ayoung: you'd still have a validation layer if you were doing this in Java - it's just that some of the validation would be done with casting | 16:05 |
| ayoung | dstanek, not if I were writing the framework I wouldn't | 16:05 |
| ayoung | dstanek, what I would do is make you create real honest to goodness objects. | 16:06 |
| ayoung | and catch exceptions where the strings could not be marshalled to objects | 16:06 |
| *** leseb has quit IRC | 16:07 | |
| *** BAKfr_ has joined #openstack-keystone | 16:08 | |
| *** BAKfr has quit IRC | 16:08 | |
| *** marcoemorais has joined #openstack-keystone | 16:11 | |
| *** jaosorior has quit IRC | 16:11 | |
| morganfainberg | ayoung, sounds to me like you're advocating the equavalent of python descriptors | 16:13 |
| morganfainberg | in whatever framework/language you choose | 16:13 |
| *** nkinder has joined #openstack-keystone | 16:14 | |
| *** browne has joined #openstack-keystone | 16:15 | |
| *** jdennis has joined #openstack-keystone | 16:18 | |
| morganfainberg | ayoung, fyi, going to be bugging you more and more about krb5 and the like wrt OpenStack. cc nkinder | 16:19 |
| morganfainberg | ayoung, just a heads up :) | 16:19 |
| *** thedodd has quit IRC | 16:21 | |
| *** leseb has joined #openstack-keystone | 16:21 | |
| *** thedodd has joined #openstack-keystone | 16:21 | |
| nkinder | morganfainberg: cool. I'll consider myself warned... :) | 16:22 |
| nkinder | morganfainberg: I have an auth plug-in question you might be able to help me with | 16:22 |
| morganfainberg | nkinder ask away | 16:23 |
| morganfainberg | nkinder, i'll answer that then go grab some food before meeting time | 16:23 |
| nkinder | morganfainberg: I was working on the token auth plug-in to not allow scoped tokens to be used to get unscoped tokens (or tokens with a different scope) | 16:23 |
| nkinder | morganfainberg: to do this, the auth plug-in needs to see the scope info from the request | 16:24 |
| morganfainberg | nkinder, makes sense (actually makes a lot of sense) | 16:24 |
| nkinder | morganfainberg: at first, I was pulling this out of context['environment']['openstack.params']['auth'] in the authenticate() method | 16:24 |
| morganfainberg | nkinder, ok | 16:25 |
| nkinder | that is the only place it's currently available in the authenticate() method | 16:25 |
| morganfainberg | isn't that information in the auth_payload passed to the plugin? | 16:26 |
| nkinder | this causes some of the trust unit tests to fail, as they set environment = {} | 16:26 |
| nkinder | morganfainberg: nope, auth payload only has the token being used for auth. It extracts the scope info | 16:26 |
| morganfainberg | hm. | 16:26 |
| nkinder | morganfainberg: What I started looking at was extending the authenticate() params | 16:26 |
| stevemar | bknudson, going to +A https://review.openstack.org/#/c/92215/1 i think it'll cause the rest to go through! | 16:27 |
| bknudson | stevemar: progress! | 16:28 |
| nkinder | morganfainberg: basically, we would pass the tuple from auth_info.get_scope() as a fourth parameter to authenticate() | 16:28 |
| morganfainberg | nkinder, hm. i feel like this should be in the auth_info (AuthInfo object) that is created in the authenticate_for_token method | 16:29 |
| morganfainberg | ah | 16:29 |
| stevemar | bknudson, done! now to wait on the gate =\ which has been super flakey lately | 16:29 |
| nkinder | morganfainberg: this would require changing all auth plug-ins, which isn't hard... | 16:29 |
| morganfainberg | nkinder, we just don't pass it to the plugin | 16:29 |
| morganfainberg | nkinder, hmmmmmm | 16:29 |
| nkinder | morganfainberg: I'm concerned about changing it in case there are other auth plug-ins out there | 16:29 |
| *** BAKfr has joined #openstack-keystone | 16:30 | |
| bknudson | stevemar: this is why noone uses public clouds. routing failures | 16:30 |
| *** sbfox has quit IRC | 16:30 | |
| morganfainberg | nkinder, yeah. this is the hard part when it comes to changing signatures of public functions. | 16:30 |
| morganfainberg | nkinder, it's silly we don't pass that info down to the plugin tbh. | 16:31 |
| *** BAKfr_ has quit IRC | 16:31 | |
| nkinder | morganfainberg: yeah, agreed | 16:31 |
| nkinder | morganfainberg: is it acceptable to propose that we change the signature for Juno? | 16:32 |
| morganfainberg | nkinder, it hasn't stopped us from doing worse than changing a signature in a cycle | 16:32 |
| morganfainberg | nkinder, grizzly -> havana we broke a bunch of external code. | 16:33 |
| *** sbfox has joined #openstack-keystone | 16:33 | |
| nkinder | morganfainberg: I suppose this is a good topic for today's meeting | 16:33 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Updates Python3 requirements to match Python2 https://review.openstack.org/95826 | 16:33 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds a fork of python-ldap for Py3 testing https://review.openstack.org/95827 | 16:33 |
| morganfainberg | nkinder, i think it would be fine to change authenticate for Juno. | 16:33 |
| morganfainberg | nkinder, i think we should make it future proof, where we pass in all the relevant auth info vs. just a subset if we are changing it though | 16:33 |
| nkinder | morganfainberg: Yeah, we should pass AuthInfo in it's entirety | 16:34 |
| morganfainberg | nkinder, or at least a copy of it. | 16:34 |
| nkinder | morganfainberg: we can then extend it if needed in the future without having to tweak the method signature | 16:34 |
| morganfainberg | nkinder, ++ exactly | 16:34 |
| *** gokrokve has quit IRC | 16:34 | |
| *** gokrokve has joined #openstack-keystone | 16:35 | |
| nkinder | morganfainberg: thanks for your input! I'll work up a patch for it. | 16:35 |
| morganfainberg | nkinder, if we are really worried about breaking older plugins we could do some versioning magic with a decorator to pass the limited dataset in if the plugin doesn't have the correct support (version?) | 16:36 |
| *** vhoward has left #openstack-keystone | 16:36 | |
| morganfainberg | nkinder, make "fixed" plugins inherit from a proper baseclass or .. have a version value or somesuch that indicates we should pass the whole object in. | 16:37 |
| nkinder | morganfainberg: interesting... So the decorator would need to be used to get the full AuthInfo | 16:37 |
| morganfainberg | nkinder, well no, the decorator would either pass the full AuthInfo or just the bit you need to match the current mechanism (methods?) | 16:37 |
| morganfainberg | nkinder, so the decorator would grab auth_info, and conditionally pass the whole object in. if we are really worried about breaking external plugins | 16:38 |
| morganfainberg | nkinder, and the topic of external plugin breakage is worth bringing up at the meeting | 16:38 |
| nkinder | morganfainberg: ok, makes sense | 16:38 |
| *** gokrokve has quit IRC | 16:39 | |
| morganfainberg | nkinder, ok bbib gonna grab some breakfast, | 16:39 |
| *** zhiyan_ is now known as zhiyan | 16:42 | |
| *** leseb has quit IRC | 16:50 | |
| *** leseb has joined #openstack-keystone | 16:51 | |
| *** zhiyan is now known as zhiyan_ | 16:51 | |
| *** david-lyle has quit IRC | 16:51 | |
| *** david-lyle has joined #openstack-keystone | 16:52 | |
| *** david-lyle has quit IRC | 16:52 | |
| *** harlowja_away is now known as harlowja_ | 16:55 | |
| *** leseb has quit IRC | 16:55 | |
| *** praneshp has joined #openstack-keystone | 16:58 | |
| *** arunkant has joined #openstack-keystone | 17:05 | |
| *** dims has quit IRC | 17:08 | |
| *** gabrielb has quit IRC | 17:13 | |
| *** dims has joined #openstack-keystone | 17:13 | |
| *** gokrokve has joined #openstack-keystone | 17:16 | |
| *** sbfox has quit IRC | 17:18 | |
| *** gokrokve_ has joined #openstack-keystone | 17:19 | |
| *** andreaf has quit IRC | 17:20 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Make auth_token return a V2 Catalog https://review.openstack.org/89458 | 17:21 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: replace string format arguments with function parameters https://review.openstack.org/94205 | 17:21 |
| *** gokrokve has quit IRC | 17:21 | |
| openstackgerrit | A change was merged to openstack/keystone: Replace magic value 'service/security' in CadfNotificationWrapper https://review.openstack.org/95550 | 17:22 |
| *** sbfox has joined #openstack-keystone | 17:24 | |
| *** nkinder has quit IRC | 17:24 | |
| rodrigods | ayoung, are we ready for a merge? =) https://review.openstack.org/#/c/91578/ | 17:26 |
| *** praneshp has quit IRC | 17:26 | |
| *** gabrielb has joined #openstack-keystone | 17:27 | |
| ayoung | rodrigods, no idea, but I +2 +Aed anyway | 17:28 |
| rodrigods | ayoung, thanks | 17:28 |
| morganfainberg | thats a lot of +2s if it wasn't ready | 17:29 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Move auth_token cache pool tests out of NoMemcache https://review.openstack.org/92215 | 17:30 |
| *** praneshp has joined #openstack-keystone | 17:31 | |
| rodrigods | morganfainberg, first patch feelings | 17:32 |
| *** jaosorior has joined #openstack-keystone | 17:34 | |
| jaosorior | lbragstad, regarding https://review.openstack.org/#/c/93992/ , it's not related to any bug (that I know of) :/ | 17:35 |
| lbragstad | jaosorior: ok, I was just commenting on that since dstanek mentioned it in his comment on patch set 4 | 17:36 |
| *** leseb has joined #openstack-keystone | 17:37 | |
| jaosorior | oh, where? | 17:37 |
| *** ajayaa has joined #openstack-keystone | 17:38 | |
| jaosorior | oooh | 17:40 |
| jaosorior | now I see | 17:40 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Cached tokens aren't expired https://review.openstack.org/92217 | 17:40 |
| jaosorior | I'll file the bug then | 17:41 |
| *** nkinder has joined #openstack-keystone | 17:41 | |
| jaosorior | thanks for pointing it out, I missed that review comment completely | 17:41 |
| *** leseb has quit IRC | 17:41 | |
| *** bvandenh has joined #openstack-keystone | 17:42 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Move auth_token tests not requiring v2/v3 to new class https://review.openstack.org/92222 | 17:42 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Remove importutils from oslo config https://review.openstack.org/92223 | 17:42 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Sync with oslo-incubator 2640847 https://review.openstack.org/92228 | 17:43 |
| *** zhiyan_ is now known as zhiyan | 17:43 | |
| stevemar | lots of merging going on :) | 17:46 |
| *** sbfox has quit IRC | 17:46 | |
| rodrigods | ++ | 17:47 |
| morganfainberg | stevemar, :) | 17:47 |
| *** vhoward has joined #openstack-keystone | 17:49 | |
| *** zhiyan is now known as zhiyan_ | 17:52 | |
| *** davlaps has joined #openstack-keystone | 17:53 | |
| openstackgerrit | Arun Kant proposed a change to openstack/keystone: Adding support for ldap connection pooling.(Work-in-progress) https://review.openstack.org/95300 | 17:54 |
| morganfainberg | dolphm, ayoung, bknudson, stevemar, dstanek, lbragstad, gyee, henrynash, jamielennox|away, auto abandon is dead, if something really should be abandoned, we should abandon it directly. it's rare we want reviews to legitimately auto-expire https://review.openstack.org/#/c/95836/ | 17:55 |
| ayoung | morganfainberg, good, but can only Dolph abandon one now if the origianl author is gone? | 17:55 |
| morganfainberg | ayoung, any core | 17:55 |
| bknudson | morganfainberg: seems like a good idea. | 17:55 |
| lbragstad | oh hey, look at that | 17:55 |
| stevemar | oh, didn't know that | 17:55 |
| dolphm | morganfainberg: ++ | 17:56 |
| morganfainberg | Infra is going to send a message about it to the ML soonish | 17:56 |
| lbragstad | cool | 17:56 |
| bknudson | another option rather than abandon it is to fix it up ourselves and get it merged | 17:56 |
| lbragstad | bknudson: +1 | 17:56 |
| bknudson | I think I've got some reviews out there that are on the back burner | 17:57 |
| dolphm | morganfainberg: authors can still restore after we abandon, right? | 17:57 |
| morganfainberg | dolphm, yes | 17:57 |
| morganfainberg | dolphm, same as any core can restore | 17:57 |
| dolphm | cool | 17:57 |
| gyee | morganfainberg, sounds good | 17:58 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Sync with oslo-incubator 4a777e5 https://review.openstack.org/95845 | 17:58 |
| morganfainberg | bknudson, there are some cases we will want to abandon eventually, e.g. a -2 that isn't fixable | 17:59 |
| *** gabrielb has quit IRC | 17:59 | |
| morganfainberg | bknudson, but yeah most of the time. | 17:59 |
| dolphm | morganfainberg: can you run today's meeting? i'm here but in a physical meeting too | 17:59 |
| morganfainberg | dolphm, sure thing. | 17:59 |
| *** david-lyle has joined #openstack-keystone | 18:05 | |
| *** jamielennox|away is now known as jamielennox | 18:05 | |
| *** Priti has joined #openstack-keystone | 18:09 | |
| *** Priti has quit IRC | 18:13 | |
| *** sbfox has joined #openstack-keystone | 18:22 | |
| *** sbfox1 has joined #openstack-keystone | 18:25 | |
| *** sbfox has quit IRC | 18:29 | |
| *** zhiyan_ is now known as zhiyan | 18:44 | |
| *** gabriel-bezerra has joined #openstack-keystone | 18:51 | |
| *** leseb_ has joined #openstack-keystone | 18:54 | |
| *** zhiyan is now known as zhiyan_ | 18:55 | |
| gabriel-bezerra | morganfainberg, dtroyer: Hi folks, I'd like to carry on with https://review.openstack.org/90771. Should I start a new change on gerrit with your idea of abstracting the differences between operating systems, or should I continue using that change? | 18:55 |
| ayoung | nkinder, I had an image from a whiteboard session | 19:00 |
| dolphm | morganfainberg: "do we support the concept of keystone across different versions of other services?" yes we do in theory, but we don't test it anywhere | 19:00 |
| morganfainberg | nkinder, i think with what dolphm said I'd like to not break non-lockstep deployments | 19:00 |
| ayoung | nkinder, https://twitter.com/admiyoung/status/429060448462577664/photo/1 | 19:00 |
| nkinder | dolphm: any guidelines on how many releases back? | 19:00 |
| nkinder | morganfainberg: yeah, that makes sense to me | 19:00 |
| morganfainberg | nkinder, especially orgs that track master closely | 19:01 |
| morganfainberg | nkinder, could get some wonky behavior | 19:01 |
| ayoung | nkinder, I realize that image is pretty gross | 19:01 |
| nkinder | morganfainberg: we should just set a target to change the default behavior to the more secure option | 19:01 |
| ayoung | morganfainberg, in paste, can one pipeline call another? | 19:01 |
| morganfainberg | ayoung, good question | 19:01 |
| ayoung | morganfainberg, say we made the token pipeline in paste, could we pull it out of the other? | 19:01 |
| morganfainberg | ayoung, i haven't ever seen it done like that | 19:02 |
| ayoung | morganfainberg, and what are we moving to in place of paste for py33 support? | 19:02 |
| morganfainberg | ayoung, we aren't, i mis heard at the summit | 19:02 |
| ayoung | morganfainberg, OK.... | 19:02 |
| dolphm | morganfainberg: nkinder: avoiding lockstep deployments is my only concern there - but -2 releases should be reasonable | 19:02 |
| morganfainberg | the answer is either help fix paste or eliminate it. | 19:02 |
| morganfainberg | dolphm, ++ | 19:02 |
| dolphm | anyone know what's up with the *-zeromq-* jobs? they have no build history... https://jenkins.openstack.org/job/gate-tempest-dsvm-postgres-zeromq-full-icehouse/ | 19:03 |
| ayoung | morganfainberg, so, lets get a solution in the paste model | 19:03 |
| ayoung | morganfainberg, something like this: | 19:03 |
| nkinder | so if the overall idea sounds good to others, I can start writing up a spec... | 19:03 |
| ayoung | make a new pipeline that only is usable to create a token | 19:03 |
| ayoung | call it /v3/auth2 or something | 19:03 |
| morganfainberg | ayoung, /auth/<version> ? | 19:04 |
| ayoung | then all of the code that leads to /v3/auth/token ends up being callable from that | 19:04 |
| ayoung | morganfainberg, nah | 19:04 |
| ayoung | morganfainberg, acutally... | 19:04 |
| nkinder | ayoung: you mean to only create an unscoped token? | 19:04 |
| ayoung | we could do | 19:04 |
| bknudson | are there other "pipeline" python APIs other than paste? | 19:04 |
| jamielennox | nkinder: ++, it sounds like this should have been the original model - and someone though default_project would be convenient - i'm all for fixing it | 19:04 |
| ayoung | make it /v3/auth/pipeline | 19:04 |
| ayoung | instead of token | 19:04 |
| dolphm | bknudson: WSGI | 19:04 |
| ayoung | but...regardless, we define that in past like this: | 19:05 |
| morganfainberg | dolphm, bknudson, i think ceiliometer doesn't use paste at all. | 19:05 |
| morganfainberg | just straight wsgi | 19:05 |
| dolphm | bknudson: paste is just a configuration framework for WSGI apps - you can build a pipeline freehand in the interpreter just stacking wsgi interfaces | 19:05 |
| dstanek | bknudson: i wrote a really simple one a while back that uses the paste ini to create WSGI applications | 19:06 |
| ayoung | [pipeline:v3_auth] | 19:06 |
| ayoung | pipeline = sizelimit url_normalize build_auth_context json_body to start | 19:06 |
| ayoung | morganfainberg, I assume we need all of those? | 19:06 |
| morganfainberg | ayoung, i think that covers our requirements -- though i'd need to look more closely to be 100% sure | 19:07 |
| dstanek | ayoung: it worries me a little to do what you are proposing in the WSGI pipeline because we wouldn't want the end used to mess with it | 19:07 |
| ayoung | morganfainberg, then: | 19:07 |
| ayoung | nkinder, no, more than just unscoped | 19:07 |
| ayoung | nkinder, the idea is that the AUTH_URL does not need to be in the catalog | 19:07 |
| ayoung | this would be a minimal viable AUTH_URL | 19:08 |
| dstanek | dolphm: what's up with https://bugs.launchpad.net/keystone/+bug/1253482 ? is there any change to make in keystone? | 19:08 |
| uvirtbot | Launchpad bug 1253482 in devstack "Keystone's IANA-assigned default port in linux local ephemeral port range" [Undecided,In progress] | 19:08 |
| morganfainberg | dstanek, nothing we can do unless we get fully under apache | 19:08 |
| morganfainberg | dstanek, and share 80/443 | 19:08 |
| ayoung | dstanek, ah, but that is the case for most of the auth pipeline. This is instead of changing just the token provider | 19:08 |
| ayoung | dstanek, we could, in theory, make a separate paste file just for this. | 19:09 |
| morganfainberg | dstanek, or just throw our hands up and assume port 5000 will be ok | 19:09 |
| ayoung | But if a user wants to switch PKI for PKIZ, that should be simple to do | 19:09 |
| morganfainberg | dstanek, effectively abandoning 35357 | 19:09 |
| ayoung | well, we can do that, but the whole token provider is pulled along with it | 19:09 |
| dolphm | dstanek: not without changing our default port? | 19:09 |
| ayoung | so, what would the stages of the pipeline be now? | 19:09 |
| ayoung | 1. authenticate | 19:10 |
| ayoung | 2. Map | 19:10 |
| morganfainberg | dstanek, we could fix it in devstack, but it wouldn't "fix" the bug... might actually make things more confusing | 19:10 |
| ayoung | 3. scope | 19:10 |
| ayoung | 4. Sign | 19:10 |
| morganfainberg | s/devstack/gate/ | 19:10 |
| ayoung | 5. record | 19:10 |
| ayoung | 6. Return | 19:10 |
| ayoung | when we get to ephemeral tokens we drop 5. | 19:10 |
| dstanek | that's unfortunate | 19:10 |
| dolphm | ayoung: then do that first :) | 19:10 |
| dstanek | should it be marked as wishlist :-) ? | 19:11 |
| morganfainberg | dolphm, going to propose the spec for that this week. | 19:11 |
| ayoung | dolphm, we discusses this. You said you wanted it back when gyee first proposed the token provider | 19:11 |
| dolphm | morganfainberg: the blocker IIRC was eliminating all the get_token() calls we have, right? | 19:11 |
| morganfainberg | dstanek, well it's in-progress. | 19:11 |
| ayoung | dolphm, that is just an example of the kind of thing we get from the pipeline approach | 19:11 |
| morganfainberg | dolphm, that is the biggest blocker, and that depends on always decoding the token in the middleware | 19:11 |
| ayoung | dolphm, we could, in theory, put compression into an optional stage as well | 19:11 |
| dolphm | morganfainberg: decode in the middleware OR fetch once from the backend, right? | 19:12 |
| morganfainberg | dolphm, for PKI always decode | 19:12 |
| morganfainberg | dolphm, never fetch, UUID = fetch | 19:12 |
| dstanek | morganfainberg: the devstack side was in progress - what i'm hearing here is that we're probably not going to deal with it right now | 19:12 |
| morganfainberg | dolphm, and the resulting non-persistent provider would cease support for UUID | 19:13 |
| dstanek | i'm just trying to go through the open bugs and see if there are next actions we can take | 19:13 |
| *** leseb_ has quit IRC | 19:13 | |
| morganfainberg | dstanek, well i'd like to do it in juno... but it has a lot of moving pieces, i'd mark that one as triaged | 19:13 |
| morganfainberg | dstanek, we can come back / revisit down the line. | 19:13 |
| morganfainberg | which reminds me, dolphm, whats the timeline on the next ksc release? | 19:14 |
| dstanek | is it still critical then? | 19:14 |
| morganfainberg | dstanek, we have it documented... i could see it dropped to high or medium (defer to dolphm on that) | 19:14 |
| dolphm | morganfainberg: was waiting until we need it to land service-side token compression - which is now | 19:15 |
| morganfainberg | dolphm, ++ exactly why i was asking | 19:15 |
| dolphm | morganfainberg: but we also need auth_token support for token compression | 19:15 |
| dolphm | so, not sure if there's any point in making a release atm? | 19:15 |
| morganfainberg | ayoung, doens't auth_token do pkiz now? | 19:15 |
| morganfainberg | ayoung, was almost sure it did | 19:15 |
| bknudson | auth_token doesn't need anything to compression | 19:15 |
| morganfainberg | bknudson, yeah i thought that was part of the cms decode | 19:16 |
| bknudson | would be unfortunate if https://review.openstack.org/#/c/80398/ didn't make this keystoneclient release. | 19:16 |
| dolphm | morganfainberg: it's a parallel API in the cms module though, right? so auth_token needs to call into it specifically? | 19:16 |
| dolphm | ayoung: ^ | 19:16 |
| bknudson | auth_token was changed to use the new cms function | 19:17 |
| morganfainberg | dolphm, let's get bknudson's merged (i'll do the deep dive again today) and if auth_token doesn't need anything else we can release. i think it's seemless vs. parallel | 19:17 |
| bknudson | I tried it | 19:17 |
| dolphm | bknudson: ah, i missed that then | 19:18 |
| morganfainberg | bknudson, i was almost positive i tested that as well. | 19:19 |
| dolphm | is anyone looking to land a BP in juno-1? | 19:19 |
| dolphm | other than token compression | 19:19 |
| *** leseb has joined #openstack-keystone | 19:20 | |
| dolphm | that's the only thing on our milestone https://launchpad.net/keystone/+milestone/juno-1 | 19:20 |
| morganfainberg | dolphm, not I. I plan to write specs for everything I want to land in Juno (even if I land it pre-J1) | 19:20 |
| *** bvandenh has quit IRC | 19:20 | |
| dstanek | for Python 3 support i've started to leap (before I look) a little bit. i've been getting Keystone to work against some unofficial patches so that we can keep it moving forward. | 19:24 |
| dstanek | my hope is that i can help make the patches part of the projects. see https://review.openstack.org/#/c/95827/ for the first one | 19:24 |
| dstanek | i have a few other ones queued up that i have almost working. | 19:24 |
| dstanek | i know we can release like this, but is this acceptable while Py3 doesn't work anyway? | 19:25 |
| dolphm | dstanek: the py3 requirements files aren't managed by global requirements at all, right? | 19:31 |
| morganfainberg | bknudson, https://review.openstack.org/#/c/92499/4/keystoneclient/middleware/auth_token.py really? we did all that work multiple times. hehe | 19:31 |
| morganfainberg | bknudson, good fix. | 19:31 |
| *** jdennis has quit IRC | 19:33 | |
| dolphm | dstanek: i think that's a good way to document the gap we have to cover to support py3 | 19:33 |
| bknudson | morganfainberg: you asked for that change | 19:33 |
| morganfainberg | bknudson, oh right *derp* | 19:33 |
| dstanek | dolphm: i don't think so | 19:33 |
| morganfainberg | bknudson, i've been juggling a bunch of stuff getting moved to new job :) | 19:34 |
| morganfainberg | bknudson, +2/+A now.... https://review.openstack.org/#/c/80398/ on to this one. | 19:34 |
| bknudson | morganfainberg: I think if I was switching jobs I'd be juggling less (or just stop juggling) | 19:35 |
| morganfainberg | bknudson, i was writing code / transferring knowledge up to about 1h before turning in keys. | 19:36 |
| morganfainberg | bknudson, then i checked out completely for the 3 day weekend | 19:36 |
| dolphm | morganfainberg: p.s. i also +2/+A'd a change to unbreak git-review on keystone-specs this morning after the repo name change (without a second +2) https://review.openstack.org/#/c/95298/ | 19:36 |
| morganfainberg | dolphm, good call | 19:36 |
| morganfainberg | i don't think i even looked at email this weekend. | 19:37 |
| bknudson | morganfainberg: you've started with hp then? | 19:38 |
| morganfainberg | bknudson, today is 1st day | 19:38 |
| morganfainberg | bknudson, :) | 19:39 |
| bknudson | morganfainberg: do they have an orientation get-together? | 19:39 |
| morganfainberg | bknudson, i'm remote, so the get together would be on IRC :P | 19:39 |
| *** leseb has quit IRC | 19:39 | |
| bknudson | when I joined IBM we had an orientation week in Chicago | 19:40 |
| morganfainberg | yeah, no such thing (that I'm aware of so far) | 19:40 |
| raildo | morganfainberg: When we discuss about inherited roles in hierarchical projects? | 19:43 |
| lbragstad | jamielennox: around for a few questions on the validator stuff? | 19:43 |
| morganfainberg | raildo, you mean how the roles inherit? | 19:44 |
| ayoung | morganfainberg, yes, auth_token now does pkiz. If we have released an new client, that is | 19:44 |
| morganfainberg | ayoung, right. | 19:45 |
| jamielennox | lbragstad: sure - i haven't looked at it for a while | 19:45 |
| *** andreaf has joined #openstack-keystone | 19:46 | |
| *** zhiyan_ is now known as zhiyan | 19:46 | |
| lbragstad | jamielennox: ok, no worries. I was looking at your refactor to schema objects today and was trying to remember what the motive for that was again... I am going to write up a spec for the json schema stuff | 19:46 |
| dstanek | lbragstad: jamielennox: there's no official declarative layer around jsonschema yet is there? | 19:47 |
| jamielennox | lbragstad: essentially i would like to stop passing dictionaries around and put some of the intelligence of parsing requests into an object of that request | 19:47 |
| raildo | morganfainberg: According to what I discussed with vish, the idea would be to use a flag to determine whether a role is inherited. To list the roles of a project, you must list all roles inherited from their hierarchy, addition to the roles associated with this project. | 19:48 |
| jamielennox | dstanek: official like OS wide? there's nothing i know of | 19:48 |
| morganfainberg | raildo, i think the way we would do it is the same as we already have it. not a "role" flag, but a flag when assigning the role | 19:48 |
| morganfainberg | raildo, we already support that concept with the OS-INHERIT extension | 19:48 |
| dstanek | jamielennox: or from the jsonschema project | 19:49 |
| raildo | yeah, of course | 19:49 |
| morganfainberg | raildo, in short, the data lives in the assignment (user A is role X on project Y, inheritable) vs role X is inherited for everyone | 19:49 |
| raildo | morganfainberg: what is missing is the part of list roles according to this hierarchy | 19:50 |
| jamielennox | dstanek: not like that i don't think - they seem mostly concerned with just parsing python primatives | 19:50 |
| morganfainberg | raildo, ahh oh i see. | 19:50 |
| lbragstad | jamielennox: so the request is the object, and the schema to validate is an instance of the request object... right? | 19:50 |
| morganfainberg | raildo, we need to support it under the heirarchy and not just from domain (optionally) | 19:51 |
| raildo | morganfainberg: +1 | 19:51 |
| morganfainberg | raildo, i think this is something we could justify moving outside of an extension. which, i think, would solve the issue once the project hierarchy code is in place | 19:51 |
| *** jaosorior has quit IRC | 19:51 | |
| jamielennox | lbragstad: not following the distinction, from memory the way i did it was just to have it as an attribute on the object | 19:52 |
| lbragstad | so ProjectCreate would inherit from models.Request https://review.openstack.org/#/c/92031/1/keystone/assignment/schema.py | 19:52 |
| morganfainberg | ayoung, henrynash, any reason we wouldn't want to make OS-INHERIT non-extension at this point? it seems like a useful feature to have in all cases. - and since it's optional... it wouldn't affect anything directly unless used. | 19:53 |
| *** ajayaa has quit IRC | 19:53 | |
| raildo | morganfainberg: you speak to incorporate inherited roles at Keystone and not an extension, I get it correct? | 19:53 |
| morganfainberg | raildo, correct. | 19:53 |
| ayoung | morganfainberg, because that would be a pain in the fourth point of contact to implement | 19:53 |
| raildo | morganfainberg: sounds good to me | 19:53 |
| lbragstad | and so the self.schema of ProjectCreate would hold the schema | 19:53 |
| ayoung | lets just say it is a "required extension" | 19:53 |
| *** dims has quit IRC | 19:54 | |
| morganfainberg | ayoung, sure, final implementation detail, but default to on i think is my main point. | 19:54 |
| morganfainberg | and required if you want the heirarchy stuff to work | 19:54 |
| ayoung | morganfainberg, required. Period | 19:54 |
| morganfainberg | ayoung, sure. | 19:55 |
| *** zhiyan is now known as zhiyan_ | 19:55 | |
| *** gyee has quit IRC | 19:57 | |
| raildo | ayoung: morganfainberg One question, if I took a -1 on a patch, but I think that -1 was invalid, what should I do? | 19:57 |
| *** leseb has joined #openstack-keystone | 19:58 | |
| ayoung | nkinder, raildo appeal to core and we can ignore it | 19:58 |
| ayoung | which one? | 19:58 |
| morganfainberg | raildo, you typically respond to the comments (inline or on the review) and / or talk in IRC about it. | 19:58 |
| morganfainberg | raildo, also, what ayoung said. | 19:58 |
| raildo | https://review.openstack.org/#/c/84136/ | 19:58 |
| morganfainberg | raildo, thought it was that one. | 19:59 |
| raildo | I justified it in the comment. | 19:59 |
| ayoung | raildo, make a trivial change, resubmit, and the -1 gets dropped. Then lbragstad appeals to me to -2 it so you have to address his comment. Nad the whole thing breaks down into anarchy | 19:59 |
| ayoung | then dolphm declares martial law | 19:59 |
| *** sbfox1 has quit IRC | 19:59 | |
| morganfainberg | dolphm, LOL | 19:59 |
| raildo | hahahaha | 20:00 |
| ayoung | raildo, I'd agree with lbragstad on that one, though | 20:00 |
| morganfainberg | dolphm, stevemar, damn twitter convo. | 20:00 |
| * dolphm unable to comply, anarchy in progress | 20:00 | |
| ayoung | actually, I'd probably go on to a rant | 20:00 |
| * ayoung takes a deep breath | 20:00 | |
| ayoung | ok, raildo here is why that is wrong | 20:00 |
| ayoung | Keystone really is two things | 20:00 |
| ayoung | one is an identity provider | 20:01 |
| * morganfainberg steps back away letting the rant wind up. | 20:01 | |
| ayoung | two is an assignment layer | 20:01 |
| * dolphm logs off | 20:01 | |
| morganfainberg | dolphm, not so fast! :P | 20:01 |
| ayoung | going from "user has a role in a project" to "this is that users data" is tricky | 20:01 |
| jamielennox | lbragstad: i did it that way because it was a relatively easy refactor - if you have something else in mind i'm ok | 20:01 |
| stevemar | morganfainberg, gotta get the best price on household goods | 20:02 |
| ayoung | raildo, we are splitting the Identity provider out of the assignement server | 20:02 |
| ayoung | people are going to want both, but I would rather never deal with the SQL based identity provider if I don't have to | 20:02 |
| jamielennox | lbragstad: i figured it was more important to make something that had the general pattern now and we could figure out interesting ways of storing the schema later | 20:02 |
| ayoung | raildo, in my world, people are stored in LDAP | 20:02 |
| morganfainberg | stevemar, now i'm sorry this i caused this conversation bleed over to IRC. | 20:02 |
| morganfainberg | stevemar, :P | 20:03 |
| stevemar | morganfainberg, as dolphm said, #openstack, better? | 20:03 |
| *** hrybacki has joined #openstack-keystone | 20:03 | |
| stevemar | hehe | 20:03 |
| morganfainberg | stevemar, thats what made me laugh and bring it here. | 20:03 |
| ayoung | so...making more streamlined calls to say "give me all of the data about all users for this project" is not really a supportable approach, even more so in a federated world. | 20:03 |
| raildo | ayoung: so I'll abandon this change. | 20:05 |
| *** morazi has joined #openstack-keystone | 20:05 | |
| ayoung | raildo, the important question is "what are you trying to do?" | 20:05 |
| morganfainberg | dolphm, so for moving over all the API specs to the new spec repo, is that something we need to convert the data from and move over or just "going forward"... or? | 20:05 |
| morganfainberg | and how does that get structured. | 20:05 |
| rodrigods | raildo, ayoung I think that get all users that have a role in a project is a really common use case | 20:06 |
| ayoung | rodrigods, in order to do what? | 20:07 |
| *** marcoemorais has quit IRC | 20:07 | |
| *** sbfox has joined #openstack-keystone | 20:07 | |
| rodrigods | ayoung, list them in horizon? | 20:07 |
| *** marcoemorais has joined #openstack-keystone | 20:07 | |
| ayoung | rodrigods, In a federated world, that will be impossible | 20:07 |
| morganfainberg | rodrigods, besides listing them in horizon, what is the usecase? | 20:07 |
| raildo | ayoung: I believe the same way that it is possible to list the user_id by project via role assingment, it should be possible to list the others informations from this user. | 20:07 |
| ayoung | raildo, nope. No in Federation | 20:08 |
| morganfainberg | rodrigods, listing them is not really a "use case", but what is the end goal? | 20:08 |
| raildo | I did not know it was impossible in federation. | 20:08 |
| rodrigods | morganfainberg, change their information? | 20:09 |
| morganfainberg | rodrigods, but federated users keystone can't change the user info | 20:10 |
| rodrigods | ayoung, hmm didn't know federation issue too | 20:10 |
| morganfainberg | rodrigods, raildo, think of it how Facebook connect works on the web, you can log into any number of websites for it, but is it really reasonable to ask facebook for all it's users that could log into the website? | 20:11 |
| rodrigods | morganfainberg, true... | 20:11 |
| morganfainberg | rodrigods, raildo, and how would that scale if you had to ask that question a whole number of times (billions of users) | 20:12 |
| rodrigods | morganfainberg, pagination | 20:12 |
| morganfainberg | likely you'd say if a user matched these attributes (maybe email address ends with @yahoo-inc.com), they are in a group, adn that group can do X | 20:12 |
| morganfainberg | rodrigods, you want to paginate 1+billion users? [extreme case, i knopw most IDPs wont have that many] even at 10,000 at 100 per page, you're talking 100+ pages and sourcing that data would take a very long time | 20:13 |
| morganfainberg | rodrigods, especially if you had to ask for that list even a few times a minute | 20:14 |
| raildo | morganfainberg: I did not have this knowledge when I was proposing this idea, taking federation, I thought a good idea. | 20:14 |
| raildo | thanks for the clarification | 20:14 |
| morganfainberg | raildo, it's not a bad idea at all. it just doesn't fit with the questions we can ask of federated users. | 20:15 |
| *** radez is now known as radez_g0n3 | 20:15 | |
| rodrigods | morganfainberg, hmm yeah, in this extreme scenario, things can get messy | 20:15 |
| morganfainberg | rodrigods, and now assume you can't even ask the IDP some of these questions, because they don't expose that information. | 20:16 |
| lbragstad | jamielennox: I was just talking to bknudson and he brought up a good point. | 20:16 |
| lbragstad | how do we go about enforcing limits specific to the backend... | 20:16 |
| rodrigods | morganfainberg, and what about other calls, like GET /v3/users? Doesn't it fall in the same issue? | 20:17 |
| jamielennox | lbragstad: limits like ?marker etc? | 20:17 |
| morganfainberg | rodrigods, correct and federated users don't appear there. and in some environments that call causes major issues and should never be used. | 20:18 |
| lbragstad | jamielennox: example the sql backend allows for 255 character user names but the LDAP backend doesn't have limit | 20:18 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Remove left over vim headers https://review.openstack.org/95896 | 20:19 |
| jamielennox | lbragstad: i guess that's something that we don't try and enforce at the jsonschema level at all | 20:19 |
| ayoung | rodrigods, the most you should expect to have in a Federated environment is the list of Groups that have roles assigned to the project | 20:19 |
| ayoung | you might have some users with direct role assignments, but we are anticipating that will be the less common approach | 20:20 |
| ayoung | nkinder, back to Horizon: | 20:20 |
| jamielennox | lbragstad: the jsonschema should enforce things defined by identity-api, backend specific things like that will have to be defined by the backend as they are now | 20:20 |
| ayoung | nkinder, I was looking at the code for Kerberos | 20:20 |
| ayoung | specifically: what do we need to do to Horizon to support Kerberos | 20:20 |
| morganfainberg | lbragstad, hopefully we are limiting things sanely to a specification not letting anything through. | 20:20 |
| ayoung | I think I need Jose's Kerberos patch first | 20:20 |
| lbragstad | jamielennox: yep, that makes sense | 20:20 |
| morganfainberg | lbragstad, jamielennox, and if we don't specify the length of values... (or expected ranges) we probably should. | 20:21 |
| morganfainberg | could get dicey otherwise | 20:21 |
| ayoung | https://review.openstack.org/#/c/74974/ | 20:21 |
| rodrigods | ayoung, morganfainberg makes sense =) | 20:21 |
| jamielennox | morganfainberg: again that would be a question for identity-api | 20:21 |
| *** boris-42 has quit IRC | 20:21 | |
| ayoung | and...if we used Kerberos/S4U2 you would not need unscoped tokens | 20:21 |
| lbragstad | morganfainberg: in one of the first patches I pushed i was doing that on UUIDs and such... | 20:21 |
| morganfainberg | jamielennox, well keystone-specs now ;) | 20:21 |
| *** boris-42 has joined #openstack-keystone | 20:21 | |
| morganfainberg | lbragstad, user_id max is 64 according to schema, (all ids iirc) | 20:21 |
| ayoung | instead, you would use the Service ticket as the unscoped token...assuming that you could make Keystone calls without a token | 20:22 |
| ayoung | something we have discussed numerous times: gyee and I would like it to be possible: | 20:22 |
| jamielennox | morganfainberg: actually i guess jsonschema can enforce implementation specific things, so long as they're global across backends | 20:22 |
| morganfainberg | lbragstad, since we need to support non-uuid ldap type stuff, you'd need to say string len(x) for example | 20:22 |
| morganfainberg | jamielennox, ++ | 20:22 |
| ayoung | nkinder, in fact, requiring any token for talking to Keystone is kindof dumb | 20:23 |
| jamielennox | morganfainberg: i'm hoping that between keystone-specs and identity-api reviews a person can actually get something implemented in a cycle | 20:23 |
| ayoung | and it only exists becasue Horizon uses the token as a session | 20:23 |
| morganfainberg | jamielennox, we should be merging the two repos | 20:23 |
| morganfainberg | jamielennox, everything should be keystone-specs | 20:23 |
| jamielennox | ..? that wasn't my understanding | 20:23 |
| morganfainberg | jamielennox, was part of the meeting earlier, docs folks specifically asked us to merge it, notably because i think we're the only project using it as a spec. | 20:24 |
| morganfainberg | jamielennox, and it's not published anywhere anyway | 20:24 |
| lbragstad | morganfainberg: currently I'm just basing things of the identity api specs for the different keystone resources... | 20:24 |
| lbragstad | it could be tighted down though I'm sure.. | 20:24 |
| morganfainberg | lbragstad, that makes sense, just keep in mind the different backends | 20:25 |
| lbragstad | yep | 20:25 |
| morganfainberg | lbragstad, there may actually be a mis-match in some cases (which we should identify and fix one side or the other depending on the mismatch) | 20:25 |
| *** afazekas has joined #openstack-keystone | 20:25 | |
| nkinder | ayoung: yes, you could simply get scoped tokens using the service ticket with Kerberos. | 20:26 |
| morganfainberg | ayoung, jamielennox, nkinder https://review.openstack.org/#/c/80398 would be good to get that in before the next ksc release | 20:26 |
| nkinder | ayoung: there's really no need for the unscoped token in that situation | 20:26 |
| morganfainberg | ayoung, jamielennox, nkinder, i think if we got that in it would make for a solid ksc release (compression + hash config) | 20:26 |
| *** dims has joined #openstack-keystone | 20:26 | |
| ayoung | nkinder, right and if we solved that X509 thing I was kicking around on the internal mailing list, we could in theory say that this is the pivot point for delegation of trust from the user to Horizon.... | 20:27 |
| ayoung | morganfainberg, now bknudson is trying for my record of most revisions on a patch? | 20:27 |
| morganfainberg | ayoung, nah, he wont even come close to stevemar's :P | 20:28 |
| ayoung | I beat stevemar pretty sure.... | 20:28 |
| lbragstad | morganfainberg: mismatch between what the different backends allow? | 20:28 |
| morganfainberg | ayoung, stevemar was > 60, so 33 is nothing :P | 20:28 |
| morganfainberg | lbragstad, what the spec says and what the backends allow | 20:28 |
| lbragstad | ahh, right | 20:28 |
| ayoung | morganfainberg, I +2Aed that before...willing to do so again now | 20:29 |
| morganfainberg | ayoung, it looks solid, nothing bad (fair certain i've reviewed it 3 or 4 times now) | 20:29 |
| stevemar | morganfainberg, ayoung's revocation stuff beat mine by a good bit | 20:29 |
| stevemar | i no longer hold the record, woo | 20:30 |
| ayoung | morganfainberg, I've readded my +2. Feel free to pull the trigger at your leisure. | 20:30 |
| morganfainberg | ayoung, doing a final once over. doesn't look wrong but just... you know :P client breakage = bad so want to be sure :) | 20:31 |
| ayoung | morganfainberg, the positive thrad for tokens gets the wringer in tempest | 20:32 |
| ayoung | thread | 20:32 |
| morganfainberg | right | 20:32 |
| schofield | I'm getting a stack trace running "keystone-all" on a manually installed keystone (icehouse/stable on Ubuntu 12.04). Stack trace and my config files are at https://gist.github.com/johnmarkschofield/4ad1fa81d798eca651a1 . Possibly a config error, possibly *anything* as it's a manual-install from source as a learning exercise. | 20:32 |
| schofield | I'm looking for either a solution or debugging suggestions. | 20:33 |
| jamielennox | morganfainberg: looking | 20:33 |
| ayoung | schofield, do you want the templated backend for catalog? | 20:33 |
| morganfainberg | jamielennox, +2'd if you don't see any issues +2/+A (or let us know so we can get it fixed re-reviewed) | 20:34 |
| ayoung | jamielennox, how comfortable do you feel with jose's Kerberos client patch? | 20:34 |
| morganfainberg | schofield, i'm guessing it's not finding the template file | 20:35 |
| jamielennox | morganfainberg: i've +2ed in the past so it should be ok | 20:36 |
| schofield | ayoung: I honestly don't know. I copied keystone-paste.ini from source. I'm attempting to follow http://docs.openstack.org/trunk/install-guide/install/apt/content/index.html as a learning exercise, but I'm still waaaay ignorant about keystone. | 20:36 |
| morganfainberg | schofield, you might try using a fully-qualified path for the template file itself. | 20:36 |
| morganfainberg | schofield, vs ./etc/... | 20:36 |
| morganfainberg | schofield in the config | 20:36 |
| morganfainberg | jamielennox, ack | 20:36 |
| schofield | @morganfainberg: Thanks for the help! Will dig into that. | 20:36 |
| morganfainberg | jamielennox, so want me to +A or you? [don't care either way] | 20:36 |
| jamielennox | ayoung: i remember it being ok, we were waiting for a server side thing | 20:37 |
| jamielennox | morganfainberg: i've got a couple of calls to do,i dont see a problem from first look | 20:37 |
| morganfainberg | schofield, also, you have data in your template, correct? | 20:37 |
| morganfainberg | jamielennox, ok i feel comfortable with a +A then. will push go. | 20:38 |
| schofield | @morganfainberg: I will shortly. ;-) This is me figuring out how the parts fit together from a position of complete ignorance. | 20:38 |
| morganfainberg | schofield, having an empty template might also be causing that error | 20:38 |
| morganfainberg | schofield, it is not a friendly error to be sure. | 20:39 |
| schofield | @morganfainberg ayoung: Thanks for your help! It was a missing template file. Copied the one from source and changed the path in keystone.conf to be explicit, and I seem to be up and running. (At least, I'm not getting that error anymore.) | 20:41 |
| morganfainberg | schofield, no problem! I highly recommend looking at the SQL based catalog (the template one is very limited). but I know a number of deployments that still use the templated one. | 20:42 |
| schofield | @morganfainberg: This is a toy deployment just for learning. Will explore the SQL-based backend once I get all the parts of this one working. | 20:43 |
| morganfainberg | schofield, sounds good! good luck :) | 20:43 |
| schofield | @morganfainberg: Thanks for your help! | 20:43 |
| dstanek | jamielennox: what is the name property for here https://review.openstack.org/#/c/92031/1/keystone/assignment/schema.py,cm? | 20:45 |
| jamielennox | dstanek: i think i did it as kind of an example of how i'd like to put request parsing code onto the objects | 20:46 |
| *** zhiyan_ is now known as zhiyan | 20:47 | |
| jamielennox | at the time the patch was mostly for showing ideas, i don't think i use it anywhere | 20:47 |
| dstanek | jamielennox: how does that dict key actually get set? i didn't see any reason to make that a subclass of dict | 20:48 |
| jamielennox | dstanek: the point initially is to co-exist between the current works as a dict and future is an object | 20:49 |
| jamielennox | when everyone uses the results correctly we could remove that subclass | 20:49 |
| jamielennox | results = request object, correctly = as an objct | 20:50 |
| *** marcoemorais has quit IRC | 20:51 | |
| *** marcoemorais has joined #openstack-keystone | 20:51 | |
| *** gokrokve_ has quit IRC | 20:52 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: indicate that sensitive messages can be disabled https://review.openstack.org/94871 | 20:53 |
| dstanek | jamielennox: i wish this stuff was more like formencode - we used to have the great validate() decorator that accepted a formencode schema (like your patch does) and then output Python values in a new dict named clean_values | 20:54 |
| dstanek | jamielennox: that was if the validator was checking for a date/timestamp the resulting value would be a datetime object | 20:55 |
| *** zhiyan is now known as zhiyan_ | 20:56 | |
| jamielennox | so the validator should do that because if its wrong then it'll fail validation, then i was thinking that you'd do datetime etc on a property or something at object level | 20:57 |
| *** huats has quit IRC | 21:01 | |
| *** huats has joined #openstack-keystone | 21:01 | |
| *** leseb has quit IRC | 21:01 | |
| dstanek | jamielennox: have you ever used formencode? | 21:02 |
| *** gyee has joined #openstack-keystone | 21:02 | |
| dstanek | jamielennox: check this out for some inspiration http://formencode.readthedocs.org/en/latest/Validator.html#using-validation | 21:02 |
| *** gyee has quit IRC | 21:07 | |
| *** henrynash has quit IRC | 21:10 | |
| dstanek | is there anyway for the gerrit emails show if i've voted for a change? | 21:11 |
| dstanek | if i +1 a review and someone else -1s it i want to go back and look; OTOH if i -1 it and get an email because someone else -1s it, i don't need to look | 21:12 |
| *** dims has quit IRC | 21:13 | |
| dstanek | right now i always click the links... | 21:13 |
| jamielennox | dstanek: i looked for this a while ago and not that i found, however in new gerrit there is a json api, so you can queru that for details in some script | 21:14 |
| dstanek | jamielennox: bummer...maybe i'll just have to do that | 21:15 |
| *** gyee has joined #openstack-keystone | 21:18 | |
| dstanek | bknudson: i'm happy with https://review.openstack.org/#/c/86578 except for the % in the logging statement - every other patchset it gets added back in | 21:24 |
| bknudson | dstanek: I didn't notice it | 21:27 |
| dstanek | bknudson: i'm going to push a fix for it because otherwise i think it's fine | 21:28 |
| bknudson | dstanek: works for me | 21:28 |
| -openstackstatus- NOTICE: Zuul is offline due to an operational issue; ETA 2200 UTC. | 21:32 | |
| *** ChanServ changes topic to "Zuul is offline due to an operational issue; ETA 2200 UTC." | 21:32 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Code which gets and deletes elements of tree was moved to one method https://review.openstack.org/86578 | 21:35 |
| *** devkulkarni has joined #openstack-keystone | 21:36 | |
| devkulkarni | Hey there, I am looking for differences between Keystone trusts and Keystone OAuth1 (use cases handled, implementation status, upcoming plans for these features, etc.). I was wondering if someone here could point me to some document(s) discussing this.. | 21:39 |
| *** marcoemorais has quit IRC | 21:43 | |
| *** marcoemorais has joined #openstack-keystone | 21:44 | |
| *** hrybacki has quit IRC | 21:44 | |
| morganfainberg | gyee, ping re: https://review.openstack.org/#/c/94251 - should we do an if-check to see if user_id != project_id so we don't lookup the domain multiple times? | 21:44 |
| *** marcoemorais has quit IRC | 21:45 | |
| gyee | morganfainberg, yo | 21:45 |
| *** marcoemorais has joined #openstack-keystone | 21:45 | |
| morganfainberg | gyee, i would rather not have to do another round trip to the backend if we don't need to. | 21:45 |
| *** dims has joined #openstack-keystone | 21:45 | |
| gyee | morganfainberg, but this is for checking the scoped project's domain | 21:46 |
| morganfainberg | gyee, right | 21:46 |
| gyee | which could be different from the user's domain | 21:46 |
| morganfainberg | gyee, so if user_id['domian_id'] != project['domain_id'] assert_domain_is_enabled | 21:46 |
| morganfainberg | else, we already should have asserted on that | 21:46 |
| gyee | morganfainberg, oh | 21:46 |
| gyee | I see your wisdom :) | 21:46 |
| morganfainberg | saves us a round trip to the backend :) | 21:47 |
| gyee | yes, performance ftw! | 21:47 |
| gyee | good point | 21:47 |
| morganfainberg | cool will comment on it as such | 21:47 |
| gyee | lemme patch it up | 21:47 |
| gyee | thanks! | 21:47 |
| morganfainberg | gyee commented. | 21:48 |
| *** zhiyan_ is now known as zhiyan | 21:48 | |
| * morganfainberg is catching up on reviews today. | 21:48 | |
| gyee | yeah man, I am behind on code reviews too | 21:48 |
| gyee | need to burn some midnight oil | 21:48 |
| morganfainberg | gyee, happens to all of us. | 21:49 |
| gyee | morganfainberg, actually, a bit of a problem, user_ref is not yet available yet | 21:56 |
| *** harlowja_ is now known as harlowja_away | 21:57 | |
| gyee | that logic was merely validating the scope info | 21:57 |
| *** zhiyan is now known as zhiyan_ | 21:57 | |
| morganfainberg | hm. sec | 21:57 |
| *** harlowja_away is now known as harlowja_ | 21:57 | |
| gyee | because, auth payload is not interpreted until it gets to the auth plugins | 21:57 |
| morganfainberg | gyee, hm. we don't have the user_id in self.auth there? | 21:59 |
| gyee | morganfainberg, no, we don't have the user_id till it comes back from the auth plugins | 22:00 |
| morganfainberg | oh bleh. | 22:00 |
| morganfainberg | hm.. | 22:00 |
| gyee | yeah I know, it needs refactoring :) | 22:00 |
| gyee | ayoung's pipeline approach | 22:01 |
| morganfainberg | i guess it is cheaper to do a single domain lookup than get all the way to validating user info just to save a round trip | 22:01 |
| gyee | token issurance based on policy | 22:01 |
| morganfainberg | hm... | 22:01 |
| gyee | morganfainberg, yet, at this point, that's probably the quick and dirty way | 22:02 |
| morganfainberg | gyee, lets leverage the _lookup_domain code instead thean | 22:02 |
| morganfainberg | gyee, maybe | 22:03 |
| *** shakamunyi has quit IRC | 22:03 | |
| gyee | morganfainberg, lookup_domain is assuming domain_info | 22:03 |
| gyee | I suppose I could refactoring it | 22:03 |
| gyee | but we're not gaining much | 22:03 |
| morganfainberg | gyee, hm. | 22:03 |
| morganfainberg | gyee, meh, this is ugly in either case :( | 22:04 |
| dstanek | dolphm: are we good to start rolling on https://review.openstack.org/#/c/64159/ again? | 22:04 |
| morganfainberg | gyee, in that case in the else in _lookup_project you should do the _assert_domain_enabled not in _assert_project_enabled | 22:06 |
| gyee | morganfainberg, but dogpile may save our asses as domain_ref is highly static | 22:06 |
| morganfainberg | gyee, so you don't assert on domain enabled when doing the project_name lookup AND then in the assert project and then on the user too | 22:06 |
| morganfainberg | gyee, sure, but lets not be too sloppy if we can avoid it | 22:06 |
| gyee | morganfainberg, project is enabled if both the project and the project's domain are enabled | 22:07 |
| gyee | so I have to check both cases | 22:07 |
| morganfainberg | right and in the case (line 161) you're looking up by project name _lookup_domain does the assert for you | 22:07 |
| morganfainberg | so put the domain_ref lookup and assert at line 164 instead of in _assert_project_enabled | 22:07 |
| morganfainberg | in the "else" post project_ref lookup, and add in DomainNotFound in the except clause for 166 (i think) | 22:08 |
| *** thedodd has quit IRC | 22:08 | |
| morganfainberg | gyee, does that make sense? | 22:09 |
| -openstackstatus- NOTICE: Zuul is started and processing changes that were in the queue when it was stopped. Changes uploaded or approved since then will need to be re-approved or rechecked. | 22:09 | |
| *** ChanServ changes topic to "Juno-1 June 12th! New formalized Identity-spec process for Juno-2 and beyond blueprints." | 22:09 | |
| morganfainberg | looking at https://review.openstack.org/#/c/94251/1/keystone/auth/controllers.py for the line numbers | 22:10 |
| gyee | morganfainberg, I hear ya | 22:10 |
| gyee | lemme put up a new patch | 22:10 |
| gyee | one sec | 22:10 |
| morganfainberg | gyee, cool. | 22:10 |
| *** shakamunyi has joined #openstack-keystone | 22:10 | |
| lbragstad | morganfainberg: how would you classify testing a jsonschema validator in the gate? | 22:11 |
| morganfainberg | lbragstad, in the restful tests, would be my guess | 22:12 |
| morganfainberg | lbragstad, oh not where... | 22:12 |
| lbragstad | yep, | 22:12 |
| lbragstad | looking at https://github.com/openstack/keystone-specs/blob/master/specs/template.rst#testing | 22:13 |
| morganfainberg | lbragstad, uhm. options? | 22:13 |
| lbragstad | would we add tempest tests for validating every Keystone resource | 22:13 |
| lbragstad | and combinations ? | 22:13 |
| gyee | morganfainberg, took 30 seconds to make the change, 30 min to run the tests :( | 22:13 |
| morganfainberg | in theory tempest should test that. | 22:13 |
| morganfainberg | gyee, yeah i know :( sorry. | 22:13 |
| lbragstad | or would the majority of that be executed with unit tests | 22:13 |
| lbragstad | ok | 22:13 |
| morganfainberg | lbragstad, that way if something in the validator changes and bounces requests someone doesn't / didn't change the unit test at the same time | 22:14 |
| lbragstad | ok | 22:14 |
| morganfainberg | lbragstad, but, in theory tempest should already be hitting the interfaces. | 22:14 |
| morganfainberg | lbragstad, theory != reality | 22:14 |
| lbragstad | the way it stands now, the validation is being done in the resource controllers | 22:15 |
| morganfainberg | :P | 22:15 |
| morganfainberg | i'd ask the QA folks if they want tests verifying the validator bounces invalid requests in tempest (i would want it there) but not sure if the volume of added tempest tests are a good idea | 22:15 |
| morganfainberg | we might just need a fuzz testing suite vs. testing alll variations. | 22:16 |
| lbragstad | morganfainberg: ok, sounds good... it would be good to have them there but testing all the permutations on all the resources + extentions might be lengthy | 22:16 |
| morganfainberg | lbragstad, exactly | 22:16 |
| morganfainberg | gyee, lol i am rapidly brain frying on reviews :P let me see if i can get through another 15 or so today before i start writing specs instead | 22:18 |
| gyee | haha | 22:18 |
| morganfainberg | lbragstad, and that was super easy! | 22:25 |
| lbragstad | morganfainberg: :) | 22:25 |
| *** browne has quit IRC | 22:27 | |
| *** stevemar has quit IRC | 22:29 | |
| *** henrynash has joined #openstack-keystone | 22:30 | |
| *** browne has joined #openstack-keystone | 22:31 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone-specs: Purpose keystone-api-validation blueprint https://review.openstack.org/95957 | 22:36 |
| *** toddnni has joined #openstack-keystone | 22:36 | |
| morganfainberg | lbragstad, NICE first real spec proposed! | 22:37 |
| morganfainberg | wooooooo | 22:37 |
| * lbragstad facepalm whitespace issues | 22:37 | |
| * lbragstad got too excited | 22:37 | |
| *** marcoemorais has quit IRC | 22:38 | |
| morganfainberg | lbragstad, LOL | 22:38 |
| *** marcoemorais has joined #openstack-keystone | 22:38 | |
| *** toddnni_ has quit IRC | 22:38 | |
| *** marcoemorais has quit IRC | 22:38 | |
| morganfainberg | lbragstad, -2 <pout>I wanted to be the first to submit a spec</pout> *snicker* | 22:38 |
| morganfainberg | lbragstad, in all seriousness, nice glad to see this process starting | 22:39 |
| *** marcoemorais has joined #openstack-keystone | 22:39 | |
| * morganfainberg needs some lunch. | 22:39 | |
| lbragstad | morganfainberg: me too... nice template btw... enforces a lot of thought when filling out a blueprint spec | 22:39 |
| morganfainberg | lbragstad, give credit to the nova team! most of it came from them | 22:39 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone-specs: Purpose keystone-api-validation blueprint https://review.openstack.org/95957 | 22:41 |
| openstackgerrit | Matt Fischer proposed a change to openstack/python-keystoneclient: Add support for extensions-list https://review.openstack.org/92978 | 22:45 |
| *** zhiyan_ is now known as zhiyan | 22:48 | |
| *** gordc has quit IRC | 22:52 | |
| *** dstanek is now known as dstanek_zzz | 22:52 | |
| *** jdennis has joined #openstack-keystone | 22:56 | |
| *** zhiyan is now known as zhiyan_ | 22:58 | |
| *** nkinder has quit IRC | 22:58 | |
| *** andreaf has quit IRC | 22:59 | |
| *** nkinder has joined #openstack-keystone | 23:00 | |
| *** henrynash has quit IRC | 23:11 | |
| openstackgerrit | Dirk Mueller proposed a change to openstack/keystone: Sync systemd with oslo-incubator 17c4e21e31 https://review.openstack.org/95963 | 23:16 |
| *** hrybacki has joined #openstack-keystone | 23:17 | |
| *** devkulkarni has quit IRC | 23:20 | |
| *** david-lyle has quit IRC | 23:25 | |
| *** nkinder has quit IRC | 23:28 | |
| *** hrybacki has quit IRC | 23:30 | |
| *** davlaps has quit IRC | 23:33 | |
| *** dstanek_zzz is now known as dstanek | 23:33 | |
| *** browne has quit IRC | 23:34 | |
| *** gokrokve has joined #openstack-keystone | 23:41 | |
| *** dstanek is now known as dstanek_zzz | 23:43 | |
| *** marcoemorais has quit IRC | 23:53 | |
| *** henrynash has joined #openstack-keystone | 23:54 | |
| gabriel-bezerra | Hi, may you guys that work with fedora tell me what the names of the default sites of apache are? | 23:58 |
| *** henrynash has quit IRC | 23:59 | |
| gabriel-bezerra | on Ubuntu 14.04 there are 000-default.conf and default-ssl.conf | 23:59 |
| gabriel-bezerra | on Ubuntu 12.04, default and default-ssl | 23:59 |
| gabriel-bezerra | what about Fedora? | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!