| *** sbfox has quit IRC | 00:04 | |
| *** arunkant has quit IRC | 00:16 | |
| *** ozialien has quit IRC | 00:20 | |
| morganfainberg | stevemar, lbragstad, wow it can take some serious time to put together one of these spec docs | 00:22 |
|---|---|---|
| *** praneshp has quit IRC | 00:24 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Composite Token Spec https://review.openstack.org/96315 | 00:26 |
| *** ncoghlan has joined #openstack-keystone | 00:37 | |
| *** gokrokve has joined #openstack-keystone | 00:38 | |
| *** gokrokve has quit IRC | 00:42 | |
| *** ozialien has joined #openstack-keystone | 00:43 | |
| ayoung | morganfainberg, yep. Hopefully, though, it will make the api-spec process much smoother | 00:46 |
| morganfainberg | ayoung, well it definitely (from a writeup perspective) made it feel like I communicated the idea better than the previous identity-api spec process | 00:47 |
| ayoung | morganfainberg, on the DB extensions, the idea was to autmatically migrate the default extensions | 00:47 |
| ayoung | you don't want to migrate extensions that are not enabled. | 00:48 |
| morganfainberg | ayoung, why? | 00:48 |
| ayoung | morganfainberg, dependencies | 00:48 |
| ayoung | the idea is that an extension is an experiement | 00:48 |
| morganfainberg | ayoung, i'm not convinced having to migrate an extension to enable it is reasonable ux | 00:48 |
| ayoung | enableing it should be a deliberate choice, as is removing it | 00:49 |
| ayoung | morganfainberg, the mistake is that we don't automatically enable the default extensions yet | 00:49 |
| ayoung | lets do that first | 00:49 |
| ayoung | for Juno that would be: oauth, revoke | 00:50 |
| morganfainberg | ayoung, i'm fine with doing it in a couple stages, but i think i need more convincing that it's proper to not migrate the db in all cases. | 00:50 |
| morganfainberg | ayoung, inconsistent schemas are ugly things . i actually really really dislike the whole extension model | 00:50 |
| ayoung | morganfainberg, we don't want to overcommit to an extension. If we won't guarantee that it is there, we should not guarantee that the scheme is there | 00:51 |
| morganfainberg | ayoung, but that is a different battle i don't know if i want to fight. | 00:51 |
| ayoung | morganfainberg, the reason I pushed for it was to be able to cheaply spin up something like identity, and then split it off. If we had done it right from the get go, that would be a trivial migration | 00:51 |
| ayoung | but instead everything is in the galactic repo | 00:52 |
| ayoung | if an extension is really a new, budding service, we should be able to spin it off easily | 00:52 |
| morganfainberg | ayoung, not 100% sold, but again, i'm fine with starting it at one place vs everything | 00:52 |
| ayoung | yeah, lets start with the default extensions....what are they? | 00:53 |
| morganfainberg | ayoung, lets see for J, federation, revoke... uhm..... | 00:53 |
| ayoung | oauth | 00:53 |
| morganfainberg | i want to collapse endpoint filtering out of an extension - but that should be default | 00:53 |
| ayoung | endpoint_filter | 00:53 |
| ayoung | lets enable it for now | 00:54 |
| morganfainberg | it shouldn't be an extension - because of the special catalog magic. | 00:54 |
| ayoung | even if it is pout of "extension" the migrations stay in their own repo. | 00:54 |
| morganfainberg | or that part needs to wind up in the base catalog driver | 00:54 |
| ayoung | what is 'access'? | 00:54 |
| ayoung | no migration there anyway | 00:54 |
| morganfainberg | old old stuff iirc | 00:54 |
| ayoung | stats non | 00:55 |
| ayoung | can ec2 go away yet? | 00:55 |
| morganfainberg | no. | 00:55 |
| morganfainberg | but it has no migrations | 00:55 |
| ayoung | I thought we put it all into credentials | 00:55 |
| morganfainberg | it's backed by credential | 00:55 |
| morganfainberg | the APIs aren't in credential | 00:55 |
| morganfainberg | and people use those | 00:55 |
| ayoung | simple_cert has no migrations, but it will shortly, if I have my way | 00:55 |
| morganfainberg | stats is deprecated anyway | 00:55 |
| ayoung | but that can wait | 00:55 |
| morganfainberg | user_crud.. thats diablo compat right? | 00:56 |
| ayoung | OK so there is the list, and it is everything with a migration | 00:56 |
| dstanek | we're not fixing v2.0 garbage right? | 00:56 |
| ayoung | leave it. | 00:56 |
| ayoung | its the only way in v2 to basic admintasks | 00:56 |
| morganfainberg | not saying remove, was more "it's diablo compat, right?" | 00:56 |
| morganfainberg | ;) | 00:56 |
| morganfainberg | oh we totally need to enable example by default /s | 00:57 |
| morganfainberg | wtf is the access extension? | 00:57 |
| ayoung | morganfainberg, look at it this way, if we get a really, really dumb idea, but we can't figure out how to say no, we say "make it an extension" and we don't really pay any price | 00:57 |
| morganfainberg | ayoung, lets save the argument for later :) | 00:58 |
| ayoung | """Writes an access log to INFO.""" | 00:58 |
| morganfainberg | ... | 00:58 |
| ayoung | Heh, it is the thing that we are writing now: if you get a token., log it | 00:58 |
| morganfainberg | but... it's not an extension. | 00:58 |
| ayoung | nope, but contrib was not just extensions | 00:58 |
| morganfainberg | it's.. middl.. nevermind | 00:58 |
| ayoung | just all extensions were contrib | 00:58 |
| morganfainberg | gonna just pretend i didn't open that bundle of ... code | 00:59 |
| ayoung | morganfainberg, its deprecated, too | 01:00 |
| morganfainberg | ayoung, yeah | 01:00 |
| ayoung | morganfainberg, we should probably split apart the migrations for identity and for assignment into their own migration repos....policy and catalog too | 01:01 |
| ayoung | if we want to split id into its own service | 01:01 |
| morganfainberg | ayoung, you mind writing a quick spec up for that? i'm happy to work on the split. just gonna be a little painful. | 01:01 |
| morganfainberg | the collapse makes it better though. | 01:02 |
| ayoung | morganfainberg, will do | 01:02 |
| morganfainberg | ayoung, cool | 01:02 |
| morganfainberg | also added you and nkinder on the composite token stuff specifically (review wise) | 01:02 |
| morganfainberg | ayoung, ^ | 01:02 |
| morganfainberg | based on summit conversations it sounds like it has some potential, but it needs some hard looking to make sure it's done right | 01:03 |
| ayoung | ++ | 01:03 |
| ayoung | morganfainberg, I think splitting the migrate repos is the right thing to do regardless. If nothing else, it will reduce migration number clash | 01:04 |
| morganfainberg | now i jsut need to remember the 2 other specs i planned to write up... | 01:04 |
| morganfainberg | ayoung, well. it'll be interesting... thats for sure. | 01:04 |
| morganfainberg | ayoung, trying to figure out the right way to do it... i think i know, (version numbering wise)... but it's still gonna be an odd one. | 01:05 |
| morganfainberg | ayoung, i might advocate that split occur when we collapse for K. | 01:06 |
| ayoung | morganfainberg, we have to lock the global repo at a version, and initialize each of the other repos at 1. | 01:06 |
| morganfainberg | no. | 01:06 |
| morganfainberg | ayoung, it doesn't matter what number you start at (new repo wise) | 01:06 |
| morganfainberg | ayoung, we could keep going from the last version of the global repo | 01:07 |
| ayoung | migration 1 for identity is checking that the global repo is in its max state | 01:07 |
| ayoung | you mean like start them all at 44? | 01:07 |
| morganfainberg | sure. | 01:08 |
| ayoung | or whereever we are now? | 01:08 |
| morganfainberg | why not? | 01:08 |
| ayoung | my point is that the start state is that the global repo is up to max | 01:08 |
| morganfainberg | actually... maybe convert to alembic when we split. | 01:08 |
| ayoung | when we collapse in, say 'L' we drop the global repo | 01:08 |
| morganfainberg | ayoung, correct. | 01:08 |
| ayoung | don't think we are going to alembic | 01:08 |
| morganfainberg | ayoung, why not? | 01:08 |
| ayoung | doesn't matter what the start number is for the individual repos | 01:09 |
| ayoung | we were only going to alembic when we thought SQL A migrate was dying | 01:09 |
| ayoung | we are supporting it now, and I don';t know if alembic provides enough benefit to migrate to it | 01:09 |
| morganfainberg | ayoung, sql a migrate is still dead | 01:09 |
| ayoung | its pining for the fjords | 01:09 |
| ayoung | beutiful plumage | 01:09 |
| morganfainberg | and with the author of sqla and alembic working on OS 50% of the time, i think we can get alembic to support what we need | 01:09 |
| *** chen has left #openstack-keystone | 01:10 | |
| * ayoung looks at how many migrations.... | 01:13 | |
| ayoung | 36-50 | 01:14 |
| ayoung | regions...that goes to policy | 01:14 |
| ayoung | we collapse for Juno, right? | 01:14 |
| ayoung | what can we collapse up to? | 01:14 |
| ayoung | morganfainberg, we support 2 releases back? | 01:15 |
| morganfainberg | yes | 01:15 |
| ayoung | actually, Icehouse is collapsed up to Havana | 01:15 |
| morganfainberg | for J we will support H[release migration]->J directly. | 01:15 |
| morganfainberg | for K we will support last I release migration -> K | 01:15 |
| *** shakamunyi has quit IRC | 01:16 | |
| ayoung | morganfainberg, so in Juno we can collapse 37-44? | 01:16 |
| * morganfainberg looks | 01:16 | |
| *** browne has quit IRC | 01:17 | |
| morganfainberg | ayoung, correct we will start at 44 (just like havana was 36 and the base migration is 036_havana, I will be 044_icehouse) | 01:17 |
| ayoung | could we collapse now? | 01:18 |
| morganfainberg | no i mean once Juno is cut we do 044_icehouse | 01:18 |
| ayoung | was the collapse already the first commit of Juno? | 01:18 |
| morganfainberg | yep | 01:18 |
| ayoung | 44 is pre-reserved. I'm assuming we will just skip those. | 01:19 |
| morganfainberg | we wont be able to collapse them until L, otherwise we have skips and SQLA-migrate can't handle gaps | 01:19 |
| morganfainberg | when we cut the K release, 45->49 will be rolled up | 01:20 |
| morganfainberg | to whatever the last migration of J will be. | 01:20 |
| morganfainberg | j<release> | 01:21 |
| *** marcoemorais has quit IRC | 01:23 | |
| *** ozialien has quit IRC | 01:26 | |
| ayoung | morganfainberg, ok, here is the logic for db_sync | 01:26 |
| ayoung | if an extension is specified, only that extension is migrated, up or down | 01:26 |
| ayoung | if no extension and no version is specified, sync common and all default_extensions to max version | 01:27 |
| ayoung | if no extension and an explicit version are specified, it is for the common repo | 01:27 |
| ayoung | if no extension and an explicit version == 0 are specified downgrade all extensions | 01:27 |
| ayoung | er, hmm | 01:27 |
| ayoung | make that last rule | 01:27 |
| ayoung | if no extension and an explicit version == 0 are specified downgrade common and all default extensions | 01:28 |
| ayoung | this is why I don't want common treated specially... | 01:28 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Migrate default extensions https://review.openstack.org/96326 | 01:30 |
| ayoung | morganfainberg, ok, is it possible to mark WIP with the new view? | 01:31 |
| morganfainberg | ayoung, Workflow -1 is WIP | 01:31 |
| ayoung | then no one looks at it | 01:32 |
| morganfainberg | ayoung, no one looked at WIP before :P | 01:33 |
| ayoung | they might. | 01:33 |
| morganfainberg | ayoung, eh not really. | 01:33 |
| ayoung | morganfainberg, the -1 workflow means that it shows up with a red X on the main page. You don't see WIP until you clic through | 01:33 |
| morganfainberg | red X for wip is in the Workflow column not the code review | 01:34 |
| morganfainberg | it's about socializing that change (yeah i brought up that bit w/ infra folks, and they agree the scary red x sucks) | 01:34 |
| ayoung | morganfainberg, anyway, there it is. Maybe we need an explicit command line switch for working with the common repo, but I'd rather treat common just as another default extension. | 01:35 |
| morganfainberg | ayoung, whats your opinion on msata drives used in conjunction with standard drives in laptops? | 01:35 |
| morganfainberg | i'm kindof torn on it. | 01:35 |
| *** BAKfr has quit IRC | 01:36 | |
| ayoung | None. THat is the one topic in the whole universe in which I have no opinion....yet | 01:36 |
| ayoung | should I? | 01:36 |
| ayoung | what is msata? | 01:36 |
| morganfainberg | it feels wonky to have both... esp. since most of the time msata is so much less storage | 01:36 |
| ayoung | I haven't been paying attention to hardware | 01:36 |
| morganfainberg | mobile sata interface, the drives are smaller than most trackpads | 01:36 |
| *** sbfox has joined #openstack-keystone | 01:36 | |
| morganfainberg | example http://www.notebookreview.com/assets/65758.jpg | 01:36 |
| morganfainberg | compared to most laptop drives | 01:37 |
| morganfainberg | i just don't know how to carve up 32GB msata SSD and 500GB rotational drive. | 01:37 |
| morganfainberg | :P | 01:37 |
| * morganfainberg likes simple 1 bigger SSD (e.g. how apple is doing it) | 01:38 | |
| morganfainberg | i know... totally unrelated. | 01:40 |
| morganfainberg | ayoung, downgrade to 0 with the collapse on the common repo will fail | 01:41 |
| morganfainberg | oh | 01:41 |
| morganfainberg | oh | 01:41 |
| *** gyee has quit IRC | 01:41 | |
| morganfainberg | you're only doing extensions | 01:41 |
| morganfainberg | or... | 01:42 |
| morganfainberg | are you? | 01:42 |
| ayoung | no, doing the common first | 01:42 |
| morganfainberg | that will fail in juno | 01:42 |
| morganfainberg | can't downgrade below 036. explicitly not supported. | 01:42 |
| ayoung | morganfainberg, should be min version... | 01:43 |
| morganfainberg | *nod* that works. | 01:43 |
| ayoung | but you should be able to downgrade to 0. That is how we nuke the database | 01:43 |
| ayoung | anyway, that portion of the code is not changed | 01:43 |
| ayoung | but for more important issues: | 01:43 |
| ayoung | why use msata? What is the usage for it? | 01:43 |
| morganfainberg | in what case would you want to actually nuke the db outside of tests? | 01:43 |
| ayoung | morganfainberg, I. Don't. Know. | 01:44 |
| ayoung | (said like Shatner) | 01:44 |
| morganfainberg | ayoung, i don't have an answer for why msata besides size. but the laptop i just was issued has one | 01:44 |
| ayoung | should have been. | 01:44 |
| ayoung | I...Don't know. | 01:44 |
| morganfainberg | I ................. Dont'Know | 01:45 |
| ayoung | morganfainberg, so either msata is faster or slower | 01:45 |
| morganfainberg | or it's just about (legitimately) size. | 01:45 |
| morganfainberg | but eh. | 01:46 |
| morganfainberg | just curious if you had run into it yet or not | 01:46 |
| ayoung | Nope, haven't run into yet. My vote would be to avoid anything unnecessary. Unlesss the drive had some profile that made it more reliable, or perhaps more easily removable, I'd probably leave it off. But 32GB would make a nice /boot | 01:49 |
| morganfainberg | yeah debating on doing it that way or just doing / as that and converting over the rotational media to mount points (+sync) for the other things | 01:50 |
| * morganfainberg shrugs | 01:50 | |
| *** gokrokve has joined #openstack-keystone | 01:51 | |
| *** gyee has joined #openstack-keystone | 01:54 | |
| ayoung | So / and /boot off that, and everything else on explicit partitions? I tend to go with one mega for the laptop | 01:55 |
| morganfainberg | ayoung, i need to do whole drive encryption anyway so... meh will need to do post 1st boot work in either case | 01:56 |
| ayoung | Put windows on the mini, and linux on the rest | 01:56 |
| morganfainberg | lol nah, i'd run windows in a VM if i _really_ need it | 01:56 |
| morganfainberg | don't have to reboot that way | 01:57 |
| ayoung | true | 01:57 |
| *** morganfainberg changes topic to "J1 Milestone June 12th! J2 and beyond blueprints require a formalized spec doc: https://git.openstack.org/cgit/openstack/keystone-specs | Please review the proposed specs." | 02:02 | |
| *** sbfox has quit IRC | 02:12 | |
| *** sbfox has joined #openstack-keystone | 02:13 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Sync with oslo-incubator caed79d https://review.openstack.org/95845 | 02:13 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Migrate default extensions https://review.openstack.org/96326 | 02:21 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Migrate default extensions https://review.openstack.org/96326 | 02:23 |
| *** xianghui has joined #openstack-keystone | 02:24 | |
| ayoung | morganfainberg, this one has malingered, and is the precursor to all the example scripts https://review.openstack.org/#/c/82687/ you ok with it? | 02:27 |
| *** dims has quit IRC | 02:29 | |
| *** zhiyan_ is now known as zhiyan | 02:34 | |
| *** rodrigods_ has quit IRC | 02:38 | |
| *** gokrokve_ has joined #openstack-keystone | 02:42 | |
| lbragstad | morganfainberg: yes it can.. most time I've spent on a blueprint | 02:45 |
| *** gokrokve has quit IRC | 02:45 | |
| stevemar | dstanek, aren't you supposed to be off this week? | 02:49 |
| *** marcoemorais has joined #openstack-keystone | 02:57 | |
| *** mberlin1 has joined #openstack-keystone | 02:59 | |
| *** mberlin has quit IRC | 03:02 | |
| *** ukalifon1 has joined #openstack-keystone | 03:23 | |
| *** gokrokve_ has quit IRC | 03:25 | |
| *** jimbaker has quit IRC | 03:26 | |
| *** daneyon has joined #openstack-keystone | 03:36 | |
| *** wpf has joined #openstack-keystone | 03:38 | |
| *** daneyon has quit IRC | 03:41 | |
| *** sbfox has quit IRC | 03:45 | |
| *** zhiyan is now known as zhiyan_ | 03:47 | |
| * mfisch wonders if anyone is awake | 03:48 | |
| *** ncoghlan is now known as ncoghlan_afk | 03:48 | |
| *** shakamunyi has joined #openstack-keystone | 03:49 | |
| *** marcoemorais has quit IRC | 03:50 | |
| *** topol has joined #openstack-keystone | 03:54 | |
| *** daneyon has joined #openstack-keystone | 03:56 | |
| *** xianghui has quit IRC | 03:57 | |
| *** daneyon has quit IRC | 04:02 | |
| *** shakamunyi has quit IRC | 04:05 | |
| morganfainberg | mfisch, maybe | 04:09 |
| *** xianghui has joined #openstack-keystone | 04:09 | |
| morganfainberg | topol, shouldn't you be... you know... asleep ?:P | 04:10 |
| *** zhiyan_ is now known as zhiyan | 04:10 | |
| morganfainberg | ayoung, oh right we need to clear that one and get some testing in place to exercise those scripts (somehow) | 04:10 |
| topol | Hi morganfainberg, how are you | 04:10 |
| morganfainberg | topol, doing well man, how was vacation? you sufficiently unwound? | 04:10 |
| topol | I am up. Was about to stress over getting a presentation ready for a few VPs on Friday and just saw a request that the VP is traveling and I dont have to worry about it until June 16th or so. | 04:11 |
| topol | morganfainberg, I am absolutely giddy right now | 04:12 |
| morganfainberg | topol, hehe | 04:12 |
| topol | morganfainberg, you at HP yet | 04:12 |
| morganfainberg | topol, https://twitter.com/MdrnStm/status/471321879433588737 | 04:12 |
| topol | morganfainberg, yes I saw that. Get that travel approved for the hackathon | 04:13 |
| morganfainberg | topol, already working on it | 04:13 |
| topol | morganfainberg, so vacation was great. Hit Nags Head beach and Myrtle Beach | 04:14 |
| morganfainberg | topol, still working out the kinks of you know... new job stuff (you know typical shenanigans) | 04:14 |
| morganfainberg | nice. | 04:14 |
| morganfainberg | sounds relaxing | 04:14 |
| *** xianghui has quit IRC | 04:14 | |
| morganfainberg | i'll take a vacation some day :P | 04:14 |
| topol | morganfainberg, mostly. although my two kids do there best to make it not relaxing :-) | 04:15 |
| morganfainberg | hehe | 04:15 |
| morganfainberg | now that you're back... REVIEW !!! https://review.openstack.org/#/q/status:open+project:openstack/keystone-specs,n,z :P | 04:15 |
| * morganfainberg snickers. | 04:15 | |
| topol | morganfainberg, thanks to the VP I now have time to review!!! | 04:16 |
| morganfainberg | topol, good thing too! :) need more smart people looking over these things. | 04:16 |
| *** ncoghlan_afk is now known as ncoghlan | 04:16 | |
| topol | morganfainberg, so this is the offical spec repo. its up and running | 04:16 |
| morganfainberg | topol, yep | 04:16 |
| topol | morganfainberg, thats great. | 04:16 |
| morganfainberg | and prety much everything except token compression (j1 target) needs a spec | 04:16 |
| morganfainberg | since i doubt any other BPs will finish before j1 | 04:17 |
| *** xianghui has joined #openstack-keystone | 04:26 | |
| openstackgerrit | Matt Fischer proposed a change to openstack/python-keystoneclient: Fix a misspelling in a comment https://review.openstack.org/96346 | 04:35 |
| *** harlowja_ is now known as harlowja_away | 04:38 | |
| *** zhiyan is now known as zhiyan_ | 04:52 | |
| *** shakamunyi has joined #openstack-keystone | 05:03 | |
| *** shakamunyi has quit IRC | 05:14 | |
| *** ajayaa has joined #openstack-keystone | 05:18 | |
| *** xianghui has quit IRC | 05:23 | |
| *** zhiyan_ is now known as zhiyan | 05:29 | |
| ajayaa | Hi. I want to have a concept of tenant admin other than cloud admin. What is the best way to go about it? | 05:37 |
| *** marcoemorais has joined #openstack-keystone | 05:37 | |
| *** marcoemorais1 has joined #openstack-keystone | 05:39 | |
| *** shakamunyi has joined #openstack-keystone | 05:40 | |
| *** xianghui has joined #openstack-keystone | 05:41 | |
| *** marcoemorais has quit IRC | 05:41 | |
| *** ajayaa has quit IRC | 05:47 | |
| stevemar | bump | 05:47 |
| stevemar | morganfainberg -> can i get quick review of https://review.openstack.org/96346 | 05:47 |
| morganfainberg | gee i dunno | 05:47 |
| morganfainberg | whats in it for me? | 05:48 |
| *** wpf has quit IRC | 05:48 | |
| morganfainberg | is topol buying more beer at the hackathon? :P | 05:48 |
| stevemar | morganfainberg, he may as well | 05:48 |
| *** wpf has joined #openstack-keystone | 05:49 | |
| topol | yes, Im sure I will | 05:50 |
| topol | beer/good bourbon | 05:50 |
| *** shakamunyi has quit IRC | 05:50 | |
| topol | smaller corwd | 05:50 |
| topol | crowd | 05:50 |
| morganfainberg | :) | 05:50 |
| morganfainberg | omg. | 05:50 |
| morganfainberg | *sigh* | 05:50 |
| topol | ? | 05:50 |
| morganfainberg | linux for the desktop and me don't seem to want to play nice. | 05:51 |
| *** sbfox has joined #openstack-keystone | 05:55 | |
| stevemar | topol, still catching up on emails? | 05:55 |
| *** dstanek is now known as dstanek_zzz | 05:58 | |
| topol | pretty much done and enjoying life since two VP meetings and a phoenix trip got rescheduled. | 05:59 |
| stevemar | life is good for topol then | 06:03 |
| *** ajayaa has joined #openstack-keystone | 06:05 | |
| stevemar | morganfainberg, if i'm cleaning up code from a review, is that bug worthy ? | 06:06 |
| morganfainberg | uhm | 06:07 |
| morganfainberg | how much cleany-up-y-code? | 06:07 |
| stevemar | a few lines here and there, actually just deletes | 06:07 |
| stevemar | left an unnecessary setup and init | 06:07 |
| morganfainberg | it doesn't hurt to have a bug to track it. | 06:08 |
| morganfainberg | but at some point it's just red-tape | 06:08 |
| stevemar | cool | 06:08 |
| stevemar | yeah | 06:08 |
| stevemar | meh | 06:08 |
| morganfainberg | judgement call, make one | 06:08 |
| morganfainberg | you're a core ;) | 06:08 |
| stevemar | says who! | 06:08 |
| stevemar | don't put labels or expectations on me | 06:08 |
| morganfainberg | would you want a bug attached to it if someone else was doing it? | 06:08 |
| morganfainberg | stevemar, oh right it was that stevemar2 guy | 06:09 |
| stevemar | yeah, i would be picky about it | 06:09 |
| morganfainberg | we made him core :P | 06:09 |
| topol | comeon stevemar, your a core. make the call dude | 06:09 |
| *** morganfainberg is now known as stevemar2 | 06:09 | |
| stevemar2 | >.> | 06:09 |
| stevemar | hate that stevemar2 guy | 06:09 |
| topol | get engaged maverick :-) | 06:09 |
| * stevemar2 laughs maniacally | 06:10 | |
| *** stevemar2 is now known as morganfainberg | 06:10 | |
| morganfainberg | ok anyway.... | 06:10 |
| stevemar | morganfainberg, hehe, like what topes sent ya? | 06:15 |
| morganfainberg | ouch | 06:15 |
| stevemar | i was so pissed | 06:15 |
| morganfainberg | i'll stick with my normal run-of-the-mill-and-probably-less-painful stuff :P | 06:16 |
| morganfainberg | seriously sucks dude, take care of that. | 06:16 |
| stevemar | morganfainberg, i'm trying, quite gimpy atm | 06:17 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Clean up oauth auth plugin code https://review.openstack.org/96366 | 06:18 |
| *** tomoiaga has joined #openstack-keystone | 06:21 | |
| *** praneshp has joined #openstack-keystone | 06:21 | |
| *** afazekas has quit IRC | 06:22 | |
| *** afazekas has joined #openstack-keystone | 06:22 | |
| stevemar | morganfainberg, i'm out | 06:22 |
| stevemar | see ya | 06:22 |
| morganfainberg | cheers | 06:22 |
| *** ncoghlan is now known as ncoghlan_afk | 06:23 | |
| *** topol has quit IRC | 06:27 | |
| *** praneshp_ has joined #openstack-keystone | 06:29 | |
| *** stevemar has quit IRC | 06:31 | |
| *** praneshp has quit IRC | 06:32 | |
| *** praneshp_ is now known as praneshp | 06:32 | |
| *** sbfox has quit IRC | 06:35 | |
| *** sbfox has joined #openstack-keystone | 06:37 | |
| ajayaa | dolphm, morganfainberg, ayoung: Hi. Would it be a problem if I use keystone v3 for authentication and for taking advantage of RBAC policies and point other components to use v2 with the v3 tokens? | 06:42 |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Fixed wrong behavior when updating tenant or user with LDAP backends https://review.openstack.org/93386 | 06:43 |
| *** shakamunyi has joined #openstack-keystone | 06:47 | |
| *** wpf has quit IRC | 06:52 | |
| *** shakamunyi has quit IRC | 06:59 | |
| *** dstanek_zzz is now known as dstanek | 07:00 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Fixed wrong behavior when updating tenant or user with LDAP backends https://review.openstack.org/93386 | 07:07 |
| *** dstanek is now known as dstanek_zzz | 07:09 | |
| *** gyee has quit IRC | 07:10 | |
| *** roby_ has joined #openstack-keystone | 07:12 | |
| *** sbfox has quit IRC | 07:17 | |
| *** ncoghlan_afk is now known as ncoghlan | 07:18 | |
| *** xianghui has quit IRC | 07:24 | |
| *** shakamunyi has joined #openstack-keystone | 07:25 | |
| openstackgerrit | Andre Naehring proposed a change to openstack/keystone: Add information regarding HTTPS for SSL enabled endpoints https://review.openstack.org/95545 | 07:34 |
| *** shakamunyi has quit IRC | 07:36 | |
| *** ncoghlan has quit IRC | 07:37 | |
| *** xianghui has joined #openstack-keystone | 07:42 | |
| *** nkinder has quit IRC | 07:49 | |
| *** nkinder has joined #openstack-keystone | 07:49 | |
| *** xianghui has quit IRC | 07:50 | |
| *** morganfainberg is now known as morganfainberg_Z | 07:54 | |
| *** marcoemorais1 has quit IRC | 08:00 | |
| *** xianghui has joined #openstack-keystone | 08:02 | |
| *** shakamunyi has joined #openstack-keystone | 08:03 | |
| *** morganfainberg_Z is now known as morganfainberg | 08:12 | |
| *** shakamunyi has quit IRC | 08:14 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Fix a misspelling in a comment https://review.openstack.org/96346 | 08:31 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Remove left over vim headers https://review.openstack.org/95896 | 08:31 |
| *** xianghui has quit IRC | 08:32 | |
| *** shakamunyi has joined #openstack-keystone | 08:40 | |
| *** xianghui has joined #openstack-keystone | 08:44 | |
| *** shakamunyi has quit IRC | 08:52 | |
| *** shakamunyi has joined #openstack-keystone | 09:19 | |
| *** leseb has joined #openstack-keystone | 09:29 | |
| *** zhiyan is now known as zhiyan_ | 09:30 | |
| *** shakamunyi has quit IRC | 09:31 | |
| *** leseb has quit IRC | 09:37 | |
| *** praneshp has quit IRC | 09:42 | |
| *** BAKfr has joined #openstack-keystone | 09:49 | |
| *** shakamunyi has joined #openstack-keystone | 09:58 | |
| *** shakamunyi has quit IRC | 10:05 | |
| openstackgerrit | liusheng proposed a change to openstack/python-keystoneclient: Set the iso8601 log level to WARN https://review.openstack.org/96413 | 10:05 |
| *** xianghui has quit IRC | 10:25 | |
| *** afazekas is now known as afazekas_sick_do | 10:43 | |
| *** afazekas_sick_do has quit IRC | 10:53 | |
| *** ajayaa has quit IRC | 11:05 | |
| *** dims has joined #openstack-keystone | 11:16 | |
| *** ajayaa has joined #openstack-keystone | 11:19 | |
| *** leseb has joined #openstack-keystone | 11:26 | |
| *** leseb has quit IRC | 11:36 | |
| *** roby_ has quit IRC | 11:48 | |
| *** lbragstad has quit IRC | 11:52 | |
| *** dims has quit IRC | 12:00 | |
| *** ajayaa has quit IRC | 12:04 | |
| *** leseb has joined #openstack-keystone | 12:17 | |
| *** ajayaa has joined #openstack-keystone | 12:24 | |
| *** dstanek_zzz is now known as dstanek | 12:41 | |
| *** ajayaa has quit IRC | 12:42 | |
| *** gordc has joined #openstack-keystone | 12:46 | |
| *** ajayaa has joined #openstack-keystone | 12:56 | |
| *** dstanek is now known as dstanek_zzz | 12:56 | |
| *** hrybacki has joined #openstack-keystone | 12:57 | |
| *** lbragstad has joined #openstack-keystone | 13:02 | |
| *** dstanek_zzz is now known as dstanek | 13:08 | |
| *** rodrigods_ has joined #openstack-keystone | 13:09 | |
| *** dims has joined #openstack-keystone | 13:10 | |
| *** zhiyan_ is now known as zhiyan | 13:11 | |
| *** shakamunyi has joined #openstack-keystone | 13:16 | |
| *** shakayumi has joined #openstack-keystone | 13:19 | |
| *** shakamunyi has quit IRC | 13:21 | |
| *** leseb has quit IRC | 13:27 | |
| *** bknudson has joined #openstack-keystone | 13:30 | |
| *** shakayumi has quit IRC | 13:34 | |
| *** nkinder has quit IRC | 13:41 | |
| *** gokrokve has joined #openstack-keystone | 13:46 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/96265 | 13:47 |
| *** shakayumi has joined #openstack-keystone | 13:48 | |
| *** stevemar has joined #openstack-keystone | 13:49 | |
| dstanek | dolphm: Can this be closed as WONTFIX? https://bugs.launchpad.net/keystone/+bug/1294437 | 13:50 |
| uvirtbot | Launchpad bug 1294437 in keystone "GET role by name OS-KSADM call not functional" [Undecided,New] | 13:51 |
| stevemar | dstanek, bad wording in the docs =\ | 13:59 |
| dstanek | stevemar: it looks like the spec really wanted to filter by name, but they didn't finish the example | 14:02 |
| *** tomoiaga has quit IRC | 14:10 | |
| *** gabriel-bezerra has quit IRC | 14:11 | |
| *** topol has joined #openstack-keystone | 14:11 | |
| *** gokrokve has quit IRC | 14:14 | |
| *** ajayaa has quit IRC | 14:15 | |
| *** yfujioka has joined #openstack-keystone | 14:19 | |
| dolphm | dstanek: yeah, go for it | 14:21 |
| *** diegows has joined #openstack-keystone | 14:22 | |
| dstanek | dolphm: done | 14:27 |
| dolphm | dstanek: thanks! | 14:28 |
| *** david-lyle has joined #openstack-keystone | 14:28 | |
| *** rodrigods_ has quit IRC | 14:29 | |
| *** tomoiaga has joined #openstack-keystone | 14:29 | |
| *** dims has quit IRC | 14:33 | |
| *** nkinder has joined #openstack-keystone | 14:34 | |
| *** rodrigods_ has joined #openstack-keystone | 14:37 | |
| *** topol has quit IRC | 14:37 | |
| *** yfujioka has quit IRC | 14:39 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: remove default=None for config options https://review.openstack.org/96480 | 14:44 |
| *** rodrigods_ has quit IRC | 14:47 | |
| *** gokrokve has joined #openstack-keystone | 14:48 | |
| *** thedodd has joined #openstack-keystone | 14:51 | |
| *** zhiyan is now known as zhiyan_ | 14:52 | |
| *** praneshp has joined #openstack-keystone | 14:53 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Add v2 & v3 API documentation https://review.openstack.org/96242 | 14:53 |
| *** gokrokve has quit IRC | 14:57 | |
| *** gokrokve has joined #openstack-keystone | 14:58 | |
| *** praneshp_ has joined #openstack-keystone | 15:00 | |
| *** gokrokve has quit IRC | 15:02 | |
| *** praneshp has quit IRC | 15:03 | |
| *** praneshp_ is now known as praneshp | 15:03 | |
| *** nkinder has quit IRC | 15:04 | |
| *** samuelmz has joined #openstack-keystone | 15:06 | |
| *** topol has joined #openstack-keystone | 15:11 | |
| *** samuelmz is now known as samuelmz-hungry | 15:14 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: document pki_setup and ssl_setup in keystone.conf.sample https://review.openstack.org/71674 | 15:16 |
| *** nkinder has joined #openstack-keystone | 15:17 | |
| *** gokrokve has joined #openstack-keystone | 15:19 | |
| kieren | if i'm using the ldap backend for identity (sql for assignment), and assigning roles to groups (rather than users), is it possible to have it recurse through nested ldap groups? | 15:27 |
| dolphm | bknudson: ayoung: ^ | 15:32 |
| ayoung | kieren, I think it depends on the LDAP server | 15:33 |
| bknudson | kieren: is there an attribute for nested group members? | 15:33 |
| ayoung | kieren, I've been told that it can, at least with 389 | 15:33 |
| kieren | ayoung: using freeipa - would the memberOf plugin be useful? | 15:33 |
| ayoung | kieren, yeah, althjough with FreeIPA you get that by default | 15:34 |
| kieren | bknudson: i don't think it shows nested group members | 15:36 |
| kieren | adding the ldap group to a role works ok, but only for the users in that group, not in subgroups | 15:37 |
| kieren | i wondered if that was just my config | 15:37 |
| morganfainberg | mornin | 15:45 |
| *** zhiyan_ is now known as zhiyan | 15:47 | |
| *** nkinder has quit IRC | 15:51 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: document pki_setup and ssl_setup in keystone.conf.sample https://review.openstack.org/71674 | 15:53 |
| *** gokrokve has quit IRC | 15:54 | |
| *** gokrokve has joined #openstack-keystone | 15:54 | |
| *** gokrokve has quit IRC | 15:55 | |
| stevemar | dolphm, TIL that you can number things as just 1 all the time | 15:55 |
| dolphm | dstanek: took me awhile to regenerate sample conf because tools/config/generate_sample.sh doesn't work on OS X and i have no idea why :( https://review.openstack.org/#/c/71674/ | 15:55 |
| dolphm | stevemar: ++ works in markdown too | 15:55 |
| dolphm | stevemar: the secret is that when it renders HTML, the numbers are discarded in favor of <ol><li>foo</li><li>bar</li></ol> anyway | 15:56 |
| stevemar | dolphm, neato! | 15:56 |
| dolphm | morganfainberg: haghlo | 15:57 |
| *** zhiyan is now known as zhiyan_ | 15:57 | |
| morganfainberg | dolphm, ooooh yeah i meant to solve that, but i generated the samples always under linux | 15:58 |
| *** shakayumi is now known as shakamunyi | 15:59 | |
| morganfainberg | stevemar, i'm torn here https://review.openstack.org/#/c/94251/ the .assert_domain_enabled shuold probably occur in the else block, since _lookup_domain already does the assert -- alternatively, we could use _lookup_domain to do the assert | 16:00 |
| morganfainberg | stevemar, or ... am I being too picky here? | 16:00 |
| stevemar | morganfainberg, i dunno, it works imo cause domain_ref is created in the if and else blocks, handled the same way as project_ref | 16:01 |
| morganfainberg | stevemar, except that if you lookup the domain for project_name based lookup you run the assert_domain code twice | 16:02 |
| morganfainberg | once in _lookup_domain and once at the end of _assert_project_enabled | 16:02 |
| dstanek | dolphm, morganfainberg: i think i just fixed it | 16:02 |
| morganfainberg | _lookup_domain already calls _assert_domain_enabled | 16:02 |
| morganfainberg | dstanek, awesome! (having pypi errors here atm) | 16:03 |
| stevemar | morganfainberg, oh i didn't see that lookup_domain already calls assert | 16:03 |
| morganfainberg | stevemar, yeah | 16:03 |
| stevemar | thats silly | 16:03 |
| stevemar | not that it does that, but adding it in again | 16:04 |
| morganfainberg | stevemar, we need to do an assert if you aren't looking up by project name | 16:04 |
| morganfainberg | but... | 16:04 |
| dolphm | dstanek: how? should i file a bug? | 16:04 |
| morganfainberg | dolphm, ... hate to say it, but it "just worked" for me | 16:04 |
| dstanek | morganfainberg: once i'm done testing i'll submit a bug and patch against oslo | 16:04 |
| morganfainberg | no changes. | 16:04 |
| dolphm | morganfainberg: on OS X? | 16:05 |
| *** sbfox has joined #openstack-keystone | 16:05 | |
| morganfainberg | dolphm, yep | 16:05 |
| *** rodrigods_ has joined #openstack-keystone | 16:05 | |
| dstanek | morganfainberg: there is some syntax issues based on bash version | 16:05 |
| dstanek | dolphm: i'll go ahead and read the bug | 16:05 |
| dolphm | i'm on GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13) | 16:05 |
| dolphm | dstanek: read or file? | 16:06 |
| morganfainberg | dolphm, GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13) | 16:06 |
| stevemar | morganfainberg, move assert to the else, and add a comment/todo explaining why it's only needed there | 16:06 |
| dstanek | hmmm...that's odd that you have the same version, but different behavior | 16:07 |
| morganfainberg | dolphm, http://pasteraw.com/9m6aboj3lrefkrnyf3wb2if3m5a4rp7 | 16:07 |
| morganfainberg | dolphm, current master | 16:07 |
| *** nkinder has joined #openstack-keystone | 16:07 | |
| morganfainberg | dolphm, maybe i did something wonky w/ brew though | 16:07 |
| morganfainberg | stevemar, i'll take a crack at this. will take just a moment | 16:08 |
| stevemar | morganfainberg, cool | 16:08 |
| stevemar | morganfainberg, i'll comment anyway | 16:08 |
| morganfainberg | stevemar, ++ just making sure i wasn't being too picky here | 16:09 |
| stevemar | morganfainberg, you got a point | 16:09 |
| stevemar | to play devils advocate... domain lookup is probably the fastest keystone operation | 16:09 |
| morganfainberg | it's not the domain lookup... it's the assert | 16:09 |
| dolphm | morganfainberg: whats your brew list? http://pasteraw.com/nylrj2pr7bo2jkv9wv5l0n1amdg0u0v | 16:10 |
| morganfainberg | and that isn't exactly heavy code | 16:10 |
| morganfainberg | dolphm, nmapopensslprotobufpypy | 16:10 |
| morganfainberg | dolphm, guess it wasn't brew then :P | 16:10 |
| *** zhiyan_ is now known as zhiyan | 16:12 | |
| *** marcoemorais has joined #openstack-keystone | 16:14 | |
| morganfainberg | stevemar, http://paste.openstack.org/show/82058/ diff from gyee's patch | 16:15 |
| morganfainberg | stevemar, thoughts? | 16:15 |
| morganfainberg | oops | 16:15 |
| morganfainberg | saiw | 16:15 |
| morganfainberg | wait* | 16:15 |
| morganfainberg | stevemar, nvm that is right | 16:16 |
| stevemar | morganfainberg, i was thinking of that too, just crafting a domain_info | 16:18 |
| morganfainberg | stevemar, simplest solution, use code we have | 16:18 |
| *** marcoemorais has quit IRC | 16:18 | |
| morganfainberg | ok i'll submit this post testrun | 16:18 |
| stevemar | morganfainberg, you need name and id for domain though | 16:19 |
| morganfainberg | stevemar, name _or_ id | 16:19 |
| stevemar | doh | 16:19 |
| morganfainberg | domain_name = domain_info.get('name') | 16:19 |
| morganfainberg | .get will return None by default | 16:19 |
| dstanek | morganfainberg: dolphm: i tried again on my Mac without my fixes and now it works | 16:21 |
| *** afaranha has left #openstack-keystone | 16:21 | |
| dolphm | le sigh | 16:21 |
| *** zhiyan is now known as zhiyan_ | 16:21 | |
| morganfainberg | oh. it's super picky about package naming | 16:21 |
| stevemar | dolphm, i don't like the title "HTTP API" i feel it's too generic :\ | 16:22 |
| morganfainberg | dolphm, was your clone called "keystone" ? | 16:22 |
| morganfainberg | or was it something like keystone_fix_my_docs | 16:22 |
| morganfainberg | the directory name | 16:22 |
| morganfainberg | that is | 16:22 |
| dolphm | morganfainberg: 'keystone' | 16:22 |
| dolphm | stevemar: have an alternative suggestion? | 16:22 |
| morganfainberg | hm. | 16:22 |
| dolphm | morganfainberg: /Users/dolph/Projects/keystone fwiw | 16:23 |
| stevemar | dolphm, "History of Keystone - by dolphm" | 16:23 |
| morganfainberg | dolphm, then no idea | 16:23 |
| morganfainberg | stevemar, History of Keystone Part 1 (a dolphm production) | 16:23 |
| stevemar | ++ | 16:23 |
| dolphm | stevemar: lol i don't know if the history really belongs, but part of the conversation we had for needing this was justification to get people onto v3, so i figured perspective might help | 16:23 |
| stevemar | dolphm, then call it 'moving from V2 to V3' ? | 16:24 |
| dolphm | morganfainberg: just nuked my .tox dir and tried again, no luck http://pasteraw.com/opumzx57h4yu7af1rqcjhujgj27wusl | 16:25 |
| stevemar | dolphm, HTTP API just sounds like an API, but this is clearly not one? | 16:25 |
| *** rodrigods_ has quit IRC | 16:25 | |
| dolphm | stevemar: ? but it's discussing our HTTP APIs | 16:25 |
| *** praneshp has quit IRC | 16:25 | |
| *** marcoemorais has joined #openstack-keystone | 16:26 | |
| morganfainberg | dolphm, perhaps no change in the config.py at the moment? that looks like a successful run to me. | 16:26 |
| dolphm | stevemar: should i wait on https://review.openstack.org/#/c/80193/ to release 0.9.0? | 16:26 |
| * morganfainberg might be misreading. | 16:26 | |
| stevemar | dolphm, no, none of the 'example' scripts are ready | 16:27 |
| dolphm | morganfainberg: then http://pasteraw.com/pcoy72axqafwlupdw68rsjomdc7tw3s | 16:27 |
| stevemar | dolphm, wait on this one? https://review.openstack.org/#/c/96366/ | 16:27 |
| dolphm | stevemar: +2 but i wouldn't block a release for it | 16:27 |
| morganfainberg | dolphm, how odd | 16:28 |
| stevemar | dolphm, yeah, you're right | 16:28 |
| *** tomoiaga has quit IRC | 16:28 | |
| *** leseb has joined #openstack-keystone | 16:28 | |
| dolphm | morganfainberg: i tried debugging this at some point, and IIRC it was producing a sample conf correctly and then something in the last block was causing it to not write the file | 16:29 |
| *** rodrigods_ has joined #openstack-keystone | 16:29 | |
| morganfainberg | dolphm, that is ... bizzare, not sure why it works for me and not you | 16:29 |
| *** rodrigods_ has quit IRC | 16:29 | |
| morganfainberg | this stuff bugs me a lot... i don't like inconsistent behavior | 16:29 |
| * dolphm why is there no https://bugs.launchpad.net/oslo.config/ | 16:30 | |
| morganfainberg | dolphm, i think it falls under oslo proper still | 16:30 |
| amerine | Can anyone explain to me how the policy endpoint has the same docs as the credentials endpoint? http://developer.openstack.org/api-ref-identity-v3.html#policies-v3 | 16:30 |
| dolphm | amerine: bad copy paste? refer to the source of truth instead https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md | 16:32 |
| *** marcoemorais has quit IRC | 16:32 | |
| *** marcoemorais has joined #openstack-keystone | 16:32 | |
| amerine | dolphm: I'm asking because it wasn't this way the other day :-(. I'll pass along the identity-api repo so they use that instead. Thanks. | 16:33 |
| dolphm | amerine: can you file a bug against openstack-manuals? https://bugs.launchpad.net/openstack-manuals/ | 16:34 |
| amerine | dolphm: Will do. | 16:34 |
| dolphm | amerine: thanks! | 16:34 |
| *** leseb has quit IRC | 16:35 | |
| *** rodrigods_ has joined #openstack-keystone | 16:35 | |
| *** devlaps has joined #openstack-keystone | 16:37 | |
| * dolphm apparently when you i write my title as OpenStack Cat Herder but turn it into one word, it looks a lot like catheter instead | 16:39 | |
| *** samuelmz-hungry is now known as samuelmz | 16:39 | |
| amerine | dolphm: catheter sounds like a terrible job. | 16:40 |
| dolphm | amerine: so is catherder | 16:40 |
| amerine | dolphm: I'm not a cat fan, so spending my BTUs on them offends my sensibilities. | 16:40 |
| dolphm | amerine: but i agree, catheter is probably worse | 16:40 |
| dolphm | amerine: rofl | 16:40 |
| *** nkinder has quit IRC | 16:40 | |
| amerine | dolphm: Bug filed. https://bugs.launchpad.net/openstack-manuals/+bug/1324607 | 16:40 |
| uvirtbot | Launchpad bug 1324607 in openstack-manuals "Identity API V3 Policies endpoint docs are a duplicate of the Credentials endpoint docs." [Undecided,New] | 16:41 |
| *** leseb has joined #openstack-keystone | 16:41 | |
| htruta | stevemar: hello! do you know someone else that could review my patch? https://review.openstack.org/#/c/91634/2 | 16:42 |
| *** gokrokve has joined #openstack-keystone | 16:42 | |
| stevemar | htruta, dtroyer or thowe (not online) | 16:44 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Make sure scoping to the project of a disabled domain result in 401. https://review.openstack.org/94251 | 16:51 |
| *** browne has joined #openstack-keystone | 16:51 | |
| morganfainberg | stevemar, ^ | 16:52 |
| stevemar | morganfainberg, ty | 16:52 |
| *** gabriel-bezerra has joined #openstack-keystone | 16:53 | |
| *** nkinder has joined #openstack-keystone | 16:53 | |
| * morganfainberg pokes topol. | 16:54 | |
| * morganfainberg makes some bad star trek "worse than that, he's dead jim" reference. | 16:55 | |
| gabriel-bezerra | I've sent a new patch to https://review.openstack.org/95977 , might you review, please? | 16:56 |
| gabriel-bezerra | morganfainberg, ayoung, jamielennox|away ^ | 16:57 |
| dolphm | morganfainberg: jamielennox|away: i'm ready to push the button for https://launchpad.net/python-keystoneclient/+milestone/0.9.0 | 16:57 |
| morganfainberg | dolphm, LGTM | 16:58 |
| morganfainberg | decent amount of fixes in it too! | 16:58 |
| *** rodrigods_ has quit IRC | 16:59 | |
| dolphm | morganfainberg: waiting for jenkins to push to pypi.. | 17:00 |
| stevemar | dolphm, morganfainberg lots of cool stuff going in to 0.9.0 | 17:00 |
| ayoung | gabriel-bezerra, working on something kindof time sensitive | 17:00 |
| * morganfainberg learned the hard way pure uefi laptops need ubuntu mac iso to install correctly. | 17:01 | |
| dolphm | morganfainberg: they make a mac iso now? | 17:01 |
| morganfainberg | dolphm, have for a while | 17:02 |
| dolphm | i guess i gave up on ubuntu desktops before that | 17:02 |
| morganfainberg | http://cdimage.ubuntu.com/releases/14.04/release/ | 17:02 |
| dolphm | weird | 17:02 |
| *** harlowja_away is now known as harlowja_ | 17:02 | |
| stevemar | gabriel-bezerra, that is a cool change | 17:02 |
| dolphm | oh but that's not a special mac build, is it? | 17:02 |
| dolphm | i mean, i'd use the same build on my PC desktop | 17:03 |
| gabriel-bezerra | ayoung: ok, I didn't manage to make it work on CentOS neither before nor after the patch. It could be the instance I got, because it was not a fresh installation of CentOS cloud. | 17:03 |
| *** rodrigods_ has joined #openstack-keystone | 17:03 | |
| morganfainberg | dolphm, yeah.. well slightly different unity default setup i think as well | 17:03 |
| morganfainberg | dolphm, but mostly the same - not anything wildly different | 17:03 |
| dolphm | https://pypi.python.org/pypi/python-keystoneclient/ | 17:03 |
| morganfainberg | woohoo. | 17:04 |
| * morganfainberg goes and proposes making it the minimum for global reqs now. | 17:04 | |
| gabriel-bezerra | I kept the change because httpd was listening for on the 5000 and 35357 ports, so I hope the change worked there. | 17:04 |
| gabriel-bezerra | stevemar: thanks :) | 17:04 |
| gabriel-bezerra | listening on* | 17:04 |
| stevemar | morganfainberg, let us know when the change is up :) | 17:06 |
| morganfainberg | https://review.openstack.org/96520 | 17:07 |
| *** gokrokve_ has joined #openstack-keystone | 17:07 | |
| stevemar | morganfainberg, so will openstack proposal bot bump it for all the projects that use keystoneclient? (like openstack client) ? | 17:08 |
| morganfainberg | yeah once it's committed | 17:09 |
| morganfainberg | /merged | 17:09 |
| *** rodrigods_ has quit IRC | 17:11 | |
| *** gokrokve has quit IRC | 17:12 | |
| htruta | stevemar: so, let's wait for it, I gues | 17:12 |
| htruta | guess* | 17:12 |
| *** zhiyan_ is now known as zhiyan | 17:12 | |
| stevemar | htruta, for bug fixes i don't mind being the only +2 and +A, but for new functions, I like dtroyer 's opinion too | 17:14 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: remove out of date docs for Fedora 15 https://review.openstack.org/96524 | 17:16 |
| *** Dontmind has joined #openstack-keystone | 17:17 | |
| *** rodrigods_ has joined #openstack-keystone | 17:20 | |
| Dontmind | Hello, I have query regarding the keystone with LDAP ? I am trying to setup keystone with openldap, but multiple parameter like desc are not present in the openldap, do we require to add any specific schema into ldap ? What all ldap are supported by keystone ? do it support writting new user, tenant in ldap or ldap is used only in read only mode ? | 17:21 |
| mfisch | stevemar: I think I addressed your concerns on the review | 17:21 |
| mfisch | Dontmind: it supports r/w | 17:22 |
| mfisch | Dontmind: for r/w you will need a specific schema | 17:22 |
| *** zhiyan is now known as zhiyan_ | 17:22 | |
| mfisch | Dontmind: also for desc you can just leave it commented out if it doesn't make sense for your server | 17:22 |
| *** browne has quit IRC | 17:23 | |
| Dontmind | mfisch : what schema do we need, are these standered schema ? | 17:23 |
| stevemar | mfisch, haha \ for life, that kinda talk will get you in trouble here | 17:23 |
| *** rodrigods_ has quit IRC | 17:25 | |
| Dontmind | basic query : what all things are stored in ldap (when keystone is configured with ldap) ? do we still need mysql in this case to store few things like endpoing or catalog ? | 17:26 |
| *** leseb has quit IRC | 17:28 | |
| Dontmind | i want to setup keystone with ldap and use swift with it. Does anybody have the end to end details on how to do it ? | 17:29 |
| mfisch | Dontmind: when I did r/w I followed some blog posts, but I ended up doing split identity and assignment and r/w | 17:30 |
| mfisch | Dontmind: look at my blog, mattfischer.com/blog I have some posts there | 17:30 |
| *** browne has joined #openstack-keystone | 17:30 | |
| mfisch | stevemar: is there a separate channel for the client? I could not find one | 17:30 |
| Dontmind | mfisch : thanks i will have a look into it | 17:34 |
| stevemar | mfisch, not really, there is #openstack-sdks which is as close as you'll get | 17:37 |
| *** gyee has joined #openstack-keystone | 17:37 | |
| *** praneshp has joined #openstack-keystone | 17:44 | |
| *** rodrigods_ has joined #openstack-keystone | 17:49 | |
| *** ozialien has joined #openstack-keystone | 17:51 | |
| *** sbfox has quit IRC | 17:56 | |
| *** openstackgerrit has quit IRC | 17:57 | |
| stevemar | dstanek, any reason you didn't +A https://review.openstack.org/#/c/94251/ | 17:58 |
| dstanek | stevemar: jenkins hasn't +1ed it yet | 17:59 |
| stevemar | dstanek, we can +A now even if jenkins hasn't passed | 17:59 |
| dstanek | stevemar: good to know - did that change after the upgrade of gerrit? | 18:00 |
| *** Dontmind has quit IRC | 18:00 | |
| stevemar | dstanek, it was unofficial before the upgrade, but it's official now | 18:01 |
| stevemar | the infra did something or other | 18:01 |
| *** rodrigods_ has quit IRC | 18:01 | |
| dstanek | stevemar: oh, interesting - i still see review comments about approving after jenkins | 18:02 |
| dstanek | we should spread the word | 18:02 |
| mfisch | stevemar: I just changed the requirement to 0.9.0 myself, should I roll that back? | 18:05 |
| stevemar | mfisch, yep, i think so | 18:06 |
| *** sbfox has joined #openstack-keystone | 18:12 | |
| *** zhiyan_ is now known as zhiyan | 18:13 | |
| *** afazekas has joined #openstack-keystone | 18:14 | |
| *** ozialien has quit IRC | 18:18 | |
| *** zhiyan is now known as zhiyan_ | 18:23 | |
| *** bobt has joined #openstack-keystone | 18:25 | |
| *** radez_g0n3 is now known as radez | 18:32 | |
| *** morganfainberg is now known as morganfainberg_Z | 18:33 | |
| *** morganfainberg_Z is now known as morganfainberg | 18:37 | |
| *** browne has quit IRC | 18:37 | |
| *** comstud has joined #openstack-keystone | 18:49 | |
| comstud | hey all | 18:49 |
| comstud | so, new keystoneclient was just posted to pypi it appears... | 18:49 |
| comstud | and from what I can tell... it's possible certain some API code responses have changed | 18:49 |
| comstud | We're asserting some things in ironic tests that now fail with the new keystone client | 18:49 |
| comstud | like getting a 401 where we got a 403 before | 18:50 |
| comstud | ideas, comments? | 18:50 |
| dolphm | comstud: link? | 18:50 |
| comstud | I don't think I have a review up with the failures | 18:50 |
| comstud | but I can paste the tracebacks | 18:50 |
| comstud | and link to corresponding tests | 18:50 |
| comstud | https://bugs.launchpad.net/ironic/+bug/1324655 | 18:50 |
| uvirtbot | Launchpad bug 1324655 in ironic "tests fail with new keystoneclient" [Undecided,In progress] | 18:51 |
| comstud | and | 18:51 |
| *** praneshp has quit IRC | 18:51 | |
| bknudson | looks like a failure in auth_token | 18:51 |
| dolphm | caching in auth_token, specifically | 18:52 |
| comstud | https://github.com/openstack/ironic/blob/master/ironic/tests/api/test_acl.py#L74 | 18:52 |
| comstud | the 'time' kwarg missing is our stub of set() in our fake memcache | 18:52 |
| comstud | But... the tracebacks I get after fixing that is more what I'm concerned about | 18:52 |
| comstud | Now... it's possible that our stub is just still broken after I add the time kwarg | 18:52 |
| comstud | I've just begun to dig into this... but I thought I'd point this out in case it stirred anything in anyone's minds about the keystone client changes | 18:53 |
| comstud | The link about to test_acl.py is now returning a 401 | 18:54 |
| dolphm | bknudson: comstud: https://review.openstack.org/#/c/81078/ | 18:54 |
| comstud | where it was a 403 before | 18:54 |
| comstud | ah | 18:54 |
| comstud | maybe I need additional logic in our fake memcache | 18:55 |
| *** praneshp has joined #openstack-keystone | 18:55 | |
| bknudson | that change wasn't meant to change so it's not backwards compatible | 18:56 |
| comstud | it's possible our fake memcache is not expiring something when it should | 18:56 |
| comstud | I wonder if that's the issue | 18:56 |
| *** browne has joined #openstack-keystone | 18:57 | |
| dolphm | comstud: how are you initializing keystoneclient with your fake cache instance? | 18:57 |
| comstud | looking | 18:58 |
| comstud | i'm not really familiar with this in our tests | 18:58 |
| dolphm | comstud: i'm sure you're more familiar than i am :) | 18:58 |
| comstud | haha | 18:59 |
| bknudson | http://git.openstack.org/cgit/openstack/ironic/tree/ironic/tests/api/test_acl.py#n35 | 18:59 |
| comstud | just a hair I guess | 18:59 |
| comstud | 35 self.environ = {'fake.cache': utils.FakeMemcache()} | 18:59 |
| bknudson | setting the environ, and then it does cfg.CONF.set_override('cache', 'fake.cache', group=acl.OPT_GROUP_NAME) | 18:59 |
| comstud | right | 18:59 |
| comstud | i suspect me just adding 'time' kwarg to our fake memcache set() is not enough :) | 18:59 |
| comstud | i probably need to do something with 'time' | 19:00 |
| bknudson | so auth_token should use the utils.FakeMemcache | 19:00 |
| comstud | what is that arg meant to be? Is it different than 'timeout'? | 19:00 |
| dolphm | bknudson: what's acl.OPT_GROUP_NAME there? | 19:00 |
| *** ukalifon1 has quit IRC | 19:00 | |
| comstud | https://github.com/openstack/ironic/blob/master/ironic/tests/api/utils.py#L67 | 19:00 |
| bknudson | i have to run to a meeting | 19:00 |
| comstud | do we have 'timeout' misnamed and it should be 'time'? | 19:00 |
| comstud | heh | 19:00 |
| * comstud checks memcache | 19:00 | |
| dolphm | comstud: historically, i think swift cache used one of those, and memcached uses the other? although they were meant to be compatible, i think | 19:01 |
| comstud | def set(self, key, val, time=0, min_compress_len=0): | 19:01 |
| comstud | that's from python-memcached | 19:01 |
| dolphm | comstud: maybe you were mocking swift cache then | 19:01 |
| comstud | no idea | 19:02 |
| comstud | but it appears we have 'timeout' where we should have 'time' | 19:02 |
| comstud | and I should make it expire properly | 19:02 |
| dolphm | comstud: does that fix the issue? | 19:02 |
| comstud | we're not tracking the timeout right now in this fake client | 19:02 |
| comstud | adding it now | 19:03 |
| *** sbfox has quit IRC | 19:03 | |
| comstud | at this point, I suspect this is just an issue with our fake client | 19:03 |
| comstud | wrongly named kwarg... and not actually doing anything with the kwarg (expiring the cache entry) | 19:04 |
| *** rodrigods_ has joined #openstack-keystone | 19:05 | |
| *** openstackgerrit has joined #openstack-keystone | 19:07 | |
| dolphm | comstud: not doing anything with it wouldn't have changed with keystoneclient 0.9.0 though | 19:08 |
| comstud | hm k | 19:08 |
| comstud | so yeah | 19:10 |
| comstud | this review you linked to | 19:10 |
| comstud | used time= before already on set9) | 19:10 |
| comstud | on set() | 19:10 |
| comstud | we must not have been hitting that code path before in keystoneclient, but now we are | 19:12 |
| *** openstackgerrit has quit IRC | 19:13 | |
| *** zhiyan_ is now known as zhiyan | 19:14 | |
| morganfainberg | comstud, interesting | 19:18 |
| dolphm | comstud: i wonder if that review just isn't the culprit then? | 19:18 |
| comstud | it's possible something landed before it, yes | 19:19 |
| comstud | that added this time= usage | 19:19 |
| comstud | to cache.set() | 19:19 |
| *** gokrokve_ has quit IRC | 19:20 | |
| comstud | I don't know at what point in time this broke with keystoneclient commits | 19:20 |
| comstud | it's just obvious now that there's a new release | 19:20 |
| comstud | upstream only pulls in pypi, so | 19:20 |
| comstud | er, gate | 19:20 |
| morganfainberg | comstud, this is unit tests not temptest right? | 19:21 |
| comstud | correct, unit tests in ironic | 19:21 |
| comstud | which stub out a fake memcache client | 19:21 |
| comstud | to pass into keystoneclient | 19:21 |
| *** dims has joined #openstack-keystone | 19:21 | |
| morganfainberg | comstud, hm. ok | 19:21 |
| comstud | a.. somewhat broken fake memcache client, it appears :) | 19:22 |
| comstud | but i dunno if that's the only problem | 19:22 |
| comstud | what's concerning me is our tests showing a switch from a 403 to a 401 | 19:22 |
| comstud | it's possible it's just our bogus fake memcache client... it's possible it's something else in keystoneclient, I dunno yet. | 19:22 |
| *** zhiyan is now known as zhiyan_ | 19:24 | |
| * morganfainberg looks at the tests in question. | 19:24 | |
| *** gokrokve has joined #openstack-keystone | 19:25 | |
| comstud | atm, i'm going back in keystoneclient commits | 19:25 |
| * dolphm is trying to reproduce | 19:25 | |
| comstud | to look before this review dolph posted | 19:26 |
| comstud | yeah, if you check out ironic master and just run 'tox', you'll get the failures | 19:26 |
| morganfainberg | comstud, same, looking at the changes between the releases. | 19:26 |
| dolphm | comstud: auth_token has a bad habit of turning 500's into 401's | 19:26 |
| dolphm | comstud: so anything that should be uncaught ends up as a 401 | 19:26 |
| comstud | so far, all I did was rename 'timeout' to 'time' in ironic/tests/api/utils.py | 19:26 |
| comstud | and then I get the 403 -> 401 | 19:27 |
| comstud | dolphm: aha ok | 19:27 |
| dolphm | i'm pretty sure keystone's contribution to openstack is arbitrarily producing 401's | 19:28 |
| comstud | https://review.openstack.org/#/c/70562/ | 19:29 |
| comstud | i suspect that maybe this review is where things broke for us | 19:29 |
| comstud | but i dunno for sure | 19:29 |
| *** rodrigods_ has quit IRC | 19:29 | |
| comstud | that's the switch from timeout=foo to time=foo | 19:30 |
| dstanek | ouch | 19:30 |
| comstud | however | 19:31 |
| comstud | just switching our kwarg from timeout to time... causes these 401s | 19:31 |
| dstanek | wasn't that change in 0.8.0? | 19:32 |
| morganfainberg | dstanek, 0.8.0 was apr 16 it looks like | 19:32 |
| comstud | if that's the case, then I guess we were never hitting this self._cache.set() before in our tests | 19:33 |
| comstud | and now we are | 19:33 |
| morganfainberg | dstanek, https://pypi.python.org/pypi/python-keystoneclient/0.8.0 | 19:33 |
| comstud | maybe with the pool change | 19:33 |
| morganfainberg | comstud, ok lets set aside the kwarg issue | 19:34 |
| comstud | sure | 19:34 |
| morganfainberg | comstud, the change to 401 from 403 seems more of an issue | 19:34 |
| comstud | right, although it doesn't happen until I fix the kwarg | 19:34 |
| comstud | :) | 19:34 |
| morganfainberg | comstud, *blink* | 19:34 |
| comstud | because that problem covers this up | 19:34 |
| morganfainberg | comstud, what if there was no caching? at all. | 19:34 |
| *** openstackgerrit has joined #openstack-keystone | 19:35 | |
| comstud | shoot, I have to listen to this call I'm on | 19:35 |
| morganfainberg | comstud, let me go look at the cache mock thing | 19:35 |
| morganfainberg | comstud, this might be something odd there. | 19:35 |
| dolphm | even if you change timout to time in ironic.test.utils, i don't see a reason for the subsequent 401 yet | 19:35 |
| morganfainberg | dolphm, unless the mocked cache is munging things up in bad ways | 19:35 |
| comstud | the mocked cache is just hardcoded to return something we expect to query | 19:36 |
| comstud | it's kinda dumb | 19:36 |
| morganfainberg | comstud, right but if it's somehow returning broken data now :P | 19:36 |
| morganfainberg | auth_token might turn that into a 401 | 19:37 |
| morganfainberg | or well.. subtling broken data | 19:37 |
| comstud | well | 19:37 |
| morganfainberg | subtley | 19:37 |
| comstud | this only happens when I fix set() but yeah | 19:37 |
| dolphm | the mocked cache also only holds one key/value | 19:37 |
| comstud | really we just throw away what set() does | 19:37 |
| comstud | apparently | 19:37 |
| comstud | i feel bad having you guys dig into this because it feels like this fake memcache is a bad idea... or poorly implemented. | 19:38 |
| comstud | :) | 19:38 |
| dolphm | oh wow yeah | 19:38 |
| dolphm | mocking always causes strange problems like this, regardless of how well it's done | 19:39 |
| comstud | nod | 19:39 |
| comstud | I thought I'd raise it in here, because I was concerned I started seeing HTTP code changes | 19:39 |
| morganfainberg | dolphm, we've had a number of things touch the caching code lately | 19:40 |
| morganfainberg | dolphm, i wouldn't be surprised if fake memcache was an issue. | 19:40 |
| *** gokrokve has quit IRC | 19:40 | |
| dolphm | morganfainberg: in ironic? or memorycache? | 19:40 |
| *** gokrokve has joined #openstack-keystone | 19:41 | |
| morganfainberg | dolphm, https://github.com/openstack/ironic/blob/master/ironic/tests/api/utils.py | 19:41 |
| morganfainberg | the fake cache they use there | 19:41 |
| morganfainberg | ironic's mock | 19:41 |
| dolphm | what happens if you remove it..? | 19:41 |
| comstud | 1) i really hate we're stubbing something that a 3rd party project is using internally. | 19:41 |
| comstud | that seems.. wrong | 19:41 |
| comstud | 2) what the hell are we testing here anyway? That keystone client is working properly?! | 19:42 |
| comstud | (these questions are more for ironic :) | 19:42 |
| dolphm | comstud: i suppose you're testing that ironic's default configuration includes something for auth_token, but that's about it? | 19:43 |
| bknudson | overriding the cache response seems broken to me. | 19:43 |
| comstud | maybe | 19:43 |
| bknudson | auth_token might decide that we're going to store data differently | 19:43 |
| comstud | yeah, that's why I think this stubbing is.. not the way to go | 19:43 |
| *** gokrokve has quit IRC | 19:45 | |
| dolphm | the only point of the fake cache that i can see is that it's pre-populating the cache with supposedly valid values | 19:45 |
| bknudson | maybe aim at a higher level, mock auth_token rather than auth_token's cache | 19:45 |
| morganfainberg | bknudson, ++ | 19:45 |
| bknudson | we do actually support the auth_token interface (the env vars that it sets) | 19:46 |
| bknudson | comstud: where's your api-paste.ini? | 19:48 |
| comstud | this is just unit tests | 19:50 |
| comstud | so... whatever is in the ironic tree | 19:50 |
| comstud | :) | 19:50 |
| dolphm | bknudson: dependence on auth_token appears to be hardcoded in ironic.api.middleware | 19:50 |
| comstud | i don't see one | 19:50 |
| comstud | dolphm: Yeah, that's what I get from this fake memcache also... is throwing supposedly valid values in there and returning them with get(). And everything is just stubbed and thrown away | 19:51 |
| nkinder | stevemar: what's the story around saml 1.1 and Keystone? | 19:51 |
| nkinder | stevemar: we only support saml2? | 19:52 |
| stevemar | nkinder, saml2 is the only one supported officially | 19:52 |
| dolphm | jamielennox|away: ironic.api.middleware.auth_token solves your public routes issue ;) | 19:52 |
| stevemar | nkinder, you're welcome to try 1.1 | 19:52 |
| *** liranc_ has joined #openstack-keystone | 19:53 | |
| nkinder | stevemar: so you're saying it might just work? | 19:53 |
| liranc_ | Hello | 19:53 |
| dolphm | liranc_: o/ | 19:54 |
| liranc_ | I am using keystone wsgi with apache2 on ubuntu 12.04.4 and it breaks my horizon | 19:54 |
| liranc_ | for glance and for neutron | 19:54 |
| liranc_ | do you have any idea how can i fixed this now i am using the single thread python for keystone but i can't scale | 19:55 |
| dolphm | liranc_: what is breaking exactly, and how? | 19:56 |
| liranc_ | i am using havana so i don't have the workers | 19:56 |
| liranc_ | here is my glance trace Paste #82082 | 19:57 |
| liranc_ | i click the images in the guy and it says Error: Unauthorized: Unable to retrieve image list. | 19:57 |
| liranc_ | sorry *GUI | 19:58 |
| liranc_ | here is the error i am getting from glance api logs Unable to get version info from keystone: 301 | 19:58 |
| liranc_ | the CLI is working as expected | 19:58 |
| dolphm | liranc_: what does your auth_token configuration look like for glance, and what does your virtual host configuration look like for keystone? | 19:59 |
| *** gokrokve has joined #openstack-keystone | 20:00 | |
| *** rodrigods has quit IRC | 20:01 | |
| liranc_ | i have the following in glance | 20:01 |
| liranc_ | all comment out | 20:02 |
| liranc_ | # Send headers containing user and tenant information when making requests to # the v1 glance registry. This allows the registry to function as if a user is # authenticated without the need to authenticate a user itself using the # auth_token middleware. # The default value is false. | 20:02 |
| liranc_ | seems to be the default | 20:02 |
| liranc_ | [keystone_authtoken] auth_host = ctpr-osm01 auth_port = 35357 auth_protocol = https admin_tenant_name = services admin_user = glance | 20:05 |
| liranc_ | auth_uri=https://ctpr-osm01:5000/ signing_dir = /var/cache/glance/api | 20:05 |
| bknudson | comstud: expires = confirm_token_not_expired(data) -- KeyError: ('expires',) | 20:05 |
| bknudson | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/middleware/auth_token.py#n368 | 20:06 |
| morganfainberg | bknudson, beat me to it! | 20:06 |
| comstud | bknudson: aha | 20:06 |
| dolphm | liranc_: https://ctpr-osm01:5000/ and https://ctpr-osm01:35357/ both work with your apache configuration? | 20:06 |
| bknudson | so the tokens in the fake cache need a expires | 20:06 |
| bknudson | 'token': {'id': ADMIN_TOKEN, 'expires': '2100-09-11T00:00:00'}, | 20:06 |
| bknudson | (for example) | 20:06 |
| comstud | ok | 20:06 |
| morganfainberg | comstud, i think https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/fixture/v2.py is what you should use to create the fake token | 20:07 |
| morganfainberg | comstud, rather than hard-coding it (if you're continuing to fake-out the memcache) | 20:07 |
| comstud | cool, I will look at that | 20:07 |
| morganfainberg | comstud, that way you're sure to get something that at least resembles the real thing. (it's why we added it) | 20:07 |
| comstud | perfect | 20:08 |
| bknudson | I still don't think it's safe to override auth_token's cache | 20:08 |
| morganfainberg | bknudson, ++ | 20:08 |
| liranc_ | OK i am lost here | 20:08 |
| dolphm | morganfainberg: oh that's a good idea | 20:08 |
| liranc_ | can you please explain | 20:08 |
| morganfainberg | comstud, i'd mock all of auth_token for these tests if you legitimately need fixed responses | 20:09 |
| liranc_ | yes i use both admin and main in apache | 20:09 |
| dolphm | liranc_: can you paste the responses you get when you curl https://ctpr-osm01:5000/ and https://ctpr-osm01:35357/ ? | 20:09 |
| morganfainberg | dolphm, yeah jamielennox|away did a bunch of work to make soem awesome fixtures for this stuff. | 20:09 |
| morganfainberg | with that ... | 20:10 |
| morganfainberg | food time. | 20:10 |
| comstud | bkudson: Yeah, I think I'm going to come up with short term fix first | 20:10 |
| comstud | And then suggest we... do something completely different | 20:10 |
| comstud | :) | 20:10 |
| bknudson | comstud: the short term fix is add the 'expires' to the tokens... worked for me | 20:11 |
| comstud | ok | 20:11 |
| liranc_ | root@ctpr-stk01:/var/log# curl --insecure https://ctpr-osm01:5000 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="https://ctpr-osm01:5000/horizon/">here</a>.</p> </body></html> | 20:11 |
| bknudson | comstud: and set time=None rather than timeout | 20:11 |
| gabriel-bezerra | Federation people: please have a look at this bug https://bugs.launchpad.net/keystone/+bug/1320140 | 20:11 |
| uvirtbot | Launchpad bug 1320140 in keystone "Federation documentation is not clear about mapping.rules.local.user.name" [Undecided,New] | 20:11 |
| comstud | bknudson: yep, got that one already | 20:12 |
| comstud | cool, thanks... that did work for me :) | 20:12 |
| liranc_ | root@ctpr-stk01:/var/log# curl --insecure https://ctpr-osm01:35357 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="https://ctpr-osm01:35357/horizon/">here</a>.</p> </body></html> | 20:12 |
| comstud | Ran 849 (+776) tests in 2.284s (+1.827s) | 20:12 |
| comstud | PASSED (id=4, skips=24) | 20:12 |
| comstud | woo | 20:12 |
| comstud | thanks a lot!! | 20:12 |
| *** hrybacki has quit IRC | 20:12 | |
| *** sbfox has joined #openstack-keystone | 20:14 | |
| *** sbfox1 has joined #openstack-keystone | 20:14 | |
| *** zhiyan_ is now known as zhiyan | 20:15 | |
| dolphm | yay :) | 20:17 |
| bknudson | auth_token needs better logging | 20:18 |
| morganfainberg | bknudson, ++ | 20:18 |
| morganfainberg | bknudson, auth_token needs a lot of things | 20:18 |
| *** sbfox has quit IRC | 20:19 | |
| -openstackstatus- NOTICE: Gerrit is going offline to correct an issue with a recent project rename. ETA 20:45 UTC. | 20:20 | |
| *** ChanServ changes topic to "Gerrit is going offline to correct an issue with a recent project rename. ETA 20:45 UTC." | 20:20 | |
| *** openstackgerrit has quit IRC | 20:25 | |
| dstanek | gabriel-bezerra: that's interesting. based on what you said, all of the examples should have a username component in the local section | 20:26 |
| *** zhiyan is now known as zhiyan_ | 20:26 | |
| dstanek | liranc_: i'm a little late to the party - did you already post your apache config? | 20:27 |
| dstanek | liranc_: getting a redirect to horizon is troubling | 20:27 |
| liranc_ | will do 1 sec | 20:27 |
| liranc_ | Paste #82101 | 20:29 |
| liranc_ | this is for the main | 20:29 |
| liranc_ | do you need the admin ? | 20:29 |
| liranc_ | the strange thing here is that the CLI is working | 20:30 |
| dstanek | liranc_: http://paste.openstack.org/show/82101/ ? i'm getting a server error | 20:32 |
| liranc_ | working for me can you try again | 20:33 |
| liranc_ | ? | 20:33 |
| liranc_ | here is a new one Paste #82102 | 20:34 |
| liranc_ | looking in horizon log i can see very short token used for auth before it fail | 20:34 |
| dstanek | liranc_: got it - had to clear an old lodgeit lookie | 20:34 |
| liranc_ | OK | 20:34 |
| liranc_ | for example DEBUG glanceclient.common.http curl -i -X GET -H 'X-Auth-Token: f75de54e2a708ae5e786e11b2b388fc6' -H 'Content-Type: application/json' -H 'User-Agent: python-glanceclient' http://192.168.212.105:9292/v1/images/detail?limit=21 | 20:35 |
| liranc_ | when i try this with a new token its working | 20:35 |
| *** gokrokve has quit IRC | 20:35 | |
| dstanek | liranc_: yes, admin too. that's where the redirect is coming from | 20:36 |
| liranc_ | admin Paste #82103 | 20:37 |
| *** ChanServ changes topic to "J1 Milestone June 12th! J2 and beyond blueprints require a formalized spec doc: https://git.openstack.org/cgit/openstack/keystone-specs | Please review the proposed specs." | 20:39 | |
| -openstackstatus- NOTICE: Gerrit is back online | 20:39 | |
| dstanek | liranc_: i don't see the word horizon in there at all | 20:39 |
| dstanek | liranc_: do you have a redirect for horizon in another file? | 20:39 |
| *** radez is now known as radez_g0n3 | 20:39 | |
| liranc_ | i will check | 20:39 |
| liranc_ | wow it was fixed | 20:41 |
| dstanek | ? | 20:42 |
| liranc_ | just remove all of my horizon files conf from apache | 20:42 |
| liranc_ | we use to have the horizon and keystone wsgi on the same instance | 20:42 |
| dstanek | that HTML returned with the 301 looks like the Apache boilerplate so my guess is your Apache config is weird | 20:42 |
| liranc_ | now its working | 20:42 |
| dstanek | liranc_: excellent...do you still need to run them on the same instance? | 20:43 |
| liranc_ | i move the horizon to a new server | 20:43 |
| liranc_ | no i don't have to | 20:43 |
| liranc_ | this is great | 20:43 |
| liranc_ | we have a very big production deployment | 20:43 |
| liranc_ | which we fail to scale after moving to havana | 20:43 |
| liranc_ | in grizzly we put some patch that gave us the option to run workers | 20:44 |
| liranc_ | multi workers | 20:44 |
| liranc_ | but its not working in havana so we had to use wsgi and now its working thanks | 20:44 |
| *** nkinder has quit IRC | 20:45 | |
| dstanek | liranc_: ma pleasure | 20:46 |
| liranc_ | thanks bye its late i have to get some sleep | 20:46 |
| *** gokrokve has joined #openstack-keystone | 20:47 | |
| *** gokrokve has quit IRC | 20:50 | |
| *** shakamunyi has quit IRC | 20:51 | |
| dstanek | liranc_: yw | 20:52 |
| *** shakamunyi has joined #openstack-keystone | 20:52 | |
| *** liranc_ has quit IRC | 20:53 | |
| *** hrybacki has joined #openstack-keystone | 20:53 | |
| *** topol has quit IRC | 20:53 | |
| *** ozialien has joined #openstack-keystone | 20:54 | |
| *** gokrokve has joined #openstack-keystone | 20:58 | |
| *** jimbaker has joined #openstack-keystone | 21:02 | |
| *** leseb has joined #openstack-keystone | 21:02 | |
| *** gokrokve has quit IRC | 21:06 | |
| *** shakamunyi has quit IRC | 21:14 | |
| *** zhiyan_ is now known as zhiyan | 21:18 | |
| *** sbfox1 has quit IRC | 21:20 | |
| *** hrybacki has quit IRC | 21:24 | |
| *** zhiyan is now known as zhiyan_ | 21:27 | |
| *** marcoemorais has quit IRC | 21:30 | |
| *** marcoemorais has joined #openstack-keystone | 21:31 | |
| *** marcoemorais has quit IRC | 21:31 | |
| *** marcoemorais has joined #openstack-keystone | 21:32 | |
| *** openstackgerrit has joined #openstack-keystone | 21:34 | |
| *** gokrokve has joined #openstack-keystone | 21:37 | |
| *** gokrokve_ has joined #openstack-keystone | 21:38 | |
| *** gokrokve has quit IRC | 21:41 | |
| *** gokrokve_ has quit IRC | 21:43 | |
| *** openstackgerrit has quit IRC | 21:47 | |
| *** sbfox has joined #openstack-keystone | 21:50 | |
| *** browne has quit IRC | 21:54 | |
| *** dims has quit IRC | 21:58 | |
| *** browne has joined #openstack-keystone | 21:59 | |
| *** gokrokve has joined #openstack-keystone | 22:01 | |
| *** gokrokve has quit IRC | 22:06 | |
| *** shakamunyi has joined #openstack-keystone | 22:11 | |
| *** lbragstad has quit IRC | 22:12 | |
| *** BAKfr has quit IRC | 22:14 | |
| gabriel-bezerra | dstanek: yes, or the code should allow it without username | 22:14 |
| *** nkinder has joined #openstack-keystone | 22:14 | |
| *** leseb has quit IRC | 22:14 | |
| gabriel-bezerra | but docs show examples without user.name and iirc says it is optional, and code doesn't allow it | 22:15 |
| *** zhiyan_ is now known as zhiyan | 22:18 | |
| *** gordc has left #openstack-keystone | 22:21 | |
| *** shakamunyi has quit IRC | 22:22 | |
| *** shakayumi has joined #openstack-keystone | 22:22 | |
| *** sbfox has quit IRC | 22:22 | |
| *** dims has joined #openstack-keystone | 22:24 | |
| *** sbfox has joined #openstack-keystone | 22:25 | |
| *** zhiyan is now known as zhiyan_ | 22:27 | |
| *** bknudson has quit IRC | 22:31 | |
| *** marcoemorais has quit IRC | 22:32 | |
| *** marcoemorais has joined #openstack-keystone | 22:32 | |
| *** marcoemorais has quit IRC | 22:32 | |
| *** marcoemorais has joined #openstack-keystone | 22:33 | |
| *** marcoemorais has quit IRC | 22:34 | |
| *** marcoemorais has joined #openstack-keystone | 22:34 | |
| *** gokrokve has joined #openstack-keystone | 22:35 | |
| *** thedodd has quit IRC | 22:41 | |
| *** leseb has joined #openstack-keystone | 22:45 | |
| *** leseb has quit IRC | 22:57 | |
| *** rodrigods has joined #openstack-keystone | 23:06 | |
| *** david-lyle has quit IRC | 23:17 | |
| *** zhiyan_ is now known as zhiyan | 23:19 | |
| *** leseb has joined #openstack-keystone | 23:24 | |
| *** leseb has quit IRC | 23:26 | |
| *** leseb has joined #openstack-keystone | 23:26 | |
| *** zhiyan is now known as zhiyan_ | 23:28 | |
| *** marcoemorais has quit IRC | 23:31 | |
| *** marcoemorais has joined #openstack-keystone | 23:32 | |
| *** leseb has quit IRC | 23:32 | |
| *** browne has quit IRC | 23:35 | |
| *** schofield has quit IRC | 23:37 | |
| *** browne has joined #openstack-keystone | 23:42 | |
| *** marcoemorais has quit IRC | 23:43 | |
| *** schofield has joined #openstack-keystone | 23:43 | |
| *** marcoemorais has joined #openstack-keystone | 23:43 | |
| *** sbfox1 has joined #openstack-keystone | 23:46 | |
| *** sbfox has quit IRC | 23:49 | |
| *** sbfox has joined #openstack-keystone | 23:53 | |
| *** gokrokve has quit IRC | 23:54 | |
| *** gokrokve has joined #openstack-keystone | 23:55 | |
| *** gokrokve has quit IRC | 23:55 | |
| *** sbfox1 has quit IRC | 23:55 | |
| *** rodrigods has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
