| *** sbfox has quit IRC | 00:07 | |
| *** praneshp_ has joined #openstack-keystone | 00:10 | |
| *** praneshp has quit IRC | 00:11 | |
| *** praneshp_ is now known as praneshp | 00:11 | |
| *** dims__ has joined #openstack-keystone | 00:12 | |
| *** dims_ has quit IRC | 00:14 | |
| *** dims__ is now known as dims | 00:15 | |
| *** nkinder has joined #openstack-keystone | 00:20 | |
| * morganfainberg feels brainfriend from doing bug triag | 00:22 | |
| morganfainberg | triage even | 00:22 |
|---|---|---|
| morganfainberg | or well... bug cleanup | 00:22 |
| *** rushiagr has quit IRC | 00:25 | |
| *** browne has quit IRC | 00:26 | |
| *** zhiyan_ is now known as zhiyan | 00:27 | |
| *** browne has joined #openstack-keystone | 00:30 | |
| *** rushiagr has joined #openstack-keystone | 00:32 | |
| *** rodrigods_ has joined #openstack-keystone | 00:48 | |
| gyee | morganfainberg, its mountain bike time here :) | 00:50 |
| morganfainberg | enjoy! | 00:50 |
| *** rwsu has quit IRC | 00:51 | |
| ayoung | morganfainberg, python question. I need to do some DJango work, spcifically on django_openstack_auth, which is in a separate repo. I want the HTTPD process to pull my code out of my git repo. I did a pythonset.py build ;sudo python setup.py install but that seems to put the code under /usr/lib. Is there some way I can get it to read the code from my git repo, and have the egg just link to it? | 00:51 |
| morganfainberg | ayoung, pip -e . | 00:51 |
| morganfainberg | ayoung, or setup develop | 00:51 |
| morganfainberg | ayoung, http://stackoverflow.com/questions/19048732/python-setup-py-develop-vs-install | 00:52 |
| *** pheadron has quit IRC | 00:52 | |
| ayoung | morganfainberg, thanks...was googling for it, but came across too much noise in the signa; | 00:53 |
| morganfainberg | ayoung, np! | 00:53 |
| *** pheadron has joined #openstack-keystone | 00:54 | |
| *** gokrokve has joined #openstack-keystone | 00:54 | |
| *** rodrigods_ has quit IRC | 00:55 | |
| ayoung | morganfainberg, I'm getting some public space on Dreamhost beta, and I'm going to install a publically accessable FreeIPA instance | 00:57 |
| *** pheadron has quit IRC | 01:01 | |
| *** amcrn has quit IRC | 01:07 | |
| *** pheadron has joined #openstack-keystone | 01:08 | |
| openstackgerrit | A change was merged to openstack/keystone: remove out of date docs for Fedora 15 https://review.openstack.org/96524 | 01:09 |
| *** pheadron has quit IRC | 01:14 | |
| *** pheadron has joined #openstack-keystone | 01:15 | |
| *** dstanek_zzz has quit IRC | 01:32 | |
| *** sbfox has joined #openstack-keystone | 01:37 | |
| *** gokrokve has quit IRC | 01:38 | |
| *** dstanek_zzz has joined #openstack-keystone | 01:39 | |
| *** dstanek_zzz is now known as dstanek | 01:39 | |
| *** dstanek has quit IRC | 01:44 | |
| *** dstanek_zzz has joined #openstack-keystone | 01:45 | |
| *** dstanek_zzz is now known as dstanek | 01:45 | |
| morganfainberg | cool | 01:47 |
| *** ncoghlan has joined #openstack-keystone | 01:59 | |
| *** pheadron has quit IRC | 02:02 | |
| *** sbfox has quit IRC | 02:04 | |
| *** marcoemorais has quit IRC | 02:10 | |
| *** richm has quit IRC | 02:17 | |
| *** browne has quit IRC | 02:27 | |
| *** xianghui has joined #openstack-keystone | 02:33 | |
| *** mberlin has joined #openstack-keystone | 02:51 | |
| *** mberlin1 has quit IRC | 02:52 | |
| *** dims has quit IRC | 02:53 | |
| *** dims has joined #openstack-keystone | 02:55 | |
| *** Abhijeet has joined #openstack-keystone | 02:56 | |
| *** gokrokve has joined #openstack-keystone | 03:02 | |
| *** browne has joined #openstack-keystone | 03:13 | |
| *** ayoung has quit IRC | 03:16 | |
| *** dims_ has joined #openstack-keystone | 03:39 | |
| *** dims has quit IRC | 03:39 | |
| *** stevemar has joined #openstack-keystone | 04:01 | |
| *** harlowja is now known as harlowja_away | 04:07 | |
| stevemar | ping | 04:14 |
| *** browne has quit IRC | 04:16 | |
| *** gokrokve has quit IRC | 04:17 | |
| *** dims_ has quit IRC | 04:20 | |
| openstackgerrit | Vladimir Eremin proposed a change to openstack/python-keystoneclient: Keystone compact PKI token https://review.openstack.org/97854 | 04:26 |
| *** dstanek is now known as dstanek_zzz | 04:32 | |
| *** dstanek_zzz is now known as dstanek | 04:34 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:43 | |
| *** sbfox has joined #openstack-keystone | 04:54 | |
| *** stevemar has quit IRC | 04:59 | |
| *** Abhijeet has quit IRC | 05:13 | |
| *** Abhijeet has joined #openstack-keystone | 05:13 | |
| *** ajayaa has joined #openstack-keystone | 05:14 | |
| *** marcoemorais has joined #openstack-keystone | 05:17 | |
| *** marcoemorais1 has joined #openstack-keystone | 05:19 | |
| *** marcoemorais has quit IRC | 05:21 | |
| *** dstanek is now known as dstanek_zzz | 05:23 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Overwrite HelpFormatter constructur to extend argument column https://review.openstack.org/97873 | 05:26 |
| *** topol has quit IRC | 05:27 | |
| *** ncoghlan_afk is now known as ncoghlan | 05:27 | |
| morganfainberg | bah missed topol by a couple minutes | 05:31 |
| openstackgerrit | Andre Naehring proposed a change to openstack/keystone: Add information regarding HTTPS for SSL enabled endpoints https://review.openstack.org/95545 | 05:51 |
| *** topol has joined #openstack-keystone | 05:59 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/97005 | 06:00 |
| *** gyee has quit IRC | 06:04 | |
| *** jraim has quit IRC | 06:05 | |
| *** jraim has joined #openstack-keystone | 06:06 | |
| *** ncoghlan is now known as ncoghlan_afk | 06:12 | |
| *** topol has quit IRC | 06:23 | |
| *** ajayaa has quit IRC | 06:26 | |
| *** ukalifon1 has joined #openstack-keystone | 06:28 | |
| *** sbfox has quit IRC | 06:42 | |
| *** ajayaa has joined #openstack-keystone | 06:43 | |
| *** sbfox has joined #openstack-keystone | 06:44 | |
| *** BAKfr has joined #openstack-keystone | 07:15 | |
| *** ncoghlan_afk is now known as ncoghlan | 07:20 | |
| *** ncoghlan has quit IRC | 07:21 | |
| *** bvandenh has joined #openstack-keystone | 07:43 | |
| *** xianghui has quit IRC | 07:43 | |
| *** xianghui has joined #openstack-keystone | 07:46 | |
| *** andreaf has joined #openstack-keystone | 07:50 | |
| *** toddnni_ has joined #openstack-keystone | 08:14 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: remove unneeded definitions of Python Source Code Encoding https://review.openstack.org/95383 | 08:15 |
| *** toddnni has quit IRC | 08:16 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: remove unneeded definitions of Python Source Code Encoding https://review.openstack.org/95383 | 08:16 |
| *** toddnni_ has quit IRC | 08:21 | |
| *** marekd|away is now known as marekd | 08:22 | |
| *** toddnni has joined #openstack-keystone | 08:24 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Implement SAML2 ECP authentication https://review.openstack.org/92166 | 08:49 |
| *** marcoemorais1 has quit IRC | 09:05 | |
| *** nsquare has quit IRC | 09:14 | |
| *** jaosorior has joined #openstack-keystone | 09:15 | |
| *** zhiyan is now known as zhiyan_ | 09:18 | |
| *** sbfox has quit IRC | 09:25 | |
| *** Abhijeet has quit IRC | 09:53 | |
| openstackgerrit | Ajaya Agrawal proposed a change to openstack/keystone: TestAuthInfo class in test_v3_auth made more efficient. https://review.openstack.org/98072 | 09:54 |
| *** xianghui has quit IRC | 09:59 | |
| *** xianghui has joined #openstack-keystone | 10:05 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Cross Backend Unique Idenifiers for User and Group Entities https://review.openstack.org/97492 | 10:15 |
| *** Chicago has joined #openstack-keystone | 10:25 | |
| *** Chicago has joined #openstack-keystone | 10:25 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Implement SAML2 ECP authentication https://review.openstack.org/92166 | 10:26 |
| *** xianghui has quit IRC | 10:26 | |
| ajayaa | jaosorior, ping! Can you please point out some problem with https://review.openstack.org/98072 | 10:27 |
| jaosorior | I wrote it as a comment in the commit message | 10:29 |
| jaosorior | https://review.openstack.org/#/c/98072/1//COMMIT_MSG | 10:29 |
| jaosorior | please change the commit message to be in accordance to this: https://wiki.openstack.org/wiki/Gerrit_Workflow#Committing_Changes :) | 10:33 |
| ajayaa | jaosorior, it could be less than 80 characters per line, right? | 10:35 |
| *** leseb has joined #openstack-keystone | 10:36 | |
| jaosorior | yus | 10:37 |
| openstackgerrit | Ajaya Agrawal proposed a change to openstack/keystone: TestAuthInfo class in test_v3_auth made more efficient. https://review.openstack.org/98072 | 10:37 |
| jaosorior | And the title preferable 50 characters or less, as stated in the Gerrit Workflow link "Git commit messages should start with a short 50 character or less summary in a single paragraph." | 10:38 |
| jaosorior | but that's no biggie | 10:38 |
| jaosorior | other than that it seems like good stuff :) Gotta wait for Jenkins to pass though | 10:38 |
| *** leseb has quit IRC | 10:40 | |
| ajayaa | jaosorior, thanks | 10:40 |
| *** praneshp has quit IRC | 10:42 | |
| *** xianghui has joined #openstack-keystone | 10:43 | |
| *** praneshp has joined #openstack-keystone | 10:44 | |
| jaosorior | Does anybody know what's up with the openstack/common folder? I've seen that in a couple of projects with very similar files. Thing is, I have a simple patch for one of the files there, but would like to know if this is some openstack-wide folder (perhaps it should be a submodule? or something) or how should patches for files in that folder be handled? | 10:44 |
| *** praneshp has quit IRC | 10:45 | |
| boris-42 | jaosorior it's openstack oslo code | 10:51 |
| boris-42 | jaosorior take a look here https://github.com/openstack/oslo-incubator/ | 10:51 |
| boris-42 | jaosorior for more details | 10:51 |
| jaosorior | thanks | 10:55 |
| *** leseb has joined #openstack-keystone | 11:11 | |
| ajayaa | Is it a good idea to write unit tests/ functional tests for custom roles? | 11:17 |
| *** Chicago has quit IRC | 11:36 | |
| *** lbragstad has quit IRC | 11:38 | |
| *** afazekas has joined #openstack-keystone | 11:48 | |
| *** juanmo has joined #openstack-keystone | 12:03 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/identity-api: Adding support for self registration to Virtual Organisations https://review.openstack.org/98087 | 12:03 |
| openstackgerrit | Kristy Siu proposed a change to openstack/identity-api: Adding support for self registration to Virtual Organisations https://review.openstack.org/98087 | 12:15 |
| openstackgerrit | Kristy Siu proposed a change to openstack/identity-api: Adding support for self registration to Virtual Organisations https://review.openstack.org/98087 | 12:18 |
| *** ajayaa has quit IRC | 12:39 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Enforce ``saml2`` protocol in Apache config https://review.openstack.org/97479 | 12:46 |
| *** lbragstad has joined #openstack-keystone | 12:47 | |
| *** gordc has joined #openstack-keystone | 12:51 | |
| *** radez_g0n3 is now known as radez | 12:53 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/identity-api: Adding support for self registration to Virtual Organisations https://review.openstack.org/98087 | 13:05 |
| *** nkinder has quit IRC | 13:10 | |
| *** ayoung has joined #openstack-keystone | 13:21 | |
| *** samuelmz has quit IRC | 13:24 | |
| *** bknudson has joined #openstack-keystone | 13:27 | |
| *** jdennis has quit IRC | 13:39 | |
| *** jdennis has joined #openstack-keystone | 13:40 | |
| *** stevemar has joined #openstack-keystone | 13:43 | |
| *** hrybacki has joined #openstack-keystone | 13:51 | |
| *** xianghui has quit IRC | 13:53 | |
| *** amuller has joined #openstack-keystone | 13:56 | |
| amuller | lbragstad: Heya, I wanted to talk about Keystone events about user/tenant create/update/delete | 13:56 |
| lbragstad | amuller: sure, what's up | 13:56 |
| amuller | I filed a Neutron spec: https://review.openstack.org/#/c/98097/2 | 13:57 |
| amuller | So that when Neutron receives a Keystone tenant delete, it deletes all of that tenant's Neutron resources | 13:57 |
| amuller | However, Keystone doesn't send these notifications by default | 13:57 |
| amuller | First off, is that something you find reasonable? Emitting these notifications by default? | 13:57 |
| openstackgerrit | Rodrigo Duarte Sousa proposed a change to openstack/python-keystoneclient: Add example script for role_assignments module https://review.openstack.org/97600 | 13:58 |
| amuller | It would be great in my mind if Keystone did. It would ease the deployment, make Tempest testing easier | 14:00 |
| *** nkinder has joined #openstack-keystone | 14:01 | |
| *** gokrokve has joined #openstack-keystone | 14:01 | |
| lbragstad | when we originally looked into notifications for Keystone, it was sort of an opt in feature | 14:04 |
| *** nkinder has quit IRC | 14:05 | |
| *** joesavak has joined #openstack-keystone | 14:07 | |
| amuller | right | 14:07 |
| amuller | As far as I could tell, all of the defaults are correct for sending out messages by default, apart from notification_driver, which defaults to the empty list | 14:08 |
| amuller | If I change that to ['messaging'] | 14:08 |
| amuller | Keystone starts sending out notifications | 14:08 |
| amuller | lbragstad: ^ | 14:09 |
| *** jsavak has joined #openstack-keystone | 14:09 | |
| amuller | The default is in oslo messaging though, not in Keystone | 14:09 |
| lbragstad | the notification driver kind of depends on what platform you're running on though | 14:10 |
| lbragstad | i.e. Ubuntu vs RHEL | 14:10 |
| amuller | lbragstad: I think you mean qpid vs rabbit? | 14:11 |
| lbragstad | amuller: right... | 14:11 |
| amuller | The notification_driver value is for log vs noop vs messaging (RPC) | 14:11 |
| amuller | not for qpid vs rabbit | 14:11 |
| lbragstad | amuller: but you have to specify an 'rpc' driver don't you? | 14:11 |
| amuller | Sure but that's already taken care of by the deployment tools | 14:12 |
| *** joesavak has quit IRC | 14:12 | |
| amuller | I'm talking about changing the upstream default to 'messaging' so that the deployment tools don't have to touch that | 14:12 |
| amuller | It's a matter of least surprise, imo... I'd guess that if an admin deletes a tenant he'd expect all of its resources gone from all of the projects | 14:13 |
| amuller | So I think that making Keystone emit the tenant delete notifications by default is a strong step towards that | 14:13 |
| amuller | relying on the deployment tools to do that would be a pain | 14:13 |
| lbragstad | amuller: I can see your point, I'd like to hear what some of the other Keystone people think about it though... | 14:14 |
| lbragstad | morganfainberg: bknudson ^ | 14:14 |
| lbragstad | subject: enabling messaging (rpc) as the default notification delivery mechanism for Keystone | 14:15 |
| amuller | lbragstad: Can Keystone work without RPC configured? IE: Without the deployment tool setting the RPC driver? | 14:15 |
| amuller | Assuming you don't care about notifications to other projects | 14:15 |
| amuller | I guess one issue with setting messaging to the default is what happens if the rpc driver / etc weren't set, but I'm asking if Keystone works at all in that case | 14:16 |
| *** andreaf has quit IRC | 14:16 | |
| bknudson | doesn't make any difference to me if notifications are enabled by default or not. | 14:16 |
| bknudson | maybe ask on the operators list? | 14:16 |
| lbragstad | amuller: yeah, that would be a good idea. | 14:16 |
| amuller | bknudson: Do these notifications currently have any clients / uses? | 14:16 |
| lbragstad | amuller: are you thinking from the perspective of "does Keystone require a messaging service to run?" | 14:16 |
| lbragstad | amuller: like Nova does? | 14:17 |
| amuller | yeah | 14:17 |
| amuller | to communicate with agents for example | 14:17 |
| lbragstad | amuller: no, it doesn't | 14:17 |
| amuller | uh huh | 14:17 |
| bknudson | I believe the notifications are required to get the cadf audit records | 14:17 |
| lbragstad | correct, | 14:17 |
| amuller | I know that the Red Hat oriented deployment tools do set the rpc values for keystone.conf | 14:18 |
| lbragstad | cadf notification are dependent on the notifcation framework in Keystone | 14:18 |
| amuller | dunno about other deployment tools | 14:18 |
| amuller | I guess it could be an issue to set the default notifications driver to 'messaging' if Keystone isn't even configured for RPC | 14:18 |
| lbragstad | if you do use a messaging/rpc driver for keystone notifications you need to specify that in your keystone.conf | 14:18 |
| *** nkinder has joined #openstack-keystone | 14:18 | |
| amuller | Devstack sets 'rpc_backend' to rabbit or qpid for example | 14:19 |
| *** diegows has joined #openstack-keystone | 14:20 | |
| lbragstad | amuller: what are you using for deployment tools? | 14:20 |
| amuller | devstack, packstack, foreman | 14:21 |
| amuller | they all set the rpc_backend | 14:21 |
| lbragstad | ok | 14:21 |
| lbragstad | amuller: I think checking with the ops list would be a good start too... | 14:22 |
| amuller | And what devs should I CC? | 14:23 |
| amuller | I have a feeling the email to the ops list won't get responses | 14:23 |
| amuller | dunno if anyone cares about this feature at this point | 14:24 |
| lbragstad | you could send a topic to the -dev list with a link to the ops list message | 14:26 |
| amuller | alright | 14:28 |
| *** topol has joined #openstack-keystone | 14:28 | |
| amuller | I'll type up an email | 14:28 |
| amuller | Hopefully we'll get a consensus in a reasonable time frame | 14:28 |
| amuller | lbragstad: Slight technical difficulty on my end, probably due to my lack of expertise with oslo config, but the default for notifications_driver is set in Oslo messaging and not in Keystone | 14:29 |
| *** gokrokve has quit IRC | 14:30 | |
| amuller | Changing the default in Oslo messaging seems unreasonable to me, but I don't exactly know how to override that default in Keystone | 14:30 |
| amuller | Registering the same option is an error, so I tried unregistering and registering, but then I'd have to read the conf file again | 14:31 |
| lbragstad | could see if the oslo guys have an opinion? | 14:34 |
| amuller | Yeah I'll talk to one of the Oslo config guys at some point in the future | 14:34 |
| amuller | bknudson: May I have your email please so I could CC you as well? | 14:34 |
| bknudson | amuller: I'm subscribed to the -dev mailing list | 14:35 |
| amuller | alright | 14:35 |
| lbragstad | amuller: same, I'm on the -dev list too | 14:35 |
| bknudson | If ops people say it's ok, there's not much to it for us... we just change the default | 14:36 |
| bknudson | I would assume since everyone's using rpc for nova already it shouldn't be a bid deal. | 14:36 |
| bknudson | big deal | 14:36 |
| amuller | notifications were merged to Keystone in Havana right? | 14:37 |
| marekd | morganfainberg: https://review.openstack.org/#/c/97479/ -> I hope I addressed your suggestions. | 14:39 |
| amuller | nm checked the bp | 14:39 |
| *** gokrokve has joined #openstack-keystone | 14:39 | |
| *** dims_ has joined #openstack-keystone | 14:44 | |
| amuller | lbragstad: bknudson: Alright thanks guys, I'll send out the email now. | 14:45 |
| *** thedodd has joined #openstack-keystone | 14:47 | |
| *** doddstack has joined #openstack-keystone | 14:49 | |
| *** thedodd has quit IRC | 14:51 | |
| *** ukalifon1 has quit IRC | 14:59 | |
| *** ukalifon1 has joined #openstack-keystone | 15:02 | |
| marekd | topol: o/ You mentioned oAuth2.0 security vuln somewhere in a review recently. Did you mean this: http://www.cnet.com/news/serious-security-flaw-in-oauth-and-openid-discovered/ ? | 15:04 |
| topol | marekd, yes | 15:04 |
| marekd | topol: ups. | 15:05 |
| *** joesavak has joined #openstack-keystone | 15:05 | |
| topol | marekd??? | 15:06 |
| topol | ups?? | 15:06 |
| marekd | topol: oauth (and later openid connect) seemed to be a robust and reliable solution :-) | 15:07 |
| *** jsavak has quit IRC | 15:07 | |
| topol | marekd, we use openid a lot here | 15:09 |
| marekd | topol: everybody does! | 15:09 |
| topol | So I just pointed it ou because I was wondering if this issue was impacting oAuth2.0 adoption | 15:10 |
| marekd | topol: I didn't read the bug description, but it looks like a bug in a protocol design? or just implementations? | 15:10 |
| marekd | topol: well...detailed bug description | 15:10 |
| topol | marekd, but it sounds like you are saying the answer, hey topol nothings perfect and we need to go forward :-) | 15:10 |
| topol | marekd, whicvh I am fine with. Honestly I was more concerned about having keystone support a web based login page | 15:11 |
| topol | I have gone back to see the responses to my questions but will circle back soon | 15:11 |
| marekd | topol: reading them now. | 15:12 |
| topol | err I have not yet gone back to see the responses.. | 15:12 |
| topol | K, I need to run out for lunch before my next cal | 15:12 |
| dolphm | topol: i'm totally lost as to what the news is in that article | 15:12 |
| marekd | topol: cheers, | 15:12 |
| dolphm | topol: it just sounds like it's describing an oauth flow of a compromised website, in which case, the website is already fucked | 15:12 |
| *** radez is now known as radez_g0n3 | 15:13 | |
| *** jsavak has joined #openstack-keystone | 15:15 | |
| *** amuller has quit IRC | 15:15 | |
| *** joesavak has quit IRC | 15:19 | |
| *** ajayaa has joined #openstack-keystone | 15:24 | |
| *** ukalifon1 has quit IRC | 15:28 | |
| *** rodrigods_ has joined #openstack-keystone | 15:30 | |
| *** richm has joined #openstack-keystone | 15:32 | |
| *** ajayaa has quit IRC | 15:38 | |
| *** rodrigods_ has quit IRC | 15:45 | |
| *** afazekas has quit IRC | 15:47 | |
| morganfainberg | marekd, yeah that looks good | 15:47 |
| marekd | morganfainberg: thanks. | 15:48 |
| *** gokrokve has quit IRC | 15:49 | |
| topol | dolphm, I agree and am okay with what you say. and we use openid a ton. so that was mostly for awareness. In any case I was more worried about add a web login page to keystone | 15:51 |
| *** larsks has left #openstack-keystone | 15:51 | |
| ayoung | morganfainberg, http://adam.younglogic.com/2014/06/unattended-install-of-a-freeipa-server/ | 15:51 |
| *** radez_g0n3 is now known as radez | 15:51 | |
| * topol really wishing I didnt mention the security issue. its like I have a mariachi band following me | 15:52 | |
| morganfainberg | ayoung, that is still fedora right? | 15:54 |
| ayoung | morganfainberg, yep | 15:55 |
| morganfainberg | topol, oooh! I know what to do at your next presentation then, i mean fungi was a good start, but... wonder how much mariachi bands cost to hire :P | 15:55 |
| ayoung | morganfainberg, I think that tjaalten doesn';t have the time on this, which means it is on tbabej...let me check | 15:55 |
| morganfainberg | ayoung, figured as much | 15:56 |
| *** bboris has joined #openstack-keystone | 15:56 | |
| bboris | hi | 15:57 |
| bboris | i want to limit a user to specific service only | 15:57 |
| bboris | the idea is that i have swift and ceph users and i want each to see different endpoints | 15:58 |
| bboris | i.e swift can only see the swift proxy and ceph can only see rados gateway | 15:58 |
| morganfainberg | ayoung, ^ this sounds an awful lot like endpoint enforcement. | 15:58 |
| ayoung | morganfainberg, well, also service/endpointspecific roles | 15:59 |
| ayoung | morganfainberg, cuz every other server would have to be hacked to enforce "endpoint only" right now | 15:59 |
| ayoung | but...yeah, least privilege is kindof the standard for security | 16:00 |
| *** sbfox has joined #openstack-keystone | 16:00 | |
| ayoung | morganfainberg, and we really need keystone to act as the policy store if we are going to do any sort of "on the fly policy update" stuff | 16:00 |
| *** dolphm changes topic to "Everyone thank morganfainberg for closing 40+ bugs yesterday!" | 16:00 | |
| ayoung | thanks morganfainberg | 16:00 |
| marekd | thank you uncle Morgan! | 16:01 |
| morganfainberg | bboris, you can limit based upon policy at the moment (e.g. require a specific role to access the endpoint) but it can't prevent a user from seeing an endpoint. If the user has the role that the endpoint's policy will accept, the user can use that endpoint | 16:01 |
| *** jaosorior has quit IRC | 16:02 | |
| dolphm | bknudson, dstanek, jamielennox, morganfainberg, stevemar, gyee, henrynash, topol, lbragstad, joesavak, shardy, fabiog, fmarco76, nkinder, lloydm, shrekuma, ksavich: see topic ^ | 16:02 |
| *** praneshp has joined #openstack-keystone | 16:02 | |
| *** marcoemorais has joined #openstack-keystone | 16:02 | |
| bknudson | morganfainberg: thanks for closing 40+ bugs! | 16:02 |
| lbragstad | morganfainberg: thanks! | 16:02 |
| *** praneshp has quit IRC | 16:02 | |
| bknudson | was that all of them? | 16:02 |
| morganfainberg | bknudson, a lot of bug sweeping. | 16:02 |
| * lbragstad owes morganfainberg a whisky | 16:02 | |
| topol | THANKS Morgan!!!! | 16:02 |
| morganfainberg | bknudson, most were bugs that had been fixed bug statuses were wrong | 16:03 |
| stevemar | lol uncle morgan, nice one marekd | 16:03 |
| morganfainberg | also, no open bugs targeting folsom, essex, or grizzly | 16:03 |
| topol | I prepaid my whiskey obligation for him in ATL :-) | 16:03 |
| topol | okay a few more in San Anton... fine | 16:03 |
| marekd | stevemar: :-) | 16:03 |
| *** yottatsa has joined #openstack-keystone | 16:03 | |
| nkinder | morganfainberg: woohoo! | 16:03 |
| morganfainberg | probably one or two of the ones targeting havana are also wedged, but spending that much time interacting with launchpad makes my head hurt | 16:04 |
| yottatsa | hi guys! | 16:05 |
| ayoung | morganfainberg, way to take one for the team. | 16:05 |
| ayoung | dolphm, I think morganfainberg 's bucking for your job. | 16:06 |
| bboris | morganfainberg: okay, so my next question is how to make such policy? | 16:06 |
| ayoung | bboris, I can help | 16:06 |
| ayoung | a policy rule needs to enforce: user has this role...so what do you want to call the role? | 16:06 |
| yottatsa | dolphm, I've implemented catalog repopulation in the middleware, wanna check out? | 16:06 |
| *** BAKfr has quit IRC | 16:07 | |
| ayoung | bboris, for exaple, we have the rule "service_role": [["role:service"]], in v3cloudsample | 16:08 |
| *** _afazekas is now known as afazekas | 16:08 | |
| yottatsa | dolphm, there is it https://review.openstack.org/97854 | 16:08 |
| *** rodrigods_ has joined #openstack-keystone | 16:08 | |
| yottatsa | Guys, do you really not affected by large PKI token problem? | 16:08 |
| ayoung | boris-42, wait...when you say endpoints, do you mean endpoints of the same service | 16:09 |
| ayoung | yottatsa, we are all affected | 16:09 |
| ayoung | yottatsa, compression is about to merge...just waiting on Zuul | 16:09 |
| yottatsa | ayoung, you've done nice patch | 16:09 |
| yottatsa | ayoung, but why don't just remove it? | 16:09 |
| ayoung | yottatsa, I'm a hack, but I hope to at least be hacking in the right direction | 16:09 |
| ayoung | yottatsa, the catalog? | 16:09 |
| ayoung | because things will need it. | 16:10 |
| yottatsa | yottatsa, yep, from SIGNED payload | 16:10 |
| bboris | ayoung: not the same service | 16:10 |
| ayoung | yottatsa, the goal is to pare it down using catalog filtering | 16:10 |
| ayoung | and then to do endpoint binding | 16:10 |
| bboris | ayoung: one service is os swift, other is ceph radosgw | 16:10 |
| morganfainberg | yottatsa, there is a bigger effort to reduce the size of the catalog and the tokens as a whole | 16:10 |
| yottatsa | ayoung, things needed just catalog, not in the PKI token, am I right? | 16:10 |
| morganfainberg | yottatsa, but we can't remove it at the moment because everything expects it to be there | 16:10 |
| yottatsa | ayoung, morganfainberg, so I implemented it's repopulation | 16:11 |
| ayoung | bboris, are the user getting to these two endpoint via the same project? Or, could you use endpoint filtering and have a "blah_swift" project that doesn't know about Ceph and a "blah_ceph" proejct that doens't know about swift? | 16:11 |
| yottatsa | https://review.openstack.org/97854 | 16:11 |
| ayoung | yottatsa, and you are a pretty cool guy for doing so | 16:11 |
| bboris | ayoung: they can be completely separated | 16:12 |
| ayoung | yottatsa, I like the idea | 16:12 |
| morganfainberg | ayoung, that was my thought on id-only tokens, when you issue the token you send the catalog [filtered] via x-catalog header to the user. - auth_token can do other magic. like that yottatsa is doing there | 16:12 |
| ayoung | bboris, then is it a question of enforcement, or just "don't show it to them and they can ignore it?" | 16:12 |
| yottatsa | ayoung, it's totally dolphm idea | 16:12 |
| * ayoung likes | 16:13 | |
| yottatsa | ayoung, https://bugs.launchpad.net/python-keystoneclient/+bug/1228317/comments/8 | 16:13 |
| uvirtbot | Launchpad bug 1228317 in python-keystoneclient "Need to be able to opt-out of X-Service-Catalog header" [Wishlist,Confirmed] | 16:13 |
| ayoung | yottatsa, what is the logic | 16:13 |
| ayoung | does it need a config file option to repopulate? | 16:13 |
| bboris | ayoung: just dont show it | 16:13 |
| ayoung | bboris, then use endpoint filtering. Its in Havana and later | 16:13 |
| yottatsa | ayoung, no, I repopulate it if catalog is requested and there is no catalog in token | 16:14 |
| dolphm | ayoung: we talked about a config option in auth_token like catalog_required, defaulting to true, that would retrieve a catalog if one wasn't available in the token | 16:14 |
| ayoung | yottatsa, does it assume that the service catalog is global? That is really not what we want long term. But it might be ok for a short term fix | 16:14 |
| ayoung | dolphm, so the "default" catalog | 16:14 |
| dolphm | ayoung: default? | 16:15 |
| ayoung | dolphm, I'm thinking about various requests we 've had, including the endpoint filtering | 16:15 |
| ayoung | but also the one where certain endpoints were not visible by default | 16:15 |
| morganfainberg | ayoung, auth_token middleware probably needs / should have all endpoints | 16:15 |
| ayoung | "super_secret_squirrel_swift_server" | 16:15 |
| morganfainberg | ayoung, ok except for explicitly hidden ones? | 16:16 |
| ayoung | morganfainberg, but then how does it know which nova to talk to for a give user? We need a smart default | 16:16 |
| yottatsa | dolphm, ayoung, I colud implement this option then | 16:16 |
| ayoung | yottatsa, it might not be a client side option | 16:16 |
| morganfainberg | ayoung, ah, we're talking two different things | 16:17 |
| ayoung | yottatsa, it might make more sense to have a better set of options for managing the catalog server side, | 16:17 |
| morganfainberg | ayoung, i was thinking id-only catalog in the token | 16:17 |
| *** gyee has joined #openstack-keystone | 16:17 | |
| ayoung | morganfainberg, he's talking about filling in a missing catalog | 16:17 |
| ayoung | id only needs all endpoints, agreed | 16:17 |
| morganfainberg | ayoung, right. | 16:17 |
| morganfainberg | ayoung, sorry, cross the streams | 16:17 |
| ayoung | morganfainberg, so we need two APIs, one that gets the default one that gets everything. | 16:18 |
| yottatsa | ayoung, it will be nice if we had some /v3/catalog hander, but it leads to api change | 16:18 |
| ayoung | "everything" might be a privilged action | 16:18 |
| *** browne has joined #openstack-keystone | 16:18 | |
| morganfainberg | ayoung, yeah that sounds right. | 16:18 |
| ayoung | yottatsa, yeah | 16:18 |
| * morganfainberg writes up the token version split from api version spec today | 16:18 | |
| ayoung | yottatsa, your change might be Ok for now, and then we work in the ability to define a default set of endpoints from a non-filtered GET /v3/catalog" | 16:19 |
| ayoung | and also | 16:19 |
| ayoung | GET /v3/catalog?all | 16:19 |
| *** rodrigods_ has quit IRC | 16:19 | |
| ayoung | which requires a specific role to execure | 16:19 |
| ayoung | execute | 16:19 |
| *** openstackgerrit has quit IRC | 16:20 | |
| dolphm | ayoung: ?all should be implied by GET /v3/catalog | 16:20 |
| *** openstackgerrit has joined #openstack-keystone | 16:20 | |
| ayoung | dolphm, but policy doesn't know how to filter on that parameter | 16:21 |
| ayoung | dolphm, and no, it should not | 16:21 |
| * yottatsa is checkking out endpoint_filter_extension | 16:21 | |
| ayoung | dolphm, /v3/catalog should show the default catalog | 16:21 |
| *** ChanServ changes topic to "Everyone thank morganfainberg for closing 40+ bugs yesterday! | | Review Specifications: https://review.openstack.org/#/q/status:open+project:openstack/keystone-specs,n,z" | 16:21 | |
| ayoung | or we tailor the output based on roles | 16:21 |
| *** nkinder has quit IRC | 16:21 | |
| ayoung | GET /v3/catalog?default can be the first hack, though | 16:22 |
| ayoung | what if we had named filters... | 16:22 |
| yottatsa | ayoung, dolphm, so could you please review for merge https://review.openstack.org/97854 ? | 16:22 |
| ayoung | GET /v3/catalog?filter=default | 16:22 |
| ayoung | yottatsa, no. Get it working first | 16:23 |
| dolphm | yottatsa: talk to gyee about the -2 first | 16:23 |
| dolphm | yottatsa: i'd also suggest proposing something to keystone-specs | 16:23 |
| yottatsa | ayoung, dolphm, it's working now and passed all the tests | 16:23 |
| ayoung | yottatsa, you break a heckofa lot of tests there | 16:23 |
| ayoung | ah | 16:23 |
| *** nkinder has joined #openstack-keystone | 16:23 | |
| morganfainberg | dolphm, ++ | 16:24 |
| gyee | sorry I missed most of the conversation, are we talking about a new catalog api instead of the current hack? | 16:24 |
| ayoung | ...ok, was looking at an old review | 16:24 |
| yottatsa | gyee, hi | 16:24 |
| bboris | ayoung: so... i enabled this filter i think. how do i use it? | 16:24 |
| ayoung | gyee, this is a way to populate the catalog if they use :no catalog in token | 16:24 |
| yottatsa | gyee, yes, we're talking about new catalog api | 16:25 |
| yottatsa | ayoung, I don't like nocatalog patch at all | 16:25 |
| gyee | ayoung, yottatse, but that's still a hack right, using the admin user's catalog instead of the requesting user's catalog | 16:25 |
| ayoung | bboris, create a user, add a role for him in each project, and get a token scoped to each project...the GET token call actually reutrns the whole catalog in the response. You can see it if | 16:25 |
| ayoung | keystone token-get --debug | 16:25 |
| gyee | new catalog api is the right approach | 16:26 |
| ayoung | gyee, yes, that is correct, it uses the admins catalog, which is why I was saying we should have a clear default | 16:26 |
| yottatsa | ayoung, I'm not using admin catalog, I'm using catalog from admin token request, which is exactly the same if we don't use filtering | 16:26 |
| gyee | yottatsa, are you going to abandon the current review and starting fresh with a keystone-specs review? | 16:27 |
| gyee | I wasn't clear on that | 16:27 |
| ayoung | gyee, I think, so long as his feature is trigged by a config option, we should go with his approach | 16:27 |
| ayoung | don' | 16:27 |
| ayoung | t abandon the review | 16:27 |
| openstackgerrit | Marco Fargetta proposed a change to openstack/keystone-specs: Web Authentication for SAML federated Keystone https://review.openstack.org/96867 | 16:27 |
| yottatsa | gyee, sorry, I'm kinda newbee, what is keystone-specs? | 16:27 |
| morganfainberg | ayoung, ++ don't abandon. | 16:27 |
| *** bvandenh has quit IRC | 16:28 | |
| *** ayoung is now known as ayoung-lunch | 16:28 | |
| gyee | yottatsa, I can remove the -2 if you make it configurable | 16:28 |
| morganfainberg | yottatsa, https://git.openstack.org/openstack/keystone-specs it is how we are reviewing/approving blueprints | 16:28 |
| gyee | at least it won't break endpoint filtering | 16:28 |
| gyee | just add an option, something like use_admin_catalog or something | 16:28 |
| yottatsa | gyee, ok | 16:30 |
| *** doddstack has quit IRC | 16:32 | |
| gyee | yottatsa, done | 16:32 |
| *** thedodd has joined #openstack-keystone | 16:33 | |
| gyee | dolphm, jammielennox|away, can you guys please review this when you have a chance? https://review.openstack.org/#/c/96575/ | 16:34 |
| gyee | I am trying to do this once for all the service clients | 16:34 |
| *** jsavak has quit IRC | 16:34 | |
| *** jsavak has joined #openstack-keystone | 16:34 | |
| yottatsa | gyee, could you please explain me what is include_service_catalog in keystoneclient/middleware/auth_token.py option for? | 16:35 |
| yottatsa | gyee, https://github.com/openstack/python-keystoneclient/commit/a97b293501fa504dd154fc921809a40bc2a34049 | 16:35 |
| gyee | yottatsa, that option controls whether to ask for service catalog on token validation and to set the X-Service-Catalog header | 16:37 |
| yottatsa | gyee, I ran into the bug if it is enabled: https://bugs.launchpad.net/python-keystoneclient/+bug/1228317/comments/6 | 16:38 |
| uvirtbot | Launchpad bug 1228317 in python-keystoneclient "Need to be able to opt-out of X-Service-Catalog header" [Wishlist,Confirmed] | 16:38 |
| yottatsa | gyee, nova requires X-Service-Catalog to be populated is some cases | 16:39 |
| *** praneshp has joined #openstack-keystone | 16:40 | |
| gyee | yottatsa, yes, I understand the problem | 16:41 |
| yottatsa | gyee, so is there any conditions when we need to prevent X-Service-Catalog population? | 16:41 |
| gyee | yottatsa, its a deployment option | 16:42 |
| gyee | if you don't use the nova-cinder extension, for example, you can disable it | 16:42 |
| gyee | I mean enable it | 16:42 |
| gyee | but I agree with the others, having a separate API to fetch the service catalog on-demand is a better option for you | 16:43 |
| *** andreaf has joined #openstack-keystone | 16:44 | |
| yottatsa | gyee, I've got it | 16:46 |
| *** praneshp has quit IRC | 16:48 | |
| *** harlowja_away is now known as harlowja | 16:50 | |
| topol | dolphm, is jsavak's keystone to keystone blueprint in the spec repo? Or is it just being done in v3/markdown? | 16:51 |
| topol | I just read one of his emails and realized I was doing out of sight out of mind... | 16:52 |
| yottatsa | gyee, I just found out that no option required for admin catalog population | 16:52 |
| gyee | yottatsa, right, but you are going to add one right? | 16:53 |
| yottatsa | gyee, yep | 16:53 |
| gyee | morganfainberg, could use your blessing here as well https://review.openstack.org/#/c/96575/ | 16:54 |
| yottatsa | gyee, populate_admin_service_catalog for example | 16:54 |
| gyee | yottatsa, yes, that'll work | 16:54 |
| gyee | yottatsa, perhaps use_admin_service_catalog? | 16:55 |
| morganfainberg | gyee, i'll look over it today. | 16:55 |
| gyee | morganfainberg, thank you sir | 16:55 |
| *** ayoung-lunch is now known as ayoung | 16:56 | |
| *** radez is now known as radez_g0n3 | 16:57 | |
| gyee | morganfainberg, dolphm, can you guys please remove the red cross on this one? https://review.openstack.org/#/c/42967/ | 16:58 |
| morganfainberg | gyee, but red is totally it's color! (removing -2 now) | 16:58 |
| gyee | heh | 16:58 |
| *** sbfox has quit IRC | 17:00 | |
| yottatsa | gyee, f*ck, test suite is not working on my mac ( | 17:01 |
| yottatsa | gonna use linux box | 17:01 |
| yottatsa | gyee, Ran 758 tests and passed! | 17:02 |
| *** praneshp has joined #openstack-keystone | 17:02 | |
| *** sbfox has joined #openstack-keystone | 17:03 | |
| *** nkinder has quit IRC | 17:04 | |
| yottatsa | gyee, should I leave it enabled by default. It is not broke things. | 17:05 |
| yottatsa | gyee, ? | 17:05 |
| gyee | yottatsa, yes | 17:06 |
| gyee | yottatsa, default is fine | 17:06 |
| gyee | yottatsa, are you using homebrew on mac? | 17:07 |
| gyee | run_tests.sh works fine on my mac, tox is a bit problematic for some reason | 17:08 |
| openstackgerrit | Vladimir Eremin proposed a change to openstack/python-keystoneclient: Keystone compact PKI token https://review.openstack.org/97854 | 17:08 |
| gyee | still troubleshooting | 17:08 |
| morganfainberg | gyee, what issues are you running into with TOX? | 17:08 |
| gyee | morganfainberg, its failing py33 | 17:08 |
| gyee | but no error logs | 17:08 |
| yottatsa | gyee, I've got 38 errors on mac | 17:09 |
| morganfainberg | gyee, hm. did you install py33? | 17:09 |
| morganfainberg | gyee, os x doesn't have py33 by default | 17:09 |
| gyee | morganfainberg, I installed python3 | 17:09 |
| yottatsa | gyee, homebrew for gcc | 17:09 |
| *** nsquare has joined #openstack-keystone | 17:12 | |
| yottatsa | gyee, oh I fixed my mac | 17:12 |
| yottatsa | gyee, ln -s /usr/local/Cellar/openssl/1.0.1g/bin/openssl /Users/yottatsa/Documents/Python/bin/ | 17:13 |
| yottatsa | yay! | 17:13 |
| *** sbfox has quit IRC | 17:13 | |
| gyee | nice! | 17:13 |
| yottatsa | guys, what IDE do you use? vim? | 17:15 |
| gyee | I use vim | 17:15 |
| yottatsa | bye guys | 17:19 |
| * yottatsa is going to cook a steak! | 17:19 | |
| *** yottatsa has quit IRC | 17:19 | |
| *** nkinder has joined #openstack-keystone | 17:20 | |
| *** leseb has quit IRC | 17:21 | |
| *** gokrokve has joined #openstack-keystone | 17:27 | |
| ayoung | morganfainberg, https://ipa.demo1.freeipa.org/ipa/ui/index.html | 17:28 |
| morganfainberg | ayoung, cool. | 17:28 |
| ayoung | morganfainberg, http://www.freeipa.org/page/Demo#Sandbox | 17:29 |
| ayoung | so employee and admin are both user names you can connect with | 17:29 |
| morganfainberg | very cool | 17:29 |
| ayoung | helpdesk and maanger as well | 17:29 |
| openstackgerrit | Harry Rybacki proposed a change to openstack/python-keystoneclient: Revocation event API https://review.openstack.org/81166 | 17:29 |
| morganfainberg | maybe we should setup a longer running infra box (fedora) that lets us do a full SAML workflow in a unit test | 17:30 |
| morganfainberg | until we get something that runs on ubuntu | 17:30 |
| morganfainberg | if we had fedora tempest gate jobs i'd just set that all up there. | 17:31 |
| * morganfainberg ponders | 17:31 | |
| morganfainberg | maybe... we should just push for ubuntu freeipa... | 17:31 |
| ayoung | morganfainberg, https://review.openstack.org/#/c/81166/ is going to be needed for Ephemeral | 17:31 |
| ayoung | hrybacki is going to work on the auth_token middleware integration | 17:32 |
| morganfainberg | ayoung, yes it will. | 17:32 |
| *** marcoemorais has quit IRC | 17:32 | |
| morganfainberg | ayoung, cool | 17:32 |
| ayoung | morganfainberg, I'm just concerned about how long a stable Ubuntu FreeIPA is going to take. | 17:32 |
| *** bboris has quit IRC | 17:32 | |
| *** marcoemorais has joined #openstack-keystone | 17:32 | |
| *** marcoemorais has quit IRC | 17:33 | |
| *** marcoemorais has joined #openstack-keystone | 17:33 | |
| *** leseb has joined #openstack-keystone | 17:33 | |
| *** sbfox has joined #openstack-keystone | 17:33 | |
| morganfainberg | ayoung, yeah but i feel like the only way we'll see real adoption is if we can get it running under ubuntu | 17:34 |
| morganfainberg | ayoung, real adoption = "recommended deployment method" | 17:35 |
| richm | do we have any fedora tempest gate jobs for any project? | 17:36 |
| morganfainberg | richm, no, we have RHEL for py2.6 | 17:38 |
| morganfainberg | richm, afaik | 17:39 |
| *** thedodd has quit IRC | 17:42 | |
| *** leseb has quit IRC | 17:47 | |
| *** ctracey has quit IRC | 17:51 | |
| *** ctracey has joined #openstack-keystone | 17:51 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Convert explicit session get/begin to transaction context https://review.openstack.org/97058 | 17:52 |
| *** sbfox has quit IRC | 17:57 | |
| gyee | morganfainberg, how did you manage to get tox working with py33 on mac? | 18:00 |
| gyee | I have python3 installed but tox can't see it | 18:00 |
| *** browne has quit IRC | 18:00 | |
| *** leseb has joined #openstack-keystone | 18:01 | |
| *** sbfox has joined #openstack-keystone | 18:02 | |
| *** amcrn has joined #openstack-keystone | 18:03 | |
| *** leseb has quit IRC | 18:05 | |
| *** vhoward has left #openstack-keystone | 18:08 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone-specs: Propose api-validation blueprint https://review.openstack.org/95957 | 18:23 |
| *** browne has joined #openstack-keystone | 18:25 | |
| jsavak | yo topol! | 18:25 |
| jsavak | https://blueprints.launchpad.net/keystone/+spec/keystone-to-keystone-federation will be in the spec repo - just haven't drafted spec yet. In the works. : ) | 18:26 |
| topol | jsavak, awesome. cause I have already programmed myself to only look for these things in the spec repo :-) | 18:27 |
| topol | its a one way door for me. ain't goin back :-) | 18:28 |
| jsavak | I've gotten myself used to conditionals. ;) | 18:28 |
| jsavak | topol - i have listed workitems in the BP - i've got the first one but they aren't necessarily all dependent. Maybe stevemar can pick up #2? | 18:29 |
| *** andreaf has quit IRC | 18:30 | |
| topol | jsavak, most of the BPs in launchpad are now just one liners and the guts go into the spec repo | 18:30 |
| jsavak | ah gotcha. My guts are all over the place. Lots of guts. | 18:31 |
| topol | jsavak but yes, stevemar will definetly be working on this topic | 18:31 |
| marekd | topol: yay! | 18:32 |
| topol | we are drinking the fed identity kool aid | 18:32 |
| topol | henrynash is gonna do some as well. | 18:32 |
| jsavak | it's refreshing. : ) | 18:32 |
| topol | stevemar is gonna set all of us up a meeting soon | 18:33 |
| marekd | stevemar: topol can we do this early next week, please? | 18:33 |
| marekd | jsavak: so you are rewriting bp into keystone-specs format, right? | 18:34 |
| jsavak | yup | 18:34 |
| marekd | jsavak: great. | 18:34 |
| topol | jsavak, Hopefiully he can avoid June 10 and 11 cause I am going to NY for an analyst thing. stevemar Imhoping we can land this on June 9th | 18:34 |
| marekd | topol: meeting? | 18:35 |
| marekd | meeting on june 9th? | 18:35 |
| topol | marekd, yes, have a meeting on June 9th. Im hoping | 18:35 |
| marekd | topol: ok, i'd like to take part as well if you let me :-) | 18:36 |
| topol | does june 9th work for marekd and jsavak | 18:36 |
| topol | marekd, OF COURSE | 18:36 |
| marekd | topol: june 9th works for me. | 18:36 |
| topol | didnt you see my eloquent rant about stakeholder driven design :-)? | 18:36 |
| jsavak | : ) Afternoon central time works and should align with morning for marekD | 18:36 |
| marekd | topol: I DID, thanks :-) | 18:36 |
| marekd | jsavak: there is some bank holiday here on monday but i will be very likely online, but if possible could we try to do this around 3pm pacific time? it'd already be evening here in Switzerland, so I will be preparing for the work eitherway :P | 18:38 |
| topol | stevemar appears to be away. but if both of you can get him times that you are avail on monday june 9th that would help. | 18:38 |
| marekd | topol: sure thing. | 18:38 |
| jsavak | yup! | 18:38 |
| marekd | topol: btw, feel free to weig in into internal mail loop about keystone2keystone :-) | 18:38 |
| topol | He may want to do it as a conf call. we have international tool free callin numbers to use | 18:38 |
| *** gyee has quit IRC | 18:42 | |
| *** thedodd has joined #openstack-keystone | 18:51 | |
| *** sbfox1 has joined #openstack-keystone | 18:52 | |
| *** sbfox has quit IRC | 18:54 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: gitignore etc/keystone/ https://review.openstack.org/98213 | 18:59 |
| stevemar | topol, you are correct... | 19:00 |
| topol | stevemar, did you catchup can you find a time on monday that works for everyone. I can bump anything on my cal on monday to accommodate | 19:02 |
| stevemar | topol, i'll find a time, hopefully not too late for marekd | 19:02 |
| stevemar | all caught up | 19:02 |
| topol | great thanks | 19:02 |
| *** jsavak has quit IRC | 19:05 | |
| *** marcoemorais1 has joined #openstack-keystone | 19:08 | |
| *** marcoemorais has quit IRC | 19:08 | |
| stevemar | marekd, 2pm EST on monday work for you? | 19:10 |
| *** leseb has joined #openstack-keystone | 19:11 | |
| stevemar | it's 8pm for you local time :( | 19:12 |
| *** leseb has quit IRC | 19:16 | |
| raildo | stevemar: I am also interested participate in a meeting about keystone2keystone, can I participate? | 19:23 |
| *** sbfox1 has quit IRC | 19:24 | |
| *** gokrokve_ has joined #openstack-keystone | 19:26 | |
| marekd | stevemar: should be fine. | 19:26 |
| dolphm | marekd: did you know there's a Denis M. at mirantis? #confusing | 19:28 |
| marekd | dolphm: that's definitely not me! | 19:29 |
| marekd | dolphm: how did you find out? | 19:29 |
| dolphm | marekd: just bug activity | 19:30 |
| dolphm | marekd: https://bugs.launchpad.net/python-openstackclient/+bug/1326811/comments/10 | 19:30 |
| *** gokrokve has quit IRC | 19:30 | |
| uvirtbot | Launchpad bug 1326811 in trove "Client failing with six =>1.6 error" [Undecided,New] | 19:30 |
| lbragstad | marekd: I noticed there are a few people with your name on twitter too... found that out when I took bknudson's picture next to your superuser. | 19:31 |
| *** erecio has quit IRC | 19:32 | |
| marekd | lbragstad: but Marek or Denis ? | 19:32 |
| lbragstad | both | 19:32 |
| *** erecio has joined #openstack-keystone | 19:32 | |
| lbragstad | :) | 19:32 |
| marekd | heh :-) | 19:33 |
| jdennis | stevemar: I understand you're an oauth2 expert, can I pick your brain for a minute? | 19:33 |
| marekd | Marek is not a very international name... | 19:33 |
| marekd | oh, another Den(n)is here ^^ :P | 19:34 |
| *** hrybacki has quit IRC | 19:35 | |
| *** afazekas is now known as _afazekas_slp | 19:37 | |
| *** sbfox has joined #openstack-keystone | 19:38 | |
| *** gokrokve_ has quit IRC | 19:38 | |
| *** gokrokve_ has joined #openstack-keystone | 19:40 | |
| *** gyee has joined #openstack-keystone | 19:46 | |
| *** gokrokve_ has quit IRC | 19:57 | |
| *** erecio has quit IRC | 20:03 | |
| *** erecio has joined #openstack-keystone | 20:09 | |
| *** dolphm changes topic to "Keystone hackathon RSVP https://docs.google.com/forms/d/1TlJ2u1ucxpia0SkWbkRo-_5DmVfXEQG7GKYVLc9abfc/viewform?usp=send_form | Review Specifications: https://review.openstack.org/#/q/status:open+project:openstack/keystone-specs,n,z" | 20:13 | |
| dolphm | ayoung, bknudson, dstanek, jamielennox, morganfainberg, stevemar, gyee, henrynash, topol, marekd, lbragstad, joesavak, shardy, fabiog, fmarco76, nkinder, lloydm, shrekuma, ksavich: keystone hackathon RSVP https://docs.google.com/forms/d/1TlJ2u1ucxpia0SkWbkRo-_5DmVfXEQG7GKYVLc9abfc/viewform?usp=send_form | 20:16 |
| dolphm | looking for an early headcount to make sure we have appropriate space and whatnot | 20:16 |
| lbragstad | nice survey :) | 20:17 |
| ayoung | Valencia is the hotel of choice, right? | 20:17 |
| gyee | dolphm, I like the choices :) | 20:18 |
| lbragstad | "I'm choosing this option because I am unable to disambiguate my opinion on the matter and I am generally a useless individual." needs to be on a shit | 20:18 |
| lbragstad | shirt** | 20:18 |
| lbragstad | that was suppose to be shirt... oops | 20:18 |
| gyee | lbragstad, nice going man! | 20:18 |
| * lbragstad hangs head | 20:19 | |
| ayoung | Who is Adam? | 20:19 |
| gyee | ^^^ | 20:19 |
| * ayoung goes back to looking for plane tickets. | 20:19 | |
| *** joesavak has joined #openstack-keystone | 20:19 | |
| dolphm | lbragstad: ++ | 20:20 |
| *** amerine has quit IRC | 20:20 | |
| *** richm1 has joined #openstack-keystone | 20:21 | |
| *** amerine has joined #openstack-keystone | 20:21 | |
| *** richm1 has left #openstack-keystone | 20:21 | |
| *** richm1 has joined #openstack-keystone | 20:24 | |
| stevemar | that is an awesome survey | 20:24 |
| *** richm1 has left #openstack-keystone | 20:24 | |
| *** andreaf has joined #openstack-keystone | 20:27 | |
| *** gokrokve has joined #openstack-keystone | 20:29 | |
| *** gokrokve has quit IRC | 20:34 | |
| *** jsavak has joined #openstack-keystone | 20:34 | |
| *** gokrokve has joined #openstack-keystone | 20:36 | |
| *** joesavak has quit IRC | 20:38 | |
| *** erecio has quit IRC | 20:38 | |
| *** joesavak has joined #openstack-keystone | 20:39 | |
| *** nkinder has quit IRC | 20:40 | |
| *** jsavak has quit IRC | 20:41 | |
| topol | dolphm, I have filled out your survey. Personally I view the who is ayoung question as a test. If you dont know Adam you should not be at the hackathon!!! | 20:44 |
| ayoung | topol, necessary but not sufficient | 20:44 |
| ayoung | too many people know me. | 20:44 |
| ayoung | many of whom you would not want to associate with | 20:45 |
| topol | ayoung, yes, so answering no is a huge red flag | 20:45 |
| ayoung | topol, might actually be an endorsement | 20:45 |
| ayoung | those people are untainted | 20:45 |
| ayoung | or liars | 20:45 |
| *** gokrokve has quit IRC | 20:47 | |
| *** marcoemorais1 has quit IRC | 20:47 | |
| *** marcoemorais has joined #openstack-keystone | 20:48 | |
| *** juanmo has quit IRC | 21:01 | |
| dolphm | ayoung: which group are you in? | 21:08 |
| *** joesavak has quit IRC | 21:10 | |
| ayoung | dolphm, that is one of those questions that Gödel used to prove his incompleteness theorems | 21:14 |
| morganfainberg | ayoung, "Waiting for Gödel?" | 21:16 |
| ayoung | "I'd never be a member of a club that would have me as a member." | 21:16 |
| *** andreaf has quit IRC | 21:17 | |
| *** sbfox has quit IRC | 21:18 | |
| dolphm | jdennis: did you see apevec's latest comment here? https://review.openstack.org/#/c/91883/ | 21:22 |
| jdennis | dolphm: yes I did and it's on my to-do list | 21:24 |
| *** topol has quit IRC | 21:30 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Initial implementation of validator https://review.openstack.org/86483 | 21:30 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Catalog V3 resources https://review.openstack.org/96266 | 21:31 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 21:31 |
| *** lbragstad has quit IRC | 21:34 | |
| *** stevemar has quit IRC | 21:36 | |
| *** nkinder has joined #openstack-keystone | 21:42 | |
| *** marekd is now known as marekd|away | 21:43 | |
| *** gokrokve has joined #openstack-keystone | 21:44 | |
| *** sbfox has joined #openstack-keystone | 21:45 | |
| *** hrybacki has joined #openstack-keystone | 21:46 | |
| *** rodrigods_ has joined #openstack-keystone | 21:48 | |
| *** dims__ has joined #openstack-keystone | 21:51 | |
| *** marcoemorais has quit IRC | 21:52 | |
| *** marcoemorais has joined #openstack-keystone | 21:52 | |
| *** dims_ has quit IRC | 21:53 | |
| *** rodrigods_ has quit IRC | 22:07 | |
| *** bknudson has quit IRC | 22:16 | |
| *** hrybacki has quit IRC | 22:18 | |
| *** marcoemorais has quit IRC | 22:22 | |
| *** marcoemorais has joined #openstack-keystone | 22:23 | |
| *** thedodd has quit IRC | 22:41 | |
| *** gordc has quit IRC | 22:52 | |
| *** jamielennox|away is now known as jamielennox | 22:54 | |
| *** amcrn has quit IRC | 23:03 | |
| *** rodrigods_ has joined #openstack-keystone | 23:04 | |
| morganfainberg | it's kinda quiet in here... | 23:05 |
| jamielennox | yep | 23:07 |
| jamielennox | love the hackfest survey | 23:07 |
| morganfainberg | hehe | 23:08 |
| jamielennox | though because i said 'no' (i don't have community spirit or some such) i didn't get to see the rest of the options without checking out the results page | 23:08 |
| morganfainberg | aw. | 23:08 |
| jamielennox | i feel my opinions on steak are still valid | 23:09 |
| morganfainberg | jamielennox, i dunno, did you eat steak whilst in the US or anywhere in the northern hemisphere? | 23:15 |
| morganfainberg | jamielennox, :P | 23:16 |
| jamielennox | umm, crap maybe i didn't | 23:16 |
| jamielennox | a whole lot of pizza | 23:16 |
| morganfainberg | jamielennox, maybe you've only ever had upsidedown steak then :P | 23:17 |
| morganfainberg | how do you know if you'd like it flipped the other way | 23:17 |
| jamielennox | that's true - it's probably crap | 23:17 |
| *** rodrigods_ has quit IRC | 23:17 | |
| morganfainberg | it's kindof like how the water spins the opposite direction down the drain around you <MORBO>CORIOLIS EFFECT DOES NOT WORK THAT WAY</MORBO> | 23:18 |
| * morganfainberg stops giving incorrect science lessons in #openstack-keystone | 23:19 | |
| *** rodrigods_ has joined #openstack-keystone | 23:19 | |
| *** praneshp has quit IRC | 23:20 | |
| *** praneshp has joined #openstack-keystone | 23:22 | |
| *** sbfox has quit IRC | 23:23 | |
| *** radez_g0n3 is now known as radez | 23:24 | |
| jamielennox | morganfainberg: easy one: https://review.openstack.org/#/c/93839/ | 23:28 |
| jamielennox | (not mine) | 23:28 |
| morganfainberg | jamielennox, fwiw, not approving anything with the gate as backed up as it is | 23:28 |
| morganfainberg | happy to review though | 23:28 |
| jamielennox | i though they fixed that? | 23:29 |
| morganfainberg | i think they did fix it some, but we're still ~120+ deep and a bunch of patches runnin 35+hrs | 23:29 |
| jamielennox | morganfainberg: don't worry about it then - it had sat there for a long time unreviewed and it was an easy +A | 23:29 |
| jamielennox | dam | 23:29 |
| morganfainberg | i was going to opt to give it some time to run the queue before stacking more on. | 23:29 |
| jamielennox | n | 23:29 |
| morganfainberg | http://status.openstack.org/zuul/ | 23:30 |
| jamielennox | i wasn't working yesterday but we had that problem tuesday and then it caught up | 23:30 |
| morganfainberg | yeah its not pretty atm. | 23:30 |
| *** rodrigods_ has quit IRC | 23:30 | |
| jamielennox | i'm guessing it's just because there are so many recheck errors, at least 50% of my patches have been failing for some transient bug | 23:31 |
| morganfainberg | yep | 23:31 |
| morganfainberg | that is the case | 23:31 |
| morganfainberg | jamielennox, here is the top of the thread about it http://lists.openstack.org/pipermail/openstack-dev/2014-June/036810.html | 23:32 |
| *** marcoemorais has quit IRC | 23:33 | |
| *** marcoemorais has joined #openstack-keystone | 23:33 | |
| morganfainberg | and yeah it's still racing pretty badly | 23:35 |
| morganfainberg | so, approving new stuffs = no-so-good | 23:35 |
| jamielennox | so i conclude we are blaming HP cloud | 23:37 |
| morganfainberg | not really, it was partially because of the move | 23:38 |
| morganfainberg | but also because we have a lot of race bugs | 23:38 |
| morganfainberg | and they've all stacked up | 23:38 |
| morganfainberg | w/o the race bugs, this wouldn't have exploded | 23:38 |
| morganfainberg | without the cloud change... it would have exploded less violently | 23:38 |
| jamielennox | i always forget a </sarcasm> | 23:38 |
| morganfainberg | hah, sarcasm via text is hard to catch sometimes | 23:39 |
| morganfainberg | for https://review.openstack.org/#/c/93839/ did you want to just verify it was called | 23:39 |
| morganfainberg | or that it was called once | 23:39 |
| morganfainberg | because it's possible to verify the number of times it was called | 23:39 |
| morganfainberg | s/you/the design is/ | 23:39 |
| jamielennox | it's not mine, assert_called_once() doesn't exist so it was returning a magicmock and not testing anything | 23:40 |
| morganfainberg | right | 23:40 |
| morganfainberg | my question is - do we want to make sure the mocked thing is only called once? | 23:40 |
| jamielennox | there's an assert_called_once_with - but there are so many arguments passed that it's not worth checking them all | 23:40 |
| morganfainberg | or just make sure it was called | 23:40 |
| jamielennox | his patch #1 just check called - i said a more direct translation from the old was to check once - i don't think it matters | 23:41 |
| jamielennox | i +2ed the first patch as well with the comment | 23:41 |
| morganfainberg | jamielennox, http://www.voidspace.org.uk/python/mock/mock.html#mock.Mock.call_count | 23:42 |
| morganfainberg | jamielennox, i was just curious what the intent of the original test was | 23:42 |
| morganfainberg | it's not clear if it really should be called once or... | 23:42 |
| jamielennox | i don't know - but the original had a _once so i'm assuming the intention was to check it was 1 | 23:42 |
| jamielennox | another chunk of code i'd love to move out | 23:43 |
| morganfainberg | *shrug* | 23:51 |
| *** ozialien has quit IRC | 23:51 | |
| * morganfainberg needs coffee :( | 23:51 | |
| *** stevemar has joined #openstack-keystone | 23:52 | |
| *** stevemar2 has joined #openstack-keystone | 23:52 | |
| *** stevemar3 has joined #openstack-keystone | 23:54 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!