| morganfainberg | perhaps need to pass a sanitized data structure in? | 00:00 |
|---|---|---|
| morganfainberg | no i don't like that | 00:00 |
| jamielennox | morganfainberg: that's passing two structures | 00:01 |
| morganfainberg | like i said don't like that | 00:02 |
| jamielennox | yea, i had come up with that one as well | 00:02 |
| jamielennox | also had the idea of passing regexps | 00:02 |
| morganfainberg | ick | 00:02 |
| jamielennox | could do more precise than regexp because you know the sensitive data at that point so you could exact match - but still nasty | 00:03 |
| morganfainberg | is serialization expected to be handled at the HTTPClient object or above it? | 00:06 |
| *** gokrokve has quit IRC | 00:08 | |
| *** bknudson has joined #openstack-keystone | 00:08 | |
| jamielennox | morganfainberg: depends on usage | 00:08 |
| jamielennox | either | 00:08 |
| morganfainberg | hmm. | 00:09 |
| morganfainberg | wonder if we can force auth requests to always serialize in HTTPClient | 00:09 |
| morganfainberg | or maybe HTTPClient should be the only place we serialize | 00:09 |
| morganfainberg | if youwant something other than JSON give me a serializer | 00:09 |
| morganfainberg | then we could log(sanatize+serialize) and emit(serialize) | 00:10 |
| jamielennox | even then though we can only test certain things | 00:11 |
| jamielennox | like we can say if a field exists called ['access']['user']['password'] then strip it out | 00:12 |
| jamielennox | that handles v2 password auth | 00:12 |
| jamielennox | do we need a way to push that information back towards the plugin? | 00:13 |
| jamielennox | the problem with all of this is can someone with a logging.conf file just get around it | 00:14 |
| morganfainberg | depends on if we log it at all | 00:14 |
| morganfainberg | if we just don't ever log certain things - we should be safe | 00:15 |
| morganfainberg | maybe sanitized data really is always ***SECURE DATA*** (or whatever) even if you're in DEBUG or TRACE | 00:15 |
| morganfainberg | we can control what our auth plugins log | 00:15 |
| jamielennox | so i'm looking at custom formatters and filters, but i guess you could get around that with specially crafted configs | 00:15 |
| jamielennox | but at which point you could get around it simply by editting the python code | 00:16 |
| jamielennox | or wireshark | 00:16 |
| morganfainberg | if someone makes a dumb plugin that logs everything i don't know if we should care besides a fat warning saying "DONT LOG SECURE DATA" as a docstring | 00:16 |
| morganfainberg | wireshark is a higher level of effort | 00:16 |
| morganfainberg | you need to be able to open a net device directly | 00:16 |
| morganfainberg | and editing the python code, again extra level of effort (usually requires elevated perms o the local system) | 00:17 |
| morganfainberg | this is to eliminate centralized logging from having this data / log files that might be visible to low priv users | 00:17 |
| morganfainberg | if you can edit python code or open a netdevice for snooping - i'm willing to give you secure data. likely... you have root already | 00:18 |
| morganfainberg | root is outside our control. | 00:18 |
| jamielennox | same thing could e set about a logging.conf file | 00:18 |
| morganfainberg | no because logging.conf could expose information to lower priv users | 00:18 |
| morganfainberg | thing logstash or centralized syslogging | 00:19 |
| morganfainberg | turning on debug logging shouldn't expose secure data to the low priv users. logging.conf falls into that category | 00:19 |
| *** gokrokve has joined #openstack-keystone | 00:34 | |
| *** ncoghlan_afk is now known as ncoghlan | 00:38 | |
| *** kun_huang has joined #openstack-keystone | 00:45 | |
| ayoung | jamielennox, RevokeEvent itself is not an API, and is instead a domain model class, so it does not belong in the V3 tree | 00:45 |
| *** xianghui has joined #openstack-keystone | 00:46 | |
| *** kun_huang has quit IRC | 00:47 | |
| *** dstanek_zzz is now known as dstanek | 00:49 | |
| *** diegows has quit IRC | 00:51 | |
| gyee | ayoung, remember that AD is not LDAP talk at the summit? | 00:56 |
| gyee | there were some out of tree code, do you happen to remember the url? | 00:56 |
| ayoung | gyee, there was no out of tree code, just some work I should do to deal with the differences between DN and filter based user lookups | 00:58 |
| gyee | ayoung, k, I thought they had to do something to write to AD | 00:59 |
| gyee | maybe I remember it wrong | 00:59 |
| ayoung | nah, AD is still read only, with writes going to SQL only | 00:59 |
| ayoung | AD does == LDAP, it just is a very persnickety LDAP | 01:00 |
| ayoung | we need Henrynash's patch to land | 01:00 |
| gyee | yeah, I remember they had to create the service account there, but I wasn't sure it was done via the LDAP driver | 01:00 |
| *** ncoghlan is now known as ncoghlan_afk | 01:00 | |
| gyee | service accounts I mean | 01:01 |
| *** amerine has quit IRC | 01:01 | |
| jamielennox | morganfainberg: is it sufficient to just add a bool? log_request and if it's false then i'll just log ***SENSITIVE REQUEST EXCLUDED*** | 01:05 |
| *** kun_huang has joined #openstack-keystone | 01:05 | |
| jamielennox | you loose access to all the other parts of the rquest you might care about | 01:05 |
| *** gyee has quit IRC | 01:08 | |
| *** ncoghlan_afk is now known as ncoghlan | 01:10 | |
| *** mberlin1 has joined #openstack-keystone | 01:10 | |
| *** mberlin has quit IRC | 01:12 | |
| *** sbfox has joined #openstack-keystone | 01:15 | |
| *** dstanek is now known as dstanek_zzz | 01:26 | |
| *** amerine has joined #openstack-keystone | 01:26 | |
| ayoung | jamielennox, morganfainberg if one of you two have the cojones to +2 https://review.openstack.org/#/c/74214/14 I will pull the trigger on it | 01:29 |
| *** dstanek_zzz is now known as dstanek | 01:29 | |
| ayoung | dstanek, ^^ goes for you, too | 01:30 |
| *** wwriverrat has quit IRC | 01:30 | |
| *** kun_huang has quit IRC | 01:31 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/99076 | 01:32 |
| *** dims__ has quit IRC | 01:35 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/96265 | 01:37 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Refactor auth_token token cache members to class https://review.openstack.org/97109 | 01:53 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Refactor auth_token revocation list members to new class https://review.openstack.org/97127 | 01:53 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Refactor auth_token, move identity server members to class https://review.openstack.org/97124 | 01:53 |
| *** amerine has quit IRC | 01:55 | |
| jamielennox | ayoung: not me, i've spent almost no time server side since the summit to know what's happening there | 01:56 |
| ayoung | chicken | 01:57 |
| jamielennox | probably | 01:57 |
| ayoung | jamielennox, heh | 01:57 |
| *** PritiDesai has joined #openstack-keystone | 01:57 | |
| ayoung | gah ! https://review.openstack.org/#/c/95989/ gyee you don;t need a flipping wiki. This is the auth plugin framework that YOU WROTE | 01:58 |
| ayoung | and I know he's not here | 01:58 |
| jamielennox | ayoung: why not just always raise and catch | 02:00 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Kerberos as method name https://review.openstack.org/95989 | 02:00 |
| jamielennox | people go to great lengths to not do a try/catch and i don't et it | 02:00 |
| ayoung | jamielennox, where? | 02:01 |
| jamielennox | https://review.openstack.org/#/c/95989/3/keystone/auth/controllers.py | 02:01 |
| ayoung | jamielennox, ah...yeah, I could do that, too. In this case, it is because I assume that this will become the hot path. | 02:02 |
| ayoung | The raise is actually spurious at this point, as I just want to see if the thing is in the list | 02:02 |
| jamielennox | i thought python was fine for exceptions | 02:02 |
| ayoung | I'm OK either way... | 02:02 |
| ayoung | want me to redo it? | 02:03 |
| jamielennox | ruby i know i was told off for using too many exceptions apparently it's a lot slower | 02:03 |
| jamielennox | meh - i was just wondering | 02:03 |
| ayoung | Actually, that one might look cleaner without.. | 02:03 |
| ayoung | let me try | 02:03 |
| jamielennox | even the get_auth_method function there really should be done with a try/ecxept | 02:04 |
| *** sbfox has quit IRC | 02:05 | |
| ayoung | jamielennox, I like it better with the try | 02:06 |
| ayoung | running the tests and I'll repost | 02:06 |
| *** xianghui has quit IRC | 02:08 | |
| ayoung | jamielennox, btw, I go the space on the dreamhost beta | 02:10 |
| ayoung | I've got an ipa server up and running, but I need to straighten out some DNS issues | 02:11 |
| *** dstanek is now known as dstanek_zzz | 02:11 | |
| jamielennox | ayoung: the one you want to use for devstack deploys? proper DNS address? | 02:12 |
| ayoung | so, the issue is that the ipa server is running inside the cloud, and gets a local IP address for all of the hosts | 02:12 |
| *** dstanek_zzz is now known as dstanek | 02:12 | |
| jamielennox | ayoung: easy review: https://review.openstack.org/#/c/97679/2 | 02:12 |
| ayoung | I want the "good" name to link to the floating IP | 02:12 |
| jamielennox | hmm, can you do that? | 02:13 |
| jamielennox | i see designate has applied for incubation - but even then? | 02:13 |
| ayoung | I had something working in the past | 02:13 |
| ayoung | I know that there is a hack to Kerberos | 02:14 |
| ayoung | found a really nasty bug, too | 02:14 |
| ayoung | ipa-server-install was rewriting sshd_config into an invalid format, and systemd refused to run it | 02:14 |
| jamielennox | how did that not get found? | 02:15 |
| ayoung | https://fedorahosted.org/freeipa/ticket/3961 | 02:16 |
| ayoung | jamielennox, I suspect that it is something about Fedora 20 that changed | 02:16 |
| ayoung | F20 installs worked fine before | 02:17 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Kerberos as method name https://review.openstack.org/95989 | 02:18 |
| ayoung | jamielennox, https://review.openstack.org/#/c/95989/5/keystone/auth/controllers.py,cm I like that a lot better | 02:19 |
| jamielennox | cool | 02:20 |
| jamielennox | now you want me to review the rest right | 02:20 |
| *** xianghui has joined #openstack-keystone | 02:21 | |
| jamielennox | looks easy enough, where does REMOTE_DOMAIN usually come from? | 02:22 |
| jamielennox | also you know you're going to get asked for tests | 02:23 |
| *** richm has quit IRC | 02:30 | |
| *** browne has quit IRC | 02:34 | |
| jamielennox | ayoung: taking that 2nd +2 on https://review.openstack.org/#/c/97679/2 as +A | 02:44 |
| ayoung | ++ | 02:46 |
| ayoung | jamielennox, you already reviewed the Kerb patch once, and I made the changes you suggested | 02:46 |
| ayoung | check for negotiate as the auth_type | 02:46 |
| jamielennox | ayoung: yep - looks good | 02:47 |
| jamielennox | i assume it works with jose's patch - i don't really have an environment to test it on right now | 02:48 |
| ayoung | jamielennox I think that is the only server side change that dpal is going to care about. So long as we can have a Kerberos story | 02:48 |
| ayoung | It basically is Jose's approach. It works with his client code | 02:48 |
| jamielennox | yea, i figured as much | 02:49 |
| *** PritiDesai has quit IRC | 02:55 | |
| *** Abhijeet_ has joined #openstack-keystone | 03:01 | |
| *** nsquare has quit IRC | 03:03 | |
| *** browne has joined #openstack-keystone | 03:04 | |
| *** browne has quit IRC | 03:05 | |
| *** PritiDesai has joined #openstack-keystone | 03:09 | |
| *** sbfox has joined #openstack-keystone | 03:10 | |
| *** sbfox has quit IRC | 03:12 | |
| *** ncoghlan is now known as ncoghlan_afk | 03:21 | |
| *** pheadron has joined #openstack-keystone | 03:22 | |
| pheadron | hey morganfainberg | 03:22 |
| *** ncoghlan_afk is now known as ncoghlan | 03:24 | |
| *** harlowja is now known as harlowja_away | 03:24 | |
| dstanek | ayoung: i'm going to mess with https://review.openstack.org/#/c/92137 a little and fix the style issues I commented on | 03:25 |
| *** PritiDesai has quit IRC | 03:27 | |
| *** gokrokve has quit IRC | 03:30 | |
| stevemar | dstanek, already cleaning things up | 03:35 |
| *** gokrokve has joined #openstack-keystone | 03:42 | |
| *** gokrokve has quit IRC | 03:43 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Basic-Auth middleware https://review.openstack.org/92137 | 03:44 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Basic-Auth middleware https://review.openstack.org/92137 | 03:45 |
| dstanek | stevemar: too late :-( just finished a first round | 03:48 |
| stevemar | dstanek, nice changes :) | 03:49 |
| dstanek | stevemar: it was all just simple stuff and adding a few tests | 03:52 |
| stevemar | dstanek, i had some comments | 03:56 |
| dstanek | stevemar: yeah, i wanted to ask ayoung about that - i was going to remove the domain_id stuff because the default will be the default id anyway | 04:12 |
| dstanek | but i didn't know if he had other plans | 04:12 |
| stevemar | dstanek, yeah, figured it might be possible, i dunno. just remarked on it anyway | 04:17 |
| *** sbfox has joined #openstack-keystone | 04:20 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Basic-Auth middleware https://review.openstack.org/92137 | 04:20 |
| *** praneshp has quit IRC | 04:25 | |
| dstanek | so when will XML actually go away? | 04:30 |
| dstanek | our API i mean - i have no hope for the rest of the world | 04:30 |
| *** gokrokve has joined #openstack-keystone | 04:34 | |
| *** henrynash has joined #openstack-keystone | 04:41 | |
| *** gokrokve has quit IRC | 04:42 | |
| *** sbfox has quit IRC | 04:44 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:44 | |
| *** praneshp has joined #openstack-keystone | 04:51 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:56 | |
| *** praneshp_ has joined #openstack-keystone | 04:56 | |
| *** praneshp has quit IRC | 04:58 | |
| *** praneshp_ is now known as praneshp | 04:58 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:59 | |
| *** hrybacki has quit IRC | 05:00 | |
| *** nsquare has joined #openstack-keystone | 05:10 | |
| morganfainberg | dstanek, stevemar, you guys here? | 05:11 |
| stevemar | morganfainberg, maybe | 05:11 |
| morganfainberg | stevemar, need a quick pair of eyes on https://review.openstack.org/#/c/74214/28 (ok not so quick), I'm doing a once-over before I +2/+A | 05:11 |
| morganfainberg | but it's a big patch | 05:12 |
| morganfainberg | maybe it needs to wait :( | 05:12 |
| *** gokrokve has joined #openstack-keystone | 05:12 | |
| dstanek | morganfainberg: nope | 05:13 |
| dstanek | morganfainberg: i'm still in the middle of it - i found lots of stuff that we can fix after the fact | 05:14 |
| stevemar | morganfainberg, uhh that one | 05:14 |
| morganfainberg | dstanek, yeah that is where i was - but it;s huge, so extra eyes = better imo | 05:15 |
| stevemar | its so massive | 05:15 |
| *** gokrokve_ has joined #openstack-keystone | 05:15 | |
| *** ajayaa has joined #openstack-keystone | 05:15 | |
| stevemar | and hitting everything | 05:15 |
| morganfainberg | dstanek, i'm seeing some "we should fix this...but... doesn't need to be fixed here" | 05:15 |
| morganfainberg | and by waiting, i was thinking of waiting until tomorrow morning :P | 05:16 |
| dstanek | morganfainberg: what i'm not liking about this patch is that it is huge and impacts lots of stuff | 05:16 |
| morganfainberg | dstanek, yeah. | 05:17 |
| *** gokrokve has quit IRC | 05:17 | |
| morganfainberg | dstanek, i really would have rather seen scaffolding for doing the mappoing (backend) and then a patch that makes everything use it | 05:17 |
| morganfainberg | at leas that would be easier to digest | 05:17 |
| dstanek | earlier i heard that we should get it in because it would allow people to use an "experimental" feature and get feedback, but this really does muck with lots of existing code | 05:17 |
| morganfainberg | i've reviewed this a bunch of times. i feel like its pretty good... | 05:18 |
| morganfainberg | but... | 05:18 |
| morganfainberg | meh i'm gonna wait till morning, fresh eyes | 05:18 |
| morganfainberg | if it's not gating i'll weigh in | 05:18 |
| morganfainberg | dstanek, if you think it's good enough to go, don't hesitate to +A on my not wanting to look till morning | 05:19 |
| morganfainberg | dstanek, but if you're not comfortable i'll take a look at everything in the morning before making a call on it | 05:19 |
| morganfainberg | (unless there is a legitimate reason to -1 ni your view) | 05:20 |
| morganfainberg | on that happy note... g'night :) | 05:20 |
| *** sbfox has joined #openstack-keystone | 05:20 | |
| stevemar | is hashlib standard? | 05:20 |
| morganfainberg | stevemar, yeah | 05:20 |
| stevemar | k | 05:20 |
| dstanek | morganfainberg: i just don't understand the implications of messing with domain awareness | 05:20 |
| morganfainberg | at least... i think it is. | 05:20 |
| dstanek | yeah, it is | 05:20 |
| morganfainberg | dstanek, want to talk through it all tomorrow morning 1st thing? | 05:21 |
| morganfainberg | dstanek, i did a bunch of work on this code in havana so i know most of what it's trying to accomplish | 05:21 |
| dstanek | morganfainberg: sure, ping me when you're up | 05:21 |
| morganfainberg | i'll be up around 6:30am pacific. | 05:21 |
| morganfainberg | so, uhm... 8:30 (your central right?) your time | 05:21 |
| dstanek | morganfainberg: no eastern - 9:30 | 05:22 |
| morganfainberg | ah ok well then | 05:22 |
| morganfainberg | i'll catch ya 9:30 -> 10ish | 05:22 |
| morganfainberg | your time | 05:22 |
| dstanek | sounds good | 05:22 |
| *** pheadron has quit IRC | 05:36 | |
| *** amerine has joined #openstack-keystone | 05:42 | |
| *** gokrokve_ has quit IRC | 05:55 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/97005 | 06:00 |
| *** praneshp has quit IRC | 06:20 | |
| *** praneshp has joined #openstack-keystone | 06:23 | |
| *** jaosorior has joined #openstack-keystone | 06:23 | |
| *** ncoghlan_afk is now known as ncoghlan | 06:26 | |
| *** gokrokve has joined #openstack-keystone | 06:36 | |
| openstackgerrit | Andre Naehring proposed a change to openstack/keystone: Add information regarding HTTPS for SSL enabled endpoints https://review.openstack.org/99278 | 06:37 |
| *** zhiyan_ is now known as zhiyan | 06:37 | |
| *** stevemar has quit IRC | 06:39 | |
| *** gokrokve has quit IRC | 06:41 | |
| openstackgerrit | A change was merged to openstack/keystone: add docs on v2 & v3 support in the service catalog https://review.openstack.org/99075 | 06:44 |
| *** ncoghlan is now known as ncoghlan_afk | 06:51 | |
| *** ajayaa has quit IRC | 06:59 | |
| *** BAKfr has joined #openstack-keystone | 07:11 | |
| *** dstanek is now known as dstanek_zzz | 07:15 | |
| *** xianghui has quit IRC | 07:16 | |
| *** xianghui has joined #openstack-keystone | 07:20 | |
| *** praneshp has quit IRC | 07:24 | |
| *** ncoghlan_afk is now known as ncoghlan | 07:26 | |
| *** leseb has joined #openstack-keystone | 07:26 | |
| *** ajayaa has joined #openstack-keystone | 07:28 | |
| *** ajayaa has quit IRC | 07:33 | |
| *** gokrokve has joined #openstack-keystone | 07:35 | |
| *** gokrokve_ has joined #openstack-keystone | 07:37 | |
| *** dstanek_zzz is now known as dstanek | 07:37 | |
| *** gokrokve has quit IRC | 07:40 | |
| *** gokrokve_ has quit IRC | 07:41 | |
| marekd|away | jamielennox: is your question still actual regarding the comment on the patchset? | 07:43 |
| *** marekd|away is now known as marekd | 07:43 | |
| *** dstanek is now known as dstanek_zzz | 07:47 | |
| *** sbfox has quit IRC | 07:59 | |
| *** ncoghlan has quit IRC | 08:12 | |
| *** Abhijeet__ has joined #openstack-keystone | 08:18 | |
| *** Abhijeet_ has quit IRC | 08:21 | |
| *** nsquare has quit IRC | 08:25 | |
| *** Abhi_ has joined #openstack-keystone | 08:33 | |
| *** Abhijeet__ has quit IRC | 08:35 | |
| *** gokrokve has joined #openstack-keystone | 08:36 | |
| *** dstanek_zzz is now known as dstanek | 08:37 | |
| *** gokrokve has quit IRC | 08:41 | |
| *** Abhijeet_ has joined #openstack-keystone | 08:45 | |
| *** Abhi_ has quit IRC | 08:47 | |
| *** dstanek is now known as dstanek_zzz | 08:47 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Implement SAML2 ECP authentication https://review.openstack.org/92166 | 08:51 |
| *** Abhijeet_ has quit IRC | 08:59 | |
| *** gokrokve has joined #openstack-keystone | 09:36 | |
| *** dstanek_zzz is now known as dstanek | 09:38 | |
| *** gokrokve has quit IRC | 09:41 | |
| openstackgerrit | Andre Naehring proposed a change to openstack/python-keystoneclient: Added help text for the debug option https://review.openstack.org/99312 | 09:47 |
| *** dstanek is now known as dstanek_zzz | 09:48 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Implement SAML2 ECP authentication https://review.openstack.org/92166 | 09:50 |
| *** rodrigods has joined #openstack-keystone | 09:52 | |
| *** rodrigods has quit IRC | 09:52 | |
| *** rodrigods has joined #openstack-keystone | 09:52 | |
| *** rodrigods has quit IRC | 09:55 | |
| *** zhiyan is now known as zhiyan_ | 10:00 | |
| *** zhiyan_ is now known as zhiyan | 10:03 | |
| *** zhiyan is now known as zhiyan_ | 10:28 | |
| *** gokrokve has joined #openstack-keystone | 10:36 | |
| *** dstanek_zzz is now known as dstanek | 10:39 | |
| *** gokrokve has quit IRC | 10:41 | |
| *** dstanek is now known as dstanek_zzz | 10:49 | |
| *** dims__ has joined #openstack-keystone | 11:01 | |
| *** ericvw has quit IRC | 11:06 | |
| *** ericvw has joined #openstack-keystone | 11:08 | |
| *** dtroyer_zz has joined #openstack-keystone | 11:10 | |
| *** afazekas is now known as __afazekas | 11:10 | |
| *** rwsu_ has joined #openstack-keystone | 11:13 | |
| *** dtroyer has quit IRC | 11:14 | |
| *** rwsu has quit IRC | 11:14 | |
| *** jaosorior has quit IRC | 11:14 | |
| *** jaosorior has joined #openstack-keystone | 11:15 | |
| *** mfisch has quit IRC | 11:25 | |
| *** mfisch has joined #openstack-keystone | 11:26 | |
| *** mfisch has quit IRC | 11:27 | |
| *** mfisch has joined #openstack-keystone | 11:27 | |
| *** gokrokve has joined #openstack-keystone | 11:36 | |
| *** dstanek_zzz is now known as dstanek | 11:40 | |
| *** gokrokve has quit IRC | 11:41 | |
| *** diegows has joined #openstack-keystone | 11:41 | |
| *** rodrigods has joined #openstack-keystone | 11:48 | |
| *** rodrigods has joined #openstack-keystone | 11:48 | |
| *** dstanek is now known as dstanek_zzz | 11:50 | |
| *** hrybacki has joined #openstack-keystone | 11:52 | |
| *** anteaya has quit IRC | 11:58 | |
| *** erecio has quit IRC | 12:05 | |
| *** openstackgerrit_ has joined #openstack-keystone | 12:05 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/identity-api: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/60489 | 12:05 |
| *** afazekas has joined #openstack-keystone | 12:07 | |
| *** erecio has joined #openstack-keystone | 12:09 | |
| *** NM has joined #openstack-keystone | 12:13 | |
| *** diegows has quit IRC | 12:13 | |
| *** erecio has quit IRC | 12:15 | |
| *** leseb_ has joined #openstack-keystone | 12:17 | |
| *** leseb has quit IRC | 12:19 | |
| *** leseb_ has quit IRC | 12:21 | |
| *** dims__ has quit IRC | 12:29 | |
| *** gokrokve has joined #openstack-keystone | 12:36 | |
| *** dims__ has joined #openstack-keystone | 12:36 | |
| *** oomichi_ has joined #openstack-keystone | 12:40 | |
| *** anteaya has joined #openstack-keystone | 12:40 | |
| *** dstanek_zzz is now known as dstanek | 12:41 | |
| *** gokrokve has quit IRC | 12:41 | |
| *** oomichi has quit IRC | 12:41 | |
| *** lbragstad has joined #openstack-keystone | 12:46 | |
| *** oomichi_ is now known as oomichi_sleeping | 12:47 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Implement SAML2 ECP authentication https://review.openstack.org/92166 | 12:48 |
| *** dstanek is now known as dstanek_zzz | 12:51 | |
| *** joesavak has quit IRC | 12:51 | |
| *** joesavak has joined #openstack-keystone | 12:52 | |
| *** leseb has joined #openstack-keystone | 12:56 | |
| *** jraim has quit IRC | 13:00 | |
| *** zhiyan_ is now known as zhiyan | 13:00 | |
| *** gordc has joined #openstack-keystone | 13:01 | |
| *** jraim has joined #openstack-keystone | 13:01 | |
| *** jsavak has joined #openstack-keystone | 13:03 | |
| *** dstanek_zzz is now known as dstanek | 13:03 | |
| *** radez_g0n3 is now known as radez | 13:09 | |
| *** nkinder has quit IRC | 13:11 | |
| *** jraim has quit IRC | 13:15 | |
| *** jraim has joined #openstack-keystone | 13:17 | |
| *** gordc has quit IRC | 13:25 | |
| *** rushiagr is now known as rushi | 13:25 | |
| *** xianghui has quit IRC | 13:29 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Implement SAML2 ECP authentication https://review.openstack.org/92166 | 13:30 |
| *** xianghui has joined #openstack-keystone | 13:30 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Implement SAML2 ECP authentication https://review.openstack.org/92166 | 13:34 |
| *** gokrokve has joined #openstack-keystone | 13:36 | |
| *** bknudson has quit IRC | 13:39 | |
| *** gokrokve has quit IRC | 13:41 | |
| *** stevemar has joined #openstack-keystone | 13:45 | |
| *** afaranha has joined #openstack-keystone | 13:52 | |
| *** daneyon has joined #openstack-keystone | 13:52 | |
| *** bknudson has joined #openstack-keystone | 13:56 | |
| *** nkinder has joined #openstack-keystone | 13:58 | |
| *** bklei has joined #openstack-keystone | 13:59 | |
| *** daneyon_ has joined #openstack-keystone | 13:59 | |
| *** bklei has quit IRC | 13:59 | |
| *** bklei has joined #openstack-keystone | 14:00 | |
| *** daneyon has quit IRC | 14:01 | |
| *** DuncanT- has left #openstack-keystone | 14:03 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/identity-api: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/60489 | 14:04 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Add service_name to URL discovery https://review.openstack.org/97679 | 14:17 |
| henrynash | morganfainberg, dstanek: any new thoughts on the multi-backend-uuid patch? | 14:22 |
| *** gokrokve has joined #openstack-keystone | 14:24 | |
| *** gokrokve_ has joined #openstack-keystone | 14:25 | |
| *** zhiyan is now known as zhiyan_ | 14:26 | |
| *** gokrokve has quit IRC | 14:28 | |
| *** gordc has joined #openstack-keystone | 14:29 | |
| dstanek | henrynash: no, i created a few patches on top to fix my style nits | 14:29 |
| morganfainberg | dstanek, hi | 14:29 |
| dstanek | henrynash: i also started to break it up into 3 smaller patches so i would understand it better :-) | 14:29 |
| dstanek | morganfainberg: hey | 14:29 |
| morganfainberg | ah so you've gotten through it yourself then | 14:30 |
| dstanek | morganfainberg: yes, but i don't really grok the side effects of moving/removing some to the domain handling code | 14:31 |
| dstanek | henrynash: just published a few comments | 14:32 |
| henrynash | dstanek: so the domain handling code represents the old “let’s try and guess which domain this user/group cmd is aimed at” | 14:32 |
| morganfainberg | dstanek, most of the old domain handling code is not really usable becasue of the name conflicts | 14:32 |
| morganfainberg | henrynash, ++ | 14:33 |
| dstanek | henrynash: are we no longer guessing? | 14:33 |
| henrynash | dstanek: no, we never guess any more….since mapping lookup gives us the domain | 14:34 |
| *** PritiDesai has joined #openstack-keystone | 14:34 | |
| *** leseb has quit IRC | 14:35 | |
| henrynash | dstanek: so basically all that gets removed, and then the idenity manager can determin which backend to sent the cmd to once it gets the domain from the mapping table | 14:35 |
| morganfainberg | you always know (based upon ID) what backend is used | 14:36 |
| morganfainberg | it's the whole point of the mapping table | 14:36 |
| morganfainberg | LDAP assignment is 1 domain only, right? | 14:36 |
| dstanek | but the mapping table isn't always used right? | 14:36 |
| morganfainberg | because that is the only thing that stood out to me as being odd, having a FK on domain.id | 14:36 |
| dstanek | what happens in old configurations? | 14:37 |
| morganfainberg | dstanek, in most cases, nothing changes. | 14:37 |
| morganfainberg | default domain (only really usable setup because of the bugs this addresses) can be used w/o mapping | 14:37 |
| openstackgerrit | Kristy Siu proposed a change to openstack/identity-api: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/60489 | 14:38 |
| morganfainberg | and SQL doesn't need the mapping | 14:38 |
| dstanek | morganfainberg: but the code is different and that's what i'm trying to understand | 14:38 |
| dstanek | for example, did these tests actually need to change? https://review.openstack.org/#/c/74214/28/keystone/tests/test_backend.py | 14:38 |
| morganfainberg | henrynash, ^ i defer to you, i think so, because you want to always be pulling from the default assignment driver in this case. | 14:39 |
| dstanek | morganfainberg: it that's the case is it backward compatible and in what cases is it not? | 14:40 |
| morganfainberg | dstanek, the only case it isn't backwards compatible is the old per-domain-identity backend | 14:41 |
| morganfainberg | dstanek, and that is because we used to guess based upon the user's token id what scope to use | 14:41 |
| morganfainberg | erm, token.domain_id | 14:41 |
| morganfainberg | dstanek, and that code in havana and icehouse would make all sorts of strange things occur | 14:42 |
| dstanek | what happens to those configurations after this patch? | 14:42 |
| morganfainberg | dstanek, well, they weren't really usable befroe | 14:42 |
| henrynash | the whole “guessing thing” was marked as experimental, so I don’t think we need to be baclward comaptibel with it | 14:42 |
| morganfainberg | if anyone tried to use it, you'd have a broken install | 14:42 |
| dstanek | gotcha | 14:42 |
| morganfainberg | you couldn't assign grants from one domain to the other across backends (for the most part) | 14:42 |
| henrynash | and as mrgan says, it never would work properly | 14:43 |
| henrynash | which you can now | 14:43 |
| morganfainberg | henrynash, now that i am awake... | 14:43 |
| henrynash | :-) | 14:43 |
| morganfainberg | henrynash, i'm going to do a once over on this again | 14:43 |
| morganfainberg | but i think... _think_ it looks good. | 14:44 |
| henrynash | morganfainberg: ok | 14:44 |
| morganfainberg | i'll ping you if I find anything major | 14:44 |
| morganfainberg | so we can roll up something (e.g. make this all "not work" | 14:44 |
| morganfainberg | if it's stylistic etc we can do post-merge | 14:45 |
| dstanek | i have no reason to block it, i just don't understand it enough to +2 it yet | 14:45 |
| morganfainberg | dstanek, keep asking questions :) | 14:45 |
| morganfainberg | please | 14:45 |
| morganfainberg | makes us who've dug around this think about it and expliain it better | 14:45 |
| dstanek | morganfainberg: i have 3 or 4 commits on top of this to fix the style issues | 14:45 |
| * morganfainberg nods. | 14:45 | |
| dstanek | last night i was too busy to look up the 'no rebase' flag on git-review | 14:46 |
| *** leseb has joined #openstack-keystone | 14:46 | |
| morganfainberg | hehe | 14:46 |
| henrynash | morganfainberg: I also have anotehr big commit on top of this which removes the assigment of a unique ID out of teh controller into the manager | 14:47 |
| bknudson | I always git-review -nvF if it's a single commit or -nvR if it's multiple commits and no rebase | 14:47 |
| henrynash | morganfainberg: small cahnge in real code, but very large set of mechanical changes to our unit tetss | 14:48 |
| morganfainberg | henrynash, ++ | 14:48 |
| dstanek | henrynash: you're killing me :-) | 14:48 |
| morganfainberg | henrynash, thanks for splitting that out. | 14:48 |
| morganfainberg | this is a beast to begin with | 14:48 |
| henrynash | morganfainberq: which is why I held that off | 14:48 |
| morganfainberg | bknudson, i'm going to split/recombine the non-persistence and token version specs up, make one a scaffolding spec since they have a common set of needs and then make non-persistence a smaller subset of work (that we can hold / look at as revocation events go in) | 14:49 |
| morganfainberg | bknudson, and same thing with expanding upon the token versions. | 14:49 |
| bknudson | morganfainberg: that sounds great | 14:49 |
| morganfainberg | bknudson, cool | 14:50 |
| *** richm has joined #openstack-keystone | 14:51 | |
| dolphm | is this actually a bug, or just misplaced expecatations? https://bugs.launchpad.net/python-keystoneclient/+bug/1328837 | 14:51 |
| uvirtbot | Launchpad bug 1328837 in python-keystoneclient "Cannot handle http(s)_proxy" [Undecided,New] | 14:51 |
| morganfainberg | dolphm, i think this is someone trying to use the debug CURL line | 14:53 |
| morganfainberg | oh | 14:53 |
| morganfainberg | uhm | 14:53 |
| bknudson | dolphm: seems like the bug is in the python lib, if it's using http_proxy when the port is 35357 | 14:53 |
| morganfainberg | yeah | 14:53 |
| bknudson | although I don't know how it's supposed to work. Not stuck behind a proxy | 14:53 |
| morganfainberg | the python lib doesn't do conditional proxy | 14:54 |
| morganfainberg | they have HTTP proxy for external connections, this isn't external | 14:55 |
| morganfainberg | so the env var said "go use this proxy" even though it wasn't correct to do so | 14:55 |
| dstanek | isn't that the expected behavior is the env var is set? | 14:56 |
| morganfainberg | dstanek, that would be what I'd expect | 14:56 |
| morganfainberg | hey use this proxy! "ok i'll use that proxy" | 14:56 |
| bknudson | there's probably a way to set up the proxy so that it works | 14:56 |
| morganfainberg | bknudson, using an auto proxy config? | 14:57 |
| morganfainberg | or some such | 14:57 |
| * morganfainberg hasn't tried that with curl or anything. | 14:57 | |
| morganfainberg | or urllib3 | 14:57 |
| dstanek | either way i think the bug is user error | 14:58 |
| bknudson | https://docs.python.org/2/library/urllib.html#urllib.urlopen -- mentions http_proxy, or ftp_proxy | 14:58 |
| bknudson | 'The no_proxy environment variable can be used to specify hosts which shouldn’t be reached via proxy' | 14:59 |
| *** PritiDesai has quit IRC | 14:59 | |
| dolphm | bknudson: that sounds like the best solution | 15:01 |
| dolphm | bknudson: will you comment on the bug and mark it invalid? | 15:01 |
| openstackgerrit | Kristy Siu proposed a change to openstack/identity-api: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/60489 | 15:01 |
| *** sbfox has joined #openstack-keystone | 15:09 | |
| ayoung | nkinder, you asked me about multiple signers. I think we can do that today with minimal changes. The keystone server code needs to remain unchanged, but the OS-SIMPLECERT just needs a way to return a separate list from those used to sign the certificate. It looks like the openssl verify command can handle having multiple certificates in a single file | 15:11 |
| morganfainberg | henrynash, ok comments posted, doing another pass before +2. | 15:12 |
| morganfainberg | henrynash, but the comments are what i found looking through everything | 15:12 |
| morganfainberg | henrynash, all are (for the most part) 'we fix later' | 15:13 |
| morganfainberg | i don't like defaulting to UUID mapping. | 15:13 |
| ayoung | if a token fails the verify call, we could check to see if we have an out of date set of certificates, and refetch. Need to avoid abuse, so some throttleing, but this should clear up a lot of the PKI misconfiguration problems | 15:14 |
| dstanek | henrynash: question about you local id comment when you have a sec | 15:17 |
| dstanek | morganfainberg: unless you know :-) | 15:17 |
| morganfainberg | dstanek, i can try and answer | 15:18 |
| dstanek | henrynash, morganfainberg: where does local id come from? https://review.openstack.org/#/c/74214/28/doc/source/configuration.rst | 15:18 |
| *** kun_huang has joined #openstack-keystone | 15:19 | |
| morganfainberg | in the case of LDAP, it would be the bit of the DN that is used to be the id, usually like CN | 15:19 |
| dstanek | is that just a configuration choice? like as an operator i'll use XYZ value from my LDAP server? | 15:19 |
| morganfainberg | so cn=morgan,ou=users,dc=example,dc=com | 15:19 |
| morganfainberg | the cn attribute might be chosen, therefore, "morgan" | 15:19 |
| morganfainberg | yeah | 15:19 |
| morganfainberg | when configuring keystone to talk to ldap, that is the case. | 15:19 |
| ayoung | heh, you are repeating my mistake | 15:20 |
| ayoung | I want to break that cn=morgan means append it to the rest to create the DN | 15:21 |
| ayoung | cn=morgan should work when the LDAP entry has cn=morgan. Dagnabit. | 15:21 |
| morganfainberg | ayoung, no that is the way it is done now, doesn't mean it is always the case | 15:21 |
| morganfainberg | ayoung, it could be configured as something else | 15:22 |
| morganfainberg | ayoung, it was a comment of how does it work now. | 15:22 |
| ayoung | yeah...I know...just one of my hot button topics | 15:22 |
| morganfainberg | >.> | 15:22 |
| morganfainberg | cn=ayoung ! | 15:22 |
| morganfainberg | <.< | 15:22 |
| morganfainberg | :) | 15:22 |
| ayoung | (*￣m￣) | 15:22 |
| dstanek | morganfainberg: maybe i need to re-read, but i thought local id was from the ref (in this case the user id) and that is something we generate with uuids...right? | 15:23 |
| morganfainberg | dstanek, only if we are doing R/W LDAP | 15:23 |
| morganfainberg | dstanek, if it's RO LDAP no, it's not UUID | 15:24 |
| morganfainberg | and SQL is obviously UUID based | 15:24 |
| dstanek | so if it's r/w ldap how would an operator get the local id? | 15:24 |
| dstanek | seems like a strange process that should be documented | 15:25 |
| morganfainberg | dstanek, look at the LDAP server i think - but in most cases if it's RW you're doing to use the compatible ids (default domain) | 15:25 |
| morganfainberg | i think we wanted to specify multi-ldap as the non-default domain was always R/O | 15:25 |
| morganfainberg | ayoung, ^? | 15:25 |
| morganfainberg | also henrynash, ^? | 15:26 |
| dstanek | morganfainberg: also what is used for the id in RO ldap? i don't know where in the code that is set | 15:26 |
| ayoung | morganfainberg, does dogtag currently have a file backed cache? | 15:26 |
| morganfainberg | ayoung, dogpile? yes. | 15:27 |
| morganfainberg | ayoung, dogtag... no idea | 15:27 |
| ayoung | morganfainberg, dogpile, yes. I'm dealing with certs, so some bleedover in my breain between terms. OK...I think the multiple-signing-cert solution just got much simpler | 15:27 |
| morganfainberg | dstanek, that is partof the [ldap] section of the config. | 15:27 |
| *** xianghui has quit IRC | 15:28 | |
| morganfainberg | ayoung, ayoung , http://dogpilecache.readthedocs.org/en/latest/api.html#file-backends | 15:28 |
| ayoung | morganfainberg, ah, but not a generic filesystem one? | 15:29 |
| morganfainberg | ayoung, nope. | 15:29 |
| dstanek | morganfainberg: yeah, i see user_id_attribute, but not where it is used | 15:29 |
| *** wwriverrat has joined #openstack-keystone | 15:29 | |
| ayoung | morganfainberg, that may be ok. I think what I need is for OS-SIMPLE cert to be split from the certificates used by Keystone to sign the tokens: signing should be one and only one, but OS-SIMPLECERT should manage a list of CA and signing certs | 15:30 |
| ayoung | I guess it really doesn't matter where they are stored. | 15:30 |
| *** wwriverrat has left #openstack-keystone | 15:30 | |
| ayoung | DBM might be the right solution | 15:30 |
| morganfainberg | dstanek, it is from the LDAP backend UserApi which inherits from ldap common and the _get_id method i think | 15:31 |
| morganfainberg | ayoung, it would be trival to create a dogpile backend the spit things out where key = filename, value = file contents | 15:31 |
| morganfainberg | ayoung, if you don't like DMB | 15:32 |
| morganfainberg | DBM | 15:32 |
| henrynash | morganfainberq, dstanek: so we are going to generate a public ID whether it’s RO or RW | 15:32 |
| ayoung | morganfainberg, the devil is in the locking | 15:32 |
| morganfainberg | henrynash, correct. | 15:32 |
| morganfainberg | ayoung, don't use flock on NFS backed systems :P | 15:32 |
| ayoung | morganfainberg, I think DBM might be a better solution. | 15:32 |
| morganfainberg | probably | 15:32 |
| henrynash | the only issue right now is that if we are creating the user via keystone into a RW LDAP, then teh public ID is a UUID always….I have a fix for this, but it’s in my later patch | 15:33 |
| morganfainberg | DBM handles multi-reader/writer better than filesystem (with shared files) | 15:33 |
| ayoung | morganfainberg, and, for NSS, It is close to the right semantics for managing an NSS database, too. But that would have to be a separate provider....future work any way. | 15:33 |
| morganfainberg | henrynash, i don't think i see any show-stoppers here | 15:33 |
| dstanek | henrynash: i'm just confused on how the local id is something that can be known | 15:33 |
| dstanek | henrynash: unless as it apprears it is just the user_id | 15:34 |
| henrynash | dstanek: what do you mean “known" | 15:34 |
| dstanek | henrynash: as an operator i would use it on the command line | 15:34 |
| morganfainberg | dstanek, the point is nothing except the mapping system should ever need to know the localid | 15:34 |
| henrynash | ahh | 15:34 |
| morganfainberg | dstanek oh for purging purposes? | 15:34 |
| dstanek | morganfainberg: not according to the docs | 15:34 |
| dstanek | yes | 15:34 |
| *** gyee has joined #openstack-keystone | 15:35 | |
| henrynash | ok, so one way this would work is that say out-of-band a user is deleted from LDAP | 15:35 |
| morganfainberg | dstanek, in the case of a RW ldapbackend, don't we auto-cleanup the mapping on deletion? | 15:35 |
| morganfainberg | henrynash, ^ | 15:35 |
| * morganfainberg thought i saw that | 15:36 | |
| henrynash | oen of the attributes of that LDAP objects is the one that represents the keystone user-id | 15:36 |
| henrynash | morganfainberg: (yes, to auto clearn up in RW LDAP) | 15:36 |
| morganfainberg | so my biggest complaint is we default to UUID mapping | 15:36 |
| morganfainberg | not sha1 | 15:36 |
| dstanek | ok, so r/w ldap assumes that we control ldap and that nothing outside of keystone will write? | 15:37 |
| morganfainberg | dstanek, correct. | 15:37 |
| henrynash | morganfainbeerq: no! | 15:37 |
| morganfainberg | dstanek, which should be... well... a fairly sane assumption. | 15:37 |
| morganfainberg | henrynash, we don't? | 15:37 |
| morganfainberg | henrynash, or we should use UUID by default | 15:38 |
| henrynash | morganfainberg: no, why would we | 15:38 |
| morganfainberg | henrynash, i think we should default ot he most robust (can be recreated) mapping | 15:38 |
| dstanek | morganfainberg: is that documented somewhere so i can fill in the gaps in my mind or is this tribal? | 15:39 |
| dstanek | morganfainberg: wha? http://paste.openstack.org/show/83661/ i expected to see it used somewhere | 15:39 |
| morganfainberg | dstanek, i think some of this is tribal some is documented | 15:39 |
| *** bklei has quit IRC | 15:39 | |
| morganfainberg | dstanek, the LDAP backend has dark dark magic. | 15:39 |
| morganfainberg | dstanek, daaaaaark spooooooky magic | 15:40 |
| henrynash | morganfainberq: ok, so I think you can make that argument….my only issue with that is I would probably want to fix that limitation of the public ID not being sha1 when a user is created via keystone in a RW LDAP | 15:40 |
| *** xianghui has joined #openstack-keystone | 15:40 | |
| morganfainberg | it does a lot of "take this bit and that bit and figure out waht the ldap option should be) | 15:40 |
| morganfainberg | henrynash, i'm fine with that. | 15:40 |
| dolphm | this is why i'd like to see the readonly pieces of the LDAP driver split out - that driver would be relatively simple. it's the write stuff that is nuts | 15:40 |
| morganfainberg | dolphm, ++++++++++++++ | 15:40 |
| morganfainberg | dolphm, backend = "readonly_ldap" | 15:41 |
| bknudson | dstanek: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/ldap/core.py#n810 | 15:41 |
| dstanek | bknudson: haha, ok | 15:41 |
| morganfainberg | dstanek, like i said, spoooooky *waves hands* | 15:42 |
| bknudson | think of all the code duplication that was saved! | 15:42 |
| morganfainberg | bknudson, lol | 15:42 |
| dstanek | bknudson: :-P | 15:42 |
| dolphm | oh god there's LDAP code on my screen | 15:42 |
| morganfainberg | dolphm, it's ok, i'm sure there is some eyebleach to solve that issue | 15:43 |
| dstanek | bknudson: walk throught this change was hard enough using normal tools - now i'm completely out of luck | 15:43 |
| dstanek | s/walk thought/walking through/ | 15:43 |
| dolphm | morganfainberg: searching amazon for eye bleach http://www.amazon.com/dp/B005EH4TPQ/ | 15:43 |
| morganfainberg | dolphm, LOL | 15:44 |
| dstanek | will that be supplied in July or will we have to bring our own? | 15:44 |
| morganfainberg | dolphm, reddit.com/r/eyebleach (SFW) | 15:44 |
| morganfainberg | dstanek, byoeb? | 15:45 |
| bknudson | one thing I like about the ldap backend is it has separate classes for user, group, role manipulation | 15:46 |
| bknudson | instead of having it all in the one class | 15:46 |
| *** nkinder has quit IRC | 15:47 | |
| dolphm | morganfainberg: am now distracted by puppies | 15:49 |
| bknudson | bunnies and cats in pajamas | 15:49 |
| morganfainberg | dolphm, then that site is doing it's job! | 15:49 |
| *** bklei has joined #openstack-keystone | 15:49 | |
| stevemar | why is nothing getting merged | 15:51 |
| morganfainberg | stevemar, gate backup? | 15:51 |
| dolphm | stevemar: the gate is having a sad | 15:51 |
| morganfainberg | dolphm, a big sad | 15:51 |
| *** jaosorior has quit IRC | 15:52 | |
| bknudson | http://status.openstack.org/zuul/ -- looks like it's 12 hrs to merge | 15:52 |
| morganfainberg | bknudson, better than the 35+hrs last week | 15:52 |
| stevemar | i know why, i was just complaining | 15:52 |
| bknudson | stevemar: if you complain then that means you have to help out with fixing the probs! | 15:52 |
| bknudson | that's why I never complain | 15:52 |
| stevemar | dammit | 15:52 |
| *** nkinder has joined #openstack-keystone | 15:52 | |
| stevemar | i already have too much on my plate | 15:53 |
| stevemar | my metaphorical plate | 15:53 |
| morganfainberg | stevemar, is that some kind of fancy serving dish? | 15:54 |
| *** sbfox has quit IRC | 15:54 | |
| *** BAKfr has quit IRC | 15:57 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Convert explicit session get/begin to transaction context https://review.openstack.org/97058 | 15:57 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove `with_lockmode` use from Trust SQL backend. https://review.openstack.org/97059 | 15:58 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Hide details of HTTP 409 erros unless in debug https://review.openstack.org/98302 | 15:58 |
| *** BAKfr has joined #openstack-keystone | 15:58 | |
| *** jsavak has quit IRC | 16:01 | |
| *** jsavak has joined #openstack-keystone | 16:01 | |
| dstanek | morganfainberg: i like your --unused idea - may be nice to capture that as a bug or task in the BP so it gets done | 16:02 |
| morganfainberg | unless anyone needs me... i need to go grab some coffeee | 16:03 |
| * morganfainberg needs a coffee maker at home. | 16:03 | |
| * morganfainberg wouldspend a lot les $$$ on coffee that way | 16:03 | |
| dolphm | morganfainberg: http://www.amazon.com/gp/product/B005YQZNO8/ | 16:04 |
| henrynash | morganfainberg, dstanek: agreed, nice | 16:05 |
| morganfainberg | dolphm, i kinda want one of these: http://www.amazon.com/La-Pavoni-PPG-16-Professional-Espresso/dp/B0016OBCTC/ref=sr_1_17?ie=UTF8&qid=1402502722&sr=8-17&keywords=professional+espresso+maker | 16:05 |
| morganfainberg | dolphm, but i am _not_ spending $1600 on a coffee maker :P | 16:06 |
| morganfainberg | sorry $1500 | 16:06 |
| * morganfainberg needs to learn how to book travel through corp website today for meetup. | 16:07 | |
| morganfainberg | erm hackathon... er whatever | 16:07 |
| *** xianghui has quit IRC | 16:07 | |
| *** NM has quit IRC | 16:07 | |
| dolphm | morganfainberg: especially if it only makes 16 shots - that's barely a week supply and then you're out another $1500? screw that | 16:09 |
| henrynash | morganfainberg: so do you want me to submit a new patch to address your comments? The most crucial would be the changing of the default from uuid to sha1 | 16:09 |
| morganfainberg | dolphm, LOL | 16:09 |
| morganfainberg | henrynash, no still looking it over, it's a complex patchset | 16:10 |
| mfisch | have fun with HP's travel system | 16:10 |
| morganfainberg | henrynash, i'm not seeing any show stoppers | 16:10 |
| morganfainberg | mfisch, thanks... :P | 16:10 |
| henrynash | morganfainberg: ok…. | 16:10 |
| *** afazekas has quit IRC | 16:10 | |
| morganfainberg | henrynash, but i really don't want a "oopse we broke everything" down the line yanno :) | 16:10 |
| morganfainberg | esp. w/ 1500lines added | 16:10 |
| henrynash | morganfainberg: absolutely! | 16:11 |
| *** xianghui has joined #openstack-keystone | 16:12 | |
| henrynash | morganfainberg: one thing is that we don;t really want to change the defaut generator down teh line….since otherwise you would chaneg IDs when you upgraded to teh version with the new default | 16:12 |
| morganfainberg | dolphm, i'm going to propose a fix to keystoneclient that makes x-auth-token header never get printed in debug (well, or maybe 'X-Auth-token: *** SECURE DATA ***' | 16:12 |
| *** leseb has quit IRC | 16:12 | |
| morganfainberg | there has been pushback on getting that fix in other places, i figure we should just do the right thing and not expose the token data in debug logs (same as passwords) | 16:12 |
| *** leseb has joined #openstack-keystone | 16:12 | |
| morganfainberg | henrynash, that for me is a big concern, UUID is the 2nd teir choice imo. | 16:13 |
| dstanek | just to play devil's advocate...why do they need a choice here? | 16:14 |
| henrynash | dstanek: I think that is a great question | 16:14 |
| dolphm | morganfainberg: works for me. i've also been playing with the idea of hashing tokens to something unusable for anything but auditing, and logging that | 16:14 |
| morganfainberg | dstanek, the argument was in some cases you may not want the _same_ id generated in multiple cloud. | 16:15 |
| morganfainberg | dolphm, i like that for the audit logs | 16:15 |
| morganfainberg | dolphm, but for debug... bleh. | 16:15 |
| dolphm | morganfainberg: agree | 16:15 |
| henrynash | morganfainberg: but would you? if your domain is different, then your hashed ID will be different | 16:15 |
| dstanek | morganfainberg: why would they care though? would it break them it that were the case? | 16:15 |
| morganfainberg | dstanek, hm. don't think it would... default domain aside? | 16:16 |
| morganfainberg | cause we call it 'default' by 'default' | 16:16 |
| dstanek | besides we could have a configurable salt to change the sha outcome and that could be different between clouds | 16:16 |
| morganfainberg | henrynash, think we could just make sha1 the only option for now? revisit if there is a demand? | 16:16 |
| dstanek | just a thought | 16:16 |
| morganfainberg | dstanek, ooh that i like better | 16:16 |
| *** leseb has quit IRC | 16:17 | |
| morganfainberg | user_id salt option | 16:17 |
| * morganfainberg approves of that | 16:17 | |
| morganfainberg | if there really is a need | 16:17 |
| morganfainberg | henrynash, because i think that is really the only thing that bugs me about the implementation - UUID option sucks for the mapped IDs | 16:18 |
| henrynash | morganfainberg: we could indeed just make sha1 the only option…. | 16:18 |
| henrynash | morganfainberg: the only thing that then doesn’t really work right is RW LDAPs when you create users from keystone….since the controller sets the ID | 16:20 |
| morganfainberg | so we need to fix RW ldap | 16:21 |
| dolphm | morganfainberg: meh? https://gist.github.com/dolph/898520103485a9197c33 | 16:21 |
| henrynash | morganfainberg: actually, I can think of how to work round that without changing all the unit tests for now…. | 16:21 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Minor doc fix https://review.openstack.org/99416 | 16:21 |
| morganfainberg | henrynash, ok cool | 16:21 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Debug messages don't need translations https://review.openstack.org/99417 | 16:21 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds a newline for pep8 compliance https://review.openstack.org/99418 | 16:21 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Stops overriding a builtin for pep8 compliance https://review.openstack.org/99419 | 16:21 |
| morganfainberg | dolphm, sha224? | 16:22 |
| dolphm | morganfainberg: why not? | 16:22 |
| dstanek | sha65536 | 16:22 |
| morganfainberg | dolphm, lets make the security folks squimish, MD5! :P | 16:23 |
| morganfainberg | dolphm, i don't want to expose the token id even in debug fwiw | 16:23 |
| mfisch | I have a strange behavior with the client or maybe its with the server | 16:23 |
| morganfainberg | someone turns a service to debug, you shouldn't leak the token IDs to central logging | 16:23 |
| mfisch | does my token expire when I add or remove a role from myself? | 16:24 |
| morganfainberg | or to lower priv user that can see the logs | 16:24 |
| mfisch | Thats what seems to happen | 16:24 |
| morganfainberg | mfisch, which release? h, I, master? | 16:24 |
| mfisch | morganfainberg: I | 16:24 |
| morganfainberg | mfisch, are you mucking with a role on the project/tenant you're scoped to? | 16:24 |
| mfisch | morganfainberg: I have a basic script test that makes a role then adds/removes it from me, and then tries to delete it | 16:24 |
| mfisch | morganfainberg: yeah | 16:24 |
| *** BAKfr has quit IRC | 16:24 | |
| morganfainberg | if so, yes. | 16:24 |
| morganfainberg | that is expected behavior | 16:24 |
| mfisch | morganfainberg: it makes sense | 16:25 |
| mfisch | morganfainberg: I will modify | 16:25 |
| dstanek | morganfainberg: ^ those were the commits i mentioned last night | 16:27 |
| morganfainberg | dstanek, ah cool. | 16:28 |
| morganfainberg | ok coffee time | 16:30 |
| morganfainberg | be back shortly. | 16:30 |
| openstackgerrit | Juan Manuel Ollé proposed a change to openstack/python-keystoneclient: Keystoneclient create user API should have optional password. https://review.openstack.org/97597 | 16:31 |
| dstanek | bknudson: i was planning on creating a new commit to deal with the Nones you mention here: https://review.openstack.org/#/c/81528/4/keystone/catalog/backends/sql.py | 16:31 |
| dstanek | is that good enough to remove the -1? they are separate commits to me because a None is not broken, just stupid looking :-) | 16:32 |
| *** jaosorior has joined #openstack-keystone | 16:32 | |
| dstanek | i was also planning on jumping on lbragstad's bandwagon and changing my one patch to use jsonschema validation | 16:32 |
| lbragstad | whoop whoop! | 16:34 |
| *** gordc1 has joined #openstack-keystone | 16:37 | |
| *** gordc has quit IRC | 16:38 | |
| *** bklei has quit IRC | 16:38 | |
| morganfainberg | dolphm, i figure you have better knowledge on this... how many non-OpenStack services (meaning not using auth_token, e.g. Java) decode the keystone token? | 16:39 |
| morganfainberg | dolphm, i'm concerned that w/ PKI tokens they're doing the same thing heat was trying to do w/ that 'placeholder' id. | 16:40 |
| dolphm | morganfainberg: well, does that only affect v3? | 16:40 |
| dolphm | morganfainberg: (tokens don't have IDs in the v3 spec, anyway) | 16:41 |
| *** PritiDesai has joined #openstack-keystone | 16:42 | |
| *** bklei has joined #openstack-keystone | 16:44 | |
| *** browne has joined #openstack-keystone | 16:45 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds a fork of python-ldap for Py3 testing https://review.openstack.org/95827 | 16:47 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Updates Python3 requirements to match Python2 https://review.openstack.org/95826 | 16:47 |
| *** afaranha has left #openstack-keystone | 16:48 | |
| *** browne1 has joined #openstack-keystone | 16:48 | |
| *** browne has quit IRC | 16:48 | |
| *** gokrokve_ has quit IRC | 16:48 | |
| *** openstackgerrit_ has joined #openstack-keystone | 16:49 | |
| henrynash | morganfainberg: so I don’t think I can fix the RW ldap case cleanly enough, quickly enough to get this into Juno-1 | 16:50 |
| henrynash | morganfainberg: I just don’t want to rush this in | 16:50 |
| henrynash | morganfainberg, dstanek: if we really want sha1 as the default, then we should move this to Juno-2 | 16:52 |
| nkinder | henrynash: sha1 as the default for what? | 16:53 |
| *** harlowja_away is now known as harlowja | 16:53 | |
| henrynash | nkinder: the proposal is to actually only use sha1 as the public id generator in the mutlple-backend_uuids patch | 16:54 |
| nkinder | henrynash: this is the id that maps to the IdP backend, right? | 16:55 |
| henrynash | nkinder: the current patch has uuid as the default, and there is more work in a subsequent patch (taht wasn’t palnned for J1) to make sha1 always be used with RW LDAP (yes to your question) | 16:55 |
| henrynash | dolphm: I’m gonna move my patch out of J1 | 16:56 |
| *** praneshp has joined #openstack-keystone | 16:57 | |
| dstanek | henrynash: it's not just changing the default in the config? | 16:57 |
| henrynash | dstanek: so that bits easy | 16:57 |
| *** praneshp_ has joined #openstack-keystone | 16:57 | |
| henrynash | dstanek: the issue is that with RW ldap, the conrtrollers curently set the ID as a UUID on create which becomes the public ID... | 16:58 |
| henrynash | dstanek: and all our unit tests assume they can set the ID as well | 16:58 |
| henrynash | dstanek: I already have the patch ready that fixes all this, but it changes a lot of test code (all mechanical, but a lot) | 16:59 |
| dstanek | ah, i see | 16:59 |
| henrynash | dstanek: I was looking to see if I could just remove the code from teh controller and then check if no ID was specified in the manager and hence still make the unit tests work.. | 17:00 |
| henrynash | dstanek: and I can, but it looks yuk…..teh controller calls the manager with create_user(ID, user_ref) | 17:00 |
| henrynash | dstanek, so we’d ahev to pass a dummy ID…or create new manager calls for the controller to call…whcih we will tehn delete after J1….. | 17:01 |
| henrynash | dstanek: neather seems attractive | 17:01 |
| *** praneshp has quit IRC | 17:01 | |
| *** praneshp_ is now known as praneshp | 17:01 | |
| henrynash | and if we make sha1 the only option, i think we hsave to get this right... | 17:03 |
| morganfainberg | henrynash, j1 was tagged | 17:07 |
| morganfainberg | henrynash, don't worry about hitting J1 :P | 17:07 |
| morganfainberg | i think | 17:07 |
| morganfainberg | henrynash, or will be tagged. | 17:07 |
| *** hrybacki has quit IRC | 17:09 | |
| *** thedodd has joined #openstack-keystone | 17:10 | |
| dstanek | lunch time! | 17:12 |
| *** erecio has joined #openstack-keystone | 17:14 | |
| *** dstanek is now known as dstanek_zzz | 17:14 | |
| *** amcrn has joined #openstack-keystone | 17:14 | |
| *** NM has joined #openstack-keystone | 17:15 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/python-keystoneclient: Do not expose Token IDs in debug output https://review.openstack.org/99432 | 17:17 |
| *** gordc1 is now known as gordc | 17:18 | |
| *** gokrokve has joined #openstack-keystone | 17:19 | |
| henrynash | morganfainberg: no worries…I’ll update the patch (ready for openning up for J2) that has sha1 as THE generator, plus a temp workaround for fixing RW LDAP, followed by a second patch that properly moves the ID generation from controller to manager (which will remove the temp workaround)…so we can keep all teh unit test changes in the second patch | 17:20 |
| morganfainberg | henrynash, great, - yeah we're close lets not have any icky cleanup later :) | 17:21 |
| henrynash | morganfainberg: agreed | 17:21 |
| *** nsquare has joined #openstack-keystone | 17:24 | |
| *** radez is now known as radez_g0n3 | 17:28 | |
| *** praneshp has quit IRC | 17:30 | |
| morganfainberg | ok going to spend some time repinning the token spec proposals to be more sane (persistence, versioning) and get a basic scaffolding spec in. | 17:32 |
| morganfainberg | so we're moving in the needed direction even if the bigger "change" specs aren't accepted. | 17:32 |
| *** radez_g0n3 is now known as radez | 17:41 | |
| *** rushi has quit IRC | 17:51 | |
| *** kun_huang has quit IRC | 17:52 | |
| *** rushiagr has joined #openstack-keystone | 17:54 | |
| *** hrybacki has joined #openstack-keystone | 17:54 | |
| *** thedodd has quit IRC | 17:56 | |
| *** praneshp has joined #openstack-keystone | 17:57 | |
| *** thedodd has joined #openstack-keystone | 17:58 | |
| *** radez is now known as radez_g0n3 | 18:03 | |
| *** PritiDesai has quit IRC | 18:09 | |
| dolphm | morganfainberg: there's no bug report to close out for the token id thing? | 18:11 |
| dolphm | morganfainberg: (i don't think you need to open one, but SecurityImpact would be nice) | 18:11 |
| morganfainberg | dolphm, yeah will add | 18:11 |
| morganfainberg | dolphm also sdague brought up a better idea | 18:12 |
| dolphm | morganfainberg: ? | 18:12 |
| morganfainberg | just make it -H X-Auth-token: sha1(<hashed token id>) | 18:12 |
| morganfainberg | in all cases | 18:12 |
| morganfainberg | until we can rid ourselves of the curl format | 18:12 |
| dolphm | morganfainberg: for logging? | 18:12 |
| morganfainberg | dolphm, example: http://logs.openstack.org/43/98443/8/check/check-tempest-dsvm-full/27719de/logs/tempest.txt.gz#_2014-06-10_11_24_25_546 | 18:12 |
| morganfainberg | dolphm, yeah | 18:13 |
| dolphm | morganfainberg: is that saying that the value in the parens *is* a SHA1 hash? | 18:13 |
| morganfainberg | dolphm, it makes it so it is possible to correlate token_ids across requests if they are reused. | 18:13 |
| dolphm | morganfainberg: of a real token? | 18:13 |
| morganfainberg | dolphm, yes. | 18:13 |
| morganfainberg | maybe (SHA1)hashed_token_id ? | 18:13 |
| morganfainberg | like LDAP does for SSHA passwords (e.g. {SSHA}<password_hash> | 18:14 |
| morganfainberg | sometimes if a token has expired it is good to know the same token worked previously or didn't work previously (vs. its a new token) when looking at requests | 18:14 |
| dolphm | morganfainberg: that's more self-explanatory to me | 18:14 |
| morganfainberg | ok i'll go with {SHA1}<hashed_token_id> | 18:15 |
| dolphm | morganfainberg: you commented earlier that tokens should never be in debug output, and i'd argue that they should, but that we're not using verbose correctly, which i think would better serve the use case you have in mind (debug should be a dev-only feature, and verbose should be an operator feature) | 18:17 |
| morganfainberg | dolphm, my concern is if you ever turn a service on in debug and funnel data to a central source (sometimes you need a service in prod in debug) that central logging is likely incorrect place to see tokens | 18:18 |
| morganfainberg | i think the right answer would be to include (structured data format) data from within the token in the debug output. | 18:18 |
| morganfainberg | just not the bearer token id itself. | 18:18 |
| dolphm | morganfainberg: aren't you really looking for a middle ground there, between debug and relatively quiet logging? | 18:18 |
| morganfainberg | dolphm, in debug, do we want passwords in logs? | 18:18 |
| morganfainberg | dolphm, if the answer is no, then i hold that tokens are only slightly less bad than passwords | 18:19 |
| *** PritiDesai has joined #openstack-keystone | 18:19 | |
| dolphm | i've always (weakly) argued yes - that's the kind of stuff i expect from a "debug" mode - i don't want anything suppressed | 18:19 |
| dolphm | verbose should be sanitized, though | 18:20 |
| morganfainberg | dolphm, sure. if debug means "yep even passwords" then i don't argue | 18:20 |
| morganfainberg | which case verbose = sanitized | 18:20 |
| morganfainberg | but right now, debug i think is considered = verbose in most OpenStack projects. | 18:21 |
| morganfainberg | meaning we need to be a bit more heavy handed about it. | 18:21 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/python-keystoneclient: Do not expose Token IDs in debug output https://review.openstack.org/99432 | 18:22 |
| *** hrybacki has quit IRC | 18:24 | |
| *** hrybacki has joined #openstack-keystone | 18:24 | |
| * morganfainberg thinks we need to maybe remove 'verbose' and go to debug levels. debug=99999 means don't obscure anything (or something like that) where --debug = todays' verbose | 18:25 | |
| morganfainberg | or what verbose should be | 18:26 |
| *** juanmo has joined #openstack-keystone | 18:26 | |
| dolphm | morganfainberg: yeah, i think that because we've never provided a proper "verbose" level, operators have turned to debug, and don't find what they were expecting in the first place (sanitized verbosity) | 18:27 |
| morganfainberg | dolphm, ++ | 18:28 |
| *** bklei has quit IRC | 18:30 | |
| *** bklei has joined #openstack-keystone | 18:32 | |
| *** dstanek_zzz is now known as dstanek | 18:33 | |
| *** jraim has quit IRC | 18:39 | |
| *** jraim has joined #openstack-keystone | 18:40 | |
| *** bklei has quit IRC | 18:41 | |
| *** jaosorior has quit IRC | 18:42 | |
| *** sbfox has joined #openstack-keystone | 18:54 | |
| *** PritiDesai has quit IRC | 18:57 | |
| openstackgerrit | Rodrigo Duarte Sousa proposed a change to openstack/python-keystoneclient: Add example script for role_assignments module https://review.openstack.org/97600 | 18:58 |
| *** sbfox has quit IRC | 18:59 | |
| *** sbfox has joined #openstack-keystone | 18:59 | |
| *** PritiDesai has joined #openstack-keystone | 19:07 | |
| *** PritiDesai has quit IRC | 19:08 | |
| *** nsquare has quit IRC | 19:16 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Hide details of HTTP 409 erros unless in debug https://review.openstack.org/98302 | 19:24 |
| openstackgerrit | Rodrigo Duarte Sousa proposed a change to openstack/python-keystoneclient: Add example script for role_assignments module https://review.openstack.org/97600 | 19:27 |
| *** sbfox has quit IRC | 19:28 | |
| *** rodrigods_ has joined #openstack-keystone | 19:30 | |
| *** bklei has joined #openstack-keystone | 19:38 | |
| *** leseb has joined #openstack-keystone | 19:49 | |
| *** rodrigods_ has quit IRC | 19:57 | |
| *** leseb has quit IRC | 20:01 | |
| *** leseb has joined #openstack-keystone | 20:02 | |
| *** sbfox1 has joined #openstack-keystone | 20:03 | |
| *** leseb has quit IRC | 20:06 | |
| *** stevemar has quit IRC | 20:09 | |
| *** dstanek is now known as dstanek_zzz | 20:26 | |
| *** nsquare has joined #openstack-keystone | 20:29 | |
| *** NM has quit IRC | 20:30 | |
| *** marcoemorais has joined #openstack-keystone | 20:33 | |
| *** jamielennox is now known as jamielennox|away | 20:34 | |
| *** CaioBrentano1 has quit IRC | 20:37 | |
| *** thiagop has joined #openstack-keystone | 20:38 | |
| *** vhoward has quit IRC | 20:39 | |
| *** vhoward has joined #openstack-keystone | 20:40 | |
| *** leseb has joined #openstack-keystone | 20:47 | |
| *** vhoward has left #openstack-keystone | 20:53 | |
| *** juanmo has quit IRC | 20:57 | |
| *** sbfox1 has quit IRC | 20:58 | |
| *** vhoward has joined #openstack-keystone | 20:59 | |
| *** leseb has quit IRC | 20:59 | |
| *** leseb has joined #openstack-keystone | 21:00 | |
| *** leseb has quit IRC | 21:04 | |
| *** hrybacki has quit IRC | 21:07 | |
| *** jsavak has quit IRC | 21:09 | |
| *** amcrn has quit IRC | 21:10 | |
| openstackgerrit | Rodrigo Duarte Sousa proposed a change to openstack/python-keystoneclient: Add example script for role_assignments module https://review.openstack.org/97600 | 21:10 |
| *** Guest81438 has joined #openstack-keystone | 21:24 | |
| *** amcrn has joined #openstack-keystone | 21:24 | |
| *** redrobot is now known as Guest57969 | 21:25 | |
| *** Guest81438 is now known as redrobot | 21:27 | |
| *** sbfox has joined #openstack-keystone | 21:33 | |
| *** rwsu_ has quit IRC | 21:39 | |
| *** rwsu has joined #openstack-keystone | 21:42 | |
| *** marekd is now known as marekd|away | 21:43 | |
| *** PritiDesai has joined #openstack-keystone | 21:45 | |
| *** hrybacki has joined #openstack-keystone | 21:45 | |
| gyee | bknudson, ping | 21:50 |
| bknudson | gyee: what's up? | 21:50 |
| gyee | when using sqlite and running Keystone in Apache, the sqlite_db option has no effect | 21:51 |
| gyee | only the connection property is being used | 21:51 |
| gyee | I wasn't sure if was documented anywhere | 21:53 |
| bknudson | do we actually support sqlite anywhere but the unit tests? | 21:53 |
| gyee | nope, I was testing something | 21:54 |
| gyee | opted for a quickie setup | 21:54 |
| gyee | anyway, I'll add a note | 21:54 |
| bknudson | I don't see sqlite_db used anywhere?? | 21:55 |
| gyee | yeah, funny the option is there in keystone.conf.sample | 21:55 |
| bknudson | keystone/tests/ksfixtures/database.py: sqlite_db=tests.DEFAULT_TEST_DB_FILE) | 21:55 |
| bknudson | well, we set it but then don't read it anywhere | 21:55 |
| gyee | but it is used to construct the connection string | 21:55 |
| bknudson | gyee: I don't see where it's used to construct the connection string. | 21:57 |
| *** Guest57969 has quit IRC | 21:58 | |
| gyee | bknudson, keystone/tests/test_db_upgrade.py line 147 | 21:58 |
| gyee | sorry, test_sql_upgrade.py | 21:58 |
| bknudson | gyee: that's not using sqlite_db, though | 21:59 |
| bknudson | that's setting the connection string | 21:59 |
| gyee | right, only indirectly using it in the test code | 21:59 |
| gyee | I think we should just remove that option to prevent confusion | 22:00 |
| bknudson | gyee: yes, let's get rid of it | 22:00 |
| bknudson | want me to do that? | 22:00 |
| gyee | sure | 22:00 |
| gyee | bknudson, thanks | 22:00 |
| bknudson | the option itself is coming from oslo, which is moving to a separate lib. | 22:00 |
| bknudson | but we can stop referring to it in keystone already | 22:00 |
| gyee | oh, we can't just remove it from keystone.conf.sample? | 22:01 |
| *** PritiDesai has quit IRC | 22:02 | |
| *** redrobot has left #openstack-keystone | 22:02 | |
| *** gordc has quit IRC | 22:02 | |
| bknudson | can't even get rid of it, it's a positional parameter to set_defaults | 22:03 |
| bknudson | :( | 22:03 |
| bknudson | I'll open a bug. | 22:04 |
| *** amcrn has quit IRC | 22:05 | |
| gyee | yikes | 22:05 |
| *** PritiDesai has joined #openstack-keystone | 22:07 | |
| *** kieren has quit IRC | 22:09 | |
| *** hrybacki has quit IRC | 22:09 | |
| bknudson | we should be able to get to oslo.db in J, so that will probably be when we get rid of it. | 22:09 |
| bknudson | gyee: do we need something for I? | 22:10 |
| *** nkinder has quit IRC | 22:12 | |
| *** nsquare has quit IRC | 22:16 | |
| gyee | bknudson, I don't think so | 22:20 |
| bknudson | gyee: https://review.openstack.org/#/c/99493/ | 22:20 |
| *** afazekas has joined #openstack-keystone | 22:22 | |
| *** gokrokve has quit IRC | 22:25 | |
| *** dims__ has quit IRC | 22:28 | |
| *** sbfox1 has joined #openstack-keystone | 22:29 | |
| *** sbfox has quit IRC | 22:30 | |
| *** nsquare has joined #openstack-keystone | 22:33 | |
| *** jdennis has quit IRC | 22:36 | |
| *** afazekas has quit IRC | 22:42 | |
| *** bknudson has quit IRC | 22:45 | |
| *** henrynash has quit IRC | 22:53 | |
| *** jamielennox|away is now known as jamielennox | 23:00 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Create HTTP methods mixin object https://review.openstack.org/97680 | 23:14 |
| richm | did someone recently commit something that got the in-code config out-of-sync with the sample config? | 23:14 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Session Adapters https://review.openstack.org/86237 | 23:14 |
| richm | I changed one default in a config setting, ran tox -esample_config, and now keystone.conf.sample has many changes | 23:15 |
| richm | e.g. | 23:16 |
| richm | -#qpid_hostname=keystone | 23:16 |
| richm | +#qpid_hostname=localhost | 23:16 |
| richm | Did I do something wrong, or should I wait for a corrective commit to be pushed? | 23:17 |
| *** thedodd has quit IRC | 23:21 | |
| *** nkinder has joined #openstack-keystone | 23:23 | |
| *** sbfox1 has quit IRC | 23:26 | |
| *** dims__ has joined #openstack-keystone | 23:30 | |
| morganfainberg | richm, it is likely we haven't run a config update in a while | 23:31 |
| morganfainberg | richm, you can either push 2 commits: sample_config (before your change) and then one after | 23:31 |
| morganfainberg | or you can do it as one commit | 23:32 |
| morganfainberg | richm, we've taken the tack that config sample changes should be done every so often, and then as the last change for a release. it's a bit lazy but it means we don't get broken by gating on the sample being up to date and a dependent library changes | 23:33 |
| richm | ok | 23:33 |
| morganfainberg | (e.g. oslo.messaging) | 23:33 |
| morganfainberg | in short, you did nothing wrong | 23:33 |
| richm | I'll just push my commit with the config change without the sample config change | 23:33 |
| morganfainberg | yeah that works. | 23:34 |
| openstackgerrit | Richard Megginson proposed a change to openstack/keystone: test_user_mixed_case_attribute fails - mail, not email https://review.openstack.org/94668 | 23:35 |
| richm | morganfainberg: Thanks! | 23:39 |
| morganfainberg | sure thing! | 23:39 |
| morganfainberg | also, changing the default - i like that much better | 23:39 |
| *** sbfox has joined #openstack-keystone | 23:43 | |
| *** dstanek_zzz is now known as dstanek | 23:53 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!