| jgriffith | hey.. what's signing dir do? | 00:00 |
|---|---|---|
| jgriffith | it's in my past-ini but it doesn't exist | 00:00 |
| morganfainberg | ah, paste-ini maybe is where | 00:01 |
| morganfainberg | and i think thats where it's looking? | 00:01 |
| * morganfainberg looks at auth_token | 00:01 | |
| morganfainberg | the code looks to be looking for certfile cafile | 00:02 |
| morganfainberg | or signing_dir where all the certs/ca stuff lives | 00:02 |
| morganfainberg | oh | 00:02 |
| morganfainberg | no no signing_dir is where the cert info should life | 00:03 |
| morganfainberg | live* | 00:03 |
| morganfainberg | for validating tokens | 00:03 |
| jgriffith | morganfainberg: seems weird that it doesn't exist on my system? | 00:03 |
| jgriffith | morganfainberg: maybe that's a problem :) | 00:03 |
| morganfainberg | hehe point it to where you put the stuff for validating the tokens | 00:03 |
| jgriffith | morganfainberg: so like /var/lib/nova/CA ? | 00:04 |
| jgriffith | or the keystone versions? | 00:04 |
| jgriffith | /varlib/keystone/certs? | 00:05 |
| morganfainberg | uh. you put the validation certs in /var/lib/nova/CA? | 00:05 |
| morganfainberg | wherever you put the new certs | 00:05 |
| jgriffith | morganfainberg: I copied them there | 00:05 |
| jgriffith | generated them in /var/lib/keystone/cert | 00:05 |
| morganfainberg | right try the nova/CA location | 00:06 |
| jgriffith | kinda followed this dudes blog | 00:06 |
| *** nsquare has quit IRC | 00:07 | |
| *** nsquare has joined #openstack-keystone | 00:10 | |
| jgriffith | morganfainberg: ha!! | 00:18 |
| jgriffith | morganfainberg: frikin cached copy of the certs | 00:18 |
| morganfainberg | works? | 00:18 |
| morganfainberg | hehe | 00:18 |
| morganfainberg | joy | 00:18 |
| jgriffith | so the past.ini didn't seem to do anything | 00:18 |
| jgriffith | but... | 00:18 |
| morganfainberg | ahh | 00:18 |
| jgriffith | I hit the var/lib/nova/keystone-signing dir and noticed everything was "the old dates" again | 00:19 |
| jgriffith | nuked, restarted and bingo | 00:19 |
| morganfainberg | there ya go | 00:19 |
| morganfainberg | ok then! | 00:19 |
| * morganfainberg feels productive | 00:20 | |
| morganfainberg | I helped! some! | 00:20 |
| morganfainberg | and .. only 3 failures on my split/merge/split/split/merge in testing | 00:20 |
| morganfainberg | woo | 00:20 |
| jgriffith | morganfainberg: lol | 00:26 |
| jgriffith | morganfainberg: well, if I can ever return the favor let me know | 00:26 |
| jgriffith | just not right now :) | 00:26 |
| morganfainberg | jgriffith, haha sounds good :) | 00:26 |
| jgriffith | morganfainberg: take care | 00:26 |
| morganfainberg | cheers, you too | 00:27 |
| *** hrybacki has quit IRC | 00:29 | |
| *** hrybacki has joined #openstack-keystone | 00:29 | |
| morganfainberg | jamielennox, dolphm, stevemar, bknudson, ayoung_DadMode, dstanek_404, https://github.com/morganfainberg/keystonemiddleware that should be the split-out/merge down of the middlewares | 00:34 |
| morganfainberg | it (at the very least) passes pep8 and py27 | 00:34 |
| stevemar | morganfainberg, now that is pretty neat | 00:35 |
| *** topol has joined #openstack-keystone | 00:35 | |
| morganfainberg | stevemar, it also contains all the history for the tests and the middleware files | 00:36 |
| * morganfainberg is getting better at git | 00:36 | |
| jamielennox | cool, do we have any consensus of naming or where it will go? | 00:36 |
| jamielennox | morganfainberg: yea, that was the first thing i checked - it would be a shame to loose all that | 00:36 |
| morganfainberg | openstack/keystonemiddleware | 00:36 |
| jamielennox | ok | 00:36 |
| *** leseb has joined #openstack-keystone | 00:36 | |
| morganfainberg | jamielennox, i'm going to spin up the review tonight for infra to add it tomorrow | 00:37 |
| morganfainberg | so by tomorrow afternoon *hope* we will have it open for reviews | 00:37 |
| morganfainberg | already registered the LP project | 00:37 |
| morganfainberg | and setup the pypi packaging info | 00:37 |
| stevemar | morganfainberg, so what's keystoneclient going to look like? | 00:38 |
| morganfainberg | stevemar, the same as it is now, the middleware will be simply frozen (e.g. -2 on any reviews for it) except for security maintenance | 00:38 |
| morganfainberg | stevemar, first release of the new package will be 1.0.0 | 00:38 |
| morganfainberg | stevemar, so, this is the time to play cleanup :) | 00:38 |
| morganfainberg | same for ec2_token middleware in keystone (btw, we don't have tests for that) | 00:39 |
| morganfainberg | so we'll need some | 00:39 |
| *** hrybacki has quit IRC | 00:40 | |
| morganfainberg | any new middleware from this point will not be able to keep 100% of the history without each commit being submitted independently | 00:40 |
| jamielennox | morganfainberg: 1.0.0 of keystoneclient? | 00:40 |
| morganfainberg | jamielennox, keystonemiddleware | 00:41 |
| jamielennox | yea, figured | 00:41 |
| morganfainberg | jamielennox, i figure we have incubated it long enough, it's time to call it mature. | 00:41 |
| jamielennox | morganfainberg: it's stable anyway - we're not allowed to change it so we may as well call it | 00:41 |
| morganfainberg | jamielennox, yep. | 00:41 |
| *** leseb has quit IRC | 00:41 | |
| *** ncoghlan_afk is now known as ncoghlan | 00:42 | |
| morganfainberg | ok i need to get to the gym | 00:44 |
| morganfainberg | be back in a bit | 00:44 |
| *** devlaps has joined #openstack-keystone | 00:45 | |
| *** daneyon has quit IRC | 00:47 | |
| *** dims has joined #openstack-keystone | 00:58 | |
| *** daneyon has joined #openstack-keystone | 01:01 | |
| *** dims has quit IRC | 01:02 | |
| morganfainberg | ack, forgot docs! | 01:02 |
| morganfainberg | totally need to fix that. | 01:02 |
| morganfainberg | at least that shouldn't be awful to do the merge/split magic on | 01:02 |
| *** dims_ has joined #openstack-keystone | 01:05 | |
| *** diegows has quit IRC | 01:07 | |
| jamielennox | morganfainberg: i think the docs are pretty dead anyway - most of them are in keystone i think | 01:07 |
| morganfainberg | eh, still going to see if there is anything i can salvage | 01:07 |
| morganfainberg | if not *shrug* need to write em | 01:08 |
| *** mberlin has joined #openstack-keystone | 01:11 | |
| *** mberlin1 has quit IRC | 01:12 | |
| *** dstanek_404 is now known as dstanek | 01:14 | |
| *** bobt has quit IRC | 01:21 | |
| *** gokrokve has quit IRC | 01:22 | |
| *** leseb has joined #openstack-keystone | 01:37 | |
| *** dims_ has quit IRC | 01:39 | |
| *** leseb has quit IRC | 01:42 | |
| *** richm has left #openstack-keystone | 01:45 | |
| ayoung_DadMode | jamielennox, so, today morganfainberg and I discovered that Horizon is pretty much defaulting to UUID mode with tokens. Give it a PKI token, it takes the MD5 hash, and forgets the body | 01:46 |
| ayoung_DadMode | so... | 01:46 |
| *** ayoung_DadMode is now known as ayoung | 01:46 | |
| *** browne has quit IRC | 01:46 | |
| *** marcoemorais has quit IRC | 01:46 | |
| ayoung | I want to make use of the cache | 01:46 |
| ayoung | specifically, I want to take what we do in Auth_token middleware, move it into the client proper, and make it so that any client can save tokens in dogpile. | 01:46 |
| *** gokrokve has joined #openstack-keystone | 01:47 | |
| *** daneyon has quit IRC | 02:03 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Update keystoneclient code to account for hacking 0.9.2 https://review.openstack.org/100152 | 02:15 |
| *** nsquare has quit IRC | 02:16 | |
| *** rwsu has quit IRC | 02:24 | |
| *** praneshp has quit IRC | 02:30 | |
| *** stevemar has quit IRC | 02:31 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: remove default=None for config options https://review.openstack.org/101391 | 02:33 |
| *** leseb has joined #openstack-keystone | 02:38 | |
| *** leseb has quit IRC | 02:43 | |
| *** zhiyan_ is now known as zhiyan | 02:49 | |
| *** ayoung has quit IRC | 02:54 | |
| *** ayoung has joined #openstack-keystone | 02:55 | |
| ayoung | morganfainberg, jamielennox can I please merge https://review.openstack.org/#/c/101302/4 and https://review.openstack.org/#/c/95989/11 | 02:55 |
| *** harlowja is now known as harlowja_away | 02:56 | |
| *** devlaps has quit IRC | 03:10 | |
| *** gyee has quit IRC | 03:20 | |
| morganfainberg | ayoung, +2 on both | 03:23 |
| *** praneshp has joined #openstack-keystone | 03:32 | |
| *** praneshp_ has joined #openstack-keystone | 03:34 | |
| *** praneshp has quit IRC | 03:37 | |
| *** praneshp_ is now known as praneshp | 03:37 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/101404 | 03:38 |
| *** leseb has joined #openstack-keystone | 03:39 | |
| *** leseb has quit IRC | 03:43 | |
| morganfainberg | ayoung, jamielennox, https://review.openstack.org/#/c/101406/ woo :) | 04:10 |
| *** ncoghlan is now known as ncoghlan_afk | 04:37 | |
| *** leseb has joined #openstack-keystone | 04:39 | |
| *** leseb has quit IRC | 04:44 | |
| *** stevemar has joined #openstack-keystone | 04:50 | |
| *** openstackgerrit has quit IRC | 04:57 | |
| *** ncoghlan_afk is now known as ncoghlan | 05:00 | |
| *** ncoghlan is now known as ncoghlan_afk | 05:05 | |
| *** praneshp has quit IRC | 05:19 | |
| *** stevemar has quit IRC | 05:23 | |
| *** ajayaa has joined #openstack-keystone | 05:30 | |
| *** henrynash has joined #openstack-keystone | 05:38 | |
| *** chandan_kumar has joined #openstack-keystone | 05:40 | |
| *** leseb has joined #openstack-keystone | 05:40 | |
| *** leseb has quit IRC | 05:45 | |
| *** henrynash has quit IRC | 05:45 | |
| *** amirosh has joined #openstack-keystone | 05:54 | |
| ajayaa | Hi. Jenkin build fails in python-keystoneclient because of http-pretty bug? | 06:03 |
| ajayaa | jamielennox, | 06:03 |
| *** ncoghlan_afk is now known as ncoghlan | 06:08 | |
| *** amerine has joined #openstack-keystone | 06:09 | |
| *** topol has quit IRC | 06:34 | |
| *** leseb has joined #openstack-keystone | 06:41 | |
| *** leseb has quit IRC | 06:46 | |
| *** gokrokve_ has joined #openstack-keystone | 06:58 | |
| *** gokrokve has quit IRC | 07:02 | |
| *** BAKfr has joined #openstack-keystone | 07:06 | |
| *** leseb has joined #openstack-keystone | 07:42 | |
| *** leseb has quit IRC | 07:46 | |
| marekd | ajayaa: it looks fine now. | 07:51 |
| marekd | pull the master, and issue tox -re py27 | 07:52 |
| *** jimbaker has quit IRC | 07:55 | |
| *** jimbaker has joined #openstack-keystone | 08:00 | |
| *** jimbaker has quit IRC | 08:00 | |
| *** jimbaker has joined #openstack-keystone | 08:00 | |
| *** zhiyan is now known as zhiyan_ | 08:00 | |
| *** i159 has joined #openstack-keystone | 08:01 | |
| *** henrynash has joined #openstack-keystone | 08:03 | |
| *** zoresvit has joined #openstack-keystone | 08:04 | |
| marekd | jamielennox: still here? | 08:09 |
| *** henrynash has quit IRC | 08:09 | |
| *** ramonskie has joined #openstack-keystone | 08:14 | |
| ramonskie | i had a slow horizon and bumped in to this blog http://www.sebastien-han.fr/blog/2012/12/12/cleanup-keystone-tokens/ after i executed that script i'm not able to use the api anymore with test-kitchen or bosh (tools that uses the openstack api to create vm's | 08:16 |
| ramonskie | i already did a "keystone-manage db_sync" | 08:17 |
| ramonskie | o and i'm still on grizzly | 08:17 |
| *** henrynash has joined #openstack-keystone | 08:38 | |
| *** ncoghlan is now known as ncoghlan_afk | 08:42 | |
| *** leseb has joined #openstack-keystone | 08:42 | |
| *** leseb has quit IRC | 08:47 | |
| *** oomichi has quit IRC | 08:53 | |
| *** oomichi has joined #openstack-keystone | 08:54 | |
| *** oomichi has quit IRC | 08:55 | |
| *** leseb has joined #openstack-keystone | 09:01 | |
| *** chandan_kumar has quit IRC | 09:09 | |
| *** henrynash has quit IRC | 09:15 | |
| *** henrynash has joined #openstack-keystone | 09:17 | |
| *** henrynash has quit IRC | 09:18 | |
| *** leseb has quit IRC | 09:18 | |
| *** andreaf_ has joined #openstack-keystone | 09:18 | |
| *** ajayaa has quit IRC | 09:31 | |
| *** jamielennox is now known as jamielennox|away | 09:35 | |
| *** leseb has joined #openstack-keystone | 10:19 | |
| *** leseb has quit IRC | 10:23 | |
| *** fifieldt has joined #openstack-keystone | 10:26 | |
| *** toddnni_ has quit IRC | 10:43 | |
| *** toddnni has joined #openstack-keystone | 10:43 | |
| *** openstackgerrit has joined #openstack-keystone | 10:56 | |
| *** leseb has joined #openstack-keystone | 11:19 | |
| *** topol has joined #openstack-keystone | 11:23 | |
| *** leseb has quit IRC | 11:24 | |
| *** toddnni has quit IRC | 11:27 | |
| *** sdfsw2g2h has joined #openstack-keystone | 11:39 | |
| *** henrynash has joined #openstack-keystone | 11:39 | |
| *** sdfsw2g2h is now known as toddnni | 11:40 | |
| *** toddnni has quit IRC | 11:46 | |
| *** gokrokve_ has quit IRC | 11:54 | |
| *** henrynash has quit IRC | 11:57 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Add CRUD operations for Federated Protocols. https://review.openstack.org/83829 | 11:57 |
| *** ramonskie has quit IRC | 12:01 | |
| *** leseb has joined #openstack-keystone | 12:01 | |
| *** henrynash has joined #openstack-keystone | 12:05 | |
| *** leseb has quit IRC | 12:06 | |
| *** sdfsw2g234sva has joined #openstack-keystone | 12:09 | |
| *** henrynash has quit IRC | 12:10 | |
| *** sdfsw2g234sva has quit IRC | 12:11 | |
| *** toddnni has joined #openstack-keystone | 12:17 | |
| *** gokrokve has joined #openstack-keystone | 12:32 | |
| *** diegows has joined #openstack-keystone | 12:34 | |
| *** joesavak has joined #openstack-keystone | 12:34 | |
| *** wyllys has joined #openstack-keystone | 12:36 | |
| *** hrybacki has joined #openstack-keystone | 12:37 | |
| *** gokrokve has quit IRC | 12:37 | |
| ayoung | bknudson, so it looks like we have more work to do on a compliance/MD5 removal front | 12:53 |
| *** stevemar has joined #openstack-keystone | 12:53 | |
| *** henrynash has joined #openstack-keystone | 12:53 | |
| hrybacki | ayoung: any time this morning to hammer out a tentative timeline/milestone list? | 12:54 |
| ayoung | hrybacki, sure | 12:54 |
| *** richm has joined #openstack-keystone | 12:54 | |
| ayoung | hrybacki, the majore milestone is "submit change to glance client that uses keystoneclient sessions" | 12:54 |
| ayoung | Ideally, that would be followed by getting it merged into the repo | 12:55 |
| hrybacki | Nods | 12:55 |
| hrybacki | now lets work backwards from there -- you said you are doing something very similar with horizon? | 12:56 |
| ayoung | hrybacki, yeah | 13:02 |
| ayoung | horizon uses a separate project... | 13:02 |
| *** leseb has joined #openstack-keystone | 13:02 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Always use a hash based Public ID for cross backend identifiers https://review.openstack.org/100497 | 13:02 |
| hrybacki | ? | 13:02 |
| ayoung | hrybacki, openstack/django_openstack_auth | 13:02 |
| ayoung | So I am working on getting that to use the session object instead of just making a client | 13:03 |
| hrybacki | oh, well that'll make it simple :P | 13:03 |
| ayoung | and...then there is going to be some other fun stuff that doesn't involve this | 13:03 |
| ayoung | hrybacki, I don';t know how granular we can make this | 13:03 |
| ayoung | you need to go dig in to the glance code and see what it is doing | 13:04 |
| henrynash | ayoung: are you persuing the endpoint-specific policy idea….I’d be happy to provide some help if you need it? | 13:04 |
| ayoung | ideally, you will be running not just the glance unit tests, but the tempest tests as well | 13:04 |
| henrynash | ayoung: saw that the spec is a little “light” right now | 13:04 |
| ayoung | henrynash, yeah, although I was afraid we'd have to set it on the back burner. If you ahve thoughts, I'd love to hear them | 13:04 |
| ayoung | henrynash, the question is how to get the right policy | 13:05 |
| henrynash | ayoung: backburner due to lack of time, or problems | 13:05 |
| hrybacki | ayoung: I raised the question yesterday, with tempest can you even run 'component specific' suites? It seems very broad strokes | 13:05 |
| ayoung | and maybe it should not be due to "endpoint id" but rather the project of the service user that fetches the policy | 13:05 |
| ayoung | hrybacki, I think you can. dkranz (internal and external) should be able to help you there | 13:05 |
| henrynash | ayoung: Ok, so probably worth atricuating the use cases….I’ll take a crack at that | 13:05 |
| ayoung | henrynash, ++ | 13:06 |
| ayoung | henrynash, one other thing | 13:06 |
| ayoung | dolphm has this idea that we don;t need to fetch just the policy for the endpoint | 13:06 |
| hrybacki | ayoung++ | 13:06 |
| ayoung | so we can have a unified policy file for all endpoints within a single scope | 13:06 |
| ayoung | whatever that scope might be | 13:06 |
| *** leseb has quit IRC | 13:07 | |
| ayoung | henrynash, one nice aspect of that is they can then share the top level rules like is_admin.... | 13:07 |
| henrynash | ayoung: hmmm, OK, kind of see the idea…let me mull on that…. | 13:07 |
| ayoung | but, it leads to complexity on the maintain and assemble side of the policy process | 13:07 |
| henrynash | ayoung: yeah, agreed…. | 13:07 |
| henrynash | ayoung: get’s hard to easily see what the rule is for a given API | 13:07 |
| ayoung | henrynash, so, while we could do it all with CLI tools, it might make sense to be able to assemble a policy blob out of other policy blobs inside of keystone, but that is a lot of overhead | 13:08 |
| henrynash | ayoung: yeah, and right now we never interpret the blob….REALLY you’d want keystone (or maybe support functions in oslo) to geneate the resulting policy file from a hiearchy of blobs (!) | 13:09 |
| *** jsavak has joined #openstack-keystone | 13:09 | |
| hrybacki | ayoung: I don't see dkranz around, what channels is he normally in / is he in another time zone? | 13:10 |
| *** joesavak has quit IRC | 13:10 | |
| henrynash | ayoung, dolphm, morganfainberg, dtsanek: Unless any more concerns, really like to get latest version of multi-backend uuid spec: https://review.openstack.org/#/c/100497/ approved….as well as and new version of pre-cursor move of ID generation from controller to manager: https://review.openstack.org/#/c/100833/ | 13:11 |
| ayoung | henrynash, dagnabit, I just +2ed that | 13:12 |
| henrynash | ayoung: ah, great, thx | 13:12 |
| ayoung | henrynash, and another +2...we need to stop bike shedding. Specs do not need to be letter perfect until we decide to turn them in to documentation | 13:13 |
| *** ayoung is now known as ayoung_afk | 13:13 | |
| ayoung_afk | biab | 13:13 |
| *** henrynash has quit IRC | 13:26 | |
| *** bknudson has left #openstack-keystone | 13:28 | |
| *** joesavak has joined #openstack-keystone | 13:31 | |
| *** ayoung_afk is now known as ayoung | 13:32 | |
| *** gokrokve has joined #openstack-keystone | 13:34 | |
| *** jsavak has quit IRC | 13:34 | |
| *** gokrokve has quit IRC | 13:39 | |
| *** amirosh has quit IRC | 13:41 | |
| *** bknudson has joined #openstack-keystone | 13:42 | |
| *** zhiyan_ has quit IRC | 13:50 | |
| *** joesavak has quit IRC | 13:53 | |
| *** gokrokve has joined #openstack-keystone | 13:55 | |
| marekd | stevemar: thanks for +2 :-) | 13:58 |
| * stevemar shrugs, it was well done, and a good reason /cc marekd | 13:58 | |
| * marekd lol | 13:59 | |
| stevemar | thats my criteria anyway :P | 13:59 |
| stevemar | marekd, i think i know what was wrong with my sp/idp config | 13:59 |
| marekd | stevemar: tell me! | 13:59 |
| *** gokrokve has quit IRC | 14:00 | |
| stevemar | marekd, in the sp metadata, the AssertionConsumerService values didn't have the port numbers | 14:00 |
| stevemar | i have hacked it up, sent it to our idp guy, (i don't have access to the box) | 14:01 |
| marekd | stevemar: i am checking again the file i had sent to you and i looks like mine had port sepcified. | 14:01 |
| stevemar | yeah | 14:02 |
| marekd | stevemar: ah ok...i thought i had provided you wrong examples. | 14:02 |
| stevemar | did you get it generated that way? or did you hack it up? | 14:02 |
| *** gokrokve has joined #openstack-keystone | 14:02 | |
| *** leseb has joined #openstack-keystone | 14:03 | |
| marekd | stevemar: I hacked it, but I just confirmed, that when you have port specified in shibboleth2.xml config you just download Metadata and everything is in place. | 14:04 |
| *** comstud is now known as bearhands | 14:04 | |
| stevemar | marekd, where do you specify it | 14:05 |
| stevemar | ? | 14:05 |
| marekd | stevemar: what, port? | 14:05 |
| stevemar | marekd, yeah | 14:05 |
| stevemar | its a big config file :) | 14:05 |
| hrybacki | trying to setup a keystone server from the repo on Fedora 20, having problems using pip to install the requirements -- failing on libxml (of course) -- the docs are from Fedora 15 http://docs.openstack.org/developer/keystone/setup.html -- I can't seem to figure out which version of libxml to install -- thoughts? | 14:05 |
| marekd | stevemar: wait a sec - you are asking about Metadata or shibboleth2.xml now? | 14:05 |
| *** daneyon has joined #openstack-keystone | 14:06 | |
| hrybacki | error log: http://fpaste.org/111480/73159140/ | 14:06 |
| stevemar | marekd, shibboleth2, metadata is auto generated right? | 14:06 |
| marekd | stevemar: yes. metadata is something usually accessible from http://service_provider.org:<port>/Shibboleth.sso/Metadata | 14:07 |
| *** leseb has quit IRC | 14:07 | |
| stevemar | marekd, correct, so is there a way I can specify the port # in shibboleth2.xml, so that when I fetch the metadata, it's already there? | 14:07 |
| *** radez_g0n3 is now known as radez | 14:08 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/100279 | 14:12 |
| marekd | stevemar: sec. | 14:13 |
| *** joesavak has joined #openstack-keystone | 14:14 | |
| bknudson | morganfainberg: regarding keystonemiddleware -- | 14:14 |
| bknudson | could add doc/source/api/ to .gitignore | 14:14 |
| bknudson | morganfainberg: doesn't look like keystonemiddleware uses argparse, so could remove that from requirements.txt | 14:16 |
| marekd | stevemar: ok, i gave you wrong info...to much ad-hoc hacking :( You don't specify port in your shibboleth2.xml file. What you do is (of course) setup vhost to listen on a port, like 5000, and when getting a Metadata later to be provided to the IdP you just specify the port in the URL: https://keystone-sp.local:5000/Shibboleth.sso/Metadata -> Shibboleth will adjust the URLs in the file accordingly. Just checked with various ports. | 14:16 |
| marekd | brb | 14:17 |
| bknudson | morganfainberg: should update the httpretty req in test-requirementst.xt | 14:18 |
| bknudson | morganfainberg: and remove keyring , it's not used in middleware | 14:18 |
| bknudson | morganfainberg: and oauthlib | 14:18 |
| morganfainberg | bknudson sure | 14:20 |
| morganfainberg | will do | 14:20 |
| *** httt has joined #openstack-keystone | 14:21 | |
| bknudson | morganfainberg: also, bring over tools/debug_helper.sh | 14:21 |
| morganfainberg | bknudson we can also add change any of this once the repo is made. | 14:21 |
| *** httt has quit IRC | 14:21 | |
| bknudson | morganfainberg: y, I don't think any of these are required... except would be good to have httpretty req correct, otherwise everything will fail | 14:23 |
| morganfainberg | bknudson, ++ yeah fixing it now | 14:23 |
| marekd | stevemar: do you know if eventually jamielennox|away is working on something more...pluggable and extendable regarding auth methods in OSC? | 14:27 |
| marekd | stevemar: otherwise I thought about pointing that out to Matthieu and Florent. | 14:28 |
| morganfainberg | bknudson, ok updated all of those items. | 14:28 |
| marekd | jamielennox|away: is 8h ahead of me so it's quite difficult to catch up with him | 14:28 |
| *** david-lyle has joined #openstack-keystone | 14:29 | |
| bknudson | morganfainberg: thanks, +2 | 14:31 |
| marekd | dstanek: o/ | 14:31 |
| morganfainberg | bknudson, i learned a lot more about git doing this. the graduation scripts were insufficient but subtree is kinda neat | 14:32 |
| bknudson | morganfainberg: so it actually has the commit history for just the parts included? | 14:32 |
| morganfainberg | yep | 14:32 |
| marekd | dstanek: was just about to ask to review _AuthConstructor patch :P | 14:33 |
| morganfainberg | 680 commits sources from across keystoneclient and keystone server (and some for setting up this repo) | 14:33 |
| bknudson | looks like it's got commits from other parts too | 14:34 |
| hrybacki | Anyone run into ' TypeError: dist must be a Distribution instance ' when running setup.py for keystone before? | 14:34 |
| stevemar | marekd, i doubt he is looking at it, you could point mathieu and florent there if you'd like | 14:34 |
| marekd | stevemar: ok | 14:35 |
| *** BAKfr has quit IRC | 14:35 | |
| ayoung | bknudson, did you see my previous message? | 14:35 |
| marekd | stevemar: i will take a look at his patches and write them an e-mail. | 14:35 |
| *** rwsu has joined #openstack-keystone | 14:35 | |
| morganfainberg | bknudson, well there was some stuff that needed intermeidiary repos to get it merged together | 14:35 |
| bknudson | ayoung: which? | 14:35 |
| ayoung | bknudson, so it looks like we have more work to do on a compliance/MD5 removal front; Horizon hard codes MD5 into its auth code. | 14:36 |
| ayoung | https://github.com/openstack/django_openstack_auth/blob/master/openstack_auth/user.py#L72 | 14:36 |
| ayoung | bknudson, basically, Horizon punts on anything PKI tokenish | 14:37 |
| ayoung | if the token is ASN1 (starts with MII) they MD5 hash it | 14:37 |
| ayoung | which, to be fair, was what I told them to do, two years ago | 14:37 |
| bknudson | ayoung: y, we weren't using horizon so I wasn't looking at it. | 14:37 |
| ayoung | bknudson, you suck | 14:38 |
| *** gokrokve has quit IRC | 14:38 | |
| ayoung | hrybacki, I have not | 14:38 |
| ayoung | hrybacki, but then, I never run that directly | 14:38 |
| hrybacki | ayoung: thought it would be a good exercise and I could update the docs afterwards, might be a fruitless idea | 14:39 |
| ayoung | hrybacki, are you running inside a venv? | 14:39 |
| hrybacki | of course | 14:39 |
| hrybacki | http://fpaste.org/111487/74377140/ -- output if you'd like to take a look | 14:40 |
| dstanek | marekd: hi | 14:41 |
| *** radez is now known as radez_g0n3 | 14:42 | |
| dstanek | marekd: yeah, i saw it in my inbox. i | 14:42 |
| dstanek | 'm actually going to reviews with next-review now | 14:43 |
| marekd | next-review? | 14:43 |
| bknudson | marekd: https://pypi.python.org/pypi/next-review | 14:48 |
| dstanek | yeah, it uses you starred projects to suggest the next review to work on | 14:49 |
| marekd | bknudson: dstanek oh, that's great :-) | 14:49 |
| marekd | dstanek: ...or 'about to expire' projects. | 14:50 |
| ayoung | hrybacki, "/usr/lib64/python2.7/distutils/cmd.py" I wonder if there is a version conflict | 14:55 |
| ayoung | might be a version of PBR? Or Of distutils? | 14:55 |
| *** chandan_kumar has joined #openstack-keystone | 14:55 | |
| hrybacki | hrm | 14:56 |
| ayoung | hrybacki, are you running with both of these from RPMS? | 14:56 |
| ayoung | because the tox version builds a venv and installs from PIP | 14:56 |
| ayoung | and you are likely to have older versions in the RPM approach | 14:56 |
| morganfainberg | dstanek, gertty is pretty awesome too | 14:57 |
| morganfainberg | but you need some of the in-flight reviews for gertty to be non-crashy | 14:57 |
| ayoung | bknudson, are you guys really punting on all of Horizon | 14:57 |
| * ayoung so jealous | 14:57 | |
| hrybacki | ayoung: I literally followed http://docs.openstack.org/developer/keystone/setup.html (with a few more system utilities installed as they are needed for stuff now) | 14:57 |
| hrybacki | haven't even gotten to running tests yet | 14:57 |
| bknudson | ayoung: that was the value add -- we had a "better" UI. | 14:58 |
| *** radez_g0n3 is now known as radez | 14:58 | |
| ayoung | hrybacki, when you ran setup.py did you have the venv activated? | 14:58 |
| hrybacki | yes | 14:58 |
| bknudson | ayoung: although with the icehouse release we actually do have horizon | 14:58 |
| ayoung | bknudson, OK, so you need to solve this too. Good | 14:59 |
| ayoung | bknudson, here's my thought | 14:59 |
| bknudson | ayoung: we'll need to solve it | 14:59 |
| ayoung | we should make Horizon cache the PKI tokens | 14:59 |
| dstanek | morganfainberg: gertty looks interesting | 14:59 |
| ayoung | but we should make that easy to do | 14:59 |
| bknudson | I would probably assign it to our horizon group | 14:59 |
| ayoung | so, we take the caching code from Auth token middleware and move it into the keystone client | 14:59 |
| bknudson | token caching? | 14:59 |
| ayoung | and then any client can use it | 14:59 |
| dstanek | morganfainberg: do you use it? | 14:59 |
| ayoung | its up to that client to select the caching backend | 15:00 |
| ayoung | and so we will support the memcached (swift ring?) and in memory KVS | 15:00 |
| morganfainberg | dstanek, yeah | 15:00 |
| morganfainberg | dstanek, i actually dig it | 15:00 |
| bknudson | ayoung: luckily the token caching code was just moved into its own class | 15:00 |
| ayoung | should be code just like the KVS stuff in Keystone that morganfainberg did. Using Dogpile. | 15:00 |
| ayoung | was it? Good | 15:00 |
| bknudson | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/middleware/auth_token.py#n1346 | 15:01 |
| bknudson | It's probably still got some auth-token specific things | 15:01 |
| dstanek | what do i use for the password since we login through launchpad? | 15:01 |
| dstanek | morganfainberg: ^ | 15:01 |
| bknudson | ayoung: well, looking at it it's not too bad. | 15:02 |
| morganfainberg | dstanek, you create an http password in gerrit | 15:02 |
| ayoung | bknudson, agreed | 15:02 |
| morganfainberg | dstanek, https://review.openstack.org/#/settings/http-password | 15:02 |
| ayoung | bknudson, and we'll need that for Ephemeral | 15:02 |
| ayoung | bknudson, I'm going to be doing a bunch of work in that modulke anyway for Kerberos | 15:02 |
| bknudson | ayoung: the env thing is auth-token specific but that should be easy to move out | 15:02 |
| ayoung | to include making it use the Session object | 15:02 |
| hrybacki | ayoung: pbr is the current version in the venv | 15:02 |
| dstanek | morganfainberg: thx | 15:02 |
| bknudson | pass in the cache rather than have TokenCache extract it from the env | 15:03 |
| ayoung | hrybacki, if you run tox -epy27 it builds a venv for you. See if you can spot the difference between what that does and what you did by hand | 15:03 |
| ayoung | the venv is in .tox/py27 | 15:03 |
| hrybacki | nods | 15:03 |
| ayoung | and the config for it is in tox.ini | 15:03 |
| morganfainberg | dstanek, you'll want to cherrypick this: https://review.openstack.org/#/c/99563/ and https://review.openstack.org/#/c/99272/ this in | 15:03 |
| dstanek | morganfainberg: whoa - offline use? | 15:03 |
| morganfainberg | dstanek, yep, | 15:03 |
| morganfainberg | dstanek, :) it's pretty awesome... plane flight and able to do reviews! | 15:04 |
| *** leseb has joined #openstack-keystone | 15:04 | |
| morganfainberg | w/o wifi on flight | 15:04 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Add V3 parameters to V2 Password plugin https://review.openstack.org/101574 | 15:04 |
| *** thedodd has joined #openstack-keystone | 15:05 | |
| morganfainberg | bknudson, dstanek, ayoung, do you see a benefit to having the milestone-proposed logic for the middleware repo? | 15:06 |
| morganfainberg | e.g. so we could release a patch to a specific version instead of needing a complete release to "fix" a bug? | 15:06 |
| bknudson | morganfainberg: we're releasing on a different schedule | 15:06 |
| morganfainberg | bknudson, right, but does it benefit us to have milestone-proposed capabilities | 15:06 |
| ayoung | morganfainberg, hmmm | 15:06 |
| morganfainberg | so we can do 1.0.1 with an isloated fix instead of a "next release" 1.1 or a 1.0.1 with a bunch of other things | 15:07 |
| ayoung | morganfainberg, my concern is that we are going to fix something, and then every project is going to have to update its minimum version. And that needs to be coordinated | 15:07 |
| ayoung | yeah... | 15:07 |
| bknudson | morganfainberg: hmmm... well, we do seem to have the occasional security issue, so maybe it would be useful | 15:07 |
| ayoung | yes, that seems like the right approach | 15:07 |
| bknudson | morganfainberg: is there any reason not to? | 15:08 |
| morganfainberg | bknudson, if we want it, we get it. if we don't want it, i'm removing it from the ACL | 15:08 |
| *** leseb has quit IRC | 15:08 | |
| morganfainberg | bknudson, we can always add it back in later, but it's an infra-config change to add it back in | 15:08 |
| morganfainberg | if we're not going to use it, it's not worth cluttering up the ACL file. | 15:08 |
| bknudson | morganfainberg: does keystoneclient have it? | 15:09 |
| morganfainberg | bknudson, it does, we never use it | 15:09 |
| morganfainberg | bknudson, we tend to bundlefixes into the next release | 15:09 |
| bknudson | y, we're not shy about releasing new keystoneclient | 15:09 |
| morganfainberg | but with calling this 1.0.0 (stable), we may want to be more rigid about releasing versions of the iddleware | 15:10 |
| bknudson | that is funny that keystoneclient isn't 1.0 | 15:10 |
| dstanek | marekd: i think in https://review.openstack.org/#/c/83829/19 you should do the same response to expected renaming in all of the methods | 15:10 |
| morganfainberg | also going to make the requirements <=1.999.0 when we release | 15:10 |
| morganfainberg | so we can have a 2.0 milestone (restructure) down the line. | 15:10 |
| dstanek | marekd: then you could get rig of the extra attrs assertion method | 15:10 |
| marekd | dstanek: roger that! | 15:11 |
| morganfainberg | if we want. | 15:11 |
| bknudson | morganfainberg: 2.0 means that we removed deprecated function | 15:11 |
| morganfainberg | or even totally change things between major versions | 15:11 |
| morganfainberg | bknudson, yep. exactly. | 15:11 |
| marekd | dstanek: i enforced mapping_id in the func signature. | 15:11 |
| bknudson | morganfainberg: it has to be backwards compat with non-deprecated | 15:11 |
| morganfainberg | bknudson, well sortof | 15:11 |
| marekd | dstanek: but if it goes i feel a should issue a patch for idps and mappings (already merged) | 15:11 |
| bknudson | morganfainberg: otherwise we should call it middleware2 or something | 15:12 |
| bknudson | middleware-ng | 15:12 |
| morganfainberg | bknudson, if the global req says <=1.999 in theory the release could be 2.0 and break compat | 15:12 |
| morganfainberg | bknudson, we wouldn't break older versions of openstack, new versions would get the new package based on res | 15:12 |
| morganfainberg | reqs* | 15:12 |
| bknudson | morganfainberg: when reqs are updated they need to overlap | 15:13 |
| morganfainberg | bknudson, overlap what? | 15:13 |
| bknudson | morganfainberg: overlap with the prev version. | 15:13 |
| bknudson | otherwise you get a split gate | 15:13 |
| bknudson | so the apps would need to support using both versions | 15:13 |
| bknudson | morganfainberg: ask sdague about it | 15:14 |
| morganfainberg | bknudson, sortof. there are ways around it | 15:14 |
| *** joesavak has quit IRC | 15:14 | |
| morganfainberg | bknudson, i've been working on some of this for mod_wsgi deployments | 15:14 |
| morganfainberg | bknudson, but in either case, major versions should be... well in fact major | 15:14 |
| morganfainberg | ok so, are we really going to use milestone-proposed? or should we just add it in if we do need it? | 15:15 |
| morganfainberg | i'm thining latter vs former | 15:15 |
| bknudson | I assume we can remove it? | 15:16 |
| bknudson | I'd want dolphm's opinion on it since he might have some idea of what it would be used for. | 15:16 |
| morganfainberg | bknudson, we can change / add the permissions to do that as needed w/ a review | 15:16 |
| morganfainberg | bknudson, it's really easy. and we're not going to release 1.0.0 of this until we get some fixes through review | 15:16 |
| bknudson | it's scary to be making changes to it if it's not gating | 15:17 |
| bknudson | covered by tempest | 15:17 |
| morganfainberg | bknudson, we can't gate initially. | 15:21 |
| morganfainberg | the way we will need to test the gate on it is add the repo to the requirements and have a project or two try it out before release. | 15:21 |
| morganfainberg | once we do a release we can add it to the gate, but -- it's something we need projects to be updated for. | 15:22 |
| bknudson | morganfainberg: maybe we need a moratorium on anything other than obvious bug fixes until it's gating. | 15:22 |
| morganfainberg | bknudson, we can also do an alpha release. | 15:22 |
| *** joesavak has joined #openstack-keystone | 15:23 | |
| bknudson | alpha release seems like the way to go | 15:23 |
| morganfainberg | and get a review up that would have a project use it and just use that as a test-bed | 15:23 |
| morganfainberg | once we're ready to cut the release and update projects (reviews standing by) i'll add the tripleo-expirimental and the tempest tests in for it | 15:24 |
| bknudson | morganfainberg: there shouldn't be any new tempest test? | 15:24 |
| morganfainberg | so the moment the merge to cut over to it goes through we are gating. but i didn't want to pre-load those tests until we were sure. easy reviews to add the tests. | 15:24 |
| bknudson | unless we want something covering the middleware in keystoneclient | 15:24 |
| morganfainberg | bknudson, tempest doesn't test middleware directly, it does indirectly | 15:24 |
| morganfainberg | bknudson, i can add tempest tests back in if we have some direct test mechanism we want to add | 15:25 |
| marekd | dolphm: next-review. Is there any way to make it open another review even the first proposed patch was not reviewed? :P | 15:25 |
| bknudson | morganfainberg: I mean we'd run tempest where the services are configured to use keystoneclient middleware | 15:25 |
| bknudson | vs middleware middleware | 15:25 |
| bknudson | as in a devstack option | 15:26 |
| morganfainberg | bknudson, right. i'm ok adding in tempest again. | 15:26 |
| morganfainberg | bknudson, it just means until a project uses the new middleware, it's needlessly running tempest gate. | 15:27 |
| bknudson | morganfainberg: oh, you're talking about tempest for changes to keystonemiddleware? | 15:28 |
| dstanek | ayoung: i would love to have a few small things in https://review.openstack.org/#/c/100833/ fixed before it is merged. | 15:28 |
| morganfainberg | yes | 15:28 |
| *** mberlin has quit IRC | 15:28 | |
| morganfainberg | once we have projects consuming it we should gate on every change. | 15:28 |
| morganfainberg | but until then. | 15:28 |
| dstanek | ayoung: i don't see henry here so i'll quickly make the changes and then i think it's ready to merge | 15:28 |
| bknudson | morganfainberg: I assumed you'd turn that on since there's no reason to delay switching the projects to it. | 15:29 |
| morganfainberg | i can add those back in easily | 15:29 |
| morganfainberg | it's no impact if we are going to do a release quicly of this | 15:29 |
| bknudson | I assumed there wouldn't be many commits to keystonemiddleware before other projects were switched over | 15:29 |
| *** wchrisj has joined #openstack-keystone | 15:29 | |
| morganfainberg | if we're going to roll up other things before we do a release, then no real need to burn the resources | 15:29 |
| *** mberlin has joined #openstack-keystone | 15:29 | |
| morganfainberg | bknudson, agian, defering to folks here on this | 15:30 |
| bknudson | y, it's easy to change so don't worry about it | 15:30 |
| bknudson | that's the whole point of software defined environments | 15:31 |
| wchrisj | hey :dolphm - got a sec? | 15:31 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Rename v3._AuthConstructor to v3.AuthConstructor https://review.openstack.org/101127 | 15:31 |
| morganfainberg | wchrisj, dolphm is MIA today | 15:31 |
| bknudson | morganfainberg: I'm thinking I should -2 all my auth_token changes... | 15:32 |
| wchrisj | tkx :morganfainberg | 15:32 |
| morganfainberg | wchrisj, perhaps someone else can help you? | 15:32 |
| bknudson | then I'll just transfer them over to keystonemiddlware | 15:32 |
| morganfainberg | bknudson, I would prefer changes all go into the new repo once it's created today | 15:32 |
| wchrisj | sure - have been working with the docs related to identity, specifically here: http://developer.openstack.org/api-ref-identity-v3.html | 15:33 |
| wchrisj | specifically with the get token call | 15:33 |
| wchrisj | post /auth/tokens | 15:34 |
| bknudson | https://review.openstack.org/#/q/status:open+project:openstack/python-keystoneclient+file:keystoneclient/middleware/auth_token.py,n,z | 15:34 |
| wchrisj | It's not very obvious wht the request/response would look like - some differ greatly | 15:34 |
| wchrisj | Would you guys be receptive if I restructured that part of the page to show the requests and associated responses? | 15:34 |
| morganfainberg | bknudson, so, add the tempest gate jobs for keystonemiddleware back in once we're cutting a release? | 15:35 |
| wchrisj | wanted to see if it was done that way with a purpose in mind or not? | 15:35 |
| bknudson | wchrisj: good luck with that | 15:35 |
| morganfainberg | bknudson, or now (since i need to push a new patchset now anyway) | 15:35 |
| wchrisj | howso :bknudson ? | 15:35 |
| wchrisj | was that sarcasm or honesty? | 15:35 |
| wchrisj | ;-) | 15:35 |
| bknudson | morganfainberg: y, add the tempest gate job in once we've had a chance to verify that it's not completely broken | 15:36 |
| morganfainberg | k | 15:36 |
| bknudson | wchrisj: if you can figure out how to change the files to get the docs to look correct I'd be impressed. | 15:36 |
| wchrisj | I'll see what I can do :bknudson - a challenge! | 15:37 |
| bknudson | wchrisj: I've only been able to look at it on weekends when there's no docs people around, so maybe you'd have better luck. | 15:38 |
| *** daneyon has quit IRC | 15:39 | |
| *** nsquare has joined #openstack-keystone | 15:39 | |
| bknudson | wchrisj: the sample jsons don't say whether it's the request or the response. | 15:40 |
| *** gokrokve has joined #openstack-keystone | 15:41 | |
| richm | ayoung: ping - re: http://adam.younglogic.com/2014/04/packstack-to-ldap/ - it is working, including with users created in AD - keystone user-get aduser@addomain.test shows the user | 15:44 |
| wchrisj | Thanks :bknudson, in the past I've pinged Anne Gentile, who has been a HUGE help. I'll ask if I cant figure it out. That API call in particular really needs to be MUCH clearer. All it would take is someone to test/record all the requests and responses and plug them into the docs. | 15:45 |
| richm | ayoung: however, the keystone user - how do I make it an 'admin' user, since the 'admin' user is not working? | 15:45 |
| bknudson | wchrisj: there's some examples here: http://docs.openstack.org/developer/keystone/api_curl_examples.html | 15:45 |
| bknudson | which is in rst so it's easy to edit | 15:46 |
| wchrisj | Thanks! | 15:46 |
| wchrisj | That's a LOT easier to read too - what is the diff between that page and the one I noted earlier? | 15:48 |
| *** sbasamaway is now known as sbasam | 15:48 | |
| wchrisj | :bknudson ^^ | 15:48 |
| bknudson | wchrisj: here's the source for the developer docs: http://git.openstack.org/cgit/openstack/keystone/tree/doc/source/api_curl_examples.rst | 15:48 |
| *** ncoghlan_afk is now known as ncoghlan | 15:49 | |
| wchrisj | What's the diff between these dev docs and what I see on the http://developer.openstack.org/ site? | 15:49 |
| bknudson | wchrisj: here's the source for the api site -- http://git.openstack.org/cgit/openstack/api-site/tree/api-ref/src/wadls/identity-api/src/v3/wadl/identity-admin-v3.wadl | 15:49 |
| bknudson | wchrisj: rst is easier to write than wadls | 15:49 |
| richm | perhaps someone else can answer - If I have a user that I want to make an admin, and I have "locked myself out" of using the keystone client, what sql do I need to do to make this user an admin user? | 15:50 |
| wchrisj | :bknudson ^^ | 15:50 |
| bknudson | richm: you can use the admin token to do just about anything if you have it configured | 15:51 |
| wchrisj | bknudson - What is the diff between those two sites/git repos? | 15:53 |
| *** marekd is now known as marekd|weekend | 15:53 | |
| wchrisj | Why are things in multiple places? | 15:53 |
| bknudson | wchrisj: the developer docs are supposed to be for keystone developers, whereas the api site is for application developers using openstack | 15:54 |
| wchrisj | So, internal vs external documentation? | 15:54 |
| bknudson | wchrisj: and since keystone developers can't figure out the wadls we don't keep them up to date | 15:54 |
| bknudson | wchrisj: right, internal vs external | 15:54 |
| wchrisj | Yeah, that wadls is tough | 15:55 |
| *** hrybacki_ has joined #openstack-keystone | 15:55 | |
| richm | bknudson: I have OS_SERVICE_TOKEN=string | 15:55 |
| richm | bknudson: in keystone.conf I have admin_token=string | 15:56 |
| wchrisj | thanks again bknudson! | 15:56 |
| bknudson | richm: right, that should do it... I don't know the env var off the top of my head | 15:56 |
| richm | bknudson: If I do that, does keystone bypass ldap authentication? | 15:57 |
| *** jsavak has joined #openstack-keystone | 15:57 | |
| bknudson | richm: yes, it bypasses auth. actually it doesn't do ldap auth anytime a token is used. | 15:57 |
| richm | bknudson: does the user need to be a member of a particular tenant/project/role? | 15:58 |
| bknudson | richm: there's no user when you use the admin token | 15:58 |
| *** hrybacki has quit IRC | 15:59 | |
| bknudson | keystone should probably audit use of the admin token more than it does | 15:59 |
| *** ncoghlan is now known as ncoghlan_afk | 15:59 | |
| richm | hmm - keystone tenant-list is empty, and keystone.log says WARNING: keystone.common.wsgi Authorization failed. - note that this is with Havana | 15:59 |
| morganfainberg | bknudson, +++++++++++++++++ (one million) | 15:59 |
| *** hrybacki_ has quit IRC | 16:00 | |
| richm | the POST to /tokens returns 401 | 16:00 |
| bknudson | richm: y, you don't use the admin token with /tokens... but you should be able to add a role to a user | 16:00 |
| *** joesavak has quit IRC | 16:01 | |
| morganfainberg | bknudson, we should probably emit a CADF notification anytime anything is done with the admin token | 16:01 |
| bknudson | I think tenant-list shows the tenants that the token has access to so it maybe doesn't make sense for the admin token either | 16:01 |
| *** joesavak has joined #openstack-keystone | 16:01 | |
| richm | shouldn't the admin token have access to all tenants? | 16:01 |
| *** jsavak has quit IRC | 16:01 | |
| ayoung | richm, yeah, drop the ADMIN_TOKEN and add a the "admin" role to the user | 16:02 |
| ayoung | usually, you do that in the "admin" project, too | 16:02 |
| ayoung | you want to unset OS_SERVICE_TOKEN and OS_SERVICE_ENDPOINT once you do that | 16:02 |
| ayoung | dstanek, ++ | 16:03 |
| bknudson | richm: you should be able to list all projects, e.g., /v3/projects | 16:03 |
| ayoung | richm, see the part of the blog post that starts with "I don’t tend to user ‘admin’ as the user name for Keystone" | 16:04 |
| *** leseb has joined #openstack-keystone | 16:04 | |
| *** wyllys has left #openstack-keystone | 16:04 | |
| stevemar | marekd|weekend, yay got it working | 16:07 |
| *** joesavak has quit IRC | 16:07 | |
| stevemar | morganfainberg, damn, i didn't think about that, thats probably very critical to audit | 16:09 |
| *** leseb has quit IRC | 16:09 | |
| morganfainberg | stevemar, right? | 16:09 |
| morganfainberg | stevemar, :) | 16:09 |
| stevemar | morganfainberg, wasn't there something going around (on ML) to turn on auditing by default? | 16:10 |
| bknudson | could probably put something in the admin token middleware | 16:10 |
| morganfainberg | bknudson, thats where i'd put the audit stuff for it | 16:10 |
| *** jsavak has joined #openstack-keystone | 16:13 | |
| bknudson | would be great if we could get this merged somewhat quickly -- https://review.openstack.org/#/c/77210/ (haven't reviewed it myself yet) | 16:25 |
| bknudson | +28, -2959 | 16:25 |
| morganfainberg | bknudson, ooooooh /me likes | 16:28 |
| morganfainberg | bknudson, is https://review.openstack.org/#/c/77210/18/etc/keystone.conf.sample supposed to be 'oslo.sqlite' by default? | 16:31 |
| *** gyee has joined #openstack-keystone | 16:31 | |
| bknudson | morganfainberg: keystone doesn't use that option so it doesn't matter | 16:32 |
| morganfainberg | ok | 16:32 |
| bknudson | morganfainberg: I tried to get them to remove the option since oslo.db doesn't even use it | 16:32 |
| ayoung | morganfainberg, bknudson I thinkg that might mess up the extensions migrations | 16:33 |
| bknudson | but was -2 because other projects supposedly use it. | 16:33 |
| bknudson | ayoung: do we have tests for extensions migrations? probably not... | 16:33 |
| ayoung | bknudson, they should get run when the extensions themselves do | 16:34 |
| ayoung | but if we are doing the "create the tables from the models" approach, then they won't | 16:34 |
| bknudson | ayoung: ok, were those tests rmoeved? | 16:34 |
| bknudson | removed | 16:34 |
| *** marcoemorais has joined #openstack-keystone | 16:42 | |
| *** radez is now known as radez_g0n3 | 16:43 | |
| bknudson | we should definitely try things out with the oslo.db code ... if you do comment on the review | 16:46 |
| *** jsavak has quit IRC | 16:48 | |
| *** praneshp has joined #openstack-keystone | 16:52 | |
| ayoung | Could we make Horizon work only with V3 of the Keystone API from Juno on forward? | 16:52 |
| bknudson | why not? what's missing? | 16:52 |
| ayoung | V3 does everything that V2 does, right? | 16:52 |
| ayoung | bknudson, I think the DB code above is OK | 16:53 |
| bknudson | /v3/extensions | 16:53 |
| bknudson | I don't know if horizon uses /v2/extensions | 16:53 |
| ayoung | I'll check with the Horizon folks, but I think that the dual version thing is just a case of old code not going away yet | 16:53 |
| *** i159 has quit IRC | 16:54 | |
| *** richm has quit IRC | 16:55 | |
| *** nsquare has quit IRC | 16:56 | |
| *** marcoemorais has quit IRC | 16:59 | |
| *** marcoemorais has joined #openstack-keystone | 17:00 | |
| stevemar | Does horizon have a notion of domain and groups yet? | 17:00 |
| stevemar | ayoung, bknudson ^ | 17:00 |
| *** harlowja_away is now known as harlowja | 17:00 | |
| gyee | david-lyle ^^^ | 17:01 |
| stevemar | thx gyee :) | 17:01 |
| gyee | I think Horizon is v3 capable, but david-lyle is the authoritative voice on this one | 17:02 |
| *** leseb has joined #openstack-keystone | 17:05 | |
| *** leseb has quit IRC | 17:10 | |
| *** richm has joined #openstack-keystone | 17:10 | |
| david-lyle | Horizon has keystone v3 support | 17:12 |
| david-lyle | it was the default in Havana, but we switched back to keystone v2.0 as the default in Icehouse due to other clients not supporting v3 | 17:13 |
| david-lyle | if you want to use v3 in Horizon, you can make a local_settings.py change to tell it to use v3 | 17:13 |
| david-lyle | without other services support v3, we can't operate outside the default domain | 17:14 |
| gyee | stevemar, there ya go ^^^ | 17:14 |
| *** browne has joined #openstack-keystone | 17:16 | |
| david-lyle | we could hedge and use v3 and make a note that multidomain support is turned off, but we were afraid the loophole that allows use of the default domain would get closed | 17:16 |
| stevemar | ahhh i see | 17:18 |
| stevemar | oh david-lyle btw - could you look @ this keystone spec, and provide any feedback: https://review.openstack.org/#/c/96867/ | 17:19 |
| stevemar | we're all rather clueless on horizon details :) | 17:19 |
| *** joesavak has joined #openstack-keystone | 17:19 | |
| *** nsquare has joined #openstack-keystone | 17:23 | |
| *** jsavak has joined #openstack-keystone | 17:24 | |
| *** richm has quit IRC | 17:26 | |
| *** joesavak has quit IRC | 17:28 | |
| *** daneyon has joined #openstack-keystone | 17:38 | |
| gyee | ayoung, why Apache process is apache2 in debian, but httpd in fedora? | 17:41 |
| gyee | why two different names? just curious | 17:41 |
| *** richm has joined #openstack-keystone | 17:42 | |
| *** diegows has quit IRC | 17:43 | |
| *** topol has quit IRC | 17:54 | |
| dstanek | i remember reviewing some fixes for the new hacking version, but i can't find them anymore | 17:54 |
| *** lbragstad has joined #openstack-keystone | 18:00 | |
| dstanek | gyee: i think back in the day you could install apache or apache2 on debain | 18:02 |
| *** marcoemorais has quit IRC | 18:02 | |
| *** marcoemorais has joined #openstack-keystone | 18:02 | |
| dstanek | gyee: maybe fedora just switched from apache to apache2? | 18:02 |
| gyee | dstanek, its apache2 now on debian | 18:03 |
| gyee | but its called httpd on fedora so I was wondering why the inconsistency | 18:03 |
| ayoung | gyee, apache 1 vs 2, but fedora just cut over at one point, IIRC | 18:03 |
| gyee | ayoung, fedora switched over to apache2 now, as oppose to httpd? | 18:05 |
| ayoung | david-lyle, but even if you go V3, you can talk to all the other services with V3 tokens | 18:05 |
| gyee | that would be awesome | 18:05 |
| ayoung | no reason to limit Horzion to v2, is there? | 18:05 |
| ayoung | or does that change the UI? | 18:05 |
| *** leseb has joined #openstack-keystone | 18:06 | |
| *** leseb has quit IRC | 18:10 | |
| dstanek | gyee: right, there used to be an apache for 1.3 way back when | 18:10 |
| morganfainberg | ayoung, think it changes the ui | 18:12 |
| morganfainberg | ayoung, but.. i mean.. david-lyle is the exper here ;) | 18:12 |
| *** marcoemorais has quit IRC | 18:13 | |
| lbragstad | dolphm: do you have a set amount of days that a bug is assigned to someone without activity before unassigning? | 18:18 |
| lbragstad | or morganfainberg ? ^ | 18:18 |
| morganfainberg | lbragstad, not sure what dolphm's metric for that is | 18:19 |
| david-lyle | ayoung, only if you are using limiting to the default domain | 18:21 |
| ayoung | david-lyle, well, I wonder where that breaks down. Keystone and auth_token both handle V3 fine. What doesn't handle V3? | 18:21 |
| david-lyle | let me find the code line again | 18:22 |
| morganfainberg | ayoung, afaik nova has issues with v3 | 18:22 |
| lbragstad | morganfainberg: did you happen to know about this at all? https://github.com/jogo/openstack-infra-scripts/blob/master/infra_bugday.py | 18:22 |
| lbragstad | jogo's been using it to wrangle bugs in nova and infra | 18:23 |
| morganfainberg | lbragstad, thats cool | 18:23 |
| lbragstad | not sure if you used it when you went on your Keystone bug binge | 18:23 |
| lbragstad | yeha | 18:23 |
| lbragstad | http://paste.openstack.org/show/84537/ | 18:23 |
| morganfainberg | nope sure didn't | 18:23 |
| *** nsquare has quit IRC | 18:30 | |
| *** joesavak has joined #openstack-keystone | 18:31 | |
| *** juanmo has joined #openstack-keystone | 18:31 | |
| *** openstackgerrit_ has joined #openstack-keystone | 18:32 | |
| *** jsavak has quit IRC | 18:32 | |
| *** marcoemorais has joined #openstack-keystone | 18:34 | |
| david-lyle | ayoung, I believe this line was the issue https://github.com/openstack/keystone/blob/ee27d6eef62d201c99694d0f788ea2a96c6669a4/keystone/token/providers/uuid.py#L448 | 18:36 |
| david-lyle | with v3 tokens coming back from non-default domains | 18:36 |
| david-lyle | get unauthorized every time | 18:36 |
| ayoung | david-lyle, ah, trying to authenticate against the V2 token api | 18:37 |
| david-lyle | yes | 18:37 |
| ayoung | david-lyle, because they all need to do V3 as well | 18:37 |
| david-lyle | login in Horizon with v3 pass token to nova which treats it as v2.0 | 18:38 |
| ayoung | and that is an auth token issue | 18:38 |
| ayoung | IE, we can control that | 18:38 |
| david-lyle | once that is resolved, all for v3 as the default | 18:39 |
| david-lyle | I'll put the patch in immediately after | 18:39 |
| ayoung | david-lyle, ++ | 18:39 |
| *** radez_g0n3 is now known as radez | 18:45 | |
| *** gokrokve_ has joined #openstack-keystone | 18:49 | |
| *** gokrokve has quit IRC | 18:52 | |
| bknudson | morganfainberg: ayoung: I tried out some stuff with the oslo.db change and it worked for me. | 18:55 |
| ayoung | bknudson, excellent. It looks good to me as well so I can support | 18:56 |
| ayoung | bknudson, +2a | 18:56 |
| *** harlowja is now known as harlowja_away | 18:57 | |
| *** harlowja_away is now known as harlowja | 19:01 | |
| bknudson | ayoung morganfainberg: https://review.openstack.org/#/c/101255/ is also needed for oslo.db | 19:02 |
| ayoung | bknudson, +2a | 19:03 |
| *** leseb has joined #openstack-keystone | 19:07 | |
| lbragstad | vhoward: ping | 19:08 |
| lbragstad | vhoward: would you be able to restore https://review.openstack.org/#/c/73907/2 ? | 19:09 |
| lbragstad | or maybe a keystone core? ^ I cleaned up the comments on that patch and was going to push for review. | 19:09 |
| bknudson | lbragstad: restored it | 19:10 |
| lbragstad | bknudson: thank you sir! | 19:10 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Make get_trust a protected method https://review.openstack.org/73907 | 19:10 |
| *** leseb has quit IRC | 19:12 | |
| *** daneyon has quit IRC | 19:14 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Add role ids to the AccessInfo https://review.openstack.org/100774 | 19:15 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Migrate ID generation for users/groups from controller to manager https://review.openstack.org/100833 | 19:18 |
| morganfainberg | dstanek, ^ fixes your comments on henry's patch | 19:18 |
| morganfainberg | ayoung, ^ might want to re-+2 that | 19:19 |
| ayoung | looking | 19:19 |
| ayoung | morganfainberg, what is different? | 19:19 |
| morganfainberg | ayoung, uuid moved up to stdlib in identity.core | 19:20 |
| morganfainberg | ayoung, comment re-write | 19:20 |
| ayoung | k | 19:20 |
| ayoung | lets see if git review -m handles it | 19:21 |
| *** juanmo has quit IRC | 19:21 | |
| *** jsavak has joined #openstack-keystone | 19:22 | |
| ayoung | morganfainberg, how do you like that for a review comment? | 19:22 |
| *** joesavak has quit IRC | 19:23 | |
| dstanek | morganfainberg: nice, thanks | 19:23 |
| morganfainberg | dstanek, sure thing | 19:23 |
| morganfainberg | dstanek want to get that rolled in soon so, figured quickest to fix the minor nits :) | 19:24 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Update docs to reference #openstack-keystone https://review.openstack.org/101633 | 19:30 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Don't set sqlite_db default https://review.openstack.org/101635 | 19:31 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds hacking check for debug logging translations https://review.openstack.org/101636 | 19:33 |
| bknudson | morganfainberg: how goes the middleware repo? | 19:33 |
| dstanek | morganfainberg: ^ took me longer than expected to clean that up | 19:33 |
| morganfainberg | bknudson, waiting on infra now. | 19:33 |
| morganfainberg | bknudson, but they're in the middle of stuff. | 19:34 |
| morganfainberg | bknudson, gate related. | 19:34 |
| bknudson | they're always in the middle of something | 19:34 |
| bknudson | some major crapstorm brewing and we don't even know about it | 19:34 |
| morganfainberg | they're working on getting tempest to run on 14.04 for juno and later | 19:35 |
| *** lbragstad has quit IRC | 19:36 | |
| dstanek | morganfainberg: you forgot a period, but i +2d it anyway | 19:36 |
| morganfainberg | dstanek, LOL ok | 19:36 |
| bknudson | you mean LOL ok. | 19:36 |
| morganfainberg | bknudson, Yes. you. are. right. about. that. | 19:37 |
| morganfainberg | i need to go get lunch | 19:38 |
| *** marcoemorais has quit IRC | 19:48 | |
| *** marcoemorais1 has joined #openstack-keystone | 19:48 | |
| *** nsquare has joined #openstack-keystone | 19:49 | |
| *** marcoemorais1 has quit IRC | 19:49 | |
| *** marcoemorais has joined #openstack-keystone | 19:49 | |
| *** ncoghlan_afk is now known as ncoghlan | 19:50 | |
| *** thedodd has quit IRC | 19:55 | |
| *** marcoemorais has quit IRC | 19:58 | |
| *** marcoemorais has joined #openstack-keystone | 19:58 | |
| *** leseb has joined #openstack-keystone | 20:00 | |
| *** ncoghlan is now known as ncoghlan_afk | 20:00 | |
| *** marcoemorais1 has joined #openstack-keystone | 20:06 | |
| openstackgerrit | A change was merged to openstack/keystone: remove unneeded definitions of Python Source Code Encoding https://review.openstack.org/95383 | 20:08 |
| openstackgerrit | A change was merged to openstack/keystone: Test `common.sql` initialization https://review.openstack.org/101255 | 20:08 |
| openstackgerrit | A change was merged to openstack/keystone: oslo.db implementation https://review.openstack.org/77210 | 20:10 |
| *** marcoemorais has quit IRC | 20:10 | |
| *** radez is now known as radez_g0n3 | 20:16 | |
| dstanek | morganfainberg: is gertty is subscribed projects different from starred projects? | 20:22 |
| *** amerine has quit IRC | 20:23 | |
| *** amerine has joined #openstack-keystone | 20:25 | |
| *** gokrokve_ has quit IRC | 20:26 | |
| *** thedodd has joined #openstack-keystone | 20:26 | |
| *** ayoung has quit IRC | 20:32 | |
| *** joesavak has joined #openstack-keystone | 20:32 | |
| *** jsavak has quit IRC | 20:34 | |
| *** thedodd has quit IRC | 20:37 | |
| *** thedodd has joined #openstack-keystone | 20:38 | |
| *** daneyon has joined #openstack-keystone | 20:40 | |
| *** lbragstad has joined #openstack-keystone | 20:40 | |
| *** Camisa has joined #openstack-keystone | 20:41 | |
| *** Camisa has joined #openstack-keystone | 20:41 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Update docs to reference #openstack-keystone https://review.openstack.org/101633 | 20:45 |
| *** zhiyan_ has joined #openstack-keystone | 20:46 | |
| *** rodrigods has joined #openstack-keystone | 20:54 | |
| *** jareking has joined #openstack-keystone | 20:55 | |
| *** ncoghlan_afk has quit IRC | 20:56 | |
| *** gokrokve has joined #openstack-keystone | 20:57 | |
| *** jsavak has joined #openstack-keystone | 20:57 | |
| *** gokrokve_ has joined #openstack-keystone | 20:59 | |
| *** joesavak has quit IRC | 21:01 | |
| *** gokrokve has quit IRC | 21:02 | |
| *** gokrokve_ has quit IRC | 21:04 | |
| *** marcoemorais1 has quit IRC | 21:07 | |
| *** marcoemorais has joined #openstack-keystone | 21:07 | |
| *** jamielennox|away has quit IRC | 21:08 | |
| *** marcoemorais has quit IRC | 21:10 | |
| *** marcoemorais has joined #openstack-keystone | 21:11 | |
| *** marcoemorais has quit IRC | 21:11 | |
| *** marcoemorais has joined #openstack-keystone | 21:12 | |
| *** rodrigods has quit IRC | 21:13 | |
| openstackgerrit | A change was merged to openstack/keystone: Migrate ID generation for users/groups from controller to manager https://review.openstack.org/100833 | 21:14 |
| *** leseb has quit IRC | 21:16 | |
| *** leseb has joined #openstack-keystone | 21:16 | |
| stevemar | gyee, good thing i wasn't the only one confused by it https://review.openstack.org/#/c/101574/ | 21:17 |
| *** leseb_ has joined #openstack-keystone | 21:20 | |
| *** leseb has quit IRC | 21:21 | |
| gyee | stevemar, yeah, I don't understand that change at all | 21:22 |
| gyee | man, its going to take all day to review Henry's big patch :) | 21:23 |
| stevemar | gyee, oh *that* one.... i'm scared of it | 21:23 |
| gyee | I am having a hard time deciding whether to do that review or watching world cup | 21:25 |
| jsavak | both! | 21:25 |
| gyee | +1 | 21:25 |
| morganfainberg | gyee, eh, world cup | 21:25 |
| morganfainberg | :P | 21:25 |
| gyee | gooooooooaaaaaal | 21:25 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Update docs to reference #openstack-keystone https://review.openstack.org/101633 | 21:25 |
| jsavak | that could either be a +1 on review or a world-cup soccer goal. | 21:27 |
| jsavak | er football | 21:27 |
| morganfainberg | ugh having suddenly new issues with devstack and keystone under mod_wsgi tempest | 21:28 |
| morganfainberg | getting a 204 on a delete where a ...200 is expected?! | 21:30 |
| morganfainberg | wtf. | 21:30 |
| gyee | that sounds familiar | 21:30 |
| gyee | morganfainberg, you are not messing with mod_rewrite or anything right? | 21:31 |
| morganfainberg | gyee, nope | 21:31 |
| morganfainberg | http://logs.openstack.org/47/100747/4/check/check-tempest-dsvm-neutron/201d76a/console.html#_2014-06-20_20_49_05_070 | 21:31 |
| * morganfainberg goes to look at tempest. why do i get the suspicion someone changed something | 21:32 | |
| stevemar | gyee, next match isn't for 30 minutes, you can review some more before then :) | 21:33 |
| morganfainberg | gyee did you see fra vs sui | 21:33 |
| gyee | yeah, reviewing them now | 21:34 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone-specs: V3 extension advertisement https://review.openstack.org/95973 | 21:36 |
| gyee | morganfainberg, no didn't watch that one, was doing agile sprint conclusion thingy all morning | 21:36 |
| stevemar | gyee, you sound really excited about that | 21:36 |
| gyee | stevemar, what agile? do you really want to know how I feel :) | 21:37 |
| stevemar | gyee, I think I know you feel :) | 21:38 |
| bknudson | we should have a reflection at the design summit | 21:38 |
| gyee | you do that | 21:39 |
| bknudson | oh, I always miss it | 21:39 |
| *** gokrokve has joined #openstack-keystone | 21:39 | |
| *** amerine has left #openstack-keystone | 21:39 | |
| *** jareking has quit IRC | 21:41 | |
| *** jareking has joined #openstack-keystone | 21:50 | |
| *** marcoemorais has quit IRC | 21:55 | |
| *** praneshp_ has joined #openstack-keystone | 21:56 | |
| *** marcoemorais has joined #openstack-keystone | 21:56 | |
| *** praneshp has quit IRC | 21:57 | |
| *** praneshp_ is now known as praneshp | 21:57 | |
| *** diegows has joined #openstack-keystone | 22:02 | |
| openstackgerrit | Arun Kant proposed a change to openstack/keystone: Adding support for ldap connection pooling. https://review.openstack.org/95300 | 22:03 |
| *** andreaf_ has quit IRC | 22:04 | |
| marekd|weekend | stevemar: glad it worked! | 22:20 |
| *** thedodd has quit IRC | 22:36 | |
| *** morganfainberg is now known as morganfainberg_Z | 22:41 | |
| *** david-lyle has quit IRC | 22:44 | |
| *** david-lyle has joined #openstack-keystone | 22:46 | |
| *** david-lyle has quit IRC | 22:50 | |
| *** leseb_ has quit IRC | 23:06 | |
| *** leseb has joined #openstack-keystone | 23:07 | |
| *** jsavak has quit IRC | 23:08 | |
| *** leseb has quit IRC | 23:11 | |
| openstackgerrit | A change was merged to openstack/keystone: Update docs to reference #openstack-keystone https://review.openstack.org/101633 | 23:14 |
| *** richm has left #openstack-keystone | 23:24 | |
| *** nsquare_ has joined #openstack-keystone | 23:39 | |
| *** nsquare has quit IRC | 23:40 | |
| *** stevemar has quit IRC | 23:41 | |
| *** morganfainberg_L has joined #openstack-keystone | 23:45 | |
| morganfainberg_L | anything interesting going on? | 23:46 |
| * morganfainberg_L needs to dig up access to personal vpn again (and znc) while other computer is being repaired | 23:47 | |
| *** gokrokve has quit IRC | 23:50 | |
| lbragstad | morganfainberg_L: not really, about to fire up the BBQ ;) | 23:50 |
| morganfainberg_L | lbragstad, sounds like a good plan. too hot here in SoCal though really to be BBQing | 23:51 |
| morganfainberg_L | gonna go have a glass of whiskey with a friend though instead. | 23:51 |
| lbragstad | oh, that's a good sub. | 23:51 |
| lbragstad | morganfainberg_L: enjoy! | 23:52 |
| morganfainberg_L | yeah, gotta wait another ~30mins before headed out | 23:52 |
| morganfainberg_L | actually... i think i'm gonna go cool off before headed out.. maybe a quick swim! | 23:56 |
| *** david-lyle has joined #openstack-keystone | 23:56 | |
| *** bknudson has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!