| *** jamielennox|away has joined #openstack-keystone | 00:05 | |
| *** stevemar has quit IRC | 00:14 | |
| *** jamielennox|away is now known as jamielennox | 00:26 | |
| jamielennox | hrybacki: here? | 00:28 |
|---|---|---|
| hrybacki | jamielennox++ | 00:29 |
| jamielennox | i just realized i was an idiot and it's sunday.. but that never seems to matter | 00:29 |
| hrybacki | haha, yeah most of the core names never seem to get off this channel | 00:29 |
| jamielennox | they aren't always here, but more often that not i guess | 00:30 |
| jamielennox | so what do you want to know about sessions? | 00:30 |
| hrybacki | Well, I was wondering what about certain components make them more difficult to integrate | 00:31 |
| hrybacki | Is it solely how many points of contact they have with keystone? | 00:31 |
| hrybacki | I'm still building my mental blueprints of OpenStack | 00:31 |
| jamielennox | no, it's not really related to keystone at all in terms of converting clients, it's more about what client specific ways they communicate | 00:32 |
| jamielennox | so for example glance and i assume cinder that do large file transfers do chunking | 00:32 |
| hrybacki | nods | 00:32 |
| jamielennox | that's something i know the session could handle but i haven't tried it | 00:32 |
| jamielennox | different clients do different things with SSL certs | 00:33 |
| jamielennox | by default requests has a list i think of standard CA certs, the OS package of requests should override that with the system CA certs | 00:33 |
| hrybacki | okay | 00:34 |
| jamielennox | my bad, requests by defaults ships with nothing and then you are supposed to use certifi or something for default CAs | 00:34 |
| jamielennox | but if you install via pip as most people do you get nothing | 00:34 |
| jamielennox | so for example neutron i think goes and tries to see if it can load system CAs in the client code | 00:34 |
| hrybacki | What made you describe one of the components as rubbish? | 00:37 |
| jamielennox | heh, um they have been doing some interesting things to integrate the session object | 00:38 |
| jamielennox | for neutron and cinder i've just said that the old code can still exist and that if you pass a session then you get the new functionality | 00:38 |
| *** morganfainberg_L has quit IRC | 00:39 | |
| jamielennox | let me see if i can find it | 00:39 |
| hrybacki | integration with glance will be a bit more complex? | 00:39 |
| jamielennox | so the python original way to do http is with httplib | 00:40 |
| jamielennox | there are a whole lot of problems with httplib, chief amongst them for us is that they don't handle SSL certs correctly | 00:41 |
| jamielennox | we (and most of the python community) has moved to using a library called requests | 00:41 |
| * hrybacki nods | 00:41 | |
| jamielennox | (which is just a wrapper around httplib, but handling a lot of common cases for us correctly) | 00:41 |
| hrybacki | when did keystone/client convert? | 00:42 |
| jamielennox | there was a push a while ago to move all the clients to requests, glance seems to have ignored that and instead done there own SSL validation | 00:42 |
| hrybacki | and have all of the other components made the switch? | 00:42 |
| hrybacki | that seems odd | 00:42 |
| jamielennox | this was the tracker: https://bugs.launchpad.net/bugs/1188189 | 00:43 |
| uvirtbot | Launchpad bug 1188189 in cinder "Some server-side 'SSL' communication fails to check certificates (use of HTTPSConnection)" [High,In progress] | 00:43 |
| jamielennox | they had a reason | 00:43 |
| jamielennox | ah, no that's the server side | 00:43 |
| jamielennox | no - that's right, from memory they had to remove projects from it because launchpad didn't support a bug across that many projects | 00:44 |
| hrybacki | hah | 00:44 |
| jamielennox | 2013-09-13: Fix merged to python-keystoneclient (master) | 00:45 |
| jamielennox | afaik glance is the only one that didn't | 00:45 |
| jamielennox | the reason i think was to do with not being able to control SSL compression from requests - however swift had that and they've since switched | 00:46 |
| hrybacki | someone extended the requests library or they found another workaround? | 00:47 |
| jamielennox | i think they decided that it shouldn't be up to the client to dictate that | 00:47 |
| jamielennox | SSL compression can be subject to the BEAST attack, during SSL handshake both client and server should say whether they support compression or not | 00:48 |
| jamielennox | essentially they were trying to make the client say no we don't support compression - and the solution should be to disable it on your servers | 00:48 |
| hrybacki | okay | 00:49 |
| hrybacki | is there any good documentation on how each of the clients/servers interact? | 00:50 |
| jamielennox | now that i look they've cleaned up the neturon client review a lo t | 00:50 |
| jamielennox | not really | 00:50 |
| jamielennox | well - depends what you want | 00:50 |
| jamielennox | if you want to know the API then sure there is great docs | 00:50 |
| hrybacki | well, I feel like I'm missing the bigger picture of how all of these things interact -- and the docs never seem to help much | 00:51 |
| jamielennox | regarding how the clients work they have all grown somewhat organicly | 00:51 |
| jamielennox | ok | 00:51 |
| jamielennox | heh, where's that pic that everyone likes to use in slides | 00:51 |
| hrybacki | I think I know what you're talking about | 00:51 |
| hrybacki | https://securityblog.redhat.com/wp-content/uploads/2014/04/openstack-arch-havana-logical-v1.jpg | 00:51 |
| jamielennox | http://docs.openstack.org/training-guides/content/module001-ch004-openstack-architecture.html | 00:52 |
| jamielennox | yea, that one | 00:52 |
| jamielennox | essentially what it means is that every service in openstack is responsible for a relatively small component of the overall cloud | 00:53 |
| * hrybacki nods | 00:53 | |
| jamielennox | and that there is a whole lot of communication between them to offload what they shouldn't be doing | 00:53 |
| jamielennox | so when managing volumes (disks) you talk to cinder, you do that with the cinder cmdline app which is part of cinderclient | 00:53 |
| jamielennox | nova when it wants to attach a volume to a VM also has to talk to cinder to find the information of what to offer and attach | 00:54 |
| jamielennox | so it uses the library part of cinderclient, and unfortunately the library and the CLI components are more tightly interwoven than would be liked | 00:55 |
| jamielennox | and both of those things talk to keystone to make sure that the user and service wanting to do these things is allowed to | 00:55 |
| jamielennox | and they should be doing that with keystoneclient | 00:55 |
| hrybacki | do all of the components have a server and a client? | 00:56 |
| jamielennox | yes | 00:56 |
| jamielennox | the client side receives a lot less love because it's generally a lot less interesting | 00:57 |
| jamielennox | and also the client should really just be a reference implementation of something that you could always do yourself because the APIs are well documented | 00:57 |
| hrybacki | huh | 00:58 |
| hrybacki | so, if you were me, which of the components would you start session integration with? | 00:59 |
| jamielennox | so the more i look the more clients are starting to do it themselves | 00:59 |
| hrybacki | ayoung and morazi have talked about glance, neutron, and cinder -- ayoung is working with horizon righ tnow | 00:59 |
| jamielennox | i just saw a review for ceilometer | 01:00 |
| hrybacki | link? | 01:00 |
| jamielennox | horizon is a bit of a difficult one because it tries to cache and reuse connections | 01:00 |
| hrybacki | nods -- ayoung said it would be a complicated one | 01:00 |
| jamielennox | https://review.openstack.org/#/c/96323/ | 01:00 |
| hrybacki | thank you | 01:01 |
| jamielennox | that one is somewhat confusing - it looks like he copied neutron before he cleaned it up | 01:01 |
| jamielennox | so IMO glance is going to be the difficult one, whether that relates to most interesting is up to you | 01:01 |
| jamielennox | different difficult to horizon, there's no juggling connections or anything it's just that there is a lot of existing code to rip out | 01:02 |
| *** xianghui has joined #openstack-keystone | 01:02 | |
| jamielennox | and clients are generally concerned with backwards compatability | 01:02 |
| jamielennox | however i think i would just do it the same way that i did nova and cinder, leave the old stuff there and if they pass a session then we use new behaviour | 01:02 |
| jamielennox | then it's a matter of converting all the test cases over so that they test the session code - which takes ages :) | 01:03 |
| hrybacki | nods | 01:03 |
| hrybacki | I've got 6 weeks, but I'm new, and I wanna have something concrete to show by the end. | 01:04 |
| jamielennox | so you'll need to pester the glance guys to get it done, but i now that the PTL is keen to get rid of all that stuff | 01:05 |
| hrybacki | okay, I'll start by playing with Glance a bit to get familiar with the API | 01:08 |
| jamielennox | cool - but honestly you probably don't need to know the API that much | 01:08 |
| hrybacki | How would you recommend I start? | 01:08 |
| jamielennox | the data that is sent wont change it's just how it is sent | 01:08 |
| jamielennox | have a look at the requests library | 01:08 |
| jamielennox | see how that works | 01:08 |
| hrybacki | okay | 01:08 |
| jamielennox | have a look at the httpclient part of the current glance and figure out how it's sending and receiving http | 01:09 |
| jamielennox | the session is just some helpers around the requests library so it's mostly a matter of figuring out how the Managers (the part of the library responseible for a resource) send commands and how to support that with requests | 01:10 |
| * hrybacki nods | 01:10 | |
| *** mitz has quit IRC | 01:11 | |
| hrybacki | thanks for taking some time to walk me through this stuff and give me something to get started btw | 01:13 |
| *** diegows has quit IRC | 01:13 | |
| *** morganfainberg_L has joined #openstack-keystone | 01:14 | |
| jamielennox | no worries, let me know what else you need | 01:14 |
| jamielennox | i'm sure once you wrap your head around some of the http stuff there will be more questions | 01:14 |
| hrybacki | nods, mind if I shoot you emails with questions if you're offline? | 01:15 |
| jamielennox | yea, that's fine | 01:21 |
| hrybacki | jamielennox++ thanks again -- off for the night | 01:22 |
| jamielennox | night, and no problem | 01:22 |
| hrybacki | o/ | 01:22 |
| *** mitz has joined #openstack-keystone | 01:25 | |
| *** mitz has quit IRC | 01:28 | |
| *** mitz has joined #openstack-keystone | 01:28 | |
| *** ncoghlan has joined #openstack-keystone | 01:30 | |
| *** mberlin has joined #openstack-keystone | 01:43 | |
| *** mberlin1 has quit IRC | 01:44 | |
| *** mitz has quit IRC | 01:57 | |
| *** ncoghlan is now known as ncoghlan_afk | 01:59 | |
| *** topol_ has joined #openstack-keystone | 01:59 | |
| *** topol has quit IRC | 02:00 | |
| *** topol_ is now known as topol | 02:00 | |
| *** mitz has joined #openstack-keystone | 02:01 | |
| *** hrybacki has quit IRC | 02:03 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Propose Specification for non-persistent-tokens https://review.openstack.org/95976 | 02:05 |
| morganfainberg_L | awww crap. | 02:07 |
| morganfainberg_L | i lost my gpg key :( | 02:07 |
| jamielennox | morganfainberg_L: :( | 02:13 |
| jamielennox | i know i should get one and make use of it, but i need one on such a rare occasion i'm sure i'll lose it | 02:14 |
| *** topol has quit IRC | 02:18 | |
| *** bvandenh has quit IRC | 02:18 | |
| *** topol has joined #openstack-keystone | 02:18 | |
| morganfainberg_L | jamielennox: i had to take my primary laptop (personal) into get repaired | 02:25 |
| morganfainberg_L | ended up wiping the HDD in the process (have a backup but think some files are missing) | 02:25 |
| morganfainberg_L | this is the first time i've used a linux desktop for more than the odd task in years. it's... passible | 02:26 |
| morganfainberg_L | but on the plus side, i have this ubuntu laptop all setup now and csan do dev work on it. | 02:26 |
| * morganfainberg_L almost bought a macbook air while the mbpr was being fixed. | 02:27 | |
| jamielennox | morganfainberg_L: i haven't done any dev on OSX | 02:27 |
| jamielennox | so i'm pretty used to the desktop i guess | 02:27 |
| jamielennox | can't use windows at all any more | 02:27 |
| jamielennox | i sat down at a win8 machine the other day - had no idea where anything was | 02:28 |
| morganfainberg_L | linux desktop still feels so rough compared to osx. a lot of "oh i need to go compile that" or "wow, this is missing x y and z" | 02:28 |
| morganfainberg_L | win8 is terribad | 02:28 |
| morganfainberg_L | imo | 02:28 |
| jamielennox | what are you compiling yourself - that's pretty rare for me these days | 02:29 |
| morganfainberg_L | mostly it is for features on something i need, e.g. pigin plugin was missing something. | 02:29 |
| * morganfainberg_L doesn't remember what. | 02:29 | |
| morganfainberg_L | but i had to recompile it. | 02:29 |
| morganfainberg_L | chromium i think as well for some reason | 02:30 |
| jamielennox | ok, | 02:31 |
| *** ncoghlan_afk is now known as ncoghlan | 02:39 | |
| *** mitz has quit IRC | 02:48 | |
| *** mitz has joined #openstack-keystone | 02:50 | |
| *** mitz has quit IRC | 02:52 | |
| *** lbragstad has quit IRC | 02:54 | |
| *** mitz has joined #openstack-keystone | 02:54 | |
| *** lbragstad has joined #openstack-keystone | 02:55 | |
| *** zhiyan_ is now known as zhiyan | 03:04 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Don't log sensitive auth data https://review.openstack.org/101792 | 03:14 |
| jamielennox | morganfainberg_L: it's not tested yet but does ^ seem reasonable? | 03:15 |
| *** Camisa has joined #openstack-keystone | 03:28 | |
| *** Camisa has joined #openstack-keystone | 03:28 | |
| *** bobt has quit IRC | 03:30 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Don't log sensitive auth data https://review.openstack.org/101792 | 04:10 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Don't log sensitive auth data https://review.openstack.org/101792 | 04:18 |
| *** praneshp_ has joined #openstack-keystone | 04:23 | |
| *** praneshp has quit IRC | 04:24 | |
| *** praneshp_ is now known as praneshp | 04:24 | |
| *** daneyon has joined #openstack-keystone | 04:34 | |
| *** gokrokve has joined #openstack-keystone | 04:50 | |
| *** jamielen1ox has joined #openstack-keystone | 04:52 | |
| *** daneyon_ has joined #openstack-keystone | 05:01 | |
| *** daneyon has quit IRC | 05:04 | |
| *** chandan_kumar_ has joined #openstack-keystone | 05:13 | |
| *** fifieldt has joined #openstack-keystone | 05:14 | |
| *** chandan_kumar has quit IRC | 05:16 | |
| *** chandan_kumar_ is now known as chandan_kumar | 05:17 | |
| *** jamielen1ox has quit IRC | 05:19 | |
| *** morganfainberg_L has quit IRC | 05:24 | |
| *** topol has quit IRC | 05:26 | |
| *** ajc_ has joined #openstack-keystone | 05:29 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/101800 | 05:30 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/101404 | 05:34 |
| *** gokrokve has quit IRC | 05:39 | |
| *** gokrokve has joined #openstack-keystone | 05:39 | |
| *** gokrokve_ has joined #openstack-keystone | 05:40 | |
| *** gokrokve has quit IRC | 05:44 | |
| *** gokrokve_ has quit IRC | 05:45 | |
| *** ncoghlan is now known as ncoghlan_afk | 05:54 | |
| *** marekd|weekend is now known as marekd | 05:55 | |
| *** ajayaa has joined #openstack-keystone | 05:57 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/97005 | 06:00 |
| *** ajayaa has quit IRC | 06:06 | |
| *** gokrokve has joined #openstack-keystone | 06:10 | |
| *** gokrokve has quit IRC | 06:16 | |
| *** ncoghlan_afk is now known as ncoghlan | 06:18 | |
| *** afazekas_ has joined #openstack-keystone | 06:20 | |
| *** afazekas has quit IRC | 06:20 | |
| *** ayoung has joined #openstack-keystone | 06:20 | |
| *** ajayaa has joined #openstack-keystone | 06:23 | |
| *** ayoung has quit IRC | 06:23 | |
| *** openstackstatus has quit IRC | 06:27 | |
| *** henrynash has joined #openstack-keystone | 06:38 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Implement SAML2 ECP authentication https://review.openstack.org/92166 | 06:42 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Scope unscoped saml2 tokens. https://review.openstack.org/99704 | 06:47 |
| *** BAKfr has joined #openstack-keystone | 07:06 | |
| *** praneshp has quit IRC | 07:08 | |
| *** praneshp has joined #openstack-keystone | 07:09 | |
| *** gokrokve has joined #openstack-keystone | 07:13 | |
| *** afazekas_ is now known as afazekas | 07:14 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Add CRUD operations for Federated Protocols. https://review.openstack.org/83829 | 07:15 |
| *** gokrokve has quit IRC | 07:18 | |
| *** praneshp has quit IRC | 07:21 | |
| *** andreaf has joined #openstack-keystone | 07:44 | |
| *** i159 has joined #openstack-keystone | 08:01 | |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 08:02 |
| *** ajayaa has quit IRC | 08:03 | |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Use metadata.create_all() to fill a test database https://review.openstack.org/93558 | 08:03 |
| *** gokrokve has joined #openstack-keystone | 08:15 | |
| *** ajayaa has joined #openstack-keystone | 08:15 | |
| *** oomichi has quit IRC | 08:19 | |
| *** gokrokve has quit IRC | 08:20 | |
| *** ajayaa has quit IRC | 08:36 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: trustor_user_id not available in v2 trust token https://review.openstack.org/101829 | 08:47 |
| *** ncoghlan has quit IRC | 08:49 | |
| *** ajayaa has joined #openstack-keystone | 08:54 | |
| *** gokrokve has joined #openstack-keystone | 09:16 | |
| *** gokrokve has quit IRC | 09:21 | |
| *** henrynash has quit IRC | 09:27 | |
| *** jaosorior has joined #openstack-keystone | 09:31 | |
| *** RockKuo_Office has joined #openstack-keystone | 09:37 | |
| *** RockKuo_Office has quit IRC | 09:37 | |
| *** RockKuo_Office has joined #openstack-keystone | 09:37 | |
| *** RockKuo_ has joined #openstack-keystone | 09:37 | |
| *** RockKuo_Office has quit IRC | 09:37 | |
| *** RockKuo_ has quit IRC | 09:37 | |
| *** RockKuo_Office has joined #openstack-keystone | 09:38 | |
| *** nsquare has quit IRC | 10:07 | |
| *** nsquare has joined #openstack-keystone | 10:09 | |
| *** nsquare has quit IRC | 10:09 | |
| *** gokrokve has joined #openstack-keystone | 10:16 | |
| *** gokrokve has quit IRC | 10:21 | |
| *** zhiyan is now known as zhiyan_ | 10:32 | |
| *** topol has joined #openstack-keystone | 10:33 | |
| *** lalves has joined #openstack-keystone | 10:35 | |
| lalves | hi, quick question from an OS/python noobie: | 10:38 |
| lalves | getting this error when testing my keystone instance | 10:39 |
| lalves | mod_wsgi (pid=3000): Exception occurred processing WSGI script '/usr/lib/cgi-bin/keystone/main'. Traceback (most recent call last): File "/usr/lib/cgi-bin/keystone/main", line 25, in <module> gettextutils.enable_lazy() AttributeError: 'module' object has no attribute 'enable_lazy' | 10:39 |
| openstackgerrit | Ajaya Agrawal proposed a change to openstack/keystone: TestAuthInfo class in test_v3_auth made more efficient. https://review.openstack.org/98072 | 10:39 |
| lalves | using Grizzly | 10:39 |
| lalves | openstack-nova-common-2013.1.4-7.el6.noarch openstack-nova-api-2013.1.4-7.el6.noarch openstack-keystone-2013.1.4-2.el6.noarch | 10:40 |
| lalves | on centOS 6.5 | 10:40 |
| lalves | could that be due to a wrong keystone/openstack/common/gettextutils.pyc version? | 10:43 |
| lalves | I'm using this https://github.com/openstack/keystone/blob/master/httpd/keystone.py as /usr/lib/cgi-bin/keystone/main | 10:44 |
| lalves | TIA | 10:44 |
| *** mberlin has quit IRC | 10:59 | |
| *** mberlin has joined #openstack-keystone | 11:11 | |
| *** gokrokve has joined #openstack-keystone | 11:17 | |
| *** gokrokve has quit IRC | 11:22 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: auth tests should not require admin token https://review.openstack.org/101861 | 11:28 |
| *** ajayaa has quit IRC | 11:31 | |
| *** chandan_kumar is now known as chkumar246 | 11:35 | |
| *** RockKuo_Office has quit IRC | 11:38 | |
| *** diegows has joined #openstack-keystone | 11:39 | |
| *** lbragstad has quit IRC | 11:40 | |
| *** ajayaa has joined #openstack-keystone | 11:43 | |
| *** chkumar246 has quit IRC | 11:45 | |
| *** chandan_kumar has joined #openstack-keystone | 11:46 | |
| *** Ju_ has joined #openstack-keystone | 11:55 | |
| *** xianghui has quit IRC | 12:14 | |
| *** gokrokve has joined #openstack-keystone | 12:19 | |
| *** gokrokve has quit IRC | 12:24 | |
| *** erecio has joined #openstack-keystone | 12:24 | |
| *** gordc has joined #openstack-keystone | 12:26 | |
| *** xianghui has joined #openstack-keystone | 12:28 | |
| *** ajc_ has quit IRC | 12:40 | |
| *** bknudson has joined #openstack-keystone | 13:02 | |
| *** nkinder_ has quit IRC | 13:13 | |
| *** xianghui has quit IRC | 13:13 | |
| *** radez_g0n3 is now known as radez | 13:13 | |
| *** lbragstad has joined #openstack-keystone | 13:18 | |
| *** gokrokve has joined #openstack-keystone | 13:20 | |
| *** richm has joined #openstack-keystone | 13:26 | |
| *** gokrokve has quit IRC | 13:26 | |
| *** dims has joined #openstack-keystone | 13:31 | |
| *** joesavak has joined #openstack-keystone | 13:32 | |
| *** hrybacki has joined #openstack-keystone | 13:37 | |
| *** Dafna has joined #openstack-keystone | 13:45 | |
| *** gordc has quit IRC | 13:50 | |
| *** daneyon_ has quit IRC | 13:52 | |
| *** ajayaa has quit IRC | 13:57 | |
| *** gordc has joined #openstack-keystone | 13:59 | |
| *** stevemar has joined #openstack-keystone | 14:04 | |
| *** nkinder_ has joined #openstack-keystone | 14:08 | |
| *** morganfainberg_L has joined #openstack-keystone | 14:18 | |
| *** gordc has quit IRC | 14:19 | |
| morganfainberg_L | mornin | 14:19 |
| *** jsavak has joined #openstack-keystone | 14:20 | |
| morganfainberg_L | bknudson: ping, re: 409 errors fi | 14:21 |
| morganfainberg_L | x | 14:21 |
| bknudson | morganfainberg_L: is this the real morganfainberg? | 14:21 |
| morganfainberg_L | bknudson: yeah | 14:21 |
| jsavak | authenticated! | 14:21 |
| morganfainberg_L | bknudson: other laptop is broken, and don't have access to my personal VPN for my ZNC | 14:22 |
| bknudson | morganfainberg_L: ok, only the real morganfainberg would know to answer with "yeah" | 14:22 |
| morganfainberg_L | lol | 14:22 |
| bknudson | morganfainberg_L: right, so not surprisingly we're sloppy in our exceptions | 14:22 |
| *** morganfainberg_L is now known as mdrnstm | 14:23 | |
| *** mdrnstm has quit IRC | 14:23 | |
| *** mdrnstm has joined #openstack-keystone | 14:23 | |
| bknudson | mdrnstm: : and since we're sloppy and I don't think we'll be un-sloppy any time soon, and there's security implications .... | 14:23 |
| *** gokrokve has joined #openstack-keystone | 14:23 | |
| bknudson | how about we default to "secure" exceptions | 14:23 |
| *** ChanServ sets mode: +o mdrnstm | 14:23 | |
| mdrnstm | bknudson: there? proof enough it's me :P | 14:24 |
| bknudson | and then pick some that we know are safe non-secure | 14:24 |
| mdrnstm | bknudson: that was what i wanted to check with you on before changing the code | 14:24 |
| mdrnstm | bknudson: i think the suggestion to make the base exception the 'securityexception' was good | 14:24 |
| mdrnstm | and then we can relax the data sent out as needed instead of trying to secure the data as we find holes | 14:25 |
| bknudson | mdrnstm: seems like the only safe way to do it | 14:26 |
| mdrnstm | bknudson: ++ cool. | 14:26 |
| bknudson | mdrnstm: I don't know what we can mark as safe -- maybe NotFound? | 14:26 |
| mdrnstm | LOL | 14:26 |
| mdrnstm | notfound should be relatively safe | 14:27 |
| *** gordc has joined #openstack-keystone | 14:27 | |
| *** gokrokve has quit IRC | 14:28 | |
| bknudson | mdrnstm: should we have a class for safe exceptions or should it be a flag for each instance? | 14:29 |
| bknudson | if it's a flag then we'd have to be explicit and wouldn't be making any safe by accident | 14:30 |
| bknudson | maybe docstring for the exception would help | 14:30 |
| mdrnstm | probably. | 14:31 |
| mdrnstm | i'll figure it out | 14:31 |
| *** ayoung has joined #openstack-keystone | 14:32 | |
| marekd | stevemar: hi. | 14:35 |
| marekd | stevemar: appreciate your eyes on https://review.openstack.org/#/c/83829/ | 14:36 |
| stevemar | marekd, ahhhh, yes! | 14:37 |
| marekd | stevemar: don't worry. | 14:37 |
| *** lalves has quit IRC | 14:38 | |
| *** morganfainberg has quit IRC | 14:45 | |
| *** morganfainberg_Z has joined #openstack-keystone | 14:45 | |
| *** mdrnstm is now known as morganfainberg | 14:45 | |
| *** diegows has quit IRC | 14:51 | |
| *** gokrokve has joined #openstack-keystone | 14:52 | |
| *** gokrokve has quit IRC | 14:53 | |
| *** gokrokve has joined #openstack-keystone | 14:53 | |
| *** radez is now known as radez_g0n3 | 14:53 | |
| *** rwsu has joined #openstack-keystone | 14:55 | |
| morganfainberg | bknudson, jamielennox, ayoung, working with infra to get middleware repo created asap | 14:55 |
| ayoung | morganfainberg, sounds good | 14:56 |
| morganfainberg | just got the first +2 on it | 14:56 |
| ayoung | morganfainberg, I still think we want to have a strategy to deduplicate the code between the two repos. I realize there is a cricular, but there has to be some solution | 14:56 |
| bknudson | morganfainberg: they're going to do it today rather than wait until fri? | 14:57 |
| *** gokrokve has quit IRC | 14:57 | |
| ayoung | bknudson, why wait | 14:57 |
| morganfainberg | bknudson: i dunno, they didn't get it done last friday because trying to get gate using 14.04 | 14:58 |
| morganfainberg | bknudson: was told it really was just bugging the right people, might get it sooner | 14:58 |
| bknudson | ayoung: my understanding is that they queued repo changes to fridays. | 14:58 |
| *** joesavak has quit IRC | 14:58 | |
| *** jsavak has quit IRC | 14:58 | |
| ayoung | bknudson, cuz trhey like working over wekends? | 14:58 |
| ayoung | weekends | 14:58 |
| bknudson | because there's some manual work that needs to be done | 14:58 |
| morganfainberg | ayoung: i think "duplicating" code is bad. and circual deps are even worse. | 14:59 |
| morganfainberg | we can just propose fixes to both places if you _really_ feel strongly about it, but that would require changing the spec. | 14:59 |
| *** radez_g0n3 is now known as radez | 14:59 | |
| ayoung | morganfainberg, short of creating a separate repo for libkeystone, though, I can't see how to make it work, and I think that is too far | 15:00 |
| ayoung | OK, here is what we need to do, I think | 15:00 |
| morganfainberg | ayoung: yeah, i think the security maintenance of ksc middleware is a good option | 15:00 |
| morganfainberg | esp. if we are releasing middleware as 1.0.0 (stable) | 15:00 |
| ayoung | yeah | 15:01 |
| *** joesavak has joined #openstack-keystone | 15:01 | |
| *** jsavak has joined #openstack-keystone | 15:01 | |
| *** xianghui has joined #openstack-keystone | 15:04 | |
| *** jareking has joined #openstack-keystone | 15:04 | |
| *** jareking has quit IRC | 15:06 | |
| *** jsavak has quit IRC | 15:07 | |
| *** david-lyle has joined #openstack-keystone | 15:16 | |
| *** gordc has quit IRC | 15:20 | |
| *** gokrokve has joined #openstack-keystone | 15:23 | |
| stevemar | anyone seeing a "worlddump.py: error:" in devstack recently? | 15:23 |
| *** gokrokve_ has joined #openstack-keystone | 15:23 | |
| *** gokrokve has quit IRC | 15:27 | |
| *** afazekas has quit IRC | 15:28 | |
| morganfainberg | stevemar: "worlddump" thats new... | 15:29 |
| stevemar | morganfainberg, apparently so, within the last 24 hrs | 15:29 |
| stevemar | apparently for dumping process info | 15:29 |
| stevemar | i think it depends on a specific log directory being setup, but if devstack craps out earlier, then the directory is never setup | 15:30 |
| *** daneyon has joined #openstack-keystone | 15:30 | |
| morganfainberg | looks like dpkg related | 15:30 |
| morganfainberg | doing this on ubuntu i am guessing? | 15:30 |
| *** gordc has joined #openstack-keystone | 15:31 | |
| morganfainberg | stevemar: https://github.com/openstack-dev/devstack/commit/4adc16f7e453de014abc97ac254c105ab120caae might be the guilty commit | 15:32 |
| stevemar | morganfainberg, yep, and I opened, https://bugs.launchpad.net/devstack/+bug/1333321 | 15:33 |
| uvirtbot | Launchpad bug 1333321 in devstack "worlddump shouldn't depend on LOGDIR" [Undecided,New] | 15:33 |
| stevemar | it's probably a mistake in my setup, but it should give a better error message :) | 15:34 |
| morganfainberg | stevemar: ++ | 15:34 |
| ayoung | any one feel like we spend so much time on process now that we are not really making any forward process, or such minimal forward progress as to be irrelevant? | 15:36 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Make gen_pki.sh bash8 compliant https://review.openstack.org/93438 | 15:40 |
| topol | ayoung I agree the process is too slow now. blueprints are much better but price is too high. wish there was a compromise. dont want to go back to 3 line bluepritnts | 15:41 |
| morganfainberg | lbragstad: mind updating the commit on that ^ to reflect it also affected debug_helper.sh ? | 15:41 |
| morganfainberg | lbragstad: otherwise lgtm | 15:41 |
| morganfainberg | topol: ++ | 15:41 |
| lbragstad | morganfainberg will do, thanks! | 15:41 |
| ayoung | topol, its more than that. With Keystone, we should be far more stand alone, but instead we are dependant on changes to every last *aaS that gets added. | 15:41 |
| ayoung | Specs for BPs are actaully fine | 15:42 |
| morganfainberg | ayoung: we might be able to petition TC to allow us to release more like swift... but i think we have some serious cleanup to do before then | 15:42 |
| *** gyee has joined #openstack-keystone | 15:42 | |
| topol | ayoung, please give an example | 15:42 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Make gen_pki.sh & debug_helper.sh bash8 compliant https://review.openstack.org/93438 | 15:42 |
| ayoung | topol, every time we can't get code merged because of Grenade | 15:43 |
| morganfainberg | ayoung: but i don't see what we're blocking on tbh with other *aaS | 15:43 |
| ayoung | or some other test like that which has nothing to do with Keystone | 15:43 |
| *** BAKfr has quit IRC | 15:43 | |
| morganfainberg | ayoung: except we do want to make sure we don't break people in upgrades, even if we released independent of named releases | 15:44 |
| ayoung | topol, or other tempest cinder type issues | 15:44 |
| ayoung | morganfainberg, ther is a lot of automation for testing, but I don't think Keystone has theright set of it. Maybe that is on us. | 15:44 |
| morganfainberg | sure, but the inverse is true, if we screw up something the gate helps protect everyone who depends on us | 15:45 |
| hrybacki | ayoung: do your session integration work with Horizon up anywhere? | 15:45 |
| morganfainberg | it's not foolproof, but it's really one of the best CI systems i've seen | 15:45 |
| ayoung | But we also are pretty restrictive . I think the "no API changes" after Milestone 2 is a pretty draconioan restriction | 15:46 |
| ayoung | hrybacki, not yet...still hacking on it local | 15:46 |
| hrybacki | ayoung: nods | 15:46 |
| morganfainberg | if we released separate from named releases, that would be a different bet. | 15:46 |
| ayoung | morganfainberg, its no one thing, its the sum total of everything we have in place. I'll admit Termie rewriting everything in a vacuum was too much one way, but were starting to slip too far the other | 15:46 |
| morganfainberg | but as long as we're within the named release cycle we need to draw lines somewhere. | 15:46 |
| marekd | morganfainberg: Hey. Do you mind taking a look at https://review.openstack.org/96867 esp the workflow description starting at line 116) . I am asking especially you cause you are working on non persistent tokens and it looks like he might need to *somehow* store tokens in the backend or cache. | 15:47 |
| ayoung | morganfainberg, well, porobably the mistake was writing Keytonein the first place | 15:47 |
| ayoung | instead of using SAML | 15:47 |
| ayoung | or some other mechanism that already existed | 15:47 |
| stevemar | it seems devstack is breaking my pip install :\ | 15:47 |
| morganfainberg | marekd: sure. that would be icky to need to store tokens | 15:47 |
| marekd | morganfainberg: i know ;/ | 15:48 |
| marekd | morganfainberg: i would like to push this bp somehow.... | 15:48 |
| morganfainberg | ayoung: we are making strides towards correcting some of the issues, but some stuff is in the past | 15:48 |
| morganfainberg | marekd: i might need coffee for this. | 15:50 |
| morganfainberg | marekd: but i'm looking | 15:50 |
| marekd | morganfainberg: because it's that boring ? :P | 15:50 |
| morganfainberg | marekd: no cause my brain doesn't work well when i haven't been caffeinated | 15:51 |
| * morganfainberg hasn't had breakfast yet. | 15:51 | |
| * marekd already thinks about dinner :P | 15:51 | |
| ayoung | hrybacki, I started some more trello thoughts. But I can't add to your board | 15:52 |
| hrybacki | ayoung: 1 sec | 15:52 |
| hrybacki | ayoung: you've got admin rights now | 15:53 |
| ayoung | hrybacki, thanks...now I needto remember my passwrod. I've been doing this all on my phone where it is cached... | 15:53 |
| ayoung | Ah... | 15:54 |
| ayoung | OK, I'm in | 15:54 |
| ayoung | there are strange things that happen in the land of web authentication | 15:54 |
| ayoung | sometimes I just shake my head and move on | 15:54 |
| ayoung | hrybacki, OK, So I have another board... | 15:55 |
| hrybacki | Have you added me to it? | 15:55 |
| ayoung | do you have a virtual organization set up for the Glance board? | 15:55 |
| hrybacki | nope -- I could make one really quick though | 15:56 |
| ayoung | not yet, I'd rather move the cards to the existing board | 15:56 |
| ayoung | which I just renamed | 15:56 |
| hrybacki | nods | 15:56 |
| morganfainberg | marekd: is this meant to be AuthN or AuthZ? | 15:57 |
| marekd | morganfainberg: what? | 15:57 |
| marekd | morganfainberg: mind i am not an author.... | 15:58 |
| morganfainberg | marekd: i'm seeing mixed information, where the client is redirected to the authorization server | 15:58 |
| morganfainberg | marekd: sure, was asking to see if you knew ;) | 15:58 |
| morganfainberg | marekd: i'm happy to comment, but making sure i'm not missing some subtlety | 15:58 |
| marekd | morganfainberg: ah, so I think he meant both.... | 15:58 |
| morganfainberg | ah, so he's expecting the provider (SAML) to be both authn and authz? | 15:59 |
| morganfainberg | i think that is.. not gonna fly. | 15:59 |
| marekd | morganfainberg: he wants to use saml like we do now... | 15:59 |
| morganfainberg | oh hm | 15:59 |
| morganfainberg | ohh i see he just doesn't call out keystone as is | 15:59 |
| morganfainberg | like i said, no coffee yet | 15:59 |
| marekd | he speaks about "login page in Keystone" | 15:59 |
| marekd | first of all: he wasnt to solve two problems with one bp. | 16:00 |
| marekd | wants* | 16:00 |
| morganfainberg | yeah and sometimes killing two birds with one stone is fine | 16:00 |
| *** packet has joined #openstack-keystone | 16:00 | |
| marekd | morganfainberg: yeah. | 16:00 |
| marekd | morganfainberg: let's say real example: A client (browser) goes to Horizon webpage, and automatically gets redirected directly to Keystone (https://keystone.com/login). Now, the client authn himself. In response he get's something what is called 'authorization code', which identifies an user. | 16:02 |
| marekd | Keystoe should very likely redirect the client to the Horizon again | 16:02 |
| morganfainberg | marekd: sure | 16:02 |
| marekd | and horizon should use this code to retrieve token. | 16:02 |
| nkinder_ | there's an interesting question about signing cert renewal on the user list | 16:03 |
| morganfainberg | nkinder_: i saw. have been mulling it over before responding. | 16:03 |
| marekd | nkinder_: you are talking about websso now? | 16:03 |
| nkinder_ | if the signing cert is renewed, but you use the same keys, wouldn't the old tokens still be valid? | 16:04 |
| marekd | nkinder_: ah, sorry ;/ | 16:04 |
| nkinder_ | marekd: no, I changed topics... | 16:04 |
| marekd | nkinder_: yeah, sorry about that :( | 16:04 |
| morganfainberg | nkinder_: i.. don't know | 16:05 |
| hrybacki | ayoung: -- revised the integration board, please review | 16:05 |
| marekd | morganfainberg: speaking about websoo, as you may see my comments i am not really sure who are the actors in depicted workflow ;/ | 16:05 |
| morganfainberg | marekd: yeah seeing the comments as i go through | 16:06 |
| morganfainberg | totally agree the diagram and workflow aren't as clear as they need to be | 16:06 |
| morganfainberg | i can make intelligent guesses, but i hate guessing when it comes to reviewing ;) | 16:06 |
| marekd | morganfainberg: ++ | 16:06 |
| marekd | i spend some time trying to figure out who is who, but i could see opposing pieces information | 16:07 |
| marekd | spent* | 16:07 |
| morganfainberg | nkinder_: so, when you sign something, you sign with the cert and the key.. right? not just the key? | 16:07 |
| morganfainberg | nkinder_: trying to think through token validity here (outloud) | 16:07 |
| morganfainberg | nkinder_: so if we're using the cert _and_ key, we can't validate with the new cert | 16:08 |
| morganfainberg | nkinder_: since it's tied to the old cert. | 16:08 |
| *** Dafna is now known as Dafna_away | 16:09 | |
| nkinder_ | morganfainberg: the CMS RFC shows that is has issuer and serial number | 16:10 |
| ayoung | hrybacki, I'm going to make the Horizon board public. If we talk about it in here, no reason other people shouldn't be able to see it | 16:10 |
| nkinder_ | morganfainberg: this is really a case where we need the ability to have multiple certs used for validation | 16:11 |
| marekd | dolphm: o/ How much reluctant would you be to binding some HTML or even JS directly with Keystone? I am speaking about WebSSO. | 16:11 |
| morganfainberg | nkinder_: yeah. sounds like it | 16:11 |
| nkinder_ | morganfainberg: it would allow renewal as well as using separate keys/certs for separate keystone instances in HA | 16:11 |
| hrybacki | ayoung++ | 16:11 |
| morganfainberg | nkinder_: though i'm (unfortunately) sadly out of date with my renewal of cert knowledge | 16:11 |
| *** jaosorior has quit IRC | 16:12 | |
| morganfainberg | nkinder_: maybe a legitimate cert "renewal" would still validate | 16:12 |
| nkinder_ | morganfainberg: well, the serial number changes when you do a renewal | 16:12 |
| morganfainberg | nkinder_: true. | 16:13 |
| nkinder_ | morganfainberg: but you can use the same keys | 16:13 |
| *** bknudson has quit IRC | 16:14 | |
| *** praneshp has joined #openstack-keystone | 16:15 | |
| *** nsquare has joined #openstack-keystone | 16:17 | |
| morganfainberg | nkinder_: i think you're right, this is a case of needing multiple validation certs. | 16:17 |
| morganfainberg | related, we would need to allow keystone to provide OS-SIMPLE-CERT? multiple certificates then? | 16:18 |
| morganfainberg | but more to the point http://www.ietf.org/rfc/rfc3850.txt effectively says we shouldn't rely on signingtime (if i am reading this correctly), if the cert is expired the tokens should also be invalid | 16:19 |
| *** dstanek_zzz is now known as dstanek | 16:24 | |
| *** gokrokve_ has quit IRC | 16:24 | |
| *** browne has joined #openstack-keystone | 16:24 | |
| *** marcoemorais has joined #openstack-keystone | 16:26 | |
| dstanek | morganfainberg: gertty is a great idea, but it's hard for me to actually use it | 16:27 |
| morganfainberg | dstanek: it takes time to get use to it | 16:27 |
| morganfainberg | dstanek: it may also not be a good option for you :) to each their own, right? | 16:27 |
| morganfainberg | marekd: , i don't see a need to cache the token anywhere in here | 16:28 |
| marekd | topol: I responded to your question in websso bp (https://review.openstack.org/#/c/96867/) | 16:28 |
| morganfainberg | marekd: thankfully | 16:28 |
| dstanek | morganfainberg: i think there are some UI change i can make to get it to work better for me - i really want to do offline reviews | 16:28 |
| topol | marekd, OK cool. I will look later today | 16:28 |
| marekd | morganfainberg: how do we map authorization code with token? | 16:28 |
| marekd | topol: ++ | 16:28 |
| morganfainberg | marekd: for what revocations? you would need to include the auth code in the token | 16:29 |
| morganfainberg | marekd: once the keystone token is issued, we don't really care (Except for audit and revocation) what the auth code is | 16:29 |
| morganfainberg | the rest of the info would already be in the token. | 16:29 |
| marekd | morganfainberg: so, so after authN Keystone would need to return whole token. | 16:29 |
| morganfainberg | that is how the saml stuff works today, no? you auth, get the assertion and the assertion is used to issue a token (drastic simplification) | 16:30 |
| marekd | morganfainberg: yes it does, but according to the author's idea only auth code is returned. | 16:30 |
| marekd | and he later reuses this auth code to get a token. | 16:31 |
| morganfainberg | well this author is also thinking that keystone would broker the username/password | 16:31 |
| morganfainberg | which would be wrong and insecure | 16:31 |
| morganfainberg | hand my AD credentials to keystone, and keystone asks for the assertion? | 16:31 |
| marekd | morganfainberg: if you look at line ~207 | 16:31 |
| marekd | i think he assumes that having this authorization code will be enough to get a token. | 16:32 |
| *** gordc has quit IRC | 16:32 | |
| morganfainberg | marekd: ah hadn't gotten that far in yet | 16:32 |
| ayoung | nkinder_, so, on the OS-SIMPLE-CERT question, I was wondering if we could, as a first approximation, just send all of the certs that Keystone knows about everyt time it is called | 16:32 |
| marekd | morganfainberg: ah, ok. | 16:32 |
| morganfainberg | marekd: i also think this needs to be split up | 16:33 |
| ayoung | morganfainberg, the SIMPLE_CERT API is already written to send more than one cert, | 16:33 |
| morganfainberg | ayoung: ++ | 16:33 |
| marekd | morganfainberg: split into federated/non-federated usecase? | 16:33 |
| ayoung | morganfainberg, but that might now work in practice | 16:33 |
| morganfainberg | marekd: yeah | 16:33 |
| morganfainberg | marekd: they may be closely related, and the federated case may expand on the non-federated case (do a redirect instead of consuming/brokering username/password) | 16:33 |
| ayoung | morganfainberg, for example, if you wereto use CURL to hit simple-cert, I don't know if there is any clean way to say "save them each in their own file" but maybe for PEM files and openssl, it doesn't matter | 16:33 |
| ayoung | I thin that the verify can work against a set of certs in the same file | 16:34 |
| marekd | morganfainberg: maybe. | 16:34 |
| marekd | morganfainberg: whatever we do we might need some hacks on top of that...;/ | 16:34 |
| morganfainberg | ayoung: or we could make it multiple certs return a 30..what was multiple options? 305? and then you get a list you can download, downlaod them all in sequence | 16:34 |
| morganfainberg | marekd: yeah. :( | 16:35 |
| ayoung | from the openssl cms man page: cert.pem... one or more certificates of message recipients: used when encrypting a message. | 16:35 |
| marekd | morganfainberg: that's why I am starting to have some crazy ideas about handling the login in JS. | 16:35 |
| marekd | logic* | 16:35 |
| marekd | sorry | 16:35 |
| morganfainberg | ayoung: that is the sign/encrypt part, what about the verify part | 16:35 |
| morganfainberg | ayoung: i have no doubt sign/encrypt can target multiple recipients (though the token would baloon in size) | 16:36 |
| ayoung | morganfainberg, 300 multiple choices does not mean that, I think | 16:36 |
| ayoung | morganfainberg, no this is the verify part | 16:36 |
| ayoung | sign encrypt would be with a singe cert | 16:36 |
| ayoung | single | 16:36 |
| ayoung | OS-SIMPLE_CERT if for distributing the server for verification | 16:37 |
| morganfainberg | what you quoted was 'used when encrypting' ^^ look up :P | 16:37 |
| marekd | morganfainberg: anyways, i once had suggested that maybe a full token, instead of authorization code, should be returned, but author didn't like that idea. Leave your comments if possible, as you will have probably much bigger impact on all that. | 16:37 |
| ayoung | morganfainberg, yes, cuz they all share the same common options: cms verify, encrypt etc | 16:37 |
| morganfainberg | ayoung: i admit i am unfamiliar with a chunk of this | 16:38 |
| ayoung | morganfainberg, man cms | 16:38 |
| morganfainberg | ayoung: i've been reading that :P | 16:38 |
| ayoung | openssl is a little greedy when it comes to man page namespacing | 16:38 |
| morganfainberg | ayoung: it still makes my brain hurt! ;) | 16:38 |
| *** gordc has joined #openstack-keystone | 16:38 | |
| morganfainberg | ayoung: we also have an issue with middleware leaking tmpdirs | 16:39 |
| morganfainberg | ayoung: mildly related | 16:39 |
| morganfainberg | restart a service enough, middleware will consume /tmp with tmpdirs if you don't specify a signing dir | 16:39 |
| ayoung | morganfainberg, remember ,most of the verify exampls they show assumes that the certs are embedded in the message | 16:39 |
| morganfainberg | ayoung: ah right. and we're not embeding them | 16:39 |
| ayoung | morganfainberg, I thought we specified the "autocleanup" option when creating tmpdir | 16:40 |
| ayoung | if not, we should | 16:40 |
| morganfainberg | ayoung: mkdtemp has not autocleanup | 16:40 |
| morganfainberg | no* | 16:40 |
| morganfainberg | it is explicitly the job of the invoker to cleanup afterwards | 16:40 |
| morganfainberg | the tmpfile creation would have autocleanup | 16:40 |
| ayoung | is that the python call? | 16:41 |
| morganfainberg | yeah we use tempfile.mkdtemp | 16:41 |
| morganfainberg | or similar | 16:41 |
| ayoung | and that should call the underlying klib...looking | 16:41 |
| *** marekd is now known as marekd|away | 16:41 | |
| morganfainberg | ayoung: https://docs.python.org/2/library/tempfile.html#tempfile.mkdtemp | 16:42 |
| morganfainberg | ayoung: The user of mkdtemp() is responsible for deleting the temporary directory and its contents when done with it. | 16:42 |
| ayoung | morganfainberg, there are other variations, though | 16:42 |
| ayoung | at least in the native lib | 16:43 |
| morganfainberg | ayoung: not for directories, for files (python not sure about native lib) | 16:43 |
| ayoung | morganfainberg, if we don't get autocleanup, we have to trap and cleanup on exit | 16:44 |
| morganfainberg | or we could instead use multiple tempfiles that do autocleanup | 16:44 |
| *** amcrn has joined #openstack-keystone | 16:44 | |
| morganfainberg | no reason we _have_ to use a tmpdir | 16:44 |
| ayoung | ah, but we can't unlink.... | 16:44 |
| morganfainberg | mkstmp automatically handles that when the FD is closed | 16:45 |
| morganfainberg | or uh tempfile? | 16:45 |
| ayoung | morganfainberg, except that we don't know the name of the file a-priori, and remember this needs to work from Apache HTTPD | 16:45 |
| morganfainberg | https://docs.python.org/2/library/tempfile.html#tempfile.NamedTemporaryFile | 16:45 |
| morganfainberg | ayoung: this is middleware, not keystone | 16:46 |
| ayoung | morganfainberg, and we need the other services to be capable of running in HTTPD | 16:46 |
| morganfainberg | we create a tmpdir per thread as is | 16:46 |
| morganfainberg | this is all irrelevant if a shared signing dir is specified | 16:47 |
| morganfainberg | this is just if middleware does all the management, which case separate tempfiles isn't different from what we do now, just would autocleanup | 16:47 |
| morganfainberg | anyway | 16:48 |
| *** dstanek is now known as dstanek_zzz | 16:48 | |
| *** diegows has joined #openstack-keystone | 16:52 | |
| *** dstanek_zzz is now known as dstanek | 16:52 | |
| *** gordc has quit IRC | 17:00 | |
| *** nsquare has quit IRC | 17:01 | |
| *** bobt has joined #openstack-keystone | 17:07 | |
| *** i159 has quit IRC | 17:08 | |
| *** harlowja_away is now known as harlowja | 17:08 | |
| morganfainberg | marekd|away: commented on the SSO review | 17:13 |
| *** vhoward has left #openstack-keystone | 17:20 | |
| *** nsquare has joined #openstack-keystone | 17:33 | |
| *** richm has quit IRC | 17:34 | |
| *** gordc has joined #openstack-keystone | 17:34 | |
| *** gordc has quit IRC | 17:40 | |
| *** gokrokve has joined #openstack-keystone | 17:44 | |
| *** andreaf has quit IRC | 17:46 | |
| *** ayoung has quit IRC | 17:47 | |
| morganfainberg | gyee: i updated henry-nash's spec update to correct | 17:48 |
| morganfainberg | 'encryption' to 'hashing' | 17:48 |
| *** richm has joined #openstack-keystone | 17:48 | |
| *** amerine has joined #openstack-keystone | 17:50 | |
| *** hrybacki_ has joined #openstack-keystone | 17:51 | |
| gyee | morganfainberg, looks good! | 17:52 |
| *** hrybacki has quit IRC | 17:54 | |
| *** ayoung has joined #openstack-keystone | 17:55 | |
| *** hrybacki_ has quit IRC | 17:56 | |
| *** harlowja has quit IRC | 18:00 | |
| *** marcoemorais has quit IRC | 18:02 | |
| *** marcoemorais has joined #openstack-keystone | 18:03 | |
| *** marcoemorais has quit IRC | 18:04 | |
| *** marcoemorais has joined #openstack-keystone | 18:04 | |
| *** marcoemorais has quit IRC | 18:04 | |
| *** marcoemorais has joined #openstack-keystone | 18:04 | |
| *** marcoemorais has quit IRC | 18:05 | |
| *** marcoemorais has joined #openstack-keystone | 18:06 | |
| *** marcoemorais has quit IRC | 18:06 | |
| *** marcoemorais has joined #openstack-keystone | 18:06 | |
| *** bknudson has joined #openstack-keystone | 18:06 | |
| stevemar | joesavak, ping | 18:08 |
| *** hrybacki has joined #openstack-keystone | 18:08 | |
| *** hrybacki has quit IRC | 18:12 | |
| *** hrybacki has joined #openstack-keystone | 18:12 | |
| hrybacki | ayoung: should we make the other board public as well? | 18:15 |
| ayoung | hrybacki, yeah, if we are going to keep it just with the upstream tasks | 18:15 |
| hrybacki | I don't foresee any reason why that wouldn't be the case, do you? | 18:16 |
| hrybacki | ayoung: how are you testing horizon to see where you need to make patches? | 18:28 |
| ayoung | hrybacki, heh, right now I am battling a devstack setup | 18:29 |
| ayoung | I had one working, but it was for all of the kerberos work | 18:29 |
| hrybacki | ayoung: hehe | 18:29 |
| ayoung | what i am trying to do is run a vm | 18:29 |
| ayoung | and mount the devstack dir via nfs | 18:29 |
| ayoung | and I had it working, but I started with a cloud image, and it only has 2 GB of storag. | 18:29 |
| ayoung | so I'm resizing it, and it is a pain | 18:30 |
| hrybacki | that sounds complicated -- why not just set up your vm with virt-whatever, install devstack, and roll? | 18:30 |
| dstanek | bknudson: what (if anything) actually uses sqlite_db? i didn't see oslo.db using it either. re: https://review.openstack.org/#/c/101635 | 18:33 |
| bknudson | dstanek: nova tests | 18:33 |
| bknudson | and some other projects use it, don't remember which | 18:34 |
| amerine | ayoung: Is it cool if I PM you real quick? | 18:34 |
| ayoung | HAHAH | 18:34 |
| ayoung | amerine, sure | 18:34 |
| *** ajayaa has joined #openstack-keystone | 18:36 | |
| bknudson | dstanek: looks like nova could stop using it by parsing sqlite_connection | 18:36 |
| bknudson | oops, sql_connection | 18:36 |
| dstanek | bknudson: odd, i wonder why oslo.db defines it as an option if it's not used by them | 18:38 |
| *** harlowja has joined #openstack-keystone | 18:38 | |
| *** harlowja has quit IRC | 18:38 | |
| *** harlowja has joined #openstack-keystone | 18:39 | |
| *** harlowja has quit IRC | 18:39 | |
| bknudson | dstanek: I filed a bug and tried to get rid of it but they wanted nova, etc, changed first | 18:39 |
| openstackgerrit | A change was merged to openstack/keystone: Make gen_pki.sh & debug_helper.sh bash8 compliant https://review.openstack.org/93438 | 18:39 |
| dstanek | bknudson: odd, i wonder why oslo.db defines it as an option if it's not used by them | 18:42 |
| bknudson | dstanek: I filed a bug and tried to get rid of it but they wanted nova, etc, changed first (same response as last time) | 18:46 |
| *** ayoung has quit IRC | 18:48 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Initial implementation of validator https://review.openstack.org/86483 | 18:48 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Catalog V3 resources https://review.openstack.org/96266 | 18:48 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 18:48 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Credential V3 https://review.openstack.org/98522 | 18:48 |
| stevemar | this change has made my keystone unhappy https://github.com/openstack/keystone/commit/8db9ba790696c5572a8fce3be913f05fa391c491 | 18:48 |
| stevemar | dstanek did you also have the same issue? | 18:49 |
| dstanek | stevemar: not that i know of...is that broken for you? | 18:50 |
| stevemar | well I don't have it cloned or anything, but i pulled in latest changes for keystone, and i couldnt do operations | 18:51 |
| *** harlowja has joined #openstack-keystone | 18:51 | |
| *** harlowja has quit IRC | 18:51 | |
| *** david-lyle has quit IRC | 18:51 | |
| *** david-lyle has joined #openstack-keystone | 18:52 | |
| stevemar | dstanek, just cloned it into the same directory as all my other openstack stuff, but i'm still getting an import error when the keystone code hits oslo.db | 18:52 |
| *** david-lyle has quit IRC | 18:52 | |
| *** harlowja has joined #openstack-keystone | 18:52 | |
| *** harlowja has quit IRC | 18:52 | |
| dstanek | stevemar: failing to import oslo.db? | 18:52 |
| hrybacki | jamielennox: you around? | 18:53 |
| dstanek | stevemar: you may have to rebuild your tox env | 18:53 |
| *** david-lyle has joined #openstack-keystone | 18:53 | |
| stevemar | dstanek, that will make my shoes sad | 18:53 |
| *** harlowja has joined #openstack-keystone | 18:53 | |
| stevemar | dstanek, i just pip installed the latest version, seems to be all better | 18:54 |
| bknudson | is git fetch working for people? | 18:54 |
| bknudson | ok, it finally worked | 18:55 |
| joesavak | stevemar - yo! : ) | 18:55 |
| stevemar | joesavak, i was just closing my laptop to get a coffee, catch you in 10 minutes? | 18:56 |
| joesavak | sure | 18:56 |
| stevemar | joesavak, awesome, wanted to talk keystone specs stuff | 18:56 |
| joesavak | woot. | 18:57 |
| *** dims_ has joined #openstack-keystone | 18:57 | |
| *** dims has quit IRC | 18:58 | |
| *** stevemar has quit IRC | 18:58 | |
| *** ayoung has joined #openstack-keystone | 19:00 | |
| *** gordc has joined #openstack-keystone | 19:04 | |
| *** marcoemorais has quit IRC | 19:06 | |
| *** marcoemorais has joined #openstack-keystone | 19:06 | |
| *** marcoemorais has quit IRC | 19:06 | |
| *** marcoemorais has joined #openstack-keystone | 19:07 | |
| *** david-lyle has quit IRC | 19:08 | |
| *** david-lyle has joined #openstack-keystone | 19:08 | |
| *** david-lyle has quit IRC | 19:09 | |
| *** david-lyle has joined #openstack-keystone | 19:10 | |
| *** esmute has quit IRC | 19:10 | |
| *** fyb3r has joined #openstack-keystone | 19:15 | |
| fyb3r | I need a little help with an error im getting. Currently im following the install guide on the site, on this http://docs.openstack.org/icehouse/install-guide/install/apt/content/glance-verify.html page. When I go to run glance image-create --name "cirros-0.3.2-x86_64" --disk-format qcow2 \ --container-format bare --is-public True --progress < cirros-0.3.2-x86_64-disk.img after sourcing the OS_USERNAME:glance OS_PASSWORD:password I us | 19:18 |
| fyb3r | 401 Unauthorized | 19:18 |
| fyb3r | This server could not verify that you are authorized to access the document you requested. Either you supplied the wrong credentials (e.g., bad password), or your browser does not understand how to supply the credentials required. | 19:18 |
| fyb3r | Request returned failure status. | 19:18 |
| fyb3r | Invalid OpenStack Identity credentials. | 19:18 |
| *** stevemar has joined #openstack-keystone | 19:19 | |
| fyb3r | api-log shows this: 2014-06-23 13:44:51.867 13342 INFO keystoneclient.middleware.auth_token [-] Invalid user token - deferring reject downstream, 2014-06-23 13:44:51.897 13342 INFO glance.wsgi.server [-] 10.1.10.150 - - [23/Jun/2014 13:44:51] "POST /v1/images HTTP/1.1" 401 381 0.031280 | 19:19 |
| fyb3r | any help would be awesome ^_^ | 19:19 |
| *** esmute has joined #openstack-keystone | 19:25 | |
| hrybacki | ayoung, jamielennox: I'm digging around in https://github.com/openstack/python-glanceclient/blob/e6579f43cc39db0f2d640041477b66a011acff59/glanceclient/common/http.py#L74 -- but I'm not really sure how to get started with the port tbh | 19:28 |
| *** erecio has quit IRC | 19:37 | |
| *** erecio has joined #openstack-keystone | 19:38 | |
| ayoung | hrybacki, lets start with the Horizon board: | 19:45 |
| ayoung | https://trello.com/b/YamiJPl6/horizon-auth | 19:45 |
| hrybacki | nods | 19:45 |
| ayoung | hrybacki, OK ,so what I found was that they are doing wacky things with creating the client | 19:46 |
| hrybacki | okay' | 19:46 |
| ayoung | so the first thing to do is to | 19:46 |
| ayoung | ah..... | 19:47 |
| morganfainberg | lbragstad: couple minor comments on your validator patches | 19:47 |
| hrybacki | is that a question or lead up to a statement? | 19:47 |
| ayoung | yeah, very different from theHorizon case | 19:47 |
| ayoung | Horzion already uses Keystone client | 19:48 |
| ayoung | in some ways, you might be in a better position | 19:48 |
| ayoung | OK... | 19:48 |
| ayoung | so, leaving the exisitng code in place, first thing is just create a keystoneclient session object...somewhere | 19:48 |
| ayoung | probably where something would currently create an HTTPClient | 19:49 |
| *** ajayaa has quit IRC | 19:49 | |
| openstackgerrit | Joe Savak proposed a change to openstack/keystone-specs: Implements: blueprint keystone-to-keystone-federation https://review.openstack.org/100023 | 19:49 |
| openstackgerrit | Joe Savak proposed a change to openstack/keystone-specs: Spec to define cross-keystone federation https://review.openstack.org/101987 | 19:50 |
| joesavak | urg. | 19:50 |
| ayoung | hrybacki, so, um, it would seem that you would need to be able to create a glanceclient the same way that the keystone code creates a keystone client | 19:54 |
| ayoung | make session an optional parameter, and if it is included use it to populate the values of the client | 19:55 |
| ayoung | hrybacki, http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/client.py#n42 | 19:56 |
| hrybacki | okay | 19:58 |
| hrybacki | so, leaving the glanceclient stuff that is currently there intact, create a new way of establishing a keystone client connection that can optionally be handed a session, yes? | 19:59 |
| *** packet has quit IRC | 20:01 | |
| lbragstad | morganfainberg thanks! | 20:05 |
| fyb3r | >_> still dunno wha tto do about my problem | 20:05 |
| openstackgerrit | A change was merged to openstack/keystone-specs: Always use a hash based Public ID for cross backend identifiers https://review.openstack.org/100497 | 20:07 |
| hrybacki | ayoung: it's not a coincidence that https://github.com/openstack/python-glanceclient/blob/e6579f43cc39db0f2d640041477b66a011acff59/glanceclient/common/http.py looks remarkably similar to https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/httpclient.py is it? | 20:08 |
| *** bknudson has quit IRC | 20:10 | |
| *** bknudson has joined #openstack-keystone | 20:11 | |
| hrybacki | ayoung: can you point fyb3r to somone who might be able to help with his error? | 20:11 |
| fyb3r | <# | 20:13 |
| fyb3r | <3 too | 20:13 |
| *** jamielennox is now known as jamielennox|away | 20:16 | |
| fyb3r | though I believe Im finding my way around the service now and how to troubleshoot it ^_^ but help is always appreciated lol | 20:17 |
| ayoung | fyb3r, reading up | 20:19 |
| *** stevemar2 has joined #openstack-keystone | 20:19 | |
| ayoung | fyb3r, http://adam.younglogic.com/2013/07/troubleshooting-pki-middleware/ | 20:20 |
| fyb3r | Ill get on it. ty for the link | 20:21 |
| hrybacki | ayoung++ | 20:21 |
| *** stevemar has quit IRC | 20:22 | |
| *** nkinder has joined #openstack-keystone | 20:28 | |
| *** daneyon has quit IRC | 20:30 | |
| fyb3r | it seems the guide for icehouse and juno are pretty lacking with their info too. In combining the knowledge from the grizzly guide and icehouse / juno, i think I have it figured out lol | 20:30 |
| *** nkinder_ has quit IRC | 20:32 | |
| hrybacki | fyb3r: the docs are seriously lacking =/ | 20:33 |
| fyb3r | cant complain for free though :) mayhaps I should get off my butt and contribute to my findings | 20:33 |
| hrybacki | nods, I have a list of numerous fixes to the docs -- haven't taken the time to figure out _where_ to go to request changes to them though | 20:34 |
| *** marcoemorais has quit IRC | 20:36 | |
| *** marcoemorais has joined #openstack-keystone | 20:37 | |
| hrybacki | ayoung: should I be worried about the v1 client for glance or not? | 20:39 |
| ayoung | hrybacki, I don't think so. But worth finding out from the Glance community about that | 20:40 |
| ayoung | #openstack-glance probably | 20:40 |
| hrybacki | I pinged them earlier but got static back | 20:40 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Federating multiple Keystones https://review.openstack.org/100023 | 20:41 |
| hrybacki | just pinged them again | 20:41 |
| hrybacki | ayoung: I still don't understand the purpose of the clients for each component exactly, why not just interact with the servers directly? How do they actually function in a real world setup? | 20:42 |
| *** vhoward has joined #openstack-keystone | 20:43 | |
| ayoung | hrybacki, its what happens when you start coding: just coding curl to the server...then you find common parts, refactor, and bam, you have a whole Python API | 20:43 |
| ayoung | and each of the projects evolved a litle differently | 20:44 |
| ayoung | so we are trying to make sure that common part is really common | 20:44 |
| ayoung | especially when it comes to security | 20:44 |
| ayoung | they all need tokens, and have to go to keystone to get them | 20:44 |
| ayoung | they should not each be writing that code from scratch | 20:44 |
| ayoung | add in SSL and Kerberos and it all gets quite tricky | 20:44 |
| hrybacki | so in essence they are just API wrappers that communicate with their respective servers (the actual components)? | 20:45 |
| hrybacki | do we want the glanceclient communicating with keystone to start a session or should that be going through a keystoneclient? all a bit confusing =/ | 20:47 |
| *** topol has quit IRC | 20:48 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Initial implementation of validator https://review.openstack.org/86483 | 20:48 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Catalog V3 resources https://review.openstack.org/96266 | 20:48 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 20:48 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Credential V3 https://review.openstack.org/98522 | 20:48 |
| stevemar2 | lbragstad, marekd|away dstanek gyee dolphm morganfainberg ayoung and whoever else i missed, i would appreciate eyes on https://review.openstack.org/#/c/100023/5 | 20:50 |
| marekd|away | stevemar2: link again please? | 20:51 |
| stevemar2 | marekd|away, https://review.openstack.org/#/c/100023/5 | 20:51 |
| marekd|away | stevemar2: just lookin at it. | 20:51 |
| marekd|away | stevemar2: did you somehow stayed in touch with Joe? | 20:52 |
| stevemar2 | marekd|away, btw i got federation working with our product, is your SAML client stuff usable yet? | 20:52 |
| stevemar2 | marekd|away, i did | 20:52 |
| fyb3r | welp i lied, damn thing is still broken lol | 20:52 |
| marekd|away | stevemar2: i think so. | 20:52 |
| stevemar2 | marekd|away, expect me to test it out then :) | 20:52 |
| marekd|away | stevemar2: sure thing. | 20:53 |
| stevemar2 | marekd|away, any necessary config changes to shib? | 20:53 |
| stevemar2 | maybe enable ECP ? | 20:53 |
| stevemar2 | but thats it? | 20:53 |
| marekd|away | stevemar2: yes, enable ecp and pretty much that's all. | 20:53 |
| marekd|away | stevemar2: you know how to do it? | 20:53 |
| stevemar2 | where do i type in the username and password :P | 20:53 |
| marekd|away | ECP="true" in one directive in shibboleth2.xml file. | 20:54 |
| stevemar2 | marekd|away, i think it's just 1 value in mod_shib? if it's not, i would appreciate docs if you have them | 20:54 |
| stevemar2 | yeah | 20:54 |
| marekd|away | that's one value. | 20:54 |
| *** david-lyle has quit IRC | 20:54 | |
| marekd|away | user/pass are arguments for plugin auth. | 20:54 |
| stevemar2 | cool | 20:54 |
| marekd|away | i had a wrapper wround the plugins so one can execute from cmdline | 20:54 |
| *** dims__ has joined #openstack-keystone | 20:54 | |
| stevemar2 | nice | 20:54 |
| stevemar2 | good call | 20:54 |
| stevemar2 | i look forward to trying it out! | 20:55 |
| *** david-lyle has joined #openstack-keystone | 20:55 | |
| marekd|away | but it's on my other computer so I can send it to you in 9-10h :/ | 20:55 |
| stevemar2 | lol | 20:55 |
| stevemar2 | np | 20:55 |
| stevemar2 | marekd|away, ttyl | 20:55 |
| marekd|away | i wrote it on my knee so didnt bother with sharing among multiple devices etc ;/ | 20:55 |
| *** dims__ has quit IRC | 20:55 | |
| *** david-lyle has quit IRC | 20:55 | |
| *** dims__ has joined #openstack-keystone | 20:56 | |
| *** david-lyle has joined #openstack-keystone | 20:56 | |
| marekd|away | stevemar2: you'd better review protocols crud in keystoneclient :-) | 20:56 |
| hrybacki | What is the purpose of instantiating HTTPClient here: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/client.py#L19 if it isn't used elsewhere? | 20:57 |
| *** dims_ has quit IRC | 20:57 | |
| marekd|away | ok, gotta run. | 20:59 |
| *** stevemar2 has quit IRC | 20:59 | |
| *** erecio has quit IRC | 21:00 | |
| dstanek | hrybacki: it's not creating an instance - it's likely an alias so that other modules can import it directly from client.py | 21:01 |
| hrybacki | ah | 21:02 |
| dstanek | hrybacki: based on the comment that's likely to be backward compatible | 21:02 |
| hrybacki | are a lot of things wonky to maintain backwards compatability? | 21:03 |
| *** marcoemorais has quit IRC | 21:04 | |
| *** marcoemorais has joined #openstack-keystone | 21:04 | |
| dstanek | hrybacki: i'm sure some things seem different. on the server side we have a deprecated decorator that we use for situations like this | 21:04 |
| *** amcrn has quit IRC | 21:04 | |
| hrybacki | dstanek: okay, thank you, so much stuff to absorb | 21:05 |
| fyb3r | found out curl http://localhost:35357/v2.0/certificates/signing is getting its connection refused 0,o | 21:06 |
| *** hrybacki has quit IRC | 21:07 | |
| *** afazekas has joined #openstack-keystone | 21:10 | |
| *** david-lyle has quit IRC | 21:16 | |
| *** david-lyle has joined #openstack-keystone | 21:16 | |
| *** david-lyle has quit IRC | 21:17 | |
| *** david-lyle has joined #openstack-keystone | 21:20 | |
| fyb3r | http://paste.openstack.org/show/84734/ | 21:31 |
| fyb3r | ive been trying to figure this our for just over 16 hours now, and im burnt on it. Not even really sure how to properly troubleshoot because of the vast amount of seemingly outdated docs 0,o any direct would be awesome | 21:31 |
| dstanek | fyb3r: is that from a glance log? | 21:35 |
| *** joesavak has quit IRC | 21:36 | |
| fyb3r | api.log for glance, yes | 21:37 |
| dstanek | fyb3r: i'm not familiar with that :-( is the token you specified valid? | 21:40 |
| fyb3r | im not specifying a token, which is what confused me lol | 21:40 |
| dstanek | are you using your credentials? | 21:41 |
| fyb3r | http://docs.openstack.org/icehouse/install-guide/install/apt/content/glance-verify.html following this step currently in setting it up | 21:41 |
| fyb3r | im using the glance creds for the tenant: service | 21:42 |
| fyb3r | y | 21:42 |
| fyb3r | oops misstype sry | 21:42 |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone-specs: Propose Specification for Endpoint Group Filter https://review.openstack.org/102023 | 21:43 |
| dstanek | fyb3r: do those credentials work directly against keystone? | 21:45 |
| *** nkinder has quit IRC | 21:45 | |
| *** gordc has quit IRC | 21:49 | |
| *** jamielennox|away is now known as jamielennox | 21:51 | |
| *** lbragstad has quit IRC | 21:53 | |
| *** Dafna_away has quit IRC | 21:54 | |
| fyb3r | yes they do | 21:54 |
| fyb3r | for both admin and glance | 21:54 |
| *** bobt has quit IRC | 21:55 | |
| fyb3r | now im just totally lost on what to do rofl. it makes no sense why it wouldnt authenticate if i can use glace with its credentials perfectly | 21:56 |
| *** hrybacki has joined #openstack-keystone | 22:04 | |
| *** gordc has joined #openstack-keystone | 22:05 | |
| *** hrybacki has quit IRC | 22:05 | |
| *** hrybacki has joined #openstack-keystone | 22:05 | |
| openstackgerrit | Priti Desai proposed a change to openstack/keystone: Ignoring order of user list in TenantTestCase https://review.openstack.org/101712 | 22:05 |
| *** gordc has quit IRC | 22:06 | |
| *** dstanek is now known as dstanek_zzz | 22:07 | |
| fyb3r | >_> <_< >_< | 22:07 |
| *** bknudson has quit IRC | 22:10 | |
| *** dstanek_zzz is now known as dstanek | 22:16 | |
| *** fyb3r has left #openstack-keystone | 22:26 | |
| openstackgerrit | Justin Shepherd proposed a change to openstack/keystone: Adding an index on token.user_id https://review.openstack.org/102041 | 22:31 |
| *** marcoemorais has quit IRC | 22:35 | |
| *** marcoemorais has joined #openstack-keystone | 22:35 | |
| *** marcoemorais has quit IRC | 22:35 | |
| *** marcoemorais has joined #openstack-keystone | 22:36 | |
| *** marcoemorais has quit IRC | 22:36 | |
| *** marcoemorais has joined #openstack-keystone | 22:37 | |
| *** dstanek is now known as dstanek_zzz | 22:50 | |
| *** morganfainberg_L has joined #openstack-keystone | 23:12 | |
| *** morganfainberg has quit IRC | 23:12 | |
| *** morganfainberg_Z is now known as morganfainberg | 23:12 | |
| *** fyb3r has joined #openstack-keystone | 23:13 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Session loading from conf https://review.openstack.org/95015 | 23:18 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Session loading from CLI options https://review.openstack.org/95678 | 23:18 |
| jamielennox | hey everyone - i really need to get some movement in keystoneclient. Please have a look at the following: | 23:19 |
| jamielennox | https://review.openstack.org/#/c/86237 | 23:19 |
| jamielennox | https://review.openstack.org/95015 | 23:19 |
| jamielennox | https://review.openstack.org/95678 | 23:20 |
| *** amcrn has joined #openstack-keystone | 23:21 | |
| *** morganfainberg_L is now known as mdrnstm | 23:21 | |
| *** mdrnstm has quit IRC | 23:22 | |
| *** mdrnstm has joined #openstack-keystone | 23:22 | |
| *** morganfainberg has quit IRC | 23:22 | |
| *** mdrnstm is now known as morganfainberg | 23:22 | |
| *** morganfainberg_Z has joined #openstack-keystone | 23:22 | |
| *** marcoemorais has quit IRC | 23:23 | |
| *** marcoemorais has joined #openstack-keystone | 23:23 | |
| *** marcoemorais has quit IRC | 23:23 | |
| *** marcoemorais has joined #openstack-keystone | 23:24 | |
| fyb3r | http://paste.openstack.org/show/84739/ | 23:28 |
| fyb3r | i cant even find a log for that error | 23:33 |
| fyb3r | yeesh | 23:33 |
| fyb3r | cd | 23:34 |
| morganfainberg | jamielennox: +2 on the first one | 23:35 |
| morganfainberg | jamielennox: others look like they need rebase | 23:35 |
| morganfainberg | oh no the subsequent patches != the ones you linked :P | 23:35 |
| morganfainberg | nvm n the rebase | 23:35 |
| *** oomichi has joined #openstack-keystone | 23:42 | |
| *** fyb3r has quit IRC | 23:44 | |
| *** david-lyle has quit IRC | 23:47 | |
| *** david-lyle has joined #openstack-keystone | 23:48 | |
| *** david-lyle has quit IRC | 23:52 | |
| *** xianghui has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
