| *** amcrn has quit IRC | 00:07 | |
| *** rodrigods_ has joined #openstack-keystone | 00:07 | |
| *** gokrokve has quit IRC | 00:15 | |
| *** rodrigods__ has joined #openstack-keystone | 00:15 | |
| *** rodrigods_ has quit IRC | 00:15 | |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Privatize Everything https://review.openstack.org/104027 | 00:26 |
|---|---|---|
| *** packet has quit IRC | 00:33 | |
| *** xianghui has joined #openstack-keystone | 00:34 | |
| jamielennox | so in my auth plugin loading from config file stuff i have two basic options the auth_plugin which is the name of the plugin to use and the auth_section which is an ini [section] to read the values from | 00:43 |
| jamielennox | the idea being that if you are like nova and have glance, cinder whatever with multiple connection properties you can point them all to a common [passworddata] section rather than specify that information twice | 00:44 |
| jamielennox | and ideally that the auth plugin itself should be sharable if it's loaded from the same [section] | 00:44 |
| jamielennox | my question is, does it make sense to have the auth_plugin name within that [section] or outside as it is now | 00:45 |
| jamielennox | which i think boils down to the question if you have all your auth data stored in a [section] then does that mean that you want to use the same plugin for that? | 00:46 |
| jamielennox | or can you read a v2password plugin and a v3password plugin from the same section | 00:47 |
| jamielennox | ... crickets - it's fairly easy to support both cases, that saves making a decision :) | 00:55 |
| *** gokrokve has joined #openstack-keystone | 00:55 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add oslo.i18n as dependency https://review.openstack.org/104399 | 01:02 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Use oslo.i18n https://review.openstack.org/104400 | 01:02 |
| *** arosen has left #openstack-keystone | 01:02 | |
| *** mberlin1 has joined #openstack-keystone | 01:13 | |
| *** mberlin has quit IRC | 01:15 | |
| *** gokrokve has quit IRC | 01:35 | |
| *** marcoemorais has quit IRC | 01:39 | |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Allow LDAP lock attributes to be used as enable attributes https://review.openstack.org/104408 | 01:42 |
| *** gokrokve has joined #openstack-keystone | 01:43 | |
| *** rodrigods__ has quit IRC | 01:55 | |
| *** rodrigods_ has joined #openstack-keystone | 01:57 | |
| *** daneyon has quit IRC | 02:02 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone-specs: Revoke tokens when deleting EC2 credential https://review.openstack.org/103493 | 02:09 |
| *** gokrokve has quit IRC | 02:11 | |
| *** gokrokve has joined #openstack-keystone | 02:11 | |
| morganfainberg | jamielennox, ping | 02:11 |
| jamielennox | morganfainberg: hey | 02:11 |
| morganfainberg | jamielennox, mind pressing go on https://review.openstack.org/#/c/104208/ [ok reviwwing and] | 02:12 |
| morganfainberg | jamielennox, it's the last outstanding thing we need before middleware release | 02:12 |
| morganfainberg | jamielennox, i just got back. reading the backlog | 02:13 |
| jamielennox | morganfainberg: i was looking at that and wondering how it works | 02:13 |
| morganfainberg | jamielennox, the same way it works now w/ ksc and keystone | 02:14 |
| morganfainberg | jamielennox, it's strictly for the generator code (e.g. keystone.openstack.common.config.generator | 02:14 |
| morganfainberg | or well not how ksc works :P | 02:15 |
| *** junhongl has joined #openstack-keystone | 02:15 | |
| jamielennox | does something on the generator side know to only include the ep.name that are depended on for that project | 02:15 |
| jamielennox | just doing a pure iterate you'll get options for every library installed on the machine | 02:16 |
| morganfainberg | hm? | 02:16 |
| morganfainberg | ep.name? | 02:16 |
| morganfainberg | oh entrypoint | 02:16 |
| jamielennox | endpoint name | 02:16 |
| jamielennox | sorry, that was in code somewhere | 02:16 |
| morganfainberg | yeah it lets us be more specific as in load the options from auth_token instead of the entire package afaict | 02:16 |
| jamielennox | so it's marked as oslo.messaging in entry points, the config generator says i import oslo.messaging so lookup the options for that via entrypoitn? | 02:16 |
| morganfainberg | looking for the explicit example for you | 02:17 |
| jamielennox | having said that to you i'm almost sure that's how it would work | 02:17 |
| morganfainberg | so look here: https://github.com/openstack/keystone/blob/master/tools/config/oslo.config.generator.rc | 02:18 |
| morganfainberg | this lists the packages we're looking for | 02:18 |
| morganfainberg | well the "EXTRA" ones | 02:18 |
| jamielennox | oh, nice - that's even better | 02:18 |
| jamielennox | i'm not a fan of the magic of some of these libraries, if you have to add a name to a list that's better | 02:18 |
| morganfainberg | then we have the generator script | 02:19 |
| morganfainberg | https://github.com/openstack/keystone/blob/master/tools/config/generate_sample.sh | 02:19 |
| morganfainberg | which passes the library info into the generator | 02:19 |
| morganfainberg | jamielennox, https://github.com/openstack/keystone/blob/master/keystone/openstack/common/config/generator.py#L109 | 02:20 |
| jamielennox | +A | 02:23 |
| morganfainberg | jamielennox, cool ty | 02:24 |
| morganfainberg | jamielennox, on the topic of auth plugins | 02:24 |
| morganfainberg | jamielennox, you're asking if we should support any passed in group | 02:24 |
| morganfainberg | or a fixed group name for the auth options? | 02:24 |
| morganfainberg | jamielennox, because i can see one use case for the former... but not sure if we care | 02:24 |
| jamielennox | morganfainberg: no, i'm doing that already | 02:24 |
| *** rodrigods_ has quit IRC | 02:24 | |
| jamielennox | so we are handling loading any plugin right | 02:25 |
| morganfainberg | ok | 02:25 |
| jamielennox | the options that get registered initially are auth_plugin and auth_section | 02:25 |
| morganfainberg | right | 02:25 |
| jamielennox | auth_plugin is an entrypoint name | 02:25 |
| jamielennox | auth_section is a way to point to a different, user defined, [section] of your conf file so that you can share auth data | 02:25 |
| jamielennox | if section is not provided then it defaults to the same section as we are currently in | 02:26 |
| morganfainberg | ok | 02:26 |
| jamielennox | so my question was if section is provided, should the auth_plugin option be within the section as well or in the initial group | 02:27 |
| morganfainberg | i'd go with section | 02:27 |
| jamielennox | right, cause i can see you defining a part of your config with | 02:28 |
| jamielennox | [v2Password] | 02:28 |
| jamielennox | auth_plugin = v2password | 02:28 |
| jamielennox | username = xxx | 02:28 |
| jamielennox | password - xxx | 02:28 |
| jamielennox | you shouldn't need to specify auth_section = v2password and auth_plugin = v2password | 02:29 |
| jamielennox | at the moment i'm attempting supporting both in that auth_plugin in initial would overrule auth_plugin provided in section | 02:30 |
| jamielennox | it's not that hard - i'm just not sure anyone ever wants that level of flexibility in a config file | 02:30 |
| morganfainberg | right | 02:30 |
| morganfainberg | *shrug* i'd go with in-section exclusively | 02:30 |
| morganfainberg | but thats me | 02:31 |
| morganfainberg | wish i could be more help :P | 02:31 |
| jamielennox | in openstack - if you can't decide, make it configurable | 02:31 |
| morganfainberg | hah | 02:33 |
| *** diegows has quit IRC | 02:36 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Mark keystonemiddleware as being a universal wheel https://review.openstack.org/104424 | 02:56 |
| *** hrybacki has joined #openstack-keystone | 03:12 | |
| *** praneshp has quit IRC | 03:12 | |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Allow LDAP lock attributes to be used as enable attributes https://review.openstack.org/104408 | 03:20 |
| *** dims has quit IRC | 03:32 | |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Expose an entry point to list auth_token middleware config options https://review.openstack.org/104208 | 03:40 |
| *** hrybacki has quit IRC | 03:40 | |
| morganfainberg | and on that note, ^^ | 03:40 |
| morganfainberg | i don't see any reason we're not clear to do a release | 03:41 |
| morganfainberg | dolphm, jamielennox, bknudson, gyee, dstanek, I think we're set to do a middleware release now. everything we need should be merged. lets do one last sanity check :) woo | 03:42 |
| morganfainberg | and get it out the door | 03:42 |
| *** zhiyan_ is now known as zhiyan | 03:47 | |
| dolphm | morganfainberg: ++ | 03:53 |
| morganfainberg | dolphm, and just chatted w/ StevenK we should get docs published when we release | 03:53 |
| dolphm | morganfainberg: on http://docs.openstack.org/developer/keystonemiddleware/ ? | 03:54 |
| morganfainberg | dolphm, yeah | 03:54 |
| morganfainberg | dolphm, though we should also get it on the proper docs page | 03:55 |
| morganfainberg | dolphm, ooooh maybe we wont publish | 03:55 |
| * morganfainberg 2x checks | 03:55 | |
| *** dstanek is now known as dstanek_zzz | 03:57 | |
| morganfainberg | dolphm, anyway StevenK is looking into this in -dev. gotta go get food. catch ya tomorrow | 04:02 |
| *** stevemar has joined #openstack-keystone | 04:07 | |
| *** ajc_ has joined #openstack-keystone | 04:17 | |
| openstackgerrit | Zhi Yan Liu proposed a change to openstack/python-keystoneclient: Expose an entry point to list auth_token middleware config options https://review.openstack.org/104128 | 04:21 |
| *** bvandenh has joined #openstack-keystone | 04:44 | |
| *** gyee has quit IRC | 05:09 | |
| *** achampion has joined #openstack-keystone | 05:26 | |
| openstackgerrit | A change was merged to openstack/keystone: remove default=None for config options https://review.openstack.org/96480 | 05:29 |
| *** gokrokve has quit IRC | 05:30 | |
| *** praneshp has joined #openstack-keystone | 05:41 | |
| *** harlowja is now known as harlowja_away | 05:47 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/103380 | 06:00 |
| *** gokrokve has joined #openstack-keystone | 06:00 | |
| *** ukalifon1 has joined #openstack-keystone | 06:06 | |
| *** henrynash has joined #openstack-keystone | 06:12 | |
| *** gokrokve has quit IRC | 06:16 | |
| *** chandan_kumar has joined #openstack-keystone | 06:25 | |
| *** henrynash has quit IRC | 06:27 | |
| *** tkelsey has joined #openstack-keystone | 06:38 | |
| openstackgerrit | lawrancejing proposed a change to openstack/keystone: Fix the section name in CONTRIBUTING.rst https://review.openstack.org/103758 | 06:46 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Modify oauth calls to expect urlencoded responses https://review.openstack.org/104320 | 06:46 |
| openstackgerrit | lawrancejing proposed a change to openstack/python-keystoneclient: Add CONTRIBUTING.rst https://review.openstack.org/103761 | 06:48 |
| *** stevemar has quit IRC | 06:51 | |
| *** marekd|away is now known as marekd | 07:10 | |
| *** gokrokve has joined #openstack-keystone | 07:12 | |
| *** afazekas_ has joined #openstack-keystone | 07:15 | |
| *** gokrokve has quit IRC | 07:17 | |
| *** leseb has joined #openstack-keystone | 07:37 | |
| *** henrynash has joined #openstack-keystone | 07:50 | |
| *** BAKfr has joined #openstack-keystone | 08:05 | |
| *** afazekas_ is now known as afzekas | 08:05 | |
| *** afzekas is now known as afazekas_ | 08:07 | |
| *** gokrokve has joined #openstack-keystone | 08:13 | |
| *** gokrokve has quit IRC | 08:18 | |
| *** gokrokve has joined #openstack-keystone | 08:31 | |
| *** henrynash has quit IRC | 08:32 | |
| *** praneshp has quit IRC | 08:34 | |
| *** gokrokve has quit IRC | 08:35 | |
| *** mrda is now known as mrda-away | 08:39 | |
| *** jaosorior has joined #openstack-keystone | 08:55 | |
| *** mitz has quit IRC | 09:22 | |
| *** mitz has joined #openstack-keystone | 09:26 | |
| *** gokrokve has joined #openstack-keystone | 09:31 | |
| *** gokrokve has quit IRC | 09:36 | |
| *** kwss has joined #openstack-keystone | 09:54 | |
| openstackgerrit | Kanagaraj Manickam proposed a change to openstack/keystone-specs: endpoint table is missing reference to region table https://review.openstack.org/104500 | 09:56 |
| *** dstanek_zzz is now known as dstanek | 10:14 | |
| *** junhongl has quit IRC | 10:17 | |
| *** leseb has quit IRC | 10:18 | |
| *** leseb has joined #openstack-keystone | 10:19 | |
| *** leseb has quit IRC | 10:24 | |
| *** gokrokve has joined #openstack-keystone | 10:32 | |
| *** gokrokve has quit IRC | 10:37 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Loggin Test - DO NOT MERGE https://review.openstack.org/104512 | 10:46 |
| *** leseb has joined #openstack-keystone | 10:49 | |
| *** leseb has quit IRC | 10:54 | |
| *** mberlin1 has quit IRC | 11:27 | |
| *** mberlin has joined #openstack-keystone | 11:28 | |
| openstackgerrit | Kanagaraj Manickam proposed a change to openstack/keystone-specs: keystone: bind endpoint with region in db https://review.openstack.org/104500 | 11:33 |
| *** gokrokve has joined #openstack-keystone | 11:33 | |
| *** leseb has joined #openstack-keystone | 11:35 | |
| *** gokrokve has quit IRC | 11:37 | |
| *** radez_g0n3 is now known as radez | 11:43 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: reengineered-federation https://review.openstack.org/104301 | 11:45 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert keystone CLI to use auth plugins https://review.openstack.org/95680 | 12:00 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Plugin loading from config objects https://review.openstack.org/79542 | 12:00 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow loading auth plugins from CLI https://review.openstack.org/95679 | 12:00 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Provide an __all__ for auth module https://review.openstack.org/104529 | 12:00 |
| *** dims has joined #openstack-keystone | 12:04 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert keystone CLI to use auth plugins https://review.openstack.org/95680 | 12:07 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Plugin loading from config objects https://review.openstack.org/79542 | 12:07 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow loading auth plugins from CLI https://review.openstack.org/95679 | 12:07 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Provide an __all__ for auth module https://review.openstack.org/104529 | 12:07 |
| *** afazekas_ has quit IRC | 12:07 | |
| *** joesavak has joined #openstack-keystone | 12:09 | |
| *** bvandenh has quit IRC | 12:09 | |
| *** jdennis has joined #openstack-keystone | 12:09 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert keystone CLI to use auth plugins https://review.openstack.org/95680 | 12:23 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Plugin loading from config objects https://review.openstack.org/79542 | 12:23 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow loading auth plugins from CLI https://review.openstack.org/95679 | 12:23 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Provide an __all__ for auth module https://review.openstack.org/104529 | 12:23 |
| *** afazekas_ has joined #openstack-keystone | 12:24 | |
| *** henrynash has joined #openstack-keystone | 12:30 | |
| *** ajc_ has quit IRC | 12:30 | |
| henrynash | jamielennox: you there? | 12:31 |
| jamielennox | henrynash: yea, | 12:31 |
| jamielennox | sucker for punishment at the moment - just keep going | 12:31 |
| henrynash | hi….a quick question….with today’s keystone (as is)….am I right in thinking that clients can really only hand nova a v2 token... | 12:32 |
| henrynash | (because of issues with neutron etc.) | 12:32 |
| jamielennox | depends what you mean by handing, most of the clients do there own authentication and they only support v2 | 12:33 |
| jamielennox | theoretically if you had a v3 token then you could use it i think | 12:33 |
| *** gokrokve has joined #openstack-keystone | 12:33 | |
| jamielennox | you would just have to inject it into the client yourself, i think heat does this for example | 12:34 |
| henrynash | so if i’m writing my one UI, say, that is going to talk to OS… | 12:34 |
| *** afazekas_ has quit IRC | 12:34 | |
| henrynash | …,..when you say inject into the client….what do you mean? | 12:34 |
| jamielennox | so the clients will have the auth token stored somewhere as a string to pass with requests | 12:35 |
| *** fifieldt has quit IRC | 12:35 | |
| jamielennox | you can use a v3 token to authenticate with v2 resources and with other services | 12:35 |
| jamielennox | i think heat does a v3 keystone auth, takes the raw token and manages the catalog, then puts that information into the clients | 12:36 |
| jamielennox | but it's really unsupported and a whole lot of trouble | 12:36 |
| henrynash | conversely, I assume I can get a v2 token scoped to a project that is in a different domain to the default….and I assume that’s how everything hangs together right now | 12:37 |
| *** zigo has quit IRC | 12:37 | |
| henrynash | i.e. pass a tenantID of a project in DomainX to get my v2 scoped token | 12:37 |
| *** zigo has joined #openstack-keystone | 12:37 | |
| jamielennox | umm, i haven't tried it but i assume that would work | 12:38 |
| *** gokrokve has quit IRC | 12:38 | |
| jamielennox | if you're accessing by id i don't think the keystone code checks that the tenant is in the default domain | 12:39 |
| *** lbragstad has quit IRC | 12:40 | |
| henrynash | i asume that must be true.. | 12:40 |
| *** jsavak has joined #openstack-keystone | 12:41 | |
| henrynash | ok, thx | 12:41 |
| *** henrynash has quit IRC | 12:41 | |
| jamielennox | np | 12:41 |
| *** zigo has quit IRC | 12:41 | |
| *** zigo has joined #openstack-keystone | 12:42 | |
| *** jaosorior has quit IRC | 12:42 | |
| *** joesavak has quit IRC | 12:44 | |
| *** zigo has quit IRC | 12:45 | |
| *** _elmiko is now known as elmiko | 12:46 | |
| *** afazekas_ has joined #openstack-keystone | 12:47 | |
| *** hrybacki has joined #openstack-keystone | 12:48 | |
| *** hrybacki has quit IRC | 12:48 | |
| *** hrybacki has joined #openstack-keystone | 12:49 | |
| *** jamielennox is now known as jamielennox|away | 12:50 | |
| *** miqui has joined #openstack-keystone | 12:56 | |
| *** dims_ has joined #openstack-keystone | 12:58 | |
| *** achampio1 has joined #openstack-keystone | 13:01 | |
| *** dims has quit IRC | 13:02 | |
| *** achampion has quit IRC | 13:03 | |
| boris-42 | jamielennox|away ping | 13:07 |
| *** ayoung has joined #openstack-keystone | 13:11 | |
| *** oomichi has quit IRC | 13:14 | |
| *** chandan_kumar is now known as chandankumar | 13:18 | |
| *** sigmavirus24 has joined #openstack-keystone | 13:31 | |
| *** gokrokve has joined #openstack-keystone | 13:34 | |
| openstackgerrit | Harry Rybacki proposed a change to openstack/python-keystoneclient: Add tests without optional create endpoint params https://review.openstack.org/103229 | 13:35 |
| *** achampion has joined #openstack-keystone | 13:36 | |
| *** jdennis has quit IRC | 13:36 | |
| *** achampio1 has quit IRC | 13:38 | |
| *** bobt has joined #openstack-keystone | 13:38 | |
| *** gokrokve has quit IRC | 13:39 | |
| openstackgerrit | Harry Rybacki proposed a change to openstack/python-keystoneclient: service_id should be random uuid https://review.openstack.org/103989 | 13:39 |
| *** bobt has quit IRC | 13:47 | |
| *** diegows has joined #openstack-keystone | 13:49 | |
| elmiko | when i create an instance of keystoneclient.client.Client, is it necessary for me to manually call the authenticate() method if i want to get an auth_token? | 13:53 |
| *** jdennis has joined #openstack-keystone | 13:53 | |
| openstackgerrit | Matthieu Huin proposed a change to openstack/python-keystoneclient: Improve auth plugins use in v3 client https://review.openstack.org/104551 | 13:53 |
| marekd | mhu hi! | 13:57 |
| marekd | mhu: just saw your uploaded patch ^^ | 13:57 |
| mhu | hi marekd ! | 13:57 |
| rodrigods | elmiko, not really, once you create the client it already gets a token | 13:57 |
| openstackgerrit | Steven Hardy proposed a change to openstack/keystone-specs: Spec for trusts redelegation https://review.openstack.org/99908 | 13:58 |
| rodrigods | elmiko, it does the auth process, i mean | 13:58 |
| rodrigods | and you get access the token | 13:58 |
| rodrigods | s/get/can | 13:58 |
| *** zigo has joined #openstack-keystone | 13:58 | |
| elmiko | rodrigods: ok, when i instantiate with a username, password, and tenant, i get back a keystoneclient object, but auth_token is empty until i call authenticate. am i doing something wrong? | 13:59 |
| marekd | mhu: doesn't your plugin somehow overlap with those patches : https://review.openstack.org/#/c/79542/ https://review.openstack.org/#/c/84071/ ? | 13:59 |
| rodrigods | elmiko, which version are you using? | 14:00 |
| mhu | marekd, I wasn't aware of the first one, I'll give it a look | 14:00 |
| elmiko | rodrigods: trunk | 14:00 |
| elmiko | rodrigods: v3 endpoint | 14:00 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Details the proper way to call a callable https://review.openstack.org/104552 | 14:00 |
| elmiko | rodrigods: http://paste.openstack.org/show/85418/ is a snip of what i'm playing with | 14:01 |
| marekd | dstanek: hi | 14:01 |
| dstanek | marekd: hi | 14:02 |
| marekd | dstanek: do you have any experience with barbican already? | 14:02 |
| *** jdennis has quit IRC | 14:02 | |
| rodrigods | elmiko, ok will take a look | 14:02 |
| dstanek | marekd: not really, i looked through the code and did some reviews, but that's about it so far | 14:02 |
| marekd | dstanek: nah, ok | 14:02 |
| elmiko | rodrigods: thanks for the help :) | 14:02 |
| dstanek | marekd: next week i'll be at their hackathon though | 14:02 |
| marekd | dstanek: ah, ok | 14:03 |
| *** daneyon has joined #openstack-keystone | 14:07 | |
| *** daneyon has quit IRC | 14:07 | |
| marekd | dstanek: there are some ideas for sing barbican as a public keys storage for k2k bp, but it looks like current Barbican API allows for keeping secrets grouped by tenants... | 14:07 |
| *** daneyon has joined #openstack-keystone | 14:08 | |
| *** daneyon has quit IRC | 14:11 | |
| *** bobt_ has joined #openstack-keystone | 14:12 | |
| marekd | mhu: on the other hand, i think there are no ongoing works to enhance openstackclient with such smart features :-) | 14:15 |
| marekd | mhu: i think i saw some pieces of code where only token and password were only acceptable authN methods. | 14:15 |
| marekd | mhu: and this should definitely change :-) | 14:15 |
| rodrigods | elmiko, sorry for the delay, i bit busy here | 14:16 |
| rodrigods | a bit* | 14:16 |
| *** dims_ has quit IRC | 14:16 | |
| elmiko | rodrigods: no worries, i appreciate any help :) | 14:17 |
| mhu | marekd, absolutely, but it made more sense to work on keystoneclient first. I'll join in the review of the first patch, which is more thorough than mine | 14:17 |
| rodrigods | elmiko, here is an example: http://paste.openstack.org/show/85422/ | 14:17 |
| rodrigods | this code works for me | 14:17 |
| marekd | mhu: yeah, thanks :-) | 14:18 |
| elmiko | rodrigods: thanks, domain_name is also know as region? | 14:18 |
| elmiko | *known | 14:18 |
| *** richm has joined #openstack-keystone | 14:19 | |
| *** gokrokve has joined #openstack-keystone | 14:19 | |
| ayoung | hrybacki, 1705 in the inbox. Not too bad for 3 days off | 14:19 |
| *** andreaf has joined #openstack-keystone | 14:22 | |
| hrybacki | ayoung: see you in another three days :P | 14:26 |
| rodrigods | elmiko, domain is a user container, different from region | 14:27 |
| elmiko | rodrigods: ok thanks, i'll need to do a litte more reading | 14:27 |
| elmiko | rodrigods: is leaving out the domain parameters what is causing me to need a call to authenticate manually? | 14:28 |
| rodrigods | elmiko, not really, when you get a token, you can get a token scoped for a project or domain | 14:28 |
| elmiko | rodrigods: hmm, ok | 14:29 |
| openstackgerrit | Harry Rybacki proposed a change to openstack/python-keystoneclient: endpoint_id and service_id should be random uuid https://review.openstack.org/103989 | 14:29 |
| hrybacki | Zuul reruns after adjusting a commit message? | 14:30 |
| *** gokrokve has quit IRC | 14:32 | |
| elmiko | rodrigods: one more question, about your example, did you import keystoneclient.v3.client as client? | 14:34 |
| rodrigods | elmiko, exactly =) | 14:35 |
| hrybacki | ayoung: granted my revocation events middleware integration change is on hold (pending jamielennox's session stuff) how does the move pushing middleware into its own repo affect what I've done? | 14:35 |
| elmiko | rodrigods: thanks | 14:35 |
| ayoung | hrybacki, good question. The revocation events API needs to go in first regardless | 14:36 |
| ayoung | hrybacki, then the changes to auth_token need to be made in the middleware repo | 14:36 |
| ayoung | on top of jamies | 14:36 |
| elmiko | so, what is recommended practice if i want to use v3. the using v3 docs suggest the discovery method with the version parameter, is that preferred or should i just ask for the v3.client? | 14:37 |
| ayoung | did he resubmit against the new repo? | 14:37 |
| hrybacki | no, I wanted to discuss what to do with you first | 14:37 |
| hrybacki | I think the middleware repo is still awaiting on a patch adding it to the devstack installer | 14:38 |
| *** mostly_d34dh0r53 is now known as d34dh0r53 | 14:38 | |
| ayoung | lets get the existing patches resubmitted against middleware | 14:38 |
| *** jsavak has quit IRC | 14:38 | |
| ayoung | those can happen in parallel | 14:38 |
| *** chandankumar has quit IRC | 14:38 | |
| *** leseb has quit IRC | 14:38 | |
| hrybacki | It sounded like dolphm and morganfainberg didn't want anything new in the middleware repo for it's initial release | 14:38 |
| hrybacki | session stuff would 1.1.0 | 14:39 |
| *** leseb has joined #openstack-keystone | 14:39 | |
| ayoung | hrybacki, can you apply https://review.openstack.org/#/c/74908/ against the middleware repo? | 14:39 |
| ayoung | its ok, we still can submit it for review | 14:39 |
| ayoung | we'll just hold off on merging until it is stable | 14:39 |
| hrybacki | okay, yeah I can try and come to you when I get stuck? | 14:40 |
| *** gokrokve has joined #openstack-keystone | 14:40 | |
| hrybacki | here's a question actually, how do I set up an env that's setup to use the middleware repo? | 14:40 |
| ayoung | bknudson, you are stealing years from my life. https://review.openstack.org/#/c/102702/ doesn't have any unit tests because I cannot port them over straight away | 14:40 |
| ayoung | they are in the follow on patch | 14:40 |
| bknudson | ayoung: ok, I'll try with the follow-on patch | 14:42 |
| ayoung | ++ | 14:43 |
| dolphm | hrybacki: ++ | 14:43 |
| *** henrynash has joined #openstack-keystone | 14:43 | |
| elmiko | rodrigods: i tried your example, but i still get NoneType for auth_token after instantiating the client object | 14:43 |
| *** leseb has quit IRC | 14:43 | |
| hrybacki | dolphm: ? | 14:43 |
| dolphm | hrybacki: regarding session stuff in 1.1 | 14:43 |
| hrybacki | ++ | 14:43 |
| ayoung | hrybacki, if you were to start with devstack, you would modify the paste-api.ini file for nova to replace keystoneclient with keystonemiddleware | 14:43 |
| *** leseb has joined #openstack-keystone | 14:43 | |
| dolphm | hrybacki: to use middleware repo, swap your auth_token config in all your services from keystoneclient.middleware.auth_token to keystonemiddleware.auth_token | 14:44 |
| hrybacki | dolphm: silly question, how do I locate all of them? | 14:44 |
| dolphm | hrybacki: they probably have *paste* in the name, and they're all in /etc | 14:45 |
| bknudson | hrybacki: https://review.openstack.org/#/q/status:open+topic:keystonemiddleware,n,z | 14:45 |
| dolphm | grep authtoken etc/ | 14:45 |
| dolphm | or auth_token etc/ | 14:45 |
| dolphm | err /etc | 14:45 |
| hrybacki | bknudson, dolphm++ | 14:52 |
| dolphm | morganfainberg: jamielennox|away: bknudson: i'm ready to release 1.0.0 if we have no more blockers | 14:52 |
| bknudson | dolphm: I can't think of any. | 14:53 |
| bknudson | if you give me a minute I can try it out a little bit | 14:53 |
| *** ukalifon1 has quit IRC | 14:55 | |
| *** raildo has quit IRC | 14:56 | |
| *** gokrokve has quit IRC | 14:57 | |
| *** thedodd has joined #openstack-keystone | 15:00 | |
| bknudson | dolphm: I tried starting devstack with keystonemiddleware and didn't have any probs. | 15:04 |
| *** dims_ has joined #openstack-keystone | 15:04 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add _BaseFederationExtension class https://review.openstack.org/104577 | 15:04 |
| hrybacki | bknudson: dolphm, I did the same the other day via the patch you were trying to get merged. Ran a full tempest suite w/o any errors locally on F20 | 15:04 |
| dolphm | bknudson: hrybacki: thanks! | 15:04 |
| dolphm | i think morganfainberg was ready last night, and jamielennox|away probably won't be on anytime soon... so i'll go ahead and push the button | 15:05 |
| morganfainberg | dolphm, :) | 15:05 |
| morganfainberg | dolphm, i'm fair certain we're good. | 15:06 |
| morganfainberg | dolphm, unless anyone has a reason not to | 15:06 |
| dolphm | morganfainberg: i'm not aware of any | 15:06 |
| hrybacki | what exactly is being merged/going live? the middleware repo itself? | 15:06 |
| *** doddstack has joined #openstack-keystone | 15:06 | |
| dolphm | hrybacki: pushing keystonemiddleware to pypi and stamping it 1.0.0 | 15:07 |
| hrybacki | sweet! | 15:07 |
| dolphm | morganfainberg: but of course, something must go wrong... what happened to our Fix Committed bugs on keystonemiddleware?? https://bugs.launchpad.net/keystonemiddleware | 15:07 |
| *** thedodd has quit IRC | 15:08 | |
| *** dims_ has quit IRC | 15:08 | |
| morganfainberg | dolphm, have we ... had any ksc bug fixes land since the split? | 15:09 |
| morganfainberg | dolphm, that affects middleware | 15:09 |
| dolphm | morganfainberg: doc bugs? | 15:09 |
| dolphm | privatize wasn't tracked.... | 15:09 |
| dolphm | https://bugs.launchpad.net/keystonemiddleware/+bug/1335965 | 15:09 |
| uvirtbot | Launchpad bug 1335965 in keystonemiddleware "project is missing a CONTRIBUTING.rst" [Wishlist,Triaged] | 15:09 |
| dolphm | they're not fix committed! no bot? | 15:09 |
| bknudson | it's it just 1333948 and that one? | 15:09 |
| dolphm | bknudson: i think so | 15:09 |
| dolphm | at least there's something on https://launchpad.net/keystonemiddleware/+milestone/1.0.0 now | 15:10 |
| dolphm | just waiting on zuul now... http://status.openstack.org/zuul/ | 15:12 |
| dolphm | release job is on the right column | 15:12 |
| *** ukalifon1 has joined #openstack-keystone | 15:13 | |
| morganfainberg | dolphm, doh! sorry :( | 15:17 |
| morganfainberg | dolphm, yah privatize slipped through in the 'lets get this out' | 15:17 |
| morganfainberg | dolphm, http://docs.openstack.org/developer/keystonemiddleware/ yay | 15:19 |
| openstackgerrit | gordon chung proposed a change to openstack/keystone-specs: move audit middleware to keystonemiddleware repo https://review.openstack.org/104584 | 15:19 |
| *** radez is now known as radez_g0n3 | 15:20 | |
| morganfainberg | dolphm, do we want to retoactively make the privatize bug? | 15:21 |
| morganfainberg | dolphm, simply for release tracking purposes? | 15:21 |
| dolphm | morganfainberg: if you create the bug, i'll stick it in 1.0.0 | 15:21 |
| morganfainberg | ++ | 15:22 |
| bknudson | https://pypi.python.org/pypi/keystonemiddleware | 15:23 |
| *** gokrokve has joined #openstack-keystone | 15:24 | |
| morganfainberg | dolphm, https://bugs.launchpad.net/keystonemiddleware/+bug/1337381 | 15:25 |
| uvirtbot | Launchpad bug 1337381 in keystonemiddleware "Privatize all middleware modules in keystonemiddleware" [High,Fix committed] | 15:25 |
| *** jdennis has joined #openstack-keystone | 15:26 | |
| *** david-ly_ has joined #openstack-keystone | 15:27 | |
| morganfainberg | bknudson, i issued a recheck on your requirements patch for middleware | 15:28 |
| bknudson | it should pass now | 15:28 |
| morganfainberg | bknudson, ++ | 15:28 |
| bknudson | luckily middleware wasn't released as an alpha package | 15:29 |
| morganfainberg | hehe | 15:29 |
| bknudson | that's https://review.openstack.org/#/c/102341/ if people want to +1 | 15:29 |
| morganfainberg | dolphm, so re http://lists.openstack.org/pipermail/openstack-dev/2014-July/039132.html [http statuses] | 15:30 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Loggin Test - DO NOT MERGE https://review.openstack.org/104512 | 15:30 |
| morganfainberg | dolphm, it sounds liek that fix would need to be backported based on QA practices to icehouse as well | 15:30 |
| morganfainberg | dolphm, mtreinish wouldn't be opposed to that if we had wide enough support for it to land in J. What is your opinion | 15:31 |
| hrybacki | ayoung: could review https://review.openstack.org/#/c/103989/ and https://review.openstack.org/#/c/103229/ one last time -- I think they are finally ready | 15:31 |
| *** praneshp has joined #openstack-keystone | 15:33 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: Simplified Mapping for Federated Authentication https://review.openstack.org/100280 | 15:34 |
| *** stevemar has joined #openstack-keystone | 15:37 | |
| dolphm | dstanek: stevemar: henrynash: k2k g+ https://plus.google.com/hangouts/_/g5rgewkfuzfvymkeqiscm4bqsea?hl=en | 15:38 |
| stevemar | thx | 15:39 |
| marekd | dolphm: i will passively join you, may i ? :-) | 15:40 |
| dstanek | dolphm: almost there | 15:41 |
| dolphm | marekd: absolutely | 15:41 |
| dolphm | we're discussing using MFA or token binding to eliminate the attack vector of cross-cloud bearer tokens | 15:42 |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: Simplified Mapping for Federated Authentication https://review.openstack.org/100280 | 15:49 |
| *** kwss has quit IRC | 15:50 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: HEAD responses should return same status as GET https://review.openstack.org/104026 | 15:50 |
| *** gyee has joined #openstack-keystone | 15:52 | |
| *** david-ly_ is now known as david-lyle | 15:54 | |
| *** joesavak has joined #openstack-keystone | 15:58 | |
| *** ukalifon1 has quit IRC | 15:59 | |
| *** dhellmann is now known as dhellmann_ | 16:04 | |
| *** dims_ has joined #openstack-keystone | 16:05 | |
| *** dims_ has quit IRC | 16:09 | |
| *** praneshp has quit IRC | 16:11 | |
| *** BAKfr has quit IRC | 16:15 | |
| *** hrybacki_ has joined #openstack-keystone | 16:16 | |
| *** tkelsey has quit IRC | 16:18 | |
| *** hrybacki has quit IRC | 16:19 | |
| *** leseb has quit IRC | 16:19 | |
| *** leseb has joined #openstack-keystone | 16:20 | |
| *** bobt_ has quit IRC | 16:21 | |
| *** hrybacki_ has quit IRC | 16:21 | |
| *** dims_ has joined #openstack-keystone | 16:21 | |
| *** leseb has quit IRC | 16:24 | |
| *** zhiyan is now known as zhiyan_ | 16:29 | |
| morganfainberg | change id for GET vs HEAD responses (master and stable): https://review.openstack.org/#/q/I13ce159cbe9739d4bf5d321fc4bd069245f32734,n,z change for tempest that would need to land before those do. https://review.openstack.org/#/c/104610/ | 16:36 |
| morganfainberg | if we are headed down this path, those two changes need +2s before the tempest change can merge | 16:37 |
| morganfainberg | just not approval (because they obviously can't merge) | 16:37 |
| *** dhellmann_ is now known as dhellmann | 16:44 | |
| dstanek | morganfainberg: why are you keeping the original GETs around in https://review.openstack.org/#/c/104026/2/keystone/assignment/routers.py ? | 16:45 |
| dstanek | morganfainberg: oh, wait. maybe you're not | 16:46 |
| morganfainberg | dstanek, i'm adding in GETs where only HEAD existed before | 16:46 |
| morganfainberg | long term, i'd like to support HEAD and GET together always | 16:47 |
| *** afazekas_ has quit IRC | 16:47 | |
| morganfainberg | but that is a bit broader scope than i want to deal with here. | 16:47 |
| dstanek | morganfainberg: what do you mean by that? | 16:49 |
| morganfainberg | dstanek, trying to fix the bug here, if we're going to do an expansion to handle HEAD in all GET locations (that doesn't currently impact anyone) I want to do that separately | 16:50 |
| morganfainberg | dstanek, keep this change as limited to the specific bug as possible. | 16:50 |
| *** leseb has joined #openstack-keystone | 16:50 | |
| *** leseb has quit IRC | 16:52 | |
| dstanek | morganfainberg: you mean just have keystone.common.wsgi accept all head requests for anything that supports a get? | 16:52 |
| *** leseb has joined #openstack-keystone | 16:52 | |
| morganfainberg | dstanek, it would be a router change not a common.wsgi change to support HEAD wherever GET is done. | 16:53 |
| morganfainberg | dstanek, i mean... we could re-write it in keystone.common.wsgi ? | 16:53 |
| morganfainberg | would that be better? | 16:53 |
| dstanek | morganfainberg: i'm not sure what you'd do in the router, but the first thing i think of is Apache style rewrites so the app has not idea it's a HEAD | 16:54 |
| morganfainberg | except some cases we have different policy for HEAD vs GET requests [doh!] | 16:54 |
| dstanek | wow really | 16:54 |
| dstanek | ? | 16:54 |
| morganfainberg | dstanek, yes | 16:55 |
| morganfainberg | dstanek, token validation | 16:55 |
| morganfainberg | validate is more secure than check. | 16:55 |
| morganfainberg | dstanek, maybe the best bet is to just rewrite it all in openstack,common.wsgi | 16:56 |
| morganfainberg | dstanek, the same that apache would have done. | 16:56 |
| dstanek | that's unfortunate - i would have expected that to be a different URL | 16:56 |
| morganfainberg | dstanek, i know | 16:56 |
| *** d34dh0r53 is now known as mostly_d34dh0r53 | 16:56 | |
| *** leseb has quit IRC | 16:57 | |
| *** amerine has joined #openstack-keystone | 16:59 | |
| morganfainberg | dstanek, ok i'm going to get breakfast. be back shortly, let me know if you think we should just rewrite all HEAD requests to GET in common.wsgi and do magic in there - would be about the same changeset, but would capture the "always support HEAD and GEt the same" | 17:00 |
| *** mostly_d34dh0r53 is now known as d34dh0r53 | 17:01 | |
| dstanek | morganfainberg: for the bug i don't think i'd change it | 17:01 |
| dstanek | morganfainberg: i was thinking long term | 17:01 |
| morganfainberg | dstanek, ++ ok | 17:01 |
| morganfainberg | maybe something to discuss at the hackathon | 17:01 |
| *** leseb has joined #openstack-keystone | 17:02 | |
| *** leseb has quit IRC | 17:02 | |
| *** stevemar has quit IRC | 17:03 | |
| *** leseb has joined #openstack-keystone | 17:03 | |
| *** leseb has quit IRC | 17:07 | |
| *** praneshp has joined #openstack-keystone | 17:13 | |
| *** henrynash has quit IRC | 17:17 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove `with_lockmode` use from Trust SQL backend. https://review.openstack.org/97059 | 17:19 |
| bknudson | some kind of auto-test would be good... like every time you do a get also do a head. | 17:22 |
| morganfainberg | bknudson, ++ i would like that | 17:23 |
| morganfainberg | ayoung, i know you liked/wanted run_tests: https://review.openstack.org/#/c/103282/ | 17:24 |
| ayoung | looking | 17:32 |
| ayoung | morganfainberg, let me try that out... | 17:33 |
| *** radez_g0n3 is now known as radez | 17:33 | |
| ayoung | $ ./run_tests.sh | 17:34 |
| ayoung | ./run_tests.sh: line 109: NONSUBUNIT_ENVS[@]: unbound variable | 17:34 |
| ayoung | python-subunit | 17:35 |
| *** praneshp_ has joined #openstack-keystone | 17:38 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Implement Service Providers API for OS-FEDERATION https://review.openstack.org/104623 | 17:40 |
| ayoung | morganfainberg, nope | 17:41 |
| *** praneshp has quit IRC | 17:42 | |
| *** marekd is now known as marekd|away | 17:42 | |
| *** praneshp_ is now known as praneshp | 17:42 | |
| ayoung | morganfainberg, ./run_tests.sh: line 109: NONSUBUNIT_ENVS[@]: unbound variable | 17:43 |
| *** henrynash has joined #openstack-keystone | 17:43 | |
| morganfainberg | ayoung, ah i am missing a :- in there | 17:52 |
| ayoung | not my system, then | 17:52 |
| morganfainberg | ayoung, if you make line 109: NONSUBUNIT_ENVS=( "pep8" ${NONSUBUNIT_ENVS[@]:-} ) | 17:53 |
| morganfainberg | it should solve that issue | 17:53 |
| morganfainberg | ayoung, i'll post an update here in a bit. | 17:53 |
| ayoung | morganfainberg, coo;l | 17:53 |
| *** stevemar has joined #openstack-keystone | 17:56 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Make run_tests.sh a wrapper for tox https://review.openstack.org/103282 | 17:56 |
| *** henrynash has quit IRC | 17:56 | |
| morganfainberg | ayoung, ^ that should fix the issue you were seeing | 17:57 |
| ayoung | looks good on first pass | 17:57 |
| ayoung | let me try some of the more esoteric combincations | 17:58 |
| morganfainberg | ayoung, hehe sure | 17:59 |
| *** d34dh0r53 is now known as mostly_d34dh0r53 | 18:02 | |
| *** amcrn has joined #openstack-keystone | 18:05 | |
| dolphm | ayoung: i'm excited to see your conference talk on Esoteric Combincations | 18:09 |
| *** doddstack has quit IRC | 18:19 | |
| morganfainberg | dolphm, LOL | 18:25 |
| *** mostly_d34dh0r53 is now known as d34dh0r53 | 18:26 | |
| *** hrybacki has joined #openstack-keystone | 18:28 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: auth_token cached token handling https://review.openstack.org/102399 | 18:29 |
| nkinder_ | combincations is the new multiprojectcy | 18:30 |
| morganfainberg | bknudson, i'm not seeing where the .get fails if an external cache is provided in ^ | 18:30 |
| bknudson | morganfainberg: hmm, if it's not then that would be a bug | 18:31 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Adding an index on token.user_id https://review.openstack.org/102041 | 18:32 |
| bknudson | morganfainberg: http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token.py#n1517 | 18:32 |
| morganfainberg | bknudson, ok let me check on that | 18:33 |
| bknudson | morganfainberg: I don't see how external cache makes a difference | 18:33 |
| morganfainberg | bknudson, i might have missed a call. | 18:33 |
| morganfainberg | bknudson, right, like i said, i might have missed a call | 18:33 |
| morganfainberg | bknudson, ok i misread this, i jumped passed _cache_get, sorry | 18:38 |
| morganfainberg | bknudson, you're 100% right in your comment. | 18:38 |
| bknudson | no problem | 18:38 |
| morganfainberg | this is complex enough i want to make sure we didn't have an edge case sneaking through :) | 18:38 |
| bknudson | y, hopefully having separate classes will make it less complicated | 18:38 |
| bknudson | I'll work on adding new tests just for the class. | 18:39 |
| morganfainberg | bknudson, ++ | 18:41 |
| dolphm | morganfainberg: this isn't just wishlist? https://bugs.launchpad.net/keystonemiddleware/+bug/1337381 | 18:49 |
| uvirtbot | Launchpad bug 1337381 in keystonemiddleware "Privatize all middleware module methods/properties in keystonemiddleware" [High,Fix released] | 18:49 |
| *** bobt has joined #openstack-keystone | 18:50 | |
| *** jdennis has quit IRC | 18:58 | |
| *** hrybacki has quit IRC | 19:07 | |
| *** hrybacki has joined #openstack-keystone | 19:08 | |
| *** doddstack has joined #openstack-keystone | 19:08 | |
| *** dims_ has quit IRC | 19:09 | |
| *** nkinder_ has quit IRC | 19:20 | |
| *** nkinder has joined #openstack-keystone | 19:21 | |
| *** hrybacki has quit IRC | 19:24 | |
| *** hrybacki has joined #openstack-keystone | 19:25 | |
| *** jdennis has joined #openstack-keystone | 19:32 | |
| dolphm | stevemar: i see that doc bug build bug is still an issue - is there any progress on it? | 19:36 |
| morganfainberg | dolphm, go ahead and switch it to wishlist, but we did hold the release up for it :P | 19:37 |
| dolphm | morganfainberg: i just don't want people to think they're missing a high priority bug fix by not switching or something | 19:37 |
| morganfainberg | ah, ok medium? | 19:38 |
| dolphm | stevemar: ooh found it, says fix released... https://bugs.launchpad.net/openstack-api-site/+bug/1335731 | 19:38 |
| morganfainberg | or low? | 19:38 |
| uvirtbot | Launchpad bug 1335731 in openstack-api-site "dox-publish build fails to build for identity-api" [Critical,Fix released] | 19:38 |
| morganfainberg | i won't think it's "wishlist" | 19:38 |
| morganfainberg | s/wont/dont | 19:38 |
| morganfainberg | otherwise i don't see why we would have help up the release ;) [just forward thinking, it doesn't matter really what we set it as] | 19:39 |
| morganfainberg | god i can't type | 19:39 |
| morganfainberg | s/help/held | 19:39 |
| dolphm | anyone know if elastic-recheck makes considerations for queries for non-transient gate failures? | 19:42 |
| dolphm | like, rechecking will just cause another failure, but it'd still be nice to get the comment noting which bug was encountered | 19:43 |
| stevemar | dolphm, look @ the latest comment for the bug, i don't think it fixed everything | 19:45 |
| morganfainberg | dolphm, i don't think elastic recheck cares if a recheck was done, it should comment on _any_ failure it knows about | 19:46 |
| *** henrynash has joined #openstack-keystone | 19:46 | |
| dolphm | stevemar: i'm running a logstash query now ... http://logstash.openstack.org/#eyJzZWFyY2giOiJtZXNzYWdlOlwiY29tLnJhY2tzcGFjZS5jbG91ZC5hcGkuZG9jcy5waXBlbGluZS5QaXBlbGluZUV4Y2VwdGlvbjogbmV0LnNmLnNheG9uLnM5YXBpLlNheG9uQXBpRXhjZXB0aW9uOiBQcm9jZXNzaW5nIHRlcm1pbmF0ZWQgYnkgeHNsOm1lc3NhZ2UgYXQgbGluZSAtMSBpbiBudWxsXCIiLCJmaWVsZHMiOltdLCJvZmZzZXQiOjAsInRpbWVmcmFtZSI6IjE3MjgwMCIsImdyYXBobW9kZSI6ImNvdW50IiwidGltZSI6eyJ1c2VyX2ludGV | 19:46 |
| dolphm | ydmFsIjowfSwic3RhbXAiOjE0MDQ0MTY2Njc1OTl9 | 19:46 |
| dolphm | morganfainberg: yeah, but will they approve the query if it's not a transient? | 19:46 |
| morganfainberg | dolphm, bitly is your friend when pasting those queries :( | 19:46 |
| morganfainberg | oh | 19:47 |
| morganfainberg | uhm | 19:47 |
| morganfainberg | good question | 19:47 |
| dolphm | morganfainberg: yeah... or you can decode the b64, trim the fat from the json encoded request, and then re-encode for a much shorter url! | 19:47 |
| morganfainberg | yeah! | 19:47 |
| morganfainberg | bitly sounds like less work :P | 19:47 |
| dolphm | morganfainberg: stevemar: http://bit.ly/1zaZr86 | 19:48 |
| *** henrynash has quit IRC | 19:48 | |
| stevemar | 33 hits, not bad | 19:49 |
| morganfainberg | dolphm, LOL | 19:50 |
| morganfainberg | dolphm, well played, well played | 19:50 |
| dolphm | stevemar: in 48 hours. | 19:51 |
| *** dims_ has joined #openstack-keystone | 19:53 | |
| dolphm | morganfainberg: stevemar: submitted to elastic-recheck https://review.openstack.org/#/c/104664/ | 19:54 |
| morganfainberg | dolphm, i think this is reasonable to have. but i dunno what infra/ER's stance on this is | 19:55 |
| dolphm | morganfainberg: eventually we'll have to recheck/reverify all the failures against that bug to get them to land - seems sensible & helpful to me. | 19:56 |
| dolphm | hell, i kept losing track of the bug... not knowing if it was fixed or not | 19:57 |
| morganfainberg | dolphm, ++ | 19:57 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: HEAD responses should return same status as GET https://review.openstack.org/104026 | 19:59 |
| dstanek | yesterday someone seemed to imply that the bug was caused by a change in identity-api itself. has that been proven to be true? | 20:03 |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone-specs: Propose Specification for Endpoint Group Filter https://review.openstack.org/102023 | 20:03 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor auth_token, move identity server members to class https://review.openstack.org/102402 | 20:04 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor auth_token revocation list members to new class https://review.openstack.org/102403 | 20:04 |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone-specs: Propose Specification for Endpoint Group Filter https://review.openstack.org/102023 | 20:07 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor auth_token, move identity server members to class https://review.openstack.org/102402 | 20:18 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor auth_token revocation list members to new class https://review.openstack.org/102403 | 20:18 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Add a fixture for Keystone version discovery https://review.openstack.org/99846 | 20:21 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor auth_token, move identity server members to class https://review.openstack.org/102402 | 20:24 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor auth_token revocation list members to new class https://review.openstack.org/102403 | 20:24 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor auth_token, move identity server members to class https://review.openstack.org/102402 | 20:26 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor auth_token revocation list members to new class https://review.openstack.org/102403 | 20:26 |
| hrybacki | bknudson: you are breaking all of my work :P | 20:30 |
| bknudson | hrybacki: hopefully the refactoring makes it easier to work with | 20:30 |
| hrybacki | bknudson: probably | 20:31 |
| dolphm | stevemar: curl http://paste.openstack.org/raw/85451/ | git apply | 20:33 |
| *** daneyon has joined #openstack-keystone | 20:34 | |
| stevemar | dstanek, nah, it's independent of any identity-api changes | 20:35 |
| stevemar | welp, time to review some bknudson changes | 20:35 |
| stevemar | dolphm, i take it you are not pushing a patch for k2k? I can add in your changes | 20:38 |
| dolphm | stevemar: i am not. there's some good conversation that i didn't want to stomp on before it's resolved | 20:40 |
| stevemar | dolphm, so I should hold off on stomping too? | 20:41 |
| dolphm | stevemar: please! i just wanted to post because i know i'm not going to be able to follow up quickly enough | 20:41 |
| dolphm | (post the diff) | 20:41 |
| stevemar | fair enough | 20:42 |
| *** daneyon_ has joined #openstack-keystone | 20:42 | |
| morganfainberg | dolphm, stevemar, sorry didn't mean to de-rail the convo from mfa earlier today | 20:42 |
| dstanek | tempest has a surprising about of line coverage for the few tests that it runs | 20:42 |
| dolphm | morganfainberg: no-no, we had brought up your question twice before anyway, and kept deferring it... it needs to be covered | 20:43 |
| *** daneyon has quit IRC | 20:43 | |
| morganfainberg | dolphm, it feels like that issue is an elephant in the room each time this is brought up | 20:43 |
| dolphm | morganfainberg: just like the issue today - there's two ways to go about a solution, and it's not obvious which is better | 20:44 |
| morganfainberg | dolphm, yeah | 20:44 |
| dolphm | morganfainberg: waht type is resp.headers.get('Content-Length') ? | 20:44 |
| morganfainberg | always a string afaict | 20:45 |
| morganfainberg | all headers are a string from what i can see | 20:45 |
| dolphm | k | 20:45 |
| morganfainberg | at least we prevously always compared with "0" for a zero-length content | 20:45 |
| morganfainberg | dolphm, will check that the 204 change != 'head' isn't breaking anything the whitespace change is ... well dumb and will be fixed | 20:51 |
| morganfainberg | dolphm, and i'll move to .upper() cause "meh" ;) | 20:51 |
| dolphm | morganfainberg: comparisons to 'head' and 'get' might be slightly more self-explanatory that way :-/ | 20:54 |
| morganfainberg | sure. | 20:55 |
| rodrigods | is anyone managing to apply dolphm patch? here i get: fatal: corrupt patch at line 640 =/ | 20:56 |
| dolphm | so we got a bug report that concludes with "Everything works perfectly!" and then reiterates with "everything is working properly" | 20:57 |
| dolphm | rodrigods: uh oh | 20:57 |
| morganfainberg | lol | 20:57 |
| morganfainberg | dolphm, GREAT! BUG SOLVED! | 20:57 |
| dolphm | let's break something! FIX RELEASED | 20:57 |
| morganfainberg | hehe | 20:58 |
| morganfainberg | LOL *facepalm* | 20:58 |
| * morganfainberg remembers to change 'head' to 'HEAD' in tests | 20:59 | |
| dolphm | rodrigods: doesn't work for me either! | 20:59 |
| rodrigods | dolphm, added a blank line in the end, looks like it worked | 21:00 |
| dolphm | rodrigods: i was about to try that too | 21:00 |
| rodrigods | =) | 21:00 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: HEAD responses should return same status as GET https://review.openstack.org/104026 | 21:01 |
| *** raildo has joined #openstack-keystone | 21:01 | |
| *** marekd|away is now known as marekd | 21:02 | |
| dolphm | rodrigods: looks like paste.openstack.org is trimming the input or something? anyway: | 21:05 |
| dolphm | $ curl http://pasteraw.com/sfh8luetcvdumpbw93n5ingqzst7thf | git apply | 21:05 |
| dolphm | same diff ^ plus a blank line at the end | 21:06 |
| *** joesavak has quit IRC | 21:07 | |
| dolphm | would we ever return 203 for anything? | 21:08 |
| morganfainberg | 203.. | 21:09 |
| morganfainberg | really? | 21:09 |
| morganfainberg | uhm. | 21:09 |
| dolphm | truncated collection..? | 21:09 |
| * morganfainberg has no idea | 21:09 | |
| morganfainberg | ah | 21:09 |
| morganfainberg | was that what we determined | 21:09 |
| morganfainberg | the hard-set "limit" bit? | 21:09 |
| dolphm | morganfainberg: yes | 21:11 |
| dolphm | i don't see where we create a 203 anywhere | 21:11 |
| dolphm | but i found this, which git blames to dstanek, but looks like a refactor https://github.com/openstack/keystone/blob/master/keystone/tests/rest.py#L119-L121 | 21:11 |
| morganfainberg | yeah | 21:12 |
| morganfainberg | just saw the same | 21:12 |
| morganfainberg | i don't see anyplace we actually respond with a 203 | 21:12 |
| dstanek | dolphm: ? | 21:12 |
| dolphm | dstanek: you made a refactor here https://review.openstack.org/#/c/54209/ is all | 21:13 |
| dstanek | dolphm: ah, ok | 21:13 |
| dolphm | dstanek: that means you're on the hook for explaining why the example uses a 203 | 21:13 |
| dstanek | dolphm: ha, i can deflect | 21:15 |
| *** radez is now known as radez_g0n3 | 21:16 | |
| afaranha | What's required to use OS-INHERIT in order to inherit roles? | 21:17 |
| dstanek | dolphm: the dark ages https://github.com/openstack/keystone/commit/21248908 | 21:19 |
| ayoung | dolphm, OK, I think we have a catch 22 | 21:20 |
| ayoung | V3 Api | 21:20 |
| ayoung | if you request a token with no project name or id, you get an unscoped token | 21:20 |
| ayoung | this does not have a service catalog | 21:20 |
| ayoung | if you then attempt to request the project list, you get "keystoneclient.exceptions.EmptyCatalog: The service catalog is empty." | 21:21 |
| ayoung | what the client should be doing is using the AUTH_URL as the management url to make that call | 21:21 |
| dolphm | ayoung: that sounds like a new bug then, and doesn't sound specific to v3? | 21:22 |
| ayoung | since v2 auth request as for default project, I don't think it has this problem | 21:22 |
| *** 77CAAPLE4 has joined #openstack-keystone | 21:22 | |
| dolphm | ayoung: both v2 and v3 have similar behaviors there | 21:23 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Modify oauth calls to expect urlencoded responses https://review.openstack.org/104320 | 21:23 |
| ayoung | dolphm, I don;t think V2 has that problem | 21:24 |
| ayoung | dolphm, I'm still digging, but it might be specific to the Session code, too | 21:24 |
| ayoung | in the past, we've created a client with AUTH_URL as one of the kwargs | 21:25 |
| *** marekd is now known as marekd|away | 21:33 | |
| morganfainberg | afaranha, you need to enable OS-INHERIT in your config, and when creating the grant you need to use the OS-INHERIT api not the standard grant api | 21:36 |
| morganfainberg | afaranha, i think you were creating the grant via the normal method instead of /OS-INHERIT/ directly | 21:36 |
| morganfainberg | afaranha, in the previous conversation | 21:37 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Correct docstring for assertResponseSuccessful https://review.openstack.org/104693 | 21:38 |
| *** elmiko has quit IRC | 21:39 | |
| *** doddstack has quit IRC | 21:44 | |
| *** hrybacki has quit IRC | 21:48 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: update example with a status code we actually use https://review.openstack.org/104699 | 21:53 |
| *** mrda-away is now known as mrda | 21:53 | |
| dolphm | bknudson: i +2 your trivial doc fix, and raise you an even more trivial doc fix ^ | 21:54 |
| bknudson | dolphm: now all the docstrings are clear and concise. | 21:56 |
| bknudson | ayoung: I think that might have changed because I'm pretty sure that's how the client worked at some point | 21:57 |
| dolphm | bknudson: for some value of 'all' | 21:57 |
| openstackgerrit | Boris Pavlovic proposed a change to openstack/python-keystoneclient: Add profiling support to Keystone https://review.openstack.org/103367 | 22:02 |
| david-lyle | in policy.v3cloudsample.json, what is the admin_domain_id intended to be? | 22:06 |
| morganfainberg | david-lyle, i think the global admin domain, e.g. what the cloud operator would use. | 22:07 |
| david-lyle | I get the concept, just wasn't sure if default was the intended admin domain | 22:07 |
| morganfainberg | david-lyle, though... i uhm. need to 2x check to be sure | 22:07 |
| david-lyle | or a new domain | 22:07 |
| david-lyle | default seems problematic | 22:07 |
| morganfainberg | david-lyle, ah, uhm. not sure | 22:07 |
| *** nkinder has quit IRC | 22:07 | |
| morganfainberg | david-lyle, it might be that making someone admin in the default domain was intented | 22:07 |
| david-lyle | ok, that could make sense | 22:08 |
| * morganfainberg is unsure intention atm. | 22:08 | |
| david-lyle | I can play with that to make it work for now :) | 22:08 |
| *** sigmavirus24 has quit IRC | 22:08 | |
| david-lyle | thanks morganfainberg | 22:08 |
| *** daneyon_ has quit IRC | 22:13 | |
| *** dims__ has joined #openstack-keystone | 22:13 | |
| *** dims_ has quit IRC | 22:15 | |
| *** richm has left #openstack-keystone | 22:31 | |
| *** d34dh0r53 is now known as mostly_d34dh0r53 | 22:31 | |
| *** andreaf has quit IRC | 22:37 | |
| david-lyle | did anyone ever use the policy.v3cloudsample.json as even a test? | 22:40 |
| *** rodrigods_ has joined #openstack-keystone | 22:54 | |
| *** henrynash has joined #openstack-keystone | 22:57 | |
| *** david-lyle has quit IRC | 22:57 | |
| *** henrynash has quit IRC | 22:57 | |
| *** david-ly_ has joined #openstack-keystone | 22:58 | |
| *** david-ly_ has quit IRC | 23:03 | |
| *** jamielennox|away is now known as jamielennox | 23:04 | |
| *** gokrokve has quit IRC | 23:12 | |
| *** gmurphy has quit IRC | 23:13 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert keystone CLI to use auth plugins https://review.openstack.org/95680 | 23:14 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Plugin loading from config objects https://review.openstack.org/79542 | 23:14 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow loading auth plugins from CLI https://review.openstack.org/95679 | 23:14 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Provide an __all__ for auth module https://review.openstack.org/104529 | 23:14 |
| *** gmurphy has joined #openstack-keystone | 23:14 | |
| jamielennox | dolphm: this one's waiting on (specifically) your approval https://review.openstack.org/#/c/100776/ | 23:17 |
| *** rodrigods_ has quit IRC | 23:35 | |
| ayoung | jamielennox, I need to go to dinner here in a sec, bu: if I create a client using a session, and don't specify any scope, (no project) I get a token with no catalog, right? | 23:38 |
| ayoung | so I would need to somehow tell it that it should use the AUTH_URL as the management url...how? | 23:39 |
| jamielennox | yes, you'd get an unscoped token and they don't contain a catalog (though i've proposed we change that) | 23:42 |
| jamielennox | ayoung: currently in client there is a management=False boolean that is passed to the request - i think it should work with sessions | 23:43 |
| jamielennox | that will tell it to use the auth_url | 23:43 |
| openstackgerrit | A change was merged to openstack/keystone: Correct docstring for assertResponseSuccessful https://review.openstack.org/104693 | 23:45 |
| *** oomichi has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!