| *** alex_xu has joined #openstack-keystone | 00:05 | |
| *** rwsu has quit IRC | 00:31 | |
| *** markwash has quit IRC | 00:31 | |
| *** marcoemorais has quit IRC | 00:33 | |
| *** marcoemorais has joined #openstack-keystone | 00:33 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Isolate get_discovery function https://review.openstack.org/107569 | 00:36 |
|---|---|---|
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow unauthenticated discovery https://review.openstack.org/107570 | 00:36 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Control identity plugin reauthentication https://review.openstack.org/107555 | 00:36 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Use token and discovery fixture in identity tests https://review.openstack.org/107554 | 00:36 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Version independent password authentication plugin https://review.openstack.org/81147 | 00:36 |
| *** amerine_ has joined #openstack-keystone | 00:38 | |
| *** amerine has quit IRC | 00:39 | |
| *** hemna is now known as hemna_ | 00:39 | |
| ayoung | morganfainberg, it sounds like you are pretty well set against PKIZ tokens. Do you think they are fatally flawed, or something we can work around? | 00:43 |
| morganfainberg | ayoung, I am *not* against having multiple forms of tokens | 00:43 |
| morganfainberg | ayoung, I think s/mime is a big issue | 00:44 |
| morganfainberg | i think we need to solve that issue | 00:44 |
| morganfainberg | i think 2-5x the size of the request for auth data is absurd and we need to figure that out | 00:44 |
| morganfainberg | i do not want to remove PKI, i do not want to remove PKIZ. | 00:44 |
| ayoung | morganfainberg, I don't think any form of authentication document is going to be much smaller. Its not specific to S/MIME | 00:45 |
| morganfainberg | however, if most people use UUID in deploymnet because the token size is too big, or SSL shared-state, etc, we have to address that | 00:45 |
| ayoung | the signature is bascially 500 bytes, with the rest of the size overhead pretty much either negligable or due to encoding | 00:45 |
| morganfainberg | ayoung, let me clarify, authentication document that needs to transit from the end user | 00:45 |
| morganfainberg | if it is an issue on repeated requests for a token, it is an issue for the initial request | 00:46 |
| ayoung | morganfainberg, right. But the auth document needs to get to the endpoint somehow. If it is not from the end user, it is not transparent, and does not lend to distributed scheme. THat was the direction PKIZ was taking us | 00:46 |
| morganfainberg | so, i am in support of devstack defaulting to uuid (and adding a temptest test that runs w/ PKIZ that is exclusive to keystone patchs) | 00:46 |
| ayoung | If we do a UUID based scheme, it means that the endpoints know a-priori which keystone to talk to to do everything, it means persisted tokens, and it means a single point of signing. | 00:47 |
| ayoung | so we either fix the current token approach, or accept those points as fixed | 00:48 |
| morganfainberg | ayoung, i honestly don't believe pkiz tokens are the right direction | 00:48 |
| morganfainberg | ayoung, but i don't know what *is* | 00:48 |
| ayoung | morganfainberg, before we make a change, lets figure that out | 00:48 |
| morganfainberg | ayoung, but the bulk of the deployers i've talked to have all said they use UUID | 00:48 |
| morganfainberg | because PKI is too big, not baked, requires shared-state-of-signing-certs, etc | 00:49 |
| ayoung | that is fine. There is nothing broken about UUID tokens, but if we change the default, it means the PKIZ will not be tested. The current issues came out because people are actually using them | 00:49 |
| ayoung | morganfainberg, so, lets break the problem down: | 00:49 |
| ayoung | 1. is horizon. 2. is the size of the tokens when talking to individual services | 00:49 |
| ayoung | I think those are the big ones | 00:49 |
| morganfainberg | 3. shared-signing data for multiple keystones. [we have to address this long term either way but right now uuid has no requirement on this] | 00:50 |
| ayoung | morganfainberg, 4. how the hell am I going to keep my 8 year old in bed to complete this conversation | 00:53 |
| ayoung | morganfainberg, there are a few things PKI had foisted on it that UUID tokens side-stepped. I'm still a little annoyed at all the effort we had to put into revocations. UUID tokens would be stuck in memcached and never checked for revocation. But I am OK with making a complete system. Just don't want to waste time on it if the founding blocks are going to be removed | 00:54 |
| *** jamielennox has quit IRC | 00:54 | |
| morganfainberg | 4. popen->openssl is sucky (far far far down the list, but it is legitimate) | 00:55 |
| morganfainberg | #4 i'd say is in the category of "meh fix other things first" | 00:55 |
| morganfainberg | 1. is an issue that only a developer issue so far | 00:55 |
| morganfainberg | ayoung, i'm going to need to go soon, headed home (had a long couple days this week) | 00:55 |
| morganfainberg | ayoung, i think we need to circle up on this a bit later (tomorrow) | 00:55 |
| *** jamielennox_ has joined #openstack-keystone | 00:55 | |
| ayoung | morganfainberg, that is fine. And I'm not digging in my heels here: I'm willing to go along with whatever we decide the long term approach should be, but I want that to be deliberate, and well thought out. | 00:56 |
| *** jamielennox_ is now known as jamielennox | 00:56 | |
| ayoung | If there is any huge gain to be had by making UUID tokens default, I need to understand what it is. | 00:56 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Version independent password authentication plugin https://review.openstack.org/81147 | 00:56 |
| morganfainberg | ayoung, 8 yr olds have a nack of interrupting convos :P | 00:57 |
| ayoung | morganfainberg, it was spending the morning with him that means I'm working until midnight tonight, too. Ah, fatherhood. | 00:57 |
| morganfainberg | ayoung, my responses on that review were mostly to clarify the specific stakes, notice i didn't +2 the review. | 00:58 |
| morganfainberg | ayoung, i want to amke sure as we discuss this we're not adding things to the convo that aren't needed. (k2k, that is going to be a different beast) | 00:58 |
| ayoung | morganfainberg, heh. So Horizon needs memcache for a different reason, I think. THey need the service catalog no matter what, and they have a hard stop at the 8k limit | 00:58 |
| morganfainberg | ayoung, we can figure out the best course, and no i am not advocating signed requests (they have issues) | 00:59 |
| ayoung | morganfainberg, yeah. I like signed requests, but I can't say that everything should be based on them. | 00:59 |
| morganfainberg | ayoung, also, memcache is optional for all services, most deployments don't use it in auth_token afaict | 00:59 |
| morganfainberg | ayoung, ++ they *could* be awesome | 00:59 |
| morganfainberg | but... uh... | 00:59 |
| morganfainberg | lots more convos there if we go down that path | 00:59 |
| ayoung | morganfainberg, without memcache, auth_token hits keystone for each validation. That was actually the origianl reason for PKI tokens. | 01:00 |
| morganfainberg | ayoung, right | 01:00 |
| ayoung | without memcache, the "cookie the session token" thing is out the window anyway | 01:00 |
| morganfainberg | yeah | 01:01 |
| ayoung | that was just an optimization, to try and manage what Horizon is doing as a hack and better manage it | 01:01 |
| ayoung | I am pretty sure that adding 1K to a request for authorization data is negligable. Its the 8K-blow-out-the-header size PKI tokens that we need to reduce | 01:02 |
| *** gabriel-bezerra has quit IRC | 01:02 | |
| *** gokrokve has quit IRC | 01:03 | |
| *** gokrokve has joined #openstack-keystone | 01:03 | |
| *** gabriel-bezerra has joined #openstack-keystone | 01:04 | |
| ayoung | I want to keep the power in the hands of the end user. I think we can remove the catalog from the tokens and fix that in most of the services. It seems that the catalog data does not need to be sent around on every request. | 01:04 |
| ayoung | If we used SSL client certs of Kerberos, we actually would have much more overhead on the network. It just wouldn't be apparent in the openstack specific payloads. | 01:05 |
| *** gokrokve has quit IRC | 01:08 | |
| *** LinStatSDR has quit IRC | 01:15 | |
| *** gokrokve has joined #openstack-keystone | 01:34 | |
| *** gokrokve has quit IRC | 01:36 | |
| *** gokrokve has joined #openstack-keystone | 01:37 | |
| *** mberlin has quit IRC | 01:40 | |
| *** gokrokve has quit IRC | 01:41 | |
| *** marcoemorais has quit IRC | 01:47 | |
| *** hrybacki has joined #openstack-keystone | 01:48 | |
| *** xianghui has joined #openstack-keystone | 01:49 | |
| jamielennox | ayoung: the client cert thing is debatable, you get overhead sure, but with kerberos i'm having to do 2 calls per request to get the Negotiate to work | 01:49 |
| ayoung | jamielennox, you have to send the client cert | 01:49 |
| ayoung | its just added data | 01:49 |
| ayoung | buyt at least 1K | 01:49 |
| jamielennox | right but it happens at https handshake | 01:50 |
| ayoung | the point is that keystone PKIZ tokens are probably going to be about as light weight as we can get things | 01:50 |
| jamielennox | so you get some benefit there from using connection pooling properly, | 01:50 |
| jamielennox | negotiate is happening per request and AFAIK doesn't pool | 01:50 |
| ayoung | if you reuse the session, then the cert doesn't have to go across the wire again. But with the session cookie hack, things are efficent after the first transmission as well. Its a wash | 01:51 |
| ayoung | yeah, negotiate is a beast | 01:51 |
| ayoung | and that is why it tends to be done once, and then, again. session cookied | 01:51 |
| ayoung | that is what IPA does | 01:51 |
| jamielennox | anyway, haven't even read all the context to that, just the bit that i've played with kerberos and requests Negotiate is a huge burden | 01:52 |
| ayoung | yep | 01:52 |
| ayoung | if the authorization is passed through the user, PKIZ tokens is the smallest we can get it....and it remains a bearer token | 01:52 |
| *** gokrokve has joined #openstack-keystone | 01:53 | |
| ayoung | I think that the size of the reuqest thing is not really an issue here, but I want people to understand the real issues before we go yanking out PKIZ | 01:53 |
| hrybacki | ayoung, jamielennox: Brant asked some pretty solid design choice questions in https://review.openstack.org/#/c/105031/9/keystonemiddleware/auth_token.py and I'd like to hear you alls' thoughts if you have time | 01:54 |
| *** gokrokve has quit IRC | 01:54 | |
| *** gokrokve has joined #openstack-keystone | 01:54 | |
| *** morganfainberg is now known as morganfainberg_Z | 01:58 | |
| jamielennox | hrybacki: agree with pretty much everything | 01:58 |
| hrybacki | removing the factory methods too? | 01:59 |
| jamielennox | yea | 01:59 |
| jamielennox | i don't see that they're doing anything | 01:59 |
| jamielennox | and it means saving a bunch of things on the object that we never reuse | 01:59 |
| ayoung | let me see... | 02:00 |
| hrybacki | what about his comments on 520, 1280, and 1298? | 02:01 |
| ayoung | jamielennox, so the factory methods were there to allow for lazy creation of those objects later | 02:01 |
| ayoung | he did it back when we were going further with this patch | 02:02 |
| jamielennox | ayoung: but we're not lazy loading we're calling them straight away | 02:02 |
| *** zzzeek has joined #openstack-keystone | 02:02 | |
| jamielennox | so at the very least they're not relevant to thsi patch | 02:02 |
| ayoung | the goal is to not contact keystone until the first request | 02:02 |
| ayoung | yeah...just churn | 02:02 |
| jamielennox | ayoung: we don't contact keystone | 02:02 |
| jamielennox | everything about auth plugins so far is lazy | 02:02 |
| ayoung | I know..but once there is discovery, we will | 02:02 |
| jamielennox | right - and i would argue that it's a better thing to do the upfront request than deal with all that | 02:03 |
| ayoung | jamielennox, ? | 02:03 |
| jamielennox | if we need to do discovery i'd prefer to do it in __init__ than on first request | 02:04 |
| ayoung | remember, this is a bring-up time. We might be bringing things up async, so keystone might not be up yet | 02:04 |
| ayoung | we don't want to force an ordering to starting the services | 02:04 |
| jamielennox | fair enough | 02:05 |
| hrybacki | hmm | 02:05 |
| jamielennox | still not related to this one | 02:05 |
| *** diegows has quit IRC | 02:06 | |
| hrybacki | so should we opt to thin down the patch some more and save this for a discussion/follow up patch? | 02:07 |
| jamielennox | hrybacki: always thin it down to what you need for this particular feature | 02:07 |
| ayoung | yeah, but the factory methods is a better organization | 02:08 |
| ayoung | meh | 02:08 |
| hrybacki | jamielennox: is that a general design principle, keystone standard, or your personal preference? | 02:08 |
| jamielennox | hrybacki: it's what get's patches reviewed quickest | 02:08 |
| hrybacki | ayoung: I'm inclined to agree with you on that. I think it leaves everything else looking cleaner | 02:08 |
| hrybacki | modularity++ | 02:09 |
| hrybacki | jamielennox: haha fair | 02:09 |
| ayoung | hrybacki, I'm hardly unbiased here. I told you to do it. | 02:09 |
| jamielennox | ayoung: i don't mind factory functions when there is something difficult happening, personal opinion if there's no logic going on i'd just prefer to have it inline | 02:09 |
| ayoung | jamielennox, the init function was growin long | 02:09 |
| ayoung | this pulls like into like, and allows the easy migration of creation when the time calls for it | 02:10 |
| ayoung | I think the code is more organized this way | 02:10 |
| ayoung | I am more interested in the other comment " but then in the place where there's some logic in creating the object (self._session.auth), there's no factory... weird. | 02:11 |
| ayoung | " | 02:11 |
| ayoung | lines 505 to 524...probably should also be in their own function. | 02:11 |
| hrybacki | ayoung: that makes sense | 02:12 |
| hrybacki | IdentityServer also has a pretty bulky __init__ | 02:13 |
| hrybacki | what about his comment on 520? | 02:13 |
| ayoung | jamielennox, I think that question is for you. | 02:14 |
| jamielennox | oh, yea just posted a response | 02:14 |
| jamielennox | umm, we're a little bit stuck there | 02:15 |
| jamielennox | i need to fix the construct() method, it was designed for a very specific purpose but it has grown | 02:15 |
| jamielennox | you can't pass auth= to construct() which is why i did it that way originally | 02:16 |
| jamielennox | fixing things in ksc now will take ages to make it back to middleware though so i don't see a lot of other choices than the way we do now | 02:16 |
| hrybacki | oaky | 02:18 |
| hrybacki | okay* | 02:18 |
| *** alex_xu has quit IRC | 02:19 | |
| hrybacki | ayoung, jamielennox: I'm going to leave in the factory functions. I'd like to pull the session.auth logic into a function as well. Would it make sense for that to be part of the session factory itself? Is there any reason not to? | 02:21 |
| ayoung | I think it belongs in session factory | 02:21 |
| jamielennox | ok, make it part of the session factory | 02:24 |
| jamielennox | a request though - a factory returns the object, it doesn't set a variable | 02:25 |
| *** markwash has joined #openstack-keystone | 02:26 | |
| hrybacki | jamielennox++ okay | 02:26 |
| hrybacki | those are the nits I need :P | 02:27 |
| *** xianghui has quit IRC | 02:32 | |
| *** xianghui has joined #openstack-keystone | 02:33 | |
| *** lbragstad has joined #openstack-keystone | 02:37 | |
| *** jamielennox is now known as jamielennox|away | 02:45 | |
| *** jamielennox|away is now known as jamielennox | 02:48 | |
| *** zzzeek has quit IRC | 02:48 | |
| hrybacki | jamielennox: Can I get your thoughts on one more section. On line 1280 Brant has concerns about the new exception handling within _http_request() | 02:49 |
| *** xianghui has quit IRC | 02:49 | |
| jamielennox | hrybacki: i'd just scrap that section | 02:51 |
| jamielennox | hrybacki: i'm not sure who's right there | 02:51 |
| hrybacki | jamielennox: hrm | 02:51 |
| jamielennox | (so do what he says) | 02:51 |
| hrybacki | jamielennox: do you remember your initial motivation for that? | 02:52 |
| jamielennox | from memory when i was doing it initially i was getting errors coming up from session that had nothing to do with the actual request | 02:53 |
| jamielennox | however that would still be caught with what is there so that's not a reason | 02:53 |
| jamielennox | so no :) | 02:53 |
| hrybacki | haha alright | 02:55 |
| *** xianghui has joined #openstack-keystone | 03:02 | |
| *** topol has joined #openstack-keystone | 03:06 | |
| *** harlowja is now known as harlowja_away | 03:06 | |
| *** gokrokve_ has joined #openstack-keystone | 03:07 | |
| *** gokrokve has quit IRC | 03:11 | |
| *** xianghuihui has joined #openstack-keystone | 03:11 | |
| *** xianghui has quit IRC | 03:12 | |
| *** gokrokve_ has quit IRC | 03:12 | |
| hrybacki | jamielennox: it may get caught but it sure does cause test failures | 03:22 |
| hrybacki | I'll dig into that tomorrow morning I suppose | 03:23 |
| jamielennox | hrybacki: it causes test failures if you don't allow http errors? | 03:24 |
| hrybacki | yep | 03:24 |
| jamielennox | hrybacki: oh right, of course it does | 03:24 |
| hrybacki | ? | 03:24 |
| jamielennox | so with a standard requests.request it will return a response object with the status_code=400 or something | 03:24 |
| jamielennox | if you get a http failure | 03:25 |
| hrybacki | ok | 03:25 |
| jamielennox | with the session we take that response and turn it into a HttpError exception | 03:25 |
| hrybacki | ah | 03:25 |
| hrybacki | that's why it was in there | 03:25 |
| jamielennox | so you need to let those errors go through or they won't be correctly handled at the higher level | 03:25 |
| jamielennox | so yea the comment is not good | 03:26 |
| hrybacki | I'll update the comment | 03:26 |
| *** mrmoje has joined #openstack-keystone | 03:28 | |
| *** xianghuihui has quit IRC | 03:30 | |
| *** xianghuihui has joined #openstack-keystone | 03:34 | |
| *** ajayaa has joined #openstack-keystone | 03:42 | |
| openstackgerrit | Harry Rybacki proposed a change to openstack/keystonemiddleware: Convert auth_token middleware to use sessions https://review.openstack.org/105031 | 03:46 |
| *** wanghong has quit IRC | 03:47 | |
| *** jaosorior has joined #openstack-keystone | 03:50 | |
| *** lbragstad has quit IRC | 03:51 | |
| *** ayoung has quit IRC | 03:54 | |
| *** boris-42 has quit IRC | 03:57 | |
| *** stevemar has joined #openstack-keystone | 03:59 | |
| *** topol has quit IRC | 03:59 | |
| *** boris-42 has joined #openstack-keystone | 04:07 | |
| *** stevemar has quit IRC | 04:10 | |
| *** gokrokve has joined #openstack-keystone | 04:11 | |
| *** gokrokve has quit IRC | 04:21 | |
| *** gokrokve has joined #openstack-keystone | 04:22 | |
| *** gokrokve has quit IRC | 04:26 | |
| *** ukalifon1 has joined #openstack-keystone | 04:27 | |
| *** zzzeek has joined #openstack-keystone | 04:28 | |
| *** ukalifon1 has quit IRC | 04:30 | |
| *** stevemar has joined #openstack-keystone | 04:30 | |
| jamielennox | stevemar: question, if the mapper gets a match does it continue to find other matches or quit early? | 04:30 |
| jamielennox | so can you do lots of little 'if role then group' matches that get combined or do you need to write them all as one big statement | 04:31 |
| stevemar | jamielennox, i believe it still goes through all of them, because several rules may apply | 04:31 |
| jamielennox | cool, that's what i expected - quicker to ask than dig through the code | 04:32 |
| jamielennox | stevemar: thanks | 04:32 |
| stevemar | that was one of the requirements of the mapping, if several rules applied, it would get all the results (in particular for group ids) | 04:32 |
| stevemar | if several user ids are matched, then we toss up an error | 04:32 |
| stevemar | np | 04:32 |
| *** hrybacki has quit IRC | 04:33 | |
| *** chandankumar has joined #openstack-keystone | 04:45 | |
| *** gokrokve has joined #openstack-keystone | 04:50 | |
| *** wanghong has joined #openstack-keystone | 04:51 | |
| *** alex_xu has joined #openstack-keystone | 04:52 | |
| *** ukalifon1 has joined #openstack-keystone | 05:23 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert shell tests to httpretty https://review.openstack.org/110210 | 05:35 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Change unscoped token fallback to be session aware https://review.openstack.org/104771 | 05:35 |
| *** RockKuo_Office has joined #openstack-keystone | 05:45 | |
| *** gokrokve_ has joined #openstack-keystone | 05:50 | |
| *** k4n0 has joined #openstack-keystone | 05:51 | |
| *** gokrokve has quit IRC | 05:52 | |
| *** gokrokve_ has quit IRC | 05:54 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/106939 | 06:05 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add a domain to federated users https://review.openstack.org/110858 | 06:06 |
| *** alex_xu has quit IRC | 06:08 | |
| *** tomoiaga has joined #openstack-keystone | 06:11 | |
| *** stevemar has quit IRC | 06:19 | |
| *** alex_xu has joined #openstack-keystone | 06:26 | |
| *** bvandenh has joined #openstack-keystone | 06:33 | |
| *** henrynash has joined #openstack-keystone | 06:34 | |
| *** wanghong has quit IRC | 06:35 | |
| *** RockKuo_Office has quit IRC | 06:35 | |
| *** wanghong has joined #openstack-keystone | 06:35 | |
| *** henrynash has quit IRC | 06:36 | |
| *** RockKuo_Office has joined #openstack-keystone | 06:36 | |
| *** mrmoje has quit IRC | 06:36 | |
| *** tomoiaga has quit IRC | 06:37 | |
| *** jamielennox is now known as jamielennox|away | 06:38 | |
| *** krypto has joined #openstack-keystone | 06:51 | |
| krypto | hi can some one tell me the need of Public API endpoint for keystone,i have horizon with public IP and for authenticating with keystone it uses private ip, | 06:53 |
| krypto | i couldn't find any use case other than CLI for creating instances outside Data centre will fail,am i correct,or any other use case for public API endpoint for keystone | 06:56 |
| *** alex_xu has quit IRC | 06:57 | |
| *** afazekas has joined #openstack-keystone | 06:57 | |
| *** mtl11 has quit IRC | 07:04 | |
| *** mtl1 has joined #openstack-keystone | 07:05 | |
| *** alex_xu has joined #openstack-keystone | 07:09 | |
| *** jogo has left #openstack-keystone | 07:11 | |
| *** bvandenh_ has joined #openstack-keystone | 07:11 | |
| *** marekd|away is now known as marekd | 07:13 | |
| *** bvandenh has quit IRC | 07:15 | |
| *** henrynash has joined #openstack-keystone | 07:51 | |
| *** mrmoje has joined #openstack-keystone | 08:02 | |
| *** xianghuihui has quit IRC | 08:45 | |
| *** xianghui has joined #openstack-keystone | 08:45 | |
| *** abhishek has joined #openstack-keystone | 09:06 | |
| *** jamiec has quit IRC | 09:11 | |
| *** dtroyer has quit IRC | 09:12 | |
| *** jamiec has joined #openstack-keystone | 09:14 | |
| *** dtroyer has joined #openstack-keystone | 09:14 | |
| *** alex_xu has quit IRC | 09:23 | |
| abhishek | hi all, can any one review this patch https://review.openstack.org/#/c/107482/5/ | 09:27 |
| abhishek | thank you | 09:27 |
| *** xianghui has quit IRC | 09:36 | |
| *** andreaf has joined #openstack-keystone | 10:02 | |
| *** diegows has joined #openstack-keystone | 10:57 | |
| openstackgerrit | A change was merged to openstack/keystone: Do not consume trust uses when create token fails https://review.openstack.org/103445 | 11:03 |
| *** vhoward has left #openstack-keystone | 11:04 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Enable filtering of services by name https://review.openstack.org/110904 | 11:08 |
| *** RockKuo_Office has quit IRC | 11:16 | |
| *** tomoiaga has joined #openstack-keystone | 12:13 | |
| *** k4n0 has quit IRC | 12:14 | |
| *** jasondotstar has joined #openstack-keystone | 12:36 | |
| *** jasondotstar has quit IRC | 12:42 | |
| *** bknudson has quit IRC | 12:50 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: List federated projects and domains https://review.openstack.org/107393 | 12:54 |
| *** jasondotstar has joined #openstack-keystone | 12:56 | |
| *** andreaf_ has joined #openstack-keystone | 13:01 | |
| *** andreaf has quit IRC | 13:04 | |
| *** bknudson has joined #openstack-keystone | 13:08 | |
| *** thedodd has joined #openstack-keystone | 13:11 | |
| *** ByteSore has joined #openstack-keystone | 13:14 | |
| *** shufflebot has quit IRC | 13:15 | |
| *** ByteSore_ has quit IRC | 13:15 | |
| *** junhongl has quit IRC | 13:15 | |
| *** abhishek has quit IRC | 13:15 | |
| *** anteaya has quit IRC | 13:15 | |
| *** chandankumar has quit IRC | 13:15 | |
| *** junhongl has joined #openstack-keystone | 13:15 | |
| *** shufflebot has joined #openstack-keystone | 13:16 | |
| *** chandankumar has joined #openstack-keystone | 13:16 | |
| *** anteaya has joined #openstack-keystone | 13:17 | |
| *** lbragstad has joined #openstack-keystone | 13:21 | |
| *** lbragstad has quit IRC | 13:22 | |
| *** lbragstad has joined #openstack-keystone | 13:23 | |
| *** jasondotstar has quit IRC | 13:35 | |
| *** thedodd has quit IRC | 13:39 | |
| *** krypto has quit IRC | 13:40 | |
| *** gordc has joined #openstack-keystone | 13:42 | |
| *** needscoffee has joined #openstack-keystone | 13:50 | |
| *** needscoffee has quit IRC | 13:50 | |
| *** needscoffee has joined #openstack-keystone | 13:50 | |
| *** ayoung has joined #openstack-keystone | 13:56 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Filter users by email https://review.openstack.org/110970 | 13:56 |
| *** joesavak has joined #openstack-keystone | 14:02 | |
| *** needscoffee has quit IRC | 14:04 | |
| *** chandankumar has quit IRC | 14:05 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Enable filtering of services by name https://review.openstack.org/110904 | 14:08 |
| jaosorior | henrynash: fixed the wrong word in the commit message, thanks for the catch | 14:10 |
| *** toddnni has joined #openstack-keystone | 14:14 | |
| *** stevemar has joined #openstack-keystone | 14:30 | |
| *** rwsu has joined #openstack-keystone | 14:42 | |
| *** thedodd has joined #openstack-keystone | 14:49 | |
| *** morganfainberg_Z is now known as morganfainberg | 14:51 | |
| *** gokrokve has joined #openstack-keystone | 14:52 | |
| *** markwash has quit IRC | 14:54 | |
| *** gabriel-bezerra has quit IRC | 14:54 | |
| openstackgerrit | John Trowbridge proposed a change to openstack/keystone: Adds ability to use policy.json with Keystone V2 API get_endpoints method. https://review.openstack.org/110986 | 14:55 |
| *** gabriel-bezerra has joined #openstack-keystone | 14:55 | |
| *** jsavak has joined #openstack-keystone | 14:55 | |
| *** lbragstad has quit IRC | 14:58 | |
| *** lbragstad has joined #openstack-keystone | 14:58 | |
| *** joesavak has quit IRC | 15:00 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone: Standardizing the Federation Process https://review.openstack.org/105597 | 15:01 |
| *** lbragsta_ has joined #openstack-keystone | 15:02 | |
| *** lbragstad has quit IRC | 15:02 | |
| *** kwss has joined #openstack-keystone | 15:05 | |
| *** ukalifon1 has quit IRC | 15:07 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Filter users by email https://review.openstack.org/110970 | 15:15 |
| *** lbragsta_ is now known as lbragstad | 15:17 | |
| *** hrybacki has joined #openstack-keystone | 15:31 | |
| *** lbragstad_ has joined #openstack-keystone | 15:37 | |
| *** lbragstad has left #openstack-keystone | 15:38 | |
| *** morganfainberg is now known as morganfainberg_Z | 15:39 | |
| *** thedodd has quit IRC | 15:40 | |
| *** thedodd has joined #openstack-keystone | 15:41 | |
| *** tomoiaga has quit IRC | 15:41 | |
| *** lbragstad has joined #openstack-keystone | 15:43 | |
| *** morganfainberg_Z is now known as morganfainberg | 15:44 | |
| *** lbragstad has quit IRC | 15:44 | |
| *** gyee has joined #openstack-keystone | 15:45 | |
| *** bobt has joined #openstack-keystone | 15:46 | |
| openstackgerrit | A change was merged to openstack/keystone: Refactor set domain-id and mapping code https://review.openstack.org/107680 | 15:50 |
| *** bklei has joined #openstack-keystone | 15:52 | |
| ayoung | gyee, one https://review.openstack.org/#/c/105031/ I think you missed some of the discussion. We cut down the scope of this patch to specifically aoid some issues brought on by discovery | 15:58 |
| ayoung | the "factories" were written as part of the larger effort. They are not specifically needed now, but the are better organization, and I advised him to leave them in. | 15:59 |
| *** gabriel-bezerra has quit IRC | 15:59 | |
| ayoung | So remove your -1 please and lets get this thing in so we can move on, unless you see anything that is fatal. | 15:59 |
| hrybacki | ayoung, gyee++ I was just about to comment on that. Gyee, Brant had similar concerns that I addressed in PS #9 | 16:00 |
| gyee | ayoung, what about others? | 16:00 |
| *** gabriel-bezerra has joined #openstack-keystone | 16:00 | |
| gyee | like http timeout? | 16:00 |
| gyee | hrybacki, ayoung, don't worry about the factory comments, that's merely a question | 16:01 |
| gyee | I didn't understand why we need them, but if can drop a NOTE there that would be helpful | 16:02 |
| hrybacki | fair | 16:02 |
| hrybacki | I'm looking back over the timeout thing right now | 16:02 |
| ayoung | gyee, timeout is handled by client code now | 16:02 |
| gyee | but we need it to be configurable right? | 16:02 |
| ayoung | gyee, I think I can show you the patch that handles that | 16:03 |
| ayoung | gyee, line 1017 | 16:05 |
| ayoung | timeout=self._conf_get('http_connect_timeout') | 16:05 |
| ayoung | gyee, and what did you mean by your comment on line 505? | 16:05 |
| gyee | ayoung, got it | 16:06 |
| hrybacki | ayoung: he just caught something that should be private | 16:06 |
| hrybacki | my bad | 16:06 |
| hrybacki | gyee: I also submitted a bug to add discovery here -- that'll be my follow up patch | 16:07 |
| *** mtl1 has left #openstack-keystone | 16:07 | |
| gyee | hrybacki, thanks, I'll probably submit a patch after you to do v3 auth for the service user | 16:07 |
| *** topol has joined #openstack-keystone | 16:09 | |
| *** lbragstad_ has quit IRC | 16:13 | |
| *** kwss has quit IRC | 16:14 | |
| morganfainberg | henrynash, gyee, got a moment to talk policy (specifically policy.json format) | 16:15 |
| gyee | morganfainberg, sure | 16:16 |
| *** gabriel-bezerra has quit IRC | 16:16 | |
| *** gabriel-bezerra has joined #openstack-keystone | 16:16 | |
| *** gokrokve has quit IRC | 16:17 | |
| *** marcoemorais has joined #openstack-keystone | 16:17 | |
| morganfainberg | gyee, https://github.com/openstack/nova/blob/master/etc/nova/policy.json#L4 looks like it already rejects domain scoped tokens | 16:17 |
| morganfainberg | gyee, am i mis-reading it? | 16:17 |
| *** lbragstad has joined #openstack-keystone | 16:18 | |
| morganfainberg | i mean we can't stop admins, but the explicit (project_id) bit means we're already no accepting domain scoped tokens | 16:18 |
| morganfainberg | i *think* | 16:18 |
| henrynash | morganfainberg: so the default policy file doesn’t really work for domains... | 16:19 |
| gyee | morganfainberg, its a problem, Nova only cares about the 'admin' role, regardless of scope | 16:19 |
| morganfainberg | so we need to fix that bit to *require* a project scope? | 16:19 |
| henrynash | morganfainberg: ah sorry, this is nova’s policy file...sorry | 16:19 |
| morganfainberg | henrynash, yes, nova :P | 16:19 |
| gyee | morganfainberg, we can't, or otherwise we break backward compatibility | 16:20 |
| gyee | morganfainberg, but its a security concern | 16:20 |
| morganfainberg | well | 16:20 |
| morganfainberg | this was an ask from nova to move to v3 | 16:20 |
| morganfainberg | specifically they want to reject domain scoped token | 16:21 |
| * morganfainberg is trying to figure out if we can do that in the policy.json | 16:21 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Filter users by email https://review.openstack.org/110970 | 16:23 |
| openstackgerrit | Diane Fleming proposed a change to openstack/identity-api: Remove ATOM responses for list versions and get version details. https://review.openstack.org/110777 | 16:25 |
| gyee | morganfainberg, before we get to rejecting domain-scoped token, Nova needs to decide what does 'admin' mean | 16:26 |
| gyee | in fact, OpenStack needs to decide what 'admin' means | 16:26 |
| morganfainberg | gyee, for now, we need to just say "project scoped tokens only" | 16:26 |
| gyee | this question's being around for over 2 years now :) | 16:26 |
| morganfainberg | gyee, the other questions are still valid, they are not relevant for this conversation. | 16:27 |
| *** bobt_ has joined #openstack-keystone | 16:27 | |
| openstackgerrit | Harry Rybacki proposed a change to openstack/keystonemiddleware: Convert auth_token middleware to use sessions https://review.openstack.org/105031 | 16:28 |
| gyee | morganfainberg, looks like we may nave to enhance policy engine to match *any* | 16:32 |
| gyee | then we can do something like this | 16:32 |
| gyee | "admin_required": "role:admin and not domain_id:*", | 16:32 |
| gyee | assuming * match any | 16:32 |
| morganfainberg | gyee, yeah that was my thought | 16:33 |
| morganfainberg | gyee, i'm ok with that. | 16:33 |
| gyee | morganfainberg, lemme dig into policy engine code to see what we can do | 16:34 |
| morganfainberg | gyee, i can help if needed. i was looking at this but wanted a second pair of eyes | 16:34 |
| *** jasondotstar has joined #openstack-keystone | 16:34 | |
| *** jasondotstar has quit IRC | 16:38 | |
| *** jasondotstar has joined #openstack-keystone | 16:38 | |
| *** gokrokve has joined #openstack-keystone | 16:43 | |
| *** jasondotstar has quit IRC | 16:44 | |
| *** lbragsta_ has joined #openstack-keystone | 16:44 | |
| *** thedodd has quit IRC | 16:49 | |
| morganfainberg | gyee, ok i need to go get breakfast. be back in a little bit. do you want to dig into the policy stuff or want me to? i'm fine in either case | 16:50 |
| *** thedodd has joined #openstack-keystone | 16:53 | |
| *** jasondotstar has joined #openstack-keystone | 16:57 | |
| gyee | morganfainberg, I am working on other stuff right now, probably won't have time to look at the policy stuff till afernoon | 17:02 |
| *** gokrokve has quit IRC | 17:03 | |
| morganfainberg | gyee, ok i'll see what needs to be added to the policy rules engine to match like any(project_id) | 17:03 |
| *** gokrokve has joined #openstack-keystone | 17:04 | |
| *** lbragsta_ has quit IRC | 17:05 | |
| *** henrynash has quit IRC | 17:06 | |
| *** amcrn has joined #openstack-keystone | 17:10 | |
| *** mrmoje has quit IRC | 17:13 | |
| dstanek | is there an easy way to rebase a stack of changes when a commit you depend on changes? | 17:16 |
| *** henrynash has joined #openstack-keystone | 17:21 | |
| *** joesavak has joined #openstack-keystone | 17:21 | |
| ayoung | morganfainberg, that is, I think, the best justification for dolphm 's goal of shipping a single policy file: lets get a common set of base rules for definingh what adminness means. | 17:22 |
| *** morganfainberg is now known as reallywantscoffe | 17:23 | |
| *** jsavak has quit IRC | 17:23 | |
| *** reallywantscoffe is now known as morganfainberg | 17:23 | |
| ayoung | gyee, can you bless https://review.openstack.org/#/c/105031/12 | 17:23 |
| ayoung | dstanek, if you do a rebase -i, you can change the commit ID | 17:24 |
| morganfainberg | ayoung, once i'm back from food i'll review that one as well. | 17:24 |
| ayoung | morganfainberg, cool | 17:24 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add a domain to federated users https://review.openstack.org/110858 | 17:26 |
| gyee | ayoung, patch looks good, will let morganfainberg push the button | 17:27 |
| ayoung | gyee, ++ | 17:28 |
| dstanek | ayoung: thx | 17:28 |
| dstanek | lbragstad: you around? | 17:28 |
| *** lbragsta_ has joined #openstack-keystone | 17:36 | |
| *** thedodd has quit IRC | 17:39 | |
| *** lbragsta_ has quit IRC | 17:40 | |
| *** lbragsta_ has joined #openstack-keystone | 17:44 | |
| *** lbragsta_ has quit IRC | 17:47 | |
| *** gabriel-bezerra has quit IRC | 17:48 | |
| *** gabriel-bezerra has joined #openstack-keystone | 17:49 | |
| *** gabriel-bezerra has quit IRC | 17:49 | |
| *** gabriel-bezerra has joined #openstack-keystone | 17:50 | |
| *** afazekas has quit IRC | 18:00 | |
| *** lbragsta_ has joined #openstack-keystone | 18:13 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone-specs: Hierarchical Multitenacy https://review.openstack.org/101017 | 18:15 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone-specs: Hierarchical Multitenacy https://review.openstack.org/101017 | 18:19 |
| *** thedodd has joined #openstack-keystone | 18:24 | |
| morganfainberg | jamielennox|away, ayoung, dolphm, any idea why 'verify_token' in auth_token middleware isn't a private method? | 18:25 |
| ayoung | morganfainberg, cuz nothing in middleware was private origianlly and we haven't gotten them all | 18:25 |
| ayoung | morganfainberg, everything in auth token should be private | 18:26 |
| ayoung | itsnot meant to be extended | 18:26 |
| morganfainberg | ayoung, oooh looks like it was bknudson 's refactor - the class that method is on is private, the method is public | 18:26 |
| morganfainberg | nvm | 18:26 |
| morganfainberg | it's correct. | 18:26 |
| ayoung | ++ | 18:27 |
| bknudson | morganfainberg: jamielennox|away made the change to have everything private | 18:28 |
| bknudson | oh, you're asking about the methods in the new classes | 18:29 |
| morganfainberg | bknudson, right, and your change made the class private but the method public on tht class _IdentityServer | 18:29 |
| morganfainberg | bknudson, yeah it confused me for a second | 18:29 |
| morganfainberg | bknudson, once i looked at the class and saw the clss was private (separate class) it all made sense | 18:29 |
| bknudson | we actually did get a request to make the options public | 18:29 |
| *** doddstack has joined #openstack-keystone | 18:33 | |
| *** thedodd has quit IRC | 18:33 | |
| ayoung | morganfainberg, so, internally we had a problem where the DBA had been tuning the Keystone database (adding indexes and the like) that broke the migrations. I am wondering if keystone-manage db_sync should have a "create a backup" option. | 18:34 |
| ayoung | Our DBA did a backup, fortunately, but... | 18:34 |
| morganfainberg | ayoung, so what does generic backup look like for mysql, postgres, db2, and sqlite? | 18:35 |
| morganfainberg | ayoung, just playing devils advocate, not saying it shouldn't be there | 18:35 |
| morganfainberg | ayoung, and any other DB someone has managed to wedge keystone into | 18:35 |
| *** bklei has quit IRC | 18:36 | |
| morganfainberg | bknudson, they are public just not in the place you'd expect | 18:36 |
| ayoung | morganfainberg, the fact that you are dumping passwords.... | 18:36 |
| morganfainberg | bknudson, https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/opts.py#L28 | 18:36 |
| morganfainberg | ayoung, i'm inclined to say db_sync can't know how to do backups because the backups are *really* a RDBMS specific case and any one of them is likely very different than others | 18:37 |
| bknudson | morganfainberg: ok... maybe the bug submitter should use that... there's a bug for it | 18:37 |
| morganfainberg | bknudson, i think i commented on that bug already. let me 2x check | 18:38 |
| ayoung | morganfainberg, yeah, but we really need to warn people to backup their DBs before doing migrate. This could have been a disaster | 18:38 |
| morganfainberg | bknudson, https://bugs.launchpad.net/keystonemiddleware/+bug/1347304 marked as invalid and confirmed it does the job | 18:39 |
| uvirtbot | Launchpad bug 1347304 in keystonemiddleware "Need a way to allow user to register config opts locally" [Undecided,Invalid] | 18:39 |
| *** lbragsta_ has quit IRC | 18:39 | |
| bknudson | morganfainberg: great, thanks | 18:39 |
| morganfainberg | bknudson, np | 18:40 |
| *** lbragsta_ has joined #openstack-keystone | 18:40 | |
| *** lbragsta_ has quit IRC | 18:40 | |
| *** ukalifon1 has joined #openstack-keystone | 18:40 | |
| morganfainberg | ayoung, sure we should document it... but if you're mucking around adding indexes in the db outside of the migrations... I don't know if we canr eally protect against this | 18:41 |
| *** lbragsta_ has joined #openstack-keystone | 18:41 | |
| ayoung | morganfainberg, oh, agreed, but adding indexes and the like are a common tool for DBAs. | 18:41 |
| ayoung | they just need to know that they are likely to break migrations | 18:41 |
| morganfainberg | dolphm, ayoung, look what stevemar did! http://specs.openstack.org/openstack/keystone-specs/ | 18:42 |
| stevemar | morganfainberg, it's actually live for all official projects that have specs :) | 18:43 |
| bknudson | stevemar: http://specs.openstack.org/openstack/nova-specs/ ? | 18:43 |
| stevemar | the *-specs project just have to push a dummy patch to start the upload | 18:43 |
| stevemar | bknudson ^ | 18:43 |
| bknudson | ok | 18:43 |
| stevemar | http://specs.openstack.org/openstack/ lists the current ones | 18:43 |
| stevemar | we need a landing page :( | 18:44 |
| ayoung | stevemar, I give you full credit anyway | 18:44 |
| stevemar | ajaeger helped too, knows his infra stuff | 18:44 |
| *** lbragsta_ has quit IRC | 19:03 | |
| morganfainberg | hrybacki, next time please submit cleanup the cleanup patch separate from the code change patch, https://review.openstack.org/#/c/105031/12/keystonemiddleware/auth_token.py has been a bit of a beast to review because of the changes for cleanup and session lumped into one | 19:03 |
| morganfainberg | ayoung, gyee, could _safe_quote on line 1173 bite us? https://review.openstack.org/#/c/105031/12/keystonemiddleware/auth_token.py previously we didn't pass the safe-quoted token to verify | 19:07 |
| gyee | morganfainberg, I don't think it matters as token are base64 encoded anyway | 19:08 |
| morganfainberg | gyee, then why do we even safe_quote anywhere? | 19:08 |
| morganfainberg | base64 != urlsafe | 19:08 |
| hrybacki | morganfainberg: will do | 19:08 |
| ayoung | we use urlsafe base64 encoding | 19:09 |
| gyee | yeah, for token at least | 19:09 |
| morganfainberg | ayoung, so why do we explicitly safe_quote in the auth_token middleware for the token? | 19:09 |
| morganfainberg | ayoung, and/or why are we changeing what we safe-quote and pass to .verify_token | 19:09 |
| gyee | to make it really really safe? :)_ | 19:09 |
| morganfainberg | gyee, lol | 19:10 |
| ayoung | morganfainberg, what line? I don't see safe quote on 1173 | 19:10 |
| morganfainberg | ayoung, in the new code user_token is safe_quoted on 1143 | 19:10 |
| morganfainberg | old code safe quoted as needed | 19:10 |
| ayoung | morganfainberg, well, it might be needed for PKI but not PKIZ. PKIZ uses the python lirary. let me pull that up, though | 19:11 |
| bknudson | we should have a tempest run where we set revoke_by_id=false | 19:11 |
| morganfainberg | bknudson, ++ once middleware supports it | 19:11 |
| bknudson | y, middleware is going to need it for a full run | 19:12 |
| ayoung | URL-encode user-supplied tokens (bug 974319) | 19:13 |
| uvirtbot | Launchpad bug 974319 in python-keystoneclient "auth_token does not quote token to validate" [Low,Fix released] https://launchpad.net/bugs/974319 | 19:13 |
| ayoung | morganfainberg, blame chmouel | 19:14 |
| ayoung | https://bugs.launchpad.net/keystone/+bug/974319 | 19:14 |
| uvirtbot | Launchpad bug 974319 in python-keystoneclient "auth_token does not quote token to validate" [Low,Fix released] | 19:14 |
| morganfainberg | ayoung, then how has it been working before? | 19:14 |
| ayoung | morganfainberg, it works fine. This is defensive programming against bogus data | 19:14 |
| morganfainberg | ayoung, ok. | 19:15 |
| * gyee is hungry, going to do some defensive eating against fat | 19:15 | |
| *** ukalifon1 has quit IRC | 19:17 | |
| morganfainberg | ayoung, found an issue that might cause us to endlessly loop on retrying a token | 19:20 |
| ayoung | in the new code, or pre-exisiting | 19:20 |
| morganfainberg | ayoung, new code | 19:21 |
| ayoung | ? | 19:21 |
| morganfainberg | https://review.openstack.org/#/c/105031/12/keystonemiddleware/auth_token.py 1172 | 19:21 |
| morganfainberg | we don't check retry anymore | 19:21 |
| morganfainberg | if we get unauthorized we'll loop indefinitely retrying the token | 19:21 |
| morganfainberg | well until we hit call stack depth limit | 19:21 |
| bknudson | morganfainberg: looks like it calls with retry=False | 19:23 |
| morganfainberg | bknudson, but if you look at the old code, it "if retry:" before calling self.verify_token(token, false) | 19:23 |
| bknudson | oh, but it never checks the retry variable | 19:23 |
| morganfainberg | yep | 19:23 |
| openstackgerrit | werner mendizabal proposed a change to openstack/keystone-specs: Allow optional xml middleware configuration https://review.openstack.org/111048 | 19:23 |
| bknudson | we still haven't gotten rid of that crappy xml middleware! | 19:24 |
| bknudson | we need to get rid of stuff so we don't keep getting reviews for it. | 19:24 |
| morganfainberg | ayoung, hrybacki, i set -1 workflow on that so it cannot merge without a new patch (don't want to use a sticky blocking -2) | 19:24 |
| morganfainberg | ayoung, hrybacki, but we need to check the retry before retrying. :( sorry | 19:25 |
| ayoung | morganfainberg, good catch | 19:25 |
| hrybacki | morganfainberg: yep | 19:25 |
| hrybacki | damn | 19:25 |
| morganfainberg | hrybacki, please also fix the docstring -> comment in the next patch :) | 19:25 |
| hrybacki | nods | 19:25 |
| morganfainberg | i think this also means we have a testing gap | 19:26 |
| hrybacki | right on time for an intern meeting | 19:26 |
| *** hrybacki is now known as hrybacki-afk | 19:26 | |
| gyee | morganfainberg, good catch! that's a big one | 19:27 |
| *** harlowja_away is now known as harlowja | 19:27 | |
| morganfainberg | i think setting WIP might be a good approach to block a patch but not sticky-block it | 19:29 |
| morganfainberg | a little more forceful than a -1 | 19:29 |
| *** harlowja has quit IRC | 19:30 | |
| *** lbragsta_ has joined #openstack-keystone | 19:34 | |
| *** lbragsta_ has quit IRC | 19:38 | |
| *** hrybacki-afk has quit IRC | 19:39 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add a domain to federated users https://review.openstack.org/110858 | 19:47 |
| stevemar | morganfainberg, ^ | 19:48 |
| stevemar | bknudson, if we get rid of too much, then we have nothing left to review | 19:49 |
| stevemar | we'll just be a wrapper for apache modules and oslo libraries | 19:49 |
| morganfainberg | stevemar, lol | 19:52 |
| *** gabriel-bezerra has quit IRC | 19:52 | |
| *** gabriel-bezerra has joined #openstack-keystone | 19:53 | |
| bknudson | I think that's our goal | 19:55 |
| *** lbragsta_ has joined #openstack-keystone | 20:01 | |
| *** markwash has joined #openstack-keystone | 20:03 | |
| *** lbragsta_ has quit IRC | 20:05 | |
| boris-42 | bknudson hi there | 20:06 |
| bknudson | boris-42: hi | 20:06 |
| boris-42 | bknudson as far as I remember you said me that osprofiler requires BP | 20:06 |
| boris-42 | bknudson so I finally decided to make a spec for it | 20:06 |
| boris-42 | bknudson but I putted it to oslo | 20:06 |
| boris-42 | bknudson https://review.openstack.org/#/c/103825/ | 20:06 |
| *** gabriel-bezerra has quit IRC | 20:06 | |
| bknudson | it is good to have a spec for it then we can make sure it's in the release notes | 20:06 |
| boris-42 | bknudson could you pls take a look | 20:07 |
| boris-42 | bknudson I put in oslo-spec cause it's the similar for all projects | 20:07 |
| bknudson | it's got a lot of +1 already! | 20:07 |
| boris-42 | bknudson ya=) | 20:07 |
| boris-42 | bknudson I wanna make sure that everybody is ok with it | 20:07 |
| *** gabriel-bezerra has joined #openstack-keystone | 20:07 | |
| boris-42 | bknudson as it's cross project stuff at least one core from that team should +1 | 20:07 |
| bknudson | boris-42: is the work going to be done in oslo? | 20:08 |
| boris-42 | bknudson hm nope there is nothing related to oslo | 20:08 |
| boris-42 | bknudson as you already see we have to add 2 patches in all projects | 20:08 |
| boris-42 | bknudson 1 in python client 1 in main project | 20:08 |
| bknudson | boris-42: so this might show if I'm using nova that keystone took x seconds to validate the token? that kind of cross-project profiling? | 20:10 |
| boris-42 | bknudson yep | 20:10 |
| boris-42 | bknudson so you are getting one trace that goes through all services | 20:11 |
| boris-42 | of all projects | 20:11 |
| bknudson | I think someone tried to do this before but it didn't get too far | 20:11 |
| boris-42 | bknudson Yahoo! guy | 20:11 |
| bknudson | it didn't involve ceilometer notifications | 20:11 |
| boris-42 | bknudson that was working on tomograhp | 20:11 |
| boris-42 | tomograph* | 20:11 |
| boris-42 | bknudson that uses zipkin | 20:11 |
| *** jsavak has joined #openstack-keystone | 20:12 | |
| *** raildo_ has joined #openstack-keystone | 20:12 | |
| boris-42 | bknudson I just use the similar idea but make it integrable in OpenStack | 20:12 |
| *** jaosorior has quit IRC | 20:12 | |
| bknudson | I think there already is some trace middleware in oslo | 20:12 |
| boris-42 | bknudson nope | 20:12 |
| bknudson | that's why I was asking if the work is in oslo | 20:12 |
| boris-42 | bknudson there is no tracing middleware | 20:12 |
| bknudson | I mean a request ID, not tracing. | 20:12 |
| bknudson | maybe the request ID middleware can go away with this | 20:12 |
| bknudson | boris-42: http://git.openstack.org/cgit/openstack/oslo-incubator/tree/openstack/common/middleware/correlation_id.py | 20:13 |
| boris-42 | bknudson yep there is request-id | 20:13 |
| bknudson | it's pretty fancy | 20:13 |
| boris-42 | bknudson but it's another storry | 20:13 |
| boris-42 | bknudson it is as well super important feature | 20:13 |
| boris-42 | bknudson but it is different | 20:13 |
| boris-42 | =) | 20:13 |
| boris-42 | bknudson it put's to logs request-ids | 20:14 |
| boris-42 | bknudson so you are able to grep all logs related to request | 20:14 |
| boris-42 | bknudson and it is very useful in such cases when you gat failure in request | 20:15 |
| *** joesavak has quit IRC | 20:15 | |
| bknudson | boris-42: I like that there's security consideration in your proposal | 20:15 |
| boris-42 | bknudson and wanna find what the hell happen | 20:15 |
| boris-42 | bknudson but it want help you in case when you would like to find what works slow | 20:15 |
| boris-42 | bknudson and it doesn't support this nested stuff, and as well this extra info, like what was SQL requests, arguments of called method and so on=) | 20:16 |
| boris-42 | bknudson yep security in such stuff is quite important | 20:16 |
| boris-42 | bknudson cause this stuff is for production cloud, and should be turned on | 20:17 |
| boris-42 | bknudson so there must not be security issues | 20:17 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add an OS-FEDERATION section to scoped federation tokens https://review.openstack.org/111070 | 20:19 |
| stevemar | morganfainberg, ^ | 20:19 |
| *** joesavak has joined #openstack-keystone | 20:20 | |
| *** jsavak has quit IRC | 20:22 | |
| openstackgerrit | Diane Fleming proposed a change to openstack/identity-api: Remove ATOM responses for list versions and get version details. https://review.openstack.org/110777 | 20:23 |
| *** mrmoje has joined #openstack-keystone | 20:25 | |
| *** mrmoje has quit IRC | 20:25 | |
| *** jsavak has joined #openstack-keystone | 20:31 | |
| *** topol has quit IRC | 20:32 | |
| dstanek | bknudson: any reason to not +A this? https://review.openstack.org/#/c/103998/ i just realized that you have 3 +2s | 20:32 |
| bknudson | dstanek: I don't know why it isn't +A, but even if it was the review it depends on isn't +A. | 20:33 |
| dstanek | ah, that may be why...i'll start looking at the one it depends on to get this moving | 20:34 |
| *** joesavak has quit IRC | 20:34 | |
| *** joesavak has joined #openstack-keystone | 20:34 | |
| dstanek | bknudson: nm, i already +2ed that one | 20:35 |
| bknudson | dstanek: you did your part. | 20:35 |
| *** jsavak has quit IRC | 20:37 | |
| morganfainberg | bknudson, https://review.openstack.org/#/c/110138/ rebase needed, tried to +A it | 20:40 |
| bknudson | morganfainberg: ok, I'll try to do that today. | 20:40 |
| bknudson | morganfainberg: looking at revocation events with mysql | 20:40 |
| morganfainberg | bknudson, if it's a trvial rebase conflict consider my +2 to stand | 20:40 |
| *** raildo_ has quit IRC | 20:47 | |
| *** ajayaa has quit IRC | 20:53 | |
| *** gabriel-bezerra has quit IRC | 20:54 | |
| *** gokrokve has quit IRC | 20:54 | |
| *** openstackgerrit has quit IRC | 21:01 | |
| *** openstackgerrit has joined #openstack-keystone | 21:02 | |
| *** openstack has joined #openstack-keystone | 21:08 | |
| dolphm | dstanek: i don't have long chains too often, but checkout the last in the chain, and rebase it onto the one that was updated underneath you? | 21:15 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/python-keystoneclient: Config fixture from oslo-incubator is not used. https://review.openstack.org/103998 | 21:18 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/python-keystoneclient: Use config fixture from oslo.config https://review.openstack.org/110138 | 21:18 |
| openstackgerrit | John Trowbridge proposed a change to openstack/keystone: Adds RBAC to Keystone V2 API get_endpoints method. https://review.openstack.org/111088 | 21:19 |
| *** gabriel-bezerra has joined #openstack-keystone | 21:21 | |
| *** joesavak has quit IRC | 21:21 | |
| lbragstad | nonameentername: https://github.com/openstack/oslo-incubator/blob/master/openstack/common/importutils.py#L68 | 21:23 |
| *** doddstack has quit IRC | 21:25 | |
| *** doddstack has joined #openstack-keystone | 21:26 | |
| *** doddstack has quit IRC | 21:34 | |
| bknudson | dolphm: we may have to revert https://review.openstack.org/#/c/109747/ ... somehow the gate is now unstable. | 21:34 |
| dolphm | bknudson: because of that? is there a bug filed? | 21:35 |
| bknudson | dolphm: https://bugs.launchpad.net/tempest/+bug/1351026 | 21:35 |
| uvirtbot | Launchpad bug 1351026 in tempest "IdentityError in TokensV3TestJSON.test_rescope_token" [Undecided,New] | 21:35 |
| bknudson | I don't understand why it would be intermittent | 21:35 |
| bknudson | maybe all these changes have to go in together rather than splitting it up. | 21:36 |
| dolphm | bknudson: if we have gate-fixing bugs, we can ask infra to prioritize them in the gate | 21:37 |
| bknudson | probably just https://review.openstack.org/#/c/109820/ and https://review.openstack.org/#/c/109389/ have to go in tgether | 21:37 |
| dolphm | gate-fixing patches* | 21:37 |
| *** andreaf_ has quit IRC | 21:41 | |
| *** andreaf_ has joined #openstack-keystone | 21:43 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add a domain to federated users https://review.openstack.org/110858 | 21:47 |
| *** thedodd has joined #openstack-keystone | 21:49 | |
| morganfainberg | stevemar, ^ looks like it was bad verbiage in the commit message that was throwing things off. fixed | 21:49 |
| *** andreaf_ has quit IRC | 21:53 | |
| stevemar | morganfainberg, cool, my bad on the wording | 21:58 |
| morganfainberg | stevemar, meh | 21:58 |
| morganfainberg | stevemar, it happens | 21:58 |
| stevemar | not my forte | 21:58 |
| *** topol has joined #openstack-keystone | 22:01 | |
| dolphm | bknudson: +2 on https://review.openstack.org/#/c/109389/ | 22:02 |
| *** gokrokve has joined #openstack-keystone | 22:07 | |
| *** markwash has quit IRC | 22:10 | |
| *** nkinder_away has quit IRC | 22:10 | |
| *** nkinder_away has joined #openstack-keystone | 22:11 | |
| *** ayoung has quit IRC | 22:13 | |
| *** markwash has joined #openstack-keystone | 22:24 | |
| dolphm | bknudson: wow, thanks for your last comment on bug 1347961! that makes sense now :( | 22:24 |
| uvirtbot | Launchpad bug 1347961 in ossa "Revocation events are broken with mysql" [Undecided,Incomplete] https://launchpad.net/bugs/1347961 | 22:24 |
| bknudson | dolphm: y, I wasn't sure after the other changes if it still applied... working on a change to workaround it now | 22:25 |
| bknudson | essentially just always truncating the expires_at time. | 22:26 |
| dolphm | bknudson: this also means we can't deploy on mysql < 5.6 now at all, right? | 22:26 |
| dolphm | bknudson: or, i guess we could. wed | 22:26 |
| dolphm | we'd have seconds accuracy on both sides of the comparison | 22:26 |
| *** gabriel-bezerra has quit IRC | 22:26 | |
| morganfainberg | dolphm, not sure what happens with DATETIME(6) on mysql < 5.6 | 22:27 |
| bknudson | dolphm: can't deploy with revocation events or in general? | 22:27 |
| *** henrynash has quit IRC | 22:27 | |
| *** gabriel-bezerra has joined #openstack-keystone | 22:28 | |
| morganfainberg | bknudson, we are also losing resolution (i think) on normal token expiry/issued_at | 22:28 |
| dolphm | "MySQL 5.6.4 and up expands fractional seconds support for TIME, DATETIME, and TIMESTAMP values, with up to microseconds (6 digits) precision" | 22:28 |
| dolphm | .4 is quite specific for such a feature | 22:28 |
| morganfainberg | i don't think we publish a minimum mysql version for openstack | 22:28 |
| morganfainberg | though, i'd laugh if someone tries mysql 4 | 22:29 |
| bknudson | when I ran the tempest test the token seemed to be revoked properly (couldn't create a new token), unless I set revoke_by_id=false | 22:29 |
| dolphm | morganfainberg: if you deployed on 5.5 for example, both your token's expiration and revocation event's expiration should both be in full seconds? | 22:30 |
| morganfainberg | dolphm, or mysql will barf when you say datetime(6) | 22:30 |
| morganfainberg | and break everything | 22:30 |
| dolphm | morganfainberg: it just truncates | 22:31 |
| morganfainberg | oh then it should be fine | 22:31 |
| morganfainberg | yeah, though it means we need to truncate our internal resolution as well | 22:31 |
| dolphm | prior to 5.6.4: "when MySQL stores a value into a column of any temporal data type, it discards any fractional part and does not store it." | 22:31 |
| morganfainberg | well sure | 22:31 |
| morganfainberg | but i wonder if migrating to DATETIME(6) will cause issues. | 22:31 |
| dolphm | morganfainberg: changing the column type? | 22:32 |
| morganfainberg | dolphm, yeah thats how you "fix" the issue | 22:32 |
| morganfainberg | datetime defaults to datetime(0) in mysql5.6.4 | 22:32 |
| morganfainberg | which is opposite of the SQL standard | 22:32 |
| dolphm | well that's not convenient | 22:32 |
| morganfainberg | we could move to string columns | 22:33 |
| bknudson | y, store an iso string | 22:33 |
| morganfainberg | but somehow i think we're the only ones who *really* care about microseconds | 22:33 |
| bknudson | but then it's hard to compare? | 22:33 |
| morganfainberg | bknudson, not nearly as efficient | 22:33 |
| *** stevemar2 has joined #openstack-keystone | 22:34 | |
| *** stevemar has quit IRC | 22:36 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix revocation event handling with MySQL https://review.openstack.org/111106 | 22:48 |
| morganfainberg | dolphm, re: federated user domains, happy to have that be a -spec as well | 22:50 |
| dolphm | morganfainberg: yeah, that was a discussion we started in icehouse and never finished. definitely worth having | 22:51 |
| morganfainberg | dolphm, my opinion is federated users belong to no domain. | 22:51 |
| morganfainberg | but tokens should be uniform | 22:51 |
| morganfainberg | but i'm def. not hard-line on that stance. | 22:51 |
| openstackgerrit | werner mendizabal proposed a change to openstack/keystone: Making import lxml optional https://review.openstack.org/111108 | 22:53 |
| *** bknudson has quit IRC | 22:58 | |
| *** gabriel-bezerra has quit IRC | 22:59 | |
| *** gordc has quit IRC | 22:59 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove `with_lockmode` use from Trust SQL backend. https://review.openstack.org/97059 | 23:00 |
| *** gabriel-bezerra has joined #openstack-keystone | 23:01 | |
| *** hrybacki has joined #openstack-keystone | 23:18 | |
| *** bknudson has joined #openstack-keystone | 23:18 | |
| *** marcoemorais has quit IRC | 23:18 | |
| *** bknudson has quit IRC | 23:22 | |
| *** marcoemorais has joined #openstack-keystone | 23:22 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Revert "Fix for V2 token issued_at time changing" https://review.openstack.org/111116 | 23:25 |
| *** bknudson has joined #openstack-keystone | 23:37 | |
| bknudson | 'm hoping that https://review.openstack.org/#/c/111116/ will get the gate working again... | 23:39 |
| bknudson | not sure how it got in considering postgresql tempest seems to be failing all the time now | 23:39 |
| *** topol has quit IRC | 23:40 | |
| *** gabriel-bezerra has quit IRC | 23:48 | |
| *** gabriel-bezerra has joined #openstack-keystone | 23:48 | |
| *** gyee has quit IRC | 23:48 | |
| *** marcoemorais has quit IRC | 23:51 | |
| *** jamielennox|away is now known as jamielennox | 23:53 | |
| *** marcoemorais has joined #openstack-keystone | 23:53 | |
| *** stevemar2 is now known as stevemar | 23:55 | |
| *** gabriel-bezerra has quit IRC | 23:57 | |
| *** gabriel-bezerra has joined #openstack-keystone | 23:57 | |
| stevemar | morganfainberg, sry about the duplicate bugs, launchpad was acting all sorts of funny | 23:58 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!