| *** ncoghlan is now known as ncoghlan_afk | 00:01 | |
| *** ncoghlan_afk is now known as ncoghlan | 00:03 | |
| *** ncoghlan is now known as ncoghlan_afk | 00:04 | |
| *** yasukun has joined #openstack-keystone | 00:11 | |
| *** ayoung has joined #openstack-keystone | 00:22 | |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Convert auth_token middleware to use sessions https://review.openstack.org/105031 | 00:54 |
|---|---|---|
| *** ncoghlan_afk is now known as ncoghlan | 01:00 | |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/111621 | 01:07 |
| *** mitz has quit IRC | 01:10 | |
| *** mitz has joined #openstack-keystone | 01:11 | |
| *** gyee has quit IRC | 01:12 | |
| morganfainberg | jamielennox, shameless plug :P https://twitter.com/MdrnStm/status/496825644714823681 | 01:13 |
| jamielennox | morganfainberg: done | 01:14 |
| morganfainberg | :) | 01:14 |
| jamielennox | so many proposals | 01:14 |
| morganfainberg | i know | 01:14 |
| jamielennox | i think i voted on about a dozen before giving up | 01:14 |
| morganfainberg | i also think the site for voting is bad | 01:15 |
| morganfainberg | i hate the "random" thing | 01:15 |
| morganfainberg | give me a list so i can compare and see if one company has submitted the *same* talk 5 times but with different people and slightly different wording | 01:15 |
| morganfainberg | a list by category would be fine | 01:15 |
| *** marcoemorais has quit IRC | 01:16 | |
| jamielennox | list by category can be done | 01:16 |
| jamielennox | well, random by category | 01:16 |
| *** gokrokve has joined #openstack-keystone | 01:21 | |
| morganfainberg | jamielennox, the random part is the part is dislike, | 01:35 |
| *** amcrn has quit IRC | 01:36 | |
| *** hrybacki has quit IRC | 01:41 | |
| openstackgerrit | wanghong proposed a change to openstack/python-keystoneclient: expose the revoke token for V3 https://review.openstack.org/102701 | 01:44 |
| *** shufflebot has joined #openstack-keystone | 01:48 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Control identity plugin reauthentication https://review.openstack.org/107555 | 01:51 |
| *** rwsu has quit IRC | 01:54 | |
| *** rwsu has joined #openstack-keystone | 02:07 | |
| *** shakamunyi has joined #openstack-keystone | 02:17 | |
| *** diegows has quit IRC | 02:22 | |
| jamielennox | is there a problem related to cinder mucking up the gate ATM? | 02:32 |
| *** RockKuo_Office has joined #openstack-keystone | 02:44 | |
| *** gokrokve_ has joined #openstack-keystone | 02:56 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Create an Auth Plugin to pass to users https://review.openstack.org/107222 | 02:56 |
| *** gokrokve_ has quit IRC | 02:58 | |
| *** gokrokve_ has joined #openstack-keystone | 02:59 | |
| *** gokrokve has quit IRC | 03:00 | |
| stevemar | morganfainberg, i don't think i can make role assignment notifications fit into the current decorator | 03:00 |
| stevemar | that makes me sad | 03:00 |
| *** mrmoje has quit IRC | 03:23 | |
| *** ncoghlan is now known as ncoghlan_afk | 03:27 | |
| jamielennox | morganfainberg: how far did you get converting people to middleware.auth_token | 03:28 |
| jamielennox | ? | 03:28 |
| *** gokrokve has joined #openstack-keystone | 03:30 | |
| *** gokrokve_ has quit IRC | 03:34 | |
| *** ayoung has quit IRC | 03:34 | |
| *** richm has quit IRC | 03:40 | |
| openstackgerrit | A change was merged to openstack/keystone: Refactor existing endpoint filter tests https://review.openstack.org/111130 | 03:42 |
| *** ncoghlan_afk is now known as ncoghlan | 03:46 | |
| *** gokrokve has quit IRC | 03:51 | |
| *** gokrokve has joined #openstack-keystone | 03:51 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:16 | |
| *** hrybacki has joined #openstack-keystone | 04:25 | |
| *** gokrokve has quit IRC | 04:33 | |
| *** gokrokve has joined #openstack-keystone | 04:35 | |
| *** jasondotstar has joined #openstack-keystone | 04:38 | |
| *** jasondotstar has quit IRC | 04:43 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:46 | |
| *** k4n0 has joined #openstack-keystone | 04:47 | |
| *** jkappert has quit IRC | 04:51 | |
| *** jkappert has joined #openstack-keystone | 04:52 | |
| *** jaosorior has joined #openstack-keystone | 04:53 | |
| *** hrybacki has quit IRC | 04:55 | |
| *** jasondotstar has joined #openstack-keystone | 04:56 | |
| *** ajayaa has joined #openstack-keystone | 04:57 | |
| *** ncoghlan is now known as ncoghlan_afk | 05:01 | |
| stevemar | i think i found the least invasive way to get notifications on role assignments yay | 05:06 |
| *** chandankumar has joined #openstack-keystone | 05:06 | |
| *** jasondotstar has quit IRC | 05:19 | |
| *** gokrokve has quit IRC | 05:24 | |
| stevemar | is this even used: https://github.com/openstack/keystone/blob/master/keystone/tests/test_notifications.py#L183-L187 | 05:26 |
| *** afazekas has quit IRC | 05:34 | |
| *** ncoghlan_afk is now known as ncoghlan | 05:41 | |
| *** ajayaa has quit IRC | 05:49 | |
| *** gokrokve has joined #openstack-keystone | 05:52 | |
| *** gokrokve has quit IRC | 05:55 | |
| *** gokrokve has joined #openstack-keystone | 05:56 | |
| *** gokrokve has quit IRC | 06:00 | |
| *** ajayaa has joined #openstack-keystone | 06:02 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add notification for grant created and deleted events https://review.openstack.org/112204 | 06:02 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/111920 | 06:05 |
| *** mitz has quit IRC | 06:07 | |
| openstackgerrit | Ajaya Agrawal proposed a change to openstack/keystone: Implemented caching in identity layer. https://review.openstack.org/110575 | 06:07 |
| *** mitz has joined #openstack-keystone | 06:09 | |
| *** tomoiaga has joined #openstack-keystone | 06:09 | |
| *** afazekas has joined #openstack-keystone | 06:13 | |
| *** shakamunyi has quit IRC | 06:16 | |
| *** chandankumar has quit IRC | 06:18 | |
| *** k4n0 has quit IRC | 06:18 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Remove unused function https://review.openstack.org/112211 | 06:18 |
| *** gokrokve has joined #openstack-keystone | 06:21 | |
| *** chandankumar has joined #openstack-keystone | 06:22 | |
| *** gokrokve_ has joined #openstack-keystone | 06:25 | |
| *** gokrokve has quit IRC | 06:26 | |
| *** zigo has quit IRC | 06:28 | |
| *** gokrokve_ has quit IRC | 06:31 | |
| *** henrynash has joined #openstack-keystone | 06:32 | |
| *** zigo has joined #openstack-keystone | 06:33 | |
| *** ukalifon has joined #openstack-keystone | 06:42 | |
| *** henrynash has quit IRC | 06:44 | |
| *** ukalifon1 has joined #openstack-keystone | 06:46 | |
| *** stevemar has quit IRC | 06:50 | |
| *** marekd|away is now known as marekd | 07:15 | |
| *** gokrokve has joined #openstack-keystone | 07:22 | |
| *** gokrokve has quit IRC | 07:27 | |
| *** andreaf has quit IRC | 07:35 | |
| *** andreaf has joined #openstack-keystone | 07:35 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: V2 token from trust cannot be generated with user/pass https://review.openstack.org/112230 | 07:42 |
| *** henrynash has joined #openstack-keystone | 07:44 | |
| *** tomoiaga has quit IRC | 07:49 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add documentation on LDAP 'user_id_attribute' https://review.openstack.org/93480 | 07:52 |
| *** tomoiaga has joined #openstack-keystone | 07:53 | |
| openstackgerrit | Qin Zhao proposed a change to openstack/python-keystoneclient: Fix the condition expression for ssl_insecure https://review.openstack.org/112232 | 07:54 |
| *** tellesnobrega1 has joined #openstack-keystone | 07:58 | |
| *** notmyname has quit IRC | 07:58 | |
| *** tellesnobrega has quit IRC | 07:58 | |
| *** wanghong has quit IRC | 07:59 | |
| *** notmyname has joined #openstack-keystone | 07:59 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Load session from builtin session loader https://review.openstack.org/111655 | 08:21 |
| *** gokrokve has joined #openstack-keystone | 08:22 | |
| *** gokrokve has quit IRC | 08:26 | |
| *** mrmoje has joined #openstack-keystone | 08:43 | |
| *** henrynash has quit IRC | 08:45 | |
| *** huats_ has joined #openstack-keystone | 08:52 | |
| *** raildo1 has quit IRC | 08:53 | |
| *** gmurphy has quit IRC | 08:53 | |
| *** Guest26240 has quit IRC | 08:53 | |
| *** ByteSore has quit IRC | 08:53 | |
| *** ashepelev has quit IRC | 08:53 | |
| *** raildo has joined #openstack-keystone | 08:53 | |
| *** huats has quit IRC | 08:54 | |
| *** gmurphy has joined #openstack-keystone | 08:54 | |
| *** ByteSore has joined #openstack-keystone | 08:54 | |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Use metadata.create_all() to fill a test database https://review.openstack.org/93558 | 08:55 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 08:55 |
| *** ashepelev has joined #openstack-keystone | 08:55 | |
| *** ajayaa has quit IRC | 09:03 | |
| *** wanghong has joined #openstack-keystone | 09:18 | |
| *** gokrokve has joined #openstack-keystone | 09:22 | |
| *** toddnni has quit IRC | 09:23 | |
| *** ajayaa has joined #openstack-keystone | 09:26 | |
| *** gokrokve has quit IRC | 09:27 | |
| openstackgerrit | Qin Zhao proposed a change to openstack/python-keystoneclient: Fix the condition expression for ssl_insecure https://review.openstack.org/112232 | 09:31 |
| *** ncoghlan has quit IRC | 09:32 | |
| *** ajayaa has quit IRC | 09:43 | |
| *** toddnni has joined #openstack-keystone | 09:50 | |
| openstackgerrit | Matthieu Huin proposed a change to openstack/keystone: Check for empty string value in REMOTE_USER https://review.openstack.org/111953 | 10:02 |
| *** ajayaa has joined #openstack-keystone | 10:05 | |
| *** ajayaa has quit IRC | 10:20 | |
| *** henrynash has joined #openstack-keystone | 10:22 | |
| *** gokrokve has joined #openstack-keystone | 10:22 | |
| *** yasukun has quit IRC | 10:26 | |
| *** toddnni has quit IRC | 10:27 | |
| *** toddnni has joined #openstack-keystone | 10:27 | |
| *** gokrokve has quit IRC | 10:28 | |
| *** jamielennox has quit IRC | 10:34 | |
| *** jamielennox has joined #openstack-keystone | 10:35 | |
| *** ajayaa has joined #openstack-keystone | 10:44 | |
| *** henrynash has quit IRC | 10:45 | |
| *** henrynash has joined #openstack-keystone | 10:50 | |
| *** jamielennox is now known as jamielennox|away | 10:57 | |
| *** diegows has joined #openstack-keystone | 11:09 | |
| *** henrynash has quit IRC | 11:15 | |
| *** amcrn has joined #openstack-keystone | 11:17 | |
| *** amcrn has quit IRC | 11:18 | |
| *** amcrn has joined #openstack-keystone | 11:18 | |
| *** amcrn has quit IRC | 11:24 | |
| *** RockKuo_Office has quit IRC | 11:25 | |
| marekd | thanks mhu | 11:41 |
| *** henrynash has joined #openstack-keystone | 11:50 | |
| *** miqui has quit IRC | 12:10 | |
| *** stevemar has joined #openstack-keystone | 12:17 | |
| *** ajayaa has quit IRC | 12:20 | |
| *** gokrokve has joined #openstack-keystone | 12:22 | |
| *** gokrokve has quit IRC | 12:26 | |
| openstackgerrit | Marcos FermÃn Lobo proposed a change to openstack/keystone: Add information regarding HTTPS for SSL enabled endpoints https://review.openstack.org/95545 | 12:46 |
| *** gordc has joined #openstack-keystone | 12:47 | |
| dstanek | ab | 12:50 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: Add OS-FEDERATION section to scoped federation tokens https://review.openstack.org/111873 | 12:53 |
| *** cjellick has joined #openstack-keystone | 12:55 | |
| openstackgerrit | henry-nash proposed a change to openstack/identity-api: Extension for endpoint policy association. https://review.openstack.org/112292 | 12:57 |
| *** bknudson has quit IRC | 13:14 | |
| *** vhoward has left #openstack-keystone | 13:18 | |
| openstackgerrit | A change was merged to openstack/keystone: Remove unused function https://review.openstack.org/112211 | 13:18 |
| marekd | six is a stdlib or 3rd party? | 13:22 |
| *** gokrokve has joined #openstack-keystone | 13:22 | |
| *** richm has joined #openstack-keystone | 13:23 | |
| *** chandankumar has quit IRC | 13:23 | |
| dstanek | marekd: third party | 13:24 |
| dstanek | i have a patch for the commit i just approved | 13:24 |
| dstanek | marekd: i didn't want to have people go back and +2 it again | 13:25 |
| marekd | dstanek: what patch? | 13:25 |
| dstanek | marekd: i haven't pushed it yet...waiting about 10 more mins for your to merge | 13:25 |
| marekd | dstanek: https://review.openstack.org/107393 | 13:26 |
| marekd | ah this... | 13:26 |
| marekd | ok | 13:26 |
| dstanek | i couldn't get git-review not to rebase and want to re-push yours | 13:26 |
| marekd | sure, thanks for +A | 13:27 |
| marekd | it will be finally merged. | 13:27 |
| marekd | and thanks for not lossing other +2s. | 13:27 |
| *** wchrisj has joined #openstack-keystone | 13:28 | |
| *** gokrokve has quit IRC | 13:28 | |
| *** wchrisj has left #openstack-keystone | 13:29 | |
| *** hrybacki has joined #openstack-keystone | 13:30 | |
| *** ayoung has joined #openstack-keystone | 13:31 | |
| *** bknudson has joined #openstack-keystone | 13:32 | |
| marekd | dstanek: i think urlencode from six will not work for strings. Do you have something instead that? | 13:32 |
| marekd | i already have a string and simply need to urlencode it. | 13:32 |
| dstanek | marekd: what do you mean by that? you have a string that you want to urlencode to be something like a query param? | 13:33 |
| marekd | yes, escape some characters etc. | 13:34 |
| dstanek | and then what are you doing with the string? | 13:34 |
| *** jasondotstar has joined #openstack-keystone | 13:34 | |
| marekd | sending as a request body. | 13:35 |
| dstanek | marekd: does quote work for you then? | 13:35 |
| dstanek | marekd: also i think many client libraries will take care of that for you. do you have sample code? | 13:36 |
| marekd | dstanek: https://review.openstack.org/#/c/111771/3/keystoneclient/contrib/auth/v3/saml2.py line 608 | 13:36 |
| marekd | this is what i was doing but that's not Py3 compatible, right? | 13:37 |
| marekd | and without that I am getting HTTP 500 :/ | 13:37 |
| *** gokrokve has joined #openstack-keystone | 13:37 | |
| *** jasondotstar has quit IRC | 13:40 | |
| dstanek | marekd: yeah, you'll have to import it from six | 13:40 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: List federated projects and domains https://review.openstack.org/107393 | 13:40 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add notifications for role assignment created and deleted events https://review.openstack.org/112204 | 13:41 |
| openstackgerrit | David Stanek proposed a change to openstack/python-keystoneclient: Fixes import grouping https://review.openstack.org/112299 | 13:41 |
| marekd | dstanek: but what exactly? | 13:41 |
| *** gokrokve has quit IRC | 13:42 | |
| marekd | dstanek: i think you can post your patch | 13:44 |
| marekd | (six) | 13:45 |
| dstanek | marekd: already done ^ | 13:45 |
| marekd | dstanek: aha, ok | 13:45 |
| dstanek | marekd: for six you import 'from six.moves import urllib' | 13:45 |
| dstanek | and then i think it's urllib.parse.quote | 13:45 |
| marekd | dstanek: dstanek yessssssssssssssssssssssssss | 13:46 |
| dstanek | six.moves makes everything look like the new py3 structure | 13:46 |
| *** chandankumar has joined #openstack-keystone | 13:46 | |
| *** radez_g0n3 is now known as radez | 13:49 | |
| dstanek | marekd: better? | 13:51 |
| marekd | dstanek: perfect! | 13:52 |
| dstanek | marekd: nice | 13:52 |
| *** jasondotstar has joined #openstack-keystone | 13:54 | |
| marekd | dstanek: thanks | 13:54 |
| *** vhoward has joined #openstack-keystone | 13:56 | |
| *** saipandi has joined #openstack-keystone | 14:02 | |
| dstanek | marekd: yw | 14:05 |
| *** shakamunyi has joined #openstack-keystone | 14:08 | |
| *** joesavak has joined #openstack-keystone | 14:12 | |
| *** vhoward has left #openstack-keystone | 14:14 | |
| *** ukalifon1 has quit IRC | 14:22 | |
| ayoung | dstanek, saw this in in tox run on the client | 14:23 |
| ayoung | No distributions matching the version for oslo.config>=1.4.0.0a3 (from -r /opt/stack/python-keystoneclient/requirements.txt (line 6)) | 14:23 |
| ayoung | have you seen that before? | 14:23 |
| ayoung | I needed to rebuilt the venv due to jamielennox|away 's httpretty evisceration. | 14:24 |
| dstanek | ayoung: i have no, but i'm tryin to reproduce it now | 14:24 |
| *** gokrokve has joined #openstack-keystone | 14:24 | |
| ayoung | dstanek, thanks | 14:24 |
| dhellmann | ayoung: your virtualenv/pip/tox might be a little old. There are some versions that don't automatically install wheels. | 14:25 |
| ayoung | dhellmann, I need an updated tox? | 14:25 |
| ayoung | python-tox-1.6.1-1.fc21.noarch | 14:25 |
| dstanek | dhellmann: do you know what version changed that? | 14:25 |
| dhellmann | dstanek: I don't off the top of my head, no. | 14:25 |
| ayoung | What is a Wheel? | 14:26 |
| dstanek | ayoung: i'm also on 1.6.1 | 14:26 |
| dhellmann | ayoung: what pip and virtualenv? | 14:26 |
| dhellmann | ayoung: a python package type | 14:26 |
| ayoung | dhellmann, is it a new thing or something old? | 14:26 |
| ayoung | pip 1.4.1 from /usr/lib/python2.7/site-packages (python 2.7) | 14:26 |
| dhellmann | ayoung: it's not brand new, but it's newish https://wiki.openstack.org/wiki/Oslo/VersioningPolicy | 14:27 |
| dhellmann | ayoung: I have pip 1.5.4, try updating pip first | 14:28 |
| *** david-lyle has joined #openstack-keystone | 14:28 | |
| *** david-lyle has quit IRC | 14:28 | |
| *** david-lyle has joined #openstack-keystone | 14:28 | |
| ayoung | "To everything (churn. churn, churn) there is a version (churn. churn, churn) A new way to solve each problem, under Heaven...." | 14:28 |
| dstanek | i don't actually have pip installed on the host - i depend on it being installed into the venv | 14:29 |
| ayoung | dstanek, tox does that, right? | 14:29 |
| ayoung | I just ran tox -r | 14:29 |
| *** gokrokve has quit IRC | 14:30 | |
| dstanek | ayoung: yes, happens when tox creates the venv | 14:30 |
| ayoung | so the only thing we can affect is tox version | 14:30 |
| dstanek | and virtualenv | 14:30 |
| dstanek | i don't have this issue btw | 14:31 |
| dstanek | my virtualenv is 1.11.4 | 14:31 |
| ayoung | 1.10.1 | 14:31 |
| *** gokrokve has joined #openstack-keystone | 14:35 | |
| *** jsavak has joined #openstack-keystone | 14:44 | |
| *** jorge_munoz has joined #openstack-keystone | 14:45 | |
| *** henrynash has quit IRC | 14:45 | |
| *** joesavak has quit IRC | 14:48 | |
| *** thedodd has joined #openstack-keystone | 14:52 | |
| *** tomoiaga has quit IRC | 14:53 | |
| marekd | ayoung: mhu had the same problem yesterday | 14:56 |
| marekd | (osdlo.config) | 14:56 |
| marekd | oslo* | 14:56 |
| marekd | mhu: ^^ | 14:56 |
| mhu | ayoung, marekd : yes, I solved this when I updated virtualenv | 14:59 |
| ayoung | mhu, testing that now. There is a 1.11 mrunge submitted on Koji | 14:59 |
| mhu | ayoung, there's a thread in the ML about it | 14:59 |
| marekd | mhu: what virtualenv ver do you have now? | 14:59 |
| ayoung | sudo yum install https://kojipkgs.fedoraproject.org//packages/python-virtualenv/1.11.6/1.fc20/noarch/python-virtualenv-1.11.6-1.fc20.noarch.rpm | 15:00 |
| mhu | marekd: 1.11.6 | 15:00 |
| *** jsavak has quit IRC | 15:01 | |
| *** richm has left #openstack-keystone | 15:10 | |
| *** gokrokve has quit IRC | 15:12 | |
| *** thiagop has joined #openstack-keystone | 15:16 | |
| thiagop | Hello everybody | 15:17 |
| dstanek | ayoung: did updating virtualenv help | 15:17 |
| dstanek | thiagop: hiya | 15:17 |
| ayoung | looking | 15:17 |
| thiagop | stevemar: I'm having some troubles here to re-scope a federated token, can you help me? | 15:17 |
| ayoung | dstanek, something failed, but not sure if its the same.... | 15:18 |
| *** joesavak has joined #openstack-keystone | 15:19 | |
| *** richm has joined #openstack-keystone | 15:24 | |
| *** thedodd has quit IRC | 15:29 | |
| *** joesavak has quit IRC | 15:32 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: SAML2 federated authentication for ADFS. https://review.openstack.org/111771 | 15:33 |
| *** joesavak has joined #openstack-keystone | 15:33 | |
| *** thedodd has joined #openstack-keystone | 15:35 | |
| *** hrybacki has quit IRC | 15:40 | |
| *** joesavak has quit IRC | 15:47 | |
| *** mrmoje has quit IRC | 15:49 | |
| *** joesavak has joined #openstack-keystone | 15:50 | |
| *** gyee has joined #openstack-keystone | 15:54 | |
| *** gyee has quit IRC | 15:54 | |
| *** jsavak has joined #openstack-keystone | 15:56 | |
| *** joesavak has quit IRC | 16:00 | |
| *** ukalifon has joined #openstack-keystone | 16:00 | |
| *** chandankumar has quit IRC | 16:01 | |
| *** gyee has joined #openstack-keystone | 16:01 | |
| *** jorge_munoz has quit IRC | 16:14 | |
| *** marcoemorais has joined #openstack-keystone | 16:21 | |
| *** gokrokve has joined #openstack-keystone | 16:24 | |
| morganfainberg | mornin | 16:31 |
| *** thedodd has quit IRC | 16:45 | |
| *** henrynash has joined #openstack-keystone | 16:47 | |
| *** thedodd has joined #openstack-keystone | 16:48 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Make token_provider_api contain token persistence https://review.openstack.org/109041 | 16:49 |
| stevemar | dolphm, piiiiiiiiing | 16:54 |
| openstackgerrit | Stuart McLaren proposed a change to openstack/keystonemiddleware: Add composite authentication support https://review.openstack.org/108384 | 17:08 |
| *** hrybacki has joined #openstack-keystone | 17:11 | |
| *** hrybacki has quit IRC | 17:12 | |
| *** hrybacki has joined #openstack-keystone | 17:12 | |
| *** spandhe has joined #openstack-keystone | 17:16 | |
| *** KimJ has joined #openstack-keystone | 17:18 | |
| *** spandhe has quit IRC | 17:20 | |
| *** spandhe has joined #openstack-keystone | 17:24 | |
| *** gokrokve has quit IRC | 17:25 | |
| *** gokrokve has joined #openstack-keystone | 17:25 | |
| *** thiagop has quit IRC | 17:32 | |
| *** packet has joined #openstack-keystone | 17:35 | |
| *** bobt_ has joined #openstack-keystone | 17:41 | |
| *** packet has quit IRC | 17:41 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes eventlet server SIGHUP handling https://review.openstack.org/112368 | 17:45 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes eventlet server SIGHUP handling https://review.openstack.org/112368 | 17:47 |
| *** afazekas has quit IRC | 17:52 | |
| *** amerine has quit IRC | 17:56 | |
| *** amerine_ has joined #openstack-keystone | 17:56 | |
| dstanek | stevemar: hiya | 18:04 |
| *** ayoung has quit IRC | 18:24 | |
| *** henrynash has quit IRC | 18:25 | |
| *** henrynash has joined #openstack-keystone | 18:28 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Refactor some names in templated catalog backend https://review.openstack.org/112377 | 18:35 |
| *** ukalifon has quit IRC | 19:01 | |
| *** marcoemorais has quit IRC | 19:01 | |
| *** marcoemorais has joined #openstack-keystone | 19:02 | |
| *** ukalifon has joined #openstack-keystone | 19:03 | |
| dstanek | morganfainberg: ping | 19:06 |
| openstackgerrit | A change was merged to openstack/keystone: Remove `with_lockmode` use from Trust SQL backend. https://review.openstack.org/97059 | 19:11 |
| *** ukalifon has quit IRC | 19:15 | |
| *** shakamunyi has quit IRC | 19:17 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Remove S3 middleware tests from tox.ini https://review.openstack.org/112387 | 19:21 |
| *** jorge_munoz has joined #openstack-keystone | 19:29 | |
| *** ayoung has joined #openstack-keystone | 19:31 | |
| *** Guest27295 is now known as mgagne | 19:31 | |
| *** mgagne has quit IRC | 19:31 | |
| *** mgagne has joined #openstack-keystone | 19:31 | |
| *** radez is now known as radez_g0n3 | 19:32 | |
| *** jsavak has quit IRC | 19:44 | |
| *** marcoemorais has quit IRC | 19:53 | |
| *** marcoemorais has joined #openstack-keystone | 19:54 | |
| *** hrybacki has quit IRC | 19:59 | |
| *** joesavak has joined #openstack-keystone | 20:03 | |
| *** marcoemorais has quit IRC | 20:04 | |
| *** marcoemorais has joined #openstack-keystone | 20:04 | |
| *** marcoemorais has quit IRC | 20:04 | |
| *** marcoemorais has joined #openstack-keystone | 20:04 | |
| *** hrybacki has joined #openstack-keystone | 20:08 | |
| *** joesavak has quit IRC | 20:08 | |
| *** cjellick_ has joined #openstack-keystone | 20:13 | |
| *** cjellick_ has quit IRC | 20:14 | |
| *** cjellick_ has joined #openstack-keystone | 20:15 | |
| *** cjellick has quit IRC | 20:15 | |
| *** huats_ is now known as huats | 20:19 | |
| *** amcrn has joined #openstack-keystone | 20:21 | |
| *** amcrn has quit IRC | 20:21 | |
| *** amcrn has joined #openstack-keystone | 20:22 | |
| *** amcrn has quit IRC | 20:22 | |
| *** amcrn has joined #openstack-keystone | 20:23 | |
| rodrigods | marekd, quick question about k2k: considering the example given in the spec, when BETA's region with its URL will be added? When registering it as service provider? | 20:27 |
| marekd | rodrigods: I can see that this way. | 20:28 |
| rodrigods | marekd, cool | 20:28 |
| marekd | rodrigods: usually federation requires some configuration (metadata exchange, registering idp, adding mapping rules, protocol) | 20:28 |
| marekd | rodrigods: so this region would be a next step in the configuration. | 20:28 |
| stevemar | dstanek, hey dude | 20:29 |
| dstanek | stevemar: howdy | 20:29 |
| dstanek | i don't remember what i wanted now :-( but i did answer your decorator question (i think) | 20:30 |
| stevemar | dstanek, awesomeo, thanks for reviewing, i also wasn't a fan of the branching crap going on | 20:30 |
| rodrigods | marekd, yeah... was thinking about ACME's users side | 20:30 |
| stevemar | dstanek, but i wanted to be as non-invasive as possible | 20:31 |
| marekd | rodrigods: heh, ACME was a SP or IdP (can't remember atm) | 20:31 |
| marekd | rodrigods: what are your concerns? | 20:32 |
| stevemar | dstanek, so i should mimic the ManagerNotificationWrapper? seems like a lot of code to dupe :( | 20:32 |
| stevemar | also, do you think it's worth keeping the change to _send_notification? (from resource_id to payload?) | 20:33 |
| dstanek | stevemar: i don't think you shoud dup the code...but i don't know how i would break that up | 20:33 |
| rodrigods | marekd, ACME is the original keystone, that is bursting to BETA | 20:33 |
| dstanek | stevemar: if you are not going to be working on it tonight i can take a deeper look | 20:33 |
| marekd | rodrigods: so IdP. | 20:34 |
| rodrigods | marekd, I was trying to figure out, in which step BETA's URL would appear at ACME's service catalog | 20:34 |
| dstanek | stevemar: wasn't that because you have more data for that particular event? | 20:34 |
| marekd | rodrigods: when should it be added or when should be present in the Service Catalog? | 20:34 |
| stevemar | dstanek, i was going to duplicate it and take out the arg_index crap | 20:34 |
| rodrigods | marekd, both | 20:35 |
| stevemar | create a payload, and use _send_notification | 20:35 |
| marekd | rodrigods: i'd say added when the cloud admins configure federation between clouds. | 20:35 |
| marekd | rodrigods: when should appear in the SC...let me take a look at the spec | 20:37 |
| marekd | rodrigods: because there were many potential ways and I cannot recall the final one. | 20:37 |
| rodrigods | marekd, ok | 20:37 |
| rodrigods | thanks | 20:37 |
| stevemar | bknudson, thanks for the OSC reviews regarding oslo.i18n | 20:37 |
| bknudson | stevemar: looked like one of them was a wip | 20:37 |
| stevemar | bknudson, i think maybe the last one in the set, i had changed most of the error messages over, but not the help text :( | 20:38 |
| marekd | rodrigods: it looks like both steps are described in the spec. | 20:39 |
| marekd | rodrigods: adding a region is listed under Figure 1. | 20:39 |
| marekd | rodrigods: and it looks like after marek@ACME authenticated himself with ACME he will get a Service Catalog with all regions (clouds) where he can burst into. | 20:40 |
| marekd | rodrigods: see desc. under Fig 2. | 20:40 |
| rodrigods | marekd, so, (1) Add BETA as an SP , right | 20:40 |
| rodrigods | ? | 20:41 |
| rodrigods | marekd, thanks | 20:41 |
| marekd | rodrigods: Cloud Implementer at ACME adds BETA as V3 Regions, supplying BETA’s external authentication URL. | 20:41 |
| marekd | rodrigods: http://specs.openstack.org/openstack/keystone-specs/specs/juno/keystone-to-keystone-federation.html | 20:42 |
| rodrigods | marekd, I'm there, thanks | 20:42 |
| marekd | rodrigods: cool. | 20:43 |
| *** amcrn has quit IRC | 20:50 | |
| *** arborism has joined #openstack-keystone | 20:51 | |
| *** arborism is now known as amcrn | 20:53 | |
| *** joesavak has joined #openstack-keystone | 20:53 | |
| stevemar | dstanek, if you could look @ role assignment stuff tonight that would be super awesome | 20:54 |
| dstanek | stevemar: shore | 20:54 |
| stevemar | dstanek, yay, i owe you many beer | 20:54 |
| *** stevemar has quit IRC | 21:00 | |
| *** joesavak has quit IRC | 21:04 | |
| *** huats has quit IRC | 21:16 | |
| *** hrybacki has quit IRC | 21:27 | |
| *** chellygel has joined #openstack-keystone | 21:28 | |
| *** saipandi has quit IRC | 21:28 | |
| *** chellygel has left #openstack-keystone | 21:28 | |
| *** cjellick has joined #openstack-keystone | 21:29 | |
| *** cjellick has quit IRC | 21:30 | |
| *** cjellick_ has quit IRC | 21:33 | |
| *** amcrn has quit IRC | 21:34 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: Endpoint policy extension https://review.openstack.org/99842 | 21:46 |
| *** marzif_ has joined #openstack-keystone | 21:52 | |
| *** hrybacki has joined #openstack-keystone | 21:58 | |
| morganfainberg | henrynash, ping re email stuff | 21:58 |
| morganfainberg | henrynash, do you have a real use case wehre you're filtering on email addresses? | 21:58 |
| henrynash | morganfainberq: hi | 21:58 |
| morganfainberg | henrynash, it seems a little odd as first-class metadata (even though it is common) | 21:58 |
| henrynash | morganfainberg: I must admit, I don’t.... | 21:58 |
| morganfainberg | henrynash, i am concerned about making more first-class columns + optional (i admit i *HATE* extra) unless we really need it. not opposed, just was looking for a "why" (specific use case) | 21:59 |
| henrynash | morganfainberg: Others have been pushing ths (Juan)…and seemed unable to put a spec up…so I wrote it up for us to force the issue one way or the other | 22:00 |
| morganfainberg | henrynash, sure ok so i'd like to get Juan to comment the real use case | 22:00 |
| morganfainberg | i get the feeling that "we wanted to make the username email addresses but in the past ran into XXXX issue doing so, now we want to fix it" | 22:00 |
| morganfainberg | is the answer | 22:00 |
| henrynash | morganfainberg: that’s fair enough….there’s a bug report I think that mentions is….someone was writinga custom client (since our cleint explicitly supprots email)….and then discpovered email wasn’t there | 22:01 |
| morganfainberg | w/o impacting current usernames. | 22:01 |
| ayoung | morganfainberg, I'ma +2ing youses patches | 22:01 |
| morganfainberg | ayoung, tyvm. | 22:02 |
| ayoung | De Nada | 22:02 |
| morganfainberg | ayoung, i'll rebase them here shortly (out of date) | 22:02 |
| ayoung | morganfainberg, I like where it is headed | 22:02 |
| morganfainberg | ayoung, need to solve the domain idp issue and i can get the rest of them done | 22:02 |
| morganfainberg | ayoung, and as long as we all agree on it, i'm content with the direction (at this point as long as the solution isn't brittle, i'm happy) | 22:03 |
| ayoung | Heh...I think I've made my view on that topic clear. I'll leave it to you to do the right thing | 22:03 |
| morganfainberg | ayoung, as long as we can make it not-brittle, i'm ok with whichever direction. | 22:03 |
| morganfainberg | ayoung, so, i'll bug dolphm (hope everything is ok on that front) and folks tomorrow | 22:03 |
| morganfainberg | and we can get steve's fix rolling (either way). | 22:04 |
| morganfainberg | ayoung, this one: https://review.openstack.org/#/c/109041/ needs to go in before the others do. | 22:06 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove assignment controller dependency on token_api https://review.openstack.org/109162 | 22:07 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Expose token revocation list via token_provider_api https://review.openstack.org/109170 | 22:07 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove ec2 contrib dependency on token_api https://review.openstack.org/109173 | 22:07 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove trust dependency on token_api https://review.openstack.org/109462 | 22:07 |
| morganfainberg | henrynash, ok commented on it and added a -1, but if others see a benefit i wont re-add the -1 on subsequent patches | 22:08 |
| morganfainberg | ayoung, you have a fedora (modern vintage) handy right? | 22:08 |
| morganfainberg | ayoung, is there an apachectl or good way to know if apache 2.4 is installed instead of 2.2 in RHEL/Cent/Fedora ? | 22:08 |
| morganfainberg | short of "just knowing what ships with the distro" | 22:09 |
| morganfainberg | henrynash, or will zero the score as needed | 22:10 |
| *** amcrn has joined #openstack-keystone | 22:10 | |
| morganfainberg | ayoung, henrynash, second (unrelated) question: any opinion on a "attribute exists" policy rule language format (e.g. this token doesn't have domain_id but has project_id)? | 22:10 |
| *** bknudson has quit IRC | 22:11 | |
| ayoung | morganfainberg, Ah, so we are renaming the basic token API operations to be specifically token persistance. I like | 22:11 |
| morganfainberg | ayoung, yep! makes it a lot easier to control how we get tokens / interact with persistence | 22:11 |
| ayoung | morganfainberg, um....I would say that it would be a reject | 22:12 |
| ayoung | we need to explicitly match or reject | 22:12 |
| morganfainberg | so how do we say in the polcy language reject if the token is domains coped | 22:12 |
| *** henrynash has quit IRC | 22:12 | |
| ayoung | morganfainberg, rpm -q is the Fedora way | 22:13 |
| morganfainberg | there is no "does this exist" language in the rules engine | 22:13 |
| morganfainberg | or make sure XXX doesn't exist | 22:13 |
| ayoung | if you mean something that is outside of the RPM mechanism, it wouldn't be Fedora | 22:13 |
| morganfainberg | ayoung, ok so i'll need to make devstack be rpm-aware in that case, it's fine, just seeing if there was an `apachectl` analogue before doing that :) | 22:14 |
| ayoung | morganfainberg, the Oslo language is pretty clear | 22:14 |
| ayoung | oslo-policy that is | 22:14 |
| morganfainberg | ayoung, it is, but nova needs to say "domain scoped admin != admin" | 22:14 |
| ayoung | let me see | 22:14 |
| *** jorge_munoz has quit IRC | 22:14 | |
| morganfainberg | in their polcy.json | 22:14 |
| morganfainberg | right now they only check the role "admin" | 22:14 |
| ayoung | morganfainberg, right. We have that rule in the cloudsample | 22:15 |
| morganfainberg | this was a specific request to aid in the march towards v3 | 22:15 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json#n8 | 22:15 |
| morganfainberg | ayoung, we can match "rule:admin_required and domain_id:admin_domain_id but we can't say reject domain scoped tokens | 22:15 |
| david-lyle | fun fact, no users in devstack are bootstrapped with a domain scoped role (truestory) | 22:15 |
| ayoung | "cloud_admin": "rule:admin_required and domain_id:admin_domain_id", | 22:15 |
| morganfainberg | ayoung, thatis a positive match on a domain scoped token | 22:16 |
| david-lyle | well maybe a heat user, but that doesn't help much | 22:16 |
| ayoung | david-lyle, I think the current expected response is "Cool Story Bro" | 22:16 |
| ayoung | morganfainberg, right | 22:16 |
| morganfainberg | ayoung, nova wants a negative match e.g. reject all domain scoped tokens | 22:16 |
| morganfainberg | ayoung, or .. only allow project scoped tokens, regardless of project [other filtering is done] | 22:16 |
| ayoung | morganfainberg, then just enforce that the project_Id needs to match | 22:17 |
| david-lyle | ayoung, excellent | 22:17 |
| morganfainberg | ayoung, hmm. i think that breaks some other assumptions. | 22:17 |
| morganfainberg | ayoung, i'll have to dig further. | 22:17 |
| morganfainberg | ayoung, thanks | 22:17 |
| ayoung | What is the API they want to call? | 22:17 |
| ayoung | I mean, to say "you can call this on anything, so long as you have the admin role on any project" sounds suspect | 22:18 |
| morganfainberg | ayoung, all nova apis should by default (from the request I got) tell domain scoped tokens to go fly a kite | 22:18 |
| morganfainberg | but if it is a project scoped, admin is valid (backwards compat) even across projects | 22:18 |
| ayoung | Um. That is gross | 22:18 |
| morganfainberg | ayoung, it's a step towards real v3 support but we can't make the change all at once | 22:18 |
| ayoung | Why does that make sense to anyone. | 22:19 |
| morganfainberg | ayoung, right now it's if you have the amdin role (domain, project, whatever) you're admin | 22:19 |
| morganfainberg | except domain scoped tokens would break lots of things in wierd and subtle ways | 22:19 |
| ayoung | If Admin on project is acceptable, why wouldn't admin on domain be acceptable | 22:19 |
| *** huats has joined #openstack-keystone | 22:19 | |
| *** huats has quit IRC | 22:19 | |
| *** huats has joined #openstack-keystone | 22:19 | |
| morganfainberg | get a domain scoped token and try and boot an instance for example | 22:19 |
| morganfainberg | it just gets very odd | 22:19 |
| ayoung | You should be admin on the project that owns that instance | 22:19 |
| ayoung | not on all projects | 22:20 |
| morganfainberg | i agree. | 22:20 |
| morganfainberg | but that breaks backwards compat if we change that *now* | 22:20 |
| morganfainberg | since previously the default policy allowed it | 22:20 |
| ayoung | Why? | 22:20 |
| ayoung | They actually fetch the objects before they enforce policy | 22:20 |
| morganfainberg | if someone is using default policy and they upgrade and now can't act on things in their cloud, we get very grumpy/annoyed/angry deployers/users | 22:21 |
| morganfainberg | because the policy enforcer prevents it | 22:21 |
| ayoung | I'm missing something | 22:22 |
| morganfainberg | ayoung, it's ok, i'll see if i can make this work w/o breaking people initially | 22:23 |
| ayoung | If we said "admin is admin" and ignore the project in the token, it breaks...what? | 22:23 |
| ayoung | Policy, or are they trying to use policy to keep their code from breaking? | 22:23 |
| morganfainberg | ayoung, it's that there is a lot of assumption about projects existing in the context of the user | 22:23 |
| morganfainberg | ayoung, so domain scoped tokens are invalid to nova | 22:23 |
| morganfainberg | ayoung, and probably all projects *except* keystone intially | 22:23 |
| *** marcoemorais has quit IRC | 22:24 | |
| *** joesavak has joined #openstack-keystone | 22:24 | |
| *** marcoemorais has joined #openstack-keystone | 22:24 | |
| ayoung | then let them write a middleware that rejects them. But I suspect relying on policy to reject them across the board is going to fail | 22:24 |
| *** david-lyle has quit IRC | 22:24 | |
| morganfainberg | ayoung, i need to look at it a bit more closely, i'll ask again when i have a better idea of what is going on. | 22:24 |
| ayoung | cuz its goingto break before they get to policy | 22:24 |
| morganfainberg | ayoung, i suspect there is some kind of really crazy/bad assumption | 22:24 |
| *** david-lyle has joined #openstack-keystone | 22:25 | |
| *** david-lyle has quit IRC | 22:25 | |
| morganfainberg | ayoung, oh similar vein, should authcontextmiddleware decode the token or should keystone.wsgi? | 22:25 |
| morganfainberg | ayoung, when interacting with keystone | 22:25 |
| morganfainberg | ayoung, since we do it multiple times now :( | 22:25 |
| *** david-lyle has joined #openstack-keystone | 22:25 | |
| ayoung | morganfainberg ugh. Yeah, about time to have that discussion | 22:25 |
| *** bknudson has joined #openstack-keystone | 22:25 | |
| morganfainberg | ayoung, it's next on the hit list for token_api -> persistence | 22:26 |
| ayoung | OK...so we would ideally use auth_token middleware, but with local calls | 22:26 |
| morganfainberg | ayoung, assuming that is a longer-term end-goal | 22:26 |
| ayoung | so that the logic is written once and only once | 22:26 |
| ayoung | the steps are: | 22:26 |
| morganfainberg | ayoung, what would the initial case be as in, the short term token_api -> persistence and de-duping work | 22:26 |
| ayoung | 1. validate the signature | 22:26 |
| ayoung | 2. unpack | 22:26 |
| morganfainberg | ayoung, so we know where we can plug auth_token in more easily | 22:26 |
| ayoung | 3. check revocations | 22:26 |
| ayoung | auth_token can do all that, but it calls into the client to get data from the server | 22:27 |
| *** gordc has quit IRC | 22:27 | |
| ayoung | ideally, it would not reject a request due to no token, but we have an option for that. | 22:27 |
| ayoung | lets do it in authcontextmiddleware | 22:28 |
| morganfainberg | ayoung, ++ works for me. so w/o authcontextmiddleware we will not decode a token and basically be non-functional (i'm just making sure i plan the documentation "DO NOT REMOVE THIS FROM THE PIPELINE") | 22:28 |
| ayoung | morganfainberg, so....policy | 22:29 |
| *** david-lyle has quit IRC | 22:29 | |
| ayoung | that is currently handled by the controller base class | 22:30 |
| *** bknudson has quit IRC | 22:30 | |
| morganfainberg | ayoung, correct. | 22:30 |
| ayoung | and that is where the token is expected to be unpacked | 22:30 |
| morganfainberg | ayoung, it is expected to be unpacked by that point, but it does the unpacking | 22:30 |
| morganfainberg | ayoung, it could reference the auth_context of the request directly, which is populated by authcontextmiddleware | 22:30 |
| ayoung | right...and it should | 22:30 |
| ayoung | I cut a corner there as I recall | 22:31 |
| morganfainberg | ayoung, long term, it would be nice if we could move policy enforcement to middleware | 22:31 |
| morganfainberg | but that might be a hard sell | 22:31 |
| morganfainberg | s/hard sell/massive work across all projects/ | 22:31 |
| ayoung | I don't think we can. I think making it a common library in keystoneclient is more likely | 22:31 |
| ayoung | there is more logic in http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py#n156 | 22:32 |
| morganfainberg | ayoung, there is | 22:32 |
| ayoung | revoke by id ... http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py#n69 | 22:32 |
| ayoung | But that should be OK. We will have the ID and the unpacked token at that point. | 22:33 |
| morganfainberg | ayoung, well we can cross generic policy bridge as we get there. i'm just looking to de-dupe the get token, unpack it we currently are doing | 22:33 |
| ayoung | authcontext needs to reject an invalid token, but not enforce policy | 22:33 |
| morganfainberg | twice-ish on all requests | 22:33 |
| ayoung | yeah. | 22:33 |
| morganfainberg | ayoung, yeah that is easy enough to do. | 22:33 |
| morganfainberg | cool thanks | 22:33 |
| ayoung | if not CONF.token.revoke_by_id: | 22:34 |
| ayoung | self.token_api.token_provider_api.validate_token( | 22:34 |
| ayoung | context['token_id']) needs to move to middleware | 22:34 |
| morganfainberg | that was the way i was headed, but needed a sanity check / 2nd brain | 22:34 |
| ayoung | that was the mistake I made. It should not be in policy enforcement | 22:34 |
| morganfainberg | eh, we all make mistakes | 22:34 |
| morganfainberg | this one at least is an easy-ish fix | 22:34 |
| ayoung | Nah, I didn't have it clear at the time | 22:34 |
| ayoung | OK, so we are going to move the token fetch to... | 22:34 |
| morganfainberg | to authcontextmiddleware. | 22:35 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/middleware/core.py#n256 here is where I punted | 22:35 |
| morganfainberg | ayoung, yah | 22:35 |
| morganfainberg | we'll use that one (and i'll populate the context with the TokenModel i merged earlier) | 22:35 |
| ayoung | does your new code work around the cache issue I posted there? | 22:36 |
| morganfainberg | ayoung, validate token is way smarter than when that was written | 22:36 |
| morganfainberg | ayoung, it checks revocations and expiry | 22:36 |
| ayoung | OK, we should be good to go then. After authcontext middleware runs, the token is in the environment, and validate will accept the token data from there | 22:37 |
| morganfainberg | yeah. | 22:37 |
| ayoung | self.token_api.token_provider_api.validate_token( | 22:37 |
| ayoung | context['token_id']) validates based on ID | 22:37 |
| ayoung | yeah, that should be simple to merge now | 22:38 |
| ayoung | thanks for cleaning out this particular stable | 22:38 |
| *** thedodd has quit IRC | 22:41 | |
| *** jamielennox|away is now known as jamielennox | 22:42 | |
| *** joesavak has quit IRC | 22:43 | |
| *** bknudson has joined #openstack-keystone | 22:43 | |
| *** KimJ has quit IRC | 22:45 | |
| jamielennox | gyee: ugh, turns out that cinderclient is relying on specific behaviour from the errors in keystoneclient discovery | 22:47 |
| jamielennox | gyee: so if i make this change: https://review.openstack.org/#/c/107569/6/keystoneclient/_discover.py the gate fails | 22:48 |
| ayoung | Nice! | 22:48 |
| ayoung | jamielennox, sessions for auth token merged | 22:49 |
| jamielennox | ayoung: excellent, need to see if the 0.10 update has merged as well | 22:51 |
| ayoung | progress. | 22:51 |
| gyee | jamielennox, really?!! | 22:51 |
| jamielennox | gyee: yea, it's to do with that snippet you showed me | 22:51 |
| ayoung | jamielennox, BTW, I think you httpretty Exocism is mucking with my latest tests for scoped/unscoped...discovery is now failing in the test | 22:51 |
| ayoung | I'm in the process of rebasing, but | 22:52 |
| *** jaosorior has quit IRC | 22:52 | |
| jamielennox | gyee: https://github.com/openstack/python-cinderclient/blob/master/cinderclient/shell.py#L755-L777 | 22:52 |
| ayoung | + self.stub_auth(json=self.TEST_RESPONSE_DICT) | 22:52 |
| ayoung | - self.stub_url(method=httpretty.GET, body=self.TEST_DISCOVERY_RESPONSE) | 22:52 |
| ayoung | and that looks wrong... | 22:52 |
| ayoung | let me fix that | 22:52 |
| jamielennox | so httpretty.GET -> 'GET' | 22:53 |
| jamielennox | using json= rather than body= just means that the library does the JSON encode | 22:53 |
| jamielennox | gyee: so in gate there is the case where it is throwing a 404 error and so falling back to there other logic, if i change it to discovery error then it hits the except block and bails out | 22:54 |
| gyee | jamielennox, I see, so we have a bit of a decision to make | 22:54 |
| ayoung | jamielennox, it was https://review.openstack.org/#/c/106838/5/keystoneclient/tests/auth/test_identity_v3.py,cm | 22:55 |
| *** mrmoje has joined #openstack-keystone | 22:55 | |
| gyee | what does DiscoveryError covers? | 22:55 |
| bknudson | when I start devstack with ldap I get "ImportError: No module named ldappool" | 22:55 |
| jamielennox | ayoung: i've got 3 blog posts to write, one of them is an intro to requests-mock | 22:55 |
| ayoung | I assumed I need to hack off @httpretty.activate and change the httpretty.POST type values to "POST" | 22:55 |
| ayoung | jamielennox, I suspect you should add an equivalent to httpretty.POST | 22:56 |
| jamielennox | ayoung 'POST' | 22:56 |
| jamielennox | ayoung: i did | 22:56 |
| jamielennox | it just isn't released yet | 22:56 |
| ayoung | ah | 22:56 |
| jamielennox | i found a relatively major problem in the current release so i'll do another one soon | 22:56 |
| gyee | bknudson, ldappool is optional | 22:56 |
| bknudson | gyee: even if using ldap? | 22:57 |
| bknudson | did I turn it on somehow? | 22:57 |
| jamielennox | i'm just waiting for infra to approve the extra jobs because i want to test having -infra do the release rather than having to do it manually | 22:57 |
| ayoung | bknudson, yeah, pooling is optional | 22:57 |
| gyee | bknudson, no, what I mean is what's the process of adding optional requirements? | 22:57 |
| gyee | we have requirements.txt and test-requirements.txt | 22:57 |
| gyee | but no optional-requirements.txt | 22:57 |
| ayoung | jamielennox, is there a difference between 'POST' and 'post' and I assume we should use the all caps version? | 22:58 |
| jamielennox | ayoung: there's no difference, just http typically uses the uppercase | 22:58 |
| *** bobt_ has quit IRC | 22:59 | |
| jamielennox | ayoung: i've actually found a better option that looks much more requests-y, instead of doing register_uri('POST', ... i just added a method .post() | 22:59 |
| *** jorge_munoz has joined #openstack-keystone | 22:59 | |
| bknudson | gyee: there must be someplace in devstack where it installs extra packages... | 22:59 |
| ayoung | jamielennox, Something is different in how it is processing the Version data | 23:00 |
| ayoung | the response looks like a valid response to me, but | 23:00 |
| ayoung | body_resp = resp.json() | 23:00 |
| ayoung | gets a value error | 23:00 |
| jamielennox | ayoung: paste the error and the diff for me | 23:00 |
| jamielennox | gyee: can you have a look at your -1 on https://review.openstack.org/#/c/107333/ | 23:00 |
| ayoung | jamielennox, running with tox is causing major spew, to the point that I can't find it. I 'm in the debugger at the moment... | 23:00 |
| jamielennox | that's the unscoped catalog one | 23:00 |
| gyee | jamielennox, so cinder makes a distinction between DiscoveryError and HTTP error | 23:01 |
| gyee | DiscoveryFailure means API is there but the response body is wrong | 23:01 |
| jamielennox | if we kill the proposal then that's ok, but i've got like 4 weeks before i disappear for a while so i need to get that and https://review.openstack.org/#/c/107325/ moving if they are to be done for juno | 23:01 |
| ayoung | jamielennox, I'll paste the code I'm running through | 23:01 |
| jamielennox | gyee: yep - which i had thought was a feature, i had let them be different on purpose | 23:02 |
| gyee | jamielennox, I'll change it to +0, I am not going to block it, but I am not sure if we really need it either | 23:02 |
| jamielennox | mostly because a ConnectionError might be different | 23:02 |
| jamielennox | gyee: that's ok - it turns people off reviewing when it's got a -1 though | 23:02 |
| ayoung | jamielennox, http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/_discover.py#n36 is the code I'm calling | 23:03 |
| ayoung | I'll paste the test | 23:03 |
| jamielennox | gyee: so what do you think we should do? if cinderclient is relying on that behaviour i'm not sure what option we have | 23:04 |
| ayoung | OK...I figured out the first mistake | 23:05 |
| gyee | jamielennox, how about catching just 404 and raise a DiscoveryNotSupported exception | 23:05 |
| jamielennox | gyee: if DiscoverNotSupported is a subclass of DiscoveryError then it will still fail the cinder case | 23:05 |
| gyee | everything else would constitute DiscoveryFailure | 23:05 |
| jamielennox | and if we do just that one case it would seem more logical to me to just let people catch the 404 error | 23:06 |
| gyee | won't be a subclass | 23:06 |
| ayoung | jamielennox, the code looks like this http://paste.openstack.org/show/91235/ | 23:06 |
| ayoung | its failing on line 26 | 23:06 |
| gyee | we basically need to be able to distinguish API not supported versus some other error | 23:06 |
| jamielennox | ayoung: you don't want body=, if it's a dict you want json= if it's a string you want text=, | 23:07 |
| jamielennox | gyee: yes, but we can do that now by catching DiscoveryError and HttpError seperately | 23:08 |
| gyee | jamielennox, alrighty then | 23:08 |
| jamielennox | gyee: i'm not advocating it - it's not ideal, but i think the best way around it is to document and require the current behaviour | 23:09 |
| jamielennox | it's not wrong, you just have to be aware of what can be thrown | 23:09 |
| *** jorge_munoz has quit IRC | 23:09 | |
| ayoung | jamielennox, OK, its probably something along those lines. I'll dig in after dinner | 23:09 |
| gyee | jamielennox, make sense | 23:09 |
| gyee | ayoung, you dig in during dinner :) | 23:09 |
| *** jorge_munoz has joined #openstack-keystone | 23:10 | |
| jamielennox | ayoung, gyee: do you guys want to have a look at https://review.openstack.org/#/c/107222/ for me | 23:10 |
| jamielennox | be strict - this will have a huge impact on how middleware works | 23:10 |
| ayoung | jamielennox, I need to wrap my head around that. Its ringing alarm bells, but might just be the Dinner bell | 23:12 |
| gyee | jamielennox, I actually like that patch | 23:12 |
| jamielennox | ayoung: no problem, i'm going to line up a few client/middleware patches for you and gyee | 23:12 |
| gyee | no different than passing logger and memcache object in the env | 23:12 |
| jamielennox | gyee: it will be really good to have landed | 23:12 |
| jamielennox | it means the service won't have to deal with headers at all, just make a session with the provided auth plugin | 23:12 |
| jamielennox | and pass that to whatever client they want | 23:13 |
| gyee | hell yeah! | 23:13 |
| jamielennox | gyee: it's taken me a long time, but the session and plugin stuff is finally getting to the point i initially wanted | 23:14 |
| gyee | jamielennox, ++, next make the service user auth using verson-agnostic auth plugin | 23:15 |
| jamielennox | gyee: i've got the plugin in review, and prototype's for the service user | 23:16 |
| jamielennox | i spun up a new devstack yesterday to try it out | 23:16 |
| gyee | nice! | 23:17 |
| jamielennox | easy code review along that path: https://review.openstack.org/#/c/111655/ | 23:18 |
| gyee | jamielennox, are you going to backout that change to unbreak cinder? I can review it real quick | 23:18 |
| jamielennox | gyee: yep | 23:18 |
| jamielennox | i'll do it now | 23:18 |
| gyee | thanks! | 23:18 |
| ayoung | ok, I'm tracking... | 23:20 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Make token_provider_api contain token persistence https://review.openstack.org/109041 | 23:23 |
| morganfainberg | bknudson, hah, i feel dumb for the exception remove / move / readd screwup in that big patchchain. :P | 23:28 |
| bknudson | morganfainberg: now you can see why I was confused about it | 23:29 |
| morganfainberg | bknudson, totally | 23:29 |
| morganfainberg | bknudson, this has been one of the largest patch chain's i've had to manage in a while. i just stopped piling things on top of this change until i get it through cause it's giving me a headache trying to keep track of it all | 23:30 |
| morganfainberg | (and the rebasing) | 23:30 |
| morganfainberg | but at least i hope i'm keeping the patchest small enough to be reviewable. | 23:30 |
| bknudson | morganfainberg: it's harder when you try to fan-out | 23:30 |
| morganfainberg | bknudson, yeah. | 23:31 |
| *** gokrokve has quit IRC | 23:32 | |
| *** gokrokve has joined #openstack-keystone | 23:32 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Isolate get_discovery function https://review.openstack.org/107569 | 23:32 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow unauthenticated discovery https://review.openstack.org/107570 | 23:32 |
| jamielennox | gyee: ^ i changed it slightly, i moved all of the except handling into the one place | 23:32 |
| jamielennox | i think that way it is more consistent at least | 23:33 |
| jamielennox | everyone has to deal with HTTPError vs DiscoveryError, not just people consuming that one function | 23:33 |
| gyee | jamielennox, yeah, I think that's fine | 23:34 |
| jamielennox | bknudson: i fixed up an issue i saw on https://review.openstack.org/#/c/102355/6 and am hassling cinder-core to push it through | 23:35 |
| bknudson | jamielennox: what's the issue? | 23:36 |
| jamielennox | bknudson: you added keystonemiddleware but didn't remove keystoneclient from the dependencies | 23:36 |
| jamielennox | i did check, they didn't have any other uses of it | 23:36 |
| bknudson | jamielennox: ah... I suppose most of the projects don't use keystoneclient directly or have a use for it. | 23:37 |
| jamielennox | yep, most just use it for auth_token | 23:37 |
| bknudson | jamielennox: it's +A already | 23:40 |
| jamielennox | bknudson: yea, i just got thingee to look at it in #cinder | 23:40 |
| jamielennox | bknudson: there's some testing i want to do that requires it, i wrote my own patch for the conversion and then realized you had one | 23:41 |
| bknudson | jamielennox: looks like that's the last one for keystonemiddleware. | 23:41 |
| bknudson | oh, wait... | 23:41 |
| bknudson | still have marconi, heat, and ironic | 23:41 |
| bknudson | https://review.openstack.org/#/q/status:open+branch:master+topic:keystonemiddleware,n,z | 23:41 |
| bknudson | jamielennox: do you need it in all the projects first? | 23:43 |
| jamielennox | bknudson: wow, you did everybody, i don't generally get that far out into the non core projects | 23:43 |
| jamielennox | bknudson: nah, basically i wanted cinder, nova and glance | 23:43 |
| bknudson | jamielennox: yah, I'm crazy | 23:43 |
| jamielennox | anyone else is a bonus | 23:43 |
| jamielennox | did trove do the convert? | 23:43 |
| bknudson | http://git.openstack.org/cgit/openstack/trove/tree/etc/trove/api-paste.ini#n17 | 23:44 |
| jamielennox | they were the ones that were causing the problem with defining both a username/password and admin token in the gate that meant i couldn't land those changes in keystoneclient.auth_token | 23:44 |
| jamielennox | i had a patch that landed in trove/stable that should have fixed it but i didn't chase up | 23:44 |
| jamielennox | seems it worked though :) | 23:45 |
| bknudson | gyee fixed trove | 23:45 |
| jamielennox | see keystone isn't insular - we help everybody | 23:46 |
| jamielennox | i got a rant the other day at a openstack mini-conf that keystone doesn't tell everyone about the changes we make, we just expect people to adopt what we tell them | 23:46 |
| *** ncoghlan has joined #openstack-keystone | 23:47 | |
| morganfainberg | jamielennox, so they want us to build everything by committee, polling the entire community? | 23:47 |
| morganfainberg | jamielennox, :P | 23:47 |
| jamielennox | morganfainberg: not sure, but they wanted us to explain our changes better - though in my experience when you start explaining changes in auth you can see peoples eyes glaze over | 23:48 |
| morganfainberg | jamielennox, yeah so, we're implementing plugins to make it so .. wah wah wha wah wah wah wah... wah wha wah wah.. wah wah... wah wah wah... wah wah wah wah wah... </peanuts> | 23:49 |
| morganfainberg | "but you didn't tell us you were doing that!!!" uh.. yes we did, you just tuned it out | 23:49 |
| jamielennox | morganfainberg: heh, yep | 23:49 |
| jamielennox | still, i need to write up my stuff more | 23:50 |
| morganfainberg | i should "fix" my blog (it died) | 23:51 |
| morganfainberg | i have like 5 or six things to write up. | 23:51 |
| jamielennox | died? | 23:52 |
| jamielennox | i go through periods of how interested i am in it, but it shouldn't die | 23:52 |
| *** amcrn has quit IRC | 23:57 | |
| *** amcrn has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!