| *** rkofman has quit IRC | 00:20 | |
| *** zzzeek has quit IRC | 00:20 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow unauthenticated discovery https://review.openstack.org/107570 | 00:20 |
|---|---|---|
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 00:20 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow providing a default value to CLI loading https://review.openstack.org/113742 | 00:20 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Version independent plugins https://review.openstack.org/81147 | 00:20 |
| *** zzzeek has joined #openstack-keystone | 00:25 | |
| *** zzzeek has quit IRC | 00:26 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Fix handling of deprecated opts in CLI https://review.openstack.org/113859 | 00:28 |
| *** richm has left #openstack-keystone | 00:30 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Replace httpretty with requests-mock https://review.openstack.org/112777 | 00:32 |
| *** rwsu has quit IRC | 00:42 | |
| gyee | morganfainberg, want to have a pow wow on https://review.openstack.org/#/c/107873/? | 00:50 |
| gyee | I have the medicine bag | 00:51 |
| *** rwsu has joined #openstack-keystone | 00:55 | |
| *** rwsu has quit IRC | 00:57 | |
| *** rwsu has joined #openstack-keystone | 00:58 | |
| *** gokrokve has joined #openstack-keystone | 01:00 | |
| *** ayoung_is_a_Dad is now known as ayoung | 01:04 | |
| *** Dafna has quit IRC | 01:07 | |
| *** amcrn has quit IRC | 01:10 | |
| *** Krast has quit IRC | 01:17 | |
| *** Krast has joined #openstack-keystone | 01:17 | |
| *** Dafna has joined #openstack-keystone | 01:28 | |
| *** Dafna has quit IRC | 01:28 | |
| *** Dafna has joined #openstack-keystone | 01:29 | |
| ayoung | _elmiko, ugh, and the proxy users are in a different domain than the user that did the GET? | 01:30 |
| ayoung | morganfainberg, the "load by classname" method still works | 01:31 |
| ayoung | THe unit tests depend on that | 01:31 |
| morganfainberg | ayoung, not mixed | 01:31 |
| ayoung | morganfainberg, yeah, the method is external to the plugin | 01:32 |
| morganfainberg | ayoung, e.g. if you use one of plugins without the .method attr, it wont wonk | 01:32 |
| morganfainberg | work* | 01:32 |
| ayoung | lets see... | 01:32 |
| morganfainberg | so we should probably remove the load-by-class path | 01:32 |
| morganfainberg | it's suboptimal in my opinion, but eh, | 01:32 |
| ayoung | morganfainberg, however, to be fair, that method was not documented, and I wasn't aware we were doing it. | 01:33 |
| morganfainberg | i just don't want to force using one over the other or make it so it sortof works one way, if that makes sense | 01:33 |
| ayoung | AI agree, but not in this patch | 01:33 |
| ayoung | this is the minimal viable patch here | 01:33 |
| morganfainberg | in this patch at least *deprecate* (warning message) | 01:33 |
| morganfainberg | that load by class-name | 01:33 |
| ayoung | not in this patch. It doesn't belong here | 01:33 |
| ayoung | this is only removing a restriction that is unnecessary | 01:34 |
| morganfainberg | ayoung, you are breaking the consistency, it does | 01:34 |
| ayoung | no I am not | 01:34 |
| ayoung | load by class name works fine | 01:34 |
| morganfainberg | yes you are, if a plugin that the method is external to it is used it *cannot* be loaded by classname | 01:34 |
| ayoung | let me show you... | 01:34 |
| morganfainberg | because the conf.get() wont work | 01:34 |
| morganfainberg | erm wont be used | 01:34 |
| morganfainberg | and it would fail w/o the .method attr | 01:35 |
| ayoung | hrm | 01:35 |
| ayoung | ah...I remember | 01:35 |
| ayoung | right, this is not forcing one or the other. | 01:35 |
| morganfainberg | line 55 would fail in the load-by-class name | 01:35 |
| ayoung | it is just making it so you don't *HAVA* to have the method | 01:35 |
| ayoung | and nothing said that we did | 01:35 |
| ayoung | so who made this mess> | 01:36 |
| ayoung | ? | 01:36 |
| morganfainberg | ayoung, that was an oversight when i implemented it. honestly, my intention was to move 100% to class-name loading | 01:36 |
| ayoung | I don't recall that from the original auth plugin design, was it added later? | 01:36 |
| morganfainberg | and it was done as part of the having to list the auth methods then a class separatly was awful to support | 01:37 |
| morganfainberg | so, my mistake on missing the documentation :( | 01:37 |
| ayoung | ok, I missed all of that discussion, and would have recommended a different approach | 01:37 |
| morganfainberg | i'm fine walking away from that method but we should say clearly "do not use this" if we accept this patch | 01:37 |
| ayoung | but, water under the breidge | 01:37 |
| morganfainberg | accept yours that is. | 01:37 |
| ayoung | lets break the "have to" as that is the thing holding up the Mapping and Kerberos efforts | 01:37 |
| morganfainberg | put a "hey don't use this method" in and i'm fine with your patch | 01:38 |
| morganfainberg | otherwise i am not. | 01:38 |
| ayoung | Where do I puth that? It is not in the documentation that you *can* do that | 01:38 |
| morganfainberg | log.warning | 01:38 |
| ayoung | hmmm, what is left that does do method.... | 01:38 |
| morganfainberg | 'loading by classname is deprecated in Juno and slated to be removed in I; | 01:39 |
| ayoung | I think itis token and password that we use in the unit tests | 01:39 |
| morganfainberg | just put it in around line 58 when plugin_name = driver.method | 01:39 |
| morganfainberg | ayoung, maybe. i think a lot of that can be cleaned up because we changed the defaults (can be explored/fixed post this patch) | 01:39 |
| ayoung | is doing it as a comment OK? I don't really want to spam the logs, as this will only show in the unit tests | 01:40 |
| ayoung | *I* didn't know about this, I doubt few people outside of core did | 01:40 |
| morganfainberg | i'll commit to fixing the tests tomorrow if you put it as a log please. | 01:40 |
| ayoung | DEAL! | 01:40 |
| morganfainberg | or i'll fix it tomorrow and we can rebase your patch on top | 01:40 |
| ayoung | And it doesn';t have to be tomorrow | 01:40 |
| morganfainberg | either way | 01:40 |
| ayoung | I'll fix now | 01:40 |
| morganfainberg | ++ | 01:40 |
| morganfainberg | yeah not a big deal to fix i think, just really don't want people to look at tests assume this code is doing things correctly loading that way. | 01:41 |
| morganfainberg | and i'm fine walking away from that method of loading auth plugins (yeah missing the doc was my mistake :( ) | 01:41 |
| *** gokrokve has quit IRC | 01:44 | |
| ayoung | morganfainberg, the fact is, most of the plugins should go away, and we will be left with the mapping plugin for all of them. Even Password could be replaced with and external one if we moved over to basic auth. That really just leaves token. | 01:45 |
| ayoung | So, Password, Token, and Mapping. | 01:46 |
| morganfainberg | ayoung, yeah we might be able to make things a bit more sane and still allow people to specify their own auth plugins | 01:47 |
| ayoung | morganfainberg, what I'm seeing is the "method" part is usually more part of the network setup, or, like in the case of SAML, stuff that happens external to Keystone, than anything that really needs to be handled by the keystone python code | 01:48 |
| _elmiko | ayoung: https://gist.github.com/elmiko/647f21b2bd08599695cd | 01:49 |
| _elmiko | that was the output from the call | 01:49 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Enhance V3 routers to store basic resource description https://review.openstack.org/111573 | 01:49 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Provide the V3 routers to the V3 extension controller https://review.openstack.org/111574 | 01:49 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Enhance V3 version controller to provide JSON Home response https://review.openstack.org/111575 | 01:49 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Change V3 router classes to provide JSON Home data https://review.openstack.org/111576 | 01:49 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Enhance V3 extensions to provide JSON Home data https://review.openstack.org/103983 | 01:49 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Change the sub-routers to provide JSON Home data https://review.openstack.org/111577 | 01:49 |
| ayoung | morganfainberg, how's this for a message 'Loading auth-plugins by class-name is deprecated.' | 01:49 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Change OS-INHERIT extension to provide JSON Home data https://review.openstack.org/111578 | 01:49 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Enhance V3 extension class to integrate JSON Home data https://review.openstack.org/111579 | 01:49 |
| morganfainberg | ayoung, works for me | 01:49 |
| _elmiko | ayoung: line 148 is where the proxy user begins | 01:50 |
| ayoung | _elmiko, I'm sorry, I can't refer to you exterannally. The _ at the beginning of your name indicates you are a module private variable | 01:50 |
| _elmiko | rofl! | 01:51 |
| *** _elmiko is now known as elmiko | 01:51 | |
| elmiko | i thought we were within module scope in this channel? | 01:51 |
| ayoung | Nah, just package | 01:51 |
| elmiko | nice | 01:51 |
| ayoung | elmiko, that might be a bug. I'm not sure, but I thought the code was supposed to limit the list_users to only users of the same domain as the requestor unless specifically stated | 01:52 |
| elmiko | ayoung: i could try updating my keystone, it's probably a few weeks old | 01:52 |
| elmiko | i've become gunshy of running reclone=yes for devstack | 01:53 |
| ayoung | elmiko, don't bother | 01:53 |
| ayoung | this would have happend a long time back | 01:53 |
| elmiko | k | 01:53 |
| ayoung | its not just a multi-dom issue | 01:53 |
| *** amerine_ has joined #openstack-keystone | 01:54 | |
| ayoung | elmiko, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py#n559 that code there seems to be written to figure out what domain to list for | 01:54 |
| ayoung | so maybe it is the sql backend not honoring it | 01:55 |
| elmiko | not filtering the domain properly? | 01:56 |
| *** amerine has quit IRC | 01:56 | |
| ayoung | elmiko, yeah. we have this whole 'hints' architecture | 01:56 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/sql.py#n118 | 01:56 |
| *** amerine__ has joined #openstack-keystone | 01:56 | |
| ayoung | my guess is this is supposed to be a hint, but it never made it...looking | 01:56 |
| ayoung | refs = self.identity_api.list_users( | 01:57 |
| ayoung | domain_scope=self._get_domain_id_for_list_request(context), | 01:57 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/controllers.py#n218 | 01:57 |
| ayoung | so it is always called with a domain id | 01:57 |
| ayoung | driver = self._select_identity_driver(domain_scope) | 01:57 |
| ayoung | Ah...I think I see the breakdown | 01:58 |
| ayoung | nah, sql should be domain aware... | 01:58 |
| *** amerine_ has quit IRC | 02:00 | |
| elmiko | i was using an admin generated auth token for the request, would that matter? | 02:01 |
| ayoung | elmiko, well, file that as a bug and we can chase it down. The code looks right to me to a first approximation | 02:01 |
| ayoung | maybe | 02:01 |
| elmiko | ayoung: i'll file a bug though | 02:01 |
| ayoung | it should have failed if it was AUTH_TOKEN | 02:01 |
| ayoung | or ADMIN_TOKEN | 02:01 |
| ayoung | elmiko, this was a real user or using admin_token? | 02:02 |
| elmiko | i did a `keystone token-get` on the admin user, then used that token | 02:02 |
| elmiko | it's a real account though, i can login through horizon and whatnot | 02:02 |
| ayoung | elmiko that user should be in the default domain, and the query should be limited to the default domain | 02:03 |
| ayoung | elmiko, is the system available? | 02:03 |
| elmiko | that user is definitely in the default domain | 02:03 |
| elmiko | no, it's a default devstack running on my laptop | 02:03 |
| ayoung | I'd like to step through the code and see what is failing | 02:03 |
| ayoung | ok, wanna step through it for me? Its cool | 02:04 |
| elmiko | sure, where to start? | 02:04 |
| ayoung | you need remote-pdb | 02:04 |
| ayoung | either pip install or rpm | 02:04 |
| ayoung | I think I used pip | 02:04 |
| *** ncoghlan has joined #openstack-keystone | 02:05 | |
| elmiko | surprised it isn't in yum | 02:05 |
| ayoung | elmiko, it might be, just don't know what it is named | 02:05 |
| ayoung | yum search remote-pdb turned up bupkiss | 02:05 |
| elmiko | yea | 02:05 |
| ayoung | then it is | 02:05 |
| elmiko | even yum search pdb wasn't much better | 02:05 |
| elmiko | i got it through pip | 02:06 |
| ayoung | edit the file where you want to break, which in this case would be in keystone/identity/controller.py | 02:06 |
| ayoung | AT line... | 02:06 |
| elmiko | k | 02:06 |
| ayoung | 216 | 02:06 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/controllers.py#n216 | 02:06 |
| elmiko | hmm | 02:06 |
| ayoung | and put this in there | 02:07 |
| elmiko | this is devstack, i need to attach to the screen console and do everything from there? | 02:07 |
| ayoung | from remote_pdb import RemotePdb | 02:07 |
| ayoung | nope...I'll show you | 02:07 |
| elmiko | k | 02:07 |
| ayoung | RemotePdb('0.0.0.0', 4444).set_trace() | 02:07 |
| ayoung | those two lines will stop the program and get it to listen on port 4444 | 02:07 |
| ayoung | then telnet localhost 4444 | 02:08 |
| ayoung | and you have a pdb session | 02:08 |
| ayoung | told you it was cool | 02:08 |
| elmiko | very nice | 02:08 |
| elmiko | my pdb skills are kinda rusty | 02:08 |
| ayoung | yeah, so'r mine | 02:10 |
| ayoung | elmiko, you do need to restart httpd | 02:10 |
| *** rushiagr_away is now known as rushiagr | 02:11 | |
| elmiko | ok, don't i need to stop the running keystone and this one installed? | 02:11 |
| elmiko | er, get this one | 02:11 |
| ayoung | elmiko, its in httpd now | 02:13 |
| ayoung | so make that edit in /opt/stack/keystone or whereever you put it, and restart httpd. | 02:13 |
| ayoung | It runs out of tree | 02:14 |
| elmiko | ok | 02:14 |
| *** gokrokve has joined #openstack-keystone | 02:14 | |
| elmiko | wow, crazy... | 02:14 |
| elmiko | ok, telnetting | 02:14 |
| elmiko | i'm in | 02:15 |
| elmiko | ayoung: it stopped me in a weird place | 02:15 |
| elmiko | or i should unexpected | 02:16 |
| ayoung | elmiko, keep your personal problems to yourself | 02:16 |
| ayoung | oh | 02:16 |
| elmiko | lol | 02:16 |
| ayoung | might have been a wrapper, | 02:16 |
| ayoung | _get_attr thing? | 02:16 |
| elmiko | i'm in keystone.common.controller@469 | 02:17 |
| elmiko | ok, guess i'm at the beginning of build_driver_hints | 02:17 |
| *** gokrokve has quit IRC | 02:19 | |
| morganfainberg | ayoung, http://paste.openstack.org/show/94760/ i *think* this will solve the subsecond issue with mysql on revocation events | 02:21 |
| ayoung | Wow, I haven't had to write a SQL migration in a long time. I'm OK with that | 02:22 |
| ayoung | code look good | 02:23 |
| ayoung | elmiko, you waiting on me? Here;s the goal | 02:23 |
| ayoung | step through and see if the hints get built at all. | 02:23 |
| elmiko | ayoung: trying, i just borked it up though lol | 02:23 |
| ayoung | and eventaully you will end up in the sql driver....you might even want to preposition a breakpoint at the list_users call | 02:23 |
| elmiko | i know you said leave my personal life out of it, but i CAN'T | 02:23 |
| ayoung | which it | 02:23 |
| ayoung | which is | 02:23 |
| ayoung | keystone/identity/backends/sql.py line 119 | 02:24 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/sql.py#n119 | 02:24 |
| morganfainberg | ayoung, i'm going to test it locally first, but going to post it to see if CI freaks out on it | 02:24 |
| morganfainberg | as well | 02:25 |
| ayoung | morganfainberg, ++++++ | 02:25 |
| morganfainberg | longer term using expires_at like we do is bad (talked this over with Mike, SQLAlchemy dude), we're effectively using a timestamp as a PK (alittle more complex) we should evaluate moving to a uuid or something that is non-secure that doesn't have this type of issue | 02:26 |
| morganfainberg | not that we can drop expires at immidiately, but we could in theory convert over to uuid and use it instead moving forward | 02:26 |
| morganfainberg | expires_at (in the event that is) | 02:27 |
| elmiko | ayoung: so at keystone.identity.controllers line 220, i've got a hints object | 02:27 |
| ayoung | whats it look like | 02:27 |
| *** ncoghlan is now known as ncoghlan_afk | 02:28 | |
| ayoung | print hints | 02:28 |
| elmiko | kinda lumpy | 02:28 |
| elmiko | <keystone.common.driver_hints.Hints object at 0x7f4dbe4232d0> | 02:28 |
| elmiko | hints.filters=[] | 02:28 |
| ayoung | so no filters set | 02:28 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes an issue with the XMLEquals matcher https://review.openstack.org/109177 | 02:29 |
| ayoung | elmiko, is that before the call to the driver? | 02:29 |
| ayoung | refs = self.identity_api.list_users( | 02:29 |
| *** rushiagr is now known as rushiagr_away | 02:30 | |
| ayoung | I assume the breakpoint pushed the line numbers up a couple | 02:30 |
| elmiko | i think it might have been after | 02:30 |
| elmiko | i'm having a problem with the telnet session returning on a continue | 02:30 |
| jamielennox | ayoung, morganfainberg: there are at least two patches in a series starting here: https://review.openstack.org/#/c/112563 that are a fairly simple code move ~50 lines changed | 02:32 |
| jamielennox | do you guys mind taking a look quickly - if i can get those merged i don't have to do a giant rebasing | 02:32 |
| ayoung | yeah, that happend to me. I ended up killing the session and reconnecting | 02:32 |
| ayoung | jamielennox, both look good | 02:34 |
| elmiko | ayoung: keystone/common/controller.py@485, hints=[] and query_dict={} looks like what's going on | 02:35 |
| *** stevemar has joined #openstack-keystone | 02:36 | |
| jamielennox | ayoung: cheers, i have so many small patches but all relating to a common goal - if i put them in series though then they all get stuck waiting for a nit in the base one | 02:37 |
| ayoung | no query string, so we would only be looking at the hints array | 02:37 |
| ayoung | elmiko, but I think it would be later | 02:38 |
| ayoung | that returns nothing, as expected | 02:38 |
| ayoung | refs = self.identity_api.list_users( gets called with the domain id | 02:38 |
| ayoung | elmiko, can you step into identity/core.py? | 02:39 |
| ayoung | the code that I am wondering about now is the call http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/core.py#n592 | 02:39 |
| ayoung | as that should turn the domain scope into a hint | 02:39 |
| elmiko | ayoung: the call to list_users? | 02:39 |
| ayoung | in that call, yes | 02:39 |
| ayoung | elmiko, alternatively, you could put a breakpoint in the sql driver at list_users and see if ther are any hints | 02:40 |
| elmiko | k, i'll get there | 02:40 |
| ayoung | if there are, then we know the problem is the sql driver | 02:40 |
| ayoung | if they are not there, the problem is this call | 02:40 |
| jamielennox | i realize it's not really something that git can do but i'd love it if a gerrit patch could have multiple dependencies. A lot of these changes don't depend on each other in anyway but they all need to be merged before some larger changes | 02:41 |
| jamielennox | my only choice now is to put them all in sequentially | 02:41 |
| elmiko | ayoung: looks like also, i don't have CONF.identity.domain_specific_drivers_enabled, which causes a return from _get_domain_id_for_list_request | 02:42 |
| ayoung | ACHA! | 02:42 |
| elmiko | ayoung: is that my goof for not setting it up, or should that function return the domain regardless of the conf setting? | 02:43 |
| ayoung | so...probably a bug, too, as the list_users should be scoped to domain\ | 02:45 |
| ayoung | elmiko, butyeah, you are going to want that to be set. I should have thought of that. | 02:45 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Update AuthContextMiddleware to not use token_api https://review.openstack.org/113429 | 02:46 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not overwrite token expires with lower resolution https://review.openstack.org/114103 | 02:46 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Convert (for mysql) revocation events expires_at to varchar https://review.openstack.org/114104 | 02:46 |
| elmiko | ayoung: this should always be set for the use case we are considering? | 02:46 |
| ayoung | elmiko, yeah | 02:46 |
| elmiko | ayoung: ok, good to know. | 02:46 |
| ayoung | I don't think there is any hard to setting it. It mightr slow down certain domain operations, if no domain_specific drivers are set | 02:47 |
| elmiko | i'm trying to compile all these notes to make sure i have the documentation details correct | 02:47 |
| elmiko | the thing is, once this change goes into sahara, then users who want to use swift will need to have this configuration. | 02:47 |
| ayoung | elmiko, yep | 02:48 |
| elmiko | security comes at a cost | 02:48 |
| ayoung | elmiko, so try setting that value and doing the search, and you should not see the sahara users | 02:49 |
| ayoung | elmiko, https://bugs.launchpad.net/keystone/+bug/1356682 | 02:50 |
| uvirtbot | Launchpad bug 1356682 in keystone "GET /v3/users lists users in all domains" [Undecided,New] | 02:50 |
| ayoung | please add whatever info you have that is relevant | 02:50 |
| elmiko | ayoung: will do | 02:50 |
| ayoung | elmiko, I copied in your gist | 02:51 |
| elmiko | ayoung: ok, cool | 02:51 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Do not require method attribute on plugins https://review.openstack.org/107873 | 02:52 |
| elmiko | ayoung: it looks like the fix is just to remove that line, should i test a little and offer a patch? | 02:52 |
| ayoung | morganfainberg, ^^ was waiting on tox. | 02:52 |
| ayoung | yes | 02:53 |
| ayoung | elmiko, that would be superb | 02:53 |
| elmiko | ayoung: happy to help :) | 02:53 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not overwrite token expires with lower resolution https://review.openstack.org/114103 | 02:55 |
| morganfainberg | ayoung, +2. | 02:55 |
| ayoung | gyee, care to re +2 that one? | 02:56 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Convert (for mysql) revocation events expires_at to varchar https://review.openstack.org/114104 | 02:58 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Update AuthContextMiddleware to not use token_api https://review.openstack.org/113429 | 02:58 |
| morganfainberg | ok now that ci is chewing on that i need to go setup an env to test this migration a bit more in depth | 02:58 |
| *** rkofman has joined #openstack-keystone | 03:04 | |
| *** topol has joined #openstack-keystone | 03:06 | |
| elmiko | ayoung: is it possible that the auth token i'm generating has no domain id associated with it? | 03:10 |
| elmiko | ayoung: shouldn't it default to the user's domain | 03:10 |
| ayoung | elmiko, it seems to me that is the case | 03:13 |
| ayoung | elmiko, I'm going to crash | 03:13 |
| ayoung | late here | 03:13 |
| elmiko | ayoung: k, may be another bug here too | 03:13 |
| ayoung | ++ | 03:13 |
| *** ayoung has quit IRC | 03:13 | |
| *** elmiko is now known as _elmiko | 03:16 | |
| dstanek | any reason not to just mark this as 'fixed released' for Keystone? https://bugs.launchpad.net/keystone/+bug/1277104 | 03:20 |
| uvirtbot | Launchpad bug 1277104 in python-openstackclient "wrong order of assertEquals args " [Low,In progress] | 03:20 |
| morganfainberg | dstanek, probably can just mark it | 03:21 |
| morganfainberg | dstanek, i have no reason not to | 03:21 |
| *** spandhe_ has quit IRC | 03:22 | |
| *** gokrokve has joined #openstack-keystone | 03:25 | |
| *** ncoghlan_afk is now known as ncoghlan | 03:25 | |
| *** spandhe_ has joined #openstack-keystone | 03:28 | |
| *** gokrokve has quit IRC | 03:29 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: Add SAML generation route to OS-FEDERATION https://review.openstack.org/113998 | 03:34 |
| *** ncoghlan is now known as ncoghlan_afk | 03:35 | |
| *** spandhe_ has quit IRC | 03:41 | |
| *** toddnni_ has joined #openstack-keystone | 03:48 | |
| gyee | ah, I see ayoung and morganfainberg got it all figured out :) | 03:49 |
| *** jraim__ has joined #openstack-keystone | 03:49 | |
| *** KanagarajM has joined #openstack-keystone | 03:51 | |
| KanagarajM | Hi, i have submitted the patch https://review.openstack.org/#/c/113183/ for the blue print "endpoint table is missing reference to region table". Could you please review it. Thanks. | 03:52 |
| *** jraim has quit IRC | 03:52 | |
| *** radez_g0n3 has quit IRC | 03:52 | |
| *** lbragstad has quit IRC | 03:52 | |
| *** toddnni has quit IRC | 03:52 | |
| *** mgagne has quit IRC | 03:52 | |
| *** Dafna has quit IRC | 03:52 | |
| *** samuelmz has quit IRC | 03:52 | |
| *** dtroyer has quit IRC | 03:52 | |
| *** comstud has quit IRC | 03:52 | |
| *** toddnni_ is now known as toddnni | 03:52 | |
| *** lbragstad_ has joined #openstack-keystone | 03:52 | |
| *** dutsmoc has joined #openstack-keystone | 03:52 | |
| *** lbragstad_ is now known as lbragstad | 03:52 | |
| *** jraim__ is now known as jraim | 03:52 | |
| *** samuelmz has joined #openstack-keystone | 03:53 | |
| *** mgagne has joined #openstack-keystone | 03:53 | |
| *** Dafna has joined #openstack-keystone | 03:53 | |
| *** mgagne is now known as Guest54676 | 03:53 | |
| *** radez_g0n3 has joined #openstack-keystone | 03:53 | |
| *** gyee has quit IRC | 03:54 | |
| *** dtroyer has joined #openstack-keystone | 03:54 | |
| morganfainberg | of course.... | 03:55 |
| morganfainberg | tempest *CHECKS* that we use a low resolution timestamp | 03:55 |
| *** amirosh has joined #openstack-keystone | 03:58 | |
| *** amirosh_ has joined #openstack-keystone | 04:02 | |
| *** rkofman has left #openstack-keystone | 04:05 | |
| *** amirosh has quit IRC | 04:07 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Role assignment notifications https://review.openstack.org/113669 | 04:11 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: Update region entries to include URLs https://review.openstack.org/114118 | 04:20 |
| *** ncoghlan_afk is now known as ncoghlan | 04:24 | |
| *** wwriverrat has joined #openstack-keystone | 04:31 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 04:32 |
| *** wwriverrat1 has joined #openstack-keystone | 04:44 | |
| *** wwriverrat has quit IRC | 04:46 | |
| *** amcrn has joined #openstack-keystone | 04:46 | |
| *** chandankumar has joined #openstack-keystone | 04:51 | |
| *** wwriverrat has joined #openstack-keystone | 04:54 | |
| *** wwriverrat1 has quit IRC | 04:54 | |
| *** wwriverrat has left #openstack-keystone | 04:55 | |
| *** ncoghlan is now known as ncoghlan_afk | 05:02 | |
| *** alex_xu has joined #openstack-keystone | 05:08 | |
| *** gokrokve has joined #openstack-keystone | 05:10 | |
| jamielennox | who's still awake that can +a some simple reviews? | 05:17 |
| *** rushiagr_away is now known as rushiagr | 05:19 | |
| *** amcrn has quit IRC | 05:21 | |
| *** arborism has joined #openstack-keystone | 05:24 | |
| *** afazekas has joined #openstack-keystone | 05:25 | |
| *** rushiagr is now known as rushiagr_away | 05:31 | |
| *** rushiagr_away is now known as rushiagr | 05:31 | |
| *** arborism has quit IRC | 05:35 | |
| *** gokrokve has quit IRC | 05:36 | |
| *** gokrokve has joined #openstack-keystone | 05:36 | |
| *** arborism has joined #openstack-keystone | 05:37 | |
| *** chandankumar has quit IRC | 05:40 | |
| *** gokrokve has quit IRC | 05:41 | |
| *** topol has quit IRC | 05:45 | |
| stevemar | jamielennox, hit me | 05:50 |
| jamielennox | people are staying up later - i like it | 05:51 |
| jamielennox | stevemar: https://review.openstack.org/#/c/112563/3 | 05:51 |
| jamielennox | and https://review.openstack.org/#/c/113478/ | 05:51 |
| jamielennox | what the hell jenkins | 05:51 |
| stevemar | jamielennox, it's that time of the release | 05:51 |
| stevemar | jamielennox, do you know how i can figure out the ip address of the keystone server? | 05:52 |
| jamielennox | which keystone server? | 05:52 |
| stevemar | there used to be a config value in CONF | 05:52 |
| jamielennox | oh, you can still override it in CONF, otherwise it takes it from the incoming request | 05:52 |
| stevemar | know the exact value? | 05:52 |
| jamielennox | so it uses whatever the user asked for (because apparently that worked for them ) | 05:53 |
| jamielennox | it's not retrieved from the server anywhere | 05:53 |
| stevemar | thats weird | 05:54 |
| jamielennox | if i request http://host1:5000/v2 and something bounces me around, the response should still say host1 | 05:54 |
| stevemar | i guess | 05:54 |
| jamielennox | stevemar: i'd be ok approving that review even though jenkins failed, it's something to do with pip | 05:55 |
| jamielennox | otherwise i'm stuck till tomorrow | 05:55 |
| jamielennox | well not stuck, just have to be careful of what order i put things up for review in | 05:55 |
| stevemar | recheck it i suppose | 05:55 |
| stevemar | i'll +2 it soon | 05:56 |
| stevemar | if jenkins passes, i think you can +A it | 05:56 |
| jamielennox | that's true, if it's got the two +2s i'll +a it when jenkins passes | 05:56 |
| stevemar | jamielennox, meh, i +A'ed it too | 05:59 |
| stevemar | since if jenkins fails, nothing bad will actually happen | 06:00 |
| stevemar | you'll be stuck in rebaseland | 06:00 |
| stevemar | err.. recheckland | 06:00 |
| jamielennox | stevemar: yea, gates quiet this time of day/night | 06:00 |
| stevemar | oh man | 06:00 |
| jamielennox | no one will mind | 06:00 |
| stevemar | thats right | 06:00 |
| stevemar | you mean it doesn't take ALL DAY for you to get a jenkins result? | 06:00 |
| stevemar | i only get that on the weekend :) | 06:00 |
| jamielennox | heh, still depends on the day | 06:00 |
| jamielennox | if it's backed up it will still be backed up | 06:01 |
| jamielennox | the down side is obviously that no-one is around for me to make approve stuff | 06:01 |
| *** ajayaa has joined #openstack-keystone | 06:01 | |
| *** chandankumar has joined #openstack-keystone | 06:02 | |
| *** arborism has quit IRC | 06:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/111920 | 06:05 |
| stevemar | jamielennox, done! | 06:05 |
| jamielennox | stevemar: thanks | 06:06 |
| stevemar | np! | 06:06 |
| jamielennox | it appears it is going to do a check run first anyway | 06:07 |
| *** ukalifon has joined #openstack-keystone | 06:16 | |
| *** renlt has joined #openstack-keystone | 06:16 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Create SAML generation route and controller https://review.openstack.org/114138 | 06:23 |
| *** ncoghlan_afk is now known as ncoghlan | 06:23 | |
| *** jamielennox is now known as jamielennox|away | 06:24 | |
| *** tomoiaga has joined #openstack-keystone | 06:25 | |
| *** k4n0 has joined #openstack-keystone | 06:30 | |
| *** stevemar has quit IRC | 06:31 | |
| *** bvandenh has joined #openstack-keystone | 06:49 | |
| *** wanghong has quit IRC | 06:50 | |
| openstackgerrit | A change was merged to openstack/keystone: Do not require method attribute on plugins https://review.openstack.org/107873 | 06:56 |
| *** wanghong has joined #openstack-keystone | 06:57 | |
| *** arborism has joined #openstack-keystone | 06:57 | |
| *** dhu has joined #openstack-keystone | 06:59 | |
| *** alex_xu has quit IRC | 07:02 | |
| *** abhishekk has joined #openstack-keystone | 07:22 | |
| abhishekk | hi all, can any one review this patch, https://review.openstack.org/#/c/107482/ | 07:23 |
| abhishekk | thank you | 07:23 |
| *** arborism has quit IRC | 07:30 | |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Standardizing the Federation Process https://review.openstack.org/105597 | 07:41 |
| *** renlt has quit IRC | 07:52 | |
| *** abhishekk has quit IRC | 07:55 | |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Standardizing the Federation Process https://review.openstack.org/105597 | 07:57 |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Standardizing the Federation Process https://review.openstack.org/105597 | 08:00 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Individual plugin CLI registering https://review.openstack.org/112563 | 08:08 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Allow registering individual plugin CONF options https://review.openstack.org/113478 | 08:09 |
| *** henrynash has joined #openstack-keystone | 08:16 | |
| *** henrynash has quit IRC | 08:51 | |
| *** andreaf_ has quit IRC | 08:52 | |
| *** jaosorior has joined #openstack-keystone | 08:54 | |
| *** andreaf has joined #openstack-keystone | 09:00 | |
| *** ncoghlan has quit IRC | 09:02 | |
| *** yasukun has joined #openstack-keystone | 09:04 | |
| *** ashepelev has quit IRC | 09:05 | |
| openstackgerrit | Ihar Hrachyshka proposed a change to openstack/keystone: migration: adopt for MySQL Connector https://review.openstack.org/110271 | 09:06 |
| *** andreaf has quit IRC | 09:06 | |
| *** alex_xu has joined #openstack-keystone | 09:07 | |
| *** abhishekk has joined #openstack-keystone | 09:18 | |
| *** andreaf has joined #openstack-keystone | 09:30 | |
| *** andreaf has quit IRC | 09:30 | |
| *** andreaf has joined #openstack-keystone | 09:30 | |
| *** alex_xu has quit IRC | 09:32 | |
| *** andreaf has quit IRC | 10:02 | |
| *** andreaf has joined #openstack-keystone | 10:03 | |
| *** henrynash has joined #openstack-keystone | 10:05 | |
| *** chandankumar has quit IRC | 10:19 | |
| *** chandankumar has joined #openstack-keystone | 10:31 | |
| *** ajayaa has quit IRC | 10:34 | |
| *** alex_xu has joined #openstack-keystone | 10:58 | |
| *** alex_xu has quit IRC | 10:58 | |
| *** alex_xu has joined #openstack-keystone | 10:58 | |
| *** henrynash has quit IRC | 10:58 | |
| *** bvandenh has quit IRC | 11:00 | |
| *** ajayaa has joined #openstack-keystone | 11:01 | |
| *** andreaf has quit IRC | 11:05 | |
| *** bvandenh has joined #openstack-keystone | 11:06 | |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Implement group related methods for LDAP backend https://review.openstack.org/102244 | 11:19 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: add --rebuild option for ssl/pki_setup https://review.openstack.org/88207 | 11:28 |
| *** Krast has quit IRC | 11:31 | |
| *** amirosh_ has quit IRC | 11:49 | |
| *** amirosh has joined #openstack-keystone | 11:49 | |
| *** henrynash has joined #openstack-keystone | 11:55 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone: Standardizing the Federation Process https://review.openstack.org/105597 | 12:02 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: trustor_user_id not available in v2 trust token https://review.openstack.org/101829 | 12:03 |
| openstackgerrit | henry-nash proposed a change to openstack/identity-api: Update region entries to include URLs https://review.openstack.org/114118 | 12:20 |
| *** diegows has joined #openstack-keystone | 12:20 | |
| *** cjellick has joined #openstack-keystone | 12:24 | |
| *** mflobo has joined #openstack-keystone | 12:27 | |
| *** cjellick has quit IRC | 12:28 | |
| *** cjellick has joined #openstack-keystone | 12:29 | |
| *** bvandenh has quit IRC | 12:31 | |
| *** KanagarajM has quit IRC | 12:33 | |
| *** _elmiko is now known as elmiko | 12:34 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 12:34 |
| *** andreaf has joined #openstack-keystone | 12:36 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/114067 | 12:39 |
| *** bvandenh has joined #openstack-keystone | 12:41 | |
| openstackgerrit | Ihar Hrachyshka proposed a change to openstack/keystone: migration: adopt for MySQL Connector https://review.openstack.org/110271 | 12:46 |
| *** abhishekk has quit IRC | 12:50 | |
| *** gordc has joined #openstack-keystone | 12:53 | |
| *** ajayaa has quit IRC | 13:01 | |
| elmiko | if i create a domain specific configuration file for the default domain, do i need to put more than just the identity section's "driver" config? | 13:03 |
| *** amirosh has quit IRC | 13:06 | |
| *** amirosh has joined #openstack-keystone | 13:06 | |
| elmiko | henrynash: hi, i ran into this bug https://bugs.launchpad.net/keystone/+bug/1356682 last night. i have a few questions about it. | 13:10 |
| uvirtbot | Launchpad bug 1356682 in keystone "GET /v3/users lists users in all domains" [Undecided,New] | 13:10 |
| henrynash | elmiko: ok... | 13:11 |
| henrynash | elmiko: the “design feature”, you mean :-) | 13:11 |
| elmiko | henrynash: so, i turn on specific domain backend. do a `keystone token-get` from the command line, when i issue the /v3/users call from rest i get an error because the token does not have a domain, what's the correct behavior here? | 13:12 |
| elmiko | lol | 13:12 |
| elmiko | i was thinking that if you issue the user list without a domain scope, it should return a list from your user's default domain. | 13:13 |
| henrynash | elmiko: so if you put a filter on it (e.g. ?domain_id=XYZ”) the it will work | 13:13 |
| elmiko | henrynash: let me try | 13:13 |
| elmiko | yes, it works as expected | 13:14 |
| *** nkinder has quit IRC | 13:14 | |
| elmiko | henrynash: i was going to propose a patch that scopes the token to the user's default domain, but i wanted to make sure that is appropriate. | 13:15 |
| elmiko | wrong wording, not scopes, but returns the user list from their default domain | 13:15 |
| henrynash | elmiko: so many things like that are possible | 13:16 |
| elmiko | henrynash: are you saying that this pattern exists in many places? | 13:17 |
| henrynash | elmiko: the issue I have with all these suggestions is that I think in a production, the ploci engine will drive a lot of what is allowed to happen | 13:18 |
| elmiko | henrynash: so perhaps, the returned error is the most appropriate response? | 13:19 |
| *** hrybacki has joined #openstack-keystone | 13:19 | |
| henrynash | elmiko: well, we do somethings already - e.g. if you create a user and don’t specify the domain_id of the use, it will use the domain scope of the token instead (and if it’s not domain scoped it will fail) | 13:21 |
| elmiko | right | 13:21 |
| henrynash | elmiko: I think this area is an interesting thing to discuss, however…and we the tension is: “production strictness” vs “small cloud where I want to see everything" balance | 13:23 |
| elmiko | henrynash: that makes sense, and it's a good question. how would an admin see all the users regardless of domain. | 13:25 |
| henrynash | elimiko: so, with domain-specific backends, they really can’t…but today they can for regualr SQL…and they question is really should we retain that ability | 13:26 |
| henrynash | elmiko: plent of folks (ayoung among them) would liek to abolish an unfettered GET /users….and I see their point…except for when small clouds are strating up it’s kind of nice | 13:27 |
| henrynash | elmiko: and right now you can insists on the filter by way of the policy file if you want….and that was the compromise... | 13:28 |
| elmiko | henrynash: interesting topic, i don't have a strong opinion either way. i guess, i thought at the least a v3/users GET should return something aside from an error, but maybe not. | 13:29 |
| henrynash | elmiko: yeah, understand the concern…sounds like a good ongoing conversation | 13:30 |
| elmiko | henrynash: and at the least, i'm thinking the docs for the v3/users endpoint should point out the domain specific issue | 13:32 |
| *** bknudson has joined #openstack-keystone | 13:34 | |
| *** yasukun has quit IRC | 13:38 | |
| *** andreaf_ has joined #openstack-keystone | 13:38 | |
| *** rushiagr is now known as rushiagr_away | 13:39 | |
| *** andreaf has quit IRC | 13:41 | |
| *** gokrokve has joined #openstack-keystone | 13:59 | |
| *** nkinder has joined #openstack-keystone | 13:59 | |
| *** bvandenh has quit IRC | 14:00 | |
| *** joesavak has joined #openstack-keystone | 14:03 | |
| mflobo | Question about keystone. Do we have some flow diagram about "what happends" when a request is sent to keystone? | 14:13 |
| *** jasondotstar has joined #openstack-keystone | 14:13 | |
| mflobo | with "what happends" I mean: what files, clases and functions are executed | 14:14 |
| *** gokrokve has quit IRC | 14:14 | |
| *** gokrokve has joined #openstack-keystone | 14:14 | |
| *** ukalifon has quit IRC | 14:16 | |
| *** ukalifon2 has joined #openstack-keystone | 14:16 | |
| mflobo | for example: http://mykeystone.com:5000/v3/whatever | 14:19 |
| elmiko | mflobo: keystone novice here, but you might try looking at the code in keystone/tests. i think the test_v3.py will give some clues about the flow for various calls | 14:23 |
| *** ayoung has joined #openstack-keystone | 14:24 | |
| mflobo | elmiko: thanks for the info but, do you know if there is some flow-chart or something? | 14:25 |
| elmiko | mflobo: i haven't seen one, have you poked around http://docs.openstack/org/developer/keystone ? | 14:25 |
| mflobo | elmiko: yes I have but I didn't find nothing similiar | 14:26 |
| mflobo | elmiko: thanks again ;) | 14:26 |
| *** zzzeek has joined #openstack-keystone | 14:26 | |
| elmiko | mflobo: yea, i don't think there is a flow chart that shows exactly how a rest call is processed. | 14:27 |
| morganfainberg | ayoung, it's not worth fixing expiration time to be isostr, v2 tokens explicitly are 1s resolution (in the identity api, and validated in tempest) on expires time | 14:27 |
| morganfainberg | ayoung, i'm going to add the audit id concept instead. | 14:27 |
| morganfainberg | ayoung, which means i need to fix the identity api for revoke events | 14:29 |
| morganfainberg | ayoung, ........... | 14:29 |
| bknudson | morganfainberg: the identity v2 spec says 1s? | 14:30 |
| bknudson | "expires": "2014-01-31T15:30:58Z", | 14:32 |
| bknudson | weird | 14:32 |
| morganfainberg | bknudson, yep. | 14:33 |
| morganfainberg | bknudson, and tempest validates we use low resolution | 14:33 |
| bknudson | very thorough | 14:33 |
| openstackgerrit | Marek Denis proposed a change to openstack/identity-api: Add SAML generation route to OS-FEDERATION https://review.openstack.org/113998 | 14:34 |
| bknudson | morganfainberg: why didn't you like the audit id before? I thought that's what you started with | 14:34 |
| morganfainberg | bknudson, i do like it, i got a few directed complaints about "adding stuff to the token" | 14:35 |
| *** topol has joined #openstack-keystone | 14:35 | |
| bknudson | morganfainberg: seems like "adding stuff to the token" is as bad as "changing v2 token timestamp to be millisecond rather than second" | 14:35 |
| morganfainberg | bknudson, both require identity-api changes as revocation events explicitly says (in it's api doc) expiration_time is used | 14:36 |
| bknudson | is it just that tempest doesn't check that there's no audit id field so it's easier? | 14:36 |
| morganfainberg | bknudson, pretty much. and guaranteed to only be one place in the docs to fix things :P | 14:36 |
| morganfainberg | bknudson, strike that, still need to chase down all the token locations | 14:37 |
| morganfainberg | bknudson, so we can add audit id | 14:37 |
| bknudson | morganfainberg: adding audit_id affects both v2 and v3, so seems like it would be more doc work | 14:37 |
| morganfainberg | bknudson, it's probably about the same amount. | 14:38 |
| bknudson | changing an existing field is considered a non-backwards compatible change | 14:38 |
| morganfainberg | bknudson, yep. | 14:38 |
| morganfainberg | bknudson, and since revocation events shipped, in *theory* removing the expires_at stuff is non-compatible | 14:38 |
| morganfainberg | bknudson, the audit id would need to replace expires_at use in revovcation events | 14:38 |
| bknudson | maybe we need to find a way to support old revocation event format | 14:39 |
| bknudson | (which I would expect requires dropping the revocation tree checking and making it easier to understand) | 14:39 |
| *** andreaf_ is now known as andreaf | 14:39 | |
| ayoung | morganfainberg, which means you have to work with the tree code, and you are not looking forward to that, so you are contemplating rolling back to the older, easier to understand version? | 14:39 |
| morganfainberg | ayoung, i'd like to, but this is turning into an even bigger project than it already is. | 14:40 |
| ayoung | yep | 14:40 |
| bknudson | the check code is still there, it's in the test | 14:40 |
| morganfainberg | ayoung, i'm fairly certain i could make the tree code work. i currently have my head wrapped around what it is doing | 14:40 |
| *** stevemar has joined #openstack-keystone | 14:41 | |
| ayoung | morganfainberg, what if we break the v2.0 tokens? Make their expires time longer. Would that really break anything? | 14:41 |
| *** rushiagr_away is now known as rushiagr | 14:41 | |
| morganfainberg | ayoung, you mean add subsecond resolution? it's considered non-backwards compatible | 14:41 |
| morganfainberg | ayoung, we're changing the format of a field | 14:42 |
| morganfainberg | bknudson, i think adding the audit id is the lowest impact change. just a lot of doc work | 14:42 |
| morganfainberg | bknudson, and i *think* i can make the code do "use expires_at if audit id doesn't exist" | 14:43 |
| openstackgerrit | Harry Rybacki proposed a change to openstack/keystonemiddleware: Remove superfluous exception block from auth_token https://review.openstack.org/114261 | 14:43 |
| bknudson | morganfainberg: here's the non-tree code: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/test_revoke.py#n51 | 14:45 |
| *** k4n0 has quit IRC | 14:45 | |
| bknudson | morganfainberg: I don't have a problem with audit ID. | 14:45 |
| morganfainberg | bknudson, oh you weren't kidding its really in the tests :P | 14:45 |
| bknudson | might not need a whole uuid for the audit ID | 14:45 |
| morganfainberg | bknudson, probably not | 14:45 |
| bknudson | could be a shorter random string. | 14:45 |
| morganfainberg | bknudson, could probably do uuid4().hex[1:8] | 14:46 |
| bknudson | since it's going to be unique to a user | 14:46 |
| bknudson | morganfainberg: could do better than limiting to hex chars... should be able to use base64 | 14:46 |
| bknudson | it only has to be unique to a user and for a limited time. | 14:47 |
| morganfainberg | bknudson, sure. could use just about anything that'll json encode decently | 14:47 |
| bknudson | I'd think 3 chars would be adequate. | 14:48 |
| morganfainberg | bknudson, so uuid4().bytes.encode('base64')[:5] ? | 14:48 |
| bknudson | morganfainberg: let me try it... | 14:49 |
| bknudson | morganfainberg: I like it | 14:49 |
| morganfainberg | bknudson, cool | 14:49 |
| elmiko | ayoung: i dug into that issue we were looking at last night, looks like a bigger can of worms than i initially thought. | 14:49 |
| *** david-lyle has joined #openstack-keystone | 14:50 | |
| ayoung | morganfainberg, what if V2 tokens had an additional, option field | 14:50 |
| ayoung | that had the expiration at microseconds or whatnot | 14:50 |
| ayoung | milis? | 14:50 |
| morganfainberg | ayoung, about as much work as adding the audit id string | 14:50 |
| ayoung | morganfainberg, yeah, but it means we are back to revoking one token at a time | 14:50 |
| morganfainberg | ayoung, and there is more benefit if we're doing that (no collisions on expires_time) to go to the audit id route | 14:50 |
| ayoung | pros and cons...I trust your judgement on this | 14:51 |
| bknudson | ayoung: this is the issue that morganfainberg ran into. when revoking a token it was revoking other tokens. | 14:51 |
| ayoung | bknudson, yes, I'm, aware | 14:51 |
| ayoung | and that was due to the overly borad matching of the expires time | 14:52 |
| morganfainberg | ayoung, i think audit id is best, we *can* chain the audit id "original_audit_id" or "audit_chain_id" and explicitly revoke on that | 14:52 |
| ayoung | if needs be | 14:52 |
| morganfainberg | ayoung, when we want to do a "revoke everything in the chain" | 14:52 |
| morganfainberg | ayoung, expires time event at mills resolution is likely to get more collisions | 14:52 |
| morganfainberg | in a big environment with many keystones | 14:52 |
| ayoung | not for the same user | 14:52 |
| ayoung | size of the env does not matter, it is single user activity | 14:53 |
| morganfainberg | ayoung, 5 processes for user+project combo doing actions at the same time | 14:53 |
| morganfainberg | ayoung, multiple keystones (nothing says that is impossible) | 14:53 |
| morganfainberg | ayoung, colissions are much more likely especially when tokens are issued across multple processors / servers | 14:53 |
| ayoung | morganfainberg, fair enough. We can go the audit ID approach. It should make topol happy, too | 14:54 |
| ayoung | and yes, topol, summing you was intentional | 14:54 |
| morganfainberg | ayoung, yeah, also i think the *smallest* amount of work | 14:54 |
| morganfainberg | of the options | 14:54 |
| bknudson | if it's really for audit then maybe it should be a full uuid | 14:54 |
| topol | ayoung Im here | 14:54 |
| morganfainberg | bknudson, sure. happy to use full uuid | 14:55 |
| ayoung | topol, for revocation events, we are considering adding an additional identifier to thetoken, just to be used for revoking it | 14:55 |
| bknudson | still, seems like we can do better than hex chars | 14:55 |
| topol | bknudson ++ full uuid is alway good for auditing | 14:55 |
| morganfainberg | bknudson, >>> uuid4().bytes.encode('base64').strip() | 14:55 |
| morganfainberg | 'tWUiRM/PRDW+lzTks37cLQ==' | 14:55 |
| ayoung | we are planning on calling it audit_id, as you can then use it to uniquely identify a token in audit without giving away the secret | 14:55 |
| bknudson | morganfainberg: always ends in == so that's redundant | 14:56 |
| morganfainberg | bknudson, (strip because of the \n) | 14:56 |
| topol | ayoung that sounds like a very good idea | 14:56 |
| *** jsavak has joined #openstack-keystone | 14:56 | |
| ayoung | topol, we have a couple problems with the current way we process token revocations, and this seems like the best approach | 14:56 |
| morganfainberg | bknudson, hm. yeah because of the length it should always be == at the end | 14:56 |
| bknudson | uuid.uuid4().bytes.encode('base64')[:-3] | 14:56 |
| morganfainberg | bknudson, >>> uuid4().bytes.encode('base64')[:-3] | 14:56 |
| morganfainberg | bknudson, ++ | 14:56 |
| bknudson | why does it add a newline?? weird | 14:56 |
| topol | ayoung sounds good to me | 14:56 |
| *** hrybacki has quit IRC | 14:56 | |
| morganfainberg | bknudson, yeah i dunno about that. it's very odd | 14:57 |
| ayoung | morganfainberg, OK, lets do this in a managable series of patches. First merely adds the audit_id to the tokens | 14:57 |
| *** joesavak has quit IRC | 14:57 | |
| morganfainberg | ayoung, thats the first one | 14:57 |
| ayoung | Second allows for revocation by audit_id | 14:57 |
| ayoung | only | 14:57 |
| morganfainberg | ayoung, bknudson, do you *want* to support knowing the token chain? | 14:58 |
| ayoung | third changes the revocation of a specific token to revoking by audit id | 14:58 |
| ayoung | morganfainberg, not for now | 14:58 |
| ayoung | morganfainberg, I think that might be the wrong direction | 14:58 |
| bknudson | morganfainberg: I assume if you create token from a token then it'll get the parent token's audit_id? | 14:58 |
| morganfainberg | ayoung, figured i'd ask because it really is 4 extra lines and future proffes us | 14:58 |
| bknudson | or are we going to have both? | 14:58 |
| bknudson | just like it gets the parent token's expiration time | 14:58 |
| ayoung | instead, I think I would rather focus on not trading a scoped token for another token | 14:58 |
| ayoung | and then revoking a scoped token doesn't need a chaing | 14:59 |
| ayoung | chain | 14:59 |
| morganfainberg | bknudson, i was thinking each token always has a unique id, and the first token's audit id is carried forward for all rescoping in a separate field | 14:59 |
| *** hrybacki has joined #openstack-keystone | 14:59 | |
| *** hrybacki has quit IRC | 14:59 | |
| bknudson | morganfainberg: separate field works. | 14:59 |
| *** hrybacki has joined #openstack-keystone | 14:59 | |
| ayoung | revoking an unscoped token OTOH it might make sense to leave around its scoped children to get work done | 14:59 |
| morganfainberg | bknudson, {'audit_id': <audit id>, 'audit_chain': <original token's audit id, optional>} | 14:59 |
| ayoung | especially if their lifespan is short | 14:59 |
| *** hrybacki has quit IRC | 14:59 | |
| *** hrybacki has joined #openstack-keystone | 15:00 | |
| ayoung | I clicked log out. I hope that vm I just kicked off gets built, but I don;'t want to leave my session open to find out" | 15:00 |
| morganfainberg | bknudson, but i'm not heartset on needing that or anything, just asking if we wanted that now, since it is so trivial to add | 15:00 |
| morganfainberg | and updating docs is going to be a bunch of work anyway | 15:01 |
| bknudson | morganfainberg: I think it's needed to have it work as it does now | 15:01 |
| morganfainberg | bknudson, ah because we *can* chain revoke we should still support it | 15:01 |
| morganfainberg | bknudson, ok so the original token would then have the same value for audit_id and audit_chain. sound good? | 15:02 |
| morganfainberg | bknudson, all subsequent/rescoped tokens from there would end up with the original's audit_chain value, but their own audit_id | 15:03 |
| bknudson | ayoung: considering that we're past getting new proposals in, I think we're past where we can make the change to trade a scoped token for another token... | 15:03 |
| bknudson | I think it would be a major improvement | 15:04 |
| ayoung | So, bknudson oph, yeah, I'm tqalking future stuff here | 15:04 |
| bknudson | but I think it requires a summit discussion | 15:04 |
| bknudson | morganfainberg: I'm fine with an original token having audit_id == audit_chain, although it seems redundant. | 15:05 |
| bknudson | most tokens are going to be original tokens, aren't they? | 15:05 |
| bknudson | so then most token would have something they don't need | 15:05 |
| morganfainberg | bknudson, somewhat. anything in horizon will be unscoped -> scoped -> whoknowswhat | 15:06 |
| morganfainberg | bknudson, there is a *lot* of rescoping that goes on. | 15:06 |
| bknudson | maybe it's just because I don't use horizon | 15:06 |
| ayoung | make audit ID be an array | 15:06 |
| ayoung | the id for this token is the last element of the array | 15:06 |
| morganfainberg | ayoung, ah and only ever end up with 2 in the array (max) | 15:07 |
| morganfainberg | ayoung, hm. ... i think that will pose problems in the tree matching | 15:07 |
| ayoung | morganfainberg, tree code can start by just matching the last | 15:08 |
| bknudson | I'd prefer it if audit_chain is left off for an original token, and there if it's a rescoped token | 15:08 |
| morganfainberg | bknudson, happy to do so. | 15:08 |
| morganfainberg | bknudson, will leave the chain out | 15:08 |
| morganfainberg | bknudson, for originals that is | 15:08 |
| morganfainberg | bknudson, any thoughts on using an array vs. flat scalar value? | 15:09 |
| morganfainberg | ^ | 15:09 |
| ayoung | morganfainberg, why not do it as an array. That makes us future proof | 15:10 |
| ayoung | the tree check can be a for-each type logic | 15:10 |
| bknudson | with json you could have it a string and then an array if there's more than 1 | 15:10 |
| bknudson | would save a couple bytes | 15:10 |
| bknudson | I don't have a problem with an array | 15:10 |
| morganfainberg | ayoung, didn't have a reason not to, just asking for extra views. | 15:11 |
| morganfainberg | ayoung, if there was a reason i wasn't seeing and bknudson did, i'd want to know :) | 15:11 |
| henrynash | stevemar: any chance you could re-apply your +2 to https://review.openstack.org/#/c/99842/ - I fixed the nits you rasied on it | 15:11 |
| bknudson | I'm assuming it's only going to have 2 elements max | 15:11 |
| ayoung | henrynash, question for you. | 15:11 |
| morganfainberg | bknudson, yeah | 15:11 |
| ayoung | list users | 15:11 |
| stevemar | oops | 15:11 |
| morganfainberg | bknudson, that would be the intent | 15:11 |
| stevemar | henrynash, sure thing | 15:11 |
| henrynash | ayoung: mais oui... | 15:11 |
| ayoung | henrynash, right now the logic is different is domain specific backends is enabled | 15:11 |
| bknudson | if we allow infinite elements then that could be a denial of service | 15:11 |
| ayoung | should list users always be confined to a specific domain? | 15:12 |
| ayoung | I would think "yes" | 15:12 |
| morganfainberg | bknudson, i would explicitly only allow 2 in our code. audit id, and audit chain | 15:12 |
| *** david-lyle has quit IRC | 15:12 | |
| henrynash | ayoung: yes, if you have domain-specifc backends we inisit there is a domain scope of some kind (either explicit filter of domain scoped token) | 15:12 |
| bknudson | morganfainberg: ok, works for me... might make some potential applications a little more difficult to write | 15:12 |
| ayoung | henrynash, but shouldn't that be the case even if there are no domain specific backends? | 15:13 |
| morganfainberg | bknudson, perhaps. but i think we're smart enough. | 15:13 |
| *** david-lyle has joined #openstack-keystone | 15:13 | |
| morganfainberg | bknudson, ;) | 15:13 |
| ayoung | henrynash, say I am a provider. Each customer goes into their own domain | 15:13 |
| bknudson | e.g., if I wanted to write an application to grab the token with a given audit id I'd have to parse the field | 15:13 |
| ayoung | I don't want customers in dom1 listing users in dom2 | 15:13 |
| henrynash | ayoung: so elmiko and I had quite a long chat about this ealier | 15:13 |
| ayoung | henrynash, I know, I primed that pump | 15:13 |
| elmiko | o/ | 15:13 |
| henrynash | ayoung: I’d never have guessed :-) | 15:14 |
| elmiko | lol | 15:14 |
| ayoung | actually, I didn;t know you guys had talked | 15:14 |
| ayoung | did you decide something? | 15:14 |
| *** richm has joined #openstack-keystone | 15:15 | |
| elmiko | we agreed it's a good conversation topic =D | 15:15 |
| henrynash | ayoung: so most production systems woudl, I’m sure, use the policy so that most users had to specify a filter | 15:15 |
| marekd|away | dolphm: How about adding a SAML XML response in https://review.openstack.org/#/c/113998/ ? | 15:15 |
| ayoung | henrynash, that is going to be unfriendly. Why not use the rule that you already put in place? If no filter, hen filter by users domain? | 15:16 |
| henrynash | ayoung: the question is, if we were to mandate scope-ness (either by filter or token), then do you think we would have to allow some kind of admin ability to bypass this? | 15:16 |
| ayoung | henrynash, list all users everywhere? | 15:16 |
| henrynash | ayoung: actually we filter by the scope of teh token I think | 15:16 |
| ayoung | henrynash, only if domain_specific_backends is enabled | 15:17 |
| ayoung | henrynash, so it is a unevenly applied | 15:17 |
| henrynash | ayoung: but some principle (and yes, only then) | 15:17 |
| henrynash | ayoung: and I agree, unevenly applied | 15:17 |
| *** david-lyle has quit IRC | 15:17 | |
| ayoung | henrynash, so I am just suggesting applying it evenly | 15:17 |
| henrynash | ayoung: so I switch on openstack for teh first time | 15:17 |
| ayoung | henrynash, you are worried about "least surprise" here? | 15:18 |
| henrynash | ayoung: well. just don’t want the small clouds who are starting out to find it too hard | 15:18 |
| elmiko | ayoung: just to be clear, if domain_specific_backends=false and a GET on /v3/users/ comes in, then the reply should be a list from the user's domain? | 15:19 |
| ayoung | henrynash, if you are looking at multiple domains, it is beyond "small clouds" I think | 15:19 |
| ayoung | elmiko, I think so | 15:19 |
| henrynash | ayoung: agreed…. | 15:19 |
| elmiko | ayoung: then likewise, if domain_specific_backends=true, should the same GET return the same? | 15:19 |
| ayoung | elmiko, yes | 15:20 |
| henrynash | ayoung; so we’d be saying that you have to get a domain scoped token to do a naked Get /users | 15:20 |
| ayoung | henrynash, not quite | 15:20 |
| morganfainberg | bknudson, last question, audit_chain first or last? | 15:20 |
| ayoung | it means you need to have an appropriate role for doing that | 15:20 |
| ayoung | so it is policy dependany | 15:20 |
| henrynash | ayoung: even if you have justthe default domain | 15:20 |
| bknudson | morganfainberg: really makes no difference to me... I'd expect audit_chain last since then the first elem is always the audit_id. | 15:20 |
| ayoung | but, yeah. Isn't that waht domain scoped tokens are supposed to be for, though? | 15:20 |
| morganfainberg | bknudson, ++ that was my thought | 15:21 |
| bknudson | morganfainberg: or are there always 2 elements? | 15:21 |
| henrynash | ayoung: I guess I’d find it hard to argue agains that | 15:21 |
| morganfainberg | bknudson, oh you mean [ID, None] in the case of original token? | 15:21 |
| bknudson | or [ID, ID] | 15:21 |
| morganfainberg | bknudson, i thought we wanted to not duplicate data for original tokens | 15:21 |
| ayoung | ['ME'] | 15:21 |
| ayoung | ['ME', ['Parent'] | 15:22 |
| bknudson | morganfainberg: I'd expect 1 element [ID] for original token and [ID, CHAIN_ID] | 15:22 |
| ayoung | er | 15:22 |
| bknudson | y | 15:22 |
| ayoung | ['ME', 'Parent'] | 15:22 |
| elmiko | ayoung, henrynash, so it sounds like regardless of the domain specific option, GET on /v3/users/ should return a list of the user's domain, even if the token is unscoped? | 15:22 |
| ayoung | so audit_chain[0] is me | 15:22 |
| henrynash | ayoung: so we’d probably have to allow an admin token to work….but in that case, which domain? | 15:22 |
| morganfainberg | bknudson, so ['ME', None] or ['Me', 'Me'] for original token? | 15:22 |
| bknudson | morganfainberg: that seems unnecessary. | 15:22 |
| *** amirosh has quit IRC | 15:22 | |
| henrynash | elmiko: so taht’s not true for eitehr case today | 15:22 |
| ayoung | elmiko, hmmm you should not be able to do list users with an unscoped token | 15:22 |
| morganfainberg | bknudson, k so ['Me'] is original | 15:23 |
| elmiko | henrynash: yea | 15:23 |
| morganfainberg | bknudson, ['me', 'parent'] is chained | 15:23 |
| bknudson | morganfainberg: y | 15:23 |
| ayoung | admin_token is default domain only | 15:23 |
| *** david-lyle has joined #openstack-keystone | 15:23 | |
| morganfainberg | bknudson, cool | 15:23 |
| elmiko | ayoung: ok | 15:23 |
| *** amirosh has joined #openstack-keystone | 15:23 | |
| henrynash | elmiko I don’t think we should use the “user’s domain”…it should be the scope of the token | 15:23 |
| ayoung | henrynash, ++ | 15:23 |
| elmiko | henrynash: ok, so you need to have a domain scoped token to do a user list then? | 15:24 |
| henrynash | elimiko: or specify a filter | 15:24 |
| elmiko | right, or that | 15:24 |
| ayoung | henrynash, now, what is that going to break? | 15:24 |
| henrynash | ayoung: so if i am booting opemstacl, using teh admin token | 15:25 |
| henrynash | ayoung: I am sure I want to do a list users | 15:25 |
| ayoung | implicitly scope it to the default_domain admin role | 15:25 |
| henrynash | ayoung: so I only see users in the default domain? | 15:25 |
| *** gokrokve_ has joined #openstack-keystone | 15:27 | |
| *** dutsmoc is now known as comstud | 15:27 | |
| *** amirosh has quit IRC | 15:27 | |
| henrynash | ayoung: the other kind of thing that break I suspect is that if a customer is using the default policy file (which bascially says admin can do anyting), and I was unsing multiple domains in a promiscious way, then my Get /users wouldn’t do what it used to | 15:28 |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone: Standardizing the Federation Process https://review.openstack.org/105597 | 15:28 |
| henrynash | morganfainberg: when you have a minute, could you reapply your +2 (maybe a +A as well/) to https://review.openstack.org/#/c/99842/ - only chnage since you did it last was fixing some nits from Steve | 15:29 |
| morganfainberg | henrynash, done | 15:29 |
| henrynash | morganfainberg: thx | 15:29 |
| *** gokrokve has quit IRC | 15:31 | |
| *** gokrokve_ has quit IRC | 15:31 | |
| ayoung | henrynash, I'm going read the current state, and I'll click +A | 15:34 |
| ayoung | +2 is on there from 2 core | 15:34 |
| *** topol has quit IRC | 15:34 | |
| *** joesavak has joined #openstack-keystone | 15:38 | |
| ayoung | henrynash, so...now that the spec is in, lets talk fetching for a moment... | 15:38 |
| ayoung | you patch made me think that each endpoint should get its own identity | 15:38 |
| ayoung | ie a service domain, with each endpoint getting a distinct user | 15:38 |
| ayoung | then user->endpoint means "fetch policy for me" can be resolved without the endpoint needing to store its own id | 15:39 |
| openstackgerrit | A change was merged to openstack/keystone-specs: Endpoint policy extension https://review.openstack.org/99842 | 15:40 |
| *** hrybacki_ has joined #openstack-keystone | 15:40 | |
| *** jsavak has quit IRC | 15:41 | |
| *** hrybacki has quit IRC | 15:41 | |
| *** henrynash has quit IRC | 15:42 | |
| *** ukalifon2 has quit IRC | 15:43 | |
| *** tomoiaga has quit IRC | 15:44 | |
| elmiko | ayoung: does this look like the proper json to create a domain scoped token? https://gist.github.com/elmiko/b6270c626061767fbce7 | 15:55 |
| elmiko | ayoung: oops, disregard... i pasted the wrong thing | 15:58 |
| ayoung | elmiko, I'll paste | 15:58 |
| ayoung | er...wait, no I won't | 15:58 |
| *** henrynash has joined #openstack-keystone | 15:58 | |
| *** KanagarajM has joined #openstack-keystone | 15:59 | |
| ayoung | elmiko, but instead of "project" the level under scoped should be "domain" | 15:59 |
| elmiko | ayoung: ok, that's what i'm trying but when i GET v3/auth/tokens i get "user ... has no access to domain default" | 16:00 |
| elmiko | er POST | 16:00 |
| ayoung | elmiko, that is correct | 16:00 |
| ayoung | it is not implicit that a user with a role on a project in the domain has a role on the domain iotslef | 16:01 |
| ayoung | itself | 16:01 |
| ayoung | create a role assignment for the user on the domain | 16:01 |
| *** david-lyle has quit IRC | 16:01 | |
| elmiko | ok, i'll check the roles. thanks | 16:02 |
| elmiko | ayoung: there are project roles and domain roles? | 16:03 |
| *** david-lyle has joined #openstack-keystone | 16:03 | |
| ayoung | elmiko, the names of the roles are the same, but yeah, its where the role is assigned that counts, and roles can be assigned to a user on a project or assigned to a user on a domain | 16:03 |
| openstackgerrit | A change was merged to openstack/identity-api: Removes WADL references from Identity v2.0 API https://review.openstack.org/112620 | 16:04 |
| elmiko | ahh, turtles all the way down :) | 16:04 |
| ayoung | pretty much | 16:06 |
| *** afazekas has quit IRC | 16:10 | |
| *** ayoung is now known as ayoung_lunch | 16:15 | |
| *** gokrokve has joined #openstack-keystone | 16:27 | |
| *** hrybacki_ is now known as hrybacki | 16:27 | |
| *** hrybacki is now known as hryabcki_afk | 16:29 | |
| *** Guest54676 is now known as mgagne | 16:30 | |
| *** mgagne has joined #openstack-keystone | 16:30 | |
| *** henrynash has quit IRC | 16:39 | |
| *** jaosorior has quit IRC | 16:42 | |
| stevemar | dstanek, replied to your q on adding url to region | 16:43 |
| stevemar | dstanek, i would also appreciate a review on the patch i mention there :) | 16:43 |
| *** chandankumar has quit IRC | 16:46 | |
| *** afazekas has joined #openstack-keystone | 16:49 | |
| *** david-lyle has quit IRC | 16:50 | |
| *** tpatil has joined #openstack-keystone | 16:50 | |
| *** david-lyle has joined #openstack-keystone | 16:50 | |
| *** raildo has joined #openstack-keystone | 16:51 | |
| *** david-lyle has quit IRC | 16:53 | |
| *** david-lyle has joined #openstack-keystone | 16:53 | |
| *** topol has joined #openstack-keystone | 16:53 | |
| *** david-lyle has quit IRC | 16:54 | |
| *** david-lyle has joined #openstack-keystone | 16:54 | |
| *** harlowja has joined #openstack-keystone | 16:56 | |
| *** spandhe_ has joined #openstack-keystone | 16:59 | |
| *** vhoward has left #openstack-keystone | 17:02 | |
| *** chandankumar has joined #openstack-keystone | 17:03 | |
| *** radez_g0n3 is now known as radez | 17:10 | |
| *** jsavak has joined #openstack-keystone | 17:34 | |
| *** joesavak has quit IRC | 17:36 | |
| dstanek | stevemar: nice, i'll check it out | 17:39 |
| *** abhishekk has joined #openstack-keystone | 17:48 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Standardizing the Federation Process https://review.openstack.org/105597 | 17:50 |
| stevemar | marekd|away, dstanek, dolphm i think it's worth checking out https://review.openstack.org/#/c/105597/8 - kwss patch for refactoring, it's looking pretty good to me... | 17:52 |
| abhishekk | hi all, can any one review this patch, https://review.openstack.org/#/c/107482/ | 17:52 |
| abhishekk | thank you | 17:52 |
| *** hryabcki_afk is now known as hrybacki | 17:54 | |
| *** david-lyle has quit IRC | 17:55 | |
| *** david-lyle has joined #openstack-keystone | 17:56 | |
| *** arun_kant has joined #openstack-keystone | 17:58 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: WiP: Script to sync oslo https://review.openstack.org/114305 | 18:00 |
| *** david-lyle has quit IRC | 18:00 | |
| *** KanagarajM has quit IRC | 18:00 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: WIP Add Audit IDs to tokens https://review.openstack.org/114306 | 18:00 |
| *** david-lyle has joined #openstack-keystone | 18:02 | |
| *** spandhe_ has quit IRC | 18:02 | |
| *** spandhe_ has joined #openstack-keystone | 18:03 | |
| *** tpatil has quit IRC | 18:03 | |
| *** spandhe_ has quit IRC | 18:06 | |
| *** radez is now known as radez_g0n3 | 18:06 | |
| *** andreaf has quit IRC | 18:18 | |
| *** afazekas has quit IRC | 18:19 | |
| *** andreaf has joined #openstack-keystone | 18:19 | |
| *** amirosh has joined #openstack-keystone | 18:21 | |
| *** chandankumar has quit IRC | 18:22 | |
| *** ayoung_lunch has quit IRC | 18:22 | |
| *** leonchio__ has joined #openstack-keystone | 18:41 | |
| stevemar | morganfainberg, ping | 18:41 |
| stevemar | morganfainberg, if given a token id, and i want to get the user and roles ref, i should be using self.token_provider_api.validate_token(token_id) right? | 18:42 |
| stevemar | the new token provider api | 18:43 |
| leonchio__ | hi folks, just like to post a question, does Keystone V2 APIs support creating Groups and Users via Ldap or they are only available with V3 APIs? | 18:45 |
| morganfainberg | stevemar, ping | 18:54 |
| morganfainberg | stevemar, erm pong | 18:54 |
| morganfainberg | stevemar, yes please, i also suggest funneling it into the KeystoneToken model | 18:55 |
| morganfainberg | stevemar, so you don't need conditional code to know v2 vs v3 | 18:55 |
| stevemar | morganfainberg, still worth using token model if it's v3 specific? | 18:56 |
| stevemar | actually... i guess the idp side doesn't have to be | 18:57 |
| *** david-lyle has quit IRC | 18:59 | |
| stevemar | morganfainberg, <3 the keystone token model | 19:00 |
| *** david-lyle has joined #openstack-keystone | 19:02 | |
| *** amirosh has quit IRC | 19:04 | |
| stevemar | lbragstad, did you validation stuff go in? | 19:05 |
| *** abhishekk has quit IRC | 19:06 | |
| *** tpatil has joined #openstack-keystone | 19:10 | |
| jsavak | lbragstad may or may not be on a boat in the middle of lake travis now. | 19:12 |
| dstanek | stevemar: no, not yet | 19:12 |
| dstanek | jsavak: he on vacation? | 19:12 |
| jsavak | nope - team outing | 19:12 |
| dstanek | ah, ok | 19:12 |
| stevemar | dstanek, it is in | 19:13 |
| stevemar | the base stuff is in anyway | 19:13 |
| stevemar | i just made a schema to validate stuff | 19:13 |
| stevemar | yay | 19:13 |
| stevemar | AND i'm using the token model | 19:14 |
| dstanek | stevemar: yeah, some of the initial stuff is in, but there are log of outstanding things to deal with | 19:14 |
| stevemar | dstanek, i just want to create a simple schema to do my error handling | 19:14 |
| stevemar | validator handles the structure of the req, and backends handle if it exists, then i am gold | 19:15 |
| *** arosen1 has joined #openstack-keystone | 19:15 | |
| arosen1 | There seems to be a really bad bug that was introduced in the keystoneclient i believe that breaks it against older deployments i blieve: http://paste.openstack.org/show/95157/ | 19:17 |
| *** morganbird has joined #openstack-keystone | 19:17 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Create SAML generation route and controller https://review.openstack.org/114138 | 19:17 |
| arosen1 | I noticed that my neutronclient doesn't work against our internal cloud anymore. Installing an older one seems to fix it. | 19:17 |
| arosen1 | anyone see this trace in keystone before: http://paste.openstack.org/show/95162/ | 19:21 |
| dstanek | arosen1: someone mentioned that yesterday and i think we have a bug for it | 19:24 |
| dstanek | i'm not sure what it is though | 19:24 |
| arosen1 | dstanek: which one? | 19:24 |
| dstanek | arosen1: i think https://bugs.launchpad.net/keystone/+bug/1339439 is what they were talking about | 19:26 |
| uvirtbot | Launchpad bug 1339439 in keystone "TypeError: object of type 'NoneType' has no len()" [Undecided,Incomplete] | 19:26 |
| arosen1 | it seems related to the session code i think | 19:26 |
| arosen1 | let me digg into it | 19:26 |
| dstanek | arosen1: do you installed an older version of the neutron client to get it to work? | 19:26 |
| arosen1 | i did | 19:26 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 19:27 |
| *** miqui has quit IRC | 19:33 | |
| *** stevemar has quit IRC | 19:35 | |
| *** ayoung has joined #openstack-keystone | 19:35 | |
| *** stevemar has joined #openstack-keystone | 19:36 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Create SAML generation route and controller https://review.openstack.org/114138 | 19:37 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 19:38 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Create SAML generation route and controller https://review.openstack.org/114138 | 19:39 |
| *** miqui has joined #openstack-keystone | 19:40 | |
| *** tpatil has quit IRC | 19:44 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone: Standardizing the Federation Process https://review.openstack.org/105597 | 19:51 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Bump hacking to 0.9.x series https://review.openstack.org/98996 | 19:53 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Updates package comment to be more accurate. https://review.openstack.org/114326 | 19:53 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Enable hacking H104 - Full of only comments https://review.openstack.org/114327 | 19:54 |
| dstanek | morganfainberg: do you not like hacking H104 enabled? | 19:54 |
| morganfainberg | dstanek, which one is H104? | 19:55 |
| morganfainberg | dstanek, oh full of only comments | 19:55 |
| morganfainberg | yeah i don't see a benefit to that one | 19:55 |
| dstanek | file full of only comments | 19:55 |
| morganfainberg | it seems like a silly test | 19:55 |
| morganfainberg | i mean, i wont -1 it being enabled, but i wouldn't put forther the effort to enable it :P i mean... i've already typed more than i think it's worth on the subject | 19:56 |
| dstanek | morganfainberg: i just abandoned my patch :-) | 19:56 |
| morganfainberg | dstanek, hehe | 19:56 |
| dstanek | morganfainberg: i fixed up /opt/stack/keystone/.git/.COMMIT_EDITMSG.swp | 19:56 |
| dstanek | blah.... | 19:56 |
| morganfainberg | LOL | 19:56 |
| dstanek | https://review.openstack.org/#/c/98996/11 | 19:57 |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone: Standardizing the Federation Process https://review.openstack.org/105597 | 19:57 |
| morganfainberg | ok i think i almost have the audit_ids in tokens code done | 19:58 |
| *** nkinder has quit IRC | 20:04 | |
| *** gokrokve has quit IRC | 20:05 | |
| *** gokrokve has joined #openstack-keystone | 20:06 | |
| *** leonchio__ has quit IRC | 20:08 | |
| *** gokrokve has quit IRC | 20:08 | |
| *** gokrokve has joined #openstack-keystone | 20:08 | |
| *** andreaf_ has joined #openstack-keystone | 20:14 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add audit ids to tokens https://review.openstack.org/114306 | 20:14 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add audit ids to tokens https://review.openstack.org/114306 | 20:15 |
| morganfainberg | dstanek, slowly i'm populating new token unit tests in the keystone.token.unit.token package :) | 20:16 |
| morganfainberg | erm keystone.test.unit.token | 20:16 |
| *** andreaf has quit IRC | 20:17 | |
| *** jasondotstar has quit IRC | 20:19 | |
| *** nkinder has joined #openstack-keystone | 20:21 | |
| dstanek | morganfainberg: nice, | 20:21 |
| morganfainberg | topol, ^ you might want to look at that from an audit perspective | 20:22 |
| morganfainberg | jamielennox|away, ping re: printing token information when you're back. | 20:22 |
| morganbird | Hey all, I asked in #openstack-horizon but it seems dead: is there a recommendation or working prototype for third party auth with horizon and keystone? I've got federated keystone working with a SAML IdP but can't find much on integrating horizon with federated keystone. | 20:24 |
| morganbird | Just looking for a point in the right direction. | 20:27 |
| openstackgerrit | Brad Topol proposed a change to openstack/keystone: Add audit support to keystone federation implements bp/audit-support-for-federation https://review.openstack.org/114337 | 20:32 |
| *** leonchio_ has joined #openstack-keystone | 20:34 | |
| *** tpatil has joined #openstack-keystone | 20:36 | |
| openstackgerrit | Brad Topol proposed a change to openstack/keystone: Add audit support to keystone federation implements bp audit-support-for-federation https://review.openstack.org/114337 | 20:36 |
| tpatil | ayoung: Are you there? | 20:37 |
| ayoung | tpatil, Ain't nobody here but us chickens | 20:38 |
| *** ayoung is now known as chicken | 20:39 | |
| *** chicken is now known as ayoung | 20:39 | |
| tpatil | ayoung: Can you please review this patch https://review.openstack.org/#/c/107482/? Need one more +2 to get this patch merged. Thanks. | 20:39 |
| ayoung | tpatil, have you reviewed any of my patches? I mean, c'mon, fair is fair. | 20:39 |
| ayoung | Heh | 20:39 |
| ayoung | But I like that patch of yours | 20:40 |
| ayoung | and I'm totally joking. Don't bother looking at my patch list | 20:40 |
| ayoung | tpatil, check me on this. the "listen" code is not really dealing with the SIGHUP issue, right? I mean, it looks good, but it is a different bug? | 20:41 |
| tpatil | ayoung: Let me explain it in 2 steps | 20:44 |
| ayoung | please do | 20:44 |
| tpatil | ayoung: 1. First we have added reset method as the service framework requires the wsgiservice to implement reset method. | 20:44 |
| ayoung | OK | 20:44 |
| ayoung | but that is just a pass | 20:45 |
| ayoung | what does that fix? | 20:45 |
| ayoung | ah | 20:45 |
| tpatil | ayoung: after the reset method wass added, we got "SSL object can not be duplicated" error so we have made other changes including changing listen method. | 20:45 |
| ayoung | AttributeError: 'Server' object has no attribute 'reset'. | 20:45 |
| tpatil | ayoung: Yes | 20:46 |
| ayoung | tpatil, any issues in converting regular socket to ssl? | 20:46 |
| ayoung | it hasn't started listening, so no room for a non-secured request on it, right? | 20:47 |
| *** rushiagr is now known as rushiagr_away | 20:47 | |
| *** morganbird has quit IRC | 20:48 | |
| tpatil | ayoung: I need to check this in my environment, checking now.. | 20:49 |
| ayoung | tpatil, what is the sequence? start is called before listen, I assume? | 20:50 |
| tpatil | young: listen is called first, in which socket is created, then the service framework calls start method after SIGHUP signal is sent. | 20:51 |
| ayoung | tpatil, its no different than what happens now, I see | 20:52 |
| tpatil | ayoung: after the SIGHUP signal is sent, when the server is killed that socket is closed, so we have duplicated the socket in the start method. | 20:52 |
| ayoung | just that you are duplicating after the listen, so if there is a problem with your code, it is there in the existing, | 20:53 |
| ayoung | I suspect that nothing can be done until the pool.spawn is called at the bottom. | 20:54 |
| tpatil | ayoung: yes, the issue is there in the existing code, we have tried to fix it here. | 20:54 |
| ayoung | tpatil, I assume that the list....wrap_ssl pattern is the greenthread norm? | 20:55 |
| ayoung | tpatil, OK, let me try this on my machine... | 20:56 |
| tpatil | aoyung: FYI, you can find the same design implemented in the cinder/nova services. | 20:56 |
| ayoung | tpatil, I assure you that gives me no reassurance what-so-ever. It just means we copied each other. | 20:56 |
| tpatil | ayoung: s/aoyung/ayoung | 20:56 |
| ayoung | But your part of the code looks ok | 20:56 |
| ayoung | tpatil, OK, how do I trigger the bug? I am running code without your patch. | 20:57 |
| tpatil | ayoung: kill -SIGHUP <process_id> | 20:58 |
| ayoung | tpatil, and....? | 20:59 |
| tpatil | if you are using devstack, then you need to make changes to the "_is_daemon" to return TRUE here or run keystone service as a daemon. | 20:59 |
| ayoung | killed the server ,but no error | 20:59 |
| ayoung | ok | 20:59 |
| ayoung | Got it. | 21:00 |
| ayoung | I can just run bin/keytstone-all & | 21:00 |
| ayoung | now let me try your code | 21:00 |
| tpatil | ayoung: ok | 21:01 |
| ayoung | tpatil, need to update my venv.... | 21:03 |
| tpatil | ayoung: ok | 21:04 |
| ayoung | tpatil, I kindof need to run this one by hand, as there really is no trusting the CI to catch this, is there | 21:05 |
| tpatil | ayoung: I and stank together had tested this patch in his environment few days ago. | 21:07 |
| tpatil | s/stank/dstanek | 21:08 |
| *** jsavak has quit IRC | 21:10 | |
| *** stevemar has quit IRC | 21:10 | |
| ayoung | tpatil, Very nice | 21:12 |
| ayoung | tpatil, let me know if Gate chokes on it, but it should merge | 21:13 |
| tpatil | ayoung: Aure. Thanks for approving this patch | 21:13 |
| tpatil | s/Aure/Sure | 21:13 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: WiP: Script to sync oslo https://review.openstack.org/114305 | 21:14 |
| *** hrybacki has quit IRC | 21:18 | |
| *** zzzeek has quit IRC | 21:23 | |
| *** cjellick_ has joined #openstack-keystone | 21:24 | |
| *** cjellick has quit IRC | 21:26 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add audit ids to tokens https://review.openstack.org/114306 | 21:26 |
| dstanek | marekd|away: you hacking on the "Federation Process" review? | 21:34 |
| marekd|away | dstanek: https://review.openstack.org/#/c/105597/ this one? | 21:35 |
| dstanek | marekd|away: yep | 21:35 |
| marekd|away | dstanek: no, i posted my comments only. | 21:35 |
| marekd|away | i meant 'their' changes :-) | 21:35 |
| dstanek | :-) i may fix my nits are push again - but i'm not going to address the older tests or the REMOTE_USER issue you brought up | 21:36 |
| *** zzzeek has joined #openstack-keystone | 21:36 | |
| marekd|away | dstanek: i am gonna crash soon, so could you please copy my comments to the new version so kwss or gyee can see them tmrw? | 21:38 |
| dstanek | marekd|away: sure, i'll make sure it's obvious that there is still work to be done | 21:38 |
| morganfainberg | dstanek, i like the WIP button for that. | 21:38 |
| morganfainberg | dstanek, forces another patchset before it can merge (at the least) | 21:39 |
| marekd|away | unless you know what was their idea and can answer on behalf of them. | 21:39 |
| dstanek | morganfainberg: good point. | 21:39 |
| *** openstackgerrit has quit IRC | 21:46 | |
| *** openstackgerrit has joined #openstack-keystone | 21:47 | |
| *** topol has quit IRC | 21:51 | |
| *** andreaf has joined #openstack-keystone | 21:55 | |
| *** andreaf has quit IRC | 21:56 | |
| *** andreaf has joined #openstack-keystone | 21:56 | |
| *** andreaf has quit IRC | 21:56 | |
| *** tpatil has quit IRC | 21:57 | |
| *** andreaf_ has quit IRC | 21:58 | |
| *** cjellick_ has quit IRC | 22:04 | |
| *** cjellick has joined #openstack-keystone | 22:04 | |
| *** cjellick has quit IRC | 22:08 | |
| dstanek | dolphm, bknudson: i'm heading out for dinner in a bit. when i get back i'll work on https://bugs.launchpad.net/keystone/+bug/1354208 if it's not assigned to anyone else | 22:09 |
| bknudson | dstanek: I haven't had time to work on it, so go ahead | 22:09 |
| dstanek | bknudson: i'm planning on starting off with a whitelist and see who barks | 22:09 |
| bknudson | dstanek: I think that's the direction people are leaning. | 22:10 |
| dolphm | dstanek: =D | 22:12 |
| morganfainberg | dolphm, before i start down the next steps in this path (of resolving the ick in low resolution time stamps): any thoughts concerns about https://review.openstack.org/#/c/114306/ adding audit ids into the token? | 22:15 |
| morganfainberg | dolphm, not sure if you saw the earlier conversation(s) | 22:15 |
| *** david-lyle has quit IRC | 22:15 | |
| morganfainberg | dolphm, i expect some doc updates to go with it as well but nothing too crazy | 22:16 |
| dolphm | morganfainberg: i missed the earlier conversation, but i already like the direction | 22:16 |
| dolphm | morganfainberg: "audit id" makes it sound globally unique though :-/ | 22:16 |
| morganfainberg | the audit ids are uuids | 22:16 |
| morganfainberg | they *should* be unique | 22:17 |
| dolphm | morganfainberg: oh, maybe i'm misreading | 22:17 |
| morganfainberg | the concept is you have 2 values, 1 the token's audit, 2 the audit chain id | 22:17 |
| morganfainberg | if a token hasn't been rescoped it only has the audit id | 22:17 |
| dolphm | oh, so tokens way down the line will be huge? | 22:17 |
| morganfainberg | if a token has been rescoped it also contains the 1st token's audit id as index[1] | 22:17 |
| morganfainberg | you never have more than 2 values | 22:18 |
| morganfainberg | your id, and the first token in the chain's id | 22:18 |
| morganfainberg | prevents balloning tokens | 22:18 |
| dolphm | morganfainberg: hmm | 22:18 |
| morganfainberg | it allows us to revoke a whole chain, or an individual token | 22:18 |
| dolphm | morganfainberg: i read it first as an incrementing integer (like the audit ID was an index into the chain of tokens) <-- which won't work | 22:19 |
| bknudson | you can revoke all the tokens in a chain with the same scope | 22:19 |
| dolphm | morganfainberg: what's the point in having the second, per-token ID ? | 22:19 |
| morganfainberg | bknudson, technically we could expand beyond that w/o causing issues with this. but yes initially that is the limit | 22:19 |
| bknudson | I don't think we'll be able to revoke an individual token | 22:19 |
| dolphm | just per token revocation? | 22:19 |
| morganfainberg | dolphm, yes, which solves the horizon can't handle revocing the whole chain issue | 22:20 |
| morganfainberg | dolphm, we can also publish both ids on any auth_token request and show where a token came from. | 22:20 |
| morganfainberg | bknudson, we can use the individual token id, that should be unique | 22:20 |
| morganfainberg | bknudson, if we want to revoke a single token | 22:20 |
| bknudson | how would that be represented in a revocation event? | 22:21 |
| morganfainberg | bknudson, audit_id = <id> | 22:21 |
| morganfainberg | bknudson, vs audit_chain_id=<id> | 22:21 |
| dolphm | morganfainberg: why is this not just 'id' ? | 22:21 |
| morganfainberg | first one is one token revocation, one is audit chain | 22:21 |
| morganfainberg | dolphm, token ids are "secure" data (why revocation list was priviledged) | 22:21 |
| dolphm | oh because you have to add this to v2 tokens as well... | 22:21 |
| bknudson | we don't have a "revoke audit chain" API | 22:22 |
| bknudson | all we have is "revoke token" | 22:22 |
| morganfainberg | bknudson, not yet. i was trying to figure out how we'd add that. | 22:22 |
| dolphm | morganfainberg: revocation list became hashes of tokens anyway | 22:22 |
| morganfainberg | dolphm, except hashes can be used as tokens, uuid-form | 22:22 |
| dolphm | yeah that was dumb | 22:22 |
| morganfainberg | dolphm, if i could un-do it w/o breaking things i would | 22:23 |
| bknudson | we could change the revocation list to use these. | 22:23 |
| dolphm | alright, i can't break your approach :) | 22:23 |
| morganfainberg | bknudson, ++ we can. | 22:23 |
| bknudson | they're shorter | 22:23 |
| *** david-lyle has joined #openstack-keystone | 22:23 | |
| morganfainberg | bknudson, yep! | 22:23 |
| morganfainberg | i also kinda dig using uuid4().bytes.encode('base64') fwiw | 22:24 |
| morganfainberg | it's... a bit cooler than .hex imo :P a little more work though | 22:24 |
| *** nkinder has quit IRC | 22:24 | |
| bknudson | morganfainberg: put it in a function then it's less work | 22:25 |
| morganfainberg | bknudson, it is! :) but i mean from a code perspective, encode does require (minutely) more cpu than .hex iirc | 22:25 |
| morganfainberg | dolphm, i just wanted to run it by you before i did a bunch of extra work on the revocation front to use this. so we aren't using the low resolution and conflicting expires timestamp | 22:26 |
| morganfainberg | bknudson, interesting idea converting to use the audit ids in the revocation list as well | 22:28 |
| bknudson | morganfainberg: os.urandom(16).encode('base64') would give the same result | 22:28 |
| morganfainberg | bknudson, *nod* | 22:28 |
| *** gokrokve has quit IRC | 22:28 | |
| morganfainberg | it *could* allow us to make TRL non-priviledged all | 22:29 |
| morganfainberg | all=call | 22:29 |
| *** david-lyle has quit IRC | 22:29 | |
| *** david-lyle has joined #openstack-keystone | 22:29 | |
| dolphm | umm, who wants to be core on pycadf? please form an orderly line | 22:31 |
| morganfainberg | dolphm, if you need reviewers, i'll be. | 22:34 |
| bknudson | dolphm: you own it now | 22:34 |
| morganfainberg | dolphm, but uh. *shrug* doesn't matter to me. | 22:34 |
| dolphm | i'm rewriting it, will need reviews :P | 22:34 |
| morganfainberg | sure. i'll review it | 22:34 |
| morganfainberg | dolphm, topol said you were doing magic to it | 22:35 |
| bknudson | there are some projects where core just approve their own changes | 22:35 |
| morganfainberg | bknudson, not sure if we want the audit lib to work like that. just sayin :P | 22:35 |
| dolphm | replacing all the java with jsonschema | 22:35 |
| dolphm | morganfainberg: ++ lol | 22:35 |
| morganfainberg | but it might make sense to do 1 core +2 on it if it doesn't say inherit all of keystonecore | 22:35 |
| morganfainberg | dolphm, you *could* make that core team inherit keystonecore if you wanted. | 22:36 |
| dolphm | morganfainberg: i was considering exactly that | 22:37 |
| bknudson | dolphm: are you keeping the current cadf core? | 22:38 |
| dolphm | if everyone is still engaged, i think that's reasonable | 22:38 |
| bknudson | I assume that was gordc and matt rutkowski and etc | 22:38 |
| morganfainberg | bknudson, and dhellmann | 22:38 |
| morganfainberg | bknudson, https://review.openstack.org/#/admin/groups/192,members | 22:39 |
| morganfainberg | though might want to drop oslo-core, (not sure if that makes sense) | 22:39 |
| morganfainberg | interesting, aparantly everyone in oslo-core is part of pycadf-ptl | 22:40 |
| bknudson | what's the size of the code base? | 22:40 |
| *** gokrokve has joined #openstack-keystone | 22:40 | |
| bknudson | I assume it's not so big that a keystone core couldn't grasp changes in it already | 22:41 |
| bknudson | so putting keystone core on there doesn't worry me | 22:41 |
| dolphm | example of my rewriting it, and also cover topol's new use case for federation: https://review.openstack.org/#/c/114356/5/pycadf/credential.py | 22:42 |
| bknudson | it is actually pretty big | 22:42 |
| morganfainberg | bknudson, about 6k lines | 22:43 |
| morganfainberg | inc. shared oslo-incubator stuff | 22:43 |
| dolphm | bknudson: well i should be making it smaller, hopefully | 22:43 |
| dolphm | it needs more tests too, but that's not a big deal | 22:43 |
| dolphm | i'm not really sure what's public API, either, so i don't know what i need to avoid breaking | 22:44 |
| bknudson | dolphm: that's what I was just thinking... the change of "credential.CRED_KEYNAMES" -- was that a public API? | 22:45 |
| dolphm | or if i just need to bump the major version at the end of this, and focus on maintaining the obviously public APIs | 22:45 |
| dolphm | bknudson: i have no idea on that one. nothing else was using it so i made it go away | 22:45 |
| dolphm | the tests are calling into what i would consider to be private APIs | 22:45 |
| dolphm | bknudson: in the rewrite, everything will just be dicts with a 'schema' attribute, and a 'valid' attribute. and the dicts self-validate on init | 22:46 |
| dolphm | so that should minimize the API surface area to worry about | 22:47 |
| morganfainberg | dolphm, nice. | 22:49 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Standardizing the Federation Process https://review.openstack.org/105597 | 22:50 |
| dolphm | the way end users import this stuff is also a bit messy... it seems logical to break this into service types maybe? from pycadf import identity; identity.Credential() identity.Authentication() etc | 22:50 |
| *** gordc has quit IRC | 22:54 | |
| *** amcrn has joined #openstack-keystone | 22:54 | |
| bknudson | this library is kind of weird... I thought it wasn't openstack specific | 22:55 |
| bknudson | lots of TODOs in there. | 22:57 |
| *** bknudson has quit IRC | 23:05 | |
| *** leonchio__ has joined #openstack-keystone | 23:10 | |
| dolphm | bknudson: any idea what these were supposed to be used for? TYPE_URI_GEOLOCATION = cadftype.CADF_VERSION_1_0_0 + 'geolocation' | 23:13 |
| dolphm | there's one in every module | 23:13 |
| dolphm | oh you're gone. boo. | 23:13 |
| *** leonchio_ has quit IRC | 23:13 | |
| *** leonchio_ has joined #openstack-keystone | 23:17 | |
| *** leonchio__ has quit IRC | 23:17 | |
| *** arun_kant has quit IRC | 23:20 | |
| morganfainberg | dolphm, GEOLOCATION? | 23:20 |
| dolphm | morganfainberg: it's like a location, but on earth? | 23:22 |
| morganfainberg | dolphm, LOL | 23:22 |
| dolphm | morganfainberg: it's one of hte modules with an event type | 23:22 |
| morganfainberg | dolphm, yeah it looks like it's meant to be something like IP->location magic support | 23:22 |
| dolphm | morganfainberg: i'm really asking about the TYPE_URI_<MODULE_NAME> = VERSION stuff | 23:23 |
| morganfainberg | right | 23:23 |
| morganfainberg | dolphm, looks like version of cadf spec? lib? and the module identifier, looks like event is the only one using it? | 23:24 |
| morganfainberg | dolphm, aha, looks like it's a TODO https://github.com/openstack/pycadf/blob/master/pycadf/event.py#L131 | 23:26 |
| dolphm | morganfainberg: well, i left that line in https://review.openstack.org/#/c/114356/6/pycadf/geolocation.py | 23:27 |
| morganfainberg | yeah i think it's future looking stuff | 23:27 |
| morganfainberg | dolphm, question on the .is_valid that is potentially used if a dataum is changed after init? | 23:28 |
| morganfainberg | which is why it can return false? or is it assumed you never validate outide of init? | 23:28 |
| dolphm | morganfainberg: yeah, that's why i left it as a public method | 23:28 |
| morganfainberg | ah ok | 23:28 |
| morganfainberg | yeah it looked a bit odd since it *seemed* like everything should be init only validation | 23:28 |
| morganfainberg | but backwards compat | 23:29 |
| dolphm | ++ | 23:29 |
| dolphm | if i was going to remove it, i'd want it to be an immutable dict | 23:29 |
| *** elmiko is now known as _elmiko | 23:30 | |
| *** jamielennox|away is now known as jamielennox | 23:31 | |
| morganfainberg | dolphm, ++ .__setitem__ raise NotouchyTheValuesOrKeyst() | 23:31 |
| dolphm | lol | 23:31 |
| dolphm | file a no-touchy blueprint please :D | 23:31 |
| morganfainberg | lol | 23:31 |
| morganfainberg | i wish descriptors were easier on the eyes | 23:32 |
| dolphm | and on bkhudson's concern earlier, this lib is VERY openstack centric... i'd like to maybe split it apart into openstack stuff and generic cadf stuff | 23:32 |
| morganfainberg | but jsonschema + descriptors are particularly brutal | 23:32 |
| dolphm | still one lib, but make a clean separation if it's going to squat on pypi/pycadf | 23:32 |
| dolphm | brutal? | 23:33 |
| morganfainberg | yeah it's just really hard to follow | 23:33 |
| morganfainberg | i really like descriptors, they are soooooooo cool | 23:33 |
| morganfainberg | you also get instant validation if you want | 23:33 |
| morganfainberg | X.prop = thing, raise Exception if not valid | 23:33 |
| *** nkinder has joined #openstack-keystone | 23:33 | |
| dolphm | morganfainberg: oh i thought you were talking about https://github.com/openstack/pycadf/blob/master/pycadf/event.py#L81 | 23:33 |
| dolphm | now i follow! | 23:33 |
| morganfainberg | dolphm, i'm talking about all the descriptors in pycadf | 23:34 |
| morganfainberg | dolphm, you're switching from descriptors to jsonschema | 23:34 |
| morganfainberg | much more readable, but i kinda dig the metaprogramming aspect of descriptors | 23:34 |
| dolphm | let's talk about it tomorrow | 23:34 |
| dolphm | i'm running off to see guadians of the galaxy now :) | 23:35 |
| morganfainberg | haha Nice enjoy! | 23:35 |
| jamielennox | dolphm, morganfainberg: i have a +2 from bk on https://review.openstack.org/#/c/107325/ | 23:35 |
| jamielennox | the /auth spec | 23:35 |
| morganfainberg | and don't get me wrong, i am not saying what you're doing is wrong there. it does help make it a lot more clear what is going on | 23:35 |
| jamielennox | if we can approve i'll write the code today | 23:35 |
| morganfainberg | jamielennox, let me look before i run off to the gym | 23:36 |
| jamielennox | morganfainberg: also, i'm here regarding token informatoin | 23:36 |
| morganfainberg | jamielennox, also, you might like https://review.openstack.org/#/c/114306/ | 23:36 |
| morganfainberg | jamielennox, the concept, not the code :P | 23:36 |
| morganfainberg | code is... open for discussion of course | 23:36 |
| jamielennox | cool - do you know how this plays into the osprofiler thingy? | 23:37 |
| morganfainberg | jamielennox, this would solve our need, not sure if osprofiler would benefit from it | 23:37 |
| morganfainberg | we can't rely on osprofiler for secure in-token data | 23:38 |
| jamielennox | that's enough for me, i just know they were trying to add there own tracking data as well | 23:38 |
| jamielennox | morganfainberg: i had a similar question regarding composite tokens | 23:38 |
| morganfainberg | this is *mostly* for us to beable to revoke tokens / chains of tokens without needing to rely on expires_at (whcih is crummy and can conflict all over) | 23:39 |
| jamielennox | if you get a request with a service and user token, and have to make a request to another service, do you replace or chain the service token | 23:39 |
| jamielennox | morganfainberg: oh, i thought it was audit trail | 23:39 |
| morganfainberg | jamielennox, it also acts like an audit trail | 23:39 |
| jamielennox | morganfainberg: honestly for that all we really need to do is break the link that token_id == sha1(token) right? | 23:39 |
| morganfainberg | jamielennox, we can track a token, not nessicarily a request. | 23:39 |
| morganfainberg | jamielennox, i don't think osprofiler can track tokens easily esp. when it comes to rescoping | 23:40 |
| morganfainberg | this would let us track that kind of stuff so it is an audit trail, just not the same kind-of audit trail | 23:40 |
| morganfainberg | jamielennox, i would love to break token_id == sha1(token) but lets be honest we can't. and hashing is all sorts of encumbered by auditors. | 23:41 |
| jamielennox | morganfainberg: yea, i said it, then thought for a secnod - it can't be done | 23:41 |
| morganfainberg | this solution no one can really complain about because the data is random, not used for "auth" reasons, and should be unique enough to identify a token (and the originating token for any other tokens) | 23:41 |
| jamielennox | anyway regarding composite tokens, you don't want to chain service tokens do yo? | 23:42 |
| morganfainberg | re: composite auth, no service tokens should *only* be used by that service | 23:42 |
| morganfainberg | and should not be passed on. | 23:42 |
| morganfainberg | e.g. service token to nova should not then be used by nova to talk to glance, nova should use it's own service token if that is needed | 23:43 |
| morganfainberg | we talked through the chaining stuff and i think it was such an edge case that would be needed, it wasn't worth it. | 23:43 |
| morganfainberg | and it makes things super complex | 23:43 |
| jamielennox | yep, thats what i thought. there might bevery specific cases where the chain would be useful but it's way too hard | 23:43 |
| jamielennox | arosen1: i don't know much about how neutronclient uses the sessions, but did you find an answer? | 23:45 |
| morganfainberg | jamielennox, +2 from me on that spec | 23:47 |
| jamielennox | morganfainberg: excellent, that's been sitting a while - noone objected but noone cared enough to vote | 23:47 |
| morganfainberg | jamielennox, i didn't +A just giving a little more time in case dolph wants to say something about it | 23:48 |
| morganfainberg | you know the whole... sneaking things in when no one is awake | 23:48 |
| morganfainberg | but i would say you're good to write the code (i'll press +A tomorrow if no one says anything else) - i'm sure it'll just be nits if anything though | 23:48 |
| *** leonchio__ has joined #openstack-keystone | 23:50 | |
| jamielennox | morganfainberg: yea, i figured i needed to write it anyway, going to figure out my client rebase hell and do that | 23:50 |
| *** david-lyle has quit IRC | 23:51 | |
| *** david-lyle has joined #openstack-keystone | 23:51 | |
| *** leonchio_ has quit IRC | 23:53 | |
| *** leonchio_ has joined #openstack-keystone | 23:55 | |
| *** david-lyle has quit IRC | 23:56 | |
| *** leonchio__ has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!