| *** topol has joined #openstack-keystone | 00:03 | |
| *** dims has joined #openstack-keystone | 00:10 | |
| *** dims has quit IRC | 00:14 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Change tenant to project https://review.openstack.org/127066 | 00:14 |
|---|---|---|
| *** bknudson has quit IRC | 00:14 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Change admin user to service user. https://review.openstack.org/127075 | 00:14 |
| *** dims has joined #openstack-keystone | 00:14 | |
| *** Kui has quit IRC | 00:17 | |
| *** _cjones_ has quit IRC | 00:18 | |
| *** _cjones_ has joined #openstack-keystone | 00:19 | |
| *** marcoemorais has quit IRC | 00:20 | |
| *** marcoemorais has joined #openstack-keystone | 00:21 | |
| *** _cjones_ has quit IRC | 00:23 | |
| *** NM has joined #openstack-keystone | 00:38 | |
| *** NM has quit IRC | 00:44 | |
| *** shakayumi has quit IRC | 00:45 | |
| morganfainberg | why is it that when i need a second brain it always ends up being silly late where everyone is :P | 00:45 |
| *** alex_xu has joined #openstack-keystone | 00:55 | |
| *** marcoemorais has quit IRC | 00:57 | |
| *** amcrn has quit IRC | 01:00 | |
| *** richm has quit IRC | 01:01 | |
| dims | morganfainberg: i am here for you :) | 01:16 |
| *** andreaf has quit IRC | 01:18 | |
| *** andreaf has joined #openstack-keystone | 01:19 | |
| nkinder | morganfainberg: what are we, chopped liver? ;) | 01:24 |
| morganfainberg | Haha ;) | 01:25 |
| *** rwsu has quit IRC | 01:30 | |
| *** zhiyan|afk has joined #openstack-keystone | 01:32 | |
| *** andreaf has quit IRC | 01:32 | |
| *** andreaf has joined #openstack-keystone | 01:32 | |
| *** rwsu has joined #openstack-keystone | 01:32 | |
| *** jorge_munoz has joined #openstack-keystone | 01:33 | |
| *** zhiyan has quit IRC | 01:33 | |
| *** vishy has quit IRC | 01:33 | |
| *** vish1 has joined #openstack-keystone | 01:33 | |
| *** vish1 is now known as vishy | 01:33 | |
| *** dims has quit IRC | 01:34 | |
| *** zhiyan|afk is now known as zhiyan | 01:34 | |
| *** dims has joined #openstack-keystone | 01:35 | |
| *** openstack has joined #openstack-keystone | 01:42 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 01:42 | |
| *** dims has quit IRC | 01:42 | |
| *** jorge_munoz has quit IRC | 01:42 | |
| *** csd_ has joined #openstack-keystone | 01:42 | |
| *** Guest49899 has quit IRC | 01:42 | |
| *** anteaya has quit IRC | 01:42 | |
| *** csd has quit IRC | 01:42 | |
| *** dvorak has quit IRC | 01:42 | |
| *** csd_ is now known as csd | 01:42 | |
| *** larsks|alt has joined #openstack-keystone | 01:43 | |
| *** mfisch` has joined #openstack-keystone | 01:43 | |
| *** fifieldt has joined #openstack-keystone | 01:43 | |
| *** openstackgerrit has joined #openstack-keystone | 01:43 | |
| *** anteaya has joined #openstack-keystone | 01:52 | |
| *** dvorak has joined #openstack-keystone | 01:52 | |
| *** jorge_munoz has joined #openstack-keystone | 01:52 | |
| *** jorge_munoz has quit IRC | 01:52 | |
| *** jorge_munoz has joined #openstack-keystone | 01:56 | |
| *** shakamunyi has joined #openstack-keystone | 01:58 | |
| *** samuelms_home has joined #openstack-keystone | 02:01 | |
| *** jorge_munoz has quit IRC | 02:01 | |
| *** andreaf has quit IRC | 02:03 | |
| *** andreaf has joined #openstack-keystone | 02:03 | |
| *** samuelms__ has joined #openstack-keystone | 02:08 | |
| *** larsks|alt is now known as larsks | 02:12 | |
| *** samuelms_home has quit IRC | 02:12 | |
| *** lhcheng has quit IRC | 02:16 | |
| *** lhcheng has joined #openstack-keystone | 02:16 | |
| *** harlowja is now known as harlowja_away | 02:21 | |
| *** lhcheng has quit IRC | 02:21 | |
| *** shakayumi has joined #openstack-keystone | 02:24 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Fixes docstring at eventlet_server https://review.openstack.org/128496 | 02:25 |
| *** shakamunyi has quit IRC | 02:27 | |
| *** samuelms__ has quit IRC | 02:31 | |
| *** alex_xu has quit IRC | 02:31 | |
| *** dims has joined #openstack-keystone | 02:36 | |
| *** alex_xu has joined #openstack-keystone | 02:39 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 02:39 | |
| *** dims has quit IRC | 02:40 | |
| *** stevemar has joined #openstack-keystone | 02:44 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Fixes docstring at eventlet_server https://review.openstack.org/128496 | 02:46 |
| *** amcrn has joined #openstack-keystone | 02:47 | |
| *** marcoemorais has joined #openstack-keystone | 02:53 | |
| *** marcoemorais1 has joined #openstack-keystone | 02:54 | |
| *** andreaf has quit IRC | 02:56 | |
| *** andreaf has joined #openstack-keystone | 02:56 | |
| *** marcoemorais has quit IRC | 02:57 | |
| openstackgerrit | takehirokaneko proposed a change to openstack/keystone: Adds a validation param "max_username_size". https://review.openstack.org/128504 | 03:10 |
| *** ayoung has joined #openstack-keystone | 03:12 | |
| *** ayoung has quit IRC | 03:14 | |
| *** ayoung has joined #openstack-keystone | 03:14 | |
| *** lhcheng has joined #openstack-keystone | 03:17 | |
| *** lhcheng has quit IRC | 03:22 | |
| *** lhcheng has joined #openstack-keystone | 03:26 | |
| *** sunrenjie has joined #openstack-keystone | 03:26 | |
| *** radez is now known as radez_g0n3 | 03:26 | |
| *** ajayaa has joined #openstack-keystone | 03:30 | |
| *** david-lyle has joined #openstack-keystone | 03:45 | |
| *** amcrn has quit IRC | 03:50 | |
| *** wpf has quit IRC | 03:54 | |
| *** andreaf has quit IRC | 03:54 | |
| *** andreaf has joined #openstack-keystone | 03:55 | |
| r1chardj0n3s | ayoung: I have replaced the rubby parts of angboard with the node.js programming language to appease you :) | 03:58 |
| *** ajayaa has quit IRC | 04:04 | |
| *** renlt has joined #openstack-keystone | 04:07 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Use oslo.utils and oslo.serialization https://review.openstack.org/128454 | 04:23 |
| *** dims has joined #openstack-keystone | 04:25 | |
| *** swamireddy has joined #openstack-keystone | 04:25 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Use oslo.utils and oslo.serialization https://review.openstack.org/128454 | 04:25 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Set install_venv_common as a script, not a module https://review.openstack.org/128455 | 04:28 |
| *** dims has quit IRC | 04:29 | |
| *** andreaf has quit IRC | 04:30 | |
| *** andreaf has joined #openstack-keystone | 04:30 | |
| *** gyee has quit IRC | 04:34 | |
| *** wpf has joined #openstack-keystone | 04:47 | |
| *** ncoghlan has joined #openstack-keystone | 04:52 | |
| *** lhcheng has quit IRC | 04:58 | |
| *** ajayaa has joined #openstack-keystone | 05:12 | |
| *** ukalifon1 has joined #openstack-keystone | 05:24 | |
| *** toddnni has quit IRC | 05:24 | |
| openstackgerrit | takehirokaneko proposed a change to openstack/keystone: Adds a validation param "max_username_size". https://review.openstack.org/128504 | 05:26 |
| *** alex_xu has quit IRC | 05:31 | |
| *** alex_xu has joined #openstack-keystone | 05:47 | |
| *** lhcheng has joined #openstack-keystone | 05:50 | |
| *** lhcheng has quit IRC | 05:51 | |
| *** lhcheng has joined #openstack-keystone | 05:52 | |
| *** lhcheng_ has joined #openstack-keystone | 05:56 | |
| *** lhcheng has quit IRC | 05:56 | |
| *** lhcheng_ has quit IRC | 05:57 | |
| *** lhcheng has joined #openstack-keystone | 05:57 | |
| *** lhcheng has quit IRC | 05:59 | |
| *** lhcheng has joined #openstack-keystone | 06:00 | |
| *** zigo has joined #openstack-keystone | 06:08 | |
| *** stevemar has quit IRC | 06:12 | |
| *** ncoghlan is now known as ncoghlan_afk | 06:13 | |
| *** dims has joined #openstack-keystone | 06:13 | |
| *** david-lyle has quit IRC | 06:14 | |
| *** dims has quit IRC | 06:18 | |
| *** stevemar has joined #openstack-keystone | 06:27 | |
| *** ncoghlan_afk is now known as ncoghlan | 06:30 | |
| *** jacer_huawei has quit IRC | 06:31 | |
| *** stevemar has quit IRC | 06:31 | |
| *** afazekas has joined #openstack-keystone | 06:36 | |
| *** stevemar has joined #openstack-keystone | 06:37 | |
| *** jamiec has quit IRC | 06:41 | |
| *** andreaf has quit IRC | 06:50 | |
| *** Guest86578 is now known as d0ugal | 07:04 | |
| *** jamiec has joined #openstack-keystone | 07:05 | |
| *** d0ugal has quit IRC | 07:05 | |
| *** d0ugal has joined #openstack-keystone | 07:05 | |
| *** jamiec has quit IRC | 07:20 | |
| *** marcoemorais1 has quit IRC | 07:25 | |
| *** jamiec has joined #openstack-keystone | 07:26 | |
| *** topol has quit IRC | 07:31 | |
| *** jamiec has quit IRC | 07:38 | |
| *** lhcheng has quit IRC | 07:42 | |
| *** lhcheng has joined #openstack-keystone | 07:42 | |
| *** jamiec has joined #openstack-keystone | 07:43 | |
| *** lhcheng has quit IRC | 07:47 | |
| *** navid_ has quit IRC | 07:51 | |
| marekd|away | stevemar: thanks, I will take another round before Friday. | 07:55 |
| marekd|away | stevemar: actually, 90% of that was you :-) I only added 2 slides :-) | 07:56 |
| stevemar | marekd|away, np, i would have made suggestions but i don't know enough about what you are trying to convey :P | 07:56 |
| *** marekd|away is now known as marekd | 07:56 | |
| marekd | stevemar: appreciate, but I don't want you to waste your time on my part of the job :-) | 07:57 |
| stevemar | mehhhh, it's no issue, i just want our presentation to kick butt | 07:57 |
| marekd | stevemar: it will :-) | 08:00 |
| marekd | why are still not asleep ? | 08:01 |
| stevemar | marekd, drank coffee too late :( | 08:02 |
| *** jistr has joined #openstack-keystone | 08:02 | |
| marekd | stevemar: oh, lol | 08:03 |
| stevemar | marekd, i'm going to share a google doc with you :) | 08:05 |
| stevemar | please review it if you can | 08:05 |
| marekd | stevemar: ok | 08:05 |
| marekd | stevemar: it's about k2k ? | 08:05 |
| marekd | stevemar: or sth else | 08:05 |
| stevemar | marekd, OSC | 08:06 |
| marekd | stevemar: btw is CADF an open standard and IBM just contributes to it or it was created by IBM ? | 08:06 |
| stevemar | marekd, was open before we started, IIRC | 08:07 |
| marekd | stevemar: one more thing - is OSC also being cut just like keystoneclient is? | 08:08 |
| stevemar | marekd, not sure what you mean | 08:08 |
| stevemar | marekd, you mean whenever we want to release, we can? | 08:08 |
| stevemar | because yes | 08:08 |
| marekd | stevemar: i meant: do you make versions and official releases :-) | 08:08 |
| stevemar | marekd, technically we're still 'beta' since we don't have a 1.0 release | 08:09 |
| stevemar | but keystoneclient is also considered beta too | 08:09 |
| stevemar | but yeah, whenever we want we can cut a new version | 08:09 |
| stevemar | 0.5 should come out soon | 08:09 |
| stevemar | before paris | 08:09 |
| marekd | stevemar: ok | 08:09 |
| stevemar | dtroyer and i have been doing a lot of stuff the last 2 weeks | 08:10 |
| marekd | stevemar: i could see tha | 08:10 |
| marekd | t | 08:10 |
| stevemar | marekd, why do you ask? :) | 08:10 |
| marekd | i am curious. | 08:10 |
| marekd | and I would like to tell others that federation is now included in the pip release of the osc. | 08:11 |
| marekd | so they can simply type pip install openstackclient | 08:11 |
| marekd | stevemar: this google doc is for IBM's article? | 08:12 |
| stevemar | marekd, ah i see, and yes | 08:13 |
| stevemar | marekd, http://www.dmtf.org/sites/default/files/standards/documents/DSP0262_1.0.0.pdf lots of authors and contributors from other companies, we have a guy who co-chairs it | 08:14 |
| stevemar | (page 9) | 08:14 |
| marekd | stevemar: ok, thanks. | 08:14 |
| stevemar | marekd, i'm on the fence for the federation auth plugin in OSC | 08:15 |
| stevemar | adding lxml just scares me | 08:15 |
| marekd | stevemar: hmmm, but why would you add lxml to OSC ? | 08:16 |
| marekd | it should be all covered by keystoneclient. | 08:16 |
| stevemar | marekd, cause it's not actually used at all, it's a lot of bloat for a client | 08:16 |
| stevemar | i need to figure out if we can get it to pass jenkins without having it in test-req | 08:17 |
| marekd | stevemar: in other words, you don't want to include federation auht plugins by default in OSC? | 08:18 |
| stevemar | marekd, not at all, i want to, but i just dont want to list lxml as a dependency | 08:19 |
| marekd | stevemar: i suspect people will never read docs, and there will be lots of bugs "when i used federateion auth it blew my client" | 08:20 |
| marekd | stevemar: besides, lxml is already a dependency in keystoneclient. | 08:21 |
| marekd | stevemar: so i really don't see any need for putting lxml as osc dependency - > it will simply install keystoneclient as dep and this will include lxml | 08:21 |
| marekd | right? | 08:21 |
| marekd | stevemar: at the osc level we never touch any XML | 08:23 |
| stevemar | marekd, ahhh thats the things right there | 08:23 |
| marekd | ? | 08:23 |
| stevemar | marekd, see thats why i'm saying there is no need to list it in test-req, since it's installed by KSC. | 08:24 |
| stevemar | BUT it's also listed in test-req in KSC, so it's never actually installed there | 08:24 |
| stevemar | for some reason, if mhu takes it out of test-req, the tests fail | 08:24 |
| marekd | osc test-req or ksc test-req ? | 08:24 |
| *** ajayaa has quit IRC | 08:25 | |
| *** alex_xu has quit IRC | 08:27 | |
| stevemar | osc test req | 08:27 |
| stevemar | i commented | 08:28 |
| stevemar | i think i know whats going on | 08:28 |
| stevemar | anyway | 08:28 |
| stevemar | it's late, i'm outta here | 08:28 |
| marekd | stevemar: sure | 08:28 |
| stevemar | marekd, until next time! | 08:28 |
| marekd | stevemar: until afternoon :-) | 08:28 |
| *** rwsu has quit IRC | 08:31 | |
| *** stevemar has quit IRC | 08:32 | |
| openstackgerrit | A change was merged to openstack/keystone: wrong logic in assertValidRoleAssignmentListResponse method https://review.openstack.org/119303 | 08:41 |
| *** aix has joined #openstack-keystone | 08:42 | |
| *** ncoghlan has quit IRC | 08:47 | |
| *** alex_xu has joined #openstack-keystone | 08:49 | |
| *** rwsu has joined #openstack-keystone | 08:56 | |
| *** jacer_huawei has joined #openstack-keystone | 09:08 | |
| *** alex_xu has quit IRC | 09:09 | |
| *** aix has quit IRC | 09:19 | |
| *** nellysmitt has joined #openstack-keystone | 09:23 | |
| *** lsmola has quit IRC | 09:26 | |
| *** sunrenjie has quit IRC | 09:31 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: SAML2 wrapper plugin for full federation authN https://review.openstack.org/106751 | 09:34 |
| *** renlt has quit IRC | 09:34 | |
| *** lsmola has joined #openstack-keystone | 09:41 | |
| *** andreaf has joined #openstack-keystone | 09:46 | |
| *** andreaf has quit IRC | 09:53 | |
| *** Tahmina has joined #openstack-keystone | 09:54 | |
| *** aix has joined #openstack-keystone | 09:56 | |
| *** henrynash has joined #openstack-keystone | 09:58 | |
| *** henrynash has quit IRC | 10:01 | |
| *** amakarov_away is now known as amakarov | 10:02 | |
| *** henrynash has joined #openstack-keystone | 10:02 | |
| *** andreaf has joined #openstack-keystone | 10:10 | |
| *** ajayaa has joined #openstack-keystone | 10:17 | |
| *** dims has joined #openstack-keystone | 10:18 | |
| *** ukalifon2 has joined #openstack-keystone | 10:28 | |
| *** ukalifon1 has quit IRC | 10:28 | |
| *** henrynash has quit IRC | 10:45 | |
| *** andreaf has quit IRC | 10:47 | |
| *** andreaf has joined #openstack-keystone | 10:47 | |
| *** ukalifon2 has quit IRC | 10:52 | |
| *** andreaf has quit IRC | 11:00 | |
| *** henrynash has joined #openstack-keystone | 11:06 | |
| *** henrynash has quit IRC | 11:17 | |
| *** miqui has quit IRC | 11:24 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Docstrings should have :returns: everywhere. https://review.openstack.org/128612 | 11:35 |
| *** henrynash has joined #openstack-keystone | 11:37 | |
| *** swamireddy1 has joined #openstack-keystone | 11:37 | |
| *** radez_g0n3 is now known as radez | 11:37 | |
| *** swamireddy has quit IRC | 11:40 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Fix mappings.Mapping docstring https://review.openstack.org/128615 | 11:43 |
| *** swamireddy1 has quit IRC | 11:44 | |
| *** henrynash has quit IRC | 11:46 | |
| *** bknudson has joined #openstack-keystone | 12:06 | |
| *** dims has quit IRC | 12:11 | |
| *** dims has joined #openstack-keystone | 12:12 | |
| *** dims_ has joined #openstack-keystone | 12:14 | |
| *** dims has quit IRC | 12:16 | |
| *** bdossant has joined #openstack-keystone | 12:24 | |
| *** Tahmina has quit IRC | 12:28 | |
| amakarov | ayoung, ping | 12:31 |
| *** ajayaa has quit IRC | 12:52 | |
| *** andreaf has joined #openstack-keystone | 12:52 | |
| *** afazekas has quit IRC | 12:58 | |
| ayoung | amakarov, you are about 3 deep in the queue right now. got a meeting in 2 minutes...talk to you in about 45? | 12:58 |
| ayoung | r1chardj0n3s, you rock. Excellent. It will help the packagers out immensely | 12:59 |
| *** andreaf has quit IRC | 13:00 | |
| *** alex_xu has joined #openstack-keystone | 13:00 | |
| *** andreaf has joined #openstack-keystone | 13:03 | |
| *** Dafna has quit IRC | 13:06 | |
| *** nkinder has quit IRC | 13:10 | |
| *** gordc has joined #openstack-keystone | 13:10 | |
| *** Dafna has joined #openstack-keystone | 13:10 | |
| amakarov | ayoung, good | 13:11 |
| ayoung | amakarov, fire away | 13:12 |
| *** afazekas has joined #openstack-keystone | 13:14 | |
| amakarov | ayoung, there is 1-line bugfix hanging about a week for now https://review.openstack.org/#/c/125923/ | 13:14 |
| *** swamireddy has joined #openstack-keystone | 13:15 | |
| amakarov | ayoung, and about trust chains: I implemented the feature, Steve Hardy is about to review it, but it's Keystone feature after all... So maybe you look at it too: https://review.openstack.org/#/c/126897/ | 13:16 |
| *** richm has joined #openstack-keystone | 13:17 | |
| ayoung | amakarov, already have 3 draft review comments | 13:18 |
| ayoung | amakarov, basically looks good. I'm not a huge fan of how you are using &= | 13:18 |
| ayoung | I think you should do an early exit from the logic instead | 13:18 |
| ayoung | amakarov, I'll hit submit on my review, as there is some work for you there, but I've not completed reviewing it, and I might have more comments. Fair enough? | 13:19 |
| amakarov | ayoung, ok, I did it this way to have more compact code, but it does not allow detailed validation feedback. Thank you for your attention ) | 13:20 |
| ayoung | amakarov, yeah, I see what you are doing. Throwin an exception at the actual point of failure, though, makes it easier to debug | 13:21 |
| ayoung | amakarov, otherwise, all the user finds out is that it failed | 13:22 |
| ayoung | and not whether it was due to the first line, the second... | 13:22 |
| amakarov | ayoung, so may I consider concept approved and just prettify implementation? | 13:24 |
| ayoung | amakarov, yes. Is there a spec? | 13:24 |
| amakarov | ayoung, yes, 1 sec for link search. Loding... | 13:25 |
| ayoung | amakarov, I'm there | 13:25 |
| ayoung | amakarov, just wanted to confirm the spec was approved | 13:25 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone-specs/tree/specs/kilo/trusts-redelegation.rst | 13:25 |
| amakarov | ayoung, yes, Steve himself pointed me there | 13:25 |
| amakarov | yes, here it is | 13:26 |
| ayoung | amakarov, this is really good stuff. | 13:26 |
| *** andreaf has quit IRC | 13:26 | |
| amakarov | ayoung, I have a pic for that :) https://docs.google.com/a/mirantis.com/drawings/d/1IZk_JwMJ0uQkSewnAWgzdgo2smORQSTL-v3tK_464PE/edit | 13:27 |
| *** andreaf has joined #openstack-keystone | 13:28 | |
| ayoung | NICE! Happy little trusts! Happ little users! | 13:28 |
| *** saipandi has joined #openstack-keystone | 13:34 | |
| *** Gippa has joined #openstack-keystone | 13:37 | |
| *** afazekas has quit IRC | 13:37 | |
| ayoung | amakarov, I need to update my Keystone presentation to explain trusts better | 13:41 |
| *** andreaf has quit IRC | 13:42 | |
| amakarov | ayoung, cool, there is a presentation ))) Can you please share a link? I didn't find it on my research | 13:42 |
| ayoung | amakarov, yeah...one sec | 13:43 |
| ayoung | http://adam.younglogic.com/presentations/KeystoneFolsom/ was from back at Folsome | 13:43 |
| ayoung | Folsom | 13:43 |
| ayoung | and lets see... | 13:43 |
| ayoung | I don't think I published the internal one I did back in April... | 13:44 |
| ayoung | http://adam.younglogic.com/presentations/SecuringOpenstackFreeIPA/Securing-OpenStack-FreeIPA.html was the FreeIPA integration, too | 13:44 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Change tenant to project https://review.openstack.org/127066 | 13:44 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Change admin user to service user. https://review.openstack.org/127075 | 13:44 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Correct tests to use strings in conf https://review.openstack.org/128655 | 13:44 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Auth token supports deprecated names for paste conf options https://review.openstack.org/128656 | 13:44 |
| ayoung | amakarov, I have one I need to update that is IJK... | 13:44 |
| ayoung | er h-i-j... | 13:45 |
| ayoung | Apr 1 2014... | 13:45 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:46 | |
| amakarov | ayoung, thanks, that'll be handy | 13:46 |
| ayoung | amakarov, I have it as a PDF. Let me see if I can generate it as HTML. | 13:46 |
| amakarov | ayoung, pdf is ok | 13:47 |
| *** andreaf has joined #openstack-keystone | 13:48 | |
| *** afazekas has joined #openstack-keystone | 13:51 | |
| ayoung | amakarov, I know, but I want to make it into something I can deep link | 13:52 |
| *** nkinder has joined #openstack-keystone | 13:54 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Correct typos in man page https://review.openstack.org/127685 | 13:58 |
| *** ayoung has quit IRC | 13:59 | |
| *** vhoward has joined #openstack-keystone | 14:00 | |
| *** andreaf has quit IRC | 14:00 | |
| *** Gippa has quit IRC | 14:03 | |
| *** swamireddy has quit IRC | 14:10 | |
| *** shakayumi has quit IRC | 14:12 | |
| *** Gippa has joined #openstack-keystone | 14:13 | |
| *** Gippa has quit IRC | 14:13 | |
| *** Gippa has joined #openstack-keystone | 14:13 | |
| *** Gippa has quit IRC | 14:13 | |
| *** vb has joined #openstack-keystone | 14:17 | |
| vb | hello, could anyone please tell me why we have amqp setting in keystone? What functions of keystone need it? Any pointers to blogs or architecture stuff are welcome :) | 14:19 |
| *** vhoward has left #openstack-keystone | 14:19 | |
| *** jorge_munoz has joined #openstack-keystone | 14:21 | |
| *** aix has quit IRC | 14:25 | |
| *** david-lyle has joined #openstack-keystone | 14:30 | |
| *** sigmavirus24 has left #openstack-keystone | 14:30 | |
| *** alex_xu has quit IRC | 14:34 | |
| *** zzzeek has joined #openstack-keystone | 14:39 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Docstring cleanup for return type https://review.openstack.org/127857 | 14:43 |
| *** stevemar has joined #openstack-keystone | 14:58 | |
| *** sigmavirus24 has joined #openstack-keystone | 15:05 | |
| *** thedodd has joined #openstack-keystone | 15:06 | |
| *** henrynash has joined #openstack-keystone | 15:07 | |
| *** afazekas has quit IRC | 15:11 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/identity-api: convert v3 API docs from markdown to rst https://review.openstack.org/128676 | 15:17 |
| morganfainberg | dstanek, keystonemiddleware.tests.test_auth_token_middleware.v2AuthTokenMiddlewareTest.test_http_error_not_cached_token is the issue (or the first one) | 15:32 |
| stevemar | dolphm, is there a difference between wrapping a section with ==== (above and below) and just === (below) | 15:33 |
| morganfainberg | i also greatly dislike the mixin use for tests. | 15:33 |
| dolphm | stevemar: yes | 15:33 |
| dolphm | stevemar: the overall document title is wrapped above and below - everything else is below, and is a section title in taht doc | 15:33 |
| dstanek | morganfainberg: what is the issue? | 15:33 |
| morganfainberg | dstanek, that test hangs on cleanup | 15:34 |
| morganfainberg | dstanek, forever | 15:34 |
| morganfainberg | in py34 | 15:35 |
| dstanek | morganfainberg: really? i only have one error in test_shell.py | 15:35 |
| morganfainberg | dstanek, yep. it doesn't ever exit when run on my system (ubuntu 14.04) | 15:35 |
| morganfainberg | just spins, | 15:36 |
| dstanek | morganfainberg: this is my only failure http://paste.openstack.org/show/121291/ | 15:36 |
| morganfainberg | that looks like hashseed issue | 15:36 |
| morganfainberg | oh | 15:37 |
| morganfainberg | nope | 15:37 |
| morganfainberg | bad dict | 15:37 |
| morganfainberg | dstanek, http://paste.openstack.org/show/121293/ | 15:37 |
| *** wwriverrat has joined #openstack-keystone | 15:37 | |
| dstanek | what verion of python are you running? i have 3.4.1 installed using pyenv | 15:38 |
| morganfainberg | been sitting like that for ~10 minutes while i'm tyring to figure out wtf is going on | 15:38 |
| morganfainberg | all the other tests work | 15:38 |
| morganfainberg | erm all the other tests i've tried | 15:38 |
| morganfainberg | Python 3.4.0 (default, Apr 11 2014, 13:05:11) | 15:38 |
| morganfainberg | it's the trusty default install | 15:38 |
| morganfainberg | let me 2x check. | 15:39 |
| morganfainberg | but.. that should be the latest for 14.04 | 15:39 |
| dstanek | morganfainberg: oh, wait - i'm looking at client and you are looking at middleware | 15:39 |
| morganfainberg | yes | 15:40 |
| morganfainberg | client failure is much less severe under py34 afaict | 15:40 |
| morganfainberg | something is acting waaaay up with middleware | 15:40 |
| dstanek | build a middleware venv now to see if i can replicate | 15:41 |
| morganfainberg | there are a few tests that look to hang forever. this is jut the first one. | 15:41 |
| morganfainberg | it *might* all be around memcache stuff. | 15:41 |
| *** wwriverrat has left #openstack-keystone | 15:44 | |
| stevemar | nkinder, does RDO release a juno version of OS when Juno is announced? | 15:44 |
| stevemar | how's that work? | 15:44 |
| dstanek | morganfainberg: the issue is our sleeping token check | 15:45 |
| dstanek | http://paste.openstack.org/show/121298/ | 15:45 |
| morganfainberg | dstanek, ugh | 15:46 |
| *** packet has joined #openstack-keystone | 15:46 | |
| dstanek | morganfainberg: i don't use testtools/testr for development because it's super lacking - i always use nose | 15:46 |
| morganfainberg | dstanek, sure. but the question is why does py33 pass? | 15:47 |
| morganfainberg | and py34 not. | 15:47 |
| morganfainberg | i have clear evidence py33 *does* work :P | 15:47 |
| dstanek | not sure - i haven't looked into it yet | 15:47 |
| morganfainberg | huh, i am not seeing how we're getting dropped into that loop | 15:51 |
| morganfainberg | we explicitly set retry max. | 15:52 |
| *** lhcheng has joined #openstack-keystone | 15:55 | |
| *** ayoung has joined #openstack-keystone | 15:56 | |
| *** lhcheng has quit IRC | 16:02 | |
| *** lhcheng has joined #openstack-keystone | 16:03 | |
| *** _cjones_ has joined #openstack-keystone | 16:03 | |
| morganfainberg | dstanek, not sure if it's in the retry loop actually, because i get an "OK" the test passes, it hangs on what looks like one of the addcleanups | 16:04 |
| bknudson | it looks like heat has hard-coded our auth_token config option names so we can never change them. | 16:04 |
| bknudson | http://logs.openstack.org/66/127066/3/check/check-tempest-dsvm-postgres-full/5353623/console.html#_2014-10-15_14_28_49_464 | 16:04 |
| dstanek | morganfainberg: i can only get it to hang there - well i only tried 2 or 3 times - looking a the ksc issue | 16:05 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/identity-api: split HTTP methods & resources from section titles https://review.openstack.org/128690 | 16:05 |
| morganfainberg | dstanek, yeah it takes a few seconds to clear out of that. i'm digging into this. | 16:05 |
| morganfainberg | it's ... weird | 16:05 |
| dstanek | morganfainberg: dumb thought - are the conf values type or does that max retry come back as a string? | 16:06 |
| morganfainberg | hm. | 16:06 |
| morganfainberg | in this case it's guaranteed to be an int, we set it in the test case | 16:06 |
| ayoung | nkinder, So, I tried the openstack client with the Kerberos plugin. Didn't work out the gate, looks like some sort of issue with the entrypoints/Stevedore loading the plugin. I'm going to debug. | 16:08 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/identity-api: add doc8 validation to v3/ https://review.openstack.org/128693 | 16:10 |
| *** __TheDodd__ has joined #openstack-keystone | 16:11 | |
| *** thedodd has quit IRC | 16:12 | |
| *** jistr has quit IRC | 16:14 | |
| *** marcoemorais has joined #openstack-keystone | 16:17 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:19 | |
| ayoung | breton, you want to take over the work on the DB migrations? | 16:25 |
| breton | ayoung: yep | 16:26 |
| breton | ayoung: afaik sqlalchemy-migrations is deprecated and not developed | 16:26 |
| ayoung | breton, OK, so we looked briefly into Alembic about two releases ago | 16:26 |
| ayoung | and it seemed at the time that it was going to replace SQL A-Migrate | 16:27 |
| ayoung | but not certain that is still the case | 16:27 |
| ayoung | we got an OpenStack developer to take on the maint of SQL-A-M and we've been able to get it to limp along since then | 16:27 |
| *** bdossant has quit IRC | 16:27 | |
| ayoung | I liked what I saw of Alembic, but not enought to force me over to it...I'm kind of path of least resistance on this | 16:28 |
| ayoung | So...first thing is to confirm that the changeover to Alembic is still worth while. morganfainberg dstanek bknudson any input? | 16:28 |
| morganfainberg | zzzeek, ^ | 16:29 |
| zzzeek | heh | 16:29 |
| morganfainberg | :) | 16:29 |
| morganfainberg | zzzeek, we <3 you here! | 16:29 |
| zzzeek | considering sqlalchemy-migrate is dead..... | 16:29 |
| ayoung | Are we still looking to move to Alembic, then? | 16:29 |
| morganfainberg | ayoung, ideally, unless the community is going a different direction (don't think that is the case since zzzeek is here) | 16:30 |
| zzzeek | we’ve been trying to work out the integartion path | 16:30 |
| bknudson | can we compact our migrations again for J? | 16:30 |
| morganfainberg | bknudson, yes | 16:30 |
| zzzeek | and it’s not the current thing im working on, so it needs work | 16:30 |
| morganfainberg | bknudson, we should squash H -> I | 16:30 |
| breton | I also think that we should migrate to Alembic because it's py3-ready | 16:31 |
| bknudson | sqlalchemy-migrate seems to be getting the work done. | 16:31 |
| ayoung | morganfainberg, assuming we do that, should all Kilo migrations be in Alembic? | 16:31 |
| morganfainberg | ayoung, i think we need to conver completly over to alembic if we're doing that not just "start using alembic after XXX" | 16:32 |
| morganfainberg | ayoung, it's more work, but less likelyhood of things being weird because we're briding two things. | 16:32 |
| morganfainberg | esp. with our extensions with their own migrate repos | 16:32 |
| *** jorge_munoz has quit IRC | 16:33 | |
| ayoung | morganfainberg, right, so we need 2 things: | 16:33 |
| bknudson | how do you transition from migrate to alembic? | 16:34 |
| ayoung | 1. a way to convert a system already at SQL-A-M max to alembic | 16:34 |
| ayoung | 2. Initialize a system with the collapsed to I migrations using Alembic | 16:34 |
| ayoung | I think 2 will be easier. | 16:34 |
| ayoung | breton, want to start with that? | 16:34 |
| breton | yep | 16:35 |
| breton | I'm not sure yet what "collapsed to I" means | 16:35 |
| ayoung | breton, we take the set of migrations and collapse them periodically | 16:36 |
| ayoung | I means Icehouse. so all migrations up through Icehouse get collapsed into one migration that shows the end state | 16:36 |
| breton | got it | 16:37 |
| *** marcoemorais has quit IRC | 16:37 | |
| *** marcoemorais has joined #openstack-keystone | 16:38 | |
| *** marcoemorais has quit IRC | 16:38 | |
| *** marcoemorais has joined #openstack-keystone | 16:39 | |
| morganfainberg | dolphm, ping, it's possible to re-push sessions to sched.org until the deadline (e.g. update the sessions) | 16:45 |
| ayoung | breton, so what I was suggesting is that we hold off on any more SQL-A migrations and do any from here on forward in Alembic, but it means we need to get the Alembic stuff done early. Alternatively, we could do the two tasks in parallel, and just accept that we are going to have to do double work for a while: | 16:45 |
| dolphm | morganfainberg: see anne's comment on https://review.openstack.org/#/c/128676/ | 16:45 |
| morganfainberg | dolphm, right? | 16:45 |
| dolphm | morganfainberg: yes | 16:45 |
| morganfainberg | dolphm, anne's comment makes sense to me. | 16:46 |
| dolphm | morganfainberg: there's a long cache expiration delay on sched.org before you'll see changes reflected, but yes | 16:46 |
| morganfainberg | dolphm, cool. going to push the first pass then. | 16:46 |
| breton | ayoung: how early? | 16:46 |
| morganfainberg | dolphm, http://kilodesignsummit.sched.org/type/keystone | 16:46 |
| ayoung | doing the same migrations in SQL A and in Alembic until we can lock in to only Alembic | 16:47 |
| morganfainberg | henrynash, topol, nkinder, i think we're going to want a couple more questions for the ops session. but it's def a good start | 16:47 |
| *** henrynash has quit IRC | 16:48 | |
| dolphm | morganfainberg: sweet :) | 16:48 |
| *** morganfainberg changes topic to "Now open for Kilo development! Blocking reviews: https://gist.github.com/dolph/651c6a1748f69637abd0 | Please review design session schedule and provide feedback: http://kilodesignsummit.sched.org/type/keystone" | 16:48 | |
| breton | ayoung: well, ok, but how early does alembic need to be done? | 16:50 |
| morganfainberg | david-lyle, pushed the Keystone tentative schedule to sched.org, let me know if I need to shuffle around the SSO one | 16:53 |
| *** ayoung has quit IRC | 16:53 | |
| morganfainberg | dolphm, and let me know if you see any glaring ick on those sessions / recommended changes. | 16:53 |
| david-lyle | morganfainberg, can you PM me the link to push? I missed it somehow | 16:54 |
| morganfainberg | david-lyle, sure. | 16:54 |
| *** henrynash has joined #openstack-keystone | 16:57 | |
| *** browne has joined #openstack-keystone | 16:59 | |
| breton | ok, anyway, I'll start working on Alembic integration tomorrow | 16:59 |
| *** marcoemorais has quit IRC | 17:00 | |
| dstanek | morganfainberg: any luck? | 17:00 |
| *** marcoemorais has joined #openstack-keystone | 17:00 | |
| morganfainberg | dstanek, nope. i haven't been able to figure it out. aparantely we're also leaking memory, fungi said he forgot to kill it ran his machine out of memory | 17:00 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Docstrings should have :returns: everywhere. https://review.openstack.org/128612 | 17:01 |
| dstanek | morganfainberg: i'm going to start poking around too | 17:01 |
| morganfainberg | dstanek, i figured i was going to push the sched.org stuff then come back to it. | 17:02 |
| morganfainberg | dstanek, it is really odd. | 17:03 |
| stevemar | morganfainberg, shouldi create specs for these, or are they more bps/untargeted: 1) adding new CI tests for keystone (think federation/notifications), and 2) revamping docs, as i just got slammed for keystone not having enough docs, and them being super scattered. | 17:04 |
| *** marcoemorais has quit IRC | 17:05 | |
| *** marcoemorais has joined #openstack-keystone | 17:05 | |
| *** marcoemorais has quit IRC | 17:05 | |
| *** marcoemorais has joined #openstack-keystone | 17:06 | |
| *** marcoemorais has quit IRC | 17:06 | |
| morganfainberg | the federation ci testing i could go either way on needing a spec [ BPs are still a mess, slowly working through them ], docs revamp probably doesn't need a spec. we *should* do it. | 17:06 |
| *** marcoemorais has joined #openstack-keystone | 17:06 | |
| stevemar | morganfainberg, we *should* do the spec or the revamp? | 17:07 |
| stevemar | sorry, it's ambiguous :) | 17:07 |
| morganfainberg | the revamp | 17:07 |
| stevemar | morganfainberg, okay | 17:07 |
| morganfainberg | if you *want* to do a spec, feel free to. | 17:07 |
| stevemar | morganfainberg, i'll start writing it up, if it's actually some meaty content i'll post it | 17:07 |
| morganfainberg | k | 17:08 |
| stevemar | currently it's kinda nebulous in my head | 17:08 |
| morganfainberg | dstanek, hmm. | 17:09 |
| morganfainberg | dstanek, socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC, 0) = -1 EMFILE (Too many open files) *interesting* | 17:09 |
| *** harlowja_away is now known as harlowja | 17:15 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone-specs: add v3 API documentation https://review.openstack.org/128712 | 17:15 |
| morganfainberg | dstanek, wow, we have likw 40billion sockets opened by that test. | 17:16 |
| dstanek | morganfainberg: i think it's in an infinite loop trying to talk to keystone | 17:16 |
| morganfainberg | dstanek, yeah. | 17:16 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone-specs: add v3 API documentation https://review.openstack.org/128712 | 17:17 |
| *** _cjones_ has quit IRC | 17:17 | |
| morganfainberg | wondering if HTTPretty is failing in a weird way | 17:17 |
| *** _cjones_ has joined #openstack-keystone | 17:17 | |
| stevemar | dolphm, whats the point of ^ | 17:18 |
| stevemar | why add it to -specs? | 17:18 |
| stevemar | so we can kill identity-api and api-site?!? | 17:18 |
| dolphm | stevemar: annegentle has wanted us to do that for awhile - she commented as such on https://review.openstack.org/#/c/128676/ | 17:18 |
| dolphm | stevemar: pretty much, yes | 17:18 |
| stevemar | dolphm, <3 | 17:19 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Cleanup docs - raises class https://review.openstack.org/127858 | 17:19 |
| stevemar | dolphm, you needs to also change project-config too | 17:21 |
| stevemar | i assume we are actually going to publish these? | 17:21 |
| dolphm | stevemar: dunno - link me to what i need to change? | 17:22 |
| * dolphm is headed to lunch | 17:22 | |
| *** amakarov is now known as amakarov_away | 17:23 | |
| bknudson | food trucks! | 17:25 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Docstring cleanup for return type https://review.openstack.org/127857 | 17:26 |
| stevemar | dolphm, will do, also eating lunch | 17:29 |
| * morganfainberg goes to get food | 17:31 | |
| *** marcoemorais has quit IRC | 17:32 | |
| *** marcoemorais has joined #openstack-keystone | 17:32 | |
| *** r-daneel has joined #openstack-keystone | 17:37 | |
| *** henrynash has quit IRC | 17:44 | |
| morganfainberg | Do we want to do midcycle discussion at the summit or pre-summit since we know the schedule for the release already. | 17:49 |
| *** henrynash has joined #openstack-keystone | 17:52 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 17:53 | |
| *** vsilva is now known as victsou | 18:05 | |
| *** victsou is now known as vsilva | 18:05 | |
| *** __TheDodd__ has quit IRC | 18:07 | |
| *** thedodd has joined #openstack-keystone | 18:09 | |
| *** thedodd has quit IRC | 18:23 | |
| *** navid_ has joined #openstack-keystone | 18:29 | |
| rodrigods | stevemar, marekd, trying to create a mapping here using keystoneclient, but: http://paste.openstack.org/show/121326/ | 18:32 |
| rodrigods | what's wrong? =( | 18:32 |
| nkinder | rodrigods: you need an outer "mapping:" | 18:34 |
| nkinder | rodrigods: let me pastebin an example | 18:34 |
| rodrigods | nkinder, thanks! | 18:34 |
| nkinder | rodrigods: http://paste.openstack.org/show/121327/ | 18:35 |
| *** ayoung has joined #openstack-keystone | 18:35 | |
| rodrigods | nkinder, have you ever tried with keystoneclient? | 18:36 |
| stevemar | rodrigods, get rid of the outer mapping like nkinder says, and don't dump it with jsonutils* http://paste.openstack.org/show/121328/ | 18:36 |
| *** ayoung has quit IRC | 18:36 | |
| *** ayoung has joined #openstack-keystone | 18:36 | |
| nkinder | stevemar: ah, create_mapping adds the outer "mapping:" for you? | 18:37 |
| rodrigods | nkinder, it does | 18:37 |
| stevemar | nkinder, yes | 18:37 |
| nkinder | ok, cool | 18:37 |
| rodrigods | stevemar, thanks, will try here! | 18:37 |
| stevemar | nkinder, i think that is most of the client apis | 18:37 |
| stevemar | we don't pass in {user: {'name | 18:37 |
| stevemar | in for user, just the name | 18:38 |
| ayoung | nkinder, you messing with mod_lookup_identity? | 18:38 |
| nkinder | ayoung: not at the moment | 18:38 |
| rodrigods | stevemar, nkinder it worked! \o/ | 18:38 |
| nkinder | ayoung: I need to, but haven't gotten to it just yet | 18:38 |
| *** gyee has joined #openstack-keystone | 18:38 | |
| nkinder | rodrigods: great! | 18:38 |
| *** topol has joined #openstack-keystone | 18:38 | |
| ayoung | nkinder, OK. One thing I was trying to figure out is if I have something like just the env vars themselves if there is some way we could figure out a-priori which mapping to pick. I don't think there is. | 18:39 |
| ayoung | like if we had Kerberos with two different realms, and they had different mappings... | 18:39 |
| nkinder | ayoung: the only way to use a mapping is to use the federation stuff, right? | 18:40 |
| nkinder | ayoung: ...which requires tying a mapping to an IdP | 18:40 |
| stevemar | yay | 18:40 |
| ayoung | nkinder, yeah. When I looked, there are two calls for fetching mappings. One is for the list, and the second is for the individual mapping | 18:40 |
| ayoung | https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-federation-ext.md#mappings-os-federationmappings | 18:41 |
| stevemar | you can use a mapping on it's own, they are top level | 18:41 |
| stevemar | just enable OS-FEDERATION | 18:41 |
| nkinder | stevemar: so when does the mapping get evaluated in that case? | 18:41 |
| ayoung | https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-federation-ext.md#list-all-supported-protocol-and-attribute-mapping-combinations-of-an-identity-provider-get-os-federationidentity_providersidp_idprotocols | 18:42 |
| stevemar | nkinder, we call it when the user authN's, but you can call it any time if you're making a new function | 18:42 |
| ayoung | stevemar, want to use it with the Kerberos approach and the external plugin | 18:42 |
| nkinder | stevemar: we're talking about using it for the normal auth route (not for a federation token request) | 18:42 |
| ayoung | so you get REMOTE_USER, and a handful of other env vars set, and ... | 18:43 |
| stevemar | nkinder, https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/mapped.py#L139-L147 | 18:43 |
| ayoung | its really the same thing gyee needs fro X509 | 18:43 |
| stevemar | ohh i see the issue, the user should have to know what mapping to use | 18:43 |
| ayoung | for | 18:43 |
| ayoung | not have to know... | 18:43 |
| nkinder | ayoung: what if there is a mapping assigned to a domain? | 18:44 |
| ayoung | nkinder, how? Its the other way around, I think, where the mapping can chose the domain... | 18:44 |
| ayoung | I think | 18:44 |
| nkinder | ayoung: so we can tie a SSSD domain to a keystone domain and associated a specific mapping | 18:44 |
| ayoung | I think so... | 18:45 |
| nkinder | ayoung: richm and I were just chatting about needing to figure this area out earlier | 18:45 |
| ayoung | nkinder, OK, let me start with my old examples. | 18:45 |
| ayoung | http://adam.younglogic.com/2014/05/keystone-federation-via-mod_lookup_identity/ | 18:45 |
| nkinder | ayoung: need to drop for a bit. Will be back in about an hour | 18:46 |
| ayoung | nkinder, OK...I've had a router failure at home, currently at a cafe with wireless | 18:46 |
| nkinder | oh, fun | 18:46 |
| ayoung | I should still be here in an hour, need to head out and get another router | 18:46 |
| ayoung | yeah, I was using the cell phone as a wireless hotspot until the battery drained | 18:46 |
| *** thedodd has joined #openstack-keystone | 18:47 | |
| *** henrynash has quit IRC | 18:48 | |
| ayoung | stevemar, where do we specify what is an acceptable mapping for Federation? | 18:49 |
| stevemar | dolphm, http://imgur.com/AzdUcZ2 | 18:51 |
| stevemar | i wanted to check with you before over-riding your patch | 18:51 |
| *** nkinder has quit IRC | 18:51 | |
| *** packet has quit IRC | 18:55 | |
| ayoung | stevemar, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/auth/plugins/mapped.py do we not do anything with domain id? | 18:55 |
| *** stevemar has quit IRC | 18:55 | |
| *** huats_ has joined #openstack-keystone | 18:57 | |
| *** huats_ has quit IRC | 18:57 | |
| *** huats_ has joined #openstack-keystone | 18:57 | |
| *** packet has joined #openstack-keystone | 18:57 | |
| *** xianghui has quit IRC | 18:57 | |
| *** Guest27566 has quit IRC | 18:57 | |
| *** stevemar has joined #openstack-keystone | 18:58 | |
| ayoung | rodrigods, are you interested in using Federation with multiple domains? | 18:58 |
| rodrigods | ayoung, absolutely | 18:59 |
| rodrigods | needing extra hands somewhere? | 18:59 |
| *** xianghui has joined #openstack-keystone | 18:59 | |
| ayoung | rodrigods, I'm looking at the code and I don't see anything that handles domains | 18:59 |
| ayoung | it just assumes that REMOTE_USER == user_id | 18:59 |
| ayoung | rodrigods, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/auth/plugins/mapped.py#n134 | 18:59 |
| ayoung | and...I'm confused how that could be the case, so I'm investigating, but having someone else with a vested interest in this providing a double check on me would be welcome | 19:00 |
| rodrigods | ayoung, will add to my list | 19:01 |
| rodrigods | thanks | 19:01 |
| ayoung | and, I'd like to log what I'm seeing, so I'm going to send these notifications to you, so I don't look like some IRC equivalent to a schizophrenic talking to myself | 19:01 |
| ayoung | the auth plugin gets the post-processed SAML or whatever. | 19:01 |
| ayoung | rodrigods, there is nothing in here about domains http://git.openstack.org/cgit/openstack/keystone/tree/keystone/auth/plugins/mapped.py | 19:02 |
| *** _cjones_ has quit IRC | 19:02 | |
| *** _cjones_ has joined #openstack-keystone | 19:03 | |
| *** amcrn has joined #openstack-keystone | 19:03 | |
| rodrigods | ayoung, can't I map different federated users to different groups in different domains? | 19:04 |
| rodrigods | I thought it was a possible case | 19:05 |
| ayoung | rodrigods, I don't see how | 19:05 |
| rodrigods | ayoung, hmm | 19:05 |
| ayoung | rodrigods, and, in general, no, user and groups must all come from the same domain | 19:05 |
| ayoung | rodrigods, groups are part of identity, not assignment | 19:05 |
| rodrigods | ayoung, why is that? where the "unique" domain link is made? | 19:06 |
| ayoung | rodrigods, lets punt on groups for the moment | 19:06 |
| *** drjones has joined #openstack-keystone | 19:06 | |
| *** _cjones_ has quit IRC | 19:06 | |
| ayoung | cuz with mapping, we could do all sorts of wacky things, so we can probably make whatever use case you need to happen, but right now, I'm concerned that federation is one domain only | 19:06 |
| ayoung | or, worse, that we blindly accept the domain out of the request alongside the users ID. | 19:07 |
| ayoung | I don't think that is the case, as the user domain should be in the AuthCOntext object | 19:07 |
| rodrigods | ayoung, hmm... yeah, we don't attach a domain to a IdP | 19:08 |
| ayoung | rodrigods, I was kindof insisting on it back a bout a year ago and ...well...what happened to it? | 19:08 |
| rodrigods | ayoung, yeah, only 6 moths of openstack | 19:09 |
| rodrigods | =( | 19:09 |
| ayoung | rodrigods, I think I'm coming up on a Half Century of OpenStack..feeels like it anyway | 19:09 |
| ayoung | rodrigods, OK, check my logic here: | 19:10 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/auth/plugins/mapped.py#n89 calls extract_assertion_data | 19:11 |
| ayoung | down in that function, we assume user_id = REMOTE_USER | 19:11 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/auth/plugins/mapped.py#n136 | 19:11 |
| ayoung | so if there is REMOTE_USER, we ignore any additional mapping: | 19:11 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/auth/plugins/mapped.py#n105 we would only set user_id if it were not already set | 19:12 |
| ayoung | so if REMOTE_USER was ayoung@REDHAT.COM for me an rodrigods@RODRIGODS.COM for you, we couldn't map those to different domains. | 19:12 |
| ayoung | I think that we would want to pull in the code that we use for multiple backends here: | 19:13 |
| ayoung | split the REMOTE_USER on the @ sign and thjen the user_id would be | 19:14 |
| ayoung | the sha256 of the left portion of the REMOTE_USER field and the domain_id | 19:14 |
| rodrigods | that makes sense if the user has a left/right portion | 19:15 |
| rodrigods | is that true for k2k, for example? | 19:15 |
| rodrigods | anyway | 19:16 |
| rodrigods | ayoung, we would need a "valid federation" domains somewhere | 19:16 |
| rodrigods | right? | 19:16 |
| ayoung | rodrigods, K2K is using SAML | 19:16 |
| ayoung | and so when the SAML assertion comes in, the user_id will be the value in the REMOTE_USER field, no matter where it came from | 19:17 |
| rodrigods | ayoung, yes, my doubt is if REMOTE_USER is always like you said | 19:17 |
| ayoung | pretty sure REMOTE_USER will be set to USER_ID, but haven't looked at the token->saml code recently enough to remember | 19:17 |
| rodrigods | ayoung, trying to generate one here | 19:17 |
| rodrigods | 1 sec | 19:18 |
| ayoung | rodrigods, where is the SAML code for that anyway? | 19:18 |
| ayoung | federation/idp.py | 19:19 |
| rodrigods | ayoung, https://review.openstack.org/#/c/114850/24/keystone/contrib/federation/idp.py | 19:20 |
| rodrigods | yeah | 19:20 |
| rodrigods | was looking for the review | 19:20 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/contrib/federation/idp.py#n244 | 19:20 |
| ayoung | create_assertion | 19:20 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/contrib/federation/idp.py#n153 that is the binding | 19:21 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/contrib/federation/controllers.py#n273 user name....not even the id | 19:23 |
| *** jogo has joined #openstack-keystone | 19:23 | |
| jogo | have a fun nova spec that is all about keystone | 19:24 |
| jogo | https://review.openstack.org/#/c/92507/13/specs/kilo/approved/validate-tenant-user-with-keystone.rst | 19:24 |
| morganfainberg | ohboy! | 19:24 |
| jogo | would like to get the opinion of keystone on it | 19:24 |
| ayoung | jogo, hmmm | 19:25 |
| ayoung | jogo, what's a tenant? | 19:25 |
| jogo | just added keystone-core to the review | 19:25 |
| morganfainberg | ayoung, hah. | 19:25 |
| ayoung | -1 for 'tenant' alone | 19:26 |
| jogo | this seems to be a fairly common use case | 19:26 |
| morganfainberg | ayoung, in nova i think it's still called tenants | 19:26 |
| ayoung | so what | 19:27 |
| jogo | I as an admin of sorts wants to set the quota for !notme | 19:27 |
| jogo | !me | 19:27 |
| openstack | jogo: Error: "me" is not a valid command. | 19:27 |
| ayoung | !yesitis | 19:27 |
| openstack | ayoung: Error: "yesitis" is not a valid command. | 19:27 |
| jogo | gah, go away openstack | 19:27 |
| ayoung | !a valid command | 19:27 |
| openstack | ayoung: Error: "a" is not a valid command. | 19:27 |
| ayoung | meh | 19:27 |
| morganfainberg | !help | 19:27 |
| openstack | morganfainberg: (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin. | 19:27 |
| ayoung | !list | 19:28 |
| openstack | ayoung: Admin, Channel, ChannelLogger, Config, MeetBot, Misc, Owner, Services, and User | 19:28 |
| ayoung | anyway | 19:28 |
| morganfainberg | i'm surprised this hasn't been a bigger issue until now. | 19:28 |
| jogo | me too | 19:28 |
| morganfainberg | i think it's reasonable to validate projects - users might be harder since federated users don't "exist" | 19:29 |
| ayoung | morganfainberg, so everyone in Federation is going to live in one, big, happy domain. And their user_ids are going to be whatever REMOTE_USER is set to be | 19:29 |
| morganfainberg | but we can verify the user has authenticated i guess w/ henry's mapping thing | 19:29 |
| ayoung | morganfainberg, henry's mapping thing is, I think, out of the flow | 19:30 |
| *** ChanServ sets mode: -o morganfainberg | 19:30 | |
| morganfainberg | ayoung, i mean we can say "this id has been used / came from keystone" | 19:31 |
| ayoung | that is done by the identity plugin | 19:31 |
| morganfainberg | vs. a totally unknown id. | 19:31 |
| ayoung | and Federation mapping is going to be in the auth pipeline... | 19:31 |
| morganfainberg | but we don't have that support yet | 19:31 |
| ayoung | ah, wait, so once the mapping is applied (auth plugin) we then turn over to the token provider to make the token....somewhere in between we hit identity | 19:32 |
| ayoung | I think we still need to add domain to the mapping plugin, but... | 19:32 |
| morganfainberg | ayoung, probably. | 19:33 |
| morganfainberg | jogo, so in short, validating projects makes sense, users might be a bit harder if they are federated. | 19:33 |
| ayoung | morganfainberg, I still think we want to limit what domains a given mapping can map to, or a given IdP really | 19:33 |
| ayoung | ah bugger | 19:34 |
| ayoung | we create the auth context, then run authenticate | 19:34 |
| ayoung | there is no correlation between the data | 19:34 |
| ayoung | which means federation is broken | 19:34 |
| ayoung | morganfainberg, check me on this | 19:34 |
| jogo | morganfainberg: what about the existing REST call | 19:34 |
| jogo | where someone can set the quota for someone else | 19:35 |
| jogo | or something else | 19:35 |
| morganfainberg | ayoung, lets backup and talk about jogo's request before we dive into federation oddities | 19:35 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/auth/controllers.py#n370 | 19:35 |
| ayoung | morganfainberg, this is more important | 19:35 |
| ayoung | and I was talking first anyway | 19:35 |
| ayoung | heh | 19:35 |
| ayoung | what you can't carrry on five converstaions at once? | 19:35 |
| ayoung | Give you another month at PTL and you'll be able to do 10 | 19:36 |
| morganfainberg | ayoung, you're missing the convos in other IRC channels and via email. | 19:36 |
| ayoung | true | 19:36 |
| morganfainberg | ayoung, so. i might be at 10+ already :P | 19:36 |
| morganfainberg | jogo, so i'm not super familiar with nova's quotas anymore (been since grizzly since i spent a lot of time on nova) | 19:37 |
| jogo | morganfainberg: so I think the first gotcha is | 19:37 |
| jogo | the only data we have from keystone now is what we get from the keystone middleware | 19:37 |
| rodrigods | ayoung, I was with only two and was completely lost, will take a look in the domains + fed stuff tonight, ok? | 19:38 |
| jogo | which tells us what project the person is in, and data that we pass into the policy engine | 19:38 |
| ayoung | jogo, the token gets expanded | 19:38 |
| ayoung | and that project ID will be avalid | 19:38 |
| ayoung | valid | 19:38 |
| jogo | to figure out what commands they can call | 19:38 |
| ayoung | so I don't think you need to validate a second time | 19:38 |
| morganfainberg | ayoung, this would be for user X setting a quota on "not-his-project" Y | 19:39 |
| morganfainberg | i think | 19:39 |
| morganfainberg | if i'm understanding this correctly | 19:39 |
| jogo | AFAIK quota commands today have no validation beyond checking the policy file | 19:39 |
| ayoung | morganfainberg, then the token should be for the....ah | 19:39 |
| jogo | morganfainberg: yup | 19:39 |
| ayoung | yeah, you don't want to have the role to set quote for the project internal to the project | 19:39 |
| ayoung | cuz then the admin can change the quota | 19:39 |
| morganfainberg | jogo, i think this is absolutly related to the authorization and policy topics i've started the conversation on | 19:40 |
| ayoung | set_quota should be a separate role from admin | 19:40 |
| jogo | this is all we have for quota update http://git.openstack.org/cgit/openstack/nova/tree/etc/nova/policy.json#n222 | 19:40 |
| jogo | morganfainberg: too bad I didn't pay attention to those | 19:40 |
| morganfainberg | jogo, there is plans for a summit design session... but unfortunately nova has sessions at all the same times we do (keystone) | 19:40 |
| jogo | morganfainberg: [openstack-dev] [all][policy][keystone] Better Policy Model and Representing Capabilites ? | 19:41 |
| morganfainberg | jogo, yes | 19:41 |
| morganfainberg | jogo, i think this is something that hasn't been addressed *yet* in that thread, but is valid, policy decisions beyond the limited enforcement we have now. | 19:41 |
| ayoung | morganfainberg, OK, so this came up in a different context. If a project is owned by a domain, and a user has some role that implies "can set quota" should the token be for the domain or for the project? | 19:41 |
| jogo | morganfainberg: cool | 19:41 |
| morganfainberg | ayoung, i'd say domain in that case. | 19:42 |
| morganfainberg | ayoung, but afaik nova doesn't work with domain tokens. | 19:42 |
| * ayoung votes we call the role "quoter" | 19:42 | |
| jogo | so want to comment on the spec, it sounds like there are some big issues to sort out before we can even review this spec | 19:42 |
| ayoung | well, that would also be a more important feature than "validate project with keystone" then | 19:42 |
| morganfainberg | yeah. there are some sizable issues around this that stretch beyond the basics of "validating the project" | 19:42 |
| jogo | morganfainberg: yeah that is my understanding too, nova has no concept of domains, and as of know doesn't want to know about them. | 19:43 |
| morganfainberg | jogo, but i mean, it's not unreasonable to include a "make sure the project exists" api call. | 19:43 |
| jogo | morganfainberg: sure, but the quota-update call is still wide open to all 'admins' | 19:43 |
| jogo | its not per project etc | 19:43 |
| morganfainberg | jogo, exactly | 19:43 |
| jogo | its a global admin thing | 19:43 |
| jogo | yeah adding a sanity check make sure project exists should be an easy first step | 19:44 |
| ayoung | morganfainberg, ok, I think we are actual cool WRT Federation. auth_info vs auth_context is horrible naming | 19:44 |
| morganfainberg | jogo, we also have a topic on hierarchical multitency and role management, policy management | 19:44 |
| jogo | but the whole quota thing is funny in this sense | 19:44 |
| jogo | so random tangent | 19:44 |
| morganfainberg | jogo, it's all interelated. i think kilo is going to be "OMG POLICY" and workign towards fixing the "admin scope" issue we've had ... forever | 19:44 |
| jogo | thoughts on keystone owning a quotas library | 19:45 |
| morganfainberg | ayoung, yes it is awful naming. | 19:45 |
| ayoung | morganfainberg, in mapped its called auth_payload, which is a little better | 19:45 |
| jogo | as policy, quotas and keystone are all related somewhat | 19:45 |
| morganfainberg | jogo, yeah, we've had some conversations on that | 19:45 |
| jogo | oh nice | 19:45 |
| morganfainberg | the general consensus is at least initial quota state should be stored in keystone (Centrally) | 19:46 |
| morganfainberg | or something *like* keystone | 19:46 |
| jogo | I am not sure I agree actually | 19:46 |
| morganfainberg | but enforcement has to be other projects | 19:46 |
| jogo | I think we can hide the distributed nature of things via openstackclient | 19:46 |
| ayoung | morganfainberg, I think in Keystone makes sense so long as Keystone does not try to understand the quota data | 19:46 |
| jogo | so openstack quotas list | 19:46 |
| morganfainberg | ayoung, ++ | 19:46 |
| jogo | would show all things | 19:46 |
| ayoung | its like posting the shipping manifest on the outside of the shipping container | 19:47 |
| morganfainberg | jogo, hm. | 19:47 |
| ayoung | All the container knows is that there is a piece of paper stuck to its front | 19:47 |
| ayoung | and it doesn;t care...its just a big metal box | 19:47 |
| morganfainberg | jogo, perhaps.. | 19:47 |
| jogo | ayoung: your containers are conscious. scary | 19:48 |
| ayoung | jogo, most of my things are scary | 19:48 |
| morganfainberg | jogo, i do agree we need a quota "library" to make handling quota better, but I'm unsure if keystone as a project needs to own it | 19:48 |
| ayoung | you should see my desk | 19:48 |
| jogo | morganfainberg: sure, maybe not own it | 19:48 |
| morganfainberg | jogo, wrt policy lib, i plan on adopting that one - i'm not sure how far apart policy and quota actually ends up | 19:48 |
| ayoung | morganfainberg, OK, so quota is probably not best stored in Keystone...here's why | 19:48 |
| ayoung | lets assume you have a sharedproject | 19:48 |
| jogo | it can live in oslo or where ever too, I was just trying to sign keystone up for more work ;) | 19:48 |
| morganfainberg | jogo, haha | 19:49 |
| ayoung | usually nova1 is paired with cinder1 and nova2 with cinder2, but in this case, its nova1 with cinder2 | 19:49 |
| morganfainberg | jogo, i don't know if we want Identity to own quota. i think i need to noodle on that one some. | 19:49 |
| ayoung | all of the 1 resources are owned by, say Harvard and all of the 2 resources by BostonU | 19:49 |
| jogo | so maybe not own, but maybe just be involved in a bit | 19:50 |
| ayoung | so in the case of Nova1 to BU2 you don't want BU admins overriding the quota's set by Nova | 19:50 |
| ayoung | er By Harvard | 19:50 |
| morganfainberg | jogo, oh absolutely, likely with the heirarchical stuff we need to add quota support. | 19:50 |
| ayoung | Now..lets make it even more complex | 19:50 |
| morganfainberg | jogo, so we'll have a vested interest [e.g. max numbers of projects under a domain that can be created, etc] | 19:50 |
| ayoung | where this project has VMs in both nova1 and nova2 | 19:50 |
| ayoung | and the quoatas should be kept separate | 19:50 |
| * ayoung has been fielding some wacky use cases lately | 19:51 | |
| morganfainberg | jogo, though we do sortof own audit, which is somewhat closely aligned with quota so we may be the best place for it when it comes down to it | 19:51 |
| lhcheng | qq, is it possible to setup keystone with ldap backend for user and using db-backend for projects/roles? | 19:51 |
| morganfainberg | lhcheng, yep | 19:51 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Add a specification for revamping the documentation https://review.openstack.org/128747 | 19:52 |
| ayoung | lhcheng, its the normal LDAP approach. Even better, with the new multiple backends, you can put service users in SQL, and use LDAP for the real users | 19:52 |
| stevemar | dolphm, ^ | 19:52 |
| ayoung | lhcheng, http://adam.younglogic.com/2014/08/getting-service-users-out-of-ldap/ | 19:52 |
| jogo | morganfainberg: so to double back to your email thread | 19:53 |
| jogo | morganfainberg: I have a use case I have been wanting to address for a while now | 19:53 |
| jogo | morganfainberg: have a smart 'nova help' that only shows me things I can do | 19:53 |
| morganfainberg | jogo, my email doesn't cover that use case, but it should be added to the pile | 19:53 |
| ayoung | morganfainberg, so extending mapping to handle domains: bug or new spec? | 19:53 |
| morganfainberg | once the schedule for the summit is more or less solidified i plan on replying with "hey come talk about this, keystone has volunteered a design slot so we can *really* work on this" | 19:54 |
| morganfainberg | ayoung, i'd say it's not a bug so much as a feature add | 19:54 |
| jogo | morganfainberg: I think there are two aspects to this use case: 1) discovering what extensions are running (I think this can be done today) | 19:54 |
| jogo | discovering what the policy will allow | 19:54 |
| morganfainberg | jogo, ++ | 19:54 |
| lhcheng | morganfainberg: how do I configure project/role to continue using db-backend? if I don't have an ldap mapping to projects, does keystone assume it is db-backend? | 19:55 |
| *** ayoung has quit IRC | 19:56 | |
| morganfainberg | lhcheng, you will set the driver in [assigment] to use the sql driver keystone.assignment.backends.sql.Assignment (i think), and [identity] driver option to be keystone.identity.backends.ldap.Identity | 19:56 |
| lhcheng | ayoung: thanks for the link, the back-end by domain sounds great. | 19:56 |
| jogo | morganfainberg: added my use case to the thread for posterity | 19:57 |
| morganfainberg | jogo, thanks! | 19:57 |
| lhcheng | ayoung: I'll keep that in mind, one more reason to move to v3! :) | 19:57 |
| morganfainberg | jogo, http://kilodesignsummit.sched.org/event/061876b56285e8a46443bc3bf730031b | 19:57 |
| jogo | morganfainberg: I wonder how many other sessions that will conflict with heh | 19:57 |
| morganfainberg | jogo, that is the tentative slot we (keystone) have ponied up for this policy conversation. I | 19:57 |
| morganfainberg | jogo, likely a few :(. but i think it's a bit late to get a cross-project slot and a *lot* of it has to do with Keystone in either case. | 19:58 |
| jogo | yeah makes sense | 20:01 |
| jogo | anyway thanks, glad this is on the roadmap | 20:02 |
| lhcheng | morganfainberg: sweet! it works! | 20:03 |
| lhcheng | morganfainberg: I thought the assignment-driver only applies to role assignments | 20:03 |
| morganfainberg | lhcheng, nah, assignment is projects, domains, roles, etc | 20:04 |
| lhcheng | morganfainberg: so if I don't have a project ldap mapping, keystone defaults the back-end to the assignment driver? | 20:04 |
| morganfainberg | lhcheng, the LDAP driver for assigment is separate, you *could* use ldap assigment | 20:04 |
| morganfainberg | but i don't recommend it | 20:04 |
| morganfainberg | those options are for using that LDAP driver | 20:04 |
| lhcheng | morganfainberg: I see, and identity backend just applies only to "users" | 20:06 |
| morganfainberg | lhcheng, yep | 20:07 |
| morganfainberg | lhcheng, there is some code to line them up if you only set the [identity] driver for operator experience / compatibility | 20:07 |
| r1chardj0n3s | ayoung: I got rid of the ruby for you :) | 20:08 |
| lhcheng | morganfainberg: what do you mean by lining them up? organizing the config setting? | 20:09 |
| morganfainberg | lhcheng, in previous releases (havana and before) there was no "assignment" split. so you would only set [identity[ | 20:10 |
| morganfainberg | lhcheng, so we needed a way to make sure [identity] and [assigment] drivers were the same *if* only identity was set | 20:11 |
| morganfainberg | lhcheng, otherwise the operators/deployers would come after us for making upgrades awful | 20:11 |
| *** nkinder has joined #openstack-keystone | 20:11 | |
| lhcheng | morganfainberg, ++ on that. Glad this is already in keystone! :) | 20:13 |
| lhcheng | morganfainberg, dolphm: on another note, question on v3 domain scoped token. It's probably asked too many times, but I'll ask anyway. | 20:14 |
| lhcheng | Which identity operations should we used domain-scoped token? | 20:14 |
| morganfainberg | lhcheng, that depends on what your policy.json ends up looking like | 20:16 |
| lhcheng | I've read the response somewhere, but I couldn't find it again :( | 20:16 |
| morganfainberg | right now, with the default policy, i don't think we've got much that is domain scoped compatible | 20:16 |
| nkinder | stevemar: this is just the normal call to get a scoped token, not something OS-FEDERATION specific, right? http://docs.openstack.org/api/openstack-identity-service/3/content/request-a-scoped-os-federation-token-post-authtokens.html | 20:17 |
| lhcheng | morganfainberg: assuming the cloud_admin policy file | 20:17 |
| lhcheng | morganfainberg, https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json | 20:17 |
| morganfainberg | lhcheng, then the stuff that looks for "domain admin" [i don't remember all of them off the top of my head] are domain scoped actions | 20:17 |
| morganfainberg | iirc | 20:17 |
| nkinder | lhcheng: domain scoped token should be used to create projects within the domain and to assign roles to user within the domain | 20:17 |
| morganfainberg | nkinder, ++ | 20:18 |
| nkinder | lhcheng: also user/group CRUD operations within the domain | 20:18 |
| nkinder | lhcheng: the "cloud admin" would be responsible for defining roles, CRUD operations for the domain objects, and assigning an admin to each domain | 20:19 |
| lhcheng | nkinder: seems like almost all identity operations :P | 20:19 |
| nkinder | lhcheng: think of the domain owning users/groups/projects for that domain | 20:19 |
| nkinder | lhcheng: so the domain admin manages those things (and assignment of roles to their users/groups) | 20:20 |
| nkinder | the cloud admin really just needs to set the domains up and can then delegate the administration within those domains down to the domain admin | 20:20 |
| lhcheng | nkinder: thanks for the explanation! That makes sense, that all domain admin related task would be using the domain scoped token. | 20:23 |
| lhcheng | nkinder: how about managing regions and endpoints? the policy file uses "rule:admin_or_cloud_admin" | 20:24 |
| nkinder | lhcheng: it's a cloud admin task | 20:24 |
| lhcheng | nkinder: does that mean I could a domain scoped token from cloud_admin domain and project scoped token with admin role | 20:25 |
| lhcheng | s/could/could use | 20:25 |
| nkinder | lhcheng: let me bring up the policy and check | 20:25 |
| stevemar | nkinder, it's pretty much the same, except the methods is different | 20:26 |
| nkinder | stevemar: yeah, the way it's processed is different. It just looked like the route is the same | 20:27 |
| nkinder | lhcheng: so the region policies seem odd to me... | 20:27 |
| nkinder | lhcheng: create, update, and delete all just use admin_or_cloud_admin | 20:28 |
| nkinder | lhcheng: I'm not sure that's ideal. That means anyone with the "admin" role on anything can do those operations | 20:28 |
| nkinder | morganfainberg: do you know why those policies were set up that way? ^^^ | 20:29 |
| morganfainberg | nkinder, uhm | 20:29 |
| nkinder | services and endpoints look like what I would expect - https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json | 20:29 |
| nkinder | but why wouldn't regions be the same? | 20:29 |
| morganfainberg | nkinder, you need to ask henrynash specifically why those were setup thatway | 20:30 |
| morganfainberg | i'm honestly not 100% sure at this point it's been a while | 20:30 |
| nkinder | morganfainberg: cool, was wondering who to ask... :) | 20:30 |
| nkinder | the current policy seems like it would allow a project "admin" to delete a region that the "cloud admin" created | 20:30 |
| nkinder | lhcheng: endpoint policies look correct. The cloud admin manages them, but any admin can read them | 20:33 |
| morganfainberg | yeah might need some adjustments | 20:33 |
| nkinder | morganfainberg: there could be hard-coded restrictions (like trusts have) | 20:33 |
| nkinder | I'll bug henry about it when he's around | 20:33 |
| lhcheng | nkinder: thanks for looking that up | 20:34 |
| lhcheng | nkinder, I guess for now that policy file is just a reference | 20:34 |
| lhcheng | and operator still needs to tweak it | 20:34 |
| nkinder | lhcheng: sure! That policy file actually works, but it might need some tweaks | 20:35 |
| morganfainberg | lhcheng, i think that's all policy files. | 20:35 |
| *** amerine_ has joined #openstack-keystone | 20:35 | |
| lhcheng | morganfainberg: true | 20:35 |
| nkinder | lhcheng: At a minimum, you need to set the id of your admin domain to use it. | 20:35 |
| lhcheng | nkinder: right | 20:36 |
| nkinder | lhcheng: here's a snippet of a script that I've been using to switch over to using the domain aware policy - http://paste.openstack.org/show/121352/ | 20:36 |
| nkinder | lhcheng: you should be able to get the basic idea from that | 20:37 |
| *** nellysmitt has quit IRC | 20:37 | |
| lhcheng | when horizon start using the domain-scoped token for KS V# operation, we'll be able to verify the correctness of the policy. | 20:37 |
| *** nellysmitt has joined #openstack-keystone | 20:38 | |
| *** amerine has quit IRC | 20:38 | |
| lhcheng | nkinder, nice | 20:38 |
| nkinder | lhcheng: I started to switch my horizon config over to use a domain on my test setup, but got side-tracked on other things | 20:38 |
| nkinder | lhcheng: horizon does have domain specific config | 20:39 |
| lhcheng | yeah, I worked on that :) It can work with V3, however it is using project-scoped token for all identity operations. | 20:41 |
| lhcheng | nkinder, as long as keystone uses the default policy file, it works. | 20:42 |
| *** nellysmitt has quit IRC | 20:42 | |
| nkinder | lhcheng: ok, so horizon isn't getting a domain scoped token for anything now then? | 20:42 |
| nkinder | lhcheng: this seems like it would fit in with the stuff ayoung has been looking at (having horizon get an unscoped token and using that to switch between projects) | 20:43 |
| lhcheng | nkinder: nope. it doesn't get the domain scoped token at all. I think ayoung have started looking at that, or at least refactoring openstack_auth to make the transition easier. | 20:44 |
| nkinder | lhcheng: I suppose horizon would need a way for the user to select a domain to perform domain operations (as opposed to just projects) | 20:44 |
| nkinder | lhcheng: yeah, he and I have talked about it quite a bit. | 20:44 |
| nkinder | lhcheng: are you going to be at the summit? | 20:44 |
| lhcheng | nkinder: the flow in the ui still needs to be figured out | 20:44 |
| lhcheng | nkinder, yes | 20:44 |
| nkinder | lhcheng: great, we should all sit down and figure out the flow and what needs to be done. | 20:45 |
| lhcheng | nkinder, agree! | 20:45 |
| nkinder | lhcheng: I'd really like to get domains and federation working well in horizon | 20:45 |
| lhcheng | nkinder: ++ | 20:45 |
| lhcheng | nkinder, time to get lunch, brb | 20:45 |
| lhcheng | thank you all for the help | 20:46 |
| *** Kui has joined #openstack-keystone | 20:47 | |
| *** saipandi has quit IRC | 20:47 | |
| *** vsilva is now known as victsou | 20:53 | |
| *** saipandi has joined #openstack-keystone | 20:55 | |
| *** fifieldt has quit IRC | 21:00 | |
| *** fifieldt has joined #openstack-keystone | 21:00 | |
| *** amerine has joined #openstack-keystone | 21:05 | |
| *** amerine_ has quit IRC | 21:07 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Publish the Identity v3 API specs https://review.openstack.org/128765 | 21:09 |
| *** dims_ has quit IRC | 21:14 | |
| morganfainberg | dstanek, pretty straight forward fix to get *most* things fixed for the httpretty patch | 21:14 |
| morganfainberg | dstanek, erm, requests-mock | 21:14 |
| morganfainberg | getting some spurious 401s instead of expected responses atm | 21:14 |
| morganfainberg | though | 21:14 |
| rodrigods | can anyone have a quick look at https://review.openstack.org/#/c/111355/ . I'm most concerned with the parameters names choices (they have a considerable impact in the code we are shipping) | 21:14 |
| *** dims_ has joined #openstack-keystone | 21:15 | |
| dstanek | morganfainberg: i started fixing some things on that patch and ran into issues | 21:15 |
| morganfainberg | dstanek, so i'm down to: | 21:15 |
| morganfainberg | dstanek, http://paste.openstack.org/show/121355/ | 21:15 |
| bknudson | what do you think about having a tests/public directory that has tests of the public API, such that you'd know if you changed something in public/ then you're changing a public API | 21:15 |
| morganfainberg | looks like spurious 401s where they aren't expected. | 21:16 |
| morganfainberg | bknudson, that would be a nice distinction, but isn't that equiavelent of all of our RESTFUL atm? | 21:16 |
| morganfainberg | bknudson, slash functional changes. | 21:17 |
| morganfainberg | erm s/changes/tests | 21:17 |
| dstanek | morganfainberg: i was getting this crap again http://paste.openstack.org/show/121356/ | 21:17 |
| morganfainberg | oh that. | 21:17 |
| morganfainberg | FFS | 21:17 |
| bknudson | morganfainberg: I'm thinking about this for the auth_token middleware... since somehow the CONF options are part of the public API now. | 21:17 |
| morganfainberg | dstanek, that was an "old version of requests" issue iirc | 21:18 |
| morganfainberg | bknudson, ah, sure | 21:18 |
| dstanek | morganfainberg: it was, but i upgrade to 0.5.1 | 21:18 |
| bknudson | which nobody would realize otherwise. | 21:18 |
| morganfainberg | dstanek, oh so did it regress? | 21:18 |
| dstanek | morganfainberg: not sure, i stopped so that i can watch a live stream for work | 21:18 |
| morganfainberg | i'm (at the very least) not seeing that issue with the 2.7 test run i'm doing | 21:19 |
| * morganfainberg keeps hacking on these changes to try and figure out the last of these tests. | 21:19 | |
| mfisch | anyone seen this with the juno version of K + LDAP? 'module' object has no attribute 'LDAP_CONTROL_PAGE_OID' | 21:19 |
| morganfainberg | something is weird converting from httpretty...like we had a side effect of using it | 21:19 |
| nkinder | mfisch: yes, someone mentioned that to me today | 21:20 |
| mfisch | without paging I get too many results | 21:20 |
| nkinder | mfisch: I just tried to repro with RC2 and it worked for me | 21:20 |
| mfisch | I'm on RC2 | 21:20 |
| nkinder | mfisch: so the report I received said that they downgraded python-ldap to 2.3 and it worked | 21:20 |
| *** Kui has quit IRC | 21:20 | |
| nkinder | mfisch: but that doesn't make much sense | 21:20 |
| mfisch | yeah I've read that, but frankly thats dumb | 21:20 |
| nkinder | mfisch: glad we arrived at the same conclusion :) | 21:21 |
| nkinder | mfisch: So I've seen error like this before, and it was related to some mismatch between python-ldap and openldap libs on the system | 21:21 |
| mfisch | let me look | 21:21 |
| nkinder | mfisch: on your system, can you start an interactive python session and 'import ldap'? | 21:21 |
| mfisch | sure | 21:21 |
| bknudson | we can always code LDAP_CONTROL_PAGE_OID ourselves in keystone | 21:22 |
| mfisch | (someone remind me to build a time machine and go back to last December when I volunteered to work on AD integration and call in sick) | 21:22 |
| bknudson | it's a known value | 21:22 |
| mfisch | nkinder: what do you want me to do? | 21:22 |
| mfisch | ldap.LDAP_CONTROL_PAGE_OID is of course undef | 21:23 |
| nkinder | mfisch: ok, so you got that same error? | 21:23 |
| mfisch | >>> ldap.LDAP_CONTROL_PAGE_OID | 21:23 |
| mfisch | AttributeError: 'module' object has no attribute 'LDAP_CONTROL_PAGE_OID' | 21:23 |
| bknudson | ldap.__version__ | 21:24 |
| mfisch | >>> ldap.__version__ | 21:24 |
| mfisch | '2.4.10' | 21:24 |
| bknudson | I've got '2.3.13' | 21:24 |
| mfisch | import bknudson; bknudson.set_trace() | 21:24 |
| mfisch | thats what the internet says, to downgrade but thats dirty | 21:25 |
| mfisch | let me look for an upstream bug | 21:25 |
| nkinder | so did they drop this from the module? | 21:25 |
| *** radez is now known as radez_g0n3 | 21:25 | |
| mfisch | I see references to this back to 2007 even | 21:26 |
| nkinder | mfisch: yeah - https://mail.python.org/pipermail//python-ldap/2012q1/003105.html | 21:26 |
| *** Kui has joined #openstack-keystone | 21:26 | |
| mfisch | https://mail.python.org/pipermail//python-ldap/2012q1/003105.html | 21:26 |
| mfisch | jinx | 21:26 |
| nkinder | Micahel is the python-ldap maintainer/developer | 21:27 |
| mfisch | so should the keystone packages require 2.3 then? | 21:27 |
| mfisch | I think 2.3 is in for P, but not later in Ubuntu | 21:27 |
| mfisch | and confirmed | 21:27 |
| nkinder | yeah, so this is a bug | 21:27 |
| nkinder | 2.4 is in RHEL7 too | 21:27 |
| *** __TheDodd__ has joined #openstack-keystone | 21:28 | |
| bknudson | from ldap.controls import SimplePagedResultsControl -- it's totally different | 21:28 |
| nkinder | keystone needs to be able to work with 2.4 | 21:28 |
| mfisch | agree | 21:28 |
| *** amcrn has quit IRC | 21:28 | |
| nkinder | mfisch: mind filing a keystone bug? | 21:28 |
| *** r-daneel has quit IRC | 21:28 | |
| mfisch | was about to ask | 21:28 |
| mfisch | I love fiiling bugs | 21:28 |
| nkinder | mfisch: I can see what needs to be done to fix it (unless bknudson has a burning interest) | 21:29 |
| *** thedodd has quit IRC | 21:29 | |
| mfisch | let me know if you need more details | 21:30 |
| mfisch | https://bugs.launchpad.net/keystone/+bug/1381768 | 21:30 |
| uvirtbot | Launchpad bug 1381768 in keystone "AttributeError: 'module' object has no attribute 'LDAP_CONTROL_PAGE_OID' with python-ldap 2.4" [Undecided,New] | 21:30 |
| nkinder | mfisch: thanks | 21:30 |
| mfisch | is this more than just definiing that value? seems like it | 21:31 |
| nkinder | mfisch: yes, though defining it could work around it | 21:32 |
| mfisch | okay I may try that | 21:32 |
| mfisch | just for fun | 21:32 |
| nkinder | mfisch: gotta love when APIs change | 21:32 |
| morganfainberg | dstanek, found the issue. lack of passing "status_code" properly | 21:36 |
| morganfainberg | dstanek, we have *broken* tests | 21:36 |
| morganfainberg | dstanek, requests-mock highlights this | 21:37 |
| dstanek | morganfainberg: no surprise there :-P | 21:37 |
| openstackgerrit | Jeremy Stanley proposed a change to openstack/python-keystoneclient: Actually test interactive password prompt https://review.openstack.org/128770 | 21:37 |
| mfisch | nkinder: the downgrade made my code work | 21:37 |
| mfisch | I see you guys have improved ldap performance, its about 3 minutes to list every user in my company | 21:38 |
| morganfainberg | dstanek, http://paste.openstack.org/show/121363/ | 21:38 |
| morganfainberg | dstanek, status_code isn't httpretty | 21:38 |
| nkinder | mfisch: it looks like keystone could just set the OID value to make this work with 2.3 and 2.4 (for now) | 21:38 |
| morganfainberg | valid | 21:38 |
| nkinder | mfisch: how long did it used to be? | 21:38 |
| nkinder | mfisch: and how many users? | 21:38 |
| mfisch | nkinder: 5 mins ;) I forgot to change my driver to not list ldap | 21:38 |
| mfisch | nkinder: 50k+ | 21:38 |
| morganfainberg | so that has been failing forever, fixing it, breaks the composite tests i'm seeing (with requests-mock). with requests-mock, not supplying "status_code" nets us the FP error you're seeing | 21:39 |
| mfisch | an unreasonable amount | 21:39 |
| nkinder | mfisch: still seems a bit ridiculous... | 21:39 |
| nkinder | mfisch: AD, or something else? | 21:39 |
| mfisch | a normal place would use an AD group to isolate people... | 21:39 |
| mfisch | that involves paperwork unfortunately | 21:39 |
| morganfainberg | dstanek, weird *now* i am only getting the FP error | 21:39 |
| morganfainberg | wtf. | 21:39 |
| dstanek | haha | 21:40 |
| nkinder | mfisch: still, I bet keystone is doing multiple operations per user when it really doesn't need to | 21:40 |
| morganfainberg | i think we're going to need to push the fix through that jamie didn't want in requests mock | 21:40 |
| nkinder | mfisch: I did packet traces of LDAP early int he cycle and counted the number of LDAP operations for various CRUD operations in keystone. It wasn't pretty... | 21:40 |
| mfisch | nkinder: I'm happy to volunteer some of my time to help you track that stuff down as long as I can scrub the data | 21:40 |
| morganfainberg | https://review.openstack.org/#/c/117890/ or https://review.openstack.org/#/c/118032/ | 21:41 |
| *** gordc has quit IRC | 21:41 | |
| nkinder | mfisch: I can mimic your setup with some basic details (numbers of entries, how you use groups, and what your keystone config looks like) | 21:42 |
| mfisch | nkinder: happy to get you that | 21:42 |
| morganfainberg | dstanek, i can push that one jamie has through. | 21:42 |
| mfisch | nkinder: will email you offline | 21:42 |
| morganfainberg | dstanek, but honestly his comment about breaking people worries me | 21:42 |
| morganfainberg | https://review.openstack.org/#/c/118032/ | 21:42 |
| nkinder | mfisch: cool. Let me try some things on the paging control. I think a quick fix would be OK for now on this issue. | 21:43 |
| morganfainberg | dstanek, oh *doh* | 21:43 |
| mfisch | nkinder: check your pms | 21:43 |
| morganfainberg | dstanek, body != text | 21:43 |
| morganfainberg | *grumble* | 21:43 |
| openstackgerrit | Jeremy Stanley proposed a change to openstack/python-keystoneclient: Actually test interactive password prompt https://review.openstack.org/128770 | 21:44 |
| *** drjones has quit IRC | 21:48 | |
| *** _cjones_ has joined #openstack-keystone | 21:49 | |
| *** victsou is now known as vsilva | 21:50 | |
| *** _cjones_ has quit IRC | 21:53 | |
| *** mflobo has quit IRC | 21:56 | |
| *** packet has quit IRC | 21:58 | |
| morganfainberg | oooh | 22:00 |
| *** _cjones_ has joined #openstack-keystone | 22:01 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Replace httpretty with requests-mock https://review.openstack.org/112777 | 22:05 |
| morganfainberg | dstanek, ^ | 22:05 |
| morganfainberg | dstanek, it at least passes py27, checking py34 now. | 22:07 |
| morganfainberg | and pep8 | 22:08 |
| morganfainberg | yep, passes py34, omg spammy output we need to "fix" | 22:09 |
| *** bknudson has quit IRC | 22:09 | |
| *** topol has quit IRC | 22:14 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:19 | |
| nkinder | mfisch: I have a patch I'm running through the unit tests now. If all goes well, I'll propose it for review. It would be great if you could try it out. | 22:20 |
| *** praneshp has joined #openstack-keystone | 22:20 | |
| praneshp | Hi dolphm | 22:20 |
| praneshp | keystone.user table has a column called ‘extra' | 22:21 |
| praneshp | is there a way to see the contents of that from the CLI / python client? | 22:21 |
| praneshp | morganfainberg: ^^ | 22:21 |
| mfisch | nkinder: sure can you add me as a reviewer? | 22:23 |
| nkinder | mfisch: will do | 22:23 |
| *** david-lyle has quit IRC | 22:27 | |
| morganfainberg | praneshp, i don't think so. | 22:30 |
| praneshp | morganfainberg: ok. I was hoping we could update that field without sql | 22:31 |
| praneshp | thanks morganfainberg | 22:31 |
| lhcheng | morganfainberg: if python-client is used as library, we should be able to update the "extra" attribute with this code: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v2_0/users.py#L45 ? | 22:33 |
| *** __TheDodd__ has quit IRC | 22:33 | |
| morganfainberg | lhcheng, but not from the CLI | 22:33 |
| lhcheng | morganfainberg: yup | 22:33 |
| lhcheng | but praneshp could use python client directly and write a python script to update the "extra" attribute instead of sql | 22:34 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Create specification for CADF everywhere https://review.openstack.org/128780 | 22:35 |
| praneshp | lhcheng: can you also see (get) the extra atrrubut somehow? | 22:35 |
| lhcheng | morganfainberg: I haven't tested the update() though :P But from the code, looks like it should work :) | 22:36 |
| lhcheng | praneshp: I think it should also work for get. Have to boot my devstack to try it out.. | 22:37 |
| praneshp | lhcheng: let me walk over so you can use my cluster | 22:38 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Replace httpretty with requests-mock https://review.openstack.org/112777 | 22:45 |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Use newer python-ldap paging control API https://review.openstack.org/128782 | 22:46 |
| morganfainberg | nkinder, that is reverse compatible with older versions of the python-ldap lib? | 22:46 |
| morganfainberg | ah nvm | 22:46 |
| morganfainberg | i see what you did | 22:46 |
| nkinder | morganfainberg: yeah | 22:46 |
| morganfainberg | euuw | 22:46 |
| morganfainberg | really.. they did that on a minor point release? | 22:46 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Create specification for CADF everywhere https://review.openstack.org/128780 | 22:46 |
| * morganfainberg shakes head. | 22:47 | |
| nkinder | morganfainberg: yeah... | 22:47 |
| morganfainberg | wtf people | 22:47 |
| morganfainberg | :P | 22:47 |
| *** henrynash has joined #openstack-keystone | 22:49 | |
| *** browne has quit IRC | 22:49 | |
| nkinder | henrynash: hey Henry | 22:51 |
| henrynash | nkinder: hi | 22:51 |
| nkinder | henrynash: I have a policy question for you | 22:51 |
| henrynash | nkinder: shoot | 22:51 |
| nkinder | henrynash: I'm not sure I understand the region policy here - https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json | 22:52 |
| nkinder | henrynash: should create, update, delete be allowed for any admin users, or only cloud admin? | 22:52 |
| nkinder | henrynash: it looks like anyone with "admin" at any scope would be allowed to delete regions that the cloud admin defined | 22:52 |
| henrynash | nkinder: yes, I don’t agree with the region policy here… | 22:53 |
| nkinder | henrynash: Ok. It seems like it should be the same as the service and endpoint API | 22:53 |
| henrynash | nkinder: in fact, I don’t think that just haveing the role admin for non-project/domain related APIs should get you anything at all | 22:53 |
| nkinder | henrynash: +1 | 22:54 |
| nkinder | henrynash: I'll propose a fix | 22:54 |
| henrynash | nkinder: excellent! | 22:54 |
| nkinder | lhcheng: ^^^ that answers the policy thing we were talking about earlier | 22:54 |
| henrynash | nkinder: someone else has a proposed set of changes for this as well…which I think might fix this too…have to find the patch | 22:55 |
| nkinder | henrynash: oh, I'll look for it too. Let me know if you find it first. | 22:55 |
| henrynash | nkinder: https://review.openstack.org/#/c/123509/ | 22:56 |
| lhcheng | nkinder: thanks! | 22:57 |
| nkinder | henrynash: looks like a pretty big overhaul | 22:58 |
| henrynash | nkinder: yes…(maybe too big?)…but one nice idea is to combine the two policy files so we onlyhave one | 22:58 |
| nkinder | henrynash: I agree that this is worth more discussion for Kilo. | 23:00 |
| henrynash | nkinder: yes | 23:00 |
| nkinder | henrynash: I'll provide a more surgical update to the current policy in the meantime | 23:00 |
| *** marcoemorais has quit IRC | 23:05 | |
| *** marcoemorais has joined #openstack-keystone | 23:05 | |
| *** marcoemorais has quit IRC | 23:05 | |
| *** marcoemorais has joined #openstack-keystone | 23:06 | |
| *** marcoemorais has quit IRC | 23:06 | |
| *** marcoemorais has joined #openstack-keystone | 23:06 | |
| *** henrynash has quit IRC | 23:06 | |
| *** marcoemorais has quit IRC | 23:07 | |
| *** marcoemorais has joined #openstack-keystone | 23:07 | |
| *** henrynash has joined #openstack-keystone | 23:13 | |
| *** praneshp has quit IRC | 23:20 | |
| *** praneshp has joined #openstack-keystone | 23:22 | |
| lhcheng | henrynash, nkinder: haneef already started some work to combine the two policy file to work with v2 and v3: https://review.openstack.org/#/c/126217/ | 23:22 |
| *** _cjones_ has quit IRC | 23:24 | |
| lhcheng | oops I'm assigned to the ticket (https://bugs.launchpad.net/keystone/+bug/1378036) that unblocks it. I'll un-assign myself for now, in case someone wants to work on it. | 23:24 |
| uvirtbot | Launchpad bug 1378036 in keystone "Keystone unit tests should use domain scoped token" [Low,Triaged] | 23:24 |
| *** _cjones_ has joined #openstack-keystone | 23:24 | |
| *** marcoemorais has quit IRC | 23:26 | |
| *** drjones has joined #openstack-keystone | 23:26 | |
| *** marcoemorais has joined #openstack-keystone | 23:26 | |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Restrict certain APIs to cloud admin in domain-aware policy https://review.openstack.org/128788 | 23:28 |
| *** _cjones_ has quit IRC | 23:29 | |
| *** stevemar has quit IRC | 23:32 | |
| *** praneshp has left #openstack-keystone | 23:32 | |
| *** henrynash has quit IRC | 23:37 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/127765 | 23:41 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/126631 | 23:41 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/126679 | 23:46 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!