| *** samuelms_home has joined #openstack-keystone | 00:04 | |
| *** dims_ has quit IRC | 00:06 | |
| *** dims_ has joined #openstack-keystone | 00:06 | |
| *** dims__ has joined #openstack-keystone | 00:07 | |
| *** drjones has quit IRC | 00:07 | |
| *** _cjones_ has joined #openstack-keystone | 00:07 | |
| rodrigods | gyee, once it had a +2 https://review.openstack.org/#/c/117784/ =) | 00:10 |
|---|---|---|
| *** dims_ has quit IRC | 00:11 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Use oslo.utils and oslo.serialization https://review.openstack.org/128454 | 00:14 |
| gyee | rodrigods, yeah | 00:14 |
| rodrigods | gyee, no pressure hehe | 00:15 |
| gyee | just the minor nits right? | 00:15 |
| *** packet has joined #openstack-keystone | 00:18 | |
| gyee | rodrigods, on behalf of ayoung, I sincerely apologize for making you implement this in LDAP :) | 00:18 |
| rodrigods | gyee, reaaally?! | 00:20 |
| rodrigods | haha | 00:21 |
| gyee | ah, ain't that bad | 00:22 |
| rodrigods | gyee, future plans, right? | 00:32 |
| *** raildo_ has joined #openstack-keystone | 00:35 | |
| gyee | rodrigods, yeah, I still need to review the other patches, just need to find the time | 00:36 |
| rodrigods | gyee, ++ the next one of the series is quite small... the biggest part are tests | 00:37 |
| raildo_ | gyee: ++ | 00:37 |
| raildo_ | gyee: and we have to talk later about the HM session :) | 00:37 |
| mfisch | nkinder: still want me to try that patch or will you have something different tomorrow? | 00:38 |
| nkinder | mfisch: I have a fix now. I was just working on a test. | 00:38 |
| nkinder | mfisch: I can push what I have | 00:38 |
| mfisch | I'm fine to wait, not in a rush here | 00:38 |
| gyee | raildo_, yes, I am interested in the role management piece, like ownership, visibility, etc | 00:39 |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Use newer python-ldap paging control API https://review.openstack.org/128782 | 00:39 |
| gyee | nkinder, when's jamie coming back? | 00:39 |
| nkinder | mfisch: ^^^ try that please | 00:40 |
| rodrigods | gyee, looks like you are in interested in this patch https://review.openstack.org/#/c/117787/ hehe | 00:40 |
| nkinder | mfisch: I reproduced the problem and tested it against a real LDAP server, but a second confirmation would be good. | 00:40 |
| raildo_ | gyee: rodrigods hahaha | 00:40 |
| nkinder | gyee: monday I think | 00:40 |
| nkinder | gyee: but he'll be on europe hours, as he's hanging out in the czech republic until the summit | 00:41 |
| *** jacer_huawei has quit IRC | 00:42 | |
| gyee | nkinder, how did he get all these perks :) | 00:42 |
| *** marcoemorais has quit IRC | 00:50 | |
| morganfainberg | ... | 00:51 |
| rodrigods | morganfainberg, available for a tiny review? (not HM related) | 00:52 |
| morganfainberg | rodrigods: can take a look in a few minutes fixing my IRC client | 00:52 |
| rodrigods | morganfainberg, great | 00:52 |
| morganfainberg | . | 00:55 |
| nkinder | looks mike morganfainberg is in morse code mode | 00:56 |
| morganfainberg | .. / .- -- / -. --- - / .. -. / -- --- .-. ... . / -.-. --- -.. . / -- --- -.. . | 00:57 |
| morganfainberg | ugh. thats annoying. | 00:59 |
| nkinder | morganfainberg: lol, you're contradicting yourself | 01:00 |
| *** jacer_huawei has joined #openstack-keystone | 01:02 | |
| *** packet has quit IRC | 01:03 | |
| *** stevemar has joined #openstack-keystone | 01:05 | |
| *** _cjones_ has quit IRC | 01:08 | |
| *** sunrenjie6 has joined #openstack-keystone | 01:09 | |
| *** _cjones_ has joined #openstack-keystone | 01:09 | |
| rodrigods | morganfainberg, success? | 01:12 |
| *** _cjones_ has quit IRC | 01:13 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 01:14 | |
| mfisch | nkinder: +1 on your patch | 01:16 |
| morganfainberg | rodrigods, ping | 01:19 |
| rodrigods | morganfainberg, https://review.openstack.org/#/c/123619/ this one | 01:20 |
| rodrigods | thanks | 01:20 |
| morganfainberg | rodrigods, cool | 01:20 |
| morganfainberg | i got *some* of my client fixed up | 01:20 |
| morganfainberg | still needs a little work | 01:20 |
| morganfainberg | but it's def. better | 01:20 |
| morganfainberg | had to recompile it. | 01:20 |
| morganfainberg | rodrigods, LGTM | 01:21 |
| morganfainberg | nkinder, ping | 01:21 |
| rodrigods | morganfainberg, ++ | 01:21 |
| morganfainberg | nkinder, ok nvm. whoopse. | 01:21 |
| morganfainberg | rodrigods, direct another message at me in irc please | 01:22 |
| rodrigods | morganfainberg, ... | 01:22 |
| morganfainberg | ok i can't fix that, oh well | 01:22 |
| morganfainberg | thanks | 01:23 |
| rodrigods | morganfainberg, which client do you use? | 01:23 |
| morganfainberg | rodrigods, textual | 01:23 |
| morganfainberg | rodrigods, https://github.com/Codeux/Textual | 01:23 |
| rodrigods | morganfainberg, beautiful, I use the regular xchat | 01:24 |
| morganfainberg | it's a version of Limechat | 01:25 |
| morganfainberg | i just am tired of waiting for the new version and the old one has bugs | 01:25 |
| morganfainberg | so.. i compiled it myself :) | 01:25 |
| *** dims__ has quit IRC | 01:26 | |
| *** dims_ has joined #openstack-keystone | 01:27 | |
| rodrigods | morganfainberg, brave | 01:27 |
| *** gyee has quit IRC | 01:28 | |
| *** _kenjiro has joined #openstack-keystone | 01:28 | |
| rodrigods | morganfainberg, there was a time that I almost used gentoo | 01:29 |
| rodrigods | a friend of mine uses, he spends 2 days installing it | 01:29 |
| *** jjulien has joined #openstack-keystone | 01:29 | |
| *** dims_ has quit IRC | 01:29 | |
| *** dims_ has joined #openstack-keystone | 01:30 | |
| *** _kenjiro has quit IRC | 01:30 | |
| *** kenjiro__ has joined #openstack-keystone | 01:33 | |
| morganfainberg | lol | 01:34 |
| morganfainberg | yeah no thanks | 01:34 |
| samuelms_home | Hi guys, as I've discussed with dolphm and dstanek a few days ago .. I created an etherpad to list some possible improvements on keystone tests | 01:37 |
| samuelms_home | https://etherpad.openstack.org/p/Keystone_Tests_Improvement | 01:37 |
| samuelms_home | I'd be glad if you could take a look at it | 01:37 |
| morganfainberg | samuelms_home, nice. | 01:37 |
| samuelms_home | morganfainberg, dolphm, dstanek ^ | 01:37 |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 01:38 | |
| samuelms_home | I left a space for discussions on each section | 01:39 |
| samuelms_home | Looking forwarding to having your feedback :) | 01:39 |
| samuelms_home | s/forwarding/forward :p | 01:40 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Actually test interactive password prompt https://review.openstack.org/128770 | 01:41 |
| morganfainberg | great! | 01:41 |
| *** alex_xu has joined #openstack-keystone | 01:43 | |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Replace httpretty with requests-mock https://review.openstack.org/112777 | 01:51 |
| *** samuelms__ has joined #openstack-keystone | 01:53 | |
| samuelms__ | morganfainberg, could you take a look at 'Extract Assignment tests from IdentityTestCase' | 01:54 |
| samuelms__ | morganfainberg, https://review.openstack.org/#/c/121653/ | 01:54 |
| samuelms__ | morganfainberg, we already have a +2 from henrynash | 01:54 |
| samuelms__ | :) | 01:54 |
| *** shakamunyi has joined #openstack-keystone | 01:54 | |
| *** samuelms_home has quit IRC | 01:56 | |
| *** samuelms__ is now known as samuelms_home | 01:57 | |
| *** diegows has joined #openstack-keystone | 02:00 | |
| *** sunrenjie6 has quit IRC | 02:05 | |
| *** stevemar has quit IRC | 02:16 | |
| *** diegows has quit IRC | 02:18 | |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Use newer python-ldap paging control API https://review.openstack.org/128782 | 02:21 |
| nkinder | morganfainberg: do you know why we're pinned to python-ldap==2.3.13 in test-requirements.txt? | 02:23 |
| nkinder | 2.4 is on most platforms, which is what Keystone is actually using in the wild | 02:24 |
| nkinder | I'm running all of the tests with 2.4 locally now to see if everything is working | 02:24 |
| morganfainberg | Probably release | 02:25 |
| morganfainberg | Reqs / packaging from previous release ? | 02:28 |
| morganfainberg | That's my only real guess | 02:28 |
| *** stevemar has joined #openstack-keystone | 02:30 | |
| *** topol has joined #openstack-keystone | 02:30 | |
| openstackgerrit | wanghong proposed a change to openstack/keystonemiddleware: use keystone v3 api to fetch revocation list https://review.openstack.org/127459 | 02:30 |
| *** alex_xu has quit IRC | 02:30 | |
| *** lhcheng has quit IRC | 02:31 | |
| *** zzzeek has quit IRC | 02:32 | |
| nkinder | morganfainberg: so what's the process for juno fixes at this point? We're going to want https://review.openstack.org/128782 backported for sure. | 02:32 |
| nkinder | morganfainberg: still using proposed/juno? | 02:32 |
| openstackgerrit | wanghong proposed a change to openstack/keystonemiddleware: call _choose_api_version in one place https://review.openstack.org/127866 | 02:33 |
| morganfainberg | We add it to the known issues list, and we plan a backport to stable/Juno when we cut it | 02:33 |
| nkinder | morganfainberg: ok. Where can I fill in details for known issues? | 02:34 |
| *** alex_xu has joined #openstack-keystone | 02:34 | |
| morganfainberg | The release notes wiki page | 02:34 |
| nkinder | morganfainberg: there are some workarounds worth mentioning | 02:34 |
| morganfainberg | https://wiki.openstack.org/wiki/ReleaseNotes/Juno | 02:34 |
| nkinder | morganfainberg: yep, adding it now | 02:35 |
| morganfainberg | Cool. And yeah since there are relatively straight forward workarounds I am hesitant to say this is a massive show stopper that would require an emergency rc3 | 02:35 |
| morganfainberg | And we'll definitely have the fix quickly into stable. | 02:36 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: fix the wrong order of assertEqual args in test_v3 https://review.openstack.org/127110 | 02:37 |
| morganfainberg | I am more and more disappointed that these libraries are making changes like this with point releases. :( | 02:37 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: use expected_length parameter to assert expected length https://review.openstack.org/128197 | 02:38 |
| morganfainberg | nkinder: if you talk to jamielennox let him know I pushed the initial pass at the client session to sched. He should let me know (email works) if we need to change it | 02:38 |
| nkinder | morganfainberg: ok, will do. | 02:39 |
| nkinder | morganfainberg: it's not a massive show stopper. It only happens when paging is enabled, so that could be turned off, or python-ldap can be downgraded. | 02:40 |
| *** lhcheng has joined #openstack-keystone | 02:40 | |
| nkinder | morganfainberg: that will hold people over until it's backported to stable/juno | 02:40 |
| morganfainberg | Yep. Exactly | 02:40 |
| *** renlt has joined #openstack-keystone | 02:40 | |
| mfisch | nkinder: I'm confused as to whether your new test actually does anything | 02:45 |
| nkinder | morganfainberg: https://wiki.openstack.org/wiki/ReleaseNotes/Juno#Known_Issues_5 | 02:45 |
| nkinder | mfisch: it does. I backed out the fix and watched it fail | 02:45 |
| nkinder | mfisch: ...but, test-requirements.txt is pinning it to python-ldap 2.3.x | 02:46 |
| nkinder | mfisch: So the test will never fail unless you update python-ldap in your venv using pip (or tweak test-requirements.txt) | 02:46 |
| mfisch | nkinder: well I'm dumb, I didnt scroll down, now I see useful stuff ;) | 02:47 |
| nkinder | mfisch: It never actually processes a paged results control though. It just exercises the API that we use to create the control | 02:47 |
| mfisch | good enough for this one | 02:47 |
| nkinder | yeah | 02:47 |
| *** raildo_ has quit IRC | 02:47 | |
| *** wpf has quit IRC | 02:48 | |
| nkinder | mfisch: doh! I added a semicolon at the end of a line in the test though | 02:48 |
| nkinder | old habits die hard (lots of C programming) | 02:49 |
| mfisch | looks like you also forgot to free your pointers there | 02:49 |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Use newer python-ldap paging control API https://review.openstack.org/128782 | 02:49 |
| mfisch | nkinder: why not change the requirements to be >= 2.3? | 02:50 |
| nkinder | mfisch: doing that in a separate patch | 02:50 |
| mfisch | wfm | 02:50 |
| nkinder | mfisch: that way I can cleanly propose this for backport | 02:50 |
| nkinder | just verified that all tests pass with 2.4.x too | 02:50 |
| morganfainberg | nkinder: c / perl. Yes old habits die hard. | 02:53 |
| *** wpf has joined #openstack-keystone | 02:54 | |
| morganfainberg | nkinder: from __future__ import braces | 02:54 |
| mfisch | whenever my code is incomprehensible I'm thinking well there's your old perl shining through and when it crashes spectacularly I think of C | 02:55 |
| nkinder | morganfainberg: haha. Hadn't seen that before | 02:56 |
| morganfainberg | mfisch: if you can get Python to segfault in pure Python (not ctypes or c bindings) you can claim your Python works like c ;) | 02:57 |
| mfisch | I've been dealing with some non-enjoyable openvswitch segfaults this week already | 02:57 |
| morganfainberg | Be glad it isn't multithreaded coroutines. Yes, that was a past life of debugging. GDB is awful at coroutine boost debugging. | 02:58 |
| morganfainberg | And don't try to understand multithreaded coroutine as a concept. | 02:59 |
| mfisch | well there's some good news about being an operator, part of a failure like this is calling someone else | 03:00 |
| mfisch | I still get the pages though | 03:00 |
| *** dims_ has quit IRC | 03:01 | |
| morganfainberg | Also my past life. It's why I develop software now instead. I much rather debug that be called in the middle of the night (as the front line) | 03:02 |
| *** dims_ has joined #openstack-keystone | 03:02 | |
| mfisch | its a different experience for sure | 03:02 |
| morganfainberg | mfisch: https://twitter.com/mdrnstm/status/522583606699769857 | 03:04 |
| mfisch | is that the large hole at the top? | 03:05 |
| *** dims_ has quit IRC | 03:06 | |
| morganfainberg | Maybe. | 03:10 |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Update python-ldap version used for testing https://review.openstack.org/128816 | 03:14 |
| morganfainberg | nkinder: that have a requirements (global) change? | 03:15 |
| morganfainberg | nkinder: if it's already in global reqs the bot should auto propose the change. | 03:16 |
| nkinder | morganfainberg: nope, it must be coming from there - https://github.com/openstack/requirements/blob/master/global-requirements.txt | 03:17 |
| rodrigods | morganfainberg, nkinder, did you see https://bugs.launchpad.net/keystone/+bug/1381843 ? | 03:17 |
| uvirtbot | Launchpad bug 1381843 in keystone "keystone isn't compatible with python-ldap 2.4.* when enable paging" [Undecided,New] | 03:17 |
| morganfainberg | rodrigods: yep. | 03:17 |
| rodrigods | or are you talking about it and I just interrupting ? | 03:17 |
| nkinder | rodrigods: looks like a dupe of https://bugs.launchpad.net/keystone/+bug/1381768 | 03:17 |
| uvirtbot | Launchpad bug 1381768 in keystone "AttributeError: 'module' object has no attribute 'LDAP_CONTROL_PAGE_OID' with python-ldap 2.4" [Undecided,In progress] | 03:17 |
| morganfainberg | Not interrupting but is has been discussed. | 03:17 |
| nkinder | rodrigods: which I just fixed | 03:18 |
| morganfainberg | nkinder: ++ yep | 03:18 |
| rodrigods | morganfainberg, nkinder, cool =) | 03:18 |
| nkinder | morganfainberg: so I need to propose a change to global-requirements.txt, right? | 03:18 |
| morganfainberg | nkinder: yeah. | 03:18 |
| nkinder | morganfainberg: does that mean I shoudl abandon my patch for test-requirements.txt? | 03:18 |
| morganfainberg | Yeah the bot should auto propose once global reqs are updated. | 03:19 |
| morganfainberg | You can bring the patch back if bot gets dumb. But it can't gate until the global reqs are updated. | 03:19 |
| morganfainberg | rodrigods: I'll make that bug as a dupe. | 03:20 |
| rodrigods | morganfainberg, ++ | 03:20 |
| rodrigods | was checking out lbragstad tracking site | 03:20 |
| morganfainberg | Ah someone beat me to marking as dupe. | 03:21 |
| nkinder | morganfainberg: https://review.openstack.org/#/c/128817/ | 03:23 |
| morganfainberg | nkinder: so your patch to keystone needs to merge before that one right? | 03:27 |
| *** harlowja is now known as harlowja_away | 03:32 | |
| morganfainberg | nkinder: sadly we don't gate against ldap | 03:32 |
| *** harlowja_away is now known as harlowja | 03:34 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Explicit complaint about old OpenSSL when testing https://review.openstack.org/123619 | 03:37 |
| *** richm has quit IRC | 03:52 | |
| *** lhcheng has quit IRC | 04:19 | |
| *** lhcheng has joined #openstack-keystone | 04:19 | |
| *** marcoemorais has joined #openstack-keystone | 04:22 | |
| *** lhcheng has quit IRC | 04:24 | |
| *** marcoemorais1 has joined #openstack-keystone | 04:24 | |
| *** marcoemorais has quit IRC | 04:27 | |
| nkinder | morganfainberg: I don't think the merge order matters | 04:39 |
| nkinder | morganfainberg: my new test passes with version 2.3 or 2.4 | 04:39 |
| nkinder | morganfainberg: the existing tree doesn't have a test that fails in 2.4 since it doesn't cover paged results | 04:40 |
| nkinder | morganfainberg: so we *should* be good either way in terms of the gate | 04:40 |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Use newer python-ldap paging control API https://review.openstack.org/128782 | 04:43 |
| morganfainberg | Ok | 04:59 |
| *** lhcheng has joined #openstack-keystone | 05:05 | |
| *** lhcheng has quit IRC | 05:08 | |
| *** lhcheng has joined #openstack-keystone | 05:09 | |
| *** alex_xu has quit IRC | 05:12 | |
| *** _cjones_ has joined #openstack-keystone | 05:13 | |
| *** drjones has joined #openstack-keystone | 05:14 | |
| *** swamireddy has joined #openstack-keystone | 05:15 | |
| *** _cjones_ has quit IRC | 05:18 | |
| *** drjones has quit IRC | 05:20 | |
| *** _cjones_ has joined #openstack-keystone | 05:20 | |
| *** _cjones_ has quit IRC | 05:25 | |
| *** k4n0 has joined #openstack-keystone | 05:29 | |
| *** HenryG has quit IRC | 05:36 | |
| *** harlowja is now known as harlowja_away | 05:41 | |
| *** dims_ has joined #openstack-keystone | 06:03 | |
| *** swamireddy has quit IRC | 06:03 | |
| *** renlt has quit IRC | 06:06 | |
| *** dims_ has quit IRC | 06:07 | |
| *** topol has quit IRC | 06:19 | |
| stevemar | nkinder you certainly bring a point of view that the rest of us don't seem to have | 06:23 |
| *** lufix has joined #openstack-keystone | 06:28 | |
| *** lhcheng has quit IRC | 06:29 | |
| *** lhcheng has joined #openstack-keystone | 06:45 | |
| *** shakamunyi has quit IRC | 06:46 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Fix mappings.Mapping docstring https://review.openstack.org/128615 | 06:49 |
| *** shakamunyi has joined #openstack-keystone | 06:49 | |
| *** shakamunyi has quit IRC | 06:56 | |
| *** nellysmitt has joined #openstack-keystone | 07:01 | |
| *** alex_xu has joined #openstack-keystone | 07:06 | |
| *** afazekas has joined #openstack-keystone | 07:17 | |
| *** lhcheng has quit IRC | 07:20 | |
| *** HenryG has joined #openstack-keystone | 07:20 | |
| *** lhcheng has joined #openstack-keystone | 07:21 | |
| *** samuelms_home has quit IRC | 07:25 | |
| *** lhcheng has quit IRC | 07:26 | |
| *** lufix has quit IRC | 07:46 | |
| *** stevemar has quit IRC | 07:54 | |
| *** henrynash has joined #openstack-keystone | 07:55 | |
| *** henrynash has quit IRC | 08:08 | |
| *** jistr has joined #openstack-keystone | 08:09 | |
| *** henrynash has joined #openstack-keystone | 08:15 | |
| *** henrynash has quit IRC | 08:16 | |
| *** henrynash has joined #openstack-keystone | 08:17 | |
| *** vb has quit IRC | 08:33 | |
| *** vb has joined #openstack-keystone | 08:33 | |
| *** renlt has joined #openstack-keystone | 09:17 | |
| *** alex_xu has quit IRC | 09:18 | |
| *** bdossant has joined #openstack-keystone | 09:36 | |
| *** aix has joined #openstack-keystone | 09:38 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: Log the username when using an invalid username or password https://review.openstack.org/128860 | 09:44 |
| *** kenjiro__ has quit IRC | 09:46 | |
| *** renlt has quit IRC | 10:03 | |
| *** shikui_ has joined #openstack-keystone | 10:05 | |
| *** Kui has quit IRC | 10:08 | |
| *** nellysmitt has quit IRC | 10:08 | |
| *** nellysmitt has joined #openstack-keystone | 10:09 | |
| *** renlt has joined #openstack-keystone | 10:12 | |
| *** nellysmitt has quit IRC | 10:13 | |
| *** topol has joined #openstack-keystone | 10:13 | |
| *** openstackgerrit has quit IRC | 10:19 | |
| *** openstackgerrit has joined #openstack-keystone | 10:19 | |
| *** renlt has quit IRC | 10:31 | |
| *** dims_ has joined #openstack-keystone | 10:58 | |
| *** amakarov_away is now known as amakarov | 11:02 | |
| *** marcoemorais1 has quit IRC | 11:11 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: Log the username when using an invalid username or password https://review.openstack.org/128860 | 11:11 |
| *** shikui__ has joined #openstack-keystone | 11:33 | |
| *** shikui_ has quit IRC | 11:36 | |
| *** diegows has joined #openstack-keystone | 11:47 | |
| *** radez_g0n3 is now known as radez | 12:04 | |
| *** topol has quit IRC | 12:32 | |
| *** diegows has quit IRC | 12:35 | |
| *** bknudson has joined #openstack-keystone | 12:47 | |
| *** miqui has joined #openstack-keystone | 13:01 | |
| *** ayoung has joined #openstack-keystone | 13:06 | |
| rodrigods | bknudson, there? do you have some time to check the HM patch again? https://review.openstack.org/#/c/117784/ | 13:07 |
| bknudson | rodrigods: not today | 13:08 |
| rodrigods | bknudson, ok, another day then, thanks | 13:09 |
| *** ayoung has quit IRC | 13:12 | |
| *** thiagop has joined #openstack-keystone | 13:14 | |
| *** r-daneel has joined #openstack-keystone | 13:15 | |
| *** richm has joined #openstack-keystone | 13:23 | |
| thiagop | Hi henrynash ! | 13:24 |
| *** vhoward has joined #openstack-keystone | 13:24 | |
| thiagop | henrynash: our team has finished a PoC of using the endpoint policy to enforce rules on Horizon. Do you want to take a look? Maybe you have some insights to help us to improve this to a usable approach... :) | 13:25 |
| henrynash | thiagop: yes..would love to take a look | 13:25 |
| thiagop | henrynash: It's very crude. I put it on my github so you can look/clone: https://github.com/tpborion/horizon/compare/poc-endpoint-policy?expand=1 | 13:27 |
| henrynash | will go through it later….thanks | 13:27 |
| thiagop | henrynash: Some assumptions made in this design are here: https://etherpad.openstack.org/p/poc-endpoint-policy-horizon | 13:31 |
| *** shikui__ has quit IRC | 13:34 | |
| *** ayoung has joined #openstack-keystone | 13:36 | |
| *** ayoung has quit IRC | 13:36 | |
| *** thedodd has joined #openstack-keystone | 13:42 | |
| *** gordc has joined #openstack-keystone | 13:45 | |
| *** shufflebot has quit IRC | 13:48 | |
| *** zzzeek has joined #openstack-keystone | 13:55 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:56 | |
| *** sigmavirus24 has left #openstack-keystone | 13:59 | |
| *** nellysmitt has joined #openstack-keystone | 14:05 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Merge tag '2014.2' https://review.openstack.org/128930 | 14:05 |
| *** henrynash has quit IRC | 14:14 | |
| *** david-lyle has joined #openstack-keystone | 14:16 | |
| *** henrynash has joined #openstack-keystone | 14:16 | |
| *** amerine_ has joined #openstack-keystone | 14:17 | |
| *** amerine has quit IRC | 14:17 | |
| *** zarric has quit IRC | 14:18 | |
| *** packet has joined #openstack-keystone | 14:22 | |
| *** ayoung has joined #openstack-keystone | 14:26 | |
| bknudson | what are these ^? | 14:27 |
| henrynash | thiagop: yeh, that’s neat! | 14:29 |
| *** thedodd has quit IRC | 14:29 | |
| *** thedodd has joined #openstack-keystone | 14:31 | |
| ayoung | thiagop is there a way to get Django to reread and reinitialize its config without dropping connections? If so, then the "IT WILL NOT BE RELOADED" will use that to reread the policies? | 14:32 |
| *** k4n0 has quit IRC | 14:40 | |
| thiagop | ayoung: I use an option in L76 that disables the reloading. By today's implementation of policy.py from oslo, the only reload that can be made is if the policy is a file. | 14:41 |
| ayoung | thiagop, what happens if I restart Horizon'sweb server? | 14:41 |
| thiagop | ayoung: It gets reloaded, yes. | 14:42 |
| ayoung | thiagop, does the response from fetching the policy URL get held in memory or on disk | 14:42 |
| thiagop | ayoung: in memory. | 14:43 |
| ayoung | thiagop, so each user logging in will re-request the file from Keystone? | 14:43 |
| * ayoung not sure of the HTTPD threading model in effect | 14:43 | |
| ayoung | does that code get run before the users request thread forks off | 14:44 |
| ayoung | clones to be pedantic | 14:44 |
| ayoung | ? | 14:44 |
| thiagop | ayoung: good question. I thought that it was loaded once and used to all users, but the threading can prevent that | 14:45 |
| ayoung | thiagop, just worth keeping in mind. Caching and refreshing is always a concern when one service calls another | 14:46 |
| ayoung | thiagop, for example, we don't currently have a good cache invalidation strategy for the certs used in PKI tokens | 14:46 |
| ayoung | not a problem until your certs expire | 14:47 |
| thiagop | ayoung: currently, we are working in a way to notify horizon if a policy was changed in keystone. It's a 3rd step on our plans. | 14:47 |
| *** amakarov has quit IRC | 14:47 | |
| *** amakarov has joined #openstack-keystone | 14:48 | |
| ayoung | thiagop, thanks for doing this...this is vital to Keystone | 14:48 |
| *** openstackgerrit has quit IRC | 14:48 | |
| *** openstackgerrit has joined #openstack-keystone | 14:49 | |
| thiagop | ayoung: do you think there is a too huge impact on keystone's performance if the policy is probed when each individual user logs in? | 14:49 |
| ayoung | thiagop, alone, no, but the aggregate of calls from Horizon to Keystone might get excessive | 14:49 |
| ayoung | just keep it in mind; we can always work on optimizing it once we get things working | 14:50 |
| thiagop | ayoung: absolutely. ;) | 14:51 |
| ayoung | thiagop, it really depends on the scale of the deployment, too. If this is a single Horizon and a single Keystone, Nova, Glance etc, and its not getting hammered, it really doesn't matter | 14:51 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Remove XML support https://review.openstack.org/125738 | 14:51 |
| *** stevemar has joined #openstack-keystone | 14:51 | |
| ayoung | if it is at scale, then there will be load balancing and session affinity issues to keep in mind. | 14:51 |
| ayoung | Drive on, I'm just making sure I understand what is going on, and my Horizon-Fu is still in the White-Belt stage (to mix terms from different Martial Arts) | 14:52 |
| amakarov | ayoung, could you please look as well at https://review.openstack.org/#/c/118590/ and https://review.openstack.org/#/c/120043/ ? | 14:53 |
| thiagop | ayoung: Mine is kinda yellow belt. But I'm making the exam to green shortly. :) | 14:53 |
| ayoung | amakarov, depends. What have you done for me recently? | 14:53 |
| ayoung | amakarov, Ah, you did those reviews for me. Yes and Yes! | 14:53 |
| amakarov | ayoung, tomorrow we discussed trust delegations | 14:53 |
| ayoung | amakarov, BTW, there is something else we can do to shrink tokens that will have an even bigger impact | 14:54 |
| ayoung | amakarov, with PKIZ it turns out that the signing is still done in an ASCII format (PEM) instead of DER. I have yet to figure out how to get Python 3's POpen to honor the binary output | 14:55 |
| amakarov | ayoung, that'd be nice but for now my only idea is packing token somehow more compact than base64 encoding :) | 14:56 |
| ayoung | amakarov, 25% reduction for unscoped, 50% for scoped | 14:56 |
| ayoung | amakarov, https://review.openstack.org/#/c/127533/ | 14:57 |
| ayoung | dstanek, any idea how to make that work? | 14:57 |
| amakarov | ayoung, so I'm to research how to replace PEM with DER? | 14:57 |
| ayoung | dstanek, I want to popen a file, and get binary output from the pipe | 14:58 |
| ayoung | amakarov, if you are so drive, yes! | 14:58 |
| ayoung | amakarov, I've also bugged gsilvis to work on the issue, as he is doing a bunch of stuff with the PKIZ tokens: figuring out which cert to use in a multiple cert use case | 14:59 |
| ayoung | amakarov, http://adam.younglogic.com/2014/10/who-signed-that-token/ | 14:59 |
| *** jorge_munoz has joined #openstack-keystone | 14:59 | |
| *** zarric has joined #openstack-keystone | 15:00 | |
| amakarov | ayoung, so sertification changes and unnecessary spaces removal may be joined? Or it's better to do one thing at a time? | 15:01 |
| ayoung | one at a time | 15:04 |
| amakarov | ayoung, btw what's the point of signing with openssl using Popen? Is't there any library to do that? | 15:04 |
| dstanek | ayoung: catching up - are you talking about that review? | 15:05 |
| ayoung | amakarov, changing the underlying formate of the PKIZ tokens might have side effects if deployment is done out of order, so we want to make sure we get it right before commiting anyway | 15:05 |
| ayoung | dstanek, the reason the py3 test failed | 15:05 |
| ayoung | dstanek, the openssl popen puts der format (binary) into std out | 15:05 |
| ayoung | dstanek, let me see if I can show you the erroneous output | 15:06 |
| amakarov | ayoung, definitely a thing to consider | 15:06 |
| ayoung | dstanek, http://logs.openstack.org/33/127533/1/check/gate-python-keystoneclient-python33/54d4355/testr_results.html.gz | 15:07 |
| dstanek | ayoung: just pulled your change so i can run it locally | 15:07 |
| ayoung | dstanek, so the failing tests are | 15:07 |
| ayoung | test_cached_revoked_pkiz | 15:07 |
| ayoung | etc | 15:07 |
| ayoung | dstanek, I might be able to set you up with a better test env, too, lets see | 15:08 |
| dstanek | ayoung: so you are expected a 401 unauthorized, but the actual response is 200 OK? | 15:09 |
| ayoung | dstanek, I tend to use the code in python-keystoneclient/examples/pki/gen_cmsz.py | 15:09 |
| ayoung | dstanek, the 200 is a scary failure mode | 15:10 |
| ayoung | since the token should be invalid... | 15:10 |
| dstanek | ayoung: yeah, that's what i was thinking too | 15:10 |
| ayoung | that is a separate issue, though | 15:10 |
| ayoung | a 401 would mask the problem. I'd almost prefer a 500 at this point | 15:11 |
| *** zarric has quit IRC | 15:13 | |
| ayoung | dstanek, ok, so to run the code, I've activated the py3 venv from tox and then | 15:15 |
| ayoung | python3 -mpdb gen_cmsz.py | 15:15 |
| ayoung | putting a break point at | 15:15 |
| ayoung | line 105 | 15:15 |
| ayoung | encoded = cms.pkiz_sign(text, | 15:15 |
| ayoung | dstanek, OK, maybe I am jumping the conclusion gun | 15:18 |
| ayoung | /opt/stack/python-keystoneclient/keystoneclient/common/cms.py(205)pkiz_sign() | 15:18 |
| ayoung | (Pdb) print signed | 15:18 |
| ayoung | b'0\x82\x07\ | 15:18 |
| * ayoung removed the endless debugging, but you can see it is in binary form | 15:19 | |
| dstanek | ayoung: in that test inform is set to DER - is that correct? | 15:19 |
| ayoung | yes | 15:19 |
| ayoung | dstanek, cms_sign_data(text, is called with | 15:19 |
| ayoung | PKIZ_CMS_FORM) | 15:19 |
| dstanek | when i run that same test in 27 it's PEM | 15:19 |
| ayoung | (Pdb) print PKIZ_CMS_FORM | 15:19 |
| ayoung | 'DER' | 15:19 |
| ayoung | dstanek, you have the wrong version of the patch | 15:20 |
| ayoung | if you are seeing PEM you have what is in master | 15:20 |
| ayoung | oh, wait | 15:20 |
| ayoung | I'm not in the test, I'm in the cmsz code | 15:20 |
| ayoung | dstanek, are you seeing that in the verify or the sign call? | 15:21 |
| ayoung | py33: commands succeeded | 15:22 |
| ayoung | gah | 15:22 |
| *** gyee has joined #openstack-keystone | 15:24 | |
| *** nellysmitt has quit IRC | 15:24 | |
| *** nellysmitt has joined #openstack-keystone | 15:25 | |
| dstanek | that | 15:25 |
| dstanek | 's the verify | 15:25 |
| ayoung | dstanek, OK, it might be old data, but then the verify should fall back to dealing with PEM anyway | 15:25 |
| ayoung | dstanek, see the code line 142 if formatted.startswith(CMS_PREFIX) | 15:26 |
| ayoung | https://review.openstack.org/#/c/127533/1/keystoneclient/common/cms.py,cm | 15:27 |
| dstanek | ayoung: it doesn't ever get to that 'if' | 15:29 |
| ayoung | ? | 15:29 |
| *** nellysmitt has quit IRC | 15:29 | |
| ayoung | dstanek, I just ran the unit tests successfully using tox -epy33 | 15:29 |
| dstanek | formatted seems to be bytes in Python3 | 15:29 |
| dstanek | what did you change? | 15:29 |
| ayoung | dstanek, no clue | 15:30 |
| ayoung | let me git clean | 15:30 |
| dstanek | the problem i am having is the mixing of bytes and strings | 15:30 |
| ayoung | Ran 976 tests in 2.943s (-0.570s) | 15:31 |
| ayoung | PASSED (id=330, skips=3 | 15:31 |
| ayoung | dstanek, so the check if isinstance(formatted, six.string_types): is returning false for you and bypassing the next block, because the data is in binary? | 15:32 |
| ayoung | Fedora vs Ubuntu difference in Python verisions? | 15:33 |
| ayoung | Python 3.3.2 for me | 15:33 |
| dstanek | ayoung: yes - so it used the DER inform because that is passed into the function | 15:33 |
| ayoung | dstanek, what used the DER inform? | 15:34 |
| ayoung | which function? | 15:34 |
| dstanek | cms_verify | 15:35 |
| ayoung | dstanek, does your file match the code https://review.openstack.org/#/c/127533/1/keystoneclient/common/cms.py,cm | 15:35 |
| ayoung | so you are saying what happens after? | 15:36 |
| ayoung | you are saying that formatted is not a six.string type so it doesn't change the inform and so on? | 15:36 |
| stevemar | lbragstad, you get my thanks for taking on the xml removal support and not complaining | 15:36 |
| lbragstad | stevemar: hah, it's not over yet :) | 15:37 |
| dstanek | ayoung: yes, it's a byte string | 15:37 |
| ayoung | dstanek, ok...I think I need to merge in the test data changes with the code changes | 15:37 |
| ayoung | https://review.openstack.org/#/c/127534/ | 15:37 |
| dstanek | why is the test data string data instead of byte data? | 15:37 |
| ayoung | now that I look at that review, it only fails when check-tempest-dsvm-neutron-icehouse | 15:37 |
| ayoung | but... | 15:37 |
| ayoung | I think that is dangerous, so I will rework my patch so that it passes even with the old sample data...OK I think I know what I need to do | 15:38 |
| ayoung | thanks | 15:38 |
| *** shakamunyi has joined #openstack-keystone | 15:38 | |
| dstanek | ayoung: at runtine does that data come in as bytes in Python3? | 15:39 |
| *** jistr has quit IRC | 15:40 | |
| dstanek | oh, wait. we probably don't have anyone using that middleware in Python3 yet | 15:40 |
| ayoung | dstanek, I think I was fooling myself that it did | 15:40 |
| ayoung | dstanek, I don't think I ran the tests with the old, pre-recreated sample data | 15:40 |
| ayoung | so I was getting a false negative when I ran...I ran with the wrong review | 15:41 |
| ayoung | now that I have the right one, I see the failure. | 15:41 |
| ayoung | I can fix and rebase | 15:41 |
| dstanek | it's not the data that's broken. the fixture reads the data in as strings for the sample data, but generates bytes | 15:41 |
| *** richm has quit IRC | 15:42 | |
| ayoung | dstanek, OK, so if I have bytes...how should I be doing the comparison? | 15:42 |
| ayoung | dstanek, how are you running the tests in a debugger? | 15:44 |
| ayoung | activate the venv and then run...? | 15:44 |
| ayoung | testr? nose? | 15:45 |
| dstanek | tox -e py33 -- test_cached_revoked_pkiz | 15:45 |
| ayoung | dstanek, and import pdb; pdb.set_trace() ? | 15:45 |
| dstanek | i was just doing: raise Exception(repr(formatted)) | 15:46 |
| dstanek | but pdb would work doo | 15:46 |
| dstanek | too | 15:46 |
| ayoung | dstanek, I did that, and saw no information | 15:49 |
| ayoung | DOH scrolled off the screen | 15:50 |
| * ayoung needs more cofffeeeee | 15:50 | |
| ayoung | no, I don't get a stack trace | 15:51 |
| *** thedodd has quit IRC | 15:53 | |
| ayoung | dstanek, you are just running tox -e py33 -- test_cached_revoked_pkiz and you see a trace that shows the result of raise Exception(repr(formatted)) in the first line or so of cms_verify | 15:53 |
| ayoung | I get bupkis | 15:54 |
| *** david-lyle has quit IRC | 15:54 | |
| ayoung | http://paste.openstack.org/show/121500/ | 15:54 |
| dstanek | really? i put it as the first line of the function so that i know it was executed | 15:54 |
| *** richm has joined #openstack-keystone | 15:55 | |
| ayoung | how does the venv find the code? I thought it was a symlink to the git repo | 15:55 |
| ayoung | I did a git clean -xdf | 15:55 |
| *** jorge_munoz has quit IRC | 15:55 | |
| ayoung | and the .pyc files are generated when I run tox | 15:56 |
| ayoung | but pdb doesn't work either | 15:56 |
| ayoung | http://paste.openstack.org/show/121501/ just that change | 15:56 |
| *** jistr has joined #openstack-keystone | 16:00 | |
| stevemar | dstanek, ping | 16:02 |
| *** jorge_munoz has joined #openstack-keystone | 16:03 | |
| dstanek | ayoung: hacking on this a little now to understand it | 16:03 |
| dstanek | stevemar: heya | 16:03 |
| ayoung | stevemar, no, don't please don't kidnap dstanek on me! | 16:04 |
| stevemar | dstanek, i was wondering if you could check https://review.openstack.org/#/c/128788/ to see why PolicyJsonTestCase is not catching the diff. But... it looks like it the 2 policy files have been different for a while now | 16:05 |
| stevemar | I can dig into it on my own | 16:05 |
| stevemar | ayoung, he's all yours | 16:05 |
| ayoung | thanks | 16:05 |
| ayoung | dstanek, OK, running with nose gets me more info, but pdb still doesn't work... | 16:06 |
| *** _cjones_ has joined #openstack-keystone | 16:07 | |
| ayoung | but the raise call now shows output | 16:07 |
| dstanek | nose with --pdb? | 16:07 |
| *** aix has quit IRC | 16:07 | |
| ayoung | dstanek, ah, not import pdb; pdb.set_trace() | 16:07 |
| ayoung | let me try with the switch. too | 16:07 |
| samuelms | dstanek, I wrote an etherpad listing some possible improvements on tests .. as we've discussed some days ago | 16:08 |
| samuelms | dstanek, | 16:08 |
| samuelms | dstanek, https://etherpad.openstack.org/p/Keystone_Tests_Improvement | 16:08 |
| dstanek | ayoung: you have to still set_trace, but you need to tell nose you are going to do it with --pdb | 16:08 |
| dstanek | samuelms: yes, i read over them briefly, but i haven't had a chance to think about them | 16:09 |
| dstanek | samuelms: some of them seem like fix the code (like many of the NotImplemented calls) | 16:09 |
| samuelms | dolphm, henrynash ^ | 16:09 |
| ayoung | nosetests --pdb keystoneclient.tests.test_auth_token_middleware.v3AuthTokenMiddlewareTest | 16:09 |
| dstanek | samuelms: and there are some reviews for those now | 16:09 |
| ayoung | and I get | 16:09 |
| ayoung | E> /usr/lib64/python3.3/pdb.py(1587)post_mortem() | 16:09 |
| ayoung | -> raise ValueError("A valid traceback must be passed if no " | 16:09 |
| *** lhcheng has joined #openstack-keystone | 16:10 | |
| samuelms | dstanek, hmm.. I'll look for those submitted bugs related to those proposals | 16:11 |
| *** nellysmitt has joined #openstack-keystone | 16:11 | |
| samuelms | I left a space for discussions on each section .. feel free to add your comments there | 16:11 |
| *** openstackstatus has joined #openstack-keystone | 16:13 | |
| *** ChanServ sets mode: +v openstackstatus | 16:13 | |
| *** marcoemorais has joined #openstack-keystone | 16:14 | |
| samuelms | bknudson, thanks for your comments on 'skipping tests' | 16:15 |
| ayoung | dstanek, well, now I got the tests to pass for Python3 but fail for 2 | 16:16 |
| ayoung | um...yay? | 16:16 |
| samuelms | bknudson, I don't understand why it takes longer to write code .. | 16:16 |
| samuelms | bknudson, we just should use assertRaises instead of skip .. | 16:16 |
| -openstackstatus- NOTICE: An error in a configuration change to mitigate the poodle vulnerability caused a brief outage of git.openstack.org from 16:06-16:12. The problem has been corrected and git.openstack.org is working again. | 16:19 | |
| *** david-lyle has joined #openstack-keystone | 16:21 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Honor the inform and outform parameters https://review.openstack.org/127533 | 16:22 |
| *** lsmola has quit IRC | 16:29 | |
| *** shakamunyi has quit IRC | 16:30 | |
| *** sigmavirus24 has joined #openstack-keystone | 16:34 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Fixes sample data for PKIZ format https://review.openstack.org/127534 | 16:34 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Updates sample data for PKIZ format https://review.openstack.org/127534 | 16:35 |
| *** wwriverrat has joined #openstack-keystone | 16:36 | |
| *** wwriverrat has left #openstack-keystone | 16:36 | |
| *** jorge_munoz has quit IRC | 16:36 | |
| *** jorge_munoz has joined #openstack-keystone | 16:40 | |
| *** lsmola has joined #openstack-keystone | 16:44 | |
| bknudson | samuelms: it takes longer if I -1 a change and then have to wait for a new patch set. | 16:45 |
| bknudson | this is what people complain about all the time. | 16:45 |
| morganfainberg | mornin | 16:54 |
| *** dims_ has quit IRC | 16:55 | |
| *** dims_ has joined #openstack-keystone | 16:55 | |
| dstanek | stevemar: still having that issue? | 17:01 |
| *** bdossant has quit IRC | 17:03 | |
| samuelms | bknudson, yes .. that's true | 17:04 |
| *** bdossant has joined #openstack-keystone | 17:05 | |
| *** _cjones_ has quit IRC | 17:06 | |
| *** _cjones_ has joined #openstack-keystone | 17:06 | |
| *** topol has joined #openstack-keystone | 17:07 | |
| *** _cjones_ has quit IRC | 17:07 | |
| *** _cjones_ has joined #openstack-keystone | 17:07 | |
| *** bdossant has quit IRC | 17:10 | |
| *** drjones has joined #openstack-keystone | 17:12 | |
| *** _cjones_ has quit IRC | 17:12 | |
| rodrigods | henrynash, there? | 17:12 |
| *** thedodd has joined #openstack-keystone | 17:18 | |
| *** harlowja_away is now known as harlowja | 17:19 | |
| stevemar | dstanek, yo | 17:26 |
| stevemar | dstanek, so i'm not sure, turns out the test only checks to see if the *keys* are the same, not the *values* | 17:27 |
| stevemar | i'm not sure if we should be testing values or not | 17:27 |
| stevemar | thoughts? | 17:27 |
| dstanek | i think when i wrote the test the values were not the same | 17:27 |
| dstanek | i remember someone saying that they need a rule for each key, but the rules would differ | 17:28 |
| dstanek | because if they didn't, then there would be no need to have two files | 17:28 |
| dstanek | stevemar: ^ | 17:28 |
| stevemar | dstanek, that makes sense | 17:29 |
| stevemar | thank you sir | 17:29 |
| dstanek | stevemar: ma, pleasure | 17:29 |
| stevemar | i'll stop going down that rabbit hole | 17:29 |
| amakarov | ayoung, about token signing: why use Popen to spawn openssl CLI while openssl library can be used via python ctypes? | 17:31 |
| *** jorge_munoz has quit IRC | 17:32 | |
| henrynash | rodigods: hi | 17:33 |
| dstanek | amakarov: there was some trouble doing that IIRC | 17:34 |
| *** bdossant has joined #openstack-keystone | 17:34 | |
| amakarov | dstanek, so it's a temporary solution? | 17:35 |
| dstanek | amakarov: it's permanent until someone creates a better way | 17:35 |
| amakarov | dstanek, noted :) | 17:36 |
| dstanek | amakarov: ayoung might better remember the troubles he was having | 17:36 |
| rodrigods | henrynash, are you ok with using a for loop to avoid loops in the HM methods? | 17:37 |
| amakarov | dstanek, thank you, I'll ask him | 17:37 |
| henrynash | rodigods: depends what the condition is to terminate :-) | 17:38 |
| rodrigods | henrynash, we have a max_tree_depth config | 17:38 |
| *** bdossant has quit IRC | 17:39 | |
| rodrigods | we can use it, just need to get the code from the third patch to the second | 17:39 |
| henrynash | rodigods: so that’s one way… | 17:39 |
| henrynash | rodigods: isn’t a another to just check if the child you get is already in the list of ids you’vre already seen? | 17:40 |
| rodrigods | henrynash, I'm not an absolute fan of that approach, because we add a new O(n) in the method complexity | 17:41 |
| henrynash | O(n) | 17:41 |
| henrynash | ? | 17:41 |
| rodrigods | henrynash, wait... we can use set(), right? =) | 17:41 |
| *** dims_ has quit IRC | 17:42 | |
| *** dims_ has joined #openstack-keystone | 17:42 | |
| henrynash | rodigods: not sure if that stops the infinte recusion… | 17:45 |
| henrynash | rodigods: what’s wrong with: | 17:46 |
| henrynash | if ref in children: | 17:46 |
| henrynash | if ref in subtree: | 17:46 |
| henrynash | raise error | 17:46 |
| *** thedodd has quit IRC | 17:47 | |
| henrynash | sorry whould be a for loopon teh first line…I’ll add it as a suggestion to the review and then you can shoot it down :-) | 17:47 |
| openstackgerrit | Andre Aranha proposed a change to openstack/keystone: Extracting Method https://review.openstack.org/129009 | 17:47 |
| rodrigods | henrynash, ++ | 17:47 |
| *** arborism has joined #openstack-keystone | 17:47 | |
| *** arborism has quit IRC | 17:48 | |
| *** leonchio_ has joined #openstack-keystone | 17:52 | |
| henrynash | rodigods: added | 17:53 |
| rodrigods | henrynash, thanks | 17:56 |
| *** thedodd has joined #openstack-keystone | 18:05 | |
| rodrigods | henrynash, suggestion for the error that will be raised? | 18:12 |
| henrynash | rodigods: so I wrote one similar somewhere…let me find it… | 18:13 |
| *** bdossant has joined #openstack-keystone | 18:13 | |
| openstackgerrit | A change was merged to openstack/keystone: Restrict certain APIs to cloud admin in domain-aware policy https://review.openstack.org/128788 | 18:16 |
| *** bdossant has quit IRC | 18:17 | |
| henrynash | rodigods: so I did one in contrib/endpoint_policy/core.py | 18:18 |
| henrynash | if region_id in regions_examined: | 18:18 |
| henrynash | msg = _LE('Circular reference or a repeated entry found ' | 18:18 |
| henrynash | 'in region tree - %(region_id)s.') | 18:18 |
| henrynash | LOG.error(msg, {'region_id': ref.region_id}) | 18:18 |
| henrynash | return | 18:18 |
| henrynash | i.e. log an error and break out of teh while loop | 18:18 |
| rodrigods | henrynash, ++ | 18:18 |
| *** gsilvis has quit IRC | 18:19 | |
| rodrigods | thanks | 18:19 |
| *** lvh has quit IRC | 18:20 | |
| openstackgerrit | Andre Aranha proposed a change to openstack/keystone: Refactor: create a helper function to create users https://review.openstack.org/129009 | 18:20 |
| *** lvh has joined #openstack-keystone | 18:22 | |
| openstackgerrit | Andre Aranha proposed a change to openstack/keystone: Refactor: create a helper function to create users https://review.openstack.org/129009 | 18:25 |
| ayoung | amakarov, http://adam.younglogic.com/2014/06/why-popen-for-openssl-calls/ | 18:25 |
| ayoung | amakarov, I'm willing to listen to a better suggestion. Especially now that HTTPD is the default | 18:27 |
| morganfainberg | ayoung: there *has* to be a better option. | 18:28 |
| morganfainberg | But popen works for us for now. | 18:28 |
| ayoung | morganfainberg, I think Popen makes the most sense for Eventlet, but a ctypes approach for HTTPD would be fine, so long as it does not lock the gil | 18:29 |
| morganfainberg | It doesn't make sense for event let really. Iirc popen doesn't yeield. | 18:29 |
| morganfainberg | Oh god ctypes. Scary | 18:29 |
| amakarov | ayoung, I understand C-extentions to Python have some problems running in greenlet environments. There is cffi to use instead of ctypes. They promise to support PyPy, so I hope it may be the chance | 18:30 |
| morganfainberg | amakarov: it's why mysqldb locks up the event let worker. | 18:30 |
| ayoung | amakarov, do your homework and I'll be more than happy to endorce a reasonable replacement | 18:30 |
| amakarov | but I haven't done any research yet | 18:30 |
| morganfainberg | ayoung: if Python wasn't so bad at crypto I'd advocate pure python impl | 18:32 |
| ayoung | I'd smack you ith a wet sock fullof flour | 18:33 |
| morganfainberg | ayoung: but right now it isn't worth the effort to make that really viable. | 18:33 |
| morganfainberg | Let alone the other issues associated with it. | 18:33 |
| ayoung | its not just that python is bad a crypto | 18:33 |
| *** afazekas has quit IRC | 18:33 | |
| ayoung | its that we want to use the best reviewed implementation of the crypto algorithms | 18:33 |
| ayoung | of course, OpenSSL is kindof hurting repuatation these days | 18:33 |
| ayoung | but to be fair, POODLE was not openssl specific, was it | 18:34 |
| morganfainberg | That was the implication | 18:34 |
| morganfainberg | I dunno. It might be OpenSSL specific | 18:34 |
| morganfainberg | Not many things rely on that version, so it might be a hold over. | 18:35 |
| morganfainberg | But I am guessing poodle was not OpenSSL specific | 18:35 |
| amakarov | For now I didn't see any rocket science in ssl usages | 18:35 |
| *** wpf has quit IRC | 18:39 | |
| *** wpf has joined #openstack-keystone | 18:44 | |
| *** diegows has joined #openstack-keystone | 18:45 | |
| dstanek | morganfainberg: our own impl of a crypto algorithm shouldn't get past a security review | 18:47 |
| dstanek | stevemar: i can't parse that email | 18:48 |
| rodrigods | morganfainberg, feature branch needs rebase https://review.openstack.org/#/c/117784/ ? | 18:48 |
| morganfainberg | dstanek, no i was thinking pure python = something out there that is well reviewed and maintained | 18:52 |
| morganfainberg | dstanek, not something we implement here. | 18:52 |
| morganfainberg | dstanek, and only for us | 18:52 |
| morganfainberg | dstanek, but i don't think it'll ever happen | 18:52 |
| morganfainberg | rodrigods, i'll try and get that rebased today. | 18:53 |
| morganfainberg | rodrigods, for you. | 18:53 |
| dstanek | it would be nice to get this stuff into the cryptography library | 18:53 |
| amakarov | ayoung, I have a crazy idea: what if we wrap libssl & libcrypto in a service? Daemon with HTTP(or simplier) interface whitten in C? | 18:53 |
| ayoung | amakarov, I addressed that in my blog post. | 18:54 |
| ayoung | it doesn't solve anything | 18:54 |
| stevemar | dstanek, my email or OPs? | 18:54 |
| morganfainberg | amakarov, it's a whole lot worse than we have now actually, it implies less control | 18:54 |
| dstanek | stevemar: the OPs | 18:54 |
| amakarov | ayoung, oops, continue reading ) | 18:54 |
| ayoung | welll, not as a service, but then, you'd lost all sense of trust | 18:54 |
| morganfainberg | ayoung, ++ | 18:54 |
| ayoung | amakarov, I talk about having a dedicated project | 18:54 |
| ayoung | process | 18:55 |
| stevemar | dstanek, oh theres a follow up | 18:55 |
| ayoung | and that serializes things you don't want serialized. A stand alone services would still have that problem | 18:55 |
| dstanek | i don't see that - just the OP and your response | 18:55 |
| ayoung | amakarov, but keep up the thought experiments. | 18:55 |
| morganfainberg | ayoung, hm. | 18:56 |
| morganfainberg | ayoung, i have a fleeting thought let me try something | 18:56 |
| ayoung | amakarov, I'd really like to be able to swap in NSS for OpenSSL, too, and be able to use the versions that made common criteria and FIPS 1** compliance | 18:56 |
| ayoung | uh oh | 18:56 |
| dstanek | stevemar: does he just want to use Kerveros and LDAP? | 18:57 |
| *** gsilvis has joined #openstack-keystone | 18:57 | |
| rodrigods | morganfainberg, ++ thanks | 18:57 |
| *** jistr has quit IRC | 18:59 | |
| *** boris-42 has quit IRC | 19:02 | |
| stevemar | dstanek, i honestly can | 19:02 |
| stevemar | can't tell | 19:02 |
| *** marcoemorais has quit IRC | 19:03 | |
| dstanek | based on the follow up i think yes | 19:03 |
| *** marcoemorais has joined #openstack-keystone | 19:03 | |
| *** boris-42 has joined #openstack-keystone | 19:04 | |
| morganfainberg | bleh, hate it when fleeting thoughts / brain storms end up being more of a light drizzle... just enough to make things damp and annoyting | 19:05 |
| dstanek | stevemar: isn't this just the external plugin? | 19:05 |
| thiagop | guys, do we have an option on python-keystoneclient so as to get a token with "nocatalog"? | 19:06 |
| morganfainberg | thiagop, from the CLI or as a library? | 19:06 |
| thiagop | morganfainberg: lib | 19:06 |
| morganfainberg | thiagop, i am fairly certain it should support that | 19:07 |
| *** bdossant has joined #openstack-keystone | 19:07 | |
| bknudson | I don't think there's really a way in the client to get a token... there's auth plugins | 19:07 |
| bknudson | and I think there's a get_raw_token... | 19:07 |
| thiagop | I couldn't find anything on the docs nor on a shallow look on the code... | 19:08 |
| thiagop | it seems useful since it will reduce the size of the token being transmitted to some services in some cases | 19:09 |
| morganfainberg | huh did we not merge a way for ksc to avoid getting a catalog? | 19:09 |
| ayoung | nkinder, so...I've been beating on openstack common client using the Kerberos auth plugin. So far, no go: | 19:09 |
| bknudson | this has gotten to be a huge mess because rather than implementing a low level api for getting a token we've only got the plugins. | 19:09 |
| ayoung | $/usr/bin/openstack --insecure --os-auth-plugin kerberos --os-project-name demo --os-project-domain-name Default hypervisor list | 19:10 |
| ayoung | ERROR: openstack 'username' | 19:10 |
| bknudson | what you would think is a low level api (get_raw_token_from_identity_service) is implemented using plugins | 19:10 |
| ayoung | there seems to be some weirdness with Stevedore, and I had to hack the Pbr version thing again, too | 19:10 |
| ayoung | bknudson, ? | 19:11 |
| *** bdossant has quit IRC | 19:11 | |
| ayoung | get_raw_token_from_identity_service uses the plugin to populate the request | 19:11 |
| ayoung | the HTTP call is handled by the session. | 19:12 |
| ayoung | bknudson, I had to hack in a call "force_reauthenticate" in Django openstack auth that does what you are complaining about: | 19:12 |
| bknudson | ayoung: that does ?nocatalog ? | 19:13 |
| ayoung | bknudson, https://review.openstack.org/#/c/121281/6/openstack_auth/utils.py,cm | 19:13 |
| ayoung | bknudson, nope, but I think I need the catalog | 19:13 |
| ayoung | bknudson, although, good point that ?nocatalog would make sense for initial authentication | 19:13 |
| bknudson | auth_token middleware has an option to not request the catalog, so it can't be implemented using keystoneclient. | 19:14 |
| ayoung | bknudson, I don't understand | 19:14 |
| ayoung | bknudson, http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token.py#n1431 ? | 19:15 |
| bknudson | ayoung: yes. auth_token gets a token but it's not using keystoneclient to do it. | 19:16 |
| bknudson | and auth_token can't use keystoneclient since keystoneclient doesn't provide a way to ?nocatalog | 19:16 |
| ayoung | bknudson, there is a fix posted for that | 19:16 |
| *** gsilvis has quit IRC | 19:16 | |
| bknudson | ayoung: to have keystoneclient support ?nocatalog ? | 19:17 |
| ayoung | bknudson, so first we add nocatalog as an option to client, and then | 19:17 |
| ayoung | yep... | 19:17 |
| ayoung | ah, no | 19:17 |
| ayoung | there is a fix to make auth_token use KC | 19:17 |
| ayoung | not sure if it deals with nocatalog or not...looking | 19:17 |
| bknudson | ok... I wonder how it supports ?nocatalog. | 19:17 |
| ayoung | bknudson, https://review.openstack.org/#/c/115857/ | 19:18 |
| ayoung | bknudson, we need jamie back... | 19:19 |
| bknudson | ayoung: tell mrs jamie | 19:19 |
| bknudson | ayoung: https://review.openstack.org/#/c/115857/3/keystonemiddleware/auth_token.py is still not using auth plugin | 19:20 |
| *** david-lyle_ has joined #openstack-keystone | 19:20 | |
| *** david-lyle has quit IRC | 19:20 | |
| ayoung | bknudson, no, I know...I was mis-remembering how far things got | 19:20 |
| bknudson | it eventually does: response = self._session.request(path, method, **kwargs) | 19:20 |
| bknudson | so the request goes through a session now. | 19:21 |
| ayoung | gyee, on https://review.openstack.org/#/c/115857/ will you OK it if we do your suggesting as a follow on change? | 19:21 |
| *** gsilvis has joined #openstack-keystone | 19:22 | |
| dstanek | so can you not use the external password with the ldap identity backend? | 19:24 |
| gyee | ayoung, yes, that's what auth plugin is for | 19:25 |
| ayoung | gyee, so this change can go through? | 19:25 |
| ayoung | remove your -1 | 19:25 |
| ayoung | or are you saying this change *must* support the config option? | 19:26 |
| gyee | ayoung, see https://review.openstack.org/#/c/113735/ | 19:26 |
| gyee | that's how Jamie approach it | 19:26 |
| ayoung | gyee, you are in a rush, and you are confusing me | 19:26 |
| *** david-lyle_ is now known as david-lyle | 19:27 | |
| ayoung | what jamie's patch is doing is prep work for the config option you suggest. I think you are right, just that can be a follow on patch | 19:27 |
| *** amakarov is now known as amakarov_away | 19:28 | |
| gyee | ayoung, that's the end goal, if we want to get there in steps, I am fine with it | 19:30 |
| ayoung | ++ | 19:31 |
| ayoung | gyee, I'm a +2 a it then. Didn't want you to think I was ignoring you | 19:31 |
| gyee | ayoung, lemme remove the -1 | 19:31 |
| bknudson | file a wishlist bug so we don't forget | 19:32 |
| gyee | bkundson, ++ | 19:33 |
| gyee | sorry I mean bknudson | 19:33 |
| ayoung | bknudson, will do. I think I need it for Kerberos support, and gyee will want it for X509 | 19:33 |
| gyee | ayoung, hell yeah! :) | 19:33 |
| ayoung | gyee, I'll do a recheck first anyway | 19:33 |
| gyee | k | 19:33 |
| ayoung | ah, needs a manual rebase. | 19:34 |
| bknudson | I think with the change to requests-mock it's going to need a rebase | 19:34 |
| ayoung | I'll let jamie field it then, but gyee please remove the -1 | 19:34 |
| gyee | ayoung, done | 19:35 |
| ayoung | bknudson, do you understand stevedore and how entrypoints get registered? I'm having erratic results using the kerberos keystone auth plugin that is out of tree | 19:35 |
| bknudson | ayoung: it's been on my list of things to look at for some time and I haven't had a chance. | 19:36 |
| stevemar | dolphm, https://review.openstack.org/#/c/128747/ | 19:36 |
| ayoung | bknudson, it ties in with the auth plugin thing in that patch: we should be using entrypoints to enumerate plugins, but sometimes the out-of-tree plugin doesn't seem to get registered, and sometimes it does | 19:37 |
| bknudson | ayoung: scary. | 19:37 |
| ayoung | bknudson, not too mention PBR | 19:37 |
| morganfainberg | ayoung, they are in the egg info, you then query the libs: https://pythonhosted.org/setuptools/pkg_resources.html#entry-points | 19:38 |
| gyee | bknudson, this is october, it suppose to be scary :) | 19:38 |
| morganfainberg | ayoung, it's part of setuptools and pkg_resources | 19:38 |
| morganfainberg | pbr just makes extensive use of it, as does stevedore | 19:38 |
| ayoung | morganfainberg, what determines which eggs get queried for entrypoints on a given run? | 19:39 |
| morganfainberg | ayoung, it queries *all* eggs iirc | 19:39 |
| ayoung | morganfainberg, I wish it were that simple | 19:39 |
| morganfainberg | for a specific entry point group | 19:39 |
| ayoung | morganfainberg, sometimes, depending on how I call it, it finds the kerberos plugin, and sometimes it doesn't | 19:39 |
| morganfainberg | stevedore or pkg_resources | 19:39 |
| ayoung | if I import keystoneclient_kerberos it always finds it | 19:39 |
| morganfainberg | look at pkg_resources | 19:40 |
| dhellmann | ayoung: the egg containing the entry point has to be installed in sys.path | 19:40 |
| morganfainberg | dhellmann, to the rescue! | 19:40 |
| ayoung | the DOA code seems to be finding it reliably | 19:40 |
| dhellmann | ayoung: https://pypi.python.org/pypi/entry_point_inspector may help you debug | 19:40 |
| ayoung | dhellmann, I did sudo pip install -e . | 19:40 |
| ayoung | from inside the python-keystoneclient-kerberos repo | 19:41 |
| dhellmann | ayoung: which python package does that install into? (the dir name under site-packages) | 19:41 |
| dhellmann | i.e., is keystoneclient a namespace package? | 19:41 |
| *** bdossant has joined #openstack-keystone | 19:41 | |
| ayoung | $cat /usr/lib/python2.7/site-packages/python-keystoneclient-kerberos.egg-link | 19:42 |
| ayoung | /opt/stack/python-keystoneclient-kerberos | 19:42 |
| ayoung | $cat /opt/stack/python-keystoneclient-kerberos/python_keystoneclient_kerberos.egg-info/entry_points.txt | 19:43 |
| ayoung | [keystoneclient.auth.plugin] | 19:43 |
| ayoung | kerberos = keystoneclient_kerberos.kerberos:Kerberos | 19:43 |
| dhellmann | ayoung: ok, so you say "from keystoneclient_kerberos import something"? | 19:43 |
| ayoung | dhellmann, or just import keystoneclient_kerberos and it works | 19:43 |
| dhellmann | ayoung: ok, I'm trying to understand the code layout | 19:44 |
| ayoung | dhellmann, so we have this little thing called the openstack common client. You might have heard mention of it | 19:44 |
| ayoung | heh | 19:44 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Add a specification for revamping the documentation https://review.openstack.org/128747 | 19:44 |
| dhellmann | ayoung: what does "epi group show keystoneclient.auth.plugin" give you? | 19:45 |
| ayoung | let me install epi | 19:45 |
| ayoung | dhellmann, where's epi come from? | 19:46 |
| *** bdossant has quit IRC | 19:46 | |
| ayoung | pip install entry_point_inspector | 19:46 |
| dhellmann | ayoung: pip install entry_point_inspector | 19:46 |
| ayoung | dhellmann, its in there | 19:47 |
| ayoung | last line is | 19:47 |
| ayoung | | kerberos | keystoneclient_kerberos.kerberos | Kerberos | python-keystoneclient-kerberos 0.0.1.dev3.g263148b | | | 19:47 |
| dhellmann | ayoung: and how are you running the thing that can't find it? | 19:47 |
| ayoung | dhellmann, varies, but it seems to be maybe a new shell thing? | 19:47 |
| dhellmann | ayoung: do you have code for loading the plugins that I can look at? | 19:47 |
| ayoung | let me try that | 19:47 |
| ayoung | dhellmann, I have a review | 19:48 |
| ayoung | dhellmann, https://review.openstack.org/#/c/115463/6/openstack_auth/utils.py,cm | 19:48 |
| ayoung | dhellmann, let me try a new shell... | 19:48 |
| ayoung | dhellmann, try this | 19:50 |
| ayoung | git clone the repo, pip install -e . | 19:50 |
| ayoung | and then | 19:50 |
| ayoung | /usr/bin/openstack --insecure --os-auth-plugin kerberos --os-project-name demo --os-project-domain-name Default hypervisor list | 19:50 |
| ayoung | something is whack with PBR, too | 19:51 |
| ayoung | I keep getting | 19:51 |
| ayoung | raise Exception("Versioning for this project requires either an sdist" | 19:51 |
| ayoung | Exception: Versioning for this project requires either an sdist tarball, or access to an upstream git repository. Are you sure that git is installed? | 19:51 |
| ayoung | dhellmann, OK, bet this is related | 19:56 |
| ayoung | I just did a new ssh tothe machine, then | 19:56 |
| ayoung | python | 19:56 |
| ayoung | and in the interpreter | 19:56 |
| ayoung | import pbr.version | 19:56 |
| ayoung | pbr.version.VersionInfo( 'keystoneclient_kerberos').version_string() | 19:56 |
| ayoung | raise Exception("Versioning for this project requires either an sdist" | 19:57 |
| ayoung | Exception: Versioning for this project requires either an sdist tarball, or access to an upstream git repository. Are you sure that git is installed? | 19:57 |
| ayoung | I'm going to try just install the thing without pip | 19:57 |
| ayoung | nope...same problem | 19:58 |
| dhellmann | ayoung: that pbr error might be causing an import error, but I don't know why you are getting that | 19:58 |
| ayoung | dhellmann, so I did sudo python setup.py install | 19:58 |
| ayoung | same problem | 19:59 |
| dhellmann | did you uninstall the editable version first? | 19:59 |
| ayoung | no, let me do that | 19:59 |
| dhellmann | ayoung: which version of pbr do you have? | 19:59 |
| ayoung | 1.10 something | 19:59 |
| ayoung | pbr==0.10.1.dev8.g81c2000 | 19:59 |
| dhellmann | you might be hitting https://bugs.launchpad.net/pbr/+bug/1265622 | 20:00 |
| uvirtbot | Launchpad bug 1265622 in pbr "pbr running in git context when it shouldn't" [Undecided,New] | 20:00 |
| ayoung | sure sounds like it | 20:01 |
| ayoung | dhellmann not sure why only the new plugin is showing this behavior | 20:02 |
| dhellmann | ayoung: I'm looking at your plugin code now | 20:02 |
| ayoung | | kerberos | keystoneclient_kerberos.kerberos | Kerberos | python-keystoneclient-kerberos 0.0.1.dev3.g263148b | Versioning for this project requires either an sdist tarball, or access to an upstream git repository. Are you sure that git is installed? | | 20:03 |
| ayoung | dhellmann, you need the version from review... | 20:03 |
| dhellmann | ayoung: which review? | 20:03 |
| *** shikui__ has joined #openstack-keystone | 20:03 | |
| ayoung | https://review.openstack.org/#/c/123614/ | 20:03 |
| ayoung | dhellmann, the repo is just an empty repo, until that gets in | 20:03 |
| dhellmann | ayoung: yeah, saw | 20:04 |
| *** david-lyle_ has joined #openstack-keystone | 20:04 | |
| dhellmann | ayoung: which system packages do I need for this plugin to work? | 20:04 |
| ayoung | requests-kerberos | 20:05 |
| ayoung | that might pull in all of the kerberos libraries | 20:05 |
| ayoung | prolly kerb-workstation or something like that | 20:05 |
| *** david-lyle has quit IRC | 20:06 | |
| dhellmann | tox -e py27 -r fixed it | 20:06 |
| ayoung | dhellmann, suspect that if you exited out and then back in you would see the problem again | 20:07 |
| dhellmann | I don't have a devstack setup to test this against, but the plugin setup code looks ok | 20:07 |
| ayoung | its pbr. It can't seem to find the package info | 20:07 |
| dhellmann | ayoung: what does this give you: python -c 'import keystoneclient_kerberos; print keystoneclient_kerberos' | 20:08 |
| ayoung | raise Exception("Versioning for this project requires either an sdist" | 20:09 |
| ayoung | Exception: Versioning for this project requires either an sdist tarball, or access to an upstream git repository. Are you sure that git is installed? | 20:09 |
| dhellmann | ayoung: do you have git installed? | 20:09 |
| ayoung | dhellmann, yep | 20:09 |
| dhellmann | ayoung: ok, let's clean out the installed stuff you have for that lib and make sure it's not there at all, then reinstall it not in editable mode and see what that does | 20:10 |
| dhellmann | ayoung: you might also want to try installing pbr 0.10.0 instead of the dev version you have | 20:10 |
| ayoung | dhellmann, something is wrong with the package name | 20:11 |
| dhellmann | ayoung: we could also try setting this up in a virtualenv to see if your system site-packages is borked | 20:11 |
| ayoung | $ sudo pip uninstall python-keystoneclient-kerberos | 20:11 |
| ayoung | Can't uninstall 'python-keystoneclient-kerberos'. No files were found to uninstall. | 20:11 |
| ayoung | -sh-4.2$ sudo pip uninstall python_keystoneclient_kerberos | 20:11 |
| ayoung | Can't uninstall 'python-keystoneclient-kerberos'. No files were found to uninstall. | 20:11 |
| dhellmann | ayoung: how did you install it? | 20:11 |
| *** mpath-rax has left #openstack-keystone | 20:11 | |
| ayoung | /usr/lib/python2.7/site-packages/keystoneclient_kerberos/ | 20:12 |
| *** TemporalBeing has quit IRC | 20:12 | |
| dhellmann | ayoung: what command did you use to install it? | 20:12 |
| ayoung | sudo python setup.py install | 20:12 |
| dhellmann | ok, you'll have to remove it by hand then | 20:12 |
| ayoung | dhellmann, OK, guessing something in setup.cfg is wrong | 20:13 |
| ayoung | http://git.openstack.org/cgit/openstack/python-keystoneclient-kerberos/tree/setup.cfg | 20:13 |
| dhellmann | ayoung: if you don't install it with pip, it doesn't look the same so pip doesn't know how to uninstall it | 20:13 |
| ayoung | well, its gone now | 20:13 |
| *** bknudson has quit IRC | 20:14 | |
| dhellmann | ok, install it again with "pip install ." | 20:14 |
| ayoung | -sh-4.2$ pip freeze | grep kerb | 20:15 |
| ayoung | -e git://git.openstack.org/openstack/django_openstack_auth.git@ff6d7a52cb1067121b77bc389244eab674989149#egg=django_openstack_auth-kerberos | 20:15 |
| ayoung | kerberos==1.1.1 | 20:15 |
| ayoung | -e git+https://git.openstack.org/openstack/python-keystoneclient-kerberos@263148b11b4585448ec4bdea83405a407ece406a#egg=python_keystoneclient_kerberos-plugin | 20:15 |
| ayoung | requests-kerberos==0.5 | 20:15 |
| dhellmann | did you install it with "pip install -e"? | 20:15 |
| ayoung | not this time | 20:15 |
| ayoung | dhellmann, let me see if there are vestiges hiding elsewhere | 20:16 |
| dhellmann | ok, uninstall it and run pip freeze again -- that -e line says it's looking at your source | 20:16 |
| dhellmann | yeah, it's in a .pth file | 20:16 |
| ayoung | where? | 20:16 |
| dhellmann | hang on | 20:16 |
| dhellmann | ayoung: /usr/local/lib/python2.7/*-packages/easy-install.pth | 20:17 |
| ayoung | dhellmann, that got rid of one of them | 20:19 |
| dhellmann | ayoung: ok, now try installing with "pip install ." again and let's see if pbr still tries to get version info from git | 20:20 |
| ayoung | dhellmann, I still have | 20:20 |
| ayoung | -e git://git.openstack.org/openstack/django_openstack_auth.git@ff6d7a52cb1067121b77bc389244eab674989149#egg=django_openstack_auth-kerberos | 20:20 |
| ayoung | ah, disregard | 20:20 |
| ayoung | that is DOA | 20:21 |
| ayoung | Nope | 20:21 |
| ayoung | dhellmann, OK, so it works immediately after pip install, but if I start a new session (log out and back in) it fails same way | 20:22 |
| ayoung | lets see what I have | 20:22 |
| dhellmann | ayoung: I have no idea why your login session would have anything to do with python's import machinery | 20:22 |
| ayoung | dhellmann, cuz something loaded it into something that is cached, or a python path, or something | 20:22 |
| ayoung | /usr/lib/python2.7/site-packages/python_keystoneclient_kerberos-0.0.1.dev3.g263148b-py2.7.egg-info/ | 20:23 |
| dhellmann | ayoung: python doesn't cache things in your shell environment, though | 20:23 |
| ayoung | liar | 20:23 |
| ayoung | let see | 20:23 |
| ayoung | dhellmann I just got a hunch | 20:27 |
| ayoung | dhellmann, I bet it is the _ in the name that is f)(*Y it up | 20:27 |
| ayoung | lets take a lookssssseeeee | 20:27 |
| dhellmann | ayoung: that shouldn't matter either; why do you think? | 20:28 |
| ayoung | dhellmann, hunch | 20:28 |
| *** shikui__ has quit IRC | 20:28 | |
| ayoung | dhellmann, it does all sorts of string matching, that is why I think the _ is the culprit | 20:32 |
| ayoung | dhellmann, (Pdb) print requirement |=> provider = pkg_resources.get_provider(requirement) | 20:33 |
| ayoung | keystoneclient-kerberos | 20:33 |
| ayoung | I bet the _ to - transform is messing it up | 20:33 |
| dhellmann | ayoung: ah! so it's not just that there is a _, but that there are 2 forms of the name that don't match? | 20:34 |
| *** nellysmitt has quit IRC | 20:34 | |
| ayoung | dhellmann, failing at /usr/lib/python2.7/site-packages/pbr/version.py line 435 | 20:34 |
| ayoung | provider = pkg_resources.get_provider(requirement) | 20:35 |
| dhellmann | ok, that's not pbr then | 20:35 |
| *** nellysmitt has joined #openstack-keystone | 20:35 | |
| *** bdossant has joined #openstack-keystone | 20:36 | |
| ayoung | dhellmann, as I said, I think it is setup.cfg | 20:37 |
| ayoung | but, yes, it is pbr | 20:37 |
| dhellmann | ayoung: it's not the - to _, it's the "python-" missing from the front | 20:37 |
| ayoung | cuz pbr is a nosy bastid | 20:37 |
| ayoung | that should not be in the registered name, shoud it | 20:37 |
| dhellmann | hrm, or maybe not | 20:37 |
| dhellmann | novaclient does the same thing | 20:37 |
| ayoung | name = python-keystoneclient-kerberos | 20:38 |
| ayoung | that seems just wrong | 20:38 |
| ayoung | but keystoneclient does the same thing, too | 20:38 |
| ayoung | I think it is the _to- | 20:38 |
| *** nellysmitt has quit IRC | 20:39 | |
| ayoung | dhellmann, why does this even exist? | 20:39 |
| ayoung | why does __init__.py need to say anything about version | 20:39 |
| dhellmann | ayoung: I have no idea, I thought you wanted that | 20:40 |
| ayoung | god no | 20:40 |
| ayoung | it is all over the place | 20:40 |
| dhellmann | if you change __name__ to 'python-keystoneclient-kerberos' in your __init__ that will fix it | 20:40 |
| dhellmann | that's what novaclient does | 20:41 |
| ayoung | dhellmann, http://legacy.python.org/dev/peps/pep-0008/#version-bookkeeping | 20:41 |
| dhellmann | ayoung: meh. I use pkg_resources to ask for versions when I want them, I don't depend on having it in the lib | 20:41 |
| ayoung | dhellmann, PBR needs to die | 20:42 |
| dhellmann | ayoung: anyway, the fix is to use the right name for the distribution ^^ | 20:42 |
| ayoung | or at least pbr.version | 20:42 |
| ayoung | no difference | 20:44 |
| dhellmann | fixed it for me, did you re-install? | 20:44 |
| ayoung | I removed the installed version and went back to pip install -e . | 20:44 |
| dhellmann | :-| | 20:44 |
| dhellmann | ayoung: is this a box I can login to? | 20:45 |
| ayoung | dhellmann, it should work | 20:45 |
| ayoung | nope. internal | 20:45 |
| dhellmann | as much fun as playing 20 questions with you is... | 20:45 |
| ayoung | heh | 20:45 |
| ayoung | I think I'ma kill PBR | 20:45 |
| ayoung | in this case | 20:45 |
| ayoung | lets see if that allows the entrypoint registry | 20:46 |
| dhellmann | it's time for me to leave my current location, but I'll watch for an update later | 20:46 |
| *** david-lyle_ is now known as david-lyle | 20:48 | |
| ayoung | dhellmann, killing pbr made it work | 20:50 |
| ayoung | now I get an error on the openstack client | 20:50 |
| ayoung | [ayoung@horizon ~(keystone_demo)]$/usr/bin/openstack --insecure --os-auth-plugin kerberos --os-project-name demo --os-project-domain-name Default hypervisor list | 20:50 |
| ayoung | /usr/lib/python2.7/site-packages/requests/packages/urllib3/connectionpool.py:730: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.org/en/latest/security.html (This warning will only appear once by default.) | 20:50 |
| ayoung | InsecureRequestWarning) | 20:50 |
| ayoung | ERROR: openstack 'username' | 20:50 |
| ayoung | ooh, think I can drop insecure...let me see | 20:50 |
| dhellmann | ayoung: add --debug for a full traceback | 20:51 |
| ayoung | ah, thanks | 20:51 |
| ayoung | dhellmann, OK, I think the problem is that the kerberos approach doesn't use username from the request | 20:51 |
| ayoung | File "/opt/stack/python-openstackclient/openstackclient/common/clientmanager.py", line 54, in __getattr__ | 20:52 |
| ayoung | return self._auth_params[name[1:]] | 20:52 |
| ayoung | KeyError: 'username | 20:52 |
| *** amcrn has joined #openstack-keystone | 20:53 | |
| *** gsilvis has quit IRC | 20:56 | |
| *** raildo is now known as raildo_away | 20:59 | |
| *** thedodd has quit IRC | 21:03 | |
| *** thiagop has quit IRC | 21:08 | |
| *** topol has quit IRC | 21:09 | |
| *** andreaf has joined #openstack-keystone | 21:23 | |
| *** stevemar has quit IRC | 21:32 | |
| *** drjones has quit IRC | 21:43 | |
| *** _cjones_ has joined #openstack-keystone | 21:44 | |
| *** thedodd has joined #openstack-keystone | 21:47 | |
| *** drjones has joined #openstack-keystone | 21:48 | |
| *** david-lyle has quit IRC | 21:49 | |
| *** _cjones_ has quit IRC | 21:51 | |
| *** radez is now known as radez_g0n3 | 22:04 | |
| *** david-lyle has joined #openstack-keystone | 22:05 | |
| *** rwsu has quit IRC | 22:07 | |
| *** bdossant_ has joined #openstack-keystone | 22:09 | |
| *** packet has quit IRC | 22:09 | |
| *** bdossant has quit IRC | 22:12 | |
| *** Tahmina has joined #openstack-keystone | 22:23 | |
| *** david-lyle has quit IRC | 22:24 | |
| *** htruta has quit IRC | 22:24 | |
| *** afaranha has quit IRC | 22:24 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:28 | |
| *** htruta has joined #openstack-keystone | 22:29 | |
| *** afaranha has joined #openstack-keystone | 22:30 | |
| *** Kui has joined #openstack-keystone | 22:32 | |
| *** thedodd has quit IRC | 22:35 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 22:37 | |
| *** gordc has quit IRC | 22:44 | |
| *** Tahmina has quit IRC | 23:01 | |
| *** zzzeek_ has joined #openstack-keystone | 23:05 | |
| *** zzzeek has quit IRC | 23:08 | |
| *** zzzeek has joined #openstack-keystone | 23:09 | |
| *** zzzeek_ has quit IRC | 23:09 | |
| *** zzzeek has quit IRC | 23:14 | |
| *** zzzeek has joined #openstack-keystone | 23:18 | |
| *** drjones has quit IRC | 23:19 | |
| *** _cjones_ has joined #openstack-keystone | 23:20 | |
| *** arunkant_work has quit IRC | 23:24 | |
| *** dims__ has joined #openstack-keystone | 23:30 | |
| *** dims__ has quit IRC | 23:33 | |
| *** dims_ has quit IRC | 23:33 | |
| *** dims_ has joined #openstack-keystone | 23:34 | |
| *** Tahmina has joined #openstack-keystone | 23:37 | |
| *** alex_xu has joined #openstack-keystone | 23:52 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:52 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!