| gyee | marekd, ping | 00:07 |
|---|---|---|
| *** drjones has joined #openstack-keystone | 00:15 | |
| *** _cjones_ has quit IRC | 00:17 | |
| *** ks-untriaged-bot has joined #openstack-keystone | 00:29 | |
| ks-untriaged-bot | Untriaged bugs for project keystone: | 00:29 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1381961 | 00:29 |
| uvirtbot | Launchpad bug 1381961 in keystone "Keystone API GET 5000/v3 returns wrong endpoint URL in response body" [Undecided,New] | 00:29 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1378270 | 00:29 |
| uvirtbot | Launchpad bug 1378270 in keystone "keystone-manage db_sync command failed" [Undecided,Incomplete] | 00:29 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1270378 | 00:29 |
| uvirtbot | Launchpad bug 1270378 in keystone "NormalizingFilter performs incorrect validation of PATH_INFO variable" [Undecided,Incomplete] | 00:29 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1376937 | 00:29 |
| ks-untriaged-bot | Untriaged bugs for project python-keystoneclient: | 00:29 |
| uvirtbot | Launchpad bug 1376937 in keystone "No way to prevent duplicates in endpoints" [Undecided,Confirmed] | 00:29 |
| ks-untriaged-bot | https://bugs.launchpad.net/python-keystoneclient/+bug/1377080 | 00:29 |
| uvirtbot | Launchpad bug 1377080 in python-keystoneclient "Stale endpoint selection logic in keystone client" [Undecided,In progress] | 00:29 |
| ks-untriaged-bot | https://bugs.launchpad.net/python-keystoneclient/+bug/1372710 | 00:29 |
| uvirtbot | Launchpad bug 1372710 in python-keystoneclient "cfn-push-stats fails to authenticate" [Undecided,Incomplete] | 00:29 |
| ks-untriaged-bot | https://bugs.launchpad.net/python-keystoneclient/+bug/1357567 | 00:29 |
| uvirtbot | Launchpad bug 1357567 in python-keystoneclient "auth_ref caching/retrieving is failing - user needs to provide password for every command" [Undecided,New] | 00:29 |
| *** ks-untriaged-bot has quit IRC | 00:29 | |
| lhcheng | hi folks! If I setup ldap as my identity backend, how will keystone authenticate the password of the user logging in? | 00:34 |
| *** Tahmina has quit IRC | 00:36 | |
| lhcheng | I see a check_password() in the identity/backend/ldap.py, but it seems like it is never used. | 00:36 |
| lhcheng | https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap.py#L258 | 00:36 |
| *** ncoghlan has joined #openstack-keystone | 00:37 | |
| *** drjones has quit IRC | 00:53 | |
| *** _cjones_ has joined #openstack-keystone | 00:53 | |
| *** _cjones_ has quit IRC | 00:58 | |
| openstackgerrit | Lin Hua Cheng proposed a change to openstack/keystone: Remove check_password() in identity.backend.ldap https://review.openstack.org/129103 | 01:15 |
| *** jasondotstar has quit IRC | 01:17 | |
| *** henrynash_ has joined #openstack-keystone | 01:18 | |
| *** henrynash has quit IRC | 01:21 | |
| *** henrynash_ is now known as henrynash | 01:21 | |
| *** zzzeek has quit IRC | 01:43 | |
| *** zzzeek has joined #openstack-keystone | 01:45 | |
| *** diegows has quit IRC | 01:46 | |
| *** marcoemorais has quit IRC | 01:46 | |
| *** richm has quit IRC | 01:51 | |
| *** zzzeek has quit IRC | 02:00 | |
| *** tellesnobrega_ has joined #openstack-keystone | 02:02 | |
| *** zzzeek has joined #openstack-keystone | 02:02 | |
| *** tellesnobrega_ has quit IRC | 02:02 | |
| *** _cjones_ has joined #openstack-keystone | 02:04 | |
| *** _cjones_ has quit IRC | 02:08 | |
| *** ncoghlan is now known as ncoghlan_afk | 02:13 | |
| nkinder | lhcheng: keystone performs an LDAP bind to authenticate the user | 02:14 |
| lhcheng | nkinder: figured that out after reading the code :) found some unused code ldap backend | 02:15 |
| nkinder | lhcheng: that horrible code needs to die :) | 02:15 |
| nkinder | lhcheng: there may have been a time where we actually expected to read the has from LDAP and compare it in keystone | 02:15 |
| nkinder | lhcheng: I ripped out some code that would hash the LDAP passwords a while back | 02:15 |
| nkinder | lhcheng: must have missed this code :( | 02:16 |
| openstackgerrit | Lin Hua Cheng proposed a change to openstack/keystone: Remove check_password() in identity.backend.ldap https://review.openstack.org/129103 | 02:16 |
| nkinder | lhcheng: yay! | 02:17 |
| lhcheng | take 2, forgot to remove the unused import | 02:17 |
| lhcheng | :) | 02:17 |
| lhcheng | nkinder: if I want to customize the authentication for ldap identity backend, to perform auth to another system, do you recommend writing another auth/plugin? or just hack the identity.ldap.authenticate() method? | 02:19 |
| nkinder | lhcheng: what are you authenticating against? | 02:19 |
| nkinder | is this a different auth method against LDAP (like a SASL bind), or something completely different? | 02:20 |
| lhcheng | proprietary authentication service, the password is not stored in ldap | 02:20 |
| *** r-daneel has quit IRC | 02:21 | |
| nkinder | lhcheng: so a plug-in seems more appropriate | 02:22 |
| nkinder | lhcheng: I wonder if you could do something like this - http://docs.openstack.org/developer/keystone/external-auth.html | 02:22 |
| nkinder | lhcheng: I'm referring to the WSGI middleware approach at the bottom half of that page | 02:23 |
| lhcheng | nkinder: interesting | 02:25 |
| nkinder | lhcheng: there's also a comment about the SQL driver's _check_password() being modeled off of the LDAP code. I pointed it out in my review of your patch. | 02:25 |
| nkinder | lhcheng: probably should clean that at the same time to prevent further confusion | 02:26 |
| lhcheng | what would be the advantage using WSGI than implementing auth plugin? | 02:26 |
| lhcheng | nkinder: ha! I'll clean that up too | 02:26 |
| nkinder | lhcheng: I'm not sure if there is a big advantage. It's just another possibility that might be simpler to write? | 02:27 |
| nkinder | lhcheng: I expect more use of external auth via REMOTE_USER going forward | 02:27 |
| openstackgerrit | Lin Hua Cheng proposed a change to openstack/keystone: Remove check_password() in identity.backend.ldap https://review.openstack.org/129103 | 02:28 |
| nkinder | lhcheng: things like mod_auth_kerb and mod_ssl performing auth in httpd and passing it through via REMOTE_USER | 02:28 |
| nkinder | lhcheng: it's similar to mod_shib or mod_auth_mellon doing authentication up front in a way | 02:28 |
| lhcheng | nkinder: makes sense, the customization will be cleaner that | 02:30 |
| *** alex_xu has quit IRC | 02:31 | |
| lhcheng | nkinder: long term, using apache is the way to run keystone | 02:32 |
| nkinder | lhcheng: ...however, if this is still password based auth, I think a plug-in might be better since you would still perform a token request with the exact same "password" method. | 02:32 |
| nkinder | lhcheng: I guess it depends if you are still just doing password auth against a different source, or if you are using a completely different type of authentication that is not password based. | 02:33 |
| nkinder | lhcheng: and ++ on apache! | 02:33 |
| lhcheng | nkinder: yeah, it is still password based | 02:35 |
| lhcheng | nkinder: I'll go with the plugin for now then | 02:35 |
| lhcheng | nkinder: good stuff! | 02:36 |
| lhcheng | nkinder: thanks for the guidance! | 02:37 |
| *** alex_xu has joined #openstack-keystone | 02:44 | |
| *** stevemar has joined #openstack-keystone | 02:45 | |
| *** harlowja is now known as harlowja_away | 02:47 | |
| *** zzzeek has quit IRC | 03:00 | |
| *** stevemar has quit IRC | 03:08 | |
| *** stevemar has joined #openstack-keystone | 03:23 | |
| *** ncoghlan_afk is now known as ncoghlan | 03:50 | |
| *** swamireddy has joined #openstack-keystone | 04:11 | |
| *** swamireddy has quit IRC | 04:11 | |
| *** saipandi has quit IRC | 04:15 | |
| *** dims_ has quit IRC | 04:48 | |
| *** dims_ has joined #openstack-keystone | 04:48 | |
| *** dims_ has quit IRC | 04:53 | |
| *** _cjones_ has joined #openstack-keystone | 05:18 | |
| *** lhcheng has quit IRC | 05:25 | |
| *** lhcheng has joined #openstack-keystone | 05:25 | |
| *** lhcheng has quit IRC | 05:30 | |
| *** _cjones_ has quit IRC | 05:37 | |
| *** _cjones_ has joined #openstack-keystone | 05:37 | |
| *** gyee has quit IRC | 05:42 | |
| *** lhcheng has joined #openstack-keystone | 05:48 | |
| *** afazekas has joined #openstack-keystone | 05:50 | |
| *** drjones has joined #openstack-keystone | 05:50 | |
| *** _cjones_ has quit IRC | 05:54 | |
| *** drjones has quit IRC | 05:55 | |
| *** stevemar has quit IRC | 06:08 | |
| *** k4n0 has joined #openstack-keystone | 06:09 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add max-complexity to pep8 for Keystone https://review.openstack.org/129143 | 06:14 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add max-complexity to pep8 for Keystone https://review.openstack.org/129143 | 06:16 |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 06:22 | |
| *** tellesnobrega has quit IRC | 06:24 | |
| *** amcrn has quit IRC | 06:39 | |
| *** ncoghlan has quit IRC | 07:27 | |
| *** aix has joined #openstack-keystone | 08:19 | |
| *** jistr has joined #openstack-keystone | 08:24 | |
| *** vb has quit IRC | 08:33 | |
| *** vb has joined #openstack-keystone | 08:34 | |
| *** nellysmitt has joined #openstack-keystone | 08:57 | |
| *** lhcheng has quit IRC | 09:14 | |
| *** lhcheng has joined #openstack-keystone | 09:14 | |
| *** alex_xu has quit IRC | 09:15 | |
| *** lhcheng has quit IRC | 09:18 | |
| *** dims_ has joined #openstack-keystone | 09:27 | |
| *** dims_ has quit IRC | 09:32 | |
| *** f13o has quit IRC | 09:38 | |
| *** viklund has quit IRC | 09:51 | |
| *** f13o has joined #openstack-keystone | 09:56 | |
| *** dims_ has joined #openstack-keystone | 10:02 | |
| *** henrynash has quit IRC | 10:30 | |
| *** henrynash has joined #openstack-keystone | 10:31 | |
| *** henrynash has quit IRC | 10:31 | |
| *** nellysmitt has quit IRC | 11:13 | |
| *** nellysmitt has joined #openstack-keystone | 11:14 | |
| *** dims_ has quit IRC | 11:14 | |
| *** dims_ has joined #openstack-keystone | 11:15 | |
| *** dims_ has quit IRC | 11:18 | |
| *** dims_ has joined #openstack-keystone | 11:19 | |
| *** dims_ has quit IRC | 11:19 | |
| *** nellysmitt has quit IRC | 11:19 | |
| *** dimsum_ has joined #openstack-keystone | 11:19 | |
| *** lhcheng has joined #openstack-keystone | 11:30 | |
| *** lhcheng has quit IRC | 11:34 | |
| rodrigods | dolphm, there? | 11:44 |
| *** raildo_away is now known as raildo | 11:56 | |
| marekd | navid_: o/ | 11:57 |
| rodrigods | marekd, question for you: in k2k, when I generate the IdP SAML assertion, what is the URL of the SP I send it? | 12:03 |
| *** vsilva is now known as victsou | 12:05 | |
| *** topol has joined #openstack-keystone | 12:06 | |
| marekd | rodrigods: hey, you check your SP's metadata | 12:09 |
| marekd | and look for one with ECP | 12:09 |
| marekd | it's generally specified by SP | 12:09 |
| *** packet has joined #openstack-keystone | 12:10 | |
| *** packet has quit IRC | 12:12 | |
| *** topol has quit IRC | 12:15 | |
| rodrigods | marekd, great, thanks | 12:16 |
| *** mflobo has joined #openstack-keystone | 12:16 | |
| marekd | rodrigods: np. | 12:19 |
| *** thiagop has joined #openstack-keystone | 12:24 | |
| *** dimsum_ has quit IRC | 12:28 | |
| *** dimsum_ has joined #openstack-keystone | 12:28 | |
| *** g4rg4m3|_ has joined #openstack-keystone | 12:31 | |
| *** packet has joined #openstack-keystone | 12:38 | |
| *** andreaf has quit IRC | 12:38 | |
| *** andreaf has joined #openstack-keystone | 12:38 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: SAML2 wrapper plugin for full federation authN https://review.openstack.org/106751 | 12:41 |
| *** k4n0 has quit IRC | 12:55 | |
| marekd | mhu: looks like i found much easier and cleanerway to overcome out problems with function signatures. | 12:56 |
| marekd | i was so ignorant :-) | 12:57 |
| mhu | marekd, good ol' keyword arguments dict ? | 13:00 |
| marekd | mhu: but used with non keyword arguments. | 13:03 |
| marekd | and then i can mix the order. | 13:03 |
| mhu | smart ! | 13:04 |
| *** diegows has joined #openstack-keystone | 13:05 | |
| *** tellesnobrega has joined #openstack-keystone | 13:15 | |
| *** gordc has joined #openstack-keystone | 13:18 | |
| *** stevemar has joined #openstack-keystone | 13:18 | |
| *** openstackgerrit has quit IRC | 13:19 | |
| *** openstackgerrit has joined #openstack-keystone | 13:19 | |
| *** Kui has quit IRC | 13:20 | |
| marekd | stevemar: we have call in ~1.5h, right? | 13:26 |
| raildo | ayoung, ping | 13:29 |
| raildo | stevemar, we have implemented a solution to revoke tokens if the IdP was deleted, but we have a problem. | 13:30 |
| raildo | First we implement the solution in keystoneclient and there we could use the token and get the identity provider. | 13:30 |
| raildo | but ayoung say to me, that this is the wrong local to implement this. | 13:31 |
| raildo | so we went to implement in keystonemiddleware but never receive the token, only the token_id | 13:32 |
| *** lhcheng has joined #openstack-keystone | 13:32 | |
| raildo | so we can't retrieve the identity provider | 13:32 |
| ayoung | raildo, for UUID tokens revocation has to happen at the Server | 13:32 |
| stevemar | marekd, yes we do | 13:34 |
| raildo | ayoung, we know but what about PKI? Shouldn't that be in middleware? | 13:35 |
| stevemar | ayoung, raildo if the token is UUID the revocation must happen at server, if it's PKI it can happen at middleware? | 13:35 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:36 | |
| *** lhcheng has quit IRC | 13:36 | |
| *** r-daneel has joined #openstack-keystone | 13:37 | |
| *** victsou is now known as vsilva | 13:38 | |
| vsilva | stevemar, that's where we thought it could, but the middleware doesn't seem to have the token - only the token-id. The solution we discussed here needed the full token to get the IdP from it! | 13:39 |
| vsilva | can we get that somewhere? I looked into the header but couldn't find it; I think it only gets the token id. | 13:41 |
| *** vsilva is now known as victsou | 13:47 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: SAML2 wrapper plugin for full federation authN https://review.openstack.org/106751 | 13:51 |
| marekd | mhu: stevemar ^^ what do you think about it? | 13:51 |
| mhu | marekd, I'll have a look ASAP | 13:52 |
| openstackgerrit | Alberto Planas proposed a change to openstack/keystone: Adds openSUSE support for developer documentation https://review.openstack.org/129256 | 13:53 |
| stevemar | victsou, is there a way to ask the server for token details, once the middleware has the token-id? | 13:57 |
| stevemar | marekd, lookin now | 13:57 |
| stevemar | nkinder, ping | 13:57 |
| raildo | stevemar, That is our question, and it would not be costly, retrieve the token for every request in middleware. | 13:59 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Remove XML support https://review.openstack.org/125738 | 14:01 |
| rodrigods | marekd, stuck now with while sending the SAML assertion, when I googled for the error, just found the code that actually raises the exception. Do you have a moment to help me out? | 14:11 |
| *** radez_g0n3 is now known as radez | 14:13 | |
| *** topol has joined #openstack-keystone | 14:14 | |
| *** saipandi has joined #openstack-keystone | 14:18 | |
| marekd | rodrigods: i have ~30 minutes. | 14:24 |
| marekd | rodrigods: did you install pysaml2? | 14:25 |
| rodrigods | marekd, thanks... Yes, I have pysaml2 installed | 14:25 |
| rodrigods | marekd, sent the request details in pvt | 14:26 |
| *** tellesnobrega has quit IRC | 14:27 | |
| *** tellesnobrega has joined #openstack-keystone | 14:28 | |
| *** rwsu has joined #openstack-keystone | 14:31 | |
| *** morganfainberg has quit IRC | 14:32 | |
| ayoung | raildo, for PKI we are not yet using revocation events. Until we use revocation events, we need to be able to enumerate the UUIDs from the server | 14:32 |
| *** nellysmitt has joined #openstack-keystone | 14:33 | |
| ayoung | I apologize that I have not been able to get Revocation events in, but my current requirement is sorting out all of the kerberos related issues. | 14:33 |
| *** morganfainberg has joined #openstack-keystone | 14:33 | |
| ayoung | And, I kindof think revocation is too complex and error prone, we should be focused on short lived tokens instead | 14:34 |
| raildo | ayoung, ok, but I think we should at least prevent the user from using the token, (we could throw an exception) | 14:35 |
| ayoung | raildo, that is revocation | 14:36 |
| ayoung | raildo, instead, lets get token lifespans down | 14:36 |
| ayoung | and then tokens just expire | 14:36 |
| ayoung | so if an IdP gets deactivated, we do not issue any new tokens for it | 14:36 |
| ayoung | raildo, considering that today, most systems use Memcached to avoid going back to keystone, revocations are kindof a joke anyway | 14:37 |
| ayoung | its part of the reason I've been so unwilling to put any more effort into revocations | 14:37 |
| *** henrynash has joined #openstack-keystone | 14:37 | |
| *** jorge_munoz has joined #openstack-keystone | 14:38 | |
| raildo | ayoung, i understand... | 14:39 |
| raildo | ayoung, ok, thank you | 14:39 |
| ayoung | raildo, sorry to be such a downer | 14:39 |
| raildo | ayoung, no problem, sometimes we need to be :) | 14:40 |
| ayoung | raildo, that being said, I think I am going to work on the IdP -> domain issue | 14:46 |
| raildo | ayoung, great! I believe that would solve some of our problems | 14:47 |
| ayoung | raildo, OK...lets talk through this, then | 14:47 |
| raildo | ayoung, sure | 14:48 |
| stevemar | ayoung, did nkinder mention anything about improving the mapping function? | 14:48 |
| ayoung | raildo, right now, there is an assumption in Federation mapping that everything goes into the default domain | 14:48 |
| ayoung | stevemar, he and I have talked about it a bit, but I was thinking to have a more in depth discussion with him today | 14:49 |
| stevemar | ayoung, cool, cc me when it starts (if it's on irc) | 14:49 |
| ayoung | so, today, there is no real way to disable all of the IdP driven accounts. | 14:49 |
| ayoung | but...lets say that we fix that: | 14:50 |
| ayoung | first off, we specify that an IdP should have a domain associated with it: | 14:51 |
| ayoung | at least one per | 14:51 |
| ayoung | I would suspect that a single IdP would need to have a one-to-many relationship with domains | 14:51 |
| ayoung | stevemar, so domains are a namespace...there really is not a driving need for domains for users, since usernames from an IdP should be implicitly namespaced but there is for groups. | 14:55 |
| ayoung | but I think that even the implicit namespacing of users is suspect | 14:56 |
| ayoung | the current Federation mapping code assumes REMOTE_USER becomes userid. | 14:56 |
| ayoung | And REMOTE_USER is set by the SAML configuration | 14:56 |
| ayoung | so, whatever mod_auth_shib or comparable sets it to be, based on the SAML assertion | 14:57 |
| *** nkinder has quit IRC | 15:03 | |
| *** tellesnobrega has quit IRC | 15:14 | |
| *** zzzeek has joined #openstack-keystone | 15:15 | |
| morganfainberg | rodrigods, raildo, sorry I didn't get to merge forward the topic branch yesterday | 15:16 |
| rodrigods | morganfainberg, np | 15:16 |
| rodrigods | if you could do that today, I'd appreciate | 15:17 |
| rodrigods | and ask henrynash and gyee to readd their +2 =) | 15:17 |
| morganfainberg | rodrigods, yep, will do. going to first thing | 15:17 |
| rodrigods | morganfainberg, ++ | 15:18 |
| morganfainberg | ayoung, we aren't going to get token lifespan down much tbh in one cycle | 15:22 |
| morganfainberg | ayoung, i think we're almost at the limit until we solve a lot of other issues. | 15:22 |
| henrynash | rodigods: what ya need? | 15:22 |
| morganfainberg | ayoung, as it is most people i've been talking to have been re-increasing the token life span to ~14400 | 15:23 |
| morganfainberg | in real deployments. | 15:23 |
| morganfainberg | and revocations are a real concern to them. | 15:23 |
| ayoung | morganfainberg, lets fix that | 15:23 |
| ayoung | and they are caching tokens | 15:24 |
| ayoung | and not checking revocations | 15:24 |
| morganfainberg | ayoung, they are caching tokens and relying on revocations to work because middleware does the revocation bit | 15:24 |
| ayoung | the "real life" deployments are frightening | 15:24 |
| ayoung | and I don't think we should design with those constraints ignored, but rather design to make those people have a secure system to work with | 15:24 |
| morganfainberg | ayoung, we can't ignore what we've done so far. we hava said "use revocations... we will support them" | 15:25 |
| ayoung | morganfainberg, are they? Or arethey running UUID tokens, memcache, and never checking to see if a token is revoked | 15:25 |
| *** gsilvis has joined #openstack-keystone | 15:25 | |
| morganfainberg | ayoung, almost *no one* is using memcached in middleware | 15:25 |
| morganfainberg | unless they are running swift | 15:25 |
| morganfainberg | afaict | 15:25 |
| morganfainberg | they have done things like make keystone re-issue tokens with extended lifespans | 15:26 |
| *** thedodd has joined #openstack-keystone | 15:26 | |
| morganfainberg | i've been asked about revocation events for UUID tokens. | 15:26 |
| morganfainberg | so they can use memcached | 15:26 |
| morganfainberg | in short, if we're doing PKI tokens we're still going to need revocation events... if we're doing session tokens we still need to be able to revoke that session token. | 15:27 |
| ayoung | morganfainberg, how High a priority? | 15:28 |
| morganfainberg | you know. lets talk more in depth about this at the summit :) | 15:28 |
| morganfainberg | we have a bunch of sessions / time set aside for it | 15:28 |
| morganfainberg | we can prioritze correctly then | 15:28 |
| morganfainberg | see where other things land | 15:28 |
| *** thedodd has quit IRC | 15:28 | |
| *** thedodd has joined #openstack-keystone | 15:28 | |
| morganfainberg | lets say "not a priority until we know what the rest of kilo looks like" but definitely on the map. | 15:28 |
| ayoung | https://review.openstack.org/#/c/81166/ | 15:29 |
| ayoung | morganfainberg, I can't keep chasing that review | 15:29 |
| ayoung | I had it full green in mid July and it sat there | 15:29 |
| ayoung | raildo, you want your revocation to work? Get that patch back into shape | 15:29 |
| morganfainberg | ayoung, so lets evaluate what things look like at the summit. if we have better options we can chase that, or we can all chip in and make events "complete" | 15:29 |
| morganfainberg | ayoung, i'm fine dedicating time to it, but you're right unknown priority until we have a better view of all kilo targets | 15:30 |
| ayoung | morganfainberg, I can't help but feel like we have things backwards. When I first approached PKI tokens, I was thinking that we could have a system where the Keystone server could drop off and things would continue to run | 15:32 |
| ayoung | revocation events implies all of these services getting more and more tied to a single point of failure and bottleneck | 15:32 |
| morganfainberg | ayoung, we've been there a long long long time. | 15:33 |
| *** lhcheng has joined #openstack-keystone | 15:33 | |
| morganfainberg | ayoung, did you see joe gordon's service dependency graph? | 15:33 |
| ayoung | nope | 15:33 |
| morganfainberg | let me find it | 15:34 |
| ayoung | but I can imagine what it looks like | 15:34 |
| *** wwriverrat has joined #openstack-keystone | 15:34 | |
| ayoung | everything depends on Keystone. Nova depends on cinder, glance, and neutron, glance depends on swift | 15:34 |
| ayoung | morganfainberg, what if UUID tokens were trusts? | 15:35 |
| morganfainberg | http://i.imgur.com/y8zmNIM.png | 15:35 |
| ayoung | what's red mean there? | 15:35 |
| ayoung | er..nova depends on ironc? I guess that the colors of the arrows imply something about stage of deployment? | 15:36 |
| morganfainberg | red is a reverse dependency i think | 15:37 |
| morganfainberg | let me 2x check | 15:37 |
| ayoung | everything depends on Keystone, keystone depends on nothing | 15:38 |
| morganfainberg | red is "depends on" as in can't run w/o | 15:38 |
| *** lhcheng has quit IRC | 15:38 | |
| morganfainberg | and bi-directional | 15:38 |
| morganfainberg | e.g. nova needs cinder, and cinder needs nova | 15:38 |
| ayoung | morganfainberg, https://twitter.com/admiyoung/status/517142665901932544 | 15:38 |
| morganfainberg | or. huh maybe "nova can use" and cinder needs | 15:39 |
| ayoung | cinder needs nova is a scary concept. Do you the justification for that? | 15:39 |
| morganfainberg | ayoung, i think because in "openstack" what is cinder? | 15:39 |
| morganfainberg | i'm not 100% sure tbh | 15:39 |
| morganfainberg | from the why does cinder require nova | 15:40 |
| *** thedodd has quit IRC | 15:40 | |
| ayoung | its the block storage service. It might be useless without Nova, but you could see someone using it directly | 15:40 |
| ayoung | In fact, I could very much think of use cases for Cinder without Nova in the abstract | 15:40 |
| morganfainberg | ah | 15:40 |
| ayoung | same with Neutron or Glance for that matter | 15:40 |
| morganfainberg | https://github.com/jogo/graphing-openstack/blob/master/openstack.yaml#L35 | 15:40 |
| *** thedodd has joined #openstack-keystone | 15:40 | |
| morganfainberg | you can't attach the volume w/o nova | 15:40 |
| morganfainberg | this is "openstack specific' | 15:40 |
| ayoung | Only Nova can attach a volume from Cinder? | 15:41 |
| morganfainberg | red is "depends on", black is "requires", grey is "can use" | 15:41 |
| morganfainberg | in openstack | 15:41 |
| ayoung | Meh, Nova has an inflated view of its own importance | 15:41 |
| morganfainberg | as in, running an openstack cloud - you need nova to consume cinder for VMs | 15:41 |
| morganfainberg | neutron can't attach a cinder volume to nova | 15:41 |
| morganfainberg | erm to a vm | 15:42 |
| morganfainberg | similarly keystone can't. | 15:42 |
| morganfainberg | if you're looking to attach a volume to a vm managed by nova, you must use nova. | 15:42 |
| *** samuelms has quit IRC | 15:43 | |
| ayoung | morganfainberg, back to the topic at hand...what if we made it implicit in the nova client that, when getting a token for Keystone, you created a trust? | 15:43 |
| ayoung | same logic from Horizon | 15:43 |
| ayoung | when calling Nova, you create a trust. Or you reuse one if you have it already | 15:43 |
| ayoung | make it trivial to reuse trusts | 15:44 |
| rodrigods | henrynash, if the branch rebase remove your reviews at HM first patch, I'll ping you =) | 15:44 |
| morganfainberg | ayoung, i'd say i am not sure about it and would want to spend some serious time exploring that / looking into the ramifications | 15:44 |
| ayoung | really, that is what they are trying to use long lived tokens to do | 15:44 |
| ayoung | could we insulate all of that logic in Auth Token Middleware? | 15:44 |
| ayoung | morganfainberg, thought experiement: | 15:45 |
| henrynash | rodigods: ok….I haev looked at the changes…I think I spotted one issue though in the parent_id loop in sql.py | 15:45 |
| henrynash | rodigods: I added a comment | 15:45 |
| morganfainberg | ayoung, so we've got a ton of things in flight, a lot aroudn authorization and how it works. this is why we have a heavily focused auth/policy cycle ahead of us | 15:45 |
| *** __TheDodd__ has joined #openstack-keystone | 15:45 | |
| morganfainberg | ayoung, my biggest concern is we have so much in flight and a lot of things we need to solve (they are legitimate issues that we're finally at because we've solved a lot of other higher priority things with keystone) I don't want us to jump down the "implement something new and shiney and have another partially built thing | 15:46 |
| ayoung | lets say that user X call "boot" on Nova with token T1. Auth Token Middleware gets T1 and looks at the policy file. From the policy file it deduces "this is a delegation type task, service user Nova1 is going to need to call glance; let me get it a token to do that" | 15:46 |
| morganfainberg | ayoung, so in short, i'm open to the concept, but it needs solid thought / direction. | 15:47 |
| morganfainberg | and a buy in that we can actually get everything moved over to it. | 15:47 |
| *** thedodd has quit IRC | 15:47 | |
| morganfainberg | ayoung, ok keep going with the thought path. | 15:48 |
| ayoung | morganfainberg, if we take jamie's unified client and session approach as the baseline....when nova calls glance, it should do so through the glance client, and reuse the session | 15:48 |
| ayoung | the session gets initiated with the token that the user passed in | 15:49 |
| ayoung | now, the "smart client" approach is to say "this token is only good for nova, but there is a trust associated with it, let me get a token for glance" | 15:49 |
| *** wwriverrat has left #openstack-keystone | 15:50 | |
| ayoung | so the Nova service user calls into the glance client. The glance client uses the nova service users credentials and the initial tokens aassociate trust to get a token for glance | 15:50 |
| morganfainberg | ayoung, how do you know which trust is associated? the trust is locked to that specific token? | 15:51 |
| ayoung | get_trust_for_token could have a lifespan longer than the initial token. The initial token's expiration is only checked by Nova | 15:52 |
| *** wwriverrat has joined #openstack-keystone | 15:52 | |
| ayoung | one to many token to trust | 15:52 |
| morganfainberg | what if i have 30 of these trusts in flight | 15:52 |
| ayoung | its just an association. The trust id is just the primary key | 15:52 |
| morganfainberg | which one do i use? | 15:52 |
| morganfainberg | of i've delegated other trusts that look "similar" | 15:52 |
| ayoung | morganfainberg, you only need one trust per service/project | 15:53 |
| ayoung | at least, in general | 15:53 |
| ayoung | you really need one trust per service/project/operation...or maybe | 15:53 |
| ayoung | service/project/role | 15:53 |
| henrynash | rodigods: I’ll be back on a bit later and will check on it | 15:54 |
| ayoung | so long as the trusts are identical, go ahead and reuse them. Now, Delegation for trusts makes issues more complicated, but lets table that for the moment, and say this if just done by the end user with no redelegation | 15:54 |
| ayoung | and...infact, the same token could, in theory, be associated with different trusts depending on the caller | 15:54 |
| ayoung | but I don;t think we need that | 15:55 |
| ayoung | when a user requests a token for Nova, that token is locked to Nova...a specific endpoint even | 15:55 |
| ayoung | If nova needs to call glance, which needs to call swift, it is done via two trusts | 15:56 |
| ayoung | nova uses the token to look up the trust, and get a token for glance | 15:56 |
| ayoung | glance uses its token to look up the trust and get a token for swift | 15:56 |
| ayoung | the whole constraints approach would still work, as you would want to make the trusts specific to a workflow... | 15:57 |
| raildo | ayoung, thanks! i will see and review this patch :) | 15:57 |
| morganfainberg | ayoung, i think we need to solve the policy "what can i do with X token" and "what roles do i need to do X" before we can go down this path | 15:58 |
| morganfainberg | or s/token/authorization_we_end_up_using | 15:58 |
| ayoung | morganfainberg, I think the whole thing would work if we started off with some way to make trusts easy to define | 15:58 |
| ayoung | morganfainberg, and...I think that policy/constraints need to be fiurst class objects | 15:59 |
| morganfainberg | ayoung, maybe revisit deleting the "trust" concept and making delegation a top-level part of the assignment api | 15:59 |
| ayoung | policy rules, that is | 15:59 |
| morganfainberg | give me X authorization for user Y [approved] with roles Z,Q,R | 15:59 |
| *** zzzeek has quit IRC | 15:59 | |
| ayoung | morganfainberg, more than "roles" I think | 16:00 |
| ayoung | roles are collections of capabilities | 16:00 |
| morganfainberg | sure. capabilites | 16:00 |
| ayoung | we assign roles to users, and then users delegate capabilities | 16:00 |
| morganfainberg | but in this context of conversation role = capability | 16:00 |
| morganfainberg | or at least today | 16:00 |
| *** afazekas has quit IRC | 16:01 | |
| ayoung | right now I think capability is defined by the keys in the policy file: identity:create_user...but even then, we limit based on project. I think it would be hard to say what a capability is today | 16:01 |
| ayoung | as it really implies "what would this policy rule evaluate to in some request" | 16:02 |
| *** bknudson has joined #openstack-keystone | 16:03 | |
| morganfainberg | it sounds to me like this is interesting but likely we're going to need to solve the Kilo "issues" around policy, role definition/ownership, etc before we can go down this path too far | 16:03 |
| morganfainberg | it *could* be a kilo target, but i'm not sure we'll get there | 16:03 |
| *** _cjones_ has joined #openstack-keystone | 16:04 | |
| ayoung | morganfainberg, Do we want to make policy rules a database managed value, and then generate the policy.json files? | 16:07 |
| ayoung | So much of this would be easier if we had management of the rules themselves | 16:07 |
| morganfainberg | ayoung, i've had a couple brief conversations that lend me to belive that something down that path is right. likley though we need to revisit the policy "format" in general (whether that is put it in a DB or make it a DSL that isn't painful for deployers doesn't matter). | 16:08 |
| ayoung | morganfainberg, then the first step is to get a good object model defined. | 16:09 |
| morganfainberg | ayoung, ++ | 16:09 |
| morganfainberg | ayoung, *points to summit session* | 16:09 |
| ayoung | I'll have it available by then | 16:09 |
| morganfainberg | which reminds me. i need to send a followup to that thread saying we're having a session on it. | 16:10 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/python-keystoneclient: Fix listing of endpoints for a token https://review.openstack.org/91990 | 16:12 |
| *** lhcheng has joined #openstack-keystone | 16:14 | |
| *** lhcheng has quit IRC | 16:16 | |
| *** lhcheng has joined #openstack-keystone | 16:16 | |
| *** marcoemorais has joined #openstack-keystone | 16:17 | |
| *** marcoemorais has quit IRC | 16:17 | |
| *** marcoemorais has joined #openstack-keystone | 16:17 | |
| *** tellesnobrega has joined #openstack-keystone | 16:25 | |
| *** leonchio__ has joined #openstack-keystone | 16:27 | |
| *** leonchio_ has quit IRC | 16:28 | |
| morganfainberg | raildo, i'm going to get breakfast (late because of multiple meetings i watch at this time) and then work on merging forward your topic branch | 16:35 |
| *** tellesnobrega has quit IRC | 16:36 | |
| raildo | morganfainberg, ok. thank you! | 16:37 |
| morganfainberg | raildo, my hope is we can have everything in place prior to the summit so post summit it's cleanup, merge -> master, and work on new stuff | 16:37 |
| raildo | morganfainberg, sounds good to me :) | 16:38 |
| *** david-lyle has joined #openstack-keystone | 16:39 | |
| *** tellesnobrega has joined #openstack-keystone | 16:39 | |
| *** leonchio_ has joined #openstack-keystone | 16:45 | |
| *** leonchio__ has quit IRC | 16:45 | |
| *** leonchio_ has quit IRC | 16:45 | |
| *** gyee has joined #openstack-keystone | 16:50 | |
| *** richm1 has joined #openstack-keystone | 16:54 | |
| *** __TheDodd__ has quit IRC | 17:06 | |
| *** victsou is now known as vsilva | 17:12 | |
| *** vsilva is now known as victsou | 17:17 | |
| *** jogo is now known as flashgordon | 17:17 | |
| *** victsou is now known as vsilva | 17:22 | |
| *** vsilva is now known as victsou | 17:22 | |
| *** comstud is now known as bearhands | 17:23 | |
| *** amerine has joined #openstack-keystone | 17:24 | |
| *** amerine_ has quit IRC | 17:26 | |
| *** morganfainberg is now known as captainmorgan | 17:29 | |
| *** mikedillion has joined #openstack-keystone | 17:33 | |
| *** tellesnobrega has quit IRC | 17:34 | |
| *** tellesnobrega has joined #openstack-keystone | 17:39 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Add xmlsec1 dependency comments https://review.openstack.org/129338 | 17:40 |
| rodrigods | marekd, stevemar, ^ | 17:40 |
| rodrigods | had this problem while trying to setup the k2k env | 17:40 |
| *** wwriverrat has left #openstack-keystone | 17:41 | |
| stevemar | rodrigods, hmm, i thought we already doc'ed that, oh well, more docs the better | 17:46 |
| *** saipandi has quit IRC | 17:46 | |
| ayoung | captainmorgan, https://admiyo.fedorapeople.org/openstack/keystone/policy/ | 17:48 |
| ayoung | That is where we are today | 17:48 |
| rodrigods | stevemar, ++ | 17:48 |
| *** harlowja_away is now known as harlowja | 17:49 | |
| ayoung | dhellmann, question about common cli: http://git.openstack.org/cgit/openstack/python-openstackclient/tree/openstackclient/compute/client.py#n47 | 17:52 |
| ayoung | Is there some reason that the username etc is not pulled out of the token data? | 17:53 |
| ayoung | dhellmann, I'm not certain why, but even setting: --os-username doesn't work in the Kerberos Plugin case | 17:54 |
| *** toddnni has joined #openstack-keystone | 17:55 | |
| dtroyer | ayoung: first off, https://review.openstack.org/#/c/127655/3/openstackclient/compute/client.py,unified might interest you in that specific instance…all of the client creation bits need updating with the arrival of sessions and suh plugins | 17:56 |
| ayoung | dtroyer, oh yes it does...let me try that | 17:56 |
| dtroyer | ayoung: in theory, we're giving the old client libs a token and telling them to 'trust us' but it hasn't always worked. as they change to using the auth plugins that'll get much cleaner | 17:57 |
| ayoung | dtroyer, +2 trhat change! | 17:58 |
| ayoung | dtroyer, I just tested it out, and it cleans up the call significantly | 17:58 |
| dtroyer | it's been a day or two, stevemar? ^^^ | 17:59 |
| ayoung | dtroyer, I'm using an out-of-tree plugin for kerberos, and with that, there is no explicit set of most data | 17:59 |
| ayoung | I still need to specify the domain for the project, but | 17:59 |
| ayoung | /usr/bin/openstack --debug --insecure --os-auth-plugin kerberos --os-username ayoung --os-project-domain-name Default hypervisor list | 17:59 |
| ayoung | just worked for me | 17:59 |
| ayoung | OK, next question: --insecure should not be required... | 18:00 |
| dtroyer | ayoung: cool. I've been curious how many assumptions were left in the auth setup | 18:00 |
| ayoung | think I'm messing up the cert | 18:00 |
| ayoung | lemme see the CLI Param for that | 18:01 |
| *** marcoemorais has quit IRC | 18:01 | |
| dtroyer | yeah, that's all in your setup. if you have a ca cert available, use —os-cacert to point to it, or add it to … whatever requests wants for the ca bundle | 18:01 |
| *** marcoemorais has joined #openstack-keystone | 18:01 | |
| ayoung | I have a ca cert | 18:02 |
| ayoung | Bundle...does that imply something other than pem? | 18:02 |
| ayoung | ah, wait, no I don't...duh | 18:02 |
| dtroyer | no, that is whatever requests (mayby python itself??) uses for the distributed ca list | 18:02 |
| dtroyer | :) | 18:02 |
| ayoung | works much better with the correct path | 18:03 |
| *** radez is now known as radez_g0n3 | 18:04 | |
| ayoung | dtroyer, so I suspect we are going to want to add OS_AUTH_PLUGIN as an accpetable env var | 18:06 |
| *** radez_g0n3 is now known as radez | 18:07 | |
| ayoung | dtroyer, wanna see something frightening? | 18:07 |
| dtroyer | ayoung: possibly. I think I'd rather leave off _PLUGIN. nad it may change in other ways, I dont think that's the friendliest bit yet | 18:07 |
| dtroyer | ayoung: uh oh... | 18:07 |
| ayoung | dtroyer, https://admiyo.fedorapeople.org/openstack/keystone/policy/ | 18:08 |
| ayoung | dtroyer, just wondering if that diagram makes sense to anyone beyond me. | 18:08 |
| dtroyer | besides being a search-n-replace of my old expense approval path at Perot? lemme study a bit | 18:09 |
| *** thedodd has joined #openstack-keystone | 18:09 | |
| dtroyer | I wouldn't call it self-explanatory…but the whole policy thing is a black box to me atm too | 18:12 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Remove XML support https://review.openstack.org/125738 | 18:14 |
| *** arborism has joined #openstack-keystone | 18:16 | |
| *** arborism is now known as amcrn | 18:17 | |
| stevemar | dtroyer, crashing -keystone again? | 18:22 |
| ayoung | dtroyer, this is just together the classes from openstack/common/policy and the keystone side that builds a token | 18:22 |
| ayoung | there really is nothing in policy persay that is RBAC beyond the "RoleCheck": | 18:22 |
| *** ukalifon has joined #openstack-keystone | 18:24 | |
| *** marcoemorais has quit IRC | 18:26 | |
| *** marcoemorais has joined #openstack-keystone | 18:26 | |
| dtroyer | ayoung: ah, sure. I got DB tables stuck in my head knowing that is not what that was, and it wouldn't leave… | 18:26 |
| *** packet has quit IRC | 18:26 | |
| dtroyer | stevemar: I'm like kibo, say the magic word and I appear... | 18:27 |
| *** marcoemorais has quit IRC | 18:27 | |
| *** marcoemorais has joined #openstack-keystone | 18:28 | |
| *** thedodd has quit IRC | 18:28 | |
| stevemar | dtroyer, always with the obscure and random! | 18:29 |
| dtroyer | stevemar: when is jamie back? looking at https://review.openstack.org/#/c/127655/, we can make adjustments to the TokenEndpoint class if/when it moves to ksc | 18:29 |
| dtroyer | stevemar: no, just OLD | 18:29 |
| stevemar | dtroyer, thats the question of the month, we have no idea | 18:29 |
| stevemar | something about getting married :P | 18:29 |
| stevemar | but i think he's gone til conference? | 18:30 |
| dtroyer | will he be in paris? that's the honeymoon he needed to take… | 18:30 |
| stevemar | he will be for sure | 18:30 |
| dtroyer | ok, like sdad | 18:30 |
| ayoung | stevemar, dtroyer who else can +2 that patch? | 18:33 |
| dtroyer | it's us. I'll +A it if stevemar is happy. | 18:34 |
| ayoung | dtroyer, I think I can vouch for the KC code being OK | 18:34 |
| ayoung | dtroyer, nothing I see locks us in to a bad design decision there: we are creating the nova client based on a session, which is proper. | 18:35 |
| *** ukalifon has quit IRC | 18:42 | |
| ayoung | stevemar, just checked nkinder's status (internal IRC) and it says PTO, so no discussion with him today | 18:43 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: Trust redelegation https://review.openstack.org/126897 | 18:45 |
| *** amerine has quit IRC | 18:47 | |
| *** amerine has joined #openstack-keystone | 18:47 | |
| *** _cjones_ has quit IRC | 18:58 | |
| *** _cjones_ has joined #openstack-keystone | 18:58 | |
| ayoung | amakarov_away, I think there is a pretty significant amount of work to do on trust delegations. | 19:02 |
| *** _cjones_ has quit IRC | 19:03 | |
| *** tellesnobrega has quit IRC | 19:05 | |
| *** gordc has quit IRC | 19:11 | |
| captainmorgan | ayoung, so that diagram? | 19:14 |
| ayoung | captainmorgan, yes | 19:14 |
| captainmorgan | ayoung is that just the different peices we need / steps / stuff? | 19:14 |
| ayoung | captainmorgan, actually, it is the current status | 19:14 |
| captainmorgan | ah ok | 19:15 |
| captainmorgan | cool | 19:15 |
| captainmorgan | thanks | 19:15 |
| captainmorgan | wasn't sure if you were looking at it from current view or future looking | 19:15 |
| captainmorgan | makes more sense :) | 19:15 |
| ayoung | captainmorgan, I would say that we use it as a starting point, and we can add in "if we do constraints it would look like this" | 19:15 |
| captainmorgan | yep. | 19:15 |
| captainmorgan | i like it | 19:15 |
| ayoung | captainmorgan, I think we want to go incremental on policy. As tempting as it is to try and scrap and rewrite from scratch, I don't see anything fundamentally wrong in our current approach | 19:16 |
| *** radez is now known as radez_g0n3 | 19:17 | |
| ayoung | for example, we are not locked in to RBAC, its just the best supported "check" type in common policy | 19:17 |
| captainmorgan | ayoung, the whole point for the summits session is to set the targets where we *need* to get to | 19:17 |
| captainmorgan | between here and there is going to be quite the road | 19:17 |
| *** radez_g0n3 is now known as radez | 19:18 | |
| ayoung | captainmorgan I've been on this road for a while. | 19:19 |
| ayoung | Jane, get me off this crazy thing | 19:19 |
| captainmorgan | ayoung, i know. now it's just where the rest of OpenStack is catchingup | 19:19 |
| ayoung | captainmorgan, anyway, I'm starting to think along the lines of multiple Keystones working together. Really, if you have admin access to the authorization service, you can do anything, so the logical way to break up delegation decisions is to say "run your own authorization service" | 19:22 |
| ayoung | Maybe policy shouldn't be served out of the same thing that issues tokens | 19:22 |
| ayoung | captainmorgan, if each endpoint has a single Keystone server which is the "authoritative" that issues out policy, and admin tokens, etc. But then accepted tokens from a different one, based on limitations placed by the first, we'd have an interesting model for separate of concerns. | 19:26 |
| captainmorgan | ayoung, i know the congress folks are highly interested in this conversation | 19:26 |
| captainmorgan | i specifically called out that policy may be centralized in KEystone *or* Congress *or* something else. | 19:27 |
| ayoung | I still don't like that the "authoritative" could override what the other keystones are doing. I'd like to to be that the authoritative could say "you cant' do that" but then couldn't fake it itself | 19:27 |
| *** _cjones_ has joined #openstack-keystone | 19:27 | |
| ayoung | "they can't do that to our pledges" "yeah, only we can do that to our pledges!" | 19:28 |
| ayoung | I like the idea of splitting up policy from tokens | 19:28 |
| captainmorgan | i'm less worried about Cloud X issuing policy for Cloud Y. | 19:28 |
| ayoung | from a purely paranoia perspecive | 19:29 |
| captainmorgan | heck i don't think that is the right choice. | 19:29 |
| stevemar | dtroyer, ayoung which patch? | 19:29 |
| captainmorgan | but i'm not sure if a per-endpoint keystone would work. | 19:29 |
| ayoung | stevemar, for openstack client. Session patch | 19:29 |
| captainmorgan | ayoung, i think there is a lot of conversation that is going to happen this cycle and it's time. | 19:29 |
| stevemar | ayoung, checking now | 19:30 |
| captainmorgan | ayoung, https://www.youtube.com/watch?v=_J6-3l3hCm0 | 19:30 |
| ayoung | would not want a light cigar inside my helmut visor | 19:31 |
| captainmorgan | haha | 19:31 |
| ayoung | lit | 19:31 |
| dtroyer | stevemar: too late…I'm bamking on your +1 as my sole defense | 19:31 |
| stevemar | dtroyer, nooooo! | 19:31 |
| stevemar | dtroyer, :P | 19:31 |
| captainmorgan | ayoung, one of the best video game cut scenes (the SC2 intro) - so enjoy that bit of work. | 19:31 |
| ayoung | I +1ed it as well | 19:32 |
| stevemar | sc2 intro is pretty badass captainmorgan | 19:32 |
| captainmorgan | reminds me i need to install it and play it + HotS compaign | 19:35 |
| captainmorgan | stevemar, i'm still sad SC Ghost was cancelled :( | 19:37 |
| *** thedodd has joined #openstack-keystone | 19:40 | |
| captainmorgan | and i think that just failed. | 19:52 |
| captainmorgan | ugh | 19:52 |
| * captainmorgan just tried to merge the HM branch | 19:53 | |
| captainmorgan | and git didn't do what i wanted it to do... | 19:54 |
| *** marcoemorais has quit IRC | 20:01 | |
| raildo | captainmorgan, how sad i'm for you :'( | 20:02 |
| raildo | hahaha | 20:02 |
| *** marcoemorais has joined #openstack-keystone | 20:02 | |
| *** Kui has joined #openstack-keystone | 20:04 | |
| captainmorgan | raildo, https://review.openstack.org/#/c/129376/ | 20:06 |
| rodrigods | captainmorgan, \o/ | 20:06 |
| raildo | \o/\o/ | 20:06 |
| rodrigods | captainmorgan, we need to wait for dolphm , right? | 20:07 |
| captainmorgan | rodrigods, no we need to wait for jenkins | 20:07 |
| captainmorgan | *any* core can approve that change. | 20:07 |
| rodrigods | captainmorgan, true, first things first | 20:07 |
| rodrigods | great | 20:07 |
| raildo | captainmorgan, In Paris, I'll buy you a beer as a reward \o | 20:07 |
| captainmorgan | i have no problem with a single +2 for approval on it | 20:07 |
| captainmorgan | so, once jenkins passes bug any of us. | 20:07 |
| rodrigods | ++ | 20:08 |
| captainmorgan | you can rebase on it and check test runs. | 20:08 |
| captainmorgan | locally that is | 20:08 |
| captainmorgan | if it looks good go ahead and push the changes on top of it. | 20:08 |
| * rodrigods already rebasing, captainmorgan too late | 20:08 | |
| richm1 | I think you should by captainmorgan a rum . . . | 20:08 |
| captainmorgan | OH NO! ;) | 20:08 |
| richm1 | buy | 20:08 |
| captainmorgan | richm1, no :( sadly i'm not a rum person | 20:08 |
| captainmorgan | now.. brandy... cognac | 20:09 |
| captainmorgan | scotch.. yes | 20:09 |
| openstackgerrit | Brad Topol proposed a change to openstack/keystone-specs: Add a specification for revamping the documentation https://review.openstack.org/128747 | 20:09 |
| richm1 | but - your namesake!!! | 20:09 |
| captainmorgan | haha | 20:09 |
| captainmorgan | i snagged this for speak like a pirate day. | 20:09 |
| captainmorgan | just too good to not use every now and again | 20:09 |
| captainmorgan | ayoung, ok so i'm going to finish my BP cleanup this weekend. the only BPs i've mucked with (beside priority) that you posted were obvious duplicates | 20:11 |
| richm1 | ok - then I suggest armagnac | 20:11 |
| captainmorgan | richm1, ++ | 20:11 |
| captainmorgan | ayoung, any that i'm unsure about / know we might want I'm simply classifying as priority "not" and "pending approval" | 20:12 |
| captainmorgan | so we know not to review them in the weekly meeting | 20:12 |
| *** david-lyle has quit IRC | 20:24 | |
| -openstackstatus- NOTICE: Gerrit will be offline from 2100-2130 for project renames | 20:33 | |
| *** ChanServ changes topic to "Gerrit will be offline from 2100-2130 for project renames" | 20:33 | |
| ayoung | captainmorgan, lets see | 20:40 |
| ayoung | dhellmann, captainmorgan, BTW, I figured out part of the PBR issue. When I changed the "name" value in setup.cfg from python-keystoneclient-kerberos to keystoneclient_kerberos, PBR (and entrypoints) worked | 20:41 |
| captainmorgan | ahh | 20:41 |
| ayoung | I think having python- in there is kinda dumb | 20:42 |
| ayoung | that should be the RPM name, but for a python module it is redundant | 20:42 |
| captainmorgan | ayoung, yeah but we're already there with python-keystoneclient | 20:43 |
| *** topol has quit IRC | 20:43 | |
| captainmorgan | so, lets stay consistent | 20:43 |
| ayoung | captainmorgan, nah | 20:44 |
| ayoung | lets kill it for KC | 20:44 |
| ayoung | tis dumb | 20:44 |
| * ayoung likes to break all the things | 20:44 | |
| *** zzzeek has joined #openstack-keystone | 20:47 | |
| *** miqui has quit IRC | 20:50 | |
| captainmorgan | ayoung, we have bigger fish to fry than renaming packages. | 20:52 |
| ayoung | heh | 20:52 |
| captainmorgan | lets not do busy work ;) | 20:52 |
| ayoung | That she blows....tis the white whale, and the doubloon is mine! | 20:53 |
| captainmorgan | haha | 20:54 |
| captainmorgan | ayoung, we have this: https://blueprints.launchpad.net/keystone/+spec/policy-for-endpoint don't we? | 20:54 |
| captainmorgan | that was henry-nash's thing | 20:55 |
| captainmorgan | right? | 20:55 |
| ayoung | yeah, mark that as done | 20:55 |
| *** rwsu has quit IRC | 20:56 | |
| ayoung | https://blueprints.launchpad.net/devstack/+spec/ssl-everywhere really is not a Keystone BP | 20:57 |
| captainmorgan | BPs are starting to look a lot better | 20:57 |
| ayoung | captainmorgan, you still don;t think keystone should generate html if you hit it from a browser? | 20:57 |
| ayoung | https://blueprints.launchpad.net/keystone/+spec/render-html | 20:58 |
| captainmorgan | ayoung, i am torn. FreeIPAs interface makes me want it | 20:58 |
| ayoung | FreeIPA is actually all Javascript and JSON RPC | 20:58 |
| *** jistr has quit IRC | 20:58 | |
| captainmorgan | i don't know if it's something i see as important enough this cycle, we have a lot of higher prio things | 20:58 |
| captainmorgan | ayoung, doesn't change my view on it :) | 20:58 |
| captainmorgan | freeipa's interface is pretty slick out of the box | 20:58 |
| ayoung | I still have the code...was done as an extension | 20:59 |
| captainmorgan | if we could do it w/o needing to hook into the plumbing of keystone it would be awesome | 20:59 |
| captainmorgan | but then... wouldn't it just be "horizon"? :P | 20:59 |
| *** lhcheng has quit IRC | 20:59 | |
| ayoung | https://review.openstack.org/#/c/29105/ | 20:59 |
| ayoung | I still think that the JSON middleware needs to be fixed | 21:00 |
| *** lhcheng has joined #openstack-keystone | 21:00 | |
| captainmorgan | so this is a glorified middleware? | 21:00 |
| ayoung | https://review.openstack.org/#/c/29105/9/keystone/contrib/html/middleware.py,cm | 21:00 |
| ayoung | captainmorgan, no glory | 21:00 |
| captainmorgan | hm | 21:00 |
| ayoung | instead of stacking the content renderer, has one that switches based on the requests header | 21:01 |
| *** radez is now known as radez_g0n3 | 21:01 | |
| ayoung | if accepts starts with HTML, select the HTML one | 21:01 |
| captainmorgan | isn't this mostly solved if we moved to pcan/wsme? | 21:01 |
| captainmorgan | and less code for us to maintain? | 21:01 |
| ayoung | I don't think so. I mean, pecan has the concept, but I don't think it actually had the HTML renderer | 21:02 |
| captainmorgan | i meant needing to "fix" the middleware just create a renderer for it | 21:02 |
| -openstackstatus- NOTICE: Gerrit is offline from 2100-2130 for project renames | 21:02 | |
| *** ChanServ changes topic to "Gerrit is offline from 2100-2130 for project renames" | 21:02 | |
| captainmorgan | so we could have a JSON renderer / html one / etc | 21:02 |
| ayoung | captainmorgan, that is what I was told, but I did not really get deep enough into it to confirm | 21:02 |
| ayoung | that is the right abstraction | 21:02 |
| captainmorgan | if we can use that kind of abstraction and get it for free moving away from our *very* custom setup, i'd be good with that approach. otherwise making the rederer pluggable would be good | 21:03 |
| ayoung | https://github.com/stackforge/wsme/tree/master/wsme/rest | 21:03 |
| ayoung | JSON and XML, no HTML | 21:03 |
| captainmorgan | and we just need to keep the interface super stable. then that html one could be out of tree / in tree, etc | 21:03 |
| captainmorgan | who cares where it is. | 21:03 |
| captainmorgan | ayoung, *doh* | 21:04 |
| ayoung | and the JSON was, IIRC not identical to what we are producing now | 21:04 |
| captainmorgan | i'd rather get out of the business of writing our own json renderer if we can. | 21:04 |
| captainmorgan | if it's something we could plug html rendering into as well, double win? | 21:04 |
| ayoung | yeah...pretty much I want to stop writing any custom code that is not fundamental to Authorization | 21:05 |
| captainmorgan | ayoung, so i think we need to change that conversation: fix the redering middleware/pipeline/stuff to be more sane | 21:05 |
| ayoung | a dead simple HTML interface would make testing Keystone so much simpler. | 21:05 |
| captainmorgan | then we can easily handle <format> because it's pluggable. | 21:05 |
| ayoung | since we are dreaming | 21:05 |
| ayoung | ... | 21:05 |
| ayoung | the auth stuff should be in its own pipeline | 21:06 |
| ayoung | split /auth from identity, etc | 21:06 |
| captainmorgan | ayoung, hehe. something to talk about in the authorizaton session? | 21:06 |
| captainmorgan | i think so :) | 21:06 |
| * ayoung knew there was a reason... | 21:06 | |
| captainmorgan | i think this cycle is auth, policy, and "omg fix the ick in our backends so they aren't slow" | 21:07 |
| ayoung | captainmorgan, if auth were its own pipeline, it would make sense to then stack the pieces of the token pipeline as separate pipeline components | 21:07 |
| ayoung | v3 pipeline is all: | 21:08 |
| ayoung | pipeline = sizelimit url_normalize build_auth_context token_auth admin_token_auth xml_body_v3 json_body ec2_extension_v3 s3_extension simple_cert_extension revoke_extension service_v3 | 21:08 |
| captainmorgan | or even if we didn't use paste, something were you could hook code in (via... i dunno... entry points *OMGOSH!*) | 21:08 |
| ayoung | is there a good tool for wiring together entrypoints? | 21:08 |
| ayoung | extensions should also be their own pipeline | 21:09 |
| captainmorgan | now you're talking nonsense :P | 21:09 |
| captainmorgan | i mean.. | 21:09 |
| ayoung | so we have | 21:09 |
| captainmorgan | i think moving to that kind of distinction is a couple cycles out though | 21:09 |
| ayoung | [composite:main] | 21:09 |
| ayoung | use = egg:Paste#urlmap | 21:09 |
| captainmorgan | but we do have the *dep injection / life cycle* session | 21:10 |
| ayoung | then things like /v2.0 = public_api | 21:10 |
| captainmorgan | which does touch lightly on extensions (optional deps) | 21:10 |
| ayoung | those really should be more like | 21:10 |
| ayoung | /v3/auth = auth_v3 | 21:10 |
| ayoung | then admin would have /user but not the one that you would hang out for the outside world (perhaps) | 21:11 |
| captainmorgan | gyee, we're committed to filtering instead of pagination right? | 21:11 |
| captainmorgan | cause i don't think we can make pagination work easily w/o a lot of ick. | 21:11 |
| captainmorgan | gyee, re: https://blueprints.launchpad.net/keystone/+spec/pagination | 21:11 |
| ayoung | pagination dumb | 21:13 |
| *** gyee has quit IRC | 21:14 | |
| captainmorgan | ayoung, yeah i don't think we can do pagination. | 21:14 |
| captainmorgan | going to nix that one. | 21:14 |
| captainmorgan | we should do filtering :) | 21:15 |
| captainmorgan | unless the TC comes in and says "we support pagination like XXX" | 21:15 |
| captainmorgan | wich case we try and convince them it's wrong... and then if still losing we implement pagination | 21:15 |
| ayoung | LDAP can't paginate | 21:18 |
| captainmorgan | ayoung, sure it can. it just sucks at it | 21:18 |
| captainmorgan | ;) | 21:18 |
| ayoung | if it can't do it underload, then it really can't | 21:18 |
| captainmorgan | i killed that BP | 21:18 |
| ayoung | https://blueprints.launchpad.net/horizon/+spec/share-the-web-server is basically done, isn't it? | 21:19 |
| ayoung | its a Horizon BP... | 21:19 |
| captainmorgan | This we have with regions... right: https://blueprints.launchpad.net/keystone/+spec/discoverable-hierarchical-catalog ? | 21:19 |
| ayoung | I have to ask mrunge | 21:19 |
| ayoung | captainmorgan, I'd say so. Oh, but there are other issues with how we use the catalog...basically, there BP was neither necessary nor sufficient | 21:20 |
| ayoung | need to ask the Nova folks if they would support something that allowed things like Glance image IDs and Neutron ports to be passed in as Full URLs instead of just IDs. It would mean that the Service catalog would be kindof irrelvant | 21:21 |
| ayoung | it would certainly help disambiguate when there were two endpoints for the same services | 21:22 |
| ayoung | er service | 21:22 |
| ayoung | captainmorgan, please approve this https://blueprints.launchpad.net/django-openstack-auth/+spec/kerberos | 21:22 |
| captainmorgan | i can't | 21:23 |
| captainmorgan | thats owned by horizon/david-lyle | 21:23 |
| ayoung | ah, right | 21:23 |
| captainmorgan | if i could approve it, so could you | 21:23 |
| * ayoung needs reading glasses to see fine print | 21:24 | |
| ayoung | https://blueprints.launchpad.net/keystone/+spec/basic-auth marked as *not* thought that one was good-to-go | 21:24 |
| *** ChanServ changes topic to "Now open for Kilo development! Blocking reviews: https://gist.github.com/dolph/651c6a1748f69637abd0 | Please review design session schedule and provide feedback: http://kilodesignsummit.sched.org/type/keystone" | 21:25 | |
| -openstackstatus- NOTICE: Gerrit is back online | 21:25 | |
| ayoung | ah, needs spec url | 21:25 |
| rodrigods | captainmorgan, +1 from jenkings ^^ | 21:25 |
| captainmorgan | rodrigods, cool | 21:25 |
| captainmorgan | ayoung, mind tossing a +2/+A on this to keep multitenency work moving? | 21:26 |
| captainmorgan | https://review.openstack.org/#/c/129376/ | 21:26 |
| captainmorgan | ayoung, it's just a merge to pull the topic branch to current master | 21:26 |
| ayoung | *just* ? | 21:26 |
| ayoung | you mean the other way round, don't you? | 21:27 |
| *** gyee has joined #openstack-keystone | 21:27 | |
| ayoung | Merge remote-tracking branch 'origin/master' into feature/hierarchical-multitenan ... | 21:27 |
| ayoung | no? | 21:27 |
| ayoung | captainmorgan, that is basically a "resync" right? | 21:28 |
| captainmorgan | yep | 21:28 |
| captainmorgan | it's a merge commit though, because we can't FF only it | 21:28 |
| *** captainmorgan is now known as needscoffee | 21:29 | |
| *** needscoffee is now known as captainmorgan | 21:29 | |
| ayoung | +2Away | 21:31 |
| rodrigods | ayoung, captainmorgan thanks! | 21:31 |
| ayoung | my pleasure | 21:31 |
| captainmorgan | ayoung, side note: https://review.openstack.org/#/c/129143/ what do you think of gating on complexity? | 21:31 |
| ayoung | please no more rules | 21:32 |
| ayoung | if it makes it harder to get code to pass tox -epep8 I'm against it | 21:32 |
| ayoung | categorically | 21:32 |
| captainmorgan | ayoung, we have *no* code that exceeds complexity of 24 | 21:32 |
| ayoung | I'll try harder | 21:32 |
| captainmorgan | and that is a migrate script. | 21:32 |
| ayoung | heh | 21:32 |
| captainmorgan | generally speaking our complexity is <15 | 21:32 |
| ayoung | what does this buy us? | 21:32 |
| captainmorgan | but we're really picky about the code. | 21:32 |
| captainmorgan | it's just a fence to help limit someone from creating crazy loop, loop, loop, loop constructs | 21:33 |
| captainmorgan | w/o us seeing it because it's hard to read | 21:33 |
| ayoung | hmmm, so if we set complexity to, say 20, what would that do with 'Auth._authenticate_token' | 21:33 |
| captainmorgan | it would fail pep8 | 21:33 |
| ayoung | would it help suggest ways to decomplixificate? | 21:34 |
| captainmorgan | and tell you that the method is too complex | 21:34 |
| captainmorgan | no it doesn't really have that smarts | 21:34 |
| captainmorgan | it can't re-write the python | 21:34 |
| ayoung | all you want to do is say "no more complex than we have now" for now? | 21:35 |
| captainmorgan | pretty much | 21:35 |
| captainmorgan | 24 is pretty good | 21:35 |
| captainmorgan | nova is in the ~64 range at the top end for example | 21:35 |
| ayoung | lets do it. It lets the coder mess with the value, and maybe tox will provide some feedback to simplify in the future | 21:35 |
| ayoung | If it gets painful we can always remove | 21:36 |
| captainmorgan | thats my thought | 21:36 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient-kerberos: kerberos client plugin https://review.openstack.org/123614 | 21:37 |
| *** henrynash has quit IRC | 21:37 | |
| ayoung | captainmorgan, so, I think I want to break things on the 'der' vs 'pem' issue and compressed tokens. Here's my logic: | 21:37 |
| ayoung | THe 'right' thing to do would be to create a new token format | 21:38 |
| ayoung | lets call it derz for now | 21:38 |
| ayoung | to differentiate from pkiz | 21:38 |
| ayoung | if we did that, any clients out there now would be broken if the keystone server started serving out 'derz_' tokens | 21:38 |
| ayoung | and would have no way to deal with it. | 21:38 |
| captainmorgan | fwiw i already have internal people coding java validators to handle pkiz | 21:39 |
| captainmorgan | so breaking it might be bad | 21:39 |
| ayoung | So,its basically the same thing that would happen if we changed pkiz to doing der | 21:39 |
| captainmorgan | with a target of juno support (since juno is released) | 21:39 |
| ayoung | so, one thing to do is to publish something about the 'der' side of the issue: | 21:39 |
| ayoung | I have code in the current posting that would accept both pem and der | 21:39 |
| captainmorgan | sadly i think we need to make it a config to switch to der - our code can be smart,but it needs tobe explicit for the server to issue der fmt | 21:40 |
| rodrigods | besides ayoung and jamielennox, who are other keystone bloggers? | 21:40 |
| captainmorgan | in theory you coudl make STD PKI tokens also der fmt with a switch like that | 21:40 |
| captainmorgan | rodrigods, dolphm | 21:40 |
| rodrigods | captainmorgan, ++ | 21:41 |
| captainmorgan | rodrigods, and i used to some till my blog died a horrible death | 21:41 |
| captainmorgan | and i gave up | 21:41 |
| captainmorgan | i should ressurect it. | 21:41 |
| rodrigods | captainmorgan, hehe | 21:41 |
| rodrigods | I was posting a tutorial for k2k fed | 21:41 |
| captainmorgan | nice! | 21:41 |
| rodrigods | captainmorgan, just need to figure out how to send the SAML assertion to the SP | 21:41 |
| rodrigods | hehe | 21:41 |
| captainmorgan | rodrigods, hehe | 21:42 |
| rodrigods | not trivial task right now (not documented too) | 21:42 |
| rodrigods | will submit other documentation improvements in this area | 21:42 |
| captainmorgan | ok i need to head out for a couple of hours. | 21:42 |
| captainmorgan | be back later on. | 21:42 |
| rodrigods | just have https://review.openstack.org/#/c/129338/ right now | 21:43 |
| *** lhcheng has quit IRC | 21:43 | |
| rodrigods | captainmorgan, o/ | 21:43 |
| *** lhcheng has joined #openstack-keystone | 21:44 | |
| *** lhcheng has quit IRC | 21:46 | |
| *** lhcheng has joined #openstack-keystone | 21:49 | |
| ayoung | rodrigods, nkinder blogs too | 21:51 |
| ayoung | https://blog-nkinder.rhcloud.com/ rodrigods | 21:51 |
| rodrigods | thanks ayoung | 21:52 |
| rodrigods | adding to my feedly | 21:52 |
| ayoung | rodrigods, http://rodrigods.com/ ? | 21:53 |
| ayoung | POK, family time | 21:54 |
| rodrigods | ayoung, yep! | 21:54 |
| *** ayoung has quit IRC | 21:54 | |
| *** zzzeek_ has joined #openstack-keystone | 21:54 | |
| *** zzzeek has quit IRC | 21:56 | |
| *** zzzeek_ is now known as zzzeek | 21:56 | |
| *** lhcheng_ has joined #openstack-keystone | 21:57 | |
| *** andreaf has quit IRC | 21:59 | |
| *** openstackgerrit has quit IRC | 22:03 | |
| *** openstackgerrit has joined #openstack-keystone | 22:04 | |
| *** lhcheng_ has quit IRC | 22:05 | |
| *** lhcheng has quit IRC | 22:05 | |
| *** lhcheng_ has joined #openstack-keystone | 22:05 | |
| *** lhcheng has joined #openstack-keystone | 22:05 | |
| *** lhcheng has quit IRC | 22:05 | |
| *** Tahmina has joined #openstack-keystone | 22:08 | |
| *** zzzeek_ has joined #openstack-keystone | 22:09 | |
| *** dimsum_ has quit IRC | 22:09 | |
| *** dimsum_ has joined #openstack-keystone | 22:09 | |
| *** zzzeek has quit IRC | 22:10 | |
| *** zzzeek_ is now known as zzzeek | 22:10 | |
| openstackgerrit | A change was merged to openstack/pycadf: Updated from global requirements https://review.openstack.org/127786 | 22:10 |
| *** mikedillion has quit IRC | 22:12 | |
| *** r-daneel has quit IRC | 22:12 | |
| *** amerine has quit IRC | 22:12 | |
| *** tellesnobrega has joined #openstack-keystone | 22:14 | |
| *** dimsum_ has quit IRC | 22:14 | |
| *** _cjones_ has quit IRC | 22:16 | |
| *** _cjones_ has joined #openstack-keystone | 22:16 | |
| *** _cjones_ has quit IRC | 22:21 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: add v3 API documentation https://review.openstack.org/128712 | 22:25 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Publish the Identity v3 API specs https://review.openstack.org/128765 | 22:26 |
| *** henrynash has joined #openstack-keystone | 22:27 | |
| *** mikedillion has joined #openstack-keystone | 22:29 | |
| *** jorge_munoz has quit IRC | 22:33 | |
| *** pc-m has quit IRC | 22:34 | |
| *** thedodd has quit IRC | 22:35 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:36 | |
| *** andreaf has joined #openstack-keystone | 22:41 | |
| *** _cjones_ has joined #openstack-keystone | 22:46 | |
| *** arunkant has quit IRC | 22:49 | |
| *** rwsu has joined #openstack-keystone | 22:52 | |
| *** mikedillion has quit IRC | 22:58 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Make assignments pluggable. https://review.openstack.org/129397 | 23:00 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Add an extension to store domain specific configuration in SQL. https://review.openstack.org/123238 | 23:06 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Make assignments pluggable. https://review.openstack.org/129397 | 23:08 |
| *** _cjones_ has quit IRC | 23:10 | |
| *** _cjones_ has joined #openstack-keystone | 23:11 | |
| *** tellesnobrega has quit IRC | 23:11 | |
| *** _cjones_ has quit IRC | 23:15 | |
| *** tellesnobrega has joined #openstack-keystone | 23:17 | |
| *** gyee has quit IRC | 23:30 | |
| *** _cjones_ has joined #openstack-keystone | 23:42 | |
| *** _cjones_ has quit IRC | 23:42 | |
| *** _cjones_ has joined #openstack-keystone | 23:42 | |
| *** dimsum_ has joined #openstack-keystone | 23:44 | |
| *** gyee has joined #openstack-keystone | 23:44 | |
| *** nellysmitt has quit IRC | 23:45 | |
| *** nellysmitt has joined #openstack-keystone | 23:45 | |
| *** henrynash has quit IRC | 23:45 | |
| *** dimsum_ has quit IRC | 23:46 | |
| *** dimsum_ has joined #openstack-keystone | 23:46 | |
| *** dimsum_ has quit IRC | 23:47 | |
| *** dimsum_ has joined #openstack-keystone | 23:48 | |
| *** nellysmitt has quit IRC | 23:50 | |
| *** david-lyle has joined #openstack-keystone | 23:52 | |
| *** dimsum_ has quit IRC | 23:52 | |
| *** david-lyle has quit IRC | 23:52 | |
| *** dimsum_ has joined #openstack-keystone | 23:55 | |
| *** dimsum_ has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
