| *** jogo has left #openstack-keystone | 00:00 | |
| *** henrynash has quit IRC | 00:12 | |
| *** mitz_ has joined #openstack-keystone | 00:33 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Add xmlsec1 dependency comments https://review.openstack.org/129338 | 00:38 |
|---|---|---|
| *** topol has joined #openstack-keystone | 00:40 | |
| rodrigods | bknudson, just replied in the tiny doc patch ^ | 00:46 |
| *** jacer_huawei has quit IRC | 00:47 | |
| *** sudorandom has quit IRC | 00:51 | |
| *** sudorandom has joined #openstack-keystone | 00:51 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Fix mappings.Mapping docstring https://review.openstack.org/128615 | 00:51 |
| *** apex has joined #openstack-keystone | 00:58 | |
| *** jacer_huawei has joined #openstack-keystone | 00:59 | |
| *** apex is now known as k-kosaka | 01:00 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: rescope tokens unscoped to scoped only https://review.openstack.org/123760 | 01:05 |
| *** stevemar has quit IRC | 01:06 | |
| *** stevemar has joined #openstack-keystone | 01:06 | |
| *** amcrn has joined #openstack-keystone | 01:08 | |
| *** alex_xu has joined #openstack-keystone | 01:12 | |
| openstackgerrit | A change was merged to openstack/keystone: Remove check_password() in identity.backend.ldap https://review.openstack.org/129103 | 01:19 |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: hierarchical roles https://review.openstack.org/125704 | 01:47 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone-specs: hierarchical roles https://review.openstack.org/125704 | 01:56 |
| *** dimsum_ has quit IRC | 02:01 | |
| *** dimsum_ has joined #openstack-keystone | 02:02 | |
| *** dimsum_ has quit IRC | 02:06 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Basic-Auth middleware https://review.openstack.org/92137 | 02:34 |
| *** diegows has quit IRC | 02:52 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: Session Tokens https://review.openstack.org/96648 | 03:11 |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Use newer python-ldap paging control API https://review.openstack.org/128782 | 03:14 |
| *** topol has quit IRC | 03:36 | |
| *** HenryG has quit IRC | 03:49 | |
| *** ayoung is now known as ayoung-ZZZzzz | 03:57 | |
| *** topol has joined #openstack-keystone | 04:00 | |
| *** topol has quit IRC | 04:24 | |
| *** fifieldt has joined #openstack-keystone | 04:48 | |
| *** swartulv has quit IRC | 04:58 | |
| *** swartulv has joined #openstack-keystone | 04:59 | |
| *** amcrn has quit IRC | 05:34 | |
| *** stevemar has quit IRC | 05:42 | |
| *** k4n0 has joined #openstack-keystone | 06:11 | |
| *** aix has joined #openstack-keystone | 06:33 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 06:37 | |
| *** dimsum_ has joined #openstack-keystone | 06:40 | |
| *** aix has quit IRC | 06:42 | |
| *** dimsum_ has quit IRC | 06:45 | |
| openstackgerrit | Dave Chen proposed a change to openstack/keystone: Correct the code path of implementation for the abstract method https://review.openstack.org/129530 | 06:54 |
| *** vb has quit IRC | 07:37 | |
| *** nellysmitt has joined #openstack-keystone | 07:49 | |
| *** jamielennox has joined #openstack-keystone | 07:49 | |
| * jamielennox the triumphant return | 07:51 | |
| *** henrynash has joined #openstack-keystone | 08:04 | |
| *** jistr has joined #openstack-keystone | 08:12 | |
| * marekd o/ | 08:13 | |
| *** afazekas has joined #openstack-keystone | 08:19 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Convert authentication into a plugin https://review.openstack.org/115857 | 08:59 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Revert "Support service user and project in non-default domain" https://review.openstack.org/129551 | 08:59 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Allow loading other auth methods in auth_token https://review.openstack.org/129552 | 08:59 |
| *** henrynash has quit IRC | 09:19 | |
| *** k4n0 has quit IRC | 09:32 | |
| *** k4n0 has joined #openstack-keystone | 09:35 | |
| *** amakarov_away is now known as amakarov | 09:41 | |
| *** k-kosaka has quit IRC | 09:55 | |
| *** htruta has quit IRC | 10:18 | |
| *** KanagarajM has joined #openstack-keystone | 10:18 | |
| *** yasu_ has joined #openstack-keystone | 10:33 | |
| *** aix has joined #openstack-keystone | 10:43 | |
| *** KanagarajM has quit IRC | 10:51 | |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: Trust redelegation https://review.openstack.org/126897 | 10:51 |
| *** dimsum_ has joined #openstack-keystone | 10:57 | |
| *** samuelms has joined #openstack-keystone | 11:18 | |
| *** shikui_ has joined #openstack-keystone | 11:25 | |
| *** diegows has joined #openstack-keystone | 11:35 | |
| *** HenryG has joined #openstack-keystone | 11:39 | |
| *** vb has joined #openstack-keystone | 11:52 | |
| samuelms | dolphm, ping | 12:08 |
| openstackgerrit | Masahito Muroi proposed a change to openstack/keystonemiddleware: Changing the value type of http_connect_timeout https://review.openstack.org/126543 | 12:11 |
| *** shikui_ has quit IRC | 12:19 | |
| *** htruta has joined #openstack-keystone | 12:19 | |
| *** dimsum_ has quit IRC | 12:28 | |
| *** dimsum_ has joined #openstack-keystone | 12:28 | |
| *** nellysmitt has quit IRC | 12:40 | |
| *** yasu_ has quit IRC | 12:45 | |
| *** henrynash has joined #openstack-keystone | 12:48 | |
| openstackgerrit | Xu Chen proposed a change to openstack/python-keystoneclient: set close_fds=True in Popen https://review.openstack.org/129456 | 12:49 |
| *** saipandi has joined #openstack-keystone | 12:49 | |
| *** radez_g0n3 is now known as radez | 12:55 | |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: LDAP additional attribute mappings description https://review.openstack.org/118590 | 12:56 |
| *** pc-m has joined #openstack-keystone | 12:57 | |
| *** henrynash has quit IRC | 13:02 | |
| *** gordc has joined #openstack-keystone | 13:09 | |
| *** bknudson has quit IRC | 13:12 | |
| openstackgerrit | A change was merged to openstack/keystone: Use newer python-ldap paging control API https://review.openstack.org/128782 | 13:36 |
| *** bknudson has joined #openstack-keystone | 13:39 | |
| amakarov | bknudson, greetings! A question on https://review.openstack.org/#/c/120043/5/keystone/common/utils.py | 13:42 |
| bknudson | amakarov: ok | 13:43 |
| amakarov | bknudson, SmarterEncoder is used to encode all outcoming json responses | 13:43 |
| amakarov | So if I make special encoder for PKI tokens I have to replace SmarterEncoder Everywhere ) | 13:44 |
| *** stevemar has joined #openstack-keystone | 13:44 | |
| bknudson | amakarov: the commit message doesn't make it clear that the goal is to change the encoding of all outgoing json responses... | 13:44 |
| bknudson | the commit message only mentions PKI tokens. | 13:44 |
| amakarov | bknudson, I see. So nothing wrong to encode all responses in a new way, just to mention it in commit message? | 13:45 |
| bknudson | amakarov: I think it is wrong to encode all responses in a new way | 13:46 |
| amakarov | bknudson, well, what's you idea about it? | 13:47 |
| bknudson | amakarov: have a specific encoder just for the PKI token. | 13:50 |
| bknudson | create a new class and use that to encode the PKI token. | 13:50 |
| jamielennox | wow, we have a huge problem when we're concerned with gains like that | 13:50 |
| bknudson | PKI tokens are broken | 13:51 |
| *** bdossant_ has quit IRC | 13:51 | |
| jamielennox | it's not that the patch is bad - just a huge problem | 13:51 |
| *** bdossant has joined #openstack-keystone | 13:51 | |
| jamielennox | bknudson: so I proposed https://review.openstack.org/#/c/129551/ | 13:53 |
| amakarov | bknudson, good, I'll look how to bypass common json middleware | 13:53 |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: Hierarchical Roles https://review.openstack.org/125704 | 13:54 |
| bknudson | jamielennox: looks like I was already +2 on https://review.openstack.org/#/c/115857/ | 13:55 |
| *** k4n0 has quit IRC | 13:55 | |
| jamielennox | bknudson: do you understand where i was trying to go with it? | 13:55 |
| jamielennox | I'm pretty sure that the WIP i posted as a follow up will work, i'm just spinning up some new environments to do a proper test | 13:55 |
| jamielennox | and then add some test cases for it | 13:56 |
| bknudson | oh, it was WIP | 13:56 |
| jamielennox | no i added a new one as a follow on to that which is WIP | 13:56 |
| *** Guest4574 is now known as mfisch | 13:56 | |
| *** mfisch has joined #openstack-keystone | 13:56 | |
| jamielennox | https://review.openstack.org/#/c/129552/ is WIP | 13:56 |
| bknudson | jamielennox: ok, so this reverts support for v3 auth | 13:57 |
| jamielennox | bknudson: yes, v3 auth can be supported (with whatever domain you like) by using an auth plugin | 13:58 |
| bknudson | so it reopens the bug | 13:58 |
| jamielennox | yes | 13:59 |
| jamielennox | 129552 will close it (or make it invalid) | 14:01 |
| *** thedodd has joined #openstack-keystone | 14:01 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:02 | |
| bknudson | jamielennox: ok... add some tests so it's not a WIP | 14:02 |
| bknudson | then I can try it out | 14:02 |
| jamielennox | bknudson: yep, and i want to write up a chunk of documentation to be in the same patch | 14:02 |
| jamielennox | just want to make sure you know why i'm proposing the revert | 14:03 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: PKI and PKIZ tokens unnecessary whitespace removed https://review.openstack.org/120043 | 14:11 |
| stevemar | blah, xml support is in the pipeline by default | 14:14 |
| stevemar | and lxml is in test-req.txt | 14:15 |
| bknudson | when can we remove xml support? | 14:17 |
| *** ayoung-ZZZzzz is now known as ayoung | 14:17 | |
| stevemar | bknudson, lbragstad is doing that now | 14:19 |
| ayoung | jamielennox, you planning on posting a follow up to https://review.openstack.org/#/c/129551/ that uses a V3 auth plugin? | 14:19 |
| stevemar | bknudson, quick q about https://review.openstack.org/#/c/126543/ | 14:19 |
| lbragstad | stevemar: bknudson https://review.openstack.org/#/c/125738/ | 14:19 |
| lbragstad | bknudson: stevemar links to the tempest and devstack changes are in there as well | 14:19 |
| bknudson | stevemar: what's the q? | 14:19 |
| stevemar | bknudson, i saw other patches fail when changing the options in auth_token.py, changing the help text for instance, why did this one work | 14:20 |
| jamielennox | ayoung: i'm planning on fleshing out https://review.openstack.org/#/c/129552/ and using v3 as a reason to make people change how they configure auth_token | 14:20 |
| *** nkinder has joined #openstack-keystone | 14:20 | |
| stevemar | trying to dig up an example | 14:20 |
| ayoung | jamielennox, will that allow multiple plugins, with different config options? I'd like to make it support the Kerberos one, which means selecting the plugin based on entry point | 14:20 |
| stevemar | bknudson, like this one https://review.openstack.org/#/c/118048/ | 14:21 |
| bknudson | stevemar: heat was still using middleware in keystoneclient. | 14:21 |
| stevemar | bknudson, ah OK | 14:21 |
| stevemar | that caused some conflict | 14:21 |
| stevemar | neat | 14:22 |
| jamielennox | ayoung: that will allow any plugin to be used with auth_token, so kerberos will work and the v3 options will be supported | 14:22 |
| bknudson | stevemar: https://review.openstack.org/#/c/127100/ | 14:22 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Honor the inform and outform parameters https://review.openstack.org/127533 | 14:22 |
| bknudson | stevemar: heat is doing some wacky stuff. | 14:22 |
| stevemar | bknudson, yes i recall looking at some of those patches | 14:22 |
| stevemar | didn't realize it was so connected to the tempest tests | 14:22 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Honor the inform and outform parameters https://review.openstack.org/127533 | 14:23 |
| bknudson | they import auth_token middleware and try to grab conf options... which isn't going to work | 14:23 |
| bknudson | for example jamielennox's change is going to break heat. | 14:23 |
| *** dtroyer has joined #openstack-keystone | 14:23 | |
| stevemar | thats not good | 14:24 |
| bknudson | jamielennox: this should worry you: http://git.openstack.org/cgit/openstack/heat/tree/contrib/heat_keystoneclient_v2/heat_keystoneclient_v2/client.py#n120 | 14:24 |
| jamielennox | bknudson: the revert? | 14:24 |
| ayoung | jamielennox, I found an issue with entry points that the "name" value in setup.cfg can mess up. python-keystoneclient-kerberos didn't work, but keystoneclient_kerberos did. I'm not certain if the python- is right or wrong, but we do it for Keystone client. | 14:25 |
| bknudson | jamielennox: no, trying to use auth plugins in auth_token middleware | 14:25 |
| jamielennox | bknudson: yea, umm - i don't know what we can do about that | 14:25 |
| ayoung | break it! | 14:25 |
| jamielennox | however using the username/password from auth_tokens config is wrong | 14:25 |
| jamielennox | neutron does it to - or did | 14:26 |
| ayoung | we need to get an X509 auth plugin standard so that service users can avoid having to read passwords out of config files | 14:26 |
| jamielennox | ayoung: name in setup.cfg? like the plugin name entrypoint? or naming the gem? | 14:27 |
| jamielennox | ahh gem, module thingy | 14:27 |
| ayoung | gem is wrong language, but yes | 14:27 |
| ayoung | https://github.com/openstack/python-keystoneclient/blob/master/setup.cfg#L2 | 14:27 |
| jamielennox | yea, i think i had to do that with requests-mock. pypi can have requests-mock as the name but internally you have to use requests_mock | 14:27 |
| ayoung | really should not have python- there, as it is redundant | 14:27 |
| jamielennox | because python would freak out if you did: import requests-mock or import keystoneclient-kerberos because it treats the - as a minus | 14:28 |
| ayoung | hmmm, Monty Taylor did that. | 14:28 |
| stevemar | gordc, ping | 14:29 |
| ayoung | jamielennox, yeah, it messes up the package name, but it also is a PBR issue in registering packages. | 14:29 |
| ayoung | I suspect that the PBR code is capable of handling one - to _ transform, as otherwise the python-keystoneclient name would fail for out other entrypoints | 14:30 |
| *** rwsu has joined #openstack-keystone | 14:30 | |
| ayoung | its strange behavior. If the class has ever been loaded in a unix session, then the naming works fine, but if you come from a fresh log in, the entrypoints are not found, and it is due to PBR searching through the set of site-packages | 14:31 |
| jamielennox | that sounds .... odd | 14:31 |
| ayoung | really ugly stuff. Starting to thing that the R stands for Revenge, not Reasonableness | 14:31 |
| jamielennox | so requests-mock is PBR | 14:31 |
| jamielennox | though there isn't anything about entrypoints in thre | 14:31 |
| jamielennox | do you have a code example of where it fails | 14:31 |
| ayoung | is the name requests-mock or python-requests-mock in setup.cfg? | 14:32 |
| ayoung | yeah, previous version of the keystoneclient-kerberos patch failed | 14:32 |
| ayoung | you don;t need kerberos enabled, just load the plugin via stevedore | 14:32 |
| jamielennox | just requests-mock, the python thing has always been kind of redundant | 14:34 |
| jamielennox | is it a problem with entrypoints or PBR | 14:35 |
| gordc | stevemar: whatup | 14:36 |
| stevemar | gordc, trying to understand all the oslo incubator stuff in pycadf | 14:36 |
| gordc | sure. | 14:36 |
| stevemar | there seems to be a ton of it for a little library :) | 14:36 |
| gordc | stevemar: yes there is. | 14:37 |
| stevemar | gordc, any way we can lose the dependency on the fixture module? | 14:37 |
| gordc | and pull in oslotest? | 14:37 |
| stevemar | seems like the best candidate for shedding some bloat | 14:37 |
| stevemar | hmm yes | 14:37 |
| stevemar | i wasn't sure where that one was moved to | 14:38 |
| gordc | stevemar: yes. i think i'm using it in our tests. | 14:38 |
| stevemar | yes | 14:38 |
| gordc | stevemar: want to coordinate on the switching to graduated libs? | 14:38 |
| stevemar | gordc, i was just going to throw up some patches now | 14:39 |
| stevemar | did it for keystone, ksc, and middleware already | 14:39 |
| *** henrynash has joined #openstack-keystone | 14:39 | |
| gordc | stevemar: what'd you switch? so i don't bother posting dup stuff | 14:39 |
| ayoung | I think the problem is with PBR, as that is what does the version recognition. I hadn't 100% tracked it down, but found that it was missing the match due to the - to _ thing | 14:39 |
| stevemar | gordc, still investigating, apparently 'local' needs 'log' | 14:40 |
| *** jacer_huawei has quit IRC | 14:40 | |
| stevemar | err other way around | 14:40 |
| stevemar | but in keystone we import log, but pretty sure we don't have any local ref | 14:40 |
| gordc | might be an old ref | 14:41 |
| *** jacer_huawei has joined #openstack-keystone | 14:41 | |
| stevemar | yeah, might want to do a sync first, then remove crud | 14:41 |
| gordc | stevemar: if we can move the middleware to keystone middleware, we can really shrink pycadf | 14:41 |
| gordc | stevemar: you going to sync oslo now? and then we can figure out how we want to split rest of work | 14:42 |
| stevemar | gordc, true, but that'll be part 2 | 14:42 |
| gordc | stevemar: (yes, i'm assuming you're doing work) | 14:42 |
| stevemar | gordc, i just started looking at this all 10 minutes ago :P | 14:43 |
| stevemar | gordc, i haven't started anything, i planned to do it all, but we can certainly split it up :P | 14:43 |
| gordc | stevemar: sync it! or i can i do a patch.. i thikn my oslo is current | 14:43 |
| *** thedodd has quit IRC | 14:44 | |
| *** jorge_munoz has joined #openstack-keystone | 14:47 | |
| *** htruta has quit IRC | 14:47 | |
| stevemar | gordc, sync'ing first doesn't make sense, we will lose all crap we want to remove | 14:49 |
| stevemar | we should migrate to jsonutils, importutils, blah, and fixture, then sync and get rid of local (by updating log) | 14:50 |
| gordc | stevemar: it's actually easier to sync first. some of oslo modules reference graduated libraries... and it makes it easier to switch to new oslo libs since the latest code is closer to what exists in lib | 14:51 |
| *** mflobo has quit IRC | 14:51 | |
| *** jorge_munoz has quit IRC | 14:52 | |
| stevemar | gordc, so do a half-sync? and undo the deletes it causes to jsonutils and such? | 14:52 |
| *** jorge_munoz has joined #openstack-keystone | 14:52 | |
| gordc | stevemar: either or... it's probably best to just do a full sync and start pulling stuff out as you switch to the lib | 14:52 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Sync oslo libraries https://review.openstack.org/129637 | 14:55 |
| stevemar | gordc, ^ i left openstack-common.conf the same for now | 14:55 |
| ayoung | jamielennox, you left the comment "I've got a few things to do but i'll hopefully come back and fix up my comments soon" on the Kerberos plugin. I assume that is low in your queue, and I'm planning on making those changes myself. | 14:55 |
| jamielennox | ayoung: sure - i wasn't sure how high on your list that was | 14:56 |
| jamielennox | i think i left comments for everything i saw | 14:56 |
| ayoung | Kerberos is the biggest thing. I don't know if a V2 Kerberos plugin is realistic | 14:56 |
| ayoung | I am guessing it would have to be "external" | 14:57 |
| *** aix has quit IRC | 14:59 | |
| *** jistr has quit IRC | 14:59 | |
| *** aix has joined #openstack-keystone | 14:59 | |
| jamielennox | ayoung: there's nothing preventing it, i just don't see any point doing it | 15:01 |
| *** jistr has joined #openstack-keystone | 15:01 | |
| ayoung | Agreed...just that saying "kerberos" is the cleanest thing from the Django side, but setting it to v3kerberos for now is probably the right call | 15:05 |
| *** david-lyle has joined #openstack-keystone | 15:05 | |
| jamielennox | ayoung: you can make an 'unversioned' kerberos plugin that just errors out if v3 isn't available | 15:06 |
| ayoung | jamielennox, yeah, just that your current unversioned approach does a discovery call that I want to avoid | 15:07 |
| jamielennox | it's just about doing discovery and keeping the option open for later | 15:07 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Move to oslo.serialization https://review.openstack.org/129641 | 15:07 |
| *** saipandi has quit IRC | 15:07 | |
| ayoung | jamielennox, but Horizon shouldn't do discovery on each keystone call | 15:07 |
| jamielennox | ayoung: discovery is cached by the session and the auth plugin | 15:07 |
| jamielennox | so if it reuses session then caching is handled for it | 15:08 |
| ayoung | yes, but sessions are not shared between requests in Horizon | 15:08 |
| stevemar | gordc, ah i see log isn't in openstack-common.conf :) | 15:08 |
| stevemar | that can cause issues | 15:08 |
| ayoung | jamielennox, where we gonna cache the session? We don't have memcache guaranteed | 15:08 |
| jamielennox | cache it on the process | 15:08 |
| jamielennox | global var style | 15:08 |
| ayoung | same session used for multiple users? | 15:09 |
| ayoung | not sure what the threading model is for Horizon | 15:09 |
| jamielennox | you can pass the auth plugin per client rather than per session | 15:09 |
| jamielennox | so use the session for everybody | 15:10 |
| jamielennox | then when you want to do something user specific do | 15:10 |
| morganfainberg | jamielennox, welcome back | 15:10 |
| jamielennox | c = keystoneclient.v3.client.Client(session, user_auth) | 15:10 |
| jamielennox | morganfainberg: :) | 15:10 |
| gordc | stevemar: hmm.. it's probably pulled in by something else | 15:10 |
| *** alee has joined #openstack-keystone | 15:10 | |
| alee | ayoung, hey | 15:10 |
| stevemar | gordc, local>log>fileutils>lockutils>fixture | 15:11 |
| stevemar | damn thats a chain | 15:11 |
| morganfainberg | jamielennox, please look over the keystoneclient summit session and let me know if we need to make changes to the description. | 15:11 |
| jamielennox | morganfainberg: glad to be back might be reaching a little too much, but it's good | 15:11 |
| ayoung | alee, so you want ipa be hooked up to keystone to get a token? | 15:11 |
| alee | ayoung, yeah - is it possible? | 15:11 |
| ayoung | not sure what that means, but in general, I don;t think IPA should know about Keystone. | 15:11 |
| gordc | stevemar: you should see the original dependency graph that dhellmann created. | 15:11 |
| morganfainberg | jamielennox, http://kilodesignsummit.sched.org/event/8df02f751841faa1cee7e4f1de1450f1 | 15:11 |
| jamielennox | morganfainberg: congrats on PTL | 15:11 |
| morganfainberg | jamielennox, hehe thanks. | 15:12 |
| stevemar | gordc, jeez, i think by the end of this we will have that directory empty | 15:12 |
| alee | ayoung, in the case of vault though, ipa is providing more than just identity | 15:12 |
| alee | ayoung, its providing well - vault - just like barbican | 15:12 |
| jamielennox | morganfainberg: ok - i don't have a whole lot to say about client, most of what i need is in now and it's mostly getting other clients and services to use it | 15:12 |
| ayoung | alee, yeah, but you've got your abstractions crossed | 15:12 |
| jamielennox | don't mind leading it anyway | 15:13 |
| alee | ayoung, and so it needs to know about projects | 15:13 |
| morganfainberg | jamielennox, right. | 15:13 |
| gordc | stevemar: yeah, i'm pretty sure all the dependencies are because of test or middleware. | 15:13 |
| morganfainberg | jamielennox, cool thanks. | 15:13 |
| ayoung | I mean, you could do it if you had LDAP assignment | 15:13 |
| ayoung | and Barbican could enforce the Policy beyond what the vault does | 15:13 |
| stevemar | what about context, gordc | 15:14 |
| alee | ayoung, yes - in fact I just wrote a blueptrint to do exactly that | 15:14 |
| ayoung | alee, I guess I would say that Barbican should be able to call to Keystone, but not IPA | 15:15 |
| gordc | that we may need to keep because we add that to cadf message when we build event | 15:15 |
| gordc | but i think that's also more related to messaging so it is possible that it could be dropped. | 15:15 |
| ayoung | its the whole "external authentication" that we never felt comfortable doing in IPA. | 15:15 |
| jamielennox | why would barbican talk to keystone? i saw a thread on this with neutron wanting to talk to keystone and i dont think it's a good idea | 15:15 |
| gordc | stevemar: ^ | 15:16 |
| ayoung | alee, My current thinking is more like this: | 15:16 |
| ayoung | thereis a NIST standard for RBAC in LDAP. We could potentially support that. | 15:16 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Use oslo tests fixture https://review.openstack.org/129643 | 15:17 |
| stevemar | gordc, ah missed 1 instance, | 15:17 |
| ayoung | and then both Keystone and IPA could share a common view of RBAC, but beyond that, I think there is too much variability | 15:17 |
| gordc | stevemar: yeah, i've noticed sync/switching to graudated lib has random items you'll always miss. | 15:19 |
| ayoung | jamielennox, so, session never has the auth plugin set? | 15:19 |
| jamielennox | ayoung: yep, if it's specified to the client then it is used in preference to session - and you can just leave it unset in session | 15:20 |
| jamielennox | preference to session.auth | 15:20 |
| jamielennox | (i would leave it unset - it seems dangerous to me to mix having auth on the session and auth on the client, you're going to forget it somewhere) | 15:21 |
| ayoung | jamielennox, take a look at https://review.openstack.org/#/c/121281/ as I think I am doing it wrong | 15:21 |
| ayoung | https://review.openstack.org/#/c/121281/6/openstack_auth/utils.py,cm jamielennox has the offending code | 15:22 |
| jamielennox | yea, looking at that now | 15:23 |
| jamielennox | i don't like doing force_authenticate | 15:24 |
| jamielennox | it doesn't protect anything because the session will do it again if required | 15:24 |
| *** david-lyle has quit IRC | 15:24 | |
| jamielennox | it looks like you're doing it to set a whole bunch of variables on the client, and you shouldn't be using them | 15:25 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Use oslo.serialization https://review.openstack.org/129641 | 15:28 |
| ayoung | jamielennox, we need to be able to force authenticate. We can't be guaranteed that a login has worked unless we get a token | 15:29 |
| *** mitz has quit IRC | 15:29 | |
| ayoung | and the only time we get a second token is if the first is unscoped | 15:29 |
| *** mitz has joined #openstack-keystone | 15:29 | |
| jamielennox | ok just so you're aware that it's not always authing there and it may attempt to reauth later | 15:30 |
| jamielennox | bah, why does horizon need all that info? | 15:32 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Use oslo tests fixture https://review.openstack.org/129643 | 15:32 |
| ayoung | jamielennox, what info? | 15:33 |
| jamielennox | auth_user.Token | 15:33 |
| stevemar | ugh, just added pycadf-core, and it has like 15 people | 15:34 |
| stevemar | blah | 15:34 |
| morganfainberg | stevemar, hah | 15:34 |
| *** nellysmitt has joined #openstack-keystone | 15:34 | |
| morganfainberg | stevemar, removed oslo-core so that shouldn't happen again | 15:35 |
| stevemar | haha, thanks morganfainberg | 15:35 |
| ayoung | jamielennox, my guess is the auth_user.Token abstraction is due to there not being an alternative in the past | 15:38 |
| ayoung | Django-OpenStack-Auth needs some scrubbing | 15:38 |
| ayoung | jamielennox, my plan is to start with always requesting and storing an unscoped token | 15:39 |
| ayoung | and then using that on the switch code. | 15:39 |
| marekd | Looks like I am missing something. When I start using any openstack service (say via nova, glance cli) my clie only knos OS_AUTH_URL, a url poiting me where I should start with authentication. Then, in a token I will receive service catalog with all the services in that cloud, right? | 15:39 |
| ayoung | So at log in, it will force two calls to Keystone: 1 to get unscoped, a second to get scoped | 15:39 |
| ayoung | we do a lot of calls at login time anyway: enumerating projects, etc | 15:40 |
| ayoung | we could probably lump a bunch of calls together, but I think get it working as separate calls first | 15:40 |
| jamielennox | marekd: yes | 15:40 |
| jamielennox | ayoung: i'm still not sure what it's doing with that information though | 15:41 |
| ayoung | jamielennox, Horizon itself doens't need the data directly, it can now work through the KC abstraction for things like Service Catalog, but that was not the case when it was origianlly written | 15:42 |
| ayoung | DOA is a little behind the times | 15:42 |
| ayoung | token gets stored in the session | 15:42 |
| jamielennox | ok, yea that seems relatively common unfortunately | 15:42 |
| *** aix has quit IRC | 15:42 | |
| jamielennox | i'm trying to move things forward but people keep wanting things like the current scope from the token | 15:43 |
| marekd | jamielennox: so if in my SC there is http://keystone:5000/v2.0 configured as identity service keystoneclient will try to access this url and hence use v2 identity api, right? | 15:43 |
| ayoung | exactly | 15:43 |
| ayoung | jamielennox, and...that should probably be "current scope from the client" | 15:43 |
| ayoung | but then, how do you persist the scope? | 15:43 |
| *** aix has joined #openstack-keystone | 15:44 | |
| jamielennox | marekd: the hence is too optimistic, it doesn't recognize from the URL that it's a v2 endpoint | 15:44 |
| jamielennox | it will use whatever client you tell it to regardless of the catalog unfortunately | 15:44 |
| jamielennox | there is a hack in place to allow it to strip the /v2.0 for v3 client calls - but it's not smart enough to know | 15:44 |
| marekd | jamielennox: so if i set OS_IDENTITY_API_VERSION=3 | 15:45 |
| jamielennox | ayoung: i consider the clients mostly stateless | 15:45 |
| marekd | jamielennox: and have /v2.0 identity endpoint in my SC | 15:45 |
| jamielennox | marekd: what service are we talking about? horizon? | 15:45 |
| marekd | jamielennox: keystone | 15:45 |
| marekd | and cli | 15:45 |
| ayoung | jamielennox, so the state abstraction is the auth plugin only? | 15:45 |
| *** jistr has quit IRC | 15:45 | |
| jamielennox | marekd: keystone CLI doesn't support v3 at all | 15:45 |
| marekd | keystoneclient does, python-openstackclient does. | 15:46 |
| jamielennox | ayoung: yep | 15:46 |
| jamielennox | marekd: yes OSC does, in that case you're telling it which API version to use - which happens to equate to which auth version to use | 15:46 |
| ayoung | jamielennox, let me see if Token has snuck into the Horizon codebase or if it is limited to DOA | 15:46 |
| jamielennox | and it also does a hack to strip of /v2.0 | 15:47 |
| *** gyee has joined #openstack-keystone | 15:47 | |
| jamielennox | ayoung: that's the goal, session has some transport state like SSL certs, auth plugin has auth state, clients are stateless | 15:47 |
| jamielennox | (other than having a session and/or auth plugin) | 15:47 |
| ayoung | jamielennox, I think there are some references in the Horizon tests, but the rest of Horizon should be agnostic | 15:48 |
| marekd | jamielennox: yes, so let's say I stick to V3 API. But then In my SC i will receive identity endpoint set to http://keystone:5000/v2.0. Now if osc use this exact url it will try to use v3 api athrogh v2 pipe. Am I right? | 15:48 |
| ayoung | so all fo the cleanup would be in DOA | 15:48 |
| ayoung | marekd, and there is the pain point | 15:48 |
| jamielennox | marekd: yep, but OSC and KSC have a hack in place to recognise the mistake and work around it | 15:48 |
| marekd | jamielennox: ah, so it's already there.... | 15:49 |
| jamielennox | marekd: we unfortunately can't change the service catalog to be keystone:5000/ yet because we will break all the legacy apps that are expecting a versione endpoint | 15:49 |
| ayoung | or, even better: https://hostname/keystone/main/ | 15:49 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Sync oslo libraries https://review.openstack.org/129637 | 15:49 |
| stevemar | gordc, thanks for the comments | 15:50 |
| jamielennox | ayoung: if it's coming from the service catalog i couldn't care less what it looks like | 15:50 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Use oslo.serialization https://review.openstack.org/129641 | 15:50 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Use oslo tests fixture https://review.openstack.org/129643 | 15:50 |
| marekd | jamielennox: understood, i simply have an example of a cloud with endpoints set to /v20 only however I could use osc with v3 api and was wondering why... | 15:50 |
| stevemar | gordc, -2500 lines of code :) | 15:50 |
| ayoung | jamielennox, not sure that the hack worked for Horizon; I still needed to modify the service catalog to get it to work with V3 | 15:50 |
| jamielennox | marekd: yep, it's a hack and if you change the v2 endpoint to something other than /v2.0 it will fail | 15:50 |
| jamielennox | ayoung: if you're using the session the hack only went in in the 0.11 version | 15:51 |
| ayoung | But then,m Horizon want's to tell Keystone what version of the API it is using on top of the Auth url and the service catalog | 15:51 |
| marekd | jamielennox: so setting endpoints to /v3 and trying to use with /v2.0 will also *NOT* work. | 15:51 |
| marekd | err, setting IDENTITY_API_VERSION=2.0 | 15:51 |
| jamielennox | marekd: yes - the last thing i want to do is encourage people to move to another versioned endpoint | 15:51 |
| gordc | stevemar: now you just need to get rid of that oslo.messaging requirement and it becomes lightweight :) | 15:51 |
| *** afazekas has quit IRC | 15:52 | |
| jamielennox | marekd: i've got things in place so a number of clients will work with the unversioned endpoint in the catalog - but i want /v3 to fail so people don't try and do it | 15:52 |
| marekd | jamielennox: thanks, makes sense now :-) | 15:52 |
| ayoung | keystone --version returns 0.11.2 | 15:52 |
| stevemar | agreed! | 15:53 |
| jamielennox | split pycadf.parsing and pycadf.messaging | 15:53 |
| ayoung | jamielennox, OK, so please bleed on the Auth Tokens review for DOA, as I think getting that right is essential. I might need some more hands on help getting that to work, as the "force_reauthenticate" call was the result of much trial and error | 15:53 |
| morganfainberg | ok.. so can anyone point me to the bug/bp that is about where we issue the wrong 404 error on some operations, we should instead issue a bad request (e.g. if you try and create a role with a non-existent project, not a 404 project not found) | 15:54 |
| jamielennox | ayoung: yea, we may not have much choice on DOA because it's a library and so may be used with older versions of horizon - we just need to look at where to from here | 15:55 |
| *** lhcheng has joined #openstack-keystone | 15:56 | |
| *** lhcheng_ has joined #openstack-keystone | 15:57 | |
| *** _cjones_ has joined #openstack-keystone | 16:00 | |
| *** topol has joined #openstack-keystone | 16:00 | |
| *** fifieldt has quit IRC | 16:03 | |
| bknudson | morganfainberg: what does it mean to create a role with a non-existant project? | 16:04 |
| amakarov | ayoung, good day! I | 16:04 |
| amakarov | ayoung, good day! I've done pedigree check in trust chains | 16:05 |
| ayoung | amakarov, not yet you haven't | 16:05 |
| morganfainberg | bknudson, there is a bug where we issue a 404 when you're doing something like creating a user for a non-existent domain. this is because we do/did "get_domain" instead of sayin "oh domain doesn't exist, this is a bad request" | 16:05 |
| amakarov | ayoung, but I don't know how to test it ) | 16:05 |
| morganfainberg | bknudson, might have been fixed. | 16:05 |
| ayoung | ah..so not in a submiteed review...good | 16:06 |
| morganfainberg | bknudson, just was trying to communicate the concept, but LP is making finding that "fun". | 16:06 |
| ayoung | amakarov, OK, I think the right place to do it is in the get call | 16:06 |
| ayoung | amakarov, wrap this function: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/trust/core.py#n83 | 16:07 |
| ayoung | and check that, if it is a redelegated trust, do a get on the parent, etc | 16:07 |
| ayoung | and, on get, check that the roles etc are still valid | 16:07 |
| amakarov | ayoung, do parents care about redelegated trusts? | 16:08 |
| ayoung | amakarov, probably this logic here needs to move: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/trust/controllers.py#n69 | 16:08 |
| ayoung | amakarov, other way around: if a parent trust is invalid, so is the redelegate one | 16:09 |
| amakarov | ayoung, if I move delete logic to controller, notification event won't be fired | 16:09 |
| ayoung | amakarov, controller is the wrong place | 16:09 |
| amakarov | ayoung, agreed about descendants invalidation | 16:09 |
| ayoung | controller is really for binding to HTTP, but the common logic belongs in the manager | 16:09 |
| amakarov | ayoung, pardon, I'm about the manager ) | 16:10 |
| ayoung | amakarov, I'm all about the Pentiums myself | 16:10 |
| amakarov | It's manager's "delete" that is wrapped in notification | 16:10 |
| *** bdossant has quit IRC | 16:11 | |
| amakarov | ayoung, I have to create trust delete notification manually if logic moved to manager | 16:12 |
| ayoung | amakarov, it belongs in the manager anyway | 16:12 |
| ayoung | amakarov, here's the thing: oauth and trusts should use the same code | 16:12 |
| *** saipandi has joined #openstack-keystone | 16:12 | |
| ayoung | the trusts implementation is really the generic delegation mechanism, and I expect it to be used regardless of the API called | 16:13 |
| ayoung | amakarov, think of the controller as the WEB API implementation, and the manager as the API agnostic logic | 16:13 |
| amakarov | ayoung, so all that trust hierarchy staff goes to manager, got it | 16:14 |
| ayoung | amakarov, yeah. Common code, regardless of where and how it is called | 16:14 |
| *** lhcheng has quit IRC | 16:15 | |
| *** lhcheng_ is now known as lhcheng | 16:15 | |
| ayoung | amakarov, and with that, I am off to get lunch and walk the dog. As part of your patch, make sure you have all sorts of tests for intermediate users getting disabled, the parent use losing roles that are in the trusts, and so forth. Test the living daylights out of this code. | 16:18 |
| *** ayoung is now known as ayoung-dogwalkin | 16:18 | |
| rodrigods | henrynash, lbragstad, think it's ready for +A =) https://review.openstack.org/#/c/117785/27 | 16:18 |
| *** dimsum_ has quit IRC | 16:20 | |
| *** dimsum_ has joined #openstack-keystone | 16:21 | |
| henrynash | rodigods: only one question I have after looking at it again, is the name ot the get_project_subtree() method…. | 16:24 |
| henrynash | rodigods: in returns a list….so in general we try and name methods that return a list something like “list_xyz” | 16:25 |
| *** dimsum_ has quit IRC | 16:25 | |
| henrynash | rodigods: a “get_xyz” style of naming is meant to return a single entity | 16:25 |
| *** ks-untriaged-bot has joined #openstack-keystone | 16:26 | |
| ks-untriaged-bot | Untriaged bugs for project keystone: | 16:26 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1381961 | 16:26 |
| uvirtbot | Launchpad bug 1381961 in keystone "Keystone API GET 5000/v3 returns wrong endpoint URL in response body" [Undecided,New] | 16:26 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1376937 | 16:26 |
| uvirtbot | Launchpad bug 1376937 in keystone "No way to prevent duplicates in endpoints" [Undecided,Confirmed] | 16:26 |
| ks-untriaged-bot | Untriaged bugs for project python-keystoneclient: | 16:26 |
| ks-untriaged-bot | https://bugs.launchpad.net/python-keystoneclient/+bug/1377080 | 16:26 |
| uvirtbot | Launchpad bug 1377080 in python-keystoneclient "Stale endpoint selection logic in keystone client" [Undecided,In progress] | 16:26 |
| ks-untriaged-bot | https://bugs.launchpad.net/python-keystoneclient/+bug/1372710 | 16:26 |
| uvirtbot | Launchpad bug 1372710 in python-keystoneclient "cfn-push-stats fails to authenticate" [Undecided,Incomplete] | 16:26 |
| ks-untriaged-bot | https://bugs.launchpad.net/python-keystoneclient/+bug/1357567 | 16:26 |
| uvirtbot | Launchpad bug 1357567 in python-keystoneclient "auth_ref caching/retrieving is failing - user needs to provide password for every command" [Undecided,New] | 16:26 |
| *** ks-untriaged-bot has quit IRC | 16:26 | |
| henrynash | rodigods: now there a plenty of places where we break that rule :-)….but we have been trying to keep to it more recently | 16:27 |
| lhcheng | rodigods: I just noticed that you’re submitting the patch to feature/hierarchical-multitenancy branch instead of master. What does that mean? | 16:28 |
| morganfainberg | lhcheng, it's a feature branch | 16:28 |
| morganfainberg | lhcheng, once it's all merged we'll move it over to master | 16:28 |
| morganfainberg | lhcheng, this allowed them to work on it w/o needing -2s etc to prevent merging late in Juno | 16:29 |
| *** zzzeek has joined #openstack-keystone | 16:31 | |
| jamielennox | alright, see everyone tomorrow | 16:34 |
| *** marcoemorais has joined #openstack-keystone | 16:36 | |
| *** jamielennox has quit IRC | 16:37 | |
| *** wwriverrat has joined #openstack-keystone | 16:38 | |
| openstackgerrit | A change was merged to openstack/keystone-specs: Enable tests on non-SQLite databases https://review.openstack.org/126370 | 16:42 |
| lhcheng | morganfainberg, ah that makes sense. Is there already a target milestone for this feature? :) | 16:42 |
| morganfainberg | lhcheng, I would hope by the summit. | 16:42 |
| morganfainberg | or at least to have it completly merged to the topic branch. | 16:42 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/python-keystoneclient: Endpoint selection logic fix https://review.openstack.org/125923 | 16:43 |
| lhcheng | morganfainberg, cool looking forward to it! | 16:44 |
| * lhcheng mind blown about hierarchical project + inherited roles | 16:45 | |
| *** thedodd has joined #openstack-keystone | 16:47 | |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: PKI and PKIZ tokens unnecessary whitespace removed https://review.openstack.org/120043 | 16:49 |
| rodrigods | lhcheng, we have this feature branch, to get everything from HM in place | 16:56 |
| rodrigods | once all patches are approved, we are going to get it merged to master | 16:56 |
| *** marcoemorais has quit IRC | 17:00 | |
| *** jsavak has joined #openstack-keystone | 17:02 | |
| *** gyee has quit IRC | 17:03 | |
| *** marcoemorais has joined #openstack-keystone | 17:03 | |
| *** radez is now known as radez_g0n3 | 17:04 | |
| rodrigods | henrynash, just replied at your comment in the HM patch | 17:10 |
| *** thedodd has quit IRC | 17:11 | |
| *** topol has quit IRC | 17:14 | |
| *** harlowja_away is now known as harlowja | 17:14 | |
| *** aix has quit IRC | 17:18 | |
| *** richm has joined #openstack-keystone | 17:22 | |
| *** ayoung-dogwalkin is now known as ayoung | 17:26 | |
| ayoung | rodrigods, I'm not going to make you rework it, but I really don't like how you split up that patch and the follow on. Yes, smaller patches are good, but there has to be some logical consistency to the patches. Always think "if this one gets in, but the follow on one doesn't, does the first patch make sense?" | 17:28 |
| *** wwriverrat has left #openstack-keystone | 17:29 | |
| rodrigods | ayoung, ++ that was a difficult decision to make, I was aware about this issue | 17:29 |
| ayoung | rodrigods, I've been guilty of some hugh-mong-us patches in my time | 17:29 |
| rodrigods | ayoung, actually, it fitted better our internal tasks and was how it would be better split | 17:30 |
| rodrigods | but... yeah | 17:30 |
| ayoung | fair enough | 17:30 |
| *** marcoemorais has quit IRC | 17:32 | |
| *** jacer_huawei has quit IRC | 17:32 | |
| openstackgerrit | A change was merged to openstack/keystone: Remove unused ec2 driver option https://review.openstack.org/124810 | 17:34 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Changing the value type of http_connect_timeout https://review.openstack.org/126543 | 17:34 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Sync oslo libraries https://review.openstack.org/129637 | 17:34 |
| *** marcoemorais has joined #openstack-keystone | 17:38 | |
| *** topol has joined #openstack-keystone | 17:42 | |
| *** afazekas has joined #openstack-keystone | 17:43 | |
| *** amcrn has joined #openstack-keystone | 17:43 | |
| *** jacer_huawei has joined #openstack-keystone | 17:48 | |
| lbragstad | if anyone is itching to take on a review, I'd appreciate any feedback on the XML removal stuff https://review.openstack.org/#/c/125738/ | 17:52 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:52 | |
| lbragstad | failing tests because the proposed changes to Tempest/Devstack haven't been merged yet, they want to see a couple +2s on the Keystone patch first. | 17:53 |
| *** toddnni has quit IRC | 18:01 | |
| *** toddnni has joined #openstack-keystone | 18:02 | |
| *** toddnni has quit IRC | 18:06 | |
| *** afazekas has quit IRC | 18:08 | |
| *** thedodd has joined #openstack-keystone | 18:10 | |
| *** dimsum_ has joined #openstack-keystone | 18:11 | |
| *** afazekas has joined #openstack-keystone | 18:15 | |
| *** arunkant has joined #openstack-keystone | 18:20 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:21 | |
| openstackgerrit | A change was merged to openstack/keystone: Add max-complexity to pep8 for Keystone https://review.openstack.org/129143 | 18:22 |
| *** thedodd has quit IRC | 18:27 | |
| *** amakarov is now known as amakarov_away | 18:35 | |
| *** afazekas has quit IRC | 18:38 | |
| *** Guest52830 is now known as mgagne | 18:42 | |
| *** mgagne has joined #openstack-keystone | 18:42 | |
| *** zzzeek has quit IRC | 18:48 | |
| *** zzzeek has joined #openstack-keystone | 18:49 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Use oslo.serialization https://review.openstack.org/129641 | 18:53 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Use oslo tests fixture https://review.openstack.org/129643 | 18:53 |
| morganfainberg | ayoung, do you have a token constraints BP registered yet? or jus thr spec proposed? | 18:55 |
| *** nkinder has quit IRC | 18:56 | |
| ayoung | BP? No | 18:56 |
| ayoung | just the spec | 18:56 |
| morganfainberg | ayoung, ok cool | 18:56 |
| morganfainberg | ayoung, thanks :) | 18:56 |
| ayoung | morganfainberg, I was trying to get all of my specs up to date, then was going to get the BPs in sync, but people keep reviewing my specs (good) and -1ing them (dagnabit) | 18:56 |
| morganfainberg | ayoung, works for me | 18:56 |
| morganfainberg | ayoung, no rush. | 18:56 |
| morganfainberg | for theBPs that is | 18:57 |
| *** afaranha has quit IRC | 18:59 | |
| *** navid_ has joined #openstack-keystone | 18:59 | |
| *** raildo has quit IRC | 19:00 | |
| *** samuelms has quit IRC | 19:01 | |
| breton | somethig was happening to Alembic bp | 19:01 |
| morganfainberg | breton, i was just classifying it | 19:01 |
| morganfainberg | i'm doing BP cleanup | 19:01 |
| morganfainberg | and wanted to make sure it wasn't punted because it *is* something we want. | 19:02 |
| breton | oh, ok. I'm still on it, btw. I was reading docs and doing some experiments | 19:02 |
| morganfainberg | ++ | 19:02 |
| morganfainberg | yep, keep working on it. :) | 19:02 |
| morganfainberg | dstanek, is https://blueprints.launchpad.net/keystone/+spec/failing-tests still something you're working on? | 19:04 |
| morganfainberg | dstanek, or something i should deprioritize for now. | 19:04 |
| morganfainberg | ayoung, is ^ that BP something we even still need/want? (I can still see value there) | 19:05 |
| *** samuelms has joined #openstack-keystone | 19:05 | |
| *** raildo has joined #openstack-keystone | 19:05 | |
| ayoung | morganfainberg, that was registered as the result of a discussion about how to deal with bugs and test failures | 19:06 |
| *** afaranha has joined #openstack-keystone | 19:06 | |
| morganfainberg | ayoung, right. it's reasonable, i'm happy to see something like that | 19:06 |
| ayoung | so, yeah, I think it should be done, but not certain about priority | 19:06 |
| morganfainberg | k i'll just set it to "not" for now | 19:07 |
| morganfainberg | henrynash, ping did: https://blueprints.launchpad.net/keystone/+spec/fetch-policy-by-endpoint get implemented? | 19:08 |
| dstanek | morganfainberg: I actually implemented it last week, bit didn't have a chance to push the commit | 19:08 |
| morganfainberg | dstanek, oh cool will prio it as low and tag to kilo-1 then. awesome | 19:09 |
| morganfainberg | so interestingly, new OS X seems to have increased my battery life on my laptop from ~4hrs to ~6h with normal web use + IRC | 19:10 |
| morganfainberg | dolphm, ^ same question i asked henrynash. I want to say it was implemented... | 19:12 |
| dstanek | I found the same thing after an update. | 19:12 |
| morganfainberg | but.. honestly, i can't find the code. | 19:12 |
| morganfainberg | dstanek, don't get me wrong, I'm not complaining at all! :) | 19:12 |
| dolphm | morganfainberg: i don't think so | 19:13 |
| morganfainberg | dolphm, ok i'll tag it as something we need to pull forward to kilo | 19:13 |
| morganfainberg | thanks | 19:13 |
| dolphm | morganfainberg: just a heads up, i'm working on unwinding the hard dep that our functional tests have on XML translation | 19:17 |
| morganfainberg | dolphm, ++ awesome. | 19:17 |
| dolphm | morganfainberg: per the confused email on the thread. hoping to respond with a patch | 19:17 |
| dolphm | on the list* | 19:17 |
| morganfainberg | yeah saw the mail, thanks for jumpin on that one | 19:17 |
| *** stevemar has quit IRC | 19:19 | |
| morganfainberg | woot, blueprint list is starting to look a lot more manageable | 19:22 |
| *** andreaf has joined #openstack-keystone | 19:28 | |
| *** radez_g0n3 is now known as radez | 19:30 | |
| ayoung | what is our approach to XML going to be? | 19:34 |
| morganfainberg | ayoung, i think the right answer is what we discussed last week, middleware/pluggable system (Pecan?) that we can just write a renderer for | 19:35 |
| *** g4rg4m3|_ has quit IRC | 19:36 | |
| ayoung | morganfainberg, that was HTML. Pecan already does XML, but I am guessing it will differ (subtly? substantially) from the XML Keystone produced in the past | 19:36 |
| morganfainberg | ayoung, we've deprecated the old XML | 19:36 |
| morganfainberg | it's done, it's being removed in Juno | 19:36 |
| morganfainberg | erm | 19:37 |
| morganfainberg | Kilo | 19:37 |
| rodrigods | lhcheng, there? | 19:37 |
| morganfainberg | so if we're supporting something *new* like Pecan version of XML, that'll need to be communicated (release notes? documentation? etc?). but i think the answer is the same as HTML | 19:37 |
| ayoung | morganfainberg, I think we found that moving to Pecan/WSME rendering was going to affect out JSON processing. | 19:37 |
| lhcheng | rodrigods: hey! | 19:38 |
| morganfainberg | ayoung, pecan/wsme isn't the only option (Falcon?). but our approach should be the same. | 19:38 |
| *** miqui has joined #openstack-keystone | 19:38 | |
| morganfainberg | something pluggable not what we had. | 19:38 |
| ayoung | Falcon? Is it Blue? | 19:38 |
| morganfainberg | lol | 19:38 |
| rodrigods | lhcheng, regarding your comment about the ABOVE part in the api | 19:39 |
| rodrigods | do you have suggestions to improve it? Its indeed only the parents, the childs will not appear | 19:39 |
| ayoung | morganfainberg, is there any demand for XML? If so, from whom, and will changing the rendering render the point moot? | 19:40 |
| morganfainberg | ayoung, afaik, no. | 19:41 |
| morganfainberg | we've deprecated it and if they really need XML they could use the JSONx *duck* | 19:41 |
| morganfainberg | mechanism. | 19:41 |
| morganfainberg | i mean... | 19:41 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Fix reference to middleware architecture doc https://review.openstack.org/127078 | 19:44 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Remove HTTP_X_STORAGE_TOKEN doc https://review.openstack.org/127083 | 19:44 |
| lhcheng | rodrigods: If I request for the the current project selected to GET is a 3rd level child, should it show the parent going up Level 2 and Level 1 in a list or ju? | 19:44 |
| lhcheng | ** If I request for the “parents” of the current project (a 3rd level child), should it show the parent going up Level 2 and Level 1 in a list or just the direct parents? | 19:45 |
| lhcheng | rodrigods: not sure which one is better, just throwing some thoughts to think about in the API design. | 19:46 |
| morganfainberg | ayoung, https://blueprints.launchpad.net/keystone/+spec/kerberos-authentication this BP is effectively implemented right? | 19:47 |
| rodrigods | lhcheng, each project has only one parent. And the regular project object already has the direct parent_id. | 19:48 |
| ayoung | not yet | 19:51 |
| ayoung | morganfainberg, still need to get the client side going, but I guess that is only server side | 19:52 |
| morganfainberg | yeah | 19:52 |
| morganfainberg | that was my thought | 19:52 |
| ayoung | morganfainberg, but... | 19:52 |
| ayoung | morganfainberg, the way I am handling it now is hackish, and not the good kind | 19:52 |
| ayoung | bascially, just a separate AUTH_URL | 19:52 |
| ayoung | and no way to advertise | 19:52 |
| ayoung | but...yeah, that one as written is covered | 19:53 |
| morganfainberg | marked as implemented | 19:53 |
| *** navid_ has quit IRC | 19:53 | |
| lhcheng | rodrigods: understood. for example: If you have a hierarchy of Project A -> Project B -> Project C, then call GET /projects/<project C>?parents. Should we return [Project B, Project A] or just the direct parent of Project C? I think typical hierarchical API would just return the direct parent. And if the user want to traverse up, they need to make another call. | 19:54 |
| morganfainberg | ayoung, is this user's authenticating against an endpoint with a cert? an endpoint authenticating against keystone with a cert? something else? https://blueprints.launchpad.net/keystone/+spec/endpoint-cert | 19:55 |
| morganfainberg | part of token binding? | 19:55 |
| ayoung | morganfainberg, that was going to be the endpoints service user validating with a cert back to keystone | 19:55 |
| ayoung | here's what is going to happen | 19:56 |
| ayoung | we are going to get the X509 plugin from gyee and jamielennox is working on making middleware use an auth plugin | 19:56 |
| rodrigods | lhcheng, if you call GET /projects/<project C> it will return the project object, which will contain a parent_id field with <Project B>. If you want the whole list of parents, you call with the ?parents query, which will return an extra field called parents, that will contain a list with [Project B, Project A] | 19:56 |
| morganfainberg | the description just wasn't super useful. so just trying to update that before setting a prio on it | 19:56 |
| ayoung | that should support both kerberos and x509 auth from the endpoints | 19:56 |
| ayoung | wilco | 19:56 |
| *** nkinder has joined #openstack-keystone | 19:57 | |
| ayoung | morganfainberg, I've basically been using the Blueprints as a record of backlog items. | 19:58 |
| ayoung | Some of them have lingered for a while. but most are still valid concepts | 19:58 |
| morganfainberg | ayoung, thats fine, most of them i'm just pushing to the bottom of the pile, but if i can't figure out what they're meant to convey, it means likely only the person registering has a clue what they're meant to say | 20:00 |
| ayoung | ++ | 20:00 |
| morganfainberg | ayoung, and that makes them less than useful for anyone picking them up later | 20:00 |
| ayoung | morganfainberg, absolutely. | 20:00 |
| morganfainberg | i've also found a few you registered twice | 20:00 |
| morganfainberg | just slightly different name | 20:00 |
| morganfainberg | like 2 or 3 duplicates | 20:00 |
| morganfainberg | those i picked the one with more info and closed the other one. | 20:01 |
| morganfainberg | but like i said, most of yours i was going to leave alone since it's fine as a backlog for now (until we have something better) | 20:01 |
| * morganfainberg needs to find a new coffee shop. the music is so bad here today I can't even drown it out with headphones. | 20:02 | |
| rodrigods | morganfainberg, lol | 20:02 |
| morganfainberg | i've learned I *really* don't like "architecture in helsinki" as an artist | 20:02 |
| ayoung | morganfainberg, I'm at home, switching between Stan Getz and Gato Barbieri | 20:03 |
| morganfainberg | hehe | 20:03 |
| rodrigods | I did home office once, I miss those days =( | 20:03 |
| morganfainberg | rodrigods, i like it right until I want to *not* be at home. | 20:04 |
| *** stevemar has joined #openstack-keystone | 20:04 | |
| rodrigods | morganfainberg, that's why I'm member from a hackerspace in my city =D | 20:04 |
| morganfainberg | LA doesn't have good hackerspaces. | 20:04 |
| rodrigods | I like the one here (it's the only one), really small and friendly people | 20:05 |
| rodrigods | also with a lot of toys | 20:05 |
| lhcheng | rodrigods: missed the part about the GET /projects/<project_id> already includes the parent_id there. You can ignore my comment :P | 20:05 |
| rodrigods | lhcheng, np =P | 20:05 |
| rodrigods | lhcheng, suggestions about how to write the phrase that explains the ?parent param? | 20:06 |
| *** _cjones_ has quit IRC | 20:06 | |
| *** _cjones_ has joined #openstack-keystone | 20:06 | |
| *** harlowja is now known as harlowja_away | 20:10 | |
| lhcheng | rodrigods: Instead of “ABOVE its hierarchy”, perhaps something like “walking/traversing up its hierarchy.” | 20:13 |
| rodrigods | lhcheng, ++ | 20:14 |
| *** jsavak has quit IRC | 20:16 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/identity-api: API documentation for Hierarchical Multitenancy https://review.openstack.org/111355 | 20:17 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/identity-api: API documentation for Inherited Roles to Projects https://review.openstack.org/129445 | 20:17 |
| *** joesavak has joined #openstack-keystone | 20:17 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/identity-api: API documentation for Hierarchical Multitenancy https://review.openstack.org/111355 | 20:18 |
| *** david-lyle has joined #openstack-keystone | 20:18 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/identity-api: API documentation for Inherited Roles to Projects https://review.openstack.org/129445 | 20:19 |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 20:22 | |
| *** HenryG has quit IRC | 20:23 | |
| morganfainberg | dolphm, i think https://blueprints.launchpad.net/keystone/+spec/external-auth-plugins this has been implemented? | 20:31 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Use oslo tests fixture https://review.openstack.org/129643 | 20:34 |
| *** drjones has joined #openstack-keystone | 20:35 | |
| *** dimsum_ has quit IRC | 20:37 | |
| morganfainberg | stevemar, topol, which one: https://blueprints.launchpad.net/keystone/+spec/cadf-notifications-everywhere or https://blueprints.launchpad.net/keystone/+spec/cadf-project-operations | 20:38 |
| *** dimsum_ has joined #openstack-keystone | 20:38 | |
| morganfainberg | stevemar, topol, i'm leaning towards the "everywhere" one | 20:38 |
| stevemar | errrrwhere | 20:38 |
| topol | Im having a deja vous | 20:38 |
| *** _cjones_ has quit IRC | 20:39 | |
| topol | didnt you ask this last week :-) | 20:39 |
| morganfainberg | topol, stevemar, yes... and no one fixed it | 20:39 |
| topol | everywhere. if your gonna be a bear, be a grizzly | 20:39 |
| topol | doh! | 20:39 |
| morganfainberg | topol, stevemar, so this was the "ok i'm fixing it" | 20:39 |
| topol | how do we fix? | 20:39 |
| morganfainberg | stevemar, go take a look at the Keystone bp page ;) | 20:39 |
| morganfainberg | topol, i marked the project one a superseded by the everywhere one | 20:39 |
| *** dimsum_ has quit IRC | 20:42 | |
| *** gyee has joined #openstack-keystone | 20:45 | |
| *** radez is now known as radez_g0n3 | 20:52 | |
| *** david-lyle has quit IRC | 20:56 | |
| *** radez_g0n3 is now known as radez | 20:57 | |
| *** david-lyle has joined #openstack-keystone | 20:57 | |
| openstackgerrit | A change was merged to openstack/keystone-specs: Create specification for CADF everywhere https://review.openstack.org/128780 | 21:00 |
| *** jsavak has joined #openstack-keystone | 21:03 | |
| *** saipandi has quit IRC | 21:05 | |
| *** joesavak has quit IRC | 21:06 | |
| *** jsavak has quit IRC | 21:15 | |
| *** alex_xu has quit IRC | 21:19 | |
| -openstackstatus- NOTICE: Zuul erroneously marked some changes as having merge conflicts. Those changes have been added to the check queue to be rechecked and will be automatically updated when complete. | 21:21 | |
| mfisch | anyone seen this before? "cms_hash_token() got an unexpected keyword argument 'mode'" | 21:23 |
| mfisch | my server is spewing that (am trying the latest keystone) | 21:23 |
| *** jacer_huawei has quit IRC | 21:24 | |
| *** jacer_huawei has joined #openstack-keystone | 21:25 | |
| gyee | mfisch, which version of python-keystoneclient you have? | 21:26 |
| mfisch | I just upgraded it to the latest from UCA | 21:27 |
| mfisch | 0.10.1 | 21:27 |
| mfisch | okay it works fine if I go back a few days | 21:29 |
| mfisch | to the 16th | 21:29 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Kilo version of non-persistent token specification https://review.openstack.org/129736 | 21:29 |
| gyee | mfisch, maybe bknudson's md5 hash patch has landed a few days back? | 21:30 |
| morganfainberg | mfisch, that latest keystone might require 11.x of ksc | 21:30 |
| mfisch | hmm | 21:31 |
| morganfainberg | hm. | 21:31 |
| morganfainberg | not according to requirements.txt | 21:31 |
| gyee | bug? :) | 21:31 |
| morganfainberg | mfisch, can you use paste.openstack.org and paste the traceback? | 21:32 |
| morganfainberg | mfisch, i think you have a very old keystoneclient. | 21:33 |
| mfisch | I just upgraded to the latest in juno | 21:34 |
| mfisch | trying to see the patch set | 21:34 |
| morganfainberg | The mode kwarg was added back in like April. Been in place since 0.8.0 of keystone client for that method | 21:35 |
| mfisch | a package from last week works... thats why I'm looking at the diff | 21:36 |
| mfisch | how old is 0.8.0? | 21:36 |
| morganfainberg | mfisch, https://github.com/openstack/python-keystoneclient/commit/82359492dc14e679d48e6801da304027e508533c | 21:37 |
| mfisch | so just checked and 0.7.1 is default in trusty.. thought it was newer than that | 21:37 |
| morganfainberg | yeah 0.8 would be the minimum | 21:38 |
| morganfainberg | 0.8.0 | 21:38 |
| morganfainberg | juno should require 0.10.0 to work for trusty | 21:38 |
| morganfainberg | if not, it's a packaging error on the debian/ubuntu side | 21:38 |
| morganfainberg | s/trusty/any distro | 21:38 |
| mfisch | well keystone itself doesnt require the client | 21:39 |
| mfisch | as a package dep | 21:39 |
| mfisch | so its more like my fault | 21:39 |
| morganfainberg | mfisch, if you use pki it does. | 21:39 |
| morganfainberg | it is in the requirements.txt | 21:39 |
| morganfainberg | this likely *is* a packaging failure on the deb/ubuntu side. | 21:40 |
| morganfainberg | and potentially a long running one | 21:40 |
| *** gokrokve has joined #openstack-keystone | 21:40 | |
| mfisch | let me look | 21:40 |
| *** openstackgerrit has quit IRC | 21:40 | |
| morganfainberg | Havana, Icehouse, and Juno (or whenever we started depending on keystoneclient.cms in keystone) | 21:40 |
| *** packet has joined #openstack-keystone | 21:43 | |
| *** packet is now known as Guest29212 | 21:43 | |
| *** Guest29212 has quit IRC | 21:44 | |
| *** dimsum_ has joined #openstack-keystone | 21:45 | |
| mfisch | the latest from UCA requires 0.9.0 | 21:47 |
| mfisch | as a build-dep | 21:47 |
| mfisch | I'll let chuck know | 21:48 |
| *** radez is now known as radez_g0n3 | 21:48 | |
| *** marcoemorais has quit IRC | 21:48 | |
| *** marcoemorais has joined #openstack-keystone | 21:49 | |
| *** dims_ has joined #openstack-keystone | 21:49 | |
| *** dims_ has quit IRC | 21:51 | |
| *** dims_ has joined #openstack-keystone | 21:51 | |
| *** dimsum_ has quit IRC | 21:52 | |
| morganfainberg | mfisch, ok good not horribly broken. | 21:57 |
| morganfainberg | mfisch, bug juno should require https://github.com/openstack/keystone/blob/stable/juno/requirements.txt#L19 0.10.0 | 21:58 |
| *** marcoemorais has quit IRC | 21:58 | |
| *** marcoemorais has joined #openstack-keystone | 21:59 | |
| *** marcoemorais has quit IRC | 21:59 | |
| *** marcoemorais has joined #openstack-keystone | 21:59 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:04 | |
| *** topol has quit IRC | 22:06 | |
| *** marcoemorais has quit IRC | 22:10 | |
| *** HenryG has joined #openstack-keystone | 22:16 | |
| mfisch | hey morganfainberg what about this confusing statement I see now? | 22:17 |
| mfisch | /usr/lib/python2.7/dist-packages/sqlalchemy/sql/default_comparator.py:35: SAWarning: The IN-predicate on "assignment.actor_id" was invoked with an empty sequence. This results in a contradiction, which nonetheless can be expensive to evaluate. Consider alternative strategies for improved performance. | 22:18 |
| *** wwriverrat has joined #openstack-keystone | 22:18 | |
| mfisch | return o[0](self, self.expr, op, *(other + o[1:]), **kwargs) | 22:18 |
| *** wwriverrat has left #openstack-keystone | 22:18 | |
| *** wwriverrat1 has joined #openstack-keystone | 22:20 | |
| *** nellysmitt has quit IRC | 22:24 | |
| *** gordc has quit IRC | 22:25 | |
| *** david-lyle_ has joined #openstack-keystone | 22:26 | |
| *** david-lyle has quit IRC | 22:27 | |
| morganfainberg | mfisch: that is an awesome error | 22:29 |
| morganfainberg | Or warning. | 22:29 |
| mfisch | no stack on it though | 22:29 |
| morganfainberg | Nah. It's a warn. | 22:29 |
| morganfainberg | It is a "hay you're doing this wrong" message to us. | 22:30 |
| *** wwriverrat1 has left #openstack-keystone | 22:30 | |
| mfisch | EGETYOURSTUFFTOGETHER | 22:30 |
| *** david-lyle_ is now known as david-lyle | 22:35 | |
| *** openstackgerrit has joined #openstack-keystone | 22:42 | |
| openstackgerrit | A change was merged to openstack/pycadf: Sync oslo libraries https://review.openstack.org/129637 | 22:43 |
| *** marcoemorais has joined #openstack-keystone | 22:43 | |
| *** harlowja_away is now known as harlowja | 22:48 | |
| *** marcoemorais has quit IRC | 22:55 | |
| *** gokrokve_ has joined #openstack-keystone | 23:03 | |
| *** gokrokve has quit IRC | 23:03 | |
| *** marcoemorais has joined #openstack-keystone | 23:05 | |
| *** bknudson has quit IRC | 23:09 | |
| *** dims_ has quit IRC | 23:12 | |
| *** dimsum_ has joined #openstack-keystone | 23:13 | |
| *** dimsum_ has quit IRC | 23:17 | |
| openstackgerrit | A change was merged to openstack/pycadf: Use oslo.serialization https://review.openstack.org/129641 | 23:47 |
| *** gyee has quit IRC | 23:51 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 23:55 | |
| *** henrynash has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!