| *** bknudson has quit IRC | 00:01 | |
| *** stevemar has joined #openstack-keystone | 00:02 | |
| *** alex_xu has joined #openstack-keystone | 00:03 | |
| *** gyee has quit IRC | 00:06 | |
| *** bknudson has joined #openstack-keystone | 00:16 | |
| *** alex_xu has quit IRC | 00:18 | |
| *** alex_xu has joined #openstack-keystone | 00:18 | |
| *** marcoemorais has quit IRC | 00:18 | |
| *** marcoemorais has joined #openstack-keystone | 00:19 | |
| *** marcoemorais has quit IRC | 00:19 | |
| *** marcoemorais has joined #openstack-keystone | 00:19 | |
| *** marcoemorais has quit IRC | 00:20 | |
| *** marcoemorais has joined #openstack-keystone | 00:20 | |
| *** cjellick has quit IRC | 00:22 | |
| *** _cjones_ has quit IRC | 00:40 | |
| *** jorge_munoz has quit IRC | 00:47 | |
| wanghong | May I have a +A on these two patches: https://review.openstack.org/#/c/127110/, https://review.openstack.org/#/c/128197/. They are simple and have had a +2 long time. | 00:52 |
|---|---|---|
| *** stevemar has quit IRC | 01:01 | |
| *** stevemar has joined #openstack-keystone | 01:01 | |
| *** alex_xu has quit IRC | 01:02 | |
| *** david-lyle has joined #openstack-keystone | 01:03 | |
| *** HenryG has quit IRC | 01:04 | |
| *** HenryG_ has joined #openstack-keystone | 01:04 | |
| *** HenryG_ is now known as HenryG | 01:04 | |
| *** stevemar has quit IRC | 01:05 | |
| *** stevemar has joined #openstack-keystone | 01:05 | |
| *** marcoemorais has quit IRC | 01:06 | |
| *** dolphm has quit IRC | 01:07 | |
| *** lbragstad has quit IRC | 01:07 | |
| *** dtroyer has quit IRC | 01:07 | |
| *** Ephur has quit IRC | 01:07 | |
| *** dims__ has quit IRC | 01:08 | |
| *** d34dh0r53 has quit IRC | 01:08 | |
| *** lbragstad has joined #openstack-keystone | 01:08 | |
| *** marcoemorais has joined #openstack-keystone | 01:08 | |
| *** dims__ has joined #openstack-keystone | 01:08 | |
| *** rm_work has quit IRC | 01:08 | |
| *** hockeynut has quit IRC | 01:08 | |
| *** sigmavirus24 has quit IRC | 01:08 | |
| *** russellb has quit IRC | 01:09 | |
| *** mgagne has quit IRC | 01:10 | |
| *** dims__ has quit IRC | 01:13 | |
| *** dolphm has joined #openstack-keystone | 01:13 | |
| *** dims__ has joined #openstack-keystone | 01:13 | |
| *** d34dh0r53 has joined #openstack-keystone | 01:13 | |
| *** david-lyle has quit IRC | 01:13 | |
| *** Ephur has joined #openstack-keystone | 01:14 | |
| *** russellb has joined #openstack-keystone | 01:15 | |
| *** sigmavirus24_awa has joined #openstack-keystone | 01:16 | |
| *** dims__ has quit IRC | 01:17 | |
| *** hockeynut has joined #openstack-keystone | 01:21 | |
| *** lbragstad_ has joined #openstack-keystone | 01:21 | |
| *** mgagne has joined #openstack-keystone | 01:21 | |
| *** dtroyer has joined #openstack-keystone | 01:21 | |
| *** mgagne is now known as Guest76511 | 01:21 | |
| *** Guest76511 is now known as mgagne | 01:22 | |
| *** mgagne is now known as Guest51339 | 01:23 | |
| *** rm_work has joined #openstack-keystone | 01:23 | |
| *** shikui__ has quit IRC | 01:24 | |
| *** lbragstad has quit IRC | 01:26 | |
| *** lbragstad_ is now known as lbragstad | 01:26 | |
| *** chrisshattuck has quit IRC | 01:27 | |
| *** marcoemorais has quit IRC | 01:28 | |
| *** openstackgerrit has joined #openstack-keystone | 01:30 | |
| *** marcoemorais has joined #openstack-keystone | 01:36 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Change tenant to project https://review.openstack.org/127066 | 01:42 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Correct tests to use strings in conf https://review.openstack.org/128655 | 01:42 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Auth token supports deprecated names for paste conf options https://review.openstack.org/128656 | 01:42 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Change admin user to service user. https://review.openstack.org/127075 | 01:42 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Change occurrences of keystone to identity server https://review.openstack.org/127062 | 01:42 |
| *** marcoemorais has quit IRC | 01:43 | |
| ayoung | r1chardj0n3s, I tried running Angboard. The UI rendered, but the AJAX call never returned | 01:46 |
| ayoung | Running "watch" task | 01:48 |
| ayoung | Waiting... | 01:48 |
| ayoung | Fatal error: spawn ENOENT | 01:48 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Change tenant to project https://review.openstack.org/127066 | 01:48 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Change admin user to service user. https://review.openstack.org/127075 | 01:48 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Fix paste config option conversion for auth options https://review.openstack.org/131914 | 01:48 |
| ayoung | r1chardj0n3s, I think that making fauxstack into a wsgi should be pretty simple, no? | 01:53 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: I18n https://review.openstack.org/131287 | 02:00 |
| *** richm has quit IRC | 02:01 | |
| ayoung | port :35729 eh | 02:02 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Add release notes https://review.openstack.org/131916 | 02:04 |
| *** Kui has joined #openstack-keystone | 02:08 | |
| r1chardj0n3s | ayoung: hi, sorry, was napping. | 02:11 |
| ayoung | r1chardj0n3s, no problem | 02:11 |
| r1chardj0n3s | ayoung: (seem to have caught a cold in time for Paris, yay!) | 02:11 |
| ayoung | I figured out part of it: opened port :35729 | 02:11 |
| r1chardj0n3s | ayoung: fauxstack *is* a wsgi app, you just need to hook into it the correct way | 02:11 |
| ayoung | but I think the real issue is fauxstack | 02:11 |
| ayoung | I run it like this: | 02:12 |
| ayoung | grunt serve --keystone-url=http://$HOSTNAME:5000/v2.0 | 02:12 |
| r1chardj0n3s | what's that port for? is that liveReload? | 02:12 |
| r1chardj0n3s | yep | 02:12 |
| ayoung | yeah | 02:12 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Add release notes https://review.openstack.org/131916 | 02:12 |
| ayoung | OK...so let me see what I get from Curl | 02:12 |
| r1chardj0n3s | right; could probably put in an option to turn it off if it breaks | 02:12 |
| r1chardj0n3s | but it's too damn useful when developing ;) | 02:12 |
| ayoung | keystone/RegionOne/ | 02:13 |
| ayoung | just seems to han on | 02:14 |
| r1chardj0n3s | if you want to run the proxy as a separate wsgi thing, then you could use fauxstack.main.proxy_app in a regular WSGI setup | 02:14 |
| ayoung | curl http://horizon.younglogic.net:9000/api | 02:14 |
| *** david-lyle has joined #openstack-keystone | 02:14 | |
| ayoung | how do I debug? | 02:14 |
| r1chardj0n3s | flask.log? | 02:14 |
| r1chardj0n3s | it should give you debug info on what the proxy is doing | 02:14 |
| ayoung | where is that stuck? | 02:14 |
| r1chardj0n3s | cwd to the grunt serve command | 02:15 |
| ayoung | nothing there | 02:15 |
| r1chardj0n3s | that would imply flask isn't even being started... | 02:15 |
| ayoung | would that explain the ENOENT | 02:15 |
| r1chardj0n3s | do you see "Logging to flask.log" in the grunt serve output? | 02:15 |
| ayoung | Running "flask" task | 02:15 |
| ayoung | Starting Flask proxy server. | 02:15 |
| ayoung | Running "watch" task | 02:15 |
| ayoung | Waiting... | 02:15 |
| ayoung | Fatal error: spawn ENOENT | 02:15 |
| ayoung | Fatal error: connect ECONNREFUSED | 02:15 |
| ayoung | Fatal error: socket hang up | 02:15 |
| ayoung | Fatal error: connect ECONNREFUSED | 02:15 |
| ayoung | Fatal error: socket hang up | 02:15 |
| r1chardj0n3s | yiles, yeah, wtf? | 02:16 |
| r1chardj0n3s | that's the proxy failing to start up | 02:16 |
| ayoung | fauxstack? | 02:16 |
| r1chardj0n3s | ENOENT ... hmm | 02:16 |
| r1chardj0n3s | yeah | 02:16 |
| ayoung | so how can I run just the proxy? | 02:16 |
| r1chardj0n3s | yep, so just: | 02:16 |
| r1chardj0n3s | activate the venv | 02:16 |
| r1chardj0n3s | (.node-virtualenv) | 02:16 |
| r1chardj0n3s | and run "python run_fauxstack.py" to see if that works at all | 02:17 |
| ayoung | I'm missing .node-virtualenv | 02:18 |
| r1chardj0n3s | right, that should have been created with "npm install" | 02:18 |
| r1chardj0n3s | please run "npm install" and check for errors | 02:18 |
| ayoung | sudo npm install -g grunt-cli bower ? | 02:18 |
| r1chardj0n3s | uh, do you have Python 3.4? | 02:18 |
| ayoung | why sudo? | 02:18 |
| r1chardj0n3s | no | 02:18 |
| *** lhcheng has quit IRC | 02:18 | |
| ayoung | 3.3 | 02:18 |
| r1chardj0n3s | in the install instructions, there's two npm install commands | 02:18 |
| *** david-lyle has quit IRC | 02:19 | |
| r1chardj0n3s | ok, please git pull, I've just relaxed the python version requirement | 02:19 |
| r1chardj0n3s | I had it pinned to 3.4 rather unreasonably | 02:19 |
| r1chardj0n3s | sorry about that | 02:19 |
| ayoung | how do I do a clean setup no? | 02:20 |
| ayoung | now | 02:20 |
| r1chardj0n3s | but yeah, in the install, there's two npm installation invocations required, because some of the commands *must* be installed "globally" in /usr/local, but the rest can be local (node just doesn't have a venv solution like python, sadly) | 02:20 |
| r1chardj0n3s | just re-run the install commands, should work | 02:20 |
| ayoung | k | 02:20 |
| r1chardj0n3s | the three install commands in the README that is | 02:20 |
| ayoung | sudo npm install -g grunt-cli bower | 02:20 |
| ayoung | ? | 02:20 |
| ayoung | Ok | 02:20 |
| r1chardj0n3s | yup | 02:20 |
| r1chardj0n3s | and the next two | 02:20 |
| r1chardj0n3s | just to be sure | 02:20 |
| ayoung | that is some scary listing | 02:20 |
| r1chardj0n3s | they're smart enough to understand that stuff might already be installed | 02:21 |
| ayoung | is that all the 304s? | 02:21 |
| r1chardj0n3s | yeah, node folk loves them their many, small dependencies | 02:21 |
| r1chardj0n3s | yeah, there's caching up the wazoo | 02:21 |
| ayoung | OK, I see python3 stuff that seems to be working | 02:21 |
| r1chardj0n3s | \o/ | 02:21 |
| r1chardj0n3s | again, sorry about that 3.4 pinning | 02:22 |
| r1chardj0n3s | :( | 02:22 |
| ayoung | Creating /opt/angboard/.node-virtualenv | 02:22 |
| ayoung | no problem. I ignored it at my own peril | 02:22 |
| ayoung | 'swhat happens when you work roung midnight | 02:22 |
| r1chardj0n3s | yeah | 02:22 |
| ayoung | Running "watch" task | 02:23 |
| ayoung | Waiting... | 02:23 |
| ayoung | OK...let's see | 02:23 |
| r1chardj0n3s | ayoung: thanks for giving it a go; if you have any comments about how to make stuff better I'd love to know :) | 02:23 |
| ayoung | SCHWEET! | 02:24 |
| r1chardj0n3s | win? | 02:24 |
| ayoung | http://horizon.younglogic.net:9000/#/home | 02:24 |
| r1chardj0n3s | \o/ | 02:24 |
| ayoung | OK, how do I log out? | 02:24 |
| r1chardj0n3s | there should be a logout link in the sidebar | 02:25 |
| ayoung | Got it | 02:25 |
| ayoung | I think the demo account is borked | 02:25 |
| ayoung | admin works though | 02:25 |
| r1chardj0n3s | works for me, though I don't know the password ;) | 02:25 |
| ayoung | r1chardj0n3s, OK...so where is the Keystone stuff? | 02:26 |
| r1chardj0n3s | I don't think I've actually had two people going thru the proxy at once - nice to know that bit works ;) | 02:26 |
| ayoung | Heh | 02:26 |
| r1chardj0n3s | keystone is implemented in app/scripts/controllers/keystone.js | 02:27 |
| ayoung | This is the way Horizon should have been built from the Get go | 02:27 |
| ayoung | OK...let me see if I can make it work with V3 | 02:27 |
| ayoung | so we get domains, and Kerberos... | 02:27 |
| r1chardj0n3s | but note, there's keystone login hacks in the proxy to cache the service catalog, I don't know whether that will need to change at all | 02:27 |
| r1chardj0n3s | the service catalog caching is required so that the proxy can correctly map actions to the appropriate token-specific URLs that are in the catalog for each user :/ | 02:28 |
| ayoung | yes it will | 02:28 |
| ayoung | let me look....all that is in fauxstack right? | 02:29 |
| r1chardj0n3s | in fauxstack/proxy.py | 02:29 |
| ayoung | should be pretty similary | 02:29 |
| ayoung | the service catalog looks the same | 02:29 |
| r1chardj0n3s | # spy on serviceCatalog responses | 02:29 |
| r1chardj0n3s | if service == 'keystone' and file == 'tokens' and \ | 02:29 |
| r1chardj0n3s | that bit :) | 02:29 |
| ayoung | so on V3 the login goes to /v3/auth/tokens | 02:30 |
| ayoung | instead of /v3/tokens | 02:30 |
| ayoung | and the response is...well different JSON | 02:30 |
| r1chardj0n3s | well, that's what versioning is for ;) | 02:31 |
| ayoung | yeah | 02:31 |
| ayoung | so I think the only thing that needs to change is | 02:31 |
| ayoung | # spy on serviceCatalog responses | 02:31 |
| ayoung | r1chardj0n3s, and we can use My javascript to show it... | 02:32 |
| r1chardj0n3s | cool | 02:32 |
| ayoung | r1chardj0n3s, you have firebug installed, I suppose? | 02:32 |
| r1chardj0n3s | erm, hang on, I'll start firefox :) | 02:33 |
| ayoung | heh...do that Kinit I had you do yesterday too | 02:33 |
| r1chardj0n3s | yep | 02:34 |
| ayoung | password would work too, actually, but it would be good to show you the difference | 02:34 |
| ayoung | so | 02:34 |
| ayoung | https://keystone.younglogic.net/keystone/cops/# is a slightly different Keystone setup | 02:34 |
| ayoung | it actually talks to the same LDAP server as horizon.younglogic.net, but I chose different defaults when setting it up, etc | 02:35 |
| ayoung | the biggest difference with IPA/LDAP is that in this one the domain is YOUNGLOGIC.NET, whereas I had to drop the .NET for the one I'm demoing next week | 02:35 |
| ayoung | anyway, you remember how to get an unscoped token, then list tokens, then get a scoped token? | 02:36 |
| r1chardj0n3s | k | 02:36 |
| r1chardj0n3s | yep, clicky clicky | 02:36 |
| ayoung | take at look at the JSON response in firebug, and you'll see the diff in the scoped token | 02:36 |
| *** alex_xu has joined #openstack-keystone | 02:37 | |
| ayoung | http://paste.fedoraproject.org/146372/41463671/ | 02:38 |
| ayoung | token.catalog.endpoints | 02:38 |
| ayoung | token.catalog[0].endpoints for Keystone | 02:39 |
| r1chardj0n3s | yup | 02:39 |
| r1chardj0n3s | I must be missing something, I'm looking at the net traffic for the "Get Token" bit and there's no identifying information at all being POSTed to keystone, just {"auth":{"identity":{"methods":["kerberos"],"kerberos":{}}}} | 02:41 |
| r1chardj0n3s | I see a www-negotiate in response - I guess the krb plugin is doing magic? | 02:41 |
| ayoung | Yep | 02:49 |
| ayoung | ok, here's what happens | 02:50 |
| ayoung | first, it sends the request with just the negotiate, and gets back the 403 | 02:50 |
| *** Kui has quit IRC | 02:50 | |
| ayoung | the first time that the browser gets the 403, it goes to the kerberser server (KDC) and gets a service ticket | 02:51 |
| ayoung | that service ticket has enough info in it that only the user and the remote server can decrypt the data that gets sent...its a key sharing mechanism | 02:51 |
| r1chardj0n3s | ah ok | 02:52 |
| ayoung | so that 403 has a challenge in it, and the browser uses the info in the ticket to respond | 02:52 |
| ayoung | the challenge tells the browser that the server is the right place, and the response does the same for the server | 02:52 |
| ayoung | its 2 way authentication | 02:52 |
| ayoung | which is a hell of a lot safer than sending your password to some (possibly Phished) site | 02:53 |
| ayoung | and getting back "Sure! come on in and give me your credit card while you are at it!" | 02:53 |
| *** david-lyle has joined #openstack-keystone | 02:53 | |
| ayoung | there is a place on firebug you can see more details...I'm a lookin | 02:54 |
| ayoung | if you click get token you can quickly see the 401 (not 403, sorry) | 02:57 |
| r1chardj0n3s | yeah, I see that flashing by :) | 02:57 |
| ayoung | this one is set up with https | 02:58 |
| *** david-lyle has quit IRC | 02:58 | |
| ayoung | I didn't do that for horizon.younglogic.net yet | 02:58 |
| ayoung | anywy, first step is to get V3 working instead of v2, as that will let us do domains | 02:58 |
| *** alex_xu has quit IRC | 02:58 | |
| r1chardj0n3s | ok | 02:59 |
| r1chardj0n3s | shouldn't be too hard | 02:59 |
| ayoung | then next step is to be able to switch to kerberos for auth, and to deal with getting an unscoped token | 02:59 |
| ayoung | your logic is based on SQL, where default project is set, and you always get a scoped token | 02:59 |
| ayoung | but for LDAP, that is not going to be the case | 02:59 |
| ayoung | without a scoped token, you get no service catalog | 02:59 |
| ayoung | So you could do something like this: | 02:59 |
| ayoung | get the token, look to see if it is scoped, if not, list projects (same base AUTH_URL) and select the first one | 03:00 |
| ayoung | that is what Horizon does | 03:00 |
| ayoung | also, you can use that list to populat a drop down, and let people swap which token they have active. But... | 03:00 |
| ayoung | there is some issues with Policy, and we want to be able to let people select which token to use for what. See, domain level operations require a domain token, and Horizon has no way to support that | 03:01 |
| ayoung | but...that can be down the road | 03:02 |
| r1chardj0n3s | still a bit of work to go then :) | 03:02 |
| ayoung | this is cool....very cool | 03:02 |
| ayoung | nkinder, are you still awake? | 03:02 |
| nkinder | ayoung: yep | 03:02 |
| ayoung | nkinder, I've got the javascript code that r1chardj0n3s wrote up and running here: | 03:02 |
| ayoung | http://horizon.younglogic.net:9000/#/home | 03:02 |
| nkinder | ayoung: angboard? | 03:02 |
| ayoung | nkinder, yes | 03:02 |
| ayoung | nkinder, give a sec | 03:02 |
| ayoung | server keeps keicking me out and killing the webserver | 03:03 |
| ayoung | oh, wait, getting address already in use, maybe it didn't kill it? | 03:03 |
| nkinder | ayoung: it's up | 03:03 |
| *** david-lyle has joined #openstack-keystone | 03:04 | |
| ayoung | nkinder, tenant = admin, user = admin, same password as you've been using | 03:04 |
| ayoung | nkinder, we were just discussing the steps to Kerberos. Shouldn't be too bad | 03:04 |
| nkinder | I like that I can see my token contents | 03:05 |
| ayoung | nkinder, so he has a proxy running called fauxstack. It routes all of the traffic through one server | 03:05 |
| ayoung | so, would still be S4U2 I think | 03:05 |
| nkinder | ayoung: what about the other approach we were discussing about handing a token off to the dashboard? | 03:06 |
| ayoung | nkinder, its basically the same thing | 03:07 |
| nkinder | that could get us SAML and other federation schemes | 03:07 |
| ayoung | this could do it as well...probably could use the same Javascript | 03:07 |
| ayoung | Both are using Angular.js | 03:07 |
| *** david-lyle has quit IRC | 03:08 | |
| ayoung | nkinder, we could still drop the proxy and go direct to Keystone, it just brings in all of the CORS requirements to do that | 03:08 |
| r1chardj0n3s | yeah, ugh, cors | 03:09 |
| ayoung | this lets the Javascript development move forward without solving CORS up front | 03:09 |
| r1chardj0n3s | there's also the cookie thing which makes working with swift a lot easier | 03:09 |
| ayoung | r1chardj0n3s, I'm trying to make that a feature of auth_token middleware so we can do it with all of the services | 03:10 |
| r1chardj0n3s | ayoung: you're still trying to push that? | 03:10 |
| ayoung | the cookie thing? Just one of many irons in the forgre | 03:10 |
| *** openstackgerrit has quit IRC | 03:10 | |
| r1chardj0n3s | oh, wait, cookie as a middleware thing, not CORS? | 03:11 |
| r1chardj0n3s | :) | 03:11 |
| ayoung | r1chardj0n3s, don't forget we have many use cases | 03:11 |
| ayoung | yeah | 03:11 |
| ayoung | CORS too, though | 03:11 |
| r1chardj0n3s | I like that plan a lot then :) | 03:11 |
| *** radez is now known as radez_g0n3 | 03:11 | |
| ayoung | I think we will need it eventually | 03:11 |
| ayoung | there are use cases that call for it, but it doesn't need to be a blocker | 03:11 |
| r1chardj0n3s | the single-point thing that the proxy provides is also nice 'cos you only need one SSL certificate :) | 03:11 |
| nkinder | looks like great weather for paris... rain Sun-Wed | 03:12 |
| r1chardj0n3s | great weather for indoors activities, which I anticipate spending most of my time in | 03:12 |
| ayoung | r1chardj0n3s, OK, so what would I need to do to convert what you have to mod_wsgi? | 03:12 |
| *** alex_xu has joined #openstack-keystone | 03:12 | |
| r1chardj0n3s | find a way to use fauxstack.main.proxy_app | 03:12 |
| ayoung | Flask is the web server, right? | 03:12 |
| r1chardj0n3s | proxy_app gives you a wsgi app | 03:13 |
| ayoung | ok, lets say this is going on https://angboard.younglogic.net | 03:13 |
| ayoung | static code goes | 03:13 |
| ayoung | /var/www/html? | 03:13 |
| r1chardj0n3s | "grunt build" and then yeah, put the contents of dist in there | 03:14 |
| ayoung | hmmm. | 03:14 |
| *** dims__ has joined #openstack-keystone | 03:14 | |
| r1chardj0n3s | (that's "for realisies" deployment, not dev) | 03:15 |
| ayoung | that is basically thre app subdir | 03:15 |
| r1chardj0n3s | and all the supporting js/css minified etc | 03:15 |
| ayoung | then we'd need a wsgi file in /var/www/cgi-bin | 03:16 |
| ayoung | is that run_flask? | 03:16 |
| ayoung | duh no | 03:16 |
| ayoung | run_fauxstack | 03:16 |
| r1chardj0n3s | just use mod_wsgi? | 03:16 |
| r1chardj0n3s | to serve /api | 03:16 |
| ayoung | yeah | 03:16 |
| ayoung | but mod_wsgi needs a single entrypoint, like | 03:16 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/httpd/keystone.py | 03:17 |
| ayoung | that is what we use for keystone | 03:17 |
| r1chardj0n3s | right, so maybe someone needs to add paste support so it can be configured reasonably? | 03:17 |
| ayoung | it only requires the AUTH_URL from Keystone as a config value, right? | 03:17 |
| r1chardj0n3s | to be honest, I haven't given much thought to deployment; it's low on the priority list for a prototype :) | 03:17 |
| r1chardj0n3s | logging should also be configured | 03:18 |
| r1chardj0n3s | I guess | 03:18 |
| ayoung | yeah, just to get a demo up that I don't have to worry about crashing | 03:18 |
| ayoung | also, I need it done "right" for Kerberos support | 03:18 |
| *** dims__ has quit IRC | 03:19 | |
| ayoung | r1chardj0n3s, I'd be OK with Hardcoding the URL to start. I just need it in mod_wsgi | 03:20 |
| r1chardj0n3s | yup | 03:20 |
| ayoung | so could we use fauxstack/main.py? | 03:20 |
| ayoung | or probably could merge that and proxy into just fauxstack.py | 03:21 |
| r1chardj0n3s | the intention is that fauxstack grows to be able to actually fake API interaction | 03:21 |
| r1chardj0n3s | that's why it's split | 03:21 |
| ayoung | ah, so we could have a static impl | 03:21 |
| r1chardj0n3s | yah | 03:22 |
| ayoung | I wonder if we could make it kindof a light Keystone...none of the admin functions, just the issue token piece | 03:23 |
| ayoung | would clean up all of the SSO Kerberos stuff | 03:23 |
| r1chardj0n3s | it'll probably have to have some smarts like that, yeah | 03:24 |
| ayoung | I kindof want to make the token issuing its own pipeline anyway | 03:24 |
| ayoung | we could, in theory, build that pipeline and fauxstack into one service | 03:24 |
| r1chardj0n3s | when do you arrive in Paris, btw> | 03:24 |
| r1chardj0n3s | ? | 03:24 |
| ayoung | let me chack | 03:24 |
| ayoung | Arrives on Nov 2, 2014 | 03:26 |
| ayoung | CDG 8:35am | 03:26 |
| r1chardj0n3s | ok, cool. there's a horizon gathering in the Meridien bar at 8pm if you're awake :) | 03:27 |
| ayoung | "Its a rainy night in Paris and I'm sitting by the Seine...it's a pleasure to be soaking in the European rain..." | 03:27 |
| ayoung | r1chardj0n3s, You still look like your profile picture? | 03:28 |
| r1chardj0n3s | yup | 03:28 |
| ayoung | https://www.flickr.com/photos/andy47/3086126760/in/faves-richard_jones/ | 03:28 |
| r1chardj0n3s | yep, that's me | 03:29 |
| r1chardj0n3s | and I still likes games | 03:29 |
| r1chardj0n3s | ;) | 03:29 |
| ayoung | cool. nkinder didn't want to tell me what he looked like last summit. If he wasn';t standing next to one of our co-workers that I did not (and grinning like a Cheshire Cat) he would have gotten away with it. | 03:30 |
| ayoung | I'll bring my Go board | 03:30 |
| r1chardj0n3s | :) | 03:30 |
| r1chardj0n3s | does make it difficult :) | 03:30 |
| r1chardj0n3s | I'm packing three boardgames :) | 03:30 |
| ayoung | Do you play Go? | 03:30 |
| r1chardj0n3s | nup, never did get into it. have a board, but don't play it | 03:30 |
| ayoung | K...once it grabs you...it gets you hard | 03:30 |
| ayoung | layers upon layers | 03:31 |
| r1chardj0n3s | :) | 03:31 |
| ayoung | My son recently got a game I bet you'd like | 03:31 |
| ayoung | http://www.educationalinsights.com/product/check+math!--174-+game.do | 03:31 |
| *** dguerri has quit IRC | 03:32 | |
| r1chardj0n3s | looks neat | 03:32 |
| ayoung | Its like an intro to number theory. I still haven't figured out a strategy | 03:32 |
| r1chardj0n3s | :) | 03:32 |
| ayoung | yeah, 10 pieces, each with a number 1 to 10 | 03:32 |
| r1chardj0n3s | my daughter quite likes her numbers. hmmm.. :) | 03:32 |
| ayoung | a piece can only move onto a multiple of itself | 03:32 |
| ayoung | so 1 can move anywhere, and 10 is restricted to the 10s column | 03:33 |
| ayoung | its when you realize that common multiples are the strategic spaces that gets your head spinning | 03:33 |
| ayoung | my 8 year old routinely beats me at it, and I'm not throwing the game when he does | 03:34 |
| ayoung | what are you bringing? | 03:34 |
| r1chardj0n3s | sorry, was lost trying to figure out the shipping on that ;) | 03:35 |
| r1chardj0n3s | I'll be bringing Dominion, Sentinels of the Multiverse, Lover Letter and Hanabi | 03:36 |
| r1chardj0n3s | a bunch of my co-workers will be bringing games as well. we coordinated so we didn't double-up :) | 03:36 |
| *** anteaya has quit IRC | 03:37 | |
| *** anteaya has joined #openstack-keystone | 03:45 | |
| ayoung | sounds good. I'm headed to bed. Oh, and I'll be bringing a Tenor Sax. Just cuz. | 03:56 |
| ayoung | Gnight | 03:56 |
| *** ayoung is now known as ayoung-Zzzz | 03:56 | |
| *** david-lyle has joined #openstack-keystone | 04:04 | |
| *** david-lyle has quit IRC | 04:09 | |
| *** gokrokve has joined #openstack-keystone | 04:18 | |
| *** vsilva is now known as victsou | 04:35 | |
| *** victsou is now known as vsilva | 04:35 | |
| *** marcoemorais has joined #openstack-keystone | 04:38 | |
| *** marcoemorais1 has joined #openstack-keystone | 04:40 | |
| *** marcoemorais has quit IRC | 04:43 | |
| *** oomichi_ has joined #openstack-keystone | 04:54 | |
| *** kevinbenton has quit IRC | 04:57 | |
| *** gokrokve has quit IRC | 05:01 | |
| stevemar | r1chardj0n3s, hanabi is a very fun game, get to see folks stress out :) | 05:04 |
| *** david-lyle has joined #openstack-keystone | 05:05 | |
| r1chardj0n3s | stevemar :) | 05:07 |
| stevemar | r1chardj0n3s, i think i'll bring my copy of hanabi too, it's small enough to fit in the suitcase | 05:07 |
| stevemar | and maybe timeline too | 05:07 |
| r1chardj0n3s | \o/ | 05:08 |
| r1chardj0n3s | no idea when we'll fit gaming in, but we're keen :) | 05:08 |
| *** samuelms_home has quit IRC | 05:08 | |
| *** vsilva is now known as victsou | 05:09 | |
| *** david-lyle has quit IRC | 05:09 | |
| stevemar | i'm sure we can squeeze some in | 05:10 |
| *** victsou is now known as vsilva | 05:10 | |
| *** samuelms_home has joined #openstack-keystone | 05:10 | |
| *** dims__ has joined #openstack-keystone | 05:16 | |
| *** lhcheng has joined #openstack-keystone | 05:19 | |
| *** dims__ has quit IRC | 05:21 | |
| *** lhcheng has quit IRC | 05:23 | |
| *** alex_xu has quit IRC | 05:28 | |
| *** alex_xu has joined #openstack-keystone | 05:28 | |
| *** harlowja is now known as harlowja_away | 05:30 | |
| * morganfainberg is back-ish | 05:45 | |
| morganfainberg | finally. | 05:45 |
| *** ajayaa has joined #openstack-keystone | 05:48 | |
| *** stevemar has quit IRC | 05:50 | |
| *** lhcheng has joined #openstack-keystone | 05:58 | |
| *** david-lyle has joined #openstack-keystone | 06:06 | |
| *** david-lyle has quit IRC | 06:10 | |
| *** kevinbenton has joined #openstack-keystone | 06:11 | |
| *** ajayaa has quit IRC | 06:33 | |
| *** ajayaa has joined #openstack-keystone | 06:35 | |
| *** k4n0 has joined #openstack-keystone | 06:37 | |
| *** ajaya has joined #openstack-keystone | 06:47 | |
| *** wanghong has quit IRC | 06:51 | |
| *** gokrokve has joined #openstack-keystone | 06:52 | |
| *** wanghong has joined #openstack-keystone | 07:01 | |
| *** david-lyle has joined #openstack-keystone | 07:07 | |
| *** nellysmitt has joined #openstack-keystone | 07:09 | |
| *** david-lyle has quit IRC | 07:11 | |
| *** ajayaa has quit IRC | 07:13 | |
| *** ajaya has quit IRC | 07:14 | |
| *** ajayaa has joined #openstack-keystone | 07:14 | |
| *** samuelms_home has quit IRC | 07:30 | |
| *** lhcheng has quit IRC | 07:35 | |
| *** tomoiaga has joined #openstack-keystone | 07:48 | |
| *** david-lyle has joined #openstack-keystone | 08:08 | |
| *** david-lyle has quit IRC | 08:12 | |
| *** dims__ has joined #openstack-keystone | 08:18 | |
| *** dims__ has quit IRC | 08:23 | |
| *** afazekas_ has quit IRC | 08:26 | |
| *** jaosorior has joined #openstack-keystone | 08:32 | |
| *** aix has joined #openstack-keystone | 08:43 | |
| *** afazekas_ has joined #openstack-keystone | 08:46 | |
| *** afazekas has quit IRC | 08:47 | |
| *** marekd|away is now known as marekd | 08:47 | |
| *** jistr has joined #openstack-keystone | 08:59 | |
| *** david-lyle has joined #openstack-keystone | 09:08 | |
| *** david-lyle has quit IRC | 09:13 | |
| *** alex_xu has quit IRC | 09:24 | |
| *** oomichi_ has quit IRC | 09:49 | |
| *** henrynash has quit IRC | 09:54 | |
| *** marcoemorais1 has quit IRC | 09:55 | |
| *** mitz_ has quit IRC | 09:56 | |
| *** mitz_ has joined #openstack-keystone | 09:57 | |
| *** david-lyle has joined #openstack-keystone | 10:09 | |
| *** david-lyle has quit IRC | 10:14 | |
| *** dims__ has joined #openstack-keystone | 10:20 | |
| *** dims__ has quit IRC | 10:25 | |
| *** KanagarajM has joined #openstack-keystone | 10:46 | |
| *** dims__ has joined #openstack-keystone | 10:55 | |
| *** henrynash has joined #openstack-keystone | 11:03 | |
| *** yasu_ has joined #openstack-keystone | 11:09 | |
| *** yasu_ has quit IRC | 11:15 | |
| *** vb123 has quit IRC | 11:15 | |
| *** vb123 has joined #openstack-keystone | 11:16 | |
| *** tellesnobrega has joined #openstack-keystone | 11:34 | |
| *** jdennis has quit IRC | 11:38 | |
| *** KanagarajM has quit IRC | 11:47 | |
| *** vb123 has quit IRC | 11:48 | |
| *** amakarov_away is now known as amakarov | 11:49 | |
| *** miqui has joined #openstack-keystone | 12:15 | |
| *** jistr has quit IRC | 12:33 | |
| thiagop | Hello henrynash. Have you had time to take a look on the PoC of Horizon using the endpoint policy? | 12:35 |
| *** ayoung-Zzzz is now known as ayoung | 12:42 | |
| *** jamielennox|away is now known as jamielennox | 12:44 | |
| *** topol has joined #openstack-keystone | 12:48 | |
| *** vejdmn has joined #openstack-keystone | 12:48 | |
| *** dims__ has quit IRC | 12:51 | |
| *** dims__ has joined #openstack-keystone | 12:51 | |
| *** vejdmn has quit IRC | 12:52 | |
| *** vejdmn has joined #openstack-keystone | 12:52 | |
| *** bknudson has quit IRC | 12:55 | |
| *** thiagop has quit IRC | 12:56 | |
| *** breton has quit IRC | 12:57 | |
| *** thiagop has joined #openstack-keystone | 12:57 | |
| *** jistr has joined #openstack-keystone | 12:57 | |
| *** jistr is now known as jistr|biab | 12:57 | |
| *** breton has joined #openstack-keystone | 12:57 | |
| *** gordc has joined #openstack-keystone | 12:58 | |
| *** vhoward has joined #openstack-keystone | 13:09 | |
| *** david-lyle has joined #openstack-keystone | 13:11 | |
| *** david-lyle has quit IRC | 13:11 | |
| *** david-lyle has joined #openstack-keystone | 13:11 | |
| *** richm has joined #openstack-keystone | 13:12 | |
| *** david-lyle has quit IRC | 13:14 | |
| *** bknudson has joined #openstack-keystone | 13:16 | |
| *** boris-42 has joined #openstack-keystone | 13:25 | |
| *** vejdmn has quit IRC | 13:25 | |
| *** vejdmn has joined #openstack-keystone | 13:26 | |
| *** vejdmn has quit IRC | 13:33 | |
| *** vejdmn has joined #openstack-keystone | 13:33 | |
| *** ajayaa has quit IRC | 13:36 | |
| *** jistr|biab is now known as jistr | 13:38 | |
| *** stevemar has joined #openstack-keystone | 13:48 | |
| *** vejdmn has quit IRC | 14:00 | |
| *** stevemar has quit IRC | 14:01 | |
| *** dims_ has joined #openstack-keystone | 14:02 | |
| *** ajayaa has joined #openstack-keystone | 14:03 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:04 | |
| *** vejdmn has joined #openstack-keystone | 14:05 | |
| *** dims__ has quit IRC | 14:05 | |
| *** dims_ has quit IRC | 14:07 | |
| *** radez_g0n3 is now known as radez | 14:08 | |
| *** nellysmitt has quit IRC | 14:10 | |
| *** Deep_ has joined #openstack-keystone | 14:12 | |
| Deep_ | Hello, I am getting following error while creating service in keystone with postgresql 2014-10-30 18:41:00.524 32196 INFO eventlet.wsgi.server [-] (32196) wsgi starting up on http://0.0.0.0:35357/ 2014-10-30 18:41:08.161 32058 WARNING oslo.db.sqlalchemy.session [-] SQL connection failed. 1 attempts left. 2014-10-30 18:41:18.172 32058 CRITICAL keystone [-] DBConnectionError: (OperationalError) (2003, "Can't connect to MySQ | 14:13 |
| Deep_ | what i am missing here ? | 14:14 |
| *** david-lyle has joined #openstack-keystone | 14:14 | |
| ayoung | nkinder, I want to do a python-ldap call with system defaults for gssapi. | 14:15 |
| ayoung | the equivalent of a ldapmodify -X gssapi | 14:15 |
| ayoung | make that -Y | 14:16 |
| *** vejdmn has quit IRC | 14:18 | |
| *** vejdmn has joined #openstack-keystone | 14:19 | |
| *** david-lyle has quit IRC | 14:19 | |
| *** raildo has joined #openstack-keystone | 14:22 | |
| jamielennox | Deep_: it looks like your database connection sttring in keystone.conf is wrong | 14:24 |
| jamielennox | i an't remember what the string is but if it's postgres it should start with postgres:// or something similar to indicate the driver type | 14:24 |
| *** ajayaa has quit IRC | 14:25 | |
| Deep_ | connection = postgresql://keystone:Passw0rd@localhost/keystone | 14:26 |
| *** vejdmn has quit IRC | 14:26 | |
| Deep_ | this is my string in the keystone.conf. db_sync is working fine | 14:26 |
| *** vejdmn has joined #openstack-keystone | 14:27 | |
| Deep_ | but while adding the service it is failing , few more msg 2014-10-30 19:53:38.445 1791 ERROR keystone.common.wsgi [-] (OperationalError) could not connect to server: Permission denied Is the server running on host "dgnode2" (192.168.122.32) and accepting TCP/IP connections on port 5432? None None | 14:28 |
| Deep_ | i also added host all all 0.0.0.0/0 md5 in pg_hba.conf | 14:31 |
| *** k4n0 has quit IRC | 14:34 | |
| *** stevemar has joined #openstack-keystone | 14:36 | |
| *** aix has quit IRC | 14:37 | |
| *** vhoward has left #openstack-keystone | 14:37 | |
| *** saipandi has joined #openstack-keystone | 14:39 | |
| *** tomoiaga has quit IRC | 14:41 | |
| jamielennox | Deep_: weird - i was more going on the "can't connect to mysql" string being an issue | 14:43 |
| jamielennox | if you start up keystone with --debug does it list the correst string? | 14:43 |
| *** andreaf has joined #openstack-keystone | 14:46 | |
| *** aix has joined #openstack-keystone | 14:51 | |
| *** miqui has quit IRC | 14:51 | |
| *** david-lyle has joined #openstack-keystone | 14:55 | |
| *** thedodd has joined #openstack-keystone | 14:57 | |
| *** Deep_ has quit IRC | 14:59 | |
| *** andreaf has quit IRC | 15:00 | |
| *** henrynash has quit IRC | 15:07 | |
| *** david-lyle has quit IRC | 15:07 | |
| *** david-lyle has joined #openstack-keystone | 15:08 | |
| *** jorge_munoz has joined #openstack-keystone | 15:11 | |
| marekd | stevemar: hey. What version of osc do you think will have all the code required for federated authentication? | 15:15 |
| marekd | 0.4? | 15:15 |
| marekd | 0.4? | 15:15 |
| marekd | 0.5 ? | 15:15 |
| stevemar | o/ | 15:15 |
| marekd | \o | 15:15 |
| stevemar | what are we at now? | 15:15 |
| stevemar | 0.4.1 apparently | 15:16 |
| stevemar | then 0.5 will have it | 15:16 |
| stevemar | dtroyer, yo | 15:16 |
| marekd | ok | 15:16 |
| marekd | that's enough for me. | 15:16 |
| stevemar | dtroyer, thoughts on cutting a new OSC? cc marekd | 15:16 |
| stevemar | dtroyer, we were already talking about it before | 15:16 |
| stevemar | marekd, what else needs to land | 15:16 |
| marekd | stevemar: did listing federated projects/domains land? | 15:17 |
| stevemar | marekd, i played with creating a protocol+mapping+idp last night :) it was great, +1 for less curls | 15:17 |
| marekd | i was out of sync for a little bit. | 15:17 |
| stevemar | marekd, nope! but it's close | 15:17 |
| stevemar | marekd, is that it? any more authN bits? | 15:17 |
| marekd | stevemar: ok, so this is something that needs to land. | 15:17 |
| marekd | no. | 15:17 |
| marekd | stevemar: dude, I freely utilize clouds with SAML :-) | 15:17 |
| marekd | and with osc i merged myself. It is indeed nice | 15:18 |
| *** chrisshattuck has joined #openstack-keystone | 15:18 | |
| marekd | really great job /cc mhu | 15:19 |
| stevemar | i'm so jealous you get to actually use it :) | 15:23 |
| stevemar | marekd, i had 1 comment, i'll fix it and then +2 | 15:23 |
| stevemar | we've been meaning to get a new release out anyway | 15:23 |
| *** gokrokve has quit IRC | 15:24 | |
| stevemar | marekd, https://review.openstack.org/#/c/124101/ if you would be so kind | 15:28 |
| *** vsilva has quit IRC | 15:29 | |
| *** chrisshattuck has quit IRC | 15:30 | |
| mhu | marekd, stevemar : nice ! | 15:30 |
| mhu | marekd, I am currently toying with django_openstack_auth to add ksc sessions + auth plugins | 15:32 |
| mhu | the idea is to let the user choose the authentication method on the login form among preselected ones | 15:32 |
| mhu | so with your saml wrapper plugin some form of SAML auth would be possible in Horizon | 15:33 |
| marekd | mhu: it's a first step for websso? | 15:33 |
| marekd | mhu: i think it's more complicated | 15:33 |
| *** cjellick has joined #openstack-keystone | 15:34 | |
| marekd | than that | 15:34 |
| mhu | marekd, no, it's actually | 15:34 |
| marekd | stevemar: looking | 15:34 |
| mhu | mainly to support auth plugins | 15:34 |
| mhu | marekd, agreed, it'd be some limited form of SAML auth | 15:35 |
| *** mitz_ has quit IRC | 15:35 | |
| marekd | mhu: have you thought through whole workflow? | 15:35 |
| marekd | Keystone and Horizon are separate entities. | 15:36 |
| marekd | you want Hoizon to be a SP, while it's keystone who need to be it. | 15:36 |
| *** _cjones_ has joined #openstack-keystone | 15:38 | |
| mhu | marekd, what I am doing won't fit in that workflow, it's really a limited form of SAML auth. :) It'll be a bit like a pretty GUI frontend for osc, in a way | 15:38 |
| mhu | so no redirection to the IdP from Horizon, etc | 15:39 |
| marekd | mhu: ok, i assume you know the stuff | 15:39 |
| *** lcurtis has joined #openstack-keystone | 15:45 | |
| lcurtis | hello all...when setting up keystone originally i forgot to add in provider = keystone.token.providers.uuid.Provider | 15:46 |
| lcurtis | driver = keystone.token.persistence.backends.sql.Token in keystone.conf | 15:46 |
| lcurtis | ran into probs with glance, so double-checked docs, then added these lines in under token | 15:47 |
| lcurtis | now when i start keystone i get ImportError: No module named persistence.backends.sql | 15:47 |
| lcurtis | seems to be okay if i remove driver = keystone.token.persistence.backends.sql.Token | 15:48 |
| lcurtis | is this critical? | 15:48 |
| *** gokrokve has joined #openstack-keystone | 15:50 | |
| mhu | lcurtis which version of keystone are you deploying ? | 15:51 |
| lcurtis | 1:2014.1.3-0ubuntu2 | 15:52 |
| mhu | lcurtis, so it's icehouse, and in this version the driver is keystone.token.backends.sql.Token | 15:53 |
| lcurtis | ah..okay | 15:54 |
| lcurtis | wow..thank u so much | 15:54 |
| lcurtis | i was reading juno docs | 15:54 |
| lcurtis | u saved me much headache | 15:55 |
| lcurtis | greatly appreciated | 15:55 |
| mhu | lcurtis, you're welcome ! I guess it's a common error to look at the wrong doc version | 15:58 |
| amakarov | ayoung, morganfainberg, dstanek, good day! I've modified trust redelegation patch https://review.openstack.org/126897 and started docs: https://review.openstack.org/131541 Can you please review it once more? | 15:59 |
| ayoung | will do amakarov | 15:59 |
| lcurtis | yes...switching back and forth and pulling up docs...stopping and starting installation | 15:59 |
| amakarov | ayoung, I'd really appreciate any directions about specs writing - never done it this way before )) Is there any guide available? | 16:00 |
| ayoung | amakarov, we are all just figuring this stuff out | 16:01 |
| ayoung | all that we have is the template.rst | 16:01 |
| amakarov | ayoung, telepate_mode=on then )) | 16:03 |
| ayoung | heh | 16:03 |
| ayoung | pate is a term for the top of the head...I'm thinking of some dude with an old style phone growing out of there | 16:04 |
| *** marcoemorais has joined #openstack-keystone | 16:05 | |
| *** jorge_munoz has quit IRC | 16:05 | |
| amakarov | ayoung, :D | 16:05 |
| amakarov | ayoung, btw about that Popen issue: I found your 2 year old thread about eventlet or vanilla subprocess.Popen usage | 16:08 |
| ayoung | ++ | 16:09 |
| *** chrisshattuck has joined #openstack-keystone | 16:09 | |
| amakarov | Did you try to inspect the call stack in order to determine current mode? | 16:10 |
| ayoung | amakarov, since we are moving to HTTPD, we can do something smarter at least on the Keystone side | 16:10 |
| bknudson | we've already moved to httpd. | 16:10 |
| ayoung | amakarov, I don't remember. Probably | 16:10 |
| ayoung | bknudson, not everyone has | 16:10 |
| ayoung | bknudson, but...there is the "ensure_popen" thing that we could use to select how to setup the cms call... | 16:11 |
| ayoung | based on the env call...didn't you work on that? or was it jamielennox ? | 16:11 |
| amakarov | ayoung, I thought about it: we can write wsgi app or even apache extention to proxy HTTP call to library function | 16:11 |
| *** afazekas_ has quit IRC | 16:11 | |
| *** chrisshattuck has quit IRC | 16:11 | |
| amakarov | and let httpd take care about parellelism | 16:12 |
| jamielennox | ayoung: ? | 16:12 |
| ayoung | sorry to ignore, but I'm working on something on a screen that locks me out if I don;t respond quickly...and I need to get it done | 16:12 |
| ayoung | give me a few mintes | 16:12 |
| *** chrisshattuck has joined #openstack-keystone | 16:12 | |
| *** gyee has joined #openstack-keystone | 16:17 | |
| marekd | mhu: OS_AUTH_PLUGIN is no longer supported? | 16:21 |
| mhu | marekd, the name was changed, it's OS_AUTH_METHOD now IIRC | 16:22 |
| marekd | mhu: ah-ha | 16:22 |
| marekd | so maybe we could reflect that change in the doc? | 16:22 |
| marekd | its missing now | 16:22 |
| marekd | http://pasteraw.com/3n85581vzt1vhjlzszx3w3onwsw4hgc | 16:23 |
| mhu | marekd, you mean the help message when running openstackclient --help ? | 16:24 |
| mhu | or the man page ? | 16:24 |
| morganfainberg | morning. | 16:29 |
| *** dims__ has joined #openstack-keystone | 16:33 | |
| *** topol_ has joined #openstack-keystone | 16:33 | |
| mhu | marekd, thx | 16:33 |
| *** topol has quit IRC | 16:33 | |
| marekd | mhu: openstack -h | 16:33 |
| *** topol_ is now known as topol | 16:33 | |
| marekd | OS_AUTH_PLUGIN was changed to OS_AUTH_TYPE and it was not documented anywhere (openstack -h didn't reflect this) | 16:34 |
| ayoung | OK... | 16:35 |
| ayoung | jamielennox, I was just thinking that we could avoid using popen alltogether based on the environment setup | 16:35 |
| *** ericpeterson has joined #openstack-keystone | 16:36 | |
| jamielennox | ayoung: oh - yea, probably | 16:36 |
| jamielennox | marekd: oh this is OSC? | 16:36 |
| ericpeterson | question from Horizon developer on primary project for a user. Is that going away at some point? | 16:36 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/httpd/keystone.py#n46 | 16:36 |
| mhu | marekd, seeing as OS_AUTH_PLUGIN was never exposed in a tagged version of osc AFAIK, the change is not really critical, but the option should be documented nevertheless | 16:36 |
| ayoung | ericpeterson, sortof | 16:36 |
| jamielennox | mhu: ah, i've been meaning to find you - i am going to try and do a big overhaul of OSC handling of plugins | 16:36 |
| *** gokrokve has quit IRC | 16:37 | |
| ayoung | ericpeterson, when you have an LDAP backend, you can't count on that value being present | 16:37 |
| ericpeterson | would like to have horizon respect that setting on initial login | 16:37 |
| jamielennox | mhu: there is a whole heap of stuff that we provided in ksc so that all this stuff was standardized and OSC went and did it themselves | 16:37 |
| amakarov | ayoung, imho straitforward way is to use one or another depending on current stack | 16:37 |
| ayoung | ericpeterson, there are some other ugly related issues | 16:37 |
| marekd | jamielennox: yes, we are talking about OSC | 16:37 |
| marekd | mhu: i could see it in help msg before. | 16:37 |
| jamielennox | mhu: this is how i would like it to look https://review.openstack.org/#/c/131804/ | 16:37 |
| ayoung | for example, with cloud-policy, you need to use a domain scoped token to do domain level operations | 16:37 |
| ericpeterson | maybe if it's there then use it, otherwise the current random behavior stays? | 16:37 |
| mhu | jamielennox, cool, I'll give it a look | 16:37 |
| jamielennox | there is no reason i can think that OSC should be using stevedore etc | 16:38 |
| ayoung | ericpeterson, more like this: | 16:38 |
| ayoung | ericpeterson, first, get an unscoped token | 16:38 |
| ayoung | always | 16:38 |
| ayoung | then, always conver unscoped to scoped | 16:38 |
| *** lhcheng has joined #openstack-keystone | 16:38 | |
| jamielennox | directly rather than using ksc supported stuff - if we want to use OS_AUTH_TYPE instead of OS_AUTH_PLUGIN (i admit a better word) then i would like to make that change in ksc so that it will be picked up by all the clients | 16:38 |
| ayoung | cuz in keystone, we are going to make that a requirement: no more scoped to scoped token exchanges | 16:38 |
| mhu | jamielennox, to be honest I wasn't very familiar with stevedore so I just went with what I got working through trial and error :) | 16:38 |
| david-lyle | but in the unscoped token, default project isn't present is it? | 16:39 |
| jamielennox | mhu: are you at summit? | 16:39 |
| ayoung | david-lyle, that is correct, you would have to make an additional query | 16:39 |
| marekd | jamielennox: i was also asking if osc should manage ksc plugins and load them from stevedore. | 16:39 |
| mhu | jamielennox, yes, if all goes well | 16:39 |
| ayoung | we might be able to shoehorn that info in to the unscoped token, but ugh | 16:39 |
| jamielennox | mhu: all goes well? cutting that a little fine :) | 16:39 |
| ericpeterson | have to possibly get 3 tokens to finally arrive, oh joy david-lyle | 16:39 |
| marekd | mhu: why would you miss it? it's 10 mins from your house? | 16:39 |
| ayoung | ericpeterson, no, just two | 16:40 |
| jamielennox | marekd: i don't think it should - it should just rely on KSC | 16:40 |
| ayoung | ericpeterson, todaym a user can't even set his own default project. we should just let you guys maintain that info | 16:40 |
| mhu | marekd, I might have to guard the house at enovance :) but yeah, I'd be very surprised if I can't go | 16:40 |
| *** ChanServ sets mode: +o dolphm | 16:40 | |
| david-lyle | do I have access to the default project call with a domain-scoped token | 16:40 |
| marekd | jamielennox: that's what i once said afair | 16:40 |
| jamielennox | mhu: ok - well we can talk about it there, but essentially i don't think you should do everything via stevedore. Stevedore is good for when people know the plugin they want to load specifically | 16:41 |
| ayoung | david-lyle, it won't be in the token data | 16:41 |
| ayoung | you could get it with an additional call. | 16:41 |
| jamielennox | if you are doing things like a default, or you want to use token_endpoint (which we already have in keystoenclient) then you can refer to those classes directly | 16:41 |
| ayoung | david-lyle we could do something interesting like this: | 16:41 |
| jamielennox | also the problem with the way it works now is that OSC is going to get additional --help entries for every plugin that gets installed on the system | 16:41 |
| david-lyle | ayoung: understand that, question is, with a unscoped token can I get that info? | 16:42 |
| ericpeterson | ayoung I think david-lyle and I are looking for APIs that we have today | 16:42 |
| ayoung | david-lyle, the more I think about this, the more complex it gets | 16:42 |
| ayoung | the short answer is, maybe | 16:42 |
| david-lyle | so you're saying there's a chance | 16:42 |
| ayoung | so from an unscoped token, you pull the userid out, and then do a get user on that | 16:42 |
| ayoung | and the default project, if it exsits, would be in there | 16:43 |
| ericpeterson | seems kinda wierd that keystone has the default project (at least sometimes)..... and we don't get that out of an initial token | 16:43 |
| ayoung | with the policy files as we've written them , I think so. let me look | 16:43 |
| ayoung | https://github.com/openstack/keystone/blob/master/etc/policy.json#L41 get_user is admin_required | 16:43 |
| ayoung | and we are moving to | 16:43 |
| ayoung | https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json#L48 | 16:44 |
| mhu | jamielennox, but shouldn't the plugin options be listed through --help ? | 16:44 |
| ericpeterson | that's unfortunate | 16:44 |
| ayoung | "rule:cloud_admin or rule:admin_and_matching_target_user_domain_id", | 16:44 |
| ayoung | there is no "get my info" call | 16:44 |
| jamielennox | mhu: maybe - i was thinking of that, but if so i think it should be done via KSC | 16:44 |
| ericpeterson | keystone knows more about me than I do, it seems ;) | 16:44 |
| lhcheng | ayoung: for unscoped token doesn't it default to the default project in v3? or are you taking that out? | 16:44 |
| ayoung | but... we can make something work here. Since the LDAP case is already broken, and we know that domain admin is broken, lets ask: what do we need | 16:44 |
| jamielennox | mhu: so keystoneclient has auth.register_cli_options (or something), if we want that we should have KSC iterate through the plugins and add that info to --help | 16:45 |
| ayoung | and I think the answer is along the lines of jamielennox 's propsal to return a limited service catalog in an unscoped token | 16:45 |
| david-lyle | ayoung: what are you doing about the admin_domain_id value in the second, tangent | 16:45 |
| mhu | jamielennox, oh right, makes sense ... that's obviously stuff that could be reused in other clients | 16:45 |
| ayoung | I think we need 2 things | 16:45 |
| ayoung | 1. figure pout where user preferences should live | 16:45 |
| jamielennox | mhu: ++, as much as possible i want OSC to be 'just another CLI', standardize this as much as possible | 16:45 |
| ayoung | 2. figure out what data to return with an unscoped token | 16:45 |
| mhu | jamielennox, and this is already covered in ksc ? if so, pretty cool | 16:45 |
| mhu | jamielennox, totally agree | 16:46 |
| jamielennox | mhu: registering yes, it doesn't add the available plugins to --help at the moment | 16:46 |
| ayoung | david-lyle, yeah, I don't know about admin_domain_id...that one is the kicker | 16:46 |
| david-lyle | ayoung: big +1 on both from me | 16:46 |
| ericpeterson | ayoung horizon already has some limited preferences that we take care of. but if this setting is going to exist in keystone, it needs to actually do something useful | 16:46 |
| jamielennox | mhu: i don't know what the cost of that is because you would have to iterate through stevedore all the available names and add them to the option - and it may never be used | 16:46 |
| ericpeterson | so I'd say the initial token should have some pointer to the default project | 16:47 |
| david-lyle | ericpeterson: I'd rather the preferences live in keystone, if it's supported | 16:47 |
| david-lyle | or access to the user_preferences API call | 16:47 |
| jamielennox | mhu: because --help is a static entry, and my understanding is that most things with entry points are a bit slow - but honestly its a CLI thing it probably doesn't matter at all | 16:47 |
| morganfainberg | user preferences for horizon shouldn't be in keystone ;) | 16:47 |
| ayoung | david-lyle, in my Javascript proof-of-concept, I did each step explicitly: authenticate, list projects, get scoped token. THat is not a nice user experience, but might be OK for the fist time the user logs in | 16:47 |
| ericpeterson | david-lyle thats fine too, but we don't have that right now | 16:47 |
| ayoung | it would be nicer to remember "last project I worked with" for people that do many projects | 16:48 |
| mhu | jamielennox, yeah ... how many times are you going to call --help anyway ? | 16:48 |
| ayoung | morganfainberg, but it is more than a horizon issue | 16:48 |
| ericpeterson | horizon has a related change to store the last region in a cookie | 16:48 |
| jamielennox | mhu: if we did that we could even iterate the available plugin and have them as 'choices' on --os-auth-plugin | 16:48 |
| ericpeterson | could do the same for projects | 16:48 |
| ayoung | morganfainberg, right now, CLI and library also assumes default project if none is specified | 16:48 |
| morganfainberg | ayoung, i'm not talking about this specific case | 16:48 |
| morganfainberg | default project needs to die | 16:48 |
| ayoung | and OSC breaks due to all the domain stuff... | 16:48 |
| lhcheng | david-lyle: for the user preference, can we just store it together in the user's extra field? | 16:48 |
| morganfainberg | a horrible death | 16:48 |
| jamielennox | mhu: right well that's what i mean, you would take the hit for iterating them for every CLI call, even if you didn't use --help | 16:48 |
| ayoung | lhcheng, nope | 16:48 |
| ayoung | lhcheng, that is not writable in LDAP | 16:49 |
| morganfainberg | last project i used would be a better UX imo | 16:49 |
| ericpeterson | if default project needs to die, that's fine.... just need to have a clear direction | 16:49 |
| mhu | jamielennox, oh ok, didn't think of that | 16:49 |
| morganfainberg | and i could def. support seeing something like that | 16:49 |
| ayoung | discussion for next week | 16:49 |
| morganfainberg | ericpeterson, i expect this to be a meetup / pod discussion | 16:49 |
| lhcheng | ayoung: ah. got in late, you guys are discussing the ldap use case. carry on | 16:49 |
| jamielennox | morganfainberg: that's totally something that should be a horizon cached thing not in keystone | 16:49 |
| ayoung | lhcheng, think more the "user data is read only" use case, but yes | 16:49 |
| morganfainberg | ericpeterson, david-lyle maybe toss it on the Keystone meetup-etherpad ? | 16:49 |
| ayoung | Federation is not LDAP, but has the same issues | 16:49 |
| morganfainberg | jamielennox, i'd be fine with that. | 16:49 |
| morganfainberg | jamielennox, things to talk about. | 16:50 |
| ericpeterson | this change keeps the region in a cookie, could do the same with project https://review.openstack.org/#/c/119202/ | 16:50 |
| morganfainberg | jamielennox, and keystoneclient/osc should probably support the same cache. | 16:50 |
| jamielennox | mhu: anyway - that's why it doesn't add it to --help at the moment - we can discuss ways of making that cleaner, but i'd like to see OSC reuse as much of KSC loading as possible | 16:50 |
| jamielennox | morganfainberg: hmm... not sure there | 16:51 |
| mhu | jamielennox, ++ I'll be happy to help with that | 16:51 |
| *** nikunj2512 has joined #openstack-keystone | 16:52 | |
| jamielennox | mhu: well that review is massively failing all tests as i got a bit ambitious with the cleaning as you did the initial patch i'd be happy for you to have a go at integrating old and new | 16:52 |
| jamielennox | i'm messing with neutronclient tests at the moment - which is going to take a while | 16:52 |
| mhu | jamielennox, I'll add myself as a reviewer and have a look at it | 16:53 |
| ayoung | ericpeterson, https://review.openstack.org/#/c/121281/ is the direction I'm headed with this | 16:53 |
| mhu | ouch, you weren't lying when you said it was massively failing :P | 16:54 |
| lhcheng | wondering if this a user data that other service would also leverage other than horizon. if it would be only horizon using the user data, we could just keep it in session or cookie. | 16:54 |
| ayoung | ericpeterson, and then Kerberos should be possible with the follow on. | 16:54 |
| jamielennox | mhu: yea, i started cutting where auth_ref was used. IMO we shouldn't need that - but my opinion is fairly ruthless/not always practical in this stuff | 16:56 |
| *** wanghong has quit IRC | 16:56 | |
| jamielennox | mhu: I'm sure if it was done as an incremental change it wouldn't be so bad | 16:56 |
| mhu | jamielennox, it'll provide a working base anyway | 16:56 |
| *** nellysmitt has joined #openstack-keystone | 16:56 | |
| richm | Is there a way to assign a user to a project using the v3 api? http://docs.openstack.org/api/openstack-identity-service/3/content/users.html | 16:57 |
| richm | You can List user projects: GET /users/{user_id}/projects | 16:57 |
| *** topol has quit IRC | 16:57 | |
| bknudson | you can assign a user a role on a project | 16:57 |
| richm | ok - so you have to first have a role defined | 16:58 |
| richm | when you create a user, you can set a default_project_id | 16:59 |
| ayoung | richm, that is oldschool stuff, but yes | 17:00 |
| jamielennox | richm: we would prefer you didn't set a default_project_id | 17:00 |
| ayoung | techincally, if the user has no role on the project, that value is meaningless | 17:01 |
| ayoung | but it might implicitly add the member role | 17:01 |
| richm | This is what I'm struggling with - if I have pre-existing users in LDAP, can I assign those users to projects without also assigning them to roles? | 17:01 |
| ayoung | actually, it is ignored in v3 | 17:02 |
| ayoung | no | 17:02 |
| ayoung | richm, in the past, users were members of proejcts | 17:02 |
| richm | ok - then I need to make sure there is some role defined e.g. _member_ | 17:02 |
| ayoung | now they only have roles in projects | 17:02 |
| ayoung | otherwise we had two different forms of association | 17:02 |
| ayoung | richm, yep | 17:03 |
| ayoung | that should be done by the install | 17:03 |
| richm | List user projects: GET /users/{user_id}/projects | 17:03 |
| ayoung | richm, specifically, the value in the config file for the member role: | 17:03 |
| richm | or member_role_id | 17:03 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/config.py#n98 | 17:03 |
| ayoung | both should be set, but are only used by the V2 api | 17:04 |
| *** raildo has quit IRC | 17:04 | |
| richm | The GET /users/{user_id}/projects seems to imply that users can be directly associated with projects - but I suppose that is just a convenience method | 17:04 |
| ayoung | otherwise, any role will do, but would avoid using the admin role as that gets elevated perms | 17:05 |
| *** htruta has quit IRC | 17:05 | |
| ayoung | richm, it gets the set of projects for which the user has any roles | 17:05 |
| ayoung | needed in order to select a project for a scoped token | 17:05 |
| richm | ugh - the puppet code is going to need a lot of work to properly reflect the v3 relationships (and domains . . .) | 17:06 |
| ayoung | richm, I would love to kill domains, and just make projects nestable | 17:07 |
| *** raildo has joined #openstack-keystone | 17:08 | |
| *** diegows has joined #openstack-keystone | 17:08 | |
| *** wanghong has joined #openstack-keystone | 17:10 | |
| *** rwsu has joined #openstack-keystone | 17:12 | |
| jamielennox | cya | 17:17 |
| *** htruta has joined #openstack-keystone | 17:17 | |
| *** mikedillion has joined #openstack-keystone | 17:18 | |
| *** tellesnobrega has quit IRC | 17:18 | |
| *** jamielennox is now known as jamielennox|away | 17:18 | |
| *** harlowja_away is now known as harlowja | 17:18 | |
| stevemar | i actually like domains :\ | 17:20 |
| nkinder | stevemar: I think ayoung does too, just not calling them domains (domain == top-level project) | 17:22 |
| ayoung | stevemar, yes, a project with no parent is a domain | 17:23 |
| ayoung | but treat domains like projects | 17:23 |
| stevemar | hehe | 17:23 |
| stevemar | thats one way of putting it i suppose | 17:23 |
| ayoung | AND CALL THEM TENANTS! | 17:23 |
| stevemar | noo | 17:23 |
| ayoung | yes | 17:23 |
| stevemar | the word tenant must never return | 17:23 |
| ayoung | tenant/project/domains...they are all just namespaces | 17:23 |
| *** jdennis has joined #openstack-keystone | 17:24 | |
| ayoung | nkinder, having trouble finding 'KRB5CCNAME' in Horizon. | 17:27 |
| *** htruta has quit IRC | 17:27 | |
| ayoung | Oooh, maybe owner? Unix permissions? | 17:27 |
| amakarov | ayoung, I heard one our north nation have about 20 names for different kinds of snow :) | 17:27 |
| ayoung | http://en.wikipedia.org/wiki/Eskimo_words_for_snow | 17:28 |
| *** jorge_munoz has joined #openstack-keystone | 17:28 | |
| amakarov | ayoung, ++ | 17:28 |
| *** afaranha has quit IRC | 17:29 | |
| ayoung | I have at least 20 words for programming that I shouldn't share in polite company | 17:29 |
| *** jorge_munoz has quit IRC | 17:32 | |
| amakarov | ayoung, 20 in total with variations or initial forms? | 17:32 |
| ayoung | Heh | 17:32 |
| *** htruta has joined #openstack-keystone | 17:34 | |
| *** raildo has quit IRC | 17:36 | |
| *** raildo has joined #openstack-keystone | 17:40 | |
| *** ericpeterson has quit IRC | 17:52 | |
| *** jaosorior has quit IRC | 17:53 | |
| *** marcoemorais has quit IRC | 17:55 | |
| *** marcoemorais has joined #openstack-keystone | 17:55 | |
| *** marcoemorais has quit IRC | 17:56 | |
| *** marcoemorais has joined #openstack-keystone | 17:56 | |
| *** marcoemorais has quit IRC | 17:56 | |
| *** marcoemorais has joined #openstack-keystone | 17:57 | |
| *** marcoemorais has quit IRC | 17:57 | |
| *** marcoemorais has joined #openstack-keystone | 17:57 | |
| *** marcoemorais has quit IRC | 17:57 | |
| *** marcoemorais has joined #openstack-keystone | 17:58 | |
| *** dims__ has quit IRC | 18:02 | |
| *** afazekas_ has joined #openstack-keystone | 18:03 | |
| marekd | stevemar: so what is basically a difference between projects and domains? | 18:04 |
| marekd | stevemar: business usecases or technical ones? | 18:05 |
| stevemar | marekd, technical, a domain is good way to separate things, it's can contain differen groups, users and projects | 18:05 |
| marekd | stevemar: so, as a user when i scope my token to a domain what can i actually do? | 18:06 |
| marekd | stevemar: boot a vm? | 18:07 |
| stevemar | not much unless you are a domain admin | 18:07 |
| marekd | stevemar: ok, if i am a domain admin i will then be able to manage it, right? | 18:09 |
| *** marekd is now known as marekd|away | 18:11 | |
| *** jorge_munoz has joined #openstack-keystone | 18:12 | |
| *** jorge_munoz has quit IRC | 18:17 | |
| *** dims__ has joined #openstack-keystone | 18:18 | |
| stevemar | marekd|away, correcto | 18:20 |
| *** ayoung has quit IRC | 18:22 | |
| *** dims_ has joined #openstack-keystone | 18:24 | |
| lbragstad | qq on some of the older validation stuff that lives in the manager and driver levels. | 18:25 |
| lbragstad | some of the backends and managers use keystone/clean.py for stuff like https://github.com/openstack/keystone/blob/3d9184b6f5860f0b56091a326ed41d2a4c29fbe4/keystone/assignment/backends/sql.py#L451 | 18:25 |
| lbragstad | which leads to tests in places like https://github.com/openstack/keystone/blob/3d9184b6f5860f0b56091a326ed41d2a4c29fbe4/keystone/tests/test_backend.py#L1771 | 18:26 |
| *** dims__ has quit IRC | 18:26 | |
| lbragstad | with the jsonschema approach, should we attempt to use the same validation schema for both v2.0 and v3. Or, should we at least make sure *all* validation is done at the same layer (i.e. controller layer like for jsonschema)? | 18:26 |
| *** afazekas_ has quit IRC | 18:29 | |
| *** _cjones_ has quit IRC | 18:30 | |
| lbragstad | correction: s/same validation schema/validation but with different schemas for different versions/ | 18:30 |
| *** _cjones_ has joined #openstack-keystone | 18:31 | |
| *** stevemar has quit IRC | 18:38 | |
| *** stevemar has joined #openstack-keystone | 18:39 | |
| *** jistr has quit IRC | 18:41 | |
| *** marcoemorais has quit IRC | 18:44 | |
| *** joesavak has joined #openstack-keystone | 18:47 | |
| *** amakarov is now known as amakarov_away | 18:47 | |
| *** BAKfr has quit IRC | 18:51 | |
| *** david-ly_ has joined #openstack-keystone | 18:51 | |
| *** BAKfr has joined #openstack-keystone | 18:51 | |
| *** vejdmn has quit IRC | 18:52 | |
| *** david-lyle has quit IRC | 18:55 | |
| *** marcoemorais has joined #openstack-keystone | 19:00 | |
| *** topol has joined #openstack-keystone | 19:02 | |
| *** dims_ has quit IRC | 19:10 | |
| *** afazekas_ has joined #openstack-keystone | 19:14 | |
| *** _cjones_ has quit IRC | 19:15 | |
| *** _cjones_ has joined #openstack-keystone | 19:16 | |
| *** openstackgerrit has joined #openstack-keystone | 19:21 | |
| *** openstackgerrit has quit IRC | 19:21 | |
| *** _cjones_ has quit IRC | 19:21 | |
| *** dims_ has joined #openstack-keystone | 19:24 | |
| *** edmondsw has joined #openstack-keystone | 19:24 | |
| *** mikedillion has quit IRC | 19:26 | |
| *** ayoung has joined #openstack-keystone | 19:28 | |
| *** afazekas_ has quit IRC | 19:31 | |
| *** joesavak has quit IRC | 19:41 | |
| ayoung | nkinder, got a public demo of the kerberos stuff | 19:41 |
| ayoung | http://horizon.younglogic.net/dashboard/admin/ | 19:41 |
| morganfainberg | ayoung, awww i'm not authorized for that project | 19:41 |
| morganfainberg | >.> | 19:41 |
| morganfainberg | :P | 19:41 |
| morganfainberg | ayoung, btw, 10.9 and 10.10 of OSX has krb5 baked in | 19:42 |
| morganfainberg | no external packages needed | 19:42 |
| nkinder | ayoung: I need to set my system up for your KDC | 19:42 |
| ayoung | morganfainberg, ah, this is a new packstack install, so while your user is valid from ipa.younglogic.net, it needs a role on a project... | 19:43 |
| ayoung | nkinder, should be just the DNS entry | 19:43 |
| morganfainberg | i actually dont (again) remember my user for ipa.younglogic.net | 19:43 |
| morganfainberg | haha | 19:43 |
| ayoung | dns_lookup_realm = true | 19:43 |
| morganfainberg | what was my username btw? | 19:43 |
| ayoung | morganfainberg, I can reset your password | 19:43 |
| ayoung | one sec | 19:44 |
| ayoung | mfainberg almost certainly | 19:44 |
| ayoung | yep | 19:44 |
| morganfainberg | hmm. | 19:44 |
| morganfainberg | yeah | 19:44 |
| morganfainberg | got it | 19:44 |
| ayoung | morganfainberg, OK, let me give you a role | 19:44 |
| ayoung | morganfainberg, nkinder ok, it is set | 19:48 |
| ayoung | got move locations...back on line in a few | 19:48 |
| morganfainberg | hm. | 19:49 |
| morganfainberg | now i just need to figure out how to configure the krb5.conf | 19:49 |
| morganfainberg | lost the config somehow | 19:49 |
| *** joesavak has joined #openstack-keystone | 19:53 | |
| morganfainberg | ayoung, will bug you post food. | 19:54 |
| *** afazekas_ has joined #openstack-keystone | 19:54 | |
| *** ayoung has quit IRC | 19:59 | |
| *** jsavak has joined #openstack-keystone | 19:59 | |
| morganfainberg | wow | 20:01 |
| morganfainberg | and that *just* worked | 20:01 |
| *** afazekas_ has quit IRC | 20:01 | |
| *** joesavak has quit IRC | 20:02 | |
| morganfainberg | hm, clicking the "signon" button is a bit weird. | 20:03 |
| nkinder | morganfainberg: yeah, that requires some hacking in Horizon to get rid of it IIRC | 20:05 |
| morganfainberg | nkinder, also on OS X holy crap it was easy to setup the identity | 20:05 |
| morganfainberg | once i .. you know .. figured out the app | 20:05 |
| morganfainberg | and safari just worked. | 20:05 |
| morganfainberg | chrome doesn't hook into KRB5 though in OS X | 20:05 |
| *** afazekas_ has joined #openstack-keystone | 20:05 | |
| morganfainberg | i think FF does. | 20:05 |
| nkinder | morganfainberg: FF requires you to set a config option in about:config though | 20:06 |
| morganfainberg | yeah | 20:06 |
| morganfainberg | anyway. color me impressed with the simplicity of getting logged in | 20:06 |
| nkinder | SSO just seems like magic when it works | 20:06 |
| * morganfainberg thinks some AD folks are going to be very happy with this. | 20:06 | |
| morganfainberg | i think we're pretty close to having nearly the same level of friendliness for the federated stuff (e.g. SAML based) | 20:07 |
| morganfainberg | wont feel quite as magical though | 20:07 |
| morganfainberg | lunch time now | 20:08 |
| *** vejdmn has joined #openstack-keystone | 20:16 | |
| *** dims_ has quit IRC | 20:21 | |
| *** _cjones_ has joined #openstack-keystone | 20:22 | |
| *** vejdmn has quit IRC | 20:22 | |
| *** vejdmn has joined #openstack-keystone | 20:23 | |
| *** radez is now known as radez_g0n3 | 20:24 | |
| *** afazekas_ has quit IRC | 20:25 | |
| *** david-ly_ is now known as david-lyle | 20:28 | |
| *** ayoung has joined #openstack-keystone | 20:33 | |
| *** afazekas has joined #openstack-keystone | 20:35 | |
| *** _cjones_ has quit IRC | 20:36 | |
| *** _cjones_ has joined #openstack-keystone | 20:36 | |
| ayoung | nkinder, group membership seems to be messed up. I have a group called keystoners, and from the command line: | 20:43 |
| ayoung | groups | 20:43 |
| ayoung | ayoung wheel admins rhidm keystoners freeipa_brewers keystone_admins | 20:43 |
| ayoung | $ openstack --os-auth-type v3kerberos group show 9df5b04e923a0d4a10081ccc76db25f7317784f44a6b88680a0633480a23f32c | 20:43 |
| ayoung | +-------------+------------------------------------------------------------------+ | 20:43 |
| ayoung | | Field | Value | | 20:43 |
| ayoung | +-------------+------------------------------------------------------------------+ | 20:43 |
| ayoung | | description | Keystone Upstream Contributrors | | 20:43 |
| ayoung | | domain_id | YOUNGLOGIC | | 20:43 |
| ayoung | | id | 9df5b04e923a0d4a10081ccc76db25f7317784f44a6b88680a0633480a23f32c | | 20:43 |
| ayoung | | name | keystoners | | 20:43 |
| ayoung | +-------------+------------------------------------------------------------------+ | 20:43 |
| ayoung | but | 20:43 |
| ayoung | $ openstack --os-auth-type v3kerberos group contains user 9df5b04e923a0d4a10081ccc76db25f7317784f44a6b88680a0633480a23f32c 51dade76c252e37121c87720d183075d2ab1aa4177b87a341a58375b23e5ffce | 20:43 |
| ayoung | 51dade76c252e37121c87720d183075d2ab1aa4177b87a341a58375b23e5ffce not in group 9df5b04e923a0d4a10081ccc76db25f7317784f44a6b88680a0633480a23f32c | 20:43 |
| ayoung | $ openstack --os-auth-type v3kerberos role assignment list --effective --user 51dade76c252e37121c87720d183075d2ab1aa4177b87a341a58375b23e5ffce+----------------------------------+------------------------------------------------------------------+-------+----------------------------------+--------+ | 20:44 |
| ayoung | | Role | User | Group | Project | Domain | | 20:44 |
| ayoung | +----------------------------------+------------------------------------------------------------------+-------+----------------------------------+--------+ | 20:44 |
| ayoung | | d7ce72b32d5f4a678edd20feda0d73bf | 51dade76c252e37121c87720d183075d2ab1aa4177b87a341a58375b23e5ffce | | 85b6aa1fec2349e7bf0376c604b85652 | | | 20:44 |
| ayoung | | d7ce72b32d5f4a678edd20feda0d73bf | 51dade76c252e37121c87720d183075d2ab1aa4177b87a341a58375b23e5ffce | | b99b8eeafb634355b159d139e7827652 | | | 20:44 |
| ayoung | +----------------------------------+------------------------------------------------------------------+-------+----------------------------------+--------+ | 20:44 |
| ayoung | so member ship is not being returned correctly. | 20:44 |
| ayoung | group_member_attribute=member | 20:45 |
| *** gokrokve has joined #openstack-keystone | 20:54 | |
| nkinder | ayoung: turn on debug logging and see what the filter is | 20:55 |
| ayoung | nkinder, looks like a permissions error | 20:56 |
| ayoung | I don't think it got to the LDAP layer | 20:56 |
| nkinder | permissions on what? | 20:56 |
| *** raildo has quit IRC | 21:02 | |
| *** _cjones_ has quit IRC | 21:07 | |
| *** nellysmitt has quit IRC | 21:08 | |
| bknudson | This isn't working for me today: openstack --os-identity-api-version=3 --os-auth-url=http://localhost:5000/v3 user list | 21:13 |
| bknudson | I get "Authentication failure: Expecting to find domain in project" | 21:14 |
| bknudson | client isn't sending a domain for project or user... | 21:17 |
| bknudson | I needed to set "--os-user-domain-name=Default --os-project-domain-name=Default" | 21:19 |
| bknudson | stevemar: recent change to openstack cli? | 21:19 |
| stevemar | bknudson, i don't think it was ever defaulting it | 21:20 |
| bknudson | "Clean up shell authentication" -- https://review.openstack.org/#/c/129778/ -- hmmmm | 21:21 |
| stevemar | bknudson, yeah, i abandoned that effort https://review.openstack.org/#/c/125865/ | 21:21 |
| bknudson | stevemar: I agree it's questionable to have a default for the domain... | 21:22 |
| stevemar | bknudson, yeah we get all our options (most anyway) from keystoneclient now | 21:22 |
| stevemar | instead of carrying our own | 21:22 |
| morganfainberg | ayoung, you weren't here when i told nkinder this, but color me impressed on the SSO experience loging in. | 21:23 |
| morganfainberg | still rough edges and all, but wow. | 21:23 |
| morganfainberg | ayoung, well done sir! | 21:23 |
| stevemar | morganfainberg, details? | 21:23 |
| *** jsavak has quit IRC | 21:24 | |
| morganfainberg | stevemar, ayoung needs to give you a role on his horizon install, but basically kinit your principal on his ipa server then just go to the horizon login | 21:24 |
| morganfainberg | stevemar, then it's click a button to get a token. (the rough edge) | 21:24 |
| morganfainberg | but, it's SSO... like magic | 21:24 |
| morganfainberg | krb5 stuffs | 21:24 |
| morganfainberg | stevemar, ipa.younglogic.net (i think you have an account) | 21:24 |
| bknudson | I'll just set "export OS_USER_DOMAIN_NAME=Default" and "export OS_PROJECT_DOMAIN_NAME=Default" | 21:25 |
| morganfainberg | stevemar, smartinelli | 21:25 |
| bknudson | no GUI for me. | 21:25 |
| stevemar | bknudson, i think that's what we advise in the docs | 21:25 |
| morganfainberg | stevemar, and http://horizon.younglogic.net/dashboard | 21:25 |
| stevemar | bknudson, http://docs.openstack.org/developer/keystone/cli_examples.html#using-python-openstackclient-v3 scroll down a bit | 21:26 |
| ayoung | morganfainberg, thanks | 21:26 |
| ayoung | morganfainberg, so I was trying to just set up a group for all that, but group role assignment seems to be broken there | 21:26 |
| ayoung | I'm debugging | 21:26 |
| morganfainberg | ayoung, yeah it's wonky | 21:26 |
| stevemar | morganfainberg, whats the default password? | 21:26 |
| morganfainberg | ayoung, and i get an error everytime i login | 21:26 |
| ayoung | stevemar, I'll give you a role directly | 21:26 |
| stevemar | or is there not one? | 21:26 |
| ayoung | stevemar, none | 21:27 |
| morganfainberg | Error: Unauthorized: Unable to retrieve usage information. | 21:27 |
| ayoung | no defaults | 21:27 |
| morganfainberg | but it really does almost feel like magic | 21:27 |
| stevemar | let me know when i have a role :) | 21:27 |
| morganfainberg | you know... like SSO is supposed to feel | 21:27 |
| stevemar | hehe | 21:27 |
| * morganfainberg is debating getting a laptop w/ 12hr battery life. | 21:28 | |
| morganfainberg | i hate that i only get 6hrs on my mbp | 21:28 |
| morganfainberg | anyone have opinions on a good travel laptop that legitimately gets serious battery life? | 21:29 |
| morganfainberg | i'm ok with it having a bit less power - i don't expect to need to run massive numbers of VMs. | 21:30 |
| ayoung | morganfainberg, we're going to need another env var for the keystone client | 21:30 |
| *** chrisshattuck has quit IRC | 21:30 | |
| ayoung | one for setting the auth plugin | 21:30 |
| morganfainberg | ayoung, ugh. really? | 21:30 |
| morganfainberg | ayoung, ok. | 21:30 |
| ayoung | morganfainberg, heh | 21:30 |
| ayoung | yeah, right now I have to do | 21:30 |
| morganfainberg | ayoung, i can buy that. though it should be easy if we already have the CLI option | 21:31 |
| ayoung | openstack --os-auth-type v3kerberos domain list | 21:31 |
| ayoung | so we need | 21:31 |
| morganfainberg | ok so OS_AUTH_TYPE | 21:31 |
| ayoung | OS_AUTH_TYPE | 21:31 |
| morganfainberg | wait... we don't have that | 21:31 |
| morganfainberg | ?! | 21:31 |
| morganfainberg | ok ok so lets fix session to do the ENV var sourc if not passed on cli | 21:31 |
| ayoung | I don't think we have it yet | 21:33 |
| ayoung | the flag changed recently, it was --os-auth-plugin | 21:33 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:36 | |
| *** _cjones_ has joined #openstack-keystone | 21:36 | |
| morganfainberg | hm. | 21:36 |
| *** gokrokve has quit IRC | 21:36 | |
| morganfainberg | ayoung, I'm going to be writing up a blog post re: Federation SSO etc design session results | 21:37 |
| morganfainberg | ayoung, FYI i'm totally going to reference what you've accomplished here (and if you have an active post on your blog about it want to link to it too) | 21:37 |
| morganfainberg | ayoung, i plan on writing it up post summit session. | 21:38 |
| ayoung | Heh...I have many | 21:38 |
| ayoung | stevemar, Ok, just added a role to your user | 21:38 |
| morganfainberg | i mean if you have one about *this* specific demo / current state. | 21:38 |
| ayoung | username is | 21:38 |
| ayoung | smartinelli | 21:38 |
| morganfainberg | otherwise i'll pick one/some of the other ones. | 21:38 |
| ayoung | no idea what the password is | 21:38 |
| stevemar | ayoung, is there a default ? | 21:39 |
| stevemar | morganfainberg said there might not be one? | 21:39 |
| ayoung | morganfainberg, I don't think I'll be writing another one yet. I was going to publicize the younglogic.net thing, but just got the public demo working | 21:39 |
| ayoung | stevemar, this is the kerberos setup I did with you a month or three ago | 21:39 |
| ayoung | I can reset your password if you need | 21:39 |
| morganfainberg | ayoung, sounds good. i'll have ya read things over before I post it up anyway. | 21:39 |
| ayoung | ++ | 21:39 |
| ayoung | stevemar, https://ipa.younglogic.net/ipa/ui/#/e/user/search if you go there, your browser might have the old password cached | 21:40 |
| ayoung | morganfainberg, so, yeah, the ldap query for List-users-in-groups is returning no values | 21:41 |
| morganfainberg | ayoung, *blink* | 21:41 |
| ayoung | I've executed the same thing by handin the CLI, and it seems to work | 21:41 |
| ayoung | basically | 21:41 |
| morganfainberg | the *rest* API is not working or horizon's call isn't? | 21:42 |
| morganfainberg | or you mean you used LDAPSearch and got results | 21:42 |
| *** edmondsw has quit IRC | 21:42 | |
| ayoung | ldapsearch -s base -Y gssapi -D "cn=directory manager" -b cn=keystoners,cn=groups,cn=accounts,dc=younglogic,dc=net member | 21:42 |
| ayoung | minus the gssapi part | 21:42 |
| ayoung | deep in the ldap backend... | 21:42 |
| ayoung | /usr/lib/python2.7/site-packages/keystone/common/ldap/core.py(1452)_ldap_get_list() | 21:43 |
| *** vejdmn has quit IRC | 21:43 | |
| ayoung | hmmmm...using the packages, and this is slightly out of date | 21:44 |
| ayoung | in git that line is one function up | 21:44 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/ldap/core.py#n1452 | 21:44 |
| ayoung | the line I was looking at was | 21:44 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/ldap/core.py#n1469 | 21:45 |
| ayoung | I wonder if there is a bug fix I'm missing | 21:45 |
| morganfainberg | ayoung, hmm. | 21:47 |
| ayoung | nah...all that code change back in April | 21:48 |
| ayoung | and may for bknudson 's change.... | 21:49 |
| *** dims__ has joined #openstack-keystone | 21:51 | |
| ayoung | morganfainberg, anyway, on my machine it resolves to | 21:51 |
| ayoung | return conn.search_s(search_base, scope, query, attrlist) | 21:51 |
| bknudson | don't git blame me. | 21:51 |
| bknudson | I'm just the git messenger | 21:51 |
| ayoung | print search_base | 21:51 |
| ayoung | cn=keystoners,cn=groups,cn=accounts,dc=younglogic,dc=ne | 21:51 |
| ayoung | scope =0 which should be 'base' | 21:52 |
| ayoung | query is just | 21:52 |
| ayoung | query | 21:52 |
| ayoung | (objectClass=groupOfNames) | 21:52 |
| ayoung | and | 21:52 |
| ayoung | print attrlist is ['member'] | 21:52 |
| ayoung | oh wait! | 21:53 |
| ayoung | now I get a result... | 21:53 |
| ayoung | [(u'cn=keystoners,cn=groups,cn=accounts,dc=younglogic,dc=net', {})] | 21:53 |
| ayoung | so it found the right dn and object, but there are no members | 21:54 |
| *** dims__ has quit IRC | 21:56 | |
| ayoung | debug shows this query | 21:58 |
| ayoung | 2014-10-30 21:57:31.322 13761 DEBUG keystone.common.ldap.core [-] LDAP search: base=cn=keystoners,cn=groups,cn=accounts,dc=younglogic,dc=net scope=0 filterstr=(objectClass=groupOfNames) attrs=['member'] attrsonly=0 search_s /usr/lib/python2.7/site-packages/keystone/common/ldap/core.py:926 | 21:58 |
| *** harlowja has quit IRC | 22:00 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 22:00 | |
| *** dims__ has joined #openstack-keystone | 22:00 | |
| ayoung | nkinder, anything catch your eye there? | 22:02 |
| *** henrynash has joined #openstack-keystone | 22:02 | |
| *** stevemar2 has joined #openstack-keystone | 22:03 | |
| nkinder | ayoung: we have OS_AUTH_TYPE in OSC already | 22:03 |
| ayoung | do we? | 22:03 |
| ayoung | let me test | 22:03 |
| *** stevemar has quit IRC | 22:03 | |
| *** lhcheng has quit IRC | 22:03 | |
| nkinder | ayoung: https://github.com/nkinder/rdo-vm-factory/blob/master/rdo-kerberos-setup/vm-post-cloud-init-rdo.sh#L331 | 22:03 |
| ayoung | nkinder, need to get it into the docstinrg then | 22:04 |
| ayoung | but it works | 22:04 |
| nkinder | ayoung: yeah, I've been using it too | 22:04 |
| ayoung | nkinder, so the groups thing above ^^? | 22:04 |
| ayoung | anything jumping out at you? from the CLI it returns the members, but not python | 22:04 |
| nkinder | ayoung: let me get my daughter started on homework, then I'll take a look | 22:05 |
| ayoung | they look like the same query to me | 22:05 |
| * ayoung is jealous that kid doing homework does not require constant supervision. Not the case in my household | 22:05 | |
| *** lhcheng has joined #openstack-keystone | 22:07 | |
| henrynash | looking for other peoples views on what descriptive terms that would give a piece of Keystone that looked after the crud of Domains, Projects and Role entities? Assuming that “gaggle, herd or shoal” are all unsuitable….any ideas? Right now we have “asset” or “resource” as ideas | 22:11 |
| nkinder | ayoung: oh, my house is no different. I may get 2 minutes between pages though... | 22:12 |
| nkinder | ayoung: ok, so that filter is strange | 22:12 |
| henrynash | (this is for splitting up the current “assignments” component into “something| + “assignments”) | 22:13 |
| nkinder | ayoung: the filter would return every single group entry with all of their member attributes according to that debug log entry | 22:13 |
| ayoung | filterstr=(objectClass=groupOfNames) | 22:13 |
| ayoung | no, look at base | 22:13 |
| nkinder | ayoung: oh, the base | 22:13 |
| ayoung | it is the actual object | 22:13 |
| nkinder | ok, makes more sense | 22:13 |
| ayoung | its all about...ah forget it | 22:13 |
| * ayoung can feel the groans | 22:13 | |
| nkinder | ayoung: so you are trying to list all members of a group? What OSC command are you using? | 22:14 |
| *** stevemar2 has quit IRC | 22:14 | |
| ayoung | nkinder, it gets base a DN, so I can't help but think its the attrs | 22:14 |
| ayoung | openstack --os-auth-type v3kerberos group contains user 9df5b04e923a0d4a10081ccc76db25f7317784f44a6b88680a0633480a23f32c 51dade76c252e37121c87720d183075d2ab1aa4177b87a341a58375b23e5ffce | 22:14 |
| ayoung | nkinder, I used rpdb and stepped through | 22:15 |
| *** rm_work has quit IRC | 22:15 | |
| ayoung | nkinder, read up just after where bknudson says "git messenger" | 22:15 |
| ayoung | #define LDAP_SCOPE_BASE ((ber_int_t) 0x0000) | 22:16 |
| ayoung | so the scope is right | 22:16 |
| bknudson | there's no members in that entry | 22:18 |
| ayoung | bknudson, there is when I execute it from the CLI | 22:18 |
| nkinder | ayoung: it works for me | 22:18 |
| ayoung | bknudson, when I execute | 22:18 |
| ayoung | ldapsearch -Y GSSAPI -H ldap://ipa.younglogic.net -s base -b cn=keystoners,cn=groups,cn=accounts,dc=younglogic,dc=net "(objectClass=groupOfNames)" member | 22:19 |
| ayoung | I get back dn: cn=keystoners,cn=groups,cn=accounts,dc=younglogic,dc=net | 22:19 |
| ayoung | member: uid=ayoung,cn=users,cn=accounts,dc=younglogic,dc=net | 22:19 |
| ayoung | and many more | 22:19 |
| bknudson | is it that you don't have authority to get back member attribute? | 22:19 |
| bknudson | or keystone doesn't have authority | 22:19 |
| ayoung | was just thinking that | 22:19 |
| ayoung | keystone is doing an anoymous bind | 22:20 |
| ayoung | anonymous even | 22:20 |
| nkinder | ayoung: ok, that could be it | 22:20 |
| *** rm_work has joined #openstack-keystone | 22:20 | |
| ayoung | how do I query the ACL on that object? | 22:20 |
| *** rm_work has quit IRC | 22:20 | |
| *** rm_work has joined #openstack-keystone | 22:20 | |
| bknudson | $ ldapsearch -x SIMPLE -H ldap://ipa.younglogic.net -s base -b cn=keystoners,cn=groups,cn=accounts,dc=younglogic,dc=net "(objectClass=groupOfNames)" member | 22:20 |
| nkinder | ayoung: I think I create a user with no special privs | 22:20 |
| nkinder | ayoung: yeah, just do what bknudson says ^^^ | 22:20 |
| nkinder | ayoung: easier to just test it than to look up the ACL (which is stored at a different level than the group) | 22:21 |
| ayoung | no members returned | 22:21 |
| nkinder | ayoung: now bind as a user | 22:21 |
| nkinder | ...and do the same search | 22:21 |
| ayoung | I'll try an non-prived user after dinner | 22:21 |
| bknudson | it's just ldapsearch -x will do simple auth, don't need SIMPLE (it was taking that as an attribute name) | 22:27 |
| *** bknudson has quit IRC | 22:27 | |
| ayoung | nkinder, that worked. Important safety tip | 22:29 |
| ayoung | and now all keystoners are members of the keystoners group | 22:29 |
| nkinder | ayoung: my preso already says what access the bind user needs to have when configuring keystone for LDAP | 22:29 |
| nkinder | ayoung: listing group members is one of those things :) | 22:30 |
| ayoung | Nice | 22:30 |
| ayoung | Didn't realize that was limited by an anonymous bind, but it makes sense. IPA has cautious defaults. As it should | 22:30 |
| ayoung | There might still be an issue with listing the projects for a user. | 22:31 |
| nkinder | ayoung: I know some deployments that completely disable anonymous binds too | 22:31 |
| nkinder | ...or limit it to root DSE lookups | 22:31 |
| ayoung | And I see an issue with getting the usage information, not sure what that is | 22:31 |
| ayoung | OK..dinner and then gym for me. | 22:31 |
| *** thedodd has quit IRC | 22:32 | |
| *** lhcheng has quit IRC | 22:36 | |
| *** chrisshattuck has joined #openstack-keystone | 22:40 | |
| *** marcoemorais has quit IRC | 22:40 | |
| *** marcoemorais has joined #openstack-keystone | 22:40 | |
| *** harlowja has joined #openstack-keystone | 22:41 | |
| *** lhcheng has joined #openstack-keystone | 22:44 | |
| *** edmondsw has joined #openstack-keystone | 22:47 | |
| *** lcurtis has quit IRC | 22:50 | |
| *** chrisshattuck has quit IRC | 22:52 | |
| *** andreaf has joined #openstack-keystone | 23:10 | |
| *** lbragstad1 has joined #openstack-keystone | 23:31 | |
| *** edmondsw has quit IRC | 23:32 | |
| *** lbragstad1 has left #openstack-keystone | 23:36 | |
| *** henrynash has quit IRC | 23:39 | |
| *** andreaf_ has joined #openstack-keystone | 23:43 | |
| *** andreaf has quit IRC | 23:44 | |
| *** boris-42 has quit IRC | 23:45 | |
| *** boris-42 has joined #openstack-keystone | 23:50 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!