| *** shakamunyi has quit IRC | 00:01 | |
| *** marcoemorais1 has joined #openstack-keystone | 00:02 | |
| *** shakamunyi has joined #openstack-keystone | 00:03 | |
| *** dtturner has quit IRC | 00:04 | |
| *** marcoemorais has quit IRC | 00:06 | |
| *** david-lyle_afk is now known as david-lyle | 00:10 | |
| patrickeast | Hi all, I’m getting an error with my DevStack related to keystone (i think), when starting up i see “ERROR: openstack The plugin token_endpoint could not be found” whenever it tries to run openstack commands. Any ideas why it would be doing that? I see the token_endpoint.py file in my devstack in the keystoneclient/auth directory so I’m not sure what the isse is | 00:15 |
|---|---|---|
| patrickeast | i’m not sure if its a config issue or some new change that caused this, it only started to break my CI a few hours ago | 00:15 |
| jamielennox | patrickeast: that's weird, stevemar did you merge that change to OSC? | 00:15 |
| jamielennox | doesn't look like it | 00:16 |
| jamielennox | so the current master of OSC does a few weird tings with token_endpoint it doesn't use the one from keystoneclient it does its own | 00:16 |
| patrickeast | oh interesting | 00:17 |
| *** Viswanath has joined #openstack-keystone | 00:17 | |
| jamielennox | it wwill, but it doesnt at the moment | 00:18 |
| patrickeast | ah ok, this thing? https://github.com/openstack/python-openstackclient/blob/747a62494ca17375b835c54992ea5907e68a9a4f/openstackclient/api/auth.py#L183 | 00:19 |
| *** zzzeek has quit IRC | 00:19 | |
| *** Viswanath has quit IRC | 00:20 | |
| jamielennox | patrickeast: yes, and adds it to setuptools https://github.com/openstack/python-openstackclient/blob/747a62494ca17375b835c54992ea5907e68a9a4f/setup.cfg#L31 | 00:24 |
| jamielennox | why is generally a bad idea as it's going to conflict with the existing plugin | 00:24 |
| jamielennox | (which is currently a little broken) | 00:24 |
| *** tellesnobrega_ has joined #openstack-keystone | 00:28 | |
| stevemar | jamielennox, sry bout the late reply... the only thing merged to osc recently was to use test fixtures from ksc | 00:31 |
| *** lhcheng has quit IRC | 00:31 | |
| jamielennox | stevemar: yea saw that, just not sure why patrickeast would have started seeing that error | 00:31 |
| *** lhcheng has joined #openstack-keystone | 00:32 | |
| patrickeast | jamielennox: stevemar: hmm yea looking around through the code and logs from the run I’m not sure what changed, the weird part is that things look ok on the official jenkins but at least a couple 3rd party ci’s are suffering from it | 00:33 |
| jamielennox | patrickeast: i can understand the keystoneclient token_endpoint clashing with the osc token_endpoint | 00:34 |
| jamielennox | and they don't work the same | 00:34 |
| jamielennox | also the ksc one is a little broken unfortunately https://review.openstack.org/133866 and https://review.openstack.org/#/c/133865/1 | 00:35 |
| jamielennox | stevemar: i think OSC loads token_endpoint by name rather than directly? | 00:35 |
| *** lhcheng has quit IRC | 00:36 | |
| patrickeast | looks like by name https://github.com/openstack/python-openstackclient/blob/8ba74451ee9efe21a0554c184f28e380fe714313/openstackclient/common/clientmanager.py#L90 | 00:38 |
| *** tellesnobrega_ has quit IRC | 00:39 | |
| *** tellesnobrega_ has joined #openstack-keystone | 00:40 | |
| *** tellesnobrega_ has quit IRC | 00:48 | |
| jamielennox | ayoung: looking at certmonger - how do you set the default CA | 00:49 |
| *** gokrokve has quit IRC | 00:49 | |
| jamielennox | there doesn't seem to be an option for it (which seems dumb) | 00:49 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 00:51 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments controller https://review.openstack.org/132634 | 00:53 |
| openstackgerrit | henry-nash proposed openstack/keystone: Ensure controllers and managers reference new resource manager. https://review.openstack.org/133525 | 00:54 |
| *** henrynash has quit IRC | 00:55 | |
| *** raildo has joined #openstack-keystone | 01:00 | |
| *** wwriverrat has joined #openstack-keystone | 01:01 | |
| *** _cjones_ has quit IRC | 01:01 | |
| *** amcrn has quit IRC | 01:04 | |
| *** dims_ has quit IRC | 01:05 | |
| *** dims has joined #openstack-keystone | 01:06 | |
| *** nkinder has joined #openstack-keystone | 01:07 | |
| *** alex_xu has joined #openstack-keystone | 01:14 | |
| *** shakamunyi has quit IRC | 01:14 | |
| *** RockKuo_Office has joined #openstack-keystone | 01:21 | |
| *** gyee has quit IRC | 01:25 | |
| *** gokrokve has joined #openstack-keystone | 01:28 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Constraint to prevent duplicates endpoints https://review.openstack.org/134095 | 01:29 |
| *** marcoemorais1 has quit IRC | 01:30 | |
| *** wwriverrat has quit IRC | 01:32 | |
| openstackgerrit | ZhiQiang Fan proposed openstack/python-keystoneclient: Enable hacking rule F821 https://review.openstack.org/134096 | 01:33 |
| ayoung | jamielennox, you have to specify which CA to use. I think we will have our own logic for which to select | 01:35 |
| ayoung | I was just working on that Spec | 01:35 |
| jamielennox | the devstack certmonger thing? | 01:36 |
| jamielennox | i was just playing with certmonger, i've done this before and remember it being fairly simple | 01:36 |
| jamielennox | now it's being a PITA | 01:36 |
| jamielennox | https://bugzilla.redhat.com/show_bug.cgi?id=1163539 doesn't help | 01:37 |
| uvirtbot | jamielennox: Error: Could not parse XML returned by bugzilla.redhat.com: HTTP Error 404: Not Found | 01:37 |
| openstackgerrit | ZhiQiang Fan proposed openstack/python-keystoneclient: Enable hacking rule F821 https://review.openstack.org/134096 | 01:40 |
| *** raildo has quit IRC | 01:47 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 01:51 | |
| *** tellesnobrega_ has joined #openstack-keystone | 01:53 | |
| *** wwriverrat has joined #openstack-keystone | 01:53 | |
| *** gokrokve has quit IRC | 01:56 | |
| *** gokrokve has joined #openstack-keystone | 01:56 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: certmonger https://review.openstack.org/134099 | 02:00 |
| *** gokrokve has quit IRC | 02:01 | |
| ayoung | jamielennox, it is not that bad, but you need to have the client dbus installed, and that is in somethinkg like dbus-xorg | 02:01 |
| jamielennox | ayoung: oh, i'm actually not so much thinking even just keystone | 02:02 |
| jamielennox | i was going to start with SSL in devstack | 02:02 |
| ayoung | ah, cool | 02:02 |
| ayoung | OK, so you need: | 02:02 |
| ayoung | sudo yum install /usr/bin/dbus-launch | 02:02 |
| jamielennox | IMO keystone should just get out of the cert management business altogehter | 02:02 |
| ayoung | that is in: | 02:02 |
| ayoung | dbus-x11-1.6.12-9.fc20.x86_64 | 02:03 |
| jamielennox | just drop the manage pki functions completely | 02:03 |
| ayoung | jamielennox, eventually | 02:03 |
| ayoung | but for now, there is tooling built around it, so this gives us a transition plan | 02:03 |
| ayoung | If devstack wants to ignore it, that should be fine | 02:03 |
| *** ayoung has quit IRC | 02:04 | |
| jamielennox | right, but whatever we do in certmonger is going to require some system setup and config | 02:05 |
| jamielennox | so it's not just a transition, it's if you do these changes then your old stuff will still work | 02:05 |
| jamielennox | we may as well just ditch it directly | 02:05 |
| *** ayoung has joined #openstack-keystone | 02:05 | |
| ayoung | jamielennox, and I managed to just kill my desktop X session | 02:06 |
| jamielennox | lol | 02:06 |
| jamielennox | yea, don't mess with dbus | 02:06 |
| ayoung | thought I was on a VM | 02:06 |
| *** tellesnobrega_ has quit IRC | 02:07 | |
| *** david-lyle is now known as david-lyle_afk | 02:08 | |
| ayoung | jamielennox, anyway...you run | 02:10 |
| ayoung | dbus-launch | 02:10 |
| ayoung | and if gives you two env vars | 02:10 |
| ayoung | really should export at least the second: | 02:10 |
| ayoung | DBUS_SESSION_BUS_PID=24453 | 02:10 |
| ayoung | so you can kill it when devstack is done | 02:10 |
| jamielennox | ayoung: i have the basics working | 02:11 |
| ayoung | nice! | 02:11 |
| jamielennox | wouldn't i just use the system bus? | 02:11 |
| ayoung | depends on if you want to force it to be done by root or not | 02:12 |
| jamielennox | rather than launch a custom | 02:12 |
| ayoung | I was doing it all as the end user | 02:12 |
| jamielennox | hmm, yea, might be a problem for devstack and re-running things | 02:12 |
| ayoung | which, for devstack, is the right approach | 02:12 |
| ayoung | for packaging, I suspect it is still correct, but would be willing to let it go to root as well | 02:12 |
| jamielennox | so by that i mean i have a test folder where i've gotten certs from certmaster, not wired any further than that | 02:12 |
| jamielennox | was trying to see if there was a way to influence the certmaster CA cert | 02:15 |
| jamielennox | can i change the one being used, can i fetch it over getcert or something | 02:15 |
| openstackgerrit | ZhiQiang Fan proposed openstack/python-keystoneclient: Enable hacking rule E122 https://review.openstack.org/134101 | 02:16 |
| *** browne has quit IRC | 02:17 | |
| *** tellesnobrega_ has joined #openstack-keystone | 02:17 | |
| openstackgerrit | ZhiQiang Fan proposed openstack/python-keystoneclient: Enable hacking rule H304 https://review.openstack.org/134102 | 02:21 |
| *** tellesnobrega_ has quit IRC | 02:25 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Constraint to prevent duplicates endpoints https://review.openstack.org/134095 | 02:33 |
| ayoung | jamielennox, you'd have to ask nalind | 02:36 |
| ayoung | jamielennox, but the CA cert is not what you need, you would need the corresponding private key, and, no, that cannot be fetched | 02:36 |
| jamielennox | ayoung: right - i just need to add the CA to the system list | 02:37 |
| *** diegows has quit IRC | 02:39 | |
| *** raildo has joined #openstack-keystone | 02:41 | |
| *** richm has quit IRC | 02:45 | |
| *** dims has quit IRC | 02:49 | |
| *** dims has joined #openstack-keystone | 02:50 | |
| *** raildo has quit IRC | 02:53 | |
| *** esp has joined #openstack-keystone | 02:55 | |
| *** patrickeast has quit IRC | 02:56 | |
| *** tellesnobrega_ has joined #openstack-keystone | 02:59 | |
| *** kobtea has joined #openstack-keystone | 03:25 | |
| *** kobtea has quit IRC | 03:29 | |
| *** browne has joined #openstack-keystone | 03:31 | |
| *** browne has quit IRC | 03:31 | |
| *** ctracey has quit IRC | 04:05 | |
| *** ctracey has joined #openstack-keystone | 04:06 | |
| *** gus_ has joined #openstack-keystone | 04:11 | |
| *** tristanC_ has joined #openstack-keystone | 04:12 | |
| *** RockKuo_ has joined #openstack-keystone | 04:12 | |
| *** colettecello has joined #openstack-keystone | 04:12 | |
| *** mhu has quit IRC | 04:12 | |
| *** htruta has quit IRC | 04:12 | |
| *** EmilienM has quit IRC | 04:12 | |
| *** vishy has quit IRC | 04:12 | |
| *** cyeoh has quit IRC | 04:12 | |
| *** redrobot has quit IRC | 04:12 | |
| *** gus has quit IRC | 04:12 | |
| *** RockKuo_Office has quit IRC | 04:12 | |
| *** afaranha has quit IRC | 04:12 | |
| *** mitz_ has quit IRC | 04:12 | |
| *** tristanC has quit IRC | 04:12 | |
| *** gothicmindfood has quit IRC | 04:12 | |
| *** tsufiev has quit IRC | 04:12 | |
| *** swartulv has quit IRC | 04:12 | |
| *** mitz has quit IRC | 04:12 | |
| *** henrique_ has joined #openstack-keystone | 04:12 | |
| *** mhu1 has joined #openstack-keystone | 04:12 | |
| *** tsufiev has joined #openstack-keystone | 04:12 | |
| *** mitz has joined #openstack-keystone | 04:12 | |
| *** mhu1 is now known as mhu | 04:12 | |
| *** afaranha has joined #openstack-keystone | 04:13 | |
| *** redrobot has joined #openstack-keystone | 04:14 | |
| *** redrobot is now known as Guest17627 | 04:14 | |
| *** EmilienM has joined #openstack-keystone | 04:14 | |
| *** cyeoh has joined #openstack-keystone | 04:15 | |
| *** swartulv has joined #openstack-keystone | 04:15 | |
| *** vishy has joined #openstack-keystone | 04:15 | |
| openstackgerrit | Takashi NATSUME proposed openstack/keystone: Enable cloud_admin to list projects in all domains https://review.openstack.org/134111 | 04:19 |
| *** ayoung is now known as ayoung-mia | 04:27 | |
| *** radez is now known as radez_g0n3 | 04:47 | |
| *** tellesnobrega_ has quit IRC | 04:52 | |
| *** marcoemorais has joined #openstack-keystone | 05:15 | |
| *** alex_xu has quit IRC | 05:16 | |
| *** marcoemorais1 has joined #openstack-keystone | 05:17 | |
| *** marcoemorais has quit IRC | 05:20 | |
| *** wwriverrat has quit IRC | 05:39 | |
| *** wwriverrat has joined #openstack-keystone | 05:40 | |
| *** wwriverrat has quit IRC | 05:40 | |
| *** wwriverrat has joined #openstack-keystone | 05:40 | |
| *** ajayaa has joined #openstack-keystone | 05:58 | |
| *** KanagarajM has joined #openstack-keystone | 05:59 | |
| *** ukalifon has joined #openstack-keystone | 06:05 | |
| *** k4n0 has joined #openstack-keystone | 06:09 | |
| *** wwriverrat has quit IRC | 06:22 | |
| *** kobtea has joined #openstack-keystone | 06:59 | |
| *** josecastroleon has quit IRC | 07:03 | |
| *** kobtea has quit IRC | 07:04 | |
| *** josecastroleon has joined #openstack-keystone | 07:12 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove local conf information from paste-ini https://review.openstack.org/134124 | 07:17 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove local conf information from paste-ini https://review.openstack.org/134125 | 07:23 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove local conf information from paste-ini https://review.openstack.org/134124 | 07:25 |
| *** stevemar has quit IRC | 07:29 | |
| *** __afazekas has quit IRC | 07:36 | |
| *** henrynash has joined #openstack-keystone | 07:38 | |
| *** harlowja has joined #openstack-keystone | 07:41 | |
| *** henrynash has quit IRC | 07:44 | |
| *** harlowja has quit IRC | 07:53 | |
| *** nellysmitt has joined #openstack-keystone | 08:01 | |
| *** afazekas has joined #openstack-keystone | 08:01 | |
| *** marcoemorais1 has quit IRC | 08:02 | |
| *** harlowja has joined #openstack-keystone | 08:06 | |
| *** marekd|away is now known as marekd | 08:12 | |
| marekd | lol, gating problems for domain inheriting roles. | 08:14 |
| marekd | ? | 08:14 |
| *** harlowja has quit IRC | 08:23 | |
| *** ukalifon has quit IRC | 08:29 | |
| *** amirosh has joined #openstack-keystone | 08:34 | |
| *** ajayaa has quit IRC | 08:36 | |
| *** gordc has joined #openstack-keystone | 09:07 | |
| *** henrynash has joined #openstack-keystone | 09:07 | |
| *** junhongl has quit IRC | 09:11 | |
| *** RockKuo_ has quit IRC | 09:11 | |
| *** junhongl has joined #openstack-keystone | 09:11 | |
| *** ukalifon has joined #openstack-keystone | 09:12 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove local conf information from paste-ini https://review.openstack.org/134124 | 09:16 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove local conf information from paste-ini https://review.openstack.org/134124 | 09:19 |
| *** RockKuo_ has joined #openstack-keystone | 09:24 | |
| *** henrynash has quit IRC | 09:25 | |
| *** henrynash has joined #openstack-keystone | 09:27 | |
| *** amirosh has quit IRC | 09:27 | |
| *** amirosh has joined #openstack-keystone | 09:27 | |
| *** amirosh has quit IRC | 09:28 | |
| *** amirosh has joined #openstack-keystone | 09:28 | |
| *** ajayaa has joined #openstack-keystone | 09:31 | |
| *** amirosh has quit IRC | 09:32 | |
| *** jistr has joined #openstack-keystone | 09:34 | |
| *** jacorob has quit IRC | 09:41 | |
| *** diegows has joined #openstack-keystone | 09:49 | |
| *** RockKuo_ has quit IRC | 09:53 | |
| *** eglynn-officeafk is now known as eglynn-office | 09:54 | |
| *** sluo_laptop has quit IRC | 09:58 | |
| *** RockKuo_ has joined #openstack-keystone | 10:06 | |
| *** aix has joined #openstack-keystone | 10:07 | |
| *** diegows has quit IRC | 10:17 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments controller https://review.openstack.org/132634 | 10:22 |
| *** alex_xu has joined #openstack-keystone | 10:25 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Ensure controllers and managers reference new resource manager. https://review.openstack.org/133525 | 10:27 |
| *** tellesnobrega_ has joined #openstack-keystone | 10:35 | |
| *** kobtea has joined #openstack-keystone | 10:37 | |
| *** henrynash has quit IRC | 10:39 | |
| *** kobtea has quit IRC | 10:41 | |
| openstackgerrit | Eamonn O'Toole proposed openstack/keystonemiddleware: Added pycrypto>=2.6 to requirements.txt https://review.openstack.org/134161 | 10:50 |
| *** tellesnobrega_ has quit IRC | 10:59 | |
| *** nellysmitt has quit IRC | 11:00 | |
| *** nellysmi_ has joined #openstack-keystone | 11:01 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Don't return ``user_name`` in mapped.Mapped class. https://review.openstack.org/134027 | 11:02 |
| *** marg7175 has joined #openstack-keystone | 11:03 | |
| *** mflobo has joined #openstack-keystone | 11:06 | |
| *** aix has quit IRC | 11:09 | |
| *** henrynash has joined #openstack-keystone | 11:09 | |
| *** marg7175 has quit IRC | 11:11 | |
| samuelms | marekd, ping | 11:11 |
| samuelms | marekd, having problems with domain inherited roles? | 11:11 |
| *** RockKuo_ has quit IRC | 11:11 | |
| samuelms | henrynash, ping | 11:12 |
| marekd | samuelms: hey | 11:13 |
| henrynash | samuelms: hi | 11:13 |
| marekd | i saw henrynash couldn't merge it. | 11:13 |
| henrynash | marekd: which one? | 11:13 |
| henrynash | marekd: oh, the bug fix? | 11:14 |
| *** amakarov_away is now known as amakarov | 11:14 | |
| samuelms | marekd, what kind of problem are you having ? | 11:14 |
| *** marg7175 has joined #openstack-keystone | 11:14 | |
| marekd | henrynash: yes, i could see lots of reverify as jenkins was failing on unrelated tests | 11:15 |
| marekd | https://review.openstack.org/#/c/132872/ | 11:15 |
| henrynash | marked: indeed…still trying! | 11:15 |
| marekd | samuelms: i don't have problems ith os-inherit - there were few problems with gating the fix :-) | 11:15 |
| marekd | samuelms: like https://review.openstack.org/#/c/132872/ | 11:15 |
| marekd | that's all | 11:15 |
| samuelms | marekd, ok taking a look at this | 11:17 |
| samuelms | henrynash, for my 'list role assignments' patch, I'd propose to use the same representation at manager and driver levels | 11:17 |
| samuelms | henrynash, and then controller formats as it needs | 11:18 |
| marekd | samuelms: sure, but henrynash is probably also reveryfing :P | 11:18 |
| samuelms | henrynash, take a look at https://review.openstack.org/#/c/132872/ | 11:18 |
| henrynash | samuelms: will do… | 11:18 |
| samuelms | :) | 11:19 |
| henrynash | samuelms: did you mean to send me an example of your proposal….or did you mean to just send me teh link of my failing patch? | 11:20 |
| samuelms | henrynash, haha sorry xD | 11:20 |
| samuelms | henrynash, https://etherpad.openstack.org/p/role-assignment-backend-language | 11:20 |
| henrynash | samuelms: rubbing if in, eh? | 11:20 |
| samuelms | haha :p | 11:21 |
| *** saipandi has joined #openstack-keystone | 11:22 | |
| *** links has joined #openstack-keystone | 11:22 | |
| henrynash | samuelms: I’ll be able to take a look in a while… | 11:23 |
| henrynash | samuelms: nice iea to write it up liek that | 11:23 |
| samuelms | henrynash, ok thanks :-) | 11:24 |
| *** aix has joined #openstack-keystone | 11:25 | |
| *** KanagarajM has quit IRC | 11:27 | |
| samuelms | henrynash, you'll be working on domain owned roles, right? | 11:27 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments controller https://review.openstack.org/132634 | 11:28 |
| henrynash | samuelms: I’d have thought so, yes :-) | 11:29 |
| samuelms | henrynash, really would like to work on that with you :) | 11:29 |
| samuelms | henrynash, from spec to merge | 11:29 |
| henrynash | samuelms: you mean the “domain-ness” idea and inheritance…or something else... | 11:29 |
| henrynash | samuelms: or the role groups idea? | 11:30 |
| samuelms | henrynash, yes .. 'domain-ness' idea, where we will have roles owned by those entities (namespaced roles) | 11:30 |
| henrynash | samuelms: right, got it | 11:30 |
| henrynash | samuelms: happy to work on it together! | 11:31 |
| samuelms | henrynash, :D | 11:31 |
| samuelms | henrynash, have you already started the spec? (we need one, right) | 11:31 |
| marekd | henrynash: samuelms: you want to take a look at a chain of reviews? | 11:33 |
| marekd | starting with https://review.openstack.org/#/c/133005/3 | 11:33 |
| samuelms | marekd, sure .. will take a look on them today | 11:35 |
| samuelms | marekd, it's time to learn about federation (-: | 11:36 |
| marekd | samuelms: sure, why not | 11:36 |
| henrynash | samuelms: well my approach is a bit different than perhaps other expect…spec is here: https://review.openstack.org/#/c/133855/ | 11:37 |
| henrynash | marekd: will do | 11:37 |
| openstackgerrit | henry-nash proposed openstack/keystone: Ensure controllers and managers reference new resource manager. https://review.openstack.org/133525 | 11:38 |
| *** henrynash has quit IRC | 11:38 | |
| marekd | thanks. | 11:38 |
| *** lhcheng has joined #openstack-keystone | 11:41 | |
| *** lhcheng has quit IRC | 11:42 | |
| *** lhcheng has joined #openstack-keystone | 11:42 | |
| samuelms | henrynash, ok thanks for the link .. will take a look at | 11:44 |
| *** dims has quit IRC | 12:07 | |
| *** dims has joined #openstack-keystone | 12:08 | |
| *** henrynash has joined #openstack-keystone | 12:14 | |
| *** ajayaa has quit IRC | 12:35 | |
| *** diegows has joined #openstack-keystone | 12:44 | |
| *** ajayaa has joined #openstack-keystone | 12:48 | |
| *** amirosh has joined #openstack-keystone | 12:49 | |
| *** marg7175 has quit IRC | 12:52 | |
| *** henrynash has quit IRC | 12:54 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Don't return ``user_name`` in mapped.Mapped class. https://review.openstack.org/134027 | 12:57 |
| *** diegows has quit IRC | 13:01 | |
| *** aix has quit IRC | 13:01 | |
| *** aix has joined #openstack-keystone | 13:04 | |
| *** afazekas has quit IRC | 13:07 | |
| *** raildo has joined #openstack-keystone | 13:18 | |
| *** nellysmi_ has quit IRC | 13:19 | |
| *** afazekas has joined #openstack-keystone | 13:23 | |
| *** saipandi has quit IRC | 13:25 | |
| *** miqui has joined #openstack-keystone | 13:31 | |
| *** marg7175 has joined #openstack-keystone | 13:32 | |
| marekd | morganfainberg: can we +2 this https://review.openstack.org/#/c/134027/3 ? | 13:32 |
| marekd | dstanek: ^^ | 13:32 |
| *** afazekas has quit IRC | 13:32 | |
| *** henrynash has joined #openstack-keystone | 13:34 | |
| *** henrynash has quit IRC | 13:40 | |
| *** aix has quit IRC | 13:40 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:43 | |
| *** lhcheng_ has joined #openstack-keystone | 13:44 | |
| *** raildo has quit IRC | 13:44 | |
| openstackgerrit | Eamonn O'Toole proposed openstack/keystonemiddleware: Added pycrypto>=2.6 to requirements.txt https://review.openstack.org/134161 | 13:45 |
| *** afazekas has joined #openstack-keystone | 13:45 | |
| *** alex_xu has quit IRC | 13:45 | |
| *** lhcheng has quit IRC | 13:47 | |
| *** radez_g0n3 is now known as radez | 13:48 | |
| *** jistr has quit IRC | 13:53 | |
| openstackgerrit | Henrique Truta proposed openstack/python-keystoneclient: Creating parameter to list inherited role assignments https://review.openstack.org/117300 | 13:54 |
| *** aix has joined #openstack-keystone | 13:54 | |
| *** jistr has joined #openstack-keystone | 13:54 | |
| *** raildo has joined #openstack-keystone | 13:56 | |
| *** alex_xu has joined #openstack-keystone | 13:58 | |
| *** gokrokve has joined #openstack-keystone | 14:00 | |
| *** henrynash has joined #openstack-keystone | 14:03 | |
| *** ityaptin has joined #openstack-keystone | 14:05 | |
| *** nkinder has quit IRC | 14:08 | |
| *** packet has joined #openstack-keystone | 14:08 | |
| *** dims has quit IRC | 14:10 | |
| *** k4n0 has quit IRC | 14:10 | |
| *** dims has joined #openstack-keystone | 14:10 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Replace the concept of extensions in Keystone. https://review.openstack.org/133809 | 14:11 |
| *** richm has joined #openstack-keystone | 14:12 | |
| *** wolsen has quit IRC | 14:19 | |
| *** wolsen has joined #openstack-keystone | 14:19 | |
| *** diegows has joined #openstack-keystone | 14:22 | |
| *** marg7175 has quit IRC | 14:23 | |
| *** marg7175 has joined #openstack-keystone | 14:24 | |
| *** alex_xu has quit IRC | 14:40 | |
| *** afazekas has quit IRC | 14:44 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Move test_pemutils.py to unit test directory https://review.openstack.org/134233 | 14:45 |
| *** svasheka has joined #openstack-keystone | 14:49 | |
| svasheka | hi guys, is there any good documentation on how create trusts with python api? | 14:49 |
| morganfainberg | Marek +2 | 14:50 |
| lbragstad | svasheka: https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-trust-ext.md might be a good place to start if you haven't already referenced it | 14:50 |
| svasheka | thanks, I'm trying to test keystone with rally, so I need python bindings examples | 14:52 |
| *** nkinder has joined #openstack-keystone | 14:54 | |
| marekd | does anybody have some experience regarding python-keyring? | 14:56 |
| marekd | morganfainberg: thanks. | 14:56 |
| *** afazekas has joined #openstack-keystone | 15:00 | |
| *** jistr has quit IRC | 15:06 | |
| *** jistr has joined #openstack-keystone | 15:07 | |
| *** ajayaa has quit IRC | 15:13 | |
| *** gokrokve_ has joined #openstack-keystone | 15:15 | |
| *** gokrokve has quit IRC | 15:19 | |
| *** saipandi has joined #openstack-keystone | 15:24 | |
| amakarov | morganfainberg, hello! Can you please review my spec change for redelegation? (you asked for it :)) https://review.openstack.org/#/c/131541/ | 15:25 |
| *** stevemar has joined #openstack-keystone | 15:26 | |
| morganfainberg | amakarov: yes I can review it. We have some changes we've been discussing that are in line with that as well. | 15:26 |
| morganfainberg | Not sure when I'll be doing reviews today. Still recovering a little from jet lag. | 15:26 |
| morganfainberg | marekd: What's up with keyring? It's... Been kinda thorny / icky in the past. | 15:27 |
| amakarov | morganfainberg, good luck with that ) Is there any blueprint for changes? | 15:27 |
| marekd | morganfainberg: so i want to go ahead and enhance saml2 client plugins and make them store unscoped tokens in some cache - simply doing federated auth seems to be too expensive. | 15:28 |
| morganfainberg | amakarov: it is more along the lines we want to make delegation (and re delegation) part of the base API instead of it being an extension. | 15:28 |
| marekd | morganfainberg: however currently everytime i want to set/get a password i need to pass my desktop password | 15:29 |
| marekd | and was wondering if this could be somehow disabled. | 15:29 |
| morganfainberg | marekd: sure. I *think* it can. But I am unsure how. | 15:29 |
| morganfainberg | This is outside my knowledge of keyring. | 15:29 |
| marekd | morganfainberg: basically i think this could be done for auth plugins for general, but jamielennox seems to need to wait and he adviced me to play in my own playground - with saml auth plugins. | 15:30 |
| morganfainberg | amakarov: so, the spec is very valid, just might get a little reworking as we go through it. | 15:30 |
| morganfainberg | ;) | 15:30 |
| *** kobtea has joined #openstack-keystone | 15:30 | |
| morganfainberg | amakarov: I'll definitely review today and comment as I see needed. | 15:30 |
| morganfainberg | marekd: I agree we can make the ux better for everyone and all plugins. | 15:31 |
| marekd | morganfainberg: i'd say it's proper use of tokens :-) | 15:31 |
| marekd | morganfainberg: isn't it currently that there are tokens valid for n hours, but with each REST call Keystoe isses a new one? | 15:32 |
| morganfainberg | Lol. Since we're not ditching tokens.... Yeah. | 15:32 |
| amakarov | morganfainberg, ah, I recall something about that from sessions. +1, extension framework is indeed a strange thing for core feature implementation :) | 15:32 |
| marekd | morganfainberg: exactly, and this fills the db. | 15:32 |
| morganfainberg | People keep pushing for reissuing tokens. I'd rather use keyring. That seems way better | 15:32 |
| morganfainberg | Keyring is clients being smart, not the server needing to know if it should reissue a token. | 15:33 |
| morganfainberg | It feels like a client should be smart in that regard. Over needing to make the server way way more aware of your intentions. | 15:33 |
| marekd | morganfainberg: i will propose something for saml eiter way and this may be a starting point for some architecture decision. | 15:34 |
| morganfainberg | Sounds good. | 15:34 |
| stevemar | morganfainberg, heads up on https://bugs.launchpad.net/keystone/+bug/1392264 | 15:34 |
| uvirtbot | Launchpad bug 1392264 in keystone "Keystonemiddleware crashes when memcache encryption is enabled with Swift" [Undecided,New] | 15:34 |
| morganfainberg | Really? Nice. :( | 15:35 |
| *** kobtea has quit IRC | 15:35 | |
| *** diegows has quit IRC | 15:35 | |
| morganfainberg | stevemar: ok let's confirm that is actually happening and get that prioritized high/critical if it is (justifies a release as soon as fixed if it's happening) | 15:36 |
| morganfainberg | Oh. | 15:37 |
| morganfainberg | I see what is going on. Uhhh. "Optional dep" | 15:37 |
| stevemar | morganfainberg, i'm just not sure if it ... yeah that bit | 15:37 |
| morganfainberg | stevemar: ok hmm. Let me finish my coffee and noodle on this one. | 15:38 |
| stevemar | if you're up for an easy one: https://review.openstack.org/#/c/133005/ :) | 15:39 |
| morganfainberg | stevemar: +3 | 15:42 |
| stevemar | yee haw | 15:42 |
| morganfainberg | stevemar: when I'm done with coffee need to pick your brain a little. | 15:43 |
| stevemar | sure | 15:43 |
| marekd | morganfainberg: keystoneclient puts into X-Auth-Token token_id (string) if the uuid tokens are used and *whole* thoken in case pki tokens are used, correct ? | 15:47 |
| morganfainberg | Yes. The PKI string *is* the ID for PKI tokens. | 15:48 |
| marekd | morganfainberg: so it's a json structure or again some random string? | 15:49 |
| marekd | i thought it's the json | 15:49 |
| morganfainberg | It is ASN1 encoded/signed json. | 15:50 |
| morganfainberg | But it could be some other opaque string (see ae-token proposal) | 15:50 |
| morganfainberg | Basically token ID is used. What that ID is can vary. Either middleware can validate it or keystone is asked to validate it (and return the json blob) | 15:51 |
| marekd | so, no matter is uuid tokens or pki tokens are used and my input is keystoneclient.access.AccessInfoV3 i can simply save access_token.auth_token value to a keyring or file or wherever ? | 15:51 |
| morganfainberg | Check to make sure auth_token string is the long (not hashed) form of PKI tokens. But yes if it is the full string. | 15:52 |
| *** jistr has quit IRC | 15:53 | |
| marekd | well, it's always used in ksc as a input val for X-Auth-Token, just wanted to make sure i don't need to serialize to str depending on token's type. | 15:53 |
| *** gokrokve_ has quit IRC | 15:53 | |
| morganfainberg | No you shouldn't need to serialize that in ether case. | 15:54 |
| marekd | thanks | 15:54 |
| *** gokrokve has joined #openstack-keystone | 15:54 | |
| *** raildo has quit IRC | 15:57 | |
| baffle | I'm trying to get keystone policy.json + v3 domains + roles to work. First I'm trying to do something simple like "list users in domain". The "admin" role is assigned to an "Administrators" group for the domain, wich my user is a member of. If I list effective role assignments for my user, the ID of the "admin" role pops up for the domain. But "user list --domain <domain>" doesn't work, 403. Ideas? My policy.json is based on the Juno v3cloud sa | 16:00 |
| *** ukalifon has quit IRC | 16:01 | |
| baffle | I'm scoped to my domain, not project. | 16:02 |
| *** raildo has joined #openstack-keystone | 16:02 | |
| henrynash | baffle: on the surface of it, you seem to be doing the right thing | 16:05 |
| henrynash | baffle: the fact that it is a 403 is a little interesting, since that’s “harder” than a 401 Unathorized | 16:06 |
| henrynash | baffle: are you using domain-specific config files? | 16:07 |
| henrynash | baffle: …and I’m assuming this is the osc (openstack client), not keystone client? | 16:08 |
| baffle | henrynash: Yes, this is OSC. | 16:08 |
| baffle | henrynash: No, not domain-specific config files, everything stored in SQL. | 16:08 |
| baffle | henrynash: Normal usage works fine, I have 130+ domains. | 16:08 |
| henrynash | baffle: nice!!! | 16:09 |
| henrynash | baffle: let me have a quick squint at the code…hold on | 16:09 |
| baffle | henrynash: And users of the magic admin_domain is able to list users etc. | 16:09 |
| henrynash | baffle: interesting | 16:09 |
| baffle | I'll pastebin relevant sections. | 16:09 |
| *** agireud has joined #openstack-keystone | 16:10 | |
| henrynash | baffle: thx…just got a phone call interrupt… | 16:11 |
| morganfainberg | hmm. | 16:12 |
| morganfainberg | ok | 16:12 |
| *** links has quit IRC | 16:14 | |
| baffle | henrynash: Here: http://paste.openstack.org/show/1tRLQffdJ4YVTxShuXWf/ | 16:15 |
| baffle | Usually I scope to a project with OS_PROJECT_NAME/OS_PROJECT_DOMAIN_NAME but now I've scoped to the domain with OS_DOMAIN_NAME instead. I guess that is correct? I tried both. | 16:18 |
| *** thedodd has joined #openstack-keystone | 16:20 | |
| *** links has joined #openstack-keystone | 16:27 | |
| baffle | (I'm not using the other roles anywhere yet, as I haven't been able to get things to work with just an "admin" role yet) | 16:29 |
| *** jacorob has joined #openstack-keystone | 16:31 | |
| raildo | baffle, maybe you can use the policy.v3cloudsample, so you can use roles like project_admin, domain_admin instead of just "admin" | 16:31 |
| *** dtturner has joined #openstack-keystone | 16:32 | |
| raildo | https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json | 16:32 |
| *** raildo has left #openstack-keystone | 16:32 | |
| *** raildo has joined #openstack-keystone | 16:32 | |
| baffle | raildo: I'm using that. | 16:33 |
| *** Guest17627 is now known as redrobot | 16:34 | |
| baffle | raildo: As I mentioned, "cloud_admin" works fine. :-/ | 16:35 |
| raildo | baffle, sorry I was offline when you spoke , I just read the log now | 16:36 |
| baffle | raildo: All the commands I issued in the paste is done with a user scoped to the admin_domain; The ID of that domain is in the cloud_admin entry in policy.json. | 16:36 |
| *** marekd is now known as marekd|away | 16:36 | |
| raildo | baffle, ok | 16:37 |
| baffle | raildo: So, when I get the role:admin working for identity:list_users, I want to replace it with role:identity_domain_admin or something similar instead. | 16:37 |
| baffle | DomainID of stenstad.net is "2cfcdadf1e944cabac0b28d0361c5de7", just noticed I hadn't listed that. | 16:38 |
| *** zzzeek has joined #openstack-keystone | 16:40 | |
| henrynash | baffle: nice paste info… | 16:42 |
| *** ajayaa has joined #openstack-keystone | 16:42 | |
| henrynash | raildo, baffle: not sure we need to change admin to domain_admin….I think it’s Ok as it is (raildo, I don’t think we’ve changed the v3 policy sample to use that, have we?) | 16:43 |
| raildo | henrynash, i don't think so... | 16:44 |
| raildo | i think that this match "domain_id:%(domain_id)s" is not working | 16:45 |
| raildo | maybe change this for target.domain_id | 16:45 |
| baffle | raildo: Yeah, that might be it. | 16:46 |
| henrynash | raildo: no, for list that’s not right | 16:46 |
| raildo | henrynash, hum... ok. | 16:47 |
| henrynash | raildo, it shouldn’t be target.domain_id for a list….I think it is correct as it is (but doesn’t explain why it;s not working) | 16:47 |
| henrynash | baffle: are you using inherited roles? | 16:47 |
| baffle | henrynash: Well, they're inherited from the group? | 16:48 |
| henrynash | baffle: ok, true….I was talking more about the OS-INHERIT extension, which allows you to assign a role to a domain in order that it be inherited to all projects in that domain | 16:49 |
| *** amirosh has quit IRC | 16:49 | |
| baffle | henrynash: No, nothing like that. | 16:50 |
| *** wwriverrat has joined #openstack-keystone | 16:50 | |
| henrynash | baffle: and it’s a 403, not a 401? | 16:50 |
| *** wwriverrat has left #openstack-keystone | 16:50 | |
| baffle | ERROR: cliff.app You are not authorized to perform the requested action: identity:list_users (HTTP 403) | 16:51 |
| *** jistr has joined #openstack-keystone | 16:51 | |
| baffle | keystone.log: 2014-11-13 17:51:32.294 12502 WARNING keystone.common.wsgi [-] You are not authorized to perform the requested action: identity:list_users | 16:52 |
| baffle | Hmmm. Maybe it's not here the problem is.. | 16:54 |
| henrynash | baffle: are you able to turn debug loggging on and get me a full keystone log of a failed attemtp | 16:54 |
| openstackgerrit | Merged openstack/keystone: Fix domain federation tokens for inherited roles. https://review.openstack.org/132872 | 16:56 |
| *** amirosh has joined #openstack-keystone | 16:56 | |
| rodrigods | henrynash, ^ finally! | 16:57 |
| henrynash | rodigods: yahhhhhh!!! | 16:57 |
| baffle | I'm just doing debug logging on the client now.. If I just do "user list" I see it tries to call "https://identity.api.zetta.io:35357/v3/users".. Will it only list users belonging to the domain I'm scoped to then? And I specify --domain I see it gets a 404 on https://identity.api.zetta.io:35357/v3/domains/stenstad.net and then it tries https://identity.api.zetta.io:35357/v3/domains?name=stenstad.net and gets a "Forbidden: You are not authorized | 16:57 |
| *** david-lyle_afk is now known as david-lyle | 16:58 | |
| *** _cjones_ has joined #openstack-keystone | 16:59 | |
| openstackgerrit | Henrique Truta proposed openstack/python-keystoneclient: Creating parameter to list inherited role assignments https://review.openstack.org/117300 | 17:01 |
| baffle | If I specify the domain_id instead of domain to --domain, it does https://identity.api.zetta.io:35357/v3/domains/2cfcdadf1e944cabac0b28d0361c5de7 and I get a {"error": {"message": "You are not authorized to perform the requested action: identity:get_domain", "code": 403, "title": "Forbidden"}} | 17:01 |
| henrynash | baffle: so when you list users, it will only proceeed with the call IF you have authorization….i.e. if you just try and list users for a domain you don’t have a role on, it will error, rather then give you nothing | 17:01 |
| henrynash | bffle: but it should give yo u a 401 not a 403 | 17:01 |
| *** wwriverrat has joined #openstack-keystone | 17:02 | |
| *** marcoemorais has joined #openstack-keystone | 17:02 | |
| *** ajayaa has quit IRC | 17:02 | |
| raildo | henrynash, ++ | 17:02 |
| baffle | henrynash: So, does a call to https://identity.api.zetta.io:35357/v3/users without any other specification just list users that are in my tokens scoped domain by default? Or do I need to specify that? And it seems like I'm unable to get domain info.. Confused. So confused.. | 17:03 |
| *** _cjones_ has quit IRC | 17:03 | |
| morganfainberg | henrynash, going to split up the non-persistent tokens spec now to "fix token provider" spec and then add a "non-persistent PKI provider" | 17:03 |
| *** _cjones_ has joined #openstack-keystone | 17:04 | |
| morganfainberg | so.. | 17:05 |
| baffle | identity:list_domains: "rule:cloud_admin", <- Shouldn't this be "rule:cloud_admin or rule:admin_required and domain_id:%(target.user.domain_id)s" ... Or something.. | 17:05 |
| baffle | With ( ) .. :) | 17:05 |
| openstackgerrit | Merged openstack/keystone: fix the wrong order of assertEqual args in test_v3 https://review.openstack.org/127110 | 17:05 |
| baffle | Same with identity:get_domain? | 17:05 |
| henrynash | baffle: so that is determined by the policy.json file, which says: if you are “cloud admin” then you can list everything, but if not then you must specific a domain and you must use a domain scoped token for teh call that matches that domain AND has the role ‘admin’ in it | 17:06 |
| baffle | henrynash: I'm thinking I'm having a problem with using a specific domain, because only cloud_admin has access to information about the domain? If I understand the v3cloudsample policy correctly.. | 17:07 |
| *** miqui has quit IRC | 17:08 | |
| baffle | henrynash: And it seems the client wants do do some lookups on that domain.. | 17:08 |
| henrynash | baffle: so teh fact that only cloud admin can acccess it, tells us that the something is wrong with matching teh domain you are asking for against the token you are provding (for list_users) | 17:08 |
| *** wwriverrat has left #openstack-keystone | 17:09 | |
| henrynash | baffle: you can argue whether a domain admin should be able to list his own domain (and he probably should be able to)….remember that v3policysample is just a guide to setting this up…we exepct peopel to modify it | 17:09 |
| baffle | Yeah.. When I use the cloud admin, it does a GET for https://identity.api.zetta.io:35357/v3/domains/stenstad.net wich 404s, then it does a GET for https://identity.api.zetta.io:35357/v3/domains?name=stenstad.net to get the domain ID.. Wich is what the "normal" admin gets a 403 on.. Then it does GET https://identity.api.zetta.io:35357/v3/users?domain_id=2cfcdadf1e944cabac0b28d0361c5de7 .. | 17:09 |
| henrynash | are you sure you are working with domain scoped token? | 17:10 |
| baffle | henrynash: Yeah, and I really want to, but it's hard to understand everything. :) | 17:10 |
| *** miqui has joined #openstack-keystone | 17:11 | |
| henrynash | baffle: agreed….I wrote most of it, and I still struggle sometimes :-) | 17:11 |
| *** afazekas has quit IRC | 17:12 | |
| henrynash | baffle: …actually I have looked at code that eventually does check the policy file and (surprising, to me anyway) it does indeed throw a 403 if you don’t have the correct role…so maybe the 403 isn’t that unusual here…and points to (for some reason) there not being the correct domain/role match | 17:14 |
| henrynash | baffle: I think I really need a keystone server debiug log, unfortutnaley | 17:14 |
| baffle | henrynash: Yeah, pretty sure. I auth just like I do with my cloud-admin user. | 17:14 |
| baffle | I can ghetto in some debug logging. This is a superlive platform. 8) | 17:15 |
| henrynash | baffle: I kind of guessed that was the case :-) | 17:15 |
| baffle | But I think the problem is that the client is trying to look up the domain_id, but it's not allowed to do that.. | 17:15 |
| *** aix has quit IRC | 17:16 | |
| baffle | Since only users that match the cloud_admin rule will actually be able to do a domain search to get the domain_id.. | 17:16 |
| baffle | So, I think it boilds down to missing access to look up my own domain_id using v3/domains?name=<my domain name> | 17:17 |
| baffle | Unless a call to v3/users will automatically filter output to my scoped domain.. Wich I don't really believe in. :) | 17:18 |
| *** diegows has joined #openstack-keystone | 17:18 | |
| *** links has quit IRC | 17:20 | |
| *** links has joined #openstack-keystone | 17:21 | |
| *** tellesnobrega_ has joined #openstack-keystone | 17:22 | |
| *** marg7175 has quit IRC | 17:23 | |
| henrynash | baffle: oh, I see what you mean | 17:24 |
| henrynash | baffle: one thing you could try is change the rule for “get domain” to be: | 17:27 |
| henrynash | "rule:cloud_admin or admin_and_matching_domain_id" | 17:28 |
| *** marg7175 has joined #openstack-keystone | 17:28 | |
| henrynash | this should let you at least read a domain as the domain admin | 17:28 |
| henrynash | baffle: so if that’s what the client is doing, then that should then work | 17:29 |
| baffle | henrynash: I'm suddenly unsure if I'm scoped to the domain or not.. I scope to the domain using OS_DOMAIN_NAME, right? | 17:31 |
| *** jistr has quit IRC | 17:32 | |
| *** marg7175 has quit IRC | 17:32 | |
| *** marcoemorais has quit IRC | 17:32 | |
| *** marcoemorais has joined #openstack-keystone | 17:33 | |
| *** openstackgerrit has quit IRC | 17:34 | |
| *** openstackgerrit has joined #openstack-keystone | 17:34 | |
| baffle | Does baffle@xwing:~$ openstack user list | 17:35 |
| baffle | ERROR: cliff.app You are not authorized to perform the requested action: identity:list_users (Disable debug mode to suppress these details.) (HTTP 403) | 17:35 |
| baffle | baffle@xwing:~$ openstack user list --domain stenstad.net | 17:35 |
| baffle | ERROR: cliff.app You are not authorized to perform the requested action: identity:list_domains (Disable debug mode to suppress these details.) (HTTP 403) | 17:35 |
| baffle | Sorry for pasting. It uses list_domains, not get_domain it seems. Hmm. | 17:35 |
| henrynash | baffle: so if osc is really using list_domains, then hmm, that’s a problem! | 17:37 |
| baffle | Yup. | 17:37 |
| henrynash | baffle: meaning, if it issues a list_domains on its way to doing a list_users, then that’s a problem | 17:37 |
| *** nellysmitt has joined #openstack-keystone | 17:38 | |
| baffle | Yes, it seems like it does. :-/ | 17:38 |
| henrynash | baffle: ouch | 17:38 |
| *** links has quit IRC | 17:38 | |
| baffle | Since you can't use "matcing_domain_id" in that search afaik. | 17:38 |
| henrynash | baffle: nope | 17:40 |
| henrynash | baffle: sounds liek we need a to raise a bug and get this looked at by a client folks | 17:40 |
| baffle | Or.. I'm not scoping something correctly. | 17:41 |
| henrynash | baffle: indeed | 17:42 |
| henrynash | baffle: but I don’t think cloud admin would work if you weren’t csoping corectly | 17:43 |
| baffle | So, if I scope to project, I have a token.project json stanza. If I scope to domain I have a token.domain stanza. That means I'm scoped to the domain, right? | 17:45 |
| baffle | I guess the question is if a call to /v3/users will actually reply with a filtered list based on the domain scope by default. I think it won't. | 17:46 |
| baffle | Sometimes I wonder if I'm the only one using v3. :) | 17:47 |
| *** colettecello is now known as gothicmindfood | 17:50 | |
| baffle | Yup. There we go.. Brought out some curl. If I call https://identity.api.zetta.io/v3/users/66b228407ee74fccb09dba5d672c41eb with my domain-scoped token, I get a user listing in return. | 17:50 |
| baffle | So seems I'm able to list out users, and that it is OSC that is the problem.. | 17:51 |
| *** gokrokve_ has joined #openstack-keystone | 17:52 | |
| *** topol has joined #openstack-keystone | 17:52 | |
| baffle | But I guess I still need to have a get_domain kind of access. | 17:52 |
| baffle | To actually look up the ID? Or? | 17:52 |
| baffle | Or, technically, that is in my token. | 17:53 |
| *** gokrokve has quit IRC | 17:55 | |
| *** gokrokve_ has quit IRC | 17:56 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: Kilo version of non-persistent token specification https://review.openstack.org/129736 | 17:57 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: Token Provider Cleanup Spec https://review.openstack.org/134314 | 17:57 |
| *** patrickeast has joined #openstack-keystone | 17:58 | |
| morganfainberg | stevemar, henrynash, ^ | 17:58 |
| *** marcoemorais has quit IRC | 18:01 | |
| *** marcoemorais has joined #openstack-keystone | 18:02 | |
| *** rharwood has quit IRC | 18:02 | |
| *** gokrokve has joined #openstack-keystone | 18:03 | |
| *** marcoemorais has quit IRC | 18:03 | |
| *** marcoemorais1 has joined #openstack-keystone | 18:03 | |
| *** amakarov is now known as amakarov_away | 18:03 | |
| *** openstackgerrit has quit IRC | 18:03 | |
| *** openstackgerrit has joined #openstack-keystone | 18:04 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 18:16 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:17 | |
| *** gokrokve has quit IRC | 18:17 | |
| *** gokrokve has joined #openstack-keystone | 18:18 | |
| *** afaranha has quit IRC | 18:18 | |
| *** henrique_ has quit IRC | 18:19 | |
| *** gabriel-bezerra has quit IRC | 18:19 | |
| *** links has joined #openstack-keystone | 18:19 | |
| *** samuelms has quit IRC | 18:19 | |
| *** tellesnobrega has quit IRC | 18:19 | |
| *** tellesnobrega_ has quit IRC | 18:20 | |
| *** raildo has quit IRC | 18:20 | |
| *** stevemar2 has joined #openstack-keystone | 18:20 | |
| *** gokrokve has quit IRC | 18:22 | |
| *** stevemar has quit IRC | 18:22 | |
| *** amcrn has joined #openstack-keystone | 18:30 | |
| dtturner | keystone gurus, I have a bizzare one here: Has anyone here ever seen requests for an openstack service being incorrectly routed to a service running on a completely different endpoint IP and port? | 18:31 |
| dtturner | I'm testing mistral. Upon launching mistral services, users report that every other request "or so" time out on them. When they experience the time outs, I see the requests in mistral logs. Of course mistral errors with noSuchMethod | 18:36 |
| *** gokrokve has joined #openstack-keystone | 18:36 | |
| dtturner | Keystone service endpoint for mistral is configured to point to a completely different IP/port. Keystone services have been bounced. Currently at a loss as to how this is happening. | 18:37 |
| *** nellysmitt has quit IRC | 18:39 | |
| *** gokrokve has quit IRC | 18:39 | |
| *** gokrokve has joined #openstack-keystone | 18:39 | |
| *** gokrokve has quit IRC | 18:39 | |
| *** gokrokve has joined #openstack-keystone | 18:40 | |
| *** vhoward has left #openstack-keystone | 18:43 | |
| *** thedodd has quit IRC | 18:44 | |
| henrynash | morganfainberg: I’ll checkout your token spec split a bit later…and if you have a few minutes, there are few more of the assignment fixes in teh chain that could get approved, starting at: https://review.openstack.org/#/c/133299/ | 18:45 |
| morganfainberg | henrynash, yeah sounds good. will start there shortly. taking a small break and still working on some writeup stuff (plus need to do expense reports today/tomorrow) | 18:45 |
| henrynash | morganfainberg: expenses……yeah, gotta do that too! | 18:46 |
| baffle | henrynash: Thanks for all your help, I'll post a features request/bug for OSC. Sorry for disturbing everyone with my enduser problems. :-) | 18:47 |
| *** openstackgerrit has quit IRC | 18:49 | |
| *** openstackgerrit has joined #openstack-keystone | 18:49 | |
| *** samuelms has joined #openstack-keystone | 18:49 | |
| *** htruta has joined #openstack-keystone | 18:49 | |
| *** raildo has joined #openstack-keystone | 18:50 | |
| *** tellesnobrega has joined #openstack-keystone | 18:50 | |
| *** tellesnobrega_ has joined #openstack-keystone | 18:50 | |
| *** edmondsw has joined #openstack-keystone | 18:52 | |
| *** marcoemorais1 has quit IRC | 18:52 | |
| *** marcoemorais has joined #openstack-keystone | 18:53 | |
| *** marcoemorais has quit IRC | 18:53 | |
| *** marcoemorais has joined #openstack-keystone | 18:53 | |
| *** afaranha has joined #openstack-keystone | 18:56 | |
| henrynash | baffle: no, it’s an excllent find! | 18:56 |
| *** gabriel-bezerra has joined #openstack-keystone | 18:57 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Move functional tests to keystone/tests/functional https://review.openstack.org/133556 | 18:59 |
| *** marcoemorais has quit IRC | 19:00 | |
| *** marcoemorais has joined #openstack-keystone | 19:00 | |
| *** marcoemorais has quit IRC | 19:00 | |
| *** marcoemorais has joined #openstack-keystone | 19:01 | |
| *** amcrn_ has joined #openstack-keystone | 19:01 | |
| *** marcoemorais has quit IRC | 19:01 | |
| *** marcoemorais has joined #openstack-keystone | 19:02 | |
| baffle | henrynash: Turns out I am late to the party. Must be a few weeks since I dit a git pull on OSC. https://bugs.launchpad.net/python-openstackclient/+bug/1378565 | 19:04 |
| uvirtbot | Launchpad bug 1378565 in python-openstackclient "The '--domain' arg for identity commands should not require domain lookup" [Undecided,Fix committed] | 19:04 |
| *** amcrn has quit IRC | 19:04 | |
| *** amcrn_ is now known as amcrn | 19:04 | |
| *** kobtea has joined #openstack-keystone | 19:08 | |
| henrynash | baffle: aaha! | 19:08 |
| henrynash | baffle: well at least we deduced the problem correctly! | 19:08 |
| baffle | So now instead of just failing on the 403 returned by the "GET /v3/domains?name=stenstad.net" (since we don't have permissions to list_domains) it goes forward and does a "GET /v3/users?domain_id=stenstad.net" .. Wich also doesn't work. But if I put in a domain_id in --domain it works. \o/ | 19:10 |
| henrynash | baffle: I think maybe a better fix is that we need to provide a way that an admin for domain can look up their ID given the domain name | 19:10 |
| baffle | henrynash: You mean except studying the auth token? :) | 19:10 |
| henrynash | baffle: :-) | 19:11 |
| henrynash | baffle: i.e. GET /domains?name=mydomainname should work if you have admin role on that domain | 19:11 |
| henrynash | baffle: but it doesn’t today | 19:11 |
| baffle | henrynash: Yeah, it is just a filter on list_domains right now. | 19:12 |
| *** kobtea has quit IRC | 19:12 | |
| henrynash | baffle: or an explict get domain by name call… | 19:13 |
| henrynash | baffle: which actually exists in teh code, we just don’t expose it | 19:13 |
| *** nellysmitt has joined #openstack-keystone | 19:14 | |
| *** openstackgerrit has quit IRC | 19:18 | |
| *** openstackgerrit has joined #openstack-keystone | 19:18 | |
| *** stevemar2 has quit IRC | 19:19 | |
| *** ayoung-mia is now known as ayoung | 19:25 | |
| ayoung | henrynash, "resource" do you really think that is the right name? | 19:25 |
| *** marcoemorais has quit IRC | 19:27 | |
| *** stevemar has joined #openstack-keystone | 19:28 | |
| *** marg7175 has joined #openstack-keystone | 19:29 | |
| *** marcoemorais has joined #openstack-keystone | 19:29 | |
| *** marcoemorais1 has joined #openstack-keystone | 19:31 | |
| *** marcoemorais1 has quit IRC | 19:31 | |
| *** marg7175 has quit IRC | 19:33 | |
| *** marcoemorais has quit IRC | 19:34 | |
| *** telemonster has joined #openstack-keystone | 19:36 | |
| telemonster | Any AD/LDAP ninjas around? I found out about this channel while digging through the bug tracking database. Our AD integreation works fine on Havana but moving that config into Icehouse -- | 19:38 |
| telemonster | it just fails with username / password. | 19:38 |
| ayoung | telemonster, I'd deny it with my dying breath | 19:38 |
| telemonster | I've played with the cn / sAMAccountName fields and stuff a bunch -- I don't think that's it | 19:38 |
| telemonster | I do notice when debugging is enabled on both, and running side by side there is a slight difference in one of the queries | 19:38 |
| ayoung | telemonster, Icehouse was a long time ago...I can't remember exactly what we did when | 19:41 |
| ayoung | sAMAccountName was a captialization issue. | 19:41 |
| ayoung | telemonster, can you get enough logging to see what it is actually trying to do? | 19:41 |
| telemonster | yea, ours was a working fine config on havana, moving up to icehouse seems problematic | 19:41 |
| telemonster | I can see the queries via logging but not the password check part | 19:42 |
| ayoung | of course not, we don't want to dump passwords to the log... | 19:42 |
| ayoung | is this production? | 19:43 |
| stevemar | baffle, henrynash whats up with OSC? | 19:44 |
| telemonster | yea. Doesn't AD use kerberos encrypted passwords? | 19:44 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Rename openid to oidc in test_auth_plugins.conf https://review.openstack.org/133494 | 19:47 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Adds dynamic checking for mapped tokens https://review.openstack.org/133130 | 19:47 |
| *** links has quit IRC | 19:48 | |
| *** chrisshattuck has joined #openstack-keystone | 19:48 | |
| ayoung | telemonster, test to make sure you can still do a simple bind. Guessing that, if you have not changed AD, it will still work | 19:49 |
| telemonster | I can see when I try to login with the sAMAccountName value, I can see the full name in the CN= fields, so the bind part is okay as data is coming back | 19:49 |
| telemonster | one thing that is different between new and old, is this ldap string visible on the console debug log output | 19:50 |
| telemonster | put_filter: "(&(cn=Neutron Service)(memberof:1.2.840.113556.1.4.1941:=CN=Cloud,OU=Security Groups,OU=User Accounts,DC=int,DC=company,DC=com)(objectClass=person))" | 19:50 |
| telemonster | the part "(cn=Neutron Service)" doesn't exist on the earlier, working, debug output strings | 19:51 |
| telemonster | We've got those accounts all created on the AD server and such | 19:51 |
| telemonster | I notice others are modifying code in the ldap core.py but looking at our version it's already different than what's in the bug tracking system so I'm thinking it was already fixed | 19:55 |
| *** sterns has joined #openstack-keystone | 19:55 | |
| *** thedodd has joined #openstack-keystone | 19:56 | |
| *** diegows has quit IRC | 19:57 | |
| *** gordc has quit IRC | 19:57 | |
| *** toddnni has quit IRC | 19:58 | |
| ayoung | telemonster, cool. Good luck. | 20:03 |
| telemonster | yea | 20:03 |
| telemonster | I'm looking to see if I can take the ldap module from the old version and jam it into icehouse | 20:03 |
| *** openstackgerrit has quit IRC | 20:04 | |
| *** openstackgerrit has joined #openstack-keystone | 20:04 | |
| *** rharwood has joined #openstack-keystone | 20:05 | |
| ayoung | stevemar, https://review.openstack.org/#/c/133037/6 maybe drop the dependency on the older doc review. It doesn't seem to be a real "depends" relationship | 20:20 |
| *** tellesnobrega_ has quit IRC | 20:21 | |
| stevemar | ayoung, meh, the other one is already gating | 20:21 |
| ayoung | the doc one has a big red X from Jenkins | 20:23 |
| ayoung | https://review.openstack.org/#/c/133005/3 | 20:23 |
| *** amirosh has quit IRC | 20:31 | |
| baffle | stevemar: The thing with OSC is that the use case "I am admin of a domain and want to do create/list/set operations on users/groups/projects" doesn't really work. It needs to know the domain_id to query /v3/users/ and similar functions. Up till some weeks ago, it tried to do a filtered search on /v3/domains?name=<domain_name> if you used the "--domain=<domain_name>" parameter to the commands. But since a domain admin (except v2 "default" admin | 20:32 |
| baffle | stevemar: https://review.openstack.org/#/c/126754/ | 20:32 |
| baffle | stevemar: So, there has to/should be a way for a domain admin to query its own domain_id from domain_name. Wich according to henrynash allready exists but isn't exposed externally. | 20:33 |
| *** agireud has quit IRC | 20:35 | |
| *** edmondsw has quit IRC | 20:40 | |
| *** topol has quit IRC | 20:44 | |
| *** _cjones_ has quit IRC | 20:45 | |
| *** edmondsw has joined #openstack-keystone | 20:50 | |
| *** vhoward has joined #openstack-keystone | 20:51 | |
| *** agireud has joined #openstack-keystone | 20:53 | |
| *** nellysmitt has quit IRC | 20:55 | |
| *** agireud has quit IRC | 20:57 | |
| stevemar | baffle, *reading* | 20:59 |
| stevemar | baffle, so what are your authN variables set to? and what commands are you trying to do? | 21:01 |
| stevemar | baffle, ah yeah, the linked review is exactly what i was thinking of... | 21:01 |
| baffle | stevemar: My authtoken is fine, in that I have access to /v3/users/<domain_id>/ to list users of my domain. | 21:02 |
| *** thedodd has quit IRC | 21:02 | |
| *** marcoemorais has joined #openstack-keystone | 21:02 | |
| *** agireud has joined #openstack-keystone | 21:05 | |
| stevemar | baffle, oh you're not using a uname/pass and domain scoping? | 21:08 |
| baffle | stevemar: Yeah, standard username/password and domain scoping. | 21:09 |
| *** thedodd has joined #openstack-keystone | 21:10 | |
| baffle | Hmm.. v3cloudsample currently has "identity:list_projects": "rule:admin_required and domain_id:%(domain_id)s", .... Wich means that the cloud_admin doesn't have permissions to list projects in other domains.. That can't be on purpose? :) | 21:11 |
| *** chrisshattuck has quit IRC | 21:14 | |
| *** chrisshattuck has joined #openstack-keystone | 21:16 | |
| *** openstackgerrit has quit IRC | 21:19 | |
| dtroyer | default domain question: keystone.conf has "#default_domain_id=default"…is a default name set anywhere? I've seen references to 'Default' working… | 21:19 |
| *** openstackgerrit has joined #openstack-keystone | 21:19 | |
| dtroyer | reason is https://review.openstack.org/#/c/132083/6/openrc,unified wants to set the default name for DevStack to 'Default' in openrc | 21:19 |
| *** sterns has left #openstack-keystone | 21:19 | |
| dtroyer | I'm thinking it would be better to set OS_xxx_DOMAIN_ID instead? | 21:20 |
| *** marg7175 has joined #openstack-keystone | 21:24 | |
| *** marg7175 has quit IRC | 21:29 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Fix broken references in OAuth code https://review.openstack.org/134364 | 21:29 |
| stevemar | morganfainberg, ^ | 21:29 |
| stevemar | dtroyer, DOMAIN_ID is probably better | 21:30 |
| stevemar | rather than name | 21:30 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Increase test coverage of test_versions.py https://review.openstack.org/134365 | 21:30 |
| baffle | policy.v3cloudsample.json has: "admin_and_matching_domain_id": "rule:admin_required and domain_id:%(domain_id)s", but it seems keystone is unable to parse it? See: http://paste.openstack.org/show/ZoPdw0lSO3JMftDRVDAK/ | 21:39 |
| baffle | Should it be domain_id:%(scope.domain.id)s) instead? | 21:40 |
| *** gokrokve has quit IRC | 21:42 | |
| *** amirosh has joined #openstack-keystone | 21:42 | |
| *** toddnni has joined #openstack-keystone | 21:45 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Increase test coverage of test_versions.py https://review.openstack.org/134365 | 21:45 |
| *** _cjones_ has joined #openstack-keystone | 21:46 | |
| *** jacorob has quit IRC | 21:46 | |
| *** amirosh has quit IRC | 21:47 | |
| *** thedodd has quit IRC | 21:47 | |
| *** junhongl has quit IRC | 21:53 | |
| *** junhongl has joined #openstack-keystone | 21:55 | |
| *** thedodd has joined #openstack-keystone | 21:56 | |
| *** saipandi has quit IRC | 21:56 | |
| *** nkinder has quit IRC | 21:56 | |
| *** _cjones_ has quit IRC | 22:03 | |
| *** gokrokve has joined #openstack-keystone | 22:08 | |
| *** tellesnobrega_ has joined #openstack-keystone | 22:08 | |
| *** thedodd has quit IRC | 22:13 | |
| *** radez is now known as radez_g0n3 | 22:14 | |
| *** zzzeek has quit IRC | 22:14 | |
| openstackgerrit | Merged openstack/keystone: Improve testing of project federation tokens for inherited roles. https://review.openstack.org/133091 | 22:19 |
| baffle | Nvm. | 22:28 |
| *** gyee has joined #openstack-keystone | 22:37 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add WSGIPassAuthorization to OAuth docs https://review.openstack.org/134388 | 22:37 |
| lbragstad | stevemar: client question for you | 22:40 |
| stevemar | lbragstad, be quick i'm about to head home | 22:40 |
| lbragstad | users can update their passwords to be empty strings '' | 22:40 |
| lbragstad | stevemar: that wasn't by design was it? | 22:40 |
| stevemar | what's the server side api say? you made the json schema validator :) | 22:41 |
| lbragstad | stevemar: that is in the identity api validation patch, | 22:41 |
| stevemar | ah | 22:42 |
| lbragstad | which hasn't landed yet because we have to rip out xml support first | 22:42 |
| lbragstad | anywho. I was just curioius | 22:42 |
| stevemar | then it'll work, but it's a fantastically shitty design | 22:42 |
| lbragstad | lol | 22:42 |
| lbragstad | ok | 22:42 |
| lbragstad | there was a couple bugs filed that were related to it | 22:42 |
| stevemar | it should probably be at least 1 character? | 22:42 |
| lbragstad | I would thinks o | 22:42 |
| lbragstad | think so* | 22:42 |
| lbragstad | anywho, thought I'd ask quick, no need to hold you up if you're heading home | 22:43 |
| *** gus_ is now known as gus | 22:43 | |
| stevemar | http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3.html#change-user-password | 22:43 |
| stevemar | yeah, there is probably no validation there | 22:44 |
| lbragstad | ok, | 22:44 |
| stevemar | it's probably broken as heck for non-alphanumerics too | 22:44 |
| lbragstad | the clients just check to make sure they aren't None | 22:44 |
| stevemar | but we get away with it by saying we're not an IdP | 22:44 |
| *** gus has quit IRC | 22:44 | |
| lbragstad | :) | 22:44 |
| lbragstad | case maker! | 22:44 |
| stevemar | anywho | 22:45 |
| stevemar | i'm out | 22:45 |
| stevemar | see ya boss | 22:45 |
| *** gus has joined #openstack-keystone | 22:45 | |
| lbragstad | later, thanks! | 22:45 |
| *** gus is now known as gus_ | 22:46 | |
| *** gus_ is now known as gus | 22:46 | |
| *** stevemar has quit IRC | 22:49 | |
| *** _cjones_ has joined #openstack-keystone | 22:59 | |
| *** diegows has joined #openstack-keystone | 23:00 | |
| *** marcoemorais has quit IRC | 23:00 | |
| *** marcoemorais has joined #openstack-keystone | 23:01 | |
| *** _cjones_ has quit IRC | 23:04 | |
| *** diegows has quit IRC | 23:06 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:08 | |
| *** nkinder has joined #openstack-keystone | 23:17 | |
| *** agireud has quit IRC | 23:19 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: Kilo version of non-persistent token specification https://review.openstack.org/129736 | 23:19 |
| *** henrynash has quit IRC | 23:20 | |
| *** zzzeek has joined #openstack-keystone | 23:23 | |
| *** henrynash has joined #openstack-keystone | 23:23 | |
| *** _cjones_ has joined #openstack-keystone | 23:25 | |
| openstackgerrit | Merged openstack/keystone: Move shib specific documentation https://review.openstack.org/133005 | 23:26 |
| *** henrynash has quit IRC | 23:27 | |
| *** marcoemorais has quit IRC | 23:33 | |
| *** marcoemorais has joined #openstack-keystone | 23:34 | |
| *** gokrokve has quit IRC | 23:42 | |
| *** stevemar has joined #openstack-keystone | 23:42 | |
| ekarlso | jamielennox: u up ? | 23:46 |
| ekarlso | I got some q on ksclient generic stuffs | 23:46 |
| *** kobtea has joined #openstack-keystone | 23:46 | |
| *** kobtea has quit IRC | 23:50 | |
| *** stevemar has quit IRC | 23:53 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!