| *** samuelms_ has joined #openstack-keystone | 00:00 | |
| dstanek | gyee: nope, pysaml2 provides a sample IdP - using that as the basis for functional testing | 00:00 |
|---|---|---|
| *** zz_avozza is now known as avozza | 00:00 | |
| gyee | dstanek, in that, just take a peak at the assertion issued by sample IdP to see what attributes are there | 00:03 |
| *** avozza is now known as zz_avozza | 00:10 | |
| *** zz_avozza is now known as avozza | 00:11 | |
| *** raildo has joined #openstack-keystone | 00:11 | |
| dstanek | gyee: yeah, right now i don't see anything in there so i've been looking through the code to see where it should happen | 00:20 |
| *** rm_work is now known as rm_work|away | 00:21 | |
| *** david-lyle is now known as david-lyle_afk | 00:35 | |
| morganfainberg | dstanek, got a sec? | 00:35 |
| dstanek | morganfainberg: sure | 00:35 |
| morganfainberg | dstanek, i need someone who can tell me why my understanding of python is wrong | 00:35 |
| morganfainberg | https://bugs.launchpad.net/keystone/+bug/1398470 | 00:35 |
| uvirtbot | Launchpad bug 1398470 in keystone "sql migration helpers incorrectly inspect for FKs" [High,In progress] | 00:35 |
| morganfainberg | why does inverting the if-clause change anything | 00:36 |
| morganfainberg | https://review.openstack.org/#/c/138468/4/keystone/common/sql/migration_helpers.py | 00:36 |
| morganfainberg | am i not seeing a paren somewhere? | 00:36 |
| morganfainberg | sure it might be slightly more work to do the if in x first | 00:37 |
| morganfainberg | but i'm not seeing why that is a "high" bug | 00:37 |
| dstanek | the bug is that if fk isn't a ForeignKeyConstraint it may not have a columns attribute to look at | 00:37 |
| morganfainberg | ah | 00:38 |
| morganfainberg | see that is what i was missing | 00:38 |
| *** dims has joined #openstack-keystone | 00:38 | |
| dstanek | now how in the heck did he catch that? | 00:38 |
| morganfainberg | must be an edge case for the most part because we really haven't hit that until now | 00:38 |
| morganfainberg | dstanek, i think he's doing something that involves this in the split assignment stuff | 00:39 |
| *** raildo has quit IRC | 00:39 | |
| dstanek | ah, that would make sense | 00:39 |
| dstanek | morganfainberg: yeah, in his bug he mentions that there are other types of constraints | 00:39 |
| morganfainberg | right most constraints though have a column attr | 00:39 |
| morganfainberg | clearly, because we haven't run into this | 00:40 |
| * morganfainberg is curious what constraint wouldn't have a column associated to it | 00:40 | |
| *** oomichi has joined #openstack-keystone | 00:41 | |
| *** raildo has joined #openstack-keystone | 00:51 | |
| *** raildo has quit IRC | 00:51 | |
| *** avozza is now known as zz_avozza | 01:06 | |
| openstackgerrit | wanghong proposed openstack/keystone: don't allow user to operate role on disabled proj or domain https://review.openstack.org/141746 | 01:28 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Fix up types within API documentation https://review.openstack.org/141693 | 01:30 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Fix up types within API documentation https://review.openstack.org/141693 | 01:36 |
| *** hdd has quit IRC | 01:43 | |
| *** marcoemorais has joined #openstack-keystone | 01:53 | |
| *** marcoemorais2 has joined #openstack-keystone | 01:55 | |
| *** chrisshattuck has quit IRC | 01:56 | |
| *** marcoemorais1 has quit IRC | 01:56 | |
| *** marcoemorais1 has joined #openstack-keystone | 01:57 | |
| *** marcoemorais has quit IRC | 01:58 | |
| *** marcoemorais3 has joined #openstack-keystone | 01:58 | |
| *** marcoemorais1 has quit IRC | 01:58 | |
| *** chrisshattuck has joined #openstack-keystone | 01:59 | |
| *** marcoemorais2 has quit IRC | 02:00 | |
| *** diegows has quit IRC | 02:01 | |
| *** marcoemorais3 has quit IRC | 02:02 | |
| *** marcoemorais has joined #openstack-keystone | 02:04 | |
| *** diegows has joined #openstack-keystone | 02:05 | |
| *** erkules_ has joined #openstack-keystone | 02:05 | |
| *** dims has quit IRC | 02:06 | |
| *** dims has joined #openstack-keystone | 02:06 | |
| *** marcoemorais has quit IRC | 02:07 | |
| *** erkules has quit IRC | 02:08 | |
| *** gyee has quit IRC | 02:09 | |
| *** dims has quit IRC | 02:11 | |
| *** oomichi has quit IRC | 02:16 | |
| *** diegows has quit IRC | 02:16 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Document session usage first https://review.openstack.org/127755 | 02:18 |
| *** zz_avozza is now known as avozza | 02:27 | |
| *** avozza is now known as zz_avozza | 02:38 | |
| openstackgerrit | wanghong proposed openstack/keystone: Can't update catalog objects when using kvs driver https://review.openstack.org/130180 | 02:39 |
| *** lhcheng has quit IRC | 02:41 | |
| *** chrisshattuck has quit IRC | 02:41 | |
| *** lhcheng has joined #openstack-keystone | 02:41 | |
| *** lhcheng has quit IRC | 02:46 | |
| *** jaosorior has joined #openstack-keystone | 02:52 | |
| *** lhcheng has joined #openstack-keystone | 02:57 | |
| *** dims has joined #openstack-keystone | 02:59 | |
| *** KanagarajM has joined #openstack-keystone | 02:59 | |
| *** rwsu has quit IRC | 03:09 | |
| *** erkules_ is now known as erkules | 03:22 | |
| openstackgerrit | ayoung proposed openstack/keystone: policy refactoring https://review.openstack.org/141969 | 03:27 |
| *** zz_avozza is now known as avozza | 03:30 | |
| *** htruta_ has quit IRC | 03:30 | |
| *** zzzeek has quit IRC | 03:31 | |
| *** boris-42 has quit IRC | 03:33 | |
| *** KanagarajM has quit IRC | 03:33 | |
| openstackgerrit | ayoung proposed openstack/keystone: Modify the cloud policy https://review.openstack.org/141972 | 03:38 |
| openstackgerrit | ayoung proposed openstack/keystone: Modify the cloud policy https://review.openstack.org/123509 | 03:40 |
| *** avozza is now known as zz_avozza | 03:40 | |
| *** richm1 has quit IRC | 03:42 | |
| *** dims has quit IRC | 03:49 | |
| *** oomichi has joined #openstack-keystone | 03:53 | |
| *** chrisshattuck has joined #openstack-keystone | 03:54 | |
| *** oomichi has quit IRC | 03:54 | |
| *** lhcheng has quit IRC | 04:03 | |
| *** lhcheng has joined #openstack-keystone | 04:03 | |
| openstackgerrit | wanghong proposed openstack/keystone: move region and service exist checks into manager layer https://review.openstack.org/141977 | 04:06 |
| *** radez is now known as radez_g0n3 | 04:06 | |
| *** lhcheng has quit IRC | 04:08 | |
| *** wanghong has quit IRC | 04:10 | |
| *** chrisshattuck has quit IRC | 04:19 | |
| dstanek | bknudson: you around? | 04:21 |
| *** wanghong has joined #openstack-keystone | 04:23 | |
| *** zzzeek has joined #openstack-keystone | 04:24 | |
| *** zzzeek has quit IRC | 04:30 | |
| *** zz_avozza is now known as avozza | 04:31 | |
| stevemar | dstanek, he is not | 04:34 |
| dstanek | you IBM guys and your need for sleep | 04:34 |
| stevemar | dstanek, whatcha lookin at | 04:34 |
| stevemar | occasionally we need to recharge, once a week or so | 04:34 |
| dstanek | i had a question about a comment, but realized i wanted to do what he suggested anyway :-) | 04:34 |
| *** lbragstad has quit IRC | 04:35 | |
| *** vishy has quit IRC | 04:35 | |
| *** jraim_ has quit IRC | 04:36 | |
| *** gus has quit IRC | 04:36 | |
| *** lbragstad has joined #openstack-keystone | 04:38 | |
| *** jraim has joined #openstack-keystone | 04:38 | |
| *** gus has joined #openstack-keystone | 04:39 | |
| *** lhcheng has joined #openstack-keystone | 04:40 | |
| *** vishy has joined #openstack-keystone | 04:40 | |
| *** avozza is now known as zz_avozza | 04:41 | |
| stevemar | dstanek, marekd rodrigods https://bugs.launchpad.net/keystone/+bug/1402916 | 04:42 |
| uvirtbot | Launchpad bug 1402916 in keystone "unable to validate signature from a keystone issued SAML assertion" [Undecided,New] | 04:42 |
| dstanek | stevemar: is that a bug in our code? | 04:48 |
| stevemar | i'm not sure, but it needs to be doc'ed anyway, too many ppl asking about it | 04:50 |
| stevemar | dstanek, it might be in bug in the way we generate SAML | 04:50 |
| dstanek | stevemar: i was getting a very similar issue from the pysaml2 IdP - are you using pysaml2 to generate the assertion? | 04:51 |
| *** ayoung has quit IRC | 04:52 | |
| stevemar | dstanek, that's what keystone uses, so yes | 04:53 |
| dstanek | stevemar: i wonder if it has a flaw - i started tracing the logic into pysaml2 until i got the null security tip | 04:53 |
| dstanek | maybe it's worth it to keep working through the code | 04:54 |
| stevemar | dstanek, well rodrigods mentioned that he thinks it might have to deal with the issuer portion | 04:54 |
| stevemar | and we generate the entire SAML doc, so there might be an error there | 04:55 |
| *** wanghong has quit IRC | 05:01 | |
| *** hdd has joined #openstack-keystone | 05:03 | |
| dstanek | stevemar: i don't even know what that means | 05:09 |
| *** jacer_huawei has joined #openstack-keystone | 05:17 | |
| *** jacer_huawei has quit IRC | 05:29 | |
| *** hdd has quit IRC | 05:31 | |
| *** zz_avozza is now known as avozza | 05:32 | |
| *** jacer_huawei has joined #openstack-keystone | 05:32 | |
| *** oomichi has joined #openstack-keystone | 05:38 | |
| *** jacer_huawei has quit IRC | 05:39 | |
| *** jacer_huawei has joined #openstack-keystone | 05:41 | |
| *** marcoemorais has joined #openstack-keystone | 05:41 | |
| *** avozza is now known as zz_avozza | 05:41 | |
| *** harlowja is now known as harlowja_away | 05:42 | |
| *** marcoemorais1 has joined #openstack-keystone | 05:43 | |
| *** marcoemorais has quit IRC | 05:46 | |
| *** boris-42 has joined #openstack-keystone | 05:59 | |
| *** oomichi has quit IRC | 06:02 | |
| *** jaosorior has quit IRC | 06:03 | |
| *** ajayaa has joined #openstack-keystone | 06:05 | |
| *** jacer_huawei is now known as wanghong | 06:10 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/136243 | 06:12 |
| *** wanghong has quit IRC | 06:16 | |
| *** ajayaa has quit IRC | 06:19 | |
| *** ajayaa has joined #openstack-keystone | 06:26 | |
| *** wanghong has joined #openstack-keystone | 06:28 | |
| *** ajayaa has quit IRC | 06:30 | |
| *** ajayaa has joined #openstack-keystone | 06:32 | |
| *** zz_avozza is now known as avozza | 06:41 | |
| *** stevemar has quit IRC | 06:46 | |
| *** ajayaa has quit IRC | 06:51 | |
| *** jamielennox is now known as jamielennox|away | 07:01 | |
| *** ajayaa has joined #openstack-keystone | 07:04 | |
| openstackgerrit | wanghong proposed openstack/keystone: move region and service exist checks into manager layer https://review.openstack.org/141977 | 07:08 |
| *** avozza is now known as zz_avozza | 07:08 | |
| *** gvernik has joined #openstack-keystone | 07:17 | |
| *** pcaruana has joined #openstack-keystone | 07:18 | |
| gvernik | hi. i am trying to configure keystone. I did git clone http://github.com/openstack/keystone.git and then setup.py install. When i tried to run keystone-all i got ImportError: cannot import name backends. What i missed? I just need keystone for testing, not production | 07:20 |
| *** marcoemorais1 has left #openstack-keystone | 07:20 | |
| gvernik | great | 08:06 |
| *** gvernik has quit IRC | 08:06 | |
| *** zz_avozza is now known as avozza | 08:09 | |
| *** nellysmitt has joined #openstack-keystone | 08:16 | |
| *** rushiagr_away is now known as rushiagr | 08:21 | |
| *** henrynash has joined #openstack-keystone | 08:24 | |
| *** ChanServ sets mode: +v henrynash | 08:24 | |
| *** Krast has joined #openstack-keystone | 08:42 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove local conf information from paste-ini {WIP} https://review.openstack.org/134124 | 08:45 |
| *** k4n0 has joined #openstack-keystone | 08:47 | |
| *** svasheka has quit IRC | 08:54 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove local conf information from paste-ini {WIP} https://review.openstack.org/134124 | 08:55 |
| *** ncoghlan has quit IRC | 09:04 | |
| *** andreaf has joined #openstack-keystone | 09:32 | |
| *** nellysmitt has quit IRC | 09:51 | |
| *** Ephur has quit IRC | 09:54 | |
| *** Ephur has joined #openstack-keystone | 09:55 | |
| *** jasondotstar has joined #openstack-keystone | 10:05 | |
| *** ekarlso- has quit IRC | 10:07 | |
| *** ekarlso- has joined #openstack-keystone | 10:07 | |
| *** lufix has joined #openstack-keystone | 10:10 | |
| *** bdossant has joined #openstack-keystone | 10:15 | |
| *** lhcheng_ has joined #openstack-keystone | 10:21 | |
| *** lhcheng has quit IRC | 10:21 | |
| *** andreaf has quit IRC | 10:21 | |
| *** nellysmitt has joined #openstack-keystone | 10:25 | |
| *** avozza is now known as zz_avozza | 10:29 | |
| *** andreaf has joined #openstack-keystone | 10:53 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Fixes HEAD return code for OS-INHERIT extension https://review.openstack.org/142065 | 10:55 |
| *** zz_avozza is now known as avozza | 10:55 | |
| *** lhcheng_ has quit IRC | 10:59 | |
| openstackgerrit | David Chadwick proposed openstack/keystone-specs: Self Management of Roles and Domain Scoped Roles https://review.openstack.org/138728 | 11:00 |
| openstackgerrit | wanghong proposed openstack/keystone: move region and service exist checks into manager layer https://review.openstack.org/141977 | 11:05 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystonemiddleware: Adds Memcached dependencies doc https://review.openstack.org/134993 | 11:12 |
| openstackgerrit | David Chadwick proposed openstack/keystone-specs: Self Management of Roles and Domain Scoped Roles https://review.openstack.org/142072 | 11:15 |
| rodrigods | marekd, left a minor comment in the Service Provider spec, see if you agree | 11:23 |
| *** diegows has joined #openstack-keystone | 11:38 | |
| openstackgerrit | wanghong proposed openstack/keystone: invalidate cache when updating catalog objects https://review.openstack.org/142079 | 11:49 |
| *** jasondotstar is now known as jasondotstar|afk | 12:01 | |
| *** samuelms_ has quit IRC | 12:03 | |
| *** dims has joined #openstack-keystone | 12:07 | |
| *** jraim_ has joined #openstack-keystone | 12:12 | |
| *** dougwig_ has joined #openstack-keystone | 12:12 | |
| *** jraim has quit IRC | 12:14 | |
| *** jraim_ is now known as jraim | 12:14 | |
| *** dougwig has quit IRC | 12:14 | |
| *** diegows has quit IRC | 12:14 | |
| *** dougwig_ is now known as dougwig | 12:14 | |
| chmouel | hey guys is there any chances to cut release for keystonemiddleware there is a fix for py34 there that I would love to use | 12:16 |
| *** arif-ali has quit IRC | 12:16 | |
| chmouel | i.e: https://github.com/openstack/keystonemiddleware/commit/6266ed437d454a95bbd0022 | 12:16 |
| *** diegows has joined #openstack-keystone | 12:16 | |
| *** EmilienM is now known as EmilienM|afk | 12:17 | |
| *** arif-ali has joined #openstack-keystone | 12:17 | |
| *** tsufiev has quit IRC | 12:20 | |
| *** tsufiev has joined #openstack-keystone | 12:26 | |
| openstackgerrit | David Chadwick proposed openstack/keystone-specs: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/138693 | 12:31 |
| marekd | rodrigods: ok | 12:33 |
| openstackgerrit | David Chadwick proposed openstack/keystone-specs: Self Management of Roles and Domain Scoped Roles https://review.openstack.org/142072 | 12:46 |
| *** amakarov_away has quit IRC | 12:55 | |
| *** htruta has quit IRC | 12:56 | |
| *** tellesnobrega has quit IRC | 12:56 | |
| *** dims has quit IRC | 13:07 | |
| *** dims has joined #openstack-keystone | 13:07 | |
| *** tellesnobrega has joined #openstack-keystone | 13:08 | |
| morganfainberg | chmouel, plans are to do so this week. | 13:13 |
| morganfainberg | chmouel either today or tomorrow imo. | 13:14 |
| morganfainberg | chmouel, need to check on a couple things but yes. | 13:14 |
| *** avozza is now known as zz_avozza | 13:17 | |
| *** raildo has joined #openstack-keystone | 13:26 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Expose bug in token revocation for projects https://review.openstack.org/142099 | 13:27 |
| *** EmilienM|afk is now known as EmilienM | 13:28 | |
| *** aix has joined #openstack-keystone | 13:31 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Rename `removeEvent` to be more pythonic https://review.openstack.org/142103 | 13:33 |
| *** htruta has joined #openstack-keystone | 13:37 | |
| *** gordc has joined #openstack-keystone | 13:42 | |
| chmouel | morganfainberg: awesome thank you! | 13:54 |
| morganfainberg | chmouel, it might be friday as well (just because i'm not at home) | 13:56 |
| *** hdd has joined #openstack-keystone | 13:56 | |
| chmouel | no worries that can wait for a week more :) | 13:56 |
| *** lhcheng has joined #openstack-keystone | 13:59 | |
| *** lhcheng has quit IRC | 14:04 | |
| *** richm1 has joined #openstack-keystone | 14:13 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 14:13 |
| *** Shohei has joined #openstack-keystone | 14:21 | |
| *** HenryG_ has joined #openstack-keystone | 14:28 | |
| *** jimbaker` has joined #openstack-keystone | 14:28 | |
| *** k4n0 has quit IRC | 14:30 | |
| *** Shohei_ has quit IRC | 14:30 | |
| *** uvirtbot has quit IRC | 14:30 | |
| *** HenryG has quit IRC | 14:30 | |
| *** jimbaker has quit IRC | 14:30 | |
| *** jdennis has quit IRC | 14:30 | |
| *** xxj has quit IRC | 14:30 | |
| *** bdossant has quit IRC | 14:30 | |
| *** aix has quit IRC | 14:31 | |
| *** k4n0 has joined #openstack-keystone | 14:31 | |
| *** aix has joined #openstack-keystone | 14:32 | |
| *** jdennis has joined #openstack-keystone | 14:32 | |
| *** xxj has joined #openstack-keystone | 14:34 | |
| gabriel-bezerra | marekd, dstanek: what did you change in security-policy.xml for it to work? | 14:35 |
| marekd | gabriel-bezerra: <Policy id="default" validate="false"> | 14:36 |
| marekd | <PolicyRule type="NullSecurity"/> | 14:36 |
| marekd | </Policy> | 14:36 |
| gabriel-bezerra | marekd: thanks, I'll try that | 14:39 |
| *** tellesnobrega has quit IRC | 14:40 | |
| *** tellesnobrega has joined #openstack-keystone | 14:40 | |
| gabriel-bezerra | marekd: great, I got an "Attempted to authenticate with an unsupported method. (Disable debug mode to suppress these details.)" code="401" title="Unauthorized" | 14:42 |
| dstanek | gabriel-bezerra: marekd: now that it's nice and secure! | 14:42 |
| gabriel-bezerra | :-) | 14:43 |
| marekd | dstanek: you mean? | 14:43 |
| dstanek | gabriel-bezerra: i'll be posting a new review today that fixes up the automation with all that i have learned | 14:43 |
| marekd | dstanek: did you make it work without that NullSecurity option ? | 14:44 |
| dstanek | marekd: having a policy rule to not check the signatures isn't ideal | 14:44 |
| *** lihkin has joined #openstack-keystone | 14:44 | |
| dstanek | marekd: yeah, i have to fix my mapping though | 14:44 |
| marekd | dstanek: that's interesting. And what did you do to configure it that way ? | 14:44 |
| dstanek | marekd: to ignore the signature? | 14:45 |
| marekd | to ignore the signatuer you add the entry in the security-policy.xml file | 14:45 |
| marekd | dstanek: but i understood you made it work with proper signature check and validation | 14:46 |
| *** uvirtbot has joined #openstack-keystone | 14:46 | |
| marekd | dstanek: am i right? | 14:46 |
| dstanek | marekd: not all of the way through - after a short conversation with stevemar last night i'm going to see if i can find out what was wrong with the signature | 14:46 |
| rodrigods | dstanek, did you see my email? | 14:47 |
| rodrigods | dstanek, that step was the deepest I god debugging this | 14:47 |
| marekd | rodrigods: what email | 14:47 |
| rodrigods | marekd, the one in the thread about k2k | 14:47 |
| dstanek | marekd: i think his bug may be caused by pysaml2 | 14:47 |
| dstanek | rodrigods: no, what email? | 14:48 |
| *** henrynash has quit IRC | 14:48 | |
| marekd | dstanek: stevemars? | 14:48 |
| rodrigods | dstanek, sent to you in pvt yesterday | 14:48 |
| marekd | dstanek: well, it probably is but not in a straight way. | 14:48 |
| marekd | dstanek: we do generate saml assertion, but we have a logic for that directly in keystone | 14:48 |
| marekd | dstanek: it's not something like saml2.generate_assertion() | 14:49 |
| marekd | where saml2 is a pysaml2's module | 14:49 |
| dstanek | marekd: who signs it? | 14:49 |
| rodrigods | dstanek, tl; dr; used openssl to check the assertion signature, the output was a strange error. Than, used some argument to pass the CA issuer cert and it successfully verified the signature | 14:49 |
| *** henrynash has joined #openstack-keystone | 14:49 | |
| *** ChanServ sets mode: +v henrynash | 14:49 | |
| dstanek | rodrigods: hmmm...i don't see an email from you - but code reviews are clogging my inbox | 14:50 |
| marekd | dstanek: it uses pysaml2's methods and objects but in general the logic is in keystone. Now i think the bug may be there because of pysaml2 just because it was heavily looking how it was done in pysaml when i was writing signing part in Keystone. | 14:50 |
| marekd | dstanek: let me find the code | 14:50 |
| marekd | dstanek: https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/idp.py | 14:51 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Add get certificates for v2.0 https://review.openstack.org/142122 | 14:51 |
| gabriel-bezerra | marekd: Just adding the <PolicyRule type="NullSecurity"/> as the first entry in the default Policy also works (if that makes automation simpler...) | 14:51 |
| rodrigods | dstanek, pct chat IRC now | 14:51 |
| rodrigods | pvt* | 14:51 |
| dstanek | rodrigods: thx | 14:52 |
| marekd | dstanek: in fact we use xmlsec1 to sign the Assertion | 14:52 |
| marekd | line 397 | 14:52 |
| marekd | but that's how pysaml2 also dies | 14:52 |
| marekd | does | 14:52 |
| marekd | dstanek: unfortunately pysaml2 author didn't respond. | 14:53 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Add fetch revocations for v2.0 https://review.openstack.org/141935 | 14:53 |
| *** ayoung has joined #openstack-keystone | 14:53 | |
| *** ChanServ sets mode: +v ayoung | 14:53 | |
| marekd | gabriel-bezerra: ok, thanks. | 14:55 |
| bknudson | dstanek: you were pinging me yesterday? | 14:58 |
| dstanek | marekd: it looks like Roland is very active in this space | 14:58 |
| dstanek | bknudson: yes, but i answered my own question | 14:59 |
| marekd | dstanek: .... | 14:59 |
| *** lihkin has quit IRC | 15:05 | |
| *** zzzeek has joined #openstack-keystone | 15:05 | |
| *** lihkin has joined #openstack-keystone | 15:07 | |
| *** hdd has quit IRC | 15:11 | |
| *** andreaf has quit IRC | 15:12 | |
| *** jasondotstar|afk is now known as jasondotstar | 15:15 | |
| *** timcline has joined #openstack-keystone | 15:15 | |
| *** timcline has quit IRC | 15:16 | |
| *** timcline has joined #openstack-keystone | 15:16 | |
| *** zzzeek_ has joined #openstack-keystone | 15:20 | |
| *** david-lyle has joined #openstack-keystone | 15:21 | |
| morganfainberg | hm. darn stevemar and topol are not here... | 15:22 |
| morganfainberg | jamielennox|away, I'm going to do KSC and middleware release on monday unless i shouldn't | 15:23 |
| morganfainberg | jamielennox|away, just looked at what is going on for me and i don't think i can do it until then. | 15:23 |
| *** zzzeek has quit IRC | 15:23 | |
| *** zzzeek_ is now known as zzzeek | 15:23 | |
| morganfainberg | jamielennox|away, let me know if there is anything we *need* to land asap for either, i'll take a look at outstanding reviews in a momenrt | 15:24 |
| *** stevemar has joined #openstack-keystone | 15:24 | |
| *** ChanServ sets mode: +v stevemar | 15:24 | |
| *** HenryG_ has quit IRC | 15:25 | |
| *** HenryG_ has joined #openstack-keystone | 15:25 | |
| *** k4n0 has quit IRC | 15:25 | |
| *** k4n0 has joined #openstack-keystone | 15:25 | |
| *** aix has quit IRC | 15:25 | |
| *** aix has joined #openstack-keystone | 15:25 | |
| *** ayoung has quit IRC | 15:25 | |
| *** ayoung has joined #openstack-keystone | 15:25 | |
| *** rajaniemi.freenode.net sets mode: +v ayoung | 15:25 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Add fetch revocations for v3 https://review.openstack.org/142128 | 15:26 |
| *** afazekas has joined #openstack-keystone | 15:29 | |
| *** afazekas is now known as afazekas_pto | 15:29 | |
| gabriel-bezerra | I used a protocol that was not registered and got this error message: "Attempted to authenticate with an unsupported method. (Disable debug mode to suppress these details.)" code="401" title="Unauthorized" , listing the available authentication methods. | 15:32 |
| gabriel-bezerra | This error message doesn't help anyway finding what is wrong and even exposes internals of the server | 15:33 |
| gabriel-bezerra | of the service* | 15:33 |
| marekd | which protoccccol ??????????????????? | 15:33 |
| marekd | you should rather get 404 | 15:33 |
| gabriel-bezerra | I did GET http://localhost:5000/v3/OS-FEDERATION/identity_providers/pysaml2/protocols/saml/auth | 15:34 |
| gabriel-bezerra | but the only protocol I have registered for this identity_provider is saml2 | 15:35 |
| gabriel-bezerra | and that was the error message | 15:36 |
| marekd | do you know what line raised that exception? | 15:36 |
| gabriel-bezerra | marekd: more weird things are happening | 15:37 |
| morganfainberg | bknudson, dstanek, i'm going to go through our backport potentials and see what we really should be backporting next week so after the holidays we can hit those [i might backport a bunch of things] | 15:37 |
| morganfainberg | over the holidays | 15:37 |
| morganfainberg | bknudson, dstanek, i'll ping you guys on it as i get them done. | 15:38 |
| marekd | gabriel-bezerra: namelt | 15:38 |
| morganfainberg | cc dolphm, ^^ | 15:38 |
| marekd | namely | 15:38 |
| *** hdd has joined #openstack-keystone | 15:38 | |
| bknudson | morganfainberg: ok... I'll get an email since I'm subscribed. | 15:38 |
| dolphm | morganfainberg: awesome! | 15:38 |
| morganfainberg | bknudson, yeah i mean i'll put you on the reviews :) | 15:39 |
| gabriel-bezerra | marekd: if I do a get_mappings with saml protocol, it will list the mappings for the other protocol | 15:39 |
| bknudson | morganfainberg: no need, I'll add myself. | 15:39 |
| morganfainberg | dolphm, we have a bunch of things that need backport eyes so figure might as well do it while it gets a bit more quiet | 15:39 |
| morganfainberg | bknudson, ok works for me | 15:39 |
| marekd | gabriel-bezerra: so i gues you have screwed something | 15:39 |
| dstanek | morganfainberg: nice. i've available for reviews whenever you get it done | 15:39 |
| gabriel-bezerra | marekd: sorry | 15:39 |
| dstanek | s/get it/get any/ | 15:40 |
| marekd | gabriel-bezerra: no worries | 15:40 |
| marekd | i think it's somewhere wrong with your config. | 15:40 |
| bknudson | hopefully we'll be able to merge something. | 15:40 |
| gabriel-bezerra | marekd: mappings are not tied to a protocol in my call | 15:40 |
| bknudson | pass jenkins | 15:40 |
| morganfainberg | bknudson, right? | 15:41 |
| gabriel-bezerra | marekd: I have a bunch of shell script functions to use keystone by the rest api, and didn't notice that I was not using the protocol in the mapping call | 15:41 |
| morganfainberg | ayoung, https://bugs.launchpad.net/keystone/+bug/1400362 do you need me to handle the comments on that, it's tagged for k1 meaning we need to have it ready today if at all possible. | 15:41 |
| uvirtbot | Launchpad bug 1400362 in keystone "check and delete policy_association_for_region_and_service performs create" [High,In progress] | 15:41 |
| marekd | gabriel-bezerra: happens :-) | 15:41 |
| *** pcaruana has quit IRC | 15:42 | |
| morganfainberg | henrynash, ping re: https://bugs.launchpad.net/keystone/+bug/1398347 | 15:42 |
| uvirtbot | Launchpad bug 1398347 in keystone "LDAP backend should do filtered query instead of getting all data and then filtering" [Undecided,New] | 15:42 |
| gabriel-bezerra | marekd: regarding the GET invalid_protocol/auth, it is actually happening | 15:42 |
| henrynash | morganfainberg: will look | 15:42 |
| dstanek | we need a good old fashioned make file - i miss 'make clean' | 15:43 |
| marekd | gabriel-bezerra: can you check the logs and hsee where the exception is being raised? | 15:43 |
| gabriel-bezerra | 2014-12-16 15:40:13.160164 14150 DEBUG keystone.common.wsgi [-] arg_dict: {'identity_provider': u'pysaml2', 'protocol': u'saml'} __call__ /opt/stack/keystone/keystone/common/wsgi.py:192 | 15:43 |
| gabriel-bezerra | 2014-12-16 15:40:13.166163 14150 WARNING keystone.common.wsgi [-] Authorization failed. Attempted to authenticate with an unsupported method. (Disable debug mode to suppress these details.) (Disable debug mode to suppress these details.) from 127.0.0.1 | 15:43 |
| marekd | i am elbow deep in something else | 15:43 |
| marekd | and don't want to get distracted with it now. | 15:43 |
| marekd | gabriel-bezerra: you can help me with that. | 15:43 |
| dstanek | gabriel-bezerra: it looks like you don't have federation wired up in your config | 15:44 |
| morganfainberg | dstanek, make instead of tox! | 15:44 |
| morganfainberg | dstanek, :P | 15:44 |
| gabriel-bezerra | it is | 15:44 |
| dstanek | gabriel-bezerra: do you have the the saml2 auth method in there? | 15:44 |
| marekd | gabriel-bezerra: exactly | 15:44 |
| gabriel-bezerra | if I just change the url to use saml2 protocol, it works | 15:44 |
| marekd | gabriel-bezerra: logs complain about sth else | 15:44 |
| dstanek | morganfainberg: ++ | 15:44 |
| morganfainberg | gabriel-bezerra, that looks like it's trying to use a non-registered auth plugin | 15:45 |
| gabriel-bezerra | [auth] | 15:45 |
| gabriel-bezerra | methods=external,password,token,saml2 | 15:45 |
| gabriel-bezerra | saml2=keystone.auth.plugins.saml2.Saml2 | 15:45 |
| gabriel-bezerra | I have this in my config | 15:45 |
| dstanek | add the mapping plugin too? | 15:46 |
| gabriel-bezerra | and I don't have saml as a protocol of pysaml2 identity provider | 15:46 |
| henrynash | morganfainberq: so this is a consequence of us not yet extending the filter hints into the ldap backend…we should do this…. | 15:46 |
| henrynash | morganfainberg: there may be a defect already….not sure | 15:46 |
| morganfainberg | henrynash, right - i wanted to check where we were with it and uhm... how we should classify this | 15:46 |
| morganfainberg | henrynash, yeh LP sucks tracking that stuff down, which is why i asked you :) | 15:46 |
| morganfainberg | henrynash, figured if anyone knew it was you. | 15:47 |
| marekd | gabriel-bezerra: remove external | 15:47 |
| henrynash | morganfainberg: so hapy for you to assign it to me… | 15:47 |
| marekd | gabriel-bezerra: just to be sure. | 15:47 |
| morganfainberg | henrynash, sure thing. going to mark it wishlist though since it's really an enhancement not a "bug" | 15:47 |
| henrynash | morganfainberg: agreed | 15:47 |
| morganfainberg | henrynash, cheers and thanks | 15:47 |
| gabriel-bezerra | marekd: removing external did not resolve | 15:49 |
| gabriel-bezerra | dstanek, marekd: when I use saml2 protocol, I get a "Could not map user (Disable debug mode to suppress these details.)" code="401" title="Unauthorized" | 15:49 |
| gabriel-bezerra | when I use saml protocol, I get that error | 15:49 |
| gabriel-bezerra | that previous error* | 15:49 |
| marekd | gabriel-bezerra: for the saml2 protocol you have wrong mapping | 15:50 |
| marekd | rules | 15:50 |
| marekd | for the wrong proto and 401 instead of 404 | 15:50 |
| gabriel-bezerra | marekd: sure, but the point is that it is exposing the internals of the service when I use a bad protocol | 15:50 |
| morganfainberg | gabriel-bezerra, sortof. | 15:51 |
| marekd | gabriel-bezerra: but where is that 401 with bad protocol ? | 15:51 |
| marekd | where is it in the logs? | 15:52 |
| *** david-lyle has quit IRC | 15:52 | |
| gabriel-bezerra | the complete error is this : https://gist.github.com/gabriel-bezerra/aac13242060a98d4be45 | 15:52 |
| morganfainberg | gabriel-bezerra, that isn't really exposing the internals *that* much | 15:52 |
| gabriel-bezerra | morganfainberg: but it should be a 404, invalid protocol | 15:53 |
| dstanek | what does the message look like with debugging off? | 15:53 |
| morganfainberg | gabriel-bezerra, i mean, sure you could fuzz/probe for protocols. -- | 15:53 |
| morganfainberg | gabriel-bezerra, well is it actually a 404 or a 401 in that case i *think* the URL is technically valid atm -based on routers. | 15:54 |
| dstanek | gabriel-bezerra: is the protocol in the URL? | 15:54 |
| marekd | and the error disappears when you use good protocol (registered one) ? | 15:54 |
| gabriel-bezerra | dstanek: Yes, it is. | 15:54 |
| morganfainberg | dstanek, it would just say 401 very generically | 15:54 |
| morganfainberg | dstanek, w/o debug | 15:54 |
| gabriel-bezerra | when I use a good protocol, it gives me a mapping error, but that is expected, as I have not configured the mapping yet | 15:55 |
| gabriel-bezerra | at least not with the right rules | 15:55 |
| dstanek | so i think it looks good then | 15:56 |
| *** topol has joined #openstack-keystone | 15:56 | |
| *** ChanServ sets mode: +v topol | 15:56 | |
| ayoung | morganfainberg, sorry, thought I had submitted that, but I guess that was one I assumed henry was picking up. Lets bump to K2, as I don't think it will be through today | 15:58 |
| morganfainberg | topol, ping - need to bug ya. | 15:58 |
| ayoung | Oh, wait | 15:58 |
| morganfainberg | ayoung, you did put a patch in, just needs a tweak on it | 15:58 |
| morganfainberg | ayoung, :) | 15:58 |
| ayoung | he did submit. looking | 15:58 |
| morganfainberg | ayoung, or henry did or someone did | 15:58 |
| dstanek | lbragstad: i just hacked up some docs for you :-) http://162.242.175.31:9999/docs/html/developing.html#work-in-progress-tests | 15:58 |
| ayoung | I'm the owner of the patch | 15:58 |
| morganfainberg | ayoung, anyway just saw you on the bug so was pinging you before i fixed it | 15:58 |
| morganfainberg | ayoung, since i am also digging into a few otherthings concurrently | 15:59 |
| gabriel-bezerra | dstanek: marekd morganfainberg I updated the gist with the debbugin off | 15:59 |
| ayoung | morganfainberg, I 'm on it | 15:59 |
| gabriel-bezerra | didn't resolve the exposure | 15:59 |
| morganfainberg | ayoung, awesome, thanks. | 16:00 |
| ayoung | NP | 16:00 |
| morganfainberg | you know, east coast time does make it feel like there is a *lot* more overlap with everyone. | 16:00 |
| morganfainberg | except jamielennox|away :( | 16:00 |
| gabriel-bezerra | I'll go for lunch now, will be back in an hour. | 16:01 |
| morganfainberg | gabriel-bezerra, enjoy lunch! | 16:01 |
| marekd | gabriel-bezerra: to me the problem is compeletely somewhere else | 16:01 |
| marekd | bon app | 16:01 |
| *** ajayaa has quit IRC | 16:07 | |
| morganfainberg | lbragstad, we need to scrub specs.openstack.org API spec of XML references http://specs.openstack.org/openstack/keystone-specs/api/v2.0/identity-api-v2.0-extensions.html (look at the bottom) | 16:10 |
| *** chrisshattuck has joined #openstack-keystone | 16:11 | |
| *** amakarov has joined #openstack-keystone | 16:12 | |
| ayoung | lbragstad, OK...so your comment was "Other test cases only go through the PUT, GET, HEAD, and DELETE respectively, but here we do an additional GET and HEAD after the DELETE. I think it would be more descriptive to have a test cases that explicitly points this out." | 16:15 |
| ayoung | I think that the CRUD tests in general should do what I am doing here...so...would leaving this as the crud test and just explaining what I am doing be OK? | 16:15 |
| ayoung | damnit, I just figured out how I could make it all better.... | 16:16 |
| *** rushiagr is now known as rushiagr_away | 16:18 | |
| topol | morganfainberg leading a call but will ping when I free up | 16:19 |
| morganfainberg | topol, figured you'd ping back when able | 16:19 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds a wip decorator for tests https://review.openstack.org/131516 | 16:21 |
| * dstanek things topol is a natural leader | 16:22 | |
| dstanek | he leads all the things | 16:22 |
| morganfainberg | we should have all banded together and nominated him for the board | 16:22 |
| morganfainberg | ;) | 16:22 |
| dstanek | haha, next time | 16:22 |
| morganfainberg | dstanek, right? | 16:22 |
| morganfainberg | dstanek, though honestly the two people i wanted on the board ballot were there by the time i got to nominating folks | 16:23 |
| * topol yes topol is a legend in his own mind :-) | 16:23 | |
| ayoung | dstanek, did you bascially make it possible to let a teset fail and still have the overall set of tests pass. I think I love that! | 16:24 |
| morganfainberg | ayoung, ++ yeah the wip decorator is nice. | 16:24 |
| dstanek | morganfainberg: i was disappointed that Chuck Norris was not nominated | 16:24 |
| morganfainberg | dstanek, i was disappointed OpenStack Proposal Bot wasn't nominated | 16:24 |
| *** samuelms-away is now known as samuelms | 16:25 | |
| ayoung | Chuck Norris is a Neocon loudmouth. And Bruce Lee cleaned the walls with him. | 16:25 |
| dstanek | ayoung: yeah, i'm been using a variation of that decorator for a long time | 16:25 |
| dstanek | it seems that i've lost the ability to write grammatically correct sentences today | 16:26 |
| *** lsmola has quit IRC | 16:26 | |
| bknudson | dstanek: any reason not to put the test wip decorator in oslo? | 16:26 |
| *** kragniz is now known as kragwhale | 16:26 | |
| ayoung | bknudson, ++ it belongs there | 16:26 |
| *** lihkin has quit IRC | 16:27 | |
| openstackgerrit | ayoung proposed openstack/keystone: Check and delete for policy_association_for_region_and_service https://review.openstack.org/140122 | 16:27 |
| dstanek | bknudson: nobody uses it yet, but i can propose it in oslotest | 16:27 |
| bknudson | dstanek: at least ask if they'll take it. | 16:28 |
| ayoung | morganfainberg, BTW...did you see the unspeakable things I did with the policy code? https://review.openstack.org/#/c/141969/ | 16:28 |
| morganfainberg | ayoung, nope haven't looked at that yet. | 16:28 |
| ayoung | Its not done, but that should really be the start of the "enforce policy from a library" BP | 16:28 |
| ayoung | morganfainberg, not needing a review yet, as it still has work to be done, but I think you will like the direction | 16:29 |
| ayoung | it leaves the decorators in place, but only in the controller code. The guts of what they were doing is refactored out. | 16:29 |
| morganfainberg | ayoung, i'll take a look once i'm back home post saturday | 16:29 |
| ayoung | Next step will be to reduce duplication | 16:29 |
| *** david-lyle has joined #openstack-keystone | 16:30 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Add validate token for v3 https://review.openstack.org/142147 | 16:30 |
| ayoung | Also, I want to get the abstraction right to be able to have the same code called inprocess from Keystone and remotely, while letting the callers handle how to get the token data and the policy data (remote fetch versus DB lookup) | 16:31 |
| ayoung | afaranha, thanks for the review on it. I think now you see kindof where I was going. | 16:31 |
| *** david-lyle has quit IRC | 16:33 | |
| *** EmilienM is now known as EmilienM|afk | 16:34 | |
| afaranha | ayoung, :) | 16:34 |
| afaranha | ayoung, Now we are able to replace, target.project.domain_id or target.user.domain_id, by only target.member.domain_id, right? | 16:35 |
| ayoung | afaranha, yes. It still is not where it needs to be 100% though | 16:35 |
| afaranha | does this works for rules like: %(domain_id)s? | 16:35 |
| ayoung | and I should split up that patch into the refactoring portion and the new functionality | 16:35 |
| ayoung | I kindof caught the new code up in the refactoring, and it ended up in the right place, but it needs to be a follow on patch | 16:36 |
| ayoung | afaranha, what it does not do yet is allow the caller to specify where in the request to look for the domain ID for create requests | 16:36 |
| morganfainberg | ayoung, dolphm, so pt-archiver - the only real solution to token bloat for *today* [meaning icehouse, juno, etc] in SQL | 16:37 |
| morganfainberg | dolphm, i expect to write up a quick doc patch that we can include in juno and icehouse explaining how to use it. | 16:37 |
| afaranha | ayoung, On creation we get the domain_id from the URL, don't we? | 16:38 |
| afaranha | so in the policy we just use %(domain_id)s | 16:38 |
| ayoung | afaranha, not on all objects | 16:39 |
| afaranha | ayoung, right, on user for example, we get from the body of the request | 16:39 |
| ayoung | https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#create-user-post-users | 16:40 |
| ayoung | afaranha, let me split that patch and repost | 16:40 |
| afaranha | Ok | 16:40 |
| afaranha | let me check the workflow for create a user | 16:41 |
| ayoung | afaranha, also, look at the policy file patch. There is a failure on check_token that is due to the "owner" logic being broken | 16:41 |
| ayoung | I think it shows a bug in the rules engine | 16:41 |
| lbragstad | morganfainberg: agreed, I can go through the specs. | 16:42 |
| morganfainberg | lbragstad, thanks. | 16:42 |
| lbragstad | morganfainberg: no problem | 16:42 |
| lbragstad | nice catch | 16:42 |
| *** jimbaker` is now known as jimbaker | 16:43 | |
| lbragstad | ayoung: about the CRUD tests, I was just making the observation that the test being modified is of a different patterns than the rest | 16:43 |
| *** david-lyle_afk is now known as david-lyle | 16:44 | |
| *** jaosorior has joined #openstack-keystone | 16:44 | |
| lbragstad | ayoung: so should we make that test pattern (PUT, HEAD, GET, DELETE, HEAD-404, GET-404) the pattern? | 16:44 |
| lbragstad | ayoung: for all functional tests? | 16:44 |
| *** andreaf has joined #openstack-keystone | 16:45 | |
| ayoung | lbragstad, your question is rhetorical. Right? | 16:45 |
| afaranha | ayoung, could you show where? | 16:45 |
| ayoung | and you missed the | 16:45 |
| ayoung | HEAD-404, GET-404 at the begining of the sequence. | 16:45 |
| lbragstad | ayoung: your test adds them to the end of the sequence | 16:46 |
| lbragstad | right? | 16:46 |
| ayoung | afaranha, if you checkout that patch, run tox -epy27 test_v3_auth | 16:46 |
| ayoung | lbragstad, both | 16:46 |
| morganfainberg | lbragstad, i added a comment to that patch. | 16:46 |
| ayoung | it is a precondition check, too | 16:46 |
| * lbragstad digs for the review | 16:46 | |
| morganfainberg | but my recommendation is out of scope for the fix. | 16:46 |
| morganfainberg | lbragstad, https://review.openstack.org/#/c/140122/3/keystone/tests/test_v3_endpoint_policy.py | 16:47 |
| ayoung | morganfainberg, knowing that GET and HEAD are coming from the same code is not the same as confirm it | 16:47 |
| ayoung | confirming it | 16:47 |
| topol | morganfainberg, I am free. How can I help? | 16:47 |
| morganfainberg | ayoung, no my point is .get() should do the check that head matches | 16:47 |
| ayoung | morganfainberg, I could make it explicit, but they both check the same return code. | 16:48 |
| morganfainberg | ayoung, so .get(404 expected, check_head_req=True) should validate that you get the same responses | 16:48 |
| morganfainberg | ayoung, in any/all cases we check head and/or get. | 16:48 |
| morganfainberg | ayoung, like i said that was out of scope for the change | 16:48 |
| ayoung | morganfainberg, I see what you are saying. | 16:48 |
| morganfainberg | ayoung, i did some of that before, but we can make all testing better. anyway waaaay out of scope for this test case. | 16:49 |
| ayoung | morganfainberg, I could add a comment that the GET and HEAD need to return the same value | 16:49 |
| lbragstad | ayoung: looks good to me | 16:49 |
| morganfainberg | ayoung, nah, don't in this case | 16:49 |
| ayoung | OK | 16:49 |
| lbragstad | using _crud_test works | 16:49 |
| morganfainberg | ayoung, out of scope really for the fix. | 16:49 |
| morganfainberg | ayoung, something we should enhance as we're making tests better | 16:49 |
| lbragstad | I had one minor comment on spelling | 16:50 |
| morganfainberg | ayoung, if you respin for another patch a comment would be useful, but not worth a new patchset for unless we're changing something else. | 16:50 |
| lbragstad | published my comments | 16:51 |
| ayoung | respinning | 16:51 |
| afaranha | ayoung, I run the tests here and it's working fine | 16:53 |
| afaranha | Let me try another thing here | 16:53 |
| *** ajayaa has joined #openstack-keystone | 16:54 | |
| rodrigods | marekd, ping. Using blacklist/whitelist we'll need to *always* use direct mappings, right? | 16:54 |
| *** rm_work|away is now known as rm_work | 16:55 | |
| afaranha | ayoung, but I'm using the default policy.json. Did run with another version of the policy, or just test if the refactor didn't break anything? | 16:56 |
| ayoung | afaranha, wait one and I 'll show you, just fixing a test for another bug first | 16:56 |
| openstackgerrit | ayoung proposed openstack/keystone: Check and delete for policy_association_for_region_and_service https://review.openstack.org/140122 | 17:01 |
| ayoung | morganfainberg, there, think that is what you meant | 17:02 |
| ayoung | afaranha, OK. lets see what I get | 17:02 |
| morganfainberg | ayoung, pretty spot on | 17:03 |
| morganfainberg | ayoung, thanks | 17:03 |
| *** rushiagr_away is now known as rushiagr | 17:05 | |
| ayoung | afaranha, I see that it did not break in the check job, either, so maybe I had something wacky on my machine. I'll look again after lunch, but first will split the refactoring patch | 17:06 |
| *** nellysmitt has quit IRC | 17:10 | |
| afaranha | ayoung, If you wanna help I can help you on this | 17:12 |
| *** lhcheng has joined #openstack-keystone | 17:14 | |
| openstackgerrit | ayoung proposed openstack/keystone: Modify the cloud policy https://review.openstack.org/123509 | 17:15 |
| openstackgerrit | ayoung proposed openstack/keystone: policy refactoring https://review.openstack.org/141969 | 17:15 |
| openstackgerrit | ayoung proposed openstack/keystone: member for assignment policy https://review.openstack.org/142162 | 17:15 |
| ayoung | afaranha, yes please. Here's what I'd like you to do | 17:15 |
| *** lhcheng_ has joined #openstack-keystone | 17:15 | |
| ayoung | starting with "member for assignment policy" put in an optional parameter for the decorator that allows the coder to specify which attribute in the request has the domain ID in it | 17:16 |
| ayoung | or even better, which attribute in the request should have policy enforced on it.... | 17:16 |
| ayoung | kindof like the "member" change | 17:16 |
| afaranha | but isn't it what it does after your change? | 17:17 |
| afaranha | ayoung, ah, ok | 17:18 |
| afaranha | this is for the code knows if the attribute is on the object, or in the post body, right? | 17:18 |
| *** lhcheng has quit IRC | 17:19 | |
| afaranha | ayoung, Just saw you send more patches, right o/ | 17:19 |
| ayoung | afaranha, just split out one line from the patch, but yes | 17:19 |
| afaranha | ayoung, Don't we need to also put this code: "auth_context['scope'] = 'project'" outside the refactor patch? | 17:21 |
| ayoung | Oh...yeah | 17:22 |
| ayoung | I knew there was something I was missing | 17:22 |
| *** dims has quit IRC | 17:23 | |
| afaranha | :P | 17:23 |
| morganfainberg | jamielennox|away, AHA I rememebred what i wanted to talk to you about | 17:23 |
| *** dims has joined #openstack-keystone | 17:23 | |
| morganfainberg | jamielennox|away, i wanted to make keystone service discoverability better (minor optimisation) - so we can more easily get a catalog | 17:23 |
| morganfainberg | jamielennox|away, i'd like to be able to leverage a DNS SRV record - | 17:24 |
| morganfainberg | jamielennox|away, but i wanted your thoughts on it | 17:25 |
| morganfainberg | it would be nice to be able to say "keystone client use public.hpcloud.com" and it would know how to find keystone [no ports etc, needed] | 17:26 |
| morganfainberg | or rax, or <insert_domain here> | 17:26 |
| afaranha | ayoung, I think the reason you got error on the test is that you are using this policy: https://review.openstack.org/#/c/123509/26/etc/policy.v3cloudsample.json | 17:27 |
| *** dims_ has joined #openstack-keystone | 17:28 | |
| *** dims has quit IRC | 17:28 | |
| gabriel-bezerra | dstanek, marekd, morganfainberg: back | 17:28 |
| gabriel-bezerra | thanks for your wishes | 17:28 |
| gabriel-bezerra | regarding the error, I think the information should be about the protocol not being registered, instead of about the authentication method. Plus, it should not expose details about the configuration of the service. | 17:31 |
| dstanek | gabriel-bezerra: what details are being exposed? | 17:34 |
| gabriel-bezerra | dstanek: about the available authentication methods: password, token, saml2 | 17:34 |
| gabriel-bezerra | and external, when it was enabled | 17:34 |
| richm1 | zigo: ping - was wondering if you could help with https://bugs.launchpad.net/ubuntu/+source/python-openstackclient/+bug/1393873 | 17:34 |
| uvirtbot | Launchpad bug 1393873 in python-openstackclient "Update python-openstackclient to version 1.0.1" [Undecided,New] | 17:34 |
| dstanek | gabriel-bezerra: that's only if debug is enabled right? | 17:35 |
| gabriel-bezerra | dstanek: no, it happened with debug disabled | 17:35 |
| gabriel-bezerra | dstanek: https://gist.github.com/gabriel-bezerra/aac13242060a98d4be45 | 17:35 |
| openstackgerrit | Andre Aranha proposed openstack/keystone: policy refactoring https://review.openstack.org/141969 | 17:35 |
| dstanek | gabriel-bezerra: that's interesting | 17:36 |
| dstanek | gabriel-bezerra: i still don't know if it's a big deal - doesn't a service that expects users to authenticate need to tell them how they can authenticate? | 17:37 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Check and delete for policy_association_for_region_and_service https://review.openstack.org/140122 | 17:38 |
| morganfainberg | ayoung, ^ removed the now 100% duplicated test. | 17:38 |
| *** andreaf has quit IRC | 17:40 | |
| gabriel-bezerra | dstanek: I don't think this is the case to show other authentication methods when one try to authenticate with FEDERATION and give a protocol id that is not registered. | 17:40 |
| gabriel-bezerra | sorry for the caps | 17:40 |
| *** andreaf has joined #openstack-keystone | 17:40 | |
| morganfainberg | gabriel-bezerra, i am inclined to say this is an acceptable setup, with debug off it should just give a 401 | 17:40 |
| morganfainberg | gabriel-bezerra, with debug on, it gives more info | 17:41 |
| dstanek | morganfainberg: the list of methods is there with debug off too | 17:41 |
| *** Haneef_ has joined #openstack-keystone | 17:41 | |
| morganfainberg | dstanek, oh *shrug* i don't know if that is really bad | 17:41 |
| morganfainberg | dstanek, you know who we should summon to weigh in | 17:41 |
| dstanek | morganfainberg: i don't think so | 17:41 |
| morganfainberg | nkinder, ping ^ | 17:41 |
| nkinder | morganfainberg: hey | 17:42 |
| morganfainberg | nkinder, so in a case we have an auth attempt with Federation to an unknown protocol it says "you can't do that, 401, and here are the auth methods i support" | 17:42 |
| morganfainberg | even with debug off | 17:42 |
| morganfainberg | nkinder, is the "here are the auth methods i support" correct, incorrect, an exposure we shouldn't have? | 17:43 |
| morganfainberg | specifically in the debug-is-off case | 17:43 |
| nkinder | That doesn't seem bad to me | 17:43 |
| *** kragwhale is now known as kragniz | 17:43 | |
| nkinder | If there's an insecure auth method, you have a problem whether you advertise it or not | 17:43 |
| morganfainberg | exactly | 17:43 |
| dstanek | morganfainberg: nkinder: it's similar to going to a website and seeing you can login using a password or facebook - at some point the user has to know | 17:44 |
| morganfainberg | and being opaque about the protocols supported is not security | 17:44 |
| dstanek | i will say that this only happens because of how we result the auth pipeline and maybe the user experience is a bit weird | 17:44 |
| gabriel-bezerra | the current message also doesn't help clarify that the problem is with the specified protocol id not existing | 17:44 |
| morganfainberg | dstanek, sure we can make UX a bit better here, but i don't see this as a critical bug. | 17:44 |
| nkinder | is that advertisement per-IdP? | 17:44 |
| morganfainberg | gabriel-bezerra, we probably should make that *better* at the least | 17:45 |
| gabriel-bezerra | but I agree with you regarding the exposure of the authentication methods | 17:45 |
| gabriel-bezerra | makes total sense | 17:45 |
| morganfainberg | gabriel-bezerra, so improvement of the UX indicating what is going on i think is what we should be targeting here. | 17:45 |
| morganfainberg | nkinder, not sure if it's per, idp, but i *think* it is. | 17:45 |
| openstackgerrit | Andre Aranha proposed openstack/keystone: Member for assignment policy https://review.openstack.org/142162 | 17:46 |
| dstanek | i don't think we do auth methods by IdP if that's what you mean | 17:46 |
| morganfainberg | dstanek, we don't | 17:46 |
| nkinder | morganfainberg: I would hope so, as we don't necessarily want to list/expose IdPs | 17:46 |
| nkinder | we do support protocols per-IdP though | 17:46 |
| morganfainberg | nkinder, i think we need to enahnce this for per-idp protocols though then. | 17:47 |
| morganfainberg | but - we're not far off from that and no we wont expose other idps | 17:47 |
| morganfainberg | just might say something like "password, token, saml" are options | 17:47 |
| gabriel-bezerra | exactly, nowadays the error shows: password, token, saml2 | 17:48 |
| nkinder | as long as we dont expose IdP's, I think we're good | 17:48 |
| gabriel-bezerra | but it doesn't list the protocols supported by the idp | 17:48 |
| gabriel-bezerra | nor it says the protocol is not registered | 17:48 |
| nkinder | What I mean by the protocols being tied to an IdP can be see by the OS-FEDERATION auth URL format - /v3/OS-FEDERATION/identity_providers/<IdP ID>/protocols/<protocol>/auth | 17:48 |
| morganfainberg | gabriel-bezerra, nkinder, right | 17:49 |
| morganfainberg | nkinder, gabriel-bezerra, so we should work to make the ux on what is returned better, but this is by no means crazy critical | 17:49 |
| gabriel-bezerra | morganfainberg: agreed | 17:49 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Group role revocation invalidates all user tokens https://review.openstack.org/141854 | 17:50 |
| morganfainberg | soo it's almost that time folks. | 17:52 |
| morganfainberg | that magical time of the week. | 17:52 |
| samuelms | morganfainberg, p/ | 17:52 |
| morganfainberg | where we take our arguments to the officially sanctioned meeting channel :P | 17:52 |
| samuelms | o/ | 17:52 |
| morganfainberg | just a heads up we *are* having the meeting today | 17:52 |
| morganfainberg | in 8 minutes or so | 17:53 |
| gabriel-bezerra | in #openstack-meeting? | 17:53 |
| samuelms | gabriel-bezerra, yep | 17:54 |
| gabriel-bezerra | thanks, samuelms | 17:55 |
| *** lhcheng_ is now known as lhcheng | 18:00 | |
| morganfainberg | jamielennox|away, meeting time if you're awake | 18:01 |
| *** k4n0 has quit IRC | 18:06 | |
| *** jamielennox|away is now known as jamielennox | 18:08 | |
| *** marcoemorais has joined #openstack-keystone | 18:10 | |
| *** harlowja_away is now known as harlowja | 18:12 | |
| *** ajayaa has quit IRC | 18:22 | |
| *** gyee has joined #openstack-keystone | 18:31 | |
| *** ChanServ sets mode: +v gyee | 18:31 | |
| *** zz_avozza is now known as avozza | 18:33 | |
| *** EmilienM|afk is now known as EmilienM | 18:35 | |
| *** marcoemorais has left #openstack-keystone | 18:35 | |
| *** abhirc has joined #openstack-keystone | 18:39 | |
| marekd | rodrigods: what do you mean? | 18:42 |
| rodrigods | marekd, ? | 18:46 |
| marekd | rodrigods: "ping. Using blacklist/whitelist we'll need to *always* use direct mappings, right?" | 18:48 |
| marekd | rodrigods: what do you mean always? | 18:48 |
| *** HenryG_ has quit IRC | 18:48 | |
| *** HenryG has joined #openstack-keystone | 18:49 | |
| rodrigods | marekd, using whitelist/blacklist is tied to groups using direct maps | 18:51 |
| *** gokrokve has joined #openstack-keystone | 18:53 | |
| *** aix has quit IRC | 18:53 | |
| rodrigods | marekd, tied to the new key "groups" in the local rule | 18:55 |
| *** afaranha has quit IRC | 18:55 | |
| marekd | rodrigods: yes | 18:56 |
| rodrigods | marekd, great | 18:56 |
| marekd | rodrigods: are you implementing it now? | 18:56 |
| rodrigods | marekd, yes | 18:56 |
| marekd | good | 18:56 |
| rodrigods | me and vsilva should submit a patch this week | 18:56 |
| marekd | allrogty | 18:56 |
| marekd | i will have to stay then with debugging pysaml2 :( | 18:57 |
| rodrigods | marekd, heh :P | 18:58 |
| rodrigods | marekd, your reviews are always handy too :) | 18:58 |
| marekd | rodrigods: i will do my best. | 19:00 |
| morganfainberg | thanks all for the productive meeting. | 19:01 |
| jamielennox | morganfainberg: so, ksc release? | 19:01 |
| morganfainberg | it's going to be monday | 19:02 |
| morganfainberg | for sure | 19:02 |
| jamielennox | morganfainberg: what are we waiting for? | 19:02 |
| morganfainberg | for me to do release management stuff and get home | 19:02 |
| morganfainberg | unless there is a burning need for it tomorrow | 19:02 |
| *** amolock has joined #openstack-keystone | 19:03 | |
| morganfainberg | jamielennox, which case i'll fight with LP to do it | 19:03 |
| *** marcoemorais has joined #openstack-keystone | 19:03 | |
| jamielennox | morganfainberg: i have things waiting - but not burning, i just thought the intent was early this week and i thought you might have been waiting for certain patches | 19:03 |
| ayoung | jamielennox, do we have anything outstanding for "service users in non default domain" yet? | 19:04 |
| ayoung | er...still? | 19:04 |
| jamielennox | ayoung: no, all that stuff is merged i think | 19:04 |
| lbragstad | so, question on the splits we talked about. If there isn't a direct benefit of doing it, should it really be done? | 19:04 |
| topol | lbragstad does it make the code easier to read and maintain/ | 19:05 |
| lbragstad | or should that split wait until we have sound reason to follow through with it | 19:05 |
| *** amolock has quit IRC | 19:05 | |
| lbragstad | topol: I'd have to revisit the 25000 line patch :) | 19:06 |
| topol | lbragstad, me too. After some liquid courage | 19:06 |
| lbragstad | topol: ++ | 19:07 |
| jamielennox | lbragstad: i can't tell, most of the reasons i can come up with for having roles split out are nice in theory - but i don't think people would use it | 19:07 |
| morganfainberg | jamielennox, ok then lets do a pass and i'll fight LP tomorrow morning | 19:07 |
| morganfainberg | same with middleware | 19:07 |
| jamielennox | morganfainberg: this is not something i can help with right? | 19:07 |
| *** afaranha has joined #openstack-keystone | 19:07 | |
| morganfainberg | jamielennox, not at the moment, well besides verifying that things are all merged and in a good state | 19:08 |
| topol | lbragstad, did you find any good places to drink near where we will be for the upcoming hackathon? | 19:08 |
| *** henrynash has quit IRC | 19:08 | |
| jamielennox | morganfainberg: yea, i'm looking to see if there's anything else i want in this release if we wait a bit longer | 19:08 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Provide additional detail if OAuth headers are missing https://review.openstack.org/142191 | 19:09 |
| *** bernardo-silva has joined #openstack-keystone | 19:09 | |
| morganfainberg | jamielennox, if not i'll plan for tomorrow. | 19:09 |
| morganfainberg | or bug dolph to help me if the network is being particularly ornery | 19:09 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove unnecessary ldap import https://review.openstack.org/142192 | 19:10 |
| morganfainberg | ok it's long past lunchtime for me. and i need to find a new place to camp [where i have power] | 19:10 |
| jamielennox | morganfainberg: i don't see anything urgent, ideally we need to speed up the release cycle on these | 19:10 |
| morganfainberg | jamielennox, works for me. tomorrow it is. | 19:10 |
| lbragstad | topol: dolphm makes mean margaritas. | 19:10 |
| *** nellysmitt has joined #openstack-keystone | 19:11 | |
| morganfainberg | jamielennox, so silly question, should we just bump the version to 1.0.0? | 19:11 |
| morganfainberg | since this *might as well* be stable | 19:11 |
| morganfainberg | for ksc | 19:12 |
| jamielennox | morganfainberg: does that mean i get to break things? | 19:12 |
| morganfainberg | jamielennox, i offered that to you at the summit, you told me "nah, talk with sdk folks and such" | 19:12 |
| morganfainberg | well the x-project meeting and release group agrees, non-compat stuff should wortk w/ the sdk folks | 19:13 |
| jamielennox | morganfainberg: you ran in past the TC and they said they didn't want v2 of clients | 19:13 |
| morganfainberg | and we should move *that* direction in general | 19:13 |
| ayoung | topol, I'm staying at the Valencia again, which means the Riverwalk is right there | 19:13 |
| morganfainberg | the TC said they'd prefer SDK. | 19:13 |
| topol | ayoung, me too | 19:14 |
| jamielennox | morganfainberg: right | 19:14 |
| morganfainberg | anyway. i was meaning should this release be called 1.0.0 because well ksc is effectively stable | 19:14 |
| morganfainberg | and we should drop the 0.x.x for a stable nomenclature | 19:14 |
| jamielennox | morganfainberg: sure, ksc has been effectively stable for as long as i've been messing with it | 19:14 |
| morganfainberg | if anyone has a reason i shouldn't make this 1.0.0 of ksc | 19:14 |
| morganfainberg | please let me know | 19:14 |
| morganfainberg | but i'm off to eat and get my laptop plugged in | 19:15 |
| ayoung | I like the Linus Torvalds approach that major revision numbers should just be randomly assigned a some point in time | 19:15 |
| jamielennox | morganfainberg: does it let me change little, "this is technically backwards incompatible but you won't really notice" problems? | 19:15 |
| jamielennox | because i think old releases are pinned < 1.0 | 19:16 |
| *** nellysmitt has quit IRC | 19:16 | |
| *** marcoemorais has quit IRC | 19:27 | |
| *** marcoemorais has joined #openstack-keystone | 19:27 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Add OS-SIMPLE-CERT support for v3. https://review.openstack.org/142200 | 19:30 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Add OS-SIMPLE-CERT support for v3. https://review.openstack.org/142200 | 19:31 |
| *** lhcheng has quit IRC | 19:33 | |
| *** lhcheng has joined #openstack-keystone | 19:33 | |
| *** lhcheng_ has joined #openstack-keystone | 19:34 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/134794 | 19:36 |
| *** lhcheng has quit IRC | 19:38 | |
| *** marcoemorais has quit IRC | 19:42 | |
| *** marcoemorais has joined #openstack-keystone | 19:42 | |
| *** marcoemorais has quit IRC | 19:42 | |
| *** marcoemorais has joined #openstack-keystone | 19:43 | |
| *** marcoemorais has quit IRC | 19:44 | |
| *** amolock has joined #openstack-keystone | 19:44 | |
| *** marcoemorais has joined #openstack-keystone | 19:44 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Add get certificates for v2.0 https://review.openstack.org/142122 | 19:45 |
| *** hdd has quit IRC | 19:48 | |
| dolphm | if anyone has *not* booked a hotel for the hackathon - do so *this week* if you want a discount at the valencia | 19:49 |
| bknudson | jamielennox: old releases can't be pinned. | 19:50 |
| morganfainberg | jamielennox, no. | 19:51 |
| morganfainberg | dolphm, i've had only a couple people ask for the discount code | 19:51 |
| morganfainberg | so... | 19:51 |
| *** marcoemorais has left #openstack-keystone | 19:51 | |
| morganfainberg | i assume everyone else is booking on their own | 19:52 |
| gabriel-bezerra | marekd: idp_users.py describes the users' attributes. | 19:52 |
| gabriel-bezerra | dstanek: ^ | 19:52 |
| dstanek | gabriel-bezerra: ? | 19:52 |
| dstanek | on my new devstack instance apache is only listening on tcp6 :-( | 19:53 |
| gabriel-bezerra | you were having problems with the attributes sent by the idp, weren't you? | 19:53 |
| gabriel-bezerra | dstanek: in my setup, netstat -ltnp shows only the ipv6 address, but it works with the ipv4 too | 19:54 |
| dstanek | gabriel-bezerra: it doesn't seem to be listening on ipv4 - maybe i just need to rebuild the machine | 19:55 |
| *** hdd has joined #openstack-keystone | 19:55 | |
| gabriel-bezerra | I mean, there is only a process listening on port 5000 in the ipv6 list, but it also works when I use ipv4 from another machine | 19:55 |
| gabriel-bezerra | and there is no process lisetinng on 0.0.0.0:5000 | 19:56 |
| gabriel-bezerra | nor any ipv4 address:5000 | 19:56 |
| dstanek | no such luck for me | 19:56 |
| *** dims_ has quit IRC | 19:58 | |
| dstanek | gabriel-bezerra: i stopped just before i was going to edit the attribute xml configuration - so i'm not yet sure what needs to go in there | 19:59 |
| *** dims has joined #openstack-keystone | 19:59 | |
| *** bernardo-silva has quit IRC | 19:59 | |
| openstackgerrit | ayoung proposed openstack/keystone: Member for assignment policy https://review.openstack.org/142162 | 20:02 |
| openstackgerrit | ayoung proposed openstack/keystone: policy refactoring https://review.openstack.org/141969 | 20:02 |
| openstackgerrit | ayoung proposed openstack/keystone: policy exception handling https://review.openstack.org/142207 | 20:02 |
| *** dims has quit IRC | 20:03 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Check and delete for policy_association_for_region_and_service https://review.openstack.org/140122 | 20:11 |
| ayoung | bknudson, feel free to +2 that one again | 20:12 |
| *** marcoemorais has joined #openstack-keystone | 20:14 | |
| bknudson | ayoung: which? | 20:14 |
| ayoung | bknudson, https://review.openstack.org/#/c/140122/6 | 20:14 |
| ayoung | your change was trivial, and I think between you, me and morganfainberg we are OK saying that is ready to go in | 20:15 |
| bknudson | morganfainberg: want to take a quick look at https://review.openstack.org/#/c/140122 ? | 20:15 |
| morganfainberg | bknudson, looking now | 20:15 |
| ayoung | just to re +A it | 20:15 |
| morganfainberg | yeah wait till jenkins then +A | 20:16 |
| morganfainberg | i tossed a +2 on there as well | 20:16 |
| morganfainberg | thanks! | 20:16 |
| bknudson | thanks | 20:16 |
| morganfainberg | two more bugs to get gating - easy enough. | 20:17 |
| morganfainberg | or maybe it's one | 20:17 |
| *** dims has joined #openstack-keystone | 20:18 | |
| *** DaveChen has quit IRC | 20:19 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add generic auth plugin documentation https://review.openstack.org/141680 | 20:19 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add auth plugin params to doc https://review.openstack.org/141681 | 20:21 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Document the auth plugins that are loadable by name https://review.openstack.org/141683 | 20:24 |
| lbragstad | and reason to not push https://review.openstack.org/#/c/140122/6 into the gate? | 20:37 |
| marekd | gabriel-bezerra: yes. | 20:37 |
| lbragstad | oh, yeah... Jenkins... | 20:37 |
| *** marcoemorais has quit IRC | 20:41 | |
| *** marcoemorais has joined #openstack-keystone | 20:42 | |
| gabriel-bezerra | marekd: so am I =/ | 20:43 |
| *** rushiagr is now known as rushiagr_away | 20:44 | |
| marekd | gabriel-bezerra: ? | 20:44 |
| openstackgerrit | ayoung proposed openstack/keystone: Consolidation for policy https://review.openstack.org/142162 | 20:47 |
| gabriel-bezerra | marekd: I'm also having trouble with the attributes | 20:52 |
| openstackgerrit | David Chadwick proposed openstack/keystone-specs: Self Management of Roles and Domain Scoped Roles https://review.openstack.org/142072 | 20:54 |
| openstackgerrit | David Chadwick proposed openstack/keystone-specs: Self Management of Roles and Domain Scoped Roles https://review.openstack.org/142072 | 21:01 |
| *** marcoemorais has left #openstack-keystone | 21:02 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone-specs: Fix RST formatting issues https://review.openstack.org/141930 | 21:08 |
| openstackgerrit | David Chadwick proposed openstack/keystone-specs: Self Management of Roles and Domain Scoped Roles https://review.openstack.org/142072 | 21:11 |
| *** nellysmitt has joined #openstack-keystone | 21:11 | |
| afaranha | ayoung, So I'm creating a variable, like the member you created, called: enforce (temporary name). | 21:13 |
| afaranha | ayoung, the idea is that we can write rules like this: create_user: role:domain_admin and domain_id:%(enforce.domain_id)s | 21:13 |
| ayoung | afaranha, yeah, naming is tricky | 21:13 |
| ayoung | that is the right idea... | 21:13 |
| afaranha | In the common/controller.py where we have: def protected(callback=None) I added enforce variable | 21:14 |
| afaranha | def protected(callback=None, enforce=None) | 21:14 |
| afaranha | so, the entity controller will call the protected method passing also this variable if needed | 21:15 |
| *** tellesnobrega has quit IRC | 21:15 | |
| afaranha | ayoung, I'll just make a test to make sure it's passing the right entity as intended | 21:16 |
| afaranha | jsut a minute | 21:16 |
| ayoung | morganfainberg, I just +a-ed one of the last 3 reviews for https://launchpad.net/keystone/+milestone/kilo-1 | 21:16 |
| morganfainberg | thanks | 21:16 |
| ayoung | https://bugs.launchpad.net/bugs/1383676 | 21:16 |
| uvirtbot | Launchpad bug 1383676 in keystone "endless loop when deleting region" [High,In progress] | 21:16 |
| *** nellysmitt has quit IRC | 21:17 | |
| ayoung | morganfainberg, that really just leaves one | 21:17 |
| ayoung | https://bugs.launchpad.net/keystone/+bug/1398470 | 21:17 |
| uvirtbot | Launchpad bug 1398470 in keystone "sql migration helpers incorrectly inspect for FKs" [Medium,In progress] | 21:17 |
| morganfainberg | post x-project meeting i'm going to be looking at it and see what can be done | 21:17 |
| *** tellesnobrega has joined #openstack-keystone | 21:17 | |
| morganfainberg | isn't that one already gating? | 21:17 |
| morganfainberg | the FK one | 21:17 |
| ayoung | yep | 21:18 |
| ayoung | was just looking. | 21:18 |
| ayoung | so all 3 should be through shortly, gate willing and the creek don't rise | 21:18 |
| bknudson | these changes are to make it so that we can get rid of the rest calls in auth_token and use keystoneclient: https://review.openstack.org/#/q/status:open+project:openstack/python-keystoneclient+branch:master+topic:bp/auth-token-use-client,n,z | 21:20 |
| *** andreaf has quit IRC | 21:21 | |
| *** samuelms_ has joined #openstack-keystone | 21:26 | |
| openstackgerrit | David Chadwick proposed openstack/keystone-specs: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/138693 | 21:26 |
| openstackgerrit | Merged openstack/keystonemiddleware: remove the unused method _will_expire_soon https://review.openstack.org/140966 | 21:30 |
| openstackgerrit | Merged openstack/keystonemiddleware: documentation for audit middleware https://review.openstack.org/130344 | 21:30 |
| morganfainberg | ayoung, thanks! | 21:31 |
| dolphm | morganfainberg: lbragstad: side thought, from a comment that lance made- spec authors should never register blueprints. the person hitting WorkFlow+1 should be creating the corresponding blueprint. | 21:36 |
| morganfainberg | dolphm, i'm fine with that | 21:36 |
| morganfainberg | doesn't ttx have a tool for that though (or we could make one) | 21:36 |
| dolphm | morganfainberg: i don't know if you can enforce that within lp ...? | 21:36 |
| morganfainberg | you can't | 21:36 |
| dolphm | it'd clean up all the random blueprints in a hurry | 21:37 |
| morganfainberg | but we can just say tool XXX will co-opt a previously registered bp | 21:37 |
| morganfainberg | and we can have it cleanup any bp that isn't in -specs | 21:37 |
| lbragstad | I like that idea. Not sure we had a criteria for it before? | 21:39 |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/134794 | 21:42 |
| *** diegows has quit IRC | 21:43 | |
| afaranha | Do someone knows how these parameters are passed to this function? https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L102 | 21:46 |
| rodrigods | afaranha, it's a decorator | 21:46 |
| *** Tahmina has joined #openstack-keystone | 21:47 | |
| morganfainberg | lbragstad, no more/less of a critera than "make a spec" | 21:52 |
| morganfainberg | lbragstad, we just didn't specify who made the bp | 21:53 |
| lbragstad | yep, exactly | 21:53 |
| morganfainberg | lbragstad, easy to make this change if we make a tool do the job for us | 21:53 |
| afaranha | ayoung, working :D | 22:03 |
| stevemar | hmm, weird cinder error coming up when using devstack now... i think they moved the bin directory | 22:03 |
| afaranha | ayoung, I'll post as WIP if you wanna check | 22:03 |
| afaranha | ayoung, but needs much more improvements | 22:03 |
| ayoung | afaranha, cool. Have to head home now, and do some family time. I'll check later on tonight. THanks. | 22:04 |
| *** ayoung has quit IRC | 22:04 | |
| *** diegows has joined #openstack-keystone | 22:05 | |
| openstackgerrit | Andre Aranha proposed openstack/keystone: Member for assignment policy https://review.openstack.org/142162 | 22:07 |
| morganfainberg | raildo, rodrigods, ping - re HMT (now that it's merged) | 22:11 |
| rodrigods | morganfainberg, o/ | 22:11 |
| morganfainberg | rodrigods, so now that HMT is merged, you guys mind writing up a little blurb we can publish highlighting what it means *today* for an OpenStack user/deployer? and what is next. I'd like to also use it in the "keystone webinar" i'm doing next week (the kilo release one) | 22:12 |
| rodrigods | morganfainberg, not at all! Where? Blog post or something? | 22:14 |
| morganfainberg | if you have a blog post for it that would be PERFECT! | 22:14 |
| morganfainberg | i'll also link to it from my blog ;) | 22:14 |
| rodrigods | morganfainberg, great! Think raildo is afk, but will send him an email right now :) | 22:15 |
| morganfainberg | but the key is to highlight the two peices: what does it mean today, and what is next | 22:15 |
| rodrigods | absolutely, we are really excited about the next steps | 22:15 |
| morganfainberg | that'll help with socializing this to nova and other projects and get them thinking about it :) | 22:15 |
| rodrigods | ++ | 22:16 |
| morganfainberg | we'll also get a message on the -dev list and operator list with a link to your post | 22:16 |
| rodrigods | great! :) | 22:16 |
| morganfainberg | ooh boy i need to rebase this change to get it in. | 22:29 |
| morganfainberg | wonder if i can break the dep on the previous change... | 22:30 |
| *** chrisshattuck has quit IRC | 22:32 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Cleanup exceptions https://review.openstack.org/142243 | 22:33 |
| jamielennox | i knew apiclient was going to bite us in the arse eventually | 22:34 |
| *** marcoemorais has joined #openstack-keystone | 22:35 | |
| bknudson | can't be removed since it's part of the public api now | 22:35 |
| jamielennox | bknudson: no but it can be absorbed so it stops doing so much damage | 22:36 |
| jamielennox | that review is a start for keystoneclient ^ | 22:37 |
| lbragstad | morganfainberg: following up from earlier, all the xml references in here should be removed: https://github.com/openstack/keystone-specs/blob/master/api/v2.0/identity-api-v2.0-extensions.rst | 22:38 |
| lbragstad | correct? | 22:38 |
| lbragstad | and all the other identity-api-v2.0*.rst files | 22:38 |
| morganfainberg | lbragstad, we should make sure they aren't relevant before we remove them. | 22:38 |
| morganfainberg | lbragstad, but if we don't support XML it shouldnt be there :) | 22:38 |
| morganfainberg | saying we do that is | 22:39 |
| *** amolock has quit IRC | 22:39 | |
| lbragstad | correct, makes sense | 22:39 |
| *** samuelms_ has quit IRC | 22:39 | |
| openstackgerrit | Merged openstack/keystone: Fix the way migration helpers check FK names. https://review.openstack.org/138468 | 22:39 |
| * morganfainberg hates being at a place he can't run local unit tests. | 22:40 | |
| morganfainberg | because data rates and $hotel wifi is bad | 22:40 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: add circular check when updating region https://review.openstack.org/130474 | 22:40 |
| bknudson | morganfainberg: NameError: global name 'old_region' is not defined | 22:41 |
| morganfainberg | bknudson, dang it. | 22:41 |
| morganfainberg | bknudson thanks | 22:41 |
| morganfainberg | bknudson, i'm tempted to just smash this change in... | 22:42 |
| bknudson | morganfainberg: why? | 22:42 |
| morganfainberg | the parent change was having a number of issues. | 22:42 |
| morganfainberg | i meant combine the fix from the parent. | 22:42 |
| morganfainberg | or.. i guess i could just punt this from k1 | 22:42 |
| bknudson | it's not ready | 22:42 |
| * morganfainberg grumbles. | 22:42 | |
| morganfainberg | well this change is. | 22:43 |
| morganfainberg | the other one isn't | 22:43 |
| bknudson | there's probably a bunch of changes that are ready... | 22:43 |
| bknudson | for example, things that already have 1 or 2 +2s | 22:43 |
| morganfainberg | bknudson, the parent is the issue here | 22:44 |
| morganfainberg | bknudson, not the change i tried to rebase the parent out of | 22:44 |
| morganfainberg | bknudson, it had 2x+2 and a +A | 22:44 |
| morganfainberg | just the parent change was a) outdated, and b) not ready | 22:44 |
| bknudson | morganfainberg: I think he made the parent change because he found it while trying out the dependent change. | 22:44 |
| morganfainberg | yeah seeing what he's doing now. | 22:45 |
| * morganfainberg puts it all back | 22:45 | |
| *** topol has quit IRC | 22:45 | |
| bknudson | the parent change was to fix a bug where an update actually did a replace | 22:45 |
| morganfainberg | i hate the catalog kvs driver | 22:45 |
| openstackgerrit | Merged openstack/keystone: default revoke driver should be the non-deprecated driver https://review.openstack.org/130917 | 22:45 |
| openstackgerrit | Merged openstack/keystone: Fixes links in Shibboleth configuration docs https://review.openstack.org/140077 | 22:46 |
| bknudson | should be fine with decent unit tests | 22:47 |
| openstackgerrit | Merged openstack/keystone: fix wrong indentation in contrib/federation/utils.py https://review.openstack.org/139923 | 22:48 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: add circular check when updating region https://review.openstack.org/130474 | 22:48 |
| openstackgerrit | Merged openstack/keystone: Rename `removeEvent` to be more pythonic https://review.openstack.org/142103 | 22:49 |
| morganfainberg | bknudson, it's all good will punt that fix to k2 | 22:51 |
| openstackgerrit | Merged openstack/keystone: Add test for update role without name https://review.openstack.org/141185 | 22:51 |
| morganfainberg | it needed a rebase anyway | 22:51 |
| *** gokrokve has quit IRC | 22:57 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Remove XML references from API documentation https://review.openstack.org/142250 | 22:58 |
| *** timcline has quit IRC | 22:59 | |
| *** gokrokve has joined #openstack-keystone | 23:02 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Cleanup exceptions https://review.openstack.org/142243 | 23:05 |
| *** gokrokve has quit IRC | 23:06 | |
| *** dims has quit IRC | 23:07 | |
| *** gokrokve has joined #openstack-keystone | 23:07 | |
| *** dims has joined #openstack-keystone | 23:07 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Cleanup exceptions https://review.openstack.org/142243 | 23:08 |
| *** dims has quit IRC | 23:08 | |
| *** dims has joined #openstack-keystone | 23:08 | |
| *** nellysmitt has joined #openstack-keystone | 23:12 | |
| *** marcoemorais has left #openstack-keystone | 23:13 | |
| *** nellysmitt has quit IRC | 23:17 | |
| *** gordc has quit IRC | 23:23 | |
| *** gokrokve has quit IRC | 23:28 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Role revocation invalidates too many tokens https://review.openstack.org/141397 | 23:44 |
| *** andreaf has joined #openstack-keystone | 23:52 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!