| dolphm | the 433% can be computed from the raw data (linked), but in retrospect i'm not sure it repesents a performance metric anyone cares about, so i excluded it. it sure sounded good though :) | 00:00 |
|---|---|---|
| morganfainberg | dolphm, yep. i figured it'd be like that | 00:00 |
| morganfainberg | dolphm, toss in smart caching | 00:00 |
| morganfainberg | even better | 00:00 |
| morganfainberg | i'm sure | 00:00 |
| morganfainberg | dolphm, i actually think you underestimate validate pain | 00:01 |
| morganfainberg | people just don't think about it | 00:01 |
| *** henrynash has quit IRC | 00:01 | |
| morganfainberg | it'll be the #2 after token table issues | 00:01 |
| morganfainberg | maybe #3 post TTL and table size issues | 00:01 |
| morganfainberg | they don't know they care about it yet. | 00:01 |
| morganfainberg | ;) | 00:01 |
| dolphm | morganfainberg: it's apparently not a pain for public cloud. caching up the wazoo makes it a non-issue | 00:02 |
| dolphm | rax* public cloud | 00:02 |
| rodrigods | dolphm, that is a impressive result... we are doing some benchmarks ourselves, more related with keystone's horizontal scalability | 00:02 |
| morganfainberg | public clouds do stupid stuff to "paper over" the issue | 00:02 |
| morganfainberg | but it's because we can | 00:02 |
| morganfainberg | HP does other silly things to solve it | 00:02 |
| morganfainberg | when you have that much ram sitting around... cache all the things! | 00:03 |
| morganfainberg | but smaller providers can't do it. | 00:03 |
| *** henrynash has joined #openstack-keystone | 00:03 | |
| *** ChanServ sets mode: +v henrynash | 00:03 | |
| dolphm | rodrigods: with everything setup, i'll likely publish some additional metrics for other scalability concerns | 00:03 |
| *** henrynash has quit IRC | 00:04 | |
| dolphm | morganfainberg: yeah, i'd like to repeat these benchmarks in a deployment that would represent a much smaller provider | 00:04 |
| dolphm | morganfainberg: i imagine AE won't have as much of a performance margin there | 00:05 |
| *** dkingshott has quit IRC | 00:05 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Add entry-points for option discovery https://review.openstack.org/153090 | 00:06 |
| openstackgerrit | Lin Hua Cheng proposed openstack/pycadf: Fix oslo.messaging link in docs https://review.openstack.org/153094 | 00:16 |
| *** raildo_ has quit IRC | 00:16 | |
| lhcheng | stevemar: what was the keystone setting to output the cadf audit into a log file instead of sending to a queue? | 00:17 |
| *** dims_ has quit IRC | 00:17 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Change hacking check to verify all oslo imports https://review.openstack.org/151881 | 00:18 |
| stevemar | lhcheng, notification_driver = log | 00:22 |
| lhcheng | stevemar: thanks! I'm just about to review and test the cadf patches. :) | 00:22 |
| *** amerine has quit IRC | 00:22 | |
| *** amerine has joined #openstack-keystone | 00:23 | |
| *** gtt116_ has joined #openstack-keystone | 00:27 | |
| *** stevemar has quit IRC | 00:27 | |
| *** gtt116__ has quit IRC | 00:30 | |
| *** gordc has joined #openstack-keystone | 00:31 | |
| *** gyee has quit IRC | 00:34 | |
| *** diegows has quit IRC | 00:40 | |
| *** zzzeek has quit IRC | 00:46 | |
| *** dims__ has joined #openstack-keystone | 00:46 | |
| *** zzzeek has joined #openstack-keystone | 00:50 | |
| *** _cjones_ has quit IRC | 00:53 | |
| *** nellysmitt has joined #openstack-keystone | 00:58 | |
| *** oomichi has joined #openstack-keystone | 00:58 | |
| *** gordc has quit IRC | 01:00 | |
| *** nellysmitt has quit IRC | 01:02 | |
| *** chlong has joined #openstack-keystone | 01:05 | |
| *** zzzeek has quit IRC | 01:12 | |
| *** zzzeek has joined #openstack-keystone | 01:15 | |
| *** gordc has joined #openstack-keystone | 01:15 | |
| *** david-lyle is now known as david-lyle_afk | 01:18 | |
| openstackgerrit | Brant Knudson proposed openstack/oslo.policy: General docstring cleanup https://review.openstack.org/153100 | 01:18 |
| *** jamielennox|away is now known as jamielennox | 01:19 | |
| *** chlong has quit IRC | 01:22 | |
| *** DaveChen has joined #openstack-keystone | 01:28 | |
| *** rwsu is now known as rwsu-afk | 01:43 | |
| *** gordc has quit IRC | 01:44 | |
| openstackgerrit | Merged openstack/pycadf: Fix oslo.messaging link in docs https://review.openstack.org/153094 | 01:48 |
| *** markvoelker has joined #openstack-keystone | 01:54 | |
| *** EmilienM is now known as EmilienM|afk | 01:55 | |
| *** sluo_wfh has joined #openstack-keystone | 02:03 | |
| *** tqtran has quit IRC | 02:10 | |
| *** erkules_ has joined #openstack-keystone | 02:11 | |
| openstackgerrit | wanghong proposed openstack/keystone-specs: implement timestamp for Project, Domain, Role https://review.openstack.org/153114 | 02:13 |
| *** erkules has quit IRC | 02:14 | |
| *** dims__ has quit IRC | 02:14 | |
| openstackgerrit | Merged openstack/keystone: Handle SSL termination proxies for version list https://review.openstack.org/132235 | 02:20 |
| *** chlong has joined #openstack-keystone | 02:26 | |
| *** spandhe has quit IRC | 02:27 | |
| *** tellesnobrega_ has quit IRC | 02:31 | |
| *** thedodd has joined #openstack-keystone | 02:37 | |
| *** thedodd has quit IRC | 02:37 | |
| *** rushiagr_away is now known as rushiagr | 02:40 | |
| *** chlong has quit IRC | 02:40 | |
| *** dims__ has joined #openstack-keystone | 02:45 | |
| *** dims_ has joined #openstack-keystone | 02:46 | |
| *** dims__ has quit IRC | 02:50 | |
| *** tellesnobrega_ has joined #openstack-keystone | 02:53 | |
| *** lhcheng has quit IRC | 02:57 | |
| *** nellysmitt has joined #openstack-keystone | 02:58 | |
| *** tellesnobrega_ has quit IRC | 02:59 | |
| *** nellysmitt has quit IRC | 03:04 | |
| *** tellesnobrega_ has joined #openstack-keystone | 03:12 | |
| *** stevemar has joined #openstack-keystone | 03:12 | |
| *** ChanServ sets mode: +v stevemar | 03:12 | |
| *** dims_ has quit IRC | 03:12 | |
| *** rushiagr is now known as rushiagr_away | 03:18 | |
| *** josecastroleon has quit IRC | 03:23 | |
| *** chlong has joined #openstack-keystone | 03:30 | |
| *** chlong has quit IRC | 03:37 | |
| *** stevemar has quit IRC | 03:38 | |
| *** stevemar has joined #openstack-keystone | 03:40 | |
| *** ChanServ sets mode: +v stevemar | 03:40 | |
| *** rushiagr_away is now known as rushiagr | 03:43 | |
| *** zzzeek has quit IRC | 03:53 | |
| *** harlowja is now known as harlowja_away | 03:56 | |
| *** lhcheng has joined #openstack-keystone | 04:09 | |
| openstackgerrit | wanghong proposed openstack/python-keystoneclient: use right resource_class to create resource instance https://review.openstack.org/152831 | 04:10 |
| *** haneef_ has joined #openstack-keystone | 04:21 | |
| *** chlong has joined #openstack-keystone | 04:35 | |
| jamielennox | so there kerberos plugin has no way to specify user domain information? | 04:50 |
| jamielennox | s/there/the | 04:50 |
| jamielennox | marekd: have you come across this? | 04:50 |
| *** richm has quit IRC | 04:54 | |
| *** chlong has quit IRC | 04:54 | |
| jamielennox | ok, i guess handling that on the server side is sufficient | 04:55 |
| jamielennox | or makes more sense | 04:55 |
| jamielennox | everyone ignore the guy thinking though stuff on IRC | 04:55 |
| *** nellysmitt has joined #openstack-keystone | 04:59 | |
| *** chlong has joined #openstack-keystone | 05:03 | |
| *** nellysmitt has quit IRC | 05:04 | |
| *** abhirc has quit IRC | 05:40 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove local conf information from paste-ini https://review.openstack.org/134124 | 05:42 |
| *** dguerri has quit IRC | 05:44 | |
| *** lhcheng has quit IRC | 05:44 | |
| *** lhcheng has joined #openstack-keystone | 05:45 | |
| *** dguerri has joined #openstack-keystone | 05:45 | |
| *** tellesnobrega_ has quit IRC | 05:58 | |
| *** dims__ has joined #openstack-keystone | 06:13 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/152795 | 06:15 |
| *** dims__ has quit IRC | 06:18 | |
| stevemar | jamielennox, happens to us all https://badarabbas.files.wordpress.com/2013/07/feyn.jpg | 06:21 |
| wanghong | stevemar, ping. It seams that we will remove ldap next circle, right? | 06:21 |
| stevemar | wanghong, ldap *assignment* | 06:21 |
| jamielennox | stevemar: in my case think even moderately | 06:21 |
| wanghong | stevemar, yeah, ldap assignment | 06:22 |
| stevemar | wanghong, it'll be targeted for deprecation, so it'll be around for at least 2 cycles | 06:22 |
| stevemar | wanghong, if you have a requirement for it to stay, then let us know | 06:22 |
| stevemar | as far as we know, only one company is using it, and they are moving their assignments to SQL | 06:23 |
| jamielennox | stevemar: who? | 06:23 |
| stevemar | jamielennox, CERN | 06:23 |
| wanghong | stevemar, thanks, I just confirm. | 06:23 |
| jamielennox | so when you say one company... :) | 06:23 |
| stevemar | hehe, one BIG consumer | 06:23 |
| wanghong | haha | 06:23 |
| stevemar | wanghong, we are also thinking about removing the read/write portion of identity ldap, but that's later | 06:24 |
| stevemar | so it's just read-only | 06:24 |
| stevemar | because again, no one actually uses it in a read-write manner | 06:24 |
| stevemar | we will remove *a lot* of code that no one is using, which would be great | 06:25 |
| wanghong | But, it seams that we only have sql driver in the future | 06:27 |
| stevemar | for assignment, yes | 06:27 |
| stevemar | for identity we will still have ldap, just not the ability to write to ldap (like create new users) | 06:27 |
| wanghong | Our company only uses sql. In fact, I know little about ldap :) | 06:31 |
| stevemar | wanghong, so your huawei account is probably on a company ldap, so imagine you wanted to give access to openstack to all users on that ldap | 06:32 |
| stevemar | you just point it to the right internal url | 06:32 |
| stevemar | but your ldap admins would probably never give you permission to *create* users on it | 06:33 |
| stevemar | any SSO application will read from ldap, most ldaps have anonymous read access | 06:33 |
| marekd | morning. | 06:34 |
| stevemar | marekd, evening | 06:34 |
| wanghong | afternoon:) | 06:34 |
| stevemar | hehe | 06:34 |
| marekd | stevemar: what do you mean by sso protocol in keystone? | 06:35 |
| marekd | re: ping from ~10h ago? | 06:35 |
| stevemar | marekd, scrap that, don't worry | 06:36 |
| marekd | morganfainberg: yeah, i am focusing on that. In fact I might need some Jedi's eyes on that. | 06:36 |
| marekd | stevemar: ok | 06:37 |
| stevemar | i convinced our horizon dev that the option should be in horizon, not in keystone | 06:37 |
| marekd | which one? Because I didn't fully understand. | 06:37 |
| *** lhcheng has quit IRC | 06:37 | |
| marekd | stevemar: https://review.openstack.org/#/c/152659/ about my patch where py27 tests pass and all the rest fail on some 'unrelated' reasons I am guessing the best channel in -infra? | 06:38 |
| stevemar | marekd, look at the settings file in this patch: https://review.openstack.org/#/c/151842/ | 06:38 |
| marekd | stevemar: ah, so it will redirect to either saml2 or oidc regarding what option is put there? | 06:39 |
| stevemar | marekd, yes, that is what i was thinking initially | 06:40 |
| stevemar | marekd, but ayoung and gyee had a good suggestion, why not just have buttons that say 'saml2' and 'oidc' | 06:41 |
| marekd | stevemar: ++ | 06:41 |
| stevemar | they make more sense than "protocol id" | 06:41 |
| stevemar | which is kinda vague | 06:41 |
| marekd | yes, we can change it. | 06:41 |
| stevemar | marekd, you know more about discovery service, what do you need for that to work properly? on the horizon side? | 06:42 |
| stevemar | i was telling our dev to just have a setting called discovery_service which takes a url | 06:42 |
| marekd | stevemar: I had a guy who setup once a shibboleth with DS, but Horizon can be completely blind to this. | 06:43 |
| marekd | stevemar: (what's the past form of 'setup' ? ) | 06:44 |
| stevemar | marekd, this is funny: http://logs.openstack.org/59/152659/4/check/check-tempest-dsvm-full/ce97bcd/logs/apache/keystone.txt.gz#_2015-02-04_16_47_33_511 | 06:44 |
| marekd | stevemar: it's more like configuring shibboleth where you define: if you have one default IdP always redirect to that IdP, if you have more than one, put something in between (DS) so user can choose. | 06:44 |
| openstackgerrit | wanghong proposed openstack/keystone-specs: implement timestamp for Project, Domain, Role https://review.openstack.org/153114 | 06:45 |
| stevemar | marekd, it would be 'I knew a guy who had setup a shibboleth with DS' the 'had' implies past tense, but 'setup' doesn't have one | 06:46 |
| marekd | Ok :-) | 06:47 |
| stevemar | marekd, it's only when trying to explain english that i realize how confusing it can be | 06:47 |
| stevemar | special rules everywhere! | 06:47 |
| marekd | english is easy comparing to ...say french | 06:47 |
| stevemar | marekd, reply to the mailing list if you can, our horizon dev sent out screenshots | 06:48 |
| marekd | stevemar: I will do it. | 06:49 |
| stevemar | marekd, i think there is something screwy in your code for SPs in SC | 06:49 |
| stevemar | if you see the keystone log it has errors | 06:49 |
| marekd | stevemar: yeah, but for other tests it fails on installing packages, spawning a shell etc. | 06:49 |
| stevemar | ProgrammingError: (ProgrammingError) (1146, "Table 'keystone.service_provider' doesn't exist") 'SELECT service_provider.id AS service_provider_id, service_provider.enabled AS service_provider_enabled, service_provider.description AS service_provider_description, service_provider.auth_url AS service_provider_auth_url, service_provider.sp_url AS service_provider_sp_url \\nFROM service_provider \\nWHERE service_provider.enab | 06:50 |
| stevemar | led = 1' () | 06:50 |
| stevemar | oh... maybe it's running into that dependency problem | 06:50 |
| marekd | ooh, apparently i was checking wrong testsuites. | 06:51 |
| stevemar | i went here: http://logs.openstack.org/59/152659/4/check/check-tempest-dsvm-full/ce97bcd/logs/apache/keystone.txt.gz | 06:51 |
| morganfainberg | did keystone break the gate w/ the SP stuff? | 06:51 |
| morganfainberg | or?? | 06:51 |
| stevemar | morganfainberg, no, it's the output of a patch | 06:51 |
| stevemar | morganfainberg, go back to sleep :P | 06:51 |
| morganfainberg | oh phew | 06:51 |
| stevemar | haha | 06:51 |
| stevemar | marekd, so the dsvm suite doesn't do the db_sync for federation tables | 06:52 |
| marekd | stevemar: never happened to me before, how do I make it do db_sync ? | 06:52 |
| stevemar | marekd, you can't make it do it | 06:53 |
| marekd | who can make do it? | 06:53 |
| stevemar | well you can push a patch to infra but they will -2 it | 06:53 |
| stevemar | since you are then assuming every devstack has to create the federation tables | 06:54 |
| stevemar | i think we just have to look at https://review.openstack.org/#/c/152659/4/keystone/catalog/core.py again | 06:54 |
| marekd | hm hm h, | 06:55 |
| marekd | the worst thing is I think I cannot test it locally. | 06:57 |
| *** ajayaa has joined #openstack-keystone | 06:57 | |
| marekd | but, i am going to do the test. | 06:58 |
| stevemar | marekd, sure you can | 06:58 |
| marekd | stevemar: oh,everyday something new! | 06:59 |
| stevemar | do a minimal devstack setup, just keystone/glance/cinder/nova and don't call the federation db_sync | 06:59 |
| stevemar | pull down this patch, try to do anything with the service catalog, watch it blow up | 06:59 |
| *** josecastroleon has joined #openstack-keystone | 07:00 | |
| marekd | stevemar: ah, that way, i thought there is a way where I can actually run tests like jenkis does. | 07:00 |
| *** nellysmitt has joined #openstack-keystone | 07:00 | |
| stevemar | marekd, that's too much trouble | 07:00 |
| stevemar | and our test suite automatically resolves dependencies for all our extensions | 07:01 |
| stevemar | so it's faking it | 07:01 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Add entry-points for option discovery https://review.openstack.org/153090 | 07:01 |
| stevemar | ^^ finally figured that mess out | 07:01 |
| marekd | ++ | 07:02 |
| stevemar | oops forgot the changes to setup.cfg | 07:03 |
| marekd | stevemar: ok, i am running devstac. | 07:04 |
| marekd | devstack | 07:04 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Add entry points for option discovery https://review.openstack.org/153090 | 07:05 |
| *** nellysmitt has quit IRC | 07:05 | |
| *** markvoelker has quit IRC | 07:06 | |
| jamielennox | who destroyed django_openstack_auth - but got kerberos login in horizon? #tothetuneofshaft | 07:09 |
| jamielennox | oooooh yea | 07:09 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Privatize parsing classes https://review.openstack.org/153149 | 07:14 |
| stevemar | jamielennox, well done :) | 07:16 |
| *** erkules_ is now known as erkules | 07:18 | |
| *** harlowja_away has quit IRC | 07:23 | |
| *** mzbik has joined #openstack-keystone | 07:30 | |
| *** chlong has quit IRC | 07:39 | |
| *** afazekas has joined #openstack-keystone | 07:55 | |
| *** nkinder has joined #openstack-keystone | 07:57 | |
| *** lsmola has quit IRC | 08:05 | |
| *** stevemar has quit IRC | 08:12 | |
| *** nellysmitt has joined #openstack-keystone | 08:17 | |
| openstackgerrit | wanghong proposed openstack/keystone: remove the Conf.signing.token_format option support https://review.openstack.org/144250 | 08:21 |
| *** jaosorior has joined #openstack-keystone | 08:22 | |
| *** lsmola has joined #openstack-keystone | 08:22 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Refactor federation SQL backend https://review.openstack.org/153159 | 08:23 |
| *** zz_avozza is now known as avozza | 08:28 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Add new "RoleAssignment" exception https://review.openstack.org/133628 | 08:32 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Add ``service_providers`` in Service Catalog https://review.openstack.org/152659 | 08:32 |
| *** lsmola has quit IRC | 08:36 | |
| *** lsmola has joined #openstack-keystone | 08:38 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Skip endpoints which is not available https://review.openstack.org/144860 | 08:45 |
| openstackgerrit | wanghong proposed openstack/keystone: remove assignments for foreign actors when deleting domain https://review.openstack.org/127433 | 09:06 |
| *** jistr has joined #openstack-keystone | 09:07 | |
| *** ajayaa has quit IRC | 09:10 | |
| *** ajayaa has joined #openstack-keystone | 09:10 | |
| *** ajayaa has quit IRC | 09:30 | |
| *** ajayaa has joined #openstack-keystone | 09:31 | |
| *** gtt116_ has quit IRC | 09:34 | |
| *** pnavarro has joined #openstack-keystone | 09:37 | |
| *** MasterPiece has joined #openstack-keystone | 09:39 | |
| *** obutenko has joined #openstack-keystone | 09:49 | |
| *** nkinder has quit IRC | 09:53 | |
| *** nkinder has joined #openstack-keystone | 09:59 | |
| *** obutenko has quit IRC | 10:01 | |
| *** obutenko_ has joined #openstack-keystone | 10:01 | |
| *** pnavarro has quit IRC | 10:15 | |
| *** pnavarro has joined #openstack-keystone | 10:17 | |
| *** henrynash has joined #openstack-keystone | 10:20 | |
| *** ChanServ sets mode: +v henrynash | 10:20 | |
| *** MasterPiece has quit IRC | 10:23 | |
| *** tellesnobrega_ has joined #openstack-keystone | 10:28 | |
| *** tellesnobrega_ has quit IRC | 10:43 | |
| *** tellesnobrega_ has joined #openstack-keystone | 10:45 | |
| *** chlong has joined #openstack-keystone | 10:50 | |
| *** boris-42 has quit IRC | 10:52 | |
| breton | jamielennox: in Mirantis ldap assignment was used too | 10:58 |
| *** aix has joined #openstack-keystone | 11:04 | |
| *** tellesnobrega_ has quit IRC | 11:10 | |
| *** andreaf has joined #openstack-keystone | 11:12 | |
| *** amakarov_away is now known as amakarov | 11:18 | |
| *** lufix has joined #openstack-keystone | 11:40 | |
| *** markvoelker has joined #openstack-keystone | 11:40 | |
| *** josecastroleon has quit IRC | 11:46 | |
| *** markvoelker has quit IRC | 11:47 | |
| *** dims__ has joined #openstack-keystone | 11:47 | |
| *** pnavarro has quit IRC | 11:55 | |
| *** dims__ has quit IRC | 12:00 | |
| *** josecastroleon has joined #openstack-keystone | 12:00 | |
| *** EmilienM|afk is now known as EmilienM | 12:02 | |
| *** dims__ has joined #openstack-keystone | 12:03 | |
| *** nkinder has quit IRC | 12:12 | |
| rodrigods | henrynash, great review in the reseller spec, thx | 12:14 |
| henrynash | rodigods: np | 12:15 |
| *** nkinder has joined #openstack-keystone | 12:19 | |
| *** pnavarro has joined #openstack-keystone | 12:19 | |
| rodrigods | henrynash, replied your comments :) | 12:22 |
| henrynash | rodigods: so agree with the first bit, but not sure about teh second part….see my comment | 12:29 |
| *** topol has joined #openstack-keystone | 12:30 | |
| *** ChanServ sets mode: +v topol | 12:30 | |
| rodrigods | henrynash, just saw it | 12:31 |
| rodrigods | henrynash, my concern is... if we allow to grant a project role in a "domain" we would be giving domain powers anyway | 12:32 |
| *** chlong has quit IRC | 12:38 | |
| rodrigods | henrynash, or is this not a problem? | 12:38 |
| *** oomichi has quit IRC | 12:39 | |
| henrynash | rodigods:…so probably my unease is that I was assuming this is what we were doing (!)….but what is “a domain” power”? the only power is “do I have a role X on an entity with ID=Y”…hmmm…Iet me think on it few minutes.... | 12:42 |
| *** oomichi has joined #openstack-keystone | 12:42 | |
| henrynash | rodigods:…and I’m still uneasy about dual scoped tokens….somehow these issues are connected..but Ican’t quite artiulate my concern.... | 12:43 |
| *** markvoelker has joined #openstack-keystone | 12:43 | |
| *** oomichi has quit IRC | 12:44 | |
| rodrigods | henrynash, yes... our previous proposal was to keep both assignments types (DOMAIN and PROJECT) and have the ability to request a project scoped, domain scoped or dual scoped token depending on the assignments types you have | 12:45 |
| rodrigods | henrynash, but... thinking a bit more about assigning a project role in a "domain" is ok (doesn't make sense to deny this operation) | 12:46 |
| *** markvoelker has quit IRC | 12:47 | |
| rodrigods | henrynash, if an operator wants to split responsibilities (project -> handle resources, domain -> handle identity) it is possible by creating two different roles (domain_admin and project_admin) and using them in the policy | 12:52 |
| henrynash | rodigods: yes, that’s right…. | 12:54 |
| rodrigods | henrynash, so I think we are good as it is... just wait for lhcheng to reply | 12:55 |
| marekd | bknudson: Hi. I am fearing I am mising something with loading contrib Modules. For some reason https://review.openstack.org/#/c/152659/ -> keystone-manage db_sync --extension federation is not being run (and that's ok), but for some reason in catalog.Manager federation_api is not None behaving like federation was enabled up and running. | 12:58 |
| marekd | bknudson: my question is how can we control/check whether some extension is enabled or not | 12:59 |
| *** markvoelker has joined #openstack-keystone | 13:01 | |
| *** oomichi has joined #openstack-keystone | 13:04 | |
| *** afazekas has quit IRC | 13:06 | |
| *** oomichi has quit IRC | 13:08 | |
| *** Ctina has joined #openstack-keystone | 13:23 | |
| bknudson | marekd: providers enable themselves on import, e.g., see http://git.openstack.org/cgit/openstack/keystone/tree/keystone/contrib/federation/core.py#n49 | 13:27 |
| bknudson | marekd: so in order for federation to be enabled it has to be imported. | 13:27 |
| bknudson | and for it to not be enabled, it has to not be imported. | 13:27 |
| rodrigods | bknudson, good catch about "parent_id" being passed in kwargs: https://review.openstack.org/#/c/115770/27/keystoneclient/v3/projects.py | 13:28 |
| bknudson | normally extensions are only imported because the controller is loaded by the paste pipeline | 13:28 |
| rodrigods | bknudson, should we keep compatibility by preferring always the "parent" param? | 13:28 |
| bknudson | rodrigods: preferring the parent param makes sense... or I guess it could fail if both are used together. | 13:29 |
| marekd | bknudson: so, if federation_Extension is not loaded in any pipe in keystone-paste.ini it should not be loaded hence, available? | 13:29 |
| bknudson | marekd: if it's not in a paste pipeline then it shouldn't be available | 13:30 |
| marekd | bknudson: does it change that we are trying to load it by using @dependeny.optional() in auth/plugins/token.py ? | 13:30 |
| breton | fellas, I'd really love to see https://review.openstack.org/#/c/131531/ merged before spec freeze today. Could you please review it? | 13:30 |
| *** gordc has joined #openstack-keystone | 13:33 | |
| bknudson | marekd: the module has to be imported for the provider to be registered, that's what @dependency.provider('federation_api') does. | 13:33 |
| bknudson | there's no magic. | 13:33 |
| marekd | bknudson: so i don't understand how is it possible, that while federation_extension is not added to the paste-ini file, catalog.Manager.federation_api is not None. | 13:36 |
| *** abhirc has joined #openstack-keystone | 13:36 | |
| bknudson | marekd: something else might be importing the federation module. | 13:36 |
| marekd | https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/token.py#L27 e.g. this? or it must really be "from keystone.contrib import federation" ? | 13:38 |
| bknudson | dependency.optional doesn't import the federation module. | 13:39 |
| *** kromanenko has joined #openstack-keystone | 13:39 | |
| marekd | bknudson: probably one of those files does the dirty job: http://pasteraw.com/c5hrilm4p9o3xa9pakot9cpybd21m1f | 13:40 |
| bknudson | that's a lot of files importing that module... | 13:41 |
| *** abhirc has quit IRC | 13:41 | |
| marekd | bknudson: yes. | 13:41 |
| marekd | :( | 13:42 |
| bknudson | ./contrib/federation/routers.py is expected ... that should be what's loaded by the paste pipeline. | 13:42 |
| marekd | yes, should have added "grep -v contrib" | 13:42 |
| marekd | one dirty hack that comes to my head is to handle PRogrammingError and pass it silently, but I am not comfortable with the fact, that an Exception will be raised in probably 90% cases. | 13:44 |
| marekd | pity we don't have any more explicit way of enabling/disabling extensions. | 13:44 |
| *** dims__ has quit IRC | 13:49 | |
| bknudson | marekd: there's a spec approved to change extension handling ... | 13:51 |
| marekd | bknudson: oh, right. | 13:51 |
| marekd | forgot about that. | 13:51 |
| bknudson | http://specs.openstack.org/openstack/keystone-specs/specs/kilo/replace_extensions.html | 13:52 |
| bknudson | so I assume federation wouldn't be an extension when this is implemented. | 13:52 |
| bknudson | so federation can't be disabled | 13:53 |
| bknudson | and we don't have to worry about optional dependencies | 13:53 |
| *** afazekas has joined #openstack-keystone | 13:55 | |
| marekd | so the federation backend you be created by default, right? | 13:57 |
| marekd | (for instance) | 13:57 |
| marekd | OK, I am going to leave a comment on my patch so others can weight. | 13:58 |
| marekd | cause it's unclear to me whatto do with service_providers for K2K | 13:58 |
| *** samueldmq_ has joined #openstack-keystone | 13:58 | |
| marekd | depend on the extensions spec, add exception handler and deal with that or change API so client must explicitely ask for service_providers in the Service Catalog. | 13:59 |
| bknudson | since federation won't be an extension then the database tables will always be created. | 13:59 |
| bknudson | I don't know if we're going to remove the --extension parameter to keystone_manage db_sync or what. | 13:59 |
| bknudson | and migration is going to have to create the federation tables if they didn't exist before. | 14:01 |
| *** dims_ has joined #openstack-keystone | 14:02 | |
| marekd | well, yeah, federation related db tables would be there by default. | 14:02 |
| marekd | without any extra manual step. | 14:02 |
| *** dims___ has joined #openstack-keystone | 14:02 | |
| marekd | like db_sync --extension federation | 14:02 |
| *** abhirc has joined #openstack-keystone | 14:03 | |
| *** dims____ has joined #openstack-keystone | 14:04 | |
| *** dims_ has quit IRC | 14:06 | |
| *** dims__ has joined #openstack-keystone | 14:06 | |
| *** dims__ has quit IRC | 14:06 | |
| *** dims___ has quit IRC | 14:06 | |
| *** dims__ has joined #openstack-keystone | 14:07 | |
| *** dims__ has quit IRC | 14:08 | |
| *** dims____ has quit IRC | 14:09 | |
| *** therve has quit IRC | 14:10 | |
| *** therve has joined #openstack-keystone | 14:10 | |
| *** dims_ has joined #openstack-keystone | 14:11 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: domain as project https://review.openstack.org/143763 | 14:12 |
| *** mzbik has quit IRC | 14:16 | |
| *** richm has joined #openstack-keystone | 14:17 | |
| marekd | mflobo: https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst#authenticating | 14:19 |
| *** joesavak has joined #openstack-keystone | 14:23 | |
| *** boris-42 has joined #openstack-keystone | 14:25 | |
| *** ajayaa has quit IRC | 14:28 | |
| *** ajayaa has joined #openstack-keystone | 14:29 | |
| *** abhirc_ has joined #openstack-keystone | 14:38 | |
| *** abhirc has quit IRC | 14:40 | |
| *** henrynash has quit IRC | 14:44 | |
| *** diegows has joined #openstack-keystone | 14:45 | |
| *** krykowski has joined #openstack-keystone | 14:45 | |
| *** topol has quit IRC | 14:45 | |
| *** josecastroleon has quit IRC | 15:00 | |
| *** karimb has joined #openstack-keystone | 15:03 | |
| *** pnavarro has quit IRC | 15:08 | |
| lbragstad | dolphm: nice write up | 15:08 |
| openstackgerrit | Alistair Coles proposed openstack/keystonemiddleware: Delay denial when service token is invalid https://review.openstack.org/153247 | 15:15 |
| *** rm_work|away is now known as rm_work | 15:18 | |
| *** ajayaa has quit IRC | 15:19 | |
| *** topol has joined #openstack-keystone | 15:20 | |
| *** ChanServ sets mode: +v topol | 15:20 | |
| *** timcline has joined #openstack-keystone | 15:22 | |
| *** david-lyle_afk is now known as david-lyle | 15:23 | |
| *** josecastroleon has joined #openstack-keystone | 15:30 | |
| *** blinky_ghost has joined #openstack-keystone | 15:39 | |
| blinky_ghost | hi can anybody tell me what this error means in keystone: DEBUG urllib3.connectionpool [-] "POST /v3/auth/tokens HTTP/1.1" 401 140 _make_request /usr/lib/python2.7/site-packages/urllib3/connectionpool.py:357 DEBUG keystoneclient.session [-] Request returned failure status: 401 request /usr/lib/python2.7/site-packages/keystoneclient/session.py:345 DEBUG keystoneclient.v3.client [-] Authorization failed. get_raw_token_from_identity_service | 15:40 |
| blinky_ghost | /usr/lib/python2.7/site-packages/keystoneclient/v3/client.py:267 | 15:40 |
| blinky_ghost | thanks | 15:40 |
| *** dnalezyt has joined #openstack-keystone | 15:46 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Hierarchical multitenancy basic calls https://review.openstack.org/115770 | 15:47 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Implements subtree_as_ids and parents_as_ids https://review.openstack.org/150078 | 15:47 |
| rodrigods | bknudson, ^ think addressed your comments in the first one, thanks for the review | 15:47 |
| *** Ctina_ has joined #openstack-keystone | 15:48 | |
| bknudson | rodrigods: the decorator is necessary, it's the optional argument to the decorator. | 15:48 |
| *** dnalezyt has quit IRC | 15:49 | |
| *** dnalezyt has joined #openstack-keystone | 15:50 | |
| *** stevemar has joined #openstack-keystone | 15:50 | |
| *** ChanServ sets mode: +v stevemar | 15:50 | |
| *** dnalezyt has quit IRC | 15:50 | |
| *** Ctina has quit IRC | 15:50 | |
| *** dnalezyt has joined #openstack-keystone | 15:50 | |
| rodrigods | bknudson, didn't I add it back? | 15:54 |
| rodrigods | let me check | 15:54 |
| *** rm_work is now known as rm_work|away | 15:54 | |
| rodrigods | bknudson, it's back :) | 15:54 |
| bknudson | ok, thanks | 15:54 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Add pep8 import exception for oslo_policy._i18n https://review.openstack.org/153271 | 16:05 |
| *** avozza is now known as zz_avozza | 16:07 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Hierarchical multitenancy basic calls https://review.openstack.org/115770 | 16:08 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Implements subtree_as_ids and parents_as_ids https://review.openstack.org/150078 | 16:08 |
| rodrigods | bknudson, removed the unnecessary parameter from utils.positional decorator ^ | 16:08 |
| bknudson | ok... I'm fine with it either way. I took a quick look through it and didn't notice anything... I should have time later today to go through it. | 16:09 |
| rodrigods | bknudson, thanks! | 16:09 |
| *** raildo has left #openstack-keystone | 16:10 | |
| *** raildo has joined #openstack-keystone | 16:10 | |
| *** vishy has quit IRC | 16:11 | |
| *** vishy has joined #openstack-keystone | 16:12 | |
| *** nkinder has quit IRC | 16:17 | |
| *** zzzeek has joined #openstack-keystone | 16:18 | |
| *** thedodd has joined #openstack-keystone | 16:19 | |
| *** rushiagr is now known as rushiagr_away | 16:21 | |
| *** htruta has quit IRC | 16:22 | |
| *** rm_work|away is now known as rm_work | 16:22 | |
| *** nkinder has joined #openstack-keystone | 16:23 | |
| *** nellysmitt has quit IRC | 16:27 | |
| *** ajayaa has joined #openstack-keystone | 16:27 | |
| *** rwsu-afk is now known as rwsu | 16:28 | |
| openstackgerrit | David J Hu proposed openstack/keystone: Version independent token issuance pipeline https://review.openstack.org/150629 | 16:30 |
| *** dnalezyt2 has joined #openstack-keystone | 16:31 | |
| *** dnalezyt2 has quit IRC | 16:31 | |
| *** dnalezyt2 has joined #openstack-keystone | 16:32 | |
| *** dkingshott has joined #openstack-keystone | 16:35 | |
| *** sld has joined #openstack-keystone | 16:35 | |
| *** dnalezyt has quit IRC | 16:43 | |
| *** kromanenko has quit IRC | 16:44 | |
| *** htruta has joined #openstack-keystone | 16:48 | |
| *** rushiagr_away is now known as rushiagr | 16:49 | |
| *** ayoung has quit IRC | 16:49 | |
| *** obutenko_ has quit IRC | 16:54 | |
| *** ljfisher has joined #openstack-keystone | 16:57 | |
| *** samueldmq_ has quit IRC | 16:59 | |
| *** nkinder has quit IRC | 16:59 | |
| *** mattfarina has joined #openstack-keystone | 17:01 | |
| *** abhirc_ has quit IRC | 17:02 | |
| *** dnalezyt2 has quit IRC | 17:02 | |
| *** pnavarro has joined #openstack-keystone | 17:03 | |
| openstackgerrit | Bob Thyne proposed openstack/keystonemiddleware: Add Endpoint Enforcement to Keystonemiddleware https://review.openstack.org/153296 | 17:06 |
| *** tqtran has joined #openstack-keystone | 17:06 | |
| *** karimb has quit IRC | 17:09 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Add entry points for option discovery https://review.openstack.org/153090 | 17:10 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Add entry points for option discovery https://review.openstack.org/153090 | 17:10 |
| *** josecastroleon has quit IRC | 17:11 | |
| openstackgerrit | David Stanek proposed openstack/keystone-specs: environment setup for functional tests https://review.openstack.org/153300 | 17:14 |
| *** aix has quit IRC | 17:14 | |
| breton | dstanek: ping | 17:17 |
| breton | dstanek: on line 105 of https://review.openstack.org/#/c/147608/7/specs/kilo/functional-testing.rst it is said "To run all of the shared tests" and on line 111 "To run all of the shared config tests". What's the difference? | 17:20 |
| openstackgerrit | Tom Cameron proposed openstack/keystone: Add docstrings to remaining functions https://review.openstack.org/147313 | 17:23 |
| *** abhirc has joined #openstack-keystone | 17:26 | |
| *** ayoung has joined #openstack-keystone | 17:26 | |
| *** ChanServ sets mode: +v ayoung | 17:26 | |
| dstanek | breton: that's probably a bad example - no different in that case | 17:27 |
| *** lhcheng has joined #openstack-keystone | 17:27 | |
| dstanek | breton: actually the functional example below it makes my point - i may submit a revision making that more sane - thanks for the detailed look | 17:27 |
| *** timcline has quit IRC | 17:28 | |
| *** timcline has joined #openstack-keystone | 17:29 | |
| *** abhirc has quit IRC | 17:33 | |
| *** timcline has quit IRC | 17:33 | |
| breton | dstanek: that'd clarify things, yes, thank you | 17:35 |
| *** abhirc has joined #openstack-keystone | 17:36 | |
| *** abhirc has quit IRC | 17:36 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Fix for KVS cache backend incompatible with redis-py https://review.openstack.org/153307 | 17:38 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Redis token backend https://review.openstack.org/150844 | 17:39 |
| *** pnavarro has quit IRC | 17:43 | |
| *** tsufiev is now known as tsufiev_ | 17:44 | |
| openstackgerrit | Ian Cordasco proposed openstack/oslo.policy: [WIP] Make use of private modules https://review.openstack.org/153310 | 17:46 |
| morganfainberg | So looks like we have a k2 milestone :) | 17:47 |
| samueldmq | morganfainberg, hey | 17:48 |
| morganfainberg | Mornin. | 17:49 |
| samueldmq | morning | 17:49 |
| samueldmq | morganfainberg, since we've defined to push domain-roles a little bit and put more efforts in dynamic policies for now ... | 17:49 |
| samueldmq | shouldnt we workflow -1 this ? https://review.openstack.org/#/c/133855/ | 17:49 |
| samueldmq | we didn't make clear to reviewers our decision, and it's even getting +2 | 17:50 |
| morganfainberg | samueldmq: I will be doing -2s on specs today. | 17:53 |
| morganfainberg | Well. Tonight. | 17:54 |
| morganfainberg | To cover ones that are not approved for this cycle. | 17:54 |
| samueldmq | morganfainberg, great! thanks | 17:54 |
| breton | morganfainberg: will there be +2s among -2s? | 17:54 |
| amakarov | morganfainberg, greetings! May it be a "smart" solution as you asked https://review.openstack.org/#/c/153307/ ? :) | 17:54 |
| morganfainberg | breton: the -2s will be only for specs that will not be approved +2s for specs that will be. | 17:55 |
| *** pnavarro has joined #openstack-keystone | 17:55 | |
| raildo | lhcheng, Hi Lin, I answered your comment in the reseller spec :) | 17:55 |
| morganfainberg | amakarov: just looked it over, at a glance exactly what I was looking for. There is a weird edge case we introduce but honestly we shouldn't be relying on the mutex then (and in practice we won't ever hit it because it requires a custom mutex to be defined) | 17:56 |
| morganfainberg | amakarov: I need to do a more in-depth review but yes, spot on. :) | 17:56 |
| openstackgerrit | Jeremy Stanley proposed openstack/python-keystoneclient: Workflow documentation is now in infra-manual https://review.openstack.org/139375 | 17:56 |
| morganfainberg | raildo: so one other comment. Domains should (separate work) eventually support inheriting from a parent domain. | 17:57 |
| *** ayoung has quit IRC | 17:57 | |
| raildo | morganfainberg, sure, we have this in mind :) | 17:57 |
| morganfainberg | raildo: second. Project roles and domain roles should be the same. | 17:58 |
| morganfainberg | Not depending on which api you call. | 17:58 |
| morganfainberg | I commented on the spec. But am ready to approve it if that all is in line. | 17:58 |
| rodrigods | morganfainberg, raildo yes :) | 17:58 |
| amakarov | morganfainberg, well, thank you on that! As for me it's WIP now - it must yet pass scale testing, so I'll inform you when I done | 17:59 |
| *** Ctina_ has quit IRC | 17:59 | |
| raildo | morganfainberg, absolutely. We will do this. | 17:59 |
| morganfainberg | The fix for lua that is amakarov the redis part is I understand more WIP | 18:00 |
| lhcheng | raildo: thanks for responding to my comments! :) | 18:00 |
| *** amakarov is now known as amakarov_away | 18:02 | |
| raildo | lhcheng, np :) | 18:02 |
| *** spandhe has joined #openstack-keystone | 18:04 | |
| openstackgerrit | Ian Cordasco proposed openstack/oslo.policy: [WIP] Make use of private modules https://review.openstack.org/153310 | 18:06 |
| *** krykowski has quit IRC | 18:07 | |
| *** jistr has quit IRC | 18:09 | |
| *** lufix has quit IRC | 18:09 | |
| *** jistr has joined #openstack-keystone | 18:10 | |
| openstackgerrit | Merged openstack/keystone-specs: Reseller https://review.openstack.org/139824 | 18:13 |
| openstackgerrit | Ian Cordasco proposed openstack/oslo.policy: [WIP] Make use of private modules https://review.openstack.org/153310 | 18:14 |
| *** ndonegan has left #openstack-keystone | 18:17 | |
| openstackgerrit | Ian Cordasco proposed openstack/oslo.policy: Make use of private modules https://review.openstack.org/153310 | 18:17 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Do not use global enforcer for tests https://review.openstack.org/153321 | 18:18 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Stop shouting test attribute names https://review.openstack.org/153322 | 18:18 |
| openstackgerrit | Ian Cordasco proposed openstack/oslo.policy: Make use of private modules https://review.openstack.org/153310 | 18:18 |
| morganfainberg | dhellmann, ping - i see you're online quick question | 18:18 |
| morganfainberg | actually | 18:19 |
| morganfainberg | will ask in oslo channel [the right place] | 18:19 |
| *** mattfarina has quit IRC | 18:19 | |
| *** abhirc has joined #openstack-keystone | 18:19 | |
| *** jistr has quit IRC | 18:22 | |
| *** timcline has joined #openstack-keystone | 18:23 | |
| *** abhirc has quit IRC | 18:23 | |
| *** radez_g0n3 is now known as radez | 18:23 | |
| morganfainberg | rodrigods, stevemar, added to oslo.policy core | 18:26 |
| morganfainberg | you two were missing | 18:26 |
| *** timcline has quit IRC | 18:27 | |
| openstackgerrit | Ian Cordasco proposed openstack/oslo.policy: Do not use global enforcer for tests https://review.openstack.org/153321 | 18:27 |
| *** mattfarina has joined #openstack-keystone | 18:28 | |
| *** nellysmitt has joined #openstack-keystone | 18:28 | |
| * samueldmq is wondering if list/get grants api endpoints are not conceptually wrong, since they return roles instead of grants | 18:29 | |
| *** ljfisher has quit IRC | 18:30 | |
| *** harlowja has joined #openstack-keystone | 18:30 | |
| openstackgerrit | Ian Cordasco proposed openstack/oslo.policy: Stop shouting test attribute names https://review.openstack.org/153322 | 18:31 |
| *** abhirc has joined #openstack-keystone | 18:32 | |
| *** abhirc has quit IRC | 18:32 | |
| *** nellysmitt has quit IRC | 18:33 | |
| *** rushiagr is now known as rushiagr_away | 18:36 | |
| *** ajayaa has quit IRC | 18:39 | |
| *** afazekas has quit IRC | 18:40 | |
| marekd | morganfainberg: Hi. Need your advice on https://review.openstack.org/#/c/152659/ (see the last comment) | 18:46 |
| *** jaosorior has quit IRC | 18:46 | |
| morganfainberg | marekd, we should just migrate them always | 18:46 |
| morganfainberg | federation should be moved to default on (based on "no more extensions" spec) as it's 'stable' | 18:47 |
| *** dkingshott has quit IRC | 18:47 | |
| morganfainberg | marekd, you can do the work for the no-more-extensions to make federation stable | 18:47 |
| morganfainberg | it's mostly we have do to each item as we have a chance | 18:47 |
| marekd | morganfainberg: what exactly does it mean? | 18:47 |
| morganfainberg | no reason it can't be done as part of this. | 18:47 |
| morganfainberg | marekd, 1) make federation tables always migrate | 18:47 |
| morganfainberg | 2) put it in the default pipeline [API] | 18:48 |
| marekd | that's it? | 18:48 |
| morganfainberg | convert the "dependency.optional" to "dependency.required", ensure docs are indicating it's always there | 18:48 |
| morganfainberg | and how to disable it [re: policy.json?, etc] | 18:48 |
| morganfainberg | yeah it's mostly doc work and minor massaging of stuff inside keystone | 18:48 |
| marekd | morganfainberg: roger that. | 18:49 |
| marekd | once I do it and it's reviewed I will carry on with the K2K stuff. | 18:49 |
| morganfainberg | ack | 18:49 |
| marekd | morganfainberg: thanks, that was quick :-) | 18:49 |
| *** thedodd has quit IRC | 18:50 | |
| *** dan_ has joined #openstack-keystone | 18:51 | |
| *** zz_avozza is now known as avozza | 18:52 | |
| *** mattfarina has quit IRC | 18:57 | |
| *** thedodd has joined #openstack-keystone | 18:58 | |
| notmyname | authtoken has a config option called delay_auth_decision. it defaults to False, and that breaks a ton of functionality in Swift. therefore it means that every deployer using Swift + keystone has to explicitly change that config. is there any way to either change the default or remove the default so it must be explicitly configured? | 18:59 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Authenticated Encryption Tokens https://review.openstack.org/130050 | 19:00 |
| *** mattfarina has joined #openstack-keystone | 19:01 | |
| morganfainberg | notmyname: there are some issues around changing that behavior but, in short, iirc we want to change that default. But other services need to be smarter before we can. | 19:02 |
| morganfainberg | Making it need to be explicitly configured would be more broken though / worse experience. | 19:03 |
| *** avozza is now known as zz_avozza | 19:03 | |
| notmyname | it seems that there isn't a common correct default? so either default you pick is wrong. so making it explicitly configured means that you can't choose one that works. that makes sense to me | 19:04 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Switch the token provider to use strict_abc https://review.openstack.org/149411 | 19:04 |
| bknudson | rather than have a config we could provide 2 auth_tokens, one that does delay_auth_decision and on that doesn't | 19:07 |
| bknudson | then swift uses the one it wants and other projects use the one they want, no extra config option reqd. | 19:07 |
| bknudson | or we could somehow allow the application to pass the default to auth_token middleware | 19:08 |
| notmyname | bknudson: that seems pretty heavyweight | 19:08 |
| morganfainberg | bknudson: actually yes. And we can work to convert people over to the new one once we fix everything to be smarter (not need to reject due to lack of token)? | 19:08 |
| notmyname | what do other projects require? | 19:08 |
| bknudson | it's not heavyweight, it's just a different name that can be referenced in paste.ini | 19:08 |
| morganfainberg | notmyname: it would be the same code just a very light if/check wrapper. Delay auth decision is just not rejecting based on lack of token. | 19:08 |
| *** thedodd has quit IRC | 19:09 | |
| notmyname | but that means deployers will have to choose the right config name right? instead of the right config variable value. IOW you'll have deployers running multiple services with keystone and having to use different middleware for each | 19:09 |
| morganfainberg | notmyname: I really dislike that middleware rejects because of a lack of token. The issue is that doesn't let us expose any apis cleanly that don't need auth. | 19:11 |
| notmyname | are there other services that require that functionality to be there? | 19:11 |
| morganfainberg | notmyname: require, no. Would like in some cases: yes | 19:11 |
| notmyname | as in, require it but also don't respect the config value? | 19:11 |
| notmyname | I'm curious about the barriers to changing the default | 19:12 |
| morganfainberg | All services but swift assume the pep is only enforcing RBAC not does token exist | 19:12 |
| notmyname | I didn't parse that | 19:13 |
| morganfainberg | It's a slog to make the enforcement points not assume we validated token existence. Or at least a way to say urls xyz are open to be hit w/o a token (enforcement is done on data from token not assuming a token was provided because a request hit the service) | 19:13 |
| bknudson | any service that's not checking the X-Identity-Status is going to have a problem. | 19:14 |
| morganfainberg | bknudson: that is the issue isn't it. Services don't check that. We "enforce it for them" | 19:14 |
| *** blinky_ghost has quit IRC | 19:14 | |
| notmyname | I'm not familiar with x-identity-status | 19:15 |
| morganfainberg | "Is the token valid / existing" | 19:15 |
| bknudson | auth_token middleware sets X-Identity-Status to "Confirmed" if the token was valid. | 19:15 |
| bknudson | or set it to "Invalid" | 19:15 |
| notmyname | ah | 19:16 |
| bknudson | if delay_auth_decision is False then the application will never see "Invalid" | 19:16 |
| bknudson | but if delay_auth_decision is True and you're not checking X-Identity-Status now you're letting everything through. | 19:18 |
| morganfainberg | The policy enforcement point should check that, not middleware. But that has not been the case in general. | 19:18 |
| morganfainberg | Hence why the default is "false" | 19:18 |
| bknudson | oh, yeah, we could have a policy rule for it... would need that in the context. | 19:18 |
| *** ayoung has joined #openstack-keystone | 19:18 | |
| bknudson | there might be work going on in this area already | 19:18 |
| morganfainberg | Swift being the notable exception. | 19:18 |
| *** ChanServ sets mode: +v ayoung | 19:18 | |
| notmyname | interesting. I don't think we're checking x-identity-status, but we do have a callback to the auth system to authroize requests (way after the middleware has control of the reuqest) | 19:20 |
| samueldmq | ayoung, ping - do you know how horizon gets user' projects? | 19:23 |
| *** timcline has joined #openstack-keystone | 19:24 | |
| ayoung | samueldmq, look at the code in django openstack auth / backend.py | 19:24 |
| *** pnavarro has quit IRC | 19:24 | |
| *** abhirc has joined #openstack-keystone | 19:25 | |
| *** nellysmitt has joined #openstack-keystone | 19:26 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Privatize parsing classes https://review.openstack.org/153149 | 19:27 |
| *** timcline has quit IRC | 19:28 | |
| *** timcline has joined #openstack-keystone | 19:34 | |
| samueldmq | ayoung, k thanks will take a look | 19:36 |
| samueldmq | ayoung, I'm looking for the specific endpoint they call on keysotne | 19:36 |
| david-lyle | samueldmq: https://github.com/openstack/django_openstack_auth/blob/master/openstack_auth/utils.py#L242 | 19:42 |
| samueldmq | david-lyle, great! thanks | 19:43 |
| david-lyle | np | 19:43 |
| *** dims__ has joined #openstack-keystone | 19:44 | |
| *** r-daneel has joined #openstack-keystone | 19:44 | |
| *** dims_ has quit IRC | 19:47 | |
| samueldmq | ayoung, it will be using list_user_projects (https://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L412-L416) :-) | 19:48 |
| *** dims__ has quit IRC | 19:48 | |
| ayoung | samueldmq, yes, I think | 19:48 |
| *** abhirc has quit IRC | 19:48 | |
| ayoung | samueldmq, you should know by now better than to trust me | 19:49 |
| *** dims__ has joined #openstack-keystone | 19:50 | |
| samueldmq | ayoung, in fact I checked ... I'm just saying that to let you know/confirm if you already knew :-) | 19:50 |
| *** dims__ has quit IRC | 19:50 | |
| *** dims_ has joined #openstack-keystone | 19:54 | |
| *** dims___ has joined #openstack-keystone | 19:54 | |
| *** dims_ has quit IRC | 19:58 | |
| openstackgerrit | Merged openstack/oslo.policy: Drop usage of namespaced packages https://review.openstack.org/151836 | 20:00 |
| *** abhirc has joined #openstack-keystone | 20:00 | |
| *** dims__ has joined #openstack-keystone | 20:01 | |
| *** spandhe has quit IRC | 20:01 | |
| openstackgerrit | Merged openstack/oslo.policy: Update .gitignore https://review.openstack.org/148671 | 20:02 |
| *** dims___ has quit IRC | 20:03 | |
| *** spandhe has joined #openstack-keystone | 20:04 | |
| *** thedodd has joined #openstack-keystone | 20:08 | |
| *** spandhe has quit IRC | 20:08 | |
| *** dims_ has joined #openstack-keystone | 20:09 | |
| *** dims__ has quit IRC | 20:12 | |
| *** henrynash has joined #openstack-keystone | 20:14 | |
| *** ChanServ sets mode: +v henrynash | 20:14 | |
| *** dims__ has joined #openstack-keystone | 20:15 | |
| *** dims_ has quit IRC | 20:17 | |
| openstackgerrit | ayoung proposed openstack/keystone: Unscoped to Scoped only https://review.openstack.org/142591 | 20:19 |
| *** spandhe has joined #openstack-keystone | 20:21 | |
| stevemar | ayoung, sounds like this bug is up your alley rodrigods, ay | 20:26 |
| stevemar | copy paste fail | 20:27 |
| stevemar | bug is here https://bugs.launchpad.net/keystone/+bug/1418702 | 20:27 |
| TempLPBugBot | Launchpad bug 1418702 in Keystone "Project admin fails to list role assignments for his project with Project Scoped Token" (affected: 1, heat: 6) [Undecided,New] - Assigned to Priti Desai (priti-desai) | 20:27 |
| openstackgerrit | Merged openstack/oslo.policy: General docstring cleanup https://review.openstack.org/153100 | 20:28 |
| *** dims_ has joined #openstack-keystone | 20:30 | |
| amerine | Hey folks, is there a way to load a keystone extension that only contains callbacks in the Manager class? | 20:30 |
| amerine | I'm trying to avoid paste modifications and a fake router | 20:31 |
| amerine | But it's unclear how I might do that | 20:31 |
| *** dims__ has quit IRC | 20:31 | |
| *** zz_avozza is now known as avozza | 20:33 | |
| morganfainberg | amerine, explain what you're trying to solve - i might be able to help with a bit more infor | 20:34 |
| morganfainberg | info* | 20:34 |
| *** dims__ has joined #openstack-keystone | 20:35 | |
| *** dims_ has quit IRC | 20:37 | |
| openstackgerrit | David Stanek proposed openstack/keystone-specs: Removes confusing functional test tox example https://review.openstack.org/153366 | 20:37 |
| amerine | @morganfainberg: I have an extension that only binds to project.created events. | 20:37 |
| amerine | I'm going to do something with those events. | 20:38 |
| *** avozza is now known as zz_avozza | 20:38 | |
| amerine | The only way I've "classically"(lol) does Keystone extensions usually involves a router and endpoint additions/changes. | 20:38 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Perform an oslo-sync https://review.openstack.org/153367 | 20:38 |
| amerine | I was hoping there was an easy way to just load the extension and have the callabck registered. | 20:39 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Perform an oslo-sync https://review.openstack.org/153367 | 20:40 |
| amerine | @morganfainberg: Does that make sense? | 20:41 |
| morganfainberg | amerine, it does make sense tying to think about how to do that easily | 20:42 |
| morganfainberg | also balancing between being in a meeting :P | 20:42 |
| morganfainberg | so, i'll be really slow to come up with an answer [in ~1h or so should be free] | 20:42 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Use oslo_i18n https://review.openstack.org/152806 | 20:43 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Use oslo_i18n https://review.openstack.org/152806 | 20:44 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Add pep8 import exception for oslo_policy._i18n https://review.openstack.org/153271 | 20:44 |
| amerine | @morganfainberg: Heh, understood. Thanks! | 20:44 |
| *** pnavarro has joined #openstack-keystone | 20:46 | |
| *** dims_ has joined #openstack-keystone | 20:49 | |
| *** dims__ has quit IRC | 20:50 | |
| *** dims__ has joined #openstack-keystone | 20:52 | |
| *** dims_ has quit IRC | 20:54 | |
| *** abhirc has quit IRC | 20:54 | |
| *** diegows has quit IRC | 20:55 | |
| *** dims__ has quit IRC | 20:55 | |
| *** dims__ has joined #openstack-keystone | 20:56 | |
| *** dims__ has quit IRC | 20:56 | |
| *** henrynash has quit IRC | 20:57 | |
| *** spandhe has quit IRC | 21:03 | |
| *** dims_ has joined #openstack-keystone | 21:05 | |
| *** _cjones_ has joined #openstack-keystone | 21:05 | |
| *** spandhe has joined #openstack-keystone | 21:05 | |
| *** zz_avozza is now known as avozza | 21:06 | |
| *** _cjones_ has quit IRC | 21:11 | |
| *** _cjones_ has joined #openstack-keystone | 21:12 | |
| *** _cjones_ has quit IRC | 21:13 | |
| *** _cjones_ has joined #openstack-keystone | 21:13 | |
| openstackgerrit | Merged openstack/keystone: Refactor federation SQL backend https://review.openstack.org/153159 | 21:14 |
| *** _cjones_ has quit IRC | 21:18 | |
| *** topol has quit IRC | 21:20 | |
| *** _cjones_ has joined #openstack-keystone | 21:23 | |
| *** kfox1111 has joined #openstack-keystone | 21:28 | |
| kfox1111 | Whats the status of the v3 api? If I switch all openstack services to use the v3 api, do things work? | 21:28 |
| morganfainberg | re: token backends with redis https://review.openstack.org/#/c/153307/ | 21:32 |
| sld | thx | 21:32 |
| dan_ | Thanks! | 21:32 |
| *** amerine has quit IRC | 21:32 | |
| kfox1111 | anyone using them in production? | 21:32 |
| *** amerine has joined #openstack-keystone | 21:33 | |
| openstackgerrit | Merged openstack/oslo.policy: Drop use of oslo namespace for oslo libraries https://review.openstack.org/152808 | 21:35 |
| marekd | kfox1111: to some extent CERN users v3: http://openstack-in-production.blogspot.ch/2014/10/kerberos-and-single-sign-on-with.html | 21:36 |
| *** henrynash has joined #openstack-keystone | 21:36 | |
| *** ChanServ sets mode: +v henrynash | 21:36 | |
| *** krtaylor has quit IRC | 21:40 | |
| kfox1111 | marekd: Cool. thanks. :) | 21:41 |
| *** henrynash has quit IRC | 21:44 | |
| *** lhcheng has quit IRC | 21:44 | |
| *** lhcheng has joined #openstack-keystone | 21:45 | |
| *** atiwari has quit IRC | 21:48 | |
| *** atiwari has joined #openstack-keystone | 21:50 | |
| *** dhellmann_ has joined #openstack-keystone | 21:51 | |
| kfox1111 | is there a document that tells how to switch nova to keystone v3? | 21:52 |
| morganfainberg | kfox1111, for the most part nova doesn't need to know ahything specific about v2 or v3 | 21:52 |
| morganfainberg | i think the only case where it currently is a bit problematic is nova -> neutron | 21:52 |
| morganfainberg | which has [iirc] an outstanding patch to fix the issue | 21:53 |
| *** krtaylor has joined #openstack-keystone | 21:53 | |
| kfox1111 | right now, if I pull up the dashboard as a domain user thats not in the default domain, I get stuff like: Error: Unauthorized: Unable to retrieve usage information. | 21:53 |
| kfox1111 | it only affects nova though. glance and the other services seem to be ok. | 21:53 |
| kfox1111 | hmm... k. | 21:53 |
| morganfainberg | it should work | 21:53 |
| kfox1111 | I added a user in domain test to a project in the default domain, then logged in as the user. I can see the project, I can see images and the network and stuff, but any nova related pages fail with permission issues. | 21:54 |
| *** atiwari has quit IRC | 21:54 | |
| *** atiwari1 has joined #openstack-keystone | 21:54 | |
| *** nellysmitt has quit IRC | 21:54 | |
| *** dhellmann_ has quit IRC | 21:55 | |
| *** dhellmann_ has joined #openstack-keystone | 21:57 | |
| *** henrynash has joined #openstack-keystone | 21:57 | |
| *** ChanServ sets mode: +v henrynash | 21:57 | |
| *** thedodd has quit IRC | 21:57 | |
| *** dhellmann_ has quit IRC | 21:58 | |
| *** andreaf has quit IRC | 21:59 | |
| *** andreaf has joined #openstack-keystone | 22:00 | |
| *** thedodd has joined #openstack-keystone | 22:00 | |
| *** abhirc has joined #openstack-keystone | 22:00 | |
| *** mattfarina has quit IRC | 22:02 | |
| *** dhellmann_ has joined #openstack-keystone | 22:03 | |
| *** topol has joined #openstack-keystone | 22:04 | |
| *** ChanServ sets mode: +v topol | 22:04 | |
| *** avozza is now known as zz_avozza | 22:05 | |
| morganfainberg | kfox1111, thats weird. | 22:06 |
| morganfainberg | kfox1111, let me stand up my local devstack (ok a new one) and i'll poke at it. | 22:06 |
| morganfainberg | it *should* work | 22:06 |
| *** spandhe has quit IRC | 22:06 | |
| *** spandhe has joined #openstack-keystone | 22:07 | |
| morganfainberg | you know... | 22:07 |
| kfox1111 | k. thx. | 22:07 |
| morganfainberg | having a chair that isn't falling apart is a good thing | 22:07 |
| kfox1111 | I'm using rdo juno btw. | 22:07 |
| * morganfainberg just tightened down the bolts | 22:07 | |
| kfox1111 | hehe. yeah. | 22:07 |
| *** dhellmann_ has quit IRC | 22:08 | |
| morganfainberg | suddenly the chair doesn't feel like it's going to come apart under me | 22:08 |
| morganfainberg | :P | 22:08 |
| morganfainberg | kfox1111, hm. i should probably try RDO instead then | 22:08 |
| kfox1111 | hmm... do I need to update the identity endpoints to v3 before nova will work? | 22:08 |
| amerine | Standing desk FTW. | 22:08 |
| morganfainberg | to mirror the env. | 22:08 |
| *** henrynash has quit IRC | 22:08 | |
| morganfainberg | amerine, i have a counter-height desk and a bar-stool when i don't want to stand anymore | 22:08 |
| morganfainberg | amerine, the bar-stool was about to fall apart | 22:09 |
| * morganfainberg works from home. | 22:09 | |
| amerine | ah! | 22:09 |
| amerine | I work from home toO! | 22:09 |
| amerine | I have a NextDesk Terra. I <3 it | 22:09 |
| morganfainberg | i want to try one of the treadmill desks | 22:09 |
| *** joesavak has quit IRC | 22:09 | |
| *** henrynash has joined #openstack-keystone | 22:09 | |
| *** ChanServ sets mode: +v henrynash | 22:09 | |
| kfox1111 | I'm still waiting for the hot tub desk. ;) | 22:09 |
| amerine | I don't know that I can type an walk at the same time. | 22:09 |
| amerine | s/an/and | 22:09 |
| openstackgerrit | Merged openstack/oslo.policy: Perform an oslo-sync https://review.openstack.org/153367 | 22:11 |
| openstackgerrit | gordon chung proposed openstack/keystonemiddleware: move add event creation logic to keystonemiddleware https://review.openstack.org/149405 | 22:13 |
| openstackgerrit | gordon chung proposed openstack/keystonemiddleware: make audit event scoped to request session and not middleware https://review.openstack.org/149300 | 22:13 |
| morganfainberg | wow | 22:14 |
| morganfainberg | also noticed my chait was missing 3 screws | 22:14 |
| * morganfainberg might have just canabalized the "broken" chair to fix this one | 22:15 | |
| morganfainberg | kfox1111, CentOS/RHEL 7 or Fedora? | 22:15 |
| kfox1111 | centos 7. | 22:15 |
| openstackgerrit | Merged openstack/oslo.policy: Use oslo_i18n https://review.openstack.org/152806 | 22:18 |
| *** dhellmann_ has joined #openstack-keystone | 22:20 | |
| kfox1111 | morganfainberg: is this the patch you were refering to? : https://review.openstack.org/#/c/113735/ | 22:21 |
| openstackgerrit | Steve Martinelli proposed openstack/pycadf: Do not depend on endpoint id existing in the service catalog https://review.openstack.org/109060 | 22:24 |
| *** abhirc has quit IRC | 22:25 | |
| openstackgerrit | Merged openstack/oslo.policy: Add pep8 import exception for oslo_policy._i18n https://review.openstack.org/153271 | 22:26 |
| *** andreaf has quit IRC | 22:26 | |
| *** abhirc has joined #openstack-keystone | 22:27 | |
| *** henrynash has quit IRC | 22:30 | |
| *** andreaf has joined #openstack-keystone | 22:31 | |
| ayoung | morganfainberg, +2A this one. It's just a rebase of one you were willng to +2A in the past https://review.openstack.org/#/c/142591/ | 22:32 |
| ayoung | RDO Juno should work kfox1111 | 22:34 |
| morganfainberg | ayoung, i think this is a doc bug | 22:34 |
| ayoung | morganfainberg, I build myself a standing desk. It rocks | 22:34 |
| morganfainberg | ayoung, missing a doc on how to do v3 | 22:34 |
| ayoung | I can even get a staionary bike undfer it | 22:34 |
| ayoung | ah...v3 | 22:34 |
| *** nkinder has joined #openstack-keystone | 22:35 | |
| morganfainberg | nkinder, in cz huh? | 22:35 |
| morganfainberg | nkinder hows the travel treating you? | 22:35 |
| dstanek | ayoung: pics? | 22:35 |
| *** henrynash has joined #openstack-keystone | 22:35 | |
| *** ChanServ sets mode: +v henrynash | 22:35 | |
| ayoung | dstanek, I thought I had posted one...elmme see | 22:35 |
| ayoung | dstanek, I'd fgacebooke posted it..I'll get it up on twitter | 22:36 |
| *** henrynash has quit IRC | 22:40 | |
| ayoung | dstanek, https://twitter.com/admiyoung/status/563466541896048640 | 22:40 |
| dstanek | ayoung: nice; i've been thinking about doing that for a while; or at least making mods to my existing desk | 22:41 |
| bknudson | looks fast! | 22:41 |
| ayoung | Heh | 22:41 |
| bknudson | you're really leaning forward when on the saddle | 22:42 |
| ayoung | the trick was realizing the ingle pole was much simpler, then making sure I got a piece of black steel think enough to minimize the flex | 22:42 |
| ayoung | bknudson, actually, when I'm in bioke mode, I'm almost upright. THe tray comes right over the lap | 22:42 |
| bknudson | that makes more sense. | 22:42 |
| ayoung | bknudson, the best part is how adjustable it is. I can pretty much tweak it to get it comfortable standing, sitting, riding. I could probably make it work for laying on the floor | 22:43 |
| ayoung | the montor and keyboard trays pivot 360 | 22:43 |
| bknudson | that's a dream setup... just lying on the floor. I could do that. | 22:44 |
| ayoung | I think I'm going to set the bike up across from the bench and just pivot them 180 between the two | 22:44 |
| ayoung | bknudson, He...not so sure about that myself | 22:44 |
| *** wanghong has quit IRC | 22:44 | |
| ayoung | I'm the basement, and the floor is cold. Nice during the summer, not so much right now | 22:45 |
| *** radez is now known as radez_g0n3 | 22:46 | |
| ayoung | the trickiest part is that the verticle is held by friction, and adjusting the tray in-and-out releases that friction, so you have to hold the tray up while adjusting it horizontally | 22:46 |
| *** wanghong has joined #openstack-keystone | 22:46 | |
| nkinder | morganfainberg: yep | 22:47 |
| nkinder | morganfainberg: so far so good | 22:47 |
| *** timcline has quit IRC | 22:49 | |
| *** thedodd has quit IRC | 22:53 | |
| *** thedodd has joined #openstack-keystone | 22:53 | |
| morganfainberg | ahahah | 22:55 |
| morganfainberg | centos 7 doesn't install "ifconfig" thats been a long time coming [considering ifconfig does bad things/wrong things these days] | 22:55 |
| *** ncoghlan has joined #openstack-keystone | 22:57 | |
| *** dims_ has quit IRC | 22:58 | |
| *** dims__ has joined #openstack-keystone | 22:59 | |
| *** dims__ has quit IRC | 22:59 | |
| *** andreaf has quit IRC | 23:00 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Add entry points for option discovery https://review.openstack.org/153090 | 23:01 |
| *** dims__ has joined #openstack-keystone | 23:03 | |
| *** abhirc has quit IRC | 23:07 | |
| *** andreaf has joined #openstack-keystone | 23:09 | |
| *** dims__ has quit IRC | 23:13 | |
| *** dims__ has joined #openstack-keystone | 23:14 | |
| amerine | morganfainberg: Any more thoughts about loading an extension that only wants to register a project.created callback? | 23:14 |
| morganfainberg | amerine, so, you could add it to the paste pipeline with no routes registered i would guess | 23:14 |
| morganfainberg | amerine, so take the example one, create the router (which instantiates the manager/controller/what is listening for the event) but doesn't register any routes itself | 23:15 |
| *** abhirc has joined #openstack-keystone | 23:15 | |
| morganfainberg | amerine, i *think* that will work | 23:15 |
| morganfainberg | there is probably a better way for us to support this | 23:16 |
| morganfainberg | long term | 23:16 |
| morganfainberg | but that is how i'd do it | 23:16 |
| *** Haneef has quit IRC | 23:17 | |
| amerine | That's basically what I have :-(, But I can't seem to get the callbacks properly registered. | 23:18 |
| amerine | I'll keep digging, Thanks for the help morganfainberg. | 23:18 |
| *** raildo_ has joined #openstack-keystone | 23:21 | |
| *** henrynash has joined #openstack-keystone | 23:22 | |
| *** ChanServ sets mode: +v henrynash | 23:22 | |
| *** topol has quit IRC | 23:22 | |
| kfox1111 | morganfainberg: Yeah, I was really surprised when ifconfig wasn't there. | 23:23 |
| kfox1111 | another big learning curve. :) | 23:23 |
| *** chlong has joined #openstack-keystone | 23:23 | |
| *** abhirc has quit IRC | 23:24 | |
| morganfainberg | kfox1111, ok almost all setup | 23:25 |
| morganfainberg | just doing the last bit of install before trying to configure this v3 stuff | 23:25 |
| kfox1111 | cool. thanks for trying it. I really appreciate the help. | 23:26 |
| amerine | morganfainberg: OH MA GERD, figured it out. | 23:26 |
| morganfainberg | amerine, did my advice help you at all? ;) | 23:26 |
| amerine | The mangager has to have the dependency decorator! | 23:26 |
| morganfainberg | ahhh | 23:26 |
| amerine | manager* | 23:26 |
| morganfainberg | doh! sorry! | 23:26 |
| morganfainberg | kfox1111, like i said i *think* this is a doc bug | 23:26 |
| amerine | It's working. Ghetto but working | 23:26 |
| morganfainberg | and if it's something else. | 23:27 |
| morganfainberg | kfox1111, we have ayoung, jamielennox, and nkinder in here to go "OMG LOOK!" | 23:27 |
| morganfainberg | but i'm almost positive this *should work* | 23:27 |
| morganfainberg | packstack is interesting | 23:27 |
| *** henrynash has quit IRC | 23:27 | |
| amerine | morganfainberg: And yes, your advice helped a ton. Thank you again. | 23:27 |
| morganfainberg | amerine, happy to help | 23:28 |
| *** nkinder has quit IRC | 23:28 | |
| *** ljfisher has joined #openstack-keystone | 23:32 | |
| *** EmilienM is now known as EmilienM|afk | 23:33 | |
| *** mgarza has joined #openstack-keystone | 23:35 | |
| kfox1111 | just tried checking to see if the user/project needs to be in the same domain. didn't help. still lacks authorization.... | 23:36 |
| kfox1111 | there isn't an endpoint update command? ugg. | 23:37 |
| morganfainberg | bug 1111 | 23:37 |
| TempLPBugBot | bug 1111 in gst-plugins0.8 (Ubuntu) "doesn't extract last track" (affected: 0, heat: 6) [Medium,Fix released] https://launchpad.net/bugs/1111 - Assigned to Ubuntu GNOME (ubuntu-gnome) | 23:37 |
| rodrigods | lol | 23:37 |
| *** esmute has quit IRC | 23:39 | |
| *** spandhe has quit IRC | 23:40 | |
| kfox1111 | hmm.. do you need to restart all the services to get v3 working? I'd rather not restart neutron at this point, since it will take things down for a bit. :/ | 23:40 |
| amerine | Man, whoever introduced and pushed through that internal callbacks system blueprint many moons ago has made my life so much damn easier. | 23:40 |
| amerine | No more rabbit, no more API polling, damn I could cry | 23:40 |
| openstackgerrit | gordon chung proposed openstack/keystonemiddleware: move add event creation logic to keystonemiddleware https://review.openstack.org/149405 | 23:41 |
| *** esmute has joined #openstack-keystone | 23:41 | |
| morganfainberg | amerine, a few of us did | 23:41 |
| *** david-lyle is now known as david-lyle_afk | 23:41 | |
| morganfainberg | kfox1111, well uh. depends on if you've configured keystonemiddleware to do v3-stuff | 23:42 |
| * morganfainberg glares at "provision_glance" being slow | 23:42 | |
| *** spandhe has joined #openstack-keystone | 23:42 | |
| amerine | ^ truth | 23:42 |
| morganfainberg | amerine, though tbh we are likely going to spin up a quick project to let you hook into keystone notifications for $external_projects$, basically something that listens to the bus (we = openstack, maybe not this team, but i can hope) and you can register a callback with | 23:45 |
| *** gordc has quit IRC | 23:45 | |
| morganfainberg | amerine, this will be useful for things like "when projext X is deleted, nova can know to cleanup instances for project X" | 23:45 |
| amerine | Don't you already emit that over the rpc stuff? | 23:45 |
| morganfainberg | we do | 23:45 |
| morganfainberg | but it's hard for every project to consume | 23:46 |
| morganfainberg | they all need listeners etc | 23:46 |
| morganfainberg | we're thinking of "provide a listener and let the projects register for events they care about" | 23:46 |
| morganfainberg | and then it's on that project to act on these events | 23:46 |
| amerine | Just my 0.02, but supporting something like a webhook system for that would be nice. | 23:46 |
| amerine | Over HTTP | 23:46 |
| morganfainberg | keystone can't be responsible to call out | 23:46 |
| morganfainberg | it wont scale | 23:47 |
| amerine | Understandable. | 23:47 |
| morganfainberg | what if i have 200-300 endpoints | 23:47 |
| morganfainberg | keystone can emit a notification to the bus and the endpoints / services that care can respond | 23:47 |
| morganfainberg | s/respond/act | 23:47 |
| amerine | We've build something like that at $WORK that multiplexes Keystone state chagnes. | 23:47 |
| amerine | keystone rabbit bus -> rabbit -> multiplexer -> many endpoints. | 23:47 |
| *** rm_work is now known as rm_work|away | 23:47 | |
| morganfainberg | but if keystone needed to send notifies via webhook to all endpoints - it doesn't scale. | 23:47 |
| amerine | Agreed. | 23:47 |
| morganfainberg | i'm thinking fanout queues | 23:48 |
| morganfainberg | but same concept | 23:48 |
| amerine | The issue I'm solving now is ensuring certain auditing users keep a configured role on a project. | 23:48 |
| stevemar | lhcheng, ping | 23:49 |
| morganfainberg | this sounds like something that can be solved with the cloud-policy.json | 23:49 |
| morganfainberg | amerine, ^ | 23:49 |
| lhcheng | stevemar: pong | 23:49 |
| morganfainberg | so the user doesn't need a role on the project.. or inheritence of the role from the domain | 23:49 |
| stevemar | lhcheng, i have a request to ask of you :) | 23:50 |
| stevemar | lhcheng, can you give a preliminary review of https://review.openstack.org/#/c/136178/ and .... | 23:50 |
| * lhcheng ducks | 23:50 | |
| lhcheng | lol | 23:50 |
| morganfainberg | lhcheng, and i have a bus you can park on stevemar if he gets out of hand >.> [i also have a puddle of quicksand] | 23:50 |
| openstackgerrit | Merged openstack/keystone: Unscoped to Scoped only https://review.openstack.org/142591 | 23:50 |
| stevemar | https://review.openstack.org/#/c/151842/ | 23:50 |
| stevemar | hehe | 23:50 |
| morganfainberg | >.> | 23:50 |
| lhcheng | stevemar: sure! | 23:50 |
| stevemar | morganfainberg, i've earned some karma! i've been cleaning up oslo.policy | 23:50 |
| stevemar | lhcheng, since you are familiar with the keystone change, and horizon you are the obvious choice :P | 23:51 |
| amerine | morganfainberg: I wish it were that easy. | 23:51 |
| lhcheng | morganfainberg: hah | 23:51 |
| stevemar | lhcheng, ty! i owe you $drink in vancouver | 23:51 |
| morganfainberg | amerine, well the role inherit (os-inherit) *probbably* would work from the domain level | 23:51 |
| morganfainberg | since it automatically applies the roles to all projects under that domain for the user | 23:52 |
| kfox1111 | morganfainberg: is this document correct? anything missing? http://www.cloudkb.net/how-to-change-keystone-api-v2-v3/ | 23:52 |
| lhcheng | stevemar: no prob. I still haven't got the chance to setup my IdP, but I'll take a look :) | 23:53 |
| tqtran | lhcheng: but don't look too hard, you might find kinks we're trying to hide | 23:53 |
| stevemar | lhcheng, you know what... if i have time i will try and make a doc to use google and openidc | 23:53 |
| tqtran | stevemar: that would really really really help | 23:54 |
| lhcheng | tqtran: lol | 23:54 |
| morganfainberg | kfox1111, ok so | 23:55 |
| morganfainberg | kfox1111, i have a cent7 install on RDO | 23:55 |
| morganfainberg | v3 looks to be working right now | 23:55 |
| kfox1111 | k. what all did you have to do to it? | 23:55 |
| *** nellysmitt has joined #openstack-keystone | 23:55 | |
| morganfainberg | change horizon to use v3 identity ;) | 23:55 |
| morganfainberg | in local_settings | 23:55 |
| kfox1111 | yeah. did that. | 23:55 |
| morganfainberg | so i might be missing a step you did | 23:55 |
| kfox1111 | see the extra bits. | 23:55 |
| morganfainberg | and i restarted apache of course | 23:55 |
| kfox1111 | I see domains, projects, etc. | 23:56 |
| *** openstack has joined #openstack-keystone | 23:56 | |
| lhcheng | stevemar: so does any of "L" release name makes to you? my canadian colleague said all those doesn't really have a canadian thing in it. :P | 23:56 |
| morganfainberg | aha | 23:56 |
| kfox1111 | no, did not enable the policy yet.don't really care about domain admins vs cloud ones. | 23:56 |
| morganfainberg | ok | 23:57 |
| kfox1111 | just want to seperate ldap and sql for service accounts. | 23:57 |
| morganfainberg | sure | 23:57 |
| lhcheng | tqtran: so.. should I get a drink first before looking at the patch? | 23:57 |
| * morganfainberg doesn't have LDAP setup atm | 23:57 | |
| kfox1111 | is the policy update stil required in that case? | 23:57 |
| morganfainberg | nah | 23:57 |
| tqtran | lhcheng: i recommend several | 23:57 |
| stevemar | lhcheng, i think london is the place i'm most familiar with, it's a few hours drive away | 23:57 |
| morganfainberg | just amking sure it wasn't some kind of policy,json issue | 23:57 |
| stevemar | lhcheng, they gave reasons here https://wiki.openstack.org/wiki/Release_Naming | 23:58 |
| kfox1111 | I wouldn't think it would matter... let me see if I can make a non ldap domain quick, add a user, and see if anything's different. | 23:58 |
| stevemar | langley would have made more sense, langley BC | 23:58 |
| morganfainberg | so, did you grant the user in LDAP a role on the project you're working on? | 23:58 |
| * morganfainberg is very curious what is causing this issue. what does nova's log say when you're asking for that data? | 23:59 | |
| kfox1111 | morganfainberg: yes. | 23:59 |
| lhcheng | stevemar: ah.. the name is picked as long it is a city, doesn't need to have something uniquely identify/characterize the place. | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
