| *** abhirc has quit IRC | 00:02 | |
| morganfainberg | jamielennox, the filter in keystone or ksc? | 00:02 |
|---|---|---|
| morganfainberg | jamielennox, cause keystone filtering does do the right thing and could be used to filter things out | 00:03 |
| jamielennox | morganfainberg: whether the filter produces a new 'service' entry or just the endpoints beneath it | 00:03 |
| morganfainberg | sadly this case wouldn't matter, as you have 2 distinct things claiming to be called "compute" | 00:03 |
| morganfainberg | endpoint filter is *only* endpoints afair | 00:03 |
| morganfainberg | and doesn't care about the service | 00:03 |
| morganfainberg | fwiw this is multiple services saying they are compute | 00:04 |
| morganfainberg | which keystone would... it looks like also allow | 00:05 |
| morganfainberg | wow | 00:05 |
| jamielennox | morganfainberg: yea, i knew that one | 00:05 |
| morganfainberg | https://github.com/openstack/keystone/blob/master/keystone/catalog/backends/sql.py#L62 | 00:05 |
| jamielennox | i think we looked at fixing it at one point | 00:05 |
| morganfainberg | yep. | 00:05 |
| morganfainberg | great. | 00:05 |
| jamielennox | but it would break people | 00:05 |
| morganfainberg | rax is breaking people who have legacy stuff now | 00:05 |
| morganfainberg | so, the only thing we can do is make KSC say "300 multiple choices: pick something useful" | 00:06 |
| morganfainberg | i think | 00:06 |
| morganfainberg | because a deployer isn't going to rename things cause we suddenly got picky (hence the whole '/' in project name -2) | 00:07 |
| jamielennox | morganfainberg: we need to figure out ways to define what the service catalog contains | 00:08 |
| jamielennox | i'm looking though - i can't see why in service_catalog it only checks the first 'type' entry | 00:09 |
| jamielennox | because https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/service_catalog.py#L130 | 00:09 |
| morganfainberg | yep | 00:09 |
| morganfainberg | and in this case the legacy is 2nd so probably overrides the first | 00:10 |
| jamielennox | so it will only allow the last entry defined as type | 00:10 |
| morganfainberg | yep | 00:10 |
| *** gordc has quit IRC | 00:10 | |
| jamielennox | so that is fairly easy to fix - i just don't know if it'll solve the bigger issue | 00:10 |
| jamielennox | sc.setdefault(st, []) | 00:10 |
| jamielennox | or if i want to :o | 00:11 |
| morganfainberg | i think it's totally fine to say "multiple services found be more specific" but we need a way to let people pick what they want / software to be better about it | 00:11 |
| morganfainberg | or | 00:11 |
| morganfainberg | we squash duplicate services endpoints | 00:12 |
| jamielennox | i can see having get_endpoint returning a list would have been nice - but that's a pain now | 00:12 |
| *** spandhe has joined #openstack-keystone | 00:12 | |
| jamielennox | also - if i return a list i've no idea what they expect to do differently | 00:12 |
| morganfainberg | and say "you defined this as the same thing" | 00:12 |
| *** raildo_ has joined #openstack-keystone | 00:12 | |
| morganfainberg | i mean, would it break everything if ksc just said "oh hai, this is the same service *squish*" internally? | 00:13 |
| *** gyee has joined #openstack-keystone | 00:13 | |
| *** ChanServ sets mode: +v gyee | 00:13 | |
| morganfainberg | if you call thing A compute, and thing B compute, does it break it if all the endpoints are [compute] ? | 00:13 |
| morganfainberg | ignoring the RAX wierd case | 00:14 |
| jamielennox | morganfainberg: what would *squish* be here? | 00:14 |
| morganfainberg | where they are really different things | 00:14 |
| morganfainberg | just the endpoint data structure(s) | 00:14 |
| jamielennox | oh | 00:14 |
| morganfainberg | so the endpoint list would contain all the endpoints | 00:14 |
| jamielennox | right - no none at all i think | 00:14 |
| *** david-lyle is now known as david-lyle_afk | 00:14 | |
| jamielennox | morganfainberg: it's not even slower as there is no break in that for loop | 00:14 |
| morganfainberg | now rax breaking people because compute != compute, thats something i will happily go yell at them about | 00:14 |
| morganfainberg | because that is just crazypants. | 00:15 |
| morganfainberg | but we could at the very least not give just bizzare error responses because of that bad catalog data definition | 00:15 |
| jamielennox | morganfainberg: yep i'm fine with that for an EndpointNotFound - which is what you'd be getting now | 00:16 |
| *** pdesai has quit IRC | 00:16 | |
| jamielennox | morganfainberg: I'm not sure i like the idea of raising AmbiguousEndpoint (which it appears nova used to do) if more than one entry matches | 00:16 |
| morganfainberg | sure. | 00:16 |
| morganfainberg | i think compute != compute is a case we shouldn't care about [well we should, we shouldn't have multiple things claiming to be compute...but that is a different issue] | 00:17 |
| morganfainberg | jamielennox, so i think the right answer is we squash this in our internal data structure. | 00:19 |
| morganfainberg | jamielennox, and i *think* we've had the ask to make service unique anyway | 00:20 |
| morganfainberg | from vishy and a few others | 00:20 |
| jamielennox | morganfainberg: on keystone side? | 00:26 |
| jamielennox | how do i show bugs in launchpad that have previously been marked invalid? | 00:28 |
| jamielennox | grrr launchpad | 00:28 |
| *** henrynash has joined #openstack-keystone | 00:28 | |
| *** ChanServ sets mode: +v henrynash | 00:28 | |
| morganfainberg | jamielennox, yeah vishy and some others asked for keystone to be more strict about that stuff | 00:30 |
| morganfainberg | jamielennox, uh. sec | 00:30 |
| jamielennox | morganfainberg: would love to see that | 00:30 |
| *** henrynash has quit IRC | 00:30 | |
| jamielennox | morganfainberg: i think i got the launchpad thing, clicked around a bit then editted the URL | 00:30 |
| morganfainberg | jamielennox, https://bugs.launchpad.net/python-keystoneclient/+bugs?field.searchtext=&orderby=-importance&search=Search&field.status%3Alist=INVALID&assignee_option=any&field.assignee=&field.bug_reporter=&field.bug_commenter=&field.subscriber=&field.structural_subscriber=&field.tag=&field.tags_combinator=ANY&field.has_cve.used=&field.omit_dupes.used=&field.omit_dupes=on&field.affects_me.used=&field.has_patch.used=&field.has_branches | 00:31 |
| morganfainberg | .used=&field.has_branches=on&field.has_no_branches.used=&field.has_no_branches=on&field.has_blueprints.used=&field.has_blueprints=on&field.has_no_blueprints.used=&field.has_no_blueprints=on | 00:31 |
| *** henrynash has joined #openstack-keystone | 00:31 | |
| *** ChanServ sets mode: +v henrynash | 00:31 | |
| morganfainberg | god sorry | 00:31 |
| morganfainberg | jamielennox, http://bit.ly/1JNXIgS | 00:31 |
| jamielennox | heh | 00:32 |
| jamielennox | still can't find this bug but | 00:32 |
| morganfainberg | it's ok if we open a new one | 00:34 |
| lhcheng | https://review.openstack.org/#/c/159303/ | 00:34 |
| morganfainberg | i don't care if we just ignore anything called "invalid" as past history even if it isn't ;) | 00:34 |
| morganfainberg | cause LP. | 00:34 |
| lhcheng | morganfainberg, jamielennox: this is the fix for django_openstack_auth ^ | 00:34 |
| *** henrynash has quit IRC | 00:35 | |
| lhcheng | morganfainberg, jamielennox: unfortunately, can't use the auth_plugin.get_endpoint() since we need to iterate though the service catalog. | 00:35 |
| morganfainberg | lhcheng, thats fine for a stopgap, we can improve it further as we go along. | 00:35 |
| morganfainberg | this is a good starting place | 00:36 |
| lhcheng | morganfainberg: yup, should be good for now. still better than before :) | 00:36 |
| morganfainberg | exactly | 00:36 |
| morganfainberg | jamielennox, it might have been an opinion bug...or an incomplete | 00:37 |
| morganfainberg | jamielennox, lets just spin a new bug up about this. | 00:38 |
| *** browne has quit IRC | 00:43 | |
| *** browne has joined #openstack-keystone | 00:44 | |
| jamielennox | bug 1425766 | 00:46 |
| openstack | bug 1425766 in python-keystoneclient "Catalog can't handle multiple service definitions" [Undecided,New] https://launchpad.net/bugs/1425766 | 00:46 |
| morganfainberg | jamielennox, wtf. ok LP it just marked that as high when i clicked medium | 00:47 |
| morganfainberg | anyway | 00:47 |
| morganfainberg | yes, thanks! | 00:47 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 01:02 |
| *** spandhe has quit IRC | 01:07 | |
| lhcheng | morganfainberg: got a patch up too to fix horizon on catalog parsing: https://review.openstack.org/#/c/159308/ | 01:08 |
| openstackgerrit | Morgan Fainberg proposed openstack/python-keystoneclient: Collapse endpoints from services that are the same in the catalog https://review.openstack.org/159314 | 01:09 |
| morganfainberg | cool | 01:09 |
| *** spandhe has joined #openstack-keystone | 01:09 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Allow handling multiple service_types https://review.openstack.org/159315 | 01:11 |
| *** dims_ has joined #openstack-keystone | 01:11 | |
| morganfainberg | jamielennox, hah | 01:11 |
| jamielennox | morganfainberg: ergh | 01:11 |
| *** dims_ has quit IRC | 01:11 | |
| jamielennox | morganfainberg: well i did tests | 01:11 |
| morganfainberg | yours is better | 01:11 |
| morganfainberg | i'm sure | 01:11 |
| *** dims_ has joined #openstack-keystone | 01:11 | |
| *** dims has quit IRC | 01:12 | |
| *** gyee has quit IRC | 01:18 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Implement validation on the Identity V3 API https://review.openstack.org/132122 | 01:21 |
| *** rwsu is now known as rwsu-afk | 01:27 | |
| *** _cjones_ has quit IRC | 01:31 | |
| lhcheng | bknudson: thanks for review | 01:33 |
| lhcheng | bknudson: too many comment, missed the top part | 01:33 |
| lhcheng | bknudson: something easy for you when you get the chance: https://review.openstack.org/#/c/156763/ | 01:34 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Implement validation on the Identity V3 API https://review.openstack.org/132122 | 01:36 |
| *** dims has joined #openstack-keystone | 01:37 | |
| *** dims_ has quit IRC | 01:40 | |
| *** raildo_ has quit IRC | 01:41 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 01:44 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Import functional CLI tests from tempest https://review.openstack.org/158503 | 01:45 |
| *** davechen has joined #openstack-keystone | 01:51 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Refactor the code in SQL backend of assignment https://review.openstack.org/133135 | 01:51 |
| *** browne has quit IRC | 01:59 | |
| *** browne has joined #openstack-keystone | 01:59 | |
| *** ljfisher has quit IRC | 02:01 | |
| *** samueldmq_ has quit IRC | 02:04 | |
| *** tqtran has quit IRC | 02:04 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: WIP - Validate user/group exist when assigning roles https://review.openstack.org/93982 | 02:08 |
| *** diegows has quit IRC | 02:14 | |
| *** richm has quit IRC | 02:17 | |
| *** erkules_ has joined #openstack-keystone | 02:18 | |
| *** erkules has quit IRC | 02:20 | |
| *** darrenc is now known as darrenc_afk | 02:28 | |
| *** thedodd has joined #openstack-keystone | 02:28 | |
| *** chlong_ has joined #openstack-keystone | 02:43 | |
| *** markvoelker has quit IRC | 02:47 | |
| *** markvoelker has joined #openstack-keystone | 02:47 | |
| *** stevemar has joined #openstack-keystone | 02:49 | |
| *** ChanServ sets mode: +v stevemar | 02:49 | |
| openstackgerrit | Merged openstack/keystone: Change use of random to random.SystemRandom https://review.openstack.org/157990 | 02:51 |
| morganfainberg | oh interesting | 02:51 |
| *** darrenc_afk is now known as darrenc | 02:51 | |
| *** markvoelker has quit IRC | 02:51 | |
| *** lhcheng has quit IRC | 02:59 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Skip endpoints which is not available https://review.openstack.org/144860 | 03:03 |
| *** browne has quit IRC | 03:07 | |
| *** rm_work has quit IRC | 03:10 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Skip endpoints which is not available https://review.openstack.org/144860 | 03:11 |
| morganfainberg | jamielennox, a recheck wont fix: http://logs.openstack.org/15/159315/1/check/gate-python-keystoneclient-python34/ff15c08/console.html#_2015-02-26_01_21_37_919 | 03:20 |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 03:21 |
| jamielennox | morganfainberg: huh, i don't remember what i saw that i thought could be rechecked | 03:21 |
| morganfainberg | there was another failure that would recheck | 03:21 |
| jamielennox | morganfainberg: yea - but i looked at both | 03:21 |
| morganfainberg | but the py34 one wont... then again that might be the ubuntu fails a python3 | 03:21 |
| jamielennox | morganfainberg: i didn't know they removed xrange in py3 | 03:22 |
| morganfainberg | xrange = range in py3 | 03:22 |
| morganfainberg | and for the usecase range would be sufficient | 03:23 |
| *** spandhe has quit IRC | 03:23 | |
| morganfainberg | a little more memory hungry (but not at 3 elements) in py2.x | 03:23 |
| morganfainberg | not noticble | 03:23 |
| *** dims has quit IRC | 03:24 | |
| jamielennox | morganfainberg: oh yea, just xrange is kind of a habit and i didn't realize it had changed | 03:25 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Import functional CLI tests from tempest https://review.openstack.org/158503 | 03:25 |
| morganfainberg | yeah | 03:25 |
| morganfainberg | in py3 we always use xrange unless we go our of our way to not | 03:25 |
| morganfainberg | most of the time .range is good enough, but sometimes people don't expect the iterable | 03:26 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Allow handling multiple service_types https://review.openstack.org/159315 | 03:29 |
| *** markvoelker has joined #openstack-keystone | 03:43 | |
| morganfainberg | marekd, stevemar, need to bug you about federation stuff. | 03:46 |
| morganfainberg | when you're around (tomorrow works) | 03:46 |
| stevemar | morganfainberg, around now | 03:57 |
| morganfainberg | stevemar, just need to codify IDP vs SP requirements | 03:58 |
| morganfainberg | the only one that really stood out was "Kilo Keystone" | 03:58 |
| stevemar | ohhh thats what you mean, like the requirements for it? | 04:02 |
| stevemar | yeah, Kilo Keystone, which pulls down lxml and pysaml, and you need xmlsec1 for signing stuff and things | 04:03 |
| *** aslaen has quit IRC | 04:03 | |
| morganfainberg | sure | 04:04 |
| morganfainberg | thats all normal deps though | 04:04 |
| stevemar | morganfainberg, i guess kilo horizon too? | 04:05 |
| morganfainberg | oh heh yeah for lin's fixes | 04:05 |
| morganfainberg | and DOA. | 04:06 |
| *** aslaen has joined #openstack-keystone | 04:06 | |
| stevemar | obvs updated ksm and ksc just to be on the safe side | 04:06 |
| *** thedodd has quit IRC | 04:10 | |
| *** spandhe has joined #openstack-keystone | 04:10 | |
| *** thedodd has joined #openstack-keystone | 04:18 | |
| *** thedodd has quit IRC | 04:18 | |
| *** dims has joined #openstack-keystone | 04:25 | |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 04:30 |
| *** dims has quit IRC | 04:30 | |
| *** lhcheng has joined #openstack-keystone | 04:31 | |
| *** rm_work|away has joined #openstack-keystone | 04:36 | |
| *** rm_work|away is now known as rm_work | 04:36 | |
| *** rm_work has joined #openstack-keystone | 04:36 | |
| *** markvoelker has quit IRC | 04:44 | |
| *** markvoelker has joined #openstack-keystone | 04:45 | |
| *** markvoelker has quit IRC | 04:49 | |
| *** spandhe has quit IRC | 04:49 | |
| openstackgerrit | Merged openstack/keystone: Fix invalid super() usage in memcache pool https://review.openstack.org/154095 | 05:04 |
| *** lhcheng is now known as lhcheng_afk | 05:11 | |
| openstackgerrit | Merged openstack/keystone: Remove check_role_for_trust from sample policies https://review.openstack.org/156763 | 05:18 |
| *** spandhe has joined #openstack-keystone | 05:24 | |
| *** lhcheng_afk has quit IRC | 05:39 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Chain a trust with a role specified by name https://review.openstack.org/148642 | 05:59 |
| openstackgerrit | Merged openstack/keystone: Uses SQL catalog driver for v2 REST tests https://review.openstack.org/158438 | 06:00 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Chain a trust with a role specified by name https://review.openstack.org/148642 | 06:00 |
| openstackgerrit | Merged openstack/keystone: make tests of endpoint_filter check endpoints num https://review.openstack.org/145140 | 06:00 |
| stevemar | merge merge merge | 06:03 |
| morganfainberg | stevemar, https://review.openstack.org/#/c/148642/ should be an easy review | 06:07 |
| morganfainberg | stevemar, it was ready just had some legit cosmetic stuff. | 06:07 |
| stevemar | yup, looks good | 06:15 |
| *** spandhe has quit IRC | 06:21 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Reference OSC docs in CLI examples https://review.openstack.org/158202 | 06:22 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update `os service create` examples in config services https://review.openstack.org/158204 | 06:22 |
| *** lhcheng_afk has joined #openstack-keystone | 06:24 | |
| morganfainberg | stevemar, another relatively easy one: https://review.openstack.org/#/c/153307/ | 06:25 |
| morganfainberg | i wish we could better test that one though | 06:25 |
| *** fifieldt has joined #openstack-keystone | 06:26 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use correct dependency decorator https://review.openstack.org/159347 | 06:27 |
| stevemar | morganfainberg, i wonder if this will work ^ | 06:27 |
| morganfainberg | stevemar, it should | 06:28 |
| morganfainberg | it's a more enforcing version | 06:28 |
| morganfainberg | you might have a test that explodes | 06:28 |
| stevemar | i'm hoping it'll fix this issue: https://review.openstack.org/#/c/124599/ | 06:28 |
| stevemar | morganfainberg, maybe, but there are too many tests that could be the issue and i don't want to run them all locally | 06:29 |
| stevemar | jenkins and zuul shall do my bidding | 06:29 |
| morganfainberg | no only one or two tests that say things like "optional things should be optional" | 06:29 |
| morganfainberg | not all of them ;) | 06:29 |
| stevemar | morganfainberg, thanks for reviewing the oslo.policy change | 06:30 |
| morganfainberg | yeah | 06:30 |
| stevemar | i want to show keystone support before asking doug to cut a new release and add to GR | 06:30 |
| morganfainberg | sounds good | 06:30 |
| stevemar | morganfainberg, but he and sigmavirus24 +1'ed the last patch, so we should be good | 06:31 |
| morganfainberg | yeah | 06:31 |
| stevemar | morganfainberg, you are reviewing like a mad man | 06:34 |
| morganfainberg | stevemar, no one is bothering me and we have k3 coming up | 06:35 |
| morganfainberg | ;) | 06:35 |
| stevemar | let me know if you need another +2/+A on something, i'm writing some emails atm, but i'd be willing to look away | 06:35 |
| morganfainberg | sure. i'm trying to clear out either the easy ones or the ones that are high prio | 06:35 |
| morganfainberg | about to fix the minor nits to lbragstad's KLWT, but if you could review that one and make sure it looks sane ... that would be a big help, so we can get that thing in the gate tomororw. | 06:36 |
| morganfainberg | if at all possible | 06:36 |
| stevemar | morganfainberg, sure, i've looked at it a few times early on, it looked solid | 06:37 |
| morganfainberg | stevemar, actually: https://review.openstack.org/#/c/142573/ | 06:37 |
| morganfainberg | lets knock that one out before KLWT | 06:37 |
| stevemar | ugh, i've been putting this one off | 06:37 |
| morganfainberg | and the KLWT one we can do a nit cleanup / pass through if it's good. | 06:37 |
| morganfainberg | you want to to KLWT first? | 06:37 |
| morganfainberg | i'm fine with knocking out KLWT before we do this one. | 06:37 |
| stevemar | no no, whitelist is fine | 06:38 |
| stevemar | the schema definitely looks good | 06:39 |
| stevemar | i think the only part that is sticking out is: | 06:46 |
| stevemar | group_names_list = ast.literal_eval(identity_value['groups']) | 06:46 |
| morganfainberg | oh see now i started on KLWT :P | 06:46 |
| morganfainberg | i dislike that ast is used :( | 06:46 |
| morganfainberg | but... uhm.. | 06:46 |
| stevemar | hehe | 06:47 |
| stevemar | oh so, it's basically mapping ASFS_GROUPS, g1, g2, g3 to keystone groups 'admin', 'member', 'test' | 06:48 |
| morganfainberg | afaict yes | 06:48 |
| stevemar | err ASFS_GROUPS (g1, g2, g3) to keystone groups ('admin', 'member', 'test') | 06:48 |
| openstackgerrit | guang-yee proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 06:48 |
| breton | dstanek: <+dstanek> too many reviews and not enough -1s | 06:49 |
| stevemar | sorry morganfainberg had to -1 it | 06:58 |
| *** lhcheng_afk is now known as lhcheng | 06:59 | |
| morganfainberg | stevemar, -1 what? the KLWT or the white/blacklist? | 06:59 |
| morganfainberg | stevemar, i just -1'd the KLWT one for lots of *this should be cleaned up* stuff (all could be followups) | 06:59 |
| stevemar | morganfainberg, the white/black list | 07:00 |
| morganfainberg | yeah looking at that one now | 07:00 |
| stevemar | i'm on board with it in general, just one test is missing | 07:00 |
| stevemar | hey https://review.openstack.org/#/c/159347/ passed all the tests, neat | 07:00 |
| morganfainberg | so white/blacklist, yep your comment is spot on | 07:01 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use correct dependency decorator https://review.openstack.org/159347 | 07:01 |
| morganfainberg | stevemar, could use eyes on https://review.openstack.org/#/c/159315/ | 07:05 |
| stevemar | morganfainberg, sec, just rebasing one of brants patches | 07:05 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Avoid multiple instances for a provider https://review.openstack.org/124599 | 07:05 |
| morganfainberg | this one should be easy to review... but i'm not pushign it through till i get some thoughts on approach | 07:05 |
| stevemar | yesss, rebasing it on my opt->req patch fixed the issue | 07:06 |
| stevemar | morganfainberg, that service type one... barf | 07:06 |
| *** henrynash has joined #openstack-keystone | 07:07 | |
| *** ChanServ sets mode: +v henrynash | 07:07 | |
| morganfainberg | it's super easy though! | 07:07 |
| morganfainberg | i mean it's 2 lines of change ;) | 07:07 |
| morganfainberg | and right now RAX is somewhat broken for a number of their users... for $reasons | 07:07 |
| morganfainberg | but in short for them they have compute... AND compute... | 07:07 |
| morganfainberg | that is all sorts of ... broken | 07:08 |
| stevemar | morganfainberg, is looks okay to me | 07:10 |
| morganfainberg | is the idea sound though? | 07:10 |
| morganfainberg | i mean. i *think* it is | 07:10 |
| morganfainberg | now.. i need to go yell at rax for another reason (yell = talk sternly to someone about it) | 07:10 |
| morganfainberg | because in their case compute != compute | 07:10 |
| morganfainberg | but that isn't really something ksc can solve | 07:10 |
| stevemar | morganfainberg, well yeah, we shouldn't *have* to deal with that issue, but this is the nicest way of dealing with it | 07:12 |
| stevemar | morganfainberg, this should be easy https://review.openstack.org/#/c/147311/ | 07:12 |
| *** erkules_ is now known as erkules | 07:13 | |
| morganfainberg | this is solving the "you put something wonky in the catalog cause we didn't tell you you couldn't" not "you put something crazypants in the catalog that tells your user that 2 very different things are infact not different...except when you say they are" | 07:13 |
| stevemar | yeah, its the admin's doing something silly pants | 07:13 |
| stevemar | this is mitigating the sillyness | 07:13 |
| stevemar | do you think i should just drop the .. NOTE: blocks from here: https://review.openstack.org/#/c/146758/3 ? | 07:14 |
| morganfainberg | i would keep those | 07:14 |
| morganfainberg | no reason to remove them. | 07:15 |
| morganfainberg | though i'd wait till marek's stuff lands can we just mark k2k stable | 07:15 |
| stevemar | right | 07:15 |
| morganfainberg | before pushing that change through | 07:15 |
| stevemar | morganfainberg, last one of mine: https://review.openstack.org/#/c/158561 | 07:17 |
| morganfainberg | you have an erroneous whitespace change in there | 07:18 |
| morganfainberg | btw | 07:18 |
| morganfainberg | +2 though | 07:18 |
| stevemar | morganfainberg, i added that deliberately | 07:18 |
| morganfainberg | something something whitespace and real changes don't mix something something | 07:19 |
| stevemar | readability! | 07:19 |
| stevemar | want me to fix it up? | 07:19 |
| morganfainberg | no, +2'd already | 07:20 |
| *** lhcheng has quit IRC | 07:34 | |
| *** chlong_ has quit IRC | 07:42 | |
| *** chlong has quit IRC | 07:43 | |
| *** henrynash has quit IRC | 07:43 | |
| *** markvoelker has joined #openstack-keystone | 07:44 | |
| marekd | morganfainberg: what/up with federation? | 07:48 |
| stevemar | marekd, it's all broken | 07:48 |
| stevemar | marekd, kidding :P | 07:48 |
| marekd | stevemar: it is :P | 07:48 |
| *** markvoelker has quit IRC | 07:50 | |
| *** afazekas_ has joined #openstack-keystone | 07:50 | |
| marekd | stevemar: morganfainberg may not be here, but did we decide that service providers will be added on request, after speciifying ?service_providers in the /auth/catalog call ? | 07:50 |
| *** ioram has quit IRC | 07:58 | |
| openstackgerrit | Merged openstack/keystone: Revamp the documentation surrounding notifications https://review.openstack.org/126180 | 08:01 |
| *** dims has joined #openstack-keystone | 08:03 | |
| stevemar | marekd, no; it's basically what you have proposed | 08:04 |
| stevemar | if SPs exist, add to catalog as 'service_providers': [] | 08:04 |
| stevemar | if not, add no section | 08:04 |
| marekd | allrighty. | 08:05 |
| stevemar | morganfainberg, ^ | 08:05 |
| morganfainberg | marekd, what stevemar said | 08:05 |
| morganfainberg | and we'll need to probably do a FFE for getting filtering added, but i'm ok with that | 08:05 |
| morganfainberg | marekd, the only reason the API change wasn't merged was I wanted to make sure you looked at brant's recent comments. | 08:06 |
| marekd | FFE stands for? | 08:06 |
| morganfainberg | feature freeze exception | 08:06 |
| morganfainberg | post k3 feature work | 08:06 |
| *** dims has quit IRC | 08:07 | |
| morganfainberg | marekd, or confirm that the comments weren't something that needed to be addressed | 08:09 |
| stevemar | marekd, your local user auth patch and white/black list are super close! | 08:11 |
| openstackgerrit | Merged openstack/keystone: Add links to extensions that point to api specs https://review.openstack.org/147311 | 08:13 |
| jamielennox | stevemar: why wouldn't you always return service_providers: [] | 08:20 |
| jamielennox | what does the empty list signify that the missing element doesn't? | 08:20 |
| morganfainberg | jamielennox, it doesn't break people with older systems if k2k is not enabled | 08:21 |
| morganfainberg | jamielennox, it's strictly a compatibility thing for allowing keystone [some advanced features limited] from running in older environments. something we've been *very* good about supporting | 08:21 |
| jamielennox | morganfainberg: we're not nesting this within the 'catalog' element though right? | 08:21 |
| morganfainberg | no, but horizon and DOA will explode | 08:21 |
| morganfainberg | they still do direct catalog parsing | 08:22 |
| morganfainberg | as will old nova(s) | 08:22 |
| jamielennox | bah, really... | 08:22 |
| morganfainberg | yep. | 08:22 |
| jamielennox | well that settles any argument | 08:22 |
| stevemar | jamielennox, morganfainberg it's going to be in the 'catalog' element though right? | 08:22 |
| morganfainberg | oh it is. | 08:22 |
| morganfainberg | sorry | 08:22 |
| morganfainberg | just not in the normal service thing | 08:22 |
| jamielennox | stevemar, morganfainberg: why? just make it it's own element | 08:22 |
| morganfainberg | jamielennox, what marek proposed | 08:22 |
| morganfainberg | jamielennox, it's part of the catalog. we said as much eysterday | 08:23 |
| morganfainberg | right?! | 08:23 |
| jamielennox | the token has 'catalog': [...] | 08:23 |
| * morganfainberg might be overly tired. | 08:23 | |
| jamielennox | morganfainberg: last i heard it was going to be out on its own | 08:23 |
| * morganfainberg should also be in bed already. | 08:23 | |
| morganfainberg | jamielennox, https://review.openstack.org/#/c/156509/ | 08:23 |
| jamielennox | but i miss all the conversations that happen during the day | 08:24 |
| morganfainberg | in catalog, as it's own {} thing | 08:24 |
| morganfainberg | at least that is what i thought we discussed | 08:24 |
| morganfainberg | last night. | 08:24 |
| jamielennox | morganfainberg: yuk - i can see why it blows up | 08:25 |
| marekd | stevemar: cool, i will work on that | 08:25 |
| jamielennox | why not just have 'service_providers': [] as a top level? | 08:25 |
| marekd | morganfainberg: hah, how expensive would be changing token's structure? | 08:25 |
| marekd | talking long term plans now. | 08:25 |
| jamielennox | d.keys() = ['catalog', 'service_providers'] | 08:25 |
| morganfainberg | jamielennox, how much would it break to return it as part of auth/catalog but not in catalog? | 08:25 |
| morganfainberg | i'm going to guess lots of stuff would break | 08:25 |
| openstackgerrit | wanghong proposed openstack/keystone: add timestamp to project and role https://review.openstack.org/154370 | 08:26 |
| morganfainberg | marekd, changing token structure is painful | 08:26 |
| marekd | jamielennox: it's because service_providers are part of catalog? however i think we are slightly morphing into local/remote service catalog. | 08:26 |
| jamielennox | marekd: but i'm getting more and more keen for v4 tokens | 08:26 |
| morganfainberg | marekd, because *some* companies like to directly inspect the token and assume it looks a certain way | 08:26 |
| stevemar | jamielennox, you're suggested to change the token structure now, not the catalog | 08:26 |
| marekd | jamielennox: huh? when? how? | 08:27 |
| jamielennox | stevemar: i'm adding to the token structure, i don't think that's a problem | 08:27 |
| morganfainberg | jamielennox, please work with marekd to figure out how this needs to be (cc stevemar) i need to sleep :P | 08:27 |
| openstackgerrit | David J Hu proposed openstack/keystone: Version independent token issuance pipeline https://review.openstack.org/150629 | 08:27 |
| marekd | morganfainberg: yes sir | 08:27 |
| morganfainberg | i don't think i'm that functional right now :P but the roadblocks to accepting it as " | 08:27 |
| morganfainberg | "not just another endpoint" are gone | 08:27 |
| jamielennox | awww, i have my scotch, i can smell dinner... | 08:27 |
| * morganfainberg just wants this to be in place and working. | 08:27 | |
| morganfainberg | jamielennox, sooooo drink moar scotch, quick discussiojn and go have dinner ;) | 08:28 |
| stevemar | i don't think having the SPs in the returned token would be a problem | 08:28 |
| * morganfainberg has no horse in this race - as long as SPs are available. [and they *should* be part of the catalog response if we can do it w/o breaking people] | 08:28 | |
| stevemar | a call to /auth/catalog wouldn't return anything | 08:29 |
| jamielennox | so when i thought we were talking about having service providers in the catalog i thought we were still talking {'endpoint': {stuff}} | 08:29 |
| morganfainberg | or something someting | 08:29 |
| morganfainberg | g'night. | 08:29 |
| marekd | morganfainberg: gnight | 08:29 |
| jamielennox | just changing stuff | 08:29 |
| stevemar | nite | 08:29 |
| morganfainberg | i'll look for a review to +2 when i'm awake or something next | 08:29 |
| jamielennox | cya | 08:29 |
| stevemar | jamielennox, so having them in endpoints was never an option | 08:29 |
| marekd | stevemar: ++ | 08:29 |
| jamielennox | stevemar: yep, i didn't read the review properly | 08:29 |
| stevemar | along side endpoints was always the suggested | 08:29 |
| marekd | well, gyee brought this up | 08:29 |
| jamielennox | stevemar: and it makes sense why i had some wrong ideas | 08:30 |
| jamielennox | but they're not really along side | 08:30 |
| marekd | jamielennox: so now how do you want to have them done? | 08:30 |
| jamielennox | catalog is defined as a list - not a dictionary | 08:30 |
| morganfainberg | in short, they don't belong in endpoints [i swear i'm going to bed] | 08:30 |
| stevemar | jamielennox, right, gyee and bknudson suggested that we could 'force' these into endpoints, but that didn't fly | 08:30 |
| jamielennox | morganfainberg: you can do it | 08:30 |
| morganfainberg | jamielennox, you know.. if catalog has been a dict... that other issue we just solved in ksc wouldn't have happened | 08:30 |
| jamielennox | stevemar: right and it was going to cause problems with auth.get_endpoint | 08:30 |
| jamielennox | morganfainberg: i know | 08:30 |
| morganfainberg | jamielennox, catalog v.. 3? | 08:31 |
| morganfainberg | v4? | 08:31 |
| jamielennox | morganfainberg: i get why they didn't, but they should have | 08:31 |
| morganfainberg | v293497829348294 | 08:31 |
| jamielennox | morganfainberg: token v4 lets us redefine catalog | 08:31 |
| jamielennox | though causes a hell of a lot of other problems | 08:31 |
| morganfainberg | ooh catalog v314159265359 | 08:31 |
| marekd | jamielennox: you seriously want to start working on v4 ? | 08:31 |
| morganfainberg | marekd, not API v4 | 08:31 |
| morganfainberg | new token format only | 08:32 |
| jamielennox | marekd: it's come up in the past | 08:32 |
| stevemar | marekd, v4 is always a joke :P | 08:32 |
| morganfainberg | god no api v4 | 08:32 |
| morganfainberg | never api v4 | 08:32 |
| jamielennox | oh - that would be fun as well - but no | 08:32 |
| morganfainberg | but a new token format wouldn't be bad. | 08:32 |
| morganfainberg | a lot of work | 08:32 |
| morganfainberg | but not nearly as bad | 08:32 |
| jamielennox | just seperating the CRUD api from the token format and auth work | 08:32 |
| morganfainberg | (most deployers never actually look *in* the token) | 08:32 |
| morganfainberg | on the wire that is | 08:32 |
| marekd | morganfainberg: jamielennox: this qualifies for a summit session proabably. My suggestion would be: make a format so we can easily support hybrid clouds. | 08:33 |
| stevemar | morganfainberg, i'm not really seeing a downside to adding 'service_providers' to the token level | 08:33 |
| jamielennox | then we could do some cool stuff with auth discovery and purely external auth | 08:33 |
| jamielennox | stevemar: that's my vote | 08:33 |
| marekd | and make token that can really rule them all [federated clouds] | 08:33 |
| jamielennox | stevemar: that's what i thought i was voting with when morganfainberg suggested keeping them seperate | 08:33 |
| morganfainberg | http://www.piday.org/million/ | 08:33 |
| stevemar | morganfainberg, marekd thoughts on keeping it at the token level? | 08:34 |
| jamielennox | from an auth plugin perspective it will be a whole lot easier to support | 08:34 |
| jamielennox | because i'll just add a new call | 08:34 |
| stevemar | right | 08:34 |
| marekd | jamielennox: https://review.openstack.org/#/c/156509/1/api/v3/identity-api-v3.rst,cm so here is curent proposition. | 08:34 |
| jamielennox | the problem was always how to intertwine catalog and service providers | 08:34 |
| marekd | you are voting for moving service_providers level up? | 08:34 |
| jamielennox | (am i the only one who still can't get used to the new gerrit formatting) | 08:34 |
| marekd | i saw lots of options flying around and people changing their minds. | 08:34 |
| morganfainberg | stevemar, not the end of the world, but it's an extra call if you're sans token. but eh | 08:35 |
| morganfainberg | jamielennox, i refuse to use the new layout | 08:35 |
| morganfainberg | jamielennox, it's a trainwreck. the old gerrit = better | 08:35 |
| morganfainberg | or gertty | 08:35 |
| stevemar | agreed | 08:35 |
| jamielennox | cool, just everyone links the new way | 08:35 |
| stevemar | marekd, so /auth/catalog wouldn't return the service provders | 08:35 |
| stevemar | just /auth/tokens | 08:35 |
| morganfainberg | jamielennox, mostly ayoung-mtg and marekd afaik. | 08:35 |
| jamielennox | i think that's ok | 08:35 |
| jamielennox | GET /auth/service_providers | 08:35 |
| jamielennox | GET /auth/catalog | 08:36 |
| morganfainberg | jamielennox, ^^ yes | 08:36 |
| jamielennox | and a token has both | 08:36 |
| morganfainberg | if it isn't in the catlog, it needs it's own call | 08:36 |
| jamielennox | i talked about GET /auth/service_providers yesterday and we got sidetracked with another discussion | 08:36 |
| morganfainberg | jamielennox, compute != (or does it) compute | 08:36 |
| morganfainberg | jamielennox was the sidetrack i think. | 08:36 |
| morganfainberg | or was that today? | 08:37 |
| jamielennox | morganfainberg: today | 08:37 |
| morganfainberg | wow... i uh.. things | 08:37 |
| jamielennox | morganfainberg: sleep | 08:37 |
| * morganfainberg waves hands | 08:37 | |
| jamielennox | did that pass check? | 08:37 |
| marekd | bye | 08:37 |
| morganfainberg | go make SPs appear somewhere ;) | 08:37 |
| morganfainberg | jamielennox, yeah it did | 08:37 |
| morganfainberg | jamielennox, has 2x+2s as well | 08:37 |
| *** pnavarro has joined #openstack-keystone | 08:37 | |
| jamielennox | cool | 08:37 |
| openstackgerrit | Merged openstack/keystone: Fix for KVS cache backend incompatible with redis-py https://review.openstack.org/153307 | 08:38 |
| marekd | jamielennox: when client calls /auth/catalog? | 08:38 |
| stevemar | marekd, jamielennox http://paste.openstack.org/show/182338/ | 08:38 |
| jamielennox | stevemar: yep | 08:38 |
| jamielennox | ahh - what's with the auth_url: RegionOn | 08:38 |
| stevemar | jamielennox, copy/pasta | 08:39 |
| jamielennox | ok actual url there | 08:39 |
| morganfainberg | btw, we need to use https://github.com/philipl/pifs | 08:39 |
| stevemar | yes | 08:39 |
| morganfainberg | in keystone somewhere | 08:39 |
| stevemar | jamielennox, yeah, they are actual urls | 08:39 |
| openstackgerrit | wanghong proposed openstack/keystone: move region and service exist checks into manager layer https://review.openstack.org/141977 | 08:39 |
| jamielennox | stevemar, marekd: cool like it | 08:40 |
| stevemar | http://paste.openstack.org/show/182339/ | 08:40 |
| stevemar | there we go | 08:40 |
| stevemar | so...... | 08:40 |
| jamielennox | stevemar: it must be late, but stanek got a jump on you so can you have a look at some of those auth_token splits | 08:40 |
| stevemar | jamielennox, link me up | 08:40 |
| jamielennox | i have some stuff i want to do to auth_token for swift but i'm not going to rebase it until this all clears | 08:40 |
| jamielennox | https://review.openstack.org/#/c/157279/ | 08:41 |
| marekd | jamielennox: stevemar ok, i will change the code so it looks like steves example. | 08:41 |
| stevemar | IIRC, we (future work) were going to look into the token for the SPs anyway, so i think we can just add them to the token | 08:42 |
| marekd | (though i think it will be removed from one year from now :P) | 08:42 |
| morganfainberg | btw, feel free to push the API docs through if they match what you guys just discussed. | 08:42 |
| stevemar | the only issue is if it's always there or not, morganfainberg opinion on that one? | 08:42 |
| jamielennox | marekd: possibly, hopefully by then we will understand how this whole thing will wokr | 08:42 |
| jamielennox | stevemar: i vote always, it's not going to cause compat issues there | 08:43 |
| morganfainberg | eh, lbragstad is going to hate you in either case. | 08:43 |
| stevemar | like if all tokens will have 'service_providers': [] | 08:43 |
| jamielennox | but honestly it doesn't matter either way because we have to support old and new tokesn | 08:43 |
| stevemar | in terms of token bloat, its the same size | 08:43 |
| marekd | jamielennox: yes. as i asid earlier, we should start preparing ourselves for 'hybrid clouds' and hybrid tokens, so client could easily understand "these are my local endpoints and there are somewhere, far away" | 08:43 |
| jamielennox | marekd: yea, i don't know yet if the client stuff can support it | 08:44 |
| stevemar | yep | 08:44 |
| jamielennox | marekd: but it's in a better place than it was i guess | 08:44 |
| stevemar | jamielennox, food for thought | 08:44 |
| morganfainberg | stevemar, we should rot26 the sp_urls for security reasons | 08:44 |
| marekd | jamielennox: it's a long term future work | 08:44 |
| morganfainberg | >.> | 08:44 |
| morganfainberg | <,< | 08:44 |
| jamielennox | we still don't have people using v3 auth, i think hybrid cloud tokens will still be a while | 08:44 |
| marekd | what's that >.> ? | 08:44 |
| morganfainberg | marekd, shifty eyes | 08:44 |
| marekd | ah | 08:44 |
| jamielennox | alright - gotta go, will check that spec later | 08:44 |
| morganfainberg | like spy vs spy but ascii | 08:45 |
| marekd | jamielennox: thanks | 08:45 |
| marekd | morganfainberg: i would kick you out of channel so you finally go to bed if i could :P | 08:45 |
| morganfainberg | since this is a dict, actually i vote don't put it in the token unless it exists | 08:45 |
| morganfainberg | this also means that if we remove it for something else in the future ... it could just disappear | 08:46 |
| morganfainberg | rather than always being an empty [] | 08:46 |
| morganfainberg | (with less pain that is) | 08:46 |
| morganfainberg | since clients will already need to know if it's there/check it actually exists | 08:46 |
| morganfainberg | client being not ksc that are doing things even though we said don't | 08:46 |
| marekd | ok, so move service providers level up, make them appear only if we have something to show. | 08:47 |
| morganfainberg | yep. i think that is the best course | 08:47 |
| stevemar | morganfainberg, how can we make them a dict? | 08:47 |
| morganfainberg | stevemar, the token itself is a dict | 08:47 |
| morganfainberg | so token,get('service_providers') | 08:47 |
| morganfainberg | vs token['service_providers'] | 08:47 |
| stevemar | oh i thought you meant to make service_providers a dict | 08:48 |
| stevemar | meh | 08:48 |
| stevemar | of course token is | 08:48 |
| marekd | no no | 08:48 |
| stevemar | i was confused for a sec | 08:48 |
| morganfainberg | marekd, ? | 08:48 |
| stevemar | it is nearly 4am for me, confusion is bound to happen | 08:48 |
| morganfainberg | stevemar, go to bed | 08:48 |
| stevemar | and with that, i'm outtttttttt | 08:48 |
| morganfainberg | you need ti more than i do | 08:48 |
| stevemar | i sleep in like a beast | 08:48 |
| marekd | morganfainberg: i was saying 'no no' to steve | 08:48 |
| morganfainberg | ah yeah | 08:49 |
| morganfainberg | ok so.. g'night | 08:49 |
| marekd | bye | 08:49 |
| morganfainberg | or somesuch | 08:49 |
| stevemar | see ya in a few hours | 08:49 |
| *** karimb has joined #openstack-keystone | 08:49 | |
| *** rushiagr_away is now known as rushiagr | 08:49 | |
| stevemar | marekd, don't burn down the house | 08:49 |
| marekd | :D | 08:49 |
| marekd | yes, mum | 08:49 |
| stevemar | hehe | 08:49 |
| stevemar | get the black/white list and local user patches up, they are super close | 08:50 |
| stevemar | okay okay, not i'm gone | 08:50 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Avoid multiple instances for a provider https://review.openstack.org/124599 | 08:52 |
| *** jistr has joined #openstack-keystone | 08:53 | |
| *** henrynash has joined #openstack-keystone | 08:53 | |
| *** ChanServ sets mode: +v henrynash | 08:53 | |
| openstackgerrit | Merged openstack/keystone: Chain a trust with a role specified by name https://review.openstack.org/148642 | 08:53 |
| *** stevemar has quit IRC | 08:57 | |
| openstackgerrit | wanghong proposed openstack/keystone: apply endpoint_group filters on token catalog https://review.openstack.org/144187 | 08:57 |
| *** henrynash has quit IRC | 08:59 | |
| *** henrynash has joined #openstack-keystone | 09:01 | |
| *** ChanServ sets mode: +v henrynash | 09:01 | |
| *** MasterPiece has quit IRC | 09:10 | |
| *** jaosorior has joined #openstack-keystone | 09:38 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Implements whitelist and blacklist mapping rules https://review.openstack.org/142573 | 09:41 |
| openstackgerrit | Merged openstack/keystonemiddleware: Extract revocations to file https://review.openstack.org/157279 | 09:42 |
| *** markvoelker has joined #openstack-keystone | 09:47 | |
| *** davechen has quit IRC | 09:50 | |
| *** markvoelker has quit IRC | 09:52 | |
| *** krykowski has joined #openstack-keystone | 10:02 | |
| *** sluo_laptop has quit IRC | 10:05 | |
| *** henrynash has quit IRC | 10:08 | |
| *** EmilienM|afk is now known as EmilienM | 10:11 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Authenticate local users via federated workflow https://review.openstack.org/156308 | 10:24 |
| *** pnavarro_ has joined #openstack-keystone | 10:42 | |
| *** pnavarro has quit IRC | 10:43 | |
| *** henrynash has joined #openstack-keystone | 10:46 | |
| *** ChanServ sets mode: +v henrynash | 10:46 | |
| *** pnavarro_ has quit IRC | 10:47 | |
| *** pnavarro_ has joined #openstack-keystone | 10:48 | |
| *** dims has joined #openstack-keystone | 10:52 | |
| *** himangi has joined #openstack-keystone | 10:54 | |
| *** dims_ has joined #openstack-keystone | 10:55 | |
| *** dims has quit IRC | 10:58 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Enhance user identification in mapping engine https://review.openstack.org/154934 | 11:08 |
| *** nellysmitt has joined #openstack-keystone | 11:10 | |
| marekd | anybody willing to take a look at this patch https://review.openstack.org/#/c/152156/ ? | 11:14 |
| *** pcaruana has joined #openstack-keystone | 11:19 | |
| breton | yep | 11:29 |
| marekd | thanks. | 11:29 |
| breton | I'm getting an error when I do db_sync on mysql | 11:32 |
| *** rushiagr is now known as rushiagr_away | 11:33 | |
| marekd | like? | 11:34 |
| breton | http://paste.openstack.org/show/182417/ | 11:36 |
| marekd | ouch | 11:38 |
| marekd | you are right. | 11:38 |
| *** samueldmq has quit IRC | 11:42 | |
| marekd | breton: is you mysql using InnoDB? | 11:43 |
| breton | marekd: I don't know, I just apt-geted it from debian stable | 11:45 |
| *** dguerri is now known as dguerri`afk | 11:47 | |
| *** chlong has joined #openstack-keystone | 11:51 | |
| *** chlong_ has joined #openstack-keystone | 11:51 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 11:51 |
| *** amakarov_away is now known as amakarov | 11:52 | |
| *** samueldmq_ has joined #openstack-keystone | 12:09 | |
| *** samueldmq_ is now known as samueldmq | 12:09 | |
| samueldmq | morninig | 12:09 |
| samueldmq | henrynash, hi | 12:13 |
| *** henrynash has quit IRC | 12:13 | |
| *** dims_ has quit IRC | 12:14 | |
| *** henrynash has joined #openstack-keystone | 12:14 | |
| *** ChanServ sets mode: +v henrynash | 12:14 | |
| *** dims has joined #openstack-keystone | 12:14 | |
| *** rodrigods has left #openstack-keystone | 12:16 | |
| *** rodrigods has joined #openstack-keystone | 12:17 | |
| *** himangi has quit IRC | 12:20 | |
| samueldmq | henrynash, you around? | 12:22 |
| henrynash | samueldmq: sure | 12:22 |
| samueldmq | henrynash, hi .. I've submitted a bug for the tests failing due to bad config of domain-specific on tests | 12:23 |
| samueldmq | henrynash, https://bugs.launchpad.net/keystone/+bug/1425895 | 12:23 |
| openstack | Launchpad bug 1425895 in Keystone "Tests on DomainSpecificLDAPandSQLIdentity cannot create and use new domains" [Undecided,New] - Assigned to Samuel de Medeiros Queiroz (samueldmq) | 12:23 |
| samueldmq | henrynash, I'll fix it on the tests, as you suggested | 12:24 |
| samueldmq | henrynash, however .... when domain-specific config is in SQL, could we couple a bit more the domain creation and the check for the config? | 12:25 |
| henrynash | samueldmq: well, not without changing the API speci | 12:25 |
| samueldmq | henrynash, what's your personal feeling? i) we really don't need that samuel! ii) I agree that would be better iii) I dont care, both work for me | 12:26 |
| samueldmq | :p | 12:26 |
| henrynash | samueldmq: I’m pretty much against overly linking these things…I think it is not teh correct thing to do for production deploments | 12:26 |
| henrynash | we should a) make it possible for on-boardes to use rest to create a domain and config it (that’s what I’m doing)….but I don’t think the shoul dbe combined….. and b) we should make our tests smarter | 12:28 |
| samueldmq | henrynash, we could at least log somehting (INFO when it will be mapped into the default driver, WARNING when it cant be mapped and a config will need to be added) | 12:28 |
| henrynash | samueldmq: as I said, I’m pretty much against overly linking these things | 12:28 |
| henrynash | samueldmq: cloud admins do NOT want this stuff happending withou their control | 12:29 |
| samueldmq | henrynash, ok I agree, but what about the log messages I said ^ | 12:29 |
| henrynash | samueldmq: if they want to offer a “one button” domain onbording, they’ll do that by layering on their own UI | 12:29 |
| henrynash | samueldmq: I guess we could write a log message…..but on what condition? We create a domain, try and list users, catch thee error and log? | 12:31 |
| henrynash | all inside the create_domain method of the controller? | 12:32 |
| samueldmq | henrynash, well, we couldn't without coupling them... since we will need to check available domain configs | 12:32 |
| samueldmq | :/ | 12:32 |
| henrynash | well, we could just try the api call and catch the error….pretty yukky | 12:33 |
| henrynash | doesn’t our log from idenitity already say what domain is in error….in which case, have we gained anything? | 12:33 |
| henrynash | nobody will look at the logs until something goes wrong anyway | 12:34 |
| henrynash | (you can tell I’m skeptical of this whole thing!) | 12:34 |
| samueldmq | well, I do think if we raise an error at domain creation it would improve ux | 12:36 |
| samueldmq | Hey, you are using domain-specific configs and new domains cannot be mapped into the default driver, since it's LDAP. Please provide a config for this domain first!' | 12:36 |
| samueldmq | but since no cloud admin is hitting issues when configuring their domains, maybe this is not worth to do | 12:36 |
| samueldmq | and we have other things with higher priority :-) | 12:37 |
| samueldmq | so for me it's ok to let this as it is, np | 12:37 |
| *** diegows has joined #openstack-keystone | 12:42 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Exposing bug in domain-specific config use on test https://review.openstack.org/159099 | 12:45 |
| samueldmq | henrynash, ^ I'm exposing the bug, I will just make our tests smarter :-) | 12:46 |
| henrynash | ok | 12:47 |
| henrynash | making tests smarter is good | 12:48 |
| samueldmq | :) | 12:49 |
| *** markvoelker has joined #openstack-keystone | 12:50 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 12:50 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 12:51 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 12:51 |
| *** rodrigods is now known as rodrigod` | 12:51 | |
| *** rodrigod` is now known as rodrigods | 12:53 | |
| *** markvoelker has quit IRC | 12:56 | |
| *** kallebe has joined #openstack-keystone | 12:58 | |
| *** afazekas_ has quit IRC | 13:05 | |
| *** aix has joined #openstack-keystone | 13:13 | |
| dstanek | lbragstad: i'm going through that stuff again this morning | 13:14 |
| lbragstad | dstanek: ++ thanks for the reviews! | 13:15 |
| openstackgerrit | Merged openstack/keystone: Reference OSC docs in CLI examples https://review.openstack.org/158202 | 13:18 |
| openstackgerrit | Merged openstack/keystone: Update `os service create` examples in config services https://review.openstack.org/158204 | 13:19 |
| *** chlong has quit IRC | 13:20 | |
| *** chlong_ has quit IRC | 13:20 | |
| *** rushiagr_away is now known as rushiagr | 13:22 | |
| *** MasterPiece has joined #openstack-keystone | 13:30 | |
| *** MasterPiece has quit IRC | 13:34 | |
| *** baffle has quit IRC | 13:42 | |
| breton | dstanek: I have a problem in reviewing your functional testing patches: I don't know how to use them. What should I do after I did "git fetch && git checkout"? | 13:51 |
| *** markvoelker has joined #openstack-keystone | 13:53 | |
| dstanek | breton: which patch are you working on? | 13:56 |
| breton | dstanek: https://review.openstack.org/#/c/151310/6 for example. Or https://review.openstack.org/#/c/151311/ | 13:59 |
| *** markvoelker has quit IRC | 13:59 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:59 | |
| *** joesavak has joined #openstack-keystone | 14:01 | |
| dstanek | breton: for those you have to hack up a devstack config - the k-pyidp is a service and the federation is a keystone extension | 14:01 |
| dstanek | breton: might now be worth reviewing them at this point | 14:04 |
| breton | hm, ok. | 14:05 |
| breton | I am not sure even where to start. Do I need a running devstack for that? Do I have to apply the changeset against Keystone used in that devstack? | 14:06 |
| *** henrynash has quit IRC | 14:06 | |
| *** markvoelker has joined #openstack-keystone | 14:10 | |
| *** arunkant has quit IRC | 14:10 | |
| *** richm has joined #openstack-keystone | 14:11 | |
| *** bknudson has quit IRC | 14:15 | |
| kallebe | hey. How do I use keystone client in code? I am trying to use the client from code, not CLI. | 14:16 |
| kallebe | I tried | 14:16 |
| kallebe | cl = keystoneclient.client.Client(auth_url='http://localhost:35357/v2.0') | 14:16 |
| kallebe | but it returns keystoneclient.openstack.common.apiclient.exceptions.ConnectionRefused: Unable to establish connection to http://localhost:35357/v2.0 | 14:16 |
| kallebe | keystoneclient.openstack.common.apiclient.exceptions.ConnectionRefused: Unable to establish connection to http://localhost:35357/v2.0 | 14:16 |
| kallebe | keystoneclient.openstack.common.apiclient.exceptions.ConnectionRefused: Unable to establish connection to http://localhost:35357/v2.0 | 14:16 |
| *** gordc has joined #openstack-keystone | 14:17 | |
| amakarov | kallebe, make sure Keystone listens on localhost, not on some 10.xx.xx.xx | 14:18 |
| dstanek | breton: you have to have a devstack that contains the new code - but the kicker is that you have to actually move it into the devstack directoies | 14:18 |
| kallebe | amakarov ok, I will see that | 14:18 |
| dstanek | kallebe: what happens when you "curl http://localhost:35357/v2.0" on that same machine? | 14:18 |
| kallebe | it returns connection refused | 14:19 |
| kallebe | I will try to use direct IP | 14:19 |
| amakarov | kallebe, ++ | 14:19 |
| *** ljfisher has joined #openstack-keystone | 14:19 | |
| kallebe | well, I guess keystone must have some problem here in my machine. I will try to restore it. When i use keystone endpoint-list the connection is refused | 14:21 |
| amakarov | kallebe, a pity. I hoped for a bug :) | 14:22 |
| kallebe | amakarov so just to make it clear how I will use the keystoneclient. I want to use it to get the port of keystone adminurl | 14:23 |
| kallebe | can i just instantiate the client and use service_catalog.get_endpoints.get_endpoints() | 14:23 |
| kallebe | oops | 14:24 |
| kallebe | client.service_catalog.get_endpoints() | 14:24 |
| amakarov | kallebe, https://github.com/openstack/python-keystoneclient#python-api | 14:25 |
| amakarov | just use v3 instead of v2.0 | 14:26 |
| dstanek | kallebe: is keystone running on that machine? | 14:26 |
| *** pnavarro__ has joined #openstack-keystone | 14:26 | |
| kallebe | ok, thanks. Had not realized that :) I will try it when Keystone goes up again. | 14:26 |
| kallebe | +dstanek I thought it was running but apparently no process is listening on port 5000 nor 35357 | 14:26 |
| kallebe | I went to screen keystone tab and tried to up it again | 14:26 |
| kallebe | however, the last command is about log :( | 14:26 |
| kallebe | sudo tail -f /var/log/apache2/keystone.log | 14:27 |
| *** pnavarro_ has quit IRC | 14:27 | |
| dstanek | kallebe: is apache running? | 14:28 |
| kallebe | dstanek yes | 14:29 |
| kallebe | well, I will unstack and stack again. No problem. | 14:29 |
| *** afazekas_ has joined #openstack-keystone | 14:31 | |
| *** pnavarro__ has quit IRC | 14:31 | |
| dstanek | kallebe: is you still have issue 'netstat -l' will show that the ip:port things are listening on | 14:31 |
| kallebe | +dstanek ok, thanks. I also use netstat -taupen | grep <number> to check one in particular | 14:32 |
| *** radez_g0n3 is now known as radez | 14:34 | |
| *** bknudson has joined #openstack-keystone | 14:36 | |
| *** ChanServ sets mode: +v bknudson | 14:36 | |
| dstanek | lbragstad: you here? | 14:38 |
| lbragstad | dstanek: yes? | 14:39 |
| dstanek | lbragstad: confused by key rotation | 14:39 |
| lbragstad | dstanek: I can attempt to answer the questions on it | 14:39 |
| lbragstad | dstanek: but dolphm did quite a bit of that logic | 14:40 |
| lbragstad | dstanek: what's up? | 14:40 |
| dstanek | you have keys 0, 1, 2 and then you rotate by moving 0 to 3 and creating a new 0? | 14:40 |
| lbragstad | the key that is 0 is always the primary key | 14:40 |
| lbragstad | which is the key that does all the encrypting and signing | 14:40 |
| lbragstad | so, | 14:40 |
| lbragstad | then the old primary gets 'demoted' but is still available to decrypt | 14:41 |
| dstanek | but it's demoted by moving it to max + 1? | 14:41 |
| lbragstad | yeah, that logic ties into the max_active_keys option as well. | 14:42 |
| lbragstad | so if you say that you only want to have a maximum of 10 active keys, it takes that into consideration | 14:43 |
| *** pnavarro__ has joined #openstack-keystone | 14:43 | |
| dstanek | ok, that is what i thought - the naming of current_primary_key and new_primary_key threw me off because they don't make sense | 14:43 |
| lbragstad | dstanek: yeah, I believe dolphm said he was working on documenting that? gyee also had questions on that | 14:44 |
| lbragstad | old keys can be cleaned up once they're older than the default token lifetime | 14:44 |
| lbragstad | s/default/configured/ | 14:44 |
| lbragstad | actually, scratch that last statement | 14:45 |
| lbragstad | I was wrong | 14:45 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 14:49 |
| dstanek | lbragstad: yeah, i looks like they are only cleaned up based on the count | 14:49 |
| lbragstad | dstanek: correct, | 14:49 |
| lbragstad | dstanek: so, it would break if you had a token expiration of 6 hours, but wanted to rotate keys every 30 minutes and had max_active_keys set to 4 or something like that | 14:50 |
| lbragstad | because there would still be valid tokens out there that wouldn't able to be validated once the excess keys are pruned | 14:50 |
| dstanek | sounds like some sweet documentation - really users should only set one of those settings and the other one would be calculated | 14:51 |
| dstanek | lbragstad: they control rotation outside of keystone though, right? | 14:52 |
| lbragstad | dstanek: so you're saying that max active keys should be generated based off token expiration time and rate of key rotation? | 14:52 |
| lbragstad | dstanek: yeah | 14:53 |
| lbragstad | say I have a 24 token lifetime, and i want to rotate keys every hour, my max_active_keys shouldn't be less than 24 | 14:53 |
| lbragstad | but, not sure that management belongs in the keystone server? | 14:53 |
| lbragstad | 24 hour* | 14:54 |
| lbragstad | the tricky part is the key rotation policy since that part is up to the deployer | 14:54 |
| dstanek | yeah, i think that's a documenation thing | 14:54 |
| lbragstad | dstanek: cool | 14:55 |
| dstanek | it's harder since we are doing half the work | 14:55 |
| lbragstad | agreed | 14:55 |
| *** csoukup has joined #openstack-keystone | 14:55 | |
| *** htruta has quit IRC | 14:59 | |
| dstanek | lbragstad: first patch done | 15:04 |
| lbragstad | dstanek: thanks! | 15:04 |
| *** htruta has joined #openstack-keystone | 15:04 | |
| morganfainberg | lbragstad: key rotation is always hard | 15:10 |
| morganfainberg | lbragstad: and I apologize if my comment didn't make sense in the key rotation bits because it was super late when I reviewed that last night. | 15:11 |
| *** mattfarina has joined #openstack-keystone | 15:11 | |
| lbragstad | morganfainberg: no worries, I tried addressing them | 15:11 |
| morganfainberg | Thanks. | 15:11 |
| morganfainberg | Looking now. | 15:11 |
| morganfainberg | lbragstad: no need to split this up more. My comment about could have been separate was more future looking. | 15:14 |
| morganfainberg | lbragstad: btw. | 15:14 |
| lbragstad | morganfainberg: cool, works for me. This should get easier when the first commit goes through since we can start working things in parallel | 15:15 |
| morganfainberg | Yes. | 15:15 |
| dstanek | lbragstad: the user_id/group_id stuff concerns me a little, but i think it's really close | 15:16 |
| lbragstad | dstanek: cool, trying to address that now | 15:16 |
| dstanek | it seems like they should both be specified or that's an error | 15:16 |
| dstanek | lbragstad: probably shouldn't have defaults for them in the function signature since that really are not optional | 15:17 |
| *** nellysmitt has quit IRC | 15:19 | |
| *** markvoelker has quit IRC | 15:21 | |
| *** markvoelker has joined #openstack-keystone | 15:21 | |
| *** krykowski has quit IRC | 15:22 | |
| dstanek | lbragstad: is https://review.openstack.org/#/c/158414/7 really something that was forgotten in the parent patch? meaning if you deleted a token it would fail for KLWT | 15:23 |
| lbragstad | dstanek: it could live in the parent patch, but that patch was growing | 15:24 |
| lbragstad | and revocation needs that one line change in provider.py | 15:24 |
| dstanek | i'm not sure i understand how it allows then to take advantage or revocation events - is it that they were broken in the first patch then? | 15:24 |
| lbragstad | dstanek: there wasn't any revocation testing done in the first patch | 15:25 |
| dstanek | ok, the comment in the commit message threw me off because i expected something to me changed that looked like it enabled revocation events. not a big deal | 15:26 |
| *** markvoelker has quit IRC | 15:26 | |
| dstanek | lbragstad: my guess is that the delete is broken in the first patch and that you'd get a 404 or something because the token wasn't in the database | 15:27 |
| lbragstad | correct | 15:27 |
| dstanek | lbragstad: what do you think is needed in the middleware? | 15:28 |
| *** kallebe has quit IRC | 15:28 | |
| lbragstad | dstanek: I didn't the revocation stuff in middleware knew how to pull the latest revocation list | 15:28 |
| lbragstad | I didn't think* | 15:28 |
| morganfainberg | dstanek: middleware should consume events. Right now if someone enables caching and uses klwt no revokes will ever happen for cached tokens. | 15:29 |
| morganfainberg | So middleware needs to learn to pull events and process them. Like the TRL. | 15:29 |
| dstanek | morganfainberg: that's not a klwt problem though, right? | 15:30 |
| morganfainberg | It is a use events problem. Prior to klwt most people used TRL only. Now we force using events. | 15:31 |
| morganfainberg | Which creates a gap. So no not exclusively a klwt issue. | 15:31 |
| dstanek | that's what i thought, just wanted to make sure my understanding was still correct | 15:32 |
| morganfainberg | lbragstad: you addressed the major comments I had. | 15:34 |
| morganfainberg | lbragstad: looks pretty close. | 15:35 |
| dstanek | i didn't realize that patchset 24 had lots of commentary | 15:35 |
| lbragstad | morganfainberg: cool, finishing up dstanek's comments quick | 15:35 |
| morganfainberg | Yep. | 15:36 |
| lbragstad | yeah, ps 24 was a good iteration | 15:36 |
| dstanek | so is this being marked as experimental? | 15:36 |
| morganfainberg | dstanek: ideally yes. | 15:36 |
| morganfainberg | With the hope that next cycle we can make it stable / default. | 15:37 |
| dstanek | is that just a documentation thing or do was have a clever code was of doing it too? | 15:37 |
| morganfainberg | Doc thing. | 15:37 |
| morganfainberg | I don't want to make clever code things if we can avoid it :) | 15:37 |
| dstanek | i didn't know if you wanted to have the deployer or user specifically allow it | 15:38 |
| dstanek | i guess the user already is since that's what they are requesting | 15:38 |
| morganfainberg | Experimental stuff is mostly a deployer choice to enable and a user choice to either use that cloud or api. But since this has no api changes, the user can't know short of a wierd token coming back. | 15:40 |
| dstanek | lbragstad: what's with the adding {} around the UUID strings? | 15:40 |
| morganfainberg | For apis they should show up in json home marked as experimental | 15:40 |
| lbragstad | dstanek: is there a better way to do that? | 15:41 |
| dstanek | doesn't uuid.UUID(uuid_string) work? | 15:42 |
| dstanek | lbragstad: one last question and then i'll leave you alone for the day :-D | 15:45 |
| lbragstad | dstanek: checking quick | 15:45 |
| dstanek | lbragstad: line 152 -> https://review.openstack.org/#/c/159229/5/keystone/token/providers/klwt/token_formatters.py; what is happening that v2 is unicode and v3 is bytes? and is that the same in python3? | 15:46 |
| lbragstad | dstanek: I'm not sure why that it, I figured it was something with how v2 requests are routed versus v3? | 15:47 |
| lbragstad | is* | 15:47 |
| *** jorge_munoz has joined #openstack-keystone | 15:47 | |
| dstanek | lbragstad: i'll investigate today - i'm very curious | 15:48 |
| lbragstad | dstanek: I appreciate it | 15:48 |
| dstanek | lbragstad: OK i'm through all of those reviews - ping me if you need me | 15:49 |
| lbragstad | dstanek: sounds good, thanks! | 15:49 |
| dolphm | lbragstad: dstanek: i need to document key rotation a bit better, but i could probably also skip using 0 as a crutch (that made more sense in an earlier implementation, now it's just odd) | 15:50 |
| *** markvoelker has joined #openstack-keystone | 15:51 | |
| dolphm | lbragstad: dstanek: and concerning calculating settings, i was thinking about including a formula somewhere to act as a guide to tuning, based on the desired token lifetime and rotation frequency | 15:52 |
| lbragstad | dolphm: interesting, do you want that to live in Keystone? | 15:53 |
| dolphm | lbragstad: it would just be docs | 15:53 |
| lbragstad | dolphm: cool, that works for me | 15:53 |
| dstanek | dolphm: i think that's a good idea; i can see deployers getting confused when their keys expire early | 15:54 |
| dolphm | lbragstad: dstanek: i'm also leaning on renaming the "KLWT" to "Fernet," since that best represents the outward facing token format, and i looked at refactoring the token providers into "payload providers" and "format providers" | 15:55 |
| lbragstad | I agree with that | 15:55 |
| dolphm | lbragstad: dstanek: so theoretically, you could package up a UUID4 in a fernet token ... if you were so inclined | 15:56 |
| dolphm | or even swap Fernet for OAuth :D | 15:56 |
| lbragstad | that'd be cool | 15:56 |
| dstanek | that's neat | 15:56 |
| lbragstad | dolphm: wasn't your original POC with oauth? | 15:58 |
| dolphm | lbragstad: yep | 15:58 |
| *** kallebe has joined #openstack-keystone | 15:59 | |
| dolphm | lbragstad: the twist was that i included the secret key as part of the encrypted message in the access key, so the whole combo (secret key + access key) was entirely non persistent | 15:59 |
| openstackgerrit | David Stanek proposed openstack/keystone: Add parent_id to test_project_model https://review.openstack.org/159294 | 16:00 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes the SQL model tests https://review.openstack.org/159521 | 16:00 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes useless setup from SQL model tests https://review.openstack.org/159522 | 16:00 |
| lbragstad | dolphm: ah, nice | 16:00 |
| *** mikedillion has joined #openstack-keystone | 16:03 | |
| *** himangi has joined #openstack-keystone | 16:03 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 16:04 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 16:04 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 16:04 |
| lbragstad | jorge_munoz: rebase while it's hot! ^ | 16:04 |
| dstanek | dolphm: that's what happens when i get bored in the middle of the night - i fix inconsequential test problems | 16:04 |
| *** sigmavirus24 is now known as Slackwarebot | 16:07 | |
| *** Slackwarebot is now known as sigmavirus24 | 16:07 | |
| *** himangi has quit IRC | 16:08 | |
| *** himangi has joined #openstack-keystone | 16:08 | |
| *** mikedillion has quit IRC | 16:11 | |
| *** himangi has quit IRC | 16:12 | |
| openstackgerrit | Ihar Hrachyshka proposed openstack/oslo.policy: Expose register decorator as part of public API https://review.openstack.org/159525 | 16:12 |
| *** himangi has joined #openstack-keystone | 16:13 | |
| jorge_munoz | lbragstad: will do, thanks | 16:13 |
| morganfainberg | dstanek: some day I'll write code again >.> | 16:14 |
| morganfainberg | These days I sleep in the middle of the night. :P | 16:14 |
| *** ljfisher has quit IRC | 16:18 | |
| openstackgerrit | Ihar Hrachyshka proposed openstack/oslo.policy: Expose register decorator as part of public API https://review.openstack.org/159525 | 16:20 |
| *** ljfisher has joined #openstack-keystone | 16:21 | |
| *** dhague has joined #openstack-keystone | 16:23 | |
| *** gyee has joined #openstack-keystone | 16:24 | |
| *** ChanServ sets mode: +v gyee | 16:24 | |
| raildo | morganfainberg, we are with a doubt in the API call returns for domains... if I use GET /domains/ we have to return the domain's body as works today, or we can add the others field related to a project is_domain (parent_id, is_domain) | 16:25 |
| morganfainberg | raildo: you could add extra fields, but you cannot break what is there today. Is_domain shouldn't leak out from the v3 domains interface, if it isn't a domain you can't reference it there. | 16:27 |
| morganfainberg | Since everything on v3/domain should be a domain everything will have is_domain. Silly to add it to the on-the-wire data structure right? | 16:28 |
| *** david-lyle_afk is now known as david-lyle | 16:36 | |
| *** joesavak has quit IRC | 16:37 | |
| raildo | morganfainberg, right, I'm just with rodrigods if we will have some gain put this informations in the domains API, but maybe the parent_id can be useful in the future. | 16:38 |
| morganfainberg | Maybe in the future doesn't sound like a resounding reason to add data to the structure via that api. | 16:39 |
| morganfainberg | We can always add data when it becomes useful. Removing data from an api is hard. | 16:40 |
| *** rushiagr is now known as rushiagr_away | 16:40 | |
| raildo | morganfainberg, right. :) we don't intend remove and data, its more to add something, but for now we will not change this. | 16:41 |
| raildo | s/and/any | 16:42 |
| morganfainberg | Sounds good. | 16:42 |
| *** himangi has quit IRC | 16:42 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes the SQL model tests https://review.openstack.org/159521 | 16:44 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes useless setup from SQL model tests https://review.openstack.org/159522 | 16:44 |
| *** stevemar has joined #openstack-keystone | 16:44 | |
| *** ChanServ sets mode: +v stevemar | 16:44 | |
| *** himangi has joined #openstack-keystone | 16:46 | |
| raildo | morganfainberg, think more about this, we will have a gain now, because we can list subdomains using the parent_id and list the root domains when this parent_id is None. so I think that is a good reason to add the parent_id in the domain API. | 16:46 |
| *** rushiagr_away is now known as rushiagr | 16:47 | |
| *** pcaruana has quit IRC | 16:50 | |
| *** joesavak has joined #openstack-keystone | 16:50 | |
| *** rwsu-afk is now known as rwsu | 16:50 | |
| *** amakarov is now known as amakarov_away | 16:51 | |
| *** afazekas_ is now known as afazekas | 17:00 | |
| *** jistr has quit IRC | 17:02 | |
| *** jsavak has joined #openstack-keystone | 17:05 | |
| *** lsmola has quit IRC | 17:06 | |
| *** joesavak has quit IRC | 17:08 | |
| *** joesavak has joined #openstack-keystone | 17:09 | |
| *** jsavak has quit IRC | 17:10 | |
| *** andreaf_ has joined #openstack-keystone | 17:19 | |
| *** nellysmitt has joined #openstack-keystone | 17:20 | |
| *** andreaf_ has quit IRC | 17:20 | |
| *** _cjones_ has joined #openstack-keystone | 17:21 | |
| *** htruta has quit IRC | 17:22 | |
| openstackgerrit | Ihar Hrachyshka proposed openstack/oslo.policy: Expose stuff used in Neutron as part of public API https://review.openstack.org/159525 | 17:23 |
| *** htruta has joined #openstack-keystone | 17:24 | |
| ayoung-mtg | The problems with Tokens as a one act play: http://adam.younglogic.com/2015/02/three-types-of-tokens/ | 17:25 |
| *** nellysmitt has quit IRC | 17:25 | |
| *** pdesai has joined #openstack-keystone | 17:35 | |
| *** jsavak has joined #openstack-keystone | 17:37 | |
| *** karimb has quit IRC | 17:39 | |
| *** joesavak has quit IRC | 17:39 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 17:40 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 17:40 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 17:40 |
| *** lhcheng has joined #openstack-keystone | 17:41 | |
| *** nellysmitt has joined #openstack-keystone | 17:41 | |
| *** karimb has joined #openstack-keystone | 17:43 | |
| stevemar | ayoung-mtg, bravo | 17:43 |
| *** karimb has quit IRC | 17:43 | |
| *** ayoung-mtg is now known as ayoung | 17:44 | |
| ayoung | stevemar, trying really hard to not put the audience to sleep | 17:44 |
| ayoung | stevemar, OK...dumb idea time: | 17:46 |
| ayoung | What if...when we validated a token, we created a dictionary, that was to be consumde by Nova (etc) | 17:46 |
| ayoung | the dictionary says: for glance, use this token, for Cinder, use that one, and for Neutron this other one | 17:47 |
| stevemar | ayoung, it was really funny, i liked it | 17:47 |
| ayoung | then...when Nova validates a user's token...the response comes back with a bunch of other tokens | 17:47 |
| ayoung | Assuming we had endpoint binding in place, the new tokens would then be bound to each of the other endpoints. | 17:48 |
| stevemar | could work, whats the gain? | 17:48 |
| ayoung | The only change Nova would have to make is that, instead of reusing one token, it would select the token for the appropriate endpoint. | 17:48 |
| ayoung | stevemar, .... I'm trying to deal with delelgation, and making sure that we only delegate what we need to | 17:49 |
| ayoung | and I'm trying to havea light touch | 17:49 |
| ayoung | gah... | 17:49 |
| ayoung | OK...I was trying to get away from the user trying to get a token at all | 17:49 |
| ayoung | and instead just going direct to Nova and saying "use this project" | 17:50 |
| ayoung | and then Nova going to Keystone to say "give me roles for user X on project Y" | 17:50 |
| ayoung | we make an implied rule that says when Nova does that, it can request a token for the user that matches. | 17:50 |
| ayoung | It means that Nova still has a lot of power...it could fake a request for a token scoped to a different project | 17:51 |
| stevemar | the user would still need a token for the initial call to nova? no? | 17:51 |
| ayoung | I'm trying to break the "bearerness" of tokens | 17:51 |
| ayoung | Yeah...in the above, they would | 17:51 |
| ayoung | Nova needs something to hand to Keystone to prove the user was really there.... | 17:52 |
| ayoung | and I don;t want to shove PKI down everyones gullet | 17:53 |
| ayoung | stevemar, morganfainberg has, at one point, suggested signed requests. It would be like a PKI token, but instead of the token being signed, the whole request to Nova would be signed. It would not have the roles information in it, as that would still have to belooked up, but it would allow nova to both authenticate the user as well as prove to another service that the user actually contacted Nova | 17:55 |
| ayoung | Doing it from the CLI is not that hard, but doing it via Horizon is impractical | 17:56 |
| ayoung | stevemar, No silver bullet there, either | 17:57 |
| stevemar | signed requests was an interesting concept, i remember morganfainberg bringing it up | 17:57 |
| stevemar | it seemed like oauth | 17:57 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 17:57 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 17:57 |
| morganfainberg | It is like oauth-ish | 17:57 |
| stevemar | i'm just not sure how much is gained by nova doing actions and getting tokens | 17:57 |
| stevemar | on the plus side, it should be mostly middleware changes :D | 17:58 |
| morganfainberg | It is impractical unless we fix how we talk to services via other services. :( | 17:58 |
| *** pdesai1 has joined #openstack-keystone | 17:59 | |
| dstanek | lbragstad: you around still? | 18:00 |
| ayoung | stevemar, OAuth absolutely could be made to work, but it would be more invasive | 18:00 |
| ayoung | stevemar, image the scenario where Nova and CInder are managed and operated by different organizations. Where a user wnated to make sure that no more resources were used than paid for, and the Nova admins were not implicitly trusted | 18:01 |
| ayoung | So, while I can send a token to Nova to mount a Cinder Volume, the Cinder admin wants to know that *I* actually requested that | 18:02 |
| *** pdesai has quit IRC | 18:02 | |
| ayoung | IN an Oauth setup, I would first go to Cinder, get an Oauth delegation setup, and pass that delegation to Nova along with my request | 18:03 |
| ayoung | TOday, we don't make users do that. Keystone is the sole source of delegation | 18:03 |
| *** spandhe has joined #openstack-keystone | 18:03 | |
| stevemar | lhcheng, first ever osc meeting in -meeting :D | 18:04 |
| lhcheng | stevemar, nice! see you there :D | 18:05 |
| *** Ctina has joined #openstack-keystone | 18:06 | |
| openstackgerrit | Ben Nemec proposed openstack/oslo.policy: Add missing space to help message https://review.openstack.org/159558 | 18:09 |
| *** afazekas has quit IRC | 18:16 | |
| dstanek | dolphm: lbragstad: just yell at me if you think i'm being too picky on https://review.openstack.org/#/c/145317/ | 18:17 |
| *** browne has joined #openstack-keystone | 18:18 | |
| *** pnavarro__ has quit IRC | 18:24 | |
| stevemar | bknudson, dstanek i figured you both would be interested in https://review.openstack.org/#/c/159347/ | 18:27 |
| dstanek | well i like the title! | 18:28 |
| *** henrynash has joined #openstack-keystone | 18:32 | |
| *** ChanServ sets mode: +v henrynash | 18:32 | |
| *** MasterPiece has joined #openstack-keystone | 18:34 | |
| dstanek | morganfainberg: i only work late nights because these tests take so long to execute | 18:34 |
| morganfainberg | Yeah. | 18:35 |
| ayoung | failures=25 | 18:35 |
| *** tqtran has joined #openstack-keystone | 18:35 | |
| ayoung | morganfainberg, so with accessinfo, I found a whole body of tests that were not going through the factory. Once I started using them, I found a bunch more I had broken. I'm now down to 25 not working..but date handling is going to be much better | 18:36 |
| morganfainberg | ayoung: nice. | 18:36 |
| ayoung | Something is going on with arg passing, as I now get these | 18:36 |
| ayoung | TypeError: factory() takes at most 5 arguments (75 given) | 18:36 |
| ayoung | something about a dictionary I am guessing | 18:37 |
| morganfainberg | 75 given. Hah. | 18:37 |
| morganfainberg | Gah. | 18:37 |
| ayoung | morganfainberg, what confuses me is I thought I hadn't changed the interface to the factory methof | 18:38 |
| ayoung | method | 18:38 |
| ayoung | def factory(cls, resp=None, body=None, region_name=None, auth_token=None, | 18:38 |
| ayoung | **kwargs) | 18:38 |
| ayoung | but it is called as | 18:38 |
| ayoung | self.auth_ref = access.AccessInfo.factory(*resp) | 18:38 |
| dstanek | wasn't there a review to get rid of the old XML testing stuff? | 18:44 |
| *** grantbow has quit IRC | 18:44 | |
| *** grantbow has joined #openstack-keystone | 18:46 | |
| *** gyee has quit IRC | 18:48 | |
| *** arunkant_ has joined #openstack-keystone | 18:49 | |
| *** dims_ has joined #openstack-keystone | 18:51 | |
| *** dims_ has quit IRC | 18:53 | |
| *** dims_ has joined #openstack-keystone | 18:54 | |
| *** dims has quit IRC | 18:55 | |
| ayoung | dstanek, I'm stumped. see my comments just above yours | 18:58 |
| ayoung | I have not changed the method signature, nor the calling function | 18:59 |
| ayoung | but somehow, I broke that | 18:59 |
| dstanek | ayoung: was it always called with the *? | 18:59 |
| ayoung | yes | 19:00 |
| ayoung | dstanek, doing a git show --stat I see I have not changed the calling file | 19:01 |
| lbragstad | dstanek: responded inline https://review.openstack.org/#/c/145317/ | 19:01 |
| ayoung | File "keystoneclient/httpclient.py", line 508, in authenticate | 19:01 |
| ayoung | self.auth_ref = access.AccessInfo.factory(*resp) | 19:01 |
| *** tqtran_ has joined #openstack-keystone | 19:01 | |
| *** pdesai has joined #openstack-keystone | 19:01 | |
| ayoung | [ayoung@ayoung530 python-keystoneclient (issued-at-rebased)]$ git show --stat | grep httpclient | 19:02 |
| ayoung | dstanek, maybe it is passed through from outside? | 19:02 |
| dstanek | is it possible that resp was a tuple of a tuple of 75 things? ((.....),) | 19:02 |
| *** tqtran has quit IRC | 19:03 | |
| *** pdesai1 has quit IRC | 19:03 | |
| ayoung | dstanek, maybe it comes from the data used in the test? | 19:04 |
| ayoung | dstanek, I can check...let's see | 19:04 |
| dstanek | lbragstad: haha, me too | 19:05 |
| ayoung | dstanek, I got it | 19:05 |
| ayoung | My AccessInfo is no longer descended from the base on, and the following test changes | 19:06 |
| dstanek | lbragstad: if the user can configure user_id or group_id as empty string or None (i don't know if they can) then that code would be broken | 19:06 |
| ayoung | if isinstance(resp, access.AccessInfo): | 19:06 |
| ayoung | self.auth_ref = resp | 19:06 |
| ayoung | else: | 19:06 |
| ayoung | self.auth_ref = access.AccessInfo.factory(*resp) | 19:06 |
| ayoung | OK..I'm good | 19:06 |
| lbragstad | dstanek: ah, yep | 19:07 |
| lbragstad | http://cdn.pasteraw.com/l3efoup8oxjpbww9ttjyt3qmb5g88sb | 19:07 |
| ayoung | failures=21 | 19:11 |
| samueldmq | henrynash, ping - have a question regarding driver_hints | 19:12 |
| henrynash | samueldmq: shoot | 19:12 |
| samueldmq | henrynash, is that an easy way to check if an arbitrary entity (a project, for instance) satisfy filters ? | 19:12 |
| lbragstad | dstanek: I can't seem to pass empty strings in for those values? | 19:12 |
| samueldmq | henrynash, ok a bit of background .. | 19:12 |
| samueldmq | henrynash, I have list_projects on ldap resource... it should return the filtered projects + the is domain project (which isnt stored in ldap, as the domain isnt) | 19:13 |
| samueldmq | henrynash, so I filter and add the is domain project, *if* it satisfies provided filters ... makes sense? | 19:14 |
| dstanek | lbragstad: yeah, i may be being too pedantic here | 19:15 |
| henrynash | samueldmq: and why does it matter whether the filter was satis fied or not…why don’t you just add it in as long as it satisfies the filter (which would would check BEFORE you call the ldap backend) | 19:16 |
| henrynash | samueldmq: ahh, I suppos you’d have to apply the filter manually, duplicating the logic.... | 19:16 |
| samueldmq | henrynash, exactly | 19:17 |
| *** MasterPiece has quit IRC | 19:17 | |
| dstanek | lbragstad: http://paste.openstack.org/show/182607/ am i calling it wrong? | 19:17 |
| samueldmq | henrynash, look http://paste.openstack.org/show/182608/ | 19:17 |
| henrynash | samueldmq: so the filtering IS duplicated anyway…the log is in the v3controller class….so you could refact or that and call that on your list of one, and if there is anything left in your list afterwards, you add it into the list taht is returned from teh backend driver | 19:18 |
| samueldmq | henrynash, if is_domain filter is true, it's easy to do so ... but for other filters ... manually :/ | 19:18 |
| lbragstad | dstanek: ahh, makes sense | 19:18 |
| samueldmq | henrynash, I think this is dirty ... since the backend should honor filters it knows ... | 19:19 |
| samueldmq | henrynash, and it would be possibly returning something that does not match the filters | 19:19 |
| henrynash | samueldmq: it will…I’m not saying you take it out…but do something like | 19:19 |
| ayoung | failures=19 | 19:20 |
| henrynash | 1) before calling the backend, copy the hints object | 19:20 |
| henrynash | 2) call the bacend and get the filtered list of real projects | 19:20 |
| samueldmq | henrynash, yes because it removes the filters it honors | 19:20 |
| henrynash | 3) now called v3controller.filter_by_attributes, pass iyour copued hints object and you own list of one fake project | 19:21 |
| samueldmq | henrynash, this case is just for ldap, since we store the is_domain project in sql .... sql already returns everything ok | 19:21 |
| henrynash | 4) if there is an item in tnelist after that, then add it to the response from teh backend and then pass back | 19:21 |
| henrynash | teh only issue is you DON’t want to call a controller class….you’d probably have to refactor the filter_by_attributes to put it somewhere it can be called by either place | 19:22 |
| henrynash | a bit yukky, i know | 19:22 |
| samueldmq | henrynash, I could add the v3controller call here https://github.com/openstack/keystone/blob/master/keystone/resource/backends/ldap.py#L194-L196 | 19:23 |
| dstanek | ayoung: getting closer! | 19:23 |
| henrynash | samueldmq: sorry, just taking a call… | 19:24 |
| samueldmq | henrynash, it would be still more yukky, but would keep backends behavior conssitent, since sql already works pretty well | 19:24 |
| samueldmq | henrynash, ok np, already have the info I need, thanks ! | 19:24 |
| henrynash | samueldmq: not quite sure about putting it in the ldap code itself…. | 19:25 |
| *** himangi has quit IRC | 19:26 | |
| *** dhague has quit IRC | 19:28 | |
| lbragstad | dstanek: figure out what you meant | 19:28 |
| lbragstad | figured* | 19:28 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 19:29 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 19:29 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 19:29 |
| *** raildo has quit IRC | 19:35 | |
| *** leonchio_ has joined #openstack-keystone | 19:39 | |
| *** raildo has joined #openstack-keystone | 19:40 | |
| leonchio_ | hello, guys, I have a patch https://review.openstack.org/#/c/156870/ some test cases failed at the gate and I tried to rerun it with 'recheck no bug' and it does not seem to it? | 19:42 |
| leonchio_ | another thing from the failed cases is that it actually complains an import error, like | 19:43 |
| leonchio_ | File "/opt/stack/new/keystone/keystone/common/ldap/core.py", line 23, in <module> | 19:43 |
| leonchio_ | 2015-02-26 19:04:48.307236 import ldap.filter | 19:43 |
| leonchio_ | 2015-02-26 19:04:48.307261 ImportError: No module named ldap.filter | 19:43 |
| leonchio_ | that should been a merged code, I'm not sure why it complains ldap.filter, anyone has any clues? | 19:44 |
| *** pdesai has quit IRC | 19:44 | |
| samueldmq | leonchio_, regarding jenkins ... I think ours is quite broken, it might be people from infra working on that | 19:45 |
| samueldmq | leonchio_, regarding the import error .... is that in the same patch? | 19:45 |
| samueldmq | leonchio_, doesnt look to be, since gate-keystone-python27 is passing | 19:45 |
| leonchio_ | samueldmg, yeah, that's the same patch | 19:45 |
| samueldmq | leonchio_, ok, I will try to run the tests by myself, just a minute | 19:46 |
| leonchio_ | samueldmg, thx for looking into it | 19:46 |
| samueldmq | np | 19:46 |
| dolphm | dstanek: did you have any unaddressed questions on key rotation? | 19:46 |
| dolphm | dstanek: wondering where i should put effort on that piece next | 19:47 |
| dolphm | dstanek: documentation, functional tests, or change the approach? | 19:47 |
| morganfainberg | samueldmq, leonchio_ : http://logs.openstack.org/70/156870/7/check/check-tempest-dsvm-full/a6613c9/logs/apache/keystone.txt.gz#_2015-02-26_19_10_58_214130 | 19:47 |
| morganfainberg | which is related to: http://logs.openstack.org/70/156870/7/check/check-tempest-dsvm-full/a6613c9/logs/apache/keystone.txt.gz#_2015-02-26_19_09_22_531197 | 19:48 |
| morganfainberg | ah | 19:48 |
| morganfainberg | you found it. | 19:48 |
| samueldmq | hmm.. | 19:49 |
| dstanek | dolphm: i think one or two questions...jas | 19:49 |
| samueldmq | morganfainberg, this is imported from python right? | 19:49 |
| morganfainberg | samueldmq, python-ldap | 19:49 |
| samueldmq | morganfainberg, at least mines import from .tox/py27/../site-packages ... | 19:50 |
| dolphm | dstanek: i read through your comments from the last few patchsets, but didn't see anything left outstanding. what are they? | 19:50 |
| samueldmq | morganfainberg, exactly, python-ldap then :) | 19:50 |
| morganfainberg | samueldmq, not sure why you're hitting that and not hitting something else somewhere | 19:50 |
| morganfainberg | but i've seen that before | 19:50 |
| morganfainberg | is this change not rebased? | 19:50 |
| samueldmq | morganfainberg, is this affecting someone else? | 19:51 |
| morganfainberg | no i mean the ldap.filter bit | 19:51 |
| samueldmq | morganfainberg, leonchio_ is getting this error | 19:51 |
| morganfainberg | don't see why that is happening | 19:51 |
| samueldmq | morganfainberg, me neither, looks like his .tox environment is broken | 19:51 |
| morganfainberg | except i'm seeing it in gate? | 19:51 |
| dstanek | dolphm: no it looks like you answered it...does that mean the first rotate is always broken? | 19:52 |
| samueldmq | morganfainberg, hmm sure, your pastes from the gate .... | 19:52 |
| dolphm | dstanek: no, it'll just use key 0 as the primary | 19:52 |
| dolphm | dstanek: so, on setup, you'll just get a key 0, and that's your primary | 19:52 |
| dstanek | and then rotate 0 -> 1, but that won't actually rotate | 19:52 |
| samueldmq | morganfainberg, maybe the gate is failing to install some dependencies on the venv ? jenkins look to be so broken, it's failing too much | 19:53 |
| dstanek | seems like the setup should generate 2 keys - one for current primary and one for next primary | 19:53 |
| morganfainberg | samueldmq, unlikely | 19:53 |
| dolphm | dstanek: ahh, i see what you mean | 19:53 |
| dolphm | dstanek: i agree. simplest fix would be to add a rotate to KLWTSetup? https://review.openstack.org/#/c/145317/28/keystone/cli.py | 19:54 |
| morganfainberg | samueldmq, because https://review.openstack.org/#/c/145317/ passed gate 1h ago | 19:54 |
| leonchio_ | samueldmq morganfainberg I actually got this since last night :( | 19:55 |
| morganfainberg | leonchio_, so something in your patch is causing it | 19:55 |
| dolphm | dstanek: might also be worth rewriting it to always increment, never use 0 more than once, and always select the second key in the list as the primary (if there are at least two) | 19:55 |
| morganfainberg | likely there is an import error you're not seeing | 19:55 |
| morganfainberg | causing something to be obscured | 19:55 |
| morganfainberg | remember unit tests don't test through apache | 19:55 |
| morganfainberg | leonchio_, once i've had coffee and food i can help dig into this and see what is going on | 19:56 |
| leonchio_ | samueldmq morganfainberg, ok, that's great. since all the test passed on my local env | 19:56 |
| *** kallebe has left #openstack-keystone | 19:56 | |
| morganfainberg | leonchio_, you'd need to run devstack to find the issue. unit tests don't run keystone in the same way | 19:56 |
| samueldmq | leonchio_, k np, will try to dig a bit | 19:56 |
| morganfainberg | this is why we do devstack + tempest :) | 19:57 |
| leonchio_ | samueldmq morganfainberg ok, will try to run devstack and see :) | 19:57 |
| *** justincampbell has joined #openstack-keystone | 19:57 | |
| dolphm | dstanek: also, lbragstad wrote def _convert_to_integers(keystone_user_id, keystone_group_id) ... i don't quite understand whatthat's guarding against | 19:57 |
| morganfainberg | dolphm, non-string int represenations | 19:58 |
| morganfainberg | you *probably* should never have that happen | 19:58 |
| dolphm | morganfainberg: from where? | 19:58 |
| dstanek | dolphm: : http://paste.openstack.org/show/182607/ | 19:58 |
| morganfainberg | conf. | 19:58 |
| morganfainberg | oh cli | 19:58 |
| stevemar | leonchio_, morganfainberg | 19:58 |
| stevemar | <leonchio_> samueldmq morganfainberg ok, will try to run devstack and see :) | 19:58 |
| stevemar | <dolphm> dstanek: also, lbragstad wrote def _convert_to_in | 19:58 |
| morganfainberg | cli opts don't work quite the same as conf opts | 19:58 |
| stevemar | errr | 19:58 |
| stevemar | http://logs.openstack.org/70/156870/7/check/check-tempest-dsvm-full/a6613c9/logs/apache/keystone.txt.gz | 19:58 |
| dolphm | morganfainberg: well, they can come from CONF or CLI, but ... the ints are provided on L119 on the right https://review.openstack.org/#/c/145317/28/keystone/cli.py | 19:59 |
| stevemar | leonchio_, your error is coming from there | 19:59 |
| morganfainberg | stevemar, uhm. | 19:59 |
| morganfainberg | stevemar, yes. i was just pointing that out to him ;) | 19:59 |
| dolphm | morganfainberg: L117* | 19:59 |
| morganfainberg | dolphm, oh does utils.get_unix_* not return an int | 19:59 |
| morganfainberg | cause... | 20:00 |
| dstanek | dolphm: only is they are provided | 20:00 |
| morganfainberg | oh | 20:00 |
| morganfainberg | hm | 20:00 |
| dolphm | dstanek: they're either int or None, right? | 20:00 |
| dstanek | if you don't provide a command line opt then it's None and get_user_group will happily return None | 20:00 |
| leonchio_ | stevemar morganfainberg, so he meant i have to run devstack, right, just tried to get ti right ;) | 20:00 |
| dstanek | dolphm: yes | 20:00 |
| dolphm | dstanek: so drop the _convert_to_ints() ? | 20:01 |
| *** Ctina_ has joined #openstack-keystone | 20:01 | |
| dstanek | dolphm: i think that was just the way to make sure the args are both provided - my original comment was the geteuid/gid where broken because of the possibility of a None value | 20:02 |
| dolphm | dstanek: i saw that. the 'or' should have been an 'and' | 20:02 |
| dstanek | dolphm: you could guard using 'if not keystone_user_id and keystone_group_id: raise ... | 20:02 |
| dolphm | dstanek: at least, i assumed that would be the fix | 20:02 |
| dolphm | not (x and y) | 20:02 |
| morganfainberg | dolphm, ++ | 20:03 |
| *** himangi has joined #openstack-keystone | 20:03 | |
| dstanek | dolphm: if the test fails you also want an error message to the user - you wouldn't want to just skip the permission modifications | 20:03 |
| dolphm | dstanek: ++ | 20:03 |
| dstanek | oops, yes parens | 20:03 |
| morganfainberg | dolphm, slightly related: are we renaming klwt? | 20:03 |
| morganfainberg | dolphm, because i'd like to tee that up if we can. | 20:04 |
| morganfainberg | we we are going to do that | 20:04 |
| dolphm | morganfainberg: yeah, so i wrote a bunch of junk to explain each token in terms of the token's payload and transport format | 20:04 |
| dolphm | morganfainberg: and we tend to name tokens after their transport format, not the payload | 20:05 |
| morganfainberg | right. | 20:05 |
| dolphm | morganfainberg: so i'd propose we rename klwt (which is describing the payload: msgpack) to Fernet (the transport format) | 20:05 |
| * morganfainberg is not opposed to that | 20:05 | |
| *** Ctina has quit IRC | 20:05 | |
| dolphm | morganfainberg: i also looked at refactoring the token providers into token payload providers + token format providers, where you could theoretically mix and match any payload with any containing format | 20:06 |
| dolphm | morganfainberg: it's a non-kilo refactor to say the least :) | 20:06 |
| *** Ctina_ has quit IRC | 20:06 | |
| dolphm | morganfainberg: but it would buy you msgpack + pki, for example | 20:06 |
| dolphm | which i think would make ayoung quite happy | 20:06 |
| morganfainberg | dolphm, figured. that was the direction i was mostly driving at with the cleanup of the provider..just taken 1 step further | 20:06 |
| dolphm | morganfainberg: yeah, we're not quite there yet | 20:07 |
| morganfainberg | dolphm, yep | 20:07 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 20:07 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 20:07 |
| ayoung | dolphm, sounds about right | 20:07 |
| morganfainberg | dolphm, so the question is ... are we renaming to fernet? | 20:07 |
| dolphm | morganfainberg: i'll propose a rename patch in the next 24 hours or so, separate from the existing impl (not sure what other changes lbragstad is making) | 20:07 |
| morganfainberg | ++ | 20:07 |
| morganfainberg | i think lbragstad is really close tbh | 20:07 |
| dolphm | morganfainberg: ++ | 20:07 |
| morganfainberg | he's working on the last couple comments from dstanek | 20:07 |
| dolphm | morganfainberg: i have some work to do for dstanek too :) | 20:08 |
| morganfainberg | and i think all the other major comments have been addressed. | 20:08 |
| morganfainberg | right. | 20:08 |
| * dolphm has to run - see ya'll in gerrit | 20:08 | |
| morganfainberg | in short, i think this can gate soon™ | 20:08 |
| dolphm | lol | 20:08 |
| morganfainberg | leonchio_, here | 20:09 |
| morganfainberg | leonchio_, https://review.openstack.org/#/c/156870/7/keystone/middleware/core.py line 23 on the right | 20:09 |
| morganfainberg | leonchio_, you're importing LDAP. | 20:09 |
| *** nellysmitt has quit IRC | 20:09 | |
| morganfainberg | leonchio_, https://github.com/openstack/keystone/blob/master/requirements.txt ldap is not in requirements | 20:10 |
| morganfainberg | you would need to either add ldap to requirements *or* install python-ldap directly | 20:10 |
| morganfainberg | leonchio_, ldap is optional | 20:10 |
| morganfainberg | and devstack doesn't install test-requires | 20:10 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 20:11 |
| leonchio_ | morganfainberg optional means it is installed, so what I need to do to get it there? | 20:12 |
| leonchio_ | morganfainberg it is not | 20:12 |
| morganfainberg | leonchio_, it needs to be in requirements.txt | 20:12 |
| samueldmq | morganfainberg, nice catch! I looked into test-requirements .... but didnt realize devstack install requirements since it's deploying keystone and not running testrs internally :p | 20:13 |
| morganfainberg | instead of test-requirements.txt | 20:13 |
| leonchio_ | morganfainberg, oh got it | 20:13 |
| morganfainberg | leonchio_, why are you importing LDAP btw? | 20:13 |
| morganfainberg | for tokenless auth? | 20:13 |
| samueldmq | morganfainberg, not instead I guess, but also :) | 20:13 |
| leonchio_ | morganfainberg yeah, i need to do a url escaped to the DNs | 20:13 |
| leonchio_ | morganfainberg the parser does not like the commas | 20:13 |
| morganfainberg | leonchio_, isn't this something we were planning on relying on apache to break apart cert stuff for us? | 20:14 |
| morganfainberg | vs. something that works in eventlet and apache ? | 20:14 |
| morganfainberg | i am 100% ok with eventlet not growing features like this btw. | 20:14 |
| leonchio_ | morganfainberg yeah but we need to define the trusted issue (DNs) in keystone.conf | 20:14 |
| leonchio_ | morganfainberg issuers | 20:15 |
| *** himangi has quit IRC | 20:15 | |
| morganfainberg | leonchio_, this again sounds like something that can be managed in apache modules | 20:15 |
| morganfainberg | via CA bundles. | 20:15 |
| leonchio_ | morganfainberg, like that's what needs to defined in keystone.conf trusted_issuers = emailAddress%3DuserA%40domainA.com%2CCN%3DuserA%2COU%3DprojectA%2CO%3DdomainA.com%2CL%3DSunnyvale%2CST%3DCalifornia%2CC%3DUS | 20:16 |
| leonchio_ | morganfainberg, having commas there won't work as the paser will not take it | 20:16 |
| morganfainberg | the option parser wont? | 20:17 |
| morganfainberg | or? | 20:17 |
| morganfainberg | the issue is ListOpt is the wrong option type | 20:17 |
| morganfainberg | this is a case where multistropt is correct | 20:18 |
| morganfainberg | for each trusted issuer you would have another line in your config | 20:18 |
| morganfainberg | trusted_issuer=<dn1> | 20:18 |
| morganfainberg | trusted_issuer=<dn2> | 20:18 |
| morganfainberg | etc | 20:18 |
| morganfainberg | putting massive url-encoded strings in the conf will make deployers scream at us. | 20:19 |
| morganfainberg | or requiring it | 20:19 |
| ayoung | leonchio_, what are you trying to do here? | 20:20 |
| * ayoung interested... | 20:21 | |
| ayoung | morganfainberg, would that be a domain specific config file? | 20:21 |
| leonchio_ | morganfainberg ayoung, we try to define a list of trusted issuers(DNs) in keystone.conf like issuers=[cn=a,o=foo] | 20:21 |
| ayoung | like: this domain can accept users with certs from that issuer over there? | 20:21 |
| leonchio_ | morganfainberg ayoung however the comma there causes the issue as it is a list | 20:22 |
| morganfainberg | ayoung, the whole extract info from a cert and use that to issue a token | 20:22 |
| morganfainberg | type thing | 20:22 |
| *** aix has quit IRC | 20:22 | |
| morganfainberg | or to validate a token (more to the point) | 20:22 |
| leonchio_ | morganfainberg ayoung but the DN is seperated by coma | 20:22 |
| ayoung | morganfainberg, it is a mapping question, right? | 20:22 |
| morganfainberg | ayoung, well right now it's an issue where they are using a ListOpt, and listopts use comma dilmeters | 20:22 |
| morganfainberg | because what is cn=a,o=foo | 20:23 |
| leonchio_ | morganfainberg ayoung so all the coma in the DN is all url escaped in this case | 20:23 |
| ayoung | leonchio_, morganfainberg, this is specifically to authenticate users, right? | 20:23 |
| morganfainberg | ayoung, think so. i lost track of this spec tbh | 20:23 |
| leonchio_ | morganfainberg ayoung yesh, that's right | 20:23 |
| morganfainberg | this is the service user auths w/ a cert iirc | 20:23 |
| ayoung | leonchio_, have you been drinking :) | 20:23 |
| morganfainberg | ayoung, but asking a deployer to put url-encoded strings in configs = don't do that | 20:24 |
| ayoung | leonchio_, OK...here's a thought. Only allow one, but do it on a per domain basis | 20:24 |
| leonchio_ | morganfainberg ayoung drinking?! | 20:24 |
| morganfainberg | leonchio_, ^ | 20:24 |
| ayoung | then we could have a domain specific config file that has that trusted issuer in there? | 20:24 |
| morganfainberg | that would break i think because you need to specify drivers then for the domain config | 20:24 |
| ayoung | yesh,, driningsh | 20:24 |
| morganfainberg | this should work for non-domain-specific as well | 20:24 |
| morganfainberg | as in service users are just in domain X which is part of SQL driver | 20:25 |
| morganfainberg | since you can only have 1 SQL driver across keystone for all domains | 20:25 |
| ayoung | morganfainberg, but...it should be per domain. | 20:25 |
| ayoung | I would not want multiple signers for one domain | 20:25 |
| *** pdesai has joined #openstack-keystone | 20:25 | |
| morganfainberg | ayoung, we'd need to delay this into liberty for that, there are other issues to make that work | 20:25 |
| morganfainberg | ayoung, and i don't mind delaying it, but take that up with gyee before we do that | 20:26 |
| ayoung | morganfainberg, if we don't allow a list, though, this can make in to Liberia, right? | 20:26 |
| ayoung | leonchio_, do you *really* need multiple signers? | 20:26 |
| leonchio_ | morganfainberg ayoung basically apache configurations allow trusted CA to be specified, but what we do here is just a second level of trust | 20:27 |
| morganfainberg | ayoung, this can all make it into liberty regardless, we can work on other structural changes to make everything happy | 20:27 |
| ayoung | leonchio_, I get it | 20:27 |
| *** himangi has joined #openstack-keystone | 20:27 | |
| morganfainberg | ayoung, if it's trying to make it in Kilo we are limited in what we can support | 20:27 |
| leonchio_ | morganfainberg ayoung no, it doesn't have to be multiple | 20:27 |
| ayoung | morganfainberg, I meant Kilo | 20:27 |
| ayoung | lets go with one | 20:27 |
| morganfainberg | then if it's a single opt (stropt) we can say you get 1 signer | 20:28 |
| morganfainberg | easy | 20:28 |
| ayoung | and an eye to figuring out, in Listering how to do one per domain | 20:28 |
| ayoung | sorry. that should read Listerine | 20:28 |
| morganfainberg | leonchio_, so no url encoded options please... don't make me explain that one to anyone using this software ;) | 20:28 |
| leonchio_ | morganfainberg ayoung ok, sure we can just allow one but we thought supporting multiple would be a better options ;-) | 20:28 |
| morganfainberg | leonchio_, and use stropt. | 20:28 |
| morganfainberg | leonchio_, and only allow 1. | 20:29 |
| leonchio_ | morganfainberg ayoung, ok you got | 20:29 |
| leonchio_ | morganfainberg ayoung it | 20:29 |
| morganfainberg | leonchio_, make sure to mark this feature in documentation as experimental | 20:29 |
| leonchio_ | morganfainberg ayoung will do it | 20:29 |
| ayoung | leonchio_, not for one domain. The HTTPD server should allow multiple, but we should map singer->domain. richm nkinder make sense | 20:29 |
| morganfainberg | ayoung, that was my impression | 20:29 |
| ayoung | I like this. leonchio_ this is very cool | 20:30 |
| ayoung | thanks for doing | 20:30 |
| leonchio_ | morganfainberg ayoung cool, no problem | 20:30 |
| morganfainberg | ayoung, if you don't use per-domain backends you'll get 1 signer for all non-per-domain-driver domain | 20:30 |
| morganfainberg | ayoung, and that is where mapping should reject if there is no good way to map cert -> user in a sane way | 20:31 |
| morganfainberg | ayoung, i get the feeling this wont be super useful until we get the liberty changes in | 20:31 |
| morganfainberg | but it is an interesting direction for supporting service users | 20:31 |
| ayoung | morganfainberg, we need it for service users first, which means default domain | 20:31 |
| morganfainberg | ayoung. yeah | 20:31 |
| ayoung | morganfainberg, it will make Banks and SOX type people happy | 20:32 |
| ayoung | no passwords for Nova to talk to keystone | 20:32 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 20:32 | |
| morganfainberg | ayoung, oh exactly. i am just thinking it wont be super useful till we get liberty stuff. because service users shouldn't be ind efault domain ;) | 20:33 |
| morganfainberg | ayoung, they should be able to be in a service domain :) | 20:33 |
| morganfainberg | ayoung, it will def. fill a gap until then. and then become wwaaaaaaaaay better next cycle | 20:33 |
| *** himangi has quit IRC | 20:33 | |
| samueldmq | morganfainberg, hmm... just curious, domain service implies no password required for services? | 20:36 |
| morganfainberg | right you can use a client cert for nova to validate tokens with keystone | 20:36 |
| samueldmq | morganfainberg, so keystone use the nova cert to validate who 'nova' says to be is what we expect | 20:37 |
| samueldmq | morganfainberg, as in normal ssl workflow ... | 20:37 |
| morganfainberg | ayoung. dolphm, dstanek, lbragstad: https://review.openstack.org/#/c/159315/ about to press go on that and potentially press "point release" on ksc | 20:37 |
| morganfainberg | ayoung, dolphm, dstanek, lbragstad, that corrects the erroneous behavor that happens with say RAX cloud catalog | 20:37 |
| morganfainberg | where service "compute" is defined 2 times, with wildly different values | 20:37 |
| morganfainberg | now... i can't comprehend what should be done when "compute" != "compute" [the are different services] | 20:38 |
| samueldmq | morganfainberg, great! I did wonder why services can't just trust themselves and no passwd :) | 20:38 |
| morganfainberg | but that prevents novaclient et al from exploding | 20:38 |
| morganfainberg | because endpoints aren't found since we only ever allow the last entry in the catalog | 20:38 |
| morganfainberg | this all stems from us not being more picky about the catalog. | 20:39 |
| *** himangi has joined #openstack-keystone | 20:40 | |
| *** jorge_munoz has quit IRC | 20:46 | |
| ayoung | leonchio_, morganfainberg, this could still work with any domain, right? | 20:49 |
| ayoung | just we are limiting it to a single signer, but saying that the domain id comes from the ENV VARs is still possible | 20:49 |
| morganfainberg | sure. | 20:49 |
| morganfainberg | but to use a specific domain config you'd need that domain backed by something like LDAP or not be the default driver and be sql. | 20:50 |
| morganfainberg | where the default driver isn't sql | 20:50 |
| morganfainberg | so it's not as useful. | 20:50 |
| leonchio_ | morganfainberg ayoung yeah, I think so | 20:51 |
| ayoung | morganfainberg, the setup I saw yseterday (Puppetized) had and admin_domain specified, which was other than default. I am not sure where service users were going, but assume it was also not the default domain | 20:51 |
| ayoung | so in that case, you would reserve the X509 mechanism for service domain | 20:52 |
| morganfainberg | ayoung, so this would only work if that domain was backed by a per-domain config [if only that x509 would work in that domain] - OR it would apply to all domains provided mapping allowed it | 20:52 |
| morganfainberg | ayoung, which is what i was getting at for the liberty fixes. | 20:52 |
| ayoung | leonchio_, if you can get it to work with the multistropt I would have no objection | 20:52 |
| morganfainberg | the latter case would be if it's in the main config | 20:52 |
| leonchio_ | morganfainberg ayoung multistropt? not sure i understand that | 20:53 |
| ayoung | leonchio_, in config definition | 20:53 |
| ayoung | leonchio_, I'll link let me find it | 20:53 |
| morganfainberg | leonchio_ multistropt is where you define the option in the config file multiple times, and it makes a list out of them | 20:53 |
| morganfainberg | leonchio_, it's a different oslo config cfg opt type | 20:54 |
| morganfainberg | just like listopt is a type | 20:54 |
| leonchio_ | morganfainberg ayoung ok i got it, I've not tested that | 20:54 |
| ayoung | https://github.com/openstack/oslo.config/blob/master/oslo_config/types.py#L83 | 20:54 |
| ayoung | morganfainberg, we have any examples? | 20:54 |
| morganfainberg | ayoung, in the dogpile/kvs/cache stuff | 20:54 |
| ayoung | ++ | 20:55 |
| morganfainberg | https://github.com/openstack/keystone/blob/master/keystone/common/config.py#L296 | 20:55 |
| ayoung | leonchio_, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/config.py#n296 | 20:55 |
| ayoung | damn beaten to the punch | 20:55 |
| morganfainberg | ayoung, also the WebSSO stuff | 20:56 |
| leonchio_ | ayoung morganfainberg great, will look at that | 20:56 |
| ayoung | ++ | 20:56 |
| morganfainberg | ok i need coffee badly | 20:57 |
| morganfainberg | Keystone Developer Needs Coffee Badly </gauntlet> | 20:57 |
| *** morganfainberg is now known as needscoffee | 20:57 | |
| leonchio_ | morganfainberg, you got philz there?! i will need it too ;-) | 20:58 |
| needscoffee | leonchio_, in santa monica | 20:58 |
| needscoffee | but thats a 45m-2h drive depending on traffic | 20:58 |
| needscoffee | i have Urth Caffe | 20:58 |
| needscoffee | and Inteligentsia | 20:58 |
| leonchio_ | haha, we got one 10mins away | 20:58 |
| needscoffee | leonchio_, http://s3-media4.fl.yelpcdn.com/bphoto/J6PcCgprkKjQCFyaivCNaA/348s.jpg Bowl of coffee | 20:59 |
| needscoffee | this is a better picture of the general size: https://eatmecalifornia.files.wordpress.com/2009/08/spanish-latte.jpg | 21:00 |
| samueldmq | stevemar, ping - have question about notifications :p | 21:00 |
| leonchio_ | needscoffee ++ | 21:01 |
| *** rushiagr is now known as rushiagr_away | 21:06 | |
| stevemar | samueldmq, o/ | 21:10 |
| samueldmq | stevemar, I'd like to ask if notifications are sent when we enter a method .. independently if the method has failed or not | 21:11 |
| samueldmq | stevemar, it looks like yes | 21:11 |
| stevemar | samueldmq, depends on the notification, for authentication yes, for CRUD on resources, no | 21:12 |
| *** henrynash has quit IRC | 21:14 | |
| *** henrynash has joined #openstack-keystone | 21:15 | |
| *** ChanServ sets mode: +v henrynash | 21:15 | |
| samueldmq | stevemar, ok I'll check for resource CRUD, I think it send even if failed .... | 21:16 |
| samueldmq | stevemar, going to check .. | 21:16 |
| openstackgerrit | Ihar Hrachyshka proposed openstack/oslo.policy: Expose stuff used in Neutron as part of public API https://review.openstack.org/159525 | 21:20 |
| openstackgerrit | Ihar Hrachyshka proposed openstack/oslo.policy: Expose register and Check as part of public API https://review.openstack.org/159525 | 21:21 |
| needscoffee | stevemar: a couple open oslo.policy changes we need to land before tag. | 21:21 |
| stevemar | needscoffee, noooo | 21:22 |
| stevemar | samueldmq, nah https://github.com/openstack/keystone/blob/master/keystone/notifications.py#L110-L120 | 21:22 |
| needscoffee | Yep. Neutron can't adopt without some extra symbols exposed. | 21:22 |
| stevemar | needscoffee, thats fine, we deliberately made a lot things private | 21:23 |
| stevemar | so we can resurface as we need | 21:23 |
| needscoffee | Yes. I think register and the base check is all that is needed. | 21:23 |
| needscoffee | See the notice a few lines up? | 21:23 |
| samueldmq | stevemar, naaah, I tested it by myself as well ... | 21:23 |
| samueldmq | stevemar, I said bull**** | 21:23 |
| samueldmq | stevemar, thx | 21:23 |
| stevemar | marekd, do you think we should always make the token -> saml generation code have the ECP bits? | 21:24 |
| stevemar | i think this will help consume it | 21:24 |
| openstackgerrit | Merged openstack/oslo.policy: Add missing space to help message https://review.openstack.org/159558 | 21:26 |
| stevemar | marekd, gyee, needscoffee https://bugs.launchpad.net/keystone/+bug/1426128 | 21:28 |
| openstack | Launchpad bug 1426128 in Keystone "Add ECP related bits to saml generation code" [Undecided,New] | 21:28 |
| *** pdesai has quit IRC | 21:36 | |
| *** abhirc has joined #openstack-keystone | 21:37 | |
| *** abhirc has quit IRC | 21:45 | |
| *** pdesai has joined #openstack-keystone | 21:50 | |
| *** markvoelker has quit IRC | 21:51 | |
| *** markvoelker has joined #openstack-keystone | 21:51 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 21:53 |
| *** radez is now known as radez_g0n3 | 21:54 | |
| stevemar | ayoung, q about revoke_api | 21:54 |
| *** justincampbell has quit IRC | 21:54 | |
| ayoung | fire away | 21:54 |
| stevemar | whats up with all the if self.revoke_api: spots in the code? | 21:54 |
| stevemar | i thought it was _always_ ther | 21:55 |
| ayoung | It used to be an extension, optional depedency | 21:55 |
| stevemar | okay, that's what i had figured... theres one spot where it sets it to None | 21:55 |
| ayoung | so, nope. THe object might not have a revoke_api attribute | 21:55 |
| ayoung | where? | 21:55 |
| ayoung | link? | 21:56 |
| stevemar | in a test | 21:56 |
| *** markvoelker has quit IRC | 21:56 | |
| *** markvoelker has joined #openstack-keystone | 21:57 | |
| stevemar | https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_v3_assignment.py#L1182 | 21:57 |
| *** karimb has joined #openstack-keystone | 21:58 | |
| ayoung | GAH... everything expects things to be dictsm, not to act like dicts... whatever happend to the python fascination with duck typing? JSON marshalling code failing on me | 22:03 |
| *** gordc has quit IRC | 22:04 | |
| ayoung | stevemar, yeah, that is due to the fact that enabling extensions was done via paste and not config, no clean way to overload | 22:05 |
| *** rwsu has quit IRC | 22:06 | |
| needscoffee | ayoung: let's rewrite OpenStack in c++. Or Rust. Or Java! ;) | 22:06 |
| stevemar | dolphm, regarding your comment here: https://review.openstack.org/#/c/159347/2 | 22:06 |
| stevemar | i will remove the oauth conditional in that patch | 22:07 |
| stevemar | but i'll have to put a new one up for revoke_apis, it might need a bit more massaging | 22:07 |
| ayoung | needscoffee, don't say that too loud. THere is always someone that loves some other language more. | 22:08 |
| ayoung | needscoffee, I thought you could marshall any python object to JSON, though | 22:08 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use correct dependency decorator https://review.openstack.org/159347 | 22:08 |
| needscoffee | ayoung: you can if you have code that knows how that object is designed. :P | 22:08 |
| bknudson | pickle | 22:09 |
| *** jsavak has quit IRC | 22:10 | |
| needscoffee | bknudson: or use a thing like oslo objects or protobuf | 22:10 |
| *** henrynash has quit IRC | 22:10 | |
| *** henrynash has joined #openstack-keystone | 22:11 | |
| *** ChanServ sets mode: +v henrynash | 22:11 | |
| marekd | stevemar: if we dont use ecp we will need to make ksc pretend it's a browser. | 22:11 |
| needscoffee | marekd: I don't know if ksc should ever pretend that. | 22:12 |
| *** needscoffee is now known as needsmostcoffee | 22:12 | |
| *** spandhe has quit IRC | 22:13 | |
| marekd | needsmostcoffee: yeah. | 22:13 |
| ayoung | do we only ever marshall dicts to JSON in the server? | 22:13 |
| *** needsmostcoffee is now known as morganfainberg | 22:13 | |
| *** stevemar is now known as thinksmorganneed | 22:13 | |
| thinksmorganneed | gah! character limit | 22:13 |
| *** abhirc has joined #openstack-keystone | 22:13 | |
| marekd | needsmostcoffee: it's a matter of long term vision. We can now wrap it with ECP. | 22:13 |
| *** thinksmorganneed is now known as stevemar | 22:13 | |
| ayoung | hmmm argument for doing a named tuple.... | 22:14 |
| morganfainberg | ayoung: named tuples are cool | 22:14 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove conditionals that check for revoke_api https://review.openstack.org/159628 | 22:15 |
| stevemar | ayoung, ^ | 22:15 |
| *** jorge_munoz has joined #openstack-keystone | 22:17 | |
| ayoung | can named tuples have constructors? | 22:18 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add minimum release support notes for federation https://review.openstack.org/146758 | 22:18 |
| morganfainberg | ayoung: you mean overloaded constructors? Not sure. | 22:19 |
| *** samueldmq is now known as samueldmq-away | 22:20 | |
| *** pdesai has quit IRC | 22:21 | |
| ayoung | yeah, that is not going to work | 22:21 |
| ayoung | they don't act like dictionaries, which is what I really need | 22:21 |
| *** pdesai has joined #openstack-keystone | 22:22 | |
| morganfainberg | ok so they aren't dicts, but it's not hard to make them act like one. thats just __getitem__, __setitem__, keys, values, iteritmes, iterkeys, itervalues and possibly __iter__ | 22:22 |
| morganfainberg | depending on your needs | 22:22 |
| morganfainberg | most of the time the iters and __getitem__ are enough for most applications. | 22:23 |
| marekd | morganfainberg: stevemar: what happens if i authenticate myself with password and specify user id, name and domain ? | 22:23 |
| morganfainberg | but i prefer the tuple.<attr_name> method of access. | 22:23 |
| morganfainberg | marekd, user id *and* user name? | 22:23 |
| stevemar | oh in general? | 22:24 |
| stevemar | thats a good question | 22:24 |
| morganfainberg | i think we prefer user id to name. | 22:24 |
| stevemar | morganfainberg, but what if both are there | 22:24 |
| stevemar | does it error out? | 22:24 |
| morganfainberg | iirc we take id. | 22:24 |
| morganfainberg | but it might barf. | 22:24 |
| ayoung | morganfainberg, can you add that to a tuple?> | 22:24 |
| morganfainberg | at one point it barfed. | 22:24 |
| marekd | morganfainberg: yes, AND | 22:24 |
| stevemar | marekd, ha, no one knows | 22:24 |
| morganfainberg | ayoung, you'd need to subclass tuple or use a metaclass. | 22:24 |
| marekd | i think it takes id | 22:24 |
| morganfainberg | ayoung, but youcan. | 22:24 |
| stevemar | i say take id first | 22:24 |
| ayoung | morganfainberg, Its not what I prefer, it is what I have to make work on the client | 22:24 |
| stevemar | it's always the same bet | 22:25 |
| marekd | and i think i was checking it. | 22:25 |
| stevemar | safe* | 22:25 |
| ayoung | the logic is in the authenticate function of the identity driver | 22:25 |
| ayoung | no, wait, that takes user_id | 22:26 |
| ayoung | must be in the controller | 22:26 |
| morganfainberg | we prefer username to id | 22:27 |
| morganfainberg | https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/password.py#L95 | 22:27 |
| morganfainberg | https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/password.py#L102 | 22:27 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add in non-decorator notifiers https://review.openstack.org/158600 | 22:27 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Get initiator from manager and send to controller https://review.openstack.org/155660 | 22:27 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notifications for trusts https://review.openstack.org/151867 | 22:27 |
| marekd | morganfainberg: stevemar lol, user_name has higher prio. | 22:27 |
| morganfainberg | yep | 22:27 |
| stevemar | oh gosh | 22:27 |
| stevemar | we don't check user_id in the backend, try/except, then try user_name? | 22:28 |
| * stevemar gives up | 22:28 | |
| marekd | https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/password.py#L94-L109 | 22:28 |
| morganfainberg | stevemar, we try username if it exists else we try id. if you supply a username and it's bad we don't fall back | 22:28 |
| morganfainberg | this is relatively sane, but we should document that | 22:28 |
| stevemar | i suppose it's fine | 22:29 |
| stevemar | i'm tired and being dramatic | 22:29 |
| morganfainberg | i'm releaseing a new KSC unless there is a reason not to | 22:29 |
| morganfainberg | to fix that lovely catalog thing | 22:29 |
| stevemar | do it | 22:29 |
| morganfainberg | as soon as https://review.openstack.org/#/c/159315/ merges | 22:29 |
| morganfainberg | ~8m | 22:29 |
| marekd | morganfainberg: so, in my patch for direct user mapping i was not erroring when effective user had specified id and name/domain. i was simply taking id first. | 22:30 |
| *** rwsu has joined #openstack-keystone | 22:30 | |
| marekd | gyee pointed out that we should err such case. | 22:30 |
| morganfainberg | marekd, ah. | 22:30 |
| *** jorge_munoz has quit IRC | 22:30 | |
| morganfainberg | marekd, either raise an execption or make it consistent with the current api | 22:30 |
| morganfainberg | do not prefer id over name. | 22:30 |
| morganfainberg | i have a slight preference that we error if both are passed... but not enough to say it makes a ton of sense. | 22:31 |
| marekd | morganfainberg: lol, i just realized i can make gyee happy with 0-lines of change... | 22:31 |
| morganfainberg | marekd, then awesome! | 22:31 |
| marekd | mapping engine will accept id and name/domain but it will pass that to UserAuthInfo | 22:32 |
| marekd | that does that normalization. | 22:32 |
| *** samueldmq_ has joined #openstack-keystone | 22:33 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Make RuleProcessor._UserType class public https://review.openstack.org/157711 | 22:35 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Move UserAuthInfo to a separate file https://review.openstack.org/157717 | 22:36 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Authenticate local users via federated workflow https://review.openstack.org/156308 | 22:36 |
| *** samueldmq_ is now known as samueldmq | 22:38 | |
| *** gyee has joined #openstack-keystone | 22:38 | |
| *** ChanServ sets mode: +v gyee | 22:38 | |
| *** gyee has quit IRC | 22:40 | |
| *** jaosorior has quit IRC | 22:42 | |
| * morganfainberg glares at tempest... | 22:42 | |
| *** gyee has joined #openstack-keystone | 22:42 | |
| *** ChanServ sets mode: +v gyee | 22:42 | |
| *** rodrigods is now known as rodrigod` | 22:42 | |
| mtreinish | morganfainberg: anything I can help with? | 22:42 |
| *** rodrigod` is now known as rodrigods | 22:43 | |
| morganfainberg | mtreinish, nope. just one job is slower than i want it to be.. cause i need to do a release ;) | 22:43 |
| morganfainberg | mtreinish, nothing *anyone* can do about it. | 22:43 |
| mtreinish | morganfainberg: heh, ok :) | 22:44 |
| morganfainberg | mtreinish, :) i'd come bug you in -qa if there was a real issue :) | 22:44 |
| morganfainberg | mtreinish, thanks for checking in though! :) | 22:44 |
| *** henrynash has quit IRC | 22:44 | |
| morganfainberg | that makes me count 4 PTLs in this channel, ^_^ | 22:45 |
| *** rodrigods is now known as rodrigod` | 22:51 | |
| *** raildo_ has joined #openstack-keystone | 22:51 | |
| *** rodrigod` is now known as rodrigods | 22:51 | |
| morganfainberg | well at least success: 2629.0000 sec but wow. | 22:52 |
| breton | wat | 22:52 |
| breton | https://review.openstack.org/#/c/125923/ | 22:52 |
| openstackgerrit | Merged openstack/python-keystoneclient: Allow handling multiple service_types https://review.openstack.org/159315 | 22:52 |
| morganfainberg | yay! ^^ | 22:52 |
| breton | https://bugs.launchpad.net/python-keystoneclient/+bug/1377080 | 22:53 |
| openstack | Launchpad bug 1377080 in Keystone "Stale endpoint selection logic in keystone client" [Medium,Triaged] | 22:53 |
| morganfainberg | breton sorry we couldn't find it. | 22:53 |
| morganfainberg | breton, we looked last night :( | 22:53 |
| marekd | gyee: re https://review.openstack.org/#/c/154934/16/keystone/auth/plugins/mapped.py | 22:53 |
| morganfainberg | and yes it was re-evaluated as not invalid | 22:54 |
| morganfainberg | breton, LPs search... lets just say is awful | 22:54 |
| breton | well, I'm not the author of that patch, but I remember amakarov being angry that no one saw the bug :) | 22:56 |
| morganfainberg | hopefully storyboard can help. | 22:56 |
| morganfainberg | it's hard to find things in LP | 22:56 |
| morganfainberg | i know both jamielennox and i looked for the bug | 22:56 |
| stevemar | marekd, whats up with https://review.openstack.org/#/c/154934/16 | 22:57 |
| marekd | stevemar: held it off for a sec as dstanek wants more tests. | 22:57 |
| marekd | also gyee had an issue with setup_username() | 22:58 |
| marekd | let me check one thing. | 22:58 |
| marekd | i will un-wip it | 22:58 |
| gyee | marekd, k, looking | 22:58 |
| jamielennox | breton: apologise to amakarov_away for me, i had said no to his fix and then got pressured into it and couldn't find the bug to link it against | 22:59 |
| marekd | gyee: in both federated and standard token user object has: id, name, domain | 23:00 |
| breton | jamielennox: I guess he'll read the logs :) | 23:00 |
| gyee | marekd, my only concern there is the notion of multiple usernames yield by the mapping | 23:00 |
| morganfainberg | jamielennox, just pushed 1.2.0 | 23:00 |
| morganfainberg | jamielennox, sending an email in a minute announcing it. | 23:00 |
| gyee | user yield mapping should be unambiguous | 23:00 |
| dstanek | marekd: ah, i had to read my comments in that review to know what you were talking about :-) | 23:00 |
| gyee | yield by mapping | 23:01 |
| marekd | gyee: so, it's logged, and only first one is used. | 23:01 |
| morganfainberg | breton, yeah sorry about that if we had found it we would have used his bug/fix. | 23:01 |
| marekd | gyee: i am talking setup_username() now. | 23:01 |
| gyee | if we ended up with multiple, that means we have a potential security incident | 23:01 |
| morganfainberg | cc amakarov_away ^^ | 23:01 |
| gyee | marekd, other than that, I don't have any major concerns | 23:02 |
| marekd | gyee: can you point me file and line which bugs you now? | 23:02 |
| marekd | gyee: i think you were talking about mapped.setup_username() | 23:02 |
| *** ncoghlan has joined #openstack-keystone | 23:02 | |
| gyee | yes | 23:02 |
| marekd | gyee: line 190 https://review.openstack.org/#/c/154934/16/keystone/auth/plugins/mapped.py | 23:03 |
| marekd | this? | 23:03 |
| *** spandhe has joined #openstack-keystone | 23:03 | |
| gyee | marekd, hangon | 23:03 |
| gyee | https://review.openstack.org/#/c/154934/15/keystone/contrib/federation/utils.py | 23:04 |
| gyee | line 444 | 23:04 |
| gyee | we should raise an error instead of merely logging it | 23:04 |
| marekd | gyee: ok, but this is not the part of this patch. This is here since day 0 when mapping was merged ~1 year ago. | 23:05 |
| marekd | so i'd say: improvement or bug? | 23:05 |
| gyee | marekd, that's fine if you want a follow-on patch | 23:05 |
| gyee | lets fix it before someone file an OSSN :) | 23:06 |
| marekd | gyee: we can solve it but imho this is independent change. | 23:07 |
| marekd | anyway, you also had comments here: https://review.openstack.org/#/c/154934/15/keystone/auth/plugins/mapped.py line 204 | 23:07 |
| gyee | marekd, I think we should stay away from name=id assignment magic | 23:08 |
| gyee | when it comes to identity, it has to be unambiguous | 23:08 |
| stevemar | gyee, that was done initially because user_id is required in auth_context | 23:08 |
| gyee | stevemar, understood | 23:09 |
| stevemar | and in a mapping, a name is all that could be given | 23:09 |
| stevemar | for an ephemeral user, its good enough | 23:09 |
| marekd | about both id and name set. | 23:09 |
| marekd | gyee: (ok,for the followup patch) | 23:09 |
| *** bknudson has quit IRC | 23:09 | |
| gyee | stevemar, whatever it is, it has to be precisely the product of mapping | 23:09 |
| marekd | gyee: for ephemeral users we can take name/domain only from mapping. | 23:09 |
| gyee | not some magic in the code | 23:10 |
| marekd | and both standard and fed tokens put id, name, domain of the user. | 23:10 |
| gyee | marekd, right, everything should be directly yield by mapping | 23:11 |
| gyee | much easier to audit the mapping | 23:11 |
| marekd | so, we need to cover two cases for ephemeral users: id, name domain are set (do nothing) | 23:12 |
| marekd | and: name set (federated domain auto-added) -> user_id make of user_name ? | 23:13 |
| marekd | for the record the latter case is what we need to be backward compatible. | 23:13 |
| morganfainberg | KSC 1.2.0 should be out now in the wild | 23:13 |
| gyee | ideally we shouldn't need to fill anything in | 23:13 |
| gyee | if you want to map ephemeral user to the 'Federated' domain, express that in the mapping | 23:14 |
| marekd | gyee: i cannot, because until now, ephemeral users are not in domains. | 23:14 |
| marekd | so nobody was specifying this. | 23:14 |
| marekd | we also couldn't directly map users, so users were by definition ephemeral. | 23:14 |
| gyee | marekd, understood, that's why I said "ideally" :) | 23:15 |
| gyee | ideal != reality | 23:16 |
| gyee | marekd, I need to step out a bit, if you amend the patch, I'll review them after I come back | 23:17 |
| marekd | gyee: i will | 23:17 |
| gyee | thank you sir | 23:18 |
| * jogo likes the play ayoung wrote http://adam.younglogic.com/2015/02/three-types-of-tokens/ | 23:18 | |
| *** mattfarina has quit IRC | 23:18 | |
| *** stevemar has quit IRC | 23:19 | |
| morganfainberg | ayoung, EXIT (Stage Left) | 23:19 |
| * jogo found a typo "Keystoen knows this immediately" | 23:21 | |
| dstanek | jogo: it didn't go through code review :-) | 23:22 |
| *** pdesai1 has joined #openstack-keystone | 23:30 | |
| *** flaviof has quit IRC | 23:31 | |
| *** pdesai has quit IRC | 23:33 | |
| *** ljfisher has quit IRC | 23:39 | |
| *** browne has quit IRC | 23:41 | |
| *** browne has joined #openstack-keystone | 23:42 | |
| *** spandhe has quit IRC | 23:44 | |
| morganfainberg | uh. | 23:45 |
| morganfainberg | what? http://logs.openstack.org/17/145317/28/check/gate-keystone-pep8/3366f9b/console.html#_2015-02-26_19_45_13_649 | 23:45 |
| morganfainberg | why is that failing? | 23:45 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use correct dependency decorator https://review.openstack.org/159347 | 23:46 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove conditionals that check for revoke_api https://review.openstack.org/159628 | 23:47 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Avoid multiple instances for a provider https://review.openstack.org/124599 | 23:47 |
| *** spandhe has joined #openstack-keystone | 23:49 | |
| *** EmilienM is now known as EmilienM|afk | 23:49 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove conditional check (and test) for oauth_api https://review.openstack.org/159671 | 23:52 |
| morganfainberg | interesting: | 23:52 |
| morganfainberg | ./keystone/token/providers/klwt/utils.py:65:23: H701 Empty localization string | 23:52 |
| morganfainberg | LOG.error(_LE(msg)) | 23:52 |
| *** chlong has joined #openstack-keystone | 23:53 | |
| *** csoukup has quit IRC | 23:53 | |
| *** himangi has quit IRC | 23:54 | |
| *** dims_ has quit IRC | 23:55 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 23:55 |
| morganfainberg | lbragstad, ^^ pep8 fix (cc dolphm) | 23:55 |
| *** henrynash has joined #openstack-keystone | 23:55 | |
| *** ChanServ sets mode: +v henrynash | 23:55 | |
| *** browne has quit IRC | 23:56 | |
| *** browne has joined #openstack-keystone | 23:57 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Refactor and provide scaffolding for domain specific loading https://review.openstack.org/157701 | 23:57 |
| jamielennox | ayoung: Manny's head came out of that meeting throbbing i expect :) | 23:58 |
| *** pdesai1 has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
