| *** rodrigods is now known as rodrigod` | 00:08 | |
| *** rodrigod` is now known as rodrigods | 00:08 | |
| *** henrynash_ has joined #openstack-keystone | 00:09 | |
| *** ChanServ sets mode: +v henrynash_ | 00:09 | |
| *** rodrigods has quit IRC | 00:09 | |
| *** henrynash has quit IRC | 00:09 | |
| *** henrynash_ is now known as henrynash | 00:09 | |
| *** karimb has quit IRC | 00:10 | |
| dstanek | morganfainberg: that's a good catch by the automation | 00:11 |
|---|---|---|
| morganfainberg | dstanek, yep | 00:11 |
| morganfainberg | though i had to run it locally, devstack error didn't show the problem as clearly | 00:11 |
| *** browne has quit IRC | 00:12 | |
| *** browne has joined #openstack-keystone | 00:12 | |
| *** rodrigods has joined #openstack-keystone | 00:12 | |
| dstanek | morganfainberg: so my only issue with that review now is the _convert_to_integers because it can be simplified, but that can be a follow up | 00:12 |
| morganfainberg | dstanek, sounds good. i'm happy to see a cleanup on that as a followup | 00:13 |
| openstackgerrit | henry-nash proposed openstack/keystone: Implement backend driver support for domain config https://review.openstack.org/158051 | 00:13 |
| *** rodrigods has quit IRC | 00:14 | |
| *** rodrigods has joined #openstack-keystone | 00:14 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 00:15 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Enhance user identification in mapping engine https://review.openstack.org/154934 | 00:17 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 00:18 |
| *** raildo_ has quit IRC | 00:20 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fixes test_multiple_filters filters definition https://review.openstack.org/158411 | 00:21 |
| *** david-lyle is now known as david-lyle_Afk | 00:22 | |
| *** david-lyle_Afk is now known as david-lyle_afk | 00:22 | |
| *** markvoelker has quit IRC | 00:24 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 00:26 |
| henrynash | dstanek: hi…you still around | 00:27 |
| *** cburgess has quit IRC | 00:28 | |
| *** cburgess has joined #openstack-keystone | 00:28 | |
| *** gus has quit IRC | 00:29 | |
| *** darrenc has quit IRC | 00:29 | |
| *** darrenc has joined #openstack-keystone | 00:29 | |
| *** mhu has quit IRC | 00:29 | |
| *** EmilienM|afk has quit IRC | 00:29 | |
| *** markvoelker has joined #openstack-keystone | 00:29 | |
| *** EmilienM has joined #openstack-keystone | 00:30 | |
| *** mhu has joined #openstack-keystone | 00:30 | |
| *** gus has joined #openstack-keystone | 00:31 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Exposes bug in SQL when honoring driver_hints https://review.openstack.org/158412 | 00:32 |
| *** arunkant_ has quit IRC | 00:35 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 00:37 |
| henrynash | I need some python-super-guru help….. | 00:40 |
| samueldmq | throw your question in, maybe some is able to answer :) | 00:41 |
| samueldmq | we have some good guys with python here :-) | 00:41 |
| samueldmq | I'm just curious to see your question, and the response you'll find | 00:42 |
| henrynash | I need some help in working out what’s going with my domainConfigOpts wrapper class in https://review.openstack.org/#/c/159675/2/keystone/identity/core.py | 00:42 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Validate user exist when assigning roles in V2 https://review.openstack.org/93982 | 00:43 |
| henrynash | It works in teh simple tests (see: https://review.openstack.org/#/c/159675/2/keystone/tests/unit/identity/test_core.py) | 00:43 |
| henrynash | but blows up when use in earnest (see: https://review.openstack.org/#/c/159675/2/keystone/tests/unit/test_backend_ldap.py) | 00:44 |
| samueldmq | henrynash, going to download and try something :) | 00:45 |
| henrynash | this is what happens in that last test: http://paste.openstack.org/show/182757/ | 00:45 |
| henrynash | basically I get caught in a infinite loop doing __getattr_ … but I can’t work out why (and why on that particualr access to conf) | 00:46 |
| samueldmq | infinite loop | 00:46 |
| samueldmq | yep ... going to see the code | 00:47 |
| henrynash | I’m trying to be pretty sneaky here…..probaably too sneaky | 00:47 |
| henrynash | thx | 00:49 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 00:49 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 00:50 |
| henrynash | samueldmq: I wonder if I have to be careful not to re-patch the same class over and over again…maybe I’m blowing some kind of recursion limit | 00:55 |
| jamielennox | so member_role_name is almost completely ignored? member_role_id seems to be all that matters | 00:55 |
| *** dims has joined #openstack-keystone | 01:01 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 01:06 | |
| samueldmq | henrynash, well ... that's pretty hard :p | 01:06 |
| samueldmq | I need to understand the patches to figure out the logic in there | 01:07 |
| henrynash | yeah, it’s pretty funky…not sure if I haev it right…do you egt WHAT I’m tyring to do and why? | 01:07 |
| *** bknudson has joined #openstack-keystone | 01:10 | |
| *** ChanServ sets mode: +v bknudson | 01:10 | |
| samueldmq | not really I think .. need to recap starting from the spec | 01:10 |
| henrynash | ok, so quick summary: | 01:11 |
| henrynash | 1) Overall goal is to allow domain configs to specified in sql (instead of files) | 01:11 |
| henrynash | 2) Question is…once you have bunch of configs set for a given domain…how do you try and get all the modules taht just get a config value by saying conf.group.option to pick up the new values.... | 01:13 |
| henrynash | 3) we already create a seperate oslo cfg.ConfigOpts object for each domain | 01:13 |
| henrynash | 4) what I’m doing is creating an inherited class for this that we will pass aournd instead…and when ever someone reads an attribute (i.e. does __getattr__ ) then we get to intercept it | 01:14 |
| samueldmq | so at the end you would be able to do domain1.conf.ldap.url ? | 01:15 |
| samueldmq | or something like this? | 01:16 |
| henrynash | 5) ..but the problem is that our options are actually in groups…and that class (ConfigOpts.GroupAttr) is instantiated inside oslo and passed back to us to pass back to the caller….so we somehow need to intercpept teh __getattr__ to that class, as well as our own | 01:16 |
| henrynash | …essentiall, yes - we already create an array of domains, each one has its one conf….and each domain has its own ldap driver, initialized with the conf for taht doamin | 01:17 |
| morganfainberg | henrynash, that sounds kindof hack-y | 01:17 |
| henrynash | all that comes from teh file based support already there | 01:17 |
| henrynash | morganfainberg: probably true….it was kind of what doug as suggesting, to have a wrapper around ConfigOpts…. | 01:18 |
| samueldmq | henrynash, hmm... so yes, I see we are consistent with the way we do today (with files) | 01:18 |
| samueldmq | henrynash, e.g we have file domai1.conf , and inside it we have identity.driver -> domain1.conf.identity.driver | 01:19 |
| henrynash | the alernative approach is that I manually call teh override method for all domain speciific confisg… | 01:20 |
| henrynash | hmm, that might be a lot easier | 01:20 |
| samueldmq | henrynash, why not then ? :) | 01:20 |
| henrynash | I think I’ll see if that works better…..it might be cleaner too….have used the manual overriding before…. | 01:21 |
| henrynash | (haven’t used the..) | 01:21 |
| henrynash | try that in the morning… | 01:22 |
| henrynash | ok, thx | 01:22 |
| henrynash | time for bed, me thinks.... | 01:22 |
| *** henrynash has quit IRC | 01:22 | |
| samueldmq | :) | 01:23 |
| *** diegows has quit IRC | 01:24 | |
| openstackgerrit | wanghong proposed openstack/keystone: apply endpoint_group filters on token catalog https://review.openstack.org/144187 | 01:27 |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 01:28 |
| *** markvoelker has quit IRC | 01:32 | |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 01:32 |
| *** _cjones_ has quit IRC | 01:33 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 01:38 |
| *** davechen has joined #openstack-keystone | 01:41 | |
| *** rm_work is now known as rm_work|away | 01:46 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Make RuleProcessor._UserType class public https://review.openstack.org/157711 | 01:53 |
| *** erkules_ has joined #openstack-keystone | 02:16 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 02:17 | |
| *** erkules has quit IRC | 02:19 | |
| *** rwsu is now known as rwsu-afk | 02:26 | |
| *** gyee has quit IRC | 02:31 | |
| *** tqtran_ has quit IRC | 02:31 | |
| *** browne has quit IRC | 02:33 | |
| *** browne has joined #openstack-keystone | 02:34 | |
| *** spandhe has quit IRC | 02:44 | |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 02:48 |
| *** leonchio_ has quit IRC | 02:54 | |
| *** samueldmq has quit IRC | 02:54 | |
| ayoung | failures=17 | 03:07 |
| *** stevemar has joined #openstack-keystone | 03:18 | |
| *** ChanServ sets mode: +v stevemar | 03:18 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove conditional check (and test) for oauth_api https://review.openstack.org/159671 | 03:23 |
| openstackgerrit | wanghong proposed openstack/keystone: move region and service exist checks into manager layer https://review.openstack.org/141977 | 03:29 |
| *** browne has quit IRC | 03:36 | |
| *** csoukup has joined #openstack-keystone | 03:40 | |
| *** dims has quit IRC | 03:41 | |
| ayoung | morganfainberg, these service and endpoint defs are wrong, cuz they have no ids. Am I right? http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/tests/unit/v3/utils.py#n52 | 04:06 |
| morganfainberg | ayoung, i think you are right | 04:06 |
| ayoung | morganfainberg, checking the spec now | 04:06 |
| morganfainberg | ayoung, this is an issue whith having fixtures in two places. | 04:07 |
| ayoung | morganfainberg, we have so many diffferent fixtures in the client | 04:07 |
| morganfainberg | yeah | 04:07 |
| morganfainberg | :( | 04:07 |
| ayoung | http://developer.openstack.org/api-ref-identity-v3.html#service-catalog-v3 morganfainberg | 04:07 |
| ayoung | adding Ids now | 04:08 |
| ayoung | morganfainberg, I have , for the moment, punted on how to marshall the new objects via JSON. I've got lower hanging fruit to knock down first. I like the idea of named tuples, but it doesn;t map cleanly to a dict interface | 04:10 |
| morganfainberg | no it doesn't | 04:11 |
| ayoung | might need some more power python knowhow to finish that off | 04:11 |
| ayoung | I guess I could inherit from dict | 04:11 |
| ayoung | wouldn't be the worst thing. THe objects would still be immutable | 04:11 |
| * ayoung thinks about that | 04:11 | |
| ayoung | would be treating dict like an interface, which is really what we want here | 04:12 |
| morganfainberg | ayoung, right. | 04:13 |
| ayoung | morganfainberg, failures=7 | 04:17 |
| *** richm has quit IRC | 04:20 | |
| *** lhcheng has quit IRC | 04:34 | |
| *** dims has joined #openstack-keystone | 04:42 | |
| ayoung | failures=5 | 04:42 |
| *** spandhe has joined #openstack-keystone | 04:46 | |
| *** dims has quit IRC | 04:47 | |
| *** markvoelker has joined #openstack-keystone | 05:01 | |
| ayoung | failures=3 | 05:01 |
| *** lhcheng has joined #openstack-keystone | 05:12 | |
| *** lhcheng_ has joined #openstack-keystone | 05:15 | |
| *** lhcheng has quit IRC | 05:18 | |
| *** rushiagr_away is now known as rushiagr | 05:18 | |
| *** browne has joined #openstack-keystone | 05:24 | |
| *** markvoelker has quit IRC | 05:33 | |
| *** markvoelker has joined #openstack-keystone | 05:33 | |
| ayoung | failures=2 | 05:37 |
| *** markvoelker has quit IRC | 05:37 | |
| *** csoukup has quit IRC | 05:39 | |
| *** spandhe has quit IRC | 05:44 | |
| *** Krast has joined #openstack-keystone | 05:52 | |
| *** abhirc has quit IRC | 05:55 | |
| *** rushiagr is now known as rushiagr_away | 05:57 | |
| *** markvoelker has joined #openstack-keystone | 06:04 | |
| *** rushiagr_away is now known as rushiagr | 06:05 | |
| *** markvoelker has quit IRC | 06:09 | |
| *** MaikZ has quit IRC | 06:18 | |
| *** dims has joined #openstack-keystone | 06:31 | |
| *** dims has quit IRC | 06:36 | |
| *** MasterPiece has joined #openstack-keystone | 06:41 | |
| *** lhcheng_ has quit IRC | 06:44 | |
| *** markvoelker has joined #openstack-keystone | 07:05 | |
| *** markvoelker has quit IRC | 07:09 | |
| *** spandhe has joined #openstack-keystone | 07:10 | |
| breton | inheritance from dict? | 07:10 |
| breton | why not from Mapping or MutableMapping? | 07:14 |
| *** ajayaa has joined #openstack-keystone | 07:23 | |
| *** ncoghlan has quit IRC | 07:34 | |
| *** stevemar has quit IRC | 07:43 | |
| *** browne has quit IRC | 08:06 | |
| *** spandhe has quit IRC | 08:18 | |
| *** jaosorior has joined #openstack-keystone | 08:27 | |
| *** nellysmitt has joined #openstack-keystone | 08:29 | |
| *** himangi has joined #openstack-keystone | 08:36 | |
| *** pnavarro__ has joined #openstack-keystone | 08:42 | |
| *** chlong has quit IRC | 08:44 | |
| *** MasterPiece has quit IRC | 08:51 | |
| *** jistr has joined #openstack-keystone | 08:56 | |
| *** markvoelker has joined #openstack-keystone | 09:07 | |
| *** henrynash has joined #openstack-keystone | 09:08 | |
| *** ChanServ sets mode: +v henrynash | 09:08 | |
| *** markvoelker has quit IRC | 09:13 | |
| *** davechen has quit IRC | 09:53 | |
| *** svasheka has quit IRC | 09:55 | |
| *** henrynash has quit IRC | 09:56 | |
| *** henrynash has joined #openstack-keystone | 10:04 | |
| *** ChanServ sets mode: +v henrynash | 10:04 | |
| *** fmarco76 has joined #openstack-keystone | 10:08 | |
| *** aix has joined #openstack-keystone | 10:52 | |
| *** jaosorior has quit IRC | 11:02 | |
| *** markvoelker has joined #openstack-keystone | 11:10 | |
| *** markvoelker has quit IRC | 11:17 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Enhance user identification in mapping engine https://review.openstack.org/154934 | 11:26 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 11:27 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Make RuleProcessor._UserType class public https://review.openstack.org/157711 | 11:28 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Move UserAuthInfo to a separate file https://review.openstack.org/157717 | 11:28 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Authenticate local users via federated workflow https://review.openstack.org/156308 | 11:28 |
| *** amakarov_away is now known as amakarov | 11:30 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Redis token backend https://review.openstack.org/150844 | 11:35 |
| amakarov | dolphm, hi! ^^ Can you explain me please, how can I test a new token backend? iirc there are no tests for backends at all... | 11:37 |
| amakarov | Can somebody review my revocation bug fix? https://review.openstack.org/#/c/141854/ | 11:39 |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: Adding utf8 to federations tables https://review.openstack.org/159803 | 11:48 |
| *** henrynash has quit IRC | 11:49 | |
| breton | dolphm: could you please remove your -2 on https://review.openstack.org/#/c/155292/ since master patch has landed? | 11:52 |
| *** diegows has joined #openstack-keystone | 11:54 | |
| *** krykowski has joined #openstack-keystone | 11:56 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Add ``service_providers`` in Service Catalog https://review.openstack.org/152659 | 11:59 |
| *** aix has quit IRC | 12:00 | |
| *** pnavarro_ has joined #openstack-keystone | 12:02 | |
| *** erkules_ is now known as erkules | 12:04 | |
| *** afazekas has joined #openstack-keystone | 12:04 | |
| *** dims has joined #openstack-keystone | 12:04 | |
| *** himangi has quit IRC | 12:05 | |
| *** pnavarro__ has quit IRC | 12:06 | |
| *** pnavarro_ has quit IRC | 12:07 | |
| *** obutenko has joined #openstack-keystone | 12:11 | |
| *** markvoelker has joined #openstack-keystone | 12:13 | |
| *** flaviof has joined #openstack-keystone | 12:15 | |
| *** markvoelker has quit IRC | 12:17 | |
| *** ajayaa has quit IRC | 12:32 | |
| *** krykowski has quit IRC | 12:33 | |
| *** rushiagr is now known as rushiagr_away | 12:35 | |
| *** jaosorior has joined #openstack-keystone | 12:38 | |
| *** henrynash has joined #openstack-keystone | 12:45 | |
| *** ChanServ sets mode: +v henrynash | 12:45 | |
| *** himangi has joined #openstack-keystone | 12:49 | |
| *** aix has joined #openstack-keystone | 12:55 | |
| *** himangi has quit IRC | 13:01 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 13:05 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 13:06 |
| *** krykowski has joined #openstack-keystone | 13:11 | |
| *** markvoelker has joined #openstack-keystone | 13:14 | |
| *** abhirc has joined #openstack-keystone | 13:15 | |
| *** markvoelker has quit IRC | 13:19 | |
| *** dims is now known as dimsum__ | 13:27 | |
| *** gordc has joined #openstack-keystone | 13:37 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 13:39 |
| *** henrynash has quit IRC | 13:39 | |
| *** abhirc has quit IRC | 13:53 | |
| *** radez_g0n3 is now known as radez | 13:58 | |
| *** henrynash has joined #openstack-keystone | 14:00 | |
| *** ChanServ sets mode: +v henrynash | 14:00 | |
| *** henrynash has quit IRC | 14:01 | |
| *** abhirc has joined #openstack-keystone | 14:02 | |
| *** abhirc has quit IRC | 14:04 | |
| *** mattfarina has joined #openstack-keystone | 14:08 | |
| *** samueldmq has joined #openstack-keystone | 14:08 | |
| *** samueldmq has quit IRC | 14:13 | |
| *** markvoelker has joined #openstack-keystone | 14:15 | |
| *** ljfisher has joined #openstack-keystone | 14:17 | |
| *** rushiagr_away is now known as rushiagr | 14:18 | |
| *** markvoelker has quit IRC | 14:20 | |
| *** ljfisher has quit IRC | 14:21 | |
| *** richm has joined #openstack-keystone | 14:21 | |
| *** markvoelker has joined #openstack-keystone | 14:22 | |
| *** joesavak has joined #openstack-keystone | 14:22 | |
| *** mestery has quit IRC | 14:25 | |
| *** ljfisher has joined #openstack-keystone | 14:25 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 14:29 |
| *** csoukup has joined #openstack-keystone | 14:30 | |
| *** dimsum__ has quit IRC | 14:36 | |
| *** himangi has joined #openstack-keystone | 14:37 | |
| *** dims_ has joined #openstack-keystone | 14:38 | |
| *** rushiagr is now known as rushiagr_away | 14:40 | |
| *** mestery has joined #openstack-keystone | 14:41 | |
| *** bknudson has quit IRC | 14:42 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Populate token with service providers https://review.openstack.org/159865 | 14:42 |
| *** jsavak has joined #openstack-keystone | 14:44 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 14:46 |
| *** joesavak has quit IRC | 14:47 | |
| *** ogzy has joined #openstack-keystone | 14:48 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:50 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Populate token with service providers https://review.openstack.org/159865 | 14:50 |
| marekd | morganfainberg: shit, forgot what was decided: so, service providers are added to the token, we also need to add /auth/service_providers call. Is that true ? | 14:53 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Enhance user identification in mapping engine https://review.openstack.org/154934 | 15:08 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Make RuleProcessor._UserType class public https://review.openstack.org/157711 | 15:09 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Make RuleProcessor._UserType class public https://review.openstack.org/157711 | 15:13 |
| *** samueldmq-away has quit IRC | 15:14 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Move UserAuthInfo to a separate file https://review.openstack.org/157717 | 15:15 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Authenticate local users via federated workflow https://review.openstack.org/156308 | 15:17 |
| ayoung | dhellmann, I think out timeutils is leading us astray. I have a string like this: "2013-02-27T18:30:59.999999Z" generated buy the token provider: this meets the spec. I convert it to a string using oslo_utils.timeutils.parse_isotime(timestr) and then...I have no way of getting it back to the origianal string? AAll the functions seem to be missing the timezone. | 15:21 |
| ayoung | http://docs.openstack.org/developer/oslo.utils/api/timeutils.html | 15:21 |
| *** markvoelker has quit IRC | 15:32 | |
| *** emily_ has joined #openstack-keystone | 15:32 | |
| *** himangi has quit IRC | 15:38 | |
| *** carlosmarin has joined #openstack-keystone | 15:39 | |
| *** abhirc has joined #openstack-keystone | 15:39 | |
| *** abhirc has quit IRC | 15:40 | |
| *** stevemar has joined #openstack-keystone | 15:44 | |
| *** ChanServ sets mode: +v stevemar | 15:44 | |
| *** emily_ has quit IRC | 15:46 | |
| amakarov | stevemar, hi! A question to you: the main purpose of CADF notifications is monitoring, right? | 15:47 |
| *** stevemar2 has joined #openstack-keystone | 15:47 | |
| *** ChanServ sets mode: +v stevemar2 | 15:47 | |
| *** stevemar has quit IRC | 15:47 | |
| dstanek | amakarov: i would guess auditing | 15:47 |
| *** rushiagr_away is now known as rushiagr | 15:48 | |
| *** ogzy has quit IRC | 15:48 | |
| *** jsavak has quit IRC | 15:48 | |
| *** himangi has joined #openstack-keystone | 15:48 | |
| amakarov | dstanek, thanks! The next question is: can these notifications be used for cross-datacenter assignment replication? | 15:49 |
| *** abhirc has joined #openstack-keystone | 15:49 | |
| *** afazekas has quit IRC | 15:50 | |
| dstanek | amakarov: instead of database replication? | 15:52 |
| *** bknudson has joined #openstack-keystone | 15:52 | |
| *** ChanServ sets mode: +v bknudson | 15:52 | |
| amakarov | dstanek, yes | 15:52 |
| *** bknudson has quit IRC | 15:53 | |
| dstanek | amakarov: i'm not sure if it would have enough info | 15:53 |
| amakarov | dstanek, I've filed a use-case https://blueprints.launchpad.net/keystone/+spec/cross-env-delegations-synchronization | 15:53 |
| dstanek | amakarov: why not sure database replication? | 15:53 |
| amakarov | dstanek, multi-master? | 15:54 |
| amakarov | dstanek, not sure if there is any | 15:54 |
| amakarov | http://en.wikipedia.org/wiki/Multi-master_replication | 15:54 |
| amakarov | We used LDAP for this, but it will soon be deprecated without reliable alternative | 15:55 |
| *** jorge_munoz has joined #openstack-keystone | 15:55 | |
| dstanek | amakarov: yes, exactly | 15:55 |
| dstanek | amakarov: do you need to have write in each cloud? | 15:56 |
| amakarov | dstanek, I asked Henry Hash about it and he suggested me to start researching it | 15:56 |
| amakarov | dstanek, ++ | 15:56 |
| *** joesavak has joined #openstack-keystone | 15:57 | |
| amakarov | For now I have some options what to do - all ugly | 15:57 |
| dstanek | i don't think keystone itself would ever implement replication - that's more of a backend issue | 15:58 |
| *** krykowski has quit IRC | 15:58 | |
| *** markvoelker has joined #openstack-keystone | 15:58 | |
| *** browne has joined #openstack-keystone | 15:58 | |
| amakarov | dstanek, I agree though it seems there is no such backend available now | 15:59 |
| amakarov | and this doesn't go as an excuse :) | 15:59 |
| dstanek | amakarov: why not use the SQL backend with Postgres? | 16:00 |
| dstanek | in a past life we did multi master with it and an open source addon - not across data centers though | 16:00 |
| amakarov | dstanek, postgres is good at master->[slaves] | 16:00 |
| amakarov | dstanek, can you please share this knowledge? | 16:01 |
| dstanek | amakarov: share what? the open source project name? | 16:01 |
| amakarov | dstanek, no :) How did you do multi-master on postgres | 16:02 |
| amakarov | last time I read postgres docs, there was no recipes for multi-master | 16:03 |
| dstanek | amakarov: we used an open source project with Postgres to do it; i can ask what it was when my friend gets online | 16:03 |
| dstanek | amakarov: https://wiki.postgresql.org/wiki/Replication,_Clustering,_and_Connection_Pooling#Replication <- it was probably one of these | 16:03 |
| amakarov | dstanek, I'd appreciate it! And thanks for the link :) | 16:05 |
| *** csoukup has quit IRC | 16:06 | |
| *** bknudson has joined #openstack-keystone | 16:06 | |
| *** ChanServ sets mode: +v bknudson | 16:06 | |
| amakarov | dstanek, btw can you please review revocation fix? https://review.openstack.org/#/c/141854/ | 16:07 |
| *** justincampbell has joined #openstack-keystone | 16:07 | |
| dstanek | amakarov: assuming that cadf messages do contain enough info to recreate the changes you have all sorts of queuing issues to contend with | 16:08 |
| lbragstad | dolphm: there are a few comments related to the file status stuff in keystone/token/providers/klwt/utils.py that bknudson had, | 16:08 |
| dstanek | amakarov: sure, added to my list | 16:08 |
| amakarov | dstanek, I agree about queuing, I'll most probably fail this option, but for now I'm gathering all I can get ) | 16:10 |
| *** csoukup has joined #openstack-keystone | 16:15 | |
| *** justincampbell has left #openstack-keystone | 16:18 | |
| *** david-lyle_afk is now known as david-lyle | 16:19 | |
| *** panbalag has joined #openstack-keystone | 16:20 | |
| *** henrynash has joined #openstack-keystone | 16:24 | |
| *** ChanServ sets mode: +v henrynash | 16:24 | |
| *** markvoelker has quit IRC | 16:25 | |
| panbalag | Hi... is there a command to find out the keystone API version in use on a devstack installation? | 16:26 |
| amakarov | panbalag, version depends on components' configurations - so look there | 16:27 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 16:28 |
| amakarov | panbalag, Keystone can handle both v2.0 and v3 simultaneously so it can be different from one component to another | 16:29 |
| panbalag | amakarov, oh ok. Thanks. | 16:30 |
| *** markvoelker has joined #openstack-keystone | 16:32 | |
| *** stevemar3 has joined #openstack-keystone | 16:32 | |
| *** ChanServ sets mode: +v stevemar3 | 16:32 | |
| *** stevemar2 has quit IRC | 16:33 | |
| panbalag | amakarov, I'm looking at the config files for swift under /etc/swift/.. any idea where the version will be defined? | 16:34 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Remove email from examples in Identity API https://review.openstack.org/159914 | 16:35 |
| *** david-lyle is now known as david-lyle_Afk | 16:35 | |
| *** david-lyle_Afk is now known as david-lyle_afk | 16:35 | |
| amakarov | panbalag, look for something like http://....:5000/v(2.0|3) | 16:35 |
| amakarov | or just grep config files with | grep ":5000/" | 16:36 |
| *** henrynash has quit IRC | 16:36 | |
| *** henrynash_ has joined #openstack-keystone | 16:36 | |
| *** ChanServ sets mode: +v henrynash_ | 16:36 | |
| *** rwsu-afk is now known as rwsu | 16:39 | |
| *** fmarco76 has left #openstack-keystone | 16:40 | |
| richm | When setting up multiple domains, is it required to have a separate config file in /etc/keystone/domains? Could /etc/keystone/keystone.conf be used, with separate sections for each domain? | 16:42 |
| stevemar3 | richm, the prior, separate files, directory doesn't matter | 16:42 |
| stevemar3 | but definitely not a single file with separate sections | 16:43 |
| richm | stevemar3: thanks | 16:43 |
| *** stevemar3 is now known as stevemar | 16:43 | |
| *** stevemar is now known as not-stevemar | 16:43 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Correct the use of POST for domain configs https://review.openstack.org/159919 | 16:44 |
| *** not-stevemar has quit IRC | 16:46 | |
| *** stevemar has joined #openstack-keystone | 16:46 | |
| *** ChanServ sets mode: +v stevemar | 16:46 | |
| marekd | stevemar: hi | 16:46 |
| stevemar | marekd, heading out now | 16:47 |
| stevemar | marekd, have my jacket on :) | 16:47 |
| marekd | stevemar: :( ok | 16:47 |
| stevemar | email or pm? | 16:47 |
| marekd | stevemar: sure. | 16:47 |
| marekd | 16:47 | |
| stevemar | k | 16:47 |
| *** AndroUser has joined #openstack-keystone | 16:49 | |
| *** justincampbell has joined #openstack-keystone | 16:49 | |
| *** justincampbell has left #openstack-keystone | 16:50 | |
| *** doug-fish has joined #openstack-keystone | 16:50 | |
| *** stevedroid has joined #openstack-keystone | 16:52 | |
| doug-fish | hi keystone friends. I'm working on code to support K2K federation in Horizon and my initial code is failing with a 401 error that confuses me .... | 16:52 |
| stevedroid | Test | 16:52 |
| doug-fish | (very) WIP code is out for review. Problem code is https://review.openstack.org/#/c/159910/1/openstack_auth/backend.py around line 154 | 16:53 |
| doug-fish | I've seen prototype code that can do this series of calls, but it bypasses the keystone client to do so | 16:53 |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Add service_providers to the documentation https://review.openstack.org/159922 | 16:54 |
| doug-fish | I'm wondering if there is anything obviously wrong with my keystone client usage or other debug tips? (keystone log wasn't helpful) | 16:54 |
| lbragstad | stevedroid: getting IRC working on your phone? | 16:54 |
| *** gyee has joined #openstack-keystone | 16:55 | |
| *** ChanServ sets mode: +v gyee | 16:55 | |
| *** AndroUser has quit IRC | 16:55 | |
| *** browne has quit IRC | 16:55 | |
| doug-fish | jamielennox: I've heard you are quite familiar with the auth plugins - I suspect that could be where I'm having problems | 16:58 |
| dolphm | doug-fish: he's probably asleep (4am ish in australia now) | 16:58 |
| doug-fish | dolphm: yeah understood. Of course I'm open to input from others as well. | 16:59 |
| doug-fish | :-D | 16:59 |
| breton | fmarco76: | 17:00 |
| marekd | doug-fish: hi. What's your scenario with K2K and Horizon? | 17:04 |
| doug-fish | marekd: Basically it's a small number of keystones defined + I want to hide that fact in Horizon so users can choose regions without regard to which keystone is managing them | 17:05 |
| marekd | breton: you are probably talking https://review.openstack.org/#/c/152156/ ? | 17:06 |
| marekd | doug-fish: so, first of all we have rolled back idea of using regions as 'remote Keystones'. Does it change anything in that case? | 17:07 |
| doug-fish | I'm not quite sure what you mean by "we have rolled back idea of using regions as 'remote Keystones'" | 17:07 |
| doug-fish | marekd: I understand each keystone is used to access one or more regions | 17:08 |
| marekd | doug-fish: yes, but not necesarilly through K2K. | 17:09 |
| marekd | right? | 17:09 |
| *** samueldmq-away has joined #openstack-keystone | 17:09 | |
| doug-fish | not necessarily, but desirable in order to hide separate authenticate when switching between keystones | 17:09 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 17:10 |
| breton | marekd: yep | 17:10 |
| marekd | well, never mind, please finish your use case. | 17:10 |
| marekd | doug-fish: ^^ | 17:10 |
| breton | marekd: I could reproduce the failures | 17:10 |
| marekd | dropping utf8 helps ? | 17:11 |
| breton | marekd: but now I don't understand why they didn't happen before | 17:11 |
| marekd | breton: heh, we triggered hidden bug | 17:11 |
| marekd | and the beast is now awaken. | 17:11 |
| breton | and my "show create table identity_provider" now shows that I have latin1 too | 17:11 |
| doug-fish | marekd: use case is for hybrid environments to allow separate user, role, region management between private + public clouds, yet show all resources in Horizon without re-authenticating | 17:12 |
| *** himangi has quit IRC | 17:13 | |
| *** himangi has joined #openstack-keystone | 17:14 | |
| marekd | doug-fish: ok | 17:14 |
| marekd | doug-fish: so you probably need something to handle multiple tokens at once | 17:15 |
| marekd | or you managed to do it in a different way ? | 17:15 |
| doug-fish | marekd: my patch will manage mulitiple tokens | 17:15 |
| doug-fish | marekd: but right now it's only as far along as trying to obtain the multiple tokens | 17:15 |
| doug-fish | marekd: I can obtain unscoped tokens from the remote keystones, but can't list projects in order to get scoped tokens | 17:16 |
| *** _cjones_ has joined #openstack-keystone | 17:17 | |
| marekd | doug-fish: ok, some logs, tokens anything ? | 17:17 |
| doug-fish | marekd: I'm willing to share whatever might be helpful! You can see my code is pretty marked up with print statements - shall I collect a set of those and share? | 17:18 |
| marekd | doug-fish: yesh, why not. | 17:18 |
| henrynash_ | stevemar, bknudson, gyee, ayoung: would be great to get some eyes on the series of domain config patches - they start at: https://review.openstack.org/#/c/157701/ | 17:21 |
| *** joesavak has quit IRC | 17:21 | |
| bknudson | henrynash_: if they're not in the list of high priority reviews then I'm probably going to look at those first. | 17:21 |
| doug-fish | marekd: http://pastebin.com/MZsTPxfX | 17:21 |
| henrynash_ | bknudson: what defines high priority? If it is for Kilo, then these are indeed for Kilo | 17:22 |
| bknudson | henrynash_: I don't know where the list came from or why some reviews are in it and others aren't. | 17:23 |
| marekd | doug-fish: and what happens when you try to list projects with that token ? | 17:23 |
| doug-fish | marekd: I don't get that far - on this line r_unscoped_auth_ref = r_unscoped_auth.get_access(r_session) I get a 401 error | 17:24 |
| *** jogo is now known as flashgordon | 17:25 | |
| *** jistr has quit IRC | 17:25 | |
| *** joesavak has joined #openstack-keystone | 17:25 | |
| marekd | doug-fish: i guess there is some error | 17:26 |
| marekd | some links | 17:26 |
| marekd | or the reason | 17:26 |
| marekd | (ok, we have a reason) | 17:26 |
| marekd | printed while 401 is raised | 17:26 |
| haneef_ | henrynash: is domain specific conf only for root domain or is it for project with is_domain true too? | 17:27 |
| ayoung | henrynash_, would be great if our JSON marshalling of Dates wasn't driving me to drink | 17:27 |
| *** lhcheng has joined #openstack-keystone | 17:27 | |
| *** rushiagr is now known as rushiagr_away | 17:28 | |
| doug-fish | marekd: not much to go on here ... let me see if there is more info I can sort out: http://pastebin.com/v8GZgTdr | 17:28 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Populate token with service providers https://review.openstack.org/159865 | 17:31 |
| marekd | doug-fish: maybe apache logs on the Service PRovider site will tell us more ? | 17:35 |
| *** pdesai has joined #openstack-keystone | 17:35 | |
| *** pdesai has quit IRC | 17:37 | |
| doug-fish | marekd: I looked at them myself and asked bknudson to take a look as well. Nothing was obvious to either of us ... is there anything specific I should look for? or a socially acceptable way to share a large log file? | 17:37 |
| marekd | doug-fish: maybe grep for "Couldn't map user" | 17:38 |
| marekd | doug-fish: but, huh, no. | 17:38 |
| marekd | that would happen earlier. | 17:38 |
| doug-fish | marekd: as you theorized, it is not there. Also - I do have some working prototype code that doesn't use keystoneclient that is able to successfully get through this. | 17:39 |
| *** pdesai has joined #openstack-keystone | 17:39 | |
| doug-fish | marekd: that says to me it's either a keystone client problem, or a problem in the way I'm using it | 17:39 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 17:39 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 17:39 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 17:39 |
| dolphm | lbragstad: i'm working on a couple patches to the base klwt implementation for utils / key rotation stuff -- do you have any changes going in parallel? | 17:40 |
| lbragstad | dolphm: rebase on those ^ | 17:40 |
| dolphm | lbragstad: oh lol k | 17:40 |
| lbragstad | I just address a bunch of comments from Brant | 17:40 |
| lbragstad | and wanted to push, there are some comments bknudson left on coverage | 17:40 |
| lbragstad | that will still need to be addressed | 17:40 |
| dolphm | lbragstad: the biggest changes i'm making is removing _convert_to_integers() in favor of some defensive logic | 17:41 |
| lbragstad | dolphm: sounds good to me | 17:41 |
| lbragstad | I'll check it out when I sign back on | 17:41 |
| *** markvoelker has quit IRC | 17:51 | |
| *** lhcheng has quit IRC | 17:51 | |
| *** stevedroid has quit IRC | 17:53 | |
| *** joesavak has quit IRC | 17:54 | |
| *** lhcheng has joined #openstack-keystone | 17:55 | |
| *** lhcheng_ has joined #openstack-keystone | 17:56 | |
| *** lhcheng has quit IRC | 17:56 | |
| doug-fish | marekd: I've added some print statements inside of keystone-client - I'd assume this isn't a proper header value for X-Auth-Token http://pastebin.com/1VGwMS9v | 17:58 |
| doug-fish | now to figure out why | 17:58 |
| *** browne has joined #openstack-keystone | 17:58 | |
| *** chlong has joined #openstack-keystone | 18:04 | |
| *** markvoelker has joined #openstack-keystone | 18:05 | |
| doug-fish | marekd: I can't quite sort out the issue, but it seems like the Token auth plugin can't be told about both the token id and the token body, and as far as I can tell there is no way to pass that (I can pass one or the other, but not both) | 18:09 |
| doug-fish | could I be using the wrong plugin? | 18:09 |
| *** chlong has quit IRC | 18:11 | |
| doug-fish | marekd: wouldn't external/3rd party idp have the same need? | 18:11 |
| *** spandhe has joined #openstack-keystone | 18:11 | |
| *** spandhe has quit IRC | 18:11 | |
| *** krtaylor has quit IRC | 18:16 | |
| *** lhcheng_ is now known as lhcheng | 18:21 | |
| *** spandhe has joined #openstack-keystone | 18:23 | |
| *** Akshik has joined #openstack-keystone | 18:25 | |
| Akshik | using ubuntu 12.04 icehouse trying to integrate openstack keystone with shibboleth | 18:26 |
| Akshik | when i restarted shibd now stuck with error "2015-02-27 22:36:38 CRIT Shibboleth.Application : no MetadataProvider available, configuration is probably unusable", not sure if im missing something | 18:26 |
| Akshik | pls. guide me | 18:26 |
| doug-fish | marekd: some related keystone log info http://pastebin.com/v0yqLt6k | 18:26 |
| morganfainberg | marekd, rodrigods, gyee, ^ since you've looked at shibboleth a little more recently than I have [I'd need to context switch] | 18:27 |
| Akshik | i've even raised it in http://lists.openstack.org/pipermail/openstack-dev/2015-February/057956.html | 18:28 |
| *** chlong has joined #openstack-keystone | 18:28 | |
| *** tqtran has joined #openstack-keystone | 18:28 | |
| *** krtaylor has joined #openstack-keystone | 18:28 | |
| morganfainberg | Akshik, did you load in the metadata from your IDP? | 18:31 |
| *** pdesai1 has joined #openstack-keystone | 18:31 | |
| Akshik | yes i did register my metadata to testshib, and when i tried calling https://myserver:5000/v3/OS-FEDERATION/identity_providers/idp_2/protocols/saml2/auth i got redirected to testhib login page | 18:32 |
| Akshik | when i gave username and password | 18:33 |
| dstanek | Akshik: did you add the metadata provider to your shib config? | 18:34 |
| Akshik | *shibsp::ConfigurationException at (https://MYSERVER:5000/Shibboleth.sso/... | 18:34 |
| Akshik | <https://myserver:5000/Shibboleth.sso/SAML2/POST> ) No MetadataProvider available.* | 18:34 |
| *** pdesai has quit IRC | 18:34 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 18:34 |
| dstanek | Akshik: what is your metadata provider set to? | 18:34 |
| rodrigods | morganfainberg, bug in create_project ^ | 18:35 |
| rodrigods | morganfainberg, looking the logs | 18:35 |
| *** david-lyle_afk is now known as david-lyle | 18:35 | |
| Akshik | dstanek, http://chunk.io/f/a1186c3366ee4d118daf6db9dba6017e | 18:36 |
| Akshik | this is my shibbloeth2.xml | 18:36 |
| dstanek | Akshik: what is http://federation.org/federation-metadata.xml? i think this is your problem | 18:37 |
| dstanek | you have to tell shib about the IdP and tell the IdP about shib | 18:38 |
| *** chlong has quit IRC | 18:38 | |
| amakarov | dstanek, thank you for review, I understand that design with decorator looks weird, I don't like it too. What do you suggest? | 18:39 |
| dstanek | Akshik: my example of a mostly working config https://review.openstack.org/#/c/151311/7/dsvm/federation/devstack/files/shibboleth2.xml | 18:39 |
| gyee | morganfainberg, yeah, like dstanek said, meta data file config is not right | 18:39 |
| morganfainberg | gyee, i hadn't looked at it, yet, still pre-coffee ;) | 18:39 |
| Akshik | dstanek, Thanks, will try removing the federation.org portion of it, is rest all thing fine with the file | 18:40 |
| *** henrynash_ has quit IRC | 18:40 | |
| gyee | Akshik, if you have the file locally, you can do this as well | 18:40 |
| *** henrynash has joined #openstack-keystone | 18:40 | |
| *** ChanServ sets mode: +v henrynash | 18:40 | |
| dstanek | amakarov: no idea, you should walk through the shib docs as they tell you what to do | 18:40 |
| gyee | <MetadataProvider type="XML" file="/etc/keystone/saml2_idp_metadata.xml"/> | 18:41 |
| dstanek | amakarov: does everything need to be called as a decorator? | 18:41 |
| amakarov | dstanek, shib docs? | 18:41 |
| dstanek | this is what i get for whining about decorators :=-( | 18:41 |
| dstanek | amakarov: oops, not for you | 18:41 |
| dstanek | Akshik: : no idea, you should walk through the shib docs as they tell you what to do | 18:41 |
| Akshik | gyee, thanks, i will first try to remove the federationd in the config file and give it a try | 18:41 |
| dstanek | Akshik: do you know what metadata file to use? | 18:42 |
| amakarov | dstanek, the other option is to expose _send_notification | 18:43 |
| Akshik | dstanek, the federation potion is already commentedout | 18:43 |
| dstanek | Akshik: you need to have a metadata provider defined | 18:43 |
| Akshik | gyee, i have deleted the file backingFilePath="/tmp/testshib.xml" and when i restarted shibd | 18:44 |
| Akshik | that file got generated, whic means it fetching it from the testshib right? | 18:44 |
| Akshik | dstanek, i have them below <MetadataProvider type="XML" uri="https://idp.testshib.org/idp/shibboleth" | 18:45 |
| Akshik | backingFilePath="/tmp/testshib.xml" reloadInterval="180000"/> | 18:45 |
| gyee | Akshik, you can tell from the file itself | 18:53 |
| gyee | it has the IdP ID in it | 18:53 |
| *** pdesai2 has joined #openstack-keystone | 18:53 | |
| Akshik | gyee, this is the generated xml http://chunk.io/f/0d32318def5842149292623f2cdad5bf | 18:55 |
| gyee | Akshik, see if the entityID matches your IdP endpoint | 18:55 |
| gyee | looks fine | 18:56 |
| gyee | what error are you getting now? | 18:56 |
| *** pdesai1 has quit IRC | 18:56 | |
| *** pdesai2 has quit IRC | 18:56 | |
| *** markvoelker has quit IRC | 18:58 | |
| *** pdesai has joined #openstack-keystone | 19:01 | |
| *** markvoelker has joined #openstack-keystone | 19:01 | |
| Akshik | gyee, http://chunk.io/f/9f4a9a8758e94d48a7c944be1e0cbc5d | 19:04 |
| Akshik | this is the error i get after restarting the shibd service | 19:04 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove deprecated methods and functions in token subsystem https://review.openstack.org/151381 | 19:04 |
| Akshik | gyee, shibsp::ConfigurationException at (https://115.112.68.53:5000/Shibboleth.sso/SAML2/POST) | 19:11 |
| Akshik | No MetadataProvider available. | 19:11 |
| *** radez has quit IRC | 19:11 | |
| Akshik | is my keystone error log http://chunk.io/f/a22345d8a4874839bf85812f95f4df90 | 19:11 |
| *** aix has quit IRC | 19:13 | |
| *** samueldmq-away has quit IRC | 19:14 | |
| *** stevemar has quit IRC | 19:15 | |
| gyee | Akshik, are you setting K2K Federation or Keystone as SP? | 19:16 |
| Akshik | not sure about K2K, | 19:16 |
| *** stevemar has joined #openstack-keystone | 19:17 | |
| *** ChanServ sets mode: +v stevemar | 19:17 | |
| Akshik | im trying setup keystone with saml | 19:17 |
| *** Akshik has quit IRC | 19:17 | |
| *** stevemar has quit IRC | 19:18 | |
| *** stevemar has joined #openstack-keystone | 19:18 | |
| *** ChanServ sets mode: +v stevemar | 19:18 | |
| *** _cjones_ has quit IRC | 19:20 | |
| mfisch | Anyone seen these odd db rollback failures? I think this is just when people are trying to get tokens (randomly) | 19:21 |
| mfisch | 2015-02-27 12:01:00.153 13988 TRACE sqlalchemy.pool.QueuePool dbapi_connection.rollback() | 19:21 |
| mfisch | 2015-02-27 12:01:00.153 13988 TRACE sqlalchemy.pool.QueuePool OperationalError: (1047, 'Unknown command') | 19:21 |
| *** csoukup has quit IRC | 19:22 | |
| mfisch | seems to happen in large batches and then quiet down | 19:22 |
| *** amakarov is now known as amakarov_away | 19:22 | |
| *** nellysmitt has quit IRC | 19:23 | |
| *** _cjones_ has joined #openstack-keystone | 19:23 | |
| *** openstackgerrit has quit IRC | 19:24 | |
| *** openstackgerrit has joined #openstack-keystone | 19:24 | |
| *** csoukup has joined #openstack-keystone | 19:26 | |
| *** radez has joined #openstack-keystone | 19:35 | |
| *** fifieldt_ has joined #openstack-keystone | 19:36 | |
| *** gyee has quit IRC | 19:38 | |
| *** fifieldt has quit IRC | 19:40 | |
| *** pdesai has quit IRC | 19:44 | |
| *** mattamizer has joined #openstack-keystone | 19:45 | |
| morganfainberg | mfisch, haven't seen that one before | 19:45 |
| mfisch | thx morganfainberg | 19:46 |
| *** samueldmq has joined #openstack-keystone | 19:48 | |
| *** mattamizer has quit IRC | 19:50 | |
| *** tqtran is now known as tqtran_afk | 19:50 | |
| *** barra204 has joined #openstack-keystone | 19:50 | |
| *** joesavak has joined #openstack-keystone | 19:50 | |
| *** himangi has quit IRC | 19:51 | |
| *** rm_work|away is now known as rm_work | 19:52 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 19:55 |
| *** barra204 is now known as shakamunyi | 19:56 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fixes the SQL model tests https://review.openstack.org/159521 | 20:01 |
| *** samueldmq has quit IRC | 20:01 | |
| *** gordc has quit IRC | 20:07 | |
| *** markvoelker has quit IRC | 20:08 | |
| *** markvoelker_ has joined #openstack-keystone | 20:12 | |
| *** markvoelker_ has quit IRC | 20:16 | |
| *** joesavak has quit IRC | 20:29 | |
| *** csoukup has quit IRC | 20:30 | |
| *** _cjones_ has quit IRC | 20:34 | |
| *** csoukup has joined #openstack-keystone | 20:34 | |
| *** _cjones_ has joined #openstack-keystone | 20:34 | |
| *** _cjones_ has quit IRC | 20:36 | |
| *** _cjones_ has joined #openstack-keystone | 20:36 | |
| *** markvoelker has joined #openstack-keystone | 20:39 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 20:40 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 20:40 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 20:40 |
| *** markvoelker has quit IRC | 20:45 | |
| morganfainberg | lbragstad: dolphm anything I can do to help token stuff along? | 20:47 |
| morganfainberg | stevemar: going to go through and address comments on cadf shortly. | 20:47 |
| *** gordc has joined #openstack-keystone | 20:48 | |
| dolphm | morganfainberg: i'm working on 3 putting things into review today: docs, key rotation improvements, and the fernet rename | 20:49 |
| dolphm | morganfainberg: i'd like to have functional tests for key rotation if you're interested in that | 20:49 |
| dolphm | morganfainberg: current implementation has a subtle bug that dstanek caught :) | 20:49 |
| morganfainberg | dolphm: great. I'll look for them. I'll stage the devstack changes to let us get this into gate testing. | 20:49 |
| dolphm | s/3 putting/putting 3/ | 20:50 |
| morganfainberg | As well. | 20:50 |
| dolphm | morganfainberg: care if i jam that all into the one review, including the rename? or should that still be separate? | 20:50 |
| dolphm | i haven't started the rename yet | 20:50 |
| morganfainberg | The rename I'd like separate. The rest can go in 1 | 20:50 |
| dstanek | dolphm: it may take a little longer to review if it's squashed | 20:50 |
| morganfainberg | Just so we aren't trying to track rename + stuff. But what dstanek said. | 20:51 |
| dolphm | morganfainberg: ack | 20:51 |
| morganfainberg | Actually docs and rename could be 1. The other improvements might want to be separate. But I'll review it in either case and not complain too much. | 20:51 |
| *** markvoelker has joined #openstack-keystone | 20:52 | |
| dstanek | morganfainberg: don't worry i'll complain enough for the both of us! | 20:52 |
| morganfainberg | dstanek: oh cool let me just +2 it now without review then!:P | 20:53 |
| *** karimb has joined #openstack-keystone | 20:57 | |
| *** joesavak has joined #openstack-keystone | 20:57 | |
| *** karimb has quit IRC | 20:59 | |
| stevemar | morganfainberg, trying to help with k2k for horizon :) | 20:59 |
| *** karimb has joined #openstack-keystone | 20:59 | |
| *** lhcheng is now known as lhcheng_afk | 20:59 | |
| *** lhcheng_afk has quit IRC | 21:00 | |
| *** gyee has joined #openstack-keystone | 21:02 | |
| *** ChanServ sets mode: +v gyee | 21:02 | |
| morganfainberg | stevemar, sounds good. | 21:03 |
| *** raildo has quit IRC | 21:11 | |
| *** abhirc has quit IRC | 21:13 | |
| mfisch | morganfainberg: someone was running hourly backups ,the tables are getting locked and keystone gets angry | 21:14 |
| mfisch | the issue occurs at like 4:00, 5:01, 7, 10, 14, etc | 21:14 |
| morganfainberg | mfisch, sounds about right. | 21:14 |
| *** thedodd has joined #openstack-keystone | 21:14 | |
| morganfainberg | locking tables = icky | 21:14 |
| morganfainberg | though i'd recommend they exclude the token table | 21:14 |
| mfisch | I've reassigned the ticket, I keep telling everyone KS is flawless | 21:15 |
| morganfainberg | i bet that'll make things way faster | 21:15 |
| morganfainberg | ;) | 21:15 |
| morganfainberg | mfisch, HAH | 21:15 |
| morganfainberg | wait... HAHAHAHA | 21:15 |
| morganfainberg | mfisch, also skip_lock on a mysqldump >.> | 21:15 |
| morganfainberg | or single transaction dumps.. | 21:15 |
| morganfainberg | or do a dump from a read-only replica | 21:15 |
| * mfisch assigns ticket to Morgan | 21:19 | |
| stevemar | mfisch, good call | 21:19 |
| mfisch | I say we should love on the edge, no backups | 21:23 |
| mfisch | fail fast! | 21:23 |
| mfisch | db goes down just update linkedin | 21:24 |
| *** nellysmitt has joined #openstack-keystone | 21:24 | |
| *** stevemar has quit IRC | 21:26 | |
| marekd | doug-fish: hey, sorry, needed to head out immediately. So, looks like you are trying to scope the token not via federated workflow | 21:27 |
| marekd | doug-fish: today, with federation Keystone would never lookup user in database. | 21:27 |
| doug-fish | marekd: okay that kind of makes sense ... I don't know the federated workflow - do you know offhand where I can find out more? | 21:28 |
| marekd | well, there is everything in the code, but i am aware that is not super straightforward. | 21:29 |
| *** nellysmitt has quit IRC | 21:29 | |
| marekd | doug-fish: anyway, i'd track down what exactly is being sent to remote keystone | 21:30 |
| marekd | that it treats user as a local one. | 21:31 |
| *** joesavak has quit IRC | 21:31 | |
| marekd | doug-fish: also, i don't fully remember - why are you calling get_access() ? | 21:31 |
| doug-fish | copying related code that already exists for making the initial connection to keystone without a deep understanding | 21:32 |
| doug-fish | marekd: your question makes me think it might be a mistake to call it? | 21:33 |
| marekd | doug-fish: :-) | 21:34 |
| marekd | doug-fish: essentually you want to find out accessible domains/projects, am I right? | 21:34 |
| doug-fish | yes - as a step toward getting a scoped token to one of the projects/domains | 21:34 |
| doug-fish | marekd: my first expectation was that I'd be using some different auth plugin | 21:36 |
| doug-fish | marekd: but I couldn't sort out one that was relevant for getting an unscoped token for an SP keystone after authenticating to the first keystone | 21:37 |
| marekd | doug-fish: i don't fully understand. | 21:40 |
| marekd | doug-fish: so, you authN with your local Keystone, where you user exists and has some roles | 21:40 |
| *** lhcheng_afk has joined #openstack-keystone | 21:41 | |
| marekd | later, you exchange the token for SAML assertion | 21:41 |
| marekd | and use this saml asssertion to get unscoped federated token issued by one of your remote Keystones. | 21:41 |
| marekd | this is how you should do according to K2K workflow. | 21:41 |
| doug-fish | at a high level that makes sense and is what I intended | 21:41 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:42 | |
| doug-fish | but I couldn't sort out how to exchange the token for a SAML assertion without using new code to do it - hence the k2k.py file | 21:42 |
| doug-fish | but that didn't seem right to me - shouldn't that be implemented in python-keystoneclient somehow? | 21:42 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 21:43 | |
| doug-fish | marekd: also you use the terminology "exchange the token for SAML assertion", but that implies I can't use the token anymore - is that true? | 21:44 |
| doug-fish | I can use the token to create a saml assertion, but keep the token around too, right? | 21:44 |
| marekd | doug-fish: it should be implemeted, but we short on menpower :( And K2K was "under construction" until more or less now. | 21:45 |
| flashgordon | if any keystone folks have a moment, got a nova patch I would like some feedback on | 21:45 |
| flashgordon | https://review.openstack.org/#/c/147042/11 | 21:45 |
| morganfainberg | flashgordon, ah that has been on my list to look at for a bit | 21:45 |
| doug-fish | marekd: ah - this make sense. Maybe I can't find it because it isn't there? | 21:45 |
| marekd | doug-fish: true, but initially I think we were talking about something different, that's why I didn't tell you that. | 21:46 |
| flashgordon | morganfainberg: if you want the short version see the bug https://bugs.launchpad.net/nova/+bug/1408865 | 21:47 |
| openstack | Launchpad bug 1408865 in OpenStack Compute (nova) ""Ignoring EndpointNotFound: The service catalog is empty" error when init_host" [Low,In progress] - Assigned to wanghao (wanghao749) | 21:47 |
| flashgordon | bug explains the issue pretty well | 21:47 |
| morganfainberg | yeah looking at the bug first | 21:47 |
| morganfainberg | because the code didn't make sense right away | 21:47 |
| flashgordon | the solution makes me cringe though | 21:47 |
| marekd | doug-fish: oh, i just recalled: http://blog.rodrigods.com/playing-with-keystone-to-keystone-federation/ | 21:47 |
| morganfainberg | oh god | 21:47 |
| morganfainberg | really?! | 21:47 |
| flashgordon | right | 21:47 |
| *** arunkant has joined #openstack-keystone | 21:47 | |
| *** joesavak has joined #openstack-keystone | 21:47 | |
| morganfainberg | i mean.. sure this looks like a stop gap | 21:48 |
| doug-fish | marekd: yes - I think you've shared that link with me before -- I think the k2k.py code was based indirectly on that article | 21:48 |
| marekd | doug-fish: from your initial desc it looked like you had problems with tokens from *remote* Keystone | 21:48 |
| morganfainberg | flashgordon, we should probably make it so compute can get a catalog in a sane way... but that has other implications... | 21:48 |
| morganfainberg | flashgordon, because $scope$ | 21:49 |
| flashgordon | right, so even if we can get the catalog | 21:49 |
| flashgordon | having nova keep admin credentials for cinder on hand sounds bad | 21:49 |
| morganfainberg | yeah you have no idea what endpoint you should be talking to.. what if Cinder1 is not cinder2, and the users' scope helps suss that out... | 21:50 |
| morganfainberg | ugh. | 21:50 |
| doug-fish | marekd: I think the code I've written gets valid unscoped token from the remote keystone, but it bypasses keystone client and uses k2k.py ... | 21:50 |
| morganfainberg | uhm. | 21:50 |
| flashgordon | I think a better solution, is have nova fail more gracefully. | 21:50 |
| flashgordon | So compute restarts in middle of delete | 21:50 |
| morganfainberg | flashgordon, i would support that | 21:50 |
| flashgordon | delete fails | 21:50 |
| flashgordon | and user has to retry | 21:50 |
| flashgordon | and leave it at that | 21:50 |
| *** radez is now known as radez_g0n3 | 21:51 | |
| doug-fish | marekd: but I'm not able to sort out how I should be getting the projects from the remote keystone based on that unscoped token - I can see how to extend k2k.py to do that, but that just didn't seem right to me | 21:51 |
| marekd | doug-fish: just hit /auth/projects on that remote keystone with your unscoped token | 21:52 |
| flashgordon | morganfainberg: so i didn't fully get the part about scoped catalogs | 21:52 |
| morganfainberg | flashgordon, i *think* that is how AWS basically ends up working. *delete* and if it fails in a wierd way you need to retry... you just need to make sure in the nova case the instance is in an off-state and recoverable to a user [e.g. can try a delete again] | 21:52 |
| flashgordon | will different users possible have different URIs in the catalog? | 21:52 |
| flashgordon | morganfainberg: agreed, commented on the patch saying so | 21:52 |
| doug-fish | marekd: yeah okay - I can do that! | 21:52 |
| morganfainberg | flashgordon, you can filter the catalog based on user's scope, so when i am scoped to project A i may have access to only endpoint X, where when on another project x,y,z endpoints | 21:52 |
| marekd | doug-fish: https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst#listing-projects-and-domains | 21:52 |
| marekd | doug-fish: sorry if i mislead you at first, but from your desc it looked like you are having problems completely somewhere else. | 21:53 |
| *** dims_ is now known as dimsum__ | 21:53 | |
| morganfainberg | flashgordon, and we're adding support to ensure that if a user doesn't have an endpoint in their token they are prevented (if this security feature is enabled) from interacting with the endpoint. [basically what RAX does, if you don't see the endpoint, you can't use it] | 21:53 |
| morganfainberg | flashgordon, obviously opt-in for enforcement. | 21:53 |
| doug-fish | marekd: no worries - trying to describe what is going on has helped improved my understanding, and you've shared a lot of good information | 21:53 |
| flashgordon | morganfainberg: ahh so additional regions etc | 21:54 |
| doug-fish | what I really need is this document https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst#listing-projects-and-domains written in terms of keystoneclient instead of direct API calls | 21:54 |
| doug-fish | s/need/want | 21:54 |
| *** lhcheng__ has joined #openstack-keystone | 21:54 | |
| morganfainberg | or even that you want people who pay for $SSD-fast storage to have access to the endpoint that supports that, and people who don't can't use fast storage | 21:54 |
| morganfainberg | for example | 21:54 |
| morganfainberg | if it's a totally different cinder or somthing | 21:55 |
| flashgordon | morganfainberg: neat | 21:55 |
| morganfainberg | flashgordon, just responded to the review saying i concur with your comment | 21:56 |
| openstackgerrit | Eric Brown proposed openstack/python-keystoneclient: Use oslo_config choices support https://review.openstack.org/160018 | 21:56 |
| *** lhcheng_afk has quit IRC | 21:57 | |
| flashgordon | morganfainberg: awesome, thanks for the consult :) | 21:58 |
| morganfainberg | anytime | 21:58 |
| *** barra204_ has joined #openstack-keystone | 22:02 | |
| *** shakamunyi has quit IRC | 22:03 | |
| *** mattfarina has quit IRC | 22:04 | |
| *** barra204_ has quit IRC | 22:07 | |
| *** barra204_ has joined #openstack-keystone | 22:08 | |
| *** nkinder has quit IRC | 22:08 | |
| *** karimb has quit IRC | 22:15 | |
| ayoung | morganfainberg, guess what: Ran 1032 (+1030) tests in 10.337s (+10.302s) | 22:16 |
| ayoung | PASSED (id=1573, skips=3) | 22:16 |
| morganfainberg | ayoung, holy crap! awesome :) | 22:16 |
| ayoung | morganfainberg, yeah. That means that this might be able to work as a replacement for the client side of auth info, but even if we hold off on that, it means the server side is pretty much right on | 22:17 |
| ayoung | I still need to pep 8 and split the patch | 22:17 |
| ayoung | the JSON stuff was not a problem: oslo handled it. THe old code was not using oslo | 22:17 |
| morganfainberg | ah | 22:18 |
| morganfainberg | that makes life easier | 22:18 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 22:18 |
| ayoung | yeah. | 22:18 |
| ayoung | dolphm, thought we were going to name them after the transport mech? | 22:18 |
| dolphm | morganfainberg: lbragstad: dstanek: updated with docs & better key rotation ^ | 22:18 |
| dolphm | ayoung: that's the next patch i'm putting up, it'll be a discrete change | 22:19 |
| ayoung | ++ | 22:19 |
| morganfainberg | ayoung, the point being not to try and chase renames with other fixes | 22:19 |
| morganfainberg | ayoung. should make reviewing waaaaay better | 22:19 |
| ayoung | just wanted to make sure it was still the plan | 22:19 |
| dolphm | ayoung: i wrote a bunch of docs describing things in terms of payload & transport format though: https://review.openstack.org/#/c/145317/31/doc/source/configuration.rst | 22:19 |
| dstanek | dolphm: nice, i'll take a look after dinner | 22:19 |
| dolphm | morganfainberg: dstanek: there's also an end-user explanation of key rotation in configuration.rst (linked above) | 22:20 |
| dstanek | perfects, thx | 22:21 |
| *** thedodd has quit IRC | 22:21 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 22:21 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 22:22 |
| *** jamielennox is now known as jamielennox|away | 22:23 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add in non-decorator notifiers https://review.openstack.org/158600 | 22:25 |
| ayoung | GAH! Rebase errors | 22:27 |
| ayoung | FAILED (id=1577, failures=2 (-1), skips=3 | 22:27 |
| morganfainberg | ayoung, race to rebase! | 22:27 |
| ayoung | somebody change something on the endpoint definitions? | 22:28 |
| morganfainberg | ayoung, yes. minor change. | 22:28 |
| ayoung | enough to break my patch | 22:28 |
| morganfainberg | ayoung, we collapse services that match. | 22:28 |
| morganfainberg | so if you define compute twice, we would collapse those endpoints | 22:28 |
| morganfainberg | in ksc. | 22:28 |
| ayoung | wonder if I broken that | 22:28 |
| morganfainberg | wasn't you was the way we did session changes | 22:28 |
| ayoung | OK...I'll look later. Back to two failing tests | 22:28 |
| morganfainberg | that was what caused the ksc release yesterday | 22:29 |
| morganfainberg | was actually breaking real users in production | 22:29 |
| ayoung | yeah...I'm sure I can deal with it. Just need to go back and look...but now I need to go be dad. access_info will have to wait | 22:29 |
| morganfainberg | novaclient used to do that, and we said "oh just take the last entry in the catalog" whoopse, that doesn't work | 22:29 |
| morganfainberg | ayoung, sure. have a good evening! | 22:29 |
| morganfainberg | dolphm, btw, who do we complain at within RAX to make it clear that in the catalog if compute != compute things are not cool ;) | 22:30 |
| *** jamielennox|away is now known as jamielennox | 22:30 | |
| morganfainberg | dolphm, same thing with future looking changes (e.g. if someone defines a service more than once) | 22:30 |
| dolphm | morganfainberg: ? | 22:30 |
| morganfainberg | dolphm, so legacy compute | 22:30 |
| morganfainberg | it's not nova | 22:31 |
| dolphm | what is the compute service | 22:31 |
| dolphm | oh, no it's not | 22:31 |
| dolphm | legacy is pre-openstack | 22:31 |
| morganfainberg | but it's defined in the RAX catalog as a separate entry that claims it is compute | 22:31 |
| dolphm | morganfainberg: i'd start by complaining to lbragstad | 22:31 |
| morganfainberg | so you have [ type="compute" <--- Nova, type="compute" <-- legacy] | 22:31 |
| dolphm | totally his fault | 22:31 |
| morganfainberg | haha | 22:31 |
| morganfainberg | obv. | 22:31 |
| morganfainberg | basically i want to hunt down the right folks and make it clear that this is *not* good for users. | 22:32 |
| morganfainberg | so they don't do it again | 22:32 |
| morganfainberg | we papered over it in ksc by making the catalog in-memory construct collapse those two entries...but god if someone tried to use the legacy endpoint when trying to get nova or vice versa | 22:32 |
| morganfainberg | ick | 22:32 |
| morganfainberg | that's just insanity | 22:32 |
| morganfainberg | to be fair, novaclient *used* to do just this before we moved them to session | 22:33 |
| morganfainberg | this notably broke infra | 22:33 |
| morganfainberg | since they have both legacy and nova | 22:33 |
| openstackgerrit | henry-nash proposed openstack/keystone: Implement backend driver support for domain config https://review.openstack.org/158051 | 22:34 |
| jamielennox | doug-fish: i'm not really here, but what's up? | 22:34 |
| morganfainberg | jamielennox, it's the weekend isn't it? :P | 22:34 |
| * morganfainberg shoos jamielennox off to do weekend things. | 22:34 | |
| morganfainberg | ;) | 22:35 |
| jamielennox | morganfainberg: and i'm being told off for being on IRC on a saturday morning | 22:35 |
| jamielennox | morganfainberg: cause you can talk | 22:35 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 22:35 |
| morganfainberg | it's only 1435 on Friday here! | 22:35 |
| doug-fish | jamielennox: I've been working on K2K federation for Horizon .... I think Steve and Marek have answered my immediate questions, but after I process what they've shared I may have more. | 22:35 |
| doug-fish | jamielennox: I appreciate you checking in on the weekend! | 22:35 |
| jamielennox | morganfainberg: right, but it's not on those afternoons where i'm leaving and you're still talking to stevemar | 22:35 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 22:36 |
| morganfainberg | jamielennox, >> | 22:36 |
| morganfainberg | jamielennox, << | 22:36 |
| morganfainberg | ^_^ | 22:36 |
| *** _cjones_ has quit IRC | 22:36 | |
| jamielennox | doug-fish: ok, let me know what you need, i don't have a good story for how k2k will work from client side yet | 22:36 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 22:36 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 22:37 |
| jamielennox | ok, commented on monty's thing, doug-fish doesn't need me - i'm out again, i think it's a beach day | 22:37 |
| doug-fish | jamielennox: will do! have fun! | 22:38 |
| *** _cjones_ has joined #openstack-keystone | 22:38 | |
| *** jamielennox is now known as jamielennox|away | 22:39 | |
| *** jamielennox|away is now known as jamielennox | 22:40 | |
| jamielennox | morganfainberg: oh, yuk: https://review.openstack.org/#/c/159690 | 22:41 |
| jamielennox | bug 1426184 | 22:41 |
| openstack | bug 1426184 in Keystone "CONF.member_role_name isn't used for lookups" [Undecided,New] https://launchpad.net/bugs/1426184 | 22:41 |
| *** mordred has joined #openstack-keystone | 22:41 | |
| mordred | morganfainberg: can you explain roles to me? | 22:41 |
| morganfainberg | mordred, in what manner? | 22:41 |
| mordred | because what I've gotten so far is "you can create a thing called a role, and you can add a user to that thing | 22:42 |
| morganfainberg | mordred, creation of them? consumption of them? assignment of them? | 22:42 |
| mordred | well, you can add a user/project pair to that thing | 22:42 |
| morganfainberg | aye | 22:42 |
| mordred | ok. but then making them do anything is in policy.json which are static files on the disk | 22:42 |
| morganfainberg | yes | 22:42 |
| mordred | morganfainberg: are there any people who think this makes sense? | 22:43 |
| morganfainberg | or crazy custom policy stuff in code. [i think a couple projects do this too] | 22:43 |
| morganfainberg | no, including keystone people | 22:43 |
| mordred | ok | 22:43 |
| mordred | because, and let me just go out on a limb here ... | 22:43 |
| morganfainberg | we are working on getting policy 1st step: centralized in keystone and distributed | 22:43 |
| mordred | roles seem to be global per service defacto | 22:43 |
| morganfainberg | then something a bit more dynamic so you can map these things in a sane way | 22:43 |
| morganfainberg | policy in that case is policy.json | 22:43 |
| mordred | as in, a role only matters if it has a matching entry in some service's policy setup | 22:43 |
| morganfainberg | yes. | 22:44 |
| mordred | so | 22:44 |
| mordred | why would an admin create one with an api call | 22:44 |
| mordred | wouldn't a service just tell keystone the roles it knows about when it connects? | 22:44 |
| mordred | since it necessarily knows what roles it has? | 22:44 |
| morganfainberg | mordred, the hard part there is knowhing all the roles it cares about | 22:44 |
| mordred | why? | 22:44 |
| mordred | it cares about all the roles in policy.json | 22:44 |
| mordred | and it cares about zero more roles | 22:44 |
| morganfainberg | how do i know how to add a role is nova [for instance] is down | 22:45 |
| morganfainberg | s/is/if | 22:45 |
| mordred | you don't | 22:45 |
| mordred | you don't need to | 22:45 |
| mordred | if nova is down | 22:45 |
| mordred | then roles nova needs are pointless | 22:45 |
| morganfainberg | right but if i'm trying to assign a user a grant on a project so they can create VMs, and nova went down | 22:45 |
| mordred | oh - sorry | 22:45 |
| mordred | I'm not suggesting that | 22:46 |
| morganfainberg | ah. | 22:46 |
| mordred | I'm suggesting - when nova boots, nova should run a for loop of "keystone role-create" | 22:46 |
| mordred | and same for every other service | 22:46 |
| mordred | it sholdn't be an admin task | 22:46 |
| mordred | that's silly | 22:46 |
| morganfainberg | we're thinking about this the otherway: keystone is authoratative for both policy and the roles | 22:46 |
| mordred | there are no things an admin can do that add value here | 22:46 |
| morganfainberg | so you can craft the policy/etc in keystone then have the services pull that down | 22:46 |
| mordred | sure - that is also a thing | 22:46 |
| mordred | but having it be authoritative for half is crazy | 22:47 |
| morganfainberg | yes it is | 22:47 |
| mordred | ok | 22:47 |
| mordred | as long as we all agree | 22:47 |
| morganfainberg | yep | 22:47 |
| mordred | because this admin step of "now add roles" | 22:47 |
| mordred | I mean | 22:47 |
| mordred | come on | 22:47 |
| morganfainberg | 100% agree with you | 22:47 |
| morganfainberg | so the steps to get there are: 1) centralize policy.json [raw form] in keystone, have services pull that down, 2) make policy something workable in keystone so it's more dynamic (still have services pull that down), 3) ???, 4) profit | 22:48 |
| morganfainberg | these are liberty targets at this point. but there is little resistance towards that as far as i've heard | 22:49 |
| morganfainberg | actually the first step was graduating olso.policy ;) | 22:50 |
| morganfainberg | so we can maek the rules engine better and/or able to handle things in better ways. | 22:50 |
| openstackgerrit | Eric Brown proposed openstack/keystonemiddleware: Use oslo_config choices support https://review.openstack.org/160031 | 22:50 |
| *** abhirc has joined #openstack-keystone | 22:51 | |
| mordred | morganfainberg: when the policy.json file is in keystone | 22:52 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 22:52 |
| mordred | morganfainberg: does that mean that keystone could, you know, infer the list of roles contained within? | 22:52 |
| morganfainberg | yep that is one of the goals. | 22:52 |
| mordred | awesome | 22:52 |
| mordred | if it had not been one of the goals I would have been sad | 22:52 |
| morganfainberg | so you can ask: what can i do with role X | 22:53 |
| morganfainberg | or the inverse: to do X what role do i need | 22:53 |
| morganfainberg | based on the coarse polcy.json representation in the latter | 22:53 |
| mordred | can I ask a stupid question? | 22:53 |
| morganfainberg | sure | 22:53 |
| mordred | what defines the X in to do X what role do I need? | 22:53 |
| mordred | somewhere in the service there has to be a named capability, right? | 22:54 |
| morganfainberg | nova would have specific capabilities. this is where we get into some chicken egg issues | 22:54 |
| *** lhcheng__ is now known as lhcheng | 22:54 | |
| morganfainberg | yeah | 22:54 |
| mordred | morganfainberg: I want to stop asking questions right now don't I? | 22:54 |
| morganfainberg | but, i've opted to make the experience *generally* better and work on how we register that down the line. | 22:54 |
| morganfainberg | nah. | 22:54 |
| mordred | sure! | 22:54 |
| mordred | better is better | 22:54 |
| morganfainberg | these are all things i've been annoyed by for a while | 22:54 |
| morganfainberg | and why we tried to have policy discussions @ paris :) | 22:55 |
| morganfainberg | but big tent discussions pre-empted some of them | 22:55 |
| mordred | nod | 22:55 |
| *** mattfarina has joined #openstack-keystone | 22:55 | |
| morganfainberg | your questions are all 100% in line with my view on stuff for making deployer and user experiences both better | 22:56 |
| morganfainberg | keep asking if there is more to ask though ;) | 22:56 |
| dolphm | mordred: i think the original mistake is in keystone trying to "own" the concept of a role in the first place - it should just be a string in keystone. other services' authorization code (and really their policy.json files) is what really owns a role | 22:57 |
| *** hichtakk has joined #openstack-keystone | 22:57 | |
| *** barra204_ has quit IRC | 22:57 | |
| dolphm | mordred: but from where we are at, populating keystone with roles out of policy.json blobs probably the best move | 22:58 |
| *** abhirc has quit IRC | 22:58 | |
| morganfainberg | dolphm, i agree, none of the changes we're proposing would be broken by that inversion of responsibility, but it could also mean something else could own both. today that is hard because we owned role to begin with | 22:58 |
| dolphm | ++ | 22:58 |
| *** spandhe has quit IRC | 22:58 | |
| *** joesavak has quit IRC | 22:59 | |
| morganfainberg | so.. lets make the best of it and really own it :) | 22:59 |
| morganfainberg | though i kind of dig what repose does for you gjuys... if only it wasn't java [for $reasons] | 23:00 |
| *** nellysmitt has joined #openstack-keystone | 23:00 | |
| morganfainberg | not because i hate java, but because i'm tired of the language holy war other people keep bringing up. | 23:00 |
| *** spandhe has joined #openstack-keystone | 23:02 | |
| henrynash | dolphm: there’s one addition high priorrty spec (domain-configs, see: https://blueprints.launchpad.net/keystone/+spec/domain-config-ext)….could we get it added to https://gist.github.com/dolph/651c6a1748f69637abd0 | 23:04 |
| *** nellysmitt has quit IRC | 23:05 | |
| mordred | dolphm, morganfainberg: ++ | 23:06 |
| morganfainberg | henrynash, whats the review for that? | 23:06 |
| *** jamielennox is now known as jamielennox|away | 23:06 | |
| morganfainberg | henrynash, i can def. add it | 23:06 |
| gyee | lets ask Horizon folks how they feel about roles :) | 23:06 |
| henrynash | morganfainberg: the code, you mean? | 23:06 |
| morganfainberg | the reviewe you want on the gist | 23:06 |
| gyee | and having to parse policy.json files to setup a good UI | 23:07 |
| henrynash | morganfainberg: to put a link to the blueprint or the code patches? | 23:07 |
| morganfainberg | uh. the gist is handled via gerrit reviews | 23:07 |
| morganfainberg | henrynash, so if i star a review it's there | 23:08 |
| morganfainberg | so if we have a spec review i need to know which spec review to star :) | 23:08 |
| henrynash | morganfainberg: so the review patches start at: https://review.openstack.org/#/c/157701/ | 23:08 |
| henrynash | (it’s a chain) | 23:08 |
| morganfainberg | we might need a FFE for this btw. | 23:08 |
| morganfainberg | henrynash, are there API reviews as well? | 23:09 |
| henrynash | morgainfainberg: API alradsy merged | 23:09 |
| morganfainberg | ok | 23:09 |
| morganfainberg | cool | 23:09 |
| henrynash | morganfainberg: thx | 23:11 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Rename "Keystone LightWeight Tokens" (KLWT) to "Fernet" tokens https://review.openstack.org/160040 | 23:12 |
| dolphm | morganfainberg: lbragstad: ayoung: ^ | 23:13 |
| morganfainberg | awesome | 23:13 |
| bknudson | furby tokens | 23:15 |
| bknudson | http://en.wikipedia.org/wiki/Fernet ?? | 23:15 |
| bknudson | "a bitter, aromatic spirit" | 23:15 |
| morganfainberg | bknudson, https://cryptography.io/en/latest/fernet/ | 23:16 |
| *** ljfisher has quit IRC | 23:16 | |
| bknudson | just like dolphm | 23:16 |
| morganfainberg | but i do like that it's named after a spirit | 23:16 |
| morganfainberg | :) | 23:16 |
| morganfainberg | though fernet is gross to drink imo | 23:16 |
| bknudson | how about MultiFernet ? | 23:17 |
| bknudson | are people going to think that fernet tokens don't support key rotation? | 23:17 |
| *** jorge_munoz has quit IRC | 23:17 | |
| morganfainberg | bknudson, dolphm has some documentation around that. | 23:17 |
| *** doug-fish has left #openstack-keystone | 23:18 | |
| dolphm | bknudson: we | 23:18 |
| dolphm | bknudson: we're only using MultiFernet | 23:18 |
| dolphm | bknudson: and yes, they're named after the spirit AFAIK. github.com/fernet | 23:19 |
| bknudson | do you need to use fernet.generate_key() to get a key? | 23:19 |
| bknudson | oh, it's just a os.urandom(32) | 23:20 |
| bknudson | looks like there is something special about 32 chars, too. | 23:20 |
| bknudson | I'd prefer the renaming was done in the base patch... no reason to start with the wrong name. | 23:23 |
| morganfainberg | bknudson, easier to put the rename on the end at this point - so as to not interrupt/force a re-review of the code. | 23:25 |
| bknudson | https://review.openstack.org/#/c/145317/31 has 0 reviews. | 23:26 |
| bknudson | and I think reviewers can handle a name change. | 23:26 |
| morganfainberg | bknudson, no but we've been reviewing that a lot and have a state of where it's at | 23:26 |
| morganfainberg | when you introduce a restructure it changes that and forces a lot more re-review time | 23:27 |
| bknudson | ok... it's easy to review the name change patch, too. | 23:27 |
| morganfainberg | the fact that it's 31 patches means it's already had a ton of re-review. isolating the name change means you only need to review the name change to make sure it's right :) | 23:27 |
| bknudson | hopefully it won't take weeks to get the name change merged. | 23:28 |
| morganfainberg | god, i hope not | 23:28 |
| morganfainberg | considering we're at the deadline.. | 23:28 |
| bknudson | I should have posted all my changes at the end of the release then I wouldn't have to rebase as much. | 23:28 |
| morganfainberg | next cycle if i'm PTL we're moving back to m2 as the feature freeze. this hasn't been fun to cram everything into m3 | 23:28 |
| morganfainberg | i'd like m3 to be just featurs that actually slipped and making sure we don't have bugs. | 23:29 |
| morganfainberg | and a lot of this is because we crammed everything into m3 | 23:30 |
| bknudson | there's only so much time for doing reviews. | 23:31 |
| morganfainberg | i know. | 23:31 |
| morganfainberg | too many features and not enough reviewing. | 23:32 |
| morganfainberg | and everything crammed into a very short window. | 23:32 |
| morganfainberg | makes m3 very very unfun | 23:32 |
| bknudson | The nova team has been trying different things... not sure if they're working or not. | 23:32 |
| morganfainberg | at least for me. | 23:32 |
| morganfainberg | dunno how much it's impacted everyone else [except rebase hell] | 23:32 |
| *** gordc has quit IRC | 23:32 | |
| bknudson | e.g., runways and requiring cores to sponsor. | 23:32 |
| bknudson | it'll impact everyone who thought their bp would be in the release. | 23:33 |
| morganfainberg | i mean so far. obivously things punted affect people | 23:33 |
| bknudson | right, they'll be affected eventually... might come as a surprise to them. | 23:34 |
| morganfainberg | i think we were better with the earlier deadlines, less surprise when things don't land. | 23:34 |
| morganfainberg | honestly i think the spec process is using the wrong tool for the job. | 23:35 |
| bknudson | morganfainberg: also, just checking if the gist like for high-priority reviews is up to date? | 23:35 |
| morganfainberg | but its still better than lp | 23:35 |
| morganfainberg | bknudson, yeah it's up-to-date | 23:35 |
| morganfainberg | i removed anything that wasn't still targeted to kilo | 23:35 |
| bknudson | the spec process is lacking reviews just like the code... took too long to get approval. | 23:36 |
| morganfainberg | the issue is git is a very poor tool for specs | 23:36 |
| bknudson | I didn't prioritize reviews of specs because I care more about bug fixes. | 23:36 |
| morganfainberg | and the review process isn't good for that kind of collaboration | 23:36 |
| bknudson | the mid-cycle or the summit are likely the best place for spec discussions. | 23:37 |
| morganfainberg | thats why i'm planning on [again provided i'm ptl] | 23:37 |
| *** dims_ has joined #openstack-keystone | 23:37 | |
| morganfainberg | making m1 the spec deadline, making the summit spec discussions | 23:37 |
| *** carlosmarin has quit IRC | 23:37 | |
| morganfainberg | opening specs to be accepted for L once k3 is cut | 23:37 |
| morganfainberg | and m2 is feature freeze, m2 -> m3 is bugs/smooth out the features | 23:38 |
| *** dimsum__ has quit IRC | 23:38 | |
| morganfainberg | m3 -> rc is focus on bugs/usability concerns from m1,2,3 | 23:38 |
| bknudson | maybe we'll get out of the integrated release then we can add features whenever we want. | 23:38 |
| *** dims_ has quit IRC | 23:39 | |
| morganfainberg | bknudson, thats another separate topic i can't plan for yet ;) | 23:39 |
| *** dimsum__ has joined #openstack-keystone | 23:39 | |
| morganfainberg | bknudson, so planning for the workflow we have until that changes. | 23:39 |
| *** _cjones_ has quit IRC | 23:40 | |
| *** _cjones_ has joined #openstack-keystone | 23:41 | |
| notmyname | I've got a keystone deployment question. hoping someone can help | 23:42 |
| morganfainberg | notmyname, /me goes and hides :P | 23:42 |
| morganfainberg | notmyname, ask away :) | 23:42 |
| notmyname | heh | 23:42 |
| bknudson | I thought keystone was just some source code in git... people deploy it? | 23:43 |
| notmyname | so suppose I have multiple independent keystone deployments. and they all point to the same cloud infrastructure. how does that work? how have other people handled that? | 23:43 |
| notmyname | bknudson: lol | 23:43 |
| morganfainberg | not sure what you're asking | 23:44 |
| notmyname | is there any way that multiple keystone instances can cooperate? | 23:44 |
| morganfainberg | like 3 different keystones [with different databases, etc] and the same nova-apis controlled by them? | 23:44 |
| notmyname | yes | 23:45 |
| notmyname | (or swift in my case, of course ;-) | 23:45 |
| morganfainberg | not in the current design scope to have different keystones | 23:45 |
| notmyname | what's the barrier? | 23:45 |
| notmyname | or limitation? | 23:45 |
| morganfainberg | the database ;) | 23:45 |
| morganfainberg | how tokens are validated | 23:45 |
| notmyname | I don't understand | 23:45 |
| morganfainberg | thats the real limiting factor | 23:45 |
| bknudson | we'll have keystone-to-keystone federation. | 23:45 |
| morganfainberg | we have k2k federation to help with that, but it's pretty new [not workable in juno] | 23:46 |
| bknudson | so you can take a token from keystone1 and use it to get a token in keystone2. | 23:46 |
| morganfainberg | bknudson, but that isn't what was asked, i don't think | 23:46 |
| morganfainberg | today nova can accept tokens from 1 keystone. | 23:46 |
| notmyname | ya, I don't think that's exactly what's needed | 23:46 |
| bknudson | oh, right... auth_token middleware doesn't know the source of the token. | 23:47 |
| bknudson | especially in the case of UUID | 23:47 |
| morganfainberg | k2k federation allows you to use 1 keystone to get a token for another, but it doesn't allow multiple independant keystones to directly control a specific api | 23:47 |
| morganfainberg | so you'd need to keep the databases in sync between the keystones. | 23:47 |
| bknudson | maybe with fernet tokens you can share them? | 23:48 |
| notmyname | in this case, I've got a customer (actually more than one) with existing multiple independent keystones running. they want to unify a global swift deployment, but they want to keep the multiple keystone instances (they may be different departments or business units) | 23:48 |
| morganfainberg | bknudson, still need the assignment data shared | 23:48 |
| morganfainberg | bknudson, and identity data likely | 23:48 |
| morganfainberg | notmyname, today not doable. | 23:48 |
| morganfainberg | notmyname, without some highly custom validation middleware | 23:48 |
| notmyname | so that you can get creds from a keystone ("your keystone") and send it to a swift endpoint | 23:48 |
| bknudson | tell your customers they're high. | 23:48 |
| notmyname | you're saying it's a limitation of the auth_token middleware? | 23:49 |
| morganfainberg | notmyname, a "global deployment" with "whatever auth endpoints I like" is kindof a crazy request | 23:49 |
| bknudson | auth_token is one place that this could be handled. | 23:49 |
| morganfainberg | auth_token would need to know how to determine where a token came from | 23:49 |
| morganfainberg | so it could ask the right endpoint to validate it | 23:49 |
| notmyname | ok | 23:50 |
| morganfainberg | especially with UUID tokens - that is almost impossible, since the token has 32 characters that are opaque to that | 23:50 |
| bknudson | y, that could be through a slightly longer token with a prefix or maybe with PKI tokens. | 23:50 |
| notmyname | one thing I've been thinking is multiple instances of middleware in the pipeline | 23:50 |
| notmyname | ok | 23:50 |
| notmyname | so it (auth_token middleware) doesn't know where to validate it so it can't differentiate it | 23:50 |
| morganfainberg | notmyname, it would be a lot of overhead - a lot, since now i need to potentially ask each keystone if something is valid | 23:50 |
| notmyname | in swift we've got the concept of | 23:51 |
| *** hockeynut has quit IRC | 23:51 | |
| bknudson | lots of overhead, but PKI tokens might be doable. | 23:51 |
| notmyname | in swift we've got the concept of "reseller prefixes". that allows for multiple auth systems without having to query each one | 23:51 |
| morganfainberg | bknudson, pki or fernet could make this doable | 23:51 |
| bknudson | of course, PKI tokens are lots of overhead. | 23:51 |
| morganfainberg | notmyname, sure. you could make auth_token smarter on that kind of front, but it's not something we've designed anything for really | 23:51 |
| *** hockeynut has joined #openstack-keystone | 23:52 | |
| notmyname | so, the request coming in with a token (uuid token) has a swift account in the reuqest. which has the reseller prefix. which means I can point to a different keystone config | 23:52 |
| morganfainberg | notmyname, this sounds highly swift specific | 23:52 |
| morganfainberg | trying to figure out how this woudl apply to a nova, and i'd be scared | 23:52 |
| notmyname | ya, that's something that the keystonemiddleware (in swift's tree) can do | 23:52 |
| morganfainberg | notmyname, it also potentially could open massive security issues | 23:52 |
| morganfainberg | notmyname, because all i need to do is make my keystone validate things in a wierd way [assuming it's not all controlled by 1 group] | 23:53 |
| morganfainberg | and now i grant access where it's not supposed to happen | 23:53 |
| bknudson | y, sending tokens to an untrusted server essentially gives them access to your cloud. | 23:53 |
| morganfainberg | bknudson, ++ | 23:53 |
| notmyname | no, it would be the swift cluster configs that control where it's validating (ie 1:1 reseller prefix to endpoint) | 23:54 |
| morganfainberg | notmyname, the reason we designed k2k federation the way we did to make you get a token local to that deployment is to ensure we trust the tokens/control the issuance | 23:54 |
| notmyname | (or that's why it's not a security issue for other systems) | 23:54 |
| notmyname | ok, this has helped a lot. thanks | 23:54 |
| bknudson | so you've got your swift auth_token... then you'd need an option for keystone to prefix tokens. | 23:54 |
| morganfainberg | bknudson, in fernet/uuid yes, in pki you could decode and extract informaiton | 23:55 |
| notmyname | right. the keystone auth_token middleware doesn't know about these things and would need to differentiate somehow | 23:55 |
| notmyname | which it can't do now | 23:55 |
| bknudson | morganfainberg: you can extract fernet, right? | 23:55 |
| morganfainberg | bknudson, no, it's encrypted/opaque | 23:56 |
| bknudson | auth_token has the secret? | 23:56 |
| notmyname | now, follow-on question (and totally serious). if I (we, swiftstack) were to want to write that for keystone, is it something possible or pretty much a non-starter? | 23:56 |
| bknudson | oh. | 23:56 |
| morganfainberg | bknudson, but the msgpack underpinnings can be leveraged with a non-opaque transport like pki | 23:56 |
| bknudson | considering the size of the code change I don't see why not. | 23:56 |
| bknudson | we've got worse things in keystone. | 23:56 |
| morganfainberg | notmyname, my biggest concern is security - as long as we walk through that in sane ways and solve issues that come up i'd be ok with it. | 23:57 |
| notmyname | ok, good to know | 23:57 |
| morganfainberg | notmyname, the concept in itself isn't bothering me. but i'd want to really spend some time making sure we don't open holes. | 23:57 |
| notmyname | of course | 23:57 |
| notmyname | I don't currently know enough about auth_token middleware to know the scope of the work | 23:57 |
| morganfainberg | it likely also would require some work in keystone [minimal] to provide a clear identifier on who signed/authorized things | 23:58 |
| notmyname | what do you think. assuming no huge issues uncovered. is this measured in weeks?, months? quarters? of dev time | 23:58 |
| bknudson | you could wrap auth_token. | 23:58 |
| morganfainberg | notmyname, uhm. changes to middleware tend to be easy. | 23:58 |
| bknudson | e.g., the wrapper checks the prefix and only passes the request to the auth_token if it matches. | 23:58 |
| morganfainberg | bknudson, it could also just be another middleware that handles the first stage and then passes the data on to auth_token | 23:58 |
| notmyname | morganfainberg: ya, but it's the tentacles into other parts that are tricky ;-) | 23:58 |
| notmyname | bknudson: interesting | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!