| mordred | sure | 00:00 |
|---|---|---|
| jamielennox | seems unlikely | 00:00 |
| mordred | but I have to handle it in the library because it's a valid input | 00:00 |
| jamielennox | yep | 00:00 |
| mordred | yay! | 00:00 |
| jamielennox | i know that issue well | 00:00 |
| mordred | :) | 00:00 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add unit tests for sample policy token operations https://review.openstack.org/160204 | 00:02 |
| *** ncoghlan has joined #openstack-keystone | 00:21 | |
| *** spandhe has quit IRC | 00:22 | |
| *** stevemar has joined #openstack-keystone | 00:26 | |
| *** ChanServ sets mode: +v stevemar | 00:26 | |
| *** dimsum__ has joined #openstack-keystone | 00:34 | |
| *** dims_ has joined #openstack-keystone | 00:35 | |
| *** dims_ is now known as dims | 00:36 | |
| *** dimsum__ has quit IRC | 00:39 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix sample policy allows user to revoke or check own token https://review.openstack.org/155916 | 00:42 |
| morganfainberg | ayoung, i feel slimy saying this...but since we already have sortof implemented a kerberos-like thing for tokens [ugh], maybe we should implement an S4U2Proxy for offloading the "do something on my behalf" things nova needs to do | 00:54 |
| morganfainberg | ayoung, the slimy comes from sticking with the token system i'm not a fan off, but can't come up with an alternative | 00:55 |
| morganfainberg | that would be API compatible [and lets face it, changing the API at that level is a nightmare] | 00:55 |
| morganfainberg | and if a user can declare the interface (e.g. nova boot) they're going to interact with, we could at least limit that chain to things that accept for "nova boot", which could be encoded in the policy language | 00:57 |
| morganfainberg | and through an SELinux non-enforce mode like thing we could map out these paths... but ugh so much pain for security :( | 00:57 |
| bknudson | just use rootwrap | 00:57 |
| morganfainberg | bknudson, HAH | 00:57 |
| morganfainberg | bknudson, i see what you did there... | 00:58 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add unit tests for sample policy token operations https://review.openstack.org/160204 | 00:58 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix sample policy allows user to revoke or check own token https://review.openstack.org/155916 | 00:58 |
| stevemar | bknudson, nice patches ya got there | 00:59 |
| stevemar | thtas a good bug | 00:59 |
| bknudson | stevemar: it's still weird... not sure why we need to have a policy for a user revoking their own token. | 01:00 |
| bknudson | If someone's got a token then just use the token... | 01:00 |
| stevemar | i'll grant you that the use case doesn't really gel with me | 01:00 |
| morganfainberg | bknudson, a policy for revoking their own token? as in if they logout from horizon? | 01:00 |
| jamielennox | morganfainberg: now who's working on the weekend | 01:01 |
| morganfainberg | jamielennox, shhhh | 01:01 |
| morganfainberg | jamielennox, <-- PTL i have an excuse. | 01:01 |
| *** samueldmq has joined #openstack-keystone | 01:01 | |
| stevemar | jamielennox, well when theres 1 week left of kilo3, it's expected | 01:01 |
| morganfainberg | stevemar, 1 wk? like a couple days :P | 01:01 |
| bknudson | morganfainberg: https://bugs.launchpad.net/keystone/+bug/1421825 | 01:01 |
| openstack | Launchpad bug 1421825 in Keystone "Sample policy should allow user to validate and revoke own token" [Undecided,In progress] - Assigned to Brant Knudson (blk-u) | 01:01 |
| bknudson | there's examples in there. | 01:02 |
| jamielennox | this is where client side doesn't matter :) | 01:02 |
| morganfainberg | sure | 01:02 |
| morganfainberg | bknudson, i was thinking it was a legit use-case, not that i really advocate revoking tokens all overt the place | 01:02 |
| jamielennox | bknudson: i found a similar one to that the other day, cloud_admin can't revoke a user token | 01:02 |
| stevemar | revoke all the tokens!! | 01:03 |
| jamielennox | bknudson: want to make that part of the same bug? | 01:03 |
| bknudson | morganfainberg: the thing that's weird is why have a policy at all for using a token to revoke a token? | 01:03 |
| bknudson | if a token can be revoked using the token and I've got the token then I shouldn't need another token. | 01:03 |
| morganfainberg | bknudson, X-Subject vs X-Auth ? | 01:03 |
| morganfainberg | oj | 01:03 |
| bknudson | morganfainberg: right. | 01:03 |
| morganfainberg | oh | 01:03 |
| morganfainberg | i see, admin vs self | 01:03 |
| jamielennox | well in this case it was because tempest is doing stuff on cleanup | 01:04 |
| morganfainberg | yeah i don't want jamielennox revoking my tokens, but i don't mind if cloud_admin were | 01:04 |
| morganfainberg | but i should be able to revoke my own token if i so choose | 01:04 |
| bknudson | does auth_token middleware need its service token to validate tokens that it gets? | 01:04 |
| bknudson | why not just use the token? | 01:04 |
| morganfainberg | bknudson, i think because validate is priviledged | 01:04 |
| bknudson | you can revoke your own token but not validate it? | 01:05 |
| morganfainberg | you could in theory look for valid tokens if you could validate a token with itself | 01:05 |
| morganfainberg | oh | 01:05 |
| morganfainberg | so self validate, or self revoke | 01:05 |
| morganfainberg | hm. | 01:05 |
| morganfainberg | sure. | 01:05 |
| bknudson | you can look for valid tokens just by trying operations. | 01:05 |
| morganfainberg | just not non-priv token validate other non-priv token | 01:05 |
| bknudson | list users or something. | 01:05 |
| morganfainberg | i guess it's a small gap | 01:06 |
| bknudson | is cloud admin supposed to be able to validate tokens? | 01:07 |
| morganfainberg | bknudson, but you could also with a validate know canonically what roles you have. it opens a small door | 01:07 |
| morganfainberg | i would assume cloud admin could validate or revoke | 01:07 |
| *** davechen has joined #openstack-keystone | 01:07 | |
| morganfainberg | since cloud admin should be able to disable users. | 01:07 |
| bknudson | b/c I don't think they can based on the testing I was doing. | 01:07 |
| morganfainberg | i might be crazy thinking as much | 01:07 |
| bknudson | morganfainberg: look at the end of this: https://review.openstack.org/#/c/160204/1/keystone/tests/unit/test_v3_protection.py | 01:08 |
| morganfainberg | bknudson, see it. | 01:09 |
| bknudson | unless I don't understand how the users are set up there, cloud_admin_user couldn't revoke a user's token. | 01:09 |
| bknudson | I changed that test in patch set 2 to use domain_admin_user and that worked for some reason. | 01:09 |
| bknudson | (Note that I don't understand the v3cloudpolicy file...) | 01:09 |
| morganfainberg | so i think that is a bug in v3cloud admin if the cloud admin can't revoke | 01:10 |
| bknudson | v3cloudsample.policy file. | 01:10 |
| ayoung | morganfainberg, lets talk at the summit. I don't think that is quite the right way of saying it | 01:10 |
| morganfainberg | ayoung, i am sure i'm saying it wrong, but conceptually it's related. | 01:10 |
| morganfainberg | ayoung, i have some other bits to add to that convo, but was trying to distil down some bits to make it easier to type | 01:11 |
| ayoung | OK...so what if, instead of that, we said we woiuld provide a dictionary, with a token for each of the remote services. A user sends s token nova, nova validates, and then picks of the remote token to use when calling glance | 01:11 |
| ayoung | when the user creates a token on the Keystone side, there is an implied trust that is associated with the service catalog | 01:12 |
| morganfainberg | ayoung, sort of the direction i was headed... i think i need to draw up / write up the workflow | 01:13 |
| morganfainberg | ayoung, it is sortof revisiting the composite token concept. | 01:13 |
| morganfainberg | *sortof* | 01:13 |
| ayoung | morganfainberg, the trick will be giving Nova a way to select the right token | 01:13 |
| ayoung | Is there anywhere we need this kind of functionality but with Nova? | 01:13 |
| morganfainberg | ayoung, heat | 01:14 |
| morganfainberg | in theory | 01:14 |
| ayoung | Nah, heat can be made to use trusts | 01:14 |
| morganfainberg | but in practice they use trusts | 01:14 |
| morganfainberg | cinder minght need it | 01:14 |
| ayoung | I was thinking glance might need it to tlak to swift? | 01:14 |
| morganfainberg | if you're creating a volume from a glance image | 01:14 |
| ayoung | ah | 01:14 |
| morganfainberg | glance <-> swift. | 01:14 |
| morganfainberg | uhm... | 01:14 |
| ayoung | lets find out, and map the uses on out | 01:14 |
| morganfainberg | yeah probably more too | 01:14 |
| morganfainberg | anytime a service does X on behalf of user as a side effect of Y | 01:15 |
| ayoung | short lived, multi service co-ordinations | 01:15 |
| morganfainberg | yep | 01:16 |
| ayoung | I talked it over with Simo. I think what we are doing here is really different than oauth and the other mechanisms were designed to support. Maybe the world does need Keystone tokens after all | 01:16 |
| ayoung | btw...I need to deal with some Python34 issues on the access_info review. | 01:17 |
| ayoung | But splitting the tests went cleanly. Only one test failure, and it was for a change that I should have rolled back | 01:17 |
| morganfainberg | nice | 01:17 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add unit tests for sample policy token operations https://review.openstack.org/160204 | 01:19 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix sample policy allows user to revoke or check own token https://review.openstack.org/155916 | 01:19 |
| *** henrynash has quit IRC | 01:41 | |
| *** himangi has joined #openstack-keystone | 01:55 | |
| *** davechen_ has joined #openstack-keystone | 02:05 | |
| *** diegows has quit IRC | 02:07 | |
| *** davechen has quit IRC | 02:08 | |
| *** erkules_ has joined #openstack-keystone | 02:13 | |
| *** erkules has quit IRC | 02:15 | |
| *** richm has quit IRC | 02:19 | |
| *** gabrielbezerra has quit IRC | 02:21 | |
| *** wpf has joined #openstack-keystone | 02:23 | |
| *** gabrielbezerra has joined #openstack-keystone | 02:24 | |
| *** trey_ has joined #openstack-keystone | 02:27 | |
| *** trey has quit IRC | 02:27 | |
| *** trey_ is now known as trey | 02:27 | |
| ayoung | bknudson, so..I was creating class to deal with Date/string conversions. I had descended from String (JSON marshalling kindof dictated that) but with Python 3, when doing htat, I get | 02:36 |
| ayoung | TypeError: object.__init__() takes no parameters | 02:36 |
| ayoung | I had | 02:36 |
| ayoung | class DateString(six.text_type): | 02:36 |
| ayoung | def __init__(self, value): | 02:36 |
| ayoung | assert_datetime(value) | 02:36 |
| ayoung | self.value = value | 02:36 |
| ayoung | and then | 02:37 |
| ayoung | super(DateString, self).__init__(strval) | 02:37 |
| ayoung | and it is the last part that is problematic, I guess | 02:37 |
| ayoung | strings much not take the value in the init param? Not sure why it is jumping direct to object, but I had the same thing with str | 02:38 |
| *** junhongl has joined #openstack-keystone | 02:42 | |
| *** DaveChen has joined #openstack-keystone | 02:51 | |
| *** davechen_ has quit IRC | 02:51 | |
| *** davechen_ has joined #openstack-keystone | 02:59 | |
| *** DaveChen has quit IRC | 03:02 | |
| *** _cjones_ has joined #openstack-keystone | 03:14 | |
| stevemar | morganfainberg, i'm restless, what should i do | 03:24 |
| *** lhcheng has joined #openstack-keystone | 03:25 | |
| morganfainberg | stevemar, uh | 03:26 |
| morganfainberg | stevemar, keystone stuff, non keystone stuff, or watch movies? ;) | 03:28 |
| morganfainberg | i have recommendations for all three categories | 03:28 |
| *** samueldmq has quit IRC | 03:30 | |
| stevemar | morganfainberg, i'm going to settle for another episode of house o' cards | 03:31 |
| morganfainberg | that was what i was going to recommend over movies had you selected that category | 03:32 |
| stevemar | (still season 1 :( ) | 03:32 |
| * morganfainberg has watched 1 ep of season 3 so far | 03:32 | |
| morganfainberg | stevemar, http://www.vox.com/2015/2/27/8119829/house-of-cards-spacey-southern-accent | 03:32 |
| stevemar | morganfainberg, we need topol to weigh in on it | 03:33 |
| *** dims has quit IRC | 03:35 | |
| stevemar | morganfainberg, not bad | 03:38 |
| *** panbalag has joined #openstack-keystone | 03:38 | |
| *** nkinder has joined #openstack-keystone | 03:38 | |
| morganfainberg | i like the h-w inversion description | 03:38 |
| morganfainberg | while -> hwile | 03:38 |
| morganfainberg | reminds me of a family guy skit | 03:38 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Use Model for access_info https://review.openstack.org/160134 | 03:42 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: pep8 fix for CMS https://review.openstack.org/160132 | 03:42 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Test updates to prep for unified access info https://review.openstack.org/160133 | 03:42 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/138519 | 03:42 |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/keystone: Use dict comprehensions instead of dict constructor https://review.openstack.org/143842 | 03:45 |
| stevemar | morganfainberg, like cool 'hwip' | 03:46 |
| jamielennox | stevemar: looking at OSC auth and it's still all twisted and weird | 03:47 |
| *** panbalag has quit IRC | 03:47 | |
| stevemar | jamielennox, yep, the patch that you had going on, i don't think it ever landed right? | 03:47 |
| stevemar | jamielennox, it's weird, but it works? | 03:48 |
| jamielennox | stevemar: no, and i went back to it a while later and had to much to rebase | 03:48 |
| jamielennox | stevemar: yep, mostly | 03:48 |
| stevemar | jamielennox, i think dtroyer tried to keep up with it, but we were trying to get a 1.0.0 release out the door | 03:48 |
| jamielennox | yea, i remember | 03:48 |
| *** tqtran_afk has joined #openstack-keystone | 03:49 | |
| jamielennox | maybe i'll get back around to it just in time to have another big summit push | 03:49 |
| *** lhcheng has quit IRC | 03:49 | |
| *** _cjones_ has quit IRC | 03:51 | |
| jamielennox | stevemar: if you're not doing anything can you look at this chain again: https://review.openstack.org/#/c/157280/ | 03:51 |
| *** csoukup has joined #openstack-keystone | 03:55 | |
| *** david-lyle_afk has quit IRC | 04:02 | |
| *** himangi has quit IRC | 04:18 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Get initiator from manager and send to controller https://review.openstack.org/155660 | 04:26 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add CADF notifications for trusts https://review.openstack.org/151867 | 04:26 |
| *** himangi has joined #openstack-keystone | 04:30 | |
| *** dims has joined #openstack-keystone | 04:35 | |
| *** dims has quit IRC | 04:40 | |
| *** fifieldt has joined #openstack-keystone | 04:44 | |
| *** csoukup has quit IRC | 04:47 | |
| morganfainberg | stevemar, am i missing something... but https://review.openstack.org/#/c/154934/19/keystone/auth/plugins/mapped.py looks like it never actually checks that a user exists if it's a local user? | 04:48 |
| morganfainberg | i'm just not seeing where the local user_id is being pulled out and utilized. | 04:48 |
| morganfainberg | or username is being lookedup and validated it is in-fact a local user. | 04:49 |
| *** Akshik has joined #openstack-keystone | 04:52 | |
| stevemar | morganfainberg, lookin | 04:54 |
| morganfainberg | i admit i might be missing where that is done... but... i just don't see it | 04:54 |
| stevemar | morganfainberg, it's in another patch | 04:54 |
| stevemar | morganfainberg, https://review.openstack.org/#/c/156308/ | 04:54 |
| morganfainberg | earlier or later? | 04:54 |
| morganfainberg | ah | 04:54 |
| morganfainberg | so i *wasn't* crazy | 04:54 |
| stevemar | morganfainberg, maybe just a bit, but not in this regard | 04:55 |
| stevemar | morganfainberg, he was just making the mapping engine return the 'user' object instead of trying to fish out the name/id/blah | 04:55 |
| *** Akshik_ has joined #openstack-keystone | 04:57 | |
| *** Akshik has quit IRC | 04:57 | |
| *** Akshik_ has quit IRC | 04:58 | |
| morganfainberg | stevemar, ok just pressed go on all of those in that chain | 04:58 |
| morganfainberg | i need to look at the whitelist/blacklist one, something isn't sitting righrt with me, some bit of it is changing the data types being produced and it bugs me. | 04:59 |
| morganfainberg | until i poke at it more | 04:59 |
| stevemar | morganfainberg, what do you mean by changing the data types | 05:00 |
| morganfainberg | it's mapping in lists to a structure that preiviously afaict never contained lists | 05:00 |
| morganfainberg | so instead of [a, b, c, d] you can have [a, b, [c, d, e]] | 05:01 |
| morganfainberg | and i haven't poked at it enough to feel confident in what happens there | 05:01 |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/keystone: Use dict comprehensions instead of dict constructor https://review.openstack.org/143842 | 05:14 |
| stevemar | morganfainberg, ohhh that part | 05:15 |
| stevemar | because it was a string at first right | 05:15 |
| *** lhcheng has joined #openstack-keystone | 05:15 | |
| morganfainberg | Yeah. | 05:30 |
| *** spandhe has joined #openstack-keystone | 05:34 | |
| stevemar | morganfainberg, what else is close-ish? | 05:42 |
| stevemar | rather, in need of review | 05:43 |
| stevemar | morganfainberg, oh btw, ayoung +1'ed the 'remove kvs revoke backend' | 05:43 |
| stevemar | some tests failed, i should fix those | 05:43 |
| stevemar | i think it's just domain-config and kwlt left over | 05:44 |
| openstackgerrit | Merged openstack/keystone: Enhance user identification in mapping engine https://review.openstack.org/154934 | 05:57 |
| stevemar | jamielennox, if you have a quick second: https://review.openstack.org/#/c/160065/ | 06:02 |
| jamielennox | stevemar: +A | 06:03 |
| jamielennox | stevemar: also means that marekd's spec was merged which is good | 06:03 |
| jamielennox | i didn't see that one go in | 06:03 |
| stevemar | jamielennox, morgan and i settled on it, marek was OK, and i think you had agreed on it too | 06:03 |
| jamielennox | stevemar: it looks like what i was expecting | 06:04 |
| openstackgerrit | Merged openstack/keystone-specs: Fix nits from 159922 https://review.openstack.org/160065 | 06:06 |
| openstackgerrit | Merged openstack/keystone: Make RuleProcessor._UserType class public https://review.openstack.org/157711 | 06:17 |
| openstackgerrit | Merged openstack/keystone: Move UserAuthInfo to a separate file https://review.openstack.org/157717 | 06:17 |
| openstackgerrit | Merged openstack/keystone: Authenticate local users via federated workflow https://review.openstack.org/156308 | 06:28 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove KVS backend for revocation api https://review.openstack.org/160067 | 06:31 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/160233 | 06:34 |
| stevemar | jamielennox, whats up with registering the conf options twice? https://review.openstack.org/#/c/157280/4/keystonemiddleware/auth_token/_auth.py | 06:35 |
| stevemar | last 2 lines of the file | 06:36 |
| stevemar | oops, nvm, it's done like that anyway now | 06:36 |
| stevemar | oh it's being set of auth from KSC and AuthTokenPlugin from ksm | 06:37 |
| stevemar | thats still a bit weird >.< | 06:37 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Remove extra semicolon from mapping fixtures https://review.openstack.org/148080 | 06:42 |
| *** himangi has quit IRC | 06:44 | |
| *** tqtran_afk has quit IRC | 06:49 | |
| *** _cjones_ has joined #openstack-keystone | 06:51 | |
| stevemar | jamielennox, all that refactoring and it's still > 1100 lines | 06:53 |
| stevemar | but great job | 06:53 |
| *** hogepodge has quit IRC | 06:55 | |
| marekd | "Merged openstack/keystone: Enhance user identification in mapping engine https://review.openstack.org/154934" yupi! | 06:55 |
| stevemar | marekd, :) | 06:56 |
| *** _cjones_ has quit IRC | 06:56 | |
| marekd | stevemar: hey | 06:56 |
| stevemar | marekd i think morganfainberg had some issues with the ast bits in whitelist/blacklist | 06:56 |
| marekd | stevemar: we can add some fixups on that if he wants. | 06:57 |
| stevemar | marekd, i think it's more "it's just weird to do it that way' | 06:57 |
| stevemar | but i dunno | 06:57 |
| marekd | stevemar: it was first proposed by Victor from Brazilian uni. | 06:58 |
| *** himangi has joined #openstack-keystone | 06:58 | |
| *** ajayaa has joined #openstack-keystone | 06:59 | |
| *** lhcheng has quit IRC | 07:01 | |
| ajayaa | Hi guys. When is the feature freeze for kilo release? | 07:02 |
| *** lhcheng has joined #openstack-keystone | 07:14 | |
| marekd | ajayaa: tomorrow or so. | 07:15 |
| ajayaa | I have few patches lying around since Juno. I will rebase them asap. marekd, would you volunteer for a review? :) | 07:17 |
| marekd | i can take a look | 07:17 |
| ajayaa | marekd, Thanks. | 07:18 |
| *** jaosorior has joined #openstack-keystone | 07:31 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Remove extra semicolon from mapping fixtures https://review.openstack.org/148080 | 07:39 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Implements whitelist and blacklist mapping rules https://review.openstack.org/142573 | 07:39 |
| *** henrynash has joined #openstack-keystone | 07:43 | |
| *** ChanServ sets mode: +v henrynash | 07:43 | |
| *** hogepodge has joined #openstack-keystone | 07:49 | |
| *** chlong has quit IRC | 08:02 | |
| stevemar | marekd, commented on e^ | 08:07 |
| marekd | stevemar: thanks. | 08:07 |
| marekd | I am responding to https://review.openstack.org/#/c/152156/16 and will now fix what's missing. | 08:07 |
| *** nellysmitt has joined #openstack-keystone | 08:18 | |
| *** afazekas has joined #openstack-keystone | 08:18 | |
| *** Guest78669 is now known as d0ugal | 08:20 | |
| *** d0ugal has joined #openstack-keystone | 08:21 | |
| *** himangi has quit IRC | 08:27 | |
| *** stevemar has quit IRC | 08:36 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 08:42 |
| *** pnavarro_ has joined #openstack-keystone | 08:47 | |
| *** kashyap has joined #openstack-keystone | 08:48 | |
| *** lhcheng has quit IRC | 08:49 | |
| kashyap | Any pointers to make Keystone end points to configure with SSL? | 08:50 |
| *** ajayaa has quit IRC | 08:54 | |
| *** ncoghlan has quit IRC | 09:00 | |
| kashyap | jamielennox, If you're around, maybe you have some pointers? | 09:00 |
| *** jistr has joined #openstack-keystone | 09:12 | |
| *** ajayaa has joined #openstack-keystone | 09:12 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Implements whitelist and blacklist mapping rules https://review.openstack.org/142573 | 09:14 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 09:28 |
| *** pnavarro_ has quit IRC | 09:42 | |
| *** Akshik has joined #openstack-keystone | 09:43 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 09:50 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 09:50 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 09:51 |
| *** ajayaa has quit IRC | 09:52 | |
| *** pnavarro has joined #openstack-keystone | 09:55 | |
| *** davechen_ has quit IRC | 09:55 | |
| *** ajayaa has joined #openstack-keystone | 09:56 | |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: Implemented caching in identity layer. https://review.openstack.org/110575 | 09:56 |
| *** henrynash has quit IRC | 10:00 | |
| *** pnavarro has quit IRC | 10:02 | |
| ajayaa | marekd, Has something changed very recently wrt how different drivers are assigned through keystone.conf? | 10:25 |
| ajayaa | I am getting an error "ArgsAlreadyParsedError" while starting keystone with keystone-all | 10:25 |
| *** erkules_ is now known as erkules | 10:27 | |
| marekd | ajayaa: are you running latest version ? | 10:37 |
| marekd | ajayaa: and has packages updated ? | 10:37 |
| ajayaa | marekd, I am running master. | 10:38 |
| ajayaa | Yes updated packages. | 10:38 |
| marekd | hm | 10:38 |
| marekd | nothing i'd be aware of. | 10:38 |
| ajayaa | okay. | 10:38 |
| marekd | some more detailed errors? | 10:38 |
| *** aix has joined #openstack-keystone | 10:41 | |
| *** EmilienM is now known as EmilienM|afk | 10:54 | |
| ccard | We are trying to get an HA openstack up and running, with keystone being a pacemaker resource. I've noticed that if I turn off one of the machines running keystone and then turn it on again, systemd tries to start keystone, but when pacemaker runs its keystone monitor (calling systemd status openstack-keystone) about 8 seconds later, keystone is still starting up, and the pacemaker monitor operation returns OCF_PENDING. Then pacemaker stops | 11:05 |
| ccard | keystone, and the next time keystone is started by systemd it starts up successfully within 2 seconds. Any idea why keystone should fail to start up within 8 seconds the first time, but succeed within 2 seconds the second time? | 11:05 |
| ccard | I can't see anything in the pacemaker or keystone logs giving any indication about what is going on. | 11:06 |
| ajayaa | marekd, here it is. https://review.openstack.org/#/c/110575/. Hope you find sometime to review it. | 11:20 |
| *** Akshik has quit IRC | 11:35 | |
| *** fmarco76 has joined #openstack-keystone | 11:37 | |
| fmarco76 | I am working on https://review.openstack.org/#/c/159803/ but I have a problem I would discuss | 11:42 |
| fmarco76 | the migration scripts does not work properly because of the missing encoding | 11:44 |
| fmarco76 | the problem arise before any upgrade/downgrade is applied so even if I create a new migration script to change the tables, this will not work if the problem is present (the problem arise if default DB encoding is not utf8) | 11:45 |
| fmarco76 | the check is in oslo_db/sqlalchemy/migration.py, so external to keystone, To avoid the problem I should disable the check in the ligbraries for some table and I do not like the idea | 11:47 |
| fmarco76 | so my problem: is there a way to modify the database before the migration scripts are executed? | 11:47 |
| *** amakarov_away is now known as amakarov | 11:51 | |
| *** Gippa has joined #openstack-keystone | 11:58 | |
| *** Gippa has left #openstack-keystone | 11:59 | |
| *** henrynash has joined #openstack-keystone | 12:00 | |
| *** ChanServ sets mode: +v henrynash | 12:00 | |
| *** dims has joined #openstack-keystone | 12:09 | |
| *** henrynash has quit IRC | 12:11 | |
| *** raildo has joined #openstack-keystone | 12:12 | |
| *** fmarco76 has quit IRC | 12:34 | |
| *** henrynash has joined #openstack-keystone | 12:41 | |
| *** ChanServ sets mode: +v henrynash | 12:41 | |
| *** diegows has joined #openstack-keystone | 12:41 | |
| *** panbalag has joined #openstack-keystone | 12:44 | |
| *** himangi has joined #openstack-keystone | 13:01 | |
| *** markvoelker has joined #openstack-keystone | 13:08 | |
| *** jacorob has quit IRC | 13:10 | |
| *** jacorob has joined #openstack-keystone | 13:13 | |
| *** fmarco76 has joined #openstack-keystone | 13:16 | |
| *** jacorob has quit IRC | 13:20 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Populate token with service providers https://review.openstack.org/159865 | 13:21 |
| *** jacorob has joined #openstack-keystone | 13:27 | |
| *** gordc has joined #openstack-keystone | 13:30 | |
| *** henrynash has quit IRC | 13:31 | |
| *** ajayaa has quit IRC | 13:39 | |
| *** bknudson has quit IRC | 13:46 | |
| ccard | delving deeper, I added some write statements to the /usr/bin/keystone-all script and it appears that although systemd says "systemd[1]: Starting OpenStack Identity Service (code-named Keystone)..." in messages.minor, the keystone-all script is not being run, until pacemaker stops the openstack-keystone service and systemd has another go | 13:49 |
| *** ljfisher has joined #openstack-keystone | 13:53 | |
| mfisch | morganfainberg: it did work fine to remove the admin_auth_token from the public pipeline, I was trying to be too tricky in how I setup the pipelines and missed a difference between them when it failed | 13:59 |
| *** afazekas has quit IRC | 14:06 | |
| *** richm has joined #openstack-keystone | 14:06 | |
| *** fmarco76 has left #openstack-keystone | 14:07 | |
| *** fmarco76 has joined #openstack-keystone | 14:08 | |
| *** fmarco76 has quit IRC | 14:08 | |
| *** openstack1 has joined #openstack-keystone | 14:09 | |
| *** bknudson has joined #openstack-keystone | 14:10 | |
| *** ChanServ sets mode: +v bknudson | 14:10 | |
| openstack1 | have a quick question | 14:10 |
| openstack1 | if I don't see services in my service catalog (keystone v2.0), will that block me from accessing the open stack services | 14:10 |
| openstack1 | I can't access any apis, especially heat | 14:11 |
| openstack1 | keep getting a 403 error | 14:11 |
| larsks | openstack1: Most of the client tools (including Horizon) use the service catalog to figure out API endpoints. | 14:11 |
| larsks | If you're getting a 403 error (from keystone?), you probably want to investigate your server logs. | 14:12 |
| *** fmarco76 has joined #openstack-keystone | 14:12 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Group role revocation invalidates all user tokens https://review.openstack.org/141854 | 14:16 |
| *** nkinder has quit IRC | 14:19 | |
| openstack1 | k, I'll check it out | 14:21 |
| *** joesavak has joined #openstack-keystone | 14:21 | |
| amakarov | dstanek, hi! I addressed your -1 there can you please take a look? ^^ | 14:21 |
| openstack1 | larsks, I'm getting 403 from the Heat api | 14:21 |
| openstack1 | larsks, when I access nova, I get an error saying the tenant id on the url is not the same as the context | 14:22 |
| openstack1 | larsks, so I just chalked it all up to I don't see any services in my service catalog | 14:22 |
| *** afazekas has joined #openstack-keystone | 14:23 | |
| larsks | openstack1: you probably want to move this over to #openstack, since this channel is mostly for keystone development. | 14:25 |
| *** dims has quit IRC | 14:25 | |
| *** dims has joined #openstack-keystone | 14:26 | |
| openstack1 | k will do so, thanks | 14:26 |
| *** fmarco76 has quit IRC | 14:26 | |
| *** radez_g0n3 is now known as radez | 14:27 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Populate token with service providers https://review.openstack.org/159865 | 14:29 |
| *** mattfarina has joined #openstack-keystone | 14:32 | |
| *** ajayaa has joined #openstack-keystone | 14:36 | |
| *** afazekas has quit IRC | 14:41 | |
| dstanek | amakarov: sure | 14:44 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 14:46 |
| *** henrynash has joined #openstack-keystone | 14:46 | |
| *** ChanServ sets mode: +v henrynash | 14:46 | |
| dolphm | does anyone use a vim layout with gertty? | 14:48 |
| marekd | morganfainberg: re: https://review.openstack.org/#/c/155660/13 few questions here. Rather want to make sure that place where CADF events are emited is choosen on purpose. cc/ stevemar | 14:51 |
| openstackgerrit | Marek Denis proposed openstack/keystone: WIP - add cadf notifications for oauth https://review.openstack.org/159045 | 14:52 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 14:53 |
| *** csoukup has joined #openstack-keystone | 15:03 | |
| *** rm_work has quit IRC | 15:05 | |
| *** openstack1 has quit IRC | 15:06 | |
| dstanek | dolphm: didn't know that existed | 15:06 |
| dstanek | dolphm: i gave up on gertty because the interface was too slow | 15:06 |
| *** rm_work|away has joined #openstack-keystone | 15:07 | |
| *** rm_work|away is now known as rm_work | 15:07 | |
| *** rm_work has quit IRC | 15:07 | |
| *** rm_work has joined #openstack-keystone | 15:07 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:11 | |
| *** rm_work has quit IRC | 15:12 | |
| *** nkinder has joined #openstack-keystone | 15:13 | |
| *** rm_work|away has joined #openstack-keystone | 15:15 | |
| *** rm_work|away is now known as rm_work | 15:15 | |
| *** rm_work has joined #openstack-keystone | 15:15 | |
| *** afazekas has joined #openstack-keystone | 15:19 | |
| *** jsavak has joined #openstack-keystone | 15:20 | |
| *** joesavak has quit IRC | 15:23 | |
| marekd | ajayaa: can you tell me where function invalidate() comes from? | 15:23 |
| marekd | ajayaa: self.get_user.invalidate() | 15:23 |
| marekd | is it caching related func ? | 15:23 |
| ajayaa | marekd, yes. It comes from dogpile. | 15:24 |
| marekd | ajayaa: ok, thanks. | 15:25 |
| marekd | and it is member function of what object? | 15:25 |
| marekd | you call it on self.get_user() or similar | 15:25 |
| marekd | . | 15:25 |
| dolphm | dstanek: just wrote a patch to add basic vim motions, but it doesn't work great because there's no concept of modes when you're writing comments, etc | 15:25 |
| ajayaa | marekd, It comes from the cache object. | 15:25 |
| ajayaa | If the decorator cache is used for a function then you can call the invalidate on that function. | 15:26 |
| ajayaa | marekd, Actually this patch got one +2 at some point of time but then merge conflicts and juno feature freeze and then... | 15:27 |
| ajayaa | :) | 15:27 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Use Model for access_info https://review.openstack.org/160134 | 15:27 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: pep8 fix for CMS https://review.openstack.org/160132 | 15:27 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Test updates to prep for unified access info https://review.openstack.org/160133 | 15:27 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/138519 | 15:27 |
| dolphm | dstanek: and yeah, it's slow but i'm sitting in a waiting room on bluetooth tether + low strength LTE signal so it's going to be slow no matter what :P | 15:28 |
| dstanek | dolphm: fair enough :-) | 15:28 |
| marekd | ajayaa: ok, i understand now. | 15:29 |
| marekd | ajayaa: yeah, i saw voting history. | 15:29 |
| *** stevemar has joined #openstack-keystone | 15:32 | |
| *** ChanServ sets mode: +v stevemar | 15:32 | |
| *** radez is now known as radez_g0n3 | 15:33 | |
| marekd | ajayaa: done :-) | 15:39 |
| *** carlosmarin has joined #openstack-keystone | 15:39 | |
| ajayaa | marekd, Thanks a lot. | 15:39 |
| ajayaa | dolphm, Thanks. | 15:44 |
| *** jorge_munoz has joined #openstack-keystone | 15:46 | |
| ajayaa | dolphm, Would it possible to introduce authentication using user_id? It only supports with name as of now. It is necessary if we use a backend wherein the user name won't be unique. For e.g. a NoSql backend. | 15:47 |
| dolphm | ajayaa: auth by ID is supported by both the HTTP API and the auth driver | 15:48 |
| dolphm | ajayaa: in fact, it's the only form of auth supported at the driver layer | 15:48 |
| lbragstad | dolphm: thanks for pushing the latest patchset, I' | 15:48 |
| *** topol has joined #openstack-keystone | 15:48 | |
| *** ChanServ sets mode: +v topol | 15:48 | |
| dolphm | lbragstad: what did i do | 15:48 |
| lbragstad | I'm going to address comments if you're not working on stuff locally | 15:48 |
| lbragstad | cc jorge_munoz^ | 15:48 |
| dolphm | lbragstad: i'm only reviewing | 15:48 |
| lbragstad | dolphm: oh, it looked like you pushed patchset 31 | 15:49 |
| dolphm | lbragstad: when? | 15:49 |
| lbragstad | dolphm: 27th | 15:49 |
| ajayaa | dolphm, perhaps I am looking at an older documentation. Thanks for clarifying though. | 15:50 |
| dolphm | lbragstad: that was last month | 15:50 |
| stevemar | morganfainberg, ping when you are available | 15:56 |
| *** zzzeek has joined #openstack-keystone | 16:08 | |
| dolphm | stevemar: awake* | 16:08 |
| *** joesavak has joined #openstack-keystone | 16:19 | |
| *** jsavak has quit IRC | 16:22 | |
| *** samueldmq has joined #openstack-keystone | 16:26 | |
| samueldmq | morning | 16:26 |
| *** boris-42 has quit IRC | 16:32 | |
| openstackgerrit | Sean Dague proposed openstack/oslo.policy: remove policy_dirs option https://review.openstack.org/160407 | 16:37 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 16:42 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 16:42 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 16:42 |
| *** gyee has joined #openstack-keystone | 16:42 | |
| *** ChanServ sets mode: +v gyee | 16:42 | |
| *** _cjones_ has joined #openstack-keystone | 16:47 | |
| *** diegows has quit IRC | 16:51 | |
| *** trey has quit IRC | 16:56 | |
| *** trey has joined #openstack-keystone | 16:57 | |
| *** radez_g0n3 is now known as radez | 16:57 | |
| *** jsavak has joined #openstack-keystone | 17:01 | |
| amakarov | dolphm, greetings! Can you please suggest me a way to test Redis backend? I fear I cannot use functional testing yet so will it be enough to mock Redis? | 17:02 |
| *** tqtran_afk has joined #openstack-keystone | 17:05 | |
| *** joesavak has quit IRC | 17:05 | |
| *** diegows has joined #openstack-keystone | 17:05 | |
| *** rwsu has joined #openstack-keystone | 17:09 | |
| stevemar | henrynash, morganfainberg can you guys OK mareks concern in https://review.openstack.org/#/c/155660/13/keystone/identity/core.py | 17:12 |
| henrynash | stevemar: looking | 17:12 |
| stevemar | ayoung, more questions about the revoke api here: https://review.openstack.org/#/c/160067/ | 17:15 |
| ayoung | stevemar, looking | 17:15 |
| *** spandhe has quit IRC | 17:15 | |
| stevemar | buahaha, i every one looking at stuff | 17:15 |
| samueldmq | stevemar is keeping things moving | 17:15 |
| samueldmq | :-) | 17:16 |
| ayoung | stevemar, so, I think my take when writing it was that a KVS solution was light enough and easy enouigh to support that it was worth while | 17:16 |
| ayoung | the unit tests need something to work against, and it will be lighter to use KVS then SQL, but if we are going SQL everywhere ,then using the SQL revoke API in that test makes sense | 17:16 |
| henrynash | stevemar: done | 17:17 |
| ayoung | stevemar, I'm not certain I would recommend removing it, though. THe Revoke API is essentially write-only...data falls off due to age, but it really doesn't need to be transactional | 17:17 |
| ayoung | and for replication, Mongo etc may make more sense then MySQL | 17:17 |
| ayoung | can we maybe punt on that, and discuss de-deprecation after the release. It won't hurt anything if we leave it one more release, will it? | 17:18 |
| *** tqtran_afk is now known as tqtran | 17:18 | |
| stevemar | ayoung, agreed | 17:19 |
| ayoung | stevemar, cool | 17:19 |
| openstackgerrit | Merged openstack/keystonemiddleware: Break default auth plugin into file https://review.openstack.org/157280 | 17:20 |
| *** jistr has quit IRC | 17:21 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 17:24 |
| openstackgerrit | Merged openstack/keystone: Use correct dependency decorator https://review.openstack.org/159347 | 17:26 |
| openstackgerrit | Merged openstack/keystone: Remove conditionals that check for revoke_api https://review.openstack.org/159628 | 17:26 |
| openstackgerrit | Merged openstack/keystone: Implemented caching in identity layer. https://review.openstack.org/110575 | 17:26 |
| *** adam_g_out is now known as adam_g | 17:27 | |
| *** ayoung is now known as ayoung-lunx | 17:29 | |
| henrynash | stevemar, gyee, bknudson, morganfainberg: looking for us to make some progress on reviews of the “domain-config in SQL” series of patched…they start at: https://review.openstack.org/#/c/157701 | 17:31 |
| lbragstad | dolphm: mind if I rebase https://review.openstack.org/#/c/160040/ ? | 17:31 |
| gyee | henrynash, yes, I'll take a look in a few mins | 17:32 |
| henrynash | morganfainberg: two minor fixes to our identity API spec to correct inaccuracies….probably better to get them in sooner than later: https://review.openstack.org/#/c/159914/, https://review.openstack.org/#/c/159919/1 | 17:33 |
| henrynash | gyee: thx | 17:33 |
| gyee | henrynash, with this, we can in theory have multiple SQL backends right? | 17:33 |
| gyee | or is the SQL driver still global? | 17:34 |
| *** afazekas is now known as _afezekas|pub | 17:37 | |
| henrynash | gyee: no, we can still only have one SQL backend…this moves the config definitions into SQL so you can use REST to onbaord, rather than have to go create separate config files per domain (to specifiy each LDAP scenario) | 17:38 |
| henrynash | gyee: the multiple SQL one is another patch altogether….not for Kilo | 17:38 |
| gyee | henrynash, k, I see | 17:38 |
| samueldmq | henrynash, reviewed the first one on the domain-config, just found some nits :) | 17:49 |
| openstackgerrit | Merged openstack/keystonemiddleware: Extract all TokenCache related classes to file https://review.openstack.org/157281 | 17:50 |
| panbalag | Hi..I'm trying to add a role to existing user and seeing this error intermittently...Error "Authorization Failed: An unexpected error prevented the server from fulfilling your request: (OperationalError) (2003, "Can't connect to MySQL server on '127.0.0.1' (111)") None None (Disable debug mode to suppress these details.) (HTTP 500).".. | 17:51 |
| panbalag | Has anyone seen this error before? | 17:52 |
| samueldmq | panbalag, the error message looks to be clear "Can't connect to MySQL server on '127.0.0.1' (111)" | 17:54 |
| samueldmq | panbalag, please ensure your database you running properly and you set the configs for keystone | 17:54 |
| samueldmq | panbalag, keystone user, password, database, etc | 17:55 |
| panbalag | samueldmq, the same (keystone user-role-add) command worked after some retries. Now I'm seeing the issue with a different command | 17:55 |
| samueldmq | panbalag, refer to the official docs, such as http://docs.openstack.org/juno/install-guide/install/apt/content/keystone-install.html | 17:55 |
| samueldmq | panbalag, yep, then it clearly is a problem with your env :) | 17:56 |
| panbalag | samueldmq, ok let me check the docs and try troubleshooting | 17:56 |
| *** doug-fish has joined #openstack-keystone | 18:00 | |
| panbalag | samueldmq, is there a way to check the status on the MySQL server ? | 18:03 |
| panbalag | samueldmq, I'm working with a devstack installation and used the install script to do the installation | 18:03 |
| morganfainberg | gyee: we can't have more than one sql backend really unless we want to support multiple connectors to different sqls, and that is way painful to to right. Easier to say the main driver should be sql and ldap should override domains we want in other backends. | 18:05 |
| *** spandhe has joined #openstack-keystone | 18:05 | |
| *** boris-42 has joined #openstack-keystone | 18:05 | |
| gyee | morganfainberg, that's fine, I was just curious. I haven't come across a use case for it yet | 18:07 |
| morganfainberg | stevemar: https://review.openstack.org/#/c/158600/ answered your comment. | 18:09 |
| dolphm | gyee: why would anyone want multiple sql backends? | 18:10 |
| *** _afezekas|pub has quit IRC | 18:10 | |
| dolphm | lbragstad: go for it | 18:10 |
| amakarov | dolphm, hi! I have a question to you | 18:11 |
| dolphm | amakarov: to test the redis driver? i'd like to see docs moreso | 18:12 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 18:12 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Rename "Keystone LightWeight Tokens" (KLWT) to "Fernet" tokens https://review.openstack.org/160040 | 18:12 |
| dolphm | amakarov: there weren't any last i looked? | 18:13 |
| dolphm | amakarov: (outside of a docstr, or is that rendered to http://docs.openstack.org/developer/keystone/ somewhere?) | 18:13 |
| amakarov | dolphm, you asked for test | 18:13 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 18:13 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 18:13 |
| morganfainberg | stevemar: also pong. | 18:13 |
| dolphm | amakarov: you're right. i was concerned about documentation as well though :) | 18:14 |
| openstackgerrit | Merged openstack/keystone-specs: Correct the use of POST for domain configs https://review.openstack.org/159919 | 18:14 |
| amakarov | dolphm, I have 2 question then :) | 18:14 |
| dstanek | lbragstad: is klwt tokens ready for another pass? | 18:14 |
| amakarov | s/question/questions/ | 18:14 |
| lbragstad | dstanek: yes sir | 18:14 |
| dolphm | amakarov: i recall the docstr being pretty good, but non-developers will never see them unless they appear in http://docs.openstack.org/developer/keystone/ in a more discoverable place | 18:14 |
| samueldmq | panbalag, I'm not sure about the best place to ask about devstack specifics ... maybe morganfainberg can answer you better | 18:15 |
| lbragstad | dstanek: dolphm added a bunch of nice documentation | 18:15 |
| * dolphm cold shipley's coffee == terribad | 18:15 | |
| amakarov | dolphm, good point, I'll write a small guide here | 18:15 |
| amakarov | dolphm, 2nd question: about testing | 18:16 |
| dolphm | amakarov: regarding testing the token redis driver... have any ideas, dstanek? | 18:16 |
| panbalag | morganfainberg, is there a way to check the status on MySQL server on a devstack installation? or how to restart keystone service in devstack installation? | 18:16 |
| openstackgerrit | Merged openstack/keystone-specs: Remove email from examples in Identity API https://review.openstack.org/159914 | 18:16 |
| dstanek | dolphm: ? | 18:16 |
| amakarov | iirc we have no such tests for memcached | 18:16 |
| dolphm | dstanek: amakarov has a patch to add dogpile support for redis as a token persistence driver | 18:17 |
| lbragstad | I assume that would take some additional setup? | 18:17 |
| lbragstad | outside of just switching the CONF.token.driver | 18:17 |
| dstanek | dolphm: i remember seeing that...what's the problem with it? | 18:17 |
| *** browne has joined #openstack-keystone | 18:17 | |
| dolphm | dstanek: just wondering the best approach to add some level of test coverage to it | 18:18 |
| dstanek | dolphm: ah, i'll take a look after the klwt review i just started | 18:18 |
| morganfainberg | panbalag: restarting keystone in devstack (if it's using default options Juno and later) is restarting Apache | 18:18 |
| dolphm | amakarov: as a result, we only have about 2 deployers using memcached in any serious capacity. if that's the fate of a redis backend, then it shouldn't merge | 18:18 |
| morganfainberg | panbalag: not sure what you mean about MYSQL status. | 18:18 |
| dolphm | dstanek: priorities :P | 18:18 |
| amakarov | dolphm, dstanek, all I found is henrynash's idea to extract backend tests to a separate folder, but he used mock objects there | 18:19 |
| dolphm | amakarov: i assume you're primarily interested in redis + uuid tokens? | 18:19 |
| amakarov | dolphm, correct | 18:19 |
| panbalag | morganfainberg, I'm getting this error ""Authorization Failed: An unexpected error prevented the server from fulfilling your request: (OperationalError) (2003, "Can't connect to MySQL server on '127.0.0.1' (111)") None None (Disable debug mode to suppress these details.) (HTTP 500)."..so wanted to know if there is a way to check the status on the MySQL server. | 18:19 |
| morganfainberg | dolphm: it'd be silly if he was doing redis and fernet tokens ;) | 18:19 |
| dolphm | amakarov: have you followed the AE / KLWT / Fernet token conversation? | 18:19 |
| dolphm | amakarov: i'd be surprised if you didn't prefer to just switch from UUID to that | 18:19 |
| amakarov | dolphm, and looking forvard to move towards klwt when they are ready | 18:20 |
| dolphm | morganfainberg: well you'd get epic performance with that combo | 18:20 |
| dolphm | morganfainberg: you could go to production with redis running on a raspberry pi! it'd be great | 18:20 |
| morganfainberg | panbalag: try connecting to MySQL directly. | 18:20 |
| morganfainberg | panbalag: either username/password is wrong or maybe mysql isn't running? | 18:21 |
| panbalag | morganfainberg, it is happening only recently and nothing changed in the environment other than assigning admin role to an existing user. | 18:21 |
| dstanek | dolphm: i have a cloud of raspberry pi's that i can try it on! | 18:21 |
| panbalag | morganfainberg, ok let me check the status of mysql | 18:21 |
| lbragstad | dstanek: ++ | 18:21 |
| *** harlowja_away is now known as harlowja_ | 18:21 | |
| amakarov | dolphm, the main idea is to get rid of python-memcached actually :) | 18:21 |
| morganfainberg | panbalag: that is an issue with MySQL directly not keystone afaik. | 18:22 |
| morganfainberg | dolphm: we need to fix things to rely on py memcache not Python-memcache. But not drop in replacement(s). :( | 18:22 |
| morganfainberg | Cause Python-memcache is just awful. | 18:23 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add in non-decorator notifiers https://review.openstack.org/158600 | 18:24 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Get initiator from manager and send to controller https://review.openstack.org/155660 | 18:24 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 18:24 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Expose create project with invalid domain_id https://review.openstack.org/160446 | 18:24 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notifications for trusts https://review.openstack.org/151867 | 18:24 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP - add cadf notifications for oauth https://review.openstack.org/159045 | 18:24 |
| *** pnavarro has joined #openstack-keystone | 18:25 | |
| dolphm | amakarov: well you can accomplish that with dogpile, right? | 18:25 |
| gyee | dolphm, I haven't seen any multi sql identity backend use case yet, was just curious | 18:26 |
| dolphm | gyee: i've seen people ask about it, but never with a use case | 18:26 |
| amakarov | dolphm, right: my patch is just about it | 18:26 |
| dolphm | amakarov: morganfainberg: i don't follow. if the goal is to get rid of pymemcache & python-memcache, then dogpile supports pylibmc. i don't see how redis is a "drop in" replacement at all | 18:28 |
| raildo | morganfainberg: just a little doubt here. what should happen if a user tries to create an is_domain project, passing a domain_id | 18:33 |
| raildo | when the is_domain flag is set True, the domain_id of the project is his own id | 18:34 |
| raildo | but if I pass another domain_id, should I ignore it? | 18:34 |
| dolphm | raildo: sounds like a 400 | 18:35 |
| dolphm | raildo: if the request doesn't make any sense, let the user know instead of introducing an arbitrary behavior. someone will just file it as a bug later :) | 18:36 |
| raildo | dolphm, right, that is the other option that I have in mind. | 18:36 |
| openstackgerrit | Sean Dague proposed openstack/oslo.policy: remove policy_dirs option https://review.openstack.org/160407 | 18:37 |
| raildo | dolphm, thanks | 18:37 |
| amakarov | dolphm, redis gives some flexibility such as persistence and it's sentinel I'd like to try. For now it works quite well | 18:37 |
| amakarov | memcache lib has a problem with sharding | 18:38 |
| dolphm | amakarov: pylibmc? | 18:39 |
| dolphm | amakarov: i'm not sure what you're referring to exactly with "memcache lib" | 18:41 |
| *** aix has quit IRC | 18:41 | |
| amakarov | dolphm, haven't tried. There was some complaints from collegues about memcache itself I can't recall now. I spoke about python-memcached. | 18:42 |
| amakarov | dolphm, I can ask them again why Redis is a good idea :) | 18:43 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Populate token with service providers https://review.openstack.org/159865 | 18:43 |
| marekd | morganfainberg: stevemar bknudson gyee ^^ this is service_providers in token, for some reason it's not on 'high priorities reviews' anymore, even though it should. | 18:44 |
| dolphm | amakarov: a couple releases ago, it would have made sense. in kilo, it feels like it's going to go unused next to ae/klwt/fernet | 18:44 |
| amakarov | dolphm, as for me - I can implement event-based distributed lock on Redis instead of polling used in memcached | 18:44 |
| stevemar | marekd, i think dolph/morgan have to 'star' it | 18:44 |
| marekd | aha | 18:45 |
| dolphm | marekd: it'll appear in a minute :) | 18:45 |
| marekd | dolphm: thanks :-) | 18:45 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Emit failure notifications for CADF audits events https://review.openstack.org/156905 | 18:47 |
| openstackgerrit | henry-nash proposed openstack/keystone: Refactor and provide scaffolding for domain specific loading https://review.openstack.org/157701 | 18:48 |
| amakarov | dolphm, I agree, though Redis token backend is a nice feature for current installations as a means to harden them with little effort | 18:49 |
| amakarov | dolphm, I'm not sure I'll be capable of convincing our engineers to adopt shiny new technology in a core component lust like "Guys, I have this one here, it's cool!" :) | 18:51 |
| marekd | dolphm: https://review.openstack.org/#/c/152156/ can you also star this one? This was discussed at the meetup and i reckond this is a super nice feature. It had few iterations of reviews from stevemar, few folks and myself. | 18:52 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Group role revocation invalidates all user tokens https://review.openstack.org/141854 | 18:52 |
| openstackgerrit | henry-nash proposed openstack/keystone: Implement backend driver support for domain config https://review.openstack.org/158051 | 18:53 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 18:54 |
| amakarov | s/lust/just/ | 18:55 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 18:55 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 18:56 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 18:57 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 18:58 |
| gyee | marekd, k, looking | 19:00 |
| marekd | ty | 19:01 |
| *** devlaps has joined #openstack-keystone | 19:01 | |
| henrynash | dolphm: sorry you keep getting bugged on “staring” blueprints etc….but what determins if the chain of dependant patches appears on the high priorrity list vs just the first one? (See: https://review.openstack.org/#/c/157701/6) | 19:01 |
| henrynash | samueldmq, gyee: fixed up your suggestions on: https://review.openstack.org/#/c/157701/6 | 19:02 |
| * marekd SAML Protocol has its 10th birthday today. | 19:10 | |
| * dolphm happy birthday SAML | 19:13 | |
| * stevemar gives SAML a cake | 19:15 | |
| henrynash | and a coconut.. | 19:16 |
| * amakarov reminds SAML that cake is a lie | 19:16 | |
| henrynash | you can’t have your cake and parse it | 19:16 |
| *** haneef has quit IRC | 19:17 | |
| * gyee gives SAML a JSON toy | 19:17 | |
| morganfainberg | marekd, lbragstad: requirements.txt: The order of packages is significant, because pip processes them in the order of appearance. Changing the order has an impact on the overall integration | 19:17 |
| morganfainberg | see the comment at the top | 19:18 |
| lbragstad | morganfainberg: makes sense, I thought there was a stipulation there | 19:18 |
| lbragstad | cc stevemar ^ | 19:18 |
| morganfainberg | yeah basically... don't reorder them | 19:18 |
| morganfainberg | if it works... leave irt | 19:18 |
| *** amakarov is now known as amakarov_away | 19:20 | |
| stevemar | morganfainberg, lbragstad okie dokes | 19:20 |
| henrynash | samueldmq: if there’s a chance you could spend some time on the follow-on patches on domain-config, that would be great… | 19:22 |
| morganfainberg | so, for priorities: if you're reviewing - KLWT/Fernet tokens, Domain SQL, CADF, and then x509 | 19:24 |
| morganfainberg | sorry, rephrase: KLWT/Fernet, Service Providers in Token / other federation, Domain SQL, CADF, x509 | 19:25 |
| marekd | morganfainberg: https://review.openstack.org/#/c/145317/33/requirements.txt talking this? | 19:27 |
| morganfainberg | marekd, yeah just a comment to not reorder what is already there | 19:27 |
| marekd | ok ok | 19:28 |
| marekd | morganfainberg: i got scared i approved something that will explode as soon as it gets on this 'master' plane :-) | 19:28 |
| stevemar | henrynash, morganfainberg take another look at: https://review.openstack.org/#/c/155660/ ? it's rebased now, and the dependent patch is going through | 19:28 |
| *** devlaps has quit IRC | 19:29 | |
| morganfainberg | stevemar, looks like a clear rebase to me | 19:30 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove KVS backend for revocation api https://review.openstack.org/160067 | 19:31 |
| henrynash | stevemar: looking | 19:31 |
| gyee | KLWT review is going to take awhile, a lot of code to read :) | 19:31 |
| stevemar | morganfainberg, oh i was just going to ask about the kvs backend | 19:32 |
| morganfainberg | stevemar, was just clicking abandon | 19:32 |
| morganfainberg | based upon discussion w/ ayoung | 19:32 |
| stevemar | thats fine | 19:32 |
| morganfainberg | mis-clicked on rebase :P | 19:32 |
| stevemar | wanted to 2x check with you | 19:32 |
| stevemar | morganfainberg, marking that bp as implemented | 19:32 |
| morganfainberg | ++ | 19:33 |
| morganfainberg | gyee, and it's high priority to get it gating ;) | 19:33 |
| *** himangi has left #openstack-keystone | 19:34 | |
| openstackgerrit | Merged openstack/keystone: Correct token flush logging https://review.openstack.org/131003 | 19:35 |
| gyee | on it | 19:35 |
| openstackgerrit | Merged openstack/keystone: Use dict comprehensions instead of dict constructor https://review.openstack.org/143842 | 19:37 |
| morganfainberg | ugh | 19:38 |
| morganfainberg | ^ that is likely going to cause rebase ick | 19:38 |
| henrynash | morganfainberg: do you know what causes a full chain of dependant patches to show on the high priority list vs just the top one? | 19:39 |
| morganfainberg | henrynash, each one is starred | 19:39 |
| morganfainberg | independently | 19:40 |
| stevemar | dstanek, really pushing the criteria for a -1 there :P https://review.openstack.org/#/c/160040/ | 19:41 |
| dstanek | stevemar: :-P | 19:41 |
| stevemar | i mentioned the same issue on ps1, but still +2'ed! | 19:41 |
| stevemar | curse my disagreement percentage | 19:42 |
| dstanek | stevemar: if my comments in the parent are address this will have to be rebased anyway | 19:42 |
| * morganfainberg just bumped up dstanek's disagreement % by +2 that one... :P | 19:42 | |
| stevemar | buaha | 19:43 |
| henrynash | morganfainberg: ahh…so teh chain of domain-config patches *were* all starred yesterday…and now only the first one is…!?! | 19:45 |
| *** ajayaa has quit IRC | 19:45 | |
| morganfainberg | henrynash, wasn't my stars | 19:45 |
| morganfainberg | just starred them | 19:45 |
| morganfainberg | there is one that is still merge conflicting | 19:45 |
| morganfainberg | henrynash, my guess is you're probably going to need an FFE if those aren't gating today. | 19:46 |
| morganfainberg | henrynash, but they are behind the tokens and the small-ish federation patches priority wise. | 19:46 |
| morganfainberg | henrynash, so def. high prio. | 19:47 |
| *** henrynash has quit IRC | 19:48 | |
| morganfainberg | dstanek, so if those test issues are cleared up you'd be +2 on fernet tokens? | 19:48 |
| morganfainberg | klwt | 19:48 |
| morganfainberg | or whatever they are called | 19:48 |
| *** henrynash has joined #openstack-keystone | 19:48 | |
| *** ChanServ sets mode: +v henrynash | 19:48 | |
| *** lhcheng has joined #openstack-keystone | 19:48 | |
| henrynash | morganfainberg; let me check on that…I thought I caugth them all | 19:48 |
| morganfainberg | henrynash, it was one of the last ones in the chain | 19:48 |
| *** arunkant has joined #openstack-keystone | 19:50 | |
| rodrigods | morganfainberg, during the reseller implementation we found some bugs... can they be evaluated? (the fixes are already submitted) | 19:50 |
| dstanek | morganfainberg: yeah, and i think the ordering is also important | 19:50 |
| morganfainberg | dstanek, hm? the ordering? | 19:50 |
| morganfainberg | dstanek, missing context now. | 19:50 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 19:51 |
| dstanek | morganfainberg: https://review.openstack.org/#/c/145317/33/keystone/cli.py | 19:51 |
| morganfainberg | oh | 19:51 |
| morganfainberg | yeah | 19:51 |
| morganfainberg | if there wasn't test issues i'd say we push that as a quick cleanup on the end | 19:51 |
| morganfainberg | but since it's test issues, lets get both done at once | 19:51 |
| henrynash | stevemar: if you get a chance to at least kick off https://review.openstack.org/#/c/157701/6 (which I know you reviewd before) | 19:56 |
| henrynash | stevemar:….that would be great… | 19:57 |
| stevemar | henrynash, looking now | 19:57 |
| *** joesavak has joined #openstack-keystone | 19:58 | |
| stevemar | there is no delta between when i reviewed it the first time and the proposed code, nice :D | 19:58 |
| stevemar | i think i just took issue with the msg | 19:58 |
| henrynash | stevemar: Yes, I changed the commit message to make it clear that this was scoffolding as well as a refactor | 19:59 |
| henrynash | stevemar: “scoffolding’ : the art of cramming as much as possible into one’s mouth… | 20:00 |
| *** jsavak has quit IRC | 20:00 | |
| *** jimbaker has quit IRC | 20:00 | |
| henrynash | stevemar: thx | 20:01 |
| stevemar | np | 20:01 |
| *** nellysmi_ has joined #openstack-keystone | 20:05 | |
| *** jimbaker has joined #openstack-keystone | 20:06 | |
| *** jimbaker has quit IRC | 20:07 | |
| *** jimbaker has joined #openstack-keystone | 20:07 | |
| *** fifieldt has quit IRC | 20:07 | |
| *** nellysmitt has quit IRC | 20:09 | |
| *** EmilienM|afk is now known as EmilienM | 20:10 | |
| *** karimb has joined #openstack-keystone | 20:12 | |
| *** _afezekas|pub has joined #openstack-keystone | 20:13 | |
| morganfainberg | lbragstad, dolphm, you guys got dstanek's comments or do you want us to handle them as we prepare to put this through gate? [i'm looking at post food] | 20:14 |
| morganfainberg | i think most comments have been addressed and minor other changes besides the test ones can happen in a followup. | 20:14 |
| dolphm | morganfainberg: i'll take a poke unless lbragstad has uncommitted changes to make? | 20:14 |
| morganfainberg | unless someone has a major issue between now and then. | 20:14 |
| morganfainberg | dolphm, cool. | 20:14 |
| morganfainberg | dolphm, figure i'd ask because unless there is a major issue i'd like to get this gating today | 20:15 |
| dstanek | after those last few small things i think it's ready to go | 20:15 |
| lbragstad | dolphm: morganfainberg I can do it, I don't have anything outstanding locally (working on getting federation setup to test this with) | 20:15 |
| dolphm | morganfainberg: i still have changes i'd like to try - like moving the version into the integrity verfified message :) | 20:15 |
| dolphm | morganfainberg: but none would be blockers | 20:15 |
| dstanek | lbragstad: your other review has the same test issues | 20:15 |
| dstanek | lbragstad: i just put a quick comment on it; although i'm still going over the details of the new tests | 20:17 |
| lbragstad | dstanek: so do you want me to get rid of the matchers or just use them directly in every test case? | 20:17 |
| morganfainberg | lbragstad, more important .assert_true isn't correct | 20:17 |
| morganfainberg | the use of^ | 20:17 |
| morganfainberg | lbragstad, though the direct use of the matchers would be better for readability | 20:17 |
| lbragstad | morganfainberg: dstanek ok, I can address taht | 20:17 |
| dstanek | lbragstad: i don't care either way - we have been trending toward matchers in general though | 20:17 |
| dstanek | morganfainberg: ++ | 20:18 |
| dolphm | lbragstad: responded to dstanek's comments with a few suggestions - i agree with all of them | 20:23 |
| dolphm | lbragstad: the way you used assertTrue is how you would use assertThat instead | 20:24 |
| lbragstad | makes sense, I'll refactor | 20:24 |
| dolphm | lbragstad: hopefully those tests won't suddenly fail! (subtle catch, dstanek!) | 20:24 |
| *** fifieldt has joined #openstack-keystone | 20:24 | |
| *** mriedem has joined #openstack-keystone | 20:25 | |
| mriedem | where does the notification_driver config option come from? i see it in the config docs but not in the source, except in a test | 20:25 |
| mriedem | stevemar: ^? | 20:25 |
| morganfainberg | dolphm, hehe, right usage, wrong method :P | 20:26 |
| morganfainberg | mriedem, oslo.messaging? | 20:26 |
| lbragstad | mriedem: https://github.com/openstack/oslo.messaging/blob/master/oslo_messaging/notify/notifier.py#L30 | 20:27 |
| mriedem | lbragstad: yeah looking there now, still. | 20:28 |
| mriedem | digging around in guts | 20:28 |
| samueldmq | dstanek, ping - so it sadly looks like openstack didnt get accepted for gsoc :/ | 20:28 |
| samueldmq | dstanek, https://www.google-melange.com/gsoc/org/list/public/google/gsoc2015 | 20:28 |
| *** _afezekas|pub has quit IRC | 20:29 | |
| dstanek | samueldmq: well, that sucks | 20:29 |
| lbragstad | mriedem: the notification_driver looks to still be specified in the keystone.conf https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L352 | 20:29 |
| samueldmq | dstanek, linux foundation wasnt as well... that looks odd | 20:30 |
| samueldmq | dstanek, but .. well, next year we re-apply :p | 20:30 |
| mriedem | morganfainberg: lbragstad: ah https://github.com/openstack/oslo.messaging/blob/master/setup.cfg#L50 | 20:32 |
| lbragstad | mriedem: yeah, that looks right, you also have https://github.com/openstack/oslo.messaging/blob/master/setup.cfg#L32-L36 | 20:33 |
| mriedem | lbragstad: yeah so notification_driver=messagingv2 and rpc_backend=rabbit | 20:34 |
| mriedem | to get 'notifications' topic | 20:35 |
| mriedem | is the notifications stuff turned on at all in the gate? | 20:35 |
| stevemar | mriedem, it's not turned on at all in the gate | 20:35 |
| mriedem | was it at one point? i seem to remember performance issues with ceilometer/keystone/cadf | 20:36 |
| stevemar | wouldn't know that far back | 20:36 |
| *** david-lyle has joined #openstack-keystone | 20:37 | |
| *** jsavak has joined #openstack-keystone | 20:37 | |
| lbragstad | dstanek: dolphm with the fernet_keys/ suggestion here | 20:39 |
| lbragstad | https://review.openstack.org/#/c/145317/33/keystone/common/config.py | 20:39 |
| lbragstad | should that be done in the fernet renaming patch? | 20:39 |
| dolphm | lbragstad: works for me | 20:40 |
| *** joesavak has quit IRC | 20:41 | |
| dstanek | lbragstad: dolphm: ++ | 20:43 |
| *** lhcheng has quit IRC | 20:51 | |
| *** mriedem has left #openstack-keystone | 20:52 | |
| *** raildo_ has joined #openstack-keystone | 20:54 | |
| *** samueldmq_ has joined #openstack-keystone | 20:56 | |
| openstackgerrit | Merged openstack/keystone: Remove deprecated methods and functions in token subsystem https://review.openstack.org/151381 | 20:57 |
| lbragstad | dolphm: question on the key rotation | 21:06 |
| lbragstad | dolphm: when I have an empty key directory, and I do a keystone-manage klwt_setup, I get the following output: | 21:06 |
| samueldmq_ | henrynash, ping - have a question on your migration for adding domain config ... | 21:06 |
| *** joesavak has joined #openstack-keystone | 21:06 | |
| lbragstad | dolphm: nevermind, I answered my own question | 21:07 |
| dolphm | lbragstad: K :) | 21:08 |
| *** andreaf_ has joined #openstack-keystone | 21:08 | |
| *** andreaf_ has quit IRC | 21:08 | |
| *** jsavak has quit IRC | 21:09 | |
| *** diegows has quit IRC | 21:13 | |
| *** rm_work is now known as rm_work|away | 21:14 | |
| stevemar | lbragstad, whats the output you get? | 21:15 |
| stevemar | no keys present? | 21:15 |
| lbragstad | stevemar: the directory that you've specified as the key repository should contain two keys | 21:15 |
| lbragstad | 0 and 1 | 21:16 |
| *** lhcheng has joined #openstack-keystone | 21:16 | |
| lbragstad | so, the first time through, it should create a new staged key, 0, and then promote that key to a primary key, 1 | 21:16 |
| stevemar | so 2 is the minimum eh | 21:16 |
| lbragstad | then it should create another staged key, 0 | 21:16 |
| lbragstad | http://cdn.pasteraw.com/olixsladeuyf2lk6t5nmb2llu1aj4zk | 21:16 |
| morganfainberg | henrynash: ping. So have a question for you. | 21:21 |
| *** radez is now known as radez_g0n3 | 21:21 | |
| *** lhcheng_ has joined #openstack-keystone | 21:21 | |
| morganfainberg | henrynash: any thoughts on how to use per-domain backend where ids are needed but the Id isn't generated until the request goes through the mapping backend? | 21:22 |
| *** rm_work|away is now known as rm_work | 21:23 | |
| *** chlong has joined #openstack-keystone | 21:23 | |
| *** lhcheng has quit IRC | 21:24 | |
| *** david-lyle has quit IRC | 21:27 | |
| henrynash | morganfainberg: hi | 21:27 |
| *** ayoung-lunx has quit IRC | 21:27 | |
| henrynash | morganfainberg: can you explain some more about what you need? | 21:28 |
| morganfainberg | henrynash: so in short, how do I assign a role to someone in an ldap backend that goes through the mapping thing? Assuming I have added them to ldap but they have not logged in yet. | 21:28 |
| *** david-lyle has joined #openstack-keystone | 21:28 | |
| morganfainberg | Or I add a new group to LDAP, and want to assign a role to it. | 21:28 |
| henrynash | morganfainber: so if you just to a identity_api.get_user() on them it will generate a public ID for you | 21:30 |
| morganfainberg | So how do I get user on them if I don't know their Id yet? | 21:30 |
| morganfainberg | Or get group? | 21:30 |
| henrynash | morganfainberg: so you can do a list_users() | 21:31 |
| henrynash | morganfainberg: (filterred by user name if you like) | 21:31 |
| morganfainberg | Potentially harmful if I have 10k users. | 21:31 |
| morganfainberg | Ok. So no good answer atm b | 21:31 |
| morganfainberg | Because the filtering needs the improvement still (ish) | 21:32 |
| henrynash | morganfainberg: so if you know the local ID, then you could call the mapping manually I suspect to cause a public ID to be generated | 21:32 |
| openstackgerrit | Eric Brown proposed openstack/keystonemiddleware: Use oslo_config choices support https://review.openstack.org/160031 | 21:33 |
| henrynash | morganfainberg: I’d have to check if all the apis needed are publick | 21:33 |
| henrynash | morganfainberg: filtering by name is now supported in sql and ldap backends | 21:33 |
| morganfainberg | Right. | 21:34 |
| henrynash | morganfainberg: and there is already an explict get_user_by_name API call | 21:35 |
| morganfainberg | Ok cool. | 21:35 |
| morganfainberg | Not a rest call for get user by name though | 21:35 |
| *** david-lyle has quit IRC | 21:35 | |
| henrynash | morganfainberg: yep, its a v2 REST API | 21:37 |
| morganfainberg | Hmm. | 21:37 |
| morganfainberg | Ok so maybe a gap in v3. | 21:37 |
| morganfainberg | Small gap | 21:37 |
| henrynash | morganfainberg: and in v3 you would do GET /users?name=xyz | 21:38 |
| henrynash | morganfainberg: which would end up doing the same thing underneath | 21:38 |
| morganfainberg | Didn't that do bad things? Like filtering in memory. | 21:38 |
| *** ChristyF has joined #openstack-keystone | 21:38 | |
| morganfainberg | Or did we fix that recently? | 21:38 |
| henrynash | morganfainbergL so we fixed in for SQL a couple of releases ago…and my patch to fix with with LDAP merged last week | 21:39 |
| morganfainberg | Agh | 21:39 |
| morganfainberg | Ahh* | 21:39 |
| stevemar | hey ChristyF :) glad to see you here! | 21:43 |
| stevemar | morganfainberg, ^ new grunt that i'm trying to get up to speed | 21:44 |
| ChristyF | hey :) | 21:44 |
| morganfainberg | ChristyF, hiya! | 21:44 |
| ChristyF | tryin to get my hands dirty on this stuff ... heh | 21:44 |
| stevemar | ChristyF, still trying to setup your vm? | 21:45 |
| stevemar | and the whole launchpad/gerrit setup | 21:46 |
| ChristyF | vm is all good to go | 21:46 |
| ChristyF | readin through launchpad/gerrit stuff you linked right now | 21:46 |
| openstackgerrit | Merged openstack/keystone: Add in non-decorator notifiers https://review.openstack.org/158600 | 21:48 |
| *** chlong has quit IRC | 21:51 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 21:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 21:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 21:55 |
| *** aix has joined #openstack-keystone | 21:56 | |
| *** _afezekas|pub has joined #openstack-keystone | 21:56 | |
| openstackgerrit | Merged openstack/keystone: Get initiator from manager and send to controller https://review.openstack.org/155660 | 21:57 |
| openstackgerrit | henry-nash proposed openstack/keystone: Implement backend driver support for domain config https://review.openstack.org/158051 | 21:59 |
| morganfainberg | so.. | 21:59 |
| morganfainberg | i think DOA is doing something bad w/ fernet tokens | 22:00 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 22:00 |
| bknudson | morganfainberg: does DOA think it's a PKI token? | 22:01 |
| morganfainberg | hm nope not DOA. | 22:01 |
| *** nkinder has quit IRC | 22:01 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 22:01 |
| morganfainberg | somehow i lost my session | 22:01 |
| morganfainberg | logged in then it was invalid | 22:01 |
| *** jaosorior has quit IRC | 22:02 | |
| morganfainberg | relog solved it | 22:02 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 22:03 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 22:03 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 22:03 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 22:03 |
| henrynash | gyee, samueldmq: fixec up the suggesttions you had on: https://review.openstack.org/#/c/158051/ | 22:04 |
| *** joesavak has quit IRC | 22:04 | |
| *** david-lyle has joined #openstack-keystone | 22:05 | |
| *** _cjones_ has quit IRC | 22:06 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement validation on the Identity V3 API https://review.openstack.org/132122 | 22:08 |
| lbragstad | lhcheng_: ^ fixed a rebase issue | 22:08 |
| *** _afezekas|pub has quit IRC | 22:10 | |
| *** _cjones_ has joined #openstack-keystone | 22:12 | |
| dstanek | lbragstad: a small spelling error! | 22:12 |
| lbragstad | dstanek: which patch? | 22:12 |
| dstanek | lbragstad: https://review.openstack.org/#/c/145317/33..34/doc/source/configuration.rst *single | 22:12 |
| *** lhcheng_ is now known as lhcheng | 22:13 | |
| lhcheng | lbragstad: thanks! | 22:14 |
| lbragstad | lhcheng: thank you for moving it along | 22:14 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 22:16 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 22:16 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 22:16 |
| lbragstad | dstanek: fixed | 22:16 |
| lbragstad | dstanek: thank you for the diligent reviews | 22:16 |
| lhcheng | lhcheng: glad to help, still need to figure out the tricky part on how to add the password length on schema. Going to work on it when this patch merges. | 22:17 |
| dstanek | lbragstad: you're doing the hard part | 22:17 |
| lbragstad | lhcheng: yeah, that has something to do with how import works I believe... dstanek was digging into that a while ago. We should be able to get around it by using jsd | 22:17 |
| lhcheng | lbragstad: what's "jsd" ? | 22:18 |
| dstanek | lhcheng: it's easy to do, but it looks really, really ugly | 22:18 |
| lbragstad | lhcheng: some magical stuff | 22:18 |
| lbragstad | lhcheng: https://github.com/dstanek/jsd | 22:19 |
| dstanek | lhcheng: the problem is that the decorators are set at import time, well before the config is read | 22:19 |
| dstanek | lhcheng: jsd is an attempt to make jsonschema usable | 22:19 |
| lbragstad | it should benefit us as our schema grows | 22:19 |
| *** radez_g0n3 is now known as radez | 22:20 | |
| lhcheng | dstanek, lbragstad: nice! is this something we're looking at for kilo? or too late? | 22:21 |
| lbragstad | lhcheng: probably too late for that | 22:21 |
| dstanek | lhcheng: way too late | 22:21 |
| lhcheng | heh thought so | 22:22 |
| dstanek | lhcheng: there's some lingering fixes that i really need to push, but it hasn't been a priority for me so far | 22:22 |
| dstanek | maybe later tonight now that i've been reminded | 22:22 |
| lbragstad | lhcheng: jsd has some good ground work, but we'd need to develop it a bit more in order to use it fully in keystonbe | 22:22 |
| lbragstad | keystone* | 22:22 |
| lbragstad | lhcheng: http://lbragstad.com/?p=15 | 22:23 |
| dstanek | there twitter now knows how i feel about jsonschema | 22:23 |
| *** pnavarro has quit IRC | 22:23 | |
| lhcheng | lbragstad: umm.. the recipe post distracted me from reading the keystone post | 22:28 |
| *** ajayaa has joined #openstack-keystone | 22:28 | |
| *** topol has quit IRC | 22:29 | |
| lhcheng | dstanek: nice, seems a lot cleaner. ++ on making it reusable | 22:32 |
| *** stevemar has quit IRC | 22:33 | |
| lbragstad | lhcheng: lol yeah, they distract me too | 22:34 |
| samueldmq_ | henrynash, ok thanks, I'm reviewing the other on that chain :) | 22:34 |
| *** henrynash has quit IRC | 22:38 | |
| *** csoukup has quit IRC | 22:40 | |
| *** flaviof has left #openstack-keystone | 22:44 | |
| *** mattfarina has quit IRC | 22:44 | |
| *** radez is now known as radez_g0n3 | 22:47 | |
| dolphm | morganfainberg: i think dstanek made a mistake and put a +2 on https://review.openstack.org/#/c/145317/ almost 3 weeks before feature freeze. should probably -2 for a week or two just to be safe? | 22:49 |
| dstanek | dolphm: morganfainberg: i thought we were trying to get that through. i may have mis-read the conversation this morning though | 22:50 |
| morganfainberg | dolphm, uhm. wait what? | 22:51 |
| * morganfainberg is suddenly very confused. | 22:51 | |
| * dolphm is joking | 22:51 | |
| * morganfainberg can't tell if dolphm ... yeah | 22:51 | |
| morganfainberg | ok | 22:51 |
| morganfainberg | :) | 22:52 |
| * lbragstad got that joke! | 22:52 | |
| * dolphm is just trying to give morganfainberg a heart attack | 22:52 | |
| * morganfainberg -2's everything and rage quits (/s) | 22:52 | |
| morganfainberg | :) | 22:52 |
| morganfainberg | ooh i just realized a minor improvement we can make to dogpile, zzzeek might like this. | 22:53 |
| dstanek | dolphm: you make me want to drink | 22:53 |
| morganfainberg | maybe,... | 22:53 |
| dolphm | dstanek: haha | 22:54 |
| dolphm | dstanek: that's what friends are for! | 22:54 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Make the default cache time more explicit in code https://review.openstack.org/113586 | 22:54 |
| *** ajayaa has quit IRC | 22:56 | |
| morganfainberg | lbragstad, https://review.openstack.org/#/c/160040/ needs a rebase | 22:57 |
| morganfainberg | btw, +3 on KLWT. | 22:58 |
| morganfainberg | at this point i think we're going to pile on any fixes at the end barring major problems [ and we addressed the majority of those afaict ] | 22:58 |
| morganfainberg | s/majority/all | 22:59 |
| *** nkinder has joined #openstack-keystone | 23:05 | |
| dolphm | morganfainberg: !! lbragstad | 23:05 |
| dolphm | lbragstad: well done, sir! | 23:06 |
| dolphm | lbragstad: i've got a rebase of the rename patch ready to go, including the key dir rename, sample config update, etc | 23:06 |
| *** bknudson has quit IRC | 23:08 | |
| dstanek | dolphm: did you fix the caps issue? | 23:08 |
| dolphm | dstanek: yep! running tests to make sure i didn't break anything before posting | 23:08 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: On creation default service name to empty string https://review.openstack.org/146962 | 23:10 |
| *** nellysmi_ has quit IRC | 23:21 | |
| *** nellysmitt has joined #openstack-keystone | 23:23 | |
| *** rm_work is now known as rm_work|away | 23:24 | |
| *** nellysmitt has quit IRC | 23:28 | |
| *** gordc has quit IRC | 23:31 | |
| *** jorge_munoz has quit IRC | 23:32 | |
| *** chlong has joined #openstack-keystone | 23:33 | |
| *** henrynash has joined #openstack-keystone | 23:36 | |
| *** ChanServ sets mode: +v henrynash | 23:36 | |
| *** openstackgerrit has quit IRC | 23:38 | |
| *** rm_work|away is now known as rm_work | 23:38 | |
| *** openstackgerrit has joined #openstack-keystone | 23:38 | |
| *** ljfisher has quit IRC | 23:42 | |
| *** _cjones_ has quit IRC | 23:47 | |
| *** ayoung-lunx has joined #openstack-keystone | 23:47 | |
| *** _cjones_ has joined #openstack-keystone | 23:51 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Rename "Keystone LightWeight Tokens" (KLWT) to "Fernet" tokens https://review.openstack.org/160040 | 23:52 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Rename "Keystone LightWeight Tokens" (KLWT) to "Fernet" tokens https://review.openstack.org/160040 | 23:54 |
| dolphm | morganfainberg: the one you just +2'd had an unintended inconsequential change | 23:55 |
| morganfainberg | saw | 23:55 |
| morganfainberg | +2ing again | 23:55 |
| morganfainberg | wow, 300 lines of testing for +1,-1 change | 23:56 |
| *** EmilienM is now known as EmilienM|afk | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!