| *** nkinder has joined #openstack-keystone | 00:13 | |
| *** markvoelker has joined #openstack-keystone | 00:17 | |
| *** markvoelker has quit IRC | 00:22 | |
| *** dims has joined #openstack-keystone | 01:01 | |
| *** dims has quit IRC | 01:01 | |
| *** browne has joined #openstack-keystone | 01:14 | |
| *** dims__ has joined #openstack-keystone | 01:15 | |
| *** markvoelker has joined #openstack-keystone | 01:18 | |
| *** markvoelker has quit IRC | 01:23 | |
| *** stevemar has quit IRC | 01:34 | |
| *** mestery_ is now known as mestery | 01:53 | |
| *** Kennan has left #openstack-keystone | 01:56 | |
| *** davechen has joined #openstack-keystone | 02:00 | |
| *** spandhe has quit IRC | 02:08 | |
| *** erkules_ has joined #openstack-keystone | 02:16 | |
| *** erkules has quit IRC | 02:18 | |
| *** markvoelker has joined #openstack-keystone | 02:19 | |
| *** markvoelker has quit IRC | 02:23 | |
| *** dims__ has quit IRC | 03:01 | |
| *** trey has quit IRC | 03:13 | |
| *** trey has joined #openstack-keystone | 03:14 | |
| *** spandhe has joined #openstack-keystone | 03:16 | |
| *** iamjarvo has joined #openstack-keystone | 03:22 | |
| *** dims__ has joined #openstack-keystone | 04:06 | |
| *** stevemar has joined #openstack-keystone | 04:15 | |
| *** ChanServ sets mode: +v stevemar | 04:15 | |
| *** spandhe has quit IRC | 04:18 | |
| *** iamjarvo has quit IRC | 04:35 | |
| *** dims__ has quit IRC | 04:36 | |
| *** richm1 has quit IRC | 04:38 | |
| *** pcaruana has quit IRC | 05:07 | |
| *** bernardo-silva has joined #openstack-keystone | 05:14 | |
| *** bernardo-silva has quit IRC | 05:15 | |
| *** rushiagr_away is now known as rushiagr | 05:19 | |
| *** lhcheng_afk has quit IRC | 05:21 | |
| *** lhcheng_afk has joined #openstack-keystone | 05:28 | |
| *** spandhe has joined #openstack-keystone | 05:50 | |
| *** ishant has joined #openstack-keystone | 05:54 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/166581 | 06:05 |
|---|---|---|
| *** dims__ has joined #openstack-keystone | 06:22 | |
| *** browne has quit IRC | 06:26 | |
| *** jamielennox is now known as jamielennox|away | 06:28 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Allow saving and caching the plugin auth state https://review.openstack.org/149175 | 06:28 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Skip endpoints which is not available https://review.openstack.org/144860 | 06:31 |
| *** stevemar has quit IRC | 06:48 | |
| *** dims__ has quit IRC | 06:54 | |
| marekd | Good morning. | 06:55 |
| *** pcaruana has joined #openstack-keystone | 06:58 | |
| *** Bsony has joined #openstack-keystone | 06:59 | |
| *** jamiec has quit IRC | 07:00 | |
| *** jamiec has joined #openstack-keystone | 07:03 | |
| *** rushiagr is now known as rushiagr_away | 07:03 | |
| *** henrynash has joined #openstack-keystone | 07:04 | |
| *** ChanServ sets mode: +v henrynash | 07:04 | |
| *** mflobo has joined #openstack-keystone | 07:13 | |
| *** lhcheng_afk has quit IRC | 07:19 | |
| *** lhcheng_afk has joined #openstack-keystone | 07:23 | |
| *** lhcheng_afk has quit IRC | 07:44 | |
| *** ParsectiX has joined #openstack-keystone | 07:53 | |
| *** chlong has quit IRC | 07:58 | |
| zigo_ | Can anyone help with this? https://bugs.launchpad.net/keystone/+bug/1435174 | 08:11 |
| openstack | Launchpad bug 1435174 in Keystone "SSLTestCase errors when building Debian package" [Undecided,New] | 08:11 |
| *** markvoelker has joined #openstack-keystone | 08:24 | |
| *** junhongl has quit IRC | 08:25 | |
| *** markvoelker has quit IRC | 08:28 | |
| *** pnavarro has joined #openstack-keystone | 08:29 | |
| *** pnavarro has quit IRC | 08:30 | |
| *** pnavarro has joined #openstack-keystone | 08:32 | |
| *** dims__ has joined #openstack-keystone | 08:39 | |
| *** jistr has joined #openstack-keystone | 09:02 | |
| *** lsmola has joined #openstack-keystone | 09:10 | |
| *** dims__ has quit IRC | 09:12 | |
| *** erkules_ is now known as erkules | 09:14 | |
| *** erkules has quit IRC | 09:14 | |
| *** erkules has joined #openstack-keystone | 09:14 | |
| *** markvoelker has joined #openstack-keystone | 09:24 | |
| *** markvoelker has quit IRC | 09:29 | |
| *** afazekas_ has joined #openstack-keystone | 09:29 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/166581 | 09:35 |
| *** ccard__ has joined #openstack-keystone | 09:40 | |
| ccard__ | I have configured keystone to use domain-specific configuration, so that I can get end users from an LDAP db, and configured horizon to the v3 keystone api. | 09:42 |
| ccard__ | I have created a project in the users domain and added a user to the project as _member_, and can successfully login to horizon as the user in the users domain. | 09:43 |
| *** fhubik has joined #openstack-keystone | 09:43 | |
| fhubik | Hi there, anyone here expert on keystone v2 and v3 policy files? | 09:45 |
| ccard__ | But I get lots of Unauthorized error messages when I click on the various project menu items in horizon. When I login as the end users I get the error "Unable to retrieve usage information" and turning on debug logging in the nova api I can see messages from keystoneclient.auth.identity.v2 which indicate that horizon is talking to nova api and the nova api is trying to authenticate to the keystone v2.0 url rather than the v3 url | 09:47 |
| ccard__ | What configuration item(s) do I have to change to get the keystone client to use the v3 keystone api? | 09:48 |
| fhubik | I was wondering about possibility of deprecation the default v2 policy.json file instead of new policy.v3cloudsample.json. Is this possible or those files aren't backward-compatible? | 09:48 |
| *** dims__ has joined #openstack-keystone | 09:51 | |
| *** kodoku has joined #openstack-keystone | 09:55 | |
| *** davechen has left #openstack-keystone | 09:56 | |
| kodoku | Hi, Is it possible to use mysql and ldap authentification in keystone V2 ? | 09:57 |
| *** krykowski has joined #openstack-keystone | 10:00 | |
| *** henrynash has quit IRC | 10:23 | |
| *** markvoelker has joined #openstack-keystone | 10:25 | |
| *** amakarov_away is now known as amakarov | 10:28 | |
| *** markvoelker has quit IRC | 10:30 | |
| *** junhongl has joined #openstack-keystone | 10:31 | |
| *** junhongl has quit IRC | 10:35 | |
| *** krykowski has quit IRC | 10:51 | |
| *** krykowski_ has joined #openstack-keystone | 10:51 | |
| *** junhongl has joined #openstack-keystone | 10:51 | |
| *** jaosorior has joined #openstack-keystone | 10:53 | |
| *** junhongl has quit IRC | 10:56 | |
| *** Bsony_ has joined #openstack-keystone | 11:00 | |
| *** Bsony has quit IRC | 11:04 | |
| *** samueldmq has joined #openstack-keystone | 11:23 | |
| samueldmq | morning | 11:23 |
| *** markvoelker has joined #openstack-keystone | 11:26 | |
| *** markvoelker has quit IRC | 11:30 | |
| *** fhubik is now known as fhubik_afk | 11:30 | |
| *** kodoku has quit IRC | 11:34 | |
| ccard__ | which configuration option is it that drives the use of keystoneclient/auth/identity/v2.py rather than keystoneclient/auth/identity/v3.py? | 11:43 |
| *** markvoelker has joined #openstack-keystone | 11:46 | |
| *** henrynash has joined #openstack-keystone | 12:00 | |
| *** ChanServ sets mode: +v henrynash | 12:00 | |
| *** krykowski_ has quit IRC | 12:00 | |
| *** krykowski has joined #openstack-keystone | 12:01 | |
| *** raildo has joined #openstack-keystone | 12:04 | |
| *** richm has joined #openstack-keystone | 12:07 | |
| *** iurygregory has quit IRC | 12:20 | |
| *** gordc has joined #openstack-keystone | 12:27 | |
| *** ishant has quit IRC | 12:27 | |
| *** fhubik_afk is now known as fhubik | 12:27 | |
| *** fhubik has quit IRC | 12:28 | |
| *** davechen has joined #openstack-keystone | 12:32 | |
| *** fhubik has joined #openstack-keystone | 12:33 | |
| *** dims__ has quit IRC | 12:34 | |
| *** fhubik_afk has joined #openstack-keystone | 12:34 | |
| *** dims__ has joined #openstack-keystone | 12:34 | |
| davechen | henrynash: hi, | 12:40 |
| henrynash | hi | 12:40 |
| davechen | henrynash: I saw your comments and the bugs you filed. :) | 12:40 |
| henrynash | I;ve just invalidated two of those busg now I ACTUALLY undertand what’s going on! | 12:40 |
| davechen | henrynash: yes, as far i as i know, 1435310 is invalid. :( | 12:41 |
| henrynash | I’m going to put in a fix for the metadata shortly….since I can’t see that is used anywhere | 12:42 |
| davechen | henrynash: thanks for your focus on this issue. | 12:42 |
| davechen | yeah, did some troubleshooting either, but never see where the metadata come from. | 12:43 |
| davechen | henrynash: I will rebase on your patch once you the fix is done. | 12:43 |
| henrynash | yep, I’ll ping youwhen it is posted | 12:44 |
| davechen | henrynash: thanks henry, leave for an while, will check it when I back. | 12:47 |
| henrynash | np | 12:47 |
| openstackgerrit | Merged openstack/keystone: Specify time units for default_lock_timeout https://review.openstack.org/166304 | 12:51 |
| *** ayoung has joined #openstack-keystone | 12:51 | |
| *** ChanServ sets mode: +v ayoung | 12:51 | |
| *** henrynash has quit IRC | 12:52 | |
| *** dims__ is now known as dims | 12:52 | |
| *** Bsony has joined #openstack-keystone | 13:01 | |
| *** Bsony_ has quit IRC | 13:04 | |
| *** fhubik_afk has quit IRC | 13:09 | |
| *** fhubik_afk has joined #openstack-keystone | 13:09 | |
| *** fhubik_lunch has joined #openstack-keystone | 13:09 | |
| *** fhubik_lunch is now known as fhubik_ | 13:09 | |
| *** fhubik has quit IRC | 13:13 | |
| *** henrynash has joined #openstack-keystone | 13:13 | |
| *** ChanServ sets mode: +v henrynash | 13:13 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change domain_id FK in project table https://review.openstack.org/166354 | 13:13 |
| marekd | raildo: s ^^ is it part of FFE ? | 13:14 |
| marekd | raildo: or you are already working in the Liberty window? | 13:14 |
| raildo | marekd, its FFE, morganfainberg needs to put a -2 on this patch :) | 13:14 |
| raildo | marekd, or can i put a -1 explain this? | 13:15 |
| marekd | raildo: i don't know | 13:15 |
| marekd | probably a -2 must land there. | 13:15 |
| marekd | so people really don't approve, even by mistake. | 13:16 |
| raildo | marekd, sure... I'll talk with morganfainberg to put -2 when I see him online. | 13:17 |
| marekd | yep | 13:17 |
| raildo | marekd, thanks :) | 13:20 |
| *** iamjarvo has joined #openstack-keystone | 13:26 | |
| *** iamjarvo has quit IRC | 13:27 | |
| *** ParsectiX has quit IRC | 13:27 | |
| *** ljfisher has joined #openstack-keystone | 13:28 | |
| *** ParsectiX has joined #openstack-keystone | 13:30 | |
| *** mattfarina has joined #openstack-keystone | 13:30 | |
| *** zzzeek has joined #openstack-keystone | 13:36 | |
| ayoung | marekd, can you tag this bug as verified? https://bugs.launchpad.net/keystone/+bug/1434701 | 13:39 |
| openstack | Launchpad bug 1434701 in Keystone "websso should compare remote_id_attribute to remote_id of IdP" [Undecided,In progress] - Assigned to Nathan Kinder (nkinder) | 13:39 |
| ayoung | I can accept that his fix is correct, if I can accept that the original logic was wrong | 13:40 |
| ayoung | I'm guessing that you think he's right considering you responded on the review | 13:40 |
| ayoung | marekd, the whole concept of Remote ID scares me. WTH are we doing there? The Identity provider should not be specifying anything that is not then mapped, and this appears to be the case. I can't help but wonder if we are being too clever fro our own good here. What am I missing? | 13:49 |
| henrynash | is anyone having a problem with test_auth failing with Rule [identity:create_trust] does not exist (even on master)? | 13:53 |
| henrynash | (even though it actually does exist in policy.json) | 13:54 |
| bknudson | what does this comment mean? http://git.openstack.org/cgit/openstack/keystone/tree/keystone/notifications.py#n112 | 13:55 |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove unused metadata parameter from get_catalog methods https://review.openstack.org/166837 | 13:57 |
| *** henrynash has quit IRC | 14:01 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Use `region` or `region_id` in a consistent way https://review.openstack.org/162465 | 14:01 |
| *** hogepodge has joined #openstack-keystone | 14:02 | |
| bknudson | the event_type for role_assignment is like 'identity.created.role_assignment' whereas for projects it's like 'identity.project.created' (the order is incorrect for role assignments, based on the docs) | 14:03 |
| lbragstad | dolphm: fernet token brown bag? | 14:04 |
| bknudson | I think we'll have to remove fernet tokens... can't update cryptography requirement to support it. | 14:05 |
| lbragstad | bknudson: what is the min requirement we need? | 14:06 |
| lbragstad | bknudson: I thought it was already supported by global reqs? | 14:06 |
| bknudson | lbragstad: 0.7 , when MultiFernet was added. | 14:06 |
| bknudson | global reqs says we support down to 0.4. | 14:06 |
| ayoung | bknudson, bknudson remove? | 14:07 |
| ayoung | I would think that something not enabled by default would be OK | 14:07 |
| bknudson | y, we could add some documentation | 14:08 |
| lbragstad | so we can't bump our version up? | 14:08 |
| lbragstad | https://github.com/openstack/keystone/blob/master/requirements.txt#L13 | 14:08 |
| ayoung | if we need a way to split the dependency | 14:08 |
| bknudson | none of us here have authority to bump the requirements. | 14:08 |
| ayoung | bknudson, what happens if we leave it as is? | 14:09 |
| lbragstad | bknudson: ah, right... version bumps are done from the OpenStack Proposal Bot... | 14:09 |
| lbragstad | ayoung: unsupport MultiFernet | 14:09 |
| ayoung | It means that if someone tried to enable fernet, it would break | 14:09 |
| lbragstad | unsupported* | 14:10 |
| bknudson | ayoung: if you're using cryptography 0.4 and you enable fernet it doesn't work (raises exceptions) | 14:10 |
| lbragstad | ayoung: bknudson https://github.com/openstack/keystone/blob/d638709b7ecfdcc0f9664073689c1fc9d75a475a/keystone/token/providers/fernet/token_formatters.py#L64 | 14:10 |
| *** stevemar has joined #openstack-keystone | 14:10 | |
| *** ChanServ sets mode: +v stevemar | 14:10 | |
| ayoung | but they could bump up the cryptography version themselves, it will, so it is just the global req that can't be met. Its an experimental feature, adn I think this is appropriate | 14:10 |
| bknudson | I assume it fails pretty quickly... not sure though... the only one I know about is MutiFernet. | 14:10 |
| bknudson | there should at least be documentation. | 14:11 |
| lbragstad | bknudson: ++, I'll see if I can run the tests with 0.4 | 14:11 |
| lbragstad | bknudson: if not, then maybe dolphm has a workaround for the MultiFernet stuff? | 14:12 |
| ccard__ | "which configuration option is it that drives the use of keystoneclient/auth/identity/v2.py rather than keystoneclient/auth/identity/v3.py?" - I have tracked down the answer, /etc/nova/nova.conf must have auth_version set to v3.0 (not v3) | 14:12 |
| bknudson | lbragstad: actually, never mind, the requirements update was approved: https://review.openstack.org/#/c/164289/ | 14:13 |
| lbragstad | bknudson: sweet! | 14:14 |
| bknudson | I didn't think it would be approved. | 14:14 |
| lbragstad | bknudson: we're getting 0.8 too | 14:14 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:16 | |
| bknudson | http://docs.openstack.org/developer/keystone/event_notifications.html#example-notification-role-assignment -- docs also say identity.created.role_assignment rather than what is actually used. | 14:16 |
| bknudson | oh, no, the docs are correct. | 14:16 |
| stevemar | bknudson, i filed a bug to change it around to identity.role_assignment.created | 14:17 |
| bknudson | stevemar: I don't see a fix posted from you. | 14:20 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Skip endpoints which is not available https://review.openstack.org/144860 | 14:21 |
| bknudson | https://bugs.launchpad.net/keystone/+bug/1416767 | 14:21 |
| openstack | Launchpad bug 1416767 in Keystone "event_type for role assignment notifications is incorrect" [Medium,Triaged] | 14:21 |
| stevemar | bknudson, we would need to emit it twice, and a deprecation warning for the original event_type | 14:21 |
| bknudson | this was added before kilo? | 14:22 |
| stevemar | yeah in juno | 14:22 |
| *** timcline has joined #openstack-keystone | 14:23 | |
| *** henrynash has joined #openstack-keystone | 14:26 | |
| *** ChanServ sets mode: +v henrynash | 14:26 | |
| dstanek | stevemar: will it screw up auditing if the event is emitted twice? | 14:27 |
| *** davechen has left #openstack-keystone | 14:27 | |
| stevemar | dstanek, i think that depends on what the client is lookin at | 14:29 |
| stevemar | dstanek, it should be fine though | 14:29 |
| *** carlosmarin has joined #openstack-keystone | 14:31 | |
| *** henrynash_ has joined #openstack-keystone | 14:36 | |
| *** ChanServ sets mode: +v henrynash_ | 14:36 | |
| *** henrynash has quit IRC | 14:39 | |
| *** henrynash_ is now known as henrynash | 14:39 | |
| *** Ephur has joined #openstack-keystone | 14:39 | |
| stevemar | dstanek, bknudson the trouble was the deprecation message, wasn't sure how to handle that, with the usual LOG message or something else... | 14:40 |
| stevemar | the usual log message wouldn't be much to a consuming application | 14:41 |
| bknudson | stevemar: I don't think there needs to be a deprecation message in all cases... does cadf have a way to indicate that a message is deprecated? | 14:41 |
| *** henrynash_ has joined #openstack-keystone | 14:42 | |
| *** ChanServ sets mode: +v henrynash_ | 14:42 | |
| stevemar | bknudson, i'm thinking it doesn't... | 14:42 |
| dstanek | stevemar: you just need something that tells the operator that they need to inform the auditing people right? | 14:42 |
| bknudson | put it in the release notes. | 14:42 |
| stevemar | dstanek, yeah, in that case the usual log message would work | 14:42 |
| stevemar | we could also put it in the payload of the cadf event :P | 14:43 |
| stevemar | bknudson, CADF doesn't handle deprecations at all | 14:44 |
| *** samueldmq_ has joined #openstack-keystone | 14:45 | |
| *** henrynash has quit IRC | 14:45 | |
| *** henrynash_ is now known as henrynash | 14:45 | |
| dstanek | stevemar: it would probably be a good idea to get Matt or topol involved to know what a typical process for auditing changes looks like | 14:45 |
| *** junhongl has joined #openstack-keystone | 14:46 | |
| stevemar | dstanek, yeah, i was gonna bug Matt about this, i am thinking there is no case for this, and the spec could benefit from it | 14:47 |
| dstanek | yeah, there really should be a standard way to tell people the messages will be changing otherwise the reports could be messed up | 14:48 |
| *** r-daneel has joined #openstack-keystone | 14:49 | |
| *** junhongl has quit IRC | 14:50 | |
| *** henrynash has quit IRC | 14:56 | |
| *** thedodd has joined #openstack-keystone | 14:57 | |
| *** junhongl has joined #openstack-keystone | 14:59 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Document requirement of cryptography>=0.7 https://review.openstack.org/166874 | 15:03 |
| *** junhongl has quit IRC | 15:04 | |
| *** ParsectiX has quit IRC | 15:04 | |
| lbragstad | vim | 15:06 |
| * lbragstad hangs head... | 15:06 | |
| * lbragstad switches back to terminal window... | 15:07 | |
| morganfainberg | ^^ lbragstad https://review.openstack.org/#/c/164289/ | 15:12 |
| morganfainberg | Documentation warning is superfluous as we have g-r update coming. | 15:14 |
| stevemar | lbragstad, just got destroyed https://review.openstack.org/#/c/166874/ | 15:14 |
| morganfainberg | Soooooooooo | 15:15 |
| lbragstad | stevemar: lol, I was just adding docs based on bknudson's suggestion. | 15:15 |
| morganfainberg | Hi everyone;) | 15:15 |
| morganfainberg | Turns out Barbican is also using crypto features not in 0.4 | 15:16 |
| dolphm | anyone know where to configure what projects OpenStack Proposal Bot hits? | 15:18 |
| morganfainberg | stevemar: re cadf deprecation of msgs. I recommend you do the google protobuf thing, requires etc | 15:18 |
| morganfainberg | dolphm: yes it's in a text file in the g-r repo. Iirc | 15:18 |
| sigmavirus24 | dolphm: somewhere in openstack-infra's repos probably | 15:18 |
| sigmavirus24 | or not | 15:18 |
| dolphm | sigmavirus24: glance doesn't seem to be getting requirements updates, which would eliminate your usage of ~= | 15:19 |
| stevemar | dolphm, it comes from requirements/projects.txt | 15:19 |
| dolphm | sigmavirus24: there's a stable patch for glance, but nothing from master | 15:19 |
| morganfainberg | dolphm: or its a zuul job in project-config, but I think it's in the project.txt file | 15:19 |
| dolphm | stevemar: awesome, thanks | 15:19 |
| sigmavirus24 | stevemar: ftw | 15:19 |
| sigmavirus24 | dolphm: yeah I was going to look into that later | 15:20 |
| dolphm | sigmavirus24: glance is in the list ... https://github.com/openstack/requirements/blob/master/projects.txt | 15:20 |
| sigmavirus24 | dolphm: I know. we usually get updates | 15:20 |
| marekd | ayoung: Hi. How do you want Keystone to actually verify who issued assertion X if not via remote_id ? | 15:22 |
| ayoung | marekd, no clue | 15:22 |
| ayoung | I'm just knee-jerk panicking as usual | 15:22 |
| ayoung | marekd, so...what is a remote_id anyway | 15:22 |
| marekd | ayoung: please don't say now: we should have listened to DWChadwick, make one global mapping and list of trusted attributes" | 15:23 |
| marekd | ayoung: remote_id is entityId | 15:23 |
| marekd | ayoung: and it will usually be a URL | 15:23 |
| morganfainberg | dolphm: g-r has stable branches too. | 15:24 |
| ayoung | marekd, heh, I just want to make sure we have a plan in place to move towards self-modification of rules by the IdPs | 15:24 |
| ayoung | so remote_id...is it something we really expect the IdPs to issue? Shouldn't it be mapped? | 15:25 |
| marekd | if it doesn't then I deem the protocol as broken...or not functinoal in all cases. | 15:25 |
| marekd | ayoung: right now you need (idp, proto) to actually know HOW to map anything | 15:26 |
| marekd | ayoung: see, the point is there is kind of split in this architecture - there is mod_shib, where you actually configure who can access some URLs, and there is Keystone with its IdentityProvider backend objects. And until now , the IDentityProvider was a sstub with unique name. | 15:27 |
| marekd | plus, for websso - there is one endpoint only, and somehow we need to be able to see what was the issuer of this assertion. | 15:28 |
| marekd | mod_shib will make sure the IdP is trusted, and somewhere in that process will also check entityID (remote_id in our jargon) | 15:28 |
| ayoung | marekd, ... so this is a naming problem. Pretty much everything in the world is references by a "remote_id" of some sort. In this case, we have multiple remote_ids to...the IdP? And we are looking up the IdP bi its id...which is different from the remote_id? Can you see how a casual user will get confused. | 15:29 |
| marekd | and since mod_shib/mellon/whatever is not part of Keystone, we need to duplicate few things. | 15:29 |
| *** samueldmq__ has joined #openstack-keystone | 15:29 | |
| ayoung | So entityId/remote_id is the remote attribute that maps to...the Identity Provider itself? | 15:29 |
| marekd | it doesn't map..i'd say it identifies | 15:30 |
| marekd | ayoung: and yes, there are multiple remote_ids tied to one Idp, but then there is our work to change ppls minds and tell them: "hey, since you share your policies and mappings because your 100 universiteis agreed (SOMEHOW) on that, treat this IdP as your "federation instance" | 15:31 |
| *** samueldmq_ has quit IRC | 15:31 | |
| ayoung | marekd, is the remote_id validated by mod_shib? | 15:33 |
| marekd | now let me explain how this emerged. CERN doesn't have this problem cause we have MS ADFS and this time they did better job than FOSS community (Shibboleth), but there is Marco from INFN (italian institute) show manages OpenStack there and he comes to me and complains: dude, now you made me make up 500 stupid names to be configured in Keysone. Just becase my institute is in the federation with 500 members. | 15:33 |
| marekd | ayoung: for 99% yes. | 15:33 |
| ayoung | marekd, so I only have to worry about 1% of my users? That will help me sleep at night | 15:34 |
| marekd | ayoung: in fact, we should probably let them configure trusted idp like ppl configure mod_shib - by handing in Metadata files issued by a trusted IdP. | 15:34 |
| marekd | ayoung: i said that for 99% yes it validates, and i kept this 1% because i personally didn't see the line of code that does this validation. | 15:35 |
| *** ryanpetrello has joined #openstack-keystone | 15:35 | |
| dolphm | sigmavirus24: as it turns out, you killed the requirements job | 15:35 |
| marekd | ayoung: let me google | 15:35 |
| ayoung | heh | 15:35 |
| ryanpetrello | anybody around knowledgeable on keystone trusts? | 15:35 |
| stevemar | ayoung, ^^ | 15:35 |
| ryanpetrello | I have an interesting problem I'm trying to solve and am kind of stuck; looking for fresh ideas | 15:35 |
| ayoung | ryanpetrello, well I wrote "trusts" so I am like, the last person yiou should trust | 15:36 |
| ryanpetrello | :D | 15:36 |
| ryanpetrello | as an admin user, I want to perform some actions on behalf of a non-admin user | 15:36 |
| ayoung | I only know what I *think* they do | 15:36 |
| sigmavirus24 | dolphm: me personally or glance? | 15:36 |
| ryanpetrello | namely, I want to prefill their tenant with some things, e.g., make `neutron net-create` calls, etc... | 15:36 |
| ayoung | OK | 15:36 |
| ryanpetrello | I've *been* using user-role-add/remove to temporarily add the user into the tenant and perform some of these actions on their behalf | 15:36 |
| morganfainberg | dolphm: proposal bot can't do ~= ? | 15:37 |
| marekd | ayoung: http://blogs.forgerock.org/petermajor/2011/10/federation-with-shibboleth-sp-apache-module/ you actually specify entityId as identifier for the IdP. | 15:37 |
| ryanpetrello | but this has an unfortunate side effect: after the user-role-remove is called, *all* of the active tokens for that user are invalidated | 15:37 |
| dolphm | sigmavirus24: you personally, i'm putting up a "fix" now :P | 15:37 |
| ryanpetrello | trusts looks like a promising alternative, but as an admin, it doesn't look like I can grant myself a trust on another user's tenant; only they can grant *me* the trust | 15:37 |
| ayoung | ryanpetrello, and you would rather use a trust....not certain it makes sense....but I see why | 15:37 |
| sigmavirus24 | dolphm: which commit? | 15:37 |
| dolphm | morganfainberg: requirements/update.py can't handle it, so the bot can't | 15:37 |
| sigmavirus24 | dolphm: oh hah | 15:37 |
| ayoung | yeah...that is a concern. | 15:37 |
| * sigmavirus24 knows which change | 15:37 | |
| ryanpetrello | ayoung: https://github.com/openstack/keystone/blob/stable/juno/keystone/trust/controllers.py#L127 | 15:38 |
| ayoung | So, a trust has to be created by the trustor. | 15:38 |
| ryanpetrello | right | 15:38 |
| ryanpetrello | any other ideas how I could accomplish this? | 15:38 |
| ayoung | For audit reasons, you want the admin to do it with their own account... | 15:38 |
| ayoung | ryanpetrello, I'm putting design work in to clean up this process...but let me think if there is a way you can do it today.... | 15:39 |
| ryanpetrello | the only other thought I had was kind of disgusting :\ | 15:40 |
| ryanpetrello | I thought about, as an admin, adding an anonymous user to the target project | 15:40 |
| ayoung | temporary user? | 15:40 |
| ryanpetrello | doing the work as that user | 15:40 |
| ryanpetrello | then removing them | 15:40 |
| ryanpetrello | right | 15:40 |
| ayoung | ryanpetrello, don;'t you really want the project setup to be automated? | 15:40 |
| ayoung | Sounds like a user for a Heat template | 15:40 |
| ayoung | you still have the trust issue, but you could probably automate the trust creation when you user create the user account | 15:41 |
| ryanpetrello | wouldn't the user in question still have to run it? | 15:42 |
| ryanpetrello | right | 15:42 |
| ryanpetrello | the tricky part is that we don't *always* to this at user creation time | 15:42 |
| *** afazekas_ has quit IRC | 15:42 | |
| ryanpetrello | sometimes folks want us to do a "factory reset" of their tenant | 15:42 |
| ayoung | still would be a heat template or something...but sure... | 15:43 |
| ryanpetrello | we *could* set up a very long-running trust at user creation time | 15:43 |
| ryanpetrello | but then you've sort of got that trust hanging around forever | 15:43 |
| ryanpetrello | which is probably not super kosher from a security perspective | 15:44 |
| dolphm | sigmavirus24: the fix https://review.openstack.org/#/c/166897/ | 15:44 |
| dolphm | sigmavirus24: the result https://review.openstack.org/#/c/166894/ | 15:44 |
| ayoung | ryanpetrello, OK...so the problem is that there is no chain of responsibility. No way to say that ryanpetrello createed the ayoung user in this server, and assigned him his roles. | 15:44 |
| ayoung | Ideally, everything would be an explicit delegation | 15:45 |
| marekd | ayoung: i think IdentityProvider objects should be equipped with more and more attributes. | 15:45 |
| ayoung | temp assigning of roles is wrong because you already have the power.... | 15:45 |
| sigmavirus24 | dolphm: ah, that was something dhellmann or stevemar asked me to use and somehow merged as part of the oslo.policy graduation. Interesting | 15:46 |
| dolphm | sigmavirus24: yeah, that's what requirements *did* specify -- but it's since been updated to rip all those out | 15:46 |
| ayoung | ryanpetrello, really the bug is the revoke-all-tokens thing in your case. | 15:46 |
| sigmavirus24 | dolphm: also https://review.openstack.org/#/c/166796/ | 15:46 |
| dolphm | sigmavirus24: and glance's requirements weren't getting updated in the mean time | 15:46 |
| ryanpetrello | ayoung: correct | 15:47 |
| dolphm | sigmavirus24: oh there you go | 15:47 |
| sigmavirus24 | yeah | 15:47 |
| ryanpetrello | if the tokens weren't auto-revoked on the remove, what we have would work fine | 15:47 |
| sigmavirus24 | but we have a migration that's broken with alembic 0.7.5 | 15:47 |
| ayoung | ryanpetrello, For the factory reset case...you could build a web service that the user hits themself to do it. | 15:48 |
| sigmavirus24 | because 0.7.5 introduced some seemingly backwards incompat behaviour since 0.7.4 | 15:48 |
| sigmavirus24 | so our gate is broken on that too | 15:48 |
| ryanpetrello | yea, potentially | 15:48 |
| ryanpetrello | okay, I'll think some more on it | 15:48 |
| ayoung | they create the trust, and then you execute it | 15:48 |
| ryanpetrello | just wanted to make sure I wasn't missing something obvious | 15:48 |
| dolphm | lbragstad: abandon? https://review.openstack.org/#/c/166874/ | 15:48 |
| ayoung | ryanpetrello, for the initialization...it would work the same. Do you have some sort of provisioning system? | 15:48 |
| stevemar | dolphm, that ~ was in a bunch of other oslo libs no? | 15:49 |
| lbragstad | dolphm: yeah, I can. I threw up a review because bknudson wanted to see some docs. | 15:49 |
| dolphm | stevemar: yes, but they've since been removed because it broke everything | 15:49 |
| dolphm | lbragstad: requirements.txt is docs :) | 15:49 |
| stevemar | dolphm, someone forgot to remove for policy? | 15:49 |
| dolphm | stevemar: no, so... | 15:49 |
| dolphm | stevemar: ~= was in global requirements for policy for a moment | 15:50 |
| lbragstad | dolphm: works for me! | 15:50 |
| stevemar | oh | 15:50 |
| dolphm | stevemar: you suggested sigmavirus24 change to match requirements | 15:50 |
| dolphm | stevemar: it got ripped out of global requirements | 15:50 |
| dolphm | stevemar: and sigmavirus24's patch merged | 15:50 |
| sigmavirus24 | stevemar: it's all your fault =P | 15:50 |
| dolphm | stevemar: and glance was left broken | 15:50 |
| stevemar | gotcha, didn't realize it was ripped out so quickly | 15:50 |
| stevemar | i broken is all | 15:50 |
| stevemar | it* | 15:50 |
| stevemar | even that sentence | 15:50 |
| sigmavirus24 | lol | 15:51 |
| lbragstad | stevemar: have you done a brown bag before? | 15:51 |
| bknudson | gross. | 15:51 |
| marekd | lbragstad: what's that? | 15:51 |
| lbragstad | marekd: http://openstack.prov12n.com/vbrownbag-techtalks-in-vancouver/?awesm=awe.sm_p8ZHg | 15:51 |
| stevemar | lbragstad, nope, but i know the gist of them | 15:51 |
| * lbragstad shakes head at bknudson :) | 15:51 | |
| lbragstad | stevemar: gotcha | 15:52 |
| stevemar | bknudson, get your mind out of the gutter | 15:52 |
| *** spandhe has quit IRC | 15:52 | |
| *** _cjones_ has joined #openstack-keystone | 15:56 | |
| *** _cjones_ has quit IRC | 15:58 | |
| *** _cjones_ has joined #openstack-keystone | 15:58 | |
| bknudson | I don't see any keystone brown bags: https://www.youtube.com/playlist?list=PL2rC-8e38bUUSBsGoBGFwohNhGO8l_UlJ | 16:00 |
| bknudson | https://www.youtube.com/watch?v=3jErNTJYI-Q&list=PL2rC-8e38bUUSBsGoBGFwohNhGO8l_UlJ&index=59 | 16:01 |
| bknudson | Craig Lee – Federation Management Using Keystone | 16:01 |
| bknudson | anyone go to that? | 16:01 |
| marekd | bknudson: there are plenty of such talks | 16:02 |
| marekd | i wonder how many different federation approaches can co-exist | 16:02 |
| morganfainberg | marekd: all of them. | 16:02 |
| morganfainberg | :P | 16:02 |
| stevemar | oh neat 12 minute talks | 16:03 |
| stevemar | lbragstad, oh these brown bags.... nope never did those | 16:03 |
| marekd | morganfainberg: .... hapilly there is only one in OpenStack upstream. | 16:03 |
| marekd | :P | 16:03 |
| morganfainberg | ;) | 16:03 |
| *** samueldmq__ has quit IRC | 16:04 | |
| raildo | morganfainberg, morning :) | 16:04 |
| raildo | morganfainberg, can you put a -2 in the patch? https://review.openstack.org/#/c/166354/ it's part of reseller FFE. | 16:05 |
| marekd | ^^^ weidres request I have ever read on this channel :P | 16:05 |
| marekd | weirdest | 16:06 |
| raildo | marekd, haha :( | 16:06 |
| raildo | sad but true | 16:06 |
| morganfainberg | Done | 16:06 |
| *** thedodd has quit IRC | 16:07 | |
| raildo | marekd, in a few days I will request a +2 :D | 16:07 |
| marekd | more normal. | 16:07 |
| marekd | bknudson: why did you ask about Lee's talk? | 16:08 |
| *** Bsony has quit IRC | 16:08 | |
| bknudson | marekd: that's the only keystone one I could find. | 16:08 |
| marekd | in Vancouver? | 16:08 |
| bknudson | marekd: that one was from paris. | 16:09 |
| *** gyee has joined #openstack-keystone | 16:09 | |
| *** ChanServ sets mode: +v gyee | 16:09 | |
| marekd | bknudson: LOL i thought you found it on vancouver sched and was asking who wants to see it ;/ <facepalm> | 16:10 |
| * marekd facepalm | 16:10 | |
| rodrigods | stevemar, hey... going to implement service providers CRUD in OSC | 16:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: region.description is optional and can be null https://review.openstack.org/117611 | 16:12 |
| bknudson | why do we have both add_role_to_user_and_project and create_grant? | 16:12 |
| dstanek | is this one worth picking up and fixing? https://review.openstack.org/#/c/136946 | 16:13 |
| marekd | rodrigods: https://review.openstack.org/#/c/165755/ | 16:13 |
| bknudson | dstanek: it seems like it happened maybe once? | 16:13 |
| stevemar | rodrigods, is that a question? marekd has it going on https://review.openstack.org/#/c/165755/5 | 16:13 |
| bknudson | never seen it myself. | 16:13 |
| stevemar | dstanek, isn't that a non-issue now with migration collapse? | 16:14 |
| breton | dstanek: no. We've squashed migrations | 16:14 |
| breton | there is no more migration 039 | 16:15 |
| stevemar | yeah, what breton said | 16:15 |
| bknudson | still exists in stable/ if you want to fix it there. | 16:16 |
| rodrigods | stevemar, ahh... great, wasn't aware about it | 16:16 |
| rodrigods | stevemar, marekd, so not implement, just review :) | 16:16 |
| marekd | rodrigods: and play with it | 16:16 |
| marekd | i did last Friday and it worked. | 16:16 |
| stevemar | marekd, i was going to check it out and run some commands now | 16:17 |
| stevemar | rodrigods, do the same and we can merge it today :) | 16:17 |
| marekd | stevemar: yes, please :-) | 16:17 |
| marekd | rodrigods: U2 | 16:17 |
| breton | someone should do something about https://bugs.launchpad.net/keystone/+bug/1395959 | 16:17 |
| openstack | Launchpad bug 1395959 in Keystone "assignment table migration fails for keystone-manage db_sync if duplicate entry exists" [Undecided,In progress] - Assigned to Will Foster (wfoster-b) | 16:17 |
| stevemar | breton, i am thinking i will mark it as invalid | 16:18 |
| dstanek | bknudson: right, that would still be an issue in stable. a patch may not be worth the risk though | 16:18 |
| breton | it should be either marked as invalid or a milestone on stable/ set | 16:18 |
| rodrigods | stevemar, marekd, where devstack is currently placing OSC source? | 16:20 |
| marekd | #which openstack ? | 16:20 |
| dstanek | stevemar: the bug itself isn't invalid for stable | 16:20 |
| marekd | rodrigods: but i always create my own virtualenv, clone osc and keystone and build it there. | 16:21 |
| marekd | you still need to fetch review. | 16:21 |
| *** spandhe has joined #openstack-keystone | 16:21 | |
| *** gyee has quit IRC | 16:21 | |
| marekd | re: https://www.youtube.com/watch?v=3jErNTJYI-Q&list=PL2rC-8e38bUUSBsGoBGFwohNhGO8l_UlJ&index=59 (Lee's Keystone federation) Anyone actually know where this code lays ? | 16:22 |
| marekd | some repo? | 16:22 |
| *** spandhe has quit IRC | 16:22 | |
| *** gyee has joined #openstack-keystone | 16:23 | |
| *** ChanServ sets mode: +v gyee | 16:23 | |
| stevemar | rodrigods, devstack install all libs from pypi now, only release levels | 16:25 |
| stevemar | rodrigods, if you want the latest master code, use the following https://gist.github.com/stevemart/9ce3c7f120c25d3e6175#file-localrc-L12 | 16:25 |
| stevemar | rodrigods, then pull down the review like you normally would (git review -d <patch_number>) and run `python setup.py develop` to get the latest OSC changes for that patch (or use venvs) | 16:26 |
| rodrigods | stevemar, thanks | 16:27 |
| *** ryanpetrello has left #openstack-keystone | 16:28 | |
| *** junhongl has joined #openstack-keystone | 16:34 | |
| dstanek | mhu: are you around? | 16:34 |
| mhu | dstanek, yes | 16:34 |
| dstanek | mhu: i just commented on your notifications review | 16:35 |
| mhu | dstanek, I am having a look now | 16:35 |
| stevemar | dstanek, link me? | 16:36 |
| dstanek | stevemar: https://review.openstack.org/#/c/158777/ | 16:36 |
| stevemar | nvm https://review.openstack.org/#/c/158777/ | 16:36 |
| *** iamjarvo has joined #openstack-keystone | 16:36 | |
| *** iamjarvo has quit IRC | 16:37 | |
| *** iamjarvo has joined #openstack-keystone | 16:37 | |
| *** junhongl has quit IRC | 16:38 | |
| *** iamjarvo has quit IRC | 16:39 | |
| *** iamjarvo has joined #openstack-keystone | 16:40 | |
| mhu | dstanek, ok, that should work, I am going to remove the version test and see how it goes. Thw | 16:43 |
| mhu | thx | 16:43 |
| *** junhongl has joined #openstack-keystone | 16:46 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Add docstrings to keystone.notifications functions https://review.openstack.org/147313 | 16:48 |
| *** junhongl has quit IRC | 16:53 | |
| *** browne has joined #openstack-keystone | 16:54 | |
| *** tqtran has joined #openstack-keystone | 16:55 | |
| *** spandhe has joined #openstack-keystone | 16:57 | |
| *** ljfisher has quit IRC | 16:58 | |
| *** lhcheng_afk has joined #openstack-keystone | 17:00 | |
| *** iamjarvo has quit IRC | 17:03 | |
| *** atiwari has joined #openstack-keystone | 17:04 | |
| *** lhcheng_afk has quit IRC | 17:04 | |
| *** henrynash has joined #openstack-keystone | 17:05 | |
| *** ChanServ sets mode: +v henrynash | 17:05 | |
| *** iamjarvo has joined #openstack-keystone | 17:05 | |
| *** dan has quit IRC | 17:07 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/166437 | 17:07 |
| *** dan has joined #openstack-keystone | 17:12 | |
| *** ljfisher has joined #openstack-keystone | 17:15 | |
| ayoung | nkinder, are you doing more work on https://review.openstack.org/#/c/166391/ or are you comfortable with the tests as they are written? | 17:18 |
| marekd | ayoung: i think it's fine. I only don't know whether we want to merge it now or postpone until <something> | 17:21 |
| ayoung | marekd, nah, push it | 17:22 |
| ayoung | we are in bug fix stage of development | 17:22 |
| marekd | morganfainberg: ^ you are not going to -2 it, are you ? | 17:22 |
| marekd | ayoung: i ned to step away for a second, will revisit this patch later on. | 17:24 |
| *** _cjones_ has quit IRC | 17:24 | |
| *** _cjones_ has joined #openstack-keystone | 17:25 | |
| *** richm has quit IRC | 17:25 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix for notifications for v2 role grant/delete https://review.openstack.org/166934 | 17:27 |
| *** harlowja has joined #openstack-keystone | 17:27 | |
| *** _cjones_ has quit IRC | 17:29 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Update ServiceProviderModel attributes https://review.openstack.org/166936 | 17:32 |
| *** _cjones_ has joined #openstack-keystone | 17:32 | |
| rodrigods | stevemar, marekd, gyee ^ forgot this in the db migration patch | 17:32 |
| *** junhongl has joined #openstack-keystone | 17:33 | |
| openstackgerrit | Nicolas Simonds proposed openstack/python-keystoneclient: Upsell all command-line args to Unicode https://review.openstack.org/166495 | 17:37 |
| *** junhongl has quit IRC | 17:37 | |
| haneef | stevemar: In k2k, If an IDP has 2 sps registered, how can I get an assertion for my choice of sp from IDP. I don't see an option to specify the sp id while exchanging token for assertion | 17:38 |
| haneef | stevemar: ignore it. It is scoped to sp_id | 17:42 |
| marekd | how can we overcome the burden of multiple tokens? | 17:51 |
| rodrigods | marekd, multiple tokens? | 17:54 |
| *** jistr has quit IRC | 17:54 | |
| *** fhubik_ has quit IRC | 17:54 | |
| marekd | rodrigods: yes | 17:55 |
| marekd | rodrigods: one token per cloud. | 17:55 |
| marekd | rodrigods: this doesn't give you abstraction of one cloud | 17:56 |
| marekd | rodrigods: you can handle this in client, you can make a daemon for that | 17:56 |
| marekd | rodrigods: but what if one day you will ask for inter cloud vm migrations | 17:56 |
| marekd | or soon, image sharing. | 17:56 |
| *** amakarov is now known as amakarov_away | 17:56 | |
| rodrigods | marekd, ahh, got it | 17:57 |
| marekd | are you going to push it through the poor adsl-wire client? | 17:57 |
| marekd | noooooooooooooooooooooooooooooooooooooooooo | 17:57 |
| marekd | are actualy any protocols/standards that deal with such infrastructures? | 17:57 |
| marekd | http://www.stanford.edu/class/cs347/reading/zab.pdf | 17:59 |
| marekd | maybe this | 17:59 |
| *** bernardo-silva has joined #openstack-keystone | 18:00 | |
| *** stevemar has quit IRC | 18:02 | |
| htruta | marekd, rodri: some kind of shared storage between cloud wouldn't solve the problem? | 18:03 |
| htruta | I mean... is it an usual thing to have? | 18:03 |
| *** stevemar has joined #openstack-keystone | 18:03 | |
| *** ChanServ sets mode: +v stevemar | 18:03 | |
| *** krykowski has quit IRC | 18:07 | |
| gyee | marekd, how about copy them onto a CD and mail it over to the other cloud. :D | 18:08 |
| *** dan has quit IRC | 18:08 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix for notifications for v2 role grant/delete https://review.openstack.org/166934 | 18:09 |
| *** lhcheng_afk has joined #openstack-keystone | 18:13 | |
| *** dank_ has joined #openstack-keystone | 18:14 | |
| nkinder | ayoung: I'm happy with the tests as they are for https://review.openstack.org/#/c/166391/ | 18:17 |
| *** lhcheng_afk is now known as lhcheng | 18:17 | |
| *** omkarjoshi has joined #openstack-keystone | 18:17 | |
| *** harlowja has quit IRC | 18:18 | |
| ayoung | nkinder, Federation is broken without that fix, right? | 18:18 |
| nkinder | ayoung: sort of, yes | 18:18 |
| nkinder | ayoung: the comparison is just wrong | 18:19 |
| ayoung | nkinder, OK.. marekd let's get that one through. I think nkinder is going to propose if for backport once it is in | 18:19 |
| nkinder | ayoung: also, with mod_mellon, the remote ID value is a URL that comes straight from the IdP metadata | 18:19 |
| ayoung | nkinder, is there some way to validate that? | 18:20 |
| nkinder | that means I have to name by IdP as a URL in keystone, which also means the federation auth url contains an url within it that has to be escaped | 18:20 |
| nkinder | It would be hideous | 18:20 |
| ayoung | I wouln't want idp.pepsi.com to be able to claim to be idp.coke.com | 18:20 |
| nkinder | ayoung: I would have to look at what Mellon does exactly internally | 18:20 |
| *** harlowja has joined #openstack-keystone | 18:21 | |
| nkinder | ayoung: mellon has a distinct setting for the env. variable that the IdP ID should be dumped into. I believe it overrides anything that would actually be in the assertion. | 18:21 |
| ayoung | Good | 18:22 |
| ayoung | that is the right approach | 18:22 |
| nkinder | Pretty sure it comes straight from the local metadata, and it validates that the assertion was signed by the matching cert | 18:22 |
| *** omkarjoshi has quit IRC | 18:23 | |
| stevemar | morganfainberg, are we good to start merging code again? | 18:23 |
| ayoung | stevemar, bug fixes only, not features | 18:24 |
| stevemar | ayoung, of course, oh... you mean FFE related feature code? | 18:25 |
| ayoung | stevemar, Do we have anything approved for Thawing out? | 18:26 |
| bknudson | bug: this feature doesn't exist. | 18:26 |
| *** thedodd has joined #openstack-keystone | 18:29 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Update ServiceProviderModel attributes https://review.openstack.org/166936 | 18:32 |
| *** omkarjoshi has joined #openstack-keystone | 18:32 | |
| rodrigods | marekd, ^ added the bug reference, had to create a new bug since the other one was with Fix Released status | 18:32 |
| dstanek | quick review (i hope) -> https://review.openstack.org/#/c/147313/ | 18:34 |
| stevemar | dstanek, i'll be the judge of that | 18:40 |
| *** richm has joined #openstack-keystone | 18:40 | |
| dstanek | stevemar: that's what i am counting on | 18:42 |
| ayoung | stevemar, osol-policy has no order of operations. The only way to enforce it to create nested rules. Right? | 18:44 |
| morganfainberg | stevemar: for non features, yes. | 18:45 |
| morganfainberg | FFE I should have answers for tomorrow. | 18:45 |
| stevemar | morganfainberg, i'm sending out an FFE email on the mailing list soon, for the ECP wrapped SAML assertion | 18:46 |
| morganfainberg | stevemar: ok. Send it today please. | 18:46 |
| morganfainberg | stevemar: I plan to chat with ttx before confirming any ffes. | 18:47 |
| morganfainberg | So that'd be tomorrow. | 18:47 |
| morganfainberg | Anything not on that list I'm going to say is flat out deferred until liberty. | 18:47 |
| stevemar | morganfainberg, writing it now... | 18:49 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Bye Bye Domain Table https://review.openstack.org/161854 | 18:50 |
| raildo | ayoung, dstanek If you can take a look ^ I created a test and its working alone... but when run entire suite, I get the error migrate.exceptions.DatabaseAlreadyControlledError in test_extension_initial and other similar tests... | 18:52 |
| rodrigods | henrynash, ping.. re: did you see the reply in https://review.openstack.org/#/c/159944/ ? | 18:52 |
| *** samueldmq__ has joined #openstack-keystone | 18:52 | |
| ayoung | raildo, merge conflict | 18:53 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Bye Bye Domain Table https://review.openstack.org/161854 | 18:53 |
| raildo | ayoung, done | 18:53 |
| dstanek | raildo: sure | 18:54 |
| ayoung | migrate.exceptions.DatabaseAlreadyControlledError means migrations have already ron on those extensions. Should not be the case | 18:54 |
| dstanek | raildo: i'm getting a different error | 18:56 |
| raildo | dstanek, in the teardown I'm get the NoSuchTableError: domain error | 18:58 |
| ayoung | raildo, let's see what the check job gets. Suspect it is a dirty database problem | 19:02 |
| *** raginbajin has quit IRC | 19:04 | |
| *** haneef has quit IRC | 19:04 | |
| *** Qlawy has quit IRC | 19:04 | |
| *** grantbow has quit IRC | 19:04 | |
| *** raginbajin has joined #openstack-keystone | 19:04 | |
| *** Qlawy has joined #openstack-keystone | 19:04 | |
| *** Qlawy has quit IRC | 19:04 | |
| *** Qlawy has joined #openstack-keystone | 19:04 | |
| *** haneef has joined #openstack-keystone | 19:04 | |
| *** _cjones_ has quit IRC | 19:07 | |
| *** bernardo-silva has quit IRC | 19:12 | |
| *** lhcheng is now known as lhcheng-afk | 19:13 | |
| *** omkarjoshi has quit IRC | 19:20 | |
| ayoung | and dugh we have parenthesis | 19:21 |
| *** timcline has quit IRC | 19:22 | |
| *** rushiagr_away is now known as rushiagr | 19:23 | |
| openstackgerrit | Matthieu Huin proposed openstack/keystone: Get method's class name in a python3-compatible way https://review.openstack.org/158777 | 19:26 |
| *** _cjones_ has joined #openstack-keystone | 19:30 | |
| *** rushiagr is now known as rushiagr_away | 19:34 | |
| *** timcline has joined #openstack-keystone | 19:36 | |
| *** bernardo-silva has joined #openstack-keystone | 19:41 | |
| *** grantbow has joined #openstack-keystone | 19:50 | |
| *** grantbow has joined #openstack-keystone | 19:50 | |
| raildo | ayoung, the gate log for the drop table patch: http://logs.openstack.org/54/161854/12/check/gate-keystone-python27/81e74fe/console.html | 19:53 |
| morganfainberg | raildo, Fwiw, don't try and do a downwards migration w/ that patch. | 19:54 |
| morganfainberg | raildo, if it becomes a headache | 19:55 |
| morganfainberg | mfisch, ping - re no-downgrade stuff. want to coordinate things w/ you for documentation | 19:55 |
| mfisch | hey | 19:55 |
| morganfainberg | mfisch, soooo thanks for volunteering to help shape up the docs! | 19:56 |
| morganfainberg | mfisch, >:) | 19:56 |
| mfisch | Yeah let me schedule that in between the 4 talks I have to give in Vancouver | 19:56 |
| morganfainberg | mfisch, i think most of them are in order, we just need to do a pass on them. | 19:56 |
| mfisch | ok | 19:56 |
| morganfainberg | mfisch, it's ok, I'm on the hook for PTL things, and a couple talks in vancouver as well. | 19:56 |
| morganfainberg | soooo | 19:56 |
| mfisch | what do the docs need? just a purging of downgrade stuff? | 19:57 |
| morganfainberg | and travel-y things | 19:57 |
| morganfainberg | mfisch, i think we just need to make sure we clearly communicate best practices and say "yeah no more downgrades" | 19:57 |
| morganfainberg | mfisch, since you *actually* run a cloud... i'd like you to look over the docs, see if anything stnads out as missing. we can collaborate on updates from there. | 19:58 |
| raildo | morganfainberg, ok... thanks for the advice :) | 19:58 |
| mfisch | ok | 19:58 |
| mfisch | Is there a specific section of the docs or is downgrade all spread out? | 19:58 |
| morganfainberg | mfisch, it was linked in the spec. | 19:58 |
| mfisch | morganfainberg: FYI you guys have a cloud too ;) | 19:58 |
| mfisch | morganfainberg: ok | 19:58 |
| mfisch | I will look it over tonight | 19:58 |
| morganfainberg | mfisch, *I* don't run a cloud | 19:58 |
| morganfainberg | ;) | 19:58 |
| morganfainberg | and we have all sorts of mongo-fun baked in | 19:59 |
| morganfainberg | it's not really comparable to most. | 19:59 |
| morganfainberg | ayoung, ping | 19:59 |
| mfisch | mongo is always fun | 19:59 |
| morganfainberg | ayoung, can't elaborate, but need to run something by you. | 19:59 |
| morganfainberg | ayoung, let me know when you have a few | 19:59 |
| morganfainberg | nkinder, cc ^ you can help here as well. | 19:59 |
| morganfainberg | ayoung, nkinder, this is re: 1434034 | 20:01 |
| morganfainberg | nkinder, ayoung, I added a comment. it shouldn't be a big ask to address it's a simple check. | 20:05 |
| morganfainberg | anyway | 20:05 |
| nkinder | morganfainberg: in a meeting, but will take a look in a bit | 20:05 |
| morganfainberg | nkinder, ++ | 20:06 |
| mfisch | morganfainberg: that doc references H to G... | 20:06 |
| mfisch | is that the latest we have? | 20:06 |
| morganfainberg | mfisch, i think so. | 20:07 |
| *** ljfisher_ has joined #openstack-keystone | 20:07 | |
| morganfainberg | mfisch, another sign this is due for an update | 20:07 |
| morganfainberg | mfisch, lets plan to circle up enxt week and just hash out (etherpad) anything we want to change? | 20:07 |
| mfisch | sure | 20:07 |
| mfisch | I will file a bug now though | 20:07 |
| *** omkarjoshi has joined #openstack-keystone | 20:07 | |
| morganfainberg | mfisch, you want a email / invite for a meeting thing? or just catch ya ... say monday or tuesday (laate) | 20:08 |
| morganfainberg | mfisch, oh, also where are you based? | 20:08 |
| mfisch | Colorado | 20:08 |
| morganfainberg | ahhh | 20:08 |
| mfisch | yeah that works re: time | 20:08 |
| mfisch | https://bugs.launchpad.net/openstack-manuals/+bug/1435529 | 20:08 |
| openstack | Launchpad bug 1435529 in openstack-manuals "Rolling Back a Failed Upgrade in OpenStack Operations Guide" [Undecided,New] - Assigned to TWC Service (twc-service) | 20:08 |
| mfisch | oops, signed in as service account. | 20:08 |
| morganfainberg | lol | 20:09 |
| *** ljfisher has quit IRC | 20:09 | |
| * morganfainberg likes that the bot tells who it's assigned to. | 20:10 | |
| *** ljfisher has joined #openstack-keystone | 20:11 | |
| *** ljfisher_ has quit IRC | 20:12 | |
| dstanek | raildo: you still around? | 20:13 |
| raildo | dstanek, yeap | 20:13 |
| dstanek | raildo: i think the 'domain' table not found is caused by SQL magic - the reflect call expects it to be there because it thinks that there is still a FK relationship to it from Project | 20:14 |
| raildo | dstanek, but in the previous patch, I removed this FK... maybe can exists other for user, or group | 20:16 |
| raildo | I'll take a look on this. | 20:17 |
| stevemar | samueldmq, lbragstad i marked https://bugs.launchpad.net/keystone/+bug/1409203 as fix commited | 20:19 |
| openstack | Launchpad bug 1409203 in Keystone "Formatting in configuration.rst " [Low,Fix committed] - Assigned to Samuel de Medeiros Queiroz (samueldmq) | 20:19 |
| samueldmq | stevemar, ah sure ... sorry I forgot to reply that | 20:20 |
| stevemar | np | 20:20 |
| samueldmq | stevemar, when we closes bugs, do we need to close them (in LP) manually ? | 20:20 |
| samueldmq | close* | 20:20 |
| stevemar | lbragstad, dstanek take a look at: https://review.openstack.org/#/c/155919/ ? | 20:20 |
| morganfainberg | ayoung, nkinder, opened 1435530 on the other side of that issue as i commented. | 20:20 |
| ayoung | morganfainberg, is that a patch or a bug number? | 20:21 |
| stevemar | samueldmq, so LP is smart enough to mark the bug as 'fix committed' but only if the commit message has "Closes-Bug: 123" | 20:21 |
| openstack | bug 123 in Launchpad itself "There's no direct way to see the project info when translating it" [Medium,Fix released] https://launchpad.net/bugs/123 | 20:21 |
| morganfainberg | bug | 20:21 |
| ayoung | bug I'm guessing | 20:21 |
| *** ljfisher_ has joined #openstack-keystone | 20:21 | |
| morganfainberg | ayoung, yeah. | 20:21 |
| * morganfainberg sighs. | 20:22 | |
| stevemar | samueldmq, in your case, you used Partial-Bug, which just leaves a comment in LP, but doens't change status | 20:22 |
| ayoung | morganfainberg, I recall bringing that up when we were discussing revocation way back wehn. Nothing new. | 20:22 |
| samueldmq | stevemar, yeah I thought I did ... but I used partial on the whole chain :) | 20:22 |
| stevemar | ah | 20:22 |
| morganfainberg | ayoung, the issue is caching. | 20:22 |
| samueldmq | stevemar, needed to put closes-bug on the last one | 20:22 |
| stevemar | gotcha | 20:22 |
| ayoung | morganfainberg, I know. | 20:23 |
| stevemar | no big deal | 20:23 |
| morganfainberg | ayoung, like i said, this is something we can probably just open up and issue OSSN on | 20:23 |
| stevemar | just gotta go and clean up the bugs every now and then | 20:23 |
| ayoung | It was my argument for not putting any revocation check into PKI tokens origianl design | 20:23 |
| *** ljfisher has quit IRC | 20:23 | |
| morganfainberg | ayoung, or whatever. but erring on the side of VMT deciding what to do | 20:23 |
| *** ljfisher_ is now known as ljfisher | 20:23 | |
| ayoung | ++ | 20:23 |
| * ayoung shuts up now and goes back to muttering under breath as usual | 20:23 | |
| *** pnavarro is now known as pnavarro|off | 20:25 | |
| *** ChanServ changes topic to "High Priority Reviews: https://gist.github.com/dolph/651c6a1748f69637abd0 | Review RC Blocking Reviews." | 20:25 | |
| morganfainberg | stevemar, i hear topol is on vacation | 20:26 |
| stevemar | morganfainberg, yep | 20:27 |
| dstanek | stevemar: i can take a look in a few if lbragstad hasn't already started | 20:29 |
| lbragstad | dstanek: not yet, | 20:29 |
| bknudson | topolino is afraid to tell us where he went. | 20:35 |
| *** ljfisher_ has joined #openstack-keystone | 20:35 | |
| morganfainberg | bknudson, i bet! | 20:35 |
| morganfainberg | bknudson, someone might call him | 20:35 |
| *** ljfisher has quit IRC | 20:37 | |
| *** ljfisher has joined #openstack-keystone | 20:40 | |
| *** ljfisher_ has quit IRC | 20:41 | |
| *** ljfisher_ has joined #openstack-keystone | 20:43 | |
| *** ljfisher has quit IRC | 20:44 | |
| *** ljfisher_ is now known as ljfisher | 20:44 | |
| dstanek | stevemar: bknudson: that's an inventive and weird way to do comments in a json file | 20:49 |
| bknudson | dstanek: I'm not sure it's the best idea, but it seems to work. | 20:49 |
| bknudson | if we want the docs elsewhere it's easy to move. | 20:49 |
| dstanek | bknudson: can // not be in json? | 20:49 |
| bknudson | kind of | 20:49 |
| bknudson | dstanek: http://www.json.org/ | 20:50 |
| bknudson | there might be a FAQ on it, where he just says to use a javascript minimizer or something. | 20:50 |
| stevemar | that site looks like something out of the 90s | 20:50 |
| *** lhcheng-afk is now known as lhcheng | 20:50 | |
| bknudson | ironically doesn't use AJAX | 20:51 |
| *** samueldmq__ has quit IRC | 20:52 | |
| stevemar | hehe | 20:52 |
| stevemar | some sites are saying no comments allowed | 20:52 |
| bknudson | get your head out of the gutter. | 20:52 |
| stevemar | saying it's an Object notation | 20:53 |
| dstanek | very odd that they left comments ouf of the spec | 20:53 |
| lbragstad | not sure how common it is, but it looks like other people use this "convention" http://fadefade.com/json-comments.html | 20:54 |
| *** raildo is now known as raildo|away | 20:57 | |
| *** pnavarro|off has quit IRC | 20:59 | |
| *** jamielennox|away is now known as jamielennox | 21:02 | |
| *** samueldmq is now known as samueldmq-away | 21:06 | |
| *** lhcheng has quit IRC | 21:06 | |
| *** iamjarvo has quit IRC | 21:08 | |
| *** lhcheng has joined #openstack-keystone | 21:09 | |
| *** afazekas_ has joined #openstack-keystone | 21:09 | |
| *** lhcheng_ has joined #openstack-keystone | 21:09 | |
| *** lhcheng has quit IRC | 21:09 | |
| *** iamjarvo has joined #openstack-keystone | 21:11 | |
| bknudson | I wouldn't trust http://fadefade.com/json-comments.html since it assumes new attributes overwrite old ones. | 21:16 |
| *** iamjarvo has quit IRC | 21:17 | |
| *** samueldmq__ has joined #openstack-keystone | 21:26 | |
| *** samueldmq__ is now known as samueldmq | 21:26 | |
| *** thedodd has quit IRC | 21:28 | |
| *** lhcheng_ is now known as lhcheng | 21:30 | |
| *** mattfarina has quit IRC | 21:31 | |
| *** afazekas_ has quit IRC | 21:34 | |
| morganfainberg | gordc, ping: can you change https://launchpad.net/~pycadf-drivers owner over to "OpenStack Administrators" | 21:35 |
| morganfainberg | gordc, when you have a few | 21:35 |
| openstackgerrit | David J Hu proposed openstack/keystone: Version independent token issuance pipeline https://review.openstack.org/150629 | 21:36 |
| *** afazekas_ has joined #openstack-keystone | 21:37 | |
| *** afazekas_ has quit IRC | 21:43 | |
| stevemar | yeah gordc go do that, be a team player | 21:44 |
| morganfainberg | stevemar, ugh, FFEs are going to need String freeze exceptions too. | 21:44 |
| morganfainberg | stevemar, :( | 21:44 |
| * morganfainberg grumbles. | 21:44 | |
| stevemar | :\ | 21:44 |
| stevemar | don't translate anything! | 21:44 |
| morganfainberg | stevemar, so... also yeah string freeze - remember when approving things | 21:44 |
| stevemar | noted | 21:45 |
| dstanek | bknudson: id you do that json stuff by hand? | 21:45 |
| bknudson | dstanek: what do you mean? | 21:45 |
| dstanek | bknudson: did you write a script to figure it out or did you just do it by hand? | 21:46 |
| bknudson | dstanek: no script. | 21:46 |
| bknudson | dstanek: mostly grepping. | 21:47 |
| bknudson | where it wasn't obvious... the routes are in routers.py | 21:47 |
| openstackgerrit | Merged openstack/keystone: Lookup identity provider by remote_id for websso https://review.openstack.org/166391 | 21:50 |
| *** Tahmina has joined #openstack-keystone | 21:58 | |
| dstanek | bknudson: i hacked together a little script to help me verify things, but it doesn't entirely work | 21:58 |
| bknudson | dstanek: tjere | 21:59 |
| bknudson | there's probably a test you could write... | 21:59 |
| bknudson | ask the routes package? | 21:59 |
| bknudson | what all the routes are, and what the function is | 21:59 |
| bknudson | and then query the function? | 22:00 |
| bknudson | to see what the string is | 22:00 |
| gordc | morganfainberg: noooo!!! my power! | 22:01 |
| gordc | morganfainberg: should be good now. | 22:01 |
| dstanek | bknudson: basically - i did it down and dirty, but only had time for the v3 routes | 22:02 |
| *** timcline has quit IRC | 22:02 | |
| bknudson | dstanek: there's only a couple of v2 routes that are protected by policy anyways. | 22:02 |
| *** Tahmina has quit IRC | 22:04 | |
| morganfainberg | gordc, cool | 22:05 |
| *** Tahmina has joined #openstack-keystone | 22:05 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:07 | |
| *** iamjarvo has joined #openstack-keystone | 22:16 | |
| *** thedodd has joined #openstack-keystone | 22:18 | |
| *** iamjarvo has quit IRC | 22:18 | |
| *** thedodd has quit IRC | 22:18 | |
| dstanek | bknudson: this is what i was using to check that review: https://gist.github.com/dstanek/b6a5ae8daff0e6f9263d | 22:19 |
| bknudson | can't believe dstanek still uses the print statement. | 22:20 |
| *** Tahmina has quit IRC | 22:20 | |
| dstanek | Haha. I need to update my snippets | 22:21 |
| bknudson | he he: how to print: call print | 22:21 |
| bknudson | we all have that snippet. | 22:21 |
| bknudson | dstanek: put a link in the review. | 22:22 |
| bknudson | then maybe we can find it again l8r | 22:23 |
| *** gordc has quit IRC | 22:23 | |
| * breton has just booked all the stuff for Vancouver and is pretty excited | 22:24 | |
| *** henrynash has quit IRC | 22:26 | |
| *** browne1 has joined #openstack-keystone | 22:28 | |
| *** browne has quit IRC | 22:29 | |
| *** breton has quit IRC | 22:30 | |
| *** bernardo-silva has quit IRC | 22:39 | |
| *** ljfisher has quit IRC | 22:39 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Allow saving and caching the plugin auth state https://review.openstack.org/149175 | 22:39 |
| morganfainberg | FYI i just fixed a bunch of security permissions on VMT bugs in our projects | 22:41 |
| morganfainberg | i drasitcally paired down who has access to bugs until VMT team figures out what to do with them. | 22:41 |
| *** Tahmina_ has joined #openstack-keystone | 22:47 | |
| *** Tahmina_ has quit IRC | 22:50 | |
| *** carlosmarin has quit IRC | 22:53 | |
| *** carlosmarin has joined #openstack-keystone | 22:57 | |
| *** timcline has joined #openstack-keystone | 23:01 | |
| *** markvoelker has quit IRC | 23:01 | |
| *** timcline has quit IRC | 23:02 | |
| *** carlosmarin has quit IRC | 23:03 | |
| morganfainberg | jamielennox, ping | 23:15 |
| morganfainberg | jamielennox, ok doing the split for session (or the start of it) | 23:15 |
| morganfainberg | jamielennox, what files do we want in keystoneauth module? session, adapter, access, auth, hacking, service_catalog.py? | 23:16 |
| *** chlong has joined #openstack-keystone | 23:30 | |
| *** henrynash has joined #openstack-keystone | 23:31 | |
| *** ChanServ sets mode: +v henrynash | 23:31 | |
| *** zzzeek has quit IRC | 23:39 | |
| *** jaosorior has quit IRC | 23:42 | |
| *** markvoelker has joined #openstack-keystone | 23:47 | |
| *** markvoelker has quit IRC | 23:51 | |
| openstackgerrit | Eric Brown proposed openstack/keystonemiddleware: Use oslo_config choices support https://review.openstack.org/160031 | 23:55 |
| *** dims_ has joined #openstack-keystone | 23:58 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Remove parent_id in v2 token response https://review.openstack.org/156867 | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!