| bknudson | morganfainberg: I'm just surprised somebody's using db2. | 00:00 |
|---|---|---|
| morganfainberg | bknudson, lol | 00:00 |
| bknudson | return [x.target_id for x in query.all()] -- so it only cares about distinct target_id. | 00:02 |
| bknudson | oh, wrong one. | 00:04 |
| bknudson | ah, the code doesn't exist in kilo. | 00:05 |
| *** krtaylor has joined #openstack-keystone | 00:08 | |
| *** browne has quit IRC | 00:11 | |
| *** gyee has quit IRC | 00:16 | |
| *** junhongl_ has quit IRC | 00:31 | |
| openstackgerrit | Merged openstack/keystone: use tokens returned by delete_tokens to invalidate cache https://review.openstack.org/153501 | 00:42 |
| openstackgerrit | Merged openstack/keystone: Loosen the validation schema used for trustee/trustor ids https://review.openstack.org/145024 | 00:42 |
| openstackgerrit | Merged openstack/keystone: Distinguish between unset and empty black and white lists https://review.openstack.org/164798 | 00:42 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Tests use common base class https://review.openstack.org/167850 | 00:44 |
| *** markvoelker has joined #openstack-keystone | 00:48 | |
| *** markvoelker has quit IRC | 00:53 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move common checks into base testcase https://review.openstack.org/167852 | 00:54 |
| *** jasondotstar has joined #openstack-keystone | 00:54 | |
| *** stevemar has joined #openstack-keystone | 01:04 | |
| *** ChanServ sets mode: +v stevemar | 01:04 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Rename notification for create/delete grants https://review.openstack.org/167501 | 01:07 |
| *** raildo_ has joined #openstack-keystone | 01:18 | |
| *** diegows has quit IRC | 01:32 | |
| *** browne has joined #openstack-keystone | 01:42 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: certmonger https://review.openstack.org/134099 | 01:43 |
| *** lhcheng has quit IRC | 01:46 | |
| *** lhcheng has joined #openstack-keystone | 01:49 | |
| *** markvoelker has joined #openstack-keystone | 01:49 | |
| *** lhcheng has quit IRC | 01:53 | |
| *** markvoelker has quit IRC | 01:53 | |
| *** raildo_ has quit IRC | 02:02 | |
| *** trey has quit IRC | 02:03 | |
| *** _cjones_ has quit IRC | 02:04 | |
| *** trey has joined #openstack-keystone | 02:05 | |
| *** raildo_ has joined #openstack-keystone | 02:06 | |
| raildo_ | morganfainberg: ping, I saw that patch: https://review.openstack.org/#/c/167834/1 when you're removing the sql downgrades... so may I have to remove the downgrades for the reseller scripts? | 02:08 |
| morganfainberg | Yeah that is the idea. But not sure when it'll land | 02:09 |
| morganfainberg | Might land liberty, if it lands post reseller, it would remove the downgrades. | 02:09 |
| raildo_ | ok... I'll pay attention in this patch, thanks | 02:11 |
| *** erkules_ has joined #openstack-keystone | 02:12 | |
| *** erkules has quit IRC | 02:14 | |
| *** gokrokve has joined #openstack-keystone | 02:16 | |
| *** iamjarvo has joined #openstack-keystone | 02:19 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 02:22 | |
| *** zzzeek has quit IRC | 02:26 | |
| *** rushiagr_away is now known as rushiagr | 02:33 | |
| *** gokrokve has quit IRC | 02:36 | |
| *** dims has quit IRC | 02:39 | |
| *** gokrokve has joined #openstack-keystone | 02:45 | |
| *** gokrokve has quit IRC | 02:45 | |
| *** iamjarvo has quit IRC | 02:46 | |
| *** markvoelker has joined #openstack-keystone | 02:49 | |
| *** iamjarvo has joined #openstack-keystone | 02:53 | |
| *** iamjarvo has quit IRC | 02:53 | |
| *** harlowja is now known as harlowja_away | 02:53 | |
| *** iamjarvo has joined #openstack-keystone | 02:54 | |
| *** markvoelker has quit IRC | 02:54 | |
| *** raildo_ has quit IRC | 03:01 | |
| *** tqtran has quit IRC | 03:06 | |
| ayoung | morganfainberg, did I settle your fears on certmonger? | 03:06 |
| *** _cjones_ has joined #openstack-keystone | 03:16 | |
| *** _cjones_ has quit IRC | 03:21 | |
| *** _cjones_ has joined #openstack-keystone | 03:21 | |
| *** markvoelker has joined #openstack-keystone | 03:50 | |
| *** dims has joined #openstack-keystone | 03:52 | |
| *** markvoelker has quit IRC | 03:55 | |
| *** dims has quit IRC | 04:14 | |
| *** lhcheng has joined #openstack-keystone | 04:17 | |
| *** _cjones_ has quit IRC | 04:18 | |
| *** davechen has joined #openstack-keystone | 04:24 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Rename notification for create/delete grants https://review.openstack.org/167501 | 04:24 |
| *** iamjarvo has quit IRC | 04:25 | |
| stevemar | lhcheng, thx! | 04:36 |
| lhcheng | stevemar, test should pass this time. :) | 04:38 |
| lhcheng | stevemar: about relaxing the trusted_dashboard check, is that going to be scoped for rc1? | 04:40 |
| stevemar | lhcheng, oh yeah... i keep forgetting about that one | 04:44 |
| stevemar | lhcheng, it probably should be, but if it misses, i don't think it's a big deal | 04:44 |
| stevemar | lhcheng, i heard websso stuff got an FFE for horizon :) | 04:45 |
| lhcheng | stevemar: we'll be relaxing it anyway later, so that should still be backward compatible | 04:45 |
| lhcheng | stevemar: yeah, I am working on rebasing the websso patch with the plugin model that jamielennox added. | 04:46 |
| stevemar | lhcheng, i was just going to ask you that! | 04:46 |
| lhcheng | stevemar: and still need to figure out the issue with project switching in horizon | 04:47 |
| jamielennox | lhcheng: excellent, i was just finalizing the kerberos one and was going to look at that tomorrow | 04:47 |
| stevemar | lhcheng, i have an FFE for keystone but i think it's pretty much done (ECP wrapped assertions), so i'm mainly bug triaging right now | 04:47 |
| stevemar | lhcheng, let me know if you need me to review / test the horizon stuff, my plan was to let you and tqtran figure that out :\ since i'm a nub at horizon | 04:48 |
| lhcheng | jamielennox: the kerberos plugin is going to DOA or as separate package? I remember you were asking about the package naming convention. | 04:50 |
| jamielennox | lhcheng: https://github.com/jamielennox/django-openstack-auth-kerberos | 04:50 |
| *** markvoelker has joined #openstack-keystone | 04:51 | |
| lhcheng | stevemar: cool. I accidentally run devstack on my vm, had to re-setup keystone/horizon | 04:51 |
| lhcheng | stevemar: was going to say the websso missed add the "OIDCRedirectURI" in the apache.conf, but you already got in covered in the latest one. :) | 04:52 |
| openstackgerrit | Dave Chen proposed openstack/keystone: More content in the guide for core components' migration https://review.openstack.org/164188 | 04:52 |
| stevemar | lhcheng, yeah! thanks for that, i did forget about it; i was mostly going from memory | 04:53 |
| *** fifieldt has joined #openstack-keystone | 04:53 | |
| lhcheng | jamielennox: nice! that would come in handy as reference. I'll go back working on the websso patch tomorrow. | 04:54 |
| jamielennox | lhcheng: i think so, there's some interesting things about how you integrate a package like that with websso because it brings along a bunch of assets | 04:55 |
| jamielennox | but i think the basics should be the same | 04:55 |
| jamielennox | lhcheng: also i filled out the basics in docs/source/installation.rst for how it would be setup | 04:55 |
| *** markvoelker has quit IRC | 04:56 | |
| lhcheng | jamielennox: we're you able to setup your local freeipa server? :) | 04:57 |
| jamielennox | lhcheng: i'm rebuilding an environment now based on freeipa, unfortunately it's internal | 04:58 |
| jamielennox | i'm down to building an environment in about 4 hours - god knows how admins are supposed to work this stuff | 04:58 |
| jamielennox | horzion/freeipa/kerberos | 04:58 |
| lhcheng | jamielennox: how many times have you done it? | 05:00 |
| jamielennox | lhcheng: probably 4 | 05:02 |
| lhcheng | 4 hours jamie time =~ 4 wks to others (optimistic estimate) :P | 05:02 |
| *** _cjones_ has joined #openstack-keystone | 05:05 | |
| jamielennox | well, i wrote a bunch of the guides so maybe | 05:06 |
| lhcheng | jamielennox: is this a good starting point? http://www.jamielennox.net/blog/2015/02/12/step-by-step-kerberized-keystone/ | 05:07 |
| jamielennox | lhcheng: yes, you need that and http://www.jamielennox.net/blog/2015/02/27/setting-up-s4u2proxy/ for horizon | 05:07 |
| jamielennox | lhcheng: i want to go back and rewrite big chunks of that though, there's no point in like moving services users to freeipa, just do the domain specific config | 05:08 |
| jamielennox | also i found i left out a bit of the step-by-step - implying that no one else has tried it yet | 05:08 |
| *** _cjones_ has quit IRC | 05:09 | |
| lhcheng | jamielennox: you mean Part-6 is not needed ? | 05:12 |
| lhcheng | "Part 6 - Recreate the LDAP users" | 05:12 |
| jamielennox | lhcheng: right, skip part 5 and part 6 - leave the service users in the default domain and put your actual users in a new domain | 05:12 |
| lhcheng | jamielennox: cool | 05:13 |
| * lhcheng adding to list of to-do | 05:14 | |
| lhcheng | thanks for writing all those guides! | 05:15 |
| *** r-daneel has joined #openstack-keystone | 05:36 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Let "region" be effective both in the testcase and API https://review.openstack.org/167534 | 05:40 |
| *** r-daneel has quit IRC | 05:41 | |
| stevemar | lhcheng, btw - did you have an idea about how to loosen the validation on the hostnames? | 05:42 |
| stevemar | jamiec, domain config ftw! | 05:43 |
| *** _cjones_ has joined #openstack-keystone | 05:46 | |
| *** _cjones_ has quit IRC | 05:50 | |
| *** markvoelker has joined #openstack-keystone | 05:52 | |
| *** markvoelker has quit IRC | 05:56 | |
| lhcheng | stevemar: Instead of reading from the origin query parameter, I am thinking we could key off the Referer from the Http header to get the hostname of horizon. | 05:59 |
| lhcheng | stevemar: sounds like that should get what we need: http://en.wikipedia.org/wiki/HTTP_referer | 06:00 |
| stevemar | lhcheng, reading about that now | 06:00 |
| stevemar | lol - The word “referrer” has been misspelled in the RFC as well as in most implementations to the point that it has become standard usage and is considered correct terminology | 06:01 |
| *** _cjones_ has joined #openstack-keystone | 06:02 | |
| lhcheng | heh can't break backward compatibility | 06:02 |
| lhcheng | add a note in the code about that, otherwise you might get a -1 for misspelling | 06:06 |
| *** stevemar has quit IRC | 06:09 | |
| *** stevemar has joined #openstack-keystone | 06:09 | |
| *** ChanServ sets mode: +v stevemar | 06:09 | |
| *** dims has joined #openstack-keystone | 06:12 | |
| *** _cjones_ has quit IRC | 06:13 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 06:14 |
| *** jamielennox is now known as jamielennox|away | 06:16 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 06:21 |
| *** dims has quit IRC | 06:32 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 06:37 |
| *** chlong has quit IRC | 06:45 | |
| *** markvoelker has joined #openstack-keystone | 06:52 | |
| *** markvoelker has quit IRC | 06:57 | |
| *** stevemar has quit IRC | 06:58 | |
| *** stevemar has joined #openstack-keystone | 07:09 | |
| *** ChanServ sets mode: +v stevemar | 07:09 | |
| *** browne has quit IRC | 07:16 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Don't add unformatted project-specific endpoints to catalog https://review.openstack.org/144860 | 07:19 |
| *** ParsectiX has joined #openstack-keystone | 07:19 | |
| *** stevemar has quit IRC | 07:21 | |
| davechen | stevemar: hi, steve | 07:25 |
| *** ParsectiX has quit IRC | 07:26 | |
| *** ParsectiX has joined #openstack-keystone | 07:29 | |
| *** ParsectiX has quit IRC | 07:32 | |
| *** ParsectiX has joined #openstack-keystone | 07:32 | |
| breton | morning, post-utc keystone shift | 07:40 |
| marekd | breton: hehe | 07:40 |
| *** ParsectiX has quit IRC | 07:41 | |
| *** ParsectiX has joined #openstack-keystone | 07:41 | |
| marekd | breton: where are you based? | 07:44 |
| breton | Moscow | 07:44 |
| *** Bsony has joined #openstack-keystone | 07:52 | |
| *** markvoelker has joined #openstack-keystone | 07:53 | |
| *** markvoelker has quit IRC | 07:58 | |
| *** ekarlso has quit IRC | 07:59 | |
| *** jaosorior has joined #openstack-keystone | 08:01 | |
| *** nellysmitt has joined #openstack-keystone | 08:03 | |
| *** rm_work is now known as rm_work|away | 08:03 | |
| *** krykowski has joined #openstack-keystone | 08:12 | |
| *** henrynash has joined #openstack-keystone | 08:15 | |
| *** ChanServ sets mode: +v henrynash | 08:15 | |
| *** dims has joined #openstack-keystone | 08:17 | |
| *** fifieldt has quit IRC | 08:20 | |
| *** dims has quit IRC | 08:25 | |
| *** jistr has joined #openstack-keystone | 08:27 | |
| *** dims has joined #openstack-keystone | 08:38 | |
| * breton has that feel when everyone puts their + to a patch and he comes and spoils the party | 08:39 | |
| marekd | DDistributed breton links links | 08:41 |
| marekd | breton: maybe you are becoming another bknudson | 08:42 |
| *** markvoelker has joined #openstack-keystone | 08:54 | |
| *** markvoelker has quit IRC | 08:58 | |
| *** ekarlso has joined #openstack-keystone | 09:09 | |
| *** davechen has left #openstack-keystone | 09:46 | |
| *** erkules_ is now known as erkules | 09:49 | |
| *** erkules has quit IRC | 09:50 | |
| *** erkules has joined #openstack-keystone | 09:50 | |
| *** markvoelker has joined #openstack-keystone | 09:55 | |
| *** markvoelker has quit IRC | 09:59 | |
| *** jorge_munoz has quit IRC | 10:06 | |
| *** jorge_munoz has joined #openstack-keystone | 10:14 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Reload drivers when their domain config is updated https://review.openstack.org/163322 | 10:21 |
| *** fmarco76 has joined #openstack-keystone | 10:27 | |
| *** fifieldt has joined #openstack-keystone | 10:36 | |
| samueldmq-away | henrynash, hi | 10:37 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Add routing for list_endpoint_groups_for_project https://review.openstack.org/167939 | 10:38 |
| *** afazekas has joined #openstack-keystone | 10:39 | |
| *** henrynash has quit IRC | 10:39 | |
| *** samueldmq-away is now known as samueldmq | 10:39 | |
| *** Bsony_ has joined #openstack-keystone | 10:49 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Deprecate memcache as token persistence backend https://review.openstack.org/167594 | 10:50 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Rename notification for create/delete grants https://review.openstack.org/167501 | 10:51 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Deprecate memcache as token persistence backend https://review.openstack.org/167594 | 10:51 |
| *** Bsony has quit IRC | 10:53 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/166437 | 10:55 |
| *** markvoelker has joined #openstack-keystone | 10:56 | |
| *** lhcheng has quit IRC | 10:56 | |
| *** markvoelker has quit IRC | 11:00 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/162355 | 11:01 |
| *** nellysmitt has quit IRC | 11:05 | |
| *** crinkle_ has joined #openstack-keystone | 11:17 | |
| *** esp_ has joined #openstack-keystone | 11:17 | |
| *** fhubik_lunch has joined #openstack-keystone | 11:18 | |
| *** nkinder_ has joined #openstack-keystone | 11:18 | |
| *** dims_ has joined #openstack-keystone | 11:18 | |
| *** mordred_ has joined #openstack-keystone | 11:20 | |
| *** _nonameentername has joined #openstack-keystone | 11:20 | |
| *** lifeless1 has joined #openstack-keystone | 11:21 | |
| *** Qlawy_ has joined #openstack-keystone | 11:21 | |
| *** amakarov_away is now known as amakarov | 11:22 | |
| *** vhoward- has joined #openstack-keystone | 11:23 | |
| *** rodrigod` has joined #openstack-keystone | 11:25 | |
| *** fhubik_afk has quit IRC | 11:25 | |
| *** lsmola has quit IRC | 11:25 | |
| *** arif-ali has quit IRC | 11:25 | |
| *** g2` has quit IRC | 11:25 | |
| *** lifeless has quit IRC | 11:25 | |
| *** wolsen has quit IRC | 11:25 | |
| *** tristanC has quit IRC | 11:25 | |
| *** chlong has joined #openstack-keystone | 11:26 | |
| *** g2` has joined #openstack-keystone | 11:27 | |
| *** arif-ali has joined #openstack-keystone | 11:29 | |
| *** wolsen has joined #openstack-keystone | 11:29 | |
| *** tristanC has joined #openstack-keystone | 11:29 | |
| *** dims has quit IRC | 11:30 | |
| *** nonameentername has quit IRC | 11:30 | |
| *** Qlawy has quit IRC | 11:30 | |
| *** nkinder has quit IRC | 11:30 | |
| *** dhellmann has quit IRC | 11:30 | |
| *** rodrigods has quit IRC | 11:30 | |
| *** crinkle has quit IRC | 11:30 | |
| *** vhoward has quit IRC | 11:30 | |
| *** esp has quit IRC | 11:30 | |
| *** mordred has quit IRC | 11:30 | |
| *** anteaya has quit IRC | 11:30 | |
| *** ekarlso has quit IRC | 11:30 | |
| *** dobson has quit IRC | 11:30 | |
| *** marekd has quit IRC | 11:30 | |
| *** zz_avozza has quit IRC | 11:30 | |
| *** mordred_ is now known as mordred | 11:30 | |
| *** esp_ is now known as esp | 11:30 | |
| *** lsmola has joined #openstack-keystone | 11:31 | |
| *** dhellmann has joined #openstack-keystone | 11:33 | |
| *** ekarlso has joined #openstack-keystone | 11:33 | |
| *** dobson has joined #openstack-keystone | 11:33 | |
| *** marekd has joined #openstack-keystone | 11:33 | |
| *** zz_avozza has joined #openstack-keystone | 11:33 | |
| *** sendak.freenode.net sets mode: +v marekd | 11:33 | |
| *** anteaya has joined #openstack-keystone | 11:39 | |
| *** Qlawy_ is now known as Qlawy | 11:48 | |
| *** Qlawy has quit IRC | 11:49 | |
| *** Qlawy has joined #openstack-keystone | 11:49 | |
| *** ajayaa has joined #openstack-keystone | 11:56 | |
| *** markvoelker has joined #openstack-keystone | 11:56 | |
| *** lhcheng has joined #openstack-keystone | 11:57 | |
| *** markvoelker has quit IRC | 12:01 | |
| *** lhcheng has quit IRC | 12:01 | |
| *** rodrigod` is now known as rodrigods | 12:05 | |
| *** rushiagr is now known as rushiagr_away | 12:05 | |
| *** markvoelker has joined #openstack-keystone | 12:08 | |
| samueldmq | dstanek, bknudson could you please revisit [1] and check if you agree with my replies to your concerns | 12:13 |
| samueldmq | dstanek, bknudson [1] https://review.openstack.org/#/c/167230/2/keystone/tests/unit/test_v3_assignment.py | 12:13 |
| *** Ephur has quit IRC | 12:27 | |
| *** bknudson has quit IRC | 12:30 | |
| *** gordc has joined #openstack-keystone | 12:38 | |
| *** rodrigods has quit IRC | 12:48 | |
| *** rodrigods has joined #openstack-keystone | 12:48 | |
| *** henrynash has joined #openstack-keystone | 12:58 | |
| *** ChanServ sets mode: +v henrynash | 12:58 | |
| *** ParsectiX has quit IRC | 13:03 | |
| *** nellysmitt has joined #openstack-keystone | 13:06 | |
| *** afazekas has quit IRC | 13:07 | |
| *** rushiagr_away is now known as rushiagr | 13:10 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:10 | |
| *** nellysmitt has quit IRC | 13:10 | |
| -openstackstatus- NOTICE: gerrit stopped emitting stream events around 11:30 utc and has now been restarted. please recheck any changes currently missing results from jenkins | 13:12 | |
| *** krtaylor has quit IRC | 13:17 | |
| *** Bsony_ has quit IRC | 13:20 | |
| *** nkinder_ has quit IRC | 13:21 | |
| *** afazekas has joined #openstack-keystone | 13:23 | |
| *** afazekas has quit IRC | 13:30 | |
| *** breton has quit IRC | 13:32 | |
| *** iamjarvo has joined #openstack-keystone | 13:33 | |
| *** iamjarvo has quit IRC | 13:34 | |
| *** iamjarvo has joined #openstack-keystone | 13:34 | |
| *** iamjarvo has quit IRC | 13:34 | |
| *** breton has joined #openstack-keystone | 13:34 | |
| *** iamjarvo has joined #openstack-keystone | 13:35 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Exposes bug when getting hierarchy on Project API https://review.openstack.org/167230 | 13:37 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fixes bug when getting hierarchy on Project API https://review.openstack.org/167231 | 13:37 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Refactor _create_projects_hierarchy in tests https://review.openstack.org/167991 | 13:38 |
| samueldmq | dstanek, henrynash, raildo ^ | 13:40 |
| *** iamjarvo has quit IRC | 13:40 | |
| *** lhcheng has joined #openstack-keystone | 13:41 | |
| *** afazekas has joined #openstack-keystone | 13:43 | |
| dstanek | samueldmq: that does make sense | 13:44 |
| fmarco76 | henrynash: Hi, I am looking at your comment to the patch https://review.openstack.org/#/c/152156/36/keystone/contrib/federation/migrate_repo/versions/007_add_remote_id_table.py | 13:44 |
| raildo | samueldmq, sounds good to me, thanks :) | 13:45 |
| fmarco76 | henrynash: when you said there we do not need to provide downgrade, what do you mean? | 13:45 |
| fmarco76 | henrynash: if I remove it the tests will fail because there is the downgrade of 001 removing the linked table | 13:45 |
| henrynash | fmarco76: see: https://review.openstack.org/#/c/167834/ | 13:46 |
| *** lhcheng has quit IRC | 13:46 | |
| henrynash | fmarco76: but I think you are right, you need to eitehr keep it for now (and maybe add a TODO to go and delete it), or rebase on https://review.openstack.org/#/c/167834/ and then you don’t need it | 13:46 |
| *** krtaylor has joined #openstack-keystone | 13:46 | |
| breton | henrynash: I suggest not to -1 patches with downgrades until the master patch lands | 13:47 |
| henrynash | breton: agreed | 13:47 |
| samueldmq | dstanek, nice to hear, that keeps me sane | 13:47 |
| samueldmq | dstanek, raildo thanks | 13:47 |
| fmarco76 | henrynash: is this for Kilo? It is not on GIST | 13:48 |
| fmarco76 | henrynash: additionally, this means that I can leave the downgrade as it is if there is not error and then it will be removed along the other | 13:48 |
| *** samueldmq is now known as samueldmq-away | 13:49 | |
| henrynash | fmarco76: so I *thought* this was for Kilo….but just checked to see that a number of projets have this marked as Kilo-rc1, but we do not….it’s not got a target | 13:49 |
| fmarco76 | henrynash: OK, I leave for the moment as it is | 13:50 |
| henrynash | fmarco76: ok | 13:50 |
| fmarco76 | henrynash: for the other comment about the migration test, if I get correctly I should populate the DB before the migration, migrate and verify the values are correct | 13:51 |
| henrynash | breton: (and I don’t *think* I have -1 any patches for that, the -1 for fmarco76’s patch was because there was no migration test) | 13:51 |
| fmarco76 | henrynash: but where does the migration takes place | 13:52 |
| henrynash | fmarco76: look in test_sql_upgrade.py | 13:52 |
| fmarco76 | henrynash: OK | 13:52 |
| fmarco76 | henrynash: thanks | 13:52 |
| breton | henrynash: great, thank you | 13:52 |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Fix for migration 062 https://review.openstack.org/168003 | 14:01 |
| dstanek | samueldmq: i did find it weird that getting the parents of a subproject can skip intermediaries; does the user know their project's full heirarchy even when they can't see all of it? | 14:04 |
| *** mattfarina has joined #openstack-keystone | 14:06 | |
| *** rm_work|away is now known as rm_work | 14:08 | |
| *** r-daneel has joined #openstack-keystone | 14:12 | |
| *** iamjarvo has joined #openstack-keystone | 14:16 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 14:16 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 14:16 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change domain_id FK in project table https://review.openstack.org/166354 | 14:16 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Bye Bye Domain Table https://review.openstack.org/161854 | 14:16 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 14:16 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Stop calling domain drivers https://review.openstack.org/165936 | 14:16 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 14:16 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Restrict inherited role assignments to subdomains https://review.openstack.org/164180 | 14:17 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Creating domain and filtering by parent_id https://review.openstack.org/161378 | 14:17 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 14:17 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Cleanup Token Tests https://review.openstack.org/167832 | 14:18 |
| *** gokrokve has joined #openstack-keystone | 14:23 | |
| *** nkinder has joined #openstack-keystone | 14:25 | |
| *** stevemar has joined #openstack-keystone | 14:25 | |
| *** ChanServ sets mode: +v stevemar | 14:25 | |
| *** nellysmitt has joined #openstack-keystone | 14:26 | |
| *** thedodd has joined #openstack-keystone | 14:26 | |
| *** timcline has joined #openstack-keystone | 14:27 | |
| *** __TheDodd__ has joined #openstack-keystone | 14:30 | |
| *** nellysmitt has quit IRC | 14:30 | |
| *** breton_ has joined #openstack-keystone | 14:31 | |
| *** breton has quit IRC | 14:32 | |
| *** thedodd has quit IRC | 14:32 | |
| henrynash | stevemar, dstanek, lbragstad: a few realtive easy FFE items that maybe if you haev time we could knock in: https://review.openstack.org/#/c/166018/, https://review.openstack.org/#/c/165075/, https://review.openstack.org/#/c/165754/....and finally https://review.openstack.org/#/c/163322/ (which might need closer inspection) | 14:33 |
| stevemar | adding them to my list | 14:33 |
| henrynash | stevemar: thx (you’ve alrady +2’s one of those) | 14:33 |
| stevemar | looking at the cert monger stuff atm, for fun | 14:33 |
| henrynash | stevemar: you need to get outmore | 14:34 |
| stevemar | henrynash, you're probably right | 14:34 |
| openstackgerrit | Dave Chen proposed openstack/keystone: More content in the guide for core components' migration https://review.openstack.org/164188 | 14:36 |
| *** dims_ has quit IRC | 14:42 | |
| *** dims has joined #openstack-keystone | 14:42 | |
| *** ajayaa has quit IRC | 14:48 | |
| henrynash | morgainfianberg: are we shooting for Kilo on https://review.openstack.org/#/c/167834/ - it doesn’t seem to have a target set for keystone | 14:50 |
| *** ajayaa has joined #openstack-keystone | 14:50 | |
| *** davidckennedy has joined #openstack-keystone | 14:52 | |
| stevemar | do we track which projects can use v3? | 15:00 |
| *** bknudson has joined #openstack-keystone | 15:06 | |
| *** ChanServ sets mode: +v bknudson | 15:06 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystonemiddleware: Pull echo service out of auth_token. https://review.openstack.org/165171 | 15:10 |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 15:10 |
| openstackgerrit | Lance Bragstad proposed openstack/keystonemiddleware: Pull echo service out of auth_token. https://review.openstack.org/165171 | 15:12 |
| *** zzzeek has joined #openstack-keystone | 15:13 | |
| *** crinkle_ is now known as crinkle | 15:15 | |
| *** breton_ has quit IRC | 15:17 | |
| *** timcline has quit IRC | 15:20 | |
| *** timcline has joined #openstack-keystone | 15:20 | |
| *** timcline_ has joined #openstack-keystone | 15:22 | |
| *** timcline_ has quit IRC | 15:22 | |
| *** timcline_ has joined #openstack-keystone | 15:23 | |
| *** jistr is now known as jistr|mtg | 15:23 | |
| davidckennedy | morganfainberg I've added a comment to bug 1410543. Could you take a look and let me know your thoughts when you have a moment. | 15:24 |
| openstack | bug 1410543 in Keystone "Include service name in filtered catalog" [Medium,In progress] https://launchpad.net/bugs/1410543 - Assigned to David Charles Kennedy (dkennedy-p) | 15:24 |
| *** jistr|mtg is now known as jistr | 15:25 | |
| *** timcline has quit IRC | 15:26 | |
| *** ajayaa has quit IRC | 15:27 | |
| *** davidckennedy has quit IRC | 15:30 | |
| *** gyee has joined #openstack-keystone | 15:36 | |
| *** ChanServ sets mode: +v gyee | 15:36 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 15:37 |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 15:41 |
| *** Tahmina has joined #openstack-keystone | 15:44 | |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Migrate_repo init version helper https://review.openstack.org/137640 | 15:44 |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Share engine between migration helpers. https://review.openstack.org/137778 | 15:44 |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Use metadata.create_all() to fill a test database https://review.openstack.org/93558 | 15:44 |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Add index to the revocation_event.revoked_at. https://review.openstack.org/137639 | 15:44 |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 15:44 |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Fix index name the assignment.actor_id table. https://review.openstack.org/137637 | 15:44 |
| *** ajayaa has joined #openstack-keystone | 15:45 | |
| *** raildo has quit IRC | 15:45 | |
| *** iamjarvo has quit IRC | 15:46 | |
| *** ekarlso has quit IRC | 15:46 | |
| *** raildo has joined #openstack-keystone | 15:51 | |
| *** _cjones_ has joined #openstack-keystone | 15:53 | |
| *** timcline has joined #openstack-keystone | 15:57 | |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Fix for migration 062 on MySQL https://review.openstack.org/168003 | 15:59 |
| stevemar | nkinder, henrynash let's 'hangout'! | 16:00 |
| *** timcline_ has quit IRC | 16:01 | |
| nkinder | stevemar: the hangout plugin is installing right now. Should just take a minute | 16:01 |
| stevemar | \o/ | 16:01 |
| openstackgerrit | Merged openstack/keystone-specs: Endpoint to generate ECP assertions https://review.openstack.org/167621 | 16:02 |
| stevemar | if that fails or the reception is choppy we can use a phone number | 16:02 |
| nkinder | stevemar: plugin is working, but I get a timeout trying to connect to the call | 16:06 |
| *** timcline has quit IRC | 16:07 | |
| *** timcline has joined #openstack-keystone | 16:08 | |
| *** browne has joined #openstack-keystone | 16:12 | |
| *** davidckennedy has joined #openstack-keystone | 16:13 | |
| *** lhcheng has joined #openstack-keystone | 16:20 | |
| *** tqtran has joined #openstack-keystone | 16:23 | |
| *** samueldmq-away is now known as samueldmq | 16:26 | |
| *** lhcheng has quit IRC | 16:26 | |
| *** nellysmitt has joined #openstack-keystone | 16:27 | |
| *** ekarlso has joined #openstack-keystone | 16:27 | |
| *** lhcheng_ has joined #openstack-keystone | 16:30 | |
| *** chlong has quit IRC | 16:31 | |
| *** lhcheng_ has quit IRC | 16:31 | |
| *** lhcheng has joined #openstack-keystone | 16:31 | |
| *** nellysmitt has quit IRC | 16:31 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 16:32 |
| *** timcline_ has joined #openstack-keystone | 16:34 | |
| *** timcline has quit IRC | 16:37 | |
| *** fmarco76 has quit IRC | 16:46 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 16:47 |
| morganfainberg | stevemar: ping | 16:50 |
| *** _cjones_ has quit IRC | 16:57 | |
| *** _cjones_ has joined #openstack-keystone | 16:58 | |
| *** arunkant_ has joined #openstack-keystone | 17:00 | |
| *** jistr has quit IRC | 17:01 | |
| *** fmarco76 has joined #openstack-keystone | 17:03 | |
| *** gokrokve_ has joined #openstack-keystone | 17:05 | |
| *** _cjones_ has quit IRC | 17:05 | |
| *** Tahmina has quit IRC | 17:05 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 17:06 |
| *** gyee has quit IRC | 17:07 | |
| marekd | stevemar: we have another meeting in ~1h, right? | 17:08 |
| *** krtaylor has quit IRC | 17:08 | |
| marekd | stevemar: just wanted to make sure i didn't mess up the timing | 17:08 |
| *** gokrokve has quit IRC | 17:08 | |
| morganfainberg | davidckennedy: ok the filtering itself is just an effect of the sql driver | 17:09 |
| *** gokrokve_ has quit IRC | 17:09 | |
| morganfainberg | davidckennedy: the api should now be in the pipeline by default. The important part here is to make sure that the sql driver isn't something special that also has to be enabled. (Part of this bug) | 17:10 |
| rodrigods | marekd, yep | 17:10 |
| morganfainberg | davidckennedy: long term we are removing in-tree extensions. The first step is enabling them 100% of the time. | 17:10 |
| morganfainberg | Which has already been done | 17:10 |
| *** ajayaa has quit IRC | 17:11 | |
| davidckennedy | morganfainberg ok I'm thinking about that. | 17:13 |
| morganfainberg | This is just collapsing catalog_sql to keystone.catalog.backends.sql | 17:13 |
| morganfainberg | And leaving a deprecated class wrapper class that lives in the old place that can be removed in liberty | 17:14 |
| *** _cjones_ has joined #openstack-keystone | 17:14 | |
| samueldmq | pkiz is much smaller than pki tokens? | 17:16 |
| samueldmq | I mean, is it common to a pkiz token pass 4k? | 17:17 |
| marekd | samueldmq: probably not smaller enough since pki was not widely accepted everywhere yet :/ | 17:17 |
| samueldmq | dolphm, morganfainberg ^ any idea/ | 17:17 |
| samueldmq | marekd, I'm trying to make it so | 17:17 |
| marekd | samueldmq: make it accepted? | 17:17 |
| morganfainberg | stevemar: I can't do a hangout today. | 17:18 |
| morganfainberg | 4th day of fire alarm testing. | 17:18 |
| marekd | 0_o | 17:19 |
| samueldmq | marekd, well at least on horizon, I am trying to figure out why exactly working with pkiz tokens passes 4k limit from cokes | 17:19 |
| samueldmq | cookies | 17:19 |
| samueldmq | not cokes | 17:19 |
| samueldmq | lol | 17:19 |
| marekd | heh | 17:19 |
| marekd | morganfainberg: do you mind if we do first iteration without you today? | 17:19 |
| morganfainberg | Go for it | 17:20 |
| marekd | morganfainberg: next week i will be gone, and topol will be back :-) | 17:20 |
| morganfainberg | I just have had a migrane for 4 days now | 17:20 |
| lhcheng | samueldmq: you can have as much coke as you like :) | 17:20 |
| morganfainberg | And have to do conf calls on the street. Doesn't work well w/ hangouts. | 17:20 |
| *** tqtran has quit IRC | 17:20 | |
| samueldmq | lhcheng, yeah, cookies + cokes :-) | 17:21 |
| samueldmq | lhcheng, should be not a bad ide | 17:21 |
| samueldmq | a | 17:21 |
| morganfainberg | samueldmq: fixing pki(z) tokens in django OpenStack auth is hard | 17:21 |
| samueldmq | morganfainberg, yeah, that's what makes it interesting, right? | 17:21 |
| morganfainberg | They do a cms hash and treat the token like a uuid token | 17:21 |
| lhcheng | samueldmq: haha that will keep you up all night :) | 17:22 |
| morganfainberg | My recommendation, don't look at it too hard :P | 17:22 |
| lhcheng | morganfainberg: lol | 17:22 |
| samueldmq | morganfainberg, haha so let me say you what I'm thinking :p | 17:22 |
| lhcheng | morganfainberg: "it just works" | 17:22 |
| dstanek | davidckennedy: i didn't realize you were hanging out here. i just added a comment to that ssl bug | 17:23 |
| morganfainberg | lhcheng: it works... Except when it doesn't. | 17:23 |
| *** browne has quit IRC | 17:23 | |
| samueldmq | morganfainberg, pkiz tokens are <4k (on most cases, *I hope so*) | 17:23 |
| samueldmq | morganfainberg, why dont we store them compressed into the session ? | 17:23 |
| morganfainberg | samueldmq: sometimes. 50/50 at best | 17:23 |
| samueldmq | morganfainberg, that should solve the issue | 17:23 |
| samueldmq | morganfainberg, shouldnt? | 17:23 |
| morganfainberg | Because they still blow out session size | 17:23 |
| morganfainberg | No guarantee the token isn't >4k | 17:23 |
| lhcheng | morganfainberg: yeah, it works based on some condition. Have to test this out on multi-node deployment, other than devstack | 17:24 |
| morganfainberg | This is another reason for fernet tokens. | 17:24 |
| morganfainberg | And pkiz are already compressed | 17:24 |
| samueldmq | morganfainberg, but with fernet, we still need to ask for catalogs, etc | 17:24 |
| samueldmq | morganfainberg, and the issue comes again | 17:24 |
| morganfainberg | samueldmq: I want all tokens to eliminate he catalog from the token body | 17:25 |
| marekd | morganfainberg: what if keystonemiddleware was caching portions of tokens on every service? | 17:25 |
| marekd | morganfainberg: do we do that now? | 17:25 |
| marekd | morganfainberg: some kind of LRU type of cache. | 17:25 |
| marekd | to off load keystone. | 17:25 |
| samueldmq | morganfainberg, even if the catalog is not in the token body, horizon asks for it separately to store in the session, and booom! | 17:25 |
| *** fmarco76 has quit IRC | 17:25 | |
| morganfainberg | samueldmq: we shouldn't ever store the catalog in the session. Period. | 17:26 |
| morganfainberg | That is the *wrong* place for it | 17:26 |
| samueldmq | morganfainberg, so where to put it? (for horizon ) | 17:26 |
| samueldmq | morganfainberg, we do that today, right lhcheng ? | 17:26 |
| morganfainberg | Horizon could pair down the catalog to something sane | 17:27 |
| samueldmq | morganfainberg, catalog on serverside? | 17:27 |
| lhcheng | morganfainberg: Do you suggest requesting the service catalog for each request? store the catalog only in the scope of the django request. | 17:27 |
| morganfainberg | Alternatively we need to be able to ask keystone (or a registry service) the endpoint | 17:27 |
| *** gokrokve has joined #openstack-keystone | 17:28 | |
| morganfainberg | Ok I can't talk about this till I get out of my house. | 17:28 |
| samueldmq | morganfainberg, k will wait for you | 17:28 |
| morganfainberg | Will type more when I am not dealing with a fire alarm going off every 30s | 17:28 |
| morganfainberg | Be back around 11iah | 17:28 |
| samueldmq | lhcheng, I see a great discussion over there :) | 17:29 |
| morganfainberg | 11ish (uh 30mins) | 17:29 |
| samueldmq | morganfainberg, yeah, timezones ... I was asking myself how long that would be :p | 17:29 |
| openstackgerrit | henry-nash proposed openstack/python-keystoneclient: Provide more flexibility in response body handling in GET, PUT & PATCH https://review.openstack.org/168087 | 17:30 |
| openstackgerrit | henry-nash proposed openstack/python-keystoneclient: Provide more flexibility in response body handling in GET, PUT & PATCH https://review.openstack.org/168087 | 17:30 |
| openstackgerrit | henry-nash proposed openstack/python-keystoneclient: Support domain-specific configuration management https://review.openstack.org/168089 | 17:30 |
| *** ajayaa has joined #openstack-keystone | 17:37 | |
| samueldmq | can the service catalog differ for different users? domains? | 17:41 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Cleanup Token Tests https://review.openstack.org/167832 | 17:41 |
| openstackgerrit | henry-nash proposed openstack/python-keystoneclient: Support domain-specific configuration management https://review.openstack.org/168089 | 17:41 |
| *** amakarov is now known as amakarov_away | 17:42 | |
| davidckennedy | dstanek I saw your comment and started off cross but you're right really. I did try the approach you recommend (and even recommended it myself in one of my comments) but couldn't make it work. Maybe because I'm just not that good with ssl certs and I wanted to get on with solving the problem I was actually working on. | 17:43 |
| henrynash | stevemar: would value your views on my proposed patch of adding keystoneclient support for domain-specific configs (https://review.openstack.org/168089)….using “raw output” capability….I think that’s best, but unsure | 17:43 |
| lhcheng | samueldmq: I think so. The endpoint grouping feature allows the admin to assign set of endpoint by project. | 17:43 |
| dstanek | davidckennedy: i think my little patch would actually work if you could get the right hostname in there | 17:43 |
| dstanek | davidckennedy: right now i think the hostname is only provided in an arg that get sent to openssl and not in the config | 17:44 |
| samueldmq | lhcheng, hmm | 17:44 |
| davidckennedy | As I had that change that worked I thought I'd post it. After all, it's only dev/test scenario and even then just a warning which trashes the bathtub parsing going on in the sample_data script. If there are guys out there using the ssl_gen script to generate their ssl certs....... | 17:45 |
| henrynash | stevemar: is there a better way to do it that will mess more easily with osc and the abiliy to have commans that can manipulate a single option in teh domain-specific config? | 17:45 |
| henrynash | morganfainberg: (I may have missed your reply to my earlier question)….are we shooting for Kilo for the removal of the SQL downgrades? | 17:46 |
| davidckennedy | dstanek to generate their ssl certs for production use then somebody ought to be cross. I'll see what I can do with your suggestion when I have a moment. | 17:46 |
| stevemar | henrynash, i'll have to take a look at it first, | 17:46 |
| stevemar | stuck in meetings :( | 17:46 |
| henrynash | stevemar: we have some time in this one…so no rush | 17:47 |
| *** krtaylor has joined #openstack-keystone | 17:47 | |
| dstanek | davidckennedy: they would not be using pki_setup for production. if they do, they've already lost | 17:47 |
| davidckennedy | Precisely. | 17:48 |
| lhcheng | henrynash: any tips on debugging test failure with test_json_home_root? | 17:50 |
| lhcheng | henrynash: I got a big json blob (json_home) that doesn't match error | 17:50 |
| henrynash | lhcheng: I assume you have acres of test debug output | 17:50 |
| *** krykowski has quit IRC | 17:51 | |
| henrynash | I loaded teh out into a file and then split up teh excepted and actual | 17:51 |
| lhcheng | henrynash: yeah, can't argue with the amount of output :) | 17:51 |
| henrynash | lhcheng: what did you change…I might be able to spot the error looking at the code for you | 17:51 |
| lhcheng | henrynash: I guess the ordering of the values are the same? | 17:52 |
| lhcheng | henrynash: https://review.openstack.org/#/c/167939/ | 17:52 |
| *** krykowski has joined #openstack-keystone | 17:52 | |
| lhcheng | henrynash: ugh, could be 'href-template': '/OS-EP-FILTER/endpoint_groups/' | 17:53 |
| henrynash | mauybe... | 17:54 |
| lhcheng | henrynash: nevermind, that seems right.. | 17:54 |
| henrynash | lhcheng: so laod it all into an editor…search for the actual and expected putput, isolte it and tehn caompare | 17:55 |
| lhcheng | henrynash: yeah, going to use a file comparison tool | 17:56 |
| morganfainberg | henrynash: if it lands in kilo sure, if not it can land in liberty. If it misses kilo we should put in a shim migration that disables downwards migrations. New migrations shouldn't need downgrade. | 17:56 |
| lhcheng | henrynash: thanks for the tip! | 17:56 |
| *** browne has joined #openstack-keystone | 17:57 | |
| henrynash | morganfainberg: agreed…that last bit is what’s needed to stop peopel having to add domangrades now…but me thinks we can get it in for Kilo…it looks good | 17:57 |
| morganfainberg | Yeah. | 17:57 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Stop calling domain drivers https://review.openstack.org/165936 | 17:58 |
| *** davidckennedy has left #openstack-keystone | 17:58 | |
| *** __TheDodd__ has quit IRC | 17:59 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add caching to getting of the fully substituted domain config https://review.openstack.org/166018 | 18:01 |
| openstackgerrit | henry-nash proposed openstack/keystone: Reload drivers when their domain config is updated https://review.openstack.org/163322 | 18:02 |
| lhcheng | henrynash: found it, I need to add the new routing to the expected data in josn_home_test. Thanks | 18:07 |
| * david-lyle wants to hear more about how horizon should request the catalog continuously | 18:07 | |
| henrynash | lncheng: excellent | 18:09 |
| *** krykowski has quit IRC | 18:10 | |
| dstanek | david-lyle: continuously? | 18:13 |
| lhcheng | henrynash: qq, how is resource_name defined in the router? Do we define our own value for that? | 18:14 |
| samueldmq | david-lyle, yeah we were discussing that with morganfainberg, waiting him to get available :-) | 18:14 |
| samueldmq | dstanek, maybe he wants to hear continuously, and not request continuously, lol our languages are ambiguous :) | 18:15 |
| dstanek | haha, ok | 18:15 |
| david-lyle | dstanek: we use that information on every page load at a mininum | 18:15 |
| stevemar | henrynash, so apparently my mic works just fine for marekd and rodrigods :) | 18:15 |
| samueldmq | dstanek, as far as I could see, the service catalog does not change per user, am I right? | 18:15 |
| *** gyee has joined #openstack-keystone | 18:16 | |
| *** ChanServ sets mode: +v gyee | 18:16 | |
| lhcheng | henrynash: does that map to the "Resource:" in the specs: http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-ep-filter-ext.html | 18:16 |
| david-lyle | samueldmq: it could, but that's a different argument | 18:16 |
| morganfainberg | Horizon should use a cached version. Request if a) the cache is expired *or* if an endpoint it has never seen arrives in the catalog | 18:16 |
| morganfainberg | This cached version should be the complete catalog | 18:17 |
| david-lyle | the session is the cache | 18:17 |
| dstanek | morganfainberg: do we provide proper cache control headers for the catalog? | 18:17 |
| morganfainberg | We then could offer a mode where horizon asks just for the endpoint ids. | 18:17 |
| samueldmq | david-lyle, my point is, if there is no different catalog per user, there is no catalog per token, and then no need to store in the client-side (cookie) | 18:17 |
| samueldmq | david-lyle, put it on the horizon server side | 18:17 |
| morganfainberg | The cookie can't hold the catalog. Same reason it can't hold big tokens. | 18:17 |
| samueldmq | morganfainberg, yes, I think what I just said goes in this direction ^ | 18:18 |
| morganfainberg | Unless session is moved to db | 18:18 |
| morganfainberg | dstanek: no we provide no cc headers. We should. | 18:18 |
| david-lyle | morganfainberg: right, we're being force into a server side session cache because the catalog and token are so large | 18:18 |
| *** gokrokve has quit IRC | 18:18 | |
| *** gokrokve_ has joined #openstack-keystone | 18:18 | |
| morganfainberg | david-lyle: I have a solution but it isn't kilo. | 18:19 |
| david-lyle | samueldmq: that's a very simplistic model | 18:19 |
| morganfainberg | david-lyle: as I described above. | 18:19 |
| david-lyle | I think the catalog should be able to change per user | 18:19 |
| morganfainberg | If we have server side, at least we don't break. | 18:19 |
| morganfainberg | david-lyle: the catalog is global, the per-user is the filtered/replaced/etc version | 18:19 |
| samueldmq | david-lyle, it maybe simplistic, but I think it is what makes sense if catalog does not change per user | 18:20 |
| david-lyle | I'm arguing it should and could | 18:20 |
| david-lyle | but I think others lost that fight in keystone before | 18:20 |
| david-lyle | and gave up | 18:20 |
| morganfainberg | samueldmq: the catalog today does hanged per user. | 18:20 |
| morganfainberg | Change* | 18:20 |
| morganfainberg | Well per project | 18:21 |
| david-lyle | or maybe they didn't | 18:21 |
| samueldmq | morganfainberg, k so just store the whole catalog on horizon server-side | 18:21 |
| morganfainberg | You can endpoint filter, project if substitution into the urls | 18:21 |
| morganfainberg | Etc | 18:21 |
| dstanek | endpoint filtering is by user right? | 18:21 |
| samueldmq | morganfainberg, ah yes, that's what you were saying :-) | 18:21 |
| morganfainberg | dstanek: project / domain | 18:21 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Creating domain and filtering by parent_id https://review.openstack.org/161378 | 18:21 |
| david-lyle | horizon doesn't have a privileged session running to make admin level calls | 18:22 |
| david-lyle | and store the data | 18:22 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Restrict inherited role assignments to subdomains https://review.openstack.org/164180 | 18:22 |
| david-lyle | so we only grab per user | 18:22 |
| morganfainberg | So horizon would cache the catalog. And the user's token would contain just the ids, or horizon could only access the data for the user. | 18:22 |
| morganfainberg | david-lyle: catalog should not be priv. Info | 18:22 |
| morganfainberg | david-lyle: that call should be unprotected imo. | 18:23 |
| david-lyle | how do I know if it's filtered? | 18:23 |
| david-lyle | as a user I can request regular and decaf? | 18:23 |
| morganfainberg | david-lyle: you would just look at the ids provided to you, and then you'd return the right form of the catalog | 18:23 |
| samueldmq | david-lyle, the user token has the filtered catalog, but only the ids | 18:23 |
| david-lyle | or just cache for the usrer? | 18:23 |
| david-lyle | *user | 18:23 |
| morganfainberg | since you have a whole catalog cache. | 18:23 |
| samueldmq | it works as today, but the token has the ids, and horizon server has the whole catalog :) | 18:24 |
| *** gyee has quit IRC | 18:24 | |
| morganfainberg | It's not a kilo development thing. | 18:24 |
| morganfainberg | Today, there is no good answer. | 18:24 |
| morganfainberg | Short of server - side tokens. | 18:24 |
| david-lyle | right about kilo | 18:24 |
| morganfainberg | S/tokens/sessions | 18:24 |
| lhcheng | morganfainberg: not sure if catalog should not be priv. request, could be giving away info to malicious user | 18:24 |
| *** afazekas has quit IRC | 18:25 | |
| david-lyle | but, what account is doing the catalog cache on the horizon server? | 18:25 |
| david-lyle | that's the part I'm missing | 18:25 |
| samueldmq | morganfainberg, the cache should be done by the keystoneclient/middleware ? | 18:25 |
| morganfainberg | david-lyle: no authentication needed. Horizon would cache in memcache or wherever makes sense. | 18:25 |
| morganfainberg | david-lyle: the complete cache would be a global / no user thing | 18:26 |
| morganfainberg | david-lyle: you would refresh the cache if: user catalog has an id you haven't seen, your cache is expired, or you don't have a cache. | 18:26 |
| david-lyle | ok, so there is a completely open API to hit on keystone to get the full catalog? | 18:26 |
| david-lyle | no user_id or token required | 18:26 |
| morganfainberg | david-lyle: that would be something we need to add but yes. That would be the approach I would take. | 18:27 |
| morganfainberg | david-lyle: that's why I said not kilo | 18:27 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change domain_id FK in project table https://review.openstack.org/166354 | 18:27 |
| david-lyle | and then I grab that and DDOS all the openstack API endpoints? | 18:27 |
| david-lyle | without ever logging into the cloud? | 18:27 |
| samueldmq | maybe we should crypt the info | 18:27 |
| *** nellysmitt has joined #openstack-keystone | 18:28 | |
| samueldmq | david-lyle, I think 'open' implies to having a valid token in this case, at least | 18:28 |
| morganfainberg | david-lyle: if your endpoints are not rate limiting, and are on the Internet it isn't any more or less safe | 18:28 |
| morganfainberg | david-lyle: security through obscurity is not | 18:28 |
| *** gyee has joined #openstack-keystone | 18:28 | |
| *** ChanServ sets mode: +v gyee | 18:28 | |
| david-lyle | correct, but I don't have as easy a path to discovery as a single call | 18:28 |
| morganfainberg | So you ask keystone for the catalog. You have the whole catalog. | 18:29 |
| *** breton has joined #openstack-keystone | 18:29 | |
| morganfainberg | The user then hands you a token. You ask for the ids from that users's catalog. That is list can go in the session | 18:29 |
| morganfainberg | It's just a list of ids. | 18:29 |
| samueldmq | morganfainberg, the API endpoint to request the whole catalog could be configured to service tokens, couldnt (through policy) ? | 18:29 |
| morganfainberg | You then know both: the user's catalog and the global one | 18:30 |
| morganfainberg | And it all fits nicely in the session | 18:30 |
| david-lyle | I understand, the point I'm hung up on is bootstrapping the catalog in horizon | 18:30 |
| samueldmq | david-lyle, I think that can be configurable by policy | 18:31 |
| morganfainberg | david-lyle: on the first request ask keystone for the catalog. Cache it. The global catalog in this model is not protected info | 18:31 |
| david-lyle | as the only sessions we manage are user sessions | 18:31 |
| morganfainberg | You already need to know the keystone apriori | 18:31 |
| morganfainberg | So you know where to ask, that is in your config | 18:31 |
| morganfainberg | Horizon has server-side constructs, it can cache that big catalog. Bootstrap is either a startup or first request thing. | 18:32 |
| morganfainberg | And then refresh happens if stale, or if an endpoint Id from a user is not in your cache. | 18:32 |
| *** nellysmitt has quit IRC | 18:32 | |
| samueldmq | david-lyle, it will be a new call to get the whole catalog, a new API endpoint, portected by policy ... you can configure your policy to set it to : user:service | 18:32 |
| *** Ephur has joined #openstack-keystone | 18:32 | |
| david-lyle | again I don't have an account to do that unless it's completely open | 18:32 |
| morganfainberg | david-lyle: that is what I am advocating. The catalog list should be open | 18:33 |
| samueldmq | morganfainberg, why do we need it to be open? | 18:33 |
| morganfainberg | samueldmq: there is no user for horizon to access it with. | 18:33 |
| morganfainberg | Why does it need to be protected? I mean it could be, but the default would be not imo | 18:34 |
| samueldmq | morganfainberg, ok so it *could* be, how to do so? | 18:35 |
| david-lyle | it's down to implementation details now, I just want the full catalog to cache from a trusted source, not create a mechanism for an arbitrary user to publish shared information | 18:35 |
| samueldmq | morganfainberg, I am just interested on how to protect if we want | 18:35 |
| morganfainberg | david-lyle: keystone should still be authoritiative. The ids from the catalog for the token are issued by keystone. | 18:36 |
| morganfainberg | david-lyle: it's all the same on that front today. | 18:36 |
| david-lyle | morganfainberg: right, again my concern was opening a hole to share data from one user to others | 18:37 |
| morganfainberg | david-lyle: I don't see the hole | 18:37 |
| david-lyle | not if the catalog is open | 18:37 |
| morganfainberg | Right. Catalog is open in my view. | 18:37 |
| david-lyle | still feels like advertising for trouble, but that's your realm | 18:38 |
| david-lyle | I'll consume the APIs that are there | 18:38 |
| *** rushiagr is now known as rushiagr_away | 18:41 | |
| morganfainberg | david-lyle, the reality is obscuring your catalog is just not really buying much | 18:43 |
| david-lyle | morganfainberg: I understand your point | 18:43 |
| morganfainberg | david-lyle, i have a few other options that i'd like to explore re: endpoints registering via middleware or such and horizon could subscribe to it. | 18:43 |
| morganfainberg | david-lyle, subcribe/ask from a very fast service the active list/ | 18:44 |
| *** __afazekas is now known as afazekas | 18:44 | |
| morganfainberg | david-lyle, but my thought is we make catalog available, give a mode where horizon can just ask for the endpoint ids, and then you're off to the races | 18:44 |
| morganfainberg | david-lyle, this is all thinking liberty timeline | 18:44 |
| david-lyle | requires some mapping changes, but not too invasive to horizon | 18:45 |
| samueldmq | morganfainberg, planning to put a session in the summit ? | 18:45 |
| samueldmq | that would be great to discuss with ppl | 18:45 |
| morganfainberg | samueldmq, it is something i want to discuss at the summit | 18:45 |
| *** ajayaa has quit IRC | 18:46 | |
| morganfainberg | david-lyle, i have a whole profile of stuff i want to see done in liberty, i need to type it all up | 18:46 |
| morganfainberg | david-lyle, but if i have my way it's mostly going to be a UX and stability release ;) | 18:46 |
| morganfainberg | samueldmq, ^^ | 18:46 |
| samueldmq | morganfainberg, ++ | 18:46 |
| morganfainberg | david-lyle , and this fallsinto "ux" ;) | 18:46 |
| david-lyle | morganfainberg: works for, we're still playing catch up | 18:47 |
| samueldmq | morganfainberg, I know some ideas, I am curious to know your list, let me know when you write them up o/ | 18:47 |
| morganfainberg | samueldmq, i'll have them written up soon - i need to do it before PTL election season | 18:47 |
| samueldmq | morganfainberg, nice... looks like a *buuunch* of challenging things to be done in Liberty :-) | 18:51 |
| morganfainberg | david-lyle, samueldmq, there is nothing saying we can'd make all requests to keystone use a x509 cert or similar for getting the catalog | 18:52 |
| morganfainberg | but that is mechanism *after* the open default | 18:52 |
| morganfainberg | there are ways to cleanly secure things | 18:52 |
| morganfainberg | but you need the stuff to base it all on first | 18:52 |
| samueldmq | morganfainberg, ah nice, so if a company has its own interface, clis etc, just need to wrap them in cert checks | 18:53 |
| morganfainberg | samueldmq, that would be next logical steps | 18:54 |
| morganfainberg | samueldmq, but do it all in iteration | 18:54 |
| morganfainberg | start with the clear way to get catalogs | 18:54 |
| samueldmq | morganfainberg, you're good on thinking step-by-step :/ | 18:54 |
| samueldmq | morganfainberg, sometimes I dont see goals like something we need to walk to them, but just jumping onto them instead, if you understand me :p | 18:55 |
| morganfainberg | samueldmq, of course! | 18:55 |
| samueldmq | morganfainberg, this comes with experience I think, but see, I am learning o/ | 18:56 |
| morganfainberg | samueldmq, i also try not to talk too much about nebulous future goals. | 18:56 |
| morganfainberg | samueldmq, the open catalog, and horizon consuming ids is a feature unto itself | 18:56 |
| samueldmq | morganfainberg, yes, but sometimes I do talk to make sure at least someone agrees with my nebulous future goals :) | 18:56 |
| morganfainberg | samueldmq, the implementing a way to limit access afterwards could be done 20 different ways and i don't want to try to implement that ;) | 18:56 |
| lhcheng | morganfainberg: I agree that eventually all service-to-service communication should be done via cert | 18:56 |
| lhcheng | morganfainberg: I wonder if concept of service account would be useful | 18:57 |
| morganfainberg | lhcheng, we have a patch for at least service->keystone via x509 | 18:57 |
| morganfainberg | but it can't land in kilo | 18:57 |
| lhcheng | morganfainberg: yeah, I saw that. We had that feature back in HP :) | 18:58 |
| morganfainberg | lhcheng, :) | 18:58 |
| samueldmq | morganfainberg, hmm, and then we could make admin and public endpoitns different? | 18:58 |
| morganfainberg | samueldmq, well.. that changes a lot | 18:59 |
| lhcheng | morganfainberg: I guess for service account, I can create a service domain. That should do the trick. | 18:59 |
| samueldmq | morganfainberg, yeah and looks like stepping back | 18:59 |
| samueldmq | :p | 18:59 |
| morganfainberg | assume keystone's public and admin endpoints are just one thing. in v3 we don't differentiate | 18:59 |
| lhcheng | morganfainberg: so that real users are not mixed up with service users. Just another way of doing it. | 18:59 |
| morganfainberg | lhcheng, today that is the approach i would take | 18:59 |
| morganfainberg | lhcheng, with x509 you still need a user to map to iirc (w/ the current patch) | 18:59 |
| lhcheng | morganfainberg: yup, ++ | 18:59 |
| samueldmq | morganfainberg, yes let's not separate them again, nor call domain + projects as tenants again :p | 18:59 |
| morganfainberg | samueldmq, actually if we could re-do it i would have kept tenant vs project | 19:00 |
| morganfainberg | or made domain "tenant" | 19:00 |
| lhcheng | morganfainberg: yeah, the x509 need to map to a user. The cert need to have some attribute to map to a keystone user. | 19:00 |
| morganfainberg | but we're not changing it back now. | 19:00 |
| samueldmq | morganfainberg, yeah, I saw a thread saying users still get confused with tenant vs project :/ | 19:00 |
| morganfainberg | samueldmq, well in liberty i hope we can recommend/provide a means for people to turn off v2 keystone | 19:00 |
| morganfainberg | meaning.... | 19:01 |
| samueldmq | morganfainberg, 'no, I dont want to create a project, I want a tenant' ... | 19:01 |
| morganfainberg | we can deprecate it and start eliminating the confusion | 19:01 |
| samueldmq | morganfainberg, ++ | 19:01 |
| morganfainberg | yeesh, grizzly -> Liberty to get v3 adopted | 19:01 |
| samueldmq | morganfainberg, I remember in the summit we talked about having v3 on all services .. :/ | 19:01 |
| morganfainberg | lets never change the API version again | 19:01 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 19:01 | |
| samueldmq | morganfainberg, we had got keystone people to help others services to get v3 working | 19:01 |
| morganfainberg | actually i'd be ok with changing the API version again, but we need to next move auth endpoints out from the versioning | 19:02 |
| morganfainberg | then it becomes much easier to change versioning if we need | 19:02 |
| morganfainberg | if i wasn't on battery power i'd stand up a VM and try running tempest w/o v2 on | 19:02 |
| morganfainberg | see what breaks | 19:02 |
| morganfainberg | hm.. | 19:03 |
| morganfainberg | actually. | 19:03 |
| lhcheng | morganfainberg: what does moving out auth endpoints from versioning? you mean the info from /versions ? | 19:03 |
| samueldmq | yeah, but v2 v3 was more than that.. the problem is not only the version, but the concepts introduced (domain, etc) | 19:03 |
| morganfainberg | lhcheng, i means authentication isn't /v3/auth | 19:03 |
| lhcheng | morganfainberg: ah, interesting.. | 19:04 |
| morganfainberg | lhcheng, instead we should support /auth/<version for auth> | 19:04 |
| samueldmq | morganfainberg, the same url, but with backwards compatibility | 19:04 |
| morganfainberg | lhcheng, so if there isn't a reason to change how people auth, we don't. v4 keystone API (no we aren't doing this now or soon) could change w/o changing how the services get relevant information | 19:04 |
| lhcheng | morganfainberg: sounds reasonable, I'll be happy with that | 19:04 |
| morganfainberg | lhcheng, since most everything needs exactly: auth, catalog | 19:04 |
| morganfainberg | lhcheng, unless you're heat. | 19:04 |
| morganfainberg | lhcheng, it also means if we want to change how people auth, we can change to auth/v3.1 and not affect keystone's api | 19:05 |
| morganfainberg | lhcheng, it helps to isolate "keystone api" from "authn/authz/catalog" | 19:06 |
| morganfainberg | it's something we talked about a couple cycles ago | 19:06 |
| morganfainberg | i think it makes sense. | 19:06 |
| morganfainberg | hell if it's all post data, you can even change how the auth is done w/o versions | 19:06 |
| samueldmq | morganfainberg, yeah and maybe even having them split =x | 19:06 |
| morganfainberg | just let people auht with new methods. | 19:06 |
| morganfainberg | we can get really fancy w/o making ux bad | 19:07 |
| *** jasondotstar has quit IRC | 19:07 | |
| lhcheng | morganfainberg: I like the idea, something you planning for Liberty? or planned to prioritize in the summit? | 19:08 |
| morganfainberg | lhcheng, something to talk about at the summit | 19:08 |
| *** jasondotstar has joined #openstack-keystone | 19:08 | |
| lhcheng | morganfainberg: cool | 19:08 |
| morganfainberg | lhcheng, i see some critical features for L, but for the most part i think we can focus on stability, performance, and UX and snag a really big win | 19:08 |
| samueldmq | morganfainberg, ++ | 19:09 |
| *** rushiagr_away is now known as rushiagr | 19:09 | |
| *** _cjones_ has quit IRC | 19:10 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove SQL Downgrades https://review.openstack.org/167834 | 19:10 |
| samueldmq | morganfainberg, agree 100%, and functional tests, tests changes will be there to help on stability and correctness as well | 19:10 |
| samueldmq | henrynash, I think I missed something .. do I still need to rebase my work on this ^ | 19:10 |
| lhcheng | morganfainberg: agree with that, it'll give other services catch up with the new features. | 19:10 |
| morganfainberg | henrynash, breton ^ fixed the comment on that | 19:10 |
| samueldmq | morganfainberg, is this work landing in kilo ^ ? if so, I'd better rebase mines on it ( https://review.openstack.org/#/c/142472 ) | 19:13 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Add routing for list_endpoint_groups_for_project https://review.openstack.org/167939 | 19:13 |
| morganfainberg | samueldmq, it'll land either early in liberty or in kilo | 19:14 |
| morganfainberg | samueldmq, if it can land in kilo, that'd be nice, but i understand if it doesn't | 19:14 |
| samueldmq | morganfainberg, ack thanks | 19:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement validation on the Identity V3 API https://review.openstack.org/132122 | 19:21 |
| *** lifeless1 is now known as lifeless | 19:25 | |
| *** nellysmitt has joined #openstack-keystone | 19:26 | |
| *** nellysmitt has quit IRC | 19:27 | |
| *** _cjones_ has joined #openstack-keystone | 19:35 | |
| *** timcline_ has quit IRC | 19:36 | |
| *** timcline has joined #openstack-keystone | 19:38 | |
| *** mestery has quit IRC | 19:42 | |
| *** mestery has joined #openstack-keystone | 19:45 | |
| *** rushiagr is now known as rushiagr_away | 19:46 | |
| *** openstackgerrit has quit IRC | 19:52 | |
| *** openstackgerrit has joined #openstack-keystone | 19:52 | |
| openstackgerrit | Victor Morales proposed openstack/python-keystoneclient: Replaced assertRaisesRegexp deprecated function https://review.openstack.org/168125 | 19:59 |
| *** samueldmq is now known as samueldmq-away | 20:01 | |
| morganfainberg | i need one of those servers with like 40 cores | 20:01 |
| morganfainberg | so i cna run my unit tests in <60s | 20:01 |
| *** rushiagr_away is now known as rushiagr | 20:01 | |
| samueldmq-away | morganfainberg, we could do something like https://folding.stanford.edu/ to run the tests | 20:04 |
| samueldmq-away | morganfainberg, each contributor lends his/her pc o/ | 20:04 |
| dstanek | that would be pretty funny | 20:07 |
| dstanek | -infra could add them to node pool :-) | 20:07 |
| morganfainberg | dstanek, hehe | 20:07 |
| morganfainberg | dstanek, you should get RAX to give me a bare metal server for unit testing :P | 20:08 |
| dstanek | openstack@home | 20:08 |
| morganfainberg | >.> | 20:08 |
| dstanek | morganfainberg: don't you work for a big cloud provider? | 20:08 |
| morganfainberg | shhh | 20:08 |
| morganfainberg | :P | 20:08 |
| morganfainberg | bare metal = awesome | 20:08 |
| morganfainberg | yeah i need to fix my hp cloud account something something validation via voip phoneline | 20:08 |
| *** timcline has quit IRC | 20:14 | |
| *** timcline has joined #openstack-keystone | 20:15 | |
| morganfainberg | crap | 20:15 |
| morganfainberg | i just found another place we log token ids :( | 20:15 |
| morganfainberg | in an exception | 20:15 |
| morganfainberg | .... /me grumbles | 20:16 |
| morganfainberg | though i think this one is safe... | 20:16 |
| morganfainberg | cause it's when a token fails to validate... | 20:16 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Revert "Document mapping of policy action to operation" https://review.openstack.org/168136 | 20:20 |
| stevemar | morganfainberg, sounds like a reasonable case to log the token id | 20:22 |
| *** tqtran has joined #openstack-keystone | 20:22 | |
| *** samueldmq has joined #openstack-keystone | 20:23 | |
| samueldmq | morganfainberg, dstanek ahahah saw the conversation in the logs :p | 20:25 |
| openstackgerrit | Dan Prince proposed openstack/keystone: Revert "Document mapping of policy action to operation" https://review.openstack.org/168138 | 20:25 |
| samueldmq | dstanek, yeah openstack@home ftw | 20:25 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Revert "Document mapping of policy action to operation" https://review.openstack.org/168136 | 20:25 |
| *** tqtran_ has joined #openstack-keystone | 20:27 | |
| *** tqtran has quit IRC | 20:27 | |
| morganfainberg | oookay time to go find power... | 20:27 |
| morganfainberg | i hate coffee shops that don't provide power outlets... | 20:27 |
| morganfainberg | :P | 20:27 |
| stevemar | dstanek, can you push https://review.openstack.org/#/c/168136/ through? | 20:29 |
| stevemar | it's breaking everything in the world right now :) | 20:29 |
| morganfainberg | stevemar: if not I'll push it as soon as I get laptop power | 20:30 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Replace assertRaisesRegexp with assertRaisesRegex https://review.openstack.org/168125 | 20:31 |
| morganfainberg | stevemar: wait what? | 20:31 |
| stevemar | morganfainberg, the revert one | 20:31 |
| morganfainberg | Done. | 20:32 |
| stevemar | yay | 20:32 |
| stevemar | you're the best | 20:32 |
| stevemar | i really wonder why our tests didn't fail | 20:32 |
| stevemar | morganfainberg, are we going through with removing sql downgrades? | 20:34 |
| *** mattfarina has quit IRC | 20:34 | |
| morganfainberg | stevemar: yes. But the question is kilo or liberty. | 20:34 |
| morganfainberg | The x-project spec landed. And other projects already dumped the downgrades. | 20:35 |
| stevemar | morganfainberg, i'm tempted to push it through, but we didn't create a spec or bp for it | 20:35 |
| stevemar | or really brought it up at a meeting | 20:35 |
| stevemar | though i imagine everyone will vote for removal | 20:36 |
| openstackgerrit | henry-nash proposed openstack/keystone: Reload drivers when their domain config is updated https://review.openstack.org/163322 | 20:36 |
| morganfainberg | stevemar: there is a bug and its tied to a cross-project spec. | 20:38 |
| morganfainberg | No keystone spec needed in this case. | 20:38 |
| morganfainberg | bp we could add if needed | 20:41 |
| stevemar | morganfainberg, i'm gonna +A it! | 20:49 |
| morganfainberg | ok | 20:49 |
| stevemar | i feel like this is a big item and we should get more votes? | 20:49 |
| stevemar | maybe i'm over thinking it | 20:49 |
| morganfainberg | i'm good with it either way | 20:49 |
| morganfainberg | ask for more votes | 20:49 |
| morganfainberg | +A it. | 20:49 |
| morganfainberg | honestly i'm digging through some other bugs that need to be addressed now. | 20:50 |
| morganfainberg | feel free to ask for more eyes | 20:50 |
| morganfainberg | :) | 20:50 |
| stevemar | yeah, i will - ayoung, bknudson -> https://review.openstack.org/#/c/167834/ | 20:50 |
| stevemar | it's a bit piece, and i don't want to push it without more eyes | 20:51 |
| stevemar | breton, seems to think it's good to go :) | 20:51 |
| bknudson | watch it breaks triple-o | 20:52 |
| stevemar | bknudson, we already broke them today, we need to share the love | 20:54 |
| raildo | morganfainberg, dstanek finally we found the error in the drop domain table \o/ | 20:54 |
| raildo | The problem is when we are using sqlite, we can't list/drop/add constraints, so the script https://github.com/openstack/keystone/blob/master/keystone/common/sql/migrate_repo/versions/064_drop_user_and_group_fk.py just drop this contraints for other databases. | 20:54 |
| stevemar | bknudson, break ceilometer or neutron | 20:54 |
| raildo | So, when I drop the domain table, in the tearDown() https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_sql_upgrade.py#L176 they will load all tables but for group and user tables, the FK for domain_id still exists. So they try to load the Domain table id, but it's dropped. | 20:54 |
| ayoung | stevemar, that makes me happy | 20:54 |
| raildo | As you can see in the pdb log: http://paste.openstack.org/raw/196942/ | 20:54 |
| ayoung | +58, -664 | 20:54 |
| raildo | ayoung, ^ | 20:55 |
| stevemar | ayoung, it makes me happy too, but i wanted to give y'all the opportunity to say "NOOOOooo" | 20:55 |
| ayoung | stevemar, the reason I've been so quiet is that I've been setting up Federation with Ipsilon and Devstack: | 20:56 |
| ayoung | {"token": {"methods": ["saml2"], "expires_at": "2015-03-26T21:45:22.771808Z", "extras": {}, "user": {"OS-FEDERATION": {"identity_provider": {"id": "ipsilon"}, "protocol": {"id": "saml2"}, "groups": [{"id": "c1de735a1e214b9fbb5641db04eaa5f5"}]}, "domain": {"id": "Federated", "name": "Federated"}, "id": "ayoung", "name": "ayoung"}, "audit_ids": ["DQwpk-2KTRCfBEMYPQzm_Q"], "issued_at": "2015-03-26T20:45:22.771840Z"} | 20:56 |
| raildo | morganfainberg, dstanek ayoung this will happen for every table that is FK for other table | 20:56 |
| ayoung | Just got that back.... | 20:56 |
| stevemar | ayoung, \o/ !!! | 20:56 |
| stevemar | ipsilon, ipsilon! | 20:56 |
| morganfainberg | ayoung, woot | 20:56 |
| stevemar | ayoung, just don't set RECLONE=yes in your localrc | 20:57 |
| ayoung | stevemar, morganfainberg so, I think that the ipsilon plugin model might be a better SAML story than K2K long term: | 20:57 |
| ayoung | we run ipslon with the keystione identity backend as the guts of a plugin... | 20:57 |
| morganfainberg | ayoung, you can't assume ipslon is going to be available. | 20:58 |
| ayoung | stevemar, mostly I've been taking what nkinder had working for packstack and applying it by hand. I wish I could do FreeIPA from devstack | 20:58 |
| ayoung | morganfainberg, I said "long term" and yes I can | 20:58 |
| morganfainberg | ayoung, no you can't | 20:58 |
| ayoung | morganfainberg, what I mean is that we can use Ipsilon as the SAML front end, no tokens required | 20:58 |
| ayoung | its a way to take the user table from Keystone and export it as a general purpose SAML assertion | 20:59 |
| ayoung | which has other potential benefits: | 20:59 |
| morganfainberg | ayoung, something to discuss later, but my guess is that wont fly as *the* k2k model | 20:59 |
| morganfainberg | it might be a viable way to configure things but later. | 20:59 |
| * morganfainberg is mired in token crap right now. | 20:59 | |
| * morganfainberg is a little grumpy about said token crap. | 20:59 | |
| *** hogepodge has quit IRC | 20:59 | |
| ayoung | morganfainberg, I won't torment you with it now. I'll just rest in the warm comfort of knowing I'm right. | 21:00 |
| *** gokrokve_ has quit IRC | 21:00 | |
| ayoung | We can discuss in Vancouver | 21:00 |
| lbragstad | morganfainberg: token crap? | 21:00 |
| morganfainberg | lbragstad, a certain critical bug. | 21:00 |
| openstackgerrit | henry-nash proposed openstack/keystone: Update configuration documentation for domain config https://review.openstack.org/165754 | 21:01 |
| stevemar | "I'll just rest in the warm comfort of knowing I'm right" | 21:01 |
| henrynash | bknduson: a HEAD hhtp action should never result in a 200 status code should it? | 21:03 |
| bknudson | henrynash: it should be 200 if the request would have been successful | 21:04 |
| bknudson | e.g., if you replaced HEAD with GET the result should be the same. | 21:04 |
| bknudson | only difference should be that HEAD doesn't return a body | 21:04 |
| henrynash | bknudson:ah, right its the same as GET but no body | 21:04 |
| henrynash | bkndudson: so never should retrun a 204? | 21:04 |
| *** Tahmina has joined #openstack-keystone | 21:04 | |
| henrynash | (HEAD, that is) | 21:04 |
| bknudson | it could, if GET would have returned a 204. | 21:05 |
| morganfainberg | bknudson, ++ | 21:05 |
| bknudson | GET can return 204, if there's no representation for the resource | 21:05 |
| henrynash | bknudson: ah, right got it….just noticed that are spec does indeed list 200 and 204 as possible returns to HEAD…and was just chekcing | 21:05 |
| *** fifieldt has quit IRC | 21:07 | |
| *** rushiagr is now known as rushiagr_away | 21:07 | |
| *** raildo is now known as raildo|away | 21:09 | |
| *** devlaps has joined #openstack-keystone | 21:11 | |
| openstackgerrit | henry-nash proposed openstack/python-keystoneclient: Support domain-specific configuration management https://review.openstack.org/168089 | 21:12 |
| *** jamielennox|away is now known as jamielennox | 21:21 | |
| *** fifieldt has joined #openstack-keystone | 21:24 | |
| *** stevemar has quit IRC | 21:25 | |
| *** gordc has quit IRC | 21:32 | |
| ayoung | NO! | 21:41 |
| ayoung | stevemar I need you! | 21:41 |
| *** tqtran has joined #openstack-keystone | 22:00 | |
| *** tqtran_ has quit IRC | 22:01 | |
| dstanek | raildo|away: great, i'll take a look | 22:08 |
| *** nkinder has quit IRC | 22:11 | |
| *** timcline has quit IRC | 22:23 | |
| *** lhcheng_ has joined #openstack-keystone | 22:24 | |
| *** lhcheng has quit IRC | 22:24 | |
| *** lhcheng has joined #openstack-keystone | 22:24 | |
| *** dims_ has joined #openstack-keystone | 22:27 | |
| *** dims_ has quit IRC | 22:27 | |
| *** dims_ has joined #openstack-keystone | 22:27 | |
| *** dims has quit IRC | 22:28 | |
| *** lhcheng_ has quit IRC | 22:28 | |
| *** henrynash has quit IRC | 22:31 | |
| *** bknudson has quit IRC | 22:33 | |
| *** tqtran_ has joined #openstack-keystone | 22:37 | |
| *** tqtran has quit IRC | 22:40 | |
| *** gokrokve has joined #openstack-keystone | 22:47 | |
| *** asselin has joined #openstack-keystone | 22:50 | |
| morganfainberg | dstanek, openstack@home would be fun, but couldn't we just take a page out of distcc to start :P run the testing across multuple nodes via a queue of "actions". the @home stuff might be more overhead [better distribution though] unless we want to run the same test multiple places and confirm the results :P | 22:51 |
| asselin | Hi, trying devstack/master, and getting stack this error: /usr/local/bin/keystone-manage db_sync pkg_resources.DistributionNotFound: oslo.config<=1.6.0,>=1.4.0 http://paste.openstack.org/show/196953/ | 22:51 |
| morganfainberg | asselin, this is a re-used devstack i assume? | 22:51 |
| morganfainberg | asselin, or vm that is | 22:51 |
| asselin | morganfainberg, yes | 22:51 |
| morganfainberg | asselin, ok so you need to update your oslo libaries | 22:52 |
| morganfainberg | there are some oddities that occur when you re-use a VM | 22:52 |
| morganfainberg | especially with the oslo namespace changes | 22:52 |
| morganfainberg | if you can afford to, i recommend a new/clean VM in this case. it should help. | 22:53 |
| asselin | morganfainberg, ok this is bare metal...I tried uninstalling...but I guess maybe I need to reimage | 22:53 |
| morganfainberg | asselin, if you can afford to do so, it'll probably make for less of a headache | 22:53 |
| morganfainberg | asselin you might end up chasing a bunch of these types of errors | 22:54 |
| asselin | morganfainberg, I did see this. Anyway to upgrade them to master (I was trying juno before) http://paste.openstack.org/show/196954/ | 22:54 |
| morganfainberg | ah | 22:54 |
| asselin | I don't know how to delete those | 22:54 |
| morganfainberg | yeah that could def do it | 22:54 |
| morganfainberg | it'll probably just be much much easier to re-image and start clean | 22:55 |
| morganfainberg | ayoung, ping - posted that patch up | 22:55 |
| asselin | morganfainberg, ok thanks | 22:55 |
| morganfainberg | ayoung, eyes on it would be nice to have. | 22:55 |
| morganfainberg | ayoung, i'd like to get feedback before i try to backport it, since it's not going to be a clean backport no matter what - but the general logic should stay the same | 23:01 |
| *** jaosorior has quit IRC | 23:12 | |
| *** timcline has joined #openstack-keystone | 23:14 | |
| *** timcline has quit IRC | 23:14 | |
| *** timcline has joined #openstack-keystone | 23:14 | |
| *** timcline has quit IRC | 23:21 | |
| morganfainberg | dstanek, gyee, since i've been doing security related stuff - you guys want to be on the hook for keystone-coresec (when VMT loops in the keystone core team)? | 23:23 |
| morganfainberg | dstanek, gyee, i'm happy to keep you, but just confirming it | 23:23 |
| morganfainberg | will be bugging henrynash as well when he's on next | 23:23 |
| morganfainberg | dstanek, gyee, (also giving you an out if you don't want to deal with that stuff) | 23:24 |
| gyee | morganfainberg, sure, what do I need to do? | 23:26 |
| morganfainberg | gyee, you're already there | 23:26 |
| morganfainberg | gyee, this is the sub-set of keystonecore who will be looped in when securtiy related bugs are opened | 23:26 |
| gyee | oh | 23:26 |
| morganfainberg | by either the PTL or the VMT | 23:26 |
| *** arunkant_ has quit IRC | 23:26 | |
| gyee | sure I can help out with patches | 23:26 |
| morganfainberg | gyee, if you don't want to be on that hook, i'm happy to take you off. | 23:26 |
| morganfainberg | but it's a question of "do you want to be on the hook for that" | 23:26 |
| * morganfainberg isn't sure how the current group was constructed | 23:27 | |
| gyee | "on the hook" means triaging and submitting patches right? | 23:27 |
| morganfainberg | so letting people duck out if they want to. | 23:27 |
| morganfainberg | yep | 23:27 |
| morganfainberg | and reviewing | 23:27 |
| morganfainberg | well less triage | 23:27 |
| morganfainberg | more review/comment on/submitting patches for security bugs | 23:28 |
| morganfainberg | for keystone and keystone projects | 23:28 |
| gyee | k, I can do that | 23:28 |
| morganfainberg | ok will leave ya on there | 23:28 |
| gyee | just saw one about tokens | 23:28 |
| morganfainberg | gyee, yes. | 23:28 |
| morganfainberg | that is part of what prompted the review of who had access to this stuff | 23:29 |
| gyee | k, will go review it | 23:29 |
| *** zzzeek has quit IRC | 23:31 | |
| *** chlong has joined #openstack-keystone | 23:33 | |
| *** r-daneel has quit IRC | 23:38 | |
| gyee | morganfainberg, ya think we should come up with a standard template for people to file bugs? instead of having to asking which version of keystone, what backend, what configuration, etc | 23:42 |
| morganfainberg | gyee, yes... but i don't think it'll help until we find something not LaunchPad | 23:43 |
| gyee | tru | 23:43 |
| morganfainberg | gyee, also if you get a sec: please correct the comments on https://review.openstack.org/#/c/166086/ it is blocking a FFE | 23:44 |
| morganfainberg | gyee, your comments that is | 23:44 |
| morganfainberg | gyee, so we can get it through. -1s at this point need to get some correction done so we can land them for the FFEs. | 23:44 |
| gyee | k, I can amend that patch | 23:44 |
| gyee | gimme a min | 23:44 |
| morganfainberg | gyee, thanks! | 23:44 |
| morganfainberg | gyee, the security one is a bug, the FFEs need some love this week / by tuesday next week :) | 23:45 |
| morganfainberg | gyee, appreciate it. | 23:45 |
| gyee | gotcha | 23:45 |
| openstackgerrit | guang-yee proposed openstack/keystone-specs: Add a relay_state_prefix to the service provider resource https://review.openstack.org/166086 | 23:50 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Make trust manager raise formatted message exception https://review.openstack.org/149550 | 23:56 |
| openstackgerrit | Merged openstack/keystone: Revert "Document mapping of policy action to operation" https://review.openstack.org/168136 | 23:58 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!