| *** dims__ has joined #openstack-keystone | 00:04 | |
| *** dims_ has joined #openstack-keystone | 00:05 | |
| *** leonchio_ has quit IRC | 00:08 | |
| *** dims__ has quit IRC | 00:09 | |
| *** bknudson has joined #openstack-keystone | 00:12 | |
| *** ChanServ sets mode: +v bknudson | 00:12 | |
| *** nkinder has joined #openstack-keystone | 00:14 | |
| *** sdake has joined #openstack-keystone | 00:20 | |
| *** sdake_ has quit IRC | 00:24 | |
| mtreinish | morganfainberg: I just confirmed that signed commits work fine with gerrit, even with merge commits | 00:47 |
|---|---|---|
| mtreinish | forgot to check that after I started defaulting to singing the commits | 00:47 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add endpoint and service ids to fixtures https://review.openstack.org/174668 | 00:48 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Allow searching a catalog on service or endpoint id https://review.openstack.org/174669 | 00:48 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Remove service_type requirement from catalog searching https://review.openstack.org/174670 | 00:48 |
| mtreinish | morganfainberg: it's kinda disappointing though the gpg signature doesn't show up in any of the web views. You've got checkout out the repo and use show-signature to even know it's there | 00:52 |
| *** _cjones_ has quit IRC | 00:53 | |
| *** ozialien has joined #openstack-keystone | 01:03 | |
| morganfainberg | mtreinish: lame | 01:04 |
| *** nkinder has quit IRC | 01:05 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds an initial functional test https://review.openstack.org/158466 | 01:09 |
| *** ozialien has left #openstack-keystone | 01:12 | |
| *** gyee_ has quit IRC | 01:13 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Expose domain_name in the context for policy.json https://review.openstack.org/174633 | 01:16 |
| *** mattfarina has joined #openstack-keystone | 01:17 | |
| *** alexsyip has quit IRC | 01:18 | |
| *** lhcheng has quit IRC | 01:23 | |
| *** tqtran has quit IRC | 01:38 | |
| *** davechen has joined #openstack-keystone | 01:40 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove assigned protocol before removing IdP https://review.openstack.org/173696 | 01:40 |
| *** erkules has joined #openstack-keystone | 01:43 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Move endpoint_policy migrations into keystone core https://review.openstack.org/171916 | 01:43 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Move endpoint policy into keystone core https://review.openstack.org/171448 | 01:43 |
| *** erkules_ has quit IRC | 01:46 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove assigned protocol before removing IdP https://review.openstack.org/173696 | 01:46 |
| *** harlowja is now known as harlowja_away | 01:47 | |
| *** nkinder has joined #openstack-keystone | 01:49 | |
| *** dims_ has quit IRC | 01:54 | |
| *** trey has quit IRC | 01:54 | |
| *** trey has joined #openstack-keystone | 01:59 | |
| *** lhcheng has joined #openstack-keystone | 02:11 | |
| *** ChanServ sets mode: +v lhcheng | 02:11 | |
| *** lhcheng has quit IRC | 02:16 | |
| davechen | dstanek, hi David, are you still around? | 02:22 |
| cburgess | @morganfainberg *ping* | 02:23 |
| *** nkinder has quit IRC | 02:24 | |
| *** davechen has quit IRC | 02:56 | |
| *** davechen has joined #openstack-keystone | 02:57 | |
| *** nkinder has joined #openstack-keystone | 03:00 | |
| *** richm has quit IRC | 03:17 | |
| *** nkinder has quit IRC | 03:18 | |
| *** sdake_ has joined #openstack-keystone | 03:34 | |
| *** sdake has quit IRC | 03:38 | |
| *** leonchio_ has joined #openstack-keystone | 03:44 | |
| *** ishant has joined #openstack-keystone | 03:45 | |
| *** trey has quit IRC | 03:50 | |
| *** gyee has quit IRC | 03:52 | |
| *** lhcheng has joined #openstack-keystone | 03:52 | |
| *** ChanServ sets mode: +v lhcheng | 03:52 | |
| *** gyee_ has joined #openstack-keystone | 03:52 | |
| *** gyee_ has quit IRC | 03:54 | |
| *** _cjones_ has joined #openstack-keystone | 03:54 | |
| *** trey has joined #openstack-keystone | 03:58 | |
| *** _cjones_ has quit IRC | 03:59 | |
| *** leonchio_ has quit IRC | 04:04 | |
| *** nkinder has joined #openstack-keystone | 04:32 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Expose domain_name in the context for policy.json https://review.openstack.org/174633 | 04:49 |
| *** ajayaa has joined #openstack-keystone | 05:06 | |
| *** ajayaa has quit IRC | 05:14 | |
| *** openstackgerrit has quit IRC | 05:21 | |
| *** openstackgerrit has joined #openstack-keystone | 05:21 | |
| *** stevemar has joined #openstack-keystone | 05:21 | |
| *** ChanServ sets mode: +v stevemar | 05:21 | |
| morganfainberg | cburgess: pong | 05:23 |
| morganfainberg | cburgess: yes delayed but in Sunnyvale this week. | 05:24 |
| *** stevemar has quit IRC | 05:32 | |
| *** stevemar has joined #openstack-keystone | 05:33 | |
| *** ChanServ sets mode: +v stevemar | 05:33 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove assigned protocol before removing IdP https://review.openstack.org/173696 | 05:36 |
| *** Ephur has quit IRC | 05:37 | |
| *** rushiagr_away is now known as rushiagr | 05:38 | |
| *** kiran-r has joined #openstack-keystone | 05:44 | |
| *** ajayaa has joined #openstack-keystone | 05:49 | |
| *** lhcheng has quit IRC | 05:56 | |
| *** rm_work is now known as rm_work|away | 06:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/172624 | 06:06 |
| *** stevemar has quit IRC | 06:12 | |
| bigjools | morganfainberg: hi, cburgess was going to introduce you to me as I had a few questions about keystone. I'm all good for now, though. | 06:16 |
| *** ajayaa has quit IRC | 06:19 | |
| breton | morning, keystoneers | 06:40 |
| *** pnavarro has joined #openstack-keystone | 06:55 | |
| davechen | breton: morning, nice to see you are up. :) | 06:55 |
| *** lhcheng has joined #openstack-keystone | 06:56 | |
| *** ChanServ sets mode: +v lhcheng | 06:56 | |
| davechen | morganfainberg: Hi morgan, | 06:57 |
| davechen | morganfainberg: I saw this spec (https://blueprints.launchpad.net/keystone/+spec/ondelete-cascade) is accepted by you? I saw the "Series goal"is properly defined. :) | 06:58 |
| davechen | morganfainberg: If spec is needed, pls kindly let me know, I will provide a spec for review, thanks! | 07:00 |
| morganfainberg | Will look tomorrow. | 07:01 |
| *** lhcheng has quit IRC | 07:02 | |
| morganfainberg | davechen: ^^ | 07:02 |
| *** zz_avozza is now known as avozza | 07:04 | |
| *** sdake has joined #openstack-keystone | 07:06 | |
| davechen | morganfainberg: thanks, not such urgent. Just saw steve's comment on the patch, so check the status of that BP and found someone has help to define some scope on that BP already. | 07:07 |
| *** jsheeren has joined #openstack-keystone | 07:08 | |
| *** jaosorior has joined #openstack-keystone | 07:09 | |
| *** sdake_ has quit IRC | 07:09 | |
| *** krykowski has joined #openstack-keystone | 07:16 | |
| *** clayton has quit IRC | 07:17 | |
| *** dvorak has joined #openstack-keystone | 07:18 | |
| *** svasheka has quit IRC | 07:21 | |
| *** viktors has quit IRC | 07:28 | |
| *** chlong has quit IRC | 07:33 | |
| *** dims__ has joined #openstack-keystone | 07:33 | |
| *** dims__ has quit IRC | 07:38 | |
| *** davechen1 has joined #openstack-keystone | 07:44 | |
| *** davechen has quit IRC | 07:44 | |
| *** alex_xu has quit IRC | 07:46 | |
| *** alex_xu has joined #openstack-keystone | 07:48 | |
| *** davechen has joined #openstack-keystone | 07:49 | |
| *** jistr has joined #openstack-keystone | 07:50 | |
| *** henrynash has joined #openstack-keystone | 07:51 | |
| *** ChanServ sets mode: +v henrynash | 07:51 | |
| *** davechen1 has quit IRC | 07:51 | |
| *** erkules has quit IRC | 07:53 | |
| *** erkules has joined #openstack-keystone | 07:53 | |
| *** rushiagr is now known as rushiagr_away | 08:04 | |
| *** ajayaa has joined #openstack-keystone | 08:15 | |
| *** turul has joined #openstack-keystone | 08:18 | |
| *** sdake has quit IRC | 08:28 | |
| *** turul is now known as afazekas | 08:30 | |
| *** c0m0 has joined #openstack-keystone | 08:35 | |
| *** pcaruana has joined #openstack-keystone | 08:50 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystonemiddleware: Add Endpoint Enforcement to Keystonemiddleware https://review.openstack.org/153296 | 08:57 |
| *** ajayaa has quit IRC | 09:03 | |
| *** rushiagr_away is now known as rushiagr | 09:10 | |
| *** ihrachyshka has joined #openstack-keystone | 09:16 | |
| *** henrynash has quit IRC | 09:18 | |
| *** fhubik has joined #openstack-keystone | 09:19 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystonemiddleware: Add Endpoint Enforcement to Keystonemiddleware https://review.openstack.org/153296 | 09:21 |
| *** davidckennedy has joined #openstack-keystone | 09:26 | |
| *** davidckennedy has quit IRC | 09:26 | |
| *** davidckennedy has joined #openstack-keystone | 09:27 | |
| *** Nikkau has joined #openstack-keystone | 09:27 | |
| *** avozza is now known as zz_avozza | 09:39 | |
| *** lhcheng has joined #openstack-keystone | 09:42 | |
| *** ChanServ sets mode: +v lhcheng | 09:42 | |
| *** aix has joined #openstack-keystone | 09:45 | |
| *** davechen has left #openstack-keystone | 09:46 | |
| *** jamielennox is now known as jamielennox|away | 09:49 | |
| *** zz_avozza is now known as avozza | 10:07 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone-specs: Updated endpoint enforcement spec https://review.openstack.org/174799 | 10:26 |
| *** krykowski_ has joined #openstack-keystone | 10:31 | |
| *** krykowski has quit IRC | 10:35 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone-specs: Updated endpoint enforcement spec https://review.openstack.org/174799 | 10:36 |
| samueldmq | hi, morning | 10:49 |
| *** dims__ has joined #openstack-keystone | 11:02 | |
| *** aix has quit IRC | 11:05 | |
| *** krykowski_ has quit IRC | 11:09 | |
| *** krykowski has joined #openstack-keystone | 11:09 | |
| breton | morning | 11:10 |
| *** ishant has quit IRC | 11:22 | |
| dstanek | breton: good morning | 11:24 |
| *** amakarov_away is now known as amakarov | 11:33 | |
| *** lhcheng has quit IRC | 11:37 | |
| *** KanagarajM has joined #openstack-keystone | 11:45 | |
| KanagarajM | http://developer.openstack.org/api-ref-identity-v3.html does not have Region API deatils | 11:45 |
| amakarov | dstanek, good day! Can you please look at https://review.openstack.org/#/c/173424/ again? I've tried to explain the situation a bit | 11:45 |
| KanagarajM | could someone kindly let me know if the Region is not planned to support in public | 11:46 |
| dstanek | amakarov: i think for each of the three points you should say why they are not working or bad; to me it just reads like facts and not something that needs to be fixed | 11:50 |
| dstanek | KanagarajM: maybe that's an oversight. i don't think there are plans to remove that from the catalog. | 11:52 |
| *** krykowski has quit IRC | 11:52 | |
| amakarov | dstanek, I can't actually file a bug as it is none discovered :) May it be a link to algorithms comparing benchmark? | 11:53 |
| KanagarajM | dstanek: ok. i will file a bug on api-sites for the same | 11:53 |
| KanagarajM | dstanek: because api docs are not available, its very difficult to consume them | 11:54 |
| dstanek | amakarov: so what problem does that spec solve? | 11:55 |
| amakarov | dstanek, it improves tree operations performance | 11:56 |
| amakarov | simplifies | 11:56 |
| dstanek | amakarov: you should add those two things to the spec then | 11:56 |
| amakarov | dstanek, got it | 11:57 |
| dstanek | amakarov: it currently reads as 'to do X we do Y, but nothing says why Y is bad | 11:57 |
| amakarov | dstanek, so it is not enough to state that iterating the tree is not the best solution, is it? | 11:58 |
| *** krykowski has joined #openstack-keystone | 12:00 | |
| dstanek | amakarov: where do you say that? you just say 'is not enough' and don't clarify why recursion is bad | 12:02 |
| dstanek | amakarov: i don't think you need algorithm times, but i was hoping to see more | 12:02 |
| *** aix has joined #openstack-keystone | 12:03 | |
| amakarov | dstanek, I see you point, writing down more detailed description | 12:03 |
| dstanek | amakarov: for instance, on a given size hierarchy that would require some number of DB lookups, whereas your solution requires 1 | 12:05 |
| dstanek | amakarov: that would help us better judge the added complexity again the potential gain | 12:05 |
| amakarov | dstanek, aha, so we need some kind of user-story with measurable profit? | 12:06 |
| dstanek | amakarov: something like that. right now it doesn't seem to me that adding this complexity would create much value in other areas. | 12:07 |
| amakarov | dstanek, I think it can help to make revocation events faster - where can I explain it in this spec? Or I need another one? | 12:09 |
| breton | folks, is there any blog post or explanation why we needed admin and public instances of keystone? Why can't we have only one instance? | 12:10 |
| dstanek | breton: i don't think so, but my understanding is that restriction is melting away | 12:10 |
| amakarov | breton, we don't like to expose user-list to public for example | 12:10 |
| dstanek | breton: i believe it was for having certain privileged operations that could be more easily protected if they weren't exposed | 12:11 |
| dstanek | breton: not sure how that panned out in practice | 12:11 |
| dstanek | breton: i think the trend is to make that policy driven to remove the need for multiple ports | 12:12 |
| dstanek | amakarov: if it's related i would add that to the spec - you should use the spec to convince -core that we need this change | 12:13 |
| breton | dstanek: is this difference supported by clients? For example, ksc authenticates against public endpoint and then requests admin endpoint on user-list | 12:14 |
| *** bknudson has quit IRC | 12:15 | |
| breton | there is https://bugs.launchpad.net/keystone/+bug/1362630 but I am not sure what is its status | 12:15 |
| openstack | Launchpad bug 1362630 in Keystone "keystone catalog command line fails with "'NoneType' object has no attribute 'has_service_catalog'"" [Undecided,Invalid] - Assigned to David J Hu (david-j-hu) | 12:15 |
| dstanek | breton: i just change the os-endpoint | 12:21 |
| *** KanagarajM has quit IRC | 12:22 | |
| *** dvorak is now known as clayton | 12:25 | |
| openstackgerrit | Merged openstack/oslo.policy: Uncap library requirements for liberty https://review.openstack.org/174515 | 12:31 |
| *** bknudson has joined #openstack-keystone | 12:36 | |
| *** ChanServ sets mode: +v bknudson | 12:36 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Materialized path for project hierarchy https://review.openstack.org/173424 | 12:39 |
| amakarov | dstanek, ^^ | 12:39 |
| *** gordc has joined #openstack-keystone | 12:44 | |
| *** fhubik is now known as fhubik_afk | 12:44 | |
| *** fhubik_afk is now known as fhubik | 12:48 | |
| *** c0m0 has quit IRC | 13:07 | |
| *** richm has joined #openstack-keystone | 13:09 | |
| *** jdennis has joined #openstack-keystone | 13:20 | |
| *** Ephur has joined #openstack-keystone | 13:21 | |
| *** rushiagr is now known as rushiagr_away | 13:23 | |
| *** fhubik has quit IRC | 13:33 | |
| *** fhubik has joined #openstack-keystone | 13:34 | |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Fix mysql_engine and FK in *_token tables https://review.openstack.org/174871 | 13:34 |
| *** rushil has joined #openstack-keystone | 13:35 | |
| *** fhubik has quit IRC | 13:40 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:45 | |
| *** mattfarina has joined #openstack-keystone | 13:45 | |
| *** topol has joined #openstack-keystone | 13:46 | |
| *** ChanServ sets mode: +v topol | 13:46 | |
| *** dnalezyt has joined #openstack-keystone | 13:52 | |
| dstanek | anyone have thoughts on https://review.openstack.org/#/c/158466/ ? it's blocking a bunch of other stuff | 13:56 |
| kiran-r | Hello keystoners!!! | 14:02 |
| breton | kiran-r: hello | 14:02 |
| kiran-r | I need an immediate help. | 14:02 |
| kiran-r | I accidentally deleted the only admin | 14:02 |
| kiran-r | How do I create one?? | 14:02 |
| kiran-r | Please help me! | 14:02 |
| kiran-r | breton: Hello! | 14:02 |
| kiran-r | Any solutions.?? | 14:03 |
| kiran-r | I used os-purge cleanup-project on admin. :( | 14:04 |
| *** rushil has quit IRC | 14:05 | |
| breton | dstanek: -1'd ;) | 14:06 |
| breton | kiran-r: create a user using admin_token | 14:07 |
| dstanek | kiran-r: yes, what breton said. you probably have to enable that again in your config. | 14:07 |
| *** rushil has joined #openstack-keystone | 14:07 | |
| dstanek | breton: ouch. thanks. copy-paste issue | 14:07 |
| kiran-r | Can you please elaborate? | 14:07 |
| breton | kiran-r: http://docs.openstack.org/havana/install-guide/install/apt/content/keystone-users.html | 14:08 |
| *** rushiagr_away is now known as rushiagr | 14:08 | |
| dstanek | breton: that's what i get for trying to sneak in a few more tests | 14:08 |
| breton | kiran-r: http://docs.openstack.org/juno/install-guide/install/apt/content/keystone-users.html | 14:08 |
| breton | kiran-r: the latter link is for juno, the former is for old havana | 14:09 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds an initial functional test https://review.openstack.org/158466 | 14:09 |
| *** sdake has joined #openstack-keystone | 14:12 | |
| kiran-r | breton: Thanks alot | 14:17 |
| kiran-r | breton: :) | 14:17 |
| kiran-r | dstanek: Thanks to you too! :) | 14:18 |
| kiran-r | You both saved my day. | 14:18 |
| kiran-r | =D | 14:18 |
| dstanek | kiran-r: did you get it fixed? | 14:18 |
| kiran-r | breton: I did. | 14:18 |
| dstanek | great! | 14:19 |
| *** ayoung has quit IRC | 14:20 | |
| kiran-r | breton: I was not aware that we can bypass authentication using service token. | 14:23 |
| kiran-r | :) | 14:23 |
| *** Nikkau has quit IRC | 14:28 | |
| *** Ephur has quit IRC | 14:29 | |
| dstanek | kiran-r: that's exactly the reason why it should be turned off after the initial keystone configuration | 14:29 |
| kiran-r | dstanek: How to turn it off? | 14:32 |
| *** dims__ has quit IRC | 14:33 | |
| *** carlosmarin has joined #openstack-keystone | 14:36 | |
| *** stevemar has joined #openstack-keystone | 14:37 | |
| *** ChanServ sets mode: +v stevemar | 14:37 | |
| *** krykowski has quit IRC | 14:38 | |
| dstanek | kiran-r: http://docs.openstack.org/developer/keystone/configuringservices.html#admin-token | 14:40 |
| kiran-r | dstanek: Thanks! | 14:46 |
| kiran-r | What is the best way to delete resources in bulk | 14:46 |
| kiran-r | dstanek: What is the best way to clear resources? | 14:47 |
| *** sdake_ has joined #openstack-keystone | 14:47 | |
| davidckennedy | dstanek the initial patch set for functional testing (referred to above) is seperated from the patch set specifying a tox env. Wouldn't they be better together? Is the former going to be exercised without the latter? | 14:48 |
| *** sdake has quit IRC | 14:50 | |
| *** avozza is now known as zz_avozza | 14:54 | |
| *** afaranha_ has joined #openstack-keystone | 14:57 | |
| *** markvoelker has joined #openstack-keystone | 15:00 | |
| *** markvoelker has quit IRC | 15:00 | |
| *** markvoelker has joined #openstack-keystone | 15:00 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Make process_header private https://review.openstack.org/173171 | 15:01 |
| *** dims__ has joined #openstack-keystone | 15:04 | |
| *** davidckennedy has quit IRC | 15:06 | |
| *** zzzeek has joined #openstack-keystone | 15:08 | |
| *** jistr is now known as jistr|mtg | 15:16 | |
| *** rm_work|away is now known as rm_work | 15:18 | |
| *** dims__ has quit IRC | 15:22 | |
| *** zz_avozza is now known as avozza | 15:34 | |
| *** thedodd has joined #openstack-keystone | 15:39 | |
| *** joesavak has joined #openstack-keystone | 15:43 | |
| *** jistr|mtg is now known as jistr | 15:44 | |
| *** mtecer has joined #openstack-keystone | 15:49 | |
| *** weechat has joined #openstack-keystone | 15:49 | |
| *** weechat is now known as davidckennedy | 15:49 | |
| mtecer | Hi guys, is openstackclient now fully support keystone API v3 in Juno ? | 15:50 |
| openstackgerrit | Merged openstack/pycadf: Uncap library requirements for liberty https://review.openstack.org/174525 | 15:50 |
| *** jsavak has joined #openstack-keystone | 15:55 | |
| *** browne has joined #openstack-keystone | 15:55 | |
| *** mtecer has quit IRC | 15:58 | |
| *** joesavak has quit IRC | 15:59 | |
| *** gyee has joined #openstack-keystone | 15:59 | |
| *** ChanServ sets mode: +v gyee | 15:59 | |
| *** r-daneel has joined #openstack-keystone | 16:00 | |
| *** tqtran has joined #openstack-keystone | 16:06 | |
| *** tqtran is now known as tqtran_afk | 16:08 | |
| * kiran-r afk | 16:09 | |
| *** kiran-r has quit IRC | 16:09 | |
| *** pcaruana has quit IRC | 16:10 | |
| *** _cjones_ has joined #openstack-keystone | 16:11 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 16:20 |
| *** dims__ has joined #openstack-keystone | 16:24 | |
| davidckennedy | lbragstad thanks for the review. I've addressed the issues and put a new set up. | 16:26 |
| *** sdake has joined #openstack-keystone | 16:35 | |
| *** sdake_ has quit IRC | 16:39 | |
| *** ayoung has joined #openstack-keystone | 16:41 | |
| *** ChanServ sets mode: +v ayoung | 16:41 | |
| openstackgerrit | Merged openstack/python-keystoneclient-kerberos: Uncap library requirements for liberty https://review.openstack.org/174536 | 16:42 |
| *** Ephur has joined #openstack-keystone | 16:44 | |
| *** jistr has quit IRC | 16:48 | |
| *** dims__ is now known as dimsum__ | 16:50 | |
| *** lhcheng has joined #openstack-keystone | 16:51 | |
| *** ChanServ sets mode: +v lhcheng | 16:51 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 16:55 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 16:56 |
| samueldmq | hi, how do the calls starting with '/v3/projects' get connected with the right method in the resource controller ? | 16:56 |
| samueldmq | I was looking at https://github.com/openstack/keystone/blob/master/keystone/resource/routers.py#L91-L94 | 16:56 |
| samueldmq | and realized that it does not connect GET/HEAD/PUT/etc operations explicitly | 16:56 |
| *** ihrachyshka has quit IRC | 17:00 | |
| dstanek | samueldmq: follow the code a little deeper...that code adds a Router instance for project - https://github.com/openstack/keystone/blob/master/keystone/common/router.py | 17:01 |
| samueldmq | dstanek, great! thanks | 17:02 |
| *** markvoelker has quit IRC | 17:03 | |
| samueldmq | dstanek, yeah, it instantiates Router, and I was looking at wsgi.RoutersBase :/ | 17:03 |
| samueldmq | dstanek, thx | 17:03 |
| rodrigods | gyee, replied in https://review.openstack.org/#/c/148730/ | 17:08 |
| *** davidckennedy has quit IRC | 17:08 | |
| *** lhcheng_ has joined #openstack-keystone | 17:11 | |
| *** lhcheng has quit IRC | 17:13 | |
| gyee | rodrigods, yes, we'll need to change that behavior, updating the parent should be allowed regardless of child status | 17:16 |
| gyee | that's consistent with ownership | 17:16 |
| *** harlowja_away is now known as harlowja | 17:17 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Move httpd under keystone root folder https://review.openstack.org/172245 | 17:21 |
| rodrigods | gyee, yes, but we need the rule for this action | 17:22 |
| rodrigods | an extra rule | 17:22 |
| gyee | rodrigods, how are we checking inherited project role assignments today? same deal right? | 17:23 |
| rodrigods | gyee, but the user triggering the action can have a role that is not inherited | 17:24 |
| gyee | actually, if we store the materialized path, checking for permission should be much easier | 17:24 |
| gyee | say we have A -> B -> C -> D, and you have are the owner of B | 17:25 |
| gyee | when you are trying to access D, we just need to make sure that's a partial match of A -> B | 17:26 |
| rodrigods | gyee, but how we do this? we call the policy enforcer? | 17:26 |
| gyee | I thought we discussed this partial match advantage at the beginning of the hierarchical multitenancy initiative | 17:27 |
| rodrigods | if we have A -> B -> C -> D | 17:28 |
| rodrigods | and user X has admin role in A (not inherited) | 17:28 |
| rodrigods | we have two options: check if X has role assignment in B, C and D | 17:28 |
| rodrigods | or have a policy rule that gives "subtree power" | 17:29 |
| rodrigods | and we can not just check if X has role assignment | 17:29 |
| gyee | ++ for subtree power | 17:30 |
| gyee | I think we'll need to enhance oslo policy to allow partial match | 17:30 |
| gyee | subtree power is really about ownership | 17:30 |
| rodrigods | gyee, so we need an API call to represent this subtree power rule | 17:30 |
| rodrigods | that is /cascade | 17:30 |
| rodrigods | for both enable/disable and delete | 17:30 |
| gyee | 1) always deal with materialized/canonicalized paths | 17:32 |
| gyee | 2) allow partial match | 17:32 |
| openstackgerrit | Merged openstack/keystone: Remove assigned protocol before removing IdP https://review.openstack.org/173696 | 17:33 |
| gyee | for enable/disable, cascade is implied | 17:33 |
| rodrigods | gyee, yes | 17:33 |
| openstackgerrit | Merged openstack/python-keystoneclient-federation: Uncap library requirements for liberty https://review.openstack.org/174535 | 17:35 |
| rodrigods | gyee, for this we need to implement revocation events in ksm | 17:35 |
| rodrigods | is there something that is blocking this? | 17:35 |
| *** amerine has quit IRC | 17:35 | |
| gyee | rodrigods, yes, we must get revocation events working | 17:35 |
| *** amerine has joined #openstack-keystone | 17:36 | |
| *** lhcheng_ has quit IRC | 17:39 | |
| *** madhu_ak has joined #openstack-keystone | 17:41 | |
| openstackgerrit | Merged openstack/keystone: Remove unused policy rule for get_trust https://review.openstack.org/174155 | 17:42 |
| openstackgerrit | Merged openstack/keystone: Make memcache client reusable across threads https://review.openstack.org/170835 | 17:42 |
| madhu_ak | hi, I am looking - how to clear keystone tenant-list ? do we have any command for clearing the tenant_ids? | 17:42 |
| openstackgerrit | Merged openstack/keystone: Expose domain_name in the context for policy.json https://review.openstack.org/174633 | 17:43 |
| stevemar | madhu_ak, nope, you can delete by id only | 17:43 |
| madhu_ak | how to do that? | 17:43 |
| stevemar | keystone tenant-delete <id> should work | 17:43 |
| madhu_ak | you mean keystone tenant-delete <id> | 17:43 |
| madhu_ak | ? | 17:43 |
| stevemar | yep | 17:44 |
| madhu_ak | awesome, will do | 17:44 |
| madhu_ak | have a question though | 17:44 |
| stevemar | only 1 ID at a time | 17:44 |
| openstackgerrit | Merged openstack/keystonemiddleware: Uncap library requirements for liberty https://review.openstack.org/174493 | 17:44 |
| madhu_ak | yep | 17:44 |
| madhu_ak | another question | 17:44 |
| raildo | dstanek, thanks for your comments in reseller patches :) | 17:44 |
| openstackgerrit | Merged openstack/python-keystoneclient: Uncap library requirements for liberty https://review.openstack.org/174534 | 17:45 |
| stevemar | madhu_ak, if you are interested in trying python-openstackclient, you can specify multiple IDs :) -> http://docs.openstack.org/developer/python-openstackclient/command-objects/project.html#project-delete | 17:45 |
| stevemar | anyway, whats your other question | 17:45 |
| dstanek | raildo: thanks for doing the work :-) | 17:46 |
| madhu_ak | have created tempest tests for neutron-lbaas tree and it perfectly working as designed for admin and non-admin users..the resources are indeed setup and cleaned up against devstack instance. For admin tests, when i run the tests for many times, I could see bunch of tenant_id's when I randomly check 'keystone toekn-list' | 17:46 |
| madhu_ak | 'keystone tenant-list' | 17:47 |
| stevemar | maybe tempest is creating tenants | 17:48 |
| * stevemar shrugs | 17:48 | |
| madhu_ak | tenant_list are not cleared though, not sure where to put a check..btw I dont want to make any changes in /opt/stack/tempest/* files | 17:48 |
| madhu_ak | because I dont want other tests to be disturbed though | 17:49 |
| *** jaosorior has quit IRC | 17:52 | |
| madhu_ak | btw, Is there a way to see the tenant_id's list using keystone for non-admin? meaning, when I run the tempest test against non-admin user, how to check whether it is actually creating/or not for non-admin | 17:53 |
| *** lhcheng has joined #openstack-keystone | 17:58 | |
| *** ChanServ sets mode: +v lhcheng | 17:58 | |
| mgagne | dstanek: ping | 17:59 |
| dstanek | mgagne: pong | 17:59 |
| mgagne | dstanek: I'm looking at your change here https://review.openstack.org/#/c/174556/2 in order to understand why https://review.openstack.org/#/c/120011/16 is failing | 17:59 |
| mgagne | dstanek: while tests are now isolated as you proposed, I see that the actual implement of templated catalog still rely on KVS | 18:00 |
| dstanek | mgagne: yes, that change only fixes the tests | 18:01 |
| mgagne | dstanek: as soon as you update templated catalog to raise NotImplemented for CUD calls, keystoneclient (in keystone repo) tests are failing | 18:01 |
| dstanek | there is a dependent patch that removes kvs | 18:01 |
| mgagne | dstanek: does it address the keystoneclient tests? | 18:01 |
| dstanek | https://review.openstack.org/#/c/158442/ | 18:01 |
| mgagne | dstanek: I read it and see if I still have questions. | 18:02 |
| dstanek | mgagne: i have not looked at the patch you mentioned, but it is definitely broken | 18:02 |
| mgagne | dstanek: that's what I found out. | 18:02 |
| dstanek | mgagne: added a comment on it with a link to my patch | 18:04 |
| *** aix has quit IRC | 18:06 | |
| mgagne | dstanek: tbh, I'm trying to backport his patch to icehouse and I still don't understand why keystoneclient tests are failing and how it actually relate to his change. Which catalog is actually tested in there? | 18:07 |
| mgagne | dstanek: but I think I figured out | 18:07 |
| mgagne | dstanek: your patch changes the catalog from templated to sql | 18:07 |
| mgagne | in tests | 18:07 |
| dstanek | yes, you may have more luck trying to backport my patches | 18:08 |
| mgagne | true, I didn't see the actual implement of service/endpoint list/read to templated catalog | 18:09 |
| mgagne | dstanek: will try yours, thanks a lot for the help | 18:09 |
| dstanek | mgagne: also you may want to wait a little until some of this actually merges so you don't have to do the work twice in case things change | 18:10 |
| mgagne | dstanek: I unfortunately don't have the luxury of time =) | 18:10 |
| mgagne | dstanek: do you plan implementing endpoint list too? | 18:10 |
| *** amakarov is now known as amakarov_away | 18:14 | |
| dstanek | mgagne: oh, oops. yes, i can do that | 18:15 |
| dstanek | mgagne: problem is that your backport won't be accepted until the fixes merge into master and are a clean backport | 18:16 |
| dstanek | mgagne: i can hack that together pretty quicly | 18:16 |
| mgagne | dstanek: oh, I don't plan on proposing the backport to icehouse because it would be too featureful =) | 18:16 |
| dstanek | mgagne: i thought that's what you were trying to do | 18:17 |
| mgagne | dstanek: I'm packaging keystone locally | 18:17 |
| dstanek | ah i see | 18:17 |
| mgagne | dstanek: should have said: I'm trying to locally backport to icehouse | 18:17 |
| raildo | dstanek, i have a doubt about your comment here (line 106): https://review.openstack.org/#/c/158372/41/keystone/resource/core.py | 18:24 |
| dstanek | raildo: which one? | 18:25 |
| raildo | dstanek, about the race condition | 18:25 |
| raildo | dstanek, we are creating the new constraint here: https://review.openstack.org/#/c/158372/41/keystone/common/sql/migrate_repo/versions/074_update_project_name_constraint.py | 18:25 |
| dstanek | raildo: then why are we doing the extra check? | 18:26 |
| raildo | so if the db is not sqlite, we can't create two projects with the same name, and we don't need this method | 18:26 |
| *** rushiagr is now known as rushiagr_away | 18:26 | |
| raildo | dstanek, yes... because this extra check can be useful for the sqlite case | 18:27 |
| dstanek | raildo: so this is only there for sqlite testing? that should definitely be in a comment | 18:27 |
| dstanek | i wish we would add RI support into sqlite :-( | 18:27 |
| dstanek | raildo: what about for non-SQL backends? | 18:28 |
| *** ashleighfarnham has joined #openstack-keystone | 18:28 | |
| *** ashleighfarnham has left #openstack-keystone | 18:28 | |
| rodrigods | dstanek, yeah... since the tests run against sqlite we couldn't add tests to verify this condition | 18:28 |
| rodrigods | unless we had this "extra" checking in the code | 18:29 |
| raildo | today this works for non-sql backends, right? | 18:29 |
| raildo | we are just updating the reference to considered is_domain, | 18:30 |
| *** mtecer has joined #openstack-keystone | 18:30 | |
| dstanek | raildo: do we check for unique name somewhere for non-SQL backends? no idea...but i'm sure that would be a race condition | 18:30 |
| dstanek | i definitely think this needs a comment saying that it's for sqlite testing | 18:31 |
| rodrigods | ++ | 18:31 |
| rodrigods | thought we had another option to not have this method :( | 18:31 |
| mtecer | Is this the right room to ask Keystone v3 related question ? | 18:32 |
| raildo | dstanek, my idea is test (without this extra verification)with other backends, mysql, postgres, and if this works, maybe we can remove this from the code and run the test just for non-sqlite | 18:32 |
| *** avozza is now known as zz_avozza | 18:34 | |
| raildo | mtecer, I believe that we can help you :) | 18:35 |
| mtecer | raildo, thank you. I just switched from v2 to v3. Everything works fine with OS_TOKEN. Created an admin domain user role etc. When I switch to this user, do a user list, I get "ERROR: openstack The service catalog is empty" | 18:37 |
| mtecer | Any pointers ? | 18:37 |
| raildo | mtecer, are you doing this request via openstack client? API call? | 18:38 |
| mtecer | raildo, openstack client | 18:39 |
| raildo | mtecer, After create this user, you have grant some role for this user? | 18:40 |
| mtecer | raildo, I assigned this user as admin user in admin domain. | 18:41 |
| raildo | mtecer, can you do: echo $OS_SERVICE_ENDPOINT | 18:42 |
| raildo | mtecer, there is something like: http://localhost:35357/v3? | 18:43 |
| mtecer | raildo, OS_SERVICE_ENDPOINT is empty. However I have this OS_AUTH_URL="https://api.openstack.local:35357/v3" | 18:44 |
| raildo | mtecer, mayve you have to set this for the v3 too | 18:45 |
| raildo | mtecer, can you update this and test again? | 18:45 |
| mtecer | Yes, I will test it now. | 18:45 |
| mtecer | raildo, same error. One thing is that "admin" role I assign is the same from v2. Maybe I should re-create admin role and assign it in v3 ? | 18:50 |
| *** zz_avozza is now known as avozza | 18:53 | |
| *** alexsyip has joined #openstack-keystone | 19:09 | |
| *** madhu_ak has quit IRC | 19:13 | |
| mtecer | raildo, issue was that I used "OS_USER_DOMAIN_NAME" but it required "OS_DOMAIN_NAME". Thank you very much for your time. | 19:14 |
| *** madhu_ak has joined #openstack-keystone | 19:16 | |
| raildo | mtecer, :) | 19:29 |
| *** stevemar has quit IRC | 19:40 | |
| *** stevemar2 has joined #openstack-keystone | 19:40 | |
| *** ChanServ sets mode: +v stevemar2 | 19:40 | |
| *** kevinc has joined #openstack-keystone | 19:50 | |
| kevinc | Does keystone have the ability to store metadata for users and projects? | 19:52 |
| *** madhu_ak has left #openstack-keystone | 19:52 | |
| dstanek | kevinc: what sort of metadata? | 19:57 |
| kevinc | What department the user or project works in, internal billing codes. I don't care if the user can or cannot access this data. | 19:58 |
| dstanek | kevinc: there is a soon to be deprecated way to do it now, but i think it will be removed soon | 20:00 |
| kevinc | Do people just integrate with LDAP and store that information in LDAP? or is there a better way? | 20:06 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: DO NOT MERGE https://review.openstack.org/175040 | 20:06 |
| dstanek | kevinc: what are you trying to do exactly? | 20:07 |
| dstanek | stevemar2: should i merge that ^? | 20:07 |
| *** topol has quit IRC | 20:09 | |
| *** mattfarina has quit IRC | 20:11 | |
| kevinc | For all of the project in keystone we need to associate a project lead (first and last name) and project billing index, so we can run monthly reports for management so they can go back to each department and recover the cost of resources used | 20:12 |
| *** pnavarro has quit IRC | 20:14 | |
| *** stevemar2 is now known as stevemar | 20:15 | |
| dstanek | kevinc: unfortunately that's beyond my area of expertise | 20:15 |
| kevinc | ok thanks | 20:15 |
| stevemar | dstanek, maybe not merge that one :) | 20:15 |
| dstanek | kevinc: maybe someone else in here will be able to answer that or you can ask on one of the mailing lists | 20:15 |
| kevinc | is setting the "extra" information on the tenant the method that is going to be deprecated? | 20:17 |
| ericksonsantos | dstanek, ping about https://review.openstack.org/#/c/158720/12 | 20:18 |
| dstanek | kevinc: yes, you don't set it directly you just put key-value pairs in the entity data and they are stashed there for you | 20:18 |
| dstanek | ericksonsantos: hi | 20:19 |
| ericksonsantos | dstanek, hi, I'm new to openstack | 20:19 |
| ericksonsantos | dstanek, and I'm working with the guys of reseller | 20:20 |
| kevinc | dstanek: thank you, setting the key-value pairs will work. There are no plans to depreciate this feature are there? | 20:21 |
| dstanek | kevinc: that's exactly what we have been taking about deprecating | 20:22 |
| ericksonsantos | dstanek, we tryed to follow henry-nash suggestion and map from ProjectNotFound to ValidationError in get_project | 20:22 |
| *** openstackgerrit has quit IRC | 20:22 | |
| *** openstackgerrit has joined #openstack-keystone | 20:22 | |
| kevinc | oh ok | 20:22 |
| kevinc | thank you | 20:22 |
| ericksonsantos | dstanek, but the get_project method is never called when project_id is invalid. | 20:23 |
| ericksonsantos | dstanek, we look into the code and realized that it occurs because of the "protected" wrapper, more accurately at https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L124 | 20:24 |
| dstanek | ericksonsantos: welcome :-) | 20:24 |
| ericksonsantos | dstanek, thanks :) | 20:24 |
| dstanek | you mean in create_project right? not get_project? | 20:25 |
| dstanek | for raising the ValidationError | 20:25 |
| ericksonsantos | dstanek, in get_project too | 20:25 |
| ericksonsantos | dstanek, I think it doesn't make much sense | 20:26 |
| dstanek | i don't think get_project should raise a validationerror - if the project_id doesn't exist it should be a ProjectNotFound | 20:26 |
| ericksonsantos | dstanek, so I agree with you :) but I think henry-nash want us to do that | 20:27 |
| dstanek | ericksonsantos: looking for his comment | 20:28 |
| ericksonsantos | dstanek, or I understood his comment the wrong way | 20:28 |
| rodrigods | ericksonsantos, dstanek, think because we had a DomainNotFound | 20:28 |
| *** pnavarro has joined #openstack-keystone | 20:28 | |
| ericksonsantos | rodrigods, I don't think so | 20:29 |
| rodrigods | ericksonsantos, dstanek, sorry, confused the patches :) | 20:30 |
| dstanek | his last comment is just about adding a test for the validation error | 20:30 |
| rodrigods | dstanek, that's the tricky part | 20:31 |
| rodrigods | dstanek, there is something wrong | 20:31 |
| ericksonsantos | dstanek, hmm, I see | 20:31 |
| rodrigods | seems like the wrong controller method is being called | 20:32 |
| rodrigods | ericksonsantos can give more details :) | 20:32 |
| *** gyee has quit IRC | 20:32 | |
| raildo | dstanek, maybe we need to change the bug description, since we are handle with this in the create_project not anymore in the list parents and subtree | 20:33 |
| ericksonsantos | rodrigods, when we make a get_project call with an invalid id we get a ProjectNotFound error | 20:33 |
| ericksonsantos | rodrigods, and I think that makes sense | 20:33 |
| rodrigods | yep | 20:33 |
| rodrigods | but we handle the None case | 20:33 |
| rodrigods | and raise a ValidationError for it | 20:33 |
| rodrigods | and was suggested to "unify" the errors being raised | 20:34 |
| ericksonsantos | rodrigods, yes. | 20:35 |
| kevinc | dstanek: thank you for your help, one last question, is there a link to the discussion about deprecating the key-value pairs? I would like to note it in my documentation that the developers should watch it before using it to support our needs | 20:36 |
| ericksonsantos | rodrigods, so do you think we should map from ProjectNotFound to ValidationError in get_project? | 20:38 |
| dstanek | what would be invalid in a get_project call? | 20:39 |
| dstanek | if get_project is called with an id that doesn't exist that should result in a 404 | 20:41 |
| ericksonsantos | dstanek, hmm... I can see just two cases: None and an id of a project that doesn't exist. | 20:41 |
| *** tqtran_afk is now known as tqtran | 20:41 | |
| dstanek | ericksonsantos: how can you pass in a None? | 20:42 |
| *** thedodd has quit IRC | 20:42 | |
| dstanek | ericksonsantos: i think of ValidationError an an HTTP thing - our architecture is really bad at separating the HTTP from the application code | 20:43 |
| *** tqtran has quit IRC | 20:43 | |
| *** tqtran has joined #openstack-keystone | 20:43 | |
| ericksonsantos | dstanek, I think we understood wrong. | 20:49 |
| ericksonsantos | dstanek, we should test the create_project passing None as id | 20:50 |
| *** raildo has quit IRC | 20:51 | |
| ericksonsantos | parent_id* | 20:52 |
| ericksonsantos | I'll make a test for this and change the commit message. | 20:53 |
| ericksonsantos | dstanek, thanks :) | 20:54 |
| *** sdake_ has joined #openstack-keystone | 20:56 | |
| *** rharwood_ has joined #openstack-keystone | 20:57 | |
| *** gabrielbezerra has joined #openstack-keystone | 20:57 | |
| *** rharwood has quit IRC | 20:59 | |
| *** gabriel-bezerra has quit IRC | 20:59 | |
| *** iurygregory has quit IRC | 20:59 | |
| *** rharwood_ is now known as rharwood | 20:59 | |
| *** iurygregory has joined #openstack-keystone | 20:59 | |
| *** sdake has quit IRC | 20:59 | |
| *** leonchio_ has joined #openstack-keystone | 21:00 | |
| *** leonchio_ has quit IRC | 21:00 | |
| -openstackstatus- NOTICE: Gerrit will be unavailable between 22:00 and 23:59 UTC for project renames and a database update. | 21:04 | |
| *** avozza is now known as zz_avozza | 21:04 | |
| *** openstackgerrit has quit IRC | 21:23 | |
| *** openstackgerrit has joined #openstack-keystone | 21:23 | |
| *** sdake has joined #openstack-keystone | 21:25 | |
| *** stevemar has quit IRC | 21:29 | |
| *** sdake_ has quit IRC | 21:29 | |
| *** amerine has quit IRC | 21:41 | |
| *** amerine has joined #openstack-keystone | 21:41 | |
| *** bknudson has quit IRC | 21:44 | |
| *** jamielennox|away is now known as jamielennox | 21:48 | |
| *** kevinc has quit IRC | 21:49 | |
| *** markvoelker has joined #openstack-keystone | 21:49 | |
| *** markvoelker_ has joined #openstack-keystone | 21:50 | |
| *** gordc has quit IRC | 21:54 | |
| *** markvoelker has quit IRC | 21:54 | |
| *** mtecer has quit IRC | 21:55 | |
| *** markvoelker_ has quit IRC | 21:58 | |
| *** pnavarro has quit IRC | 21:58 | |
| *** carlosmarin has quit IRC | 22:00 | |
| *** amerine has quit IRC | 22:02 | |
| *** jsavak has quit IRC | 22:02 | |
| *** amerine has joined #openstack-keystone | 22:03 | |
| -openstackstatus- NOTICE: Gerrit is unavailable until 23:59 UTC for project renames and a database update. | 22:04 | |
| -openstackstatus- NOTICE: Gerrit is unavailable until 23:59 UTC for project renames and a database update. | 22:07 | |
| *** ChanServ changes topic to "Gerrit is unavailable until 23:59 UTC for project renames and a database update." | 22:07 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:13 | |
| *** sdake_ has joined #openstack-keystone | 22:24 | |
| *** sdake has quit IRC | 22:27 | |
| *** lhcheng has quit IRC | 22:32 | |
| *** Ephur has quit IRC | 22:41 | |
| *** lhcheng has joined #openstack-keystone | 22:42 | |
| *** ChanServ sets mode: +v lhcheng | 22:42 | |
| *** lhcheng_ has joined #openstack-keystone | 22:43 | |
| *** lhcheng has quit IRC | 22:43 | |
| *** rushil has quit IRC | 22:46 | |
| *** sdake has joined #openstack-keystone | 22:46 | |
| *** dnalezyt has quit IRC | 22:47 | |
| *** sdake_ has quit IRC | 22:50 | |
| *** lhcheng_ is now known as lhcheng | 22:53 | |
| *** ChanServ sets mode: +v lhcheng | 22:53 | |
| morganfainberg | oh kevinc is not here. | 22:58 |
| morganfainberg | i could have answered re: extra and what he was looking for | 22:58 |
| *** ChanServ changes topic to "Liberty Development Open | Look for RC-critical bugs | Review KeystoneClient and KeystoneMiddleware code | Review Liberty Keystone Specs" | 23:04 | |
| -openstackstatus- NOTICE: Gerrit is available again. | 23:04 | |
| *** sdake_ has joined #openstack-keystone | 23:14 | |
| *** sdake has quit IRC | 23:17 | |
| *** zzzeek has quit IRC | 23:23 | |
| *** lhcheng has quit IRC | 23:26 | |
| *** amerine has quit IRC | 23:27 | |
| *** amerine has joined #openstack-keystone | 23:27 | |
| *** lhcheng has joined #openstack-keystone | 23:30 | |
| *** ChanServ sets mode: +v lhcheng | 23:30 | |
| *** jamielennox is now known as jamielennox|away | 23:30 | |
| *** lhcheng_ has joined #openstack-keystone | 23:30 | |
| *** lhcheng has quit IRC | 23:30 | |
| *** sdake has joined #openstack-keystone | 23:32 | |
| *** lhcheng_ has quit IRC | 23:32 | |
| *** amerine has quit IRC | 23:33 | |
| *** zzzeek has joined #openstack-keystone | 23:33 | |
| *** amerine has joined #openstack-keystone | 23:33 | |
| *** lhcheng has joined #openstack-keystone | 23:34 | |
| *** ChanServ sets mode: +v lhcheng | 23:34 | |
| *** sdake_ has quit IRC | 23:36 | |
| *** alexsyip has quit IRC | 23:40 | |
| lhcheng | in the keystone policy file, we have a rule: "owner" : "user_id:%(user_id)s", | 23:44 |
| lhcheng | anyone knows how the right side "user_id" is evaluated? | 23:44 |
| lhcheng | I can't seem to find how the "user_id" is ever set here: "owner" : https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L134-L156 | 23:45 |
| *** zzzeek has quit IRC | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!