| stevemar | bknudson, dstanek when y'all get a chance.. https://review.openstack.org/#/c/177620/ | 00:14 |
|---|---|---|
| bknudson | stevemar: not passing jenkins. | 00:14 |
| bknudson | seems like we should pick a standard name for the config file gen tox env. | 00:15 |
| stevemar | it's a requirement failing to download, don't think it's related to the change | 00:15 |
| bknudson | e.g., I think nova uses genconfig | 00:15 |
| stevemar | bknudson, yeah. i noticed that last week | 00:15 |
| stevemar | ML topic? | 00:15 |
| bknudson | sure | 00:15 |
| bknudson | it doesn't matter to me which is used, just should be consistent. | 00:16 |
| stevemar | y, i'm of the same opinion | 00:21 |
| stevemar | bknudson, jenkins is failing cause of HTTP error 404 while getting http://pypi.DFW.openstack.org/packages/2.7/s/sphinxcontrib-blockdiag | 00:25 |
| *** dims_ has quit IRC | 00:34 | |
| *** samueldmq has quit IRC | 00:34 | |
| *** stevemar has quit IRC | 00:57 | |
| openstackgerrit | Merged openstack/keystone: pep8 whitespace changes https://review.openstack.org/177402 | 01:06 |
| openstackgerrit | Merged openstack/keystone: Fixes order of imports for pep8 https://review.openstack.org/177403 | 01:08 |
| *** sigmavirus24_awa has quit IRC | 01:16 | |
| *** Trozz_ has quit IRC | 01:16 | |
| *** Trozz has joined #openstack-keystone | 01:17 | |
| *** ctracey has quit IRC | 01:20 | |
| openstackgerrit | Merged openstack/keystone: Ignore multiple imports per line for six.moves https://review.openstack.org/177404 | 01:20 |
| *** sigmavirus24_awa has joined #openstack-keystone | 01:22 | |
| *** ctracey has joined #openstack-keystone | 01:22 | |
| breton | that feel when I open a book about blue gene/p and see Brant Knudson | 01:23 |
| breton | in authors | 01:23 |
| openstackgerrit | Merged openstack/keystone: Replaced filter with a list comprehension https://review.openstack.org/177405 | 01:32 |
| *** erkules_ has joined #openstack-keystone | 01:32 | |
| *** erkules has quit IRC | 01:35 | |
| *** stevemar has joined #openstack-keystone | 01:53 | |
| *** ChanServ sets mode: +v stevemar | 01:53 | |
| *** lhcheng has joined #openstack-keystone | 01:58 | |
| *** ChanServ sets mode: +v lhcheng | 01:58 | |
| *** lhcheng has quit IRC | 02:12 | |
| morganfainberg | hm. | 02:13 |
| stevemar | morganfainberg, ? | 02:18 |
| morganfainberg | was checking my connection | 02:18 |
| morganfainberg | typing from ~35k ft sometimes means icky connection | 02:18 |
| *** davechen has joined #openstack-keystone | 02:29 | |
| morganfainberg | stevemar: do you happen to have the etherpad for liberty priroties? | 02:31 |
| morganfainberg | stevemar: my history seems to have disappeared. i can hunt through logs if you don't have it ready | 02:31 |
| stevemar | let me see if it's in my history | 02:32 |
| morganfainberg | stevemar, found it | 02:35 |
| morganfainberg | stevemar: https://etherpad.openstack.org/p/keystone-liberty-priority-specs | 02:35 |
| stevemar | morganfainberg, oops, sorry - got distracted by twitter | 02:35 |
| morganfainberg | nice | 02:35 |
| morganfainberg | stevemar: i see how it is... | 02:38 |
| morganfainberg | stevemar: :P | 02:38 |
| stevemar | morganfainberg, blame sigmavirus24_awa he's the one distracting me | 02:39 |
| *** lhcheng has joined #openstack-keystone | 02:48 | |
| *** ChanServ sets mode: +v lhcheng | 02:48 | |
| *** spandhe has quit IRC | 02:53 | |
| *** lhcheng has quit IRC | 02:55 | |
| *** sudorando has quit IRC | 03:48 | |
| *** sudorandom has joined #openstack-keystone | 03:50 | |
| *** henrynash has quit IRC | 03:56 | |
| *** henrynash has joined #openstack-keystone | 03:56 | |
| *** ChanServ sets mode: +v henrynash | 03:56 | |
| *** arif-ali has quit IRC | 03:58 | |
| morganfainberg | stevemar: suuuuure | 04:01 |
| stevemar | morganfainberg, landed yet? | 04:05 |
| morganfainberg | yeah | 04:05 |
| morganfainberg | all checked in and in my hotel room | 04:05 |
| *** ChanServ changes topic to "Liberty Development Open | RC2 For Kilo has been tagged, please look for any new RC blockers | Review Liberty Specs | Provide feedback on Liberty Priorities: https://etherpad.openstack.org/p/keystone-liberty-priority-specs" | 04:30 | |
| *** ChanServ changes topic to "Liberty Development Open | Review Liberty Specs | Provide feedback on Liberty Priorities: https://etherpad.openstack.org/p/keystone-liberty-priority-specs" | 04:30 | |
| *** lhcheng has joined #openstack-keystone | 04:51 | |
| *** ChanServ sets mode: +v lhcheng | 04:51 | |
| *** browne has joined #openstack-keystone | 05:09 | |
| *** Trozz has quit IRC | 05:11 | |
| *** Trozz has joined #openstack-keystone | 05:12 | |
| *** ncoghlan has joined #openstack-keystone | 05:13 | |
| *** wolsen_ is now known as wolsen | 05:33 | |
| *** lhcheng has quit IRC | 05:37 | |
| *** lhcheng has joined #openstack-keystone | 05:41 | |
| *** ChanServ sets mode: +v lhcheng | 05:41 | |
| *** lhcheng has quit IRC | 05:46 | |
| *** kiran-r has joined #openstack-keystone | 06:03 | |
| *** mflobo has joined #openstack-keystone | 06:11 | |
| *** mabrams has joined #openstack-keystone | 06:16 | |
| *** afazekas has joined #openstack-keystone | 06:21 | |
| *** e0ne has joined #openstack-keystone | 06:24 | |
| *** stevemar has quit IRC | 06:27 | |
| *** e0ne has quit IRC | 06:28 | |
| *** mabrams1 has joined #openstack-keystone | 06:30 | |
| *** mabrams1 has left #openstack-keystone | 06:30 | |
| marekd | Good morning. | 06:34 |
| jamielennox | marekd: hey | 06:40 |
| marekd | jamielennox: hi! | 06:40 |
| jamielennox | marekd: i was away for the end of last week - however those saml2 review | 06:41 |
| jamielennox | s | 06:41 |
| marekd | jamielennox: heh, i messed up a little bit. | 06:41 |
| marekd | jamielennox: there is an 'interface' like class in ksc already, and i'd like it to stay there. | 06:42 |
| jamielennox | marekd: ok, so you've seen v2/auth/federated? that's pretty much what i was going to point you to | 06:42 |
| *** lhcheng has joined #openstack-keystone | 06:42 | |
| *** ChanServ sets mode: +v lhcheng | 06:42 | |
| marekd | jamielennox: unless you are super-against it. | 06:42 |
| marekd | jamielennox: yes, i noticed it on Friday 6pm. | 06:42 |
| jamielennox | heh, yea that happens | 06:43 |
| marekd | jamielennox: anyway, are we ok to remove saml2.py from ksc, simply move to ksc-saml2 and cut new version of ksc? | 06:43 |
| marekd | saying "from now on, download another repo" ? | 06:43 |
| jamielennox | i don't know if we're allowed to remove it from ksc | 06:43 |
| jamielennox | it might be that we have to deprecate it | 06:43 |
| jamielennox | however with the creation of ks auth repo that's another nail in the coffin | 06:44 |
| marekd | jamielennox: uh. | 06:44 |
| marekd | jamielennox: ok, i will fix the reviews, leave both plugins (in ksc and ksc-saml2). | 06:45 |
| jamielennox | the existing one in ksc will just stay there for a while and go into maintanence mode like the auth_token middleware that is still in keystoneclient | 06:46 |
| jamielennox | i'm not sure how we'll handle the stevedore entry points yet, but we're going to have to deal with that for ksa anyway | 06:46 |
| marekd | ksa repo doesn't exist yet, does it? | 06:47 |
| jamielennox | i think it's still waiting for infra | 06:47 |
| jamielennox | normally they process those things on a friday so i was hoping it would be done by now | 06:47 |
| marekd | jamielennox: unless it's not called https://github.com/openstack/python-keystoneclient-auth, it's not there. | 06:48 |
| jamielennox | even once infra creates the repos it will still take a while before we're ready to do a release | 06:48 |
| marekd | jamielennox: so, eventually ksc-saml2 should have ksa as dependency, right? | 06:49 |
| jamielennox | right | 06:50 |
| jamielennox | for ksc-saml2 (though we might need to rename again to ksa-saml2) it won't make much difference | 06:50 |
| marekd | right | 06:50 |
| jamielennox | the change to ksa means we get to change some interfaces and drop some old code, but the stuff around session/auth will move more or less as is | 06:51 |
| marekd | OK | 06:51 |
| *** Bsony has joined #openstack-keystone | 06:56 | |
| *** lhcheng has quit IRC | 07:02 | |
| marekd | jamielennox: still here? | 07:12 |
| marekd | jamielennox: I just wanted to ask what's the plan for deprecation method in ksc ? | 07:12 |
| marekd | jamielennox: are you going to pursue https://review.openstack.org/#/c/147026/ ? | 07:13 |
| *** Nakato has quit IRC | 07:16 | |
| *** Nakato has joined #openstack-keystone | 07:16 | |
| jamielennox | marekd: yea, i think it should just go in as is | 07:16 |
| marekd | w/o debtcollector ? | 07:17 |
| jamielennox | i'll bring it up with dolphm when i see him, but i don't want to add a new dependency | 07:17 |
| jamielennox | yea | 07:17 |
| jamielennox | debtcollector is pretty simple, it'd give much the same functionality | 07:17 |
| jamielennox | if we ever need it we'll add it but we've had trouble with having so many dependencies i think it's easiest just to wait on that | 07:18 |
| marekd | hm, i will put thich patch a a dependency and deprecate the auth plugins then. | 07:18 |
| jamielennox | deprecation is relatively easy - removal almost impossible | 07:18 |
| marekd | which makes some mess in the code (lot's of code that is not used and simply must sit in the codebase) | 07:18 |
| jamielennox | right | 07:19 |
| jamielennox | hopefully breaking out ksa will mean a lot less people actually rely on ksc | 07:19 |
| marekd | think so. | 07:19 |
| jamielennox | because there aren't many consumers of the actual CRUD | 07:19 |
| marekd | jamielennox: one more thing - k2k auth plugin - i'd put it in ksc-saml2 just because it's saml2 specific plugin, some ppl argue it's ok to leave it in ksc as it doesn't have any heavy deps (like lxml). | 07:20 |
| marekd | What's your opinion on that? | 07:20 |
| *** browne has quit IRC | 07:20 | |
| jamielennox | marekd: i want to say that saml2 is an implementation detail of something we do actually want in ksc and that if we don't actually do any xml stuff then it should be fine in ksc | 07:22 |
| jamielennox | my problem at the moment is that i don't know how it's supposed to work | 07:22 |
| jamielennox | the plugin that is up for review - i cannot imagine how you are supposed to use that with like OSC | 07:23 |
| marekd | jamielennox: oh, that one....OSC would need to combine two plugins | 07:23 |
| jamielennox | or if that's even something we would want to do in the k2k case | 07:23 |
| jamielennox | marekd: right - so given the ksa/ksc split - would k2k live in ksa or ksc? | 07:23 |
| marekd | ksa | 07:24 |
| jamielennox | it's a plugin so ksa, but it involves talking to CRUD so it's ksc | 07:24 |
| *** krykowski has joined #openstack-keystone | 07:24 | |
| jamielennox | unless they are defining that you fetch the K2K saml packet on the AUTH_INTERFACE - which makes sense but i haven't seen | 07:24 |
| jamielennox | because you have to scope to a project before you can fetch the saml | 07:25 |
| marekd | jamielennox: i think it's okay to expect user to know some information prior to auth | 07:25 |
| marekd | like SP | 07:25 |
| jamielennox | sure, i don't mind that | 07:25 |
| *** markvoelker has joined #openstack-keystone | 07:26 | |
| jamielennox | i mean, i don't like the redundancy and if the server knows that information i'd prefer it provide it than have the client specify each time | 07:26 |
| jamielennox | but i think we want K2K to be as close to a standard ECP exchange as possible | 07:26 |
| marekd | which information you you mean? | 07:26 |
| jamielennox | in one of the plugins we were discussing as to whether one of the urls (i thought maybe sp) could be returned as a header along with the saml data | 07:27 |
| jamielennox | but i can't remember what came of that discussion | 07:27 |
| marekd | jamielennox: oh, yes. and the urls are returned. | 07:28 |
| marekd | but you still need to know the *name* (defined in the Keystone) of the SP | 07:28 |
| jamielennox | cool - so for example i want to use that rather than have the user supply something that keystone already knows | 07:28 |
| jamielennox | that's all i meant | 07:28 |
| marekd | allright. | 07:28 |
| jamielennox | so what do you think the K2K plugin would look like? | 07:29 |
| jamielennox | --os-auth-plugin=k2k --os-inner-plugin-password --os-username XXX --os-auth_url XXXX --os-sp-url XXX ? | 07:30 |
| jamielennox | --os-auth-plugin=k2k --os-inner-plugin=password --os-username XXX --os-auth_url XXXX --os-sp-url XXX ? | 07:30 |
| marekd | i was about to write that we need design implementing something like --os-inner-plugin | 07:30 |
| *** markvoelker has quit IRC | 07:30 | |
| marekd | and maybe not --os-sp-url but --os-sp | 07:31 |
| jamielennox | so the way that get_options() work we might be able to do some sort of prefix like --os-inner-username | 07:31 |
| jamielennox | (need something better than inner obviously) | 07:31 |
| jamielennox | marekd: is there any collision between the local keystone and remote keystone params? | 07:33 |
| jamielennox | i haven't looked for a while - but do you respecify a project_id on remote or is that handled via mapping? | 07:34 |
| marekd | jamielennox: you gen unscoped token and need to scope it again. | 07:35 |
| marekd | projects will not have much in common | 07:35 |
| jamielennox | right - of course, everything that goes through OS-FEDERATED must be unscoped initially | 07:35 |
| jamielennox | it just leads to an interesting situation where you have to provide 2 different project ids or other scoping data | 07:36 |
| marekd | which is very uncomfortable for me. | 07:37 |
| marekd | because this is slowly going away from "request-response" model | 07:37 |
| marekd | and becomes kind of "transactional workflow, with many queries and parameters specified in the runtime" | 07:38 |
| jamielennox | oh yea - particularly in the CLI case we're up to like 5 or 6 requests just to do the initial auth - and OSC doesn't cache it | 07:38 |
| jamielennox | it makes me think i made a mistake in combining unscoped and scoped tokens in ksc - but i don't think there is anything i can do about it | 07:39 |
| marekd | in OS-FEDERATION or generally ? | 07:39 |
| jamielennox | generally | 07:39 |
| jamielennox | well we did it generally which impacted the design for OS-FEDERATION | 07:39 |
| jamielennox | to make federated plugins look like regular plugins | 07:40 |
| marekd | hm, scoping the token internally is quite easy, the problem is that you still need to put local-project-id, remote-project-id and so on. | 07:40 |
| jamielennox | right - yep let's ignore that design problem - i don't see any way to change it now | 07:40 |
| jamielennox | so we can handle prefixes | 07:41 |
| marekd | I predict soon we will need to design something for "multi token" clients. | 07:41 |
| jamielennox | each plugin has its register_conf_options or whatever and we could make some way that they could handle it for an inner plugin | 07:41 |
| jamielennox | marekd: i was thinking about multi token a while ago | 07:42 |
| marekd | jamielennox: and what was the conclusion ? | 07:42 |
| jamielennox | marekd: what i have for now is that session and auth plugin are the only thing with any state, creating a client with that is cheap | 07:42 |
| jamielennox | so what i have for now is create a session standalone, create 3 plugins that you need, create 3 clients that share a session and have a unique auth plugin | 07:43 |
| marekd | where auth plugin keeps the token | 07:43 |
| jamielennox | it's not great but it actually solves a lot of problems for us in not having to have a client juggle auth | 07:43 |
| jamielennox | because otherwise you have to find some way to specify a plugin when making a request, and for all clients - it's a mess | 07:44 |
| jamielennox | marekd: right - auth plugins always hold the token data | 07:44 |
| jamielennox | so 1 client object per token | 07:44 |
| jamielennox | make the users have multiple clients and hope that the SDK comes along with something that can operate at a higher level | 07:45 |
| *** pnavarro has joined #openstack-keystone | 07:46 | |
| *** Bsony has quit IRC | 07:46 | |
| marekd | makes sense. | 07:46 |
| *** marekd has left #openstack-keystone | 07:49 | |
| *** marekd has joined #openstack-keystone | 07:49 | |
| marekd | jamielennox: FYI, I am also starting to think about some usecases like "inter cloud image sharing" | 07:50 |
| marekd | jamielennox: (well, that's something management wants me to do, not my "because i am bored" idea) | 07:50 |
| marekd | jamielennox: ideally you would command glance-a to fetch available image from glance-b (federated clouds), and the identity part is somewhat non obvious | 07:51 |
| jamielennox | hmm, that'll be interesting because you need to do permissions across clouds right? | 07:52 |
| marekd | jamielennox: i'd reuse k2k | 07:52 |
| jamielennox | marekd: right, i mean you can download from one cloud and upload to another using k2k | 07:52 |
| marekd | as a identity layer across the clouds, and the mapping on the remote cloud | 07:52 |
| jamielennox | but to get glance to talk directly to another glance you'd need some sort of permissions? | 07:53 |
| marekd | jamielennox: exactly | 07:53 |
| jamielennox | or nova in one cloud to glance in another | 07:53 |
| jamielennox | that's.... going to be interesting | 07:53 |
| marekd | the way you say that means "you are doomed, good luck" | 07:53 |
| marekd | :-) | 07:54 |
| marekd | or "that's interesting, but i am happy i am not the one who is going to do that" | 07:54 |
| marekd | anyway, i'd like to two glances connect directly | 07:55 |
| marekd | not push it through poor client | 07:56 |
| jamielennox | heh, i'm happy throw advice from the sidelines | 07:57 |
| marekd | do you have any right now? :-) | 07:57 |
| *** jistr has joined #openstack-keystone | 07:57 | |
| jamielennox | new employment? | 07:58 |
| marekd | i am afraid i didn't understand. | 07:58 |
| jamielennox | heh, i don't know, i haven't got that far yet | 07:58 |
| jamielennox | i don't know how much of a client issue it will be | 07:58 |
| jamielennox | i think more likely it will be a signalling issue | 07:58 |
| *** rm_work has quit IRC | 07:59 | |
| marekd | so, ksm is built on top of ksc, right? | 07:59 |
| *** rm_work|away has joined #openstack-keystone | 07:59 | |
| *** rm_work|away is now known as rm_work | 07:59 | |
| *** rm_work has joined #openstack-keystone | 07:59 | |
| jamielennox | if you have the remote points (or a way to find them) in your catalog, you need a way to tell nova to go to the other cloud to get images rather than the local one | 08:01 |
| jamielennox | we might be able to build that in to discover | 08:01 |
| jamielennox | but you'd need a way to name the remote endpoints that uniquely identified them | 08:01 |
| jamielennox | like via regions or something | 08:01 |
| jamielennox | and then a way to tell nova that | 08:01 |
| jamielennox | none of which i think exists | 08:01 |
| jamielennox | i have to run - but interesting problem and i'll have more of a think | 08:01 |
| marekd | jamielennox: ok. | 08:01 |
| marekd | cheers | 08:02 |
| *** henrynash has quit IRC | 08:04 | |
| *** fhubik has joined #openstack-keystone | 08:04 | |
| *** lhcheng has joined #openstack-keystone | 08:05 | |
| *** ChanServ sets mode: +v lhcheng | 08:05 | |
| *** openstackstatus has joined #openstack-keystone | 08:06 | |
| *** ChanServ sets mode: +v openstackstatus | 08:06 | |
| -openstackstatus- NOTICE: Restarting gerrit because it stopped sending events (ETA 15 mins) | 08:10 | |
| *** openstackgerrit has quit IRC | 08:13 | |
| *** openstackgerrit has joined #openstack-keystone | 08:16 | |
| *** ncoghlan has quit IRC | 08:17 | |
| *** markvoelker has joined #openstack-keystone | 08:27 | |
| *** markvoelker has quit IRC | 08:32 | |
| *** fhubik is now known as fhubik_afk | 08:39 | |
| *** jaosorior has joined #openstack-keystone | 08:39 | |
| *** lhcheng has quit IRC | 08:42 | |
| *** erkules_ is now known as erkules | 08:45 | |
| *** erkules has quit IRC | 08:45 | |
| *** erkules has joined #openstack-keystone | 08:45 | |
| *** fhubik_afk is now known as fhubik | 08:54 | |
| *** aix has joined #openstack-keystone | 08:58 | |
| *** e0ne has joined #openstack-keystone | 08:59 | |
| *** ajayaa has joined #openstack-keystone | 09:10 | |
| *** e0ne has quit IRC | 09:10 | |
| *** e0ne has joined #openstack-keystone | 09:13 | |
| *** davechen has left #openstack-keystone | 09:22 | |
| *** fhubik is now known as fhubik_afk | 09:25 | |
| openstackgerrit | Victor Stinner proposed openstack/python-keystoneclient: Remove discover, iso8601 and oslotest dependencies https://review.openstack.org/177687 | 09:27 |
| *** markvoelker has joined #openstack-keystone | 09:27 | |
| *** fhubik_afk is now known as fhubik | 09:29 | |
| *** henrynash has joined #openstack-keystone | 09:31 | |
| *** ChanServ sets mode: +v henrynash | 09:31 | |
| openstackgerrit | Victor Stinner proposed openstack/python-keystoneclient: Remove keystoneclient.middleware https://review.openstack.org/177694 | 09:34 |
| *** markvoelker has quit IRC | 09:36 | |
| *** fhubik is now known as fhubik_afk | 09:44 | |
| *** fhubik_afk is now known as fhubik | 09:46 | |
| openstackgerrit | Victor Stinner proposed openstack/keystonemiddleware: Port keystonemiddleware to Python 3 https://review.openstack.org/177701 | 09:58 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Rename v3/federated.py to federation.py https://review.openstack.org/177704 | 10:06 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Add docstrings for ``protocol`` parameter https://review.openstack.org/177303 | 10:12 |
| *** dims has joined #openstack-keystone | 10:14 | |
| *** markvoelker has joined #openstack-keystone | 10:28 | |
| *** samueldmq has joined #openstack-keystone | 10:32 | |
| samueldmq | morning | 10:32 |
| *** markvoelker has quit IRC | 10:33 | |
| morganfainberg | Zzzzz | 10:33 |
| morganfainberg | I think I hate waking up at 0600 | 10:33 |
| *** jsheeren has joined #openstack-keystone | 10:33 | |
| morganfainberg | samueldmq: mornin. | 10:34 |
| samueldmq | morganfainberg, haha I thought it was earlier there where you are :) it's 7 36 am here | 10:36 |
| *** henrynash has quit IRC | 10:38 | |
| morganfainberg | I'm on the east coast of the U.S. This week. | 10:49 |
| samueldmq | ah, so closer to us from Brazil, in terms of tz | 10:50 |
| samueldmq | and maybe the reason you woke up earlier, tz always messing things up :p | 10:51 |
| *** fhubik is now known as fhubik_afk | 10:59 | |
| *** afazekas has quit IRC | 11:05 | |
| *** henrynash has joined #openstack-keystone | 11:05 | |
| *** ChanServ sets mode: +v henrynash | 11:05 | |
| *** josecastroleon has quit IRC | 11:06 | |
| *** josecastroleon has joined #openstack-keystone | 11:06 | |
| *** e0ne is now known as e0ne_ | 11:07 | |
| *** e0ne_ is now known as e0ne | 11:07 | |
| *** josecastroleon has quit IRC | 11:08 | |
| *** e0ne is now known as e0ne_ | 11:19 | |
| morganfainberg | samueldmq: I wake up at 0600ish every day. | 11:20 |
| morganfainberg | Sometimes I go back to sleep. ;) | 11:20 |
| *** afazekas has joined #openstack-keystone | 11:21 | |
| samueldmq | morganfainberg, hahaha :-) for me the same, but don't go back to sleep :p | 11:22 |
| samueldmq | morganfainberg, have to take my kid to school hehe | 11:23 |
| samueldmq | henrynash, hello, you around ? | 11:26 |
| breton | good day, folks | 11:29 |
| *** e0ne_ has quit IRC | 11:29 | |
| *** markvoelker has joined #openstack-keystone | 11:29 | |
| samueldmq | breton, hey morning :) | 11:30 |
| marekd | hi | 11:32 |
| *** markvoelker has quit IRC | 11:33 | |
| *** markvoelker has joined #openstack-keystone | 11:38 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Refactor SAML2 auth plugins https://review.openstack.org/176746 | 11:48 |
| samueldmq | henrynash, I was taking a look at dynamic policies and would like to talk about hierarchical roles ... | 11:48 |
| *** chmouel has quit IRC | 11:48 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 11:48 |
| *** chmouel has joined #openstack-keystone | 11:50 | |
| *** fhubik_afk is now known as fhubik | 11:52 | |
| *** fhubik is now known as fhubik_afk | 11:53 | |
| *** afazekas has quit IRC | 11:54 | |
| *** chmouel_ has joined #openstack-keystone | 11:57 | |
| *** chmouel has quit IRC | 11:57 | |
| *** e0ne has joined #openstack-keystone | 11:59 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Rename v3/federated.py to v3/federation.py https://review.openstack.org/177704 | 12:00 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Add docstrings for ``protocol`` parameter https://review.openstack.org/177303 | 12:01 |
| *** krykowski has quit IRC | 12:02 | |
| *** krykowski has joined #openstack-keystone | 12:03 | |
| *** krykowski has quit IRC | 12:05 | |
| *** krykowski has joined #openstack-keystone | 12:05 | |
| *** openstackgerrit has quit IRC | 12:06 | |
| *** openstackgerrit has joined #openstack-keystone | 12:06 | |
| *** afazekas has joined #openstack-keystone | 12:07 | |
| *** htruta has joined #openstack-keystone | 12:14 | |
| *** Ctina_ has joined #openstack-keystone | 12:18 | |
| henrynash | samueldmq: hi | 12:19 |
| *** fhubik_afk is now known as fhubik | 12:20 | |
| *** jsheeren has quit IRC | 12:22 | |
| samueldmq | morganfainberg, dolphm <andreaf> samueldmq, kiran-r: there are n-net and neutron identity v3 jobs defined in tempest experimental queue, you can also check the generated tempest.conf for them, e.g. http://logs.openstack.org/81/153681/40/experimental/check-tempest-dsvm-keystonev3-full/a7526e2/logs/tempest_conf.txt.gz | 12:23 |
| samueldmq | henrynash, hi :) | 12:23 |
| henrynash | samueldmq: dynamica policy…. | 12:24 |
| samueldmq | henrynash, so basically I think the hierarchical roles could be split from dynamic policies | 12:24 |
| samueldmq | henrynash, since they're about the granularity we give to users (as well as domain-roles) | 12:24 |
| henrynash | samuledmq: how do you define “dynamic policy”….ones that can be fine grained read/set in the DB? | 12:24 |
| *** fhubik is now known as fhubik_afk | 12:25 | |
| samueldmq | henrynash, hmm.. I was thinking more about read/set in the db, and retrieving from the api | 12:25 |
| henrynash | samueldmq: so yes, I mean via an API….. | 12:25 |
| samueldmq | henrynash, the fine grained support could be discussed out of that | 12:26 |
| samueldmq | henrynash, since we need to discuss the domain-roles as well | 12:26 |
| henrynash | samueldmq: so agreed - no reasons why hierachyical roles should be tied to that | 12:26 |
| samueldmq | henrynash, nice so we agreed on thsi | 12:26 |
| *** jsheeren has joined #openstack-keystone | 12:26 | |
| henrynash | samueldmq: getting to the state where servcies get their policy from Keystone (rather than a file) will be a mojor first step | 12:26 |
| samueldmq | henrynash, probably I will be helping ayoung on that front as well (my managers want me to) ... most specs need update | 12:27 |
| samueldmq | henrynash, ++ | 12:27 |
| henrynash | samueldmq: then making the access to those more fine-grained is step 2 | 12:27 |
| *** fhubik_afk is now known as fhubik | 12:27 | |
| samueldmq | henrynash, and at a glance I see we could split that from the dynamic-policy thing | 12:27 |
| samueldmq | henrynash, agree, but step 1 and 2 can be parallelized, they're independent | 12:28 |
| henrynash | samueldmq: hierachical roles, imho, is a totally separate thing (and as most people know, I’m still to be convinved on them) | 12:28 |
| samueldmq | henrynash, we could still implement them with domain-roles | 12:28 |
| henrynash | samueldmq: well maybe, but if a service isn’t getting their poicy file from keystone…how do we make it more granular? | 12:28 |
| henrynash | (that’s to your point about step 1 and 2 being parallel) | 12:29 |
| henrynash | (agree domain-roles are independant) | 12:29 |
| samueldmq | henrynash, hmmn.. we were about to implement domain-roles without dynamic-policies right ? | 12:29 |
| samueldmq | henrynash, this makes more granular, and has no dependency on it | 12:29 |
| samueldmq | henrynash, actually it depends on how we are going to implement the more fine-grained access ... | 12:30 |
| andreaf | samueldmq: I think it would be nice to re-use the existing DEVSTACK_GATE_KEYSTONE_V3 flag (http://git.openstack.org/cgit/openstack-infra/project-config/tree/jenkins/jobs/devstack-gate.yaml#n1283) to switch not only tempest configuration - but every service configuration - to use identity v3 only - so we can use a single flag | 12:30 |
| *** gordc has joined #openstack-keystone | 12:30 | |
| *** bknudson has quit IRC | 12:31 | |
| henrynash | samueldmq: so i see see “granularity” as being able to not having to treat the policy file as a blob as far as the API is concerned | 12:32 |
| samueldmq | andreaf, great, I plan to have more jobs on this soon ... me, morganfainberg, dolphm are working on that front | 12:32 |
| samueldmq | andreaf, we want a identity v3 only cloud running, and all the jobs being v3 only for L | 12:32 |
| henrynash | samueldmq: domain-roles doesn’t change that | 12:32 |
| samueldmq | andreaf, I have no experience on the gate jobs, will need to bug you more on that later | 12:33 |
| *** chmouel_ is now known as chmouel | 12:33 | |
| andreaf | samueldmq: let me know if you need anything | 12:33 |
| samueldmq | henrynash, k I agree, I was thinking about fine-grained as more power on the role definitions, as you can re-use domain-roles etc .. | 12:34 |
| samueldmq | henrynash, I need to go afk for a bit, have a meeting now, will be back in a bit | 12:34 |
| henrynash | samueldmq: yes, I think that is a separate thing (good, but separate)... | 12:35 |
| henrynash | ok | 12:35 |
| samueldmq | andreaf, nice thx | 12:35 |
| *** raildo has joined #openstack-keystone | 12:35 | |
| *** josecastroleon has joined #openstack-keystone | 12:36 | |
| *** openstackgerrit has quit IRC | 12:37 | |
| *** openstackgerrit has joined #openstack-keystone | 12:37 | |
| marekd | Can I ask for a review here: https://review.openstack.org/#/c/175980/ ? | 12:40 |
| henrynash | marekd: lookinh | 12:42 |
| henrynash | looking | 12:42 |
| marekd | henrynash: thanks | 12:42 |
| *** ayoung has joined #openstack-keystone | 12:43 | |
| *** ChanServ sets mode: +v ayoung | 12:43 | |
| *** fhubik is now known as fhubik_afk | 12:48 | |
| *** Ctina_ has quit IRC | 12:50 | |
| samueldmq | henrynash, I am bakc | 12:54 |
| samueldmq | henrynash, I think we could have domain-roles constrained to domains or not (so let's step back and call it role-groups) | 12:54 |
| samueldmq | henrynash, we then can essentially implement the hierarchical roles with this | 12:55 |
| samueldmq | henrynash, where they can be global (not tied to a domain), or domain specific (the domain-roles) | 12:55 |
| *** bknudson has joined #openstack-keystone | 12:56 | |
| *** ChanServ sets mode: +v bknudson | 12:56 | |
| morganfainberg | how is everyone today? | 13:03 |
| morganfainberg | ayoung: so this is what it's like when i'm on east coast time | 13:03 |
| marekd | morganfainberg: greatish | 13:03 |
| ayoung | morganfainberg, are you on the East Coast? | 13:03 |
| lbragstad | dolphm: o/ I attempted building the Fernet branch of keystone-deploy into the master branch. I added it as a dependency of the convert to Cent commit. https://github.com/dolph/keystone-deploy/pull/7 | 13:03 |
| morganfainberg | ayoung: yeah in D.C. this week | 13:03 |
| *** fhubik_afk is now known as fhubik | 13:03 | |
| ayoung | morganfainberg, Hope you found your coffee already. Its about 6 hours before you usally get breakfast, too | 13:04 |
| lbragstad | dolphm: once that's merged, I'm going to attempt converting the galera branch for centos support as well. | 13:04 |
| lbragstad | ayoung: fyi ^ | 13:04 |
| ayoung | lbragstad, branch? | 13:05 |
| ayoung | Ah, this is the Deployment via Ansible? | 13:05 |
| morganfainberg | ayoung: already had coffe and breakfast | 13:05 |
| ayoung | lbragstad, you guys are doing that via git based code, right? | 13:05 |
| lbragstad | ayoung: yep, I was able to verify the centos commit | 13:05 |
| morganfainberg | ayoung: this is what happens when i'm on the road for conference/meetings. | 13:05 |
| lbragstad | ayoung: it pull the branches from gerrit | 13:06 |
| ayoung | lbragstad, do you get systemd support any way? | 13:06 |
| lbragstad | https://github.com/dolph/keystone-deploy/blob/master/playbooks/roles/http/tasks/main.yaml#L27-L29 | 13:06 |
| morganfainberg | ayoung: can I has a distro that just says no to systemd? | 13:06 |
| lbragstad | ^ that's cool because you can deploy wip changes that are up for review to a Keystone cluster | 13:06 |
| ayoung | morganfainberg, you can have docker. | 13:06 |
| morganfainberg | ayoung: that doesn't remove the need for systemd | 13:07 |
| ayoung | morganfainberg, systemd is just different | 13:07 |
| morganfainberg | ayoung: what was wrong with sysv init? | 13:07 |
| morganfainberg | :P | 13:07 |
| * morganfainberg slides a soapbox back under the desk. | 13:07 | |
| ayoung | and after you've lived with the boot speedup for a while, you don't really want to go back | 13:07 |
| ayoung | um.. alo tactually | 13:07 |
| ayoung | morganfainberg, systemd, SELinux...all the things that people complain about from the Fedora side of the house, they are all addressing real issues. Its like X.org. Yeah, as the app user you don;'t want to have to know about these things, but you are feeling the pain | 13:09 |
| morganfainberg | SELinux i don't complain about | 13:09 |
| ayoung | morganfainberg, do you run with SELinux enabled? | 13:09 |
| morganfainberg | systemd is, imo the wrong approach | 13:09 |
| morganfainberg | ayoung: when I run RH-based linux, yes - provided i don't have a simple dev environment that doesn't need to care [e.g. devstack testing a keystone change] | 13:10 |
| morganfainberg | ayoung: but my throwaway devstacks tend to be ubuntu | 13:10 |
| ayoung | morganfainberg, work with systemd for a while. It is just different, but, really, it is just a codification or what people have developed as best practices in shell scripting systemV init, ported to a native library to speed up boot and to enforce the interface. All the issues we have with API stability in Keystone? The OS has that at the App layer. | 13:10 |
| morganfainberg | ayoung: I don't like that systemd has started consuming everything. | 13:11 |
| *** jsheeren has quit IRC | 13:11 | |
| morganfainberg | ayoung: I am fine with the signaling and other benefits it brings. but it shou;dn't be a massive monolithic-do-everything process [the way it's headed] | 13:11 |
| ayoung | morganfainberg, one thing that reading about systemd has me itching to do is to make a custome Socket factory for Java, that can open a socket as root on port 80 and pass it to a Systemd activated Tomcat instance | 13:11 |
| ayoung | I'm actually wondering if sssd should be rolled into systemd | 13:12 |
| morganfainberg | ayoung: god no | 13:12 |
| ayoung | morganfainberg, so you think customer process monitoring, once per problem domain is good? | 13:12 |
| ayoung | not the plugins...those stay as separate repos...systemd is the activation layer, with dbus the commo between them | 13:13 |
| morganfainberg | ayoung: I am of the view you should focus on doing something and doing it well especially at the OS level. not try to be everything for everyone | 13:13 |
| *** jsheeren has joined #openstack-keystone | 13:13 | |
| ayoung | morganfainberg, what are the aspects that you think systemd addresses that it should not? | 13:14 |
| morganfainberg | ayoung: right now, udev. | 13:14 |
| morganfainberg | ayoung: well udev + hard dep on kbus | 13:14 |
| morganfainberg | or headed that way | 13:14 |
| ayoung | that is Kernel, though. Systemd just consumes it | 13:14 |
| morganfainberg | ayoung: udev was moved into systemd, so now you're going to need systemd to use it. | 13:15 |
| morganfainberg | it's grabbing too much into a single space that is hard to work with | 13:15 |
| morganfainberg | anyway | 13:15 |
| ayoung | Um..I thought udevd was a separate prov\ces ,monitored by systemd? Is it not? | 13:15 |
| morganfainberg | ayoung: my concern is more that if we're not careful systemd turns issues with the system level into "only recourse is reboot" to address issues | 13:15 |
| ayoung | /usr/lib/systemd/systemd-udevd | 13:15 |
| morganfainberg | ayoung: systemd is going to be required in the near(ish) future from what i can tell to run udevd at all | 13:16 |
| ayoung | morganfainberg, looks like that is the case in Fedora | 13:16 |
| morganfainberg | ayoung: I aslo don't like that systemd and kernel are meant to be upgraded in lockstep | 13:16 |
| ayoung | ]$ rpmquery -f /usr/lib/systemd/systemd-udevd | 13:16 |
| ayoung | systemd-216-17.fc21.x86_64 | 13:16 |
| ayoung | Andy Tannenbaum is gloating | 13:16 |
| morganfainberg | anyway | 13:17 |
| * morganfainberg is not a fan of the direction systemd is headed. | 13:17 | |
| *** dims has quit IRC | 13:17 | |
| ayoung | I picture him sitting infront of a monitor, watching the Linux change sets, wearing a monicle and stroking a Persian Cat. | 13:17 |
| morganfainberg | probably | 13:17 |
| *** dims has joined #openstack-keystone | 13:18 | |
| ayoung | lbragstad, it is amazing how much that yaml file looks like the spec for an RPM | 13:21 |
| *** openstackgerrit has quit IRC | 13:21 | |
| *** openstackgerrit has joined #openstack-keystone | 13:22 | |
| samueldmq | morganfainberg, hi, in the case you didnt see yet, we already have n-net and neutron identity v3 jobs defined in tempest experimental queue | 13:22 |
| ayoung | marekd, I was trying the ecp code against Ipsilon late last week. Last thing I got was, when hitting (internal URL) http://ecp.cloudlab.freeipa.org:5000/v3/OS-FEDERATION/identity_providers/ipsilon/protocols/saml2/auth | 13:23 |
| samueldmq | morganfainberg, my approach now is to have such experimental job for devstack project, and then we can run it against your changes in devstack | 13:23 |
| ayoung | gets back | 13:23 |
| ayoung | <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> | 13:23 |
| ayoung | <html><head> | 13:23 |
| ayoung | <title>303 See Other</title> | 13:23 |
| ayoung | etc | 13:23 |
| ayoung | marekd, jdennis was looking at it. His last communique was: I just took a look at the Keystone ECP coded and it doesn't look like they are doing full ECP, rather it appears they are doing IdP initiated responses and only doing 1 step of the ECP process, returning a PAOS response. | 13:24 |
| marekd | ayoung: so it made a round trip: sp->idp->sp and with the 3rs step you got 303 ? | 13:24 |
| ayoung | marekd, I'm still trying to figure out how to get logging from the script. Not sure how many round trips... | 13:24 |
| marekd | ayoung: maybe log every http req/resp... | 13:25 |
| ayoung | marekd, can we do that by setting a config value in the script? Where was your code again, anyway? | 13:25 |
| marekd | ayoung: did jdennis look at https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/contrib/auth/v3/saml2.py#L88 ? | 13:26 |
| ayoung | marekd, I think he did. He was asking where the saml2 code is. We need to rpm package it still. | 13:26 |
| marekd | ayoung: i was using pdb and pure requests lib when i was debugging such flows | 13:26 |
| ayoung | ah | 13:27 |
| marekd | ayoung: the code was here https://gist.github.com/zaccone/9ff1f240b3d26eb0dcb7 | 13:28 |
| marekd | where can i talk with jdennis (channel e.g). | 13:28 |
| ayoung | marekd, ok, nothing different. | 13:28 |
| ayoung | marekd, he'll be here off and on...he's moving (Houses) and might still be getting his new setup finished | 13:29 |
| *** krykowski has quit IRC | 13:29 | |
| ayoung | he was a rock star last week...taking breaks at lunch and what not between the movers to keep me pointed in the right direction. I have a shell script he adapted from the shib code that shows that ECP works against Ipsilon, but now we need to close the gaps in assumptions between that and what the KC code does | 13:30 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 13:31 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Recursive deletion https://review.openstack.org/148730 | 13:31 |
| *** ajayaa has quit IRC | 13:32 | |
| *** mestery_ is now known as mestery | 13:32 | |
| *** pnavarro has quit IRC | 13:34 | |
| marekd | ayoung: nice. I will wait for him to appear here. | 13:38 |
| *** krykowski has joined #openstack-keystone | 13:38 | |
| marekd | I would like to know what he meant what's up with the KC code. | 13:38 |
| ayoung | marekd, yeah, I'm just learning ECP, but he's spent the past several weeks/months learning it | 13:42 |
| *** josecastroleon has quit IRC | 13:43 | |
| *** josecastroleon has joined #openstack-keystone | 13:44 | |
| *** morganfainberg has quit IRC | 13:44 | |
| *** xianghui has quit IRC | 13:45 | |
| *** fhubik is now known as fhubik_afk | 13:46 | |
| *** xianghui has joined #openstack-keystone | 13:46 | |
| -openstackstatus- NOTICE: gerrit has been restarted to clear a problem with its event stream. change events between 13:09 and 13:36 utc should be rechecked or have approval votes reapplied as needed to trigger jobs | 13:47 | |
| *** morganfainberg has joined #openstack-keystone | 13:47 | |
| *** ChanServ sets mode: +v morganfainberg | 13:47 | |
| *** henrynash has quit IRC | 13:47 | |
| marekd | ayoung: i found specs a little bit blurry. Like..you read tons of specs, profiles, parameters and end up with "okkkay, so how do I run this?". | 13:50 |
| ayoung | marekd, heh | 13:50 |
| *** fhubik_afk is now known as fhubik | 13:51 | |
| ayoung | marekd, I'll fpaste his spec temporarily. I don't think there is much issue with that, as it comes from the Shib repo, but he doesn | 13:51 |
| ayoung | 't want it posted for posterity | 13:51 |
| ayoung | there is a better version coming in straight python | 13:51 |
| marekd | ayoung: so wait, you claim that KC ECP code doesn't work with Ipsilon, whereas you have a working version of it? | 13:52 |
| * marekd just got confused | 13:53 | |
| ayoung | marekd, I have A shell script that tests the ECP workflow against ipsilon, not keystone | 13:55 |
| *** mkoderer has quit IRC | 13:55 | |
| ayoung | I have used the script to get a Keystone token | 13:55 |
| ayoung | so the issue is with the KC code, not Ipsilon, in my case | 13:55 |
| *** vishy has quit IRC | 13:55 | |
| marekd | ayoung: this is what i am asking about. | 13:55 |
| ayoung | it might be that Ipsilon 's ECP support is too stringent, or making a different assumption, than SHib was | 13:56 |
| ayoung | marekd, the shell script does command line curl | 13:56 |
| ayoung | marekd, easier for me to mail it to you. | 13:56 |
| marekd | ayoung: sure | 13:56 |
| marekd | marek.denis at cern . ch | 13:57 |
| ayoung | marekd, sent | 13:57 |
| *** mkoderer has joined #openstack-keystone | 13:57 | |
| *** vishy has joined #openstack-keystone | 13:58 | |
| ayoung | marekd, I don't yet have a public Ipsilon with ECP. I think I can update my younglogic one, though | 13:59 |
| *** joesavak has joined #openstack-keystone | 13:59 | |
| marekd | ayoung: i'd be happy to play with it | 14:00 |
| marekd | as long as i don't need to configure it :-) | 14:00 |
| *** edmondsw has joined #openstack-keystone | 14:02 | |
| ayoung | marekd, ok...RPMs are updated, but I think I need to make a change to the httpd config file...let | 14:02 |
| ayoung | 's see | 14:02 |
| *** richm has joined #openstack-keystone | 14:04 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:05 | |
| sigmavirus24 | morganfainberg: to be fair, I was distracting stevemar | 14:06 |
| marekd | ayoung: this script..it was written by jdennis? I think i'd seen something similar before. | 14:06 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Prohibit invalid ids in subtree and parents list https://review.openstack.org/158720 | 14:07 |
| *** Ephur has joined #openstack-keystone | 14:07 | |
| ayoung | marekd, nah, he adapted it from the shob code | 14:07 |
| ayoung | shib | 14:07 |
| marekd | ah, that you mean by saying shib code..... | 14:08 |
| ayoung | marekd, OK, I have it sort of running ...need to set up ca cert | 14:08 |
| *** fhubik is now known as fhubik_afk | 14:08 | |
| *** stevemar has joined #openstack-keystone | 14:10 | |
| *** ChanServ sets mode: +v stevemar | 14:10 | |
| marekd | ayoung: i don't say what sits in KC repo is perfect, but I was also kind of relying on what's provided in the shib reference. | 14:10 |
| marekd | ayoung: probably the best way is to talk with jdennis once he is online. | 14:11 |
| ayoung | marekd, yes. But let me try to get a public demo, so we can all confirm what works etc | 14:11 |
| marekd | ayoung: yep, happy to help | 14:12 |
| *** fhubik_afk is now known as fhubik | 14:13 | |
| *** davechen has joined #openstack-keystone | 14:13 | |
| davechen | dstanek: ping? | 14:15 |
| dstanek | davechen: pong | 14:16 |
| *** rushil has joined #openstack-keystone | 14:16 | |
| davechen | dstanek: just a quick question, will we support to run functional testing on the py27? | 14:16 |
| davechen | dstanek: I saw basepython is set to python3.4 in tox.ini, does that means only py3.4 will be supported? | 14:17 |
| dstanek | davechen: no, you must have py3.4 to run the functional tests | 14:18 |
| davechen | dstanek: any reason, I am curious about that :) | 14:18 |
| dstanek | davechen: we eventually want to move to py3 anyway - no reason to make it support py2 if developers should already have py3 | 14:18 |
| marekd | dstanek: with the advent of dropping eventlet (or eventlet supportinh py3 now) is it happening in L cycle? | 14:19 |
| dstanek | marekd: nope, this has nothing to do with what we have to support on the server side | 14:20 |
| dstanek | the functional tests will run in py3.4, but will hit what ever service you point to | 14:20 |
| davechen | dstanek: An, make sense. | 14:20 |
| dstanek | so you can run keystone in py2.7 or whatever and point the functional tests at it | 14:20 |
| marekd | dstanek: is it happening in next 6 months, then? ;) | 14:21 |
| dstanek | marekd: functional tests? | 14:21 |
| marekd | yes | 14:21 |
| dstanek | hopefully more of the patches will be merged in the next few weeks - some have already been merged | 14:21 |
| marekd | and py3 | 14:22 |
| davechen | eventually, we will drop py27 supporting even for unit test? | 14:22 |
| dstanek | marekd: i have a huge stream of work to get py3 going - probably 30 commits total - half of them were pushed on Friday and several merged over the weekend | 14:23 |
| dstanek | davechen: only when OpenStack stop supporting it - maybe 5+ years | 14:24 |
| dstanek | davechen: actually, probably longer | 14:24 |
| davechen | :-Dhope openstack is still alive then. | 14:24 |
| dstanek | we only recently dropped 2.6 and that was released more than a decade ago | 14:24 |
| dstanek | just remember that functional tests and unit tests are completely separate | 14:25 |
| dstanek | unit tests have to run in the versions of Python we officially support, whereas functional tests do not | 14:25 |
| davechen | but seems Keystoneclient still want to support py2.6 | 14:25 |
| davechen | I saw some comments told me about that. some patches is on the way. | 14:26 |
| dstanek | i wonder if the classifiers need to be updated - i thought that i removed some of the old 2.6 stuff from it | 14:26 |
| dstanek | davechen: yeah they don't test in 2.6 anymore | 14:27 |
| dstanek | morganfainberg: ^ see about about ksc and 2.6 | 14:27 |
| dstanek | jamielennox: ^ | 14:28 |
| davechen | +1, formal announcement maybe. | 14:28 |
| morganfainberg | Ksc needs to support 2.6. Keystone likely needs to update classifieds. | 14:29 |
| dstanek | morganfainberg: the classifiers say 2.6 so they're fine - we should be testing against 2.6 then right? | 14:29 |
| *** mattfarina has joined #openstack-keystone | 14:29 | |
| morganfainberg | For ksc, don't we still test 2.6? | 14:29 |
| openstackgerrit | Merged openstack/keystone-specs: Add spec for python-3 compatibility https://review.openstack.org/177380 | 14:30 |
| morganfainberg | For keystone, we don't need to test 2.6. It is no longer supported for the server. | 14:30 |
| marekd | dstanek: just in time regarding my question: https://review.openstack.org/#/c/177380/3/specs/liberty/python3.rst | 14:30 |
| morganfainberg | dstanek/davechen: looks like ksc still tests 2.6 | 14:32 |
| *** nkinder has joined #openstack-keystone | 14:33 | |
| *** ajayaa has joined #openstack-keystone | 14:33 | |
| marekd | morganfainberg: a question for you. In the KSC there is a stub class merged, yet out auth plugins (saml2 in particular) is not using. I would like to rename that class from federated to federation. Is it safe to do this without any mess with deprecations/warnings/ and all this stuff? Link : https://review.openstack.org/#/c/177704/ | 14:34 |
| morganfainberg | i'll need to think about that | 14:34 |
| davechen | morganfainberg: yeah, I saw gerrit still do that. | 14:34 |
| morganfainberg | marekd: it maaaaaaaaayyyy be ok | 14:35 |
| marekd | morganfainberg: it's not a super big deal, but since we all use federation module why not use federation also in ksc - and if i want to unify it i'd say the moment when we split repos, move modules, is the best one. | 14:35 |
| morganfainberg | it's probably ok | 14:35 |
| marekd | morganfainberg: if that's ok,please comment/vote. One thing I must already warn: all the modules in the ksc-saml2 will fail, because the new class is not in the codebase, so I think we would need to wait for the new ksc cut and only than ksc-saml2 modules will start pasing Jenkins. | 14:36 |
| morganfainberg | right | 14:37 |
| openstackgerrit | Victor Stinner proposed openstack/python-keystoneclient: Remove discover and iso8601 dependencies https://review.openstack.org/177687 | 14:37 |
| dstanek | morganfainberg: yes, just looked - we do have a 26 gate test :-) | 14:38 |
| *** browne has joined #openstack-keystone | 14:38 | |
| openstackgerrit | Victor Stinner proposed openstack/python-keystoneclient: Remove keystoneclient.middleware https://review.openstack.org/177694 | 14:42 |
| *** davechen has left #openstack-keystone | 14:43 | |
| *** krykowski has quit IRC | 14:48 | |
| *** ajayaa has quit IRC | 14:50 | |
| marekd | ayoung: why don't you give a try with Ipsilon/lasso ECP setup with that Python script: https://wiki.shibboleth.net/confluence/download/attachments/4358416/ecp.py?api=v2 ? | 14:52 |
| ayoung | marekd, I think that is what he started with. Not sure why it ended up as a bash script | 14:54 |
| ayoung | marekd, my Horizon setup is not behaving right now. Its a devstack, and my test env is RDO, so I suspect some wonkyness...not sure what | 14:55 |
| marekd | ayoung: i doubt you need horizon for ecp. | 14:56 |
| marekd | ayoung: you *don't want* horizon for ecp :P | 14:57 |
| ayoung | marekd, heh...I don't just it checks SAML, as a prereq...also I have both Horizon and Keystone on the same machine | 14:57 |
| ayoung | so when I say Horizon, I really mean the whole WebSSS | 14:57 |
| ayoung | SSo | 14:57 |
| *** mabrams has quit IRC | 15:00 | |
| *** zzzeek has joined #openstack-keystone | 15:00 | |
| *** henrynash has joined #openstack-keystone | 15:02 | |
| *** ChanServ sets mode: +v henrynash | 15:02 | |
| *** fhubik has quit IRC | 15:06 | |
| *** ajayaa has joined #openstack-keystone | 15:06 | |
| *** aix has quit IRC | 15:09 | |
| *** afazekas has quit IRC | 15:15 | |
| *** joesavak has quit IRC | 15:23 | |
| marekd | henrynash: I responded to the comment. But I'd value dstanek 's opinion on that as well: https://review.openstack.org/#/c/175980/2/keystone/contrib/federation/utils.py | 15:25 |
| marekd | henrynash: the rest of your comments is about right and I am going to fix it. | 15:25 |
| henrynash | marekd: sounds good….fyi, on that other patch to the protocol docstring | 15:26 |
| henrynash | marekd: is the “keystone service provider” the same as the “idenity provdier” or are they different? | 15:26 |
| stevemar | different | 15:27 |
| marekd | henrynash: they are differeent | 15:27 |
| marekd | keystone is the service provider | 15:27 |
| dstanek | marekd: is that error message happening when evaluating a user or when it's being added? | 15:27 |
| marekd | dstanek: it's part of the Mapping engine | 15:28 |
| henrynash | marekd: ok, so that protocol config option, is teh thing that the IDP and the keystone server must agree on…. | 15:28 |
| marekd | and mapping values from saml assertion into token data | 15:28 |
| marekd | henrynash: not in the 'protocol' case. Essentially, protocol is the parameter that will be used in the auth url: /OS-FEDERATION/identity_providers/{idp}/protocols/{protocol-values-from-parameter/auth | 15:29 |
| marekd | this bit is also configured at the keystone, so you, the client must provide one that is also configured at the remote keystone (service provider) of your choice | 15:30 |
| marekd | henrynash: so, if Keystone had protocol configured via our APIs called say...'some_proto', your clients will need to specify --os-federation-protocol='some_proto' | 15:31 |
| henrynash | ok, right got it | 15:31 |
| marekd | if that's not super clear from the help/docstring i'd be happy to see advices on how it should look like. | 15:32 |
| *** joesavak has joined #openstack-keystone | 15:32 | |
| henrynash | marekd: yeah, I still think that help text could be clearer…perhaps only because it seems a bit repetative….let me try a suggestion | 15:33 |
| henrynash | i’ll respond to the patch in a little while | 15:34 |
| henrynash | t | 15:34 |
| marekd | henrynash: please do | 15:34 |
| marekd | dstanek: re: https://review.openstack.org/#/c/175980/2/keystone/contrib/federation/utils.py : v.format() is used for filing {0}, {1} in the mapping rules. | 15:34 |
| marekd | so it's not when anything is added but it executes when user is authorizing. | 15:34 |
| marekd | sadly it's so deep in the Mapping Engine that I cannot even freely raise parameters like mapping_id or something like that. Yet, I am not so sure if exposing any values is acceptable and will not pose any security risks. | 15:36 |
| bknudson | morganfainberg: keystoneclient and keystonemiddleware stable/kilo release today? | 15:36 |
| morganfainberg | bknudson: that is the plan. | 15:37 |
| bknudson | great! | 15:37 |
| bknudson | need any help? | 15:37 |
| marekd | any chances that this would be merged and included in the release? https://review.openstack.org/#/c/177704/ | 15:37 |
| marekd | it'd make my life with ksc-saml2 easier | 15:38 |
| bknudson | marekd: the stable/kilo release? | 15:38 |
| marekd | if that's even possible | 15:38 |
| marekd | but i guess it's not. | 15:39 |
| marekd | :P | 15:39 |
| marekd | (always worth trying) | 15:39 |
| morganfainberg | bknudson: I just need to tag and push the tags. Will be done post lunch. | 15:40 |
| bknudson | I think the stable clients only get security fixes | 15:40 |
| morganfainberg | bknudson: it's about as much work as setting up someone else to do it. | 15:40 |
| morganfainberg | bknudson: security fixes or other critical bugs. | 15:40 |
| *** browne has quit IRC | 15:41 | |
| marekd | got it | 15:41 |
| bknudson | it sounds like they're not worried about keystonemiddleware not having the requirements update. | 15:42 |
| openstackgerrit | Victor Stinner proposed openstack/keystonemiddleware: Remove unused iso8601 dependency https://review.openstack.org/177831 | 15:43 |
| *** josecastroleon has quit IRC | 15:48 | |
| morganfainberg | bknudson: let me ping ttx on that. | 15:50 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Correctly handle direct mapping with keywords https://review.openstack.org/175980 | 15:50 |
| *** e0ne is now known as e0ne_ | 15:53 | |
| *** e0ne_ is now known as e0ne | 15:54 | |
| *** gyee has joined #openstack-keystone | 15:55 | |
| *** ChanServ sets mode: +v gyee | 15:55 | |
| *** henrynash has quit IRC | 15:58 | |
| *** browne has joined #openstack-keystone | 15:58 | |
| *** afazekas has joined #openstack-keystone | 16:00 | |
| *** david-ly_ is now known as david-lyle | 16:01 | |
| *** SpamapS has quit IRC | 16:12 | |
| *** tqtran has joined #openstack-keystone | 16:12 | |
| morganfainberg | bknudson: yep not a worry | 16:14 |
| morganfainberg | bknudson: spinning up everything for the release now. | 16:14 |
| *** alexsyip has joined #openstack-keystone | 16:18 | |
| *** lhcheng has joined #openstack-keystone | 16:18 | |
| *** ChanServ sets mode: +v lhcheng | 16:18 | |
| *** jsheeren has quit IRC | 16:19 | |
| *** lhcheng has quit IRC | 16:19 | |
| *** lhcheng has joined #openstack-keystone | 16:19 | |
| *** ChanServ sets mode: +v lhcheng | 16:19 | |
| morganfainberg | oh boy, have to rework all the tools for this release process now. | 16:19 |
| *** joesavak has quit IRC | 16:19 | |
| morganfainberg | bknudson: can you help me find the bugs for ksc that made it into stable/kilo, make sure they are targeted to kilo (as well as where they are) and the 1.3.1 milestone? | 16:20 |
| bknudson | morganfainberg: will do. | 16:20 |
| morganfainberg | thanks. i'm standing up the milestone(s) for middleware now | 16:20 |
| *** jistr has quit IRC | 16:21 | |
| *** esp has left #openstack-keystone | 16:23 | |
| bknudson | morganfainberg: there's only a couple of commits since the last tag, and only one fixes a bug: https://bugs.launchpad.net/keystonemiddleware/+bug/1411063 | 16:23 |
| openstack | Launchpad bug 1411063 in keystonemiddleware kilo "[OSSA 2015-007] S3token incorrect condition expression for ssl_insecure (CVE-2015-1852)" [Critical,Fix committed] - Assigned to Brant Knudson (blk-u) | 16:23 |
| bknudson | I marked it as fix committed. | 16:23 |
| morganfainberg | yeah i expect there to be very very few | 16:23 |
| bknudson | and, set target for keystoneclient - kilo to 1.3.1 | 16:23 |
| morganfainberg | yep. 1.5.1 for ksm should now be in LP | 16:24 |
| bknudson | it's the same for keystonemiddleware kilo, only the fix for that bug. | 16:25 |
| morganfainberg | ok cool | 16:25 |
| morganfainberg | justwasn't 100% sure | 16:25 |
| morganfainberg | bknudson: thnx for the help | 16:25 |
| *** _cjones_ has joined #openstack-keystone | 16:27 | |
| *** esp has joined #openstack-keystone | 16:28 | |
| *** gordc is now known as gordc_afk | 16:35 | |
| *** afazekas has quit IRC | 16:35 | |
| *** afazekas has joined #openstack-keystone | 16:36 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystonemiddleware: enforce endpoint constraint https://review.openstack.org/177661 | 16:41 |
| morganfainberg | ayoung: ping re- midcycle | 16:47 |
| morganfainberg | ayoung: status update tomorrow at the meeting but i'd like to get the venue pinned down so we can send out the midcycle email | 16:48 |
| *** afazekas has quit IRC | 16:52 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Remove keystoneclient.middleware https://review.openstack.org/177694 | 16:54 |
| samueldmq | ayoung, hi, need me to update all those dynamic policy specs ? | 16:55 |
| samueldmq | ayoung, actually I am officially allocated to work on this with you :) | 16:56 |
| *** vhoward has joined #openstack-keystone | 16:58 | |
| dstanek | hmmm...devstack master seems broken | 16:58 |
| samueldmq | dstanek, what's happening ? | 16:59 |
| samueldmq | dstanek, I ran into issues this weekend with it .. | 16:59 |
| samueldmq | dstanek, after deploying it, if I did 'sudo service apache2 restart', I got 500 from keystone oO | 16:59 |
| dstanek | 500 from keystone and it's log files are useless | 17:00 |
| samueldmq | dstanek, yeah, see ^ | 17:00 |
| *** afazekas has joined #openstack-keystone | 17:00 | |
| ayoung | morganfainberg, last week was April vacation in Mass,, and the person from BU that needed to do things was out. I'll check right now | 17:00 |
| samueldmq | dstanek, did you restart apache2? | 17:00 |
| ayoung | samueldmq, yes please | 17:00 |
| samueldmq | ayoung, nice, will do, starting on the Overview one now | 17:01 |
| ayoung | samueldmq, I'll work on the Hierarchical ones | 17:01 |
| samueldmq | ayoung, hierarchical roles, right ? | 17:01 |
| ayoung | feel free to touch up any of the others samueldmq | 17:01 |
| ayoung | samueldmq, yeah, Henrynash has some fundamental questions on that one | 17:01 |
| dstanek | samueldmq: no. i ran ./stack.sh and it failed | 17:01 |
| ayoung | samueldmq, the others are mostly details I think | 17:01 |
| samueldmq | dstanek, even worst than what I got | 17:01 |
| samueldmq | ayoung, yes I think too .. + the thing on fetching the policy on kc vs middleware | 17:02 |
| ayoung | samueldmq, yeah...some gremlins there. I would love to code up a proof-of-concept for that for Nova | 17:02 |
| ayoung | I think actually coding something there and showin the details would clarify a lot | 17:02 |
| samueldmq | ayoung, actually I was thinking hierarchical roles could be split from dynamic policies | 17:03 |
| ayoung | we can use the same cache directory approach as the certs for the first go-round | 17:03 |
| samueldmq | ayoung, I think dynamic comes from handling the policy via api right ? | 17:03 |
| ayoung | samueldmq, we need to address the scope of it. Let's have that on the agenda for tomorrow | 17:03 |
| samueldmq | ayoung, nice, I also had such discussion with henrynash | 17:04 |
| samueldmq | ayoung, perfect, let's discuss it tomorrow | 17:04 |
| ayoung | ++ | 17:04 |
| dstanek | samueldmq: i see the 500 in the access log, but nothing in the key.log | 17:04 |
| samueldmq | ayoung, I am going to add the point | 17:04 |
| samueldmq | dstanek, import controllers ? | 17:04 |
| samueldmq | dstanek, for me, it couldn't import keystone.assignment.controllers from keystone.assignment.__init__ | 17:04 |
| samueldmq | dstanek, somehting like this ... | 17:05 |
| samueldmq | iirc | 17:05 |
| samueldmq | dstanek, oh! I was seeing on the keystone one, let me retrieve it for you | 17:05 |
| dstanek | samueldmq: i can import assignment ok | 17:06 |
| dstanek | it seems that most of the keystone requests were fine - there were just a few PUTs that failed and devstack didn't start | 17:07 |
| samueldmq | dstanek, http://paste.openstack.org/show/208618/ | 17:07 |
| samueldmq | dstanek, I was getting this ^ and I did no change on the keystone code | 17:08 |
| samueldmq | I got scaried | 17:08 |
| mfisch | anyone seen this before? | 17:08 |
| mfisch | 2015-04-27 17:06:52.104 31328 TRACE sqlalchemy.pool.QueuePool ProgrammingError: (2014, "Commands out of sync; you can't run this command now") | 17:08 |
| mfisch | seems scary | 17:08 |
| mfisch | and I know that tokens are 2x slower here than in my other region | 17:08 |
| *** ericksonsantos has joined #openstack-keystone | 17:09 | |
| *** joesavak has joined #openstack-keystone | 17:09 | |
| *** spandhe has joined #openstack-keystone | 17:09 | |
| *** samleon has joined #openstack-keystone | 17:14 | |
| *** EmilienM is now known as EmilienM|afk | 17:17 | |
| *** afazekas has quit IRC | 17:18 | |
| *** kiran-r has quit IRC | 17:19 | |
| *** e0ne has quit IRC | 17:21 | |
| *** henrynash has joined #openstack-keystone | 17:30 | |
| *** ChanServ sets mode: +v henrynash | 17:30 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 17:34 |
| *** mattfarina has quit IRC | 17:34 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Dual Scoped Token https://review.openstack.org/176054 | 17:35 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 17:36 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Recursive deletion https://review.openstack.org/148730 | 17:36 |
| *** joesavak has quit IRC | 17:41 | |
| ericksonsantos | dstanek, lhcheng, ping about that: https://review.openstack.org/#/c/158372/ | 17:41 |
| samueldmq | lhcheng, ping - you aroung ? need to talk about your comment on the 'dynamic policy' spec | 17:41 |
| samueldmq | lhcheng, https://review.openstack.org/#/c/147651/3/specs/backlog/dynamic-policy.rst | 17:41 |
| ericksonsantos | I've just replied your comments. | 17:42 |
| *** henrynash has quit IRC | 17:46 | |
| samueldmq | ayoung, just to confirm, we want all this dynamic policy stuff for L, right ? | 17:49 |
| ayoung | samueldmq, as much as possible, yes | 17:50 |
| ayoung | samueldmq, but lets focus on getting it approved in backlog | 17:50 |
| samueldmq | ayoung, ++ | 17:50 |
| *** joesavak has joined #openstack-keystone | 17:50 | |
| ayoung | moving from backlog to L is easy once it is approved | 17:50 |
| samueldmq | nie | 17:50 |
| samueldmq | nice* | 17:50 |
| samueldmq | ayoung, I have some questions on the spec .... https://review.openstack.org/#/c/147651/3/specs/backlog/dynamic-policy.rst | 17:51 |
| ayoung | samueldmq, fire away | 17:51 |
| samueldmq | ayoung, great! so first thte Other End User Impact section | 17:52 |
| *** harlowja_away is now known as harlowja_ | 17:52 | |
| samueldmq | ayoung, you want to add apis to, based on a token, return a list of operations that token can perform ? | 17:52 |
| ayoung | samueldmq, did you see my policy CLI? | 17:52 |
| samueldmq | ayoung, not yet ... sorry | 17:53 |
| ayoung | 1sec I'll link | 17:53 |
| samueldmq | ayoung, where can I find it ? | 17:53 |
| samueldmq | k | 17:53 |
| ayoung | samueldmq, https://review.openstack.org/#/c/170978/ | 17:53 |
| ayoung | so, think in terms of "we have this policy, what can we do with it" | 17:53 |
| ayoung | horizon already has some of this, as Lin points out. Perhaps we move that code to the policy library | 17:54 |
| samueldmq | ayoung, nice it tests the token ... | 17:54 |
| ayoung | samueldmq, yeah, that rule is essential for refactoring a policy file: make sure I have not broken anything | 17:54 |
| ayoung | samueldmq, the Kent folks have the databsse stuff working ,but it needs Python3. We just chatted, and maybe we push to make policy its own endpoint | 17:55 |
| samueldmq | ayoung, k .. what if we stored *role X* can do *actions i,j,k* instead of *actions i,j,k*: *role X etc* | 17:56 |
| samueldmq | ayoung, we could get the list of actions for a given role more directly | 17:57 |
| ayoung | samueldmq, I've thought that several times. It would be cleaner | 17:58 |
| samueldmq | ayoung, instead of going through all APIs and asking if a role can do that, we index by the role | 17:58 |
| samueldmq | ayoung, ++ | 17:58 |
| ayoung | samueldmq, it would be easier, I think, for people to maintain that way..but the database can do that. Maybe what we do is have an alternative policy format that reverses things, once we have the DB support | 17:59 |
| samueldmq | ayoung, yes and we would have the right answer for 'what this role can do ?' , and would help to get a atrue RBAC | 17:59 |
| samueldmq | ayoung, ++ great I agree, just would like to sync things with u | 17:59 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Prohibit invalid ids in subtree and parents list https://review.openstack.org/158720 | 18:00 |
| samueldmq | ayoung, hmm .. btw, this way we described above, it's like having 'capabilities' as an attribute of a 'role' right ? | 18:01 |
| ayoung | samueldmq, yes...I think that is accurate | 18:01 |
| samueldmq | ayoung, and could be /roles/xpto?capabilities | 18:01 |
| samueldmq | ayoung, and we could add capabilities to a role by the API, as we do for grouping | 18:01 |
| ayoung | samueldmq, I know that Kent folks are coming up with a fine grained API. | 18:02 |
| *** gordc_afk is now known as gordc | 18:02 | |
| ayoung | I suspect it is along those lines, lets catch up wioth them tomorrow as well | 18:02 |
| samueldmq | ayoung, ++ | 18:02 |
| samueldmq | ayoung, I will make a new patch set of the overview spec and will ping you to have a look at | 18:03 |
| samueldmq | ayoung, I also see the introduction needs to be clearer ... anyway will do and you review it | 18:03 |
| ayoung | samueldmq, thanks a lot | 18:04 |
| samueldmq | ayoung, np | 18:04 |
| *** kiran-r has joined #openstack-keystone | 18:04 | |
| *** EmilienM|afk is now known as EmilienM | 18:06 | |
| *** josecastroleon has joined #openstack-keystone | 18:18 | |
| *** ajayaa has quit IRC | 18:20 | |
| dstanek | mfisch: i know i've seen people in here talk about it, but i'm not sure what it is | 18:26 |
| *** kiran-r has quit IRC | 18:29 | |
| samueldmq | when was the current policy mechanism introduced ? | 18:31 |
| samueldmq | the beginning of openstack a few years ago ? | 18:31 |
| marekd | ayoung: specs currently sitting in backlock are should be reviewed now? | 18:38 |
| marekd | ayoung: like https://review.openstack.org/#/c/134656/5/specs/backlog/policy-unified.rst | 18:38 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 18:38 |
| ayoung | marekd, yes. one advantage of using backlog is the specs don't need to be -2ed to be frozen when we hit spec freeze | 18:42 |
| *** e0ne has joined #openstack-keystone | 18:46 | |
| *** josecastroleon has quit IRC | 18:48 | |
| *** ajayaa has joined #openstack-keystone | 18:54 | |
| *** arif-ali has joined #openstack-keystone | 18:57 | |
| ayoung | morganfainberg,from Orran Krieger: "I think its fine to say planning on BU. From my chat with Cheryl, it shouldn’t be a problem. " | 18:57 |
| morganfainberg | ayoung: ok | 19:01 |
| *** Ephur has quit IRC | 19:01 | |
| *** ajayaa has quit IRC | 19:02 | |
| *** dguerri is now known as _dguerri | 19:11 | |
| *** _cjones_ has quit IRC | 19:17 | |
| *** _dguerri is now known as dguerri | 19:17 | |
| *** amakarov is now known as amakarov_away | 19:19 | |
| dstanek | samueldmq: so, what's weird is that if i start devstack with key,mysql services it's fine - add my usual list and it's broken, add just glance and it's broken | 19:24 |
| *** joesavak has quit IRC | 19:28 | |
| samueldmq | dstanek, hmm, any thought why that's happening ? | 19:28 |
| samueldmq | dstanek, did you ask people on #qa if there is any known issue | 19:28 |
| dstanek | i'm trying again with just key,mysql to see if i can replicate success again - this i'll know if this issue is real | 19:31 |
| morganfainberg | dstanek: dependency resolution? | 19:31 |
| morganfainberg | dstanek: also are the upstream gate jobs failing? | 19:31 |
| *** dguerri is now known as _dguerri | 19:32 | |
| dstanek | i don't think it's that because i get a few 500s from keystone and devstack fails to start | 19:33 |
| morganfainberg | dstanek: weird | 19:33 |
| morganfainberg | dstanek: are we seeing this in the upstream devstack setup? | 19:34 |
| morganfainberg | dstanek: also 14.04? | 19:34 |
| morganfainberg | or cent? or fedora? | 19:34 |
| dstanek | morganfainberg: i was on 14.04 - starting a fedora20 vm right now to test | 19:36 |
| morganfainberg | hm | 19:36 |
| samueldmq | ayoung, ping - on the policy overview, I need to make something clearer | 19:37 |
| samueldmq | ayoung, For example, we could distinguish between actions that can only read state from those that can change it: "Observer" and "Editor" Member would inherit editor, and editor would inherit observer. | 19:37 |
| samueldmq | ayoung, what would be the right inheritance logic ? | 19:38 |
| samueldmq | ayoung, just editor inherit observer ? | 19:38 |
| ayoung | samueldmq, what you have there: if -> means inherits all operations then | 19:38 |
| ayoung | member->editor->observer | 19:38 |
| ayoung | samueldmq, I hate the term inherits | 19:39 |
| ayoung | I like to think in terms of sets | 19:39 |
| samueldmq | ayoung, yeah, so lets implement sets of roles :p | 19:39 |
| ayoung | the editor set contains all elements of the observer set | 19:39 |
| samueldmq | ayoung, I am ttossing role groups on you :p | 19:39 |
| ayoung | samueldmq, I said I would take that one | 19:40 |
| samueldmq | ayoung, great, I will wait for tomorrow's meeting ,when we will agree on all this :) | 19:40 |
| ayoung | heh | 19:40 |
| samueldmq | o/ | 19:40 |
| stevemar | dstanek, o/ | 19:40 |
| dstanek | stevemar: o/ | 19:41 |
| stevemar | dstanek, can you take a look at: https://review.openstack.org/#/c/177620/ | 19:41 |
| samueldmq | dstanek, will try to reproduce the issue on my pc | 19:41 |
| dstanek | stevemar: sure | 19:42 |
| samueldmq | dstanek, ubuntu 14.04.2 | 19:42 |
| *** _cjones_ has joined #openstack-keystone | 19:43 | |
| dstanek | stevemar: neat | 19:43 |
| dstanek | samueldmq: something like that | 19:44 |
| samueldmq | ayoung, also, we will need a tool for migrating the existing policies to the new mechanism right ? | 19:44 |
| samueldmq | ayoung, I will add a point for this | 19:44 |
| stevemar | dstanek, i just need someone to make sure i'm not thinking crazy things here | 19:45 |
| ayoung | samueldmq, possibly.I think the Kent mechanism might cover that | 19:45 |
| samueldmq | ayoung, great, I will add a point to this ... making sure we are caring about the existing deployments | 19:46 |
| ayoung | samueldmq, rock on | 19:46 |
| dstanek | stevemar: that doesn't look crazy | 19:48 |
| dstanek | stevemar: jenkins doesn't seem to love you | 19:48 |
| stevemar | \o/ | 19:48 |
| stevemar | i just rechecked, there was a 404 error in downloading a requirement | 19:48 |
| stevemar | maybe i should add another argument? one for tox -e <arg> ? | 19:49 |
| stevemar | i'm assuming sample_config, but i think nova uses tox -e genconf or something | 19:50 |
| samueldmq | stevemar, btw, nice patch! I will take a deeper look on it later, so I can learn how to introduce a completely new job :) | 19:51 |
| stevemar | dstanek, it's passing now | 19:53 |
| openstackgerrit | Erickson Filipe Guedes dos Santos proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 19:54 |
| stevemar | samueldmq, just throw some stuff up and hope it works | 19:55 |
| samueldmq | stevemar, yeah it will o/ | 19:58 |
| *** joesavak has joined #openstack-keystone | 20:04 | |
| samueldmq | dstanek, mine is failing randomly | 20:07 |
| samueldmq | dstanek, wget localhost:5000/v2.0 | 20:07 |
| samueldmq | dstanek, alternating from 500 and 200 | 20:07 |
| samueldmq | lol | 20:07 |
| samueldmq | dstanek, just deployed and ran wget | 20:07 |
| dstanek | samueldmq: nice | 20:10 |
| ayoung | lbragstad, if you look here: https://github.com/nkinder/rdo-vm-factory/blob/master/rdo-federation-setup/vm-post-cloud-init-rdo.sh#L58 you can see what to add to your deployment in order to get WebSSO and Federation | 20:13 |
| lbragstad | ayoung: sweet! | 20:13 |
| samueldmq | dstanek, not nice hehe | 20:16 |
| samueldmq | :p | 20:16 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 20:19 |
| *** _dguerri is now known as dguerri | 20:20 | |
| samueldmq | morganfainberg, so it should be openstack-infra/devstack-gate who should deploy devstack and then disable it after that ? | 20:24 |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/177232 | 20:25 |
| openstackgerrit | David J Hu proposed openstack/keystone: Version independent token issuance pipeline https://review.openstack.org/150629 | 20:27 |
| morganfainberg | samueldmq: devstack needs to learn how to disable v2 | 20:27 |
| morganfainberg | samueldmq: then it should be signaled from ds-gate to do that | 20:27 |
| samueldmq | morganfainberg, yeah we define a flag on the job definition | 20:28 |
| samueldmq | morganfainberg, and the flag is read at devstack-gate, which will deploy devstack and tehn disable v2 (since we cannot disable v2 by default on devstack, right) ? | 20:28 |
| morganfainberg | samueldmq: yep | 20:28 |
| morganfainberg | samueldmq: so ds-gate takes the flag and makes sure the ENV is passed down to devstack | 20:29 |
| samueldmq | morganfainberg, ah | 20:29 |
| samueldmq | morganfainberg, so devstack reads on what ds-gate tells it, and decide to deploy v2 or not based on that | 20:29 |
| morganfainberg | yeah | 20:29 |
| samueldmq | morganfainberg, ah sorry for not getting this earlier, I am still getting familiar with all this :) | 20:30 |
| morganfainberg | samueldmq: don't be sorry :) most of us only know this cause we have dealt with it | 20:30 |
| samueldmq | morganfainberg, hehe o/ | 20:31 |
| samueldmq | morganfainberg, do you have a patch for your devstack changes already? | 20:31 |
| morganfainberg | samueldmq: I do have a partial one | 20:32 |
| morganfainberg | samueldmq: just at a conference atm | 20:32 |
| morganfainberg | samueldmq: so that is somewhat on hold for today/tomorrow/wed | 20:32 |
| samueldmq | morganfainberg, great, I will be taking a look on how things happen on infra more deeply | 20:33 |
| samueldmq | morganfainberg, and working with ayoung on the dynamic policy specs while you get that | 20:33 |
| samueldmq | morganfainberg, thanks | 20:33 |
| morganfainberg | :) | 20:33 |
| * morganfainberg is looking at SCIM | 20:35 | |
| morganfainberg | it's very interesting | 20:35 |
| *** samleon has quit IRC | 20:37 | |
| *** dguerri is now known as _dguerri | 20:39 | |
| *** _dguerri is now known as dguerri | 20:39 | |
| marekd | morganfainberg: SCIM: System for Cross-domain Identity Management ? | 20:45 |
| morganfainberg | marekd: yeah | 20:45 |
| marekd | morganfainberg: a promising SAML replacement? | 20:46 |
| morganfainberg | marekd: looks more like managing the actual identity data | 20:47 |
| marekd | morganfainberg: pity | 20:47 |
| *** tqtran has quit IRC | 20:48 | |
| *** turul has joined #openstack-keystone | 20:51 | |
| *** turul is now known as afazekas | 20:52 | |
| stevemar | morganfainberg, which conference you at? | 20:58 |
| morganfainberg | stevemar: Internet2 | 20:59 |
| stevemar | ah | 20:59 |
| *** jimbaker has joined #openstack-keystone | 21:04 | |
| *** thinrichs has joined #openstack-keystone | 21:07 | |
| thinrichs | Anyone have 2 minutes to answer a question about the keystone python client? | 21:09 |
| *** stevemar has quit IRC | 21:10 | |
| morganfainberg | dstanek: ping | 21:15 |
| morganfainberg | lhcheng: ping | 21:16 |
| lhcheng | morganfainberg: pong | 21:16 |
| *** joesavak has quit IRC | 21:17 | |
| *** gyee has quit IRC | 21:20 | |
| lhcheng | samueldmq: ping | 21:21 |
| *** thinrichs has left #openstack-keystone | 21:26 | |
| *** alexsyip has quit IRC | 21:28 | |
| *** alexsyip has joined #openstack-keystone | 21:31 | |
| *** vhoward has quit IRC | 21:41 | |
| *** vhoward has joined #openstack-keystone | 21:42 | |
| *** rushil has quit IRC | 21:53 | |
| *** gordc has quit IRC | 21:56 | |
| *** bknudson has quit IRC | 22:03 | |
| *** e0ne has quit IRC | 22:05 | |
| *** alexsyip has quit IRC | 22:06 | |
| *** vhoward has quit IRC | 22:09 | |
| *** vhoward has joined #openstack-keystone | 22:10 | |
| *** vishy has quit IRC | 22:17 | |
| *** cyeoh has quit IRC | 22:17 | |
| *** cyeoh has joined #openstack-keystone | 22:19 | |
| *** vishy has joined #openstack-keystone | 22:20 | |
| *** Ephur has joined #openstack-keystone | 22:22 | |
| dstanek | morganfainberg: pong | 22:31 |
| morganfainberg | dstanek: hmm had a question. Now I spaced on it. | 22:31 |
| dstanek | morganfainberg: haha, ok. i just got back from dinner so i'll be around for a while | 22:31 |
| morganfainberg | I'm about to head out for dinner :P | 22:32 |
| *** jaosorior has quit IRC | 22:32 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:33 | |
| *** _cjones_ has quit IRC | 22:42 | |
| *** _cjones_ has joined #openstack-keystone | 22:48 | |
| openstackgerrit | David J Hu proposed openstack/python-keystoneclient: Access Info Formatter https://review.openstack.org/177997 | 22:50 |
| *** spandhe has quit IRC | 22:56 | |
| *** _cjones_ has quit IRC | 23:00 | |
| *** drjones has joined #openstack-keystone | 23:01 | |
| *** spandhe has joined #openstack-keystone | 23:04 | |
| *** drjones has quit IRC | 23:06 | |
| *** spandhe has quit IRC | 23:09 | |
| *** _cjones_ has joined #openstack-keystone | 23:18 | |
| *** zzzeek has quit IRC | 23:19 | |
| *** zzzeek has joined #openstack-keystone | 23:19 | |
| *** _cjones_ has quit IRC | 23:23 | |
| *** _cjones_ has joined #openstack-keystone | 23:25 | |
| *** Ephur has quit IRC | 23:41 | |
| *** dims has quit IRC | 23:46 | |
| *** alexsyip has joined #openstack-keystone | 23:47 | |
| *** _cjones_ has quit IRC | 23:54 | |
| *** rushil has joined #openstack-keystone | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!