| *** arif-ali has quit IRC | 00:00 | |
| *** arif-ali has joined #openstack-keystone | 00:04 | |
| *** markvoelker has quit IRC | 00:12 | |
| *** setmason has joined #openstack-keystone | 00:16 | |
| *** gyee has quit IRC | 00:18 | |
| *** arunkant_ has quit IRC | 00:22 | |
| *** emagana has quit IRC | 00:25 | |
| *** gyee has joined #openstack-keystone | 00:25 | |
| *** ChanServ sets mode: +v gyee | 00:25 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Update testing keystone2keystone doc https://review.openstack.org/186395 | 00:28 |
|---|---|---|
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add "enabled" to create service provider example https://review.openstack.org/186402 | 00:28 |
| *** setmason_ has joined #openstack-keystone | 00:39 | |
| *** dsirrine has quit IRC | 00:40 | |
| *** setmason has quit IRC | 00:41 | |
| *** setmason_ is now known as setmason | 00:41 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 00:41 | |
| *** dims_ has quit IRC | 00:42 | |
| *** dims_ has joined #openstack-keystone | 00:47 | |
| *** mdrnstm has joined #openstack-keystone | 00:48 | |
| *** mdrnstm is now known as Guest723 | 00:48 | |
| *** tobe has joined #openstack-keystone | 00:52 | |
| *** Guest723 has quit IRC | 00:55 | |
| *** dsirrine has joined #openstack-keystone | 00:55 | |
| *** browne has quit IRC | 00:56 | |
| *** _cjones_ has quit IRC | 01:00 | |
| *** gokrokve has joined #openstack-keystone | 01:03 | |
| openstackgerrit | ayoung proposed openstack/keystone: IAM Models https://review.openstack.org/184651 | 01:06 |
| *** ayoung has joined #openstack-keystone | 01:08 | |
| *** ChanServ sets mode: +v ayoung | 01:08 | |
| *** markvoelker has joined #openstack-keystone | 01:13 | |
| *** markvoelker has quit IRC | 01:18 | |
| *** gokrokve has quit IRC | 01:20 | |
| *** gokrokve has joined #openstack-keystone | 01:20 | |
| *** tobe has quit IRC | 01:22 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Simplified template for backlog items. https://review.openstack.org/171226 | 01:22 |
| *** davechen has joined #openstack-keystone | 01:22 | |
| davechen | stevemar, dolphm: ping? | 01:24 |
| *** gokrokve has quit IRC | 01:25 | |
| davechen | stevemar, dolphm: may i ask you a question, pls? | 01:25 |
| *** alanf-mc has quit IRC | 01:25 | |
| openstackgerrit | ayoung proposed openstack/oslo.policy: Convert Exceptions to failures. https://review.openstack.org/165908 | 01:26 |
| samueldmq | davechen, just ask, then when they are available they may see and reply you | 01:28 |
| samueldmq | davechen, also; someone else may have the answer you are looking for :) | 01:28 |
| openstackgerrit | ayoung proposed openstack/oslo.policy: Convert Exceptions to failures. https://review.openstack.org/165908 | 01:29 |
| davechen | samueldmq, stevemar, dolphm: yep, I just not quite understand about the default scope, per my understanding, it maybe equivalent to unscoped in the context of get a token. | 01:31 |
| *** emagana has joined #openstack-keystone | 01:32 | |
| openstackgerrit | ayoung proposed openstack/keystone: default policy https://review.openstack.org/140113 | 01:33 |
| davechen | I am trying to understand the inline comment in this patch: https://review.openstack.org/#/c/186310/1/doc/source/api_curl_examples.rst, the CURL request is acutally for a unscoped token, so we will not get some service catalog in the response, is that true? | 01:33 |
| *** dims_ has quit IRC | 01:35 | |
| *** setmason_ has joined #openstack-keystone | 01:36 | |
| davechen | maybe I miss something, but I checked with that request, there is indeed no service catalog returned, so I am not quite understand why I need add service catalog back, stevemar and dolphm, pls drop by if you saw these message. :) | 01:36 |
| samueldmq | davechen, I am not aware what the 'default scope' said there means ... for me there scoped tokens (you specify the scope); otherwise they are unscoped | 01:37 |
| samueldmq | davechen, I am not sure what default scope means in that context | 01:37 |
| davechen | me either, so I am thinking whether it is an accurate desc. | 01:38 |
| *** setmason has quit IRC | 01:39 | |
| *** setmason_ is now known as setmason | 01:39 | |
| davechen | what's default scope means? | 01:39 |
| samueldmq | davechen, regardless the scope, I think the service catalog may be present, i.e the services that are available and you could use | 01:39 |
| *** dims_ has joined #openstack-keystone | 01:39 | |
| samueldmq | davechen, so I agree the service catalog should be there, as stated by them | 01:39 |
| jamielennox | davechen: so there is such a thing (unfortunately) as a default_project for users | 01:39 |
| jamielennox | so that if they request a token with no scoping information then it will automatically scope to that project | 01:39 |
| jamielennox | this may be how you are seeing a service catalog when you don't expect one | 01:40 |
| samueldmq | jamielennox, oh that makes sense | 01:40 |
| davechen | samueldmq: i don't think so, if it's unscoped token, there will not be *project* or *domain* associated, where i can get the service catalog? | 01:41 |
| samueldmq | jamielennox, can a service catalog be present in an unscoped token ? | 01:41 |
| davechen | samueldmq: just try the CURL provided in the example, and check the source, you will see what i am trying to do :) | 01:41 |
| jamielennox | samueldmq: there was a spec i wrote to do that - but for now no | 01:41 |
| samueldmq | davechen, ^ | 01:41 |
| samueldmq | jamielennox, k thanks | 01:42 |
| *** lhcheng has quit IRC | 01:43 | |
| jamielennox | davechen: i haven't heard it said as "default scope" before, but i'm thinking it's the same as scoped to the default project, in which case there is a service catalog | 01:43 |
| jamielennox | davechen: to get that response when you create a user add --default-project <id> to your command line and you will see the difference | 01:43 |
| davechen | jamielennox: yes, I haven't heard too. | 01:43 |
| davechen | jamielennox: cool, I will try it, thx. | 01:44 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Hierarchical Roles https://review.openstack.org/125704 | 01:45 |
| *** dims_ has quit IRC | 01:45 | |
| davechen | jamielennox: I can understand default-project, but still not default scope, for me, it seems like unscoped actually. | 01:46 |
| ayoung | davechen, unscoped tokens return no service catalog. Only scoped tokens return a service catalog | 01:46 |
| jamielennox | davechen: so having a default project means you will get a scoped catalog by default | 01:47 |
| davechen | ayoung: yes, so this is what i am trying to fix the doc, the doc is not accurate, since there is service catalog returned with the unscoped token. | 01:47 |
| jamielennox | davechen: the token you refer to is not unscoped | 01:47 |
| jamielennox | i can see the project value in there - id=default | 01:48 |
| davechen | jamielennox: sure, so what about the default scoped, shall we return service catalog for such a *default* scope? | 01:48 |
| jamielennox | ah, oops - id=some uuid, name=admin | 01:48 |
| jamielennox | davechen: i think you are overthinking the concept of default scoped | 01:48 |
| davechen | jamielennox: I think so. :P | 01:48 |
| samueldmq | davechen, default scope = user's default-project scope (if there is one, otherwise, unscoped) | 01:49 |
| samueldmq | jamielennox, is this accurate ? ^ | 01:49 |
| jamielennox | it's purely a keystone server concept, if a user requests a token and they don't specify a project then keystone will set the project to the default one from the user data and then proceed exactly the same if the user had asked for a project scoped token | 01:49 |
| ayoung | the correct term is "token scoped to the users default project" | 01:49 |
| jamielennox | ayoung: ++ | 01:49 |
| samueldmq | ayoung, ++ | 01:49 |
| davechen | ayoung: ++ | 01:49 |
| dolphm | davechen: if you give the user a default project ID, you'll get service catalog back in response to the example request | 01:49 |
| ayoung | We need a karmabot | 01:50 |
| * ayoung now has 3 points of karma | 01:50 | |
| jamielennox | ayoung: you think you'd be positive? | 01:50 |
| dolphm | lol | 01:50 |
| ayoung | jamielennox, yes, as I implmenet a bot that can't go negative, just bottoms out at zero | 01:50 |
| ayoung | you notice I asssumed I was starting from 0 | 01:51 |
| samueldmq | hehehe | 01:51 |
| davechen | dolphm: emm, so if I give a default project ID for the user, and not specify the project information in the CURL reuqest, I will still get the service catalog returned? | 01:51 |
| davechen | dolphm: I will have a try. | 01:52 |
| *** tobe has joined #openstack-keystone | 01:52 | |
| *** bradjones has quit IRC | 01:52 | |
| dolphm | davechen: correct | 01:53 |
| dolphm | davechen: you also have to explicitly assign that user a role on the project, but then you'll get a complete scoped token | 01:53 |
| ayoung | rpmquery -a | wc -l | 01:53 |
| ayoung | 3880 | 01:53 |
| ayoung | gah | 01:53 |
| ayoung | need to remove something before upgradeing to f22 | 01:53 |
| davechen | dolphm: i miss that part, thx. | 01:53 |
| *** Qiming has joined #openstack-keystone | 01:54 | |
| jamielennox | ayoung: f21 made a mess for me, i'm a little nervous about f22 | 01:54 |
| ayoung | jamielennox, I'm expecting trouble. Used to it | 01:54 |
| ayoung | I've found getting rid of as many RPMS as possible before the upgrade will help | 01:55 |
| ayoung | especailly all the new ones that our team has been developing, as I suspect I installed a few out of COPRs | 01:55 |
| ayoung | this time, I also plan on making sure my /lib/python does not have pip installed files | 01:56 |
| ayoung | that really messed me up last time | 01:56 |
| jamielennox | yea, i try to limit coprs and installing things via pip etc | 01:56 |
| jamielennox | right, pip overriding system packages is a disaster | 01:56 |
| *** bradjones has joined #openstack-keystone | 01:56 | |
| Qiming | gyee, around? | 01:56 |
| jamielennox | but it takes a few weeks to get like spotify working again | 01:56 |
| *** emagana has quit IRC | 01:57 | |
| *** emagana has joined #openstack-keystone | 01:58 | |
| ayoung | I'm doing google play. $10/month, and I've yet to come across an album they don't have | 01:58 |
| ayoung | It will kill the music industry and crush the artists, but most of the artists I like are already dead | 01:58 |
| jamielennox | they're all the same price - but i will switch to the first one that does proper DLNA support | 02:00 |
| jamielennox | stupid spotify connect reimplements a complete industry standard so that it will only work on new, certain branded speakers | 02:00 |
| jamielennox | </rant> | 02:00 |
| *** csoukup has joined #openstack-keystone | 02:01 | |
| davechen | ayoung: funny, these artists die too early. | 02:02 |
| ayoung | davechen, not all of them. Sonny Rollins is still alive and kicking. | 02:03 |
| davechen | ayoung: I am also a fun of old songs and old artists. | 02:03 |
| *** zzzeek has quit IRC | 02:04 | |
| samueldmq | ayoung, tomorrow I will update the overview spec | 02:06 |
| samueldmq | ayoung, and we can struggle to get that in | 02:06 |
| ayoung | samueldmq, thanks. MAybe this time people will realize it is an overview | 02:07 |
| samueldmq | ayoung, so people will start looking at the individual specs | 02:07 |
| samueldmq | ayoung, ++ | 02:07 |
| samueldmq | ayoung, I will also start the fetch policy based on endpoint url | 02:07 |
| samueldmq | ayoung, did you get dolphm 's toughts on that ? | 02:07 |
| ayoung | dolphm, we had a discussion earlier today about fetching policy for an endpoint. morganfainberg stated (firmyl) that he wanted it fetched based on the endpoint's URL, not the enpoint ID. Do you have an opinion? I can see his point, and am willing to implement, but I'd rather we hash out the decision now | 02:08 |
| ayoung | samueldmq, right there with you | 02:08 |
| samueldmq | ayoung, nice | 02:09 |
| samueldmq | ayoung, btw that should be only changing the GET policy right ? | 02:09 |
| dolphm | an endpoint is more likely to know it's own URL than it's keystone-assigned ID, so that makes sense to me | 02:09 |
| samueldmq | ayoung, or should we enable all the CRUD by url ? | 02:09 |
| dolphm | less fussy configuration for sure | 02:09 |
| ayoung | dolphm, that is what we figured, and the cms would know the url ahead of time, too | 02:09 |
| ayoung | so it could put it the url in the config file so the endpoint knows its own before any call to keystone | 02:10 |
| ayoung | dolphm, OK, so last question is the URL to fetch it. Suggesting in a couple seconds... | 02:10 |
| ayoung | if we were keeping the endpoint_policy in an extension, we'd put the url in the extension, but now it is in the main keystone routes | 02:11 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3.rst#n5365 is GET /policy | 02:11 |
| ayoung | but it is followed by an id, I was thinking: | 02:11 |
| ayoung | GET /policies?url=<endpointurl> | 02:12 |
| dolphm | like, GET /v3/policies?endpoint_url={encoded_url} ? | 02:12 |
| ayoung | dolphm, ^^ sound about right? | 02:12 |
| ayoung | yeah | 02:12 |
| dolphm | :) | 02:12 |
| ayoung | samueldmq, and there you have it | 02:12 |
| dolphm | seems natural to have it as an attribute of a policy | 02:13 |
| samueldmq | dolphm, do you have an oracle ? | 02:13 |
| samueldmq | :-) | 02:13 |
| ayoung | samueldmq, nah, I've just learned to think like dolph from time to time | 02:13 |
| dolphm | +1 | 02:13 |
| samueldmq | cool, I will be observing from now, maybe I can learn too | 02:14 |
| ayoung | "for all our mutual experience our separate conclusions are the same" Billy Joel, Summer, Highland Falls | 02:14 |
| samueldmq | :) | 02:14 |
| samueldmq | ayoung, so it will just be adding an optional query parameter to http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3.rst#n5319 | 02:15 |
| samueldmq | ayoung, am I right ? and the other operations (CUD) won't be affected | 02:16 |
| *** dsirrine has quit IRC | 02:20 | |
| *** kiran-r has joined #openstack-keystone | 02:20 | |
| ayoung | samueldmq, well, from an API perspective, it is a new API, as /policies does not currently return anything. the api is /policies/<id> today | 02:20 |
| ayoung | but beyond that, yeah, not other changes | 02:20 |
| ayoung | should be only one new function in the controller | 02:20 |
| samueldmq | ayoung, /policies does | 02:20 |
| * ayoung goes to confirm assumptions | 02:20 | |
| samueldmq | ayoung, look at the example http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3.rst#n5319 | 02:20 |
| ayoung | ah, right, it lists the policies | 02:21 |
| samueldmq | ayoung, yeah, and that's what we wnat to do, applying a new filter :) | 02:21 |
| ayoung | OK, even simpler | 02:21 |
| samueldmq | ayoung, yeah :D | 02:21 |
| samueldmq | ayoung, and everybody should be happy with it | 02:22 |
| samueldmq | ayoung, btw, should a cms be able to POST a policy based on the URL ? | 02:23 |
| ayoung | samueldmq, I don't think so | 02:23 |
| samueldmq | ayoung, it is deploying the cloud , it knows the urls/services .. should be in the same path | 02:23 |
| ayoung | nah, policeis are assigned to endpoints via a different mechanism. See the endpoint_policy spec | 02:24 |
| ayoung | But there it would need to know the endpoint id, and that is probably beyond the scope of this here | 02:24 |
| ayoung | I would expect a cms to maybe post the default policy, but not a per-endpoint policy | 02:24 |
| *** rwsu has quit IRC | 02:25 | |
| samueldmq | ayoung, k, let' keep it simple and implement the fetch thing | 02:25 |
| ayoung | ++ | 02:25 |
| samueldmq | ayoung, if there are any request for that in the future, we then implement :) | 02:25 |
| samueldmq | requests* | 02:26 |
| ayoung | samueldmq, in general, the goal is for endpoints to be able to fetch by their own identity, but we can assign either a default or a per-service policy file, as well as an endpoint specific policy file | 02:26 |
| samueldmq | ayoung, yeah I understand, that's important to the ksmiddleware | 02:26 |
| samueldmq | ayoung, which will have access to the endpoint's URL which it's serving | 02:27 |
| ayoung | right on | 02:27 |
| samueldmq | ayoung, and ask keystone for the right policy | 02:27 |
| samueldmq | ayoung, and ksmiddleware will get that from a confg file :) | 02:27 |
| ayoung | dolphm, was there any reason you did not implement a "default" when doing endpoint_policy? | 02:27 |
| samueldmq | ayoung, I think I got that o/ | 02:27 |
| ayoung | was it just that we had not good example of a policy file that we could return for all services yet? The need for the unified policy file? | 02:29 |
| stevemar | morganfainberg, ready for slide making soon!? | 02:30 |
| dstanek | dolphm: ayoung: just catching up - also i don't think the templated catalog had ids for endpoints | 02:30 |
| ayoung | dstanek, yeah, of course. Good point | 02:30 |
| *** setmason has quit IRC | 02:31 | |
| morganfainberg | stevemar: doing a meetup thing for a few more minutes but will be soon. | 02:32 |
| dolphm | dstanek: oh true | 02:34 |
| dolphm | dstanek: i think it *should* but even if it did, they wouldn't be consistent | 02:34 |
| stevemar | morganfainberg, cool cool, finishing up a few things myself | 02:36 |
| samueldmq | dolphm, why a fernet token is considered too long if it has lenght > 255, and not > 256? | 02:38 |
| samueldmq | dolphm, sorry it can be a dumb question | 02:39 |
| ayoung | samueldmq, needs to fit in the index field of a database table | 02:40 |
| ayoung | 255 is max | 02:40 |
| samueldmq | ayoung, I was supposing an offset ... at least assuming its minimal length is 1 | 02:41 |
| dstanek | ayoung: why? they aren't persisted | 02:42 |
| samueldmq | ayoung, so that 1-256 in that case | 02:42 |
| ayoung | dstanek, not in Keystone they aren't, but they might be elsewhere | 02:42 |
| ayoung | it's a goal to make them small enough to fit in those fields | 02:42 |
| ayoung | that was why that particular number | 02:43 |
| dstanek | ah, that makes sense | 02:43 |
| samueldmq | hmmm, yes | 02:45 |
| samueldmq | thanks | 02:45 |
| *** samueldmq has quit IRC | 02:53 | |
| *** spandhe has quit IRC | 02:56 | |
| *** kiran-r has quit IRC | 02:56 | |
| *** kiran-r has joined #openstack-keystone | 02:57 | |
| lbragstad | we knew that they needed to be small but we also weren't sure if we could get them around 100 characters... 255 seems like a reasonable limit too | 02:57 |
| lbragstad | (hence some of the tricks to save space) | 02:58 |
| *** mdrnstm has joined #openstack-keystone | 03:01 | |
| *** ChanServ sets mode: +v mdrnstm | 03:01 | |
| gyee | Qiming, yes | 03:01 |
| mdrnstm | stevemar: oh hai | 03:02 |
| *** markvoelker has joined #openstack-keystone | 03:02 | |
| gyee | mdrnstrm, what did you do to morganfainberg? | 03:02 |
| ayoung | lbragstad, you probably did not implement the binding portion of the token, did you? The thing that says a token can only be used with a specific X509 or Kerberos Principal? | 03:02 |
| *** spandhe has joined #openstack-keystone | 03:02 | |
| mdrnstm | gyee: shhhh | 03:02 |
| * mdrnstm is hiding | 03:02 | |
| Qiming | hi, gyee, could you help point me to a sample test case how a policy.json entry change should be tested | 03:02 |
| lbragstad | ayoung: checking the code | 03:03 |
| *** kiran-r has quit IRC | 03:03 | |
| gyee | Qiming, one sec | 03:03 |
| ayoung | lbragstad, I don't see how you could have. I would have to e in the signed body of the token | 03:03 |
| rodrigods | lbragstad, commented in the fernet size change, just suggested to make a clearer commit message and add a comment in the check | 03:03 |
| lbragstad | ayoung: yeah, you're right https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/core.py#L49-L52 | 03:04 |
| *** _cjones_ has joined #openstack-keystone | 03:04 | |
| ayoung | lbragstad, good enough | 03:04 |
| gyee | Qiming, see this patch, https://review.openstack.org/#/c/164848/ | 03:04 |
| ayoung | lbragstad, someday tokens will go away. | 03:04 |
| Qiming | gyee, thanks, will check | 03:04 |
| gyee | Qiming, test_policy.py and test_v3_protection.py | 03:04 |
| *** _cjones_ has quit IRC | 03:05 | |
| Qiming | got it, gyee | 03:05 |
| *** _cjones_ has joined #openstack-keystone | 03:05 | |
| mdrnstm | stevemar: ok here now | 03:06 |
| mdrnstm | stevemar: sitting around the meetup and looking at the slides | 03:06 |
| *** gyee is now known as operator99 | 03:06 | |
| *** markvoelker has quit IRC | 03:06 | |
| mdrnstm | stevemar: i'll get the extra diagram for the internal Keystone architecture diagram tonight | 03:07 |
| mdrnstm | stevemar: since i just had to draw some of that up | 03:07 |
| rodrigods | mdrnstm, stevemar another talk already? | 03:09 |
| *** someara2 has joined #openstack-keystone | 03:11 | |
| mdrnstm | rodrigods: yep | 03:11 |
| mdrnstm | rodrigods: actually a number of talks :P | 03:11 |
| rodrigods | where? | 03:11 |
| mdrnstm | rodrigods: Cloud Identity Summit, OpenStack CEE, and some others | 03:11 |
| rodrigods | mdrnstm, cool! :) | 03:12 |
| * rodrigods still catching up with the presentations of the summit | 03:12 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Log warning for Fernet tokens over 255 chars https://review.openstack.org/186396 | 03:13 |
| lbragstad | rodrigods: ^ done, thanks for the review! | 03:14 |
| mdrnstm | jamielennox: when do you want to do the next KSA release? | 03:14 |
| rodrigods | lbragstad, thanks! | 03:14 |
| jamielennox | mdrnstm: i was going to start seeing what the ksc on ksa patches look like, what fixes are required | 03:14 |
| mdrnstm | jamielennox: would a 0.2.0 with current stateof the repo make sense? | 03:15 |
| mdrnstm | for this integration - things have moved a fair bit since the 0.1.0 | 03:15 |
| jamielennox | mdrnstm: sure - doesn't make much difference to me yet | 03:15 |
| mdrnstm | ok let me drop a 0.2.0 in | 03:15 |
| stevemar | mdrnstm, lookin' now | 03:16 |
| mdrnstm | jamielennox: tagged | 03:17 |
| mdrnstm | 0.2.0 released | 03:17 |
| mdrnstm | jamielennox: for the next one i'm going to get us moved to the keystoneauth1 package | 03:17 |
| mdrnstm | and get the virtual package (keystoneauth) spun up. | 03:18 |
| *** liusheng has quit IRC | 03:27 | |
| marekd | dolphm: i haven't yet. (re:Fernet) | 03:27 |
| mdrnstm | stevemar: what tool did you use to make the images in the presenation ? | 03:28 |
| stevemar | mdrnstm, i used inkspace | 03:29 |
| stevemar | inkscape* | 03:29 |
| mdrnstm | stevemar: ahh ok | 03:29 |
| mdrnstm | yeah i have inkscape | 03:29 |
| stevemar | let me send you the file i have saved | 03:30 |
| *** someara2 has quit IRC | 03:30 | |
| mdrnstm | nice | 03:30 |
| mdrnstm | that'll help some | 03:30 |
| stevemar | done | 03:31 |
| mdrnstm | stevemar: thnx | 03:32 |
| *** someara2 has joined #openstack-keystone | 03:34 | |
| ayoung | mdrnstm, stevemar you can automate the conversion of inkscape files to png if you need to | 03:39 |
| ayoung | %.eps: %.svg | 03:40 |
| ayoung | inkscape -z -f $< -D --export-area-snap -E $@ | 03:40 |
| *** _cjones_ has quit IRC | 03:40 | |
| ayoung | ^^ for example that come out of the makefile I used for the latex based presentation | 03:40 |
| *** someara2 has quit IRC | 03:40 | |
| ayoung | I'm actually working on an internal talk for our support folks for the 16th. I might steal some of your slides. | 03:41 |
| *** someara2 has joined #openstack-keystone | 03:42 | |
| *** Qiming_ has joined #openstack-keystone | 03:43 | |
| *** Qiming has quit IRC | 03:43 | |
| *** Qiming__ has joined #openstack-keystone | 03:44 | |
| *** Qiming__ is now known as Qiming | 03:44 | |
| *** someara2 has quit IRC | 03:46 | |
| *** Qiming_ has quit IRC | 03:47 | |
| *** someara2 has joined #openstack-keystone | 03:57 | |
| mdrnstm | ayoung: of course. happy to have you steal slides | 03:57 |
| * mdrnstm is hoping to really get to spend some time with the slides next week to do another round of polish | 03:58 | |
| mdrnstm | but... | 03:58 |
| mdrnstm | done is often "good enough" | 03:58 |
| ayoung | mdrnstm, I'm repurposing a few of my own from a year or so back | 03:59 |
| ayoung | HIJ was past present and future then | 04:00 |
| *** setmason has joined #openstack-keystone | 04:00 | |
| ayoung | mdrnstm, your presentation is basically "what is keystone" right? | 04:01 |
| mdrnstm | ayoung: uhmm... | 04:01 |
| mdrnstm | ayoung: a bit more nuts and bolts but yes | 04:02 |
| ayoung | My slide decks are all here http://adam.younglogic.com/presentations/ | 04:02 |
| mdrnstm | ayoung: next week going to refloat the idea of getting us official publications | 04:02 |
| *** markvoelker has joined #openstack-keystone | 04:02 | |
| ayoung | feel free to snag any, or let me know if you want any of the slides there in some other format | 04:03 |
| mdrnstm | ayoung: cool. | 04:03 |
| mdrnstm | will check them out | 04:03 |
| mdrnstm | thnx | 04:03 |
| ayoung | I like the sequence diagram I did for token auth in the dynamic policy one. USed a python tool... | 04:03 |
| ayoung | the source was very simple | 04:03 |
| ayoung | http://interactive.blockdiag.com/seqdiag/?compression=deflate&src=eJx1Uk1PAjEQvfMrGk6QgAvoQYNLYgJ61ERvYkjpzrINTbu2ZSMSEu_-S3-Js7vdD9ilp7bz3sx7M2PgM-B0Qw4dkp0AQroTdhUqaQ3_BuKTyWjqgiamchUB30QW_8f47wI0jt2NCQ7SuodUCS0QOxtZtQVZ4DC_VkKAdh9ryjAauFesBGd799jC3lgloVaNDGeuFHkXdA0C9XQRFPfubh_mj4u_n99-92N6IirlFKkcy---PL--keTaS_V5mUDT4N0Pm7wM2lYh9Xya3UsmV2NvKQ3oBLTBW65xNMcrZZarWqKMjmnKfpW5GBWiwlXxNldPi8zUuZ-K1GaJMgbGEC5DdaFONbQLqmoAhLuRlt | 04:06 |
| ayoung | gQLItIbr6Vg6rOOXnTlvLAAz9nHlup_sztTMkE9KEZ9FIQfNkByVs9IJbqDdj-hba0eNRgYoXjO5sSgptTamKrJTpZjcnopqYANzqtnUOnnWPnHxWEF_s | 04:06 |
| ayoung | hmm, let me tinyurl that | 04:06 |
| ayoung | mdrnstm, stevemar http://tinyurl.com/q8sp6q7 | 04:07 |
| mdrnstm | ayoung: darn irc with message length! | 04:07 |
| mdrnstm | ayoung: ok that is a cool tool | 04:07 |
| mdrnstm | very cool | 04:07 |
| ayoung | mdrnstm, there are other diagram types there, too | 04:07 |
| mdrnstm | sequence diagrams are awesome | 04:07 |
| ayoung | if you tool around with that "other diagram type" dropdown in the top right | 04:07 |
| *** markvoelker has quit IRC | 04:07 | |
| ayoung | I liked the seq diagrams from that best, used latex library for UML, and some inkscape for freehand drawings | 04:08 |
| ayoung | ah, and I used dia for the diagram that explained HTM. It just came out cleaner. | 04:10 |
| *** someara2 has quit IRC | 04:10 | |
| *** iamjarvo has joined #openstack-keystone | 04:14 | |
| stevemar | ayoung, pretty neat guy | 04:14 |
| ayoung | stevemar, thanks | 04:14 |
| ayoung | as I said, let me know if you want any of them. | 04:15 |
| ayoung | Beamer and latex for presentations work very nicely | 04:15 |
| mdrnstm | stevemar: ok i need to jump off being asked keystone questions cause i am at this meetup-y thin | 04:17 |
| mdrnstm | g | 04:17 |
| mdrnstm | stevemar: will continue with diagrams and such tonight | 04:17 |
| mdrnstm | hope to have k2k and keystone internal architecture done by then | 04:17 |
| stevemar | mdrnstm, i fully intend on continuing tonight | 04:17 |
| stevemar | until most of it is done | 04:18 |
| mdrnstm | stevemar: i might need wine or whisky tonight to complete it | 04:18 |
| mdrnstm | because i also need to do expense reports | 04:18 |
| stevemar | i'll need tea or coffee | 04:18 |
| mdrnstm | irish coffee! | 04:18 |
| mdrnstm | ;) | 04:18 |
| mdrnstm | bbib | 04:18 |
| mdrnstm | bbiab* | 04:18 |
| stevemar | i *tried* to do my ERs but .... hotel wasn't on my amex yet :( | 04:18 |
| *** mdrnstm has quit IRC | 04:18 | |
| stevemar | stupid lack of next-day transaction | 04:18 |
| ayoung | ok, rebooting to upgrade. wish me luck | 04:21 |
| *** ayoung has quit IRC | 04:21 | |
| *** _cjones_ has joined #openstack-keystone | 04:37 | |
| *** setmason has quit IRC | 04:48 | |
| *** setmason has joined #openstack-keystone | 04:50 | |
| *** tobe has quit IRC | 04:52 | |
| *** _cjones_ has quit IRC | 04:53 | |
| *** _cjones_ has joined #openstack-keystone | 04:53 | |
| *** _cjones_ has quit IRC | 04:54 | |
| *** nikil22 has joined #openstack-keystone | 05:05 | |
| nikil22 | hi how to enable https in keystone ? I did [ssl] enable=true in keystone.conf. Is there anything else we have to do? | 05:06 |
| stevemar | nikil22, are you using devstack to deploy? | 05:08 |
| stevemar | it has to be done at deployment, or else all your endpoints are going to be messed up | 05:08 |
| nikil22 | +stevemar: I am trying in Redhat 7.0 with juno | 05:09 |
| nikil22 | +stevemar during deployment i did not enable any ssl options | 05:10 |
| *** iamjarvo has quit IRC | 05:10 | |
| nikil22 | +stevemar , now i just enabled ssl in keyston.conf and restarted the services and tried the cli command it througs me error "SSL exception connecting to https:/MY-IP" | 05:11 |
| *** tobe has joined #openstack-keystone | 05:14 | |
| stevemar | nikil22, are you running keystone under apache or with eventlet? | 05:16 |
| nikil22 | +stevemar : how to check if it is with apache or eventlet ? In keystone.conf in comments i see "eventlet" | 05:19 |
| *** lhcheng has joined #openstack-keystone | 05:22 | |
| *** ChanServ sets mode: +v lhcheng | 05:22 | |
| *** kiran-r has joined #openstack-keystone | 05:23 | |
| stevemar | nikil22, check where your apache or httpd server is running and see if there is a keystone.conf file? what do the keystone logs say? if you're running keystone under apache it should be much easier to enable ssl | 05:23 |
| nikil22 | +stevemar yes apache is running but in keystone.log i do see some error related to eventlet , "http://paste.openstack.org/show/243978/" | 05:31 |
| *** lhcheng_ has joined #openstack-keystone | 05:32 | |
| stevemar | that error shows that your keystone is already running | 05:33 |
| stevemar | and you are trying to start it by doing $keystone-all | 05:33 |
| stevemar | let apache start the process instead | 05:33 |
| nikil22 | +stevemar : yes i changed enable = True under [ssl] in keyston.conf and restarted the service | 05:34 |
| nikil22 | +stevemar so first i have to stop keystone all service? then start keyston with apache? | 05:34 |
| stevemar | don't restart the service with $keystone-all, thats only related to eventlet | 05:34 |
| stevemar | just restart your webserver | 05:34 |
| stevemar | $service apache restart (or whatever you are using) | 05:34 |
| *** lhcheng has quit IRC | 05:36 | |
| stevemar | then add the appropriate SSL config entries to your keystone vhost file under apache | 05:36 |
| stevemar | https://developer.rackspace.com/blog/configure-keystone-apache/ | 05:36 |
| stevemar | #SSLEngine on | 05:36 |
| stevemar | #SSLCertificateFile /etc/ssl/certs/mycert.pem | 05:36 |
| stevemar | #SSLCertificateKeyFile /etc/ssl/private/mycert.key | 05:36 |
| stevemar | #SSLVerifyClient optional | 05:36 |
| *** setmason_ has joined #openstack-keystone | 05:40 | |
| *** setmason has quit IRC | 05:43 | |
| *** rushiagr_away is now known as rushiagr | 05:44 | |
| *** setmason_ has quit IRC | 05:46 | |
| *** tobe has quit IRC | 05:47 | |
| *** markvoelker has joined #openstack-keystone | 05:52 | |
| nikil22 | +stevemar : i don't see any vhost file in /etc/httpd folder also httpd.conf i see the port only for 80 and there is no " #Listen 5000" in the config file. So sitll i am first not clear does keystone server is using apache or not | 05:53 |
| nikil22 | +stevemar : Is there any config option in keyston.conf where i should change to apache ? | 05:54 |
| *** markvoelker has quit IRC | 05:56 | |
| *** browne has joined #openstack-keystone | 05:58 | |
| *** kiran-r has quit IRC | 05:58 | |
| *** csoukup has quit IRC | 06:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/186279 | 06:06 |
| *** spandhe has quit IRC | 06:07 | |
| *** tobe has joined #openstack-keystone | 06:15 | |
| *** raghava has joined #openstack-keystone | 06:32 | |
| stevemar | morganfainberg, allo? | 06:33 |
| morganfainberg | stevemar: just finished food. Looking at diagrams now. | 06:37 |
| morganfainberg | Been a long day. | 06:37 |
| stevemar | i hear ya :( | 06:39 |
| stevemar | i have something more or less working for the authN bits | 06:39 |
| stevemar | just needs to be tighter | 06:39 |
| *** dguerri`away is now known as dguerri | 06:41 | |
| openstackgerrit | Qiming Teng proposed openstack/keystone: Enable service role to list/get users https://review.openstack.org/181298 | 06:42 |
| *** e0ne has joined #openstack-keystone | 06:42 | |
| *** ajayaa has joined #openstack-keystone | 06:43 | |
| stevemar | morganfainberg, i like your comments | 06:46 |
| morganfainberg | stevemar: thought you would | 06:46 |
| *** dguerri is now known as dguerri`away | 06:46 | |
| *** e0ne has quit IRC | 06:49 | |
| stevemar | morganfainberg, we're almost done-ish | 06:50 |
| morganfainberg | yah trying to figure out the *best* way to show the keystone architecture | 06:50 |
| morganfainberg | i think i'm going to highligh the key backends | 06:50 |
| *** woodster_ has quit IRC | 06:50 | |
| stevemar | morganfainberg, did you want to expand on the 'future' section? or just speak to the points? | 06:51 |
| morganfainberg | identity, resource, assignment, assignment.roles, etc | 06:51 |
| morganfainberg | stevemar: i'll probably expand a little | 06:51 |
| stevemar | i also don't know jack about CORS, so i'm going to nuke that part | 06:51 |
| morganfainberg | CORS = browser lets user access things from <not this specific host> | 06:51 |
| morganfainberg | it is just a way to break the "everything from one place" lockin | 06:51 |
| morganfainberg | the wikipage is more than you need to know to talk about it | 06:52 |
| morganfainberg | the server sends headers browser has to^w^wshould obey headers. no extra security is conveyed | 06:52 |
| *** lhcheng_ has quit IRC | 07:00 | |
| *** kiran-r has joined #openstack-keystone | 07:04 | |
| *** dguerri`away is now known as dguerri | 07:07 | |
| *** dguerri is now known as dguerri`away | 07:08 | |
| *** davechen has left #openstack-keystone | 07:10 | |
| *** davechen has joined #openstack-keystone | 07:11 | |
| morganfainberg | oh i see a henrynash | 07:11 |
| morganfainberg | and an operator99 | 07:12 |
| morganfainberg | oh ha nice gyee. | 07:12 |
| henrynash | hi | 07:12 |
| morganfainberg | henrynash: hows the new home? | 07:12 |
| * morganfainberg pokes at stevemar with a stick. | 07:12 | |
| henrynash | morganfainberg: excellen, thanks | 07:12 |
| morganfainberg | henrynash: great to hear! | 07:13 |
| morganfainberg | henrynash: i mean... we're not all jealous or anything :P | 07:13 |
| *** spandhe has joined #openstack-keystone | 07:13 | |
| stevemar | henrynash, !! | 07:14 |
| henrynash | stevemar, morganfainberg: :-) | 07:14 |
| *** spandhe_ has joined #openstack-keystone | 07:16 | |
| stevemar | henrynash, did you look into hotels for nice yet? | 07:16 |
| *** spandhe has quit IRC | 07:19 | |
| *** spandhe_ is now known as spandhe | 07:19 | |
| *** pnavarro has joined #openstack-keystone | 07:23 | |
| *** henrynash has quit IRC | 07:29 | |
| *** rlt_ has joined #openstack-keystone | 07:38 | |
| *** jistr has joined #openstack-keystone | 07:38 | |
| *** markvoelker has joined #openstack-keystone | 07:40 | |
| *** markvoelker has quit IRC | 07:45 | |
| *** pnavarro has quit IRC | 07:46 | |
| *** stevemar has quit IRC | 07:55 | |
| *** BrAsS_mOnKeY has quit IRC | 07:56 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: `api_curl_examples.rst` is out of date https://review.openstack.org/186310 | 08:02 |
| *** dguerri`away is now known as dguerri | 08:04 | |
| *** g2` has joined #openstack-keystone | 08:06 | |
| *** dims_ has joined #openstack-keystone | 08:12 | |
| *** dims_ has quit IRC | 08:18 | |
| *** tobe has quit IRC | 08:23 | |
| *** tobe has joined #openstack-keystone | 08:29 | |
| *** spandhe has quit IRC | 08:32 | |
| *** fhubik has joined #openstack-keystone | 08:47 | |
| *** davechen has left #openstack-keystone | 08:55 | |
| *** bdossant has joined #openstack-keystone | 08:58 | |
| *** fhubik is now known as fhubik_afk | 09:01 | |
| *** markvoelker has joined #openstack-keystone | 09:29 | |
| *** markvoelker has quit IRC | 09:34 | |
| *** fhubik_afk is now known as fhubik | 09:34 | |
| *** aix has joined #openstack-keystone | 09:41 | |
| *** fhubik has quit IRC | 09:41 | |
| *** fhubik has joined #openstack-keystone | 09:41 | |
| *** browne has quit IRC | 09:43 | |
| *** browne has joined #openstack-keystone | 09:43 | |
| *** dims_ has joined #openstack-keystone | 09:51 | |
| *** Qiming has quit IRC | 10:03 | |
| *** afazekas has joined #openstack-keystone | 10:12 | |
| *** samueldmq has joined #openstack-keystone | 10:30 | |
| samueldmq | morning | 10:30 |
| marekd | hey | 10:31 |
| *** henrynash has joined #openstack-keystone | 10:45 | |
| *** ChanServ sets mode: +v henrynash | 10:45 | |
| *** dims_ has quit IRC | 10:52 | |
| *** aix has quit IRC | 10:54 | |
| samueldmq | hmmm ... /whois operator99 | 10:59 |
| samueldmq | [operator99] is logged in as gyee | 10:59 |
| samueldmq | hehe :) | 10:59 |
| *** markvoelker has joined #openstack-keystone | 11:18 | |
| *** markvoelker has quit IRC | 11:22 | |
| openstackgerrit | Nikita Konovalov proposed openstack/python-keystoneclient: Fix logging of binray contentent in request https://review.openstack.org/183514 | 11:33 |
| *** tobe has quit IRC | 11:39 | |
| *** aix has joined #openstack-keystone | 11:45 | |
| *** fhubik is now known as fhubik_afk | 11:46 | |
| *** dims_ has joined #openstack-keystone | 11:50 | |
| *** rushiagr is now known as rushiagr_away | 11:50 | |
| kragniz | is there a link to the design summit etherpads around? | 11:52 |
| dims_ | kragniz: wiki.openstack.org/wiki/Summit/Liberty/Etherpads | 11:57 |
| kragniz | dims_: yeah, but the keystone section is empty :( | 11:59 |
| *** nikil22 has quit IRC | 11:59 | |
| dims_ | duh! sorry | 11:59 |
| *** markvoelker has joined #openstack-keystone | 11:59 | |
| kragniz | that's okay! | 12:00 |
| dims_ | kragniz: there are links off of this gist which seem to have some etherpads with info - https://gist.github.com/dstanek/fa40364d5c13657d61c7 | 12:02 |
| *** kiran-r has quit IRC | 12:05 | |
| *** kiran-r has joined #openstack-keystone | 12:05 | |
| *** aix has quit IRC | 12:06 | |
| kragniz | dims_: thanks, that lead to the one I think I was looking for | 12:06 |
| kragniz | keystone people, is the keystoneauth library likely to get to a 1.0.0 release in L? | 12:08 |
| *** aix has joined #openstack-keystone | 12:08 | |
| *** tobe has joined #openstack-keystone | 12:13 | |
| *** tobe has quit IRC | 12:14 | |
| *** fhubik_afk is now known as fhubik | 12:15 | |
| *** kiran-r has quit IRC | 12:16 | |
| dstanek | kragniz: that gist unfortunately only has some | 12:22 |
| dstanek | i hope that we were able to pull the non-OpenStack etherpad content back in | 12:22 |
| *** fhubik is now known as fhubik_afk | 12:30 | |
| *** fhubik_afk is now known as fhubik | 12:31 | |
| *** bdossant_ has joined #openstack-keystone | 12:33 | |
| *** bdossant has quit IRC | 12:35 | |
| *** ayoung has joined #openstack-keystone | 12:36 | |
| *** ChanServ sets mode: +v ayoung | 12:36 | |
| *** Guest66545 has joined #openstack-keystone | 12:37 | |
| samueldmq | morganfainberg, let me know if you need someone to feed https://wiki.openstack.org/wiki/Design_Summit/Liberty/Etherpads#Keystone | 12:37 |
| *** ChanServ sets mode: +v Guest66545 | 12:37 | |
| samueldmq | morganfainberg, I can do that later today | 12:37 |
| samueldmq | ayoung, good morning | 12:37 |
| *** jsavak has joined #openstack-keystone | 12:38 | |
| openstackgerrit | Louis Taylor proposed openstack/keystoneauth: Remove i18n stub https://review.openstack.org/186748 | 12:39 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Update testing keystone2keystone doc https://review.openstack.org/186395 | 12:42 |
| *** rushiagr_away is now known as rushiagr | 12:43 | |
| *** woodster_ has joined #openstack-keystone | 12:50 | |
| *** gsilvis has quit IRC | 12:50 | |
| *** radez_g0n3 is now known as radez | 12:54 | |
| *** afaranha has quit IRC | 12:56 | |
| *** henrynash has quit IRC | 12:58 | |
| *** afaranha has joined #openstack-keystone | 12:59 | |
| *** afaranha has left #openstack-keystone | 12:59 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:01 | |
| samueldmq | ayoung, hello, I'd like to talk about how often the ksmiddleware will ask keystone for the service's policy and update it (as a file for now, as we defined for this first step) | 13:02 |
| openstackgerrit | Louis Taylor proposed openstack/keystoneauth: Remove i18n stub https://review.openstack.org/186748 | 13:03 |
| openstackgerrit | Phil Hopkins proposed openstack/keystone: updates sample_data script to use the new openstack commands https://review.openstack.org/186560 | 13:03 |
| ayoung | samueldmq, configurable timeout, like the certificates | 13:03 |
| ayoung | cache for one minute by default | 13:03 |
| samueldmq | ayoung, great! | 13:04 |
| ayoung | unless you have a better idea. We have some thoughts around eventing, but I think we need the cache approach first, and then we'll use eventing in the future | 13:04 |
| samueldmq | ayoung, and where that config option for the endpoint_url will be? | 13:04 |
| samueldmq | ayoung, I mean, what is the config ksmiddleware use ? | 13:04 |
| ayoung | samueldmq, all that goes in the auth_token section of the config file. | 13:04 |
| samueldmq | ayoung, nice | 13:04 |
| samueldmq | ayoung, for now, let's do this .. as it simpler | 13:04 |
| samueldmq | ayoung, we can change for events later if we need/want/decide to | 13:05 |
| ekarlso | heya guys, will keystoneauth become usiable anytime soon ? | 13:05 |
| ayoung | samueldmq, yep | 13:05 |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Rename federated.py to federation.py https://review.openstack.org/186753 | 13:05 |
| *** dsirrine has joined #openstack-keystone | 13:07 | |
| *** Ephur has joined #openstack-keystone | 13:18 | |
| ayoung | ekarlso, soonish | 13:20 |
| *** raghava has quit IRC | 13:23 | |
| *** afaranha has joined #openstack-keystone | 13:23 | |
| samueldmq | ayoung, do I need a spec for /policies?url=<endpoint_url> | 13:28 |
| samueldmq | ayoung, or is the API spec enough? need a bp ? | 13:28 |
| *** afaranha has left #openstack-keystone | 13:29 | |
| ayoung | samueldmq, I think API spec is enough | 13:29 |
| *** gsilvis has joined #openstack-keystone | 13:29 | |
| samueldmq | ayoung, ++ | 13:30 |
| *** henrynash has joined #openstack-keystone | 13:30 | |
| *** ChanServ sets mode: +v henrynash | 13:30 | |
| dstanek | ayoung: it should be configurable on the keystone server side though and use http headers | 13:31 |
| ayoung | dstanek, the cache policy? Yep | 13:32 |
| ayoung | samueldmq, ^^ | 13:32 |
| samueldmq | dstanek, ayoung could you clarify this for me ? | 13:32 |
| samueldmq | the option being read by ksmiddleware is clear, but the part it is configurable in the keystone server | 13:32 |
| ayoung | samueldmq, when we fetch the file, read the http headers | 13:32 |
| samueldmq | I am not sure how kserver teels middleware about it | 13:33 |
| ayoung | the value in the http header should come from a keystoen conifg option | 13:33 |
| samueldmq | ayoung, and kserver pass the timeout to be considered ? | 13:33 |
| samueldmq | to ksmiddleware | 13:33 |
| ayoung | yes | 13:33 |
| samueldmq | ayoung, dstanek got it, thanks | 13:33 |
| dstanek | samueldmq: right, keystone will tell the client how long to cache | 13:33 |
| samueldmq | nice | 13:33 |
| dstanek | since we are trending toward a "REST" service i'd love to see us get more of the basics implemented | 13:34 |
| *** rushiagr is now known as rushiagr_away | 13:35 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add "enabled" to create service provider example https://review.openstack.org/186402 | 13:35 |
| samueldmq | dstanek, ++ | 13:35 |
| ayoung | dstanek, do we have support for headers like that now? | 13:36 |
| dstanek | ayoung: we just need to add them to the response, probably from the controller layer - might be a small about of work to get there | 13:37 |
| ayoung | dstanek, would we need to configure the durations per resource? | 13:40 |
| dstanek | ayoung: only for things we care about | 13:40 |
| ayoung | this seems like scope creep here...not a bad idea, but too much for just policy to cover | 13:41 |
| dstanek | i'll try to work up an example today | 13:41 |
| ayoung | dstanek, how about a spec instead? | 13:41 |
| dstanek | ayoung: adding a header is too much? | 13:41 |
| ayoung | dstanek, adding headers to all APIs | 13:41 |
| dstanek | you don't have to do that | 13:41 |
| ayoung | dstanek, most of our data is fetched and potentially cached...if we do it at one place, we should make the mechanism available across the board | 13:42 |
| ayoung | tokens, for example, should be cached for the lifespan of the token. | 13:42 |
| ayoung | ok...once more attempting to upgrade. wish me luck. If you don't hear from me in a few minutes, my laptop is probably stuck | 13:43 |
| *** ayoung has quit IRC | 13:43 | |
| dstanek | ayoung: right, that is adding scope creep - all i'm saying is you should do it for the policy since that is the spec you are talking about | 13:43 |
| *** henrynash has quit IRC | 13:44 | |
| *** gokrokve has joined #openstack-keystone | 13:45 | |
| *** gokrokve has quit IRC | 13:45 | |
| *** gokrokve has joined #openstack-keystone | 13:46 | |
| *** gsilvis has quit IRC | 13:47 | |
| *** lufix_ has joined #openstack-keystone | 13:47 | |
| *** aix has quit IRC | 13:49 | |
| *** aix has joined #openstack-keystone | 13:49 | |
| *** bdossant_ has quit IRC | 13:52 | |
| *** bdossant has joined #openstack-keystone | 13:52 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Listing policies filtered by service endpoint URL https://review.openstack.org/186765 | 13:53 |
| samueldmq | dstanek, ^ | 13:53 |
| samueldmq | dstanek, I also created a blueprint to point to ... that shouldn't hurt :) | 13:53 |
| dstanek | samueldmq: nice, i'll take a look in a few | 13:54 |
| *** blewis has joined #openstack-keystone | 13:54 | |
| samueldmq | dstanek, great thanks, I am going afk for a bit, will be back soon | 13:55 |
| *** henrynash has joined #openstack-keystone | 13:56 | |
| *** ChanServ sets mode: +v henrynash | 13:56 | |
| *** fhubik has quit IRC | 13:57 | |
| *** ayoung has joined #openstack-keystone | 14:03 | |
| *** ChanServ sets mode: +v ayoung | 14:03 | |
| *** emagana has quit IRC | 14:04 | |
| *** Ephur has quit IRC | 14:05 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 14:06 | |
| *** htruta has quit IRC | 14:06 | |
| *** afazekas has quit IRC | 14:06 | |
| *** ajayaa has quit IRC | 14:10 | |
| *** bdossant has quit IRC | 14:12 | |
| *** henrynash has quit IRC | 14:14 | |
| *** blewis` has joined #openstack-keystone | 14:15 | |
| *** gsilvis has joined #openstack-keystone | 14:15 | |
| *** henrynash has joined #openstack-keystone | 14:15 | |
| *** ChanServ sets mode: +v henrynash | 14:15 | |
| *** dims_ has quit IRC | 14:16 | |
| *** csoukup has joined #openstack-keystone | 14:18 | |
| *** blewis has quit IRC | 14:18 | |
| *** timcline has joined #openstack-keystone | 14:21 | |
| *** Ephur has joined #openstack-keystone | 14:21 | |
| *** bdossant has joined #openstack-keystone | 14:23 | |
| *** gsilvis has quit IRC | 14:24 | |
| *** htruta has joined #openstack-keystone | 14:25 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:25 | |
| *** jistr has quit IRC | 14:26 | |
| *** ayoung has quit IRC | 14:29 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes KVS catalog backend https://review.openstack.org/158442 | 14:30 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds missing list_endpoints tests https://review.openstack.org/176434 | 14:30 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds proper isolation to templated catalog tests https://review.openstack.org/174556 | 14:30 |
| marekd | jamielennox: dstanek morganfainberg: do we have ksa stable date already scheduled (or plans for that coming in relatively soon) ? | 14:32 |
| *** nkinder has quit IRC | 14:38 | |
| *** stevemar has joined #openstack-keystone | 14:39 | |
| *** ChanServ sets mode: +v stevemar | 14:39 | |
| *** ayoung has joined #openstack-keystone | 14:44 | |
| *** ChanServ sets mode: +v ayoung | 14:44 | |
| *** jistr has joined #openstack-keystone | 14:47 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Removed dependency.provider https://review.openstack.org/163029 | 14:49 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removed optional dependency support https://review.openstack.org/162770 | 14:49 |
| openstackgerrit | David Stanek proposed openstack/keystone: Decouple notifications from DI https://review.openstack.org/162769 | 14:49 |
| marekd | stevemar: bonjour, sir | 14:50 |
| marekd | stevemar: speaking of pull requests - i split them a little bit, but eventually they are a chain of commits, added on top of older ones | 14:51 |
| marekd | you can probably merge just the lastest one. | 14:51 |
| stevemar | marekd, excellent | 14:52 |
| stevemar | marekd, i think i did it? | 14:53 |
| stevemar | i'm too used to gerrit | 14:53 |
| marekd | stevemar: me too, unfortnately | 14:54 |
| marekd | stevemar: that's why i made so many PRs | 14:54 |
| stevemar | looks like it worked | 14:54 |
| stevemar | does it pass tox? | 14:54 |
| marekd | stevemar: anyways, i am thinking about adding some exec so one can run it from cmdline, inject mapping rules and some input (env like) and see the output - do you think it's ok for a lib to add it there? | 14:55 |
| marekd | stevemar: passes pep8,py27, doesn't pass py34 with some error "cannot find db type" | 14:55 |
| stevemar | marekd, that was my other intention for the library :) | 14:55 |
| marekd | stevemar: i know- the questions whether we add something like 'bin' directory there or add another repo? | 14:56 |
| marekd | stevemar: personally i am ok for a bin like dir | 14:56 |
| stevemar | i was thinking, we should bug infra and get this online for v0.1 | 14:56 |
| stevemar | bin directory ! | 14:56 |
| stevemar | the project shouldn't get much bigger than where it is now | 14:56 |
| marekd | stevemar: can you try out py34 ? | 14:56 |
| stevemar | bin directory + docs and call it done | 14:56 |
| stevemar | sure, let me load everything up | 14:57 |
| marekd | stevemar: my error might be something local, not code related. | 14:57 |
| marekd | once we have it gerrit i can push some changes so keystone starts depending on it. | 15:00 |
| *** emagana has joined #openstack-keystone | 15:02 | |
| dstanek | marekd: that db type error is due to having a .testrepository directory | 15:02 |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactor: create the lookup object once https://review.openstack.org/183187 | 15:05 |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactor: use __getitem__ when the key will exists https://review.openstack.org/183188 | 15:05 |
| openstackgerrit | David Stanek proposed openstack/keystone: WIP: reduce redundant get_user calls https://review.openstack.org/183189 | 15:05 |
| openstackgerrit | David Stanek proposed openstack/keystone: Order routes so most frequent requests are first https://review.openstack.org/182781 | 15:05 |
| *** zzzeek has joined #openstack-keystone | 15:06 | |
| marekd | dstanek: you are right, it worked | 15:08 |
| marekd | thanks. | 15:08 |
| dstanek | marekd: no problem | 15:08 |
| marekd | stevemar: looks like py34 are passing too :-) | 15:08 |
| marekd | stevemar: who should we ask for gerrit repo for keystone-mapper? | 15:10 |
| stevemar | marekd, yeah i suspect is py27 passes then so should py34 :) | 15:10 |
| stevemar | ummm | 15:10 |
| stevemar | lets go to infra and find out | 15:10 |
| dstanek | we'll soon be competing with puppet for most project repos! | 15:11 |
| marekd | stevemar: openstack-infra ? | 15:11 |
| stevemar | y | 15:12 |
| *** hemnafk is now known as hemna | 15:14 | |
| stevemar | marekd, i'll start going through the steps in a minute | 15:14 |
| stevemar | lets not clobber each other on launchpad | 15:14 |
| marekd | stevemar: ok, thanks! | 15:15 |
| stevemar | marekd, you've done enough, rest up | 15:15 |
| stevemar | :P | 15:15 |
| marekd | i will fininsh what i am working on right now and start playing with cmd | 15:15 |
| marekd | stevemar: i am always behind you in that matter :P | 15:15 |
| *** dims_ has joined #openstack-keystone | 15:16 | |
| *** ajayaa has joined #openstack-keystone | 15:18 | |
| *** ajayaa has quit IRC | 15:26 | |
| *** someara2 has joined #openstack-keystone | 15:33 | |
| *** someara2 has quit IRC | 15:34 | |
| *** someara2 has joined #openstack-keystone | 15:34 | |
| *** dsirrine has quit IRC | 15:39 | |
| *** gyee has joined #openstack-keystone | 15:41 | |
| *** ChanServ sets mode: +v gyee | 15:41 | |
| *** bdossant_ has joined #openstack-keystone | 15:41 | |
| *** bdossant has quit IRC | 15:41 | |
| *** dsirrine has joined #openstack-keystone | 15:43 | |
| *** ayoung has quit IRC | 15:45 | |
| *** browne has quit IRC | 15:49 | |
| *** dims_ is now known as dimsum__ | 15:49 | |
| gyee | henrynash, around? | 15:51 |
| henrynash | gyee: yep | 15:51 |
| henrynash | gyee: so you want to talk list role assignments, I assume | 15:52 |
| gyee | henrynash, the list role assignment bug is needed by Horizon | 15:52 |
| gyee | yes | 15:52 |
| gyee | basically, they need a way to list the role assignment for targets within a given domain | 15:52 |
| gyee | to enhance usability | 15:53 |
| henrynash | gyee: so understand the goal….as per my comments on the bug, this would be new terretory for us in terms of concept…. | 15:53 |
| henrynash | gyee: how would we indicate in the API call that we want to restruict by domain? | 15:54 |
| gyee | henrynash, well, right now domain admin can assign roles to targets (domain and projects) within the domain | 15:54 |
| henrynash | gyee: agreed | 15:54 |
| gyee | so its nature that domain admin can also list those assignments | 15:55 |
| henrynash | gyee: and they can (just not all in one go) | 15:55 |
| gyee | but why not? | 15:55 |
| henrynash | gyee: I’m not syaing they *shouldn’t*….just stating the current situation…and pointing out that we don’t currently have the language to ask the question | 15:56 |
| gyee | henrynash, I think we should, Horizon needed it in order to build an intuitive UI | 15:57 |
| *** mattfarina has joined #openstack-keystone | 15:57 | |
| gyee | UI dictates what APIs looks like usually | 15:57 |
| henrynash | gyee: I;m not necessarily arguing against it…but wanting us to work out how we change to the identity spec to satisfy the requirement | 15:58 |
| *** jistr has quit IRC | 15:58 | |
| gyee | henrynash, how about 'GET /role_assignments?scope.domain.id=<id>&all_targets'? | 15:59 |
| *** bknudson has joined #openstack-keystone | 15:59 | |
| *** ChanServ sets mode: +v bknudson | 15:59 | |
| henrynash | gyee: no, I don’t like that since the scope.domain_id means assignments on the domain | 16:00 |
| henrynash | gyee: not on projects in that domain | 16:00 |
| henrynash | gyee: GET /role_assignments?target.domain.id=<ID> ? | 16:00 |
| henrynash | or maybe | 16:01 |
| gyee | henrynash, sounds good | 16:01 |
| *** someara2 has quit IRC | 16:01 | |
| henrynash | GET /role_assignments?projects.domain.id=<ID> | 16:01 |
| henrynash | actually maybe | 16:01 |
| gyee | henrynash, no, projects.domain.id is no good | 16:01 |
| gyee | we need both project and domain assignments for the given domain | 16:01 |
| dstanek | we didn't freeze all of ksc right? just the cli | 16:01 |
| henrynash | GET /role_assignments/domain/<ID> | 16:02 |
| gyee | dstanek, right, ony the cli | 16:02 |
| gyee | henrynash, YES! that one seem more nature | 16:02 |
| gyee | GET /role_assignments/domains/ID | 16:02 |
| dstanek | gyee: thx, adam's -2 here confused me; seems like a change that should go through | 16:03 |
| gyee | or GET /domains/ID/role_assignments | 16:03 |
| henrynash | gyee: the only thing I am wary of on GET /role_assignments?target.domain.id=<ID> is that today our query filters all relate to an attribute being returned in the collection.... | 16:03 |
| dstanek | https://review.openstack.org/#/c/167543/4 | 16:03 |
| *** someara2 has joined #openstack-keystone | 16:04 | |
| gyee | dstanek, I think ayoung is wrong | 16:04 |
| gyee | we still support the SDK side of things | 16:04 |
| henrynash | gyee: the trouble with | 16:04 |
| henrynash | gyee: brb | 16:04 |
| bknudson | morganfainberg: was looking at keystoneclient releases and noticed we could use a 0.11.3 (stable/icehouse) release -- http://git.openstack.org/cgit/openstack/python-keystoneclient/log/?h=stable/icehouse | 16:05 |
| gyee | henrynash, GET /domains/ID/role_assignments seem more nature | 16:05 |
| gyee | natural | 16:06 |
| *** jistr has joined #openstack-keystone | 16:06 | |
| *** bdossant_ has quit IRC | 16:07 | |
| stevemar | marekd, morganfainberg, https://review.openstack.org/#/c/186817/ | 16:08 |
| *** jistr has quit IRC | 16:09 | |
| marekd | stevemar: https://review.openstack.org/#/c/186817/1/gerrit/projects.yaml you sure this should be your github account? | 16:11 |
| stevemar | hmm | 16:11 |
| stevemar | i thought theres usually a file that lists the 'source' for the initialization | 16:12 |
| stevemar | i thought that was it, i am wrong | 16:12 |
| marekd | i am asking, cause i don't know. byt it looks like this configures some reference repo location. | 16:12 |
| gyee | keystone-mapper?!! | 16:12 |
| stevemar | gyee, just pulling out some server code :) | 16:12 |
| stevemar | nothing fun | 16:12 |
| gyee | so we are going to have mapping content validation besides syntax? | 16:13 |
| morganfainberg | bknudson: good to know. | 16:13 |
| marekd | gyee: YES* | 16:13 |
| marekd | * one day | 16:13 |
| * gyee in euphoria | 16:13 | |
| marekd | gyee: read the * with that tiny font | 16:13 |
| morganfainberg | bknudson: thnx | 16:13 |
| gyee | marekd, fine prints :) | 16:14 |
| *** lhcheng has joined #openstack-keystone | 16:14 | |
| *** ChanServ sets mode: +v lhcheng | 16:14 | |
| marekd | gyee: right now the goal is to pull the RuleProcessor (+ deps) to separate library and add some cmdline so ppl can test their rules with some input of their choice | 16:14 |
| *** rwsu has joined #openstack-keystone | 16:15 | |
| marekd | gyee: but yes - i'd like to see it morphing into kind of DSL. | 16:15 |
| marekd | and not depending on string only. | 16:15 |
| gyee | marekd, nice! | 16:15 |
| henrynash | gyee: the only other thing I was wondering was whether we could do this via hierarcical projects….i.e. an project API call to the top level project object that is acting as a domain….a bit like we already provide for listing all project IDs within teh hierarchy | 16:15 |
| henrynash | gyee: but I haven’t thought that through | 16:16 |
| *** bdossant has joined #openstack-keystone | 16:16 | |
| gyee | henrynash, we can use the same paradigm for listing the hierarchy | 16:16 |
| gyee | henrynash, GET /projects/ID/role_assignments?all_children | 16:17 |
| henrynash | gyee: yeah, somthing like that | 16:18 |
| gyee | either way, we need customer callbacks to enforce authorizatoin | 16:18 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:18 | |
| gyee | oslo.policy is not powerful enough right now for complex object relationships | 16:18 |
| henrynash | gyee: yes, we need something to do that agreed. | 16:18 |
| *** josecastroleon has quit IRC | 16:19 | |
| henrynash | gyee: there’s already a whole set of patches that mover all the filtering into the driver | 16:19 |
| gyee | henrynash, should we put together a spec to get the party started? | 16:19 |
| morganfainberg | stevemar: added things for the slide deck n | 16:19 |
| henrynash | gyee: I’d be happy to drive taht if you like? | 16:19 |
| gyee | henrynash, sure, thanks | 16:20 |
| henrynash | gyee: Ok, will put somthing up this weekend | 16:20 |
| morganfainberg | stevemar: I am going to do some more polish on it over the week. But I'm not unhappy with it as is. | 16:20 |
| gyee | henrynash, I lov u man | 16:20 |
| henrynash | gyee: ahhh, shucks | 16:20 |
| gyee | hah | 16:20 |
| *** henrique_ has joined #openstack-keystone | 16:20 | |
| stevemar | morganfainberg, i got ptl duties for ya: https://review.openstack.org/#/c/186827/ | 16:23 |
| gyee | morganfainberg, wtf? we deprecated ec2 middleware? https://review.openstack.org/#/c/185509/ | 16:23 |
| gyee | ain't heat using it? | 16:23 |
| *** gokrokve has quit IRC | 16:23 | |
| samueldmq | morganfainberg, dolphm spec for 'Listing policies filtered by service endpoint URL' (https://review.openstack.org/#/c/186765) | 16:24 |
| morganfainberg | gyee: no that is the bit rotting version that was moved to ksm package | 16:24 |
| stevemar | marekd, once that patch goes in, no more git! | 16:24 |
| stevemar | good ol fashioned gerrit | 16:24 |
| gyee | morganfainberg, k, i c | 16:24 |
| morganfainberg | If someone is importing all of keystone for that middleware.... they are doing it wrong. | 16:25 |
| marekd | stevemar: heh :-) git PRs model is i think more spreaded than gerrit :-) | 16:25 |
| marekd | stevemar: we are just more used to gerrit w-f | 16:25 |
| morganfainberg | marekd: PRs also suck. | 16:26 |
| morganfainberg | And don't scale. | 16:26 |
| marekd | morganfainberg: i cannot say anything about that. | 16:26 |
| marekd | morganfainberg: because i simply don't know | 16:27 |
| morganfainberg | marekd: I contributed to saltstack when everything was a PR. | 16:27 |
| morganfainberg | It works for a small team. | 16:27 |
| marekd | why they don't scale? | 16:27 |
| marekd | cannot make dep chain ? | 16:27 |
| *** htruta has quit IRC | 16:27 | |
| morganfainberg | Moving to a big distributed team it doesn't scale. Bad commenting, dep chains are strange. And no easy way to clearly see who can accept / should review before accepting. | 16:28 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 16:28 | |
| dolphm | marekd: it can't scale to the number of code reviewers and authors we have -- the workflow is too limited | 16:28 |
| morganfainberg | dolphm: ++ | 16:28 |
| morganfainberg | it is good until about 5-7 contributors. | 16:28 |
| morganfainberg | In my experience. | 16:28 |
| morganfainberg | Then it gets to be a highly complex problem the workflow just doesn't handle. | 16:29 |
| morganfainberg | For mapper now. | 16:29 |
| marekd | morganfainberg: dolphm all right, all right - never said that one is better than another, or i'd preffer to move our workflows to PRs! :-) | 16:29 |
| morganfainberg | Before I +1 it | 16:29 |
| marekd | morganfainberg: for mapper, stevemar and i used PRs because it was not in gerrit, and that's all. | 16:29 |
| *** gokrokve has joined #openstack-keystone | 16:30 | |
| morganfainberg | Two questions: 1 ) does this belong under the keystone umbrella. | 16:30 |
| morganfainberg | Or is the generally useful (aka Oslo) or not even Oslo | 16:30 |
| *** spandhe has joined #openstack-keystone | 16:30 | |
| morganfainberg | 2) if it does belong under keystone does it increase our scope of responsibility? | 16:30 |
| *** kiran-r has joined #openstack-keystone | 16:30 | |
| marekd | morganfainberg: i doubt anybody will use it but keystone in a common shape and future roadmap. | 16:30 |
| stevemar | 1) yes, i doubt anyone else will use it right now | 16:31 |
| marekd | morganfainberg: 2) i don't know exact answer - all that code is basically copied from keuystone repo (some parts will need to be duplicated and kept in consistency manually, like exceptions for now) | 16:32 |
| stevemar | 2) i plan on adding a small CLI for users to test their mapping, so a slight uptick in scope | 16:32 |
| morganfainberg | marekd: what is the benefit of it moving out of tree at the moment? | 16:32 |
| *** _cjones_ has joined #openstack-keystone | 16:32 | |
| marekd | morganfainberg: cmdtool we can ship easily | 16:32 |
| morganfainberg | stevemar: that could be done in keystone's tree to start. | 16:32 |
| stevemar | in case there is a bug with the mapping engine we don't have to backport changes, can just release a new version | 16:33 |
| morganfainberg | stevemar: that is not true. We have stable branches of libraries. | 16:33 |
| morganfainberg | stevemar: backport *and release * is a likely workflow today. | 16:33 |
| morganfainberg | Let me be clear, I | 16:34 |
| morganfainberg | Am not saying no | 16:34 |
| morganfainberg | I'm asking questions to see if it makes sense to add overhead to reviewers and ci | 16:34 |
| bknudson | gerrit for github: http://gerrithub.io/ | 16:35 |
| morganfainberg | amakarov: I will respond to that bug soon. | 16:36 |
| stevemar | morganfainberg, it just makes more sense archy-tectually i think | 16:36 |
| marekd | stevemar: ++ | 16:36 |
| morganfainberg | So my only real worry is reviewer overhead. | 16:36 |
| bknudson | we'll need stable releases of the keystone-mapping library, so we're not saved from anything. | 16:36 |
| morganfainberg | Having another repo to look at. | 16:36 |
| stevemar | bknudson, that's cause the way we do stable is broken, with all our caps | 16:37 |
| bknudson | it will actually be more work since we have to deal with more libraries | 16:37 |
| stevemar | realistically it should just be updating a single lib | 16:37 |
| morganfainberg | bknudson: there is an effort to fix that in Python. | 16:37 |
| marekd | morganfainberg: it's lighter for user to install just this lib + some binary and test mappingsets, instead of having to install relatively heavy keystone | 16:37 |
| dstanek | bknudson: that actually it's too bad - i've imported projects into it | 16:37 |
| morganfainberg | But that is not quick work. | 16:37 |
| dstanek | morganfainberg: fix in Python? | 16:38 |
| bknudson | packagers like us don't automatically update to new versions | 16:38 |
| morganfainberg | dstanek: dep resolution in pip, etc | 16:39 |
| bknudson | and we've got our own internal process / legal issues that make it more difficult than it should be | 16:39 |
| morganfainberg | dstanek: which lets us fix the cap issues and release models in our ci. | 16:39 |
| dstanek | morganfainberg: ah, ok. i though you meant in cpython. do you have a link to that work? i'm curious now | 16:40 |
| morganfainberg | marekd: it is lighter weight than bringing all of keystone. | 16:40 |
| morganfainberg | dstanek: lifeless is doing a lot of it. | 16:40 |
| morganfainberg | dstanek: you should chat with him :) | 16:40 |
| morganfainberg | dstanek: he's same kind of time zone as jamielennox FYI. | 16:41 |
| morganfainberg | So probably out for the weekend. | 16:41 |
| dstanek | morganfainberg: thx | 16:41 |
| marekd | morganfainberg: i think i just said that. | 16:42 |
| marekd | morganfainberg: BTW: ksa stable has been scheduled? | 16:42 |
| *** browne has joined #openstack-keystone | 16:42 | |
| morganfainberg | marekd: I was confirming what you said. :) | 16:42 |
| marekd | morganfainberg: ah, ok :-) | 16:43 |
| morganfainberg | marekd: ksa has been setup to look at integration now. Once we have an idea what it will take, we will have more bugs (etc) | 16:43 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:43 | |
| morganfainberg | marekd: I want it stable asap | 16:43 |
| morganfainberg | But it has been a bunch of fix the broken stuff first. | 16:44 |
| morganfainberg | It is definitely moving forward. | 16:44 |
| marekd | morganfainberg: ok, was not sure if it's worth changing dependencies to ksa. | 16:44 |
| marekd | morganfainberg: or it will be waisted time atm. | 16:45 |
| morganfainberg | marekd: not until it is stable. | 16:45 |
| morganfainberg | 1.0 will be soon enough. | 16:45 |
| morganfainberg | But assume the contract will break between now and then. | 16:45 |
| marekd | morganfainberg: i am thinking about unreleased lib too (python-keystoneclient-saml2), so as long as it's matter of few weeks we can probably wait | 16:46 |
| morganfainberg | The 0.x releases are to make it easier to do the integration / see the remaining work. | 16:46 |
| *** gokrokve has quit IRC | 16:46 | |
| *** lhcheng has quit IRC | 16:47 | |
| morganfainberg | marekd: ok my biggest concern with the mapper moving to its own library is reviewer overhead. Conceptually it is nice to isolate these things to a library. But I worry it really is going to get lost. | 16:47 |
| morganfainberg | stevemar: ^ | 16:47 |
| *** lhcheng has joined #openstack-keystone | 16:47 | |
| *** ChanServ sets mode: +v lhcheng | 16:47 | |
| morganfainberg | it keystone is the only thing really using it. We can do everything in keystone for now. See how useful the mapping engine CLI checker is (could be like keystone-manage) | 16:48 |
| morganfainberg | Etc. | 16:48 |
| morganfainberg | Let me do an informal poll. | 16:48 |
| marekd | morganfainberg: understood. but i also feel ppl will get frustrated tring to install keystone on, say ubuntu box and adding tons of dependencies like python-ldap-something | 16:49 |
| morganfainberg | dolphm, bknudson, dstanek, lbragstad: thoughts on splitting the mapping stuff in to a lib? | 16:49 |
| bknudson | morganfainberg: my opinion is there's no need for it... I don't know why it's being proposed. | 16:51 |
| morganfainberg | marekd: sure. However, today - and in the near-term (this cycle) most people mucking with the mapping engine will be the deployer / operator. Like I said, asking questions so I know where things sit before adding another repo to watch. | 16:51 |
| marekd | morganfainberg: sure, i completely understand your hesitation. | 16:52 |
| morganfainberg | marekd: we can also add this to the agenda for next week meeting. | 16:53 |
| marekd | morganfainberg: let's wait for others' opinions and we can abandon the patch. | 16:53 |
| morganfainberg | gyee, henrynash: ^ cc (too) | 16:53 |
| dstanek | morganfainberg: i'm not a fan - what projects will use the lib? | 16:53 |
| marekd | morganfainberg: sure, we can wait. | 16:53 |
| morganfainberg | marekd: let's do this as part of the meeting. | 16:54 |
| marekd | morganfainberg: no rush. | 16:54 |
| morganfainberg | Can you wip that patch please. | 16:54 |
| marekd | y | 16:54 |
| dstanek | hotels in Cambridge are very pricey | 16:54 |
| morganfainberg | Thnx. | 16:54 |
| marekd | morganfainberg: stevemar was an author and only he can WIP it. | 16:55 |
| morganfainberg | dstanek: let me send a reminder to the ML I need to get a count. Might be able to do a hotel block if we have enough. | 16:55 |
| morganfainberg | stevemar: ^^ | 16:55 |
| morganfainberg | stevemar: please wip the patch. | 16:55 |
| openstackgerrit | Merged openstack/python-keystoneclient: A Default CLI plugin https://review.openstack.org/179563 | 16:55 |
| morganfainberg | Wip it good. | 16:55 |
| morganfainberg | /devo | 16:55 |
| marekd | LOL | 16:55 |
| marekd | stevemar: are you working on some bits for mapping cli right now? | 16:56 |
| gyee | morganfainberg, I am fine with keeping it in Keystone if the other workflow sucks | 16:56 |
| *** gokrokve has joined #openstack-keystone | 16:57 | |
| stevemar | i'll WIP it | 16:57 |
| *** gokrokve has quit IRC | 16:57 | |
| *** mdrnstm has joined #openstack-keystone | 16:58 | |
| *** gokrokve has joined #openstack-keystone | 16:58 | |
| *** mdrnstm is now known as Guest49465 | 16:58 | |
| *** Guest49465 is now known as morgan | 16:58 | |
| *** morgan has quit IRC | 16:58 | |
| *** morgan has joined #openstack-keystone | 16:58 | |
| *** ChanServ sets mode: +v morgan | 16:58 | |
| *** dguerri is now known as dguerri`away | 16:58 | |
| *** morgan is now known as mdrnstm | 16:59 | |
| *** raildo is now known as needmoresummit | 16:59 | |
| *** jsavak has quit IRC | 17:00 | |
| *** jsavak has joined #openstack-keystone | 17:02 | |
| *** bdossant has quit IRC | 17:03 | |
| *** timcline has quit IRC | 17:03 | |
| marekd | morganfainberg: i am guessing with the KSA joining our family python-keystoneclient-saml2 should be rather renamed to python-keystoneauth-saml2 (same for kerberos etc). What's the easist way to do so. Create another project, move the files, delete old project (it was not released yet) ? | 17:05 |
| mdrnstm | marekd: i'd talk to jamielennox before it. we can rename projects but it is non-trivial and requires -infra time | 17:06 |
| marekd | mdrnstm: i will shoot him an e-mail then. | 17:06 |
| *** jsavak has quit IRC | 17:07 | |
| *** jsavak has joined #openstack-keystone | 17:07 | |
| marekd | stevemar: are you going to push it soon: https://review.openstack.org/#/c/134700/ ? | 17:07 |
| marekd | stevemar: maybe we should take a long-term approach and spend some time on working on oidc and cmd solutions popularization 0_o | 17:08 |
| *** alanf-mc has joined #openstack-keystone | 17:09 | |
| *** bknudson has quit IRC | 17:12 | |
| * stevemar shrugs | 17:13 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 17:26 | |
| *** aix has quit IRC | 17:31 | |
| *** kiranr has joined #openstack-keystone | 17:31 | |
| *** timcline has joined #openstack-keystone | 17:34 | |
| *** kiran-r has quit IRC | 17:35 | |
| *** timcline has quit IRC | 17:38 | |
| *** kiranr has quit IRC | 17:41 | |
| *** kiran-r has joined #openstack-keystone | 17:42 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Depend on python-keystoneauth https://review.openstack.org/186854 | 17:42 |
| *** kiran-r has quit IRC | 17:46 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Refactor SAML2 auth plugins https://review.openstack.org/176746 | 17:46 |
| *** timcline has joined #openstack-keystone | 17:51 | |
| marekd | morganfainberg: stevemar dstanek : Quite simple patch in ksa: https://review.openstack.org/#/c/186753/ | 17:52 |
| sigmavirus24 | dstanek: y u no suggest from six.moves.http import parser? =P | 17:54 |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Rename federated.py to federation.py https://review.openstack.org/186753 | 17:54 |
| *** jsavak has quit IRC | 18:02 | |
| *** jsavak has joined #openstack-keystone | 18:02 | |
| *** jsavak has quit IRC | 18:04 | |
| openstackgerrit | Phil Hopkins proposed openstack/keystone: updates sample_data script to use the new openstack commands https://review.openstack.org/186560 | 18:04 |
| *** jsavak has joined #openstack-keystone | 18:05 | |
| *** bknudson has joined #openstack-keystone | 18:07 | |
| *** ChanServ sets mode: +v bknudson | 18:07 | |
| openstackgerrit | Phil Hopkins proposed openstack/keystone: updates sample_data script to use the new openstack commands https://review.openstack.org/186560 | 18:07 |
| *** Zanatoz has joined #openstack-keystone | 18:10 | |
| openstackgerrit | Phil Hopkins proposed openstack/keystone: updates sample_data script to use the new openstack commands https://review.openstack.org/186560 | 18:11 |
| *** kiran-r has joined #openstack-keystone | 18:11 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes unused database setup code https://review.openstack.org/186862 | 18:11 |
| *** kiran-r has quit IRC | 18:11 | |
| *** bknudson has quit IRC | 18:12 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Constraint to prevent duplicates endpoints https://review.openstack.org/134095 | 18:14 |
| *** bknudson has joined #openstack-keystone | 18:14 | |
| *** ChanServ sets mode: +v bknudson | 18:14 | |
| mdrnstm | rodrigods: please put that question / topic you emailed me about on the Agenda for next week's meeting | 18:17 |
| rodrigods | mdrnstm, will do | 18:18 |
| mdrnstm | we should consider it [and we're rapidly approaching the spec freeze deadline] | 18:18 |
| lifeless | o/ | 18:19 |
| *** pnavarro has joined #openstack-keystone | 18:19 | |
| mdrnstm | lifeless: pointed dstanek your way for all the awesome "fix the things in python and pip etc" you're doing. | 18:22 |
| * mdrnstm goes to get food... or something. | 18:22 | |
| *** someara2 has quit IRC | 18:23 | |
| *** gokrokve_ has joined #openstack-keystone | 18:24 | |
| *** rushiagr_away is now known as rushiagr | 18:25 | |
| *** gokrokve has quit IRC | 18:27 | |
| lifeless | mdrnstm: ruh roh | 18:29 |
| *** gokrokve_ has quit IRC | 18:29 | |
| *** jsavak has quit IRC | 18:31 | |
| *** jsavak has joined #openstack-keystone | 18:31 | |
| *** gokrokve has joined #openstack-keystone | 18:31 | |
| *** jsavak has quit IRC | 18:37 | |
| *** jsavak has joined #openstack-keystone | 18:39 | |
| *** ajayaa has joined #openstack-keystone | 18:44 | |
| *** mdrnstm has quit IRC | 18:47 | |
| *** mdrnstm has joined #openstack-keystone | 18:49 | |
| *** ajayaa has quit IRC | 18:49 | |
| *** mdrnstm is now known as Guest58148 | 18:49 | |
| *** Guest58148 has quit IRC | 18:50 | |
| needmoresummit | I saw a bug here #1229093 and i'm thinking in how resolve this problem. | 18:52 |
| needmoresummit | https://bugs.launchpad.net/keystone/+bug/1229093 | 18:53 |
| openstack | Launchpad bug 1229093 in Keystone "the domain name is case insensitive with keystone v3" [Medium,Triaged] - Assigned to Alexey Miroshkin (amirosh) | 18:53 |
| needmoresummit | maybe we can prohibit create new domain name with case insensitive and send a warning about previous conflicts? | 18:54 |
| *** pnavarro has quit IRC | 18:54 | |
| bknudson | we've always said that the case-sensitive or not is dependent on the backend | 18:56 |
| needmoresummit | bknudson, the guy that report the bug said: "This is not a consistent API behavior. I would like to get the same output no matter what kind of db in backend." | 18:56 |
| bknudson | the guy can configure his backend to work however he wants | 18:57 |
| needmoresummit | bknudson, so, this is why I don't know if we need to fix this on Keystone or can invalid the bug with your point | 18:57 |
| bknudson | we can add more documentation if there isn't any | 18:58 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Adds URL filter for GET /policies https://review.openstack.org/186874 | 18:58 |
| samueldmq | morganfainberg, dolphm, dstanek ^ | 18:58 |
| *** rushiagr is now known as rushiagr_away | 18:58 | |
| needmoresummit | I don't know about the documentation, I'll take a look on this :) | 18:59 |
| *** aix has joined #openstack-keystone | 19:00 | |
| *** amakarov is now known as amakarov_away | 19:02 | |
| needmoresummit | bknudson, do you agree in add some information about this here: https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3.rst#domains-v3domains? | 19:03 |
| bknudson | needmoresummit: searching for case-sensitive in that document shows all sorts of hits for case or non-case-sensitive | 19:07 |
| bknudson | I wonder how accurate that is. | 19:07 |
| bknudson | I think we should have a general comment in the API document that says that string comparison depends on the setting of the backend driver | 19:07 |
| bknudson | we can't specify what exactly is going to happen in the API doc | 19:08 |
| bknudson | something in the config / setup guide could explain that mysql and postgresql work differently | 19:08 |
| needmoresummit | bknudson, I agree | 19:08 |
| needmoresummit | bknudson, thanks | 19:09 |
| bknudson | no problem | 19:09 |
| morganfainberg | bknudson: case sensitivity could also be squashed at the api layer for consistency. It might result in a migration to fix things though. | 19:09 |
| morganfainberg | Unfortunately, we probably should have solved this for some of the index'd data fields way earlier on. | 19:10 |
| morganfainberg | For policy. It's a blob thing ATM so harder still. | 19:10 |
| bknudson | some of this all seems a little late now... I assume it's been this way since the original release | 19:10 |
| morganfainberg | Yep. | 19:11 |
| morganfainberg | =\ | 19:11 |
| stevemar | morganfainberg, i'm going to send off the slide deck to CIS folks now | 19:18 |
| morganfainberg | stevemar: did ya cleanup the extra couple slide things? | 19:19 |
| morganfainberg | stevemar: and go ahead and resolve my comments. | 19:19 |
| morganfainberg | I'm going to make some more policy stuff on it for me. But it can wait be used in the future. | 19:20 |
| morganfainberg | stevemar: just wanted to be sure we didn't leave the icky agenda in etc. | 19:20 |
| stevemar | morganfainberg, yeah, just gotta nuke that one | 19:25 |
| *** alanf-mc has quit IRC | 19:36 | |
| *** timcline has quit IRC | 19:39 | |
| *** timcline has joined #openstack-keystone | 19:52 | |
| *** timcline has quit IRC | 19:53 | |
| *** elmiko has left #openstack-keystone | 20:01 | |
| *** openstack has joined #openstack-keystone | 20:04 | |
| morganfainberg | stevemar: the slide with logos. Make sure it says these are not all the orgs contributing. | 20:11 |
| stevemar | i tried to reword it a bit | 20:15 |
| stevemar | if you have better language, thats cool | 20:15 |
| *** alanf-mc has joined #openstack-keystone | 20:15 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 20:23 | |
| *** lufix_ has quit IRC | 20:24 | |
| *** mdrnstm has joined #openstack-keystone | 20:28 | |
| *** mdrnstm has quit IRC | 20:28 | |
| *** mdrnstm has joined #openstack-keystone | 20:28 | |
| *** ChanServ sets mode: +v mdrnstm | 20:28 | |
| *** openstack has joined #openstack-keystone | 20:29 | |
| *** ayoung has joined #openstack-keystone | 20:29 | |
| *** ChanServ sets mode: +v ayoung | 20:29 | |
| mdrnstm | ayoung: ping - if you have a moment would like you to look at a bug | 20:30 |
| ayoung | mdrnstm, sure | 20:30 |
| *** needmoresummit is now known as raildo | 20:38 | |
| *** gokrokve has quit IRC | 20:40 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Update testing keystone2keystone doc https://review.openstack.org/186395 | 20:40 |
| *** gokrokve has joined #openstack-keystone | 20:46 | |
| *** mattfarina has quit IRC | 20:48 | |
| *** gokrokve has quit IRC | 20:50 | |
| *** dguerri`away is now known as dguerri | 20:56 | |
| *** openstackgerrit has quit IRC | 20:59 | |
| *** openstackgerrit has joined #openstack-keystone | 21:00 | |
| *** raildo has quit IRC | 21:00 | |
| *** gokrokve has joined #openstack-keystone | 21:07 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 21:14 | |
| *** jsavak has quit IRC | 21:17 | |
| *** openstack has joined #openstack-keystone | 21:30 | |
| *** openstackstatus has joined #openstack-keystone | 21:31 | |
| *** ChanServ sets mode: +v openstackstatus | 21:31 | |
| *** csoukup has quit IRC | 21:32 | |
| *** henrynash has quit IRC | 21:40 | |
| *** Ephur has quit IRC | 21:51 | |
| *** dims_ has joined #openstack-keystone | 21:53 | |
| *** stevemar has quit IRC | 21:53 | |
| *** Ephur has joined #openstack-keystone | 21:53 | |
| *** dimsum__ has quit IRC | 21:55 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: query configuration via web API https://review.openstack.org/186926 | 21:55 |
| ayoung | mdrnstm, ^^ | 21:56 |
| ayoung | samueldmq, ^^ | 21:56 |
| bknudson | is there any reason keystone shouldn't switch to release whenever like swift / ironic? | 21:56 |
| ayoung | bknudson, absolutetutely none | 21:57 |
| *** Guest66545 has quit IRC | 22:03 | |
| mdrnstm | bknudson: right now - because it's going to cause lots of headaches | 22:03 |
| mdrnstm | bknudson: longer term (once we see the road ironic goes down and the bumps) no reason at all | 22:04 |
| bknudson | so a couple of potential issues -- how are docs going to work | 22:06 |
| bknudson | and, there isn't really any dep management between servers | 22:06 |
| mdrnstm | bknudson: this is why i don't want to lead the charge here | 22:07 |
| mdrnstm | there are enough questions i'd rather hold back | 22:07 |
| mdrnstm | and see what comes out of the first one or two making the move | 22:07 |
| bknudson | any project that uses keystone is probably going to want to wait until we make the change | 22:07 |
| bknudson | although that hasn't affected swift somehow | 22:07 |
| mdrnstm | ironic currently uses keystone in some ways | 22:08 |
| mdrnstm | like i said, i don't want to pioneer in this case. i'd like to see how it shakes out w/ the first 1 or two | 22:08 |
| mdrnstm | then we can jump on the train | 22:08 |
| * mdrnstm needs to make a docker container with the base runtime needed to install keystone | 22:11 | |
| mdrnstm | so i cna use it for quickly testing bugs. | 22:11 |
| bknudson | docker docker docker! | 22:11 |
| mdrnstm | this whole install build essential and python is timeconsuming | 22:12 |
| mdrnstm | bknudson: yeah. | 22:12 |
| mdrnstm | bknudson: it's nice from a standpoint of having a contained environment on the laptop | 22:12 |
| bknudson | I just have 10 vms | 22:13 |
| mdrnstm | i can't run 10 vms :O | 22:13 |
| mdrnstm | 8GB of ram = need to be thrifty with resources | 22:13 |
| bknudson | I don't run them all at the same time | 22:13 |
| mdrnstm | ooooooh :P | 22:14 |
| mdrnstm | i do need to get my account setup so i cna run vms in the ${cloud} | 22:14 |
| bknudson | http://www.theonion.com/video/hp-offers-that-cloud-thing-everyone-is-talking-abo-28789 | 22:15 |
| *** alanf-mc has quit IRC | 22:15 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Policy Substitute Values https://review.openstack.org/186929 | 22:16 |
| ayoung | mdrnstm, I should move that convo here | 22:16 |
| ayoung | so ^^ is better, I think | 22:16 |
| ayoung | maybe we want to keep the subsitution until the fetch time, but then we need to sync with the Database when we get to that.., | 22:16 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/186932 | 22:17 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: query configuration via web API https://review.openstack.org/186926 | 22:19 |
| mdrnstm | lbragstad: on the 255 char length fernet token | 22:29 |
| mdrnstm | lbragstad: i think warning might be excessive | 22:29 |
| ayoung | mdrnstm, yeah, upload was just the first thought | 22:30 |
| mdrnstm | ayoung: ++ | 22:30 |
| ayoung | mdrnstm, syncing with the DB code is going to be hard, too. | 22:30 |
| mdrnstm | we already need to solve the language to indicate subst. | 22:31 |
| mdrnstm | so my thought is define what we will subst in | 22:31 |
| ayoung | I like what Iorem wrote, but we need to make it match oslo.policy | 22:31 |
| mdrnstm | on fetch we can subst | 22:31 |
| ayoung | and defer the actual substitution | 22:31 |
| ayoung | we can do it at whatever point makes the most sense | 22:32 |
| bknudson | maybe we can do a better job with the request body data with flask -- http://werkzeug.pocoo.org/docs/0.10/wrappers/#werkzeug.wrappers.BaseRequest.get_data | 22:34 |
| bknudson | I suppose just limiting the size of the request body helps | 22:34 |
| openstackgerrit | Merged openstack/keystoneauth: Rename federated.py to federation.py https://review.openstack.org/186753 | 22:34 |
| *** alanf-mc has joined #openstack-keystone | 22:34 | |
| *** hemna is now known as hemnabeer | 22:36 | |
| bknudson | flask/workzeug has built-in request body size limiter -- http://werkzeug.pocoo.org/docs/0.10/request_data/#limiting-request-data | 22:36 |
| bknudson | so we could drop the middleware | 22:36 |
| mdrnstm | lbragstad dolphm: issue with fernet tokens and KSM | 22:36 |
| mdrnstm | lbragstad dolphm: memcache code in KSM does bad things and ends up with key-lengths that are too long causing failures when enabled | 22:37 |
| mdrnstm | bknudson: ++ | 22:37 |
| bknudson | it's also got JSON parsing -- http://werkzeug.pocoo.org/docs/0.10/request_data/#how-to-extend-parsing | 22:38 |
| mdrnstm | bknudson: yay for getting things for Free ™ | 22:38 |
| mdrnstm | bknudson: interesting we could offload a bunch of stuff it looks like | 22:39 |
| *** aix has quit IRC | 22:39 | |
| bknudson | all of the stuff in http://git.openstack.org/cgit/openstack/keystone/tree/keystone/middleware/core.py seems like it shouldn't be in keystone, except for AuthContextMiddleware | 22:39 |
| mdrnstm | bknudson: I like this | 22:40 |
| bknudson | add it to the list! | 22:41 |
| openstackgerrit | Merged openstack/keystonemiddleware: Fixup test-requirements-py3.txt https://review.openstack.org/184882 | 22:41 |
| mdrnstm | lbragstad dolphm: will add another bug in a momenet for this | 22:44 |
| *** samueldmq has quit IRC | 22:47 | |
| *** samueldmq has joined #openstack-keystone | 22:48 | |
| *** boris-42 has quit IRC | 22:48 | |
| mdrnstm | dstufft: holy crap. | 22:52 |
| mdrnstm | whoopse | 22:52 |
| mdrnstm | that wasn't meant to be targeted at dstufft | 22:52 |
| * mdrnstm starts of | 22:52 | |
| mdrnstm | over | 22:52 |
| mdrnstm | holy crap, this whole container thing might actually work for a dev environment | 22:53 |
| * mdrnstm obviously can't type :) | 22:53 | |
| mdrnstm | oh there it is... fail with ffi.h | 22:53 |
| *** emagana has quit IRC | 22:55 | |
| *** emagana has joined #openstack-keystone | 22:55 | |
| samueldmq | ayoung, just in the case you didn't notice yet | 22:57 |
| samueldmq | ayoung, https://review.openstack.org/#/q/status:open+branch:master+topic:bp/list-policies-by-endpoint-url,n,z | 22:57 |
| samueldmq | ayoung, GET /policies?url=<endpoint_url> is already under review | 22:58 |
| samueldmq | ayoung, :) | 22:58 |
| *** mdrnstm has quit IRC | 23:02 | |
| *** zzzeek has quit IRC | 23:17 | |
| openstackgerrit | Merged openstack/keystone: Don't assume group IDs are UUID format https://review.openstack.org/186392 | 23:23 |
| openstackgerrit | Merged openstack/keystone: Don't assume project IDs are UUID format https://review.openstack.org/186393 | 23:26 |
| *** lhcheng has quit IRC | 23:27 | |
| *** browne has quit IRC | 23:32 | |
| *** lhcheng has joined #openstack-keystone | 23:33 | |
| *** ChanServ sets mode: +v lhcheng | 23:33 | |
| *** gokrokve_ has joined #openstack-keystone | 23:33 | |
| *** lhcheng has quit IRC | 23:33 | |
| *** lhcheng has joined #openstack-keystone | 23:34 | |
| *** ChanServ sets mode: +v lhcheng | 23:34 | |
| *** mdrnstm has joined #openstack-keystone | 23:37 | |
| *** mdrnstm has quit IRC | 23:37 | |
| *** mdrnstm has joined #openstack-keystone | 23:37 | |
| *** ChanServ sets mode: +v mdrnstm | 23:37 | |
| *** gokrokve has quit IRC | 23:37 | |
| mdrnstm | dolphm: https://bugs.launchpad.net/keystonemiddleware/+bug/1460225 | 23:44 |
| openstack | Launchpad bug 1460225 in keystonemiddleware "Fernet + Memcache causes validation failures" [Undecided,New] | 23:44 |
| *** mdrnstm has quit IRC | 23:52 | |
| *** mdrnstm has joined #openstack-keystone | 23:53 | |
| *** mdrnstm is now known as Guest46643 | 23:53 | |
| *** Guest46643 is now known as needscoffee | 23:54 | |
| *** needscoffee has joined #openstack-keystone | 23:54 | |
| *** ChanServ sets mode: +v needscoffee | 23:54 | |
| *** needscoffee is now known as mdrnstm | 23:54 | |
| *** gokrokve_ has quit IRC | 23:56 | |
| *** gokrokve has joined #openstack-keystone | 23:57 | |
| *** lhcheng has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!