Sunday, 2015-05-31

*** markvoelker has joined #openstack-keystone00:04
*** dimsum__ has joined #openstack-keystone00:06
*** stevemar has quit IRC00:08
*** markvoelker has quit IRC00:09
*** emagana has joined #openstack-keystone00:15
*** dimsum__ has quit IRC00:18
*** emagana has quit IRC00:20
*** devlaps has joined #openstack-keystone00:23
*** devlaps has quit IRC00:27
*** dimsum__ has joined #openstack-keystone00:36
*** dimsum__ has quit IRC00:37
*** dimsum__ has joined #openstack-keystone00:37
openstackgerritDiane Fleming proposed openstack/keystone-specs: Add side-by-side comparison table of v2 and v3 APIs  https://review.openstack.org/18702700:47
*** topol has joined #openstack-keystone00:58
*** ChanServ sets mode: +v topol00:58
*** markvoelker has joined #openstack-keystone01:05
*** emagana has joined #openstack-keystone01:09
*** markvoelker has quit IRC01:10
*** emagana has quit IRC01:14
*** stevemar has joined #openstack-keystone01:19
*** ChanServ sets mode: +v stevemar01:19
*** dimsum__ has quit IRC01:57
openstackgerritDiane Fleming proposed openstack/keystone-specs: Add side-by-side comparison table of v2 and v3 APIs  https://review.openstack.org/18702701:57
*** emagana has joined #openstack-keystone02:03
*** emagana has quit IRC02:08
*** markvoelker has joined #openstack-keystone02:54
*** dimsum__ has joined #openstack-keystone02:57
*** emagana has joined #openstack-keystone02:57
*** markvoelker has quit IRC02:59
*** emagana has quit IRC03:02
topoldstanek, re https://review.openstack.org/#/c/186994/1/keystoneclient/session.py, how did you know the json portion was no longer used?03:03
*** dimsum__ has quit IRC03:03
jamielennoxtopol: the _ prefix of the function means it's private so it should only be called from within the same object, given that we control how it's called if we don't pass json= to it then it isn't used03:06
topoljamielennox.  Makes sense. But any idea why it was there in the first place. Someone must have thought they may eventually use it.03:08
* topol I think jamielennox just earned himself a jacket with his great answer to my question03:08
jamielennoxtopol: more likely that it was used at some point and then it was optimised out, all the information that was passed to it is also available on the response object so if you needed to make private part of the response (like removing the token or service catalog from logs) you wanted to override the json= value03:09
jamielennoxi honestly don't remember why it was done that way03:09
*** ajayaa has joined #openstack-keystone03:09
jamielennox:)03:09
topolagreed. I guess I could do git blame if it bugs me.  But I buy your answer :-)03:10
jamielennoxthat was a powerful response indeed then03:10
jamielennoxtopol: this is the reason to make all these things private by default. if we don't use it we can change the signature and change it back again later if we need to03:10
topoljamielennox I completely agree!  Nothing scary than something looking like its a public API, then folks depend on it, then we change it and say, sorry it was really private03:11
jamielennoxtopol: we have certainly fallen into that mistake a few times03:12
topoljamielennox.  I recall them well. We had some internal IBMers that went ballistic at Brant and I when it happened a few years ago  :-)03:12
*** rlt_ has quit IRC03:16
*** ajayaa has quit IRC03:19
openstackgerritMerged openstack/keystone: Add "enabled" to create service provider example  https://review.openstack.org/18640203:30
stevemartopol, someone went ballistic on you?! never?03:31
topolstevemar. Happens all the time.  This mule has been whipped so many times I dont even feel it :-)03:32
*** ajayaa has joined #openstack-keystone03:35
stevemartopol, unleash the wookie on them03:41
topolstevemar, more flies with honey... more flies with honey03:44
*** samueldmq has quit IRC03:44
topolstevemar, I'm reviewing https://review.openstack.org/#/c/182102/7/keystone/auth/controllers.py  and Brant wrote some awesomely clean code03:45
*** emagana has joined #openstack-keystone03:52
*** emagana has quit IRC03:57
*** arunkant has quit IRC04:07
*** lhcheng has quit IRC04:13
*** arunkant has joined #openstack-keystone04:15
*** lhcheng has joined #openstack-keystone04:28
*** ChanServ sets mode: +v lhcheng04:28
topolstevemar, jamielennox After reviewing https://review.openstack.org/#/c/182102/  I am now depressed.   I don't think I could ever write code as elegant as what I just reviewed.  I feel like a short order cook in a world of gourmet chefs04:30
topolMaybe next time I should pronounce that guys name correctly on stage  :-)04:31
stevemarnah04:33
stevemarscrew that noise04:33
jamielennoxtopol: all that in ~80 lines :(04:39
openstackgerritMerged openstack/keystone: Sync oslo-incubator cc19617  https://review.openstack.org/18315304:41
*** markvoelker has joined #openstack-keystone04:42
*** emagana has joined #openstack-keystone04:46
*** markvoelker has quit IRC04:47
*** emagana has quit IRC04:50
*** _cjones_ has joined #openstack-keystone05:23
*** emagana has joined #openstack-keystone05:26
*** _cjones_ has quit IRC05:29
*** emagana has quit IRC05:31
*** ajayaa has quit IRC05:42
*** stevemar has quit IRC05:49
*** emagana has joined #openstack-keystone05:56
*** topol has quit IRC06:00
*** emagana has quit IRC06:01
*** lufix_ has joined #openstack-keystone06:04
*** henrynash_ has joined #openstack-keystone06:06
*** ChanServ sets mode: +v henrynash_06:06
*** henrynash has quit IRC06:09
*** henrynash_ is now known as henrynash06:09
*** jamielennox is now known as jamielennox|away06:17
*** _cjones_ has joined #openstack-keystone06:26
*** alanf-mc has joined #openstack-keystone06:30
*** _cjones_ has quit IRC06:30
*** mabrams has joined #openstack-keystone06:30
*** mabrams has left #openstack-keystone06:30
*** mabrams has joined #openstack-keystone06:30
*** markvoelker has joined #openstack-keystone06:31
*** markvoelker has quit IRC06:36
*** HT_sergio has quit IRC06:42
*** alanf-mc has quit IRC06:44
*** alanf-mc has joined #openstack-keystone06:48
*** emagana has joined #openstack-keystone06:51
*** alanf-mc has quit IRC06:53
*** emagana has quit IRC06:55
*** gsilvis has quit IRC07:07
*** gsilvis has joined #openstack-keystone07:09
*** dylan1 has joined #openstack-keystone07:19
dylan1Hi,all. I have a question about keystone federation. Can one keystone be configured as service provider and identity provider for another service provider?07:21
mabramsdylan1: in K2K (keystone to keystone) federation introduced in kilo, it is possible for one keystone to be a IDP for another keystone instance07:33
dylan1mabrams, does one keystone have multiple identity providers?07:36
dylan1for example, there are 3 keystone - A, B and C.  can i configure B and C as the A's IDP at the same time?07:37
mabramsdylan1: that should work07:41
dylan1thanks,mabrams, if it's ok , what's the sequence when A receives a token request?07:42
*** emagana has joined #openstack-keystone07:45
mabramsdylan1: not sure; would think it's something simple like "preferred" or conf order or something; probably not by region or TTL.  let me see if i can find a diag07:46
*** emagana has quit IRC07:49
*** alanf-mc has joined #openstack-keystone07:49
*** emagana has joined #openstack-keystone07:56
*** emagana has quit IRC08:01
dylan1Thanks, mabrams. I think  maybe  it's useful in multiple in-house clouds08:02
*** alanf-mc has quit IRC08:08
*** markvoelker has joined #openstack-keystone08:20
*** dimsum__ has joined #openstack-keystone08:24
*** markvoelker has quit IRC08:25
*** _cjones_ has joined #openstack-keystone08:27
*** alanf-mc has joined #openstack-keystone08:27
*** dimsum__ has quit IRC08:29
*** bradjones has quit IRC08:29
*** bradjones has joined #openstack-keystone08:31
*** _cjones_ has quit IRC08:31
*** emagana has joined #openstack-keystone08:50
*** emagana_ has joined #openstack-keystone08:52
*** emagana has quit IRC08:55
*** emagana_ has quit IRC08:57
*** alanf-mc has quit IRC09:09
*** _cjones_ has joined #openstack-keystone09:28
*** _cjones_ has quit IRC09:34
*** dylan1 has quit IRC09:37
*** emagana has joined #openstack-keystone09:46
*** emagana has quit IRC09:51
ekarlsols09:54
*** markvoelker has joined #openstack-keystone10:09
*** nlevinki has joined #openstack-keystone10:12
*** markvoelker has quit IRC10:14
*** emagana has joined #openstack-keystone10:40
*** emagana has quit IRC10:45
openstackgerrithenry-nash proposed openstack/keystone-specs: Enable listing of role assignments in a project hierarchy  https://review.openstack.org/18704511:10
*** henrynash has quit IRC11:33
*** emagana has joined #openstack-keystone11:34
*** emagana has quit IRC11:39
*** markvoelker has joined #openstack-keystone11:40
*** dimsum__ has joined #openstack-keystone11:43
*** markvoelker has quit IRC11:44
*** dimsum__ has quit IRC11:55
*** dimsum__ has joined #openstack-keystone11:55
*** dimsum__ has quit IRC12:01
*** dimsum__ has joined #openstack-keystone12:07
*** samueldmq has joined #openstack-keystone12:18
*** emagana has joined #openstack-keystone12:29
*** lhcheng has quit IRC12:32
*** emagana has quit IRC12:33
*** markvoelker has joined #openstack-keystone12:40
*** jamielennox|away is now known as jamielennox12:40
*** markvoelker has quit IRC12:45
*** henrynash has joined #openstack-keystone12:46
*** ChanServ sets mode: +v henrynash12:46
*** boris-42 has quit IRC12:48
*** jamielennox is now known as jamielennox|away13:19
*** emagana has joined #openstack-keystone13:23
*** emagana has quit IRC13:27
*** topol has joined #openstack-keystone13:43
*** ChanServ sets mode: +v topol13:43
*** dimsum__ has quit IRC13:46
*** henrynash has quit IRC13:49
*** emagana has joined #openstack-keystone14:17
*** emagana has quit IRC14:21
*** markvoelker has joined #openstack-keystone14:26
*** markvoelker has quit IRC14:30
*** markvoelker has joined #openstack-keystone14:33
*** samueldmq has quit IRC14:37
*** nlevinki has quit IRC14:42
*** archers has joined #openstack-keystone14:44
*** dimsum__ has joined #openstack-keystone14:50
openstackgerritBrant Knudson proposed openstack/keystone: Refactor extract function load_auth_method  https://review.openstack.org/18700414:53
openstackgerritBrant Knudson proposed openstack/keystone: Use stevedore for auth drivers  https://review.openstack.org/18210214:53
*** dimsum__ has quit IRC14:56
*** mabrams has quit IRC15:00
openstackgerritBrant Knudson proposed openstack/keystone: Fix sending invalid query parameters to database  https://review.openstack.org/16394915:02
*** topol has quit IRC15:09
*** emagana has joined #openstack-keystone15:11
*** emagana has quit IRC15:16
*** dimsum__ has joined #openstack-keystone15:17
openstackgerritBrant Knudson proposed openstack/python-keystoneclient: Cleanup fixture imports  https://review.openstack.org/18706015:28
*** emagana has joined #openstack-keystone16:05
*** emagana has quit IRC16:10
openstackgerritBrant Knudson proposed openstack/keystone: Correct oauth1 driver help text  https://review.openstack.org/18706116:16
openstackgerritBrant Knudson proposed openstack/keystone: Update sample config file  https://review.openstack.org/18706216:16
*** archers has quit IRC16:28
openstackgerritBrant Knudson proposed openstack/keystone: Update functional tox env requirements  https://review.openstack.org/18706316:28
*** markvoelker has quit IRC16:34
*** dimsum__ has quit IRC16:35
*** pnavarro has joined #openstack-keystone16:37
openstackgerritBrant Knudson proposed openstack/keystone: Correct enabled emulation query to request no attributes  https://review.openstack.org/18706516:49
*** devlaps has joined #openstack-keystone16:53
*** emagana has joined #openstack-keystone16:59
*** emagana has quit IRC17:04
*** devlaps has quit IRC17:09
*** pnavarro has quit IRC17:14
*** woodster_ has joined #openstack-keystone17:16
*** emagana has joined #openstack-keystone17:17
*** emagana has quit IRC17:21
*** markvoelker has joined #openstack-keystone17:35
*** markvoelker has quit IRC17:39
*** dimsum__ has joined #openstack-keystone17:51
*** dimsum__ has quit IRC17:56
*** stevemar has joined #openstack-keystone18:03
*** ChanServ sets mode: +v stevemar18:03
*** gokrokve_ has joined #openstack-keystone18:08
*** emagana has joined #openstack-keystone18:11
*** gokrokve has quit IRC18:11
*** stevemar has quit IRC18:14
*** emagana has quit IRC18:16
*** lhcheng has joined #openstack-keystone18:37
*** ChanServ sets mode: +v lhcheng18:37
openstackgerritMerged openstack/keystone: Correct oauth1 driver help text  https://review.openstack.org/18706118:52
*** gokrokve has joined #openstack-keystone18:53
*** gokrokve_ has quit IRC18:56
*** gokrokve has quit IRC18:58
*** boris-42 has joined #openstack-keystone18:58
*** belmoreira has joined #openstack-keystone19:03
*** gokrokve has joined #openstack-keystone19:04
*** gokrokve has quit IRC19:05
*** emagana has joined #openstack-keystone19:05
*** belmoreira has quit IRC19:09
*** emagana has quit IRC19:10
openstackgerritMerged openstack/keystone: Update sample config file  https://review.openstack.org/18706219:16
*** markvoelker has joined #openstack-keystone19:24
*** markvoelker has quit IRC19:28
*** woodster_ has quit IRC19:30
openstackgerritMerged openstack/keystone: Update functional tox env requirements  https://review.openstack.org/18706319:33
*** emagana has joined #openstack-keystone20:00
*** emagana has quit IRC20:04
*** belmoreira has joined #openstack-keystone20:04
openstackgerritDiane Fleming proposed openstack/keystone-specs: Add side-by-side comparison table of v2 and v3 APIs  https://review.openstack.org/18702720:08
*** gokrokve has joined #openstack-keystone20:09
*** gokrokve has quit IRC20:16
*** emagana has joined #openstack-keystone20:54
openstackgerritMorgan Fainberg proposed openstack/keystonemiddleware: Ensure cache keys are a known/fixed length  https://review.openstack.org/18697120:56
*** emagana has quit IRC20:59
*** dimsum__ has joined #openstack-keystone21:02
openstackgerritDiane Fleming proposed openstack/keystone-specs: Add side-by-side comparison table of v2 and v3 APIs  https://review.openstack.org/18702721:05
*** stevemar has joined #openstack-keystone21:09
*** ChanServ sets mode: +v stevemar21:09
*** markvoelker has joined #openstack-keystone21:13
openstackgerritDiane Fleming proposed openstack/keystone-specs: Add side-by-side comparison table of v2 and v3 APIs  https://review.openstack.org/18702721:14
*** lufix_ has quit IRC21:16
*** markvoelker has quit IRC21:17
openstackgerritMorgan Fainberg proposed openstack/keystoneauth: Remove i18n stub  https://review.openstack.org/18674821:21
openstackgerritMorgan Fainberg proposed openstack/keystoneauth: Cleanup needless variable binding  https://review.openstack.org/18708021:21
morganfainbergjamielennox|away: we need to figure out the auth plugins for KSA when we move to keystoneauth121:23
morganfainbergi think we just move the namespace to being keystoneauth1 for them21:23
morganfainbergso loading from keystoneauth1 works as you'd expect21:23
*** belmoreira has quit IRC21:36
*** woodster_ has joined #openstack-keystone21:42
mordredmorganfainberg: you could also have ksa do a scan for ksc plugin namespace during a transition period21:43
mordredthere is nothing special about the namespaces, they're just strings21:43
morganfainbergmordred: oh i was just thinking strictly in KSA21:43
morganfainbergnot even ksc21:43
morganfainbergthe ksc -> ksa transition yes21:43
mordredyah21:43
morganfainbergthat makes sense21:43
morganfainbergbut ksa right now owns the namespace keystoneauth.auth.plugin21:43
morganfainbergand i was thinking we need to make that keystoneauth1.auth.plugin21:44
mordredbtw - there is an amazing thunderstorm going on in NYC right now ...21:44
mordredmorganfainberg: ah - I grok what you're saying21:44
morganfainbergi'm jealous. i'm stuck in hot weather + lots of stupid on bikes (yay shutdown major roads for cycling, but ugh.. it makes the city bad to et in/out of today)21:45
morganfainbergbut awesome thunderstorm is always cool21:45
openstackgerritMerged openstack/python-keystoneclient-kerberos: Updated from global requirements  https://review.openstack.org/18123521:46
morganfainbergugh: +3963 lines21:47
morganfainbergyeah not even going to try and review that21:47
*** emagana has joined #openstack-keystone21:48
openstackgerritMerged openstack/python-keystoneclient-saml2: Updated from global requirements  https://review.openstack.org/16158821:48
*** henrynash has joined #openstack-keystone21:48
*** ChanServ sets mode: +v henrynash21:48
morganfainbergmordred: totally getting into the gertty workflow now21:50
morganfainberghenrynash: ping21:50
henrynashmorganfainberg: pong21:51
morganfainberghenrynash: https://bugs.launchpad.net/keystone/+bug/145034421:51
openstackLaunchpad bug 1450344 in Keystone "Invalid SQL Identity Assertion - Load Config from Database" [Undecided,New] - Assigned to Henry Nash (henry-nash)21:51
morganfainberghenrynash: looks like we broke people21:51
morganfainberghenrynash: can't restrict per-domain to SQL only21:51
morganfainbergerm21:51
morganfainbergLDAP only21:51
morganfainbergneed to re-enable that usecase21:51
henrynashmorganfainberg: yep, if you rememember I was concerned about his21:51
morganfainberghenrynash: well we have a clear and direct bug21:52
morganfainberggoing to hit that with a high prio stick21:52
morganfainbergi've assigned it to you, i *think* you are the best person to quickly turn it around. let me know if you need me to jump on it instead21:52
*** emagana has quit IRC21:52
henrynashmorganfainberg: so we can easily remove taht restriction…just need to decide how (if) we protect the race condition21:53
mordredmorganfainberg: it's pretty badass isn't it?21:53
morganfainbergmordred: yep. totally.21:53
henrynashmorganfainberg: I’ll get in it straight away21:53
morganfainberghenrynash: yeah. and protect the race as best you can/at least well enough to prevent people from horking themselves permanently21:53
morganfainberghenrynash: maybe the fix is any/all SQL backed domains get wired to the same backend until we get per-domain sql connection strings21:54
henrynashmorganfainberg: one fix would be to use SQL to store whether there was a domin using the SQL drver or not21:54
morganfainberghenrynash: but that wouldn't be backport worthy-future looking.21:54
morganfainberghenrynash: yeah.21:54
morganfainberghenrynash: might be the best choice21:54
morganfainbergbut i don't like the black-magic feel of it21:54
morganfainbergit's not intuitive21:55
morganfainberghenrynash: but regardless we need to fix it, so lets figure out the best way forward for the moment21:55
morganfainbergmordred: also not needing to run VMs is super duper nice for testing things21:55
henrynashmorganfainberg: as a seperate task, I want to investigate what it woyld take to remove the restriction of one SQL backend anyway…..but that’s on a longer track21:55
morganfainberghenrynash: i think that is an oslo.db needs to grow smarter issue21:56
henrynashmorganfainberg: yep, probably true21:56
henrynashmorganfainberg: seperate point….which days of the week of July 13th is the midcyle….just reserving my hotl eroom!21:57
morganfainberghenrynash: it's on the sprint wiki21:57
morganfainbergbut i think it's wed, thur, fri21:57
henrynashthat’s what I thought…ok!21:58
* morganfainberg needs to figure out that travel stuff21:58
rodrigodsnot sure, but I guess mid cycle is off the table for us :(21:59
morganfainbergrodrigods: aww =/21:59
morganfainbergi know it's hard for international travel21:59
rodrigodsyeah =/21:59
morganfainbergrodrigods: it's why i don't expect jamielennox|away to be there. if you can make it great, if not, it's why we're trying to de-emphasize the "must be there" aspect22:00
rodrigodslast one I knew that we *could* send one person22:00
rodrigodsthis one I'm not sure22:00
rodrigodsmorganfainberg, yeah, I know22:00
morganfainbergmordred: oddly, I noticed the CF chassis doesn't get as hot as the AL chassis of the MBPr. Interesting considering the chips are comparable22:01
morganfainbergmordred: is there a gertty way to get the link for the current review in gerrit?22:02
morganfainbergi don't seem to be able to copy that info out of gertty22:02
mordredhrm. I'm not sure anyone's ever asked for that22:03
morganfainberguseful for saying "hey X look at review" on irc22:03
* morganfainberg might have a feature add for gertty22:03
mordredah - we've all taken to just pasting numbers22:03
mordredassuming that everyone else has gertty and can do C-o22:03
morganfainbergright and numbers are good...22:03
morganfainbergbut dropping a link in is nice too.22:03
mordredyah22:03
morganfainbergshould be silly easy to add that in22:04
* morganfainberg will look at doing that22:04
*** belmoreira has joined #openstack-keystone22:08
morganfainbergooh. this may not be *easy*22:09
morganfainbergor stupid easy: https://github.com/asweigart/pyperclip22:12
*** henrynash has quit IRC22:12
*** jamielennox|away is now known as jamielennox22:17
*** stevemar has quit IRC22:21
openstackgerritMerged openstack/keystonemiddleware: Ignore cover directory  https://review.openstack.org/17870722:22
*** belmoreira has quit IRC22:26
*** emagana has joined #openstack-keystone22:42
*** markvoelker has joined #openstack-keystone22:43
*** emagana has quit IRC22:47
*** markvoelker has quit IRC22:48
openstackgerritMerged openstack/keystoneauth: Remove i18n stub  https://review.openstack.org/18674822:50
jamielennoxdoes anyone know how ec2 credentials work with the v3 api?23:15
*** markvoelker has joined #openstack-keystone23:18
morganfainbergjamielennox: we do something silly23:32
morganfainbergjamielennox: we just re-use the same pipeline iirc23:32
morganfainbergjamielennox: *very* silly23:32
jamielennoxec2 is available in v3 api?23:32
morganfainbergshould be.23:32
morganfainbergjamielennox: https://github.com/openstack/keystone/blob/master/etc/keystone-paste.ini#L30-L3123:33
jamielennoxergh23:34
morganfainbergjamielennox: https://github.com/openstack/keystone/blob/master/keystone/contrib/ec2/controllers.py#L36423:34
jamielennoxwell i'm looking to create credential and and least it's better than working with the credentials api23:34
jamielennoxcome on v4!23:36
*** emagana has joined #openstack-keystone23:36
jamielennoxi don't know if i want to support ec2 crud for keystoneclient v3 :(23:39
*** emagana has quit IRC23:41
*** chlong has joined #openstack-keystone23:44
morganfainbergjamielennox: uhmmmm break auth from CRUD for me23:50
jamielennoxthis is still a crud issue23:50
morganfainbergjamielennox: then v4 is something we can talk about once people are on v323:50
jamielennoxmorganfainberg: so this is all in aid of moving devstack completely off v223:51
jamielennoxand it has some ec2 credential stuff23:51
jamielennoxwhich i didn't realize we even supported in v323:52

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!