| *** sbasam has quit IRC | 00:00 | |
| *** dims_ has joined #openstack-keystone | 00:05 | |
| *** _cjones_ has quit IRC | 00:05 | |
| *** dims has quit IRC | 00:08 | |
| *** g2` has quit IRC | 00:17 | |
| *** browne has quit IRC | 00:18 | |
| *** gyee_ has quit IRC | 00:32 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/189457 | 00:33 |
|---|---|---|
| openstackgerrit | Brant Knudson proposed openstack/keystone: Refactor extract function load_auth_method https://review.openstack.org/187004 | 00:43 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Use stevedore for auth drivers https://review.openstack.org/182102 | 00:43 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update sample config file https://review.openstack.org/182138 | 00:43 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Short names for auth plugins https://review.openstack.org/182107 | 00:43 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Use stevedore for auth drivers https://review.openstack.org/182102 | 01:01 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update sample config file https://review.openstack.org/182138 | 01:01 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Short names for auth plugins https://review.openstack.org/182107 | 01:01 |
| *** spandhe has quit IRC | 01:05 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 01:06 | |
| *** dguerri is now known as dguerri` | 01:07 | |
| *** diegows has quit IRC | 01:09 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor _validate_token returns auth_ref only https://review.openstack.org/189020 | 01:10 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Change TokenCache get() to return auth_ref https://review.openstack.org/189022 | 01:10 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor _confirm_token_bind takes AccessInfo https://review.openstack.org/179676 | 01:10 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor TokenCache store takes auth_ref https://review.openstack.org/189019 | 01:10 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor use auth_ref.version rather than _token_is_v* https://review.openstack.org/189018 | 01:10 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor extract method for offline validation https://review.openstack.org/188650 | 01:10 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: validate_token returns AccessInfo https://review.openstack.org/179486 | 01:10 |
| *** tqtran_ has quit IRC | 01:11 | |
| *** noye has quit IRC | 01:16 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 01:20 | |
| *** lastops has quit IRC | 01:20 | |
| *** lastops has joined #openstack-keystone | 01:21 | |
| *** ankita_wagh has quit IRC | 01:24 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Stop using function deprecated in Python 3 https://review.openstack.org/189149 | 01:29 |
| *** jamielennox|away is now known as jamielennox | 01:32 | |
| *** roxanaghe has quit IRC | 01:40 | |
| *** dims_ has quit IRC | 01:43 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Unit tests catch deprecated function usage https://review.openstack.org/189145 | 01:47 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Switch from deprecated isotime https://review.openstack.org/189147 | 01:47 |
| *** liusheng has quit IRC | 02:09 | |
| *** lhcheng has quit IRC | 02:16 | |
| *** bradjones has quit IRC | 02:17 | |
| *** lhcheng has joined #openstack-keystone | 02:18 | |
| *** ChanServ sets mode: +v lhcheng | 02:18 | |
| *** bradjones has joined #openstack-keystone | 02:18 | |
| *** bradjones has quit IRC | 02:18 | |
| *** bradjones has joined #openstack-keystone | 02:18 | |
| *** lhcheng has quit IRC | 02:22 | |
| *** iamjarvo has joined #openstack-keystone | 02:22 | |
| *** iamjarvo has quit IRC | 02:23 | |
| *** iamjarvo has joined #openstack-keystone | 02:23 | |
| *** tobe has joined #openstack-keystone | 02:27 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Use random strings for test fixtures https://review.openstack.org/189538 | 02:31 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Stop using tearDown https://review.openstack.org/189539 | 02:31 |
| ayoung | jamielennox, if I do keystone = keystone_v3.Client(session=create_session()) I should be able to then call keystone.service_catalog.list() or something right? | 02:37 |
| jamielennox | probably not, service-catalog isn't an option of the v3 api | 02:38 |
| jamielennox | ayoung: what are you trying to do | 02:41 |
| jamielennox | there really isn't a way to get the service catalog out of a plugin | 02:41 |
| ayoung | jamielennox, I want to see what the service catalog is associated with my tokens | 02:41 |
| ayoung | I could probably just dump the log | 02:41 |
| jamielennox | i did this on purpose if we go to a DNS based catalog or something else that you can't iterate | 02:42 |
| ayoung | but I figured I'd try to learn the IPA | 02:42 |
| ayoung | heh | 02:42 |
| ayoung | the API | 02:42 |
| ayoung | and as a non-admin user, I can;'t query the SC directly | 02:42 |
| ayoung | jamielennox, so this came from a nova error: | 02:42 |
| ayoung | jamielennox, http://paste.fedoraproject.org/230196/14338177/ which I am guessing is cuz maybe I am calling a version of the Nova API that is not supported | 02:43 |
| *** dims has joined #openstack-keystone | 02:43 | |
| jamielennox | ayoung: no, that ones because you didn't provide an auth_url | 02:45 |
| ayoung | jamielennox, ah...that is right, this machine crashed and I had to restart... | 02:46 |
| *** dguerri` is now known as dguerri | 02:46 | |
| ayoung | jamielennox, so, I am working on a demo setup, and part of that involves Neutron work. I have some examples now of doing Neutron with auth sessions | 02:47 |
| ayoung | actually, of sharing a session across a couple services...neutron and nova to start | 02:48 |
| ayoung | and, thanks, that did work | 02:48 |
| jamielennox | ayoung: sweet - yea, the error messages for this stuff needs to get better but it's a hard thing to enforce | 02:49 |
| ayoung | jamielennox, oh, yeah. I should put a check in my code before I try to create the session | 02:50 |
| ayoung | the hardest part has been reverse engineering how to call neutron client code | 02:50 |
| jamielennox | i had some code that did these checks generically | 02:50 |
| *** nkinder__ has joined #openstack-keystone | 02:50 | |
| *** dims has quit IRC | 02:50 | |
| jamielennox | i assume it's still in review somewhere | 02:50 |
| jamielennox | https://review.openstack.org/#/c/148784/ | 02:51 |
| ayoung | jamielennox, now I am trying to figure out how generic to make the nova code. I couold hard-code the ids, but that won't work across two different deployments, and I know this particualr OS instance is going to get rebuilt. | 02:51 |
| jamielennox | i wasn't sure it would make it because it was changing behaviour | 02:51 |
| ayoung | jamielennox, if you get something there you like, let me know and I'll review | 02:52 |
| ayoung | anyway, the session stuff looks good. Real good. It makes me want to have smarter API clients. | 02:52 |
| ayoung | I do think I we are going to want Kerberos on the session. Could we do some sort of stevedore trick, where we list additional auth plugins as envrionment variables, and then the session lodas them in? | 02:53 |
| ayoung | trying to think how to get kerberos in there in a sane way | 02:53 |
| *** ajayaa has joined #openstack-keystone | 02:54 | |
| *** rushiagr_away is now known as rushiagr | 02:54 | |
| ayoung | jamielennox, did glance make the transition to sessions for their client? | 02:55 |
| *** dguerri is now known as dguerri` | 02:56 | |
| ayoung | http://docs.openstack.org/developer/python-glanceclient/apiv2.html does not look like it in the docs... | 02:57 |
| *** markvoelker has joined #openstack-keystone | 02:59 | |
| jamielennox | ayoung: no | 03:02 |
| ayoung | jamielennox, that is pretty lame, but I guess I can do all my glance work via Nova. | 03:02 |
| ayoung | GAH I need to get all images just to map name to id! | 03:03 |
| *** markvoelker has quit IRC | 03:04 | |
| *** briancurtin has quit IRC | 03:06 | |
| *** zhiyan has quit IRC | 03:06 | |
| *** jraim has quit IRC | 03:06 | |
| *** nzeer has quit IRC | 03:06 | |
| *** serverascode has quit IRC | 03:06 | |
| *** ctracey has quit IRC | 03:06 | |
| ayoung | jamielennox, so I can't use the glance API directly, because I don't even know the endpoint, and, as we found before, I can't get it out of the service catalog. GLanceclient has bit rotted into obscurity | 03:07 |
| ayoung | glance = Client('2', endpoint=OS_IMAGE_ENDPOINT, token=token) | 03:07 |
| jamielennox | ayoung: the way you do it is | 03:07 |
| jamielennox | token = session.get_token() | 03:08 |
| ayoung | http://docs.openstack.org/developer/python-glanceclient/apiv2.html | 03:08 |
| jamielennox | endpoint = session.get_endpoint(service_type='image', version=(2, 0), interface='public') | 03:08 |
| jamielennox | then do glance with endpoint=endpoint, token=token | 03:08 |
| ayoung | ok...let me try that | 03:08 |
| jamielennox | assuming your auth plugin is attached to the session, otherwise you kind of invert the process and ask the auth plugin and provide the session | 03:09 |
| *** lastops has quit IRC | 03:09 | |
| *** darrenc is now known as darrenc_lunch | 03:12 | |
| jamielennox | ayoung: so i'm really not a fan of providing an array of project names, that just feels wrong, i don't know why we don't maintain the restriction for now and we can deal with it if it really becomes a problem for people | 03:12 |
| ayoung | jamielennox, sorry, I'm missing the context there. | 03:13 |
| jamielennox | i sent an email reply to you a few days ago about how to identify projects by name in a hierarchy | 03:13 |
| jamielennox | actually i have only seen chadwick's response to that | 03:14 |
| jamielennox | some people's email clients sent emails that just don't render on my phone | 03:14 |
| ayoung | jamielennox, ah... | 03:14 |
| ayoung | jamielennox, you mean the delimeter thing? | 03:14 |
| jamielennox | right | 03:14 |
| ayoung | So...I think I am OK with that approach, so long as it is a consensus | 03:15 |
| ayoung | I think that DNS style naming is the right way to go | 03:15 |
| ayoung | as we will eventually be able to append those to hostname to make deeply nested URLs | 03:15 |
| ayoung | I am guessing that it will be far more natural to refer to something as /dom1/p4/p5/p6 in the long run | 03:16 |
| jamielennox | i don't know, it feels wrong | 03:17 |
| ayoung | jamielennox, we could also hack around the problem of a domain and a project in that domain having the same name buy calling the domain "/" no matter what | 03:17 |
| jamielennox | well domains will still alwyas have unique names right | 03:17 |
| jamielennox | ? | 03:17 |
| ayoung | jamielennox, yes, if you refer to them as a domains | 03:18 |
| ayoung | I think the issue is that we have domains named, say redhat and a project under them also named redhjat | 03:18 |
| ayoung | and right now, we say that a project name must be unique | 03:18 |
| ayoung | within the domain | 03:18 |
| jamielennox | i have a growing suspicion we're going about this all wrong | 03:19 |
| ayoung | lovely...whereas the nova client blows up if I pass "name=" int image list, the glance client accepts it...and ignores it and returns all images | 03:19 |
| jamielennox | we're providing a bunch of flexibility i don't know if anyone wants yet and hacking up naming schemes to support it | 03:20 |
| ayoung | jamielennox, yes, people want hierarchical | 03:20 |
| ayoung | and this is a known issue. The problem is, like most things, my fault, for insisting "a domain IS-A" project | 03:21 |
| ayoung | and...the real fault is mine for not insisting that, instead of domains, we make projects hierarchical back 3 years ago | 03:21 |
| *** kiran-r has joined #openstack-keystone | 03:21 | |
| jamielennox | ayoung: sure, if we didn't have domains already this would be simpler | 03:22 |
| *** harlowja has quit IRC | 03:22 | |
| *** harlowja_ has joined #openstack-keystone | 03:22 | |
| jamielennox | maybe we just need to scrap authing by project_name | 03:22 |
| *** gordc has joined #openstack-keystone | 03:23 | |
| ayoung | jamielennox, can't do that, either | 03:24 |
| *** iamjarvo has quit IRC | 03:24 | |
| ayoung | that is, like, the most basic thing people do..it would break everything | 03:24 |
| ayoung | jamielennox, what do you suggest: always get un unscoped token, then discover the list, then scope it? | 03:24 |
| ayoung | I'd love that | 03:24 |
| ayoung | but they'd lynch us, I suspect | 03:25 |
| jamielennox | right, but we can not extend it for nested environments | 03:25 |
| jamielennox | if my project name involves a number of slashes i'm not going to be typing it out anyway | 03:25 |
| ayoung | jamielennox, people stick it in an Env var, or they select it from a list in horizon | 03:25 |
| ayoung | so "/p1/p2/p3" works with horizon | 03:26 |
| ayoung | the combo box will get huge and ugly, but it works | 03:26 |
| jamielennox | no, horizon will do their own thing, they'll list available projects and then do the scope by id | 03:26 |
| jamielennox | they'll find a better way to display it than that | 03:26 |
| ayoung | tree probably | 03:27 |
| jamielennox | right | 03:27 |
| ayoung | then show it as a breadcrumb | 03:27 |
| ayoung | jamielennox, so the real issue is existing CLI type use | 03:27 |
| ayoung | where OS_OPROJECT_NAME="p1" is the norm | 03:28 |
| ayoung | you are saying the, for nested projects, just force OS_PROJECT_ID? | 03:28 |
| *** rushiagr is now known as rushiagr_away | 03:28 | |
| jamielennox | it's not just a CLI issue | 03:30 |
| jamielennox | the same would flow through to all the direct API usage | 03:30 |
| jamielennox | unless project_name is directly under the domain then you can't scope to it via name in keystone | 03:30 |
| openstackgerrit | Merged openstack/python-keystoneclient: Stop using function deprecated in Python 3 https://review.openstack.org/189149 | 03:30 |
| jamielennox | that's backwards compatible | 03:30 |
| *** _cjones_ has joined #openstack-keystone | 03:31 | |
| ayoung | jamielennox, that would work for domain itself | 03:32 |
| *** _cjones_ has quit IRC | 03:32 | |
| *** _cjones_ has joined #openstack-keystone | 03:33 | |
| ayoung | we could add support for either an empty project name or "/" or soemthing to allow a project scoped token for domain | 03:33 |
| *** browne has joined #openstack-keystone | 03:33 | |
| *** davechen_afk is now known as davechen | 03:33 | |
| ayoung | ie. to get a proejct scoped token for the default domain, you request a token with OS_PROJECT_NAME="", OS_DOMAIN_NAME="Default" | 03:34 |
| *** _cjones_ has quit IRC | 03:36 | |
| *** darrenc_lunch is now known as darrenc | 03:37 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 03:40 | |
| *** richm has quit IRC | 03:42 | |
| openstackgerrit | darren-wang proposed openstack/keystone: Adding 'domain_id' filter to list_user_projects() https://review.openstack.org/182569 | 03:47 |
| *** ankita_wagh has joined #openstack-keystone | 03:50 | |
| *** iamjarvo has joined #openstack-keystone | 03:52 | |
| *** iamjarvo has quit IRC | 03:52 | |
| *** iamjarvo has joined #openstack-keystone | 03:53 | |
| *** spandhe has joined #openstack-keystone | 03:55 | |
| *** rushiagr_away is now known as rushiagr | 04:07 | |
| *** spandhe has quit IRC | 04:08 | |
| *** kiran-r has quit IRC | 04:14 | |
| *** ajayaa has quit IRC | 04:15 | |
| *** lhcheng has joined #openstack-keystone | 04:16 | |
| *** ChanServ sets mode: +v lhcheng | 04:16 | |
| *** lhcheng has quit IRC | 04:16 | |
| *** lhcheng has joined #openstack-keystone | 04:17 | |
| *** ChanServ sets mode: +v lhcheng | 04:17 | |
| *** kiran-r has joined #openstack-keystone | 04:19 | |
| *** lhcheng_ has joined #openstack-keystone | 04:20 | |
| *** morgan has joined #openstack-keystone | 04:20 | |
| *** ChanServ sets mode: +v morgan | 04:20 | |
| *** mabrams has joined #openstack-keystone | 04:23 | |
| *** mabrams has left #openstack-keystone | 04:23 | |
| *** mabrams has joined #openstack-keystone | 04:23 | |
| *** ChanServ sets mode: +o morgan | 04:23 | |
| *** lhcheng has quit IRC | 04:23 | |
| morgan | oookay | 04:23 |
| morgan | time to get a new IRC client for the phone :( | 04:24 |
| *** dguerri` is now known as dguerri | 04:35 | |
| *** morgan has quit IRC | 04:40 | |
| *** ayoung has quit IRC | 04:41 | |
| *** varya has joined #openstack-keystone | 04:43 | |
| *** dguerri is now known as dguerri` | 04:45 | |
| *** dims has joined #openstack-keystone | 04:46 | |
| *** markvoelker has joined #openstack-keystone | 04:48 | |
| *** morgan has joined #openstack-keystone | 04:49 | |
| *** ChanServ sets mode: +v morgan | 04:49 | |
| *** dims has quit IRC | 04:51 | |
| *** markvoelker has quit IRC | 04:53 | |
| *** boris-42 has quit IRC | 05:04 | |
| *** tobe has quit IRC | 05:05 | |
| *** e0ne has joined #openstack-keystone | 05:29 | |
| *** henrynash has joined #openstack-keystone | 05:31 | |
| *** ChanServ sets mode: +v henrynash | 05:31 | |
| *** iamjarvo has quit IRC | 05:32 | |
| *** kiranr has joined #openstack-keystone | 05:33 | |
| *** kiranr has quit IRC | 05:35 | |
| *** kiranr has joined #openstack-keystone | 05:35 | |
| *** kiranr has quit IRC | 05:37 | |
| *** ankita_wagh has quit IRC | 05:37 | |
| *** kiran-r has quit IRC | 05:37 | |
| *** kiranr has joined #openstack-keystone | 05:37 | |
| *** ankita_wagh has joined #openstack-keystone | 05:38 | |
| *** tqtran has joined #openstack-keystone | 05:39 | |
| *** belmoreira has joined #openstack-keystone | 05:39 | |
| *** kiranr has quit IRC | 05:41 | |
| *** kiran-r has joined #openstack-keystone | 05:42 | |
| *** kiran-r has quit IRC | 05:44 | |
| *** kiran-r has joined #openstack-keystone | 05:44 | |
| *** kiran-r has quit IRC | 05:47 | |
| *** kiran-r has joined #openstack-keystone | 05:47 | |
| *** e0ne has quit IRC | 05:47 | |
| *** kiran-r has quit IRC | 05:48 | |
| *** kiran-r has joined #openstack-keystone | 05:48 | |
| *** kiran-r has quit IRC | 05:50 | |
| *** kiran-r has joined #openstack-keystone | 05:50 | |
| *** kiran-r has quit IRC | 05:54 | |
| *** lsmola has joined #openstack-keystone | 05:54 | |
| *** kiran-r has joined #openstack-keystone | 05:55 | |
| *** kiran-r has quit IRC | 05:55 | |
| *** kiran-r has joined #openstack-keystone | 05:55 | |
| *** kiran-r has quit IRC | 05:56 | |
| *** kiran-r has joined #openstack-keystone | 05:57 | |
| *** kiran-r has quit IRC | 05:58 | |
| *** kiran-r has joined #openstack-keystone | 05:58 | |
| *** kiran-r has quit IRC | 05:59 | |
| *** kiran-r has joined #openstack-keystone | 05:59 | |
| *** kiran-r has quit IRC | 06:00 | |
| *** kiran-r has joined #openstack-keystone | 06:00 | |
| *** kiran-r has quit IRC | 06:00 | |
| *** josecastroleon has quit IRC | 06:00 | |
| *** kiran-r has joined #openstack-keystone | 06:00 | |
| *** kiran-r has quit IRC | 06:01 | |
| *** kiran-r has joined #openstack-keystone | 06:01 | |
| *** kiran-r has quit IRC | 06:02 | |
| *** kiran-r has joined #openstack-keystone | 06:02 | |
| *** kiran-r has quit IRC | 06:03 | |
| *** kiran-r has joined #openstack-keystone | 06:05 | |
| *** kiran-r has quit IRC | 06:06 | |
| *** kiran-r has joined #openstack-keystone | 06:06 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/186279 | 06:06 |
| *** kiran-r has quit IRC | 06:07 | |
| *** kiran-r has joined #openstack-keystone | 06:07 | |
| *** kiran-r has quit IRC | 06:09 | |
| *** kiran-r has joined #openstack-keystone | 06:09 | |
| *** nzeer has joined #openstack-keystone | 06:13 | |
| *** kiran-r has quit IRC | 06:14 | |
| *** kiran-r has joined #openstack-keystone | 06:14 | |
| *** jraim has joined #openstack-keystone | 06:17 | |
| *** kiran-r has quit IRC | 06:18 | |
| *** kiran-r has joined #openstack-keystone | 06:19 | |
| *** kiran-r has quit IRC | 06:21 | |
| *** kiran-r has joined #openstack-keystone | 06:22 | |
| *** kiran-r has quit IRC | 06:23 | |
| *** kiran-r has joined #openstack-keystone | 06:23 | |
| *** dguerri` is now known as dguerri | 06:24 | |
| *** lhcheng_ has quit IRC | 06:24 | |
| *** kiran-r has quit IRC | 06:26 | |
| *** kiran-r has joined #openstack-keystone | 06:26 | |
| *** Nikkau has joined #openstack-keystone | 06:27 | |
| *** kiran-r has quit IRC | 06:28 | |
| *** kiran-r has joined #openstack-keystone | 06:28 | |
| *** kiran-r has quit IRC | 06:29 | |
| *** ctracey has joined #openstack-keystone | 06:30 | |
| *** kiran-r has joined #openstack-keystone | 06:30 | |
| *** kiran-r has quit IRC | 06:30 | |
| *** kiran-r has joined #openstack-keystone | 06:31 | |
| *** kiran-r has quit IRC | 06:31 | |
| *** kiran-r has joined #openstack-keystone | 06:31 | |
| *** kiran-r has quit IRC | 06:31 | |
| *** kiran-r has joined #openstack-keystone | 06:32 | |
| *** dguerri is now known as dguerri` | 06:34 | |
| *** serverascode has joined #openstack-keystone | 06:39 | |
| *** tobe has joined #openstack-keystone | 06:45 | |
| *** zhiyan has joined #openstack-keystone | 06:46 | |
| *** ankita_w_ has joined #openstack-keystone | 06:47 | |
| *** kiran-r has quit IRC | 06:50 | |
| *** kiran-r has joined #openstack-keystone | 06:50 | |
| *** kiran-r has quit IRC | 06:51 | |
| *** ankita_wagh has quit IRC | 06:51 | |
| *** kiran-r has joined #openstack-keystone | 06:51 | |
| jamielennox | morganfainberg: i'm not going to be at the meeting tomorrow, but it doesn't look like there is anything specific i need to be there for | 06:51 |
| *** kiran-r has quit IRC | 06:52 | |
| *** kiran-r has joined #openstack-keystone | 06:52 | |
| *** kiran-r has quit IRC | 06:52 | |
| *** kiran-r has joined #openstack-keystone | 06:53 | |
| *** woodster_ has quit IRC | 06:53 | |
| *** kiran-r has quit IRC | 06:53 | |
| *** kiran-r has joined #openstack-keystone | 06:53 | |
| *** kiran-r has quit IRC | 06:55 | |
| *** kiran-r has joined #openstack-keystone | 06:55 | |
| *** kiran-r has quit IRC | 06:56 | |
| *** kiran-r has joined #openstack-keystone | 06:57 | |
| *** kiran-r has quit IRC | 06:58 | |
| *** kiran-r has joined #openstack-keystone | 06:59 | |
| *** kiran-r has quit IRC | 07:00 | |
| *** kiran-r has joined #openstack-keystone | 07:00 | |
| *** ankita_w_ has quit IRC | 07:00 | |
| *** kiran-r has quit IRC | 07:00 | |
| *** lufix has joined #openstack-keystone | 07:01 | |
| *** abhishekk has joined #openstack-keystone | 07:09 | |
| *** briancurtin has joined #openstack-keystone | 07:09 | |
| *** dguerri` is now known as dguerri | 07:10 | |
| *** tqtran has quit IRC | 07:15 | |
| *** browne has quit IRC | 07:27 | |
| mflobo | Morning guys | 07:28 |
| mflobo | question: how can I avoid this message in the logs? Deprecated: keystone.common.kvs.Base is deprecated as of Icehouse in favor of keystone.common.kvs.KeyValueStore and may be removed in Kilo. | 07:29 |
| *** woodster_ has joined #openstack-keystone | 07:34 | |
| *** dguerri is now known as dguerri` | 07:36 | |
| *** markvoelker has joined #openstack-keystone | 07:37 | |
| *** pnavarro_ has joined #openstack-keystone | 07:39 | |
| morganfainberg | jamielennox: sounds good. | 07:43 |
| *** markvoelker has quit IRC | 07:43 | |
| marekd | jamielennox: still here? | 07:47 |
| jamielennox | marekd: yep | 07:47 |
| marekd | jamielennox: got 15 minutes to discuss k2k auth plugin ? | 07:47 |
| jamielennox | marekd: sure | 07:47 |
| jamielennox | where are we at? | 07:47 |
| marekd | jamielennox: https://review.openstack.org/#/c/188426/4 and up. | 07:47 |
| *** evrardjp has joined #openstack-keystone | 07:48 | |
| marekd | jamielennox: i think we should treat it as a 'extra' auth plugin. So, imagine you have your local cloud, use v3.Password for authenticating with that. Suddently you want to burst into remote cloud, then, you would use K2K plugin, simply, pass your local plugin v3.Passwd to it and pass some scoping info for remote cloud in remote_project_name, remote_domain_name etc. K2K should point to remote cloud (including auth_url). | 07:49 |
| evrardjp | good morning everyone | 07:49 |
| jamielennox | that's more or less what i thought, i wasn't thinking remote_ for attributes | 07:50 |
| *** jaosorior has joined #openstack-keystone | 07:50 | |
| marekd | from osc perspective i'd see it this way: openstack --os-auth-plugin=v3.Password --os-auth-remote-plugin=v3.k2k --os-project-name=<local project> --os-remote-project-name=<remote plugin> remote token issue | 07:50 |
| marekd | by having 'remote' command osc would actually burst into remote cloud. | 07:51 |
| jamielennox | oh, osc | 07:51 |
| jamielennox | right | 07:51 |
| marekd | without 'remote' we would be using local cloud. | 07:51 |
| marekd | my point is that local cloud should be a priority, and behave like it does always. | 07:51 |
| *** bdossant has joined #openstack-keystone | 07:52 | |
| marekd | that's why i proposed --remote-xxxx equivalents options in https://review.openstack.org/#/c/188881/ | 07:52 |
| jamielennox | # Store the Service Provider response to prevent re-posting the ECP wrapped assertion a 2nd time | 07:55 |
| jamielennox | marekd: why? | 07:55 |
| marekd | jamielennox: part of it wrote Rodrigo, i think he made that comment. He probably wanted some sort of caching... | 07:56 |
| marekd | i guess we can cache only if scoping info hasn't changed, right? | 07:56 |
| jamielennox | marekd: because the ECP assertion lasts longer than a token request? | 07:56 |
| jamielennox | a token? | 07:57 |
| marekd | jamielennox: if they do, it's not a significant difference. you just need to wrap a token into xml. | 07:57 |
| jamielennox | marekd: commented on https://review.openstack.org/#/c/188581/ | 07:59 |
| marekd | jamielennox: thanks. hm, having sp_url and sp_aurth_url would let user pass those parameters from comandline/options I think...? | 08:01 |
| jamielennox | marekd: i guess a) do we want that? b) they are currently required | 08:01 |
| *** lhcheng has joined #openstack-keystone | 08:01 | |
| *** ChanServ sets mode: +v lhcheng | 08:01 | |
| *** dguerri` is now known as dguerri | 08:02 | |
| marekd | jamielennox: a) good question - however I cannot think about a situation where I'd like to do that.... | 08:02 |
| marekd | i cannot override nova's ip address by passing some options in the cli, can i ? | 08:03 |
| marekd | jamielennox: ^^ | 08:03 |
| marekd | service catalog is the primary and the only source of endpoint knowledge, right? | 08:03 |
| jamielennox | marekd: you can override it, in nova i think it's --bypass-url | 08:04 |
| jamielennox | i don't mind having the ability but at the moment it's required | 08:05 |
| marekd | nova like nova cli ? | 08:05 |
| jamielennox | marekd: right | 08:05 |
| marekd | jamielennox: ok i will remove it. | 08:05 |
| *** amaretskiy has joined #openstack-keystone | 08:05 | |
| jamielennox | marekd: so i think there is still a review missing there which exposes the sp_auth_url and sp_url from the plugin | 08:06 |
| jamielennox | because there's not really a way to get AccessInfo from the plugin | 08:06 |
| jamielennox | so you'd need something similar to | 08:07 |
| jamielennox | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/base.py#L202 | 08:07 |
| jamielennox | and | 08:07 |
| *** kiran-r has joined #openstack-keystone | 08:07 | |
| jamielennox | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/identity/base.py#L259 | 08:07 |
| marekd | jamielennox: https://review.openstack.org/#/c/188581/9/keystoneauth/auth/identity/v3/federation.py lines 193 and below ? | 08:08 |
| marekd | K2K.load_from_plugin(v3.Password(), 'my_service_provider_id') | 08:08 |
| *** kiran-r has quit IRC | 08:09 | |
| jamielennox | i don't think auth_plugin.service_providers exists | 08:09 |
| marekd | https://review.openstack.org/#/c/188426/4 | 08:09 |
| *** kiran-r has joined #openstack-keystone | 08:09 | |
| marekd | well it's in access info | 08:10 |
| marekd | you are right. | 08:10 |
| jamielennox | yep, auth_plugin != accessinfo | 08:10 |
| marekd | so that would be something like access.create(auth_plugin.auth_token).service_providers ? | 08:10 |
| jamielennox | marekd: i was thinking you'd do it within the plugin | 08:11 |
| jamielennox | rather than at load | 08:11 |
| marekd | in the __init__ ,right? | 08:11 |
| *** fhubik has joined #openstack-keystone | 08:12 | |
| jamielennox | marekd: no, because you don't have session at __init__ | 08:12 |
| *** kiran-r has quit IRC | 08:12 | |
| *** kiran-r has joined #openstack-keystone | 08:12 | |
| jamielennox | i can't quite remember the federated method names | 08:12 |
| jamielennox | but | 08:12 |
| jamielennox | in get_auth_ref you'd do | 08:12 |
| *** kiran-r has quit IRC | 08:13 | |
| *** kiran-r has joined #openstack-keystone | 08:13 | |
| jamielennox | auth_url = local_cloud_plugin.get_sp_auth_url(session, self.service_provider) | 08:13 |
| jamielennox | url = local_cloud_plugin.get_sp_url(session, self.service_provider) | 08:13 |
| jamielennox | session.post(sp_url, ...) | 08:14 |
| jamielennox | resp = session.get(sp_auth_url, ...) | 08:14 |
| marekd | local_cloud_plugin would already be a AccessInfoV3 object. | 08:14 |
| jamielennox | return access.create(resp) | 08:14 |
| jamielennox | why? | 08:14 |
| jamielennox | if it's already an AccessInfo you can't refresh it if the local cloud token expires | 08:15 |
| marekd | otherwise we would need to add get_sp_url() somewhere in base.Auth | 08:15 |
| marekd | you ok with that? | 08:15 |
| jamielennox | yea, that's what i mean before when i linked the stuff about get_project_id | 08:16 |
| jamielennox | we will need to expose this from the plugin directly somehow, with a standard implementation that uses AccessInfo in auth.identity.base | 08:16 |
| *** rlt has joined #openstack-keystone | 08:17 | |
| marekd | jamielennox: allright, let me extend class BaseIdentityPlugin(base.BaseAuthPlugin): | 08:17 |
| jamielennox | cool, that'll probably be a standalone review after the accessinfo one | 08:18 |
| jamielennox | is there any way we can make the K2K plugin inherit FederationBaseAuth | 08:18 |
| marekd | yep, accessinfo, BaseIdentityPlugin, K2K. | 08:18 |
| marekd | jamielennox: not really, in FederationBaseAuth we require user to pass params like identity-provider and protocol | 08:19 |
| jamielennox | yea, was just looking myself, it just feels like there is a lot of overlap | 08:19 |
| jamielennox | the basic implementation of get_auth_ref that looks for scoping data should be the same | 08:20 |
| marekd | jamielennox: i wanted to inherit it first, but hit the wall with significantly different workflow and information we really need to make it happen. | 08:20 |
| *** kiran-r has quit IRC | 08:20 | |
| marekd | jamielennox: we can pull some code (not much), and make one basic level, and then inherit FederationBaseAuth and K2KAuth. | 08:20 |
| *** kiran-r has joined #openstack-keystone | 08:20 | |
| jamielennox | yea, i think don't worry about it for now and maybe it can be a cleanup later | 08:21 |
| marekd | jamielennox: exactly. | 08:21 |
| marekd | ok, i will add the missing code. | 08:22 |
| *** gordc has quit IRC | 08:22 | |
| jamielennox | marekd: commented on https://review.openstack.org/#/c/188426/ | 08:30 |
| jamielennox | not sure if you are working on that one as well | 08:30 |
| marekd | jamielennox: i am basically helping to make k2k happend so whatever is needed. | 08:31 |
| marekd | so you claim, that get_service_provider should be private or return something like AccessInfo object but for service providers ? | 08:32 |
| *** kiran-r has quit IRC | 08:36 | |
| jamielennox | marekd: i'd say for now just make it private | 08:36 |
| jamielennox | marekd: is there something we need from it? | 08:36 |
| marekd | jamielennox: i don't think so | 08:36 |
| *** kiran-r has joined #openstack-keystone | 08:36 | |
| *** pnavarro_ has quit IRC | 08:39 | |
| *** e0ne has joined #openstack-keystone | 08:46 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Encapsulate Service Providers in AccessInfo https://review.openstack.org/188426 | 08:49 |
| marekd | jamielennox: ^^ | 08:49 |
| *** kiran-r has quit IRC | 08:49 | |
| *** kiran-r has joined #openstack-keystone | 08:50 | |
| *** kiran-r has quit IRC | 08:50 | |
| marekd | jamielennox: opus, didnt notice you added new comments on that patch | 08:50 |
| *** kiran-r has joined #openstack-keystone | 08:50 | |
| *** pnavarro_ has joined #openstack-keystone | 08:50 | |
| jamielennox | marekd: yea, i'm going back through and being a bit more details rather than big picture | 08:50 |
| marekd | sure | 08:51 |
| marekd | let me address remaining comments. | 08:51 |
| jamielennox | marekd: comment on that too | 08:52 |
| jamielennox | {.. for ..} is py27 syntax | 08:52 |
| *** chlong has quit IRC | 08:52 | |
| marekd | jamielennox: it won't work in py3 ? | 08:53 |
| jamielennox | marekd: it won't work in py276 | 08:53 |
| jamielennox | marekd: it won't work in py26 | 08:53 |
| marekd | oh gosh, we are still supporting py26 in ksc? | 08:53 |
| marekd | oh, right | 08:53 |
| lifeless | please dog no | 08:53 |
| lifeless | let vendors do that if they want, the 2000's called and want their python back | 08:54 |
| jamielennox | i'm not actually sure, but i'd prefer to have a better reason than dict syntax to break it | 08:54 |
| jamielennox | yep - we still gate on it | 08:54 |
| lifeless | I'll quote ncoghlan: open source projects should start saying no to 2.6 :) | 08:54 |
| lifeless | jamielennox: AIUI we make a project wide decision to stop caring | 08:55 |
| lifeless | jamielennox: I suggest removing the gates... in particular the constraints stuff I'm working on won't generates constraints files for 2.6, because there's no python 2.6 on the node we run periodic jobs on | 08:55 |
| jamielennox | lifeless: that's a good reason to drop it | 08:56 |
| jamielennox | lifeless: i'm so used to writing for 2.6 now i don't notice, let's just go 3 | 08:56 |
| lifeless | 2.7 == 3 for all intents and purpoises :) | 08:56 |
| *** Mohhh has joined #openstack-keystone | 08:56 | |
| jamielennox | the dictionary comprehension syntax is about the only thing i can think of that's missing from 2.6 that isn't about upgrading to 3 | 08:57 |
| jamielennox | ie - things we'd use six for anyway | 08:57 |
| lifeless | secure TLS | 08:57 |
| *** rushiagr is now known as rushiagr_away | 08:58 | |
| lifeless | thats in 2.7.10, not in 2.6 at all [upstream] | 08:58 |
| jamielennox | ah, right - i was thinking from a syntax and libraries perspective | 08:58 |
| lifeless | also set literals? | 08:58 |
| lifeless | I don't remember when they came in | 08:58 |
| lifeless | {1,2,3} | 08:59 |
| jamielennox | apparently they came in 2.7 | 08:59 |
| lifeless | so yeah, them | 08:59 |
| jamielennox | i've never been a fan because i always end up with a set when i mistype a dictionary | 08:59 |
| *** rushiagr_away is now known as rushiagr | 09:00 | |
| jamielennox | anyway - i don't mind | 09:00 |
| jamielennox | but we currently have a gate job and otherwise you'll have to wait whilst it gets removed | 09:01 |
| *** Mohhh has quit IRC | 09:03 | |
| lifeless | oh shiny | 09:04 |
| lifeless | swift 2 (the language) to be open sourced, with a port to linux on day 1 | 09:04 |
| *** aix has joined #openstack-keystone | 09:05 | |
| jamielennox | port to linux? | 09:06 |
| jamielennox | that's cool - i wonder if it will be useful? | 09:07 |
| *** fhubik is now known as fhubik_afk | 09:08 | |
| *** Mohhh has joined #openstack-keystone | 09:08 | |
| Mohhh | Hi experts. I have a problem with keystone. I created a project using curl and I want to set project quota using: {"quota_set": {"floating_ips": floating_ip_count, "cores": vcpu, ... "}. But all of the item limits are properly applied(cores, ...) except floating-ips. | 09:08 |
| lifeless | seems to be gaining popularity on iOS very quickly, so its worth a look-at | 09:08 |
| Mohhh | I set "floating-ips" limit to 10, but after the project created, I check it and it sets to 50. Always sets to 50. | 09:09 |
| jamielennox | Mohhh: keystone doesn't manage quotas | 09:09 |
| jamielennox | that would be handled by the individual services | 09:09 |
| jamielennox | bbl | 09:09 |
| Mohhh | jamielennox: Thanks for your response. How can I set quota for project? | 09:10 |
| *** lhcheng has quit IRC | 09:10 | |
| Mohhh | +jamielennox: I used: request = {"quota_set": {"floating_ips": floating_ip_count, "cores": vcpu, "instances": instances, "ram": ram}} in my curl command. | 09:14 |
| *** afazekas has joined #openstack-keystone | 09:19 | |
| Mohhh | Any idea? | 09:19 |
| *** markvoelker has joined #openstack-keystone | 09:27 | |
| *** tellesnobrega has quit IRC | 09:28 | |
| *** htruta has quit IRC | 09:28 | |
| marekd | jamielennox: re https://review.openstack.org/#/c/188426/5/keystoneauth/service_providers.py inline what? make _normalize_service_providers internal in the __init__ ? | 09:28 |
| *** nicodemos has quit IRC | 09:28 | |
| *** ericksonsantos has quit IRC | 09:28 | |
| *** markvoelker has quit IRC | 09:32 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Encapsulate Service Providers in AccessInfo https://review.openstack.org/188426 | 09:39 |
| *** lufix_ has quit IRC | 09:40 | |
| *** davechen is now known as davechen_afk | 09:40 | |
| *** woodster_ has quit IRC | 09:41 | |
| dstanek | morganfainberg, lbragstad: 30% wall clock time right? https://review.openstack.org/#/c/165295/4 | 09:45 |
| *** fhubik_afk is now known as fhubik | 09:45 | |
| *** dims has joined #openstack-keystone | 09:48 | |
| *** aix has quit IRC | 09:53 | |
| *** dims has quit IRC | 09:54 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Fetch Service Providers urls from auth plugins https://review.openstack.org/189625 | 09:55 |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Add Keystone2KeystoneAuthPlugin for K2K federation https://review.openstack.org/188581 | 09:55 |
| *** e0ne is now known as e0ne_ | 10:02 | |
| *** aix has joined #openstack-keystone | 10:05 | |
| *** fhubik is now known as fhubik_afk | 10:08 | |
| *** dims has joined #openstack-keystone | 10:09 | |
| *** e0ne_ has quit IRC | 10:12 | |
| *** e0ne has joined #openstack-keystone | 10:21 | |
| morganfainberg | dstanek: yes I believe so. | 10:22 |
| marekd | jamielennox: still at work ? | 10:23 |
| jamielennox | marekd: still at my computer at least | 10:23 |
| jamielennox | i'm on (my) west coast for the next week or so - so it's not that late | 10:23 |
| jamielennox | i'm not going to make the meeting tomorrow - like 2am | 10:24 |
| morganfainberg | dstanek: was planning on circling up on that when we get to the hotel | 10:24 |
| dstanek | morganfainberg: ok | 10:24 |
| marekd | https://review.openstack.org/#/c/189625/1 -> i admit i forgot about auth.base (why is it not enforced, via abstractmethod or something? :/), but I don't fully know what shall i reimpleent regarding accessinfo on auth.identity.base . | 10:25 |
| *** kiranr has joined #openstack-keystone | 10:25 | |
| jamielennox | marekd: you just return None on the base class, you can't add abstractmethod on an existing class because it will break external subclasses | 10:26 |
| marekd | jamielennox: fine for that, but what about accessinfo ? | 10:26 |
| jamielennox | dstanek: are you still looking at flask? | 10:26 |
| dstanek | jamielennox: yes, i have it partially implemented | 10:27 |
| dstanek | actually that's probably a good thing to give an update on at the meeting today | 10:27 |
| jamielennox | marekd: accessinfo has NotImplementeds on the base class and then you refine them in subclasses | 10:28 |
| *** kiran-r has quit IRC | 10:28 | |
| marekd | jamielennox: ah, you are talking not property service_providers | 10:28 |
| marekd | AccessInfo.service_providers in the base class | 10:29 |
| jamielennox | dstanek: cool, i was doing some more on my jsonhome thing and was wondering how we could tie it into flask | 10:29 |
| jamielennox | marekd: on accessinfo i don't know, it probably doesn't matter | 10:30 |
| jamielennox | the only precedent we have is the way service catalog is done | 10:31 |
| dstanek | jamielennox: right now i'm still doing the same kind of registration that we are currently doing | 10:31 |
| jamielennox | i don't know if that's a good thing or not | 10:31 |
| jamielennox | dstanek: sure, make it the easiest change that is possible | 10:31 |
| *** fhubik_afk is now known as fhubik | 10:32 | |
| *** tobe has quit IRC | 10:32 | |
| *** tobe has joined #openstack-keystone | 10:33 | |
| openstackgerrit | David Stanek proposed openstack/keystone: WIP: Force SQLite to properly deal with foreign keys https://review.openstack.org/126030 | 10:34 |
| Mohhh | Which openstack service controls the floating_ips quota and limitation? | 10:40 |
| openstackgerrit | David Stanek proposed openstack/keystone: Force SQLite to properly deal with foreign keys https://review.openstack.org/126030 | 10:44 |
| *** samueldmq has joined #openstack-keystone | 10:46 | |
| samueldmq | morning | 10:46 |
| *** tobe has quit IRC | 10:47 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes a type check to make it work in Python 3 https://review.openstack.org/125410 | 10:47 |
| *** Mohhh has quit IRC | 10:47 | |
| *** tobe has joined #openstack-keystone | 10:49 | |
| dstanek | samueldmq: morning | 10:49 |
| samueldmq | dstanek, hi :) | 10:51 |
| samueldmq | dstanek, I was looking at that patch ^ | 10:52 |
| samueldmq | dstanek, 11 patch sets, nothing change between them, just rebases :( | 10:52 |
| dstanek | samueldmq: sqlite one? | 10:53 |
| morganfainberg | samueldmq: morning | 10:53 |
| samueldmq | morganfainberg, hi, I guess almost afternoon for you :) | 10:53 |
| dstanek | just the commit message - and keeping it out of conflict | 10:53 |
| morganfainberg | 1300 here. | 10:53 |
| *** boris-42 has joined #openstack-keystone | 10:53 | |
| *** tobe has quit IRC | 10:53 | |
| dstanek | not even 0700 here :-( | 10:55 |
| samueldmq | morganfainberg, still in budapest ? hope everything went well with your yesterday's talk | 10:56 |
| *** mabrams has quit IRC | 10:56 | |
| morganfainberg | samueldmq: in Berlin now. | 10:56 |
| samueldmq | dstanek, almost 8 here :) that's great, we have a big day ahead :) | 10:57 |
| morganfainberg | Yeah talk went ok. I have a bunch more work to do on the slides themselves. But it's turning into a good talk | 10:57 |
| dstanek | morganfainberg: that's good to hear. was it recorded at all? | 10:58 |
| samueldmq | morganfainberg, yeah the content was good imo, just had found some nits/typos | 10:58 |
| morganfainberg | dstanek: nope. | 10:58 |
| dstanek | that's too bad | 10:59 |
| morganfainberg | samueldmq: it's changed a bunch from when you read it. | 10:59 |
| morganfainberg | dstanek: I'll give you a link to the slides. It's an adaptation of what stevemar presented at CISID yesterday (targeted at an OpenStack aware audience) | 10:59 |
| samueldmq | morganfainberg, and I personally prefer to have less text in slides (only some of them had a lot) .. but maybe it's a matter of preference | 10:59 |
| morganfainberg | samueldmq: look now. There is a lot less text. | 11:00 |
| *** rushiagr is now known as rushiagr_away | 11:00 | |
| samueldmq | morganfainberg, nice, looking :) | 11:01 |
| morganfainberg | A few more slides need the same treatment. | 11:01 |
| morganfainberg | But it's improving. | 11:01 |
| *** ajayaa has joined #openstack-keystone | 11:01 | |
| dstanek | morganfainberg: we should come up with some formal rules about older reviews/specs - a sort of policy for getting rid of them | 11:22 |
| *** pnavarro_ has quit IRC | 11:22 | |
| dstanek | jamielennox: these are really old reviews. can any of them be abandoned or revised? http://bit.ly/1S0ZOKR | 11:27 |
| *** markvoelker has joined #openstack-keystone | 11:29 | |
| *** liusheng has joined #openstack-keystone | 11:32 | |
| *** fhubik is now known as fhubik_afk | 11:33 | |
| *** markvoelker has quit IRC | 11:34 | |
| *** e0ne is now known as e0ne_ | 11:34 | |
| morganfainberg | dstanek: yes we should. | 11:36 |
| morganfainberg | dstanek: I got a ton of pushback when I tried to abandon things last time. This time I'm just going through and doing it for really old things. | 11:37 |
| dstanek | morganfainberg: i've started to draft one - i was planning on submitting it as a doc review | 11:37 |
| dstanek | morganfainberg: i'm in the process of doing a little of that now :-) | 11:37 |
| morganfainberg | dstanek: ++ | 11:37 |
| morganfainberg | Thnx. | 11:37 |
| *** e0ne_ has quit IRC | 11:40 | |
| openstackgerrit | Merged openstack/keystone: Add testcases to test DefaultDomain https://review.openstack.org/185855 | 11:45 |
| *** woodster_ has joined #openstack-keystone | 11:48 | |
| *** amakarov_away is now known as amakarov | 11:51 | |
| *** diegows has joined #openstack-keystone | 11:53 | |
| *** josecastroleon has joined #openstack-keystone | 11:54 | |
| *** diegows has quit IRC | 11:54 | |
| *** fhubik_afk is now known as fhubik | 12:02 | |
| *** Guest84699 has quit IRC | 12:03 | |
| *** samueldmq has quit IRC | 12:08 | |
| *** raildo has joined #openstack-keystone | 12:11 | |
| *** tellesnobrega has joined #openstack-keystone | 12:11 | |
| *** dencaval has joined #openstack-keystone | 12:12 | |
| *** e0ne has joined #openstack-keystone | 12:14 | |
| *** htruta has joined #openstack-keystone | 12:17 | |
| *** dan_ has joined #openstack-keystone | 12:19 | |
| *** dan_ is now known as Guest5484 | 12:19 | |
| *** e0ne is now known as e0ne_ | 12:21 | |
| *** e0ne_ is now known as e0ne | 12:21 | |
| *** samueldmq has joined #openstack-keystone | 12:21 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Fetch Service Providers urls from auth plugins https://review.openstack.org/189625 | 12:29 |
| *** e0ne is now known as e0ne_ | 12:30 | |
| *** e0ne_ has quit IRC | 12:35 | |
| *** chlong has joined #openstack-keystone | 12:37 | |
| *** pnavarro_ has joined #openstack-keystone | 12:39 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 12:41 | |
| *** bknudson has quit IRC | 12:41 | |
| *** iurygregory has joined #openstack-keystone | 12:49 | |
| *** e0ne has joined #openstack-keystone | 12:55 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 13:02 |
| *** kiranr has quit IRC | 13:02 | |
| *** varya has quit IRC | 13:03 | |
| *** varya has joined #openstack-keystone | 13:03 | |
| *** raildo has quit IRC | 13:04 | |
| *** henrynash has quit IRC | 13:04 | |
| *** varya has quit IRC | 13:05 | |
| lbragstad | dstanek: let me grab you the real numbers from that test | 13:05 |
| *** henrynash has joined #openstack-keystone | 13:06 | |
| *** ChanServ sets mode: +v henrynash | 13:06 | |
| *** varya has joined #openstack-keystone | 13:06 | |
| *** varya has quit IRC | 13:07 | |
| lbragstad | dstanek: according to the monitoring; we were spending ~105 ms in Python with crypt_strength = 40000 (the default), and after we bumped it to 10000 we were spending 71 ms in Python. | 13:08 |
| *** raildo has joined #openstack-keystone | 13:08 | |
| *** lhcheng has joined #openstack-keystone | 13:12 | |
| *** ChanServ sets mode: +v lhcheng | 13:12 | |
| jamielennox | dstanek: https://review.openstack.org/#/c/117089/ was always good to go | 13:13 |
| jamielennox | i'd still like it merged | 13:13 |
| *** noye has joined #openstack-keystone | 13:13 | |
| jamielennox | https://review.openstack.org/#/c/168546/ is also fine | 13:13 |
| jamielennox | anything that's old like that that i don't know about generally is marked WIP | 13:15 |
| *** josecastroleon has quit IRC | 13:16 | |
| jamielennox | https://review.openstack.org/#/c/168792/2 should also be merged | 13:16 |
| *** ayoung has joined #openstack-keystone | 13:16 | |
| *** ChanServ sets mode: +v ayoung | 13:16 | |
| jamielennox | lhcheng has a -1 on it, but it's not a strong one | 13:16 |
| jamielennox | i think i countered the main reason for a -1 | 13:16 |
| *** lhcheng has quit IRC | 13:17 | |
| *** josecastroleon has joined #openstack-keystone | 13:17 | |
| lbragstad | dstanek: updated with a comment for more clarity (https://review.openstack.org/#/c/165295/) | 13:18 |
| dstanek | jamielennox: i'll take a look at those | 13:18 |
| dstanek | lbragstad: thx | 13:18 |
| *** josecastroleon has quit IRC | 13:19 | |
| samueldmq | ayoung, besides the config options needed for fetching the policy from server ... | 13:19 |
| *** HT_sergio has joined #openstack-keystone | 13:19 | |
| samueldmq | ayoung, should we have a config switch at middleware to define whether try to fetch it or not ? | 13:20 |
| dstanek | lbragstad: i just commented too that we could clarify the comment with "30% clock time" or something like that | 13:20 |
| ayoung | samueldmq, I think so | 13:20 |
| *** josecastroleon has joined #openstack-keystone | 13:20 | |
| samueldmq | ayoung, or should we assume that, if the configs are defined we try to do so .. | 13:20 |
| samueldmq | ayoung, k makes sense to me | 13:20 |
| ayoung | samueldmq, there is real comfort to operators in being able to turn something off. | 13:20 |
| *** lastops has joined #openstack-keystone | 13:21 | |
| samueldmq | ayoung, nice, and in the case they enabled it but not defined any of the needed configs ? | 13:21 |
| ayoung | samueldmq, then it breaks | 13:21 |
| samueldmq | ayoung, we need policy_cache_timeout endpoint_url policy_dirs policy_file | 13:21 |
| jamielennox | dstanek: cheers | 13:21 |
| samueldmq | ayoung, k makes sense | 13:22 |
| ayoung | samueldmq, I'd love to avoid the timeout option by using the headers from Keystone | 13:22 |
| *** josecastroleon has quit IRC | 13:22 | |
| ayoung | the policy_dirs yes..policy_file not so sure. | 13:22 |
| samueldmq | ayoung, but we have to be based on somehting in the case we can't find the headers | 13:22 |
| samueldmq | ayoung, well ... we need to know the file where we will be writing to | 13:23 |
| ayoung | samueldmq, fair enough, and we can put acomment in there saying that this is the max time for caching, the actualy time will be the lesser of the two values | 13:23 |
| *** josecastroleon has joined #openstack-keystone | 13:23 | |
| samueldmq | ayoung, ++ | 13:23 |
| *** jamielennox is now known as jamielennox|away | 13:23 | |
| ayoung | samueldmq, I don't know if we need a single name or not...part of me wants to autogenerate the name, or have it based on something from the fetch...but...code it as you see fit, and we can adjust if we get a better idea. | 13:24 |
| *** josecastroleon has quit IRC | 13:25 | |
| samueldmq | ayoung, great | 13:25 |
| samueldmq | ayoung, I really think we can have a demo running by the end of this week | 13:25 |
| samueldmq | ayoung, where we upload, lets say, a nova policy to keystone, get that fetched on its endpoint | 13:25 |
| samueldmq | ayoung, update policy on keystone and see enforcement being affected on nova side | 13:26 |
| *** josecastroleon has joined #openstack-keystone | 13:26 | |
| *** richm has joined #openstack-keystone | 13:26 | |
| *** abhishekk has quit IRC | 13:27 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 13:28 |
| *** josecastroleon has quit IRC | 13:28 | |
| samueldmq | ayoung, btw we need to run with specs , deadline is 25 right ? :( | 13:28 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 13:28 |
| *** josecastroleon has joined #openstack-keystone | 13:29 | |
| ayoung | samueldmq, yeah | 13:30 |
| *** radez_g0n3 is now known as radez | 13:31 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Restrict inherited role assignments to subdomains https://review.openstack.org/164180 | 13:32 |
| *** browne has joined #openstack-keystone | 13:32 | |
| *** richm has left #openstack-keystone | 13:35 | |
| *** richm has joined #openstack-keystone | 13:36 | |
| *** bknudson has joined #openstack-keystone | 13:38 | |
| *** ChanServ sets mode: +v bknudson | 13:38 | |
| *** toddnni has quit IRC | 13:40 | |
| *** diegows has joined #openstack-keystone | 13:51 | |
| *** henrynash has quit IRC | 13:52 | |
| *** kiran-r has joined #openstack-keystone | 13:54 | |
| ayoung | raildo, I have someone running QA on HMT. https://etherpad.openstack.org/p/hierarchical-projects | 13:55 |
| ayoung | raildo, htruta I'll see If I can get him to add some detail to how he is doing the role assignments | 13:56 |
| raildo | ayoung, nice, some days ago, I had reviewed this document | 14:00 |
| ayoung | raildo, need to get some of the details nailed down, I think | 14:01 |
| raildo | ayoung, yes | 14:02 |
| ayoung | raildo, can we do everything we need to test this with the CLIs yet? | 14:03 |
| ayoung | raildo, specificall, hierarchical role assignments? | 14:03 |
| raildo | ayoung, we have this patch in review: https://review.openstack.org/#/c/167613/ | 14:06 |
| *** dguerri is now known as dguerri` | 14:06 | |
| raildo | ayoung, we need to approve this patch, to do all the HMT operations on keystone client | 14:06 |
| *** iamjarvo has joined #openstack-keystone | 14:11 | |
| *** spandhe has joined #openstack-keystone | 14:15 | |
| *** spandhe has quit IRC | 14:20 | |
| *** elmiko has joined #openstack-keystone | 14:20 | |
| elmiko | dstanek: ping | 14:21 |
| *** mabrams has joined #openstack-keystone | 14:22 | |
| *** Ephur has joined #openstack-keystone | 14:25 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystoneauth: removed custom assertDictEqual https://review.openstack.org/189320 | 14:33 |
| breton | morganfainberg: I've updated a commit message ^. Please note that gate-keystoneauth-python26 is OK with the change. | 14:34 |
| morganfainberg | breton: the gate may be ok with it, but the reason we have it there is to mirror the dict check from py27 | 14:35 |
| morganfainberg | breton: i am concerned that if we remove that before we drop py26, we're going to end up with a case we're going to need to add it bac | 14:35 |
| morganfainberg | k | 14:35 |
| *** toddnni has joined #openstack-keystone | 14:37 | |
| *** rushiagr_away is now known as rushiagr | 14:37 | |
| openstackgerrit | Merged openstack/keystone: Fix sample policy to allow user to check own token https://review.openstack.org/164848 | 14:40 |
| breton | morganfainberg: tests use testtools, testtools require unittest2, unittest2 define assertDictEqual | 14:40 |
| openstackgerrit | Boris Bobrov proposed openstack/keystoneauth: removed custom assertDictEqual https://review.openstack.org/189320 | 14:42 |
| morganfainberg | breton: what you just told me would be the best thing you can put in the commit message | 14:56 |
| morganfainberg | breton: that way there is no confusion on what we rely on for testing | 14:57 |
| breton | morganfainberg: done ^ | 14:58 |
| morganfainberg | breton: nice much better | 14:58 |
| *** fhubik is now known as fhubik_afk | 15:02 | |
| *** afazekas has quit IRC | 15:06 | |
| *** markvoelker has joined #openstack-keystone | 15:07 | |
| *** henrynash has joined #openstack-keystone | 15:07 | |
| *** ChanServ sets mode: +v henrynash | 15:07 | |
| *** e0ne is now known as e0ne_ | 15:08 | |
| dstanek | elmiko: hi | 15:09 |
| *** chlong is now known as chlong-zzz | 15:10 | |
| elmiko | dstanek: hey, i'm just following up on https://review.openstack.org/#/c/183698/ | 15:10 |
| elmiko | i'm curious if you have any suggestion for better language to use than "HTTP framework"? | 15:10 |
| *** g2` has joined #openstack-keystone | 15:11 | |
| dstanek | not really - it wasn't clear to me what that meant - do just read sigmavirus24's definition and that's how i initially read it | 15:11 |
| dstanek | elmiko: ^ | 15:12 |
| elmiko | ok, i'll probably just change "must not" to "should not" and call it a day | 15:12 |
| *** pnavarro_ has quit IRC | 15:12 | |
| *** markvoelker has quit IRC | 15:12 | |
| *** g2` has quit IRC | 15:12 | |
| dstanek | elmiko: so that means no custom 500 handling in the project itself? | 15:12 |
| sigmavirus24 | I wish we wouldn't use "should" ever | 15:12 |
| * elmiko sad panda | 15:12 | |
| sigmavirus24 | "Do or do not, there is no try" =P | 15:12 |
| elmiko | dstanek: it just means we advise not doing it in the project, if you have reason to then by all means do it. | 15:13 |
| sigmavirus24 | dstanek: I mean, there's nothing to stop you. But someone will probably complain a lot that you're not following the guidelines if you make a new API that returns a 500 | 15:14 |
| sigmavirus24 | To be entirely clear, this guideline should only affect new development. The API-WG has no illusions that existing APIs will be retrofitted | 15:14 |
| sigmavirus24 | We have some illusions about people following the guidelines eventually though ;) | 15:14 |
| elmiko | i'm just stumped on whether this one needs another spin or not | 15:14 |
| dstanek | i guess i don't understand what this is trying to prevent? and what i'd do differently from what Keystone is currently doing | 15:15 |
| sigmavirus24 | dstanek: API authors should never explicitly return a 5xx error | 15:15 |
| elmiko | dstanek: in your case it might not change anything, but for folks who are considering adding a new 500 return this guideline should help them reconsider if they need to do that. | 15:15 |
| dstanek | is there an example that you can point to and say it's bad? | 15:16 |
| *** iamjarvo has quit IRC | 15:17 | |
| elmiko | good question, i don't have one at hand | 15:17 |
| *** HT_sergio has quit IRC | 15:17 | |
| sigmavirus24 | I can give a hypothetical but I'm tempted to say any code that explicitly returns a 5xx is bad | 15:17 |
| *** kiran-r has quit IRC | 15:17 | |
| *** iamjarvo has joined #openstack-keystone | 15:17 | |
| dstanek | elmiko: for example, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/wsgi.py#n787 - is that OK? | 15:17 |
| dstanek | sigmavirus24: how do you control the response body? | 15:18 |
| * elmiko reads | 15:18 | |
| sigmavirus24 | The hypothetical situation is a deployer who wants to eventually enable a feature that is currently returning a 5xx. If they have clients that store the fact that 5xx was previously returned, then that means that those clients (if they use all the allowances the RFCs afford) will never be able to use that feature once it's enabled | 15:18 |
| sigmavirus24 | I don't think anyone wants that | 15:18 |
| *** e0ne_ has quit IRC | 15:18 | |
| dstanek | sigmavirus24: are you talking 500 or 501? | 15:19 |
| sigmavirus24 | yes | 15:19 |
| bknudson | I wouldn't stop using a feature if the server returned 500. I'd report a bug. | 15:19 |
| dstanek | 500 would be returned for unhandled brokenness right? | 15:19 |
| *** dims has quit IRC | 15:19 | |
| sigmavirus24 | bknudson: I'm not talking about a human. A well written client would keep record of the fact that something returned a 5xx status and never allow another request to be made to that endpoint again | 15:20 |
| dstanek | for example, configuration is broken, db connection is down, we detect a disturbance in the force, etc | 15:20 |
| sigmavirus24 | Or at least (Method, Resource) would be baned | 15:20 |
| elmiko | dstanek: assuming i understand the usage of this function, imo i don't see an issue, you are attempting to reformat the exception message. this could easily be code that resides in the framework if errors were raised in a standard manner. | 15:20 |
| bknudson | the whole resource? what if it was related to a query parameter or a header the client sent? | 15:20 |
| sigmavirus24 | *banned | 15:21 |
| sigmavirus24 | So 501 is the only one that explicitly says it can be cached https://tools.ietf.org/html/rfc7231#section-6.6 | 15:21 |
| sigmavirus24 | But I've seen implementations of clients that stop sending requests to resources that return certain 5xx responses | 15:21 |
| dstanek | sigmavirus24: then those clients are broken :-P | 15:22 |
| sigmavirus24 | dstanek: I didn't say they were right | 15:22 |
| sigmavirus24 | But keystone should be conservative in what it sends | 15:22 |
| sigmavirus24 | keystone generating its own 5xx errors is not being conservative | 15:22 |
| dstanek | sigmavirus24: what would be better? | 15:23 |
| sigmavirus24 | The guideline has a recommendation | 15:23 |
| *** belmoreira has quit IRC | 15:23 | |
| *** e0ne has joined #openstack-keystone | 15:23 | |
| dstanek | sigmavirus24: let the framework handle it? | 15:24 |
| sigmavirus24 | dstanek: no, if you have to return an error status, it should be a 4xx, specifically I believe the guideline recommends 400 | 15:24 |
| sigmavirus24 | I'm not totally sold on 400 and it's not perfect for every case | 15:24 |
| sigmavirus24 | But the guideline admits that iirc | 15:25 |
| dstanek | '400 Our Database Is Down' seems incorrect | 15:25 |
| bknudson | we might as well just return 400 for everything and use codes in the body. | 15:25 |
| dstanek | i think that 405 is better than 501 for our use case, but a server error is a server error | 15:25 |
| *** fhubik_afk is now known as fhubik | 15:27 | |
| *** varya has joined #openstack-keystone | 15:28 | |
| dstanek | sigmavirus24: ah, your talking about https://review.openstack.org/#/c/183456 (which i think is a little incorrect since 405 could also be used) | 15:28 |
| dstanek | sigmavirus24: we started talking about https://review.openstack.org/#/c/183698/2/guidelines/http.rst | 15:28 |
| sigmavirus24 | Ah, there are too many 5xx related guidelines up right now | 15:29 |
| *** aix has quit IRC | 15:29 | |
| dstanek | :-) that second one doesn't have any rationale | 15:29 |
| dstanek | also even in most frameworks you'll have code in your project that deals with formatting error bodies and then returning that to a framework | 15:29 |
| dstanek | it's unclear if that's OK | 15:29 |
| elmiko | i think formatting and error and essentially re-reraising is not that big a deal. you are still dealing with the underlying idea of exception being returned through the frameworks 5xx reporting mechanisms | 15:31 |
| elmiko | *an error | 15:31 |
| *** josecastroleon has quit IRC | 15:32 | |
| dstanek | elmiko: in our case we are actually returning the WSGI response | 15:33 |
| *** bdossant has quit IRC | 15:33 | |
| *** josecastroleon has joined #openstack-keystone | 15:33 | |
| *** lufix has quit IRC | 15:33 | |
| dstanek | elmiko: i still don't know if i am doing it wrong :-( | 15:34 |
| *** gyee_ has joined #openstack-keystone | 15:34 | |
| elmiko | dstanek: yea, i see that. i'm not sure about the wrongness of it, for me i don't see an issue with attempting to provide better formatting for something as is going to be raised as an exception anyways. | 15:35 |
| elmiko | the way i read the guideline is more that you shouldn't explicitly be writing code that chooses to create a new 5xx instead of allowing the exception, for example, to be raised | 15:35 |
| *** josecastroleon has quit IRC | 15:35 | |
| sigmavirus24 | == elmiko | 15:35 |
| sigmavirus24 | adding more info to exceptions is good | 15:36 |
| dstanek | elmiko: when you say new 5xx are you saying a new status code like '550 Keystone Is Sleeping'? | 15:36 |
| elmiko | dstanek: so, in the example you posted i don't have an issue with that | 15:36 |
| *** josecastroleon has joined #openstack-keystone | 15:36 | |
| elmiko | dstanek: i mean more like the code catching an exception and then doing some programatic magic to decide what 5xx should be returned | 15:37 |
| dstanek | elmiko: i think that review is missing the 'why' and a more detailed 'what' - there really isn't anything actionable | 15:37 |
| *** ajayaa has quit IRC | 15:37 | |
| elmiko | dstanek: ok, good point. i'll think about it a little more | 15:37 |
| elmiko | dstanek: thanks for the input =) | 15:38 |
| *** josecastroleon has quit IRC | 15:38 | |
| *** lhcheng has joined #openstack-keystone | 15:39 | |
| *** ChanServ sets mode: +v lhcheng | 15:39 | |
| dstanek | elmiko: what i'm most confused about is that the app knows when a 500 internal server error happened because it is the thing that detected it - i can see you not wanted apps to mess with 503/504/etc | 15:39 |
| dstanek | elmiko: my pleasure. hopefully i'm being more helpful than a pain :-) | 15:39 |
| *** josecastroleon has joined #openstack-keystone | 15:39 | |
| elmiko | dstanek: definitely helpful, for me at least =) | 15:40 |
| elmiko | and yea, the app may know about the 500 and does a little formatting, that seems fine for me. | 15:40 |
| elmiko | i think the real issue is when the app makes a decision to return a 500, instead of it being the result of an unexpected code path | 15:41 |
| *** aix has joined #openstack-keystone | 15:41 | |
| elmiko | so like, you catch some exception, you know it's a 500, but just reformat the error and respond | 15:41 |
| *** josecastroleon has quit IRC | 15:41 | |
| elmiko | as opposed to the app seeing some error and then deciding to return a 500 | 15:42 |
| elmiko | if that makes sense | 15:42 |
| *** josecastroleon has joined #openstack-keystone | 15:42 | |
| dstanek | elmiko: to me it's about evaluating the error to see if it's server or client problems | 15:43 |
| elmiko | dstanek: and then choosing the appropriate status code? | 15:44 |
| *** josecastroleon has quit IRC | 15:45 | |
| *** josecastroleon has joined #openstack-keystone | 15:46 | |
| *** samleon has quit IRC | 15:46 | |
| dstanek | elmiko: for an app i can only see using 500 | 15:47 |
| *** samleon has joined #openstack-keystone | 15:47 | |
| elmiko | dstanek: like, if some unhandled exception is raised? | 15:47 |
| *** samleon has quit IRC | 15:47 | |
| *** samleon has joined #openstack-keystone | 15:48 | |
| *** josecastroleon has quit IRC | 15:48 | |
| *** josecastroleon has joined #openstack-keystone | 15:49 | |
| *** hemnafk is now known as hemna | 15:49 | |
| ayoung | http://www.duffelblog.com/2013/02/enemy-hackers-deem-ako-mypay-not-even-worth-hacking/ | 15:50 |
| *** josecastroleon has quit IRC | 15:51 | |
| ayoung | elmiko, I'm working on a script to set up a demo, and it has to call Neutron, nova, maybe some other...I cannot wait for a unified Python client API | 15:51 |
| *** josecastroleon has joined #openstack-keystone | 15:52 | |
| elmiko | ayoung: unified client api would be cool, but slightly out of scope for the api-wg ;) | 15:52 |
| ayoung | elmiko, but....but....gah! | 15:53 |
| elmiko | lol | 15:53 |
| ayoung | elmiko, actually, just having docs for Neutron would be an improvement | 15:53 |
| elmiko | ha! | 15:53 |
| elmiko | ayoung: are these http://developer.openstack.org/api-ref-networking-v2.html out of date? | 15:53 |
| *** josecastroleon has quit IRC | 15:54 | |
| elmiko | granted thats just the rest | 15:54 |
| *** josecastroleon has joined #openstack-keystone | 15:55 | |
| dstanek | elmiko: yes, and anytime an issue is detected that can't be fixed by the user | 15:56 |
| ayoung | elmiko, and how do you create a route? | 15:56 |
| ayoung | elmiko, or connect the internal network to the external? | 15:56 |
| *** josecastroleon has quit IRC | 15:57 | |
| elmiko | dstanek: i think the latter condition is what gets complicated. seems to me that there is wide opinion about what type of error should be returned if the app detects something that cannot be fixed by the user, and that is definitely a sticking point. | 15:57 |
| ayoung | elmiko, I needed to do some revese engineering before I discoved I needed to do this: https://github.com/admiyo/ossipee/blob/master/rhosidm.py#L91 | 15:58 |
| *** josecastroleon has joined #openstack-keystone | 15:58 | |
| elmiko | ayoung: i see some router info in http://developer.openstack.org/api-ref-networking-v2-ext.html but, i'm not a neutron api expert by any means | 15:58 |
| *** iamjarvo has quit IRC | 15:58 | |
| elmiko | ayoung: but isn't reverse engineering the fun part ;) | 15:59 |
| *** pnavarro_ has joined #openstack-keystone | 15:59 | |
| *** henrynash has quit IRC | 15:59 | |
| ayoung | elmiko, that would have been very useful this weekend. Wish it had turned up in either google search or a reasonably discoverable link taxononmy....what did I miss? | 15:59 |
| elmiko | ayoung: keep this link handy, http://developer.openstack.org/api-ref.html =) | 16:00 |
| *** henrynash has joined #openstack-keystone | 16:00 | |
| *** ChanServ sets mode: +v henrynash | 16:00 | |
| ayoung | elmiko, thanks....now if only the glance client had been modernized enough to use keystone sessions.... | 16:00 |
| elmiko | ayoung: lol, i can only help so much ;) | 16:00 |
| ayoung | elmiko, IT is good for me, as a dev, to sometimes feel the end users pain | 16:01 |
| ayoung | it was there and I missed it... | 16:01 |
| elmiko | ayoung: yea, definitely helps to build better understanding | 16:01 |
| *** henrynash has quit IRC | 16:01 | |
| *** josecastroleon has quit IRC | 16:02 | |
| *** e0ne is now known as e0ne_ | 16:03 | |
| *** josecastroleon has joined #openstack-keystone | 16:04 | |
| *** Nikkau has quit IRC | 16:04 | |
| *** varya has quit IRC | 16:04 | |
| *** josecastroleon has quit IRC | 16:05 | |
| *** josecastroleon has joined #openstack-keystone | 16:07 | |
| *** diegows has quit IRC | 16:08 | |
| *** josecastroleon has quit IRC | 16:08 | |
| *** e0ne_ is now known as e0ne | 16:09 | |
| *** _cjones_ has joined #openstack-keystone | 16:09 | |
| *** josecastroleon has joined #openstack-keystone | 16:10 | |
| dstanek | elmiko: yeah, i totally agree. things like DB outage are obvious, but other things like bad data in the DB are not | 16:10 |
| *** gyee_ has quit IRC | 16:10 | |
| *** josecastroleon has quit IRC | 16:11 | |
| samueldmq | how do we test changes in ksmiddleware in devstack ? | 16:11 |
| elmiko | dstanek: totally, and i can see something like the latter being a valid case for allowing the error to be reformatted and raised | 16:12 |
| samueldmq | I've put LIBS_FROM_GIT=keystonemiddleware and then devstack downloaded its source code ... however changes on it are not being applied .. | 16:12 |
| samueldmq | dstanek, ayoung any thought on this ? ^ | 16:12 |
| *** josecastroleon has joined #openstack-keystone | 16:13 | |
| *** josecastroleon has quit IRC | 16:14 | |
| *** josecastroleon has joined #openstack-keystone | 16:16 | |
| bknudson | samueldmq: I don't know how LIBS_FROM_GIT works.. I git clone into /opt/stack/keystonemiddleware and then pip install -e . in /opt/stack/keystonemiddleware | 16:16 |
| dstanek | samueldmq: did you do that after the ./stack.sh (i'm not sure, but i can see why that wouldn't work) | 16:17 |
| dstanek | samueldmq: i do what bknudson mentioned | 16:17 |
| *** josecastroleon has quit IRC | 16:17 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Properly handle Service Provider in token fixtures https://review.openstack.org/189803 | 16:17 |
| *** josecastroleon has joined #openstack-keystone | 16:19 | |
| samueldmq | bknudson, dstanek trying ... | 16:19 |
| samueldmq | dstanek, yes I did the changes after ./stack.sh | 16:19 |
| *** varya has joined #openstack-keystone | 16:20 | |
| bknudson | I wonder LIBS_FROM_GIT doesn't include keystonemiddleware , keystoneclient? | 16:20 |
| bknudson | by default | 16:20 |
| *** josecastroleon has quit IRC | 16:20 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Add Keystone2KeystoneAuthPlugin for K2K federation https://review.openstack.org/188581 | 16:21 |
| samueldmq | bknudson, I think it doesn't include anything by default :/ | 16:21 |
| samueldmq | bknudson, I always need to set it to the client I want to test | 16:21 |
| *** roxanaghe has joined #openstack-keystone | 16:22 | |
| *** josecastroleon has joined #openstack-keystone | 16:22 | |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Add testcases for list_role_assignments of v3 domains https://review.openstack.org/187899 | 16:22 |
| *** josecastroleon has quit IRC | 16:24 | |
| *** josecastroleon has joined #openstack-keystone | 16:25 | |
| *** josecastroleon has quit IRC | 16:27 | |
| samueldmq | bknudson, dstanek I am making the changes ... running 'pip install -I -e .' and then 'openstack server list' | 16:28 |
| samueldmq | this should be hitting keystone middleware code, right ? | 16:28 |
| dstanek | samueldmq: did you start the service behind the middleware? | 16:28 |
| *** josecastroleon has joined #openstack-keystone | 16:28 | |
| samueldmq | dstanek, devstack already do this, doesn't it ? it doesn't make sense it doesn't do it | 16:29 |
| dstanek | samueldmq: so it was started after the new middleware version was installed? | 16:30 |
| *** josecastroleon has quit IRC | 16:30 | |
| samueldmq | dstanek, yes | 16:30 |
| dstanek | samueldmq: hmmm...no idea then. if should have picked up your changes when the server started | 16:31 |
| samueldmq | dstanek, actually .... | 16:31 |
| *** josecastroleon has joined #openstack-keystone | 16:31 | |
| samueldmq | dstanek, it installed ksmiddleware and then started the server .. | 16:31 |
| samueldmq | dstanek, after that I made the changes ... I probably need to restart the services | 16:32 |
| dstanek | samueldmq: ah, exactly | 16:32 |
| *** josecastroleon has quit IRC | 16:33 | |
| *** tqtran_ has joined #openstack-keystone | 16:33 | |
| *** amaretskiy has quit IRC | 16:33 | |
| *** josecastroleon has joined #openstack-keystone | 16:34 | |
| *** varya has quit IRC | 16:34 | |
| *** josecastroleon has quit IRC | 16:36 | |
| *** lsmola has quit IRC | 16:37 | |
| *** josecastroleon has joined #openstack-keystone | 16:37 | |
| *** e0ne has quit IRC | 16:38 | |
| *** aix has quit IRC | 16:39 | |
| *** josecastroleon has quit IRC | 16:39 | |
| openstackgerrit | Jeremy Stanley proposed openstack/keystone: Merge tag '2014.2' https://review.openstack.org/128930 | 16:40 |
| *** josecastroleon has joined #openstack-keystone | 16:40 | |
| *** dguerri` is now known as dguerri | 16:40 | |
| *** elmiko is now known as _elmiko | 16:41 | |
| *** josecastroleon has quit IRC | 16:42 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Remove domain table references https://review.openstack.org/165936 | 16:42 |
| *** josecastroleon has joined #openstack-keystone | 16:43 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Add Keystone2KeystoneAuthPlugin for K2K federation https://review.openstack.org/188581 | 16:44 |
| *** josecastroleon has quit IRC | 16:45 | |
| *** jimbaker has quit IRC | 16:46 | |
| *** josecastroleon has joined #openstack-keystone | 16:46 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Tuple constants in revocation engine https://review.openstack.org/189810 | 16:47 |
| *** lufix has joined #openstack-keystone | 16:47 | |
| *** josecastroleon has quit IRC | 16:48 | |
| *** jimbaker has joined #openstack-keystone | 16:49 | |
| *** jimbaker has quit IRC | 16:49 | |
| *** jimbaker has joined #openstack-keystone | 16:49 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Add Keystone2KeystoneAuthPlugin for K2K federation https://review.openstack.org/188581 | 16:49 |
| *** josecastroleon has joined #openstack-keystone | 16:49 | |
| *** josecastroleon has quit IRC | 16:51 | |
| bknudson | dstanek: did you go to this talk about design patterns? https://dague.net/2015/06/09/python-design-patterns/ | 16:52 |
| *** josecastroleon has joined #openstack-keystone | 16:52 | |
| dstanek | yeah, i've seen that before | 16:53 |
| lbragstad | dstanek: bknudson looking interesting | 16:53 |
| lbragstad | s/looking/looks/ | 16:53 |
| *** spandhe has joined #openstack-keystone | 16:54 | |
| *** josecastroleon has quit IRC | 16:54 | |
| *** josecastroleon has joined #openstack-keystone | 16:55 | |
| *** markvoelker has joined #openstack-keystone | 16:56 | |
| *** lufix has quit IRC | 16:56 | |
| *** josecastroleon has quit IRC | 16:57 | |
| *** thedodd has joined #openstack-keystone | 16:58 | |
| *** josecastroleon has joined #openstack-keystone | 16:58 | |
| *** fhubik has quit IRC | 16:59 | |
| *** josecastroleon has quit IRC | 17:00 | |
| *** markvoelker has quit IRC | 17:01 | |
| *** josecastroleon has joined #openstack-keystone | 17:01 | |
| *** kfox1111 has joined #openstack-keystone | 17:02 | |
| kfox1111 | Can some keystone cores please have a look at https://review.openstack.org/#/c/186617 | 17:02 |
| kfox1111 | its the nova instance user thing we talked about at the summit. | 17:03 |
| *** josecastroleon has quit IRC | 17:03 | |
| *** josecastroleon has joined #openstack-keystone | 17:04 | |
| samueldmq | dstanek, yeah, just got that working ... I am able to see prints in the n-api screen session :) | 17:05 |
| samueldmq | dstanek, just need to restart the server ... no need to reinstall ksmiddleware | 17:05 |
| samueldmq | dstanek, bknudson thanks for your help | 17:05 |
| *** josecastroleon has quit IRC | 17:06 | |
| *** josecastroleon has joined #openstack-keystone | 17:07 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Unified delegation spec https://review.openstack.org/189816 | 17:08 |
| *** josecastroleon has quit IRC | 17:09 | |
| *** josecastroleon has joined #openstack-keystone | 17:10 | |
| *** josecastroleon has quit IRC | 17:12 | |
| *** josecastroleon has joined #openstack-keystone | 17:13 | |
| *** josecastroleon has quit IRC | 17:15 | |
| *** iamjarvo has joined #openstack-keystone | 17:15 | |
| *** topol has joined #openstack-keystone | 17:16 | |
| *** josecastroleon has joined #openstack-keystone | 17:16 | |
| *** ChanServ sets mode: +v topol | 17:16 | |
| openstackgerrit | Jeremy Stanley proposed openstack/keystone: Merge tag '2015.1.0' https://review.openstack.org/179288 | 17:17 |
| *** josecastroleon has quit IRC | 17:18 | |
| *** ericksonsantos has joined #openstack-keystone | 17:19 | |
| *** josecastroleon has joined #openstack-keystone | 17:19 | |
| *** josecastroleon has quit IRC | 17:21 | |
| *** josecastroleon has joined #openstack-keystone | 17:22 | |
| *** spandhe has quit IRC | 17:23 | |
| *** e0ne has joined #openstack-keystone | 17:24 | |
| *** josecastroleon has quit IRC | 17:24 | |
| *** josecastroleon has joined #openstack-keystone | 17:25 | |
| *** josecastroleon has quit IRC | 17:27 | |
| *** josecastroleon has joined #openstack-keystone | 17:29 | |
| *** spandhe has joined #openstack-keystone | 17:30 | |
| *** josecastroleon has quit IRC | 17:30 | |
| *** josecastroleon has joined #openstack-keystone | 17:32 | |
| *** josecastroleon has quit IRC | 17:33 | |
| *** g2` has joined #openstack-keystone | 17:34 | |
| *** josecastroleon has joined #openstack-keystone | 17:35 | |
| *** josecastroleon has quit IRC | 17:36 | |
| *** josecastroleon has joined #openstack-keystone | 17:38 | |
| *** josecastroleon has quit IRC | 17:39 | |
| *** josecastroleon has joined #openstack-keystone | 17:41 | |
| *** josecastroleon has quit IRC | 17:42 | |
| *** josecastroleon has joined #openstack-keystone | 17:44 | |
| *** dguerri is now known as dguerri` | 17:44 | |
| *** josecastroleon has quit IRC | 17:45 | |
| *** htruta_ has joined #openstack-keystone | 17:46 | |
| *** josecastroleon has joined #openstack-keystone | 17:47 | |
| *** josecastroleon has quit IRC | 17:48 | |
| *** g2` has quit IRC | 17:49 | |
| *** zzzeek has joined #openstack-keystone | 17:50 | |
| *** josecastroleon has joined #openstack-keystone | 17:50 | |
| *** josecastroleon has quit IRC | 17:51 | |
| openstackgerrit | Corey Bryant proposed openstack/python-keystoneclient: Iterate over copy of sys.modules keys in Python2/3 https://review.openstack.org/189834 | 17:52 |
| *** _elmiko is now known as elmiko | 17:52 | |
| *** josecastroleon has joined #openstack-keystone | 17:53 | |
| marekd | morganfainberg: i am afraid i will not attend today's meeting. Sorry. | 17:53 |
| openstackgerrit | David J Hu proposed openstack/keystone: IAM Formatter https://review.openstack.org/189836 | 17:53 |
| morganfainberg | marekd: that's ok. | 17:54 |
| *** josecastroleon has quit IRC | 17:54 | |
| *** g2` has joined #openstack-keystone | 17:55 | |
| *** g2` has quit IRC | 17:55 | |
| *** josecastroleon has joined #openstack-keystone | 17:56 | |
| *** dims has joined #openstack-keystone | 17:56 | |
| *** rlt has quit IRC | 17:56 | |
| morganfainberg | i think... it's that time | 17:57 |
| morganfainberg | ayoung: time check - we at meeting time? | 17:57 |
| ayoung | morganfainberg, 3 minutes... | 17:57 |
| morganfainberg | since i'm ~+9hrs from my normal timezone | 17:57 |
| morganfainberg | ayoung: cool. | 17:57 |
| *** henrynash has joined #openstack-keystone | 17:57 | |
| *** ChanServ sets mode: +v henrynash | 17:57 | |
| *** josecastroleon has quit IRC | 17:57 | |
| *** samleon has left #openstack-keystone | 17:58 | |
| *** josecastroleon has joined #openstack-keystone | 17:59 | |
| *** josecastroleon has quit IRC | 18:00 | |
| *** g2` has joined #openstack-keystone | 18:01 | |
| *** josecastroleon has joined #openstack-keystone | 18:02 | |
| *** gyee_ has joined #openstack-keystone | 18:02 | |
| *** g2` has quit IRC | 18:02 | |
| *** thedodd has quit IRC | 18:03 | |
| *** josecastroleon has quit IRC | 18:03 | |
| *** hichtakk has joined #openstack-keystone | 18:04 | |
| *** josecastroleon has joined #openstack-keystone | 18:05 | |
| *** josecastroleon has quit IRC | 18:06 | |
| *** timcline has joined #openstack-keystone | 18:07 | |
| *** bradjones is now known as bradjones|away | 18:07 | |
| *** josecastroleon has joined #openstack-keystone | 18:08 | |
| *** g2` has joined #openstack-keystone | 18:08 | |
| *** dguerri` is now known as dguerri | 18:08 | |
| *** geoffarnold has joined #openstack-keystone | 18:09 | |
| *** josecastroleon has quit IRC | 18:09 | |
| *** dguerri is now known as dguerri` | 18:11 | |
| *** josecastroleon has joined #openstack-keystone | 18:11 | |
| *** josecastroleon has quit IRC | 18:12 | |
| *** josecastroleon has joined #openstack-keystone | 18:14 | |
| *** josecastroleon has quit IRC | 18:15 | |
| *** josecastroleon has joined #openstack-keystone | 18:17 | |
| *** harlowja_ has quit IRC | 18:18 | |
| *** josecastroleon has quit IRC | 18:18 | |
| *** amaretskiy has joined #openstack-keystone | 18:19 | |
| *** josecastroleon has joined #openstack-keystone | 18:20 | |
| *** fangzhou has joined #openstack-keystone | 18:20 | |
| *** josecastroleon has quit IRC | 18:21 | |
| *** arunkant has quit IRC | 18:21 | |
| *** josecastroleon has joined #openstack-keystone | 18:23 | |
| *** josecastroleon has quit IRC | 18:24 | |
| *** harlowja has joined #openstack-keystone | 18:25 | |
| *** josecastroleon has joined #openstack-keystone | 18:26 | |
| ayoung | jamielennox|away, upstream... | 18:27 |
| *** josecastroleon has quit IRC | 18:27 | |
| *** rushiagr is now known as rushiagr_away | 18:28 | |
| *** josecastroleon has joined #openstack-keystone | 18:29 | |
| *** josecastroleon has quit IRC | 18:30 | |
| *** josecastroleon has joined #openstack-keystone | 18:32 | |
| *** belmoreira has joined #openstack-keystone | 18:33 | |
| *** josecastroleon has quit IRC | 18:33 | |
| *** josecastroleon has joined #openstack-keystone | 18:35 | |
| *** josecastroleon has quit IRC | 18:36 | |
| *** iurygregory has quit IRC | 18:37 | |
| *** iurygregory has joined #openstack-keystone | 18:37 | |
| *** josecastroleon has joined #openstack-keystone | 18:38 | |
| *** josecastroleon has quit IRC | 18:39 | |
| *** josecastroleon has joined #openstack-keystone | 18:41 | |
| *** josecastroleon has quit IRC | 18:42 | |
| *** josecastroleon has joined #openstack-keystone | 18:44 | |
| *** markvoelker has joined #openstack-keystone | 18:45 | |
| *** josecastroleon has quit IRC | 18:46 | |
| *** josecastroleon has joined #openstack-keystone | 18:47 | |
| *** openstackgerrit has quit IRC | 18:48 | |
| *** josecastroleon has quit IRC | 18:49 | |
| *** openstackgerrit has joined #openstack-keystone | 18:49 | |
| *** markvoelker has quit IRC | 18:49 | |
| *** josecastroleon has joined #openstack-keystone | 18:50 | |
| *** mabrams1 has joined #openstack-keystone | 18:50 | |
| *** mabrams has quit IRC | 18:51 | |
| *** josecastroleon has quit IRC | 18:52 | |
| dstanek | henrynash: i don't get the overall vision here. we are letting a project<is_domain=True> act as a project. will the user know that it is actually a domain too? | 18:52 |
| htruta_ | dstanek: just finish for now, in case of ambiguity, we use the old behavior | 18:53 |
| *** mabrams has joined #openstack-keystone | 18:53 | |
| *** josecastroleon has joined #openstack-keystone | 18:53 | |
| htruta_ | ops. was supposed to go in the other channel | 18:53 |
| htruta_ | anyway | 18:53 |
| dstanek | htruta_: i think that's broken | 18:53 |
| *** mabrams1 has quit IRC | 18:55 | |
| *** josecastroleon has quit IRC | 18:55 | |
| htruta | dstanek: why? | 18:55 |
| dstanek | htruta: like i said i don't get the vision, but... what if i list projects i have access to looking for a name so that i can create some resource. | 18:56 |
| *** josecastroleon has joined #openstack-keystone | 18:56 | |
| dstanek | let's assume it's A and that A is an is_domain project - is there any way i would mean to use it, but accidentally get A.A? | 18:57 |
| *** josecastroleon has quit IRC | 18:58 | |
| ayoung | dstanek, I tried that and got sent to AAA | 18:58 |
| ayoung | at least I wasnt send to AA | 18:58 |
| htruta | ayoung: lol | 18:58 |
| *** josecastroleon has joined #openstack-keystone | 18:59 | |
| ayoung | and then this greasy dude in a leather jacket cme by and said AAAAAAYYYYYY! with both thumbs up in the air.... | 18:59 |
| htruta | dstanek: yes, you can... but in the current behaviour, we are not able to get to A, only to A.A | 18:59 |
| htruta | so, nobody will try to get a project scoped token to A, unless it has really read the documentation and he's sure about that | 19:00 |
| dstanek | htruta: be we don't tell them that; we assume we know what they want and just go ahead and do it | 19:00 |
| rodrigods | bknudson, k2k auth plugin returns a scoped token that works in the remote cloud, this token will contain the remote cloud catalog | 19:02 |
| morganfainberg | https://blueprints.launchpad.net/keystone/+spec/role-descriptions - i have no issue with this not requiring a spec | 19:02 |
| morganfainberg | cores, when you're done with the current discussion please look and let me know | 19:02 |
| morganfainberg | if you agree | 19:02 |
| henrynash | morganfainberg: I agree | 19:02 |
| dstanek | morganfainberg: lost review - https://review.openstack.org/#/c/128930/ | 19:03 |
| *** josecastroleon has quit IRC | 19:03 | |
| *** htruta_ has quit IRC | 19:03 | |
| gyee_ | henrynash, for http://paste.openstack.org/show/278495/ | 19:03 |
| gyee_ | I think we may need GET /projects/id/role_assignments | 19:03 |
| htruta | dstanek: I got your point now | 19:04 |
| *** josecastroleon has joined #openstack-keystone | 19:04 | |
| bknudson | ok, so I can do "openstack server create" and create a server on my local cloud or I can create one on a remote cloud... | 19:04 |
| bknudson | how do I tell "openstack server create" which cloud to use? | 19:04 |
| dolphm | gyee_: don't we already have GET /v3/role_assignments?project_id={project_id} | 19:04 |
| gyee_ | dolphm, no, scope.project.id only | 19:04 |
| gyee_ | GET /projects/id/role_assignments is more natural | 19:05 |
| dolphm | gyee_: that's what i meant. what's the difference? | 19:05 |
| rodrigods | bknudson, ok... that's the idea of having two different auth plugins parameters: openstack --os-auth-plugin=password --project-id=<local_project> --os-remote-auth-plugin=k2k --os-remote-projectid=<remote_plugin | 19:05 |
| gyee_ | dolphm, we need domain admin to be able to lookup project assignments for a project in that domain | 19:05 |
| gyee_ | dolphm, horizon currently can't lookup assignments with a domain admin token | 19:06 |
| *** josecastroleon has quit IRC | 19:06 | |
| bknudson | I don't think it should depend on the auth plugin... make it explicit | 19:06 |
| dolphm | bknudson: i haven't reviewed this yet, but i assume that's what this provides https://review.openstack.org/#/c/188581/ | 19:06 |
| bknudson | openstack --idp=whatever server create | 19:06 |
| bknudson | the auth plugin stuff I'd probably want to come from a config file | 19:06 |
| dolphm | rodrigods: is there seriously a reason to require remote project ID? | 19:07 |
| rodrigods | dolphm, this is to request scoped tokens | 19:07 |
| *** josecastroleon has joined #openstack-keystone | 19:07 | |
| *** kfox1111 has quit IRC | 19:07 | |
| raildo | gyee, horizon can't handle with domain scoped token, that why get a project scoped token for a project is_domain can make the horizon work easier. | 19:07 |
| rodrigods | dolphm, a further step after getting a federated unscoped token | 19:07 |
| dolphm | rodrigods: the locally scoped project is passed as part of the SAML assertions right? | 19:08 |
| gyee_ | raildo, my feeling is that we may ended up with namespaces | 19:08 |
| rodrigods | dolphm, right | 19:08 |
| gyee_ | otherwise, it will be chaos | 19:08 |
| dstanek | bknudson: why would we not just use what osc already has to specify clouds | 19:08 |
| *** josecastroleon has quit IRC | 19:09 | |
| dolphm | rodrigods: is there not already a way to create the local project remotely? with matching ID and name? | 19:09 |
| rodrigods | dolphm, not really... it will depend on the mapping | 19:09 |
| dstanek | bknudson: i think it's --os-cloud | 19:09 |
| dolphm | rodrigods: i don't see why i have to use a *different* globally unique identifier for my project | 19:09 |
| bknudson | dstanek: y, if they have --os-cloud then use that. | 19:09 |
| dolphm | that's why they're UUIDs | 19:09 |
| gyee_ | dstanek, what's --os-cloud, service provider id in the token response? | 19:10 |
| *** josecastroleon has joined #openstack-keystone | 19:10 | |
| *** amakarov is now known as amakarov_away | 19:10 | |
| dstanek | bknudson: i have 2 clouds configured in my yaml file (one for personal use and one for rax) | 19:10 |
| bknudson | os-cloud should map to a service provider if it's a remote cloud. | 19:10 |
| rodrigods | dolphm, your local project can map to what ever entity in the remote cloud side | 19:10 |
| bknudson | dstanek: that's exactly what I'm thinking of... so they've already essentially got it. | 19:11 |
| rodrigods | dolphm, we only know that by asking what projects/domains we have access to | 19:11 |
| rodrigods | dolphm, after we have the federated unscoped token | 19:11 |
| bknudson | but I assume it doesn't support K2K. | 19:11 |
| dstanek | bknudson: http://docs.openstack.org/developer/python-openstackclient/configuration.html#configuration-files | 19:11 |
| dolphm | rodrigods: that made sense in the non-k2k case... i don't know that it makes any sense to me to have to ask for another scoped token in the k2k case | 19:11 |
| dstanek | doubt it, but it's a logic base to build on top of | 19:11 |
| *** josecastroleon has quit IRC | 19:12 | |
| bknudson | y, build it on that rather than trying to make insanely complicated CLI args. | 19:12 |
| dstanek | bknudson: right now you set up your creds for each one - i can see instead of username/password having a way to specify the IdP | 19:12 |
| rodrigods | dolphm, hmm I see what you mean... once the remote cloud accepted my SAML assertion, why can't I use my local token, right? | 19:12 |
| bknudson | maybe it's just like --local ds-admin --remote infra ? | 19:12 |
| dolphm | rodrigods: no, not local token | 19:12 |
| dstanek | or maybe in addition to | 19:12 |
| dolphm | rodrigods: just the project ID i'm already aware of | 19:12 |
| *** josecastroleon has joined #openstack-keystone | 19:13 | |
| rodrigods | dolphm, it's because in k2k we didn't change the keystone that is consuming the federated identity | 19:13 |
| dstanek | why not 'openstack --os-cloud remote server create' and have osc figure out what IdP to use based on the config? | 19:13 |
| bknudson | dstanek: that would be awesome. | 19:13 |
| dstanek | instead of an auth_url you can have an IdP url or something like that | 19:13 |
| rodrigods | dstanek, service provider you mean? | 19:13 |
| bknudson | but, it wouldn't fit into the openstack model of terrible UX. | 19:14 |
| dolphm | rodrigods: well that's a good philosophy, but the resulting UX is odd | 19:14 |
| dolphm | rodrigods: especially asking for a second project ID on the CLI | 19:14 |
| dstanek | rodrigods: nope the service provider is what you specify with --os-cloud | 19:14 |
| *** josecastroleon has quit IRC | 19:15 | |
| dstanek | rodrigods: you are you telling osc that for this cloud you need to auth a certain way - there documented way is auth_url + username/password or token | 19:15 |
| rodrigods | dolphm, yeah... I know, this gets even worse if we want to make it handle multiple remote clouds | 19:15 |
| dolphm | rodrigods: yep | 19:15 |
| *** e0ne has quit IRC | 19:15 | |
| dolphm | rodrigods: if my remote keystone trusts the identity asserted by my local keystone, why can't it mirror my project? | 19:16 |
| rodrigods | dstanek, so OSC will know that it needs to use k2k auth plugin and pass the default plugin to it? | 19:16 |
| *** josecastroleon has joined #openstack-keystone | 19:16 | |
| dolphm | it's just an arbitrary ID | 19:16 |
| dstanek | rodrigods: sure | 19:16 |
| rodrigods | dstanek, makes sense... will present this idea to marekd :) | 19:16 |
| rodrigods | dolphm, this sounds like a reasonable improvement to the mapping engine | 19:17 |
| rodrigods | dolphm, and something discussed in the summit iirc | 19:17 |
| *** josecastroleon has quit IRC | 19:18 | |
| dolphm | rodrigods: perhaps on Friday? i missed the federation discussion that day | 19:18 |
| rodrigods | dolphm, yeah, that day... there is a blueprint of this idea somewhere | 19:18 |
| raildo | henrynash, gyee, dstanek, morganfainberg, ayoung, htruta , rodrigods so.. you guys have any suggestions to reach a solution for the project name problem? | 19:19 |
| *** josecastroleon has joined #openstack-keystone | 19:19 | |
| ayoung | raildo, aside from the entirely sensible one I already gave? | 19:19 |
| raildo | ayoung, haha | 19:19 |
| rodrigods | lets vote? +1 for ayoung suggestion | 19:20 |
| rodrigods | we want to approve this spec super fast | 19:20 |
| raildo | ayoung, I like your suggestions but we need a agreement :P | 19:20 |
| *** josecastroleon has quit IRC | 19:21 | |
| raildo | What is the best way to come to an consensus about this? write a google form with the options and vote? | 19:21 |
| raildo | I don't know... | 19:21 |
| *** josecastroleon has joined #openstack-keystone | 19:22 | |
| rodrigods | raildo, maybe we can find 2 cores to approve the spec and that's it? :) | 19:22 |
| dolphm | morganfainberg: +1 stop supporting project names in auth requests | 19:22 |
| rodrigods | dolphm, the blueprint I was reffering https://blueprints.launchpad.net/keystone/+spec/cross-cloud-project-sync | 19:23 |
| dolphm | rodrigods: i 100% agree with the use case; was joesavak around when it was discussed? | 19:23 |
| *** josecastroleon has quit IRC | 19:24 | |
| dolphm | although, what's "image federation" specifically, in the "customer perceived priority"? | 19:24 |
| rodrigods | dolphm, yep... this bp was the "result" of the discussion | 19:24 |
| rodrigods | dolphm, it was a different discussion that came to the same topic (don't ask me how) | 19:25 |
| dolphm | raildo: write up all the options in an etherpad or on the meeting wiki, along with the reasoning for/against each one, and hold a vote in the next keystone meeting | 19:25 |
| *** josecastroleon has joined #openstack-keystone | 19:25 | |
| dolphm | raildo: but the options need to be well-defined in advance | 19:25 |
| raildo | dolphm, ok, I'll do that | 19:25 |
| openstackgerrit | Ian Wienand proposed openstack/keystone: Use lower default value for sha512_crypt rounds https://review.openstack.org/165295 | 19:26 |
| *** josecastroleon has quit IRC | 19:27 | |
| htruta | dolphm: isn't next meeting too late? | 19:27 |
| htruta | cause we still need to write the spec with the decision | 19:27 |
| htruta | we'd only have a week to write and get it approved | 19:27 |
| *** thedodd has joined #openstack-keystone | 19:27 | |
| *** josecastroleon has joined #openstack-keystone | 19:28 | |
| dolphm | htruta: too late for SPF on june 22nd? | 19:29 |
| dolphm | htruta: or too late for what? | 19:29 |
| *** josecastroleon has quit IRC | 19:30 | |
| dstanek | htruta: if you get a vote it shouldn't be too hard to get it approved | 19:30 |
| dolphm | htruta: there's actually a Problem Description and Alternatives sections in the specs template -- you could start with those two sections alone before touching any of the rest. that way you have a giant head start on the spec writing | 19:30 |
| dolphm | dstanek: ++ | 19:31 |
| *** HT_sergio has joined #openstack-keystone | 19:31 | |
| htruta | dolphm: yes, I'm considering that date | 19:31 |
| *** josecastroleon has joined #openstack-keystone | 19:31 | |
| htruta | dstanek, dolphm: ok, then :) | 19:31 |
| rodrigods | but htruta will ping you forever to review it, be warned :) | 19:32 |
| raildo | me too \o | 19:32 |
| htruta | lol | 19:33 |
| dstanek | :-) | 19:34 |
| *** josecastroleon has quit IRC | 19:34 | |
| *** josecastroleon has joined #openstack-keystone | 19:35 | |
| *** josecastroleon has quit IRC | 19:37 | |
| *** gyee_ has quit IRC | 19:38 | |
| *** josecastroleon has joined #openstack-keystone | 19:38 | |
| *** josecastroleon has quit IRC | 19:40 | |
| *** josecastroleon has joined #openstack-keystone | 19:41 | |
| ekarlso | is there any thing for CORS with the keystone middleware ? | 19:41 |
| dolphm | ekarlso: http://docs.openstack.org/developer/oslo.middleware/cors.html | 19:42 |
| *** josecastroleon has quit IRC | 19:43 | |
| *** josecastroleon has joined #openstack-keystone | 19:44 | |
| ekarlso | kewls dolphm ! | 19:44 |
| richm | gyee: ping - nkinder said you have been trying to get shibboleth working with HA proxy doing SSL termination? | 19:47 |
| richm | gyee: I was wondering if you got it working and, if so, how? | 19:47 |
| morganfainberg | dolphm: sounds good to me | 19:53 |
| *** belmoreira has quit IRC | 19:56 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/189901 | 19:58 |
| *** jamielennox|away is now known as jamielennox | 20:01 | |
| *** ayoung has quit IRC | 20:04 | |
| *** Rockyg has joined #openstack-keystone | 20:11 | |
| *** josecastroleon has quit IRC | 20:15 | |
| dolphm | dstanek: i was going to -1, but since you're not the primary author: i don't think it's "fair" to include "incorrectly-configured" just because it's swift. that just feels like including garbage? why not just exclude non-oslo projects from the useragent altogether? https://review.openstack.org/#/c/180769/10..12/keystonemiddleware/auth_token/__init__.py,unified | 20:16 |
| *** josecastroleon has joined #openstack-keystone | 20:16 | |
| *** josecastroleon has quit IRC | 20:18 | |
| dims | folks, where exactly in BU is the mid-cycle? | 20:18 |
| *** josecastroleon has joined #openstack-keystone | 20:19 | |
| *** noye has quit IRC | 20:19 | |
| *** ayoung has joined #openstack-keystone | 20:20 | |
| *** ChanServ sets mode: +v ayoung | 20:20 | |
| *** timcline has quit IRC | 20:20 | |
| *** josecastroleon has quit IRC | 20:21 | |
| *** bradjones|away has quit IRC | 20:21 | |
| *** samueldmq has quit IRC | 20:21 | |
| *** boris-42 has quit IRC | 20:22 | |
| *** josecastroleon has joined #openstack-keystone | 20:22 | |
| *** bradjones has joined #openstack-keystone | 20:23 | |
| *** bradjones has quit IRC | 20:23 | |
| *** bradjones has joined #openstack-keystone | 20:23 | |
| *** iamjarvo has quit IRC | 20:24 | |
| *** josecastroleon has quit IRC | 20:24 | |
| *** boris-42 has joined #openstack-keystone | 20:24 | |
| dstanek | dolphm: i could do that | 20:25 |
| *** josecastroleon has joined #openstack-keystone | 20:25 | |
| raildo | dims, Boston university | 20:26 |
| *** timcline has joined #openstack-keystone | 20:26 | |
| *** josecastroleon has quit IRC | 20:27 | |
| dims | raildo: y, which building i should have asked :) | 20:27 |
| raildo | dims, https://wiki.openstack.org/wiki/Sprints/KeystoneLibertySprint | 20:27 |
| dims | raildo: i went to school there :) | 20:28 |
| *** josecastroleon has joined #openstack-keystone | 20:28 | |
| *** josecastroleon has quit IRC | 20:30 | |
| bknudson | dims: which building do you want it to be in? | 20:31 |
| *** josecastroleon has joined #openstack-keystone | 20:31 | |
| dims | ha, i get to choose? :) | 20:31 |
| *** josecastroleon has quit IRC | 20:33 | |
| dolphm | dstanek: is there any case where _get_project_version would fail if _conf_get('project') had already succeeded? | 20:34 |
| *** markvoelker has joined #openstack-keystone | 20:34 | |
| *** josecastroleon has joined #openstack-keystone | 20:34 | |
| gyee | richm, yes, got it working | 20:36 |
| *** josecastroleon has quit IRC | 20:36 | |
| dstanek | dolphm: not that i know of | 20:36 |
| *** lastops has quit IRC | 20:37 | |
| *** josecastroleon has joined #openstack-keystone | 20:37 | |
| dolphm | dstanek: if you're going to post another rev, i assume L2670 is an easy change, assuming there's no justification https://review.openstack.org/#/c/180769/10..12/keystonemiddleware/tests/unit/auth_token/test_auth_token_middleware.py,unified | 20:38 |
| openstackgerrit | Merged openstack/python-keystoneclient: Use random strings for test fixtures https://review.openstack.org/189538 | 20:38 |
| *** markvoelker has quit IRC | 20:39 | |
| *** josecastroleon has quit IRC | 20:39 | |
| lbragstad | ayoung: do you know if there is anything special I have to do to get into the dorms at BU for the mid-cycle? | 20:40 |
| *** josecastroleon has joined #openstack-keystone | 20:40 | |
| dstanek | dolphm: that was from another test that i copied | 20:41 |
| dstanek | it could probably be a uuid | 20:41 |
| *** josecastroleon has quit IRC | 20:42 | |
| gyee | lbragstad, 23 Jump Street? | 20:43 |
| lbragstad | gyee: yes | 20:43 |
| *** josecastroleon has joined #openstack-keystone | 20:43 | |
| gyee | you need a side-kick | 20:44 |
| lbragstad | gyee: despite the fact that 21 and 22 jump street drop my IQ a little every time I watch them, I still do it... | 20:44 |
| gyee | me 2 :) | 20:45 |
| *** josecastroleon has quit IRC | 20:45 | |
| *** josecastroleon has joined #openstack-keystone | 20:46 | |
| *** josecastroleon has quit IRC | 20:48 | |
| richm | gyee: so you were able to configure apache to use http, but have clients use https urls? | 20:49 |
| *** josecastroleon has joined #openstack-keystone | 20:49 | |
| gyee | richm, no, we can't change the request url | 20:50 |
| *** josecastroleon has quit IRC | 20:51 | |
| *** stevemar has joined #openstack-keystone | 20:51 | |
| *** ChanServ sets mode: +v stevemar | 20:51 | |
| gyee | richm, we had to configure haproxy to do forwarding and maintain session affinity | 20:51 |
| gyee | otherwise, redirect will break | 20:51 |
| dstanek | gyee: it needed session affinity? | 20:52 |
| gyee | yes, otherwise, redirect will fail | 20:52 |
| *** josecastroleon has joined #openstack-keystone | 20:52 | |
| dstanek | that's odd. i wonder why | 20:52 |
| *** raildo has quit IRC | 20:52 | |
| gyee | dstanek, I haven't found that magic config option to not do redirect yet | 20:53 |
| *** arunkant has joined #openstack-keystone | 20:54 | |
| *** josecastroleon has quit IRC | 20:54 | |
| dstanek | even with a redirect why would it need to get back to the same keystone server. we don't actually keep session state | 20:54 |
| gyee | dstanek, shibboleth does | 20:54 |
| *** iurygregory has quit IRC | 20:54 | |
| gyee | there's a session cookie in there | 20:54 |
| *** josecastroleon has joined #openstack-keystone | 20:55 | |
| dstanek | gyee: that keystone uses? | 20:56 |
| gyee | dstanek, that's how shibboleth workflow, which k2k depends on | 20:56 |
| dstanek | gyee: ah, so it's mod_shib that requires affinity | 20:57 |
| dstanek | that makes sense | 20:57 |
| gyee | yeah, its a two step process | 20:57 |
| *** josecastroleon has quit IRC | 20:57 | |
| gyee | between mod_shib and shibd | 20:57 |
| *** josecastroleon has joined #openstack-keystone | 20:58 | |
| *** lhcheng has quit IRC | 21:01 | |
| *** dguerri` is now known as dguerri | 21:04 | |
| *** lhcheng has joined #openstack-keystone | 21:05 | |
| *** ChanServ sets mode: +v lhcheng | 21:05 | |
| *** zzzeek has quit IRC | 21:06 | |
| dolphm | gyee: any idea what shib keeps in the session? | 21:09 |
| gyee | dolphm, relay state I think | 21:09 |
| dolphm | gyee: i mean, what's in the state? | 21:10 |
| gyee | dolphm, just a random number to prevent replay attack I am guessing | 21:10 |
| gyee | but I don't know the shibd internals well | 21:10 |
| jamielennox | gyee: can you have another look at https://review.openstack.org/#/c/141267/10 when you get a chance | 21:14 |
| gyee | jamielennox, sure | 21:15 |
| *** Swanson has left #openstack-keystone | 21:15 | |
| gyee | jamielennox, https://review.openstack.org/#/c/179486/ | 21:15 |
| *** jaosorior has quit IRC | 21:15 | |
| gyee | I remember I reviewed one of your patches which also does refactoring in this area | 21:16 |
| gyee | the scary thing is that I can't find it in my history | 21:16 |
| jamielennox | gyee: yea, bknudson and i were doing a lot of refactoring in the same space but i don't think that will conflict | 21:17 |
| gyee | jamielennox, k, just want to confirm | 21:18 |
| bknudson | don't worry about conflicts with my changes... I'll just rebase. | 21:18 |
| bknudson | if you want to get jamielennox's in first go ahead | 21:18 |
| gyee | bknudson, k, I was afraid one may override the other | 21:19 |
| jamielennox | bknudson: i think mine have caught up, there are no reviews on the current one | 21:19 |
| bknudson | I think we're all moving in the same direction | 21:19 |
| dolphm | dstanek: gyee: found this when looking into shibboleth session stuff https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPClustering | 21:19 |
| bknudson | although jamielennox probably has bigger plans than I do. | 21:20 |
| jamielennox | bknudson: i was looking through those patches, are you working towards something in particular? | 21:21 |
| jamielennox | i can see the moving around and i don't have any problem with them i'm just not sure why in a few places | 21:21 |
| *** ayoung has quit IRC | 21:21 | |
| bknudson | jamielennox: I think it's cleaner to work with objects and a single representation. The single representation being AccessInfo. | 21:22 |
| gyee | dolphm, um, I need to give it a try | 21:23 |
| dolphm | gyee: you could try the other options, but i'd opt for what you're doing already myself | 21:23 |
| gyee | dolphm, I am also waiting for the mod_mellon alternative as well, to see which one offers less complexity | 21:24 |
| dolphm | the shared process model sounds far more fault-prone | 21:24 |
| dolphm | gyee: looks like mod mellon has the same basic requirements, but fewer deployment options | 21:25 |
| gyee | dolphm, not sure of mellon support ECP wrap yet, nkinder mentioned at the summit that they are making good progress | 21:26 |
| dolphm | gyee: to make shibd HA, you still need sticky sessions between your keystone nodes and the shibd nodes lol | 21:26 |
| dolphm | for the "shared process" model | 21:26 |
| gyee | yes! | 21:26 |
| gyee | we need session affinity in both cases | 21:26 |
| dolphm | i'd either do sticky session in front of keystone, or a shared db | 21:26 |
| stevemar | quit making things sticky | 21:26 |
| dolphm | and i'm not sure i want shib touching my db | 21:26 |
| dolphm | i don't want my db to be sticky | 21:27 |
| gyee | heh | 21:27 |
| dolphm | gyee: but you're right, i can't find any indication that it's solving anything other than xsrf | 21:28 |
| gyee | take the default, which is to store the relaystate in its local cache | 21:28 |
| nkinder__ | gyee: patches for ECP are proposed upstream for lasso (the underlying library that mellon uses), and mellon patches are being sent out today | 21:28 |
| *** josecastroleon has quit IRC | 21:28 | |
| gyee | nkinder__, awesome! | 21:28 |
| dolphm | i want a mellon patch | 21:28 |
| nkinder__ | :) | 21:28 |
| gyee | that's when you know summer has arrived | 21:29 |
| *** josecastroleon has joined #openstack-keystone | 21:29 | |
| *** josecastroleon has quit IRC | 21:31 | |
| stevemar | you are all mellon heads | 21:32 |
| gyee | that a band name? | 21:32 |
| *** geoffarnold has quit IRC | 21:32 | |
| *** josecastroleon has joined #openstack-keystone | 21:32 | |
| *** josecastroleon has quit IRC | 21:34 | |
| *** josecastroleon has joined #openstack-keystone | 21:35 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Make tests run against original client and session https://review.openstack.org/117089 | 21:35 |
| stevemar | gyee, it could be | 21:37 |
| *** josecastroleon has quit IRC | 21:37 | |
| *** ayoung has joined #openstack-keystone | 21:37 | |
| *** ChanServ sets mode: +v ayoung | 21:37 | |
| *** josecastroleon has joined #openstack-keystone | 21:38 | |
| *** josecastroleon has quit IRC | 21:40 | |
| *** josecastroleon has joined #openstack-keystone | 21:41 | |
| *** samueldmq has joined #openstack-keystone | 21:42 | |
| *** josecastroleon has quit IRC | 21:43 | |
| *** josecastroleon has joined #openstack-keystone | 21:44 | |
| *** ankita_wagh has joined #openstack-keystone | 21:45 | |
| *** josecastroleon has quit IRC | 21:46 | |
| *** josecastroleon has joined #openstack-keystone | 21:47 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Add service token to user token plugin https://review.openstack.org/141614 | 21:48 |
| *** josecastroleon has quit IRC | 21:49 | |
| *** josecastroleon has joined #openstack-keystone | 21:50 | |
| openstackgerrit | David J Hu proposed openstack/keystone-specs: Unified namespaced is_admin policy https://review.openstack.org/189486 | 21:51 |
| *** josecastroleon has quit IRC | 21:52 | |
| *** iamjarvo has joined #openstack-keystone | 21:53 | |
| *** josecastroleon has joined #openstack-keystone | 21:53 | |
| *** josecastroleon has quit IRC | 21:55 | |
| *** iamjarvo has quit IRC | 21:56 | |
| *** josecastroleon has joined #openstack-keystone | 21:56 | |
| *** josecastroleon has quit IRC | 21:58 | |
| *** josecastroleon has joined #openstack-keystone | 21:59 | |
| *** josecastroleon has quit IRC | 22:03 | |
| *** josecastroleon has joined #openstack-keystone | 22:04 | |
| *** Ephur has quit IRC | 22:04 | |
| *** josecastroleon has quit IRC | 22:06 | |
| *** josecastroleon has joined #openstack-keystone | 22:07 | |
| *** josecastroleon has quit IRC | 22:09 | |
| *** josecastroleon has joined #openstack-keystone | 22:10 | |
| *** josecastroleon has quit IRC | 22:12 | |
| *** josecastroleon has joined #openstack-keystone | 22:13 | |
| *** bknudson has quit IRC | 22:13 | |
| *** HT_sergio has quit IRC | 22:14 | |
| *** josecastroleon has quit IRC | 22:15 | |
| *** josecastroleon has joined #openstack-keystone | 22:16 | |
| *** pnavarro_ has quit IRC | 22:17 | |
| *** jsavak has joined #openstack-keystone | 22:17 | |
| *** josecastroleon has quit IRC | 22:18 | |
| *** josecastroleon has joined #openstack-keystone | 22:19 | |
| *** josecastroleon has quit IRC | 22:21 | |
| *** josecastroleon has joined #openstack-keystone | 22:22 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Add get_communication_params interface to plugins https://review.openstack.org/141267 | 22:23 |
| *** josecastroleon has quit IRC | 22:24 | |
| *** jsavak has quit IRC | 22:24 | |
| *** jsavak has joined #openstack-keystone | 22:24 | |
| *** josecastroleon has joined #openstack-keystone | 22:25 | |
| *** josecastroleon has quit IRC | 22:27 | |
| *** josecastroleon has joined #openstack-keystone | 22:28 | |
| openstackgerrit | Merged openstack/keystonemiddleware: validate_token returns AccessInfo https://review.openstack.org/179486 | 22:30 |
| *** josecastroleon has quit IRC | 22:30 | |
| *** topol has quit IRC | 22:30 | |
| *** josecastroleon has joined #openstack-keystone | 22:31 | |
| *** josecastroleon has quit IRC | 22:33 | |
| *** josecastroleon has joined #openstack-keystone | 22:34 | |
| *** stevemar has quit IRC | 22:35 | |
| *** josecastroleon has quit IRC | 22:36 | |
| *** josecastroleon has joined #openstack-keystone | 22:37 | |
| *** josecastroleon has quit IRC | 22:39 | |
| *** josecastroleon has joined #openstack-keystone | 22:40 | |
| jamielennox | gyee: i left some comments on https://review.openstack.org/#/c/177661/ | 22:41 |
| jamielennox | i'm still not sure i like using olso.policy for endpoint enforcement | 22:41 |
| jamielennox | we are still going to end up with enforce_endpoint_id and enforce_service_id in the config so why not do it the old way? | 22:42 |
| *** ayoung has quit IRC | 22:44 | |
| mfisch | lbragstad: how do I match fernet token IDs up with what the log file shows? | 22:50 |
| mfisch | the log file is still showing UUID-looking things in the logs | 22:50 |
| mfisch | for example | 22:51 |
| *** timcline has quit IRC | 22:51 | |
| mfisch | Could not find token: a1d6d526aa86423ca6b99f80332819c | 22:51 |
| mfisch | thats not a fernet ID, could be a piece of one I guess | 22:51 |
| mfisch | or maybe a hash or something? | 22:52 |
| mfisch | if so would love to know how to decode for debugging | 22:52 |
| *** chlong-zzz has quit IRC | 22:58 | |
| *** HT_sergio has joined #openstack-keystone | 22:58 | |
| *** thedodd has quit IRC | 23:02 | |
| *** josecastroleon has quit IRC | 23:10 | |
| *** samueldmq has quit IRC | 23:11 | |
| *** josecastroleon has joined #openstack-keystone | 23:11 | |
| *** josecastroleon has quit IRC | 23:13 | |
| morganfainberg | mfisch: uhm | 23:14 |
| morganfainberg | mfisch: did it say {SHA1}<thing>? | 23:14 |
| *** josecastroleon has joined #openstack-keystone | 23:14 | |
| *** josecastroleon has quit IRC | 23:17 | |
| *** josecastroleon has joined #openstack-keystone | 23:19 | |
| *** toddnni has quit IRC | 23:19 | |
| *** josecastroleon has quit IRC | 23:20 | |
| *** markvoelker has joined #openstack-keystone | 23:21 | |
| *** josecastroleon has joined #openstack-keystone | 23:22 | |
| *** toddnni has joined #openstack-keystone | 23:22 | |
| *** josecastroleon has quit IRC | 23:23 | |
| *** josecastroleon has joined #openstack-keystone | 23:25 | |
| *** markvoelker has quit IRC | 23:26 | |
| *** josecastroleon has quit IRC | 23:26 | |
| *** josecastroleon has joined #openstack-keystone | 23:28 | |
| *** josecastroleon has quit IRC | 23:29 | |
| *** ankita_wagh has quit IRC | 23:30 | |
| *** josecastroleon has joined #openstack-keystone | 23:31 | |
| *** mikedillion has joined #openstack-keystone | 23:31 | |
| *** mikedillion has quit IRC | 23:32 | |
| *** josecastroleon has quit IRC | 23:32 | |
| *** stevemar has joined #openstack-keystone | 23:33 | |
| *** ChanServ sets mode: +v stevemar | 23:33 | |
| *** josecastroleon has joined #openstack-keystone | 23:34 | |
| *** josecastroleon has quit IRC | 23:35 | |
| *** mikedillion has joined #openstack-keystone | 23:36 | |
| *** josecastroleon has joined #openstack-keystone | 23:37 | |
| *** toddnni_ has joined #openstack-keystone | 23:37 | |
| *** toddnni has quit IRC | 23:37 | |
| *** toddnni_ is now known as toddnni | 23:37 | |
| gyee | jamielennox, thanks, reason for the global target is that it will be generic, not just endpoint constraint enforcement | 23:39 |
| gyee | jamielennox, endpoint_id can be configured in either the global target or middleware conf | 23:39 |
| jamielennox | gyee: so i think having this as standalone middleware makes sense | 23:40 |
| *** dguerri is now known as dguerri` | 23:40 | |
| gyee | jamielennox, right, eventually | 23:40 |
| *** josecastroleon has quit IRC | 23:40 | |
| jamielennox | gyee: why wait? | 23:41 |
| gyee | jamielennox, we had a conversation with both morganfainberg and ayoung, reason is easier deployment | 23:41 |
| gyee | my understanding is that pipeline changes are a bit mroe disruptive on upgrade | 23:42 |
| *** josecastroleon has joined #openstack-keystone | 23:42 | |
| gyee | we want to keep the config changes to a minimum right now, till we expend on the functionality | 23:42 |
| *** harlowja has quit IRC | 23:42 | |
| jamielennox | i kind of disagree | 23:43 |
| *** harlowja has joined #openstack-keystone | 23:43 | |
| gyee | I don't have a problem separating it into a new middleware filter, just code :) | 23:43 |
| *** josecastroleon has quit IRC | 23:43 | |
| jamielennox | i don't like to have an explicit enable step, and ideally i'd like to not make auth_token much bigger | 23:44 |
| *** ankita_wagh has joined #openstack-keystone | 23:44 | |
| *** josecastroleon has joined #openstack-keystone | 23:45 | |
| gyee | jamielennox, the other reason is that endpoint constraint is really part of "token validation" | 23:45 |
| gyee | same as token binding | 23:45 |
| jamielennox | gyee: i would have agreed if we were doing it manually, but there's no guarantee that there's even a reference to endpoitn_id in the policy line | 23:46 |
| jamielennox | feels much more like generic policy enforcement on the token | 23:46 |
| gyee | jamielennox, you can setup a target with endpoint_id in it | 23:46 |
| *** josecastroleon has quit IRC | 23:46 | |
| gyee | "endpoint_constraint": "token.catalog.endpoints.id:12345", | 23:47 |
| gyee | or | 23:48 |
| *** mikedillion has quit IRC | 23:48 | |
| *** josecastroleon has joined #openstack-keystone | 23:48 | |
| gyee | "token_binding": "rule:endpoint_constraint and token.binding.kerberos.principal:foo" | 23:48 |
| jamielennox | is it really that specific? so it's tied to the version of the token? | 23:49 |
| *** josecastroleon has quit IRC | 23:49 | |
| gyee | jamielennox, right now it has to be token format specific, but once we canonicalize the token to AccessInfo we can have something more consistent | 23:50 |
| gyee | right now its basically enforced against a flatten token dict | 23:50 |
| *** josecastroleon has joined #openstack-keystone | 23:51 | |
| jamielennox | we aren't doing the cannonicalized thing | 23:51 |
| jamielennox | i mean we can make that work in a different way | 23:51 |
| gyee | my point is there are rooms for improvement, but they are not showstoppers | 23:51 |
| jamielennox | morganfainberg: are you set on having policy enforcement be in auth_token middleware rather than its own middleare | 23:52 |
| jamielennox | ? | 23:52 |
| *** josecastroleon has quit IRC | 23:52 | |
| gyee | jamielennox, I need to step out for about 30 mins, lets catch morganfainberg and ayoung once they are back online | 23:53 |
| *** jsavak has quit IRC | 23:53 | |
| jamielennox | gyee: ok | 23:53 |
| *** josecastroleon has joined #openstack-keystone | 23:54 | |
| *** jsavak has joined #openstack-keystone | 23:54 | |
| *** josecastroleon has quit IRC | 23:55 | |
| *** josecastroleon has joined #openstack-keystone | 23:57 | |
| *** bradjones has quit IRC | 23:58 | |
| *** josecastroleon has quit IRC | 23:58 | |
| *** lhcheng has quit IRC | 23:59 | |
| *** roxanaghe has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!