| *** htruta_ has joined #openstack-keystone | 00:02 | |
| kfox1111 | morganfainberg: I'm hoping to get the nova folks to accept the instance blueprint for the next nova meeting on the 18th. their feature window is getting very close to closing I think. Will you have a few minutes to review and weigh in on the spec before then? | 00:11 |
|---|---|---|
| *** _cjones_ has quit IRC | 00:23 | |
| *** _cjones_ has joined #openstack-keystone | 00:23 | |
| *** _cjones_ has quit IRC | 00:28 | |
| *** jasondotstar has quit IRC | 00:42 | |
| *** chlong has joined #openstack-keystone | 00:42 | |
| *** btully has quit IRC | 00:46 | |
| *** btully has joined #openstack-keystone | 00:48 | |
| *** lhcheng has quit IRC | 00:49 | |
| stevemar | jamielennox, np ;) | 00:52 |
| stevemar | i felt bad since i broke you :( | 00:52 |
| *** dsirrine has quit IRC | 00:54 | |
| jamielennox | we might need some unit tests for OSC | 00:54 |
| jamielennox | but np - it happens | 00:54 |
| *** kfox1111 has quit IRC | 00:56 | |
| *** samleon has joined #openstack-keystone | 00:57 | |
| *** samleon has quit IRC | 00:57 | |
| *** tobe has joined #openstack-keystone | 01:05 | |
| *** dsirrine has joined #openstack-keystone | 01:09 | |
| *** _liusheng has joined #openstack-keystone | 01:10 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove _get_service_endpoints function https://review.openstack.org/191659 | 01:10 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Make normalize_endpoint_type public https://review.openstack.org/191672 | 01:10 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Make _is_endpoint_type_match function public https://review.openstack.org/191670 | 01:10 |
| *** bknudson has joined #openstack-keystone | 01:11 | |
| *** ChanServ sets mode: +v bknudson | 01:11 | |
| *** ayoung has joined #openstack-keystone | 01:11 | |
| *** ChanServ sets mode: +v ayoung | 01:11 | |
| *** _liusheng has quit IRC | 01:11 | |
| *** liusheng_ has joined #openstack-keystone | 01:12 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Add get_communication_params interface to plugins https://review.openstack.org/191646 | 01:14 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove unused fixtures https://review.openstack.org/191635 | 01:16 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Prompt for password on CLI if not provided https://review.openstack.org/191639 | 01:19 |
| *** bradjones has quit IRC | 01:21 | |
| *** tqtran is now known as tqtran_afk_gowar | 01:27 | |
| *** bradjones has joined #openstack-keystone | 01:29 | |
| *** bradjones has quit IRC | 01:29 | |
| *** bradjones has joined #openstack-keystone | 01:29 | |
| *** Guest68549 is now known as dan | 01:30 | |
| *** tqtran_afk_gowar has quit IRC | 01:32 | |
| *** mtecer has quit IRC | 01:34 | |
| *** fangzhou has quit IRC | 01:34 | |
| *** spandhe has quit IRC | 01:35 | |
| *** kiran-r has joined #openstack-keystone | 01:37 | |
| openstackgerrit | guang-yee proposed openstack/keystonemiddleware: Enforce endpoint constraint https://review.openstack.org/177661 | 01:44 |
| *** gyee is now known as operator99 | 01:49 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone-specs: New way to get a project scoped token by name after Reseller https://review.openstack.org/192495 | 01:55 |
| *** iamjarvo has joined #openstack-keystone | 01:57 | |
| *** dims has quit IRC | 02:04 | |
| *** htruta_ has quit IRC | 02:05 | |
| *** dims has joined #openstack-keystone | 02:08 | |
| *** jasondotstar has joined #openstack-keystone | 02:09 | |
| *** jasondotstar has quit IRC | 02:09 | |
| *** jasondotstar has joined #openstack-keystone | 02:10 | |
| *** woodster_ has quit IRC | 02:11 | |
| *** kiran-r has quit IRC | 02:11 | |
| *** davechen is now known as davechen_afk | 02:13 | |
| *** dims has quit IRC | 02:19 | |
| *** jasondotstar has quit IRC | 02:24 | |
| *** davechen has joined #openstack-keystone | 02:25 | |
| *** csoukup has joined #openstack-keystone | 02:31 | |
| openstackgerrit | Merged openstack/oslo.policy: Updated from global requirements https://review.openstack.org/192310 | 02:36 |
| *** lhcheng has joined #openstack-keystone | 02:42 | |
| *** ChanServ sets mode: +v lhcheng | 02:42 | |
| *** spandhe has joined #openstack-keystone | 02:43 | |
| *** spandhe_ has joined #openstack-keystone | 02:44 | |
| *** lhcheng has quit IRC | 02:45 | |
| *** liusheng_ has quit IRC | 02:48 | |
| *** spandhe has quit IRC | 02:48 | |
| *** spandhe_ is now known as spandhe | 02:48 | |
| *** liusheng has joined #openstack-keystone | 02:48 | |
| *** lhcheng has joined #openstack-keystone | 02:52 | |
| *** ChanServ sets mode: +v lhcheng | 02:52 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone-specs: New way to get a project scoped token by name after Reseller https://review.openstack.org/192495 | 03:00 |
| *** kiran-r has joined #openstack-keystone | 03:05 | |
| *** marzif has joined #openstack-keystone | 03:09 | |
| *** liusheng has quit IRC | 03:09 | |
| *** liusheng has joined #openstack-keystone | 03:10 | |
| *** lhcheng has quit IRC | 03:21 | |
| *** raildo has quit IRC | 03:21 | |
| *** samueldmq has quit IRC | 03:21 | |
| *** htruta has quit IRC | 03:22 | |
| *** pauloewerton has quit IRC | 03:22 | |
| *** afaranha has quit IRC | 03:22 | |
| *** ericksonsantos has quit IRC | 03:22 | |
| *** iurygregory has quit IRC | 03:22 | |
| *** tellesnobrega has quit IRC | 03:22 | |
| *** iamjarvo has quit IRC | 03:26 | |
| *** c_soukup has joined #openstack-keystone | 03:27 | |
| *** iamjarvo has joined #openstack-keystone | 03:29 | |
| *** csoukup has quit IRC | 03:30 | |
| *** markvoelker has quit IRC | 03:31 | |
| *** stevemar has quit IRC | 03:47 | |
| *** stevemar has joined #openstack-keystone | 03:48 | |
| *** ChanServ sets mode: +v stevemar | 03:48 | |
| *** RichardRaseley has quit IRC | 03:50 | |
| *** richm has quit IRC | 03:52 | |
| *** c_soukup has quit IRC | 03:59 | |
| *** iamjarvo has quit IRC | 04:00 | |
| *** kiran-r has quit IRC | 04:06 | |
| *** rushiagr_away is now known as rushiagr | 04:10 | |
| *** marzif has quit IRC | 04:13 | |
| *** spandhe has quit IRC | 04:27 | |
| *** josecastroleon has quit IRC | 04:31 | |
| *** neelabh has joined #openstack-keystone | 04:32 | |
| *** markvoelker has joined #openstack-keystone | 04:32 | |
| *** josecastroleon has joined #openstack-keystone | 04:32 | |
| *** markvoelker has quit IRC | 04:37 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Refactor token fetching https://review.openstack.org/190673 | 04:56 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Refactor _confirm_token_bind takes AccessInfo https://review.openstack.org/179676 | 04:56 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Extract basic validation processing to base class https://review.openstack.org/180818 | 04:56 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Separate the fetch and validate token processes https://review.openstack.org/190940 | 04:56 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Make token bind work with a request https://review.openstack.org/180817 | 04:56 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't cache signed tokens https://review.openstack.org/190941 | 04:56 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Create a simple base class from AuthProtocol https://review.openstack.org/180816 | 04:56 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Refactor token fetching https://review.openstack.org/190673 | 04:59 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Refactor _confirm_token_bind takes AccessInfo https://review.openstack.org/179676 | 04:59 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Extract basic validation processing to base class https://review.openstack.org/180818 | 04:59 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Separate the fetch and validate token processes https://review.openstack.org/190940 | 04:59 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Make token bind work with a request https://review.openstack.org/180817 | 04:59 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't cache signed tokens https://review.openstack.org/190941 | 04:59 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Create a simple base class from AuthProtocol https://review.openstack.org/180816 | 04:59 |
| stevemar | jamielennox is going crazy with patches again | 05:00 |
| jamielennox | stevemar: same patches, rebase error at the bottom of the chain | 05:01 |
| *** fifieldt has joined #openstack-keystone | 05:10 | |
| *** stevemar has quit IRC | 05:14 | |
| *** Kennan has quit IRC | 05:14 | |
| *** browne has quit IRC | 05:16 | |
| *** Kennan has joined #openstack-keystone | 05:20 | |
| *** tobe has quit IRC | 05:39 | |
| *** belmoreira has joined #openstack-keystone | 05:44 | |
| *** neelabh has left #openstack-keystone | 05:46 | |
| *** lhcheng has joined #openstack-keystone | 05:53 | |
| *** ChanServ sets mode: +v lhcheng | 05:53 | |
| *** mabrams has joined #openstack-keystone | 05:54 | |
| *** markvoelker has joined #openstack-keystone | 05:55 | |
| *** markvoelker has quit IRC | 06:00 | |
| *** kiran-r has joined #openstack-keystone | 06:02 | |
| *** browne has joined #openstack-keystone | 06:03 | |
| *** browne has quit IRC | 06:14 | |
| *** jith_ has joined #openstack-keystone | 06:15 | |
| jith_ | hi all, i exported service token and endpoint. i couldnt able to delete an end point i got an error like "Unable to delete endpoint." | 06:16 |
| *** tobe has joined #openstack-keystone | 06:20 | |
| *** afazekas has joined #openstack-keystone | 06:23 | |
| *** browne has joined #openstack-keystone | 06:32 | |
| *** boris-42 has quit IRC | 06:42 | |
| *** browne has quit IRC | 06:49 | |
| *** henrynash has joined #openstack-keystone | 06:50 | |
| *** ChanServ sets mode: +v henrynash | 06:50 | |
| *** dsirrine has quit IRC | 06:56 | |
| *** lhcheng has quit IRC | 06:58 | |
| *** btully has quit IRC | 07:01 | |
| *** btully has joined #openstack-keystone | 07:03 | |
| *** pnavarro has joined #openstack-keystone | 07:29 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Make AccessInfo a dictionary https://review.openstack.org/192539 | 07:34 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Use AccessInfo from keystoneauth https://review.openstack.org/192540 | 07:36 |
| *** markvoelker has joined #openstack-keystone | 07:44 | |
| *** markvoelker has quit IRC | 07:49 | |
| *** jaosorior has joined #openstack-keystone | 07:58 | |
| *** SaintAardvark has left #openstack-keystone | 08:00 | |
| *** chlong has quit IRC | 08:18 | |
| *** MaxV has joined #openstack-keystone | 08:32 | |
| *** belmoreira has quit IRC | 08:33 | |
| *** belmoreira has joined #openstack-keystone | 08:33 | |
| MaxV | Hello all, I am currently writing some documentation and I am wondering which are the different mimetypes for the policies available (basically I only see the json but maybe there is support for yaml) | 08:34 |
| MaxV | https://plus.google.com/hangouts/_/gxibiwe6spssxkbpqytq65utaua?hl=fr | 08:35 |
| MaxV | sorry wrong link :x | 08:35 |
| MaxV | http://developer.openstack.org/api-ref-identity-v3.html#policies-v3 | 08:35 |
| *** tobe has quit IRC | 08:58 | |
| *** Xurong has joined #openstack-keystone | 08:58 | |
| *** tobe has joined #openstack-keystone | 08:59 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Refactor token fetching https://review.openstack.org/190673 | 08:59 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Refactor _confirm_token_bind takes AccessInfo https://review.openstack.org/179676 | 08:59 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Extract basic validation processing to base class https://review.openstack.org/180818 | 08:59 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Separate the fetch and validate token processes https://review.openstack.org/190940 | 08:59 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't cache signed tokens https://review.openstack.org/190941 | 08:59 |
| *** tobe_ has joined #openstack-keystone | 09:01 | |
| *** tobe_ has quit IRC | 09:01 | |
| *** tobe has quit IRC | 09:03 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Refactor token fetching https://review.openstack.org/190673 | 09:04 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't cache signed tokens https://review.openstack.org/190941 | 09:04 |
| *** tobe has joined #openstack-keystone | 09:23 | |
| *** dguerri` is now known as dguerri | 09:31 | |
| *** markvoelker has joined #openstack-keystone | 09:33 | |
| *** e0ne has joined #openstack-keystone | 09:36 | |
| *** markvoelker has quit IRC | 09:37 | |
| marekd | rodrigods: ping. | 09:38 |
| marekd | rodrigods: let me know when you are online | 09:38 |
| *** e0ne is now known as e0ne_ | 09:43 | |
| *** MaxV has quit IRC | 09:44 | |
| *** fhubik has joined #openstack-keystone | 09:44 | |
| *** fhubik is now known as fhubik_afk | 09:44 | |
| *** e0ne_ is now known as e0ne | 09:47 | |
| *** fhubik_afk is now known as fhubik | 09:48 | |
| *** davechen has left #openstack-keystone | 09:54 | |
| *** MaxV has joined #openstack-keystone | 10:02 | |
| *** dims has joined #openstack-keystone | 10:17 | |
| *** tobe has quit IRC | 10:17 | |
| *** dims has quit IRC | 10:17 | |
| *** dims has joined #openstack-keystone | 10:18 | |
| *** kiran-r has quit IRC | 10:39 | |
| *** jasondotstar has joined #openstack-keystone | 10:41 | |
| *** fhubik has quit IRC | 10:44 | |
| *** e0ne is now known as e0ne_ | 10:49 | |
| *** aix has joined #openstack-keystone | 10:49 | |
| *** e0ne_ has quit IRC | 10:54 | |
| *** e0ne has joined #openstack-keystone | 10:56 | |
| *** jasondotstar has quit IRC | 11:06 | |
| *** markvoelker has joined #openstack-keystone | 11:22 | |
| *** rushiagr is now known as rushiagr_away | 11:24 | |
| *** markvoelker has quit IRC | 11:27 | |
| *** e0ne is now known as e0ne_ | 11:29 | |
| *** tellesnobrega has joined #openstack-keystone | 11:33 | |
| *** samueldmq has joined #openstack-keystone | 11:34 | |
| *** e0ne_ has quit IRC | 11:34 | |
| *** ericksonsantos has joined #openstack-keystone | 11:36 | |
| *** kiran-r has joined #openstack-keystone | 11:38 | |
| *** tellesnobrega has quit IRC | 11:40 | |
| *** ericksonsantos has quit IRC | 11:41 | |
| *** samueldmq has quit IRC | 11:41 | |
| *** tellesnobrega has joined #openstack-keystone | 11:43 | |
| *** MaxV has quit IRC | 11:43 | |
| *** samueldmq has joined #openstack-keystone | 11:58 | |
| samueldmq | jamielennox, you around ? http://logs.openstack.org/84/186684/4/experimental/check-tempest-dsvm-neutron-identity-v3-only-full/ca5f300/logs/devstacklog.txt.gz#_2015-06-17_00_11_13_165 | 11:59 |
| samueldmq | morning guys ! | 11:59 |
| *** Xurong has quit IRC | 12:01 | |
| *** Xurong has joined #openstack-keystone | 12:01 | |
| samueldmq | ayoung, hey, I just saw your diagram | 12:03 |
| samueldmq | ayoung, it looks great | 12:03 |
| samueldmq | ayoung, when you say 'upload default policy' there, you're saying the default for that nova endpoint URL as well, right ? | 12:04 |
| samueldmq | ayoung, not the unified default one, since we decided to wait a bit more on that for now :) | 12:04 |
| *** markvoelker has joined #openstack-keystone | 12:05 | |
| *** htruta has joined #openstack-keystone | 12:06 | |
| *** rushiagr_away is now known as rushiagr | 12:11 | |
| *** iurygregory has joined #openstack-keystone | 12:16 | |
| *** e0ne has joined #openstack-keystone | 12:19 | |
| *** raildo has joined #openstack-keystone | 12:26 | |
| jamielennox | samueldmq: yes, i've seen that. it's because of glance in single tenant mode storing images to swift | 12:33 |
| jamielennox | i don't have a solution for that one yet | 12:33 |
| rodrigods | jamielennox, ping... didn't get your comment here: https://review.openstack.org/#/c/188581/23/keystoneauth/auth/identity/v3/k2k.py | 12:33 |
| samueldmq | jamielennox, I don't see how it works differently with v2/v3 | 12:33 |
| samueldmq | jamielennox, single tenant/project mode should operate the same | 12:34 |
| jamielennox | rodrigods: looking | 12:34 |
| jamielennox | samueldmq: so glance has two modes when talking to swift | 12:34 |
| jamielennox | one where glance has its own credentials and it stores everything in swift as the glance user | 12:34 |
| jamielennox | and one where it stores everything in swift as the actual user | 12:34 |
| jamielennox | the first one (the default) currently only lets you provide credentials in v2 format | 12:35 |
| jamielennox | and it's related to the fact that the swift client is crap | 12:35 |
| jamielennox | off the top of my head i'm not sure what swiftclient's v3 capabilities are anyway | 12:36 |
| *** dims has quit IRC | 12:36 | |
| samueldmq | jamielennox, in few words, that *should* be fixed making swift client use v3 token format | 12:36 |
| *** dims has joined #openstack-keystone | 12:36 | |
| jamielennox | rodrigods: oh, for that one i think it adds additional headers like the X-Auth-Token so the dictionary that you are saving at the top level may end up with additional stuff in it you didn't expect | 12:37 |
| jamielennox | samueldmq: more or less | 12:37 |
| marekd | rodrigods: i assume you are online but you don't really read old messages? | 12:37 |
| jamielennox | samueldmq: i *think* swiftclient can do v3, but there are no options available for the additional v3 parameters | 12:37 |
| jamielennox | like to give the corrrect credentials to swiftclient | 12:37 |
| rodrigods | marekd, yeah... my proxy only delivers the last 20 messages, let me see the log | 12:38 |
| marekd | rodrigods: no need | 12:38 |
| samueldmq | jamielennox, swift client accepts sessions as well, right ? | 12:39 |
| jamielennox | samueldmq: no :( | 12:39 |
| samueldmq | jamielennox, so we pass the ksclient session with v3 to it, .. | 12:39 |
| jamielennox | it's the only major one left i know of that doesn't | 12:39 |
| samueldmq | jamielennox, oh .. shouldn't we be setting this then ? https://github.com/openstack/python-swiftclient/blob/c15e81af9bba231b7bfc3d7473d47e2e9694cd0e/tests/sample.conf#L8 | 12:39 |
| jamielennox | but it's so different to the others it's really different | 12:39 |
| * jamielennox is repeating himself | 12:39 | |
| jamielennox | really difficult | 12:40 |
| rodrigods | marekd, sorry, didn't get your ping (now I see it in the log) | 12:40 |
| marekd | rodrigods: no worries. | 12:40 |
| marekd | when you were setting up the fed-keystones, you were using auth method in keystone.conf [auth] secionts saml2 = [...].Mapped or Saml2 class ? | 12:40 |
| samueldmq | jamielennox, so that option on swiftclient config ^should enable v3 .. maybe we need that when honoring our flag, or should osclient set that since it is supposed to be configured to work with v3? | 12:41 |
| rodrigods | marekd, for Kilo I believe it was Mapped | 12:41 |
| marekd | great | 12:41 |
| *** bknudson has quit IRC | 12:41 | |
| jamielennox | samueldmq: so https://github.com/openstack/python-swiftclient/blob/c15e81af9bba231b7bfc3d7473d47e2e9694cd0e/swiftclient/client.py#L319 seems to be the extend of the v3 support | 12:42 |
| jamielennox | however os_options implies to me that these options are coming from the command line | 12:42 |
| jamielennox | so i've really got no idea how you are supposed to operate swiftclient with v3 from python directly | 12:43 |
| jamielennox | swiftclient has needed a rewrite for a long time, but they were going to wait for the SDK and drop the client instead | 12:45 |
| jamielennox | i managed to get session adoption in glance, but i just don't see how it would integrate into swiftclient | 12:45 |
| *** woodster_ has joined #openstack-keystone | 12:45 | |
| rodrigods | jamielennox, hmm so I pass {'Content-Type': 'application/vnd.paos+xml'} directly? | 12:46 |
| ayoung | samueldmq, I was talking unified. I have not given up on that | 12:46 |
| jamielennox | rodrigods: i would | 12:46 |
| jamielennox | rodrigods: just pass a new dictionary every time | 12:46 |
| rodrigods | jamielennox, cool, thx | 12:46 |
| ayoung | I think unified is going to be essential | 12:46 |
| jamielennox | rodrigods: that's not why i didn't +2 it, i don't have a setup where i can really test it and with keystoneauth happening i just want to make sure it works | 12:47 |
| samueldmq | ayoung, not doing unified now doesn't mean to give up on it | 12:47 |
| samueldmq | ayoung, why is it essential ? what does it bring that we haven't without unifiying ? | 12:47 |
| ayoung | samueldmq, we don't get all the projects using a common set of roles | 12:48 |
| rodrigods | jamielennox, sure... doug-fish is kindly testing everything to help me. It seems to work for him (using a fix in keystoneclient) | 12:48 |
| samueldmq | jamielennox, yes.. so that will be a challenge on swift side .. | 12:48 |
| samueldmq | jamielennox, let me know how I can help (as I find some time between dynamic policy stuff) | 12:49 |
| *** henrynash has quit IRC | 12:49 | |
| jamielennox | rodrigods: yep - it's not that i don't trust you | 12:49 |
| jamielennox | samueldmq: yea, i don't know what to do with it | 12:49 |
| samueldmq | do we advise people to disable a user before deleting it ? | 12:50 |
| samueldmq | jamielennox, ayoung ^ | 12:50 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystoneauth: Add Keystone2KeystoneAuthPlugin for K2K federation https://review.openstack.org/188581 | 12:51 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystoneauth: Keystone2KeystoneAuthPlugin scoping capabilities https://review.openstack.org/188881 | 12:51 |
| samueldmq | I know we need to disable before delete with domain .. | 12:51 |
| *** mabrams has quit IRC | 12:51 | |
| jamielennox | samueldmq: i don't think so | 12:51 |
| samueldmq | jamielennox, same from me :) | 12:52 |
| samueldmq | jamielennox, thanks | 12:52 |
| *** Ctina_ has joined #openstack-keystone | 12:52 | |
| *** e0ne is now known as e0ne_ | 12:55 | |
| *** e0ne_ is now known as e0ne | 12:57 | |
| *** edmondsw has joined #openstack-keystone | 12:57 | |
| ayoung | we should probably not delete users | 13:00 |
| ayoung | replace CRUD with CARE. create, append, read (the summation), expire (without deleting). | 13:01 |
| ayoung | Heh Query Unindex Index Crawl and Kill, | 13:02 |
| samueldmq | ayoung, we need to synchorize on the unified policy thing, let me know when ytou have some time | 13:05 |
| samueldmq | ayoung, I want to be in full agreement with you before talking to other people (sdague and other folks) | 13:05 |
| *** richm has joined #openstack-keystone | 13:07 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystoneauth: Add Keystone2KeystoneAuthPlugin for K2K federation https://review.openstack.org/188581 | 13:08 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystoneauth: Keystone2KeystoneAuthPlugin scoping capabilities https://review.openstack.org/188881 | 13:08 |
| *** bknudson has joined #openstack-keystone | 13:08 | |
| *** ChanServ sets mode: +v bknudson | 13:08 | |
| *** jamielennox is now known as jamielennox|away | 13:13 | |
| ayoung | samueldmq, we write it ourselves and post it for review | 13:13 |
| ayoung | samueldmq, I think I have a copy somewhere public | 13:14 |
| *** bknudson has quit IRC | 13:14 | |
| ayoung | samueldmq, https://github.com/admiyo/openstack-core-policy | 13:14 |
| samueldmq | ayoung, that requires that the unified policy be released once any related project had a new version, right ? | 13:17 |
| samueldmq | ayoung, I suppose you're aware of the issue sdague pointed out | 13:17 |
| ayoung | samueldmq, or more often than that | 13:17 |
| ayoung | samueldmq, quite | 13:17 |
| samueldmq | ayoung, if we have people running in master | 13:17 |
| ayoung | samueldmq, I just don't think it will be a problem in practice | 13:17 |
| samueldmq | ayoung, why ? | 13:17 |
| ayoung | samueldmq, let's keep the effort going, and push on to see if we can solve the speed bumps | 13:17 |
| samueldmq | ayoung, I want to see what's the big advantage on unifying | 13:18 |
| samueldmq | ayoung, that we can't solve keeping them in separate | 13:18 |
| ayoung | samueldmq, otherwise, each project comes up with its own definitions of things, and this is one place we need to align | 13:18 |
| samueldmq | ayoung, the common definitions | 13:18 |
| samueldmq | ayoung, this is what you want to solve | 13:18 |
| ayoung | samueldmq, there are implicit meanings there, like "admin needs to be scoped" that a re not currently understood | 13:19 |
| samueldmq | ayoung, we could base better policies on different roles for cloud_admin, domain_admin and project_admin | 13:19 |
| ayoung | even if no one runs with the common policy file, the effort is worth it | 13:19 |
| ayoung | samueldmq, talk to dolphm , as this idea was his origianlly | 13:20 |
| ayoung | he can explain it better than I can | 13:20 |
| samueldmq | ayoung, ok .. but again, I am not against it at all, I just want to see the reasons we need that | 13:20 |
| *** jamielennox|away is now known as jamielennox | 13:21 | |
| samueldmq | ayoung, I would put a story in that wiki to have the default policies .. if we start with that (without unified) | 13:21 |
| samueldmq | ayoung, we could adopt unified later | 13:21 |
| samueldmq | ayoung, nothing is saying if we keep our individual policies direction, we wouldn't be able to adopt unified later | 13:21 |
| samueldmq | dolphm, hi - let me know when you're available to talk a little bit about the unified policies thing | 13:22 |
| samueldmq | what I want is to have a 100% clear scope for L, and this must be done first here in keystone | 13:22 |
| samueldmq | then synchronize with other folks (nova and so on) | 13:23 |
| samueldmq | so we will have specs approved and implement that in L (according to that workflow in the wiki) | 13:23 |
| samueldmq | ayoung, ^ | 13:23 |
| samueldmq | ayoung, btw, I am updating that to include the stories we were discussing yesterday ... | 13:24 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystoneauth: Add Keystone2KeystoneAuthPlugin for K2K federation https://review.openstack.org/188581 | 13:25 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystoneauth: Keystone2KeystoneAuthPlugin scoping capabilities https://review.openstack.org/188881 | 13:25 |
| *** bknudson has joined #openstack-keystone | 13:27 | |
| *** ChanServ sets mode: +v bknudson | 13:27 | |
| *** Xurong has quit IRC | 13:27 | |
| samueldmq | ayoung, what if ..... | 13:28 |
| *** Xurong has joined #openstack-keystone | 13:28 | |
| samueldmq | ayoung, the unifeid policy was something that would only contain the common definitions ? | 13:28 |
| samueldmq | ayoung, that would be used by other policies ? in the dynamic policy world | 13:28 |
| ayoung | samueldmq, and then the projects imported them? I've thought of that, but it is a far harder solution to implement | 13:29 |
| ayoung | now we need to change the build process for every project | 13:29 |
| ayoung | it also really doesn't make people talk to each other and get a rational approach for policy | 13:29 |
| ayoung | and the conversation is at least as valuable as the solution | 13:30 |
| samueldmq | ayoung, I understand your point, but I'd like to at least understand how sdague's concerns would be solved | 13:30 |
| *** stevemar has joined #openstack-keystone | 13:30 | |
| *** ChanServ sets mode: +v stevemar | 13:30 | |
| samueldmq | ayoung, I will be talking to people from other projects as well .. and I won't be able to have an answer for those questions | 13:31 |
| ayoung | samueldmq, if we were to do this completely in the realm of the current code review process, I would say the unified policy file is a starting pouint. they keep updating when they have microversions...it will be faster to get code through common policy than to get code into the main projects | 13:32 |
| ayoung | but also have good defaults | 13:32 |
| ayoung | so, it you add a new microversion api, and the code is not supported yet, you get admin | 13:32 |
| ayoung | samueldmq, also, if we split the policy file as I've been suggesting, then it is just a roles check | 13:32 |
| ayoung | and I think that is the real solution | 13:32 |
| samueldmq | ayoung, so each time there is a change in a project that affects external API signatures, there is a change in the unified policy | 13:32 |
| ayoung | samueldmq, that is how SELinux works | 13:33 |
| samueldmq | ayoung, I am not sure it's good to add such dependency between projects, and we want that | 13:33 |
| *** jamielennox is now known as jamielennox|away | 13:33 | |
| ayoung | samueldmq, it is a starting point until some comes up with something better. | 13:33 |
| samueldmq | ayoung, so it would be something from oslo-incubator ? | 13:33 |
| samueldmq | ayoung, each project would have its copy of the unified policy ? remember we need to be backwards compatible | 13:34 |
| ayoung | samueldmq, there is no need | 13:34 |
| ayoung | samueldmq, stop. | 13:35 |
| openstackgerrit | Marek Denis proposed openstack/keystone: OS-FEDERATION no longer extension in docs https://review.openstack.org/192671 | 13:35 |
| ayoung | think it through. We need role inheritance. You start with that, and come up with a different solution that does not involve sticking all the roles in the token, let me know | 13:35 |
| samueldmq | ayoung, and solve the issue with common definitions | 13:36 |
| ayoung | that too | 13:36 |
| samueldmq | ayoung, k I will mull it a bit more, and come with something later | 13:36 |
| *** lastops has joined #openstack-keystone | 13:37 | |
| samueldmq | ayoung, although we could shift this a little bit .. and work with policy definitions we have today | 13:37 |
| samueldmq | ayoung, talk to you later today | 13:37 |
| samueldmq | ayoung, you want to define role hierarchies in the policy itself ? | 13:39 |
| ayoung | samueldmq, I want to get dynamic p[olicy implemented. Defining roles in the policy is the only way I can see to make that happen, willing to hear alternatives | 13:40 |
| samueldmq | ayoung, k got it | 13:40 |
| ayoung | samueldmq, we could ship the roles in separate policy file and merge, we could do so many different things. WHich is the least surprise? Which will be the easiest to work with? Which can we get to from where we are not? | 13:41 |
| *** jamielennox|away is now known as jamielennox | 13:42 | |
| samueldmq | ayoung, what if middleware know about the role hierarchy at fetch time ? and expand them in the policy file before saving it (in /etc/nova/policy.json, for example) | 13:43 |
| samueldmq | ayoung, we would be able to use any role in the hierarchy in the policy rules directly, middleware will take care of arranging them when it fetches, before storing in the specified dir | 13:44 |
| ayoung | samueldmq all possibilities | 13:45 |
| ayoung | samueldmq, you need dolphm 's input before you can move ahead. The unified was his idea, and I don;t tthink he wrote down his rationale anywhere | 13:46 |
| samueldmq | ayoung, ok, I will talk to him when he shows up :) | 13:47 |
| samueldmq | ayoung, I am glad to see you're open | 13:47 |
| samueldmq | ayoung, and hope you see I am just trying to do the best we can (for all openstack) | 13:47 |
| samueldmq | ayoung, in the circumstances we are right now, timing, etc | 13:47 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Update docs: xmlsec1 requred for K2K https://review.openstack.org/192674 | 13:51 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Update docs: xmlsec1 required for K2K https://review.openstack.org/192674 | 13:52 |
| openstackgerrit | Marek Denis proposed openstack/keystone: OS-FEDERATION no longer extension in docs https://review.openstack.org/192671 | 13:54 |
| marekd | stevemar: you are fast | 13:54 |
| stevemar | marekd, that i am | 13:55 |
| stevemar | marekd, mind if i overwrite the patch? | 13:55 |
| marekd | stevemar: go ahead! | 13:55 |
| stevemar | ty! | 13:55 |
| marekd | tY! | 13:55 |
| rodrigods | marekd, I think some of these fixes closes this bug: https://bugs.launchpad.net/keystone/+bug/1459255 | 13:56 |
| openstack | Launchpad bug 1459255 in Keystone "Fix the docs since Federation is no longer an extension" [Medium,Triaged] | 13:56 |
| stevemar | looks like https://bugs.launchpad.net/keystone/+bug/1466092 is a dupe of 1459255 | 13:57 |
| openstack | Launchpad bug 1466092 in Keystone "Docs say OS-FEDERATION is an extension" [Low,In progress] - Assigned to Marek Denis (marek-denis) | 13:57 |
| ayoung | samueldmq, you are doing great. | 13:57 |
| marekd | stevemar: yep | 13:57 |
| ayoung | samueldmq, this is why we need the overview. Maybe it should be in an etherpad | 13:58 |
| ayoung | just afreai we will lose track of all the details, but maybe that has happened already | 13:58 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:58 | |
| stevemar | rodrigods, i marked yours as a dupe | 14:00 |
| *** nkinder has joined #openstack-keystone | 14:02 | |
| *** csoukup has joined #openstack-keystone | 14:03 | |
| stevemar | marekd, just one spot :) | 14:06 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: OS-FEDERATION no longer extension in docs https://review.openstack.org/192671 | 14:06 |
| *** fangzhou has joined #openstack-keystone | 14:08 | |
| *** jasondotstar has joined #openstack-keystone | 14:09 | |
| *** eandersson has quit IRC | 14:13 | |
| *** csoukup has quit IRC | 14:15 | |
| *** zzzeek has joined #openstack-keystone | 14:15 | |
| *** iamjarvo has joined #openstack-keystone | 14:22 | |
| *** dsirrine has joined #openstack-keystone | 14:22 | |
| *** eandersson has joined #openstack-keystone | 14:23 | |
| marekd | stevemar: bknudson: discussion on whether federation should be inlined in the pipeline by default. what are your opinions on that? https://review.openstack.org/#/c/192671/3/doc/source/federation/federation.rst | 14:26 |
| stevemar | marekd, it's already in the pipeline by default | 14:28 |
| stevemar | oh wait... | 14:28 |
| bknudson | sizelimit url_normalize request_id build_auth_context token_auth admin_token_auth json_body ec2_extension_v3 s3_extension simple_cert_extension revoke_extension federation_extension oauth1_extension endpoint_filter_extension endpoint_policy_extension service_v3 | 14:28 |
| marekd | it is.... | 14:28 |
| marekd | i was Ctrl-F'in in the browser, but it was hidden... | 14:28 |
| marekd | my bad | 14:29 |
| marekd | sorry | 14:29 |
| bknudson | there's all sorts of extensions in the pipeline | 14:29 |
| *** ninag has joined #openstack-keystone | 14:30 | |
| marekd | ok, i am fixing that | 14:30 |
| marekd | we don't have 'external' method anymore, do we? | 14:33 |
| bknudson | external is used to support REMOTE_USER | 14:34 |
| bknudson | where apache has already authenticated | 14:34 |
| bknudson | federation-lite | 14:34 |
| marekd | bknudson: a,ok, some other external like code was being droppeed not so long ago | 14:34 |
| bknudson | some of the external methods were deprecated | 14:34 |
| bknudson | but there are still a couple left | 14:35 |
| *** obedmr has joined #openstack-keystone | 14:40 | |
| *** obedmr has joined #openstack-keystone | 14:40 | |
| *** kiran-r has quit IRC | 14:41 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: OS-FEDERATION no longer extension in docs https://review.openstack.org/192671 | 14:41 |
| openstackgerrit | Henrique Truta proposed openstack/keystone-specs: New way to get a project scoped token by name after Reseller https://review.openstack.org/192495 | 14:43 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Update federation driver name in documentation https://review.openstack.org/192706 | 14:43 |
| *** belmoreira has quit IRC | 14:45 | |
| *** dsirrine_ has joined #openstack-keystone | 14:48 | |
| *** dsirrine has quit IRC | 14:48 | |
| *** henrynash has joined #openstack-keystone | 14:50 | |
| *** ChanServ sets mode: +v henrynash | 14:50 | |
| henrynash | rodrigods: so what was the results of the discussion of the type of token generated if you scope to a project that is acting as a domain? | 14:53 |
| rodrigods | henrynash, we had a tie | 14:53 |
| henrynash | rodigiods: you mean on the call yesterday? | 14:53 |
| rodrigods | the specs provides both alternatives (the another one in the Alternative section) | 14:53 |
| rodrigods | yes | 14:54 |
| henrynash | rodigods: ahh, but that just says how you specifiy the request….not whether there is a domain and project ID in the resuling token | 14:54 |
| *** dsirrine_ is now known as dsirrine | 14:55 | |
| rodrigods | henrynash, ahh... true. We won't have dual scoped tokens | 14:55 |
| rodrigods | we discussed this in the Summit | 14:56 |
| henrynash | rodigods: ah, and what was the rationale….I thought that was a major issue for Horizon etc. | 14:56 |
| rodrigods | henrynash, exactly, but we thought that would be a bad UX | 14:57 |
| *** jasondotstar has quit IRC | 14:58 | |
| henrynash | rodigods: so for now, they have to explicitly get a domain scoped token if they want to do domin operations? | 14:58 |
| rodrigods | henrynash, yes | 14:58 |
| henrynash | rodigods: ok….:-( | 14:59 |
| samueldmq | ayoung, glad to hear | 15:00 |
| samueldmq | ayoung, I am taking care of updating the wiki, but we will certainly need an etherpad soon | 15:00 |
| samueldmq | ayoung, thanks :) | 15:00 |
| * rodrigods is sad too :( | 15:00 | |
| *** browne has joined #openstack-keystone | 15:01 | |
| ayoung | rodrigods, I'd like to point out that I was called away for that vote and did not participate | 15:01 |
| ayoung | rodrigods, the only thing that can accept a domain scoped token today is Keystone | 15:02 |
| ayoung | so...why even bother | 15:02 |
| *** david8hu has quit IRC | 15:02 | |
| ayoung | keystone operations should not even require a token | 15:02 |
| bknudson | everyone thinks that domain scoped tokens are going to allow doing ops on lots of projects | 15:02 |
| bknudson | like checking the status of every project in nova | 15:02 |
| ayoung | so...let's kill them now | 15:02 |
| bknudson | I don't know where they get this idea | 15:03 |
| samueldmq | bknudson, that could be true, it depends on policy | 15:03 |
| bknudson | other than wishful thinking | 15:03 |
| *** david8hu has joined #openstack-keystone | 15:03 | |
| ayoung | and, ion fact, onl;y henrynash 's version of the policy file allows for domain scoped tokens, which most people don't even know how to run | 15:03 |
| henrynash | ayoung: :-) | 15:03 |
| ayoung | so...let's only return project scoped tokens evar! | 15:03 |
| rodrigods | ayoung, why? you'd the decisive vote | 15:03 |
| ayoung | rodrigods, I was called away, and voting had closed by the time I got back | 15:03 |
| ayoung | and nothing had been decided and we moved on | 15:04 |
| ayoung | rodrigods, I don't scale | 15:04 |
| rodrigods | ayoung, yes... we are now deciding in the spec | 15:04 |
| samueldmq | ayoung, you can, by delegation | 15:04 |
| samueldmq | :) | 15:04 |
| rodrigods | ayoung, we are between the 3 and 5 options: https://etherpad.openstack.org/p/reseller-project-token | 15:04 |
| *** openstackgerrit has quit IRC | 15:05 | |
| henrynash | rodigods: that’s a differnet questions, surely? | 15:05 |
| rodrigods | ayoung, we chose 3 as being the main option in the spec: https://review.openstack.org/#/c/192495/ | 15:05 |
| rodrigods | henrynash, just updating ayoung about the vote | 15:05 |
| *** openstackgerrit has joined #openstack-keystone | 15:05 | |
| henrynash | rodigods: the issue of what’s in the token is different from the whay you request it | 15:05 |
| *** Kr4zy has joined #openstack-keystone | 15:06 | |
| bknudson | I voted for 1 but nobody else liked it for some reason | 15:06 |
| bknudson | I'm not sure that there was enough info for me to make a choice anyways. | 15:06 |
| bknudson | since I'd only seen the options when asked to vote | 15:06 |
| Kr4zy | Authorization Failed: An unexpected error prevented the server from fulfilling your request: {'info': 'Referral:\nldap://xxxx.com/ou=UserGroups,DC=xxxx,DC=com', 'desc': 'Referral'} (Disable debug mode to suppress these details.) (HTTP 500) | 15:06 |
| Kr4zy | anyone got this error before that can assist? | 15:06 |
| ayoung | rodrigods, name: "" could be dropped. You are requesting a project scoped token | 15:07 |
| ayoung | so | 15:07 |
| bknudson | Kr4zy: I think there's an option for referral chasing... | 15:07 |
| rodrigods | bknudson, 1 was my preferred option as well - but we decided to go with 3 (since the current code is ready for it) | 15:07 |
| ayoung | "project": { | 15:07 |
| ayoung | "domain": { | 15:07 |
| ayoung | "name": "A" | 15:07 |
| ayoung | }, | 15:07 |
| ayoung | } | 15:07 |
| Kr4zy | bknudson: I have tried it both enabled and disabled, but it didn't work | 15:07 |
| bknudson | Kr4zy: http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n921 | 15:07 |
| rodrigods | ayoung, yes... we put this option in the etherpad but didn't receive votes | 15:07 |
| morganfainberg | So.. I have no idea what option 1, 2, 3 etc are. | 15:07 |
| *** fangzhou has quit IRC | 15:08 | |
| bknudson | if the referral option doesn't help then I have no idea | 15:08 |
| morganfainberg | But I'm going to say I am still a big -1 on "is_domain": True | 15:08 |
| *** HT_sergio has joined #openstack-keystone | 15:08 | |
| morganfainberg | In the request for a token if that is what is being proposed still. | 15:08 |
| rodrigods | morganfainberg, check https://etherpad.openstack.org/p/reseller-project-token whenever you have a moment :) | 15:08 |
| ayoung | rodrigods, I don't see it on there | 15:08 |
| bknudson | morganfainberg: you and I lost that vote. | 15:09 |
| rodrigods | ayoung, it's same as option 2, but just removing "name" | 15:09 |
| *** iamjarvo has quit IRC | 15:09 | |
| morganfainberg | In fact I'm close to a -2 on the is--domain | 15:09 |
| ayoung | domain has a domain name, but not explicit project name | 15:09 |
| ayoung | rodrigods, that is not "the same" though | 15:09 |
| morganfainberg | I'm close to pulling the ptl card here | 15:09 |
| henrynash | rodigods: I personally don’t like taht since it seems different to the regular way you ask for a project by name….with a name (and the domain part is just saying which domain it’s in) | 15:09 |
| ayoung | it *is* what we mean | 15:09 |
| morganfainberg | bknudson: ^ | 15:09 |
| rodrigods | henrynash, ++ | 15:09 |
| bknudson | it was a tie for a while. | 15:10 |
| henrynash | morganfainberg: and, for the record, you don’t like the is_domain part because? | 15:10 |
| *** afazekas has quit IRC | 15:10 | |
| morganfainberg | henrynash: is is a really awful ux. | 15:10 |
| bknudson | I think 5 was the runner-up | 15:10 |
| rodrigods | yes | 15:10 |
| morganfainberg | Why aren't we doing a scope that specifies domain explicitly as the type rather than guessing or needing extra params. | 15:11 |
| bknudson | my favorite was 1 with a list instead of a string but that was not liked by others. | 15:11 |
| morganfainberg | bknudson: looking at it, #1 is my choice. | 15:11 |
| rodrigods | for me #1 is better too, with delimiter | 15:11 |
| ayoung | bknudson, I suggested that one origianlly | 15:11 |
| morganfainberg | bknudson: sure a list is fine vs a string. | 15:11 |
| rodrigods | ayoung, ++ | 15:12 |
| henrynash | morganfainberg: specifiy a valid attribute of an entity you want in a request is bad ux? | 15:12 |
| ayoung | and, if you leave off the list altogether, you get the same thing : scoped to the domain | 15:12 |
| morganfainberg | henrynash: why are we conflating domain scoped requests with project scoped requests? | 15:12 |
| *** iamjarvo has joined #openstack-keystone | 15:12 | |
| morganfainberg | That is my problem. We should stop trying to make them all 100% the same. | 15:12 |
| *** iamjarvo has quit IRC | 15:12 | |
| morganfainberg | If you want a domain scoped request, ask for a domain scope, don't wedge it into how you ask for a project scope. | 15:13 |
| ayoung | treat these as the same | 15:13 |
| ayoung | "project": {"domain": {"name": "A"},"name": []} | 15:13 |
| ayoung | "proje | 15:13 |
| ayoung | "project": {"domain": {"name": "A"}} | 15:13 |
| *** iamjarvo has joined #openstack-keystone | 15:13 | |
| morganfainberg | If domain scope remains a "thing" | 15:13 |
| ayoung | morganfainberg, yep | 15:13 |
| ayoung | domain scope is kindof useless anyway. | 15:13 |
| rodrigods | morganfainberg, this is to solve the name conflict issue | 15:14 |
| ayoung | rodrigods, there is no conflict | 15:14 |
| rodrigods | if we don't allow to get project scoped token for a domain | 15:14 |
| ayoung | the domain name is not the same as the project name | 15:14 |
| ayoung | the root project of a domain has no name | 15:14 |
| morganfainberg | rodrigods: we probably need to step back if we are backed into that corner. Why do we have a name conflict. | 15:14 |
| bknudson | apropos -- https://bugs.launchpad.net/keystone/+bug/1437407 -- new bug for domain admin | 15:14 |
| openstack | Launchpad bug 1437407 in Keystone "With using V3 cloud admin policy, domain admin unable to list role assignment for projects in his domain" [Medium,In progress] - Assigned to Guang Yee (guang-yee) | 15:14 |
| e0ne | morganfainberg: hi. i posted review for cinder spec about wsgi https://review.openstack.org/#/c/192683/. i will be glad if you'll get a time to treview it | 15:15 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Add openid connect client support https://review.openstack.org/134700 | 15:15 |
| rodrigods | morganfainberg, we are migrating the domain table to the project table, it is possible to have deployments where we are going to have a name conflict in this step | 15:15 |
| e0ne | morganfainberg: also, i want to start cross-project initiative for it | 15:15 |
| morganfainberg | But the is_domain in the request to get a scoped token is the wrong approach. | 15:15 |
| morganfainberg | e0ne: cool. | 15:15 |
| rodrigods | morganfainberg, we have several options, 3 was the most voted alongside 5 in yesterday's meeting | 15:16 |
| morganfainberg | So, either we do something like (straw man): {scope: domain: <thing> } | 15:16 |
| morganfainberg | And the. We do the request with project instead. | 15:16 |
| morganfainberg | Or we use the hierarchy like option 1 | 15:16 |
| ayoung | so..that is a sure sign that people don | 15:16 |
| ayoung | 't understand | 15:16 |
| ayoung | the others all say the same thing: | 15:16 |
| ayoung | if name is missing or is falsy, give the root project for the domain | 15:17 |
| morganfainberg | The "is_domain": True is mixing how you request the scopes and really is not clear. | 15:17 |
| ayoung | None, [] , "" or just plain missing | 15:17 |
| morganfainberg | And people will do it wrong. It's wedging in a new resulting token in the wrong place. | 15:17 |
| morganfainberg | That is why I view it as bad up | 15:17 |
| morganfainberg | Ux* | 15:17 |
| ayoung | allow any of them, allow all of them, and so long as you do not explicitly request a project by name, you get the root project | 15:17 |
| rodrigods | ayoung, I don't like "hiding" the name option | 15:18 |
| rodrigods | it *will* have a name | 15:18 |
| morganfainberg | So in short I am a strong -1 on "is_domain": True, bordering on -2 | 15:18 |
| ayoung | rodrigods, you are not hiding the name option, | 15:18 |
| ayoung | you are saying that you want the root project in the domain. Say it however you want | 15:18 |
| rodrigods | passing "" won't result in a correct result | 15:18 |
| ayoung | "" None [] Bupkis | 15:19 |
| morganfainberg | e0ne: I'm excited to see that become more of a general pattern in OpenStack :) | 15:19 |
| ayoung | rodrigods, I don | 15:19 |
| ayoung | rodrigods, I don't like domains. | 15:19 |
| ayoung | We should never have had them, should have made projects hierarchical | 15:20 |
| ayoung | but, we did what we did qand now we do what we have to do to deal | 15:20 |
| rodrigods | ayoung, I mean - if we request something passing "name" with "", [] or None, it is "wrong" as an API perspective since we are going to return a name in the request response (the scope will have a name different from "", [] or None) | 15:20 |
| e0ne | morganfainberg: agree. it should be done in the same way across all projects | 15:20 |
| morganfainberg | I'm not sure what the issue with just issuing a project scoped token always is. But I'm sure there is one... | 15:20 |
| ayoung | rodrigods, so long as the name is consistently defined in the response, what does it matter? | 15:21 |
| ayoung | morganfainberg, there is none. the problem is how is Horizon going to request it | 15:21 |
| morganfainberg | e0ne: as a heads up we need to fix grenade to be smarter about upgrades. It has some issues ATM for the wsgi py files. | 15:21 |
| morganfainberg | e0ne: but it really isn't the end of the world ;) | 15:21 |
| rodrigods | ayoung, it is wrong to return something different from what was requested | 15:21 |
| ayoung | if we need to scope to the project at the root of the hierarchy for a domain, how does Horizon generate the request | 15:21 |
| ayoung | rodrigods, no it is not | 15:21 |
| e0ne | morganfainberg: could you please provide me a link with bug? | 15:22 |
| rodrigods | ayoung, of course it is | 15:22 |
| ayoung | rodrigods, it is not diffferent in meaning, just in form | 15:22 |
| morganfainberg | e0ne: i need to dig it up. It is an issue keystone is going to solve soon because we need to. | 15:22 |
| samueldmq | morganfainberg, need your view on something, will summarize in a sentence ... | 15:22 |
| e0ne | morganfainberg: as i described in spec, i'm going to leave eventlet as default (we could depreacte it) and setup CI to run with apache | 15:22 |
| morganfainberg | e0ne: we ran into it last week and I was traveling so I need to dredge through my IRC logs. | 15:23 |
| rodrigods | ayoung, if I do something in a Python API: get_entity(name="") and return is something with {name="xpto"} is wrong IMHO | 15:23 |
| *** afazekas has joined #openstack-keystone | 15:23 | |
| samueldmq | morganfainberg, what if, with hierarchical roles, one can use any role in the hierarchy in the policy, and middleware knows the hierarchy and replace roles as needed at fetching time | 15:23 |
| rodrigods | ayoung, the difference is that we are talking about a HTTP API | 15:23 |
| e0ne | morganfainberg: ok. if you or someone from keystone folks will fix it, i'm not worry on it:) | 15:23 |
| morganfainberg | e0ne: I hope eventually we can make it he default. But there is one major concern, that is event listening on Oslo. But not sure how much the cinder api has to listen. | 15:23 |
| samueldmq | morganfainberg, I will be discussing this and some unified things with dolphm once he shows up, unified vs not unified (as today) is the only point I need to agree with ayoung before talking to other projects | 15:24 |
| morganfainberg | samueldmq: hold up. Can only do two conversations at once on IRC via a cell phone :P | 15:24 |
| ayoung | samueldmq, I'll post an updated unified to the github repo in a moment | 15:24 |
| e0ne | morganfainberg: we need to move from thread-based to process-based first | 15:25 |
| samueldmq | ayoung, nice | 15:25 |
| morganfainberg | samueldmq: didn't we decide the unified was going to cause deployer issues? | 15:25 |
| morganfainberg | In the short term. | 15:25 |
| morganfainberg | e0ne: yes. | 15:25 |
| samueldmq | morganfainberg, yes, I think we had decided ... but ayoung wants to discuss it a bit more to see fi we find a solution | 15:26 |
| samueldmq | morganfainberg, I got from him what he solves with the unified, and would possibly solving with that suggestion above for hierarchcial roles ^ | 15:26 |
| samueldmq | I am trying to satisfy ayoung's requirements in a different approach | 15:27 |
| *** jasondotstar has joined #openstack-keystone | 15:27 | |
| morganfainberg | So middleware wouldn't replace the roles. Keystone would need to do it at validate. | 15:27 |
| ayoung | morganfainberg, no, people complained about policy being unified, but provided no viable alternative | 15:27 |
| ayoung | so we are continuing the conversation until we have an alternative | 15:27 |
| morganfainberg | Having the extra round trip is not worth it. | 15:27 |
| * rodrigods goes to lunch, will be back in +/- 1 hour | 15:27 | |
| *** afazekas has quit IRC | 15:28 | |
| morganfainberg | rodrigods: if you are back in -1 hour I'll be impressed :P | 15:28 |
| samueldmq | morganfainberg, middleware would do it when it fetch the policy, at the same time | 15:28 |
| morganfainberg | ;) | 15:28 |
| morganfainberg | Uhhhh | 15:28 |
| rodrigods | morganfainberg, heh :) | 15:28 |
| ayoung | morganfainberg, if I could come uip with a way to actually have the necessary conversation on this, I would./ | 15:29 |
| morganfainberg | samueldmq: why would this be a policy fetch thing and not a validate time? | 15:29 |
| ayoung | I presented at the summit on the main side, and put together a cross project talk as well | 15:29 |
| henrynash | morganfainberg: although teh current proposla is that you do just get a projrect scoped token…all we rae talkng about is how the request it | 15:29 |
| samueldmq | morganfainberg, validate policy/ token ? | 15:29 |
| ayoung | and I only found out that Nova was going off in a different direction at a party one evening | 15:29 |
| morganfainberg | henrynash: and merging how you make this request is where I have the problem. | 15:29 |
| samueldmq | morganfainberg, it would allow one to use any role in the hierarchy transparently | 15:30 |
| ayoung | the short of it is, RBAC is a cross project approach, not any one project, and we need input from the main players | 15:30 |
| morganfainberg | henrynash: we should make requesting a domain scoped token not look like a project scope request. Don't wedge it into the same thing. | 15:30 |
| ayoung | I don;'t know how to make that conversation happen short of a unified policy file starting point | 15:30 |
| samueldmq | morganfainberg, we need to translate the hierarchy somewhen, if we do that at token generation, we can have token bloat issue, and one couln't use any role in the hierarchy in the polucy | 15:30 |
| morganfainberg | ayoung: fwiw I agree with nova's general proposal. | 15:30 |
| samueldmq | morganfainberg, https://wiki.openstack.org/wiki/DynamicPolicies#Overview_Solution_-_Liberty_Scope | 15:31 |
| morganfainberg | But I'm not saying it is the right one. | 15:31 |
| ayoung | morganfainberg, I think I do to, but I think they don't even understand it | 15:31 |
| ayoung | morganfainberg, here is what I think it means | 15:31 |
| morganfainberg | I think you aren't giving them enough credit. | 15:31 |
| samueldmq | morganfainberg, this is my first try, ayoung kind of agree with that | 15:31 |
| ayoung | 1. We let the individual project defined the basis of policy. | 15:31 |
| henrynash | morganfainberg: we do! all is_domain=True is doing is provding exactness in scope…..it is not implying a domain token….that’s why it is project {} as a scope | 15:31 |
| ayoung | and that means a coupld different things | 15:31 |
| ayoung | realisitically, it means that they have to define "here is how you match scope" and "we expect this api to be used by admins vs end users" | 15:32 |
| morganfainberg | henrynash: it is mixing how you are asking for the tokens. It is not a clear "domain scope". Don't make someone guess if a project is a domain this way. Ask for a domain scope a separate way. | 15:32 |
| ayoung | morganfainberg, anyway, when you can pay attention, I am more than happy to talk throuigh it with you. | 15:33 |
| ayoung | or with anyone else | 15:33 |
| morganfainberg | ayoung: I can't hold 4 convos in IRC. On a phone. :( I'm trying. | 15:33 |
| *** csoukup has joined #openstack-keystone | 15:33 | |
| samueldmq | ayoung, I am aware of what you want :) | 15:33 |
| ayoung | morganfainberg, I understand, and I am excusing you from this one | 15:33 |
| henrynash | morganfainberg: but we aren’t asking for domain scope | 15:33 |
| samueldmq | ayoung, we basically have now to agree on whether default will be unified or not | 15:33 |
| samueldmq | ayoung, at least for you and I have a 100% agreement :) | 15:34 |
| morganfainberg | henrynash: so I've given my justification here and I am against mixing up how we are asking for this scope like that. I've been against is_domain for a while. At this point I'm going to say don't do that. | 15:34 |
| ayoung | samueldmq, if I were to start from scratch here, I would say that policy would only have RBAC checks in it. Scopeing the token to the resource would not be a policy check | 15:34 |
| ayoung | it would be in code; | 15:34 |
| ayoung | but...that implies a few things we can't do today | 15:35 |
| ayoung | 1. There are two different token formats | 15:35 |
| samueldmq | ayoung, that's story 6 | 15:35 |
| ayoung | we need to reduce that to ione | 15:35 |
| samueldmq | ayoung, we will get there, but incrementally :) | 15:35 |
| morganfainberg | The is_domain is mixing how we are asking for the scopes. It is not a clear definition it is wedging in a poor design because we feel backed into a corner on name conflicts. | 15:35 |
| ayoung | 23. We need to provide a meeting place for code from, say, Nova with the token format | 15:35 |
| ayoung | hmmmm | 15:36 |
| ayoung | what do we do with the headers for roles and proejcts right now... | 15:36 |
| henrynash | morganfainberg: Ok, this will be an agree to disagree…but that’s OK :-) | 15:37 |
| morganfainberg | henrynash: and in this case (and you known rarely do this) I'm going to play the PTL card. Let's not do it that way. | 15:37 |
| morganfainberg | S/known rarely/ know I rarely | 15:38 |
| henrynash | morganfainberg: agreed, it’s rare, and if you feel that strongly, time to play :-) | 15:38 |
| morganfainberg | henrynash: cool. | 15:38 |
| *** jamielennox is now known as jamielennox|away | 15:38 | |
| ayoung | OK, so the contract we have is the headers: 'X%s-Project-Name': 'project_name', and the roles template | 15:38 |
| ayoung | GAH! | 15:39 |
| morganfainberg | henrynash: I like the option 1, but I know there were concerns. | 15:39 |
| morganfainberg | henrynash: even with a list. But I'm not opposed to other proposals. | 15:39 |
| henrynash | morganfainbergL have to go re-read the options now!!!! | 15:39 |
| morganfainberg | henrynash: sorry! | 15:39 |
| ayoung | samueldmq, so...we probably should not even be enforcing based on the token, but based on the headers.... | 15:40 |
| ayoung | http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token/_request.py#n58 | 15:40 |
| morganfainberg | ayoung: I'll be back soonish. And will be able to do the backscroll read. | 15:40 |
| * morganfainberg looks at it being Wednesday. So much for the week off. | 15:40 | |
| *** esp has joined #openstack-keystone | 15:41 | |
| samueldmq | ayoung, but the headers must be validated against the token, since you can be lying to the service | 15:45 |
| ayoung | samueldmq, the headers are set by AUTH_TOKEN middleware | 15:45 |
| morganfainberg | samueldmq: any headers we rely on auth token strips and sets directly | 15:45 |
| *** viktors is now known as viktors|afk | 15:45 | |
| morganfainberg | We have to trust them. | 15:45 |
| samueldmq | ayoung, and at the service we trust in the headers validated by middleare | 15:45 |
| samueldmq | morganfainberg, ^ | 15:45 |
| samueldmq | don't we already do it like this ? | 15:46 |
| ayoung | samueldmq, stop asking morgan | 15:46 |
| ayoung | samueldmq, look at the code | 15:46 |
| *** ericksonsantos has joined #openstack-keystone | 15:46 | |
| ayoung | so, if there is no auth token, then, yeah, the end user could lie. | 15:46 |
| ayoung | but we don't really care | 15:46 |
| *** jamielennox|away is now known as jamielennox | 15:47 | |
| samueldmq | ayoung, isn't there a way to let people know who set the vars ? | 15:47 |
| ayoung | with auth_token, we endure the headers are valid, and that is the case we care about | 15:47 |
| samueldmq | ayoung, I mean a way to let the service trust the middleware | 15:47 |
| ayoung | samueldmq, THE USER COULD LIE ABOPUIT THAT, TOO | 15:47 |
| ayoung | gah caps lock | 15:47 |
| morganfainberg | ayoung: remember some services don't use auth_token in all cases. But I don't think that is a huge concern in this context. | 15:47 |
| *** hemnafk is now known as hemna | 15:47 | |
| ayoung | morganfainberg, In those cases, policy would be invalid, too | 15:47 |
| samueldmq | so .. why do auth_token set those env vars ? if the service is not looking at them | 15:48 |
| morganfainberg | Like I said. Probably not a huge concern. | 15:48 |
| samueldmq | :( | 15:48 |
| morganfainberg | samueldmq: it is how we pass the data down to the app under auth token. | 15:48 |
| samueldmq | morganfainberg, but is doesn't trust the token info we pass down | 15:48 |
| morganfainberg | The service does end up looking at it via huge auth context. | 15:48 |
| samueldmq | it* | 15:48 |
| morganfainberg | It has to trust the data we pass down. | 15:49 |
| morganfainberg | Auth token is a trusted data source for the apps behind it. | 15:49 |
| samueldmq | if it does, they wouldn't need the token, but only the vars passed down by middleware instead | 15:49 |
| samueldmq | I think this is what we're talking about, right ayoung | 15:49 |
| morganfainberg | The token is often used for other things too. | 15:49 |
| morganfainberg | Like nova -> glance. | 15:50 |
| morganfainberg | There are multiple things happening here n | 15:50 |
| samueldmq | morganfainberg, k it need to be passed through, but in this case, couldn't glance trust nova /? | 15:50 |
| *** stevemar has quit IRC | 15:50 | |
| morganfainberg | No. Because it needs the user's authz to access the image. | 15:50 |
| morganfainberg | I have a plan to fix it and it revolves around jamielennox 's work with the service tokens. But that is t today. | 15:51 |
| morganfainberg | Might not even be this cycle. | 15:51 |
| samueldmq | morganfainberg, sure, but nova passes the token and say, 'trust me, it's valid', and glance wouldn't need to vbalidate that again | 15:51 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: addtional Fernet test coverage https://review.openstack.org/192739 | 15:51 |
| morganfainberg | samueldmq: except they glance can't know it's valid. Since who sent it? It isn't internal communication, it is via glance's rest api | 15:52 |
| morganfainberg | So... You must re validate in this case at glance. | 15:52 |
| ayoung | samueldmq, , so, one thing I think we need to add to the policy enforcement is namespaced defaults. Instead of a global default, we need to be able to say "compuet:default" or "image:default" | 15:52 |
| *** kiran-r has joined #openstack-keystone | 15:52 | |
| bknudson | if x.509 was used you could trust it | 15:52 |
| *** stevemar has joined #openstack-keystone | 15:52 | |
| *** ChanServ sets mode: +v stevemar | 15:52 | |
| ayoung | bknudson, ++ | 15:52 |
| samueldmq | bknudson, yes | 15:52 |
| samueldmq | ayoung, if we go to the unified yes | 15:52 |
| samueldmq | ayoung, remember what I said earlier today about middleware knowing the roe hierarchy ? | 15:53 |
| morganfainberg | bknudson: sort of. Still some concerns re the model we have today. But that is off in the weeds. | 15:53 |
| ayoung | bknudson, if X509 was used we would not need tokens. We'd just map in process, and fetch roles for the user | 15:53 |
| samueldmq | morganfainberg, cc ^ | 15:53 |
| samueldmq | ayoung, morganfainberg we could have GET /policy?endoint_url=<> ... which would convert | 15:54 |
| samueldmq | 'compute:create_server': 'role:admin1' to -> 'compute:create_server': 'role:admin1 or role:admin2' | 15:54 |
| samueldmq | in the case admin2 inherits from admin 1 | 15:54 |
| samueldmq | so no need to tell middleware about role hierarchies | 15:55 |
| samueldmq | it already comes expanded from keystone, who owns them | 15:55 |
| *** pballand has joined #openstack-keystone | 15:55 | |
| samueldmq | morganfainberg, ayoung sorry I need to go afk for a bit, have an English class right now .. will be back with a better English in 2 hours :) | 15:56 |
| morganfainberg | Hah! Have fun in class ;) | 15:56 |
| *** kiran-r has quit IRC | 15:56 | |
| samueldmq | morganfainberg, ayoung and I meant : GET /policy?endoint_url=<>?effective < - ***EFFECTIVE*** | 15:56 |
| morganfainberg | Your English is probably better than mine. I speak two languages English and bad English. :P | 15:56 |
| samueldmq | morganfainberg, thanks | 15:56 |
| *** kiran-r has joined #openstack-keystone | 15:57 | |
| samueldmq | morganfainberg, haha that's a nice joke :) | 15:57 |
| morganfainberg | I don't get to take credit. It's from the 5th element. | 15:57 |
| bknudson | samueldmq: you could teach an english class. | 15:57 |
| stevemar | bknudson, ++ | 15:57 |
| *** jamielennox is now known as jamielennox|away | 15:58 | |
| samueldmq | bknudson, yes, but you misspelled that, run: s/english/portuguese | 15:58 |
| samueldmq | see you guys in a bit ;) | 15:58 |
| *** iamjarvo has quit IRC | 16:00 | |
| *** kfox1111 has joined #openstack-keystone | 16:02 | |
| *** kiran-r has quit IRC | 16:03 | |
| *** kiran-r has joined #openstack-keystone | 16:03 | |
| *** Kr4zy has quit IRC | 16:05 | |
| *** jamielennox|away is now known as jamielennox | 16:06 | |
| *** kiran-r has quit IRC | 16:10 | |
| *** dims_ has joined #openstack-keystone | 16:11 | |
| *** dims has quit IRC | 16:13 | |
| openstackgerrit | Victor Stinner proposed openstack/python-keystoneclient: Remove keystoneclient.middleware https://review.openstack.org/192752 | 16:15 |
| *** dguerri is now known as dguerri` | 16:15 | |
| *** dguerri` is now known as dguerri | 16:25 | |
| *** afazekas has joined #openstack-keystone | 16:28 | |
| *** tqtran_afk_gowar has joined #openstack-keystone | 16:30 | |
| *** tqtran_afk_gowar is now known as tqtran | 16:30 | |
| *** dguerri is now known as dguerri` | 16:32 | |
| *** openstackgerrit has quit IRC | 16:33 | |
| *** openstackgerrit has joined #openstack-keystone | 16:34 | |
| *** jamielennox is now known as jamielennox|away | 16:35 | |
| *** fangzhou has joined #openstack-keystone | 16:35 | |
| *** RichardRaseley has joined #openstack-keystone | 16:36 | |
| *** dsirrine has quit IRC | 16:36 | |
| stevemar | lhcheng has been afk lately | 16:39 |
| *** jasondotstar has quit IRC | 16:43 | |
| *** gyee_ has joined #openstack-keystone | 16:43 | |
| *** fifieldt_ has joined #openstack-keystone | 16:43 | |
| *** jasondotstar has joined #openstack-keystone | 16:44 | |
| *** fifieldt has quit IRC | 16:45 | |
| *** josecastroleon has quit IRC | 16:45 | |
| *** operator99 has quit IRC | 16:45 | |
| *** josecastroleon1 has joined #openstack-keystone | 16:45 | |
| *** jasondotstar has quit IRC | 16:45 | |
| *** roxanaghe has joined #openstack-keystone | 16:45 | |
| *** jasondotstar has joined #openstack-keystone | 16:46 | |
| *** RichardRaseley has quit IRC | 16:47 | |
| *** mfisch has quit IRC | 16:47 | |
| *** jamielennox|away is now known as jamielennox | 16:49 | |
| *** mfisch has joined #openstack-keystone | 16:49 | |
| *** mfisch has quit IRC | 16:50 | |
| *** mfisch has joined #openstack-keystone | 16:50 | |
| *** kiran-r has joined #openstack-keystone | 16:50 | |
| *** timsim has left #openstack-keystone | 16:50 | |
| *** gyee has joined #openstack-keystone | 16:52 | |
| *** ChanServ sets mode: +v gyee | 16:52 | |
| *** jasondotstar has quit IRC | 16:52 | |
| *** jasondotstar has joined #openstack-keystone | 16:54 | |
| *** belmoreira has joined #openstack-keystone | 16:57 | |
| *** kiran-r has quit IRC | 16:59 | |
| *** jasondotstar has quit IRC | 16:59 | |
| *** kiran-r has joined #openstack-keystone | 16:59 | |
| *** _cjones_ has joined #openstack-keystone | 16:59 | |
| *** e0ne has quit IRC | 17:00 | |
| *** jasondotstar has joined #openstack-keystone | 17:02 | |
| *** rushiagr is now known as rushiagr_away | 17:04 | |
| kfox1111 | morganfainberg: have a spec for the x509 federated thing handy? | 17:06 |
| morganfainberg | kfox1111: http://specs.openstack.org/openstack/keystone-specs/specs/liberty/keystone-tokenless-authz-with-x509-ssl-client-cert.html | 17:07 |
| kfox1111 | thx. :) | 17:08 |
| david8hu | ayoung, samueldmq, Sorry, I missed your earlier discussion on the topic of unified policy. I like the role check idea, but keystone should not be the gate keeper for all rules going into unified policy. For example, nova adds a new compute rule to unified policy. Nova should have its core reviewers approve the change, and not keystone core reviewers. | 17:09 |
| ayoung | david8hu, agreed, but make it a separate repo | 17:10 |
| ayoung | should not be Keysteon, should be policy reviewers | 17:10 |
| ayoung | david8hu, however, before we get there, let's just look at twhat it would look like | 17:10 |
| ayoung | we can stick in oslo to start and clone, for all I care | 17:10 |
| ayoung | its the rules themselves that matter, not the workflow at this point | 17:10 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Fix Fernet key rotation https://review.openstack.org/192782 | 17:11 |
| lbragstad | dolphm: ^ | 17:12 |
| *** jamielennox is now known as jamielennox|away | 17:13 | |
| david8hu | ayoung, I see 2 approaches, might be more. Approach 1, move policy to role check (get rid of is_admin), then unified. Approach2, Unified, then move to role check. Either way, it is going to be an up hill battle out side of keystone. But we need to start somewhere. | 17:16 |
| *** dims_ has quit IRC | 17:16 | |
| ayoung | david8hu, I think you are right, but could you clarify | 17:16 |
| ayoung | "policy to role check" means what? | 17:16 |
| *** dims has joined #openstack-keystone | 17:17 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add unit test to exercise key rotation https://review.openstack.org/192792 | 17:17 |
| dolphm | bknudson: the unit tests you just requested https://review.openstack.org/#/c/192792/ | 17:17 |
| bknudson | that was fast. | 17:17 |
| david8hu | ayoung, simply get rid context_is_admin, instead "api":"role" | 17:18 |
| lbragstad | bknudson: like Jimmy Johns.. but with code.. | 17:19 |
| david8hu | ayoung, we need to go around and educate other services on the topic of getting rid of context_is_admin. It would make our story even better, if we can get oslo.policy to deprecate is_admin arguments. | 17:20 |
| morganfainberg | lbragstad: uhh. | 17:23 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add unit test to exercise key rotation https://review.openstack.org/192792 | 17:24 |
| *** henrynash has quit IRC | 17:24 | |
| dolphm | bknudson: if you're reviewing ^ just factored out "2" as a constant and added an inline comment to explain the constant | 17:24 |
| *** belmoreira has quit IRC | 17:38 | |
| *** afazekas has quit IRC | 17:41 | |
| *** aix has quit IRC | 17:42 | |
| kfox1111 | morganfainberg: looking through that spec. it seems like there is no way to get an unscoped token with it. | 17:44 |
| kfox1111 | correct? | 17:44 |
| morganfainberg | gyee: ^ cc | 17:44 |
| morganfainberg | Going to defer you over to Guang on that one kfox1111 | 17:45 |
| morganfainberg | He's been working on the implementation. | 17:45 |
| kfox1111 | oh.... I see.. it does mention "absence of the scope headers is equivalent to an unscoped token" | 17:45 |
| kfox1111 | later on. | 17:45 |
| morganfainberg | Yeah. | 17:45 |
| kfox1111 | so this also depends on keystone in apache. ok. | 17:46 |
| morganfainberg | Some extra work will likely be needed as well for this all to work. You should take with Guang on your specific needs as well since most of that code has been written and is pending debase/review. | 17:46 |
| kfox1111 | the install howto to make instance users work is going to be long.... | 17:46 |
| morganfainberg | kfox1111: yes. But eventlet keystone is deprecated. | 17:46 |
| kfox1111 | oh really? ok. | 17:47 |
| morganfainberg | So that isn't an unreasonable ask. | 17:47 |
| kfox1111 | when was it deprecated? | 17:47 |
| morganfainberg | Yep as of kilo. Removed in m | 17:47 |
| kfox1111 | hmm... so the rdo folks have got to be planning on dealing with this soon. | 17:47 |
| morganfainberg | Eventlet keystone is a thing of the past :) | 17:47 |
| *** HT_sergio has quit IRC | 17:47 | |
| kfox1111 | rdo kilo's still eventlet out of the box. | 17:48 |
| morganfainberg | That is unfortunate. | 17:48 |
| gyee | kfox1111, you want to get a token with an x.509client cert? | 17:48 |
| *** kiall has joined #openstack-keystone | 17:48 | |
| *** eandersson has quit IRC | 17:48 | |
| *** rlt has quit IRC | 17:48 | |
| morganfainberg | gyee: ephemeral user (federated) from a cert | 17:48 |
| kfox1111 | gyee: if you haven't seen this spec yet, could you please have a look: https://review.openstack.org/#/c/186617 | 17:49 |
| morganfainberg | I think it is a minor scope increase from that spec. But should be pretty easy to accommodate. | 17:49 |
| gyee | oh ok | 17:49 |
| kfox1111 | its going to depend on the x.509client cert stuff. | 17:49 |
| kiall | Hey - Is it expected for keystonemiddleware to pull the latest+greatest keystoneclient and pycadf? It seems to be causing us issues on stable/kilo, where.. for e.g. error: oslo.config 1.9.3 is installed but oslo.config>=1.11.0 is required by set(['pycadf']) | 17:49 |
| gyee | let me take a look | 17:49 |
| kfox1111 | thx. :) | 17:49 |
| morganfainberg | kfox1111: all the federation work and lots of other things relies on Apache. It is silly to try and support eventlet as a second class citeZen. | 17:50 |
| morganfainberg | kiall: you should be using the stable/kilo middleware for kilo. | 17:50 |
| morganfainberg | kiall: there is a branch specifically for it (I need to look atwha that tag # is. But I need food first) | 17:51 |
| kfox1111 | morganfainberg: I agree. I've needed to rely on apache modules before to handle kerberos and other things. Never want to ever try and implement those directly. they are scary. :) | 17:51 |
| kiall | morganfainberg: So, this is pulling from pip using the stable/kilo global-req's pin of keystonemiddleware>=1.5.0,<1.6.0 | 17:51 |
| *** pnavarro has quit IRC | 17:51 | |
| *** kiranr has joined #openstack-keystone | 17:51 | |
| morganfainberg | kiall: possibly a global requirement issue then. | 17:51 |
| *** e0ne has joined #openstack-keystone | 17:51 | |
| morganfainberg | Middleware relies on the g-r data. | 17:51 |
| bknudson | kiall: here's the requirements.txt for keystonemiddleware in stable/kilo: http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/requirements.txt?h=stable%2Fkilo | 17:51 |
| kiall | But, it seems the released keytonemiddleware package is pulling in a post-kilo KS client and pycadf - it seems theres no cap there | 17:51 |
| morganfainberg | I think someone blocked capping in kilo a while back. | 17:52 |
| bknudson | anf ro 1.6.1 -- http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/requirements.txt?h=stable/kilo&id=1.6.1 | 17:52 |
| bknudson | *and for* | 17:52 |
| kiall | Yea, KS middlewar's KS client and pycady requirements are open, while the global-requirements repo has a cap that works :) | 17:52 |
| morganfainberg | Yep we have a -2'd patch from I think dhellman for the pin/cap in kilo | 17:53 |
| bknudson | https://review.openstack.org/#/c/173972/ | 17:53 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Fix Fernet key rotation https://review.openstack.org/192782 | 17:54 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add unit test to exercise key rotation https://review.openstack.org/192792 | 17:54 |
| kiall | Ah, Okay.. I think that needs to land.. as is it, anyone up to date with Kilo global requirements, who don't have explict dependancies on KS client and pycadf will likely be failing to `pip install -r requirements.txt` - | 17:54 |
| *** kiran-r has quit IRC | 17:55 | |
| kiall | I wonder if Doug forgot to remove the -2 on that | 17:55 |
| *** ninag has quit IRC | 17:55 | |
| *** kiranr has quit IRC | 17:58 | |
| *** browne has quit IRC | 18:01 | |
| dstanek | lbragstad: at a quick glance the logic here looks incorrect https://review.openstack.org/#/c/192782/2/keystone/token/providers/fernet/utils.py | 18:03 |
| *** browne has joined #openstack-keystone | 18:03 | |
| lbragstad | dstanek: do you think it needs a better comment? | 18:04 |
| lbragstad | or it *is* in correct? | 18:04 |
| dstanek | lbragstad: hmm....no i think it is correct, but would 'active_keys = len(key_files) - 1; number_of_keys_to_purge = max(0, active - CONF.fernet_tokens.max_active_keys)' make it more obvious? | 18:07 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add unit test to exercise key rotation https://review.openstack.org/192792 | 18:07 |
| dstanek | i found the +1 misleading, but after thinking about it it's because there is one extra file (the next key) that you are not counting, right? | 18:07 |
| lbragstad | dstanek: I think I like the logic ^ with the active keys set better? | 18:09 |
| dolphm | dstanek: then you'd be slicing from [1:first_good_key] , right? | 18:09 |
| lbragstad | but active keys should include the staged key becuase that key is also, technically active | 18:09 |
| lbragstad | s/,// | 18:09 |
| dolphm | lbragstad: but we're slicing into the list of excess keys | 18:09 |
| lbragstad | right | 18:10 |
| dolphm | which is a subset of like, [0,4,5,6] where max_active_keys=3, you should be selecting [0,4,5,6][1:1] | 18:10 |
| dolphm | excess_keys == [4] | 18:10 |
| dstanek | dolphm: i think think my logic is any different; i moved the +1 to the other side as a -1 and gave it a name | 18:10 |
| *** spandhe has joined #openstack-keystone | 18:11 | |
| dstanek | 1:1 shouldn't give you anything | 18:11 |
| dolphm | dstanek: but actually there is no zero in the list of keys, because i created one a few lines before but never added it to that list | 18:12 |
| htruta | so, morganfainberg... catching up your conversation with rodrigods, ayoung and henry-nash | 18:12 |
| htruta | does your PTL card have the number 1 option in our reseller vote? | 18:13 |
| dolphm | dstanek: so [4,5,6][:3 - 3 + 1], where the first 3 is the current length of keys, excluding the newly created staged key, and the second 3 is max_active_keys, would select [4] for purging | 18:14 |
| stevemar | where did the bin directory go for keystone? | 18:14 |
| lbragstad | stevemar: keystone/cmd/ | 18:14 |
| dstanek | stevemar: gone! using entry points now | 18:14 |
| dstanek | .cmd | 18:15 |
| lbragstad | stevemar: logic is in keystone/cli.py | 18:15 |
| stevemar | ohhh | 18:15 |
| stevemar | okayyy | 18:15 |
| dolphm | dstanek: so keys on disk would end up as 0 5 6 (max_active_keys=3) | 18:15 |
| dolphm | stevemar: and entry points are listed in setup.cfg | 18:15 |
| kiall | morganfainberg / bknudson: Doug removed the -2 from the kilo requirements update :) https://review.openstack.org/#/c/173972/ | 18:15 |
| stevemar | steve:keystone$ keystone-manage | 18:16 |
| stevemar | Traceback (most recent call last): | 18:16 |
| stevemar | File "/usr/local/bin/keystone-manage", line 6, in <module> | 18:16 |
| stevemar | from keystone.cmd.manage import main | 18:16 |
| stevemar | dolphm, expected? | 18:16 |
| dstanek | dolphm: it's not slicing to remove :-) | 18:16 |
| dstanek | dolphm: gimme a sec so i can actually read through the code | 18:16 |
| dolphm | dstanek: it's slicing to select what to purge | 18:16 |
| kiall | morganfainberg / bknudson: Discussion with Doug in #openstack-infra too, he's still got a concern it seems :) | 18:17 |
| dstanek | dolphm: hmmm..is key_files a dict? | 18:17 |
| dstanek | yeah, i guess so | 18:17 |
| lbragstad | dstanek: yep | 18:17 |
| lbragstad | dstanek: {3: '/etc/keystone/fernet-keys/3', 4: '/etc/keystone/fernet-keys/4', 5: '/etc/keystone/fernet-keys/5', 6: '/etc/keystone/fernet-keys/6'} | 18:18 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Test to ensure fernet key rotation results in new key sets https://review.openstack.org/192817 | 18:19 |
| openstackgerrit | Henrique Truta proposed openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 18:20 |
| *** kr4zy has joined #openstack-keystone | 18:20 | |
| dstanek | dolphm: lbragstad: won't there always be a 0 key? | 18:20 |
| lbragstad | dstanek: the newly created 0 key isn't added to the key_files dict per dolphm's comment above | 18:22 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Fix Fernet key rotation https://review.openstack.org/192782 | 18:22 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add unit test to exercise key rotation https://review.openstack.org/192792 | 18:22 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Test to ensure fernet key rotation results in new key sets https://review.openstack.org/192817 | 18:23 |
| *** HT_sergio has joined #openstack-keystone | 18:23 | |
| *** markvoelker has quit IRC | 18:25 | |
| *** markvoelker has joined #openstack-keystone | 18:25 | |
| dstanek | lbragstad: i get the logic. it just feels like the +1 is a magic number and i was trying to give it a name | 18:29 |
| *** diazjf has joined #openstack-keystone | 18:30 | |
| lbragstad | dstanek: what did you want that name to be? | 18:34 |
| dstanek | lbragstad: not sure | 18:35 |
| dstanek | lbragstad: since i can't think of anything better it's probably fine as-is | 18:36 |
| lbragstad | dstanek: if you come up with something better, by all means, ping me and I'll push another patch | 18:37 |
| samueldmq | dolphm, do you have any blog post (or other resource) on the idea of unified policy ? | 18:38 |
| stevemar | diazjf, fernando!! | 18:39 |
| *** afazekas has joined #openstack-keystone | 18:41 | |
| *** lhcheng has joined #openstack-keystone | 18:43 | |
| *** ChanServ sets mode: +v lhcheng | 18:43 | |
| samueldmq | stevemar, fernando ? what does it mean in English ? | 18:44 |
| stevemar | samueldmq, that is mr diazjf name | 18:45 |
| samueldmq | stevemar, is he Brazilian ? looks like a Brazilian name :) | 18:45 |
| *** markvoelker_ has joined #openstack-keystone | 18:47 | |
| *** markvoelker has quit IRC | 18:47 | |
| samueldmq | ayoung, ping - did you see the idea on GET / policies ? endpoint_url=<> & effective | 18:48 |
| samueldmq | ayoung, ? | 18:48 |
| ayoung | samueldmq, we are not rewriting policy on the way out, if that is what you are suggesting | 18:48 |
| samueldmq | ayoung, I explained earlier, and that solves role inheritance at keystone server, without even touching the token | 18:48 |
| ayoung | samueldmq, we'ere headed that way, but in the database driven approach | 18:49 |
| ayoung | not in keystone itself | 18:49 |
| samueldmq | ayoung, only middleware would ask that with ?effective | 18:49 |
| ayoung | samueldmq, I need to finish something first | 18:49 |
| samueldmq | ayoung, k | 18:49 |
| stevemar | samueldmq, nope :( | 18:50 |
| stevemar | samueldmq, diazjf is not brazilian, he's from austin TX | 18:50 |
| *** mtecer has joined #openstack-keystone | 18:50 | |
| samueldmq | stevemar, k :) | 18:50 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add unit test to exercise key rotation https://review.openstack.org/192792 | 18:50 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Test to ensure fernet key rotation results in new key sets https://review.openstack.org/192817 | 18:50 |
| kr4zy | Anyone seeing this error with Keystone before https://gist.github.com/anonymous/239f3a51e695e3398fdd | 18:51 |
| diazjf | hello everyone, not Brazilian. I'm a Miami Cuban lol | 18:55 |
| ayoung | kr4zy, not enough information to debug | 18:55 |
| samueldmq | diazjf, hi, haha :) | 18:59 |
| *** mtecer has quit IRC | 19:02 | |
| *** jaosorior has quit IRC | 19:05 | |
| *** fifieldt_ has quit IRC | 19:12 | |
| samueldmq | ayoung, Call for Speakers is now open .. let's add something once we agree on the scope for L :) | 19:13 |
| ayoung | samueldmq, heh...sure | 19:13 |
| ayoung | come up with a title. | 19:14 |
| samueldmq | ayoung, let's come up with an agreement on that thing, I am not sleeping at night :( | 19:15 |
| samueldmq | ayoung, kidding .. yes I will find a title! :) | 19:15 |
| *** openstackgerrit has quit IRC | 19:16 | |
| *** openstackgerrit has joined #openstack-keystone | 19:17 | |
| *** afazekas has quit IRC | 19:21 | |
| *** gyee has quit IRC | 19:25 | |
| openstackgerrit | Fernando Diaz proposed openstack/keystone: Adding Documentation for Mapping Combinations https://review.openstack.org/192850 | 19:25 |
| stevemar | diazjf, ^^^ | 19:26 |
| morganfainberg | samueldmq: there are 2 hard things in computer science, cache coherency and naming things. | 19:26 |
| *** mtecer has joined #openstack-keystone | 19:27 | |
| kr4zy | ayoung: hope this is enough info: https://gist.github.com/anonymous/0da837d01e4a28fb8c26 | 19:28 |
| samueldmq | morganfainberg, ++ haha | 19:28 |
| stevemar | dstanek, just teaching diazjf the workflow! | 19:28 |
| stevemar | you gave him like 10 seconds :P | 19:29 |
| samueldmq | morganfainberg, should 'get agreement in a cross-project view in openstack' (dynamic policies) be classified as fun ? :) | 19:29 |
| dstanek | stevemar: haha, i get a popup notification for every review | 19:29 |
| *** fifieldt_ has joined #openstack-keystone | 19:29 | |
| stevemar | dstanek, me too :) | 19:29 |
| ayoung | chase_referrals = False | 19:29 |
| ayoung | kr4zy, chase_referrals = False is that intentional? | 19:29 |
| ayoung | cuz the error message is | 19:30 |
| ayoung | REFERRAL: {'info': 'Referral:\nldap://xxxxx.com/ou=UserGroups,DC=xxxxx,DC=com', 'desc': 'Referral'} | 19:30 |
| ayoung | 2015-06-17 14:14:18.798 10945 TRACE keystone.common.wsgi | 19:30 |
| *** obedmr has quit IRC | 19:30 | |
| samueldmq | stevemar, ah great, so diazjf will be working with us from now ? :) | 19:30 |
| stevemar | samueldmq, FOREVER | 19:30 |
| samueldmq | stevemar, ++ great | 19:31 |
| stevemar | samueldmq, i mean... uh... we don't employ people for life | 19:31 |
| samueldmq | diazjf, welcome, feel free to ask any question :) | 19:31 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Test to ensure fernet key rotation results in new key sets https://review.openstack.org/192817 | 19:31 |
| samueldmq | diazjf, I will (and anyone here) be happy to help you ... | 19:31 |
| samueldmq | diazjf, well, at least this has been working for me since I started working here :) | 19:32 |
| dolphm | dstanek: left a stray line of cruft in that last fernet test review: https://review.openstack.org/#/c/192817/3..4/keystone/tests/unit/token/test_fernet_provider.py,unified | 19:32 |
| samueldmq | stevemar, got that , you're excited on having one more from ibm with us :) that's great to have new people coming here | 19:32 |
| ayoung | kr4zy, ah, that seems like it is in there explicitly for AD | 19:33 |
| ayoung | commit 9c15b73f8361ce8606a531b5765c94b3927d99c4 | 19:33 |
| diazjf | thanks guys | 19:34 |
| kr4zy | ayoung: yeah.. I have also tried true. Didn't help. | 19:34 |
| ayoung | kr4zy, sometjhing is throwing an excpetion talking to AD. Don't see in there the root cause of that | 19:35 |
| kr4zy | ayoung: here is the updated link: https://gist.github.com/anonymous/d978cd3a764dedfc2465. had to removed some sensitive info | 19:35 |
| ayoung | kr4zy, File "/usr/lib/python2.7/site-packages/keystone/common/ldap/core.py", line 547, in search_s is the last place it is in Keystone code | 19:36 |
| ayoung | that does not quite line up with upstream master http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/ldap/core.py#n547 | 19:38 |
| ayoung | kr4zy, what version are you running? | 19:38 |
| *** thedodd has joined #openstack-keystone | 19:40 | |
| kr4zy | ayoung: I am using openstack juno version 2014.2.2-1.el7 | 19:41 |
| ayoung | kr4zy, OK let me pull up that code | 19:41 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/ldap/core.py?h=stable/juno#n547 still doesn't seem to match your stack trace | 19:43 |
| ayoung | 547 is in search_ext, and yours shows search_s | 19:44 |
| ayoung | hmm, I thought we had logging in there, too | 19:45 |
| ayoung | kr4zy, that code sucks | 19:47 |
| ayoung | just thought I'd mention | 19:47 |
| ayoung | kr4zy, OK, so the failure is happening on an authenticate call, which is done via a simple bind | 19:51 |
| ayoung | the user passes in userid and password, and the LDAP code attempts to bind to the AD server | 19:51 |
| *** diazjf has quit IRC | 19:51 | |
| ayoung | I don't know the error being triggered there, but I would try, at a minimum, to make the same call from a command line client, to see what it is complaining a bout | 19:52 |
| ayoung | you should be able to pull together the actual LDAPQuery command values from elsewhere in that log | 19:52 |
| ayoung | I lied | 19:53 |
| ayoung | _get_project_roles_and_ref | 19:53 |
| ayoung | 2015-06-17 14:14:18.798 10945 TRACE keystone.common.wsgi user_id, tenant_id) | 19:53 |
| ayoung | that happens after wards | 19:53 |
| ayoung | _get_group_ids_for_user_id | 19:53 |
| ayoung | 2015-06-17 14:14:18.798 10945 TRACE keystone.common.wsgi x in self.identity_api.list_groups_for_user(user_id)] | 19:53 |
| ayoung | its trying to list the groups for the user | 19:53 |
| ayoung | LDAP search: base=ou=UserGroups,DC=xxxxx,DC=com scope=2 filterstr=(&(&(objectClass=groupOfNames)(member=CN=Unknown Name,OU=Users,OU=XXX,OU=Sites,DC=adstg,DC=xxxxx,DC=com))(objectClass=groupOfNames)) attrs=['ou', 'cn', 'description'] attrsonly=0 search_s /usr/lib/python2.7/site-packages/keystone/common/ldap/core.py:937 | 19:54 |
| ayoung | (member=CN=Unknown looks suspect, but maybe it makes sense to you | 19:54 |
| ayoung | kr4zy, you want to run something in the form of ldapsearch -x -H 'ldaps://$ADSERVER' -D "cn=$ADMINUSER" -w $PASSWORD -b "$BASE_DN" | 19:56 |
| kr4zy | ayoung: does the extra sapce for the cn cause an error | 19:56 |
| ayoung | kr4zy, I'll let you figure that out. I can't debug LDAP visually | 19:57 |
| *** Rockyg has joined #openstack-keystone | 19:57 | |
| *** Rockyg has quit IRC | 19:57 | |
| ayoung | kr4zy, I do know that I would not be putting spaces in mine. | 19:58 |
| kr4zy | ayoung: haha..thanks | 19:58 |
| *** Ctina_ has quit IRC | 19:59 | |
| *** Rockyg has joined #openstack-keystone | 19:59 | |
| *** stevemar has quit IRC | 20:00 | |
| *** jasondotstar has quit IRC | 20:05 | |
| *** diazjf has joined #openstack-keystone | 20:06 | |
| *** lastops has quit IRC | 20:09 | |
| *** obedmr has joined #openstack-keystone | 20:09 | |
| *** toddnni has quit IRC | 20:11 | |
| *** toddnni has joined #openstack-keystone | 20:13 | |
| *** RichardR_ has joined #openstack-keystone | 20:19 | |
| *** toddnni_ has joined #openstack-keystone | 20:23 | |
| *** RichardR_ is now known as RichardRaseley | 20:23 | |
| *** HT_sergio has quit IRC | 20:24 | |
| *** toddnni has quit IRC | 20:26 | |
| *** toddnni_ is now known as toddnni | 20:26 | |
| *** ErickCharles has joined #openstack-keystone | 20:30 | |
| *** e0ne has quit IRC | 20:32 | |
| *** e0ne has joined #openstack-keystone | 20:33 | |
| *** mtecer has quit IRC | 20:33 | |
| *** comstud has joined #openstack-keystone | 20:37 | |
| *** e0ne has quit IRC | 20:41 | |
| *** gyee has joined #openstack-keystone | 20:46 | |
| *** ChanServ sets mode: +v gyee | 20:46 | |
| *** cinerama has joined #openstack-keystone | 20:51 | |
| *** josecastroleon1 has quit IRC | 20:53 | |
| *** josecastroleon has joined #openstack-keystone | 20:54 | |
| *** dguerri` is now known as dguerri | 20:55 | |
| *** spandhe has quit IRC | 21:00 | |
| *** gyee has quit IRC | 21:03 | |
| *** pnavarro has joined #openstack-keystone | 21:03 | |
| ErickCharles | Hello everybody. I'm new to Keystone, so I apologize if this is a dumb question. I want to use Keystone as a more generalized service endpoint catalog for doing managed services. For this, I'd like to be able to create custom types (this is the "interface" field in the database). Is this advisable or worth pursuing? Right now with the Keystone client, it looks like all I can do is specify an admin endpoint, an internal, and admin | 21:04 |
| ErickCharles | URL for a very specific service. I'd like to map customers to services, and then have keystone keep track of their different endpoints that I need to create for them (like a vpn endpoint, a puppet master endpoint, etc...). | 21:04 |
| *** diazjf has quit IRC | 21:05 | |
| ErickCharles | I get that it's not quite the model or intended use, but I might just also not be understanding how to do this with the software. So, if it can't be done or shouldn't be done, I'm okay with that. | 21:05 |
| morganfainberg | ErickCharles: so endpoints typically are subordinate to the Service construct | 21:06 |
| *** edmondsw has quit IRC | 21:06 | |
| morganfainberg | ErickCharles: if you look we define a Service (aka in OpenStack land, "Compute"), then we define an endpoint for that service | 21:07 |
| morganfainberg | the URL in the endpoint is specific to that endpoint | 21:07 |
| morganfainberg | whereas the type is part of the service object | 21:07 |
| morganfainberg | this is of course assuming the V3 API | 21:07 |
| *** fangzhou has quit IRC | 21:07 | |
| morganfainberg | ErickCharles: and a service "type" is just a string | 21:09 |
| morganfainberg | but (for example) the AdminURL or InternalURL etc are assumed to be part of the structure of an endpoint that is associated to the service object (think of a one service with many endpoints relationship)_ | 21:09 |
| morganfainberg | and you can have as many services, each with as many endpoints as you'd like | 21:10 |
| cinerama | hi folks | 21:10 |
| cinerama | i was wondering if we could get a keystonemiddleware release that includes the recent requirements bump | 21:11 |
| dstanek | morganfainberg: i think what's missing is a way to do catalogs based on the user and | 21:11 |
| morganfainberg | cinerama, I cannot release keystonemiddleware anymore. | 21:11 |
| morganfainberg | cinerama: we need to get dhellmann to do it. | 21:11 |
| cinerama | morganfainberg: well, i figured this would be the best place to ask :) | 21:12 |
| morganfainberg | cinerama: #openstack-relmgr-office | 21:12 |
| morganfainberg | lets go there really quickly | 21:12 |
| *** csoukup has quit IRC | 21:13 | |
| ErickCharles | dstanek: I think that's what I'm actually trying to ask for now that you phrase it that way. I need to map an endpoint catalog to a user or tenant, but it's not necessarily one service. I can create a lot of services and do it, but then I'm duplicating a lot of work so that each customer has their own service for the same things as other tenants or users. | 21:15 |
| dstanek | ErickCharles: right now users and services are orthogonal concepts | 21:16 |
| ErickCharles | Okay, cool | 21:16 |
| morganfainberg | dstanek: but you could scope a user to a project... and filter the endpoints per project | 21:17 |
| morganfainberg | keystonemiddleware 2.0 just went out | 21:20 |
| morganfainberg | FYI. | 21:20 |
| dstanek | morganfainberg: that's an interesting thought | 21:20 |
| bknudson | congrats on 2.0! | 21:20 |
| *** diazjf has joined #openstack-keystone | 21:21 | |
| *** ChanServ changes topic to "Review Specs and Code | Milestone 1 for Liberty is ~June 23 | MidCycle July 15, 16, 17 in Boston" | 21:21 | |
| dstanek | when do we get a ksc 2.0? | 21:21 |
| morganfainberg | dstanek: when we move to Keystonauth | 21:21 |
| morganfainberg | dstanek: jamie is working on this. | 21:21 |
| morganfainberg | dstanek: we are also looking at dropping CLI in 2.0 | 21:22 |
| bknudson | I'd like to get https://review.openstack.org/#/c/191511/ in place before a 2.0 | 21:22 |
| dstanek | k, i ask because there is a review to remove the middleware | 21:22 |
| bknudson | if I can get time to work on it | 21:22 |
| morganfainberg | dstanek: yes middleare as well | 21:22 |
| morganfainberg | we could branch for 2.0 work now | 21:22 |
| morganfainberg | or use jamie's feature branch | 21:22 |
| morganfainberg | that he's using for KSA integration | 21:22 |
| ErickCharles | Thank you both :) | 21:22 |
| *** pnavarro has quit IRC | 21:22 | |
| dstanek | samueldmq: does https://review.openstack.org/#/c/186765 rely on ayoung's work? | 21:23 |
| *** openstackgerrit has quit IRC | 21:24 | |
| morganfainberg | bknudson: likely we will also have a KSM 3.0 this cycle for when we move to keystoneauth | 21:24 |
| *** openstackgerrit has joined #openstack-keystone | 21:24 | |
| *** spandhe has joined #openstack-keystone | 21:25 | |
| morganfainberg | jamielennox|away: re https://review.openstack.org/#/c/192539 what parts are hard to use from KSC? | 21:33 |
| morganfainberg | jamielennox|away: also how are we going to break the dependency on oslo_config? | 21:34 |
| *** fangzhou has joined #openstack-keystone | 21:36 | |
| *** bknudson has quit IRC | 21:37 | |
| *** Rockyg has quit IRC | 21:38 | |
| *** toddnni has quit IRC | 21:38 | |
| *** roxanaghe has quit IRC | 21:41 | |
| *** HT_sergio has joined #openstack-keystone | 21:41 | |
| *** toddnni has joined #openstack-keystone | 21:41 | |
| *** HT_sergio has quit IRC | 21:56 | |
| ayoung | dstanek, I think we are going to do something slightly different | 21:59 |
| dstanek | ayoung: related to that spec? | 21:59 |
| ayoung | https://review.openstack.org/#/c/192422/ | 21:59 |
| ayoung | so get and fetch a single policy by URL | 21:59 |
| ayoung | GET /OS-ENDPOINT-POLICY/endpoint?endpoint_url=<encodedURL> won't be a list | 22:00 |
| ayoung | it will be the blob required instead | 22:00 |
| openstackgerrit | Merged openstack/keystoneauth: Remove unused fixtures https://review.openstack.org/191635 | 22:00 |
| openstackgerrit | Merged openstack/keystoneauth: Drop use of 'oslo' namespace package https://review.openstack.org/191636 | 22:01 |
| openstackgerrit | Merged openstack/keystoneauth: Typo in openstack client help https://review.openstack.org/191637 | 22:01 |
| openstackgerrit | Merged openstack/keystoneauth: Use random strings for test fixtures https://review.openstack.org/191645 | 22:01 |
| *** thedodd has quit IRC | 22:01 | |
| openstackgerrit | Merged openstack/keystoneauth: Stop using function deprecated in Python 3 https://review.openstack.org/191644 | 22:02 |
| openstackgerrit | Merged openstack/keystoneauth: Cleanup fixture imports https://review.openstack.org/191643 | 22:02 |
| openstackgerrit | Merged openstack/keystoneauth: Ensure that failing responses are logged https://review.openstack.org/191638 | 22:02 |
| openstackgerrit | Merged openstack/keystoneauth: Removes temporary fix for doc generation https://review.openstack.org/191633 | 22:02 |
| *** kr4zy has quit IRC | 22:07 | |
| openstackgerrit | Merged openstack/keystoneauth: Remove functional tests from tox https://review.openstack.org/191634 | 22:08 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:08 | |
| *** diazjf has quit IRC | 22:08 | |
| *** spandhe has quit IRC | 22:11 | |
| *** spandhe has joined #openstack-keystone | 22:14 | |
| openstackgerrit | Merged openstack/keystoneauth: Remove _get_service_endpoints function https://review.openstack.org/191659 | 22:23 |
| openstackgerrit | Merged openstack/keystoneauth: Make _is_endpoint_type_match function public https://review.openstack.org/191670 | 22:23 |
| openstackgerrit | Merged openstack/keystoneauth: Make normalize_endpoint_type public https://review.openstack.org/191672 | 22:24 |
| *** dims has quit IRC | 22:26 | |
| openstackgerrit | Merged openstack/keystoneauth: Provide a means to get all installed plugins https://review.openstack.org/191642 | 22:30 |
| *** HT_sergio has joined #openstack-keystone | 22:34 | |
| *** dguerri is now known as dguerri` | 22:34 | |
| *** obedmr has quit IRC | 22:40 | |
| *** zzzeek has quit IRC | 22:44 | |
| *** jasondotstar has joined #openstack-keystone | 22:45 | |
| *** josecastroleon has quit IRC | 22:47 | |
| *** josecastroleon has joined #openstack-keystone | 22:48 | |
| *** Ephur has quit IRC | 22:53 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 22:55 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:56 | |
| *** lhcheng has quit IRC | 22:59 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Common base class for unit tests https://review.openstack.org/187770 | 23:00 |
| openstackgerrit | Merged openstack/keystonemiddleware: Unit tests catch deprecated function usage https://review.openstack.org/187775 | 23:01 |
| openstackgerrit | Merged openstack/keystonemiddleware: Move bandit requirement to test-requirements.txt https://review.openstack.org/188227 | 23:01 |
| *** gyee has joined #openstack-keystone | 23:01 | |
| *** ChanServ sets mode: +v gyee | 23:01 | |
| *** lhcheng has joined #openstack-keystone | 23:01 | |
| *** ChanServ sets mode: +v lhcheng | 23:01 | |
| *** lhcheng has quit IRC | 23:02 | |
| *** lhcheng has joined #openstack-keystone | 23:02 | |
| *** ChanServ sets mode: +v lhcheng | 23:02 | |
| *** ErickCharles has quit IRC | 23:12 | |
| *** ErickCharles has joined #openstack-keystone | 23:13 | |
| kfox1111 | ok... so... if the unscoped catalog is a no go.... | 23:18 |
| kfox1111 | how do I give a vm an unscoped token, and enough information so it can contact keystone, get a scoped one (maybe nova gives it a dummy project), and then use that to contact barbican? | 23:19 |
| kfox1111 | or do I start adding scopeing stuff to the nova metadata api so that nova can contact keystone and get the right token with only one call to keystone? | 23:19 |
| kfox1111 | will using a project scoped token to fetch a new one through a trust ever be disallowed? | 23:21 |
| *** HT_sergio has quit IRC | 23:24 | |
| *** dims has joined #openstack-keystone | 23:24 | |
| *** ErickCharles has quit IRC | 23:24 | |
| *** zzzeek has joined #openstack-keystone | 23:25 | |
| kfox1111 | if it will always be allowed, we could just have nova hand back nova project scoped tokens and then the vm can get trusts back for talking to things that don't support acl's. | 23:26 |
| *** dims has quit IRC | 23:28 | |
| *** dims has joined #openstack-keystone | 23:28 | |
| *** dims has quit IRC | 23:33 | |
| notmyname | is cyril roelandt around in here? I don't know his IRC nick (if any) | 23:35 |
| *** chlong has joined #openstack-keystone | 23:38 | |
| dstanek | notmyname: there doesn't seem to be an irc nick list on cyril's launchpad profile. maybe not an irc user? | 23:46 |
| *** roxanaghe has joined #openstack-keystone | 23:49 | |
| *** vilobhmm has joined #openstack-keystone | 23:51 | |
| *** RichardRaseley has quit IRC | 23:52 | |
| notmyname | dstanek: ok. he's got an enovance email, so I assume he's asleep | 23:56 |
| notmyname | I'm looking for progress on https://review.openstack.org/#/c/179777/ | 23:56 |
| notmyname | first step will be to resolve the merge conflict | 23:56 |
| notmyname | (I've got a customer who is hit by that bug) | 23:56 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!