| *** lhcheng_ has quit IRC | 00:00 | |
| morganfainberg | dstanek: ugh | 00:00 |
|---|---|---|
| dstanek | morganfainberg: keystone.tests.unit.core does a rules.init() | 00:00 |
| dstanek | trying a quick patch... | 00:00 |
| morganfainberg | dstanek: ok | 00:00 |
| *** pgbridge has quit IRC | 00:01 | |
| *** Rockyg has quit IRC | 00:05 | |
| *** tqtran-afk is now known as tqtran_ | 00:07 | |
| *** tjones1 has joined #openstack-keystone | 00:08 | |
| dstanek | morganfainberg: welcome to the pile of crap | 00:11 |
| *** dims has joined #openstack-keystone | 00:12 | |
| dstanek | keystone.tests.unit.core calles rules.init() on import - this is needed because it creates an oslo_policy Enforce object | 00:12 |
| dstanek | we need this because it will register the options for the global config object | 00:12 |
| morganfainberg | dstanek: oi | 00:13 |
| dstanek | the Enforcer object unfortunately uses the global conf in it's init | 00:13 |
| dstanek | so i can reach in and register the options in the test class and the call rule.init() in a lazy way - but i think there is a fundamental design issue here | 00:14 |
| morganfainberg | if we break the enforcer model out | 00:14 |
| morganfainberg | and stop doing the rules "backend' thing | 00:14 |
| *** chrisshattuck has quit IRC | 00:14 | |
| morganfainberg | we can hopefully solve this? | 00:14 |
| dstanek | i think it's a small change to oslo_policy to make this quite a bit nicer | 00:14 |
| *** rm_work is now known as rm_work|away | 00:15 | |
| morganfainberg | this is back to the silly decorator enforcer model though | 00:15 |
| morganfainberg | if we built enforcers on init of the manager (and not using a global one) we would also solve this | 00:15 |
| dstanek | ok, confirmed that the oslo.policy fix actually works | 00:16 |
| dstanek | morganfainberg: yes, that is true too | 00:16 |
| morganfainberg | so i think we need to do either... | 00:17 |
| morganfainberg | oslo_policy fix, fix our enforcer model, or dirty hack | 00:18 |
| *** tjones1 has quit IRC | 00:18 | |
| dstanek | even if i change enforcers to be created not at import time i still have the issue of needing to register the options | 00:20 |
| dstanek | from oslo_policy import opts; opts._register(CONF) - would have to be done in keystone.tests.unit.core | 00:21 |
| dstanek | still sort of a hack because i have to call the private method | 00:21 |
| morganfainberg | sure | 00:21 |
| *** navid__ has joined #openstack-keystone | 00:27 | |
| *** topol has quit IRC | 00:28 | |
| *** janonymous_ has quit IRC | 00:28 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Umm...yeah. If this works I'll make a better msg https://review.openstack.org/196917 | 00:29 |
| dstanek | morganfainberg: i bypass all the issues and just do the hack that we'd have to do anyway ^ | 00:30 |
| dstanek | i think we need a more explicit (at least official way) to register the options | 00:30 |
| *** boris-42 has joined #openstack-keystone | 00:30 | |
| dstanek | morganfainberg: if that works for you i'll fix up the commit message so that it's not just me rambling | 00:31 |
| *** darrenc is now known as darrenc_afk | 00:31 | |
| *** topol has joined #openstack-keystone | 00:32 | |
| *** ChanServ sets mode: +v topol | 00:32 | |
| *** jsavak has quit IRC | 00:32 | |
| *** geoffarnold has quit IRC | 00:32 | |
| morganfainberg | dstanek: ++ | 00:41 |
| morganfainberg | dstanek: commented | 00:42 |
| *** darrenc_afk is now known as darrenc | 00:44 | |
| morganfainberg | dstanek: LGTM | 00:44 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Extract basic validation processing to base class https://review.openstack.org/180818 | 00:45 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Separate the fetch and validate token processes https://review.openstack.org/190940 | 00:45 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't cache signed tokens https://review.openstack.org/190941 | 00:45 |
| dstanek | morganfainberg: which permanent fix do you think we should be using? | 00:51 |
| *** ankita_w_ has joined #openstack-keystone | 00:51 | |
| dstanek | a keystone one or an oslo_policy one? or both? | 00:51 |
| morganfainberg | dstanek: i'm leaning towards 2: oslo needs to let us register opts | 00:51 |
| morganfainberg | and 2nd, initialize enforcers in a sane way | 00:51 |
| morganfainberg | the second part is more important, but i think the ability to tell oslo "register these" is correct | 00:52 |
| dstanek | ok, i'll submit some patches for those things too | 00:52 |
| dstanek | i wonder why it doesn't break in my old environment | 00:53 |
| morganfainberg | not sure | 00:53 |
| *** ankita_wagh has quit IRC | 00:54 | |
| morganfainberg | dstanek: thanks | 00:56 |
| *** _cjones_ has quit IRC | 00:56 | |
| dstanek | it'll just have to wait until a little later tonight - almost 9pm and i haven't gone for a run yet | 00:57 |
| *** ayoung has joined #openstack-keystone | 00:58 | |
| *** ChanServ sets mode: +v ayoung | 00:58 | |
| *** henrynash_ has joined #openstack-keystone | 01:05 | |
| *** ChanServ sets mode: +v henrynash_ | 01:05 | |
| *** henrynash has quit IRC | 01:08 | |
| *** henrynash_ is now known as henrynash | 01:08 | |
| *** lhcheng has joined #openstack-keystone | 01:10 | |
| *** ChanServ sets mode: +v lhcheng | 01:10 | |
| *** ankita_w_ has quit IRC | 01:12 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 01:13 | |
| *** markvoelker has quit IRC | 01:19 | |
| *** markvoelker has joined #openstack-keystone | 01:19 | |
| *** markvoelker has quit IRC | 01:22 | |
| *** davechen has joined #openstack-keystone | 01:23 | |
| *** markvoelker has joined #openstack-keystone | 01:23 | |
| *** markvoelker has quit IRC | 01:23 | |
| *** markvoelker has joined #openstack-keystone | 01:24 | |
| *** lhcheng_ has joined #openstack-keystone | 01:26 | |
| *** lhcheng has quit IRC | 01:26 | |
| *** jasondotstar has quit IRC | 01:30 | |
| *** piyanai has joined #openstack-keystone | 01:30 | |
| *** davechen1 has joined #openstack-keystone | 01:31 | |
| *** davechen has quit IRC | 01:33 | |
| *** ankita_wagh has joined #openstack-keystone | 01:37 | |
| *** ankita_wagh has quit IRC | 01:38 | |
| *** timsim has joined #openstack-keystone | 01:38 | |
| *** timsim has left #openstack-keystone | 01:38 | |
| *** ankita_wagh has joined #openstack-keystone | 01:38 | |
| *** tobe has joined #openstack-keystone | 01:38 | |
| morganfainberg | dstanek: np | 01:39 |
| *** tobe has quit IRC | 01:39 | |
| *** davechen has joined #openstack-keystone | 01:41 | |
| *** davechen1 has quit IRC | 01:44 | |
| *** blewis` has quit IRC | 01:44 | |
| *** RichardRaseley has joined #openstack-keystone | 01:44 | |
| *** tqtran_ has quit IRC | 01:49 | |
| *** RichardRaseley has quit IRC | 01:50 | |
| *** gyee has quit IRC | 01:53 | |
| *** juvenn has joined #openstack-keystone | 02:01 | |
| *** lhcheng has joined #openstack-keystone | 02:02 | |
| *** ChanServ sets mode: +v lhcheng | 02:02 | |
| *** topol has quit IRC | 02:04 | |
| *** topol has joined #openstack-keystone | 02:04 | |
| *** ChanServ sets mode: +v topol | 02:04 | |
| *** lhcheng_ has quit IRC | 02:05 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 02:05 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes issue testing with oslo_policy.Enforcer https://review.openstack.org/196917 | 02:06 |
| *** ayoung has quit IRC | 02:07 | |
| *** chlong_ has joined #openstack-keystone | 02:08 | |
| *** ayoung has joined #openstack-keystone | 02:09 | |
| *** ChanServ sets mode: +v ayoung | 02:09 | |
| *** chlong__ has joined #openstack-keystone | 02:09 | |
| *** chlong_ has quit IRC | 02:13 | |
| *** tobe has joined #openstack-keystone | 02:16 | |
| *** spandhe has quit IRC | 02:24 | |
| *** spandhe has joined #openstack-keystone | 02:25 | |
| *** chlong_ has joined #openstack-keystone | 02:28 | |
| *** david8hu has quit IRC | 02:31 | |
| *** chlong__ has quit IRC | 02:31 | |
| *** david8hu has joined #openstack-keystone | 02:31 | |
| *** chlong has joined #openstack-keystone | 02:31 | |
| *** hrou has joined #openstack-keystone | 02:31 | |
| *** chlong_ has quit IRC | 02:34 | |
| *** navid__ has quit IRC | 02:34 | |
| *** stevemar has joined #openstack-keystone | 02:35 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Switch from deprecated oslo_utils.timeutils.strtime https://review.openstack.org/196862 | 02:36 |
| *** fangzhou has quit IRC | 02:38 | |
| mordred | jamielennox: YES! that | 02:46 |
| mordred | jamielennox, morganfainberg: can I bribe someone to get that merged and do a ksc release? | 02:47 |
| * mordred hands jamielennox a bunny rabbit | 02:47 | |
| morganfainberg | mordred: which thing? and KSC release depends on release managers atm, can do it tomorrow | 02:47 |
| * jamielennox is not sure what to do with a bunny rabbit - stew? | 02:47 | |
| morganfainberg | mordred: i no longer can do any keystone releases | 02:47 |
| stevemar | jamielennox: i'll take it | 02:48 |
| morganfainberg | jamielennox: be warned... it might be https://www.youtube.com/watch?v=pmu5sRIizdw | 02:48 |
| morganfainberg | mordred: ^ you're not giving jamielennox one of those, are you? | 02:49 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Extract basic validation processing to base class https://review.openstack.org/180818 | 02:51 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't cache signed tokens https://review.openstack.org/190941 | 02:51 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Cleanup token_info setting https://review.openstack.org/196931 | 02:51 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Separate setting catalog on headers from others https://review.openstack.org/196932 | 02:51 |
| mordred | morganfainberg: :) | 02:51 |
| mordred | morganfainberg: https://review.openstack.org/#/c/168792 | 02:51 |
| morganfainberg | mordred: +2 | 02:52 |
| morganfainberg | stevemar: , ^^ | 02:53 |
| stevemar | morganfainberg: hmmm | 02:58 |
| *** richm has quit IRC | 02:58 | |
| *** davechen has quit IRC | 03:00 | |
| jamielennox | damn, somewhere in all that i squashed 2 patches together and i've no idea how to untaggle htem | 03:02 |
| *** davechen has joined #openstack-keystone | 03:03 | |
| *** davechen1 has joined #openstack-keystone | 03:07 | |
| *** piyanai has quit IRC | 03:08 | |
| stevemar | zomg its hrou | 03:09 |
| hrou | Its stevemar ! | 03:09 |
| *** piyanai has joined #openstack-keystone | 03:09 | |
| *** davechen has quit IRC | 03:09 | |
| stevemar | morganfainberg: so hrou is starting up openstack dev, specifically swift | 03:09 |
| stevemar | (and he's known me for about 12 years :)) | 03:10 |
| hrou | Yep, throughout university, steve's a great guy ! | 03:11 |
| *** woodster_ has quit IRC | 03:11 | |
| stevemar | lies lies lies | 03:16 |
| stevemar | i just stole jamielennox's new rabbit, how nice could i be | 03:16 |
| *** davechen has joined #openstack-keystone | 03:18 | |
| *** davechen1 has quit IRC | 03:20 | |
| *** juvenn has quit IRC | 03:24 | |
| *** lhcheng has quit IRC | 03:26 | |
| morganfainberg | stevemar: oh hai and hrou oh hai | 03:26 |
| *** markvoelker has quit IRC | 03:31 | |
| *** piyanai has quit IRC | 03:35 | |
| *** dims has quit IRC | 03:48 | |
| *** juvenn has joined #openstack-keystone | 03:53 | |
| *** _cjones_ has joined #openstack-keystone | 03:57 | |
| *** juvenn has left #openstack-keystone | 03:57 | |
| openstackgerrit | Deepti Ramakrishna proposed openstack/keystone: Reject user creation using admin_token. https://review.openstack.org/196942 | 03:58 |
| *** dramakri has quit IRC | 03:59 | |
| *** _cjones_ has quit IRC | 04:02 | |
| *** juvenn has joined #openstack-keystone | 04:08 | |
| *** david-lyle has quit IRC | 04:13 | |
| *** david-lyle has joined #openstack-keystone | 04:14 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Enable listing of role assignments in a project hierarchy https://review.openstack.org/187045 | 04:14 |
| *** ankita_w_ has joined #openstack-keystone | 04:15 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Enable listing of role assignments in a project hierarchy https://review.openstack.org/187045 | 04:17 |
| *** hrou has quit IRC | 04:17 | |
| *** ankita_wagh has quit IRC | 04:19 | |
| *** ankita_w_ has quit IRC | 04:19 | |
| *** ankita_wagh has joined #openstack-keystone | 04:19 | |
| stevemar | henrynash: writing up specs, as usual | 04:22 |
| henrynash | stevemar: :-) | 04:22 |
| henrynash | heading out…spek later | 04:22 |
| stevemar | k | 04:23 |
| stevemar | davechen: hey - thanks for reviewing the oslo.cache patch | 04:24 |
| stevemar | davechen: you found a huge gap in testing in oslo.cach that we sorted out today :) | 04:25 |
| *** tobe has quit IRC | 04:31 | |
| *** hogepodge has quit IRC | 04:32 | |
| *** markvoelker has joined #openstack-keystone | 04:32 | |
| *** tobe has joined #openstack-keystone | 04:32 | |
| *** hogepodge has joined #openstack-keystone | 04:32 | |
| *** topol has quit IRC | 04:34 | |
| *** markvoelker has quit IRC | 04:36 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 04:39 | |
| *** juvenn has left #openstack-keystone | 04:51 | |
| *** kiran-r has joined #openstack-keystone | 04:52 | |
| *** rm_work|away is now known as rm_work | 04:52 | |
| *** kiran-r has quit IRC | 05:00 | |
| *** kiran-r has joined #openstack-keystone | 05:03 | |
| *** ankita_wagh has quit IRC | 05:05 | |
| *** stevemar has quit IRC | 05:05 | |
| *** stevemar has joined #openstack-keystone | 05:06 | |
| *** ankita_wagh has joined #openstack-keystone | 05:07 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Separate setting catalog on headers from others https://review.openstack.org/196932 | 05:09 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Move common request processing to base class https://review.openstack.org/180818 | 05:09 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Separate the fetch and validate parts of auth_token https://review.openstack.org/190940 | 05:09 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't cache signed tokens https://review.openstack.org/190941 | 05:09 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Create a simple base class from AuthProtocol https://review.openstack.org/180816 | 05:09 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Temporarily disable the deprecations test failure https://review.openstack.org/196948 | 05:09 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Add user_token and service_token to request https://review.openstack.org/196949 | 05:09 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Add token_auth helper to request https://review.openstack.org/196950 | 05:09 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Move enforcement and time validation to base class https://review.openstack.org/196951 | 05:09 |
| *** pgbridge has joined #openstack-keystone | 05:14 | |
| *** ncoghlan has joined #openstack-keystone | 05:17 | |
| *** kiran-r has quit IRC | 05:17 | |
| *** kiran-r has joined #openstack-keystone | 05:18 | |
| *** pgbridge has quit IRC | 05:20 | |
| *** _kiran_ has joined #openstack-keystone | 05:23 | |
| *** kiran-r has quit IRC | 05:24 | |
| *** _kiran_ is now known as kiran-r | 05:27 | |
| *** spandhe has joined #openstack-keystone | 05:27 | |
| davechen | stevemar: np, sir. | 05:32 |
| *** spandhe_ has joined #openstack-keystone | 05:33 | |
| *** spandhe has quit IRC | 05:34 | |
| *** spandhe_ is now known as spandhe | 05:34 | |
| davechen | stevemar: Acutally, I am aslo learnning a lot of the patches I reviewed. | 05:34 |
| *** jaosorior has joined #openstack-keystone | 05:38 | |
| *** ajayaa has joined #openstack-keystone | 05:39 | |
| *** chrisshattuck has joined #openstack-keystone | 05:40 | |
| *** hogepodge has quit IRC | 05:42 | |
| *** hogepodge has joined #openstack-keystone | 05:42 | |
| *** topol has joined #openstack-keystone | 05:46 | |
| *** ChanServ sets mode: +v topol | 05:46 | |
| stevemar | davechen: good :) keep doing great reviews | 05:46 |
| *** kiran-r has quit IRC | 05:46 | |
| bigjools | anyone interested in a devstack extension that sets it up to use testshib as an IdP? | 05:49 |
| stevemar | bigjools: i think dstanek was working on that | 05:49 |
| bigjools | oh well I already did it :) | 05:50 |
| davechen | stevemar: ha, nice to see you are still online. :) | 05:50 |
| stevemar | bigjools: tahts why you are BIG jools | 05:50 |
| stevemar | davechen: thats my secret, i'm always online | 05:50 |
| bigjools | stevemar: you will no doubt meet me in Tokyo and see why in person :) | 05:50 |
| stevemar | bigjools: i look forward to it! | 05:51 |
| stevemar | bigjools: got a patch or link for the shib stuff? | 05:51 |
| bigjools | not presently - I just hacked it up on a custom devstack, I need to make a branch for upstream | 05:51 |
| bigjools | I confess I am not much of a bash coder so it's rather hacky :) | 05:52 |
| stevemar | bigjools: would you consider taking a look at dstanek's work? https://review.openstack.org/#/c/151310/ | 05:52 |
| bigjools | sure | 05:52 |
| stevemar | oh right - he did it using pysaml2 - not testshib | 05:52 |
| *** browne has quit IRC | 05:53 | |
| *** rlt__ has quit IRC | 05:53 | |
| bigjools | yeah just noticed | 05:54 |
| bigjools | mine's quite a lot simpler because of that | 05:54 |
| davechen | stevemar: Tokyo is not far from my Country, welcome to drop by, I would like to be your tour guide. | 05:55 |
| bigjools | stevemar: actually mine is doing more than this, it's configuring the installed devstack to sign into testshib, which means mappings, groups, roles etc | 05:56 |
| *** markvoelker has joined #openstack-keystone | 05:56 | |
| stevemar | davechen: thanks for the offer, i just might take you up on it! | 05:57 |
| stevemar | bigjools: oh thats nice - code code code | 05:57 |
| bigjools | :) | 05:57 |
| *** topol has quit IRC | 05:57 | |
| bigjools | I'll throw it up tomorrow if I get time | 05:58 |
| stevemar | bigjools: sounds good | 05:58 |
| *** browne has joined #openstack-keystone | 06:00 | |
| bigjools | there's no reason it can't work in addition to dstanek's, it just gets enabled as a separate service | 06:00 |
| *** markvoelker has quit IRC | 06:01 | |
| *** mabrams has joined #openstack-keystone | 06:03 | |
| stevemar | bigjools: davechen see you all some other time, sleep for me! | 06:05 |
| *** stevemar has quit IRC | 06:05 | |
| *** stevemar has joined #openstack-keystone | 06:06 | |
| *** stevemar has quit IRC | 06:09 | |
| *** spandhe has quit IRC | 06:13 | |
| *** chrisshattuck has quit IRC | 06:13 | |
| *** lsmola has joined #openstack-keystone | 06:33 | |
| *** ajayaa_ has joined #openstack-keystone | 06:34 | |
| *** ajayaa has quit IRC | 06:34 | |
| ajayaa_ | jamielennox, stevemar, When I create a project using python-keystoneclient I get a warning saying "WARNING keystoneclient.utils [-] create takes at most 1 positional argument (3 given)" | 06:36 |
| ajayaa_ | sounds like a bug to me. | 06:36 |
| *** lhcheng has joined #openstack-keystone | 06:51 | |
| *** ChanServ sets mode: +v lhcheng | 06:51 | |
| *** belmoreira has joined #openstack-keystone | 06:52 | |
| *** browne has quit IRC | 06:52 | |
| *** juvenn has joined #openstack-keystone | 07:01 | |
| *** boris-42 has quit IRC | 07:02 | |
| *** dguerri` is now known as dguerri | 07:02 | |
| *** dguerri is now known as dguerri` | 07:07 | |
| marekd | bigjools: i am very much interested in it :-) | 07:09 |
| *** kiran-r has joined #openstack-keystone | 07:09 | |
| *** navid__ has joined #openstack-keystone | 07:12 | |
| *** juvenn has quit IRC | 07:13 | |
| *** juvenn has joined #openstack-keystone | 07:13 | |
| *** fhubik has joined #openstack-keystone | 07:19 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move resource related testcase into their own module https://review.openstack.org/195449 | 07:19 |
| *** rlt_ has joined #openstack-keystone | 07:30 | |
| *** e0ne has joined #openstack-keystone | 07:33 | |
| *** chlong has quit IRC | 07:35 | |
| *** e0ne has quit IRC | 07:37 | |
| *** jistr has joined #openstack-keystone | 07:43 | |
| *** fhubik is now known as fhubik_afk | 07:44 | |
| *** lhcheng has quit IRC | 07:45 | |
| *** markvoelker has joined #openstack-keystone | 07:45 | |
| *** markvoelker has quit IRC | 07:50 | |
| *** rm_work is now known as rm_work|away | 07:53 | |
| *** rm_work|away is now known as rm_work | 07:54 | |
| *** fhubik_lunch has joined #openstack-keystone | 08:02 | |
| *** jistr has quit IRC | 08:03 | |
| *** fhubik_afk has quit IRC | 08:05 | |
| *** jaosorior has quit IRC | 08:06 | |
| *** fhubik_lunch has quit IRC | 08:07 | |
| *** fhubik_lunch has joined #openstack-keystone | 08:07 | |
| *** fhubik_lunch is now known as fhubik_afk | 08:07 | |
| *** stevemar has joined #openstack-keystone | 08:07 | |
| *** jistr has joined #openstack-keystone | 08:10 | |
| *** stevemar has quit IRC | 08:10 | |
| evrardjp | good morning everyone | 08:13 |
| *** tobe has quit IRC | 08:17 | |
| *** ankita_wagh has quit IRC | 08:17 | |
| juvenn | evrardjp: good afternoon here ;) | 08:24 |
| evrardjp | close to coming back home after a hard day of work, nice! ;) | 08:25 |
| juvenn | evrardjp: are you familiar with keystoneclient.v3.client.Client? | 08:28 |
| marekd | rodrigods: ping pong. | 08:29 |
| evrardjp | juvenn: not really, you have a question? | 08:29 |
| juvenn | evradjp: I'm stuck at what params should I pass there? | 08:29 |
| juvenn | Client(auth_url=auth_url, username=username, password=password) | 08:30 |
| juvenn | it raises `eystoneclient.openstack.common.apiclient.exceptions.EndpointNotFound` | 08:31 |
| juvenn | when I do client.users.list() | 08:31 |
| juvenn | but if I provide additional `endpoint=…`, it'll raises `AuthorizationFailure: no valid auth is available` | 08:32 |
| *** fhubik_afk is now known as fhubik_lunch | 08:33 | |
| juvenn | is that `endpoint=` arg required? I suppose there should be default one, if not provided. | 08:35 |
| *** Kennan has quit IRC | 08:38 | |
| *** Kennan has joined #openstack-keystone | 08:38 | |
| *** alex_xu_ is now known as alex_xu | 08:38 | |
| juvenn | The examples in official doc does not provide `endpoint=`, as a matter of fact. http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html#introduction, | 08:40 |
| *** juvenn has quit IRC | 08:43 | |
| *** juvenn has joined #openstack-keystone | 08:45 | |
| -openstackstatus- NOTICE: OpenStack CI is down due to hard drive failures | 08:48 | |
| *** ChanServ changes topic to "OpenStack CI is down due to hard drive failures" | 08:48 | |
| *** bradjones has quit IRC | 08:55 | |
| *** ncoghlan has quit IRC | 08:56 | |
| *** bradjones has joined #openstack-keystone | 08:57 | |
| *** bradjones has quit IRC | 08:57 | |
| *** bradjones has joined #openstack-keystone | 08:57 | |
| *** e0ne has joined #openstack-keystone | 09:02 | |
| *** lufix has joined #openstack-keystone | 09:03 | |
| *** rlt_ has quit IRC | 09:09 | |
| *** dguerri` is now known as dguerri | 09:14 | |
| *** e0ne is now known as e0ne_ | 09:15 | |
| *** e0ne_ has quit IRC | 09:26 | |
| *** fhubik_lunch is now known as fhubik_afk | 09:28 | |
| *** e0ne has joined #openstack-keystone | 09:29 | |
| *** markvoelker has joined #openstack-keystone | 09:34 | |
| *** fhubik_afk is now known as fhubik_lunch | 09:36 | |
| openstackgerrit | Enrique Garcia Navalon proposed openstack/python-keystoneclient: Added endpoint group filter manager methods https://review.openstack.org/182658 | 09:38 |
| *** markvoelker has quit IRC | 09:39 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Show friendly message when request body is not provided https://review.openstack.org/195001 | 09:46 |
| *** aix has quit IRC | 09:46 | |
| *** davechen has left #openstack-keystone | 09:55 | |
| *** stevemar has joined #openstack-keystone | 09:56 | |
| *** stevemar has quit IRC | 10:00 | |
| *** fhubik_lunch is now known as fhubik_afk | 10:13 | |
| *** lufix has quit IRC | 10:15 | |
| *** fhubik_afk is now known as fhubik_lunch | 10:17 | |
| *** aix has joined #openstack-keystone | 10:17 | |
| *** e0ne is now known as e0ne_ | 10:23 | |
| *** e0ne_ is now known as e0ne | 10:25 | |
| *** amaretskiy has joined #openstack-keystone | 10:26 | |
| amaretskiy | Hi all! could someone take a look at https://review.openstack.org/#/c/188457/ ? This patch adds a lot of rally scenarios to rally job | 10:27 |
| *** fhubik_lunch is now known as fhubik_afk | 10:29 | |
| *** fhubik_afk is now known as fhubik_lunch | 10:33 | |
| *** henrynash has quit IRC | 10:34 | |
| *** ajayaa_ has quit IRC | 10:38 | |
| *** chlong has joined #openstack-keystone | 10:49 | |
| *** fhubik_lunch is now known as fhubik_afk | 10:52 | |
| *** ajayaa_ has joined #openstack-keystone | 10:54 | |
| *** piyanai has joined #openstack-keystone | 10:57 | |
| *** wendle has joined #openstack-keystone | 11:06 | |
| *** dims has joined #openstack-keystone | 11:07 | |
| *** amakarov_away is now known as amakarov | 11:12 | |
| marekd | rodrigods: hello, sir. | 11:12 |
| rodrigods | marekd, hi sir | 11:13 |
| *** wendle has quit IRC | 11:17 | |
| marekd | i need some your expertise on endpoint filtering, so it's enforced by a server, not a client, right? (i will start will silly questions) | 11:18 |
| *** markvoelker has joined #openstack-keystone | 11:24 | |
| marekd | rodrigods: ^^ | 11:25 |
| *** markvoelker has quit IRC | 11:29 | |
| *** radez is now known as radez_g0n3 | 11:36 | |
| *** stevemar has joined #openstack-keystone | 11:45 | |
| *** jaosorior has joined #openstack-keystone | 11:45 | |
| *** stevemar has quit IRC | 11:48 | |
| *** piyanai has quit IRC | 11:50 | |
| *** c_soukup has quit IRC | 11:55 | |
| *** radez_g0n3 is now known as radez | 11:58 | |
| *** fhubik_afk is now known as fhubik_lunch | 11:58 | |
| *** jistr is now known as jistr|class | 11:59 | |
| *** fhubik_lunch is now known as fhubik_afk | 11:59 | |
| *** markvoelker has joined #openstack-keystone | 12:02 | |
| rodrigods | marekd, not expert :) | 12:04 |
| rodrigods | but it's enforced by the server | 12:04 |
| samueldmq | ayoung: ping! morning, I have something to talk about with you | 12:06 |
| samueldmq | ayoung: alternative to the caching strategy we talked last week ... just to make sure it makes sense | 12:06 |
| samueldmq | ayoung: to put as an alternative solution in the spec | 12:06 |
| *** jistr|class is now known as jistr | 12:07 | |
| samueldmq | ayoung: keystone server could control the policy 'releases' .., let me give you an example | 12:07 |
| marekd | rodrigods: cool | 12:08 |
| marekd | btw, do we have anything interesting for a meeting today? | 12:08 |
| marekd | oh, we do.. | 12:09 |
| samueldmq | ayoung: keystone knows the policy for a given endpoint has max-age = 300, so each 300s it has a new policy to release to those enpoints (it is None at the beggining) | 12:09 |
| samueldmq | ayoung: when an endpoint (even behing an haproxy) asks for that policy , keystone returns> | 12:09 |
| rodrigods | marekd, do we? | 12:09 |
| samueldmq | ayoung: last released policy (can be None if there is no release yet) and: | 12:09 |
| samueldmq | ayoung: must-revalidates; private; max-age = (300 - (time passed since last release)) | 12:10 |
| samueldmq | morganfainberg: cc ^ | 12:10 |
| *** markvoelker_ has joined #openstack-keystone | 12:11 | |
| samueldmq | ayoung: morganfainberg let me know whether this makes sense to you guys, it's basically the same approach, but keystone server controls the policy synchronization itself, instead of expecting the middleware to understand Not-Valid-Before | 12:11 |
| marekd | rodrigods: depends :-) | 12:11 |
| marekd | rodrigods: e.g. progress on ksa is interesting for me. | 12:11 |
| *** navid__ has quit IRC | 12:12 | |
| *** markvoel_ has joined #openstack-keystone | 12:13 | |
| *** markvoelker has quit IRC | 12:13 | |
| *** belmoreira has quit IRC | 12:15 | |
| rodrigods | marekd, ++ | 12:16 |
| *** juvenn has quit IRC | 12:17 | |
| *** markvoelker_ has quit IRC | 12:17 | |
| *** ajayaa_ has quit IRC | 12:31 | |
| *** gordc_afk is now known as gordc | 12:38 | |
| *** edmondsw has joined #openstack-keystone | 12:39 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 12:40 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Bye Bye Domain Table https://review.openstack.org/161854 | 12:40 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 12:40 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Remove domain table references https://review.openstack.org/165936 | 12:40 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 12:40 |
| *** csoukup has joined #openstack-keystone | 12:44 | |
| *** rlt_ has joined #openstack-keystone | 12:47 | |
| *** bknudson has joined #openstack-keystone | 12:47 | |
| *** ChanServ sets mode: +v bknudson | 12:47 | |
| *** ayoung has quit IRC | 12:48 | |
| *** markvoel_ has quit IRC | 12:51 | |
| *** markvoelker_ has joined #openstack-keystone | 12:52 | |
| *** jsavak has joined #openstack-keystone | 12:52 | |
| *** bknudson has quit IRC | 12:54 | |
| *** bdossant has joined #openstack-keystone | 12:58 | |
| *** markvoelker_ has quit IRC | 13:02 | |
| *** markvoelker has joined #openstack-keystone | 13:02 | |
| *** markvoelker_ has joined #openstack-keystone | 13:03 | |
| *** hrou has joined #openstack-keystone | 13:05 | |
| *** markvoelker_ has quit IRC | 13:05 | |
| *** markvoelker_ has joined #openstack-keystone | 13:06 | |
| *** zzzeek has joined #openstack-keystone | 13:06 | |
| *** mylu has joined #openstack-keystone | 13:06 | |
| *** markvoelker has quit IRC | 13:07 | |
| *** piyanai has joined #openstack-keystone | 13:08 | |
| *** bknudson has joined #openstack-keystone | 13:10 | |
| *** ChanServ sets mode: +v bknudson | 13:10 | |
| *** jsavak has quit IRC | 13:13 | |
| *** jsavak has joined #openstack-keystone | 13:13 | |
| *** richm has joined #openstack-keystone | 13:14 | |
| *** mylu has quit IRC | 13:21 | |
| *** eandersson^ has joined #openstack-keystone | 13:25 | |
| *** eandersson^ has quit IRC | 13:26 | |
| *** e0ne is now known as e0ne_ | 13:29 | |
| *** boris-42 has joined #openstack-keystone | 13:31 | |
| *** mylu has joined #openstack-keystone | 13:32 | |
| *** ajayaa_ has joined #openstack-keystone | 13:34 | |
| *** stevemar has joined #openstack-keystone | 13:34 | |
| *** htruta has joined #openstack-keystone | 13:35 | |
| hughsaunders | hi, I'm playing with federation. I have two keystones one as IDP, one as SP. I can get a SAML assertion form IDP keystone and use that to get a token, then scoped token from SP keystone. Is there any form of service catalog integration, so that when a user views the service catalog on IDP keystone, they can see the services from SP keystone? or will users have to discover service providers via the service provider objects, then go and | 13:37 |
| hughsaunders | query those SPs directly? | 13:37 |
| *** stevemar has quit IRC | 13:37 | |
| *** blewis has joined #openstack-keystone | 13:38 | |
| *** e0ne_ has quit IRC | 13:39 | |
| samueldmq | morganfainberg: ayoung I added a topic to the meeting today to talk to people about 'Current Status and Scope for Liberty' in Dynamic Policies | 13:39 |
| samueldmq | morganfainberg: ayoung I included your names, since the decisions we have today are based on conversations including both of you | 13:40 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:40 | |
| *** stevemar has joined #openstack-keystone | 13:42 | |
| *** blewis has quit IRC | 13:42 | |
| stevemar | mfisch: around? | 13:43 |
| *** ayoung has joined #openstack-keystone | 13:43 | |
| *** ChanServ sets mode: +v ayoung | 13:43 | |
| *** e0ne has joined #openstack-keystone | 13:46 | |
| rodrigods | hughsaunders, we can't access the SP catalog in the IdP, only after request the scoped token from the SP (as you described) | 13:50 |
| hughsaunders | rodrigods: thanks, so just to confirm, users will have to discover federated resources via the service provider objects, not the service catalog? | 13:52 |
| hughsaunders | also are there any plans for service catalog integration? | 13:52 |
| rodrigods | hughsaunders, yes | 13:52 |
| rodrigods | about the second point, not that I'm aware of | 13:53 |
| *** jsavak has quit IRC | 13:53 | |
| hughsaunders | rodrigods: thanks, also thanks for your great blog post, was really helpful in getting it set up :) | 13:53 |
| rodrigods | hughsaunders, np! thanks :) | 13:53 |
| *** fhubik_afk is now known as fhubik_lunch | 13:54 | |
| lbragstad | dstanek: o/ quick question for you | 13:56 |
| dstanek | lbragstad: fire away | 13:56 |
| lbragstad | dstanek: when you're dev'ing on keystone, do you ever run the keystone process by invoking keystone/cmd/all.py manually? | 13:56 |
| *** jsavak has joined #openstack-keystone | 13:57 | |
| lbragstad | as the entry point, versus doing keystone-all? | 13:57 |
| dstanek | lbragstad: i only use keystone-all - since it is installed with 'develop' it invokes that code | 13:58 |
| *** bdossant_ has joined #openstack-keystone | 13:58 | |
| lbragstad | dstanek: ah, so you just use setup.py and install with develop | 13:58 |
| *** bdossant has quit IRC | 13:59 | |
| dstanek | lbragstad: i think tox is doing that by default too | 13:59 |
| lbragstad | ok, that makes sense | 13:59 |
| dstanek | i run it with the full path '.tox/py27/bin/keyston-all' so that i don't get the system one | 13:59 |
| lbragstad | oh, nice | 14:00 |
| *** jecarey has joined #openstack-keystone | 14:00 | |
| *** dims has quit IRC | 14:01 | |
| *** belmoreira has joined #openstack-keystone | 14:01 | |
| marekd | breton: hi, are you going to re-vote https://review.openstack.org/#/c/193703/2 based on disq in the comments? | 14:01 |
| *** dims has joined #openstack-keystone | 14:01 | |
| *** kiran-r has quit IRC | 14:02 | |
| *** mabrams has quit IRC | 14:04 | |
| *** browne has joined #openstack-keystone | 14:05 | |
| *** jsavak has quit IRC | 14:07 | |
| *** fhubik_lunch is now known as fhubik | 14:10 | |
| *** jsavak has joined #openstack-keystone | 14:10 | |
| *** topol has joined #openstack-keystone | 14:13 | |
| *** ChanServ sets mode: +v topol | 14:14 | |
| *** bdossant_ has quit IRC | 14:14 | |
| marekd | bknudson: Hi. I left a question in https://review.openstack.org/#/c/195335/1/doc/source/developing.rst . Would you care answering it ? | 14:17 |
| samueldmq | marekd: I think what he's saying there is: you submit a patch that highlight the current behavior (which is wrong) | 14:19 |
| samueldmq | marekd: if a function returns 4 and it should return 5, you could either: | 14:19 |
| *** blewis has joined #openstack-keystone | 14:19 | |
| samueldmq | marekd: add a test asserting it returns 5 and then add @wip | 14:19 |
| samueldmq | marekd: or add a tests asserting it returns 4, but leave a comment, for example, saying it's passing with wrong behavior | 14:20 |
| samueldmq | marekd: both need to be changed once the behavior is fixed in the server, by i) removing the wip or ii) fixing the asserted return from 4 to 5 | 14:20 |
| *** r-daneel has joined #openstack-keystone | 14:20 | |
| stevemar | mfisch: ping | 14:20 |
| amakarov | ayoung, hi! I know I'm a bit late: is there a dorm suite still available? | 14:21 |
| *** fhubik is now known as fhubik_afk | 14:25 | |
| breton | marekd: after today's meeting | 14:28 |
| *** blewis` has joined #openstack-keystone | 14:29 | |
| breton | marekd: there is "Review policy update" topic from bknudson. If we decide to leave use of @wip to developer, I'll be happy to +1 | 14:29 |
| ayoung | amakarov, I'll ask. Probably | 14:30 |
| ayoung | amakarov, if there is, will you take it? | 14:30 |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Add testcases for list_role_assignments of v3 domains https://review.openstack.org/187899 | 14:31 |
| *** blewis has quit IRC | 14:32 | |
| amakarov | ayoung, yes | 14:34 |
| amakarov | ayoung, thank you and look here please :) https://review.openstack.org/#/c/141854/ | 14:35 |
| amakarov | I've addressed your comments | 14:35 |
| marekd | breton: the link provided is about sth else. | 14:38 |
| ayoung | amakarov, +2 | 14:39 |
| amakarov | ayoung, _\m/ | 14:39 |
| *** jsavak has quit IRC | 14:41 | |
| *** blewis` has quit IRC | 14:41 | |
| *** HT_sergio has joined #openstack-keystone | 14:43 | |
| *** jsavak has joined #openstack-keystone | 14:44 | |
| *** rushiagr_away is now known as rushiagr | 14:45 | |
| *** jsavak has quit IRC | 14:47 | |
| *** pgbridge has joined #openstack-keystone | 14:51 | |
| *** jsavak has joined #openstack-keystone | 14:53 | |
| *** ChanServ changes topic to "Review Specs and Code | Milestone 1 for Liberty is ~June 23 | MidCycle July 15, 16, 17 in Boston" | 14:53 | |
| -openstackstatus- NOTICE: The log volume was repaired and brought back online at 14:00 UTC. Log links today from before that time may be missing, and changes should be rechecked if fresh job logs are desired for them. | 14:53 | |
| marekd | rodrigods: hm, i started to wonder whether we should call the attribute openstack_user_domain here is: you submit a patch that highlight the current behavior (which is wrong) | 14:54 |
| openstackgerrit | Merged openstack/keystone: Update MANIFEST.in https://review.openstack.org/195327 | 14:54 |
| marekd | 16:19 < samueldmq> marekd: if a function returns 4 and it should return 5, you could either: | 14:54 |
| marekd | rodrigods: eh, sorry | 14:55 |
| *** e0ne is now known as e0ne_ | 14:55 | |
| marekd | rodrigods: https://review.openstack.org/#/c/181007/1/keystone/contrib/federation/idp.py i am starting to wonder whether this should be openstack_user_domain or openstack_user_domain_name | 14:55 |
| *** piyanai has quit IRC | 14:55 | |
| marekd | stevemar: ^^ | 14:55 |
| stevemar | marekd: hmm | 14:56 |
| marekd | otherwise it *may* be confusing for ppl at the beginning. | 14:56 |
| rodrigods | marekd, stevemar, following the pattern of "openstack_project" | 14:56 |
| *** diazjf has joined #openstack-keystone | 14:56 | |
| rodrigods | it should be "openstack_user_domain" | 14:56 |
| rodrigods | otherwise, we need to add "_name" to everything | 14:56 |
| *** hrou has quit IRC | 14:56 | |
| marekd | stevemar: you agree? | 14:56 |
| *** piyanai has joined #openstack-keystone | 14:57 | |
| *** hrou has joined #openstack-keystone | 14:57 | |
| marekd | stevemar: oh i noticed your +1 there | 14:57 |
| rodrigods | marekd, the L version is already merged | 14:58 |
| *** jsavak has quit IRC | 14:58 | |
| *** e0ne_ is now known as e0ne | 14:58 | |
| *** jsavak has joined #openstack-keystone | 14:58 | |
| *** e0ne is now known as e0ne_ | 14:59 | |
| marekd | yep, i confess i hadn't noticed it was for kilo at the beginning :-) | 14:59 |
| *** e0ne_ is now known as e0ne | 14:59 | |
| marekd | anyway, i am not the one to decide whether it will be merged or not, so i can only show my opinion by giving it a +1 | 15:00 |
| rodrigods | marekd, sure | 15:00 |
| stevemar | marekd: same | 15:00 |
| diazjf | marekd, stevemar, can you guys finish reviewing https://review.openstack.org/#/c/192850/ think its ready to be merged. thanks | 15:01 |
| marekd | diazjf: ok, i am looking right now. | 15:01 |
| stevemar | diazjf: aye aye captn | 15:01 |
| diazjf | marekd, stevemar, thanks guys!! | 15:01 |
| stevemar | migthe be cleaner to put these under federation, but thats small move | 15:02 |
| *** piyanai has quit IRC | 15:02 | |
| *** jsavak has quit IRC | 15:03 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Bye Bye Domain Table https://review.openstack.org/161854 | 15:03 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 15:03 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Remove domain table references https://review.openstack.org/165936 | 15:03 |
| marekd | diazjf: i have few comments, going to add them now. | 15:07 |
| marekd | otherwise it looks pretty neat. | 15:07 |
| *** aix has quit IRC | 15:09 | |
| *** eandersson has quit IRC | 15:12 | |
| diazjf | marekd, stevemar, perfect, I'll touch it up once I see the comments and maybe move the link to http://docs.openstack.org/developer/keystone/configure_federation.html mapping section? let me know what you think? | 15:13 |
| openstackgerrit | Enrique Garcia Navalon proposed openstack/python-keystoneclient: Added endpoint group filter manager methods https://review.openstack.org/182658 | 15:13 |
| *** jasondotstar has joined #openstack-keystone | 15:15 | |
| *** kiran-r has joined #openstack-keystone | 15:16 | |
| *** belmoreira has quit IRC | 15:17 | |
| *** dramakri has joined #openstack-keystone | 15:21 | |
| *** dramakri has left #openstack-keystone | 15:21 | |
| *** belmoreira has joined #openstack-keystone | 15:21 | |
| *** aix has joined #openstack-keystone | 15:24 | |
| *** bradjones has quit IRC | 15:30 | |
| *** slberger has joined #openstack-keystone | 15:32 | |
| *** bradjones has joined #openstack-keystone | 15:32 | |
| *** bradjones has quit IRC | 15:32 | |
| *** bradjones has joined #openstack-keystone | 15:32 | |
| *** ankita_wagh has joined #openstack-keystone | 15:32 | |
| *** kiran-r has quit IRC | 15:35 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Refactor certificate fetch functions https://review.openstack.org/179460 | 15:36 |
| *** anhhuynhx has joined #openstack-keystone | 15:41 | |
| *** aix has quit IRC | 15:48 | |
| *** geoffarnold has joined #openstack-keystone | 15:48 | |
| *** kiran-r has joined #openstack-keystone | 15:49 | |
| *** belmoreira has quit IRC | 15:50 | |
| *** kiran-r has quit IRC | 15:51 | |
| *** _cjones_ has joined #openstack-keystone | 15:52 | |
| *** jasondotstar has quit IRC | 15:52 | |
| *** mrutkows has joined #openstack-keystone | 15:54 | |
| *** aix has joined #openstack-keystone | 16:00 | |
| morganfainberg | lbragstad: if you have a few minutes, i could use some eyes on https://review.openstack.org/#/c/196548/1 | 16:00 |
| *** jistr has quit IRC | 16:01 | |
| morganfainberg | lbragstad: see if i'm doing something insane | 16:01 |
| *** aix has quit IRC | 16:01 | |
| *** ngupta has quit IRC | 16:02 | |
| *** kiran-r has joined #openstack-keystone | 16:02 | |
| marekd | diazjf: still reviewing your patch. | 16:03 |
| marekd | diazjf: this shows me we should simplyfy mapping language | 16:03 |
| marekd | as even I had to look to the code to make sure I was right and there are some nested rules. | 16:03 |
| *** chenhong has joined #openstack-keystone | 16:03 | |
| *** jasondotstar has joined #openstack-keystone | 16:06 | |
| *** fhubik_afk is now known as fhubik | 16:07 | |
| * marekd added 19 comments to the patchset - feeling like bknudson. | 16:07 | |
| marekd | bknudson: stevemar: Can I ask for a review here: https://review.openstack.org/#/c/192671/ ? | 16:10 |
| *** piyanai has joined #openstack-keystone | 16:14 | |
| *** kiran-r has quit IRC | 16:15 | |
| *** navid__ has joined #openstack-keystone | 16:15 | |
| lbragstad | morganfainberg: awesome, will do | 16:16 |
| morganfainberg | lbragstad: and we need to correct the stupid around microseconds in the maintain expiry | 16:16 |
| morganfainberg | lbragstad: but that is easy | 16:16 |
| morganfainberg | lbragstad: will hopefully do that today | 16:16 |
| lbragstad | morganfainberg: that would make life so much easier | 16:17 |
| anhhuynhx | Can someone please take a look at this bug https://bugs.launchpad.net/keystone/+bug/1460492 and clarify what is meant by "list by user_id and credential type (a required field) so that i only get back my EC2 credentials"? | 16:18 |
| openstack | Launchpad bug 1460492 in Keystone "List credentials by type" [Wishlist,Triaged] - Assigned to Anh Huynh (anhx-huynh) | 16:18 |
| lbragstad | morganfainberg: going to food quick | 16:18 |
| morganfainberg | lbragstad: so the microsecond stupid will only be fixed in your test | 16:18 |
| morganfainberg | lbragstad: btw | 16:18 |
| morganfainberg | lbragstad: we can't fix it in the token because PKI tokens collide then | 16:18 |
| lbragstad | morganfainberg: ok | 16:18 |
| samueldmq | morganfainberg's doing some coding exercise :) | 16:18 |
| morganfainberg | if PKI tokens die, microseconds can msotly be droped | 16:18 |
| *** mylu has quit IRC | 16:19 | |
| morganfainberg | samueldmq: i'm playing janitor | 16:19 |
| morganfainberg | samueldmq: and cleaning up messes | 16:19 |
| samueldmq | morganfainberg: which looks great :-) | 16:19 |
| *** mylu has joined #openstack-keystone | 16:20 | |
| *** HT_sergio has quit IRC | 16:20 | |
| stevemar | marekd: reading | 16:20 |
| chenhong | dstanek: I replied your question in https://review.openstack.org/#/c/187899/ . Could you take a look at it? | 16:21 |
| *** e0ne is now known as e0ne_ | 16:23 | |
| dstanek | chenhong: if that's the case i think you should move that function | 16:24 |
| *** fhubik has quit IRC | 16:24 | |
| *** mylu has quit IRC | 16:24 | |
| *** piyanai_ has joined #openstack-keystone | 16:24 | |
| *** ankita_wagh has quit IRC | 16:25 | |
| *** ankita_wagh has joined #openstack-keystone | 16:26 | |
| chenhong | dstanek: Do you mean move 'test_v3_assignment._build_role_assignment_***' to one superclass? | 16:27 |
| *** piyanai has quit IRC | 16:28 | |
| dstanek | not a super class, but a utility module | 16:28 |
| *** piyanai_ is now known as piyanai | 16:28 | |
| *** jkomg has joined #openstack-keystone | 16:28 | |
| morganfainberg | mordred: https://review.openstack.org/#/c/168792/ +A once that lands i'll bug release management to release for you | 16:29 |
| *** dontalton has joined #openstack-keystone | 16:29 | |
| chenhong | dstanek: I agree with you and I do have a plan to do that. But it's not good to do more than one thing in one change. | 16:29 |
| samueldmq | dstanek: ++ | 16:30 |
| *** jk|osx has joined #openstack-keystone | 16:30 | |
| samueldmq | chenhong: you can do that in a preparation patch, i.e move that to an utility module, and in your patch, just import that | 16:30 |
| samueldmq | chenhong: that's my suggestion, not sure dstanek agree or have a better advice :-) | 16:31 |
| *** piyanai has quit IRC | 16:31 | |
| diazjf | marekd, stevemar, thanks for all the feedback. I'll work on updating this tonight. | 16:31 |
| dstanek | samueldmq: no, i think that's a good thing to do | 16:31 |
| *** jkomg has quit IRC | 16:33 | |
| *** jk|osx is now known as jkomg | 16:33 | |
| samueldmq | dstanek: nice :) chenhong ^ | 16:33 |
| *** e0ne_ has quit IRC | 16:34 | |
| *** piyanai has joined #openstack-keystone | 16:34 | |
| *** kiran-r has joined #openstack-keystone | 16:34 | |
| samueldmq | morganfainberg: ayoung when middleware asks with IMS, Keystone server could return only the part of the Dynamic Policy that has changed since then | 16:36 |
| *** jasondotstar has quit IRC | 16:36 | |
| chenhong | samueldmq: dstanek: So, you mean I should add this utility module firstly and then using it in the testcases? | 16:36 |
| *** e0ne has joined #openstack-keystone | 16:36 | |
| samueldmq | morganfainberg: ayoung this would be a great performance improvement in the cases there are a lot of customized rules | 16:36 |
| *** piyanai has quit IRC | 16:36 | |
| morganfainberg | samueldmq: no that is not how an IMS check works | 16:36 |
| samueldmq | chenhong: yes, you can make the patches dependent | 16:37 |
| dstanek | chenhong: yes, maybe just add the shared function to keystone.tests.unit.utils for now? | 16:37 |
| morganfainberg | samueldmq: IMS is "return the entire document" or "not modified" | 16:37 |
| *** jasondotstar has joined #openstack-keystone | 16:37 | |
| *** HT_sergio has joined #openstack-keystone | 16:37 | |
| morganfainberg | samueldmq: you would want a non-IMS check - but this isn't a lot of data, why should we try and over optimise | 16:38 |
| morganfainberg | samueldmq: use the first rule of optimisation: don't | 16:38 |
| morganfainberg | samueldmq: optimise if it is an issue | 16:38 |
| samueldmq | morganfainberg: k, but that could be a potential improvement, since if you ask IMS, you impliciyly are aware of what was defined in that time | 16:38 |
| samueldmq | morganfainberg: but I agree | 16:38 |
| morganfainberg | but more important, don't break HTTP spec | 16:38 |
| samueldmq | morganfainberg: yes, completely agree | 16:38 |
| samueldmq | morganfainberg: did you see my messages earlier today ? we can manage the synchronization complexity all in the keystone server | 16:39 |
| *** Ephur has joined #openstack-keystone | 16:39 | |
| samueldmq | morganfainberg: I am writting all that in the specs (on the fetch at middleware right now) | 16:39 |
| ayoung | samueldmq, I don't think it is worth it, at least not up front | 16:39 |
| samueldmq | morganfainberg: and *everything* I am writing is very based on HTTP spec :-) | 16:40 |
| samueldmq | very/completely | 16:40 |
| ayoung | I would be really surprised if the performance improvemtn was needed | 16:40 |
| samueldmq | ayoung: sure, that's what we just discussed :-) let's start simple | 16:40 |
| chenhong | dstanek: Yes, I'm going to do it now. | 16:40 |
| samueldmq | ayoung: and optimize if someone needs it | 16:40 |
| ayoung | samueldmq, so, what is far more likely as a stage 2 (or 3 or 4) is project specific policy | 16:41 |
| ayoung | and...I don't have a way to distribute that right now | 16:41 |
| samueldmq | ayoung: maybe, but we have a lot of things to do before make that happen | 16:41 |
| samueldmq | ayoung: exactly :) | 16:41 |
| openstackgerrit | Theodore Ilie proposed openstack/keystone: Add test case for deleting endpoint with space in url https://review.openstack.org/196883 | 16:41 |
| ayoung | that is one reason I kindof want the IDs to be a hash, as it will help the cas where two things want a policy file, and they actually have idenitcal ones | 16:41 |
| anhhuynhx | does credential type means a role like admin and such? | 16:43 |
| anhhuynhx | or credential type means things like access keys or secret keys? | 16:44 |
| *** lufix has joined #openstack-keystone | 16:46 | |
| *** piyanai has joined #openstack-keystone | 16:48 | |
| stevemar | now if i only knew what jason's irc nick is... | 16:49 |
| stevemar | jkomg seems like an appropriate name :) | 16:49 |
| jkomg | stevemar: :D | 16:49 |
| jkomg | jkennedy is registered and taken, alas | 16:50 |
| *** mylu has joined #openstack-keystone | 16:50 | |
| stevemar | ah damn that other jkennedy | 16:50 |
| *** openstackgerrit has quit IRC | 16:50 | |
| *** openstackgerrit has joined #openstack-keystone | 16:51 | |
| *** roxanaghe has joined #openstack-keystone | 16:51 | |
| *** HT_sergio has quit IRC | 16:51 | |
| jkomg | always another jkennedy | 16:53 |
| *** piyanai has quit IRC | 16:54 | |
| *** lufix has quit IRC | 16:54 | |
| *** anhhuynhx has quit IRC | 16:56 | |
| morganfainberg | topol: | 16:57 |
| morganfainberg | https://review.openstack.org/#/c/195347/ should be a nobrainer | 16:57 |
| *** geoffarnold has quit IRC | 16:58 | |
| *** geoffarnold has joined #openstack-keystone | 16:58 | |
| *** jasondotstar has quit IRC | 16:59 | |
| *** kiran-r has quit IRC | 17:02 | |
| *** jasondotstar has joined #openstack-keystone | 17:03 | |
| *** ankita_wagh has quit IRC | 17:03 | |
| *** kiran-r has joined #openstack-keystone | 17:03 | |
| *** piyanai has joined #openstack-keystone | 17:04 | |
| *** e0ne has quit IRC | 17:05 | |
| *** jlvillal has joined #openstack-keystone | 17:05 | |
| *** mylu has quit IRC | 17:06 | |
| *** lhcheng has joined #openstack-keystone | 17:07 | |
| *** ChanServ sets mode: +v lhcheng | 17:07 | |
| miguelgrinberg | marekd: are you around for a question on SSO metadata for federation? | 17:07 |
| *** samueldmq has quit IRC | 17:08 | |
| *** mylu has joined #openstack-keystone | 17:08 | |
| *** samueldmq has joined #openstack-keystone | 17:08 | |
| *** lhcheng_ has joined #openstack-keystone | 17:08 | |
| *** mylu has quit IRC | 17:10 | |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Centralizing build_role_assignment_* functions https://review.openstack.org/197184 | 17:11 |
| *** lhcheng has quit IRC | 17:11 | |
| chenhong | dstanek: Can you review this new change, https://review.openstack.org/#/c/197184/ ? | 17:12 |
| dstanek | chenhong: sure, i'll add it to my list | 17:13 |
| chenhong | dstanek: thanks. I make the previous one depend on this new patch | 17:14 |
| *** jasondotstar has quit IRC | 17:15 | |
| *** piyanai has quit IRC | 17:17 | |
| *** ankita_wagh has joined #openstack-keystone | 17:19 | |
| *** jsavak has joined #openstack-keystone | 17:20 | |
| *** richm has quit IRC | 17:21 | |
| *** amaretskiy has quit IRC | 17:21 | |
| roxanaghe | dstanek, for https://review.openstack.org/#/c/180769/ -> I think 'project' should be 'unknown' (as per my last comment). do you mind if I upload a new patch to change that? | 17:21 |
| *** ngupta has joined #openstack-keystone | 17:22 | |
| roxanaghe | I want to move that patch forward, since it's been sitting silently there for too long :) | 17:22 |
| *** kiran-r has quit IRC | 17:22 | |
| *** dguerri is now known as dguerri` | 17:25 | |
| *** jasondotstar has joined #openstack-keystone | 17:25 | |
| *** htruta_ has joined #openstack-keystone | 17:25 | |
| *** mylu has joined #openstack-keystone | 17:27 | |
| topol | morganfainberg. Done! | 17:32 |
| morganfainberg | topol: told ya that'd be an easy one | 17:32 |
| topol | :-) | 17:32 |
| *** jsavak has quit IRC | 17:33 | |
| *** jsavak has joined #openstack-keystone | 17:35 | |
| openstackgerrit | Merged openstack/keystone-specs: Cleanup and removal of StrictABC requirement https://review.openstack.org/195347 | 17:36 |
| mylu | Hi guys I am trying to set up K2K federation in kilo with devstack I'm confused about the difference between port 5000 and 35357. when should I use which? Thanks in advance! | 17:36 |
| *** navid__ has quit IRC | 17:36 | |
| *** richm has joined #openstack-keystone | 17:37 | |
| *** kiran-r has joined #openstack-keystone | 17:37 | |
| mylu | I'm following rodrigods' tutorial (http://blog.rodrigods.com/it-is-time-to-play-with-keystone-to-keystone-federation-in-kilo/) | 17:37 |
| marekd | miguelgrinberg: hi, i am here. | 17:38 |
| stevemar | mylu: just port 5000 | 17:39 |
| miguelgrinberg | marekd: Hi, I'm trying to implement keystone-to-keystone federation for the os-ansible-deployment project | 17:39 |
| miguelgrinberg | marekd: have the ECP workflow working perfectly, but I'm stuck on getting Horizon to work | 17:39 |
| *** diazjf has quit IRC | 17:40 | |
| rodrigods | miguelgrinberg, K2K isn't available for Horizon yet | 17:40 |
| rodrigods | (just the regular Federation) | 17:40 |
| miguelgrinberg | oh, so I can't have a Horizon authenticating to a Keystone IdP yet? | 17:40 |
| marekd | miguelgrinberg: not with k2k. | 17:41 |
| rodrigods | miguelgrinberg, there is a WIP for it: https://review.openstack.org/#/c/159910/ | 17:41 |
| *** rlt_ has quit IRC | 17:41 | |
| *** tqtran has joined #openstack-keystone | 17:41 | |
| stevemar | morganfainberg: might be a bit late for the keystone meeting | 17:42 |
| morganfainberg | np | 17:42 |
| marekd | miguelgrinberg: the problem is keystoneclient not handling multiple tokens at once. | 17:42 |
| marekd | miguelgrinberg: it's a longer transition process.... | 17:42 |
| *** dramakri has joined #openstack-keystone | 17:42 | |
| miguelgrinberg | marekd: okay, but I seem to be having a more basic problem, though now it may be pointless to discuss it since clearly I won't be able to get this working anyway | 17:43 |
| mylu | stevemar: Even for the auth_url when trying create SP in IdP? rodigods' blog says the auth_url should be the protocol url in SP which is using 35357 tho..(maybe I did something wrong when I create the protocol) | 17:43 |
| *** jecarey has quit IRC | 17:43 | |
| stevemar | mylu: the auth url should be 5000 | 17:43 |
| marekd | mylu: port is unrelated in this case, really 5000 is enough | 17:44 |
| marekd | miguelgrinberg: what's your problem then? | 17:44 |
| mylu | stevemar: cool thanks | 17:44 |
| miguelgrinberg | marekd: this is where you generate the SSO metadata, which uses a URI binding: https://github.com/openstack/keystone/blame/8bb63620b4d9ec71b0a60ed705938103d7d3c2c2/keystone/contrib/federation/idp.py#L490 | 17:44 |
| miguelgrinberg | marekd: and this is where shibboleth looks for bindings: https://github.com/craigpg/shibboleth-sp2/blob/f62a7996e195a9c026f3f8cb0e9086594b7f8515/shibsp/handler/impl/SAML2SessionInitiator.cpp#L164-L165 | 17:44 |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Add testcases for list_role_assignments of v3 domains https://review.openstack.org/187899 | 17:45 |
| miguelgrinberg | marekd: it looks for a few binding types, but not the URI type that Keystone generates in the IdP metadata | 17:45 |
| *** kiran-r has quit IRC | 17:45 | |
| marekd | miguelgrinberg: are you talking now about ECP or websso flow? | 17:45 |
| *** mgarza_ has joined #openstack-keystone | 17:46 | |
| miguelgrinberg | marekd: this is websso flow | 17:46 |
| miguelgrinberg | sorry if I didn't make myself clear before | 17:46 |
| marekd | miguelgrinberg: no problem. | 17:46 |
| miguelgrinberg | ECP flow works fine for me | 17:46 |
| chenhong | dstanek: I already done with the first change, please review it again. https://review.openstack.org/#/c/187899/9 | 17:47 |
| * kfox1111 beets his head on the desk. | 17:48 | |
| marekd | miguelgrinberg: ok, can you file a bug and assign it to me? I don't think we will fix this immediately, because we don't support k2k w/ websso flow, but we can mark it as wishlist. | 17:48 |
| kfox1111 | securely getting a secret to an instance so it can get secrets is hard. especially when there are so many different types of instances. :/ | 17:48 |
| miguelgrinberg | marekd: yep, certainly will. Thanks! | 17:49 |
| kfox1111 | and barbican only seems to support async certificate creation. which means I really need an authentication channel that can be used repeatedly for a while. | 17:49 |
| *** lsmola has quit IRC | 17:49 | |
| marekd | miguelgrinberg: you can examine a WIP rodrigods posted and see if it makes any use for you. | 17:50 |
| kfox1111 | implying I need an instance cert that is needed to be able to fetch the keystone cert. :/ | 17:50 |
| rm_work | kfox1111: we were looking at anchor for ephemeral syncronously created certs for this purpose in Octavia | 17:50 |
| rm_work | might fit your use-case? | 17:50 |
| kfox1111 | interesting. | 17:50 |
| kfox1111 | did you end up using it? | 17:50 |
| rm_work | not yet | 17:51 |
| kfox1111 | think it will work? | 17:51 |
| rm_work | we're still using a local implementation based on openSSL | 17:51 |
| rm_work | but I think it'll work | 17:51 |
| openstackgerrit | Merged openstack/python-keystoneclient: Support /auth routes for list projects and domains https://review.openstack.org/168792 | 17:52 |
| kfox1111 | I was kind of thinking maybe the instance creates its own self signed cert, contacts the instance user service with the cert and says handshake me... then after the instance proves it is who it says it is, it can use its own cert to talk to just the instance user service to fetch the keystone certificate until its ready. then once it is retrieved the cert is no longer trusted. | 17:52 |
| rm_work | seems like ephemeral certs would be ok for that | 17:53 |
| rm_work | our case needed to throw away the ephemeral piece | 17:53 |
| rm_work | which made using Anchor an odd choice :P but I was still planning to try | 17:53 |
| miguelgrinberg | marekd: that patch may be useful later, but at this point I'm stuck at the very beginning of the flow with this shibboleth problem, the redirect from horizon to the websso endpoint fails auth | 17:53 |
| kfox1111 | yeah. seems like overkill to centeralize the service though. since each vm would then need a way to securely get the ephemeral cert and we're all the way back around. | 17:54 |
| marekd | miguelgrinberg: for the clarity, we are still talking k2k ? | 17:55 |
| kfox1111 | in wsgi, can you programatically hook a url pattern to a CA? | 17:55 |
| *** jecarey has joined #openstack-keystone | 17:56 | |
| *** chenhong has quit IRC | 17:56 | |
| miguelgrinberg | marekd: still k2k, that's all I'm doing. We are also working on ADFS as an IdP, but I have personally not worked on that. | 17:56 |
| kfox1111 | like /v1/auth/getcert/<instanceuuid> will look up the ca associated with the instanceuuid in a db, and then ensure only that ca's allowed that endpoint? | 17:56 |
| *** chlong has quit IRC | 17:56 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Dynamic Policies Fetch and Cache https://review.openstack.org/134655 | 17:56 |
| marekd | miguelgrinberg: we support ADFS, and we use it at CERN with success. | 17:57 |
| samueldmq | ayoung: morganfainberg ^ going to the keystone server one (post-meeting) :) | 17:57 |
| miguelgrinberg | marekd: but it does not work from Horizon due to the token problem that rodrigods is working on his patch, correct? | 17:58 |
| samueldmq | ayoung: I've put myself as primary assignee as I already have patches for that | 17:58 |
| marekd | miguelgrinberg: ADFS is not K2K at all.... | 17:58 |
| samueldmq | ayoung: https://review.openstack.org/#/c/188561/ ... btw, which is now in merge conflict :( | 17:58 |
| *** fangzhou has joined #openstack-keystone | 17:58 | |
| *** shaleh has joined #openstack-keystone | 17:58 | |
| miguelgrinberg | marekd: okay, I see. The token issue is specific to K2K. | 17:58 |
| *** e0ne has joined #openstack-keystone | 17:58 | |
| marekd | miguelgrinberg: let me put this way: Keystone-SP + some 1-st class IdP like ADFS, Shibboleth_idp will work for ya via cli (based on SAML ECP) and websso. | 17:58 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Switch from deprecated oslo_utils.timeutils.strtime https://review.openstack.org/196853 | 17:58 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Unit tests catch deprecated function usage https://review.openstack.org/189145 | 17:58 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Switch from deprecated isotime https://review.openstack.org/189147 | 17:58 |
| marekd | miguelgrinberg: what we *dont* have is K2K with Horizon. | 17:59 |
| samueldmq | it's time ! :-) | 17:59 |
| miguelgrinberg | marekd: got it. I've only been doing K2K, but good to know we'll be able to get ADFS going at least. | 17:59 |
| marekd | miguelgrinberg: we will all go to openstack-meeting for our weekly meeting, so i will be slower in response for next hour. | 18:00 |
| marekd | miguelgrinberg: feel invited to the meeting if you fancy | 18:00 |
| *** jsavak has quit IRC | 18:01 | |
| miguelgrinberg | marekd: thanks | 18:01 |
| *** henrynash has joined #openstack-keystone | 18:01 | |
| *** ChanServ sets mode: +v henrynash | 18:01 | |
| marekd | miguelgrinberg: also note that Keystone-idp is not a fully fledged SAML IdP | 18:01 |
| marekd | so no redirects at this moment. | 18:01 |
| *** mylu has quit IRC | 18:01 | |
| *** mylu has joined #openstack-keystone | 18:02 | |
| marekd | miguelgrinberg: so, i'd imagine a auth plugin in horizon must simply work as K2K auth plugin in keystoneauth - swap the local token for sAML assertion, go to the remote SP, get token, scope and start using.... | 18:02 |
| marekd | miguelgrinberg: it will not be "yet another websso workflow" with all those HTTP 302 calls etc. | 18:03 |
| marekd | there is K2K plugin that works, so i would expect django_openstack_auth wrk in a similar manner. | 18:03 |
| marekd | miguelgrinberg: https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/auth/identity/v3/k2k.py | 18:04 |
| *** e0ne is now known as e0ne_ | 18:04 | |
| *** ankita_w_ has joined #openstack-keystone | 18:05 | |
| marekd | david8hu: sitting next to gyee? | 18:05 |
| marekd | tell him i think there is a way to get rid of stickyness on HaProxy balaning load to Shibboleth service providers :P | 18:06 |
| miguelgrinberg | marekd: I have seen the K2K plugin, it was actually very helpful in understanding how everything works. | 18:06 |
| *** geoffarnold has quit IRC | 18:06 | |
| marekd | miguelgrinberg: OK | 18:06 |
| *** ankita_w_ has quit IRC | 18:06 | |
| marekd | :-) | 18:06 |
| *** ankita_w_ has joined #openstack-keystone | 18:06 | |
| *** e0ne_ is now known as e0ne | 18:07 | |
| *** ankita_wagh has quit IRC | 18:08 | |
| miguelgrinberg | marekd: but we'll want to wait for upstream support for Horizon K2K, or help with the effort | 18:08 |
| *** ajayaa_ has quit IRC | 18:08 | |
| marekd | miguelgrinberg: well, feel free to work on a prototypr and get back to the community. | 18:09 |
| marekd | it's fine we may want to merge it and everybody will be happy. | 18:10 |
| marekd | if it's fine [...] | 18:10 |
| *** diazjf has joined #openstack-keystone | 18:13 | |
| lbragstad | bknudson: morganfainberg oslo.policy and oslo.cache have been added to our weekly report http://keystone-weekly-bug-report.tempusfrangit.org/weekly-bug-reports/keystone-weekly-bug-report.html | 18:13 |
| *** ericksonsantos has joined #openstack-keystone | 18:14 | |
| *** tellesnobrega_ has joined #openstack-keystone | 18:15 | |
| *** anhhuynx has joined #openstack-keystone | 18:15 | |
| *** e0ne is now known as e0ne_ | 18:18 | |
| *** rushiagr is now known as rushiagr_away | 18:18 | |
| *** tellesnobrega_ has quit IRC | 18:20 | |
| kfox1111 | well... Actually, the randomly generated string I use for authenticating the vm can continue to be used.... that should work... just gota store it. | 18:20 |
| *** e0ne_ is now known as e0ne | 18:23 | |
| *** gyee has joined #openstack-keystone | 18:24 | |
| *** ChanServ sets mode: +v gyee | 18:24 | |
| *** htruta_ has quit IRC | 18:26 | |
| *** jasondotstar has quit IRC | 18:27 | |
| mylu | Hi guys, I see this error when I try to do assertion exchange for federation "2015-06-30 18:24:22 WARN Shibboleth.SSO.SAML2 [2]: no metadata found, can't establish identity of issuer (http://128.52.181.124:5000/v3/OS-FEDERATION/saml2/idp)" But I do have MetadataProvider set up in shibboleth2.xml... | 18:29 |
| *** topol has quit IRC | 18:30 | |
| marekd | mylu: how exactly is it set? | 18:30 |
| *** topol has joined #openstack-keystone | 18:30 | |
| *** ChanServ sets mode: +v topol | 18:30 | |
| mylu | marekd: <MetadataProvider type="XML" uri="https://128.52.181.124:5000/v3/OS-FEDERATION/saml2/metadata"/> | 18:31 |
| *** ngupta has quit IRC | 18:32 | |
| marekd | mylu: you have https here... | 18:33 |
| marekd | is it correct? | 18:33 |
| marekd | log says 'http' on the other hand. | 18:34 |
| mylu | ohhhhh! | 18:34 |
| mylu | let me try it that's so silly | 18:34 |
| marekd | mylu: make sure you can access that link via curl, broweser whatever... | 18:34 |
| marekd | and then paste to the config. | 18:34 |
| *** ankita_wagh has joined #openstack-keystone | 18:38 | |
| *** ankita_w_ has quit IRC | 18:39 | |
| mylu | marekd: shibboleth log still says no metadata found, but its something different this time. I tried curl "http://128.52.181.124:5000/v3/OS-FEDERATION/saml2/metadata", it worked | 18:41 |
| mylu | shibboleth log says "building MetadataProvider of type XML" and then no metadata found.. | 18:42 |
| morganfainberg | yeesh boston hotels are priiiiicy | 18:42 |
| mylu | "2015-06-30 18:35:43 INFO Shibboleth.Application : building MetadataProvider of type XML" | 18:42 |
| marekd | mylu: what's in the shibboleth2.xml ? | 18:43 |
| marekd | <MetadataProvider> | 18:43 |
| openstackgerrit | Jason Obrien proposed openstack/keystone: Removed all mentions of keystone-all from installing.rst and developing.rst docs. https://review.openstack.org/197225 | 18:43 |
| mylu | "2015-06-30 18:35:43 WARN OpenSAML.MessageDecoder.SAML2 [3]: no metadata found, can't establish identity of issuer (http://128.52.181.124:5000/v3/OS-FEDERATION/saml2/idp" | 18:43 |
| mylu | marekd: yes | 18:44 |
| marekd | mylu: i am asking "what is in the shibboleth2.xml?" | 18:44 |
| mylu | marekd: "<MetadataProvider type="XML" uri="http://128.52.181.124:5000/v3/OS-FEDERATION/saml2/metadata"/>" | 18:44 |
| marekd | and entityId ? | 18:45 |
| marekd | is it equal to the value configured in keystone-idp in keystone.conf ? | 18:45 |
| mylu | marekd: ohhh wait the entity id was in https | 18:45 |
| mylu | let me change it to http and try again thanks a lot! | 18:45 |
| *** geoffarnold has joined #openstack-keystone | 18:46 | |
| miguelgrinberg | marekd: bug filed: https://bugs.launchpad.net/keystone/+bug/1470205 | 18:47 |
| openstack | Launchpad bug 1470205 in Keystone "Keystone IdP SAML metadata insufficient for websso flow" [Undecided,New] | 18:47 |
| marekd | miguelgrinberg: ok, thanks. | 18:51 |
| *** jasondotstar has joined #openstack-keystone | 18:55 | |
| samueldmq | o/ | 18:59 |
| *** browne has quit IRC | 19:00 | |
| samueldmq | so whether creating a separate middleware or not can be decided with a #vote next meeting | 19:00 |
| samueldmq | morganfainberg: ^ | 19:00 |
| morganfainberg | sure. | 19:00 |
| samueldmq | when we'll have all the specs updated, people will have had a change to get familiar | 19:01 |
| samueldmq | and FFE email already sent | 19:01 |
| marekd | jamielennox: can you remind me what what the link to your change where you changed gate jobs to not fail on missing requirements (ksa) ? | 19:01 |
| samueldmq | (it only left the keystone server one to be updated though :)) | 19:01 |
| henrynash | any cores want to take a quick look at https://review.openstack.org/#/c/187045/ which is looking for approval… | 19:02 |
| jamielennox | marekd: https://review.openstack.org/#/c/186228/ | 19:02 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Separate setting catalog on headers from others https://review.openstack.org/196932 | 19:02 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Add user_token and service_token to request https://review.openstack.org/196949 | 19:02 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Add token_auth helper to request https://review.openstack.org/196950 | 19:02 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Move enforcement and time validation to base class https://review.openstack.org/196951 | 19:02 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Move common request processing to base class https://review.openstack.org/180818 | 19:02 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Separate the fetch and validate parts of auth_token https://review.openstack.org/190940 | 19:02 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't cache signed tokens https://review.openstack.org/190941 | 19:02 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Create a simple base class from AuthProtocol https://review.openstack.org/180816 | 19:02 |
| morganfainberg | reminder for those who are in the US (and for those not) - July 4th is observed on Friday | 19:02 |
| morganfainberg | go out and enjoy yourself if you're having the day off. | 19:03 |
| morganfainberg | if you're not in the US - sorry, it's going to be very very quiet :P | 19:03 |
| raildo | :( | 19:03 |
| jamielennox | oh - that's happening again | 19:03 |
| morganfainberg | yeah the whole us holiday in the middle of our summer thing | 19:04 |
| samueldmq | henrynash: hi | 19:04 |
| marekd | jamielennox: hmm, so what shall i specify wrt thiat patch: https://review.openstack.org/#/c/190631/ keystoneauth_integration too ? | 19:04 |
| samueldmq | henrynash: not core but want to talk about that :) | 19:04 |
| morganfainberg | jamielennox: it doens't quite make up for the complete lack of vacation policy/sanity the us has. | 19:04 |
| henrynash | samueldmq: hi | 19:04 |
| jamielennox | morganfainberg: it's more i always forget that it's on and wonder why no-one is around | 19:04 |
| samueldmq | henrynash: so the idea is to list role assignments starting from a parent project | 19:05 |
| samueldmq | henrynash: how does that relate to effective ? | 19:05 |
| henrynash | samueldmq: yes | 19:05 |
| *** ChanServ changes topic to "US Independence Day is observed 7/3 (Friday) - expect it to be quiet while people are out." | 19:05 | |
| morganfainberg | jamielennox: ^ :P | 19:05 |
| henrynash | samueldmq: so I think it is a valid call with and without effective | 19:05 |
| ayoung | henrynash, looking | 19:06 |
| henrynash | (Henry off to sulk on 7/3 since we lost that one….) | 19:06 |
| jamielennox | lol | 19:06 |
| *** ChanServ changes topic to "| Review Code, Specs, Etc | Keystone MidCycle 15, 16, 17 | US Independence Day is observed 7/3 (Friday)" | 19:06 | |
| samueldmq | henrynash: hmm, so that's about considering *direct* assignments on the root and subproject | 19:06 |
| samueldmq | henrynash: applying effective or not is optional | 19:07 |
| henrynash | samueldmq: yes | 19:07 |
| morganfainberg | we're going to be at the midcycle during the openstack 5th birthday party | 19:07 |
| ayoung | henrynash, did the question of reseller come up with that, and the answer is : "if the roles no longer apply, you get nothing, s it just works." I suspect? | 19:07 |
| morganfainberg | jamielennox: travel for pyconau is set. need to do hotel-y-things | 19:07 |
| samueldmq | henrynash: k makes sense | 19:07 |
| jamielennox | morganfainberg: oh right, when are you coming in | 19:07 |
| morganfainberg | jamielennox: how is the transportation in town? as in... taxi, uber, etc? | 19:07 |
| samueldmq | henrynash: I am sorry for not updating the list role assignments refactoring yet | 19:08 |
| jamielennox | alhtough not sure if i can come up early anyway | 19:08 |
| henrynash | ayoung: when you say “if the roles no longer apply”….what do you mean…there is an opagque boundary | 19:08 |
| samueldmq | henrynash: dstanek asked for a split on that patch | 19:08 |
| morganfainberg | jamielennox: i'm landing the 31th of july and leaving on uh... the following friday? | 19:08 |
| morganfainberg | aug 8 | 19:08 |
| samueldmq | henrynash: I will run with that .. | 19:08 |
| jamielennox | uber is around but i've never tried it from the airport | 19:08 |
| morganfainberg | jamielennox: i can do taxis | 19:08 |
| jamielennox | the airport train is pretty good so i normally just do that - but that's when i'm paying | 19:08 |
| samueldmq | henrynash: having the refactored code will be better to the one who will implement that spec + to me (so I won't need to refactor it again) | 19:08 |
| samueldmq | henrynash: if that makes sense .. | 19:09 |
| morganfainberg | jamielennox: i just want to avoid renting a car and dealing with international driving in general if the city isn't too bad to navigate | 19:09 |
| henrynash | samueldmq: abso-bloody-lutely (to quote Dame Helen Mirran) | 19:09 |
| jamielennox | it's pretty easy to get around the city, depends what you want to do in terms of whether a hire is worth it | 19:09 |
| samueldmq | morganfainberg: LA should be a small city | 19:09 |
| jamielennox | but fair warning hiring cars here is more expensive | 19:09 |
| samueldmq | morganfainberg: so that's ok I think :p0 | 19:09 |
| samueldmq | :) | 19:09 |
| morganfainberg | jamielennox: eh | 19:10 |
| morganfainberg | jamielennox: if it's needed for business stuffs... it's fine | 19:10 |
| *** geoffarnold has quit IRC | 19:10 | |
| *** henrynash has quit IRC | 19:10 | |
| samueldmq | henrynash: haha :) | 19:10 |
| samueldmq | oops 'henrynash has quit' :( | 19:10 |
| *** ankita_wagh has quit IRC | 19:11 | |
| * morganfainberg has quit. | 19:11 | |
| morganfainberg | >.> | 19:11 |
| morganfainberg | <.< | 19:11 |
| *** dguerri` is now known as dguerri | 19:11 | |
| morganfainberg | do you believe it? | 19:11 |
| *** ankita_wagh has joined #openstack-keystone | 19:11 | |
| samueldmq | bye | 19:11 |
| samueldmq | morganfainberg: hi <.< | 19:13 |
| *** e0ne is now known as e0ne_ | 19:14 | |
| samueldmq | oops 'morganfainberg has quit' :( | 19:14 |
| *** jorge_munoz has quit IRC | 19:14 | |
| *** morganfainberg has left #openstack-keystone | 19:14 | |
| *** morganfainberg has joined #openstack-keystone | 19:14 | |
| *** ChanServ sets mode: +v morganfainberg | 19:14 | |
| samueldmq | he took that seriously | 19:14 |
| samueldmq | 16:15:30 samueldmq | he took that seriously | 19:14 |
| *** e0ne_ is now known as e0ne | 19:15 | |
| *** dguerri is now known as dguerri` | 19:15 | |
| jamielennox | morganfainberg: my current thought for the federation stuff at pycon is: live demo :) | 19:15 |
| morganfainberg | fun | 19:16 |
| morganfainberg | my current thought on the future of keystone is... uhhh i need to go get food before thinking about this | 19:16 |
| jamielennox | morganfainberg: do you know anyone that could get me some helion vms that i could do it on? | 19:16 |
| jamielennox | i don't want to fight with VPNs as well as demo gods | 19:16 |
| morganfainberg | jamielennox: uhm... you mean public cloud? or you mean something just in isolation [devstack-y], or? | 19:17 |
| jamielennox | morganfainberg: atm i was thinking at least 2 public, maybe 3 | 19:17 |
| *** yottatsa has joined #openstack-keystone | 19:17 | |
| *** mgarza_ has quit IRC | 19:18 | |
| morganfainberg | jamielennox: so.. you'd use the VMs as ... a devstack/isolated deploy | 19:18 |
| anhhuynx | jamielennox: would you please take a look at this bug https://bugs.launchpad.net/keystone/+bug/1460492 and clarify something for me? | 19:18 |
| openstack | Launchpad bug 1460492 in Keystone "List credentials by type" [Wishlist,Triaged] - Assigned to Anh Huynh (anhx-huynh) | 19:18 |
| morganfainberg | or you wanted to use a public cloud with federated auth | 19:18 |
| morganfainberg | to spin up VMs? | 19:18 |
| jamielennox | i was going to take packstack rather than devstack | 19:18 |
| morganfainberg | cause that second one is a lot of work [having done this in the past] | 19:18 |
| morganfainberg | i can porbably get you a vm or two though | 19:18 |
| jamielennox | and then IPA/ipsilon for saml | 19:18 |
| morganfainberg | ah ok | 19:18 |
| morganfainberg | yeah i can probably do that | 19:19 |
| morganfainberg | i need to spin up my cloud account anyway | 19:19 |
| jamielennox | not sure yet if it's worth splitting the IPA/ipsilon machines for demo purposes | 19:19 |
| yottatsa | hi everybody! | 19:19 |
| *** mylu has quit IRC | 19:19 | |
| morganfainberg | so we can piggyback this demo on that. | 19:19 |
| *** jorge_munoz has joined #openstack-keystone | 19:19 | |
| jamielennox | morganfainberg: i called it 'practical' federation for some reason | 19:19 |
| morganfainberg | i called mine something stupidly boring | 19:19 |
| morganfainberg | like "the future of identity in openstack (keystone)" | 19:20 |
| *** piyanai has joined #openstack-keystone | 19:20 | |
| *** jorge_munoz has quit IRC | 19:20 | |
| * yottatsa just benchmarked fernet and it's REALLY great thing | 19:21 | |
| dstanek | hmmm...i didn't know this, but apparently we shouldn't be using the config fixture to set any library config values anymore | 19:21 |
| jamielennox | but i was thinking if i had most of it ready i could pretty much start from scratch and configure a mapping, do the httpd config etc | 19:21 |
| *** dramakri has quit IRC | 19:22 | |
| jamielennox | go through the steps etc | 19:22 |
| jamielennox | never having done a demo presentation like that /me thinks - how hard can it be? | 19:22 |
| *** mylu has joined #openstack-keystone | 19:22 | |
| jamielennox | anhhuynx: i'm not ignoring you, just reading through the bug | 19:22 |
| yottatsa | here is a question: is slave_connection in keystone really using anywhere? | 19:22 |
| anhhuynx | jamielennox: thank you :) | 19:23 |
| *** jorge_munoz has joined #openstack-keystone | 19:23 | |
| *** geoffarnold has joined #openstack-keystone | 19:23 | |
| morganfainberg | dstanek: ? so... how do we handle that? | 19:23 |
| morganfainberg | dstanek: this seems like we've got a gap. | 19:23 |
| dstanek | morganfainberg: talking about it now in #openstack-oslo | 19:23 |
| * morganfainberg goes to get lunch. | 19:23 | |
| yottatsa | grep -r use_slave . | wc -l | 19:24 |
| yottatsa | 0 | 19:24 |
| kfox1111 | morganfainberg: just added some light reading for you to eat lunch by. ;) | 19:24 |
| kfox1111 | just took a stab at coming up with an initial implementation that covers everything in the problem description. | 19:24 |
| *** piyanai has quit IRC | 19:25 | |
| *** jsavak has joined #openstack-keystone | 19:26 | |
| yottatsa | I can't find any blueprint about it, should I make new? | 19:26 |
| jamielennox | anhhuynx: i replied on the bug - does that make more sense? | 19:30 |
| *** rm_work is now known as rm_work|away | 19:31 | |
| *** rm_work|away is now known as rm_work | 19:33 | |
| *** crc32 has joined #openstack-keystone | 19:33 | |
| anhhuynx | jamielennox: thank you Jamie, I'll keep working on this with the new information. | 19:33 |
| jamielennox | anhhuynx: np - bug me if you have any more questions, i'm happy to step you through what will be required | 19:35 |
| jamielennox | anhhuynx: however i'm based in Australia so this is the only day of the week i'm around at this time, but mostly people around here are friendly | 19:35 |
| openstackgerrit | Jason Obrien proposed openstack/keystone: Updated files for Keystone startup https://review.openstack.org/197225 | 19:36 |
| *** jorge_munoz has quit IRC | 19:37 | |
| dstanek | gyee: the short answer to your question on https://review.openstack.org/#/c/196917/ is no. the move to oslo_policy broke running tests by name | 19:38 |
| *** dramakri has joined #openstack-keystone | 19:39 | |
| anhhuynx | jamielennox: Would you please advise me on how to start with this? It appears that I have been going about this the wrong way, and I have no idea how to even use the v3 keystone API. If you don't mind can you point me to some reading materials? | 19:40 |
| breton | btw | 19:42 |
| breton | I was able to use fernet tokens with juno openstack and kilo keystone | 19:43 |
| breton | (well, and kilo middleware and client) | 19:43 |
| *** shaleh has quit IRC | 19:43 | |
| jamielennox | anhhuynx: hmm reading material for keystone v3... | 19:43 |
| breton | everything was good except with horizon. There is a bug in juno which is fixed in kilo | 19:44 |
| jamielennox | anhhuynx: so i guess there are multiple ways to interact and it depends what you are looking for | 19:46 |
| jamielennox | anhhuynx: so keystone provides a REST API for how to interact with it which is defined https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3.rst | 19:46 |
| dramakri | anhhuynx: some simple v3 api examples from ayoung's blog - http://adam.younglogic.com/2013/09/keystone-v3-api-examples/ | 19:46 |
| jamielennox | anhhuynx: to communicate with that you can use curl or whatever you like that talks http | 19:47 |
| anhhuynx | Thank you very much! | 19:47 |
| *** tqtran is now known as tqtran-afk | 19:47 | |
| jamielennox | we provide keystoneclient which is a python library that provides a way to talk python and have the library make calls for you | 19:47 |
| jamielennox | documentation is a bit scarse but: http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html | 19:48 |
| jamielennox | then openstack client is an application that you can call from the command line which consumes keystoneclient internally | 19:48 |
| *** jsavak has quit IRC | 19:49 | |
| jamielennox | so i guess it depends how you want to use it | 19:50 |
| jamielennox | anhhuynx: regarding how you go about implementing it, first you would need to update the identity-api-v3 document above to add a new type parameter to the list credentials | 19:51 |
| *** Rockyg has joined #openstack-keystone | 19:51 | |
| jamielennox | then you need to add it to keystone itself so that when type= is passed it filters the results | 19:51 |
| jamielennox | then add it to keystoneclient and maybe openstackclient | 19:52 |
| anhhuynx | jamielennox: Isn't the identity-api-v3 document above just documentation? | 19:54 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Dynamic Policies Fetch and Cache https://review.openstack.org/134655 | 19:54 |
| anhhuynx | Would updating it change anything? | 19:54 |
| jamielennox | anhhuynx: we consider that doc to be the complete list of what keystone can do and it's where we nitpick over the high level change | 19:55 |
| jamielennox | so no, changing it won't actually do anything but people won't let you merge the keystone review until the spec change has been approved | 19:55 |
| anhhuynx | Ok, so if I want to add any functionality I better be documenting it? | 19:55 |
| jamielennox | in this case it's really unlikely anyone will say no to the change so you can absolutely work on all of this in parallel | 19:56 |
| *** shaleh has joined #openstack-keystone | 19:56 | |
| jamielennox | yep, if it's part of the public API it has to exist in that doc | 19:56 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/196485 | 19:57 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/197254 | 19:57 |
| *** browne has joined #openstack-keystone | 19:58 | |
| anhhuynx | jamielennox: Thank you for the help! I'll try to mull over all the information. | 19:58 |
| jamielennox | anhhuynx: np - and as mentioned come back and ask if you have questions | 19:59 |
| *** arunkant has joined #openstack-keystone | 19:59 | |
| *** topol has quit IRC | 19:59 | |
| *** amakarov is now known as amakarov_away | 20:01 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf: Updated from global requirements https://review.openstack.org/197270 | 20:02 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/197277 | 20:03 |
| *** ankita_w_ has joined #openstack-keystone | 20:03 | |
| *** shaleh has quit IRC | 20:03 | |
| *** ankita_w_ has quit IRC | 20:03 | |
| *** shaleh has joined #openstack-keystone | 20:03 | |
| *** jorge_munoz has joined #openstack-keystone | 20:04 | |
| *** ankita_w_ has joined #openstack-keystone | 20:04 | |
| *** jasondotstar has quit IRC | 20:05 | |
| *** ankita_wagh has quit IRC | 20:07 | |
| *** gokrokve has joined #openstack-keystone | 20:10 | |
| lbragstad | morganfainberg: following back up the on the token expiry fix | 20:15 |
| *** mrutkows has quit IRC | 20:15 | |
| lbragstad | morganfainberg: I had to run when you were starting to explain it | 20:15 |
| lbragstad | morganfainberg: you were saying that it should only be included in the tests? | 20:16 |
| morganfainberg | lbragstad: we should just squash microseconds for the test. We unfortunately can't squash microseconds with pki tokens. | 20:16 |
| morganfainberg | Actually.. We might be able to now. | 20:17 |
| lbragstad | morganfainberg: you mean this tests? https://review.openstack.org/#/c/196475/2/keystone/tests/unit/test_v2.py | 20:17 |
| morganfainberg | Wth audit Ida | 20:17 |
| lbragstad | s/tests/tests/ | 20:17 |
| morganfainberg | Ids* | 20:17 |
| morganfainberg | let me get food. | 20:17 |
| lbragstad | morganfainberg: ok, ping me when you're ready | 20:17 |
| morganfainberg | I'm getting breakfast/lunch at 1pm | 20:17 |
| morganfainberg | :P | 20:17 |
| lbragstad | morganfainberg: I'm just stepping through the chain of patches you have up for it | 20:18 |
| *** yottatsa has quit IRC | 20:20 | |
| *** yottatsa has joined #openstack-keystone | 20:21 | |
| *** henrynash has joined #openstack-keystone | 20:23 | |
| *** ChanServ sets mode: +v henrynash | 20:23 | |
| *** piyanai has joined #openstack-keystone | 20:24 | |
| *** mgarza has joined #openstack-keystone | 20:31 | |
| *** e0ne has quit IRC | 20:35 | |
| *** piyanai has quit IRC | 20:38 | |
| *** amit213 has quit IRC | 20:44 | |
| *** amit213 has joined #openstack-keystone | 20:44 | |
| *** amit213 has quit IRC | 20:44 | |
| *** fangzhou has quit IRC | 20:44 | |
| *** jaosorior has quit IRC | 20:46 | |
| *** yottatsa has quit IRC | 20:46 | |
| *** Ephur has quit IRC | 20:50 | |
| *** Ephur has joined #openstack-keystone | 20:54 | |
| openstackgerrit | Jason Obrien proposed openstack/keystone: Updated docs for Keystone startup https://review.openstack.org/197225 | 20:54 |
| *** Ephur_ has joined #openstack-keystone | 20:55 | |
| *** radez is now known as radez_g0n3 | 20:58 | |
| *** stevemar has quit IRC | 20:58 | |
| *** Ephur has quit IRC | 20:59 | |
| gyee | dstanek, so even the policy tests depends on Rule.init()? | 21:02 |
| *** jorge_munoz has quit IRC | 21:02 | |
| openstackgerrit | Jason Obrien proposed openstack/keystone: Updated docs for Keystone startup https://review.openstack.org/197225 | 21:02 |
| dstanek | gyee: i really don't know what depends on that, but the fact that we are doing it is what breaks us | 21:03 |
| *** jorge_munoz has joined #openstack-keystone | 21:03 | |
| dstanek | morganfainberg: so it appears that what i want to do (add oslo_policy.opts.register) isn't inline with the vision of oslo | 21:04 |
| gyee | dstanek, yeah, for one thing, you are calling an internal API :) | 21:04 |
| *** piyanai has joined #openstack-keystone | 21:04 | |
| gyee | let me dig into that a bit more, I think all you have to do is initialize CONF | 21:05 |
| gyee | and oslo will scan for the policy.json automatically | 21:05 |
| dstanek | morganfainberg: the problem is that you can't do what they want yet - Doug is trying to give the config fixture a set_default() method so that the projects are not directly tied to config options | 21:05 |
| dstanek | morganfainberg: i don't see how that is really beneficial, but we're going to discuss it more tomorrow | 21:06 |
| dstanek | gyee: yes, you have to get the oslo.policy options registered | 21:06 |
| morganfainberg | ...ok | 21:06 |
| dstanek | gyee: are you thinking that you shouldn't have to register the options? | 21:07 |
| gyee | you should | 21:07 |
| gyee | what I am saying is that you first need to initialize CONF | 21:07 |
| gyee | global CONF | 21:07 |
| gyee | and oslo will take care of the rest | 21:07 |
| dstanek | gyee: that's already happening - the problem is that oslo.policy options are not being registered | 21:08 |
| gyee | then how does test_v3_protection work without your changes? | 21:08 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain in token response https://review.openstack.org/197331 | 21:08 |
| gyee | those tests are overriding the default policy.json location | 21:09 |
| dstanek | gyee: see https://bugs.launchpad.net/oslo.policy/+bug/1470183 | 21:09 |
| openstack | Launchpad bug 1470183 in oslo.policy "We need a way to register oslo.policy's options" [Undecided,Confirmed] - Assigned to David Stanek (dstanek) | 21:09 |
| *** mylu has quit IRC | 21:10 | |
| *** arunkant_ has joined #openstack-keystone | 21:10 | |
| dstanek | gyee: it's an order of operations issue | 21:11 |
| *** jdandrea has joined #openstack-keystone | 21:12 | |
| dstanek | gyee: try running this: tox -e py27 -- test_v3_protection | 21:13 |
| gyee | dstanek, k | 21:13 |
| dstanek | gyee: nm that example won't work for you :-( | 21:13 |
| *** arunkant has quit IRC | 21:14 | |
| dstanek | gyee: i had my env setup to better debug this nonsense | 21:14 |
| gyee | dstanek, sorry I need to run for another meeting, will try after I get back | 21:14 |
| *** piyanai has quit IRC | 21:15 | |
| *** ankita_w_ has quit IRC | 21:15 | |
| lbragstad | morganfainberg: I think I found something strange with trusts and fernet | 21:16 |
| *** ankita_wagh has joined #openstack-keystone | 21:16 | |
| lbragstad | I can't quite wrap my head around it | 21:16 |
| anhhuynx | jamielennox: so Jamie, I was looking at: https://github.com/openstack/keystone/blob/master/keystone/credential/controllers.py#L84-L90 | 21:16 |
| *** HT_sergio has joined #openstack-keystone | 21:16 | |
| morganfainberg | lbragstad: not surprising. | 21:16 |
| lbragstad | morganfainberg: I have this patch up, https://review.openstack.org/#/c/196774/ | 21:16 |
| lbragstad | morganfainberg: which is pretty straight forward | 21:17 |
| anhhuynx | jamielennox: Do you think that by adding @controller.filterprotected('type') I would be going down the right path? | 21:17 |
| dstanek | gyee: the simple answer for why those work is for each of those tests the global enforcer is recreated letting the new config value work | 21:17 |
| morganfainberg | Yeah | 21:17 |
| dstanek | gyee: it only works because the options have previously been registered | 21:17 |
| lbragstad | I'm just passing the respective data from token_data to token_formatter.create_token | 21:17 |
| lbragstad | in _get_token_id | 21:17 |
| dstanek | gyee: you could argue that my patch "could" just call rules.reset() at the beginning of each test, but that just seems like wasted cpu | 21:18 |
| lbragstad | morganfainberg: so that I can eliminate the fernet.core.py:Provider.issue_v3_token method | 21:18 |
| morganfainberg | You will likely still need to to squash binds | 21:18 |
| morganfainberg | But it should squash binds and then call super | 21:18 |
| morganfainberg | Nothing else. | 21:18 |
| morganfainberg | So effectively eliminated. | 21:18 |
| lbragstad | but, when keystone goes to validate that token, the user_id doesn't match the trustee_id and it throws a 403 https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L433-L435 | 21:19 |
| morganfainberg | Yeah. I was fighting that in the v2 ones. | 21:19 |
| morganfainberg | The end of my patch chain. | 21:19 |
| lbragstad | morganfainberg: do you think it's something wrong with _populate_user() ? https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L270 | 21:20 |
| morganfainberg | No the failure is before that. | 21:20 |
| lbragstad | because I'm pulling that dict in _get_token_id | 21:21 |
| lbragstad | see line 208 here https://review.openstack.org/#/c/196774/4/keystone/token/providers/fernet/core.py | 21:21 |
| *** HT_sergio has quit IRC | 21:21 | |
| morganfainberg | Is called. The trustee has already been replaced with the trustor Is the issue | 21:21 |
| lbragstad | why is that? | 21:21 |
| lbragstad | oh... https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L284 | 21:22 |
| morganfainberg | Not sure. But it fails in the data formatter | 21:22 |
| * lbragstad sigh | 21:22 | |
| morganfainberg | lbragstad: this was my hell this weekend. | 21:22 |
| lbragstad | :( | 21:22 |
| morganfainberg | But I was looking at the v2 side. Same icky issues. | 21:22 |
| lbragstad | I don't understand why that's there | 21:22 |
| morganfainberg | Because impersonation makes the auth the trustor. Not the trustee with the roles from the trustor | 21:23 |
| morganfainberg | Impersonation is broken. Horribly (as a concept). But we have it and people use it. | 21:23 |
| jamielennox | anhhuynx: that would be the first step and make keystone actually accept the type flag | 21:25 |
| jamielennox | anhhuynx: i think you would need to modify the driver hints as well and the DB call so that when you query the database you do so based on that type | 21:25 |
| jamielennox | anhhuynx: but yes - you're in the right place | 21:26 |
| lbragstad | but we make an assertion https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L434 | 21:26 |
| anhhuynx | jamielennox: Thank you Jamie. | 21:26 |
| lbragstad | morganfainberg: so, apparently using trusts that have impersonation set to False works | 21:29 |
| morganfainberg | Yeah. | 21:29 |
| morganfainberg | It's impersonation that is a train wreck to deal with. | 21:30 |
| *** BrAsS_mO- has quit IRC | 21:34 | |
| *** hrou_ has joined #openstack-keystone | 21:36 | |
| *** hrou has quit IRC | 21:36 | |
| *** fifieldt has quit IRC | 21:39 | |
| *** ayoung has quit IRC | 21:39 | |
| *** tqtran-afk is now known as tqtran | 21:39 | |
| *** jsavak has joined #openstack-keystone | 21:41 | |
| *** ngupta has joined #openstack-keystone | 21:43 | |
| openstackgerrit | Theodore Ilie proposed openstack/keystone: Add test case for deleting endpoint with space in url https://review.openstack.org/196883 | 21:43 |
| jdandrea | Clue needed with AuthN using Kilo and keystone v3, suspecting pilot error. (I checked with the #openstack channel but couldn't crack the case.) http://paste.openstack.org/show/329750/ | 21:44 |
| *** jsavak has quit IRC | 21:45 | |
| *** edmondsw has quit IRC | 21:46 | |
| morganfainberg | lbragstad: anyway... yeah maybe we need to make the data provider the only thing that does impersonation swap/check | 21:48 |
| openstackgerrit | Victor Morales proposed openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 21:48 |
| morganfainberg | lbragstad: instead of trying to do it way up in the issue code | 21:48 |
| bknudson | jdandrea: there's docs for how to use sessions -- http://docs.openstack.org/developer/python-keystoneclient/using-sessions.html | 21:48 |
| morganfainberg | lbragstad: this is only an issue with validate calling back through afaict | 21:48 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v3_token() https://review.openstack.org/196774 | 21:49 |
| lbragstad | morganfainberg: new patch with better fixes | 21:49 |
| *** shaleh has quit IRC | 21:49 | |
| lbragstad | i.e. the trust stuff and getting federation to work | 21:49 |
| morganfainberg | i'll rebase through my chain as well soon | 21:49 |
| jdandrea | bknudson: Thanks! Confused though. Not sure how seeing that error would lead me to know to use sessions? Also, does that mean the example is out of date at http://docs.openstack.org/developer/python-keystoneclient/api/keystoneclient.v3.html#module-keystoneclient.v3.client ? | 21:49 |
| morganfainberg | lbragstad: you'll still need issue_v3_token but just to raise out on bound tokens | 21:50 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v3_token() https://review.openstack.org/196877 | 21:50 |
| bknudson | jdandrea: that sample code is out of date. | 21:50 |
| morganfainberg | lbragstad: def issue_v3_token(....): if bind: raise else: return super() | 21:50 |
| jdandrea | bknudson: Ah, ok, thanks. | 21:50 |
| morganfainberg | lbragstad: unless fernet now supports binds | 21:50 |
| lbragstad | morganfainberg: no, all token providers have a _supports_bind property that returns True or False | 21:51 |
| *** jsavak has joined #openstack-keystone | 21:51 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 21:51 | |
| *** BrAsS_mOnKeY has quit IRC | 21:51 | |
| *** fifieldt has joined #openstack-keystone | 21:51 | |
| lbragstad | https://review.openstack.org/#/c/196774/5/keystone/token/providers/common.py | 21:51 |
| lbragstad | morganfainberg: ^ | 21:51 |
| morganfainberg | lbragstad: cool | 21:51 |
| morganfainberg | lbragstad: much better... | 21:52 |
| lbragstad | morganfainberg: if that's what you're thinking? | 21:52 |
| morganfainberg | yeah | 21:52 |
| morganfainberg | i'd like to move more to a capability list | 21:52 |
| morganfainberg | vs. endlessly growing @properties | 21:52 |
| morganfainberg | or such | 21:52 |
| lbragstad | morganfainberg: yeah, I liked that with the non-persistence stuff | 21:52 |
| morganfainberg | but that can happen down the line | 21:52 |
| *** henrynash has quit IRC | 21:52 | |
| morganfainberg | so get_provider_capabilities() => ['needs_persistence', 'binds', 'trusts', '...'] | 21:53 |
| morganfainberg | or some such | 21:53 |
| morganfainberg | but that is a refactor that should come later | 21:53 |
| lbragstad | morganfainberg: oh, that's an interesting idea | 21:53 |
| morganfainberg | this cleanup fernet stuff likely needs to be backported to kilo | 21:53 |
| morganfainberg | so we should do this without that level of re-structure | 21:54 |
| lbragstad | agreed, | 21:54 |
| lbragstad | switching to something like a capabilities list shouldn't be too bad later on, it's all the prereq work to get there that seems to be the fun part :) | 21:54 |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 21:55 | |
| *** BrAsS_mOnKeY has quit IRC | 21:55 | |
| openstackgerrit | Jason Obrien proposed openstack/keystone: Updated docs for Keystone startup https://review.openstack.org/197225 | 21:56 |
| browne | lbragstad: so i think i ran into a similar issue yesterday when trying to use fernet tokens. http://paste.openstack.org/show/329764/ | 21:56 |
| *** csoukup has quit IRC | 21:57 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 21:57 | |
| *** jecarey has quit IRC | 21:57 | |
| browne | in this code path it seems to expect the user_id to be a UUID, which its not because I'm using LDAP | 21:57 |
| *** BrAsS_mOnKeY has quit IRC | 21:57 | |
| lbragstad | browne: I already have a fix for you :) https://review.openstack.org/#/c/186376/ | 21:57 |
| browne | lbragstad: oh nice! | 21:57 |
| lbragstad | browne: that has already landed in master | 21:58 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/token_formatters.py#L334 | 21:58 |
| lbragstad | but hasn't done so in stable/kilo | 21:58 |
| browne | yep, i was using stable/kilo | 21:58 |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 21:59 | |
| *** BrAsS_mOnKeY has quit IRC | 21:59 | |
| morganfainberg | jamielennox: you here? | 21:59 |
| jamielennox | morganfainberg: yea | 21:59 |
| morganfainberg | jamielennox: what is the likelyhood of session [in Auth_Token] passing down the right thing to the internal service->service requests | 22:00 |
| morganfainberg | andddddd forcing a service token to be there (if possible) | 22:00 |
| jamielennox | morganfainberg: done and released? | 22:00 |
| morganfainberg | oh sweet | 22:00 |
| morganfainberg | SWEET | 22:00 |
| jamielennox | oh wait | 22:00 |
| *** diazjf has left #openstack-keystone | 22:00 | |
| jamielennox | i may be over confident on the service token | 22:00 |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 22:00 | |
| morganfainberg | hehe | 22:01 |
| bknudson | I don't think we approved the spec for that yet | 22:01 |
| jamielennox | https://review.openstack.org/#/c/193422/ | 22:01 |
| morganfainberg | i want to start really making all services that are expecting [nova] -> [<thing>] type action to use the service token | 22:01 |
| *** BrAsS_mOnKeY has quit IRC | 22:01 | |
| morganfainberg | because.... | 22:01 |
| morganfainberg | uh... | 22:01 |
| morganfainberg | if we do that we have a way out from under the bearer tokens from [user] -> [API] | 22:01 |
| jamielennox | yea, it turns out i reached too far with the X-OpenStack-Request-ID thing | 22:01 |
| jamielennox | they'll come find us when they figure out what they want there | 22:01 |
| jamielennox | so what's missing there is serialization | 22:02 |
| morganfainberg | since auth_token then can validate authz and pass on a confirmed authz in the request + service token | 22:02 |
| jamielennox | auth_token passes it down, it needs to be passed from n-api -> n-* (i can't remember which one does the work) | 22:02 |
| bknudson | jamielennox: here's the request ID spec now -- https://review.openstack.org/#/c/156508/ | 22:02 |
| morganfainberg | we can do cooler things... and then we can support *gaaaaasssssp* signed requests instead of bearer tokens along side bearer tokens | 22:02 |
| morganfainberg | and i think lots of people would be very happy with that | 22:02 |
| bknudson | it doesn't even mention logging, it's just how to get it from the client libs | 22:03 |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 22:03 | |
| morganfainberg | [it just means nova->glance is implicitly trusted, as long as you say "hey i validated this authz for the user ehre it is" | 22:03 |
| * morganfainberg tries and kills bearer tokens from user->service | 22:03 | |
| jamielennox | bknudson: i'ts sooo broken | 22:03 |
| bknudson | I'd expect client certs would be the way to go for nova->glance | 22:03 |
| *** jsavak has quit IRC | 22:03 | |
| morganfainberg | bknudson: that is the long term goal | 22:04 |
| jamielennox | morganfainberg: bearer tokens can work we just need to fix auth_token | 22:04 |
| jamielennox | and get service tokens gong | 22:04 |
| jamielennox | going | 22:04 |
| morganfainberg | bknudson: but we have to do it in steps, support different authn/authz between user and service vs service and service | 22:04 |
| jamielennox | cinder.get_previous_request_id() | 22:04 |
| morganfainberg | bknudson: then we can work / iterate on either of those separately | 22:04 |
| jamielennox | wtf - how do they expect that to work | 22:04 |
| bknudson | jamielennox: thread-local storage | 22:04 |
| morganfainberg | bknudson: yay thread-local :( | 22:04 |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 22:04 | |
| jamielennox | bknudson: you're kidding | 22:04 |
| morganfainberg | ¬_¬ | 22:05 |
| morganfainberg | jamielennox: i don't think he is | 22:05 |
| jamielennox | cinder = client.Client('2', 'demo', 'admin', 'demo',63 | 22:05 |
| jamielennox | 'http://21.12.4.342:5000/v2.0') | 22:05 |
| jamielennox | that's lovely - how do they think that's going to work with sessions ? | 22:05 |
| jamielennox | - oh yea, i remember somebody talking about auth plugins.... | 22:05 |
| jamielennox | We are proposing to add 'get_previous_request_id()' method in python-clients,44 | 22:06 |
| jamielennox | python-openstackclient and python-openstacksdk to return request id to the45 | 22:06 |
| jamielennox | user.46 | 22:06 |
| jamielennox | 22:06 | |
| jamielennox | lol to anyone who thinks they can add a method to every client | 22:06 |
| bknudson | jamielennox: I suggested that they add a way to register a callback function, and if they're going to do that then put it on the session instead | 22:06 |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 22:06 | |
| *** Lactem has joined #openstack-keystone | 22:06 | |
| bknudson | as long as all the requests go through the session they'll get the callbacks | 22:06 |
| *** BrAsS_mOnKeY has quit IRC | 22:06 | |
| jamielennox | bknudson: why would you want to thread local this stuff? why wouldn't you just retrieve it from the response | 22:07 |
| jamielennox | hmm, guess you would need to change every response for that | 22:07 |
| bknudson | jamielennox: you don't have access to the response. | 22:07 |
| *** gokrokve has quit IRC | 22:07 | |
| bknudson | you might be able to do something like response=cinder.list() ; cinder.get_request_id(response) | 22:08 |
| bknudson | and use a weakref dict | 22:08 |
| jamielennox | urgh | 22:09 |
| jamielennox | whatever | 22:09 |
| *** gordc is now known as gordc_afk | 22:09 | |
| jamielennox | if we fix auth people can break their clients in all sorts of dumb ways | 22:09 |
| Lactem | dstanek: You've been reviewing a patch of mine. Thanks for that. For some reason Jenkins keeps failing epy27. This also fails when I run tox on my local machine. I use git reset to test epy27 before my commit, and got the same errors. Thus, it's not failing for anything caused by my patch. What should I do? https://review.openstack.org/#/c/196883/ | 22:09 |
| Lactem | http://logs.openstack.org/83/196883/1/check/gate-keystone-python27/48daa2e/ | 22:09 |
| jamielennox | morganfainberg: https://review.openstack.org/#/c/167181/ is the serialization patch, it's WIP at the moment because i've no idea how it's going to integrate into oslo.context | 22:10 |
| morganfainberg | jamielennox: ah | 22:10 |
| dstanek | Lactem: rebase your patch on top of master | 22:10 |
| jamielennox | morganfainberg: it's somewhere on my list of priorities | 22:10 |
| dstanek | that issues has already been fixed | 22:10 |
| morganfainberg | jamielennox: right | 22:10 |
| Lactem | dstanek: Thanks. | 22:11 |
| dstanek | Lactem: my pleasure | 22:11 |
| Lactem | Wait. | 22:11 |
| Lactem | Hmm. It says it's already up to date when I try git rebase. | 22:11 |
| *** hrou_ has quit IRC | 22:11 | |
| jamielennox | morganfainberg: feel free to take that and experiment, my most recent concern was i'm not sure oslo.context really wants us to package a full AccessInfo object * 2 tokens and the user plugin is fairly bound to the concept of an AccessInfo | 22:11 |
| Lactem | "Current branch master is up to date." | 22:12 |
| Lactem | Maybe I should fetch first? | 22:12 |
| jamielennox | morganfainberg: We could either change UserPlugin so that it pulls the variables it needs at __init__ and therefore make serialization easier | 22:12 |
| *** Rockyg has quit IRC | 22:12 | |
| morganfainberg | jamielennox: that is the direction i think we need to go | 22:12 |
| jamielennox | or we could try and sanitize the AccessInfo somehow | 22:12 |
| morganfainberg | jamielennox: rather than sanitizing AccessInfo | 22:12 |
| openstackgerrit | David Stanek proposed openstack/keystone: Add test case for deleting endpoint with space in url https://review.openstack.org/196883 | 22:12 |
| jamielennox | morganfainberg: i think that is the last comment i made on the patch when i WIPed it | 22:13 |
| morganfainberg | jamielennox: easier to say "we grab X, Y, Z" than "we mangle this thing to make it work.. except when we miss something" | 22:13 |
| morganfainberg | i'd rather just be explicit | 22:13 |
| jamielennox | yep, you would need multiple constructors, but whatever | 22:13 |
| morganfainberg | explicit at least gives developers a target | 22:13 |
| jamielennox | if we get it right we can have helpers handle the plugin->context->plugin bit | 22:13 |
| morganfainberg | and it is less likely to move out from under them because a sanititzation change | 22:14 |
| morganfainberg | jamielennox: ++ | 22:14 |
| morganfainberg | yes | 22:14 |
| jamielennox | i just don't want to make it so that we have to have nova package all these contexts themselves | 22:14 |
| morganfainberg | and they shouldn't have to | 22:14 |
| morganfainberg | i'd say we're doing it wrong if we make them do that | 22:14 |
| openstackgerrit | Jason Obrien proposed openstack/keystone: Updated docs for Keystone startup https://review.openstack.org/197225 | 22:14 |
| jamielennox | i was thinking we could have auth_token depend on oslo.context and maybe we could even provide a BaseContext from there rather than have people go to oslo.context directly | 22:14 |
| morganfainberg | maybe | 22:15 |
| jamielennox | as in just now thinking rather than i've given that a lot of thought | 22:15 |
| morganfainberg | it could work | 22:15 |
| jamielennox | morganfainberg: please do experiment with that i have no solid ideas just that i want to take as much responsibiilty off the services as possible | 22:16 |
| jamielennox | morganfainberg: got to go out for a bit, back in like 30 minutes | 22:16 |
| * morganfainberg is finishing up a couple things then has to also head out to make it to dinner place (yay traffic) | 22:16 | |
| dstanek | i wish i could make a -1 sticky so i didn't have to -2 things | 22:16 |
| Lactem | Uh oh. What are you -2ing? | 22:17 |
| morganfainberg | dstanek: if it's serious enough that it needs to be sticky -- a -2 is probably correct | 22:17 |
| bknudson | it's probably something I did. | 22:18 |
| dstanek | morganfainberg: nah, i just want to make sure my -1 is considered. the doc review above just bothers me and i don't want to -2 a new contributor while they are actively doing development | 22:18 |
| *** dims_ has joined #openstack-keystone | 22:19 | |
| Lactem | dstanek: https://review.openstack.org/#/c/197225/ That one? | 22:19 |
| bknudson | dstanek: that one probably should be -2 | 22:19 |
| dstanek | that's the one | 22:20 |
| Lactem | Erm. What's wrong with that? | 22:20 |
| dstanek | let devstack document devstack :-) | 22:20 |
| bknudson | devstack should be reading our documentation for how to deploy it not the other way around | 22:21 |
| *** ankita_w_ has joined #openstack-keystone | 22:21 | |
| bknudson | otherwise we'll be stuck in a loop | 22:21 |
| *** dims has quit IRC | 22:22 | |
| dstanek | bknudson: yes, exactly. now nobody will know! | 22:22 |
| Lactem | Oh. I know the patch submitter irl. | 22:22 |
| Lactem | We're all new. | 22:22 |
| *** gokrokve has joined #openstack-keystone | 22:22 | |
| dstanek | Lactem: that's why i didn't want to -2 | 22:23 |
| *** yottatsa has joined #openstack-keystone | 22:23 | |
| Lactem | dstanek: I don't see what you're saying on my patch, though. "I just pushed a new patchset up that appears to show that there is definitely a bug in there." I'm not seeing anything different in your new patchset than in the one right before it. | 22:23 |
| dstanek | Lactem: the diff - https://review.openstack.org/#/c/196883/3..4/keystone/tests/unit/test_v3_catalog.py | 22:24 |
| Lactem | That's what I'm looking at. | 22:24 |
| *** ankita_wagh has quit IRC | 22:24 | |
| dstanek | Lactem: the test as it was writting wasn't saving the url with the space into the database - so the test did nothing | 22:24 |
| dstanek | s/writting/written/ | 22:25 |
| Lactem | dstanek: Is there a sample or a unit test example that would show me how to write it into the database? | 22:25 |
| *** bknudson has quit IRC | 22:26 | |
| yottatsa | Does anybody know where slave_connection were introduced? | 22:26 |
| dstanek | Lactem: i just pushed it :-) if you modify the ref before doing the POST it will get into the database | 22:27 |
| Lactem | Ohh. | 22:27 |
| Lactem | I was wondering why it was moved. Thank you. | 22:27 |
| dstanek | Lactem: the original code created a ref, POSTed it to keystone and then modified it locally | 22:27 |
| *** jsavak has joined #openstack-keystone | 22:28 | |
| Lactem | I see. | 22:28 |
| *** ayoung has joined #openstack-keystone | 22:29 | |
| *** ChanServ sets mode: +v ayoung | 22:29 | |
| *** ninag has joined #openstack-keystone | 22:36 | |
| *** shaleh has joined #openstack-keystone | 22:36 | |
| *** dontalton has quit IRC | 22:37 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/196485 | 22:39 |
| Lactem | dstanek: You're not stealing this bug from me, are you? The bug page put you down under "assigned to." Mind if I change that back to me? | 22:40 |
| Lactem | By the way this makes an error even if there's no space in tenant_id. | 22:41 |
| *** ayoung has quit IRC | 22:41 | |
| morganfainberg | Lactem: the assigned to changes automatically | 22:42 |
| morganfainberg | Lactem: based upon who pushes the patch. you still get credit for the patch because you're the "author" in git | 22:42 |
| *** jsavak has quit IRC | 22:42 | |
| morganfainberg | Lactem: it's just how our tooling and how gerrit -> launchpad works | 22:42 |
| Lactem | Okay so once I make the final patch, it will switch the assignee back. Cool. | 22:43 |
| *** jsavak has joined #openstack-keystone | 22:43 | |
| *** gokrokve has quit IRC | 22:44 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/197277 | 22:45 |
| *** dhellmann has joined #openstack-keystone | 22:46 | |
| *** slberger has quit IRC | 22:46 | |
| yottatsa | I'd just imlemented slave_connection initial support for keystone. Should I write a spec? Or I can start from blueprint? https://blueprints.launchpad.net/keystone/+spec/keystone-slaveification | 22:46 |
| *** slberger has joined #openstack-keystone | 22:46 | |
| *** slberger has left #openstack-keystone | 22:47 | |
| dstanek | Lactem: yeah, or you can assign it back if you like. i don't intend to work on in at all, i just wanted to correct the test. | 22:51 |
| dstanek | yottatsa: a spec is probably the right thing for that | 22:52 |
| dstanek | yottatsa: that blueprint is really sparse on the the details that the spec template will make you think about | 22:53 |
| yottatsa | dstanek, thank you | 22:54 |
| *** jsavak has quit IRC | 22:54 | |
| yottatsa | dstanek, which directory I should use? kilo or liberty? | 22:59 |
| dstanek | yottatsa: liberty. kilo has already happened | 23:00 |
| yottatsa | got it | 23:00 |
| *** dims_ has quit IRC | 23:01 | |
| dstanek | yottatsa: actually probably backlog, now that i think about it - don't think we are approving any liberty specs at this time | 23:01 |
| dstanek | the deadline was last week iirc | 23:01 |
| morganfainberg | dstanek: we aren't unless there is a proposal freeze exception granted | 23:05 |
| morganfainberg | dstanek: whihc we're open to - I really don't want everything piled into milestone-3 again | 23:05 |
| *** markvoelker_ has quit IRC | 23:06 | |
| dstanek | haha, isn't that how we make sure we're busy? | 23:06 |
| sigmavirus24 | morganfainberg: isn't that just Good Release Planning™? | 23:07 |
| sigmavirus24 | s/Good/Glance/ | 23:07 |
| *** ninag has quit IRC | 23:08 | |
| *** hrou has joined #openstack-keystone | 23:09 | |
| dstanek | sigmavirus24: is Glance practicing Fire-drill Driven Development? | 23:09 |
| sigmavirus24 | That was Kilo at least | 23:09 |
| sigmavirus24 | I don't think we merged a single blueprint before m-3 | 23:09 |
| sigmavirus24 | And even then, we merged 2 big ones as FFEs | 23:09 |
| sigmavirus24 | (CIS - Now openstack/searchlight, Artifacts) | 23:10 |
| *** shaleh has quit IRC | 23:10 | |
| morganfainberg | sigmavirus24: i dunno... thats my view, but i might be in the minority | 23:11 |
| morganfainberg | sigmavirus24: just today i get a lot more say in that stuff being PTL ;) | 23:11 |
| sigmavirus24 | Doesn't PTL stand for "Petty Tyrant and Liar" | 23:12 |
| * sigmavirus24 ducks | 23:12 | |
| dstanek | "party through liberty" | 23:13 |
| *** jsavak has joined #openstack-keystone | 23:13 | |
| kfox1111 | no, I'd say the ptl's job is pretty hard. I wouldn't consider it a party. ;) | 23:14 |
| *** mgarza has quit IRC | 23:15 | |
| *** mgarza_ has joined #openstack-keystone | 23:15 | |
| *** mgarza_ has quit IRC | 23:16 | |
| *** zzzeek has quit IRC | 23:18 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 23:20 | |
| openstackgerrit | Merged openstack/pycadf: Updated from global requirements https://review.openstack.org/197270 | 23:21 |
| *** jkomg has quit IRC | 23:22 | |
| morganfainberg | sigmavirus24: nah PTL stands for Please Try Later | 23:23 |
| morganfainberg | usually invoving a -1 or -2. | 23:23 |
| sigmavirus24 | "Future unclear. Please try again later" | 23:23 |
| morganfainberg | sigmavirus24: -1, Nope, Please Try Later | 23:23 |
| sigmavirus24 | So you're a glorified Magic 8 ball? | 23:23 |
| morganfainberg | sigmavirus24: oh you're giving me too much credit | 23:24 |
| morganfainberg | i only have 2 answers | 23:24 |
| morganfainberg | -1 and -2 | 23:24 |
| *** jsavak has quit IRC | 23:24 | |
| sigmavirus24 | That was me in the Kilo cycle | 23:24 |
| sigmavirus24 | My +/- ratio was something like 60% in glance | 23:24 |
| morganfainberg | i use a magic 8 ball to determine which answer to give. | 23:24 |
| Lactem | Is there a way to print debug messages in a test case without using assertEqual, which will break the execution there? | 23:25 |
| morganfainberg | don't ask how it works, it's a secret to everybody | 23:25 |
| * morganfainberg even got a LoZ reference in there! wheeeeee. | 23:25 | |
| * morganfainberg mightbe a little loopy today | 23:25 | |
| *** shaleh has joined #openstack-keystone | 23:26 | |
| Lactem | Using print doesn't seem to work. Is there a different way to log messages when using tox? | 23:26 |
| *** roxanaghe has quit IRC | 23:27 | |
| *** jsavak has joined #openstack-keystone | 23:27 | |
| *** fangzhou has joined #openstack-keystone | 23:28 | |
| *** shaleh has quit IRC | 23:32 | |
| openstackgerrit | Theodore Ilie proposed openstack/keystone: Add test case for deleting endpoint with space in url https://review.openstack.org/196883 | 23:34 |
| Lactem | : D | 23:34 |
| Lactem | I'll just leave that and go off for the day. | 23:34 |
| *** jsavak has quit IRC | 23:35 | |
| dstanek | Lactem: are you trying to print during a broken test or a successful test? | 23:36 |
| *** Lactem has quit IRC | 23:36 | |
| anhhuynx | are there any credential types other than ec2? | 23:39 |
| *** dims has joined #openstack-keystone | 23:45 | |
| *** dims has quit IRC | 23:46 | |
| *** anhhuynx has quit IRC | 23:47 | |
| *** markvoelker has joined #openstack-keystone | 23:47 | |
| *** dramakri has left #openstack-keystone | 23:50 | |
| browne | anhhuynx: the openstack client does have a cert credential type | 23:50 |
| browne | https://github.com/openstack/python-openstackclient/blob/56163aa7bc7ab1ea98b94611158dbe2df727069a/openstackclient/identity/v3/credential.py#L45 | 23:50 |
| *** zzzeek has joined #openstack-keystone | 23:55 | |
| *** htruta_ has joined #openstack-keystone | 23:57 | |
| *** ianbrown has joined #openstack-keystone | 23:57 | |
| *** dsirrine_ has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!