| *** ankita_wagh has quit IRC | 00:09 | |
| *** bjornar has quit IRC | 00:10 | |
| *** bjornar has joined #openstack-keystone | 00:11 | |
| *** mylu has quit IRC | 00:13 | |
| jamielennox | very simple review: https://review.openstack.org/#/c/196950/2 if we can merge that we can debate the next one which is significant | 00:14 |
|---|---|---|
| *** mylu has joined #openstack-keystone | 00:15 | |
| *** csoukup has quit IRC | 00:20 | |
| *** mylu has quit IRC | 00:27 | |
| *** mylu has joined #openstack-keystone | 00:27 | |
| *** Rockyg has quit IRC | 00:29 | |
| *** kfox1111 is now known as kfox1111_away | 00:32 | |
| *** albertom has quit IRC | 00:32 | |
| *** albertom has joined #openstack-keystone | 00:39 | |
| *** ankita_wagh has joined #openstack-keystone | 00:40 | |
| *** zzzeek has quit IRC | 00:40 | |
| *** zzzeek has joined #openstack-keystone | 00:45 | |
| *** zzzeek has quit IRC | 00:47 | |
| *** tqtran has quit IRC | 01:01 | |
| *** albertom has quit IRC | 01:02 | |
| *** trey has joined #openstack-keystone | 01:02 | |
| *** albertom has joined #openstack-keystone | 01:09 | |
| *** mylu has quit IRC | 01:09 | |
| *** slberger has left #openstack-keystone | 01:11 | |
| *** mylu has joined #openstack-keystone | 01:14 | |
| *** mylu has quit IRC | 01:18 | |
| *** dims_ has quit IRC | 01:19 | |
| bigjools | Folks, is there a better description of the mapping rules than here? https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst#mappings | 01:20 |
| *** stevemar has joined #openstack-keystone | 01:21 | |
| *** stevemar has quit IRC | 01:24 | |
| *** ankita_wagh has quit IRC | 01:30 | |
| *** ankita_wagh has joined #openstack-keystone | 01:31 | |
| *** mylu has joined #openstack-keystone | 01:35 | |
| *** dsirrine_ has quit IRC | 01:37 | |
| *** dims has joined #openstack-keystone | 01:39 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 01:40 | |
| *** mylu has quit IRC | 01:43 | |
| *** mylu has joined #openstack-keystone | 01:44 | |
| *** wuhg has joined #openstack-keystone | 01:52 | |
| *** richm has quit IRC | 01:55 | |
| *** mylu has quit IRC | 02:01 | |
| openstackgerrit | liusheng proposed openstack/keystone: Remove the unused config_files parameter of service entry https://review.openstack.org/186987 | 02:04 |
| *** jecarey has joined #openstack-keystone | 02:04 | |
| *** piyanai has joined #openstack-keystone | 02:12 | |
| *** mylu has joined #openstack-keystone | 02:20 | |
| *** mylu has quit IRC | 02:22 | |
| ayoung | bigjools, not really | 02:22 |
| bigjools | ayoung: damn. Ok, I'm struggling to map remote users to local ones, I keep getting an error "Unable to find valid groups while using mapping", is there anything I can look at? | 02:23 |
| ayoung | bigjools, my blog? | 02:23 |
| bigjools | heh | 02:23 |
| ayoung | bigjools, you doing Kerberos? | 02:23 |
| bigjools | saml | 02:23 |
| bigjools | I am using the MAPPING_LOCAL_USER_LOCAL_DOMAIN test fixture as inspiration | 02:23 |
| ayoung | bigjools, you need groups defined in the Keystone backend | 02:23 |
| bigjools | yeah, did that | 02:24 |
| bigjools | added the local user to it | 02:24 |
| ayoung | so the groups are in the saml assertion, but not getting matched to the ones in the backend? Can you paste your mapping? | 02:24 |
| bigjools | yes one sec | 02:24 |
| bigjools | http://paste.ubuntu.com/11807870/ | 02:25 |
| bigjools | hmmm wait up, what do you mean by groups in the saml assertion? | 02:26 |
| bigjools | The test fixture seems to suggest that you don't need that | 02:27 |
| bigjools | and that other doc says: "If the user has domain specified, the user is treated as existing in the backend, hence the server will fetch user details (id, name, roles, groups)." | 02:27 |
| *** mylu has joined #openstack-keystone | 02:30 | |
| *** lhcheng has quit IRC | 02:43 | |
| *** darrenc is now known as darrenc_afk | 02:45 | |
| *** stevemar has joined #openstack-keystone | 02:47 | |
| *** mylu has quit IRC | 02:50 | |
| *** mylu has joined #openstack-keystone | 02:53 | |
| *** mylu has quit IRC | 03:07 | |
| *** davechen has joined #openstack-keystone | 03:11 | |
| *** davechen1 has joined #openstack-keystone | 03:14 | |
| *** davechen has quit IRC | 03:17 | |
| *** piyanai has quit IRC | 03:17 | |
| *** mylu has joined #openstack-keystone | 03:21 | |
| *** dims has quit IRC | 03:22 | |
| *** jecarey has quit IRC | 03:27 | |
| *** richm has joined #openstack-keystone | 03:28 | |
| *** mylu has quit IRC | 03:31 | |
| *** richm has quit IRC | 03:34 | |
| *** juvenn has joined #openstack-keystone | 03:35 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Remove oslo-incubator specific code https://review.openstack.org/197827 | 03:36 |
| *** mylu has joined #openstack-keystone | 03:40 | |
| juvenn | hi, I'm trying curl to Keystone api, and encountered a problem: | 03:44 |
| *** mylu has quit IRC | 03:44 | |
| juvenn | my domain scoped password auth fails with "401: Unauthorized" error, while the same one with project scope auth succeeds. | 03:44 |
| *** mylu has joined #openstack-keystone | 03:44 | |
| juvenn | I noticed on the keystone.log warning: assignment.get_domain() is deprecated as of kilo in favor of resource.get_domain() and may be removed in M. | 03:46 |
| juvenn | I suppose domain scoped password auth should succeed, isn't it? | 03:47 |
| juvenn | I also find there are none domain-scoped auth test in keystone unit test …. | 03:49 |
| *** mylu has quit IRC | 03:52 | |
| jamielennox | why do you need a remote_id to associate with an identity provider? | 03:54 |
| juvenn | jamielennox: remote_id? I'm sorry, do you mean in my /etc/keystone/keystone.conf? | 03:56 |
| *** mylu has joined #openstack-keystone | 03:57 | |
| jamielennox | no i mean https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst#identity-providers | 03:57 |
| jamielennox | remote_ids is an optional list of remote_ids, is it a validation? | 03:58 |
| jamielennox | what is it validating? that only certain idps go through there? but that would be something that apache handled | 03:59 |
| jamielennox | what's it for? | 03:59 |
| *** mylu has quit IRC | 04:01 | |
| jamielennox | for anyone interested this is the spec: https://github.com/openstack/keystone-specs/blob/master/specs/kilo/idp-id-registration.rst | 04:03 |
| jamielennox | i would still expect this to be an apache setting though | 04:03 |
| *** kiran-r has joined #openstack-keystone | 04:09 | |
| *** ianbrown has quit IRC | 04:11 | |
| lifeless | jamielennox: morganfainberg: https://review.openstack.org/197773 | 04:12 |
| lifeless | you might want to merge that sooner rather than later | 04:12 |
| morganfainberg | lifeless: +2/+A | 04:20 |
| *** juvenn has quit IRC | 04:21 | |
| *** woodster_ has quit IRC | 04:21 | |
| ayoung | morganfainberg, +2...but why'd you not wait for a second +2 t +A? Is there something burning that needs that? | 04:21 |
| morganfainberg | ayoung: requirements fix. mostly this is a manual update of waht proposal bot would be doing. | 04:22 |
| morganfainberg | ayoung: treated the same as any requirements update. | 04:22 |
| *** juvenn has joined #openstack-keystone | 04:22 | |
| ayoung | morganfainberg, so more of a "get it done so we don't forget about it later" than a "oh crap we need this now" thing? | 04:23 |
| morganfainberg | yep | 04:23 |
| morganfainberg | just like any requirements update | 04:23 |
| morganfainberg | if they linger...they cause issues | 04:23 |
| morganfainberg | not an "add to requirements" but really an update thing (and this is the restructure to be no more pyXX versions). if it lingers it is likely to cause splody in bad ways down the line | 04:24 |
| ayoung | and I should go to bed | 04:25 |
| morganfainberg | go sleep then ;) | 04:26 |
| *** davechen1 has quit IRC | 04:27 | |
| *** davechen has joined #openstack-keystone | 04:27 | |
| *** vilobhmm has joined #openstack-keystone | 04:29 | |
| bigjools | jamielennox: I thought remote_ids was so that a remote IdP can be associated with an internal once | 04:32 |
| bigjools | one* | 04:32 |
| jamielennox | bigjools: that's very strongly implied by apache right? | 04:33 |
| bigjools | jamielennox: the remote id is passed through request variables from Apache | 04:33 |
| bigjools | I don't *think* there's any other way of knowing | 04:34 |
| jamielennox | bigjools: but there's no way you could request those urls without going through apache | 04:35 |
| bigjools | right | 04:35 |
| jamielennox | i'm just not sure what the point is | 04:35 |
| bigjools | you need to know which IdP is in use so that the right mapping can get used | 04:35 |
| jamielennox | bigjools: it's part of the url | 04:36 |
| stevemar | jamielennox: it was for the use case where you had one keystone IdP entry used to represent 100s of actual idps | 04:37 |
| stevemar | bigjools: ^ | 04:37 |
| bigjools | yeah, I was guessing that might be the case | 04:37 |
| stevemar | so you wanted to create a keystone entry called CERN_IdPs, and they all have the same mapping | 04:37 |
| stevemar | but you have 100 universities, and rather than manage 100 entries in apache, just use the same one, and each has a different remote-id | 04:38 |
| jamielennox | stevemar: that seems kind of wrong | 04:38 |
| stevemar | the folks from cern + infn | 04:40 |
| stevemar | ... were pushing it | 04:40 |
| bigjools | I can truly understand wanting a simple Apache config | 04:41 |
| stevemar | it also helps in the SSO case, since we don't know what the idp is, we only list protocols | 04:41 |
| bigjools | Is there a trick to getting remote users mapped to local users? I am using this as mapping http://paste.ubuntu.com/11807870/ but it complains there's no group. The local user is in a group. | 04:44 |
| *** janonymous has quit IRC | 04:44 | |
| *** crc32 has quit IRC | 04:44 | |
| stevemar | bigjools: that "type: local" bit looks wrong | 04:44 |
| bigjools | stevemar: I lifted it from MAPPING_LOCAL_USER_LOCAL_DOMAIN in the test fixtures | 04:45 |
| stevemar | bigjools: fwiw, we're trying to improve the docs atm, https://review.openstack.org/#/c/192850/ refer to doc/source/mapping_combinations.rst | 04:45 |
| bigjools | https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst#mappings | 04:45 |
| bigjools | yeah the docs are a bit lacking :) | 04:46 |
| bigjools | once I understand everything fullu, happy to help fill in | 04:46 |
| bigjools | fully* | 04:46 |
| bigjools | what should it be instead of local then? | 04:46 |
| * stevemar looking it up | 04:48 | |
| bigjools | ooo didn't know about "keystone-manage mapping_engine", that's useful | 04:48 |
| jamielennox | bigjools: i'm currently going through pretty mcuh the exact same setup, trying to figure out mapping rules | 04:48 |
| jamielennox | docs are short | 04:48 |
| bigjools | yeah | 04:48 |
| stevemar | bigjools: yeah, we wanted to make things a bit easier for folks to test out *before* having to do a huge setup | 04:49 |
| bigjools | too late :) | 04:49 |
| jamielennox | stevemar: so what i'm about to write (and would be useful if it's something people already have) is a way to print out all the values that are coming in via fedreation | 04:51 |
| stevemar | you mean from the apache modules? | 04:52 |
| jamielennox | essentially put <?php phpinfo(); ?> behind the OS-FEDERATION/x/protocols/y/auth | 04:52 |
| jamielennox | so i can figure out what inputs i have to the mapping to work with | 04:52 |
| stevemar | those should be in the logs fwiw (with debug on) | 04:52 |
| jamielennox | this is not hard to write, but if we're looking for helpers for federation | 04:52 |
| *** juvenn has left #openstack-keystone | 04:53 | |
| bigjools | oh darn, is mapping_engine not in kilo? | 04:53 |
| jamielennox | bigjools: no | 04:53 |
| stevemar | bigjools: in liberty :( | 04:53 |
| bigjools | :'( | 04:53 |
| stevemar | bigjools: https://github.com/openstack/keystone/blob/675a1cff0c007f749cf4a1fe6dc30d209bdbc179/keystone/auth/plugins/mapped.py#L121-L124 | 04:53 |
| *** jk|osx has joined #openstack-keystone | 04:54 | |
| jamielennox | bigjools: however it's a test script so you can probably run it against trunk to refine the mapping and then put it back | 04:54 |
| stevemar | looks like it sets the user id to the direct mapping value, so make sure you're using the id? | 04:54 |
| bigjools | stevemar: I've been digging into code and literally just got to those lines | 04:54 |
| stevemar | lol | 04:54 |
| bigjools | :) | 04:54 |
| bigjools | user ID is fine, but it complains: | 04:54 |
| stevemar | so you have the users already in keystone db or ldap, you just want to expose it via federation? | 04:55 |
| bigjools | Unable to find valid groups while using mapping ... | 04:55 |
| *** dobson has quit IRC | 04:55 | |
| bigjools | ok I have a complex situation, so let me explain | 04:55 |
| bigjools | I want to do k2k websso, but that doesn't exist yet, so I'm using a sneaky feature of the shibboleth SP that lets you specify an IdP directly | 04:56 |
| bigjools | we have users in LDAP already, and we can use the LDAP backend of an IdP to do SSO, but if we map the user to the internal one (which uses the same LDAP) then it'll be smoother | 04:57 |
| bigjools | anyway, in that code, if the user is not ephemeral it's not obvious where it sets the group_ids | 04:59 |
| *** darrenc_afk is now known as darrenc | 05:00 | |
| *** amit213 has joined #openstack-keystone | 05:00 | |
| *** ajayaa has joined #openstack-keystone | 05:00 | |
| stevemar | jamielennox: if you have a minute, i'd appreciate keystone eyes on https://review.openstack.org/#/c/177620/ | 05:02 |
| *** dobson has joined #openstack-keystone | 05:02 | |
| dstanek | stevemar: you're up pretty late | 05:02 |
| jamielennox | stevemar: whoa, i just mentioned something like that | 05:02 |
| stevemar | dstanek: so are you... | 05:02 |
| stevemar | dstanek: i'm surprised *you* haven't looked at https://review.openstack.org/#/c/177620/ | 05:03 |
| stevemar | it's up your alley | 05:03 |
| stevemar | bigjools: yeah, it's not obvious where it sets the group id | 05:03 |
| bigjools | stevemar: I'm not sure it does | 05:04 |
| dstanek | stevemar: oh, neat | 05:04 |
| bigjools | and then some later code blows up | 05:04 |
| stevemar | bigjools: i don't think it necessarily needs group IDs at that point yet, yeah - its going on and blowing up somewhere else | 05:04 |
| stevemar | bigjools: have logs? | 05:05 |
| bigjools | I do! | 05:05 |
| bigjools | apache log? | 05:05 |
| bigjools | there's no a lot of info in it, tbh | 05:05 |
| stevemar | meh, whatever logs | 05:05 |
| bigjools | I can see that group_ids is never set | 05:05 |
| stevemar | just want to see the exact error message | 05:05 |
| bigjools | http://paste.ubuntu.com/11808328/ | 05:06 |
| bigjools | bottom of there | 05:06 |
| stevemar | jamielennox: also.. https://review.openstack.org/#/c/196413/ | 05:07 |
| stevemar | and https://review.openstack.org/#/c/196416/ | 05:07 |
| bigjools | the only place I can see that might generate that error is in handle_scoped_token | 05:08 |
| jamielennox | stevemar: that ones at the end of a chain | 05:08 |
| stevemar | jamielennox: it is, true. my bad | 05:09 |
| jamielennox | i mean i can +2 it but meh | 05:09 |
| stevemar | was more of a heads up | 05:09 |
| jamielennox | stevemar: as penance https://review.openstack.org/#/c/196950/ | 05:10 |
| jamielennox | dstanek: https://review.openstack.org/#/c/196950/ as well, then bknudson and i can debate the one after that which actually does something | 05:10 |
| jamielennox | (other people may debate as well, just we've been going back and forth on these a lot) | 05:12 |
| *** vilobhmm has quit IRC | 05:13 | |
| *** jk|osx has quit IRC | 05:13 | |
| *** vilobhmm has joined #openstack-keystone | 05:13 | |
| stevemar | bigjools: so silly question, is 'student' in the 'default' domain in any groups? | 05:16 |
| bigjools | should be, yes, let me double check | 05:16 |
| bigjools | stevemar: http://paste.ubuntu.com/11808351/ | 05:18 |
| openstackgerrit | Merged openstack/keystone: Update requirements by hand. https://review.openstack.org/197773 | 05:19 |
| stevemar | bigjools: yep, thats a group | 05:20 |
| stevemar | bigjools: bah, the rule processor is killing you before it can create the auth context | 05:21 |
| bigjools | that sounds positive, yet negative :) | 05:22 |
| stevemar | dstanek: neat is what i was going for | 05:22 |
| dstanek | stevemar: just tried parts of the script locally and things generally looked like they would work | 05:23 |
| stevemar | dstanek: yep, i tried it myself | 05:23 |
| stevemar | the only catch is that the "author" aka bot, can only have 1 active patch per project | 05:23 |
| stevemar | if it has >1, it dies | 05:24 |
| stevemar | but that same logic is used for the requirements updates | 05:24 |
| stevemar | so i don't feel too bad | 05:24 |
| stevemar | the only bit i want, but couldn't figure out is, how to get what branch the job is running on | 05:24 |
| stevemar | might need to bug infra ppl on that one | 05:25 |
| stevemar | maybe as a follow-on patch, not sure how often we expect to generate new configs for stable branches | 05:25 |
| dstanek | stevemar: you just need to get the current branch of the working copy? | 05:25 |
| stevemar | dstanek: yessum | 05:25 |
| dstanek | stevemar: i use something like: git branch | grep '*' | awk '{print 2}' | 05:27 |
| dstanek | oops --- typo | 05:27 |
| dstanek | that last part should be $2 | 05:27 |
| dstanek | there probably is a better git way though | 05:28 |
| *** histrio has joined #openstack-keystone | 05:28 | |
| histrio | Hello, everyone! | 05:28 |
| dstanek | stevemar: and 'man git' leads me to 'git rev-parse --abbrev-ref HEAD' | 05:29 |
| dstanek | histrio: hello | 05:29 |
| histrio | Recently, I've got version conflict in devstack installation https://bpaste.net/show/d98d6ff80199 | 05:30 |
| histrio | devstack - stable/kilo | 05:30 |
| histrio | keystone - stable/kilo | 05:31 |
| histrio | /opt/stack/requirements/global-requirements.txt:pycadf>=0.8.0,<0.9.0 | 05:31 |
| bigjools | stevemar: so is that something I can fix in config or is it a bug? | 05:31 |
| histrio | I dont't know yet) | 05:31 |
| stevemar | bigjools: i think it's dying here: https://github.com/openstack/keystone/blob/675a1cff0c007f749cf4a1fe6dc30d209bdbc179/keystone/auth/plugins/mapped.py#L152 | 05:33 |
| stevemar | but it shouldn't be going there if you have local set | 05:33 |
| bigjools | right | 05:33 |
| bigjools | let me throw some debugging in and confirm | 05:34 |
| bigjools | it's not going to be in handle_scoped_token() above there is it? | 05:34 |
| stevemar | bigjools: ughhhhhhhh | 05:35 |
| bigjools | https://github.com/openstack/keystone/blob/675a1cff0c007f749cf4a1fe6dc30d209bdbc179/keystone/auth/plugins/mapped.py#L91 | 05:35 |
| stevemar | bigjools: add the "type": "local" IN the "user" key | 05:35 |
| stevemar | not in th local key | 05:35 |
| bigjools | rargh! | 05:35 |
| stevemar | https://github.com/openstack/keystone/blob/master/keystone/tests/unit/mapping_fixtures.py#L675-L681 | 05:35 |
| stevemar | yours is on the same level | 05:35 |
| stevemar | haha | 05:35 |
| stevemar | i was gonna be so pissed if it regressed | 05:36 |
| stevemar | okay, pretty sure your problem is solved :P | 05:36 |
| bigjools | shouldn't schema validation catch that? | 05:36 |
| *** fangzhou_ has quit IRC | 05:36 | |
| * bigjools tries it out | 05:36 | |
| stevemar | bigjools: nah, the validation on the local side is weak, since we don't know what properties we wanted to map to | 05:37 |
| bigjools | ok | 05:37 |
| stevemar | but yeah, that one should be validate-able | 05:37 |
| bigjools | this is a bit of a minefield.... but thanks for spotting that | 05:37 |
| stevemar | bigjools: open a bug to improve schema validation for "local" attributes? | 05:37 |
| stevemar | i got a guy who can work on it | 05:37 |
| bigjools | you bet | 05:37 |
| dstanek | histrio: that's odd. it looks like a good version does exist: https://pypi.python.org/simple/pycadf/ | 05:38 |
| bigjools | stevemar: and it worked \o/ | 05:38 |
| stevemar | bigjools: \o/ | 05:38 |
| bigjools | thanks *so much* | 05:38 |
| histrio | dstanek: yep, `pip install` does work | 05:38 |
| stevemar | dstanek: thats the version specified in GR for kilo, https://github.com/openstack/requirements/blob/stable/kilo/global-requirements.txt#L98 | 05:38 |
| bigjools | I thought I had checked that... I'm obviously more tired than I realised | 05:39 |
| dstanek | stevemar: it looks like it should be found ok | 05:39 |
| stevemar | bigjools: it's all good :) | 05:39 |
| dstanek | histrio: did you pip install with the version constraint? | 05:39 |
| bigjools | I am filing that bug *right now* :) | 05:39 |
| stevemar | that's what keystone says too pycadf>=0.8.0,<0.9.0 | 05:40 |
| stevemar | bigjools: thanks! | 05:40 |
| stevemar | i'll get diazjf to work on it | 05:40 |
| stevemar | dstanek: jamielennox have fun holding down the fort | 05:42 |
| stevemar | i'm off for another day or two | 05:42 |
| stevemar | see y'all | 05:42 |
| stevemar | bigjools: good luck | 05:42 |
| jamielennox | stevemar: see ya | 05:42 |
| *** stevemar has quit IRC | 05:42 | |
| histrio | dstanek: I tried with same constraint and it succeed | 05:42 |
| *** ayoung has quit IRC | 05:42 | |
| histrio | Manual installation works, but devstack fail with it | 05:43 |
| *** dima__ has quit IRC | 05:51 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Remove keystoneclient CLI references in README https://review.openstack.org/196413 | 05:54 |
| openstackgerrit | Merged openstack/python-keystoneclient: Remove keystoneclient CLI references in README https://review.openstack.org/196413 | 05:54 |
| histrio | I suppose, I found a problem | 06:09 |
| *** mabrams has joined #openstack-keystone | 06:09 | |
| histrio | During devstack installation ceilometermiddleware installs before keystone. | 06:11 |
| histrio | https://bpaste.net/show/0c4da7258fda | 06:12 |
| histrio | It fetch pycadf 1.0 | 06:12 |
| histrio | keystone requirements differs https://bpaste.net/show/5375c5433026 | 06:14 |
| histrio | And devstack fails https://bpaste.net/show/d98d6ff80199 | 06:16 |
| histrio | Sorry for my English | 06:16 |
| *** roxanaghe has quit IRC | 06:19 | |
| *** ankita_wagh has quit IRC | 06:30 | |
| *** browne has quit IRC | 06:36 | |
| ajayaa | jamielennox, Can I add support for "/v3/users/<user_id>/credentials/OS-EC2" in python-keystoneclient? | 06:42 |
| *** stevemar has joined #openstack-keystone | 06:42 | |
| *** belmoreira has joined #openstack-keystone | 06:44 | |
| ajayaa | Would it be something which can be accepted upstream? | 06:44 |
| *** vilobhmm has quit IRC | 06:45 | |
| *** stevemar has quit IRC | 06:46 | |
| *** belmoreira has quit IRC | 06:47 | |
| *** belmoreira has joined #openstack-keystone | 06:58 | |
| *** belmoreira has quit IRC | 06:58 | |
| *** lufix has joined #openstack-keystone | 06:59 | |
| *** belmoreira has joined #openstack-keystone | 06:59 | |
| *** _kiran_ has joined #openstack-keystone | 07:03 | |
| *** kiranr has joined #openstack-keystone | 07:04 | |
| *** _kiran_ has quit IRC | 07:05 | |
| *** kiran-r has quit IRC | 07:07 | |
| *** kiranr has quit IRC | 07:08 | |
| *** fifieldt has quit IRC | 07:09 | |
| *** hrou has quit IRC | 07:13 | |
| jamielennox | ajayaa: is that a thing? | 07:14 |
| jamielennox | we added support for ec2 to keystoneclient, but i don't remember it being there | 07:15 |
| ajayaa | If you added then it should be there, I think. | 07:16 |
| ajayaa | From what I can see right now, it is there in keystoneclient.v2, not in keystoneclient.v3 | 07:16 |
| ajayaa | I want to add it in keystoneclient.v3 too. | 07:16 |
| jamielennox | ajayaa: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/ec2.py | 07:16 |
| jamielennox | ajayaa: i only added that recently because we needed it in devstack, but it's in at least the most recent release | 07:17 |
| jamielennox | oh, that is the URL for EC2 i thought it had it's own top level | 07:17 |
| ajayaa | jamielennox, Thanks. That is helpful. I will find out which release is that and use that. | 07:17 |
| jamielennox | ajayaa: np | 07:18 |
| ajayaa | jamielennox, Why are there two ways to create ec2 credential? | 07:18 |
| ajayaa | one is v3/credential api and the other is /v3/users/<user_id>/credentials/OS-EC2. | 07:19 |
| jamielennox | ajayaa: my understanding is essentially it's a mistake | 07:19 |
| jamielennox | OS-EC2 is middleware, and at some point it was added to the v3 pipeline as well as the v2 pipeline | 07:20 |
| *** rharwood has quit IRC | 07:20 | |
| jamielennox | so we ended up with this interface which probably shouldn't exist being turned on in deployments by default | 07:20 |
| jamielennox | there are a few changes | 07:20 |
| ajayaa | My understanding is that, it should not have been added to v3 pipeline. | 07:20 |
| jamielennox | in OS-EC2 it will generate keys for you | 07:20 |
| jamielennox | and if you deal with credentials directly you need to submit ec2 credentials in a specific json format which is very ugly from a CLI | 07:21 |
| ajayaa | jamielennox, yes. That should be done even in /v3/credential api. | 07:21 |
| jamielennox | ajayaa: it should be done client side | 07:21 |
| ajayaa | jamielennox, agreed. | 07:22 |
| ajayaa | I struggled to get the json right while creating credential using curl. | 07:22 |
| jamielennox | ajayaa: yep, i experimented with that as well | 07:22 |
| ajayaa | Are there plans to drop one of these in future? | 07:22 |
| jamielennox | no, they will both survive for a while, credentials is the more general interface, hopefully one day that will be offloaded to barbican | 07:23 |
| jamielennox | but we are stuck with them both for v3 | 07:23 |
| *** rharwood has joined #openstack-keystone | 07:23 | |
| jamielennox | devstack relies on OS-EC2 which is why we added it to keystoneclient and openstackclient | 07:24 |
| *** aix has joined #openstack-keystone | 07:24 | |
| ajayaa | jamielennox, Thanks. Are there people who store certs in keystone? | 07:24 |
| ajayaa | I feel like it's something which does not fit into the problem Keystone is trying to solve. | 07:25 |
| jamielennox | ajayaa: i'm not sure what people do with credentials in large deployments, i know there was the expectation that certs and ssh keys were the other credentials | 07:25 |
| *** fhubik has joined #openstack-keystone | 07:28 | |
| *** fhubik is now known as fhubik_afk | 07:28 | |
| *** ankita_wagh has joined #openstack-keystone | 07:30 | |
| *** ankita_wagh has quit IRC | 07:43 | |
| *** jistr has joined #openstack-keystone | 07:48 | |
| *** stevemar has joined #openstack-keystone | 07:49 | |
| *** fhubik_afk is now known as fhubik | 07:49 | |
| *** kiran-r has joined #openstack-keystone | 07:49 | |
| *** stevemar has quit IRC | 07:53 | |
| *** _kiran_ has joined #openstack-keystone | 07:53 | |
| *** kiran-r has quit IRC | 07:57 | |
| *** lhcheng has joined #openstack-keystone | 07:57 | |
| *** ChanServ sets mode: +v lhcheng | 07:57 | |
| ajayaa | Hey jamielennox, I am using python-keystoneclient to create projects and users. I get a warning every time I create a user or project. This looks like "WARNING keystoneclient.utils [-] create takes at most 1 positional argument (2 given)" | 08:01 |
| ajayaa | It's really annoying. This looks ugly with my otherwise beautiful test results. | 08:01 |
| *** afazekas has joined #openstack-keystone | 08:01 | |
| ajayaa | I tried digging into the code, but could not find a good reason for this. | 08:02 |
| *** _kiran_ is now known as kiran-r | 08:03 | |
| ajayaa | I am using keystoneclient version 1.6.0 | 08:03 |
| *** rwsu has quit IRC | 08:13 | |
| *** rwsu has joined #openstack-keystone | 08:15 | |
| *** jamielennox is now known as jamielennox|away | 08:20 | |
| *** amaretskiy has joined #openstack-keystone | 08:21 | |
| marekd | odyssey4me: i am here. | 08:25 |
| marekd | gsilvis: hi, ping me when you are available. | 08:26 |
| *** henrynash has joined #openstack-keystone | 08:33 | |
| *** ChanServ sets mode: +v henrynash | 08:33 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Show helpful message when creating service without request body https://review.openstack.org/195429 | 08:33 |
| *** jamielennox|away is now known as jamielennox | 08:41 | |
| *** yottatsa has joined #openstack-keystone | 08:41 | |
| jamielennox | ajayaa: | 08:42 |
| jamielennox | ajayaa: so that means it's wanting you to pass something as a keyword argument but you pass it as a positional argument | 08:42 |
| jamielennox | it's handled by @utils.positional on functions | 08:42 |
| jamielennox | so you'd need to figure out what you're calling | 08:43 |
| *** abhishekk has joined #openstack-keystone | 08:46 | |
| *** henrynash has quit IRC | 08:48 | |
| *** aix has quit IRC | 08:50 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Show helpful message when request body is not provided https://review.openstack.org/195903 | 08:51 |
| *** ajayaa has quit IRC | 08:53 | |
| *** afazekas has quit IRC | 08:54 | |
| *** viktors has joined #openstack-keystone | 09:03 | |
| *** afazekas has joined #openstack-keystone | 09:09 | |
| *** openstackgerrit has quit IRC | 09:19 | |
| *** openstackgerrit has joined #openstack-keystone | 09:20 | |
| *** henrynash has joined #openstack-keystone | 09:23 | |
| *** ChanServ sets mode: +v henrynash | 09:23 | |
| *** afazekas has quit IRC | 09:24 | |
| *** dims has joined #openstack-keystone | 09:24 | |
| *** henrynash has quit IRC | 09:26 | |
| *** bradjones has quit IRC | 09:33 | |
| *** aix has joined #openstack-keystone | 09:34 | |
| *** bradjones has joined #openstack-keystone | 09:35 | |
| *** bradjones has quit IRC | 09:35 | |
| *** bradjones has joined #openstack-keystone | 09:35 | |
| *** e0ne has joined #openstack-keystone | 09:36 | |
| *** stevemar has joined #openstack-keystone | 09:38 | |
| *** yottatsa has quit IRC | 09:39 | |
| *** afazekas has joined #openstack-keystone | 09:39 | |
| *** stevemar has quit IRC | 09:42 | |
| *** e0ne is now known as e0ne_ | 09:46 | |
| *** davechen has left #openstack-keystone | 09:55 | |
| *** ajayaa has joined #openstack-keystone | 09:55 | |
| ekarlso | jamielennox: hey, is there a reason why one can't pass down a timeout to Adapter() ? | 10:04 |
| *** e0ne_ is now known as e0ne | 10:05 | |
| *** federico3 has joined #openstack-keystone | 10:06 | |
| *** lhcheng has quit IRC | 10:12 | |
| openstackgerrit | masato nakagawa proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 10:16 |
| *** yottatsa has joined #openstack-keystone | 10:17 | |
| ekarlso | any other guys here that know ? | 10:22 |
| *** piyanai has joined #openstack-keystone | 10:27 | |
| *** histrio has quit IRC | 10:28 | |
| *** rushiagr_away is now known as rushiagr | 10:42 | |
| *** yottatsa has quit IRC | 10:47 | |
| *** hakimo has joined #openstack-keystone | 10:56 | |
| *** fhubik is now known as fhubik_afk | 11:02 | |
| samueldmq | morning | 11:17 |
| *** amakarov_away is now known as amakarov | 11:17 | |
| *** stevemar has joined #openstack-keystone | 11:27 | |
| *** kiran-r has quit IRC | 11:27 | |
| *** stevemar has quit IRC | 11:30 | |
| *** toddnni has quit IRC | 11:31 | |
| *** e0ne is now known as e0ne_ | 11:34 | |
| *** pawel_ has quit IRC | 11:35 | |
| *** e0ne_ is now known as e0ne | 11:36 | |
| openstackgerrit | Merged openstack/oslo.policy: Remove oslo-incubator specific code https://review.openstack.org/197827 | 11:41 |
| *** toddnni has joined #openstack-keystone | 11:46 | |
| *** dguerri` is now known as dguerri | 11:49 | |
| *** fhubik_afk is now known as fhubik | 11:57 | |
| *** e0ne is now known as e0ne_ | 12:06 | |
| *** e0ne_ is now known as e0ne | 12:11 | |
| *** bdossant has joined #openstack-keystone | 12:15 | |
| *** fhubik is now known as fhubik_afk | 12:15 | |
| *** gordc_af1 is now known as gordc | 12:33 | |
| *** yottatsa has joined #openstack-keystone | 12:35 | |
| *** fhubik_afk is now known as fhubik | 12:36 | |
| odyssey4me | marekd can you unfathom how the rule mapping works for keystone fderation? | 12:37 |
| *** yottatsa_ has joined #openstack-keystone | 12:37 | |
| rodrigods | odyssey4me, hi... there is a doc (under review) that explains very well the mappings: https://review.openstack.org/#/c/192850/ | 12:39 |
| odyssey4me | thanks rodrigods :) | 12:40 |
| *** dsirrine_ has joined #openstack-keystone | 12:40 | |
| *** yottatsa has quit IRC | 12:41 | |
| *** edmondsw has joined #openstack-keystone | 12:42 | |
| odyssey4me | that helps massively, I think - let me try it out | 12:45 |
| *** radez_g0n3 is now known as radez | 12:46 | |
| marekd | odyssey4me: everything clear? | 12:55 |
| odyssey4me | marekd yeah, that's a good doc addition! | 12:55 |
| marekd | odyssey4me: pretty much | 12:55 |
| *** yottatsa_ has quit IRC | 12:57 | |
| *** hrou has joined #openstack-keystone | 13:00 | |
| *** piyanai has quit IRC | 13:05 | |
| *** stevemar has joined #openstack-keystone | 13:09 | |
| *** jsavak has joined #openstack-keystone | 13:11 | |
| *** jsavak has quit IRC | 13:11 | |
| *** jsavak has joined #openstack-keystone | 13:12 | |
| *** mylu has joined #openstack-keystone | 13:13 | |
| *** zzzeek has joined #openstack-keystone | 13:18 | |
| *** yottatsa has joined #openstack-keystone | 13:22 | |
| *** zzzeek has quit IRC | 13:22 | |
| *** bdossant_ has joined #openstack-keystone | 13:23 | |
| *** bdossant_ has quit IRC | 13:24 | |
| *** ninag has joined #openstack-keystone | 13:25 | |
| *** bdossant has quit IRC | 13:26 | |
| *** ninag has quit IRC | 13:26 | |
| *** lastops has joined #openstack-keystone | 13:26 | |
| *** abhishekk has quit IRC | 13:26 | |
| *** e0ne is now known as e0ne_ | 13:29 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 13:30 |
| *** zzzeek has joined #openstack-keystone | 13:32 | |
| *** bdossant has joined #openstack-keystone | 13:34 | |
| *** piyanai has joined #openstack-keystone | 13:35 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 13:35 |
| stevemar | bump: asking for keystone reviews on an infra patch: https://review.openstack.org/#/c/177620/ | 13:36 |
| *** r-daneel has joined #openstack-keystone | 13:36 | |
| *** richm has joined #openstack-keystone | 13:36 | |
| *** piyanai has quit IRC | 13:40 | |
| *** e0ne_ is now known as e0ne | 13:43 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Project tree deletion https://review.openstack.org/148730 | 13:46 |
| *** jsavak has quit IRC | 13:46 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: WIP: Dynamic Policies Delivering Mechanism https://review.openstack.org/197980 | 13:48 |
| *** fhubik is now known as fhubik_afk | 13:49 | |
| stevemar | samueldmq: oh no, i took a look :( | 13:51 |
| *** fhubik_afk is now known as fhubik | 13:52 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Project tree deletion https://review.openstack.org/148730 | 13:52 |
| stevemar | #noregrets | 13:52 |
| *** topol has joined #openstack-keystone | 13:52 | |
| *** ChanServ sets mode: +v topol | 13:52 | |
| samueldmq | stevemar: shh .. :( | 13:52 |
| samueldmq | stevemar: sorry, I am referencing that in another spec, and I wanted a link :) | 13:52 |
| stevemar | samueldmq: all good :) | 13:53 |
| samueldmq | stevemar: let' not talk about it, otherwise people will get curious :) | 13:53 |
| samueldmq | hehe | 13:53 |
| *** fifieldt has joined #openstack-keystone | 13:53 | |
| stevemar | talk about what? <.< >.> | 13:53 |
| samueldmq | stevemar: I have no idea what you're talking about | 13:53 |
| * samueldmq is going back to writing dynamic policy specs o/ | 13:54 | |
| *** jecarey has joined #openstack-keystone | 13:55 | |
| *** bdossant has quit IRC | 13:56 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:56 | |
| *** jsavak has joined #openstack-keystone | 13:57 | |
| *** bdossant has joined #openstack-keystone | 13:59 | |
| *** mylu has quit IRC | 14:00 | |
| *** rlt has joined #openstack-keystone | 14:04 | |
| *** mylu has joined #openstack-keystone | 14:05 | |
| *** jsavak has quit IRC | 14:05 | |
| *** jsavak has joined #openstack-keystone | 14:05 | |
| *** fhubik is now known as fhubik_afk | 14:08 | |
| *** browne has joined #openstack-keystone | 14:11 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add unit test for fernet provider https://review.openstack.org/197649 | 14:12 |
| *** fhubik_afk is now known as fhubik | 14:13 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Show helpful message when request body is not provided https://review.openstack.org/195903 | 14:15 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Show helpful message when request body is not provided https://review.openstack.org/197996 | 14:15 |
| *** jaosorior has joined #openstack-keystone | 14:19 | |
| *** dims has quit IRC | 14:19 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Dynamic Policies with Custom IDs https://review.openstack.org/198000 | 14:20 |
| samueldmq | stevemar: ^ | 14:20 |
| stevemar | o/ | 14:20 |
| samueldmq | stevemar: this one is a very simple, but has reference to others in 'Dependencies' section | 14:20 |
| stevemar | ah | 14:21 |
| *** aix has quit IRC | 14:21 | |
| samueldmq | stevemar: reading this one you can get a very good idea of the whole thing :) | 14:21 |
| stevemar | good good | 14:21 |
| samueldmq | dstanek: the spec for what we were discussing yesterday about policy with custom ids | 14:21 |
| samueldmq | morganfainberg: cc ^ | 14:21 |
| samueldmq | stevemar: now I am going to update the last one: Dynamic Policies Delivering Mechanism | 14:22 |
| samueldmq | stevemar: before sending the FFE email for dynamic policies later today o/ | 14:22 |
| dstanek | samueldmq: which one? | 14:24 |
| samueldmq | dstanek: Dynamic Policies with Custom IDs https://review.openstack.org/198000 | 14:24 |
| *** mabrams has quit IRC | 14:26 | |
| *** tsufiev has left #openstack-keystone | 14:27 | |
| *** hogepodge has quit IRC | 14:28 | |
| dstanek | stevemar: i though you were out for the next couple of days | 14:29 |
| *** ajayaa has quit IRC | 14:29 | |
| *** e0ne is now known as e0ne_ | 14:30 | |
| *** e0ne_ is now known as e0ne | 14:32 | |
| *** rm_work is now known as rm_work|away | 14:37 | |
| *** mylu has quit IRC | 14:37 | |
| *** mylu has joined #openstack-keystone | 14:38 | |
| *** dims has joined #openstack-keystone | 14:38 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Dynamic Policies with Custom IDs https://review.openstack.org/198000 | 14:40 |
| *** jsavak has quit IRC | 14:41 | |
| browne | general question, if i'm running two keystones behind a load balancer, and my keystones are using fernet tokens. do the fernet keys generated from fernet_setup have to be the same on each keystone? | 14:41 |
| *** jsavak has joined #openstack-keystone | 14:41 | |
| *** fhubik is now known as fhubik_afk | 14:42 | |
| dstanek | browne: yes | 14:42 |
| dstanek | browne: you probably want to generate on one machine and sync to the other | 14:42 |
| browne | dstanek: short and sweet. thanks! | 14:42 |
| *** mylu has quit IRC | 14:42 | |
| dstanek | or generate them offlne and sync to them both | 14:42 |
| *** dims has quit IRC | 14:44 | |
| *** mylu has joined #openstack-keystone | 14:45 | |
| *** dims has joined #openstack-keystone | 14:49 | |
| *** rlt has quit IRC | 14:50 | |
| *** rletrocquer has joined #openstack-keystone | 14:50 | |
| *** henrynash has joined #openstack-keystone | 14:54 | |
| *** ChanServ sets mode: +v henrynash | 14:54 | |
| *** piyanai has joined #openstack-keystone | 14:56 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v2_token() https://review.openstack.org/197647 | 14:57 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v2_token() https://review.openstack.org/197706 | 14:57 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor _supports_bind_authentication method https://review.openstack.org/197699 | 14:57 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v3_token() https://review.openstack.org/196877 | 14:57 |
| *** bradjones has quit IRC | 14:57 | |
| *** fhubik_afk is now known as fhubik | 14:58 | |
| *** fhubik is now known as fhubik_afk | 14:58 | |
| *** bradjones has joined #openstack-keystone | 14:58 | |
| *** bradjones has quit IRC | 14:58 | |
| *** bradjones has joined #openstack-keystone | 14:58 | |
| *** hogepodge has joined #openstack-keystone | 15:01 | |
| *** fhubik_afk is now known as fhubik | 15:01 | |
| *** fhubik is now known as fhubik_afk | 15:04 | |
| openstackgerrit | Theodore Ilie proposed openstack/keystone: Add test case for deleting endpoint with space in url https://review.openstack.org/196883 | 15:04 |
| *** dims has quit IRC | 15:06 | |
| *** Guest42148 has joined #openstack-keystone | 15:07 | |
| *** slberger has joined #openstack-keystone | 15:07 | |
| *** dguerri is now known as dguerri` | 15:07 | |
| *** afazekas has quit IRC | 15:08 | |
| *** diazjf has joined #openstack-keystone | 15:08 | |
| *** Guest42148 is now known as dims_ | 15:09 | |
| *** belmoreira has quit IRC | 15:10 | |
| *** rm_work|away is now known as rm_work | 15:14 | |
| openstackgerrit | Ioram Schechtman Sette proposed openstack/keystone-specs: API spec for managing Attribute hierarchies in the Policy database https://review.openstack.org/184926 | 15:21 |
| *** jsavak has quit IRC | 15:21 | |
| *** jsavak has joined #openstack-keystone | 15:22 | |
| *** yottatsa has quit IRC | 15:22 | |
| *** chlong has quit IRC | 15:23 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 15:23 |
| *** woodster_ has joined #openstack-keystone | 15:23 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: API changes for Reseller https://review.openstack.org/153007 | 15:24 |
| *** yottatsa has joined #openstack-keystone | 15:24 | |
| *** hrou has quit IRC | 15:26 | |
| *** jsavak has quit IRC | 15:26 | |
| *** bdossant has quit IRC | 15:27 | |
| *** jsavak has joined #openstack-keystone | 15:28 | |
| *** anhhuynx has joined #openstack-keystone | 15:28 | |
| *** lufix has quit IRC | 15:29 | |
| *** kfox1111_away is now known as kfox1111 | 15:31 | |
| *** yottatsa has quit IRC | 15:35 | |
| *** jk|osx has joined #openstack-keystone | 15:37 | |
| *** ankita_wagh has joined #openstack-keystone | 15:38 | |
| openstackgerrit | Fernando Diaz proposed openstack/keystone: Adding Documentation for Mapping Combinations https://review.openstack.org/192850 | 15:43 |
| *** ankita_wagh has quit IRC | 15:48 | |
| *** stevemar has quit IRC | 15:48 | |
| *** mylu has quit IRC | 16:00 | |
| *** mylu has joined #openstack-keystone | 16:01 | |
| *** mylu has quit IRC | 16:01 | |
| *** mylu has joined #openstack-keystone | 16:02 | |
| openstackgerrit | Jason Obrien proposed openstack/keystone: Updated docs for Keystone startup https://review.openstack.org/197225 | 16:02 |
| *** jsavak has quit IRC | 16:02 | |
| *** jistr has quit IRC | 16:02 | |
| *** jason10258 has joined #openstack-keystone | 16:04 | |
| *** jsavak has joined #openstack-keystone | 16:04 | |
| *** __afazekas is now known as afazekas | 16:08 | |
| *** Lactem has joined #openstack-keystone | 16:10 | |
| *** piyanai has quit IRC | 16:11 | |
| Lactem | Wouldn't I check if a user is admin with 'keystone ec2-credentials-get --access <access>?' | 16:12 |
| *** stevemar has joined #openstack-keystone | 16:13 | |
| *** stevemar has quit IRC | 16:14 | |
| *** fhubik_afk is now known as fhubik | 16:14 | |
| *** ayoung has joined #openstack-keystone | 16:15 | |
| *** ChanServ sets mode: +v ayoung | 16:15 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Federation API provides method to evaluate rules https://review.openstack.org/196308 | 16:16 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Change mapping model so rules is dict https://review.openstack.org/196293 | 16:16 |
| *** piyanai has joined #openstack-keystone | 16:18 | |
| *** _cjones_ has joined #openstack-keystone | 16:18 | |
| Lactem | Does anyone know how to check if a user can update/view his/her ec2 credentials? | 16:21 |
| mylu | Hi guys I'm seeing a very weird error. when I try to do a get method to /v3/OS-FEDERATION/projects I see "keystone.middleware.core [-] Auth token not in the request header" But I definitly specified headers = {'X-Auth-Token': 'abcdetiuhjvjio'} | 16:21 |
| *** mylu has quit IRC | 16:23 | |
| *** mylu has joined #openstack-keystone | 16:25 | |
| *** jkomg has joined #openstack-keystone | 16:26 | |
| *** lufix2 has joined #openstack-keystone | 16:28 | |
| *** jsavak has quit IRC | 16:30 | |
| *** jk|osx has quit IRC | 16:30 | |
| samueldmq | ayoung: morganfainberg hi, could you please take a look at 'Dynamic Policies with Custom IDs' https://review.openstack.org/198000 | 16:30 |
| samueldmq | ayoung: morganfainberg I'd like to have your toughts on that approach, which is what I was discussing yesterday with gyee and dstanek | 16:31 |
| *** jsavak has joined #openstack-keystone | 16:33 | |
| ayoung | samueldmq, I don't think so | 16:35 |
| ayoung | samueldmq, I would like to keep the ID generation inside of Keystone, as I really want that to move to a hash | 16:35 |
| ayoung | samueldmq, but I see what you are getting at....what if.... | 16:36 |
| samueldmq | ayoung: policy id could be a hash of the url, or whatever | 16:36 |
| samueldmq | ayoung: and we can advice that, actually .. .:) | 16:36 |
| *** ankita_wagh has joined #openstack-keystone | 16:36 | |
| samueldmq | ayoung: sure go ahead | 16:36 |
| ayoung | we create policy nicknames, and fetch by nicknames. You upload a new policy file for a nickname, it still gets an ID, but the ID is assigned to the nickname | 16:36 |
| *** rm_work is now known as rm_work|away | 16:37 | |
| *** roxanaghe has joined #openstack-keystone | 16:37 | |
| ayoung | the nickname could be the URL etc | 16:37 |
| ayoung | samueldmq, the policy files themselves should be uniquely identifyable, separate from "fetch me the right one" | 16:37 |
| ayoung | samueldmq, that might support david8hu 's request to fetch policy for a specific project | 16:38 |
| samueldmq | ayoung: ids would still be unique, even if customizable | 16:38 |
| samueldmq | ayoung: I see what you mean, that could be just like policy's name | 16:39 |
| samueldmq | ayoung: the idea of using id was to fetch it directly in the URL, without needing to use filters | 16:39 |
| david8hu | ayoung, samueldmq, I am multitasking multiple things today :) | 16:39 |
| samueldmq | ayoung: so we would have GET /policies/my-own-policy, as opposed to GET /policies?name=my-own-policy | 16:40 |
| openstackgerrit | Henrique Truta proposed openstack/python-keystoneclient: Add is_domain field to v3 token https://review.openstack.org/198062 | 16:40 |
| samueldmq | ayoung: if that makes sense | 16:40 |
| ayoung | david8hu, either form is OK | 16:40 |
| samueldmq | david8hu: that's good :) | 16:40 |
| samueldmq | ayoung: you meant me ? | 16:40 |
| david8hu | ayoung, trying to get things done b4 the long weekend :) | 16:41 |
| ayoung | samueldmq, yes, you. I misread. the goal is to be able to have complex rules on the "decide which one te fetch' side inside keystone | 16:41 |
| openstackgerrit | Henrique Truta proposed openstack/python-keystoneclient: Add is_domain field to v3 token https://review.openstack.org/198062 | 16:41 |
| ayoung | not that it is "store a policy, fetch only that same policy" | 16:41 |
| samueldmq | ayoung: so you ok with custom ids ? | 16:42 |
| ayoung | samueldmq, no | 16:42 |
| samueldmq | ayoung: hmm, so you don't like the idea of : download policy my-own-policy in the endpoints .. | 16:42 |
| ayoung | samueldmq, calling them ids confuses thing. Labels or names is better | 16:42 |
| ayoung | samueldmq, I like the concept. But naming is hard | 16:42 |
| ayoung | we want to fetch policy by critera | 16:43 |
| ayoung | we don't want to store by criteria | 16:43 |
| samueldmq | ayoung: from a REST POV, could I ask /entities/<entity_name_instead_of_id_if_name_is_unique> | 16:43 |
| ayoung | samueldmq, In the simplest case, we would have a unified policy file. All of the services, when asking for policy, would get that same file | 16:43 |
| ayoung | now, if we want to vary from endpoint to endpoint...we still may want to share the policy file between some endpoints, but not all | 16:44 |
| samueldmq | ayoung: yes, so a single id for them all to download | 16:44 |
| samueldmq | ayoung: in that case, you update the middleware config in the endpoints you want to vary | 16:44 |
| samueldmq | ? | 16:44 |
| ayoung | samueldmq, no updating of config | 16:44 |
| ayoung | middleware says "this is who I am. Give me the right file" | 16:45 |
| ayoung | Keystone decides which is the right file | 16:45 |
| samueldmq | ayoung: so the association still happens in the server | 16:45 |
| ayoung | absolutely | 16:45 |
| samueldmq | ayoung: and how the endpoint says: 'this is who I am' ? | 16:45 |
| ayoung | samueldmq, by URL | 16:45 |
| samueldmq | ayoung: by URL doesn't work, since different interfaces can have different URLs | 16:46 |
| ayoung | I don't care | 16:46 |
| ayoung | that is stupid and not something we really should give any credence to | 16:46 |
| samueldmq | ayoung: internal keystone can be '10.0.0.1:5000' and public '152.165.15.42:5000' | 16:46 |
| ayoung | and they should still have the same policy | 16:46 |
| *** janonymous_ has joined #openstack-keystone | 16:46 | |
| samueldmq | ayoung: oh I agree they should be the same policy, but we have to deal with the fact of URL doesn't uniquely identify an endpoint | 16:47 |
| ayoung | but that is fine | 16:47 |
| ayoung | it is the other case that is a problem | 16:47 |
| ayoung | where the same URL means two or more endpoints. | 16:47 |
| ayoung | I don't care about that, either | 16:47 |
| ayoung | two URLS getting the same endpoint-policy-file is the norm | 16:47 |
| samueldmq | ayoung: if we don't care about that, it's bad to UX for some deployers | 16:47 |
| ayoung | no it is not | 16:48 |
| ayoung | they don | 16:48 |
| samueldmq | ayoung: gyee for example have different URLs for different interfaces | 16:48 |
| ayoung | we are so far ahead of them | 16:48 |
| ayoung | and wants different polciy for them? That is supported | 16:48 |
| *** arunkant has joined #openstack-keystone | 16:48 | |
| samueldmq | ayoung: no he doesn't, but what URL should he use? | 16:48 |
| ayoung | wants the same policy for them? THat is supported too | 16:48 |
| samueldmq | ayoung: this question shows bad UX, doesn't it ? | 16:48 |
| ayoung | which ever one he wants | 16:48 |
| ayoung | samueldmq, what we have is broken, badle, and we are discussing nitnoid details. Fetch by URL is good enough, by a lonbg shot | 16:49 |
| ayoung | for all the needs | 16:49 |
| ayoung | if we need to do something more, the tools are in place | 16:49 |
| ayoung | samueldmq, maybe what we do i something like this: | 16:50 |
| dstanek | using URL is too confusing | 16:50 |
| *** ankita_w_ has joined #openstack-keystone | 16:50 | |
| ayoung | dstanek, give me any reasonable alternative | 16:50 |
| *** yottatsa has joined #openstack-keystone | 16:51 | |
| dstanek | i like the arbitrary ids that samueldmq was pitching - even if you call them names/labels or whatever | 16:51 |
| ayoung | dstanek, that is not a full solution | 16:51 |
| dstanek | what's missing? | 16:51 |
| ayoung | dstanek, you are thinking "every time I install a new endpoint, I upload my policy file" | 16:52 |
| ayoung | that is not the case | 16:52 |
| ayoung | If it is an arbitraty label, I need to map that back to the entities I have | 16:52 |
| *** Lactem has quit IRC | 16:52 | |
| ayoung | like Endpoints and services | 16:52 |
| ayoung | the idea is that policy should be global, bu maybe we need to do one policy file per service to dela with name clashes between nova and neutron | 16:53 |
| ayoung | so we need to say "I need th eright policy foir the service" | 16:53 |
| ayoung | but we are not going to go and change the config file when we finally straighten things out, and have both nova and neutron use a unified policy file | 16:53 |
| ayoung | we want to manage that in keystone | 16:53 |
| ayoung | we want the hierarchical roles | 16:53 |
| *** ankita_wagh has quit IRC | 16:54 | |
| ayoung | all the node tells is is "this is who I am" and the keystone server determines "this is the policy file you get" | 16:54 |
| dstanek | having a URL in the service config seems artibtrary. if could be any string. URL is not significant in the use cases I have seen | 16:54 |
| ayoung | if we make it an arbitraty label, we still need to map that to something | 16:54 |
| ayoung | dstanek, URL maps to endpoint...close enough for our needs | 16:54 |
| ayoung | we can fudge things a little, by doing partial url mappings and whatever | 16:55 |
| *** mestery has quit IRC | 16:55 | |
| dstanek | but my point is that the string can be arbitrary - it could be service_ha_region_iad | 16:55 |
| ayoung | if we store policy by https://nova/ and fetch via https://nova/v3 | 16:55 |
| ayoung | dstanek, that decision should be made in keystone, not in Nova | 16:55 |
| ayoung | Keystone can provide the grouping./ | 16:55 |
| ayoung | Nova endpoint does not select which policy to fetch | 16:56 |
| *** henrynash has quit IRC | 16:56 | |
| ayoung | it only says its own Identity ,and Keystone selects the right policy | 16:56 |
| dstanek | if you want hierarchical policies we should document that in the spec | 16:56 |
| *** piyanai has quit IRC | 16:56 | |
| ayoung | dstanek, I've written a hundred docs | 16:56 |
| ayoung | I've had this all laid out, and torn it apart, and...lets stop the discussion and just do the absolute minimum to move things along | 16:57 |
| ayoung | we already have fetch by endpoint id | 16:57 |
| ayoung | that was the reason for it | 16:57 |
| ayoung | we are just trying to make things easier on the deployer by giving them a way to identify the node without having to call Keystone register endpoint first | 16:57 |
| dstanek | right, and with that use case an arbitrary ID works fine | 16:58 |
| samueldmq | ayoung: and for that we need something that uniquely identify an endpoint | 16:58 |
| gsilvis | marekd: Thirty minutes from now? | 16:58 |
| samueldmq | i.e an id | 16:58 |
| dstanek | there are too many different policy specs to see a clear vision of what we are trying to do | 16:58 |
| dstanek | right now it seems like "here is a bunch of random stuff"....."go" | 16:59 |
| *** amaretskiy has quit IRC | 16:59 | |
| samueldmq | dstanek: I am finishing the last one on the set of 4 defining the scope for L, I'll be sending the FFE email today | 16:59 |
| dstanek | samueldmq: 4 different specs? | 16:59 |
| samueldmq | dstanek: it will contain the propsoed scope for L | 17:00 |
| samueldmq | dstanek: yes | 17:00 |
| samueldmq | dstanek: well 5 with the alternative of assigning by custom ID, as ayoung prefers | 17:00 |
| samueldmq | ayoung: dstanek I think we should consider both options and put that on the table next meeting | 17:00 |
| samueldmq | ayoung: dstanek looks fair, right ? so we get more eyes on this and take a decision | 17:01 |
| *** gyee has joined #openstack-keystone | 17:01 | |
| *** ChanServ sets mode: +v gyee | 17:01 | |
| ayoung | dstanek, how do Imap arbitrary Id to Endpoint? I need another API to do that | 17:01 |
| *** piyanai has joined #openstack-keystone | 17:02 | |
| ayoung | dstanek, I had a fucking overview spec. It go "not a spec" on it | 17:02 |
| *** mylu has quit IRC | 17:02 | |
| ayoung | I am really not happy now. | 17:02 |
| samueldmq | ayoung: what that spec proposes is to direct say to endpoint: 'fetch policy X' | 17:02 |
| samueldmq | ayoung: that's different from 'I am endpoint K, gimme my policy' | 17:02 |
| dstanek | :-) i guess i'm confused why we need so many specs for a single feature | 17:02 |
| samueldmq | ayoung: I will consider both and we can discuss it next meeting | 17:03 |
| dstanek | are all of the uses case in one of the specs i do i have to go and find them? | 17:03 |
| ayoung | dstanek, because it touches multiple components, many of which are not keystone. Because it has to be done infcrementally, | 17:03 |
| samueldmq | ayoung: in this specifc topoic | 17:03 |
| ayoung | dstanek, it all starts with 968696 | 17:03 |
| samueldmq | ayoung: of 'how to identify the policy for an endpoint' | 17:03 |
| ayoung | "admin" | 17:03 |
| *** Lactem has joined #openstack-keystone | 17:03 | |
| ayoung | we can't just change the default policy because then we break existing deployments | 17:04 |
| *** kiran-r has joined #openstack-keystone | 17:04 | |
| ayoung | in order to allow policy to change in a manageable manner, we have to make it dynamic | 17:04 |
| dstanek | ayoung: do any of them lay our the overall vision and end goals or do i have to come up with that i think it is after reading them all? | 17:04 |
| ayoung | dstanek, I don't know. I had it clearly laid out in the overview spec, and then the biokeshedding began | 17:05 |
| ayoung | samueldmq, has done a good job trying to keep up with it | 17:05 |
| dstanek | ayoung: i assume that was abandoned...do you have a link? | 17:05 |
| ayoung | but in doing so, we lost the links to the individual tasks...so we are now trying to recreate it on the wiki | 17:05 |
| ayoung | dstanek, yea, one sec | 17:05 |
| *** mylu has joined #openstack-keystone | 17:05 | |
| *** yottatsa has quit IRC | 17:06 | |
| *** diazjf has left #openstack-keystone | 17:06 | |
| ayoung | dstanek, not abandonded yet | 17:06 |
| *** gokrokve has joined #openstack-keystone | 17:06 | |
| ayoung | https://review.openstack.org/#/c/147651/ | 17:06 |
| ayoung | dstanek, let me look back at earlier revisions and tell you which to look at | 17:07 |
| *** arunkant has quit IRC | 17:07 | |
| *** mylu has quit IRC | 17:07 | |
| dstanek | ayoung: i'm not for or against any of these ideas...but right now i don't see what they are adding up to | 17:08 |
| *** arunkant has joined #openstack-keystone | 17:08 | |
| ayoung | dstanek, I'm leaning right now to giving a presentation at the midcycle | 17:08 |
| ayoung | I don't think I can explain it piecemeal anymore...its like sweeping sand out of a beachhouse | 17:08 |
| ayoung | dstanek, let me try and write up an endstate document, and then show how we can get there via a series of incrementals. | 17:09 |
| ayoung | https://adam.younglogic.com/2014/11/dynamic-policy-in-keystone/ probably needs an update | 17:10 |
| *** arunkant has quit IRC | 17:11 | |
| *** e0ne has quit IRC | 17:11 | |
| *** arunkant has joined #openstack-keystone | 17:12 | |
| *** yottatsa has joined #openstack-keystone | 17:12 | |
| *** crc32 has joined #openstack-keystone | 17:13 | |
| *** crc32 is now known as crc32_lundh | 17:14 | |
| *** crc32_lundh is now known as crc32_lunch | 17:14 | |
| *** stevemar has joined #openstack-keystone | 17:15 | |
| *** yottatsa has quit IRC | 17:15 | |
| *** yottatsa has joined #openstack-keystone | 17:15 | |
| *** piyanai has quit IRC | 17:16 | |
| *** piyanai has joined #openstack-keystone | 17:17 | |
| *** mylu has joined #openstack-keystone | 17:19 | |
| *** stevemar has quit IRC | 17:19 | |
| *** piyanai_ has joined #openstack-keystone | 17:20 | |
| *** piyanai has quit IRC | 17:21 | |
| *** piyanai_ is now known as piyanai | 17:21 | |
| mylu | Hey guys I hit a problem with the python-keystonclient when I try to do client.session.get(url=url, headers=headers, verify=False). I get "keystoneclient.openstack.common.apiclient.exceptions.Unauthorized:" and in keystone.log file I see "keystone.middleware.core [-] Auth token not in the request header" But I set my header to {'X-Auth-Token': '1234567qwert'} | 17:22 |
| mylu | Can some one help me with that? or point me a direction for looking? | 17:23 |
| ayoung | WTF is my openstackid? | 17:24 |
| openstackgerrit | Henrique Truta proposed openstack/python-keystoneclient: Add is_domain field to v3 token https://review.openstack.org/198062 | 17:24 |
| gsilvis | marekd: I'm going to get lunch now, but I'm free for the rest of the day after that (1800-2100 UTC) | 17:25 |
| edmondsw | is there any documentation on setting up a project to act as a domain? | 17:26 |
| morganfainberg | ayoung: your login to the openstack.org profile pages | 17:27 |
| *** piyanai has quit IRC | 17:27 | |
| morganfainberg | ayoung: its the same as it used to be, just with an openid connector now | 17:27 |
| ayoung | morganfainberg, WHAT IS MY ID? | 17:27 |
| ayoung | It is nothing I can think of | 17:27 |
| *** haneef has joined #openstack-keystone | 17:28 | |
| morganfainberg | Email? | 17:28 |
| ayoung | it is not accepting email, it is not accepting launchpad. | 17:28 |
| morganfainberg | Mine is my email. | 17:28 |
| *** piyanai has joined #openstack-keystone | 17:28 | |
| ayoung | morganfainberg, I even did password reset with email | 17:28 |
| morganfainberg | Weird. | 17:28 |
| ayoung | musthave beeen a delay | 17:29 |
| morganfainberg | Got the email now? | 17:29 |
| *** arunkant has quit IRC | 17:30 | |
| *** jason10258 has quit IRC | 17:31 | |
| *** jsavak has quit IRC | 17:31 | |
| *** jsavak has joined #openstack-keystone | 17:31 | |
| dstanek | it is near impossible to run tests on older versions of keystone. our requirements are too liberal and oslo is too volatile | 17:31 |
| openstackgerrit | Theodore Ilie proposed openstack/keystone: Catch exception.Unauthorized when checking for admin https://review.openstack.org/198071 | 17:32 |
| *** arunkant has joined #openstack-keystone | 17:33 | |
| Lactem | :) | 17:33 |
| morganfainberg | dstanek: you mean stuff thst was eol'd? | 17:35 |
| morganfainberg | Or you mean stable branches too? | 17:35 |
| dims_ | dstanek: any stable branch breaks? | 17:35 |
| morganfainberg | dims_: haha! You're lurking! | 17:35 |
| morganfainberg | :) | 17:36 |
| dstanek | i'm on master about 1500 revisions back.... i'm doing (or trying) a git bisect to see when a bug got fixed | 17:36 |
| *** kiran-r has quit IRC | 17:36 | |
| dims_ | morganfainberg: :) | 17:36 |
| morganfainberg | Lol. 1500 revisions | 17:36 |
| morganfainberg | Ouch | 17:36 |
| dstanek | morganfainberg: dims_: the problem i am having is that requirements say >= and the newer versions of oslo are completely different | 17:36 |
| morganfainberg | dstanek: yep. Welcome to *hell* | 17:38 |
| *** yottatsa has quit IRC | 17:38 | |
| dstanek | lol | 17:38 |
| morganfainberg | just make the >= a =? | 17:38 |
| dstanek | that's what i'm doing | 17:38 |
| morganfainberg | That should work and just floor the reqs | 17:39 |
| *** Lactem has quit IRC | 17:39 | |
| dstanek | but i had to change by bisect script to do that too | 17:39 |
| morganfainberg | Ick | 17:39 |
| morganfainberg | Wait. What bug are you chasing that youre 1500 revs back? | 17:39 |
| *** albertom has quit IRC | 17:39 | |
| mfisch | ran into a weird problem today with keystone when (finally) switching to wsgi | 17:40 |
| *** fhubik has quit IRC | 17:40 | |
| morganfainberg | mfisch: ok do tell! | 17:41 |
| mfisch | the prescense of python-secretstorage (package) caused keystone to blow up | 17:41 |
| mfisch | it even threw a dbus error | 17:41 |
| morganfainberg | What?! | 17:41 |
| morganfainberg | How... The | 17:41 |
| dstanek | i want to update the commit message on https://review.openstack.org/#/c/196883/ to make is sound less abrasive toward the bug reporter - wanted revisions, but i don't think that's possible | 17:41 |
| mfisch | I don't expect to see org.freedesktop in keystone logs | 17:41 |
| mfisch | I blew the machines up but I can probably repro and get you a stack. | 17:41 |
| mfisch | After it happened it refused to load the keystone.py wsgi file | 17:41 |
| morganfainberg | That is a weird one dude | 17:41 |
| dstanek | mfisch: that's weird | 17:41 |
| dims_ | dstanek: there's an effort to do better - see http://git.openstack.org/cgit/openstack/openstack-specs/tree/specs/requirements-management.rst | 17:42 |
| mfisch | nobody here knows why that package is installed, its not coming up on clean nodes, so I just removed it | 17:42 |
| dims_ | dstanek: larger than oslo | 17:42 |
| morganfainberg | dstanek: i think the commit message really is fine as is. | 17:42 |
| mfisch | I'll get some stacks and file a bug | 17:42 |
| morganfainberg | dstanek: but *shrug* | 17:42 |
| morganfainberg | mfisch: dont spend too much time on it. But it would be interesting to know why | 17:43 |
| mfisch | yeah probabloy just a bug to warn others | 17:43 |
| morganfainberg | Yup | 17:43 |
| morganfainberg | Can we put an anti requirements in? | 17:43 |
| morganfainberg | :P | 17:43 |
| mfisch | conflicts: | 17:43 |
| morganfainberg | !python-secretstorage | 17:43 |
| openstack | morganfainberg: Error: "python-secretstorage" is not a valid command. | 17:43 |
| morganfainberg | openstack: shush | 17:44 |
| morganfainberg | ! | 17:44 |
| morganfainberg | !something | 17:44 |
| openstack | morganfainberg: Error: "something" is not a valid command. | 17:44 |
| morganfainberg | Lol | 17:44 |
| morganfainberg | !help | 17:44 |
| openstack | morganfainberg: (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin. | 17:44 |
| dstanek | !rm -rf / | 17:44 |
| openstack | dstanek: Error: "rm" is not a valid command. | 17:44 |
| dstanek | openstack: now i know you are lying | 17:45 |
| samueldmq | dstanek: what are you trying to do ? LOL | 17:45 |
| dstanek | yeah, lying....time to go back to sleep | 17:45 |
| samueldmq | <.< >.> | 17:45 |
| morganfainberg | !;drop table plugins | 17:45 |
| openstack | morganfainberg: Error: ";drop" is not a valid command. | 17:45 |
| morganfainberg | I wonder if you can shellcode inject to that interface somehow. | 17:46 |
| dstanek | haha, i was just thinking that | 17:46 |
| dstanek | or XSS someone's client | 17:46 |
| dstanek | dims_: neat, i'll take a look | 17:47 |
| dstanek | dims_: i'd love to just freeze requirements for a release to exact versions | 17:47 |
| *** albertom has joined #openstack-keystone | 17:48 | |
| dstanek | and then periodically update stable if needed | 17:48 |
| *** shaleh has joined #openstack-keystone | 17:49 | |
| dims_ | dstanek: ++ hope to get there. right now we have a g-r in stable/* but we don't have all libraries released from stable branch that do have the specific g-r requirements unfortunately | 17:49 |
| *** Lactem has joined #openstack-keystone | 17:51 | |
| dims_ | so this round, the first step is centralized library releases | 17:51 |
| dstanek | dims_: that's a great start | 17:52 |
| *** hrou has joined #openstack-keystone | 17:53 | |
| openstackgerrit | Henrique Truta proposed openstack/keystonemiddleware: WIP: Handling is_domain token attribute from keystone https://review.openstack.org/198076 | 17:57 |
| *** ankita_w_ has quit IRC | 17:58 | |
| *** ankita_wagh has joined #openstack-keystone | 17:59 | |
| *** Lactem has quit IRC | 17:59 | |
| *** jake___ has joined #openstack-keystone | 18:04 | |
| *** jsavak has quit IRC | 18:05 | |
| *** jsavak has joined #openstack-keystone | 18:06 | |
| *** piyanai has quit IRC | 18:08 | |
| *** piyanai has joined #openstack-keystone | 18:09 | |
| *** slberger has left #openstack-keystone | 18:09 | |
| ayoung | mylu, was about to answer | 18:12 |
| ayoung | mylu, you are doing this from python? | 18:13 |
| *** ankita_w_ has joined #openstack-keystone | 18:14 | |
| *** jsavak has quit IRC | 18:14 | |
| *** jsavak has joined #openstack-keystone | 18:14 | |
| mylu | ayoung: yes. Did you find my question? I can post it again of not | 18:14 |
| *** jaosorior has quit IRC | 18:16 | |
| *** ankita_wagh has quit IRC | 18:16 | |
| mylu | ayoung: I also tried using netcat listen to the port to see the request body, X-Auth-Token showed up in the header section | 18:17 |
| ayoung | mylu, what are you trying to do? | 18:19 |
| *** browne has quit IRC | 18:20 | |
| mylu | ayoung: I was trying to get project lists for federated user. the python call is client.session.get(url=url, headers=headers, verify=False) | 18:21 |
| mylu | ayoung: when I do it with curl it worked | 18:21 |
| ayoung | client.session.get hmmm | 18:21 |
| *** jsavak has quit IRC | 18:22 | |
| mylu | client here is from IdP and I'm using keystone v3 | 18:23 |
| ayoung | my to list projects for user you want... | 18:23 |
| mylu | from keystone.conf file in IdP I see "keystone.middleware.core [-] Auth token not in the request header" | 18:23 |
| mylu | ayoung: sorry what do you mean? | 18:24 |
| ayoung | mylu, once you have the session, you should not be making deliberate calls onit, but rather on the keystone client...looking for the call | 18:24 |
| ayoung | mylu, so...I'm wroking with some client code, let me send you a link | 18:25 |
| mylu | ayoung: cool thanks | 18:26 |
| ayoung | https://github.com/admiyo/ossipee/blob/master/ossipee.py#L207 | 18:26 |
| ayoung | mylu, I do a little renaming in the imports, but you see there I create one session and share it among 3 clients | 18:26 |
| *** rushiagr is now known as rushiagr_away | 18:26 | |
| ayoung | so, to list projects for a user it would be ... | 18:26 |
| ayoung | self.keystone.projects.list(user=user) | 18:27 |
| ayoung | or something close to that | 18:27 |
| *** jake___ has quit IRC | 18:27 | |
| *** lhcheng has joined #openstack-keystone | 18:29 | |
| *** ChanServ sets mode: +v lhcheng | 18:29 | |
| openstackgerrit | Richard Megginson proposed openstack/keystone: add federation docs for mod_auth_mellon https://review.openstack.org/198083 | 18:31 |
| *** stevemar has joined #openstack-keystone | 18:31 | |
| mylu | ayoung: Ohh I see what you mean. I think I didn't explain my question well. Let me try again. | 18:31 |
| mylu | ayoung: so I'm trying to do "curl -s -H "X-Auth-Token: 123456aqwert" http://keystone.sp/v3/OS-FEDERATION/projects | python -mjson.tool" in python | 18:32 |
| *** r-daneel has quit IRC | 18:32 | |
| mylu | "client" here is created by my client class. it has self.session=keystoneclient.session(from keystoneclient) | 18:34 |
| *** wuhg has quit IRC | 18:34 | |
| *** stevemar has quit IRC | 18:34 | |
| mylu | I want to get SP's project list for an IdP client can I do that with self.keystone.projects.list()? | 18:34 |
| ayoung | mylu, probably not. | 18:34 |
| *** packet has joined #openstack-keystone | 18:34 | |
| ayoung | But...try it | 18:35 |
| ayoung | mylu, actually, drop the name= param | 18:35 |
| *** tjcocozz has joined #openstack-keystone | 18:35 | |
| *** gokrokve has quit IRC | 18:35 | |
| ayoung | and it should try to list projects for the current user. The Federation token should be OK for that...I think? | 18:35 |
| *** Lactem has joined #openstack-keystone | 18:35 | |
| ayoung | mylu, so, I am not current myself on the state of Federation support in the client. I *think* it is all there, but would have to go and dig in the git log | 18:37 |
| ayoung | let's seeee. | 18:37 |
| *** sp4wnr0ot_ has joined #openstack-keystone | 18:37 | |
| mylu | I read the code earlier to try to find out why | 18:37 |
| ayoung | mylu, yeah... | 18:37 |
| mylu | looks like the header is not being passed throught to me .... from here => http://docs.openstack.org/developer/keystone/_modules/keystone/middleware/core.html | 18:37 |
| Lactem | Can any core dev (besides David) look at my patch if they have a moment? https://review.openstack.org/#/c/196883 | 18:38 |
| mylu | Because the error message I found in keystone.log was "Auth token no in the request header | 18:38 |
| ayoung | mylu, commit id is 53e79a30427769b6c9498a502b5f67ca5f71f3ca | 18:39 |
| ayoung | http://git.openstack.org/cgit/openstack/python-keystoneclient/commit/?id=53e79a30427769b6c9498a502b5f67ca5f71f3ca | 18:39 |
| ayoung | self.client.federation.projects | 18:39 |
| ayoung | mylu so self.keystone.federation.projects.list() | 18:40 |
| mylu | is that is devstack kilo? | 18:40 |
| ayoung | mylu, it is in Kilo, yes | 18:41 |
| ayoung | mylu, so, the clients are not part of the integrated release, you will always get the latest from pip etc | 18:41 |
| ayoung | clients can be updated faster than the projects themselves | 18:41 |
| mylu | cool I'll try to use that | 18:42 |
| mylu | thank you! | 18:42 |
| ayoung | mylu, good luck | 18:42 |
| *** Lactem has quit IRC | 18:43 | |
| *** e0ne has joined #openstack-keystone | 18:46 | |
| *** stevemar has joined #openstack-keystone | 18:48 | |
| ayoung | samueldmq, I'm putting in a policy presentation for Tokyo. Would you like to co-present? | 18:48 |
| samueldmq | ayoung: sure | 18:49 |
| *** r-daneel has joined #openstack-keystone | 18:49 | |
| samueldmq | ayoung: let me take a look at the exact title/description when you have defined :) | 18:51 |
| samueldmq | ayoung: let me take a look at the exact title/description when you have defined :) | 18:51 |
| ayoung | samueldmq, I need a bio for you | 18:51 |
| samueldmq | oh sorry, wanted to re-run the last command in another scren | 18:51 |
| samueldmq | ayoung: ^ hehe | 18:51 |
| samueldmq | screen | 18:51 |
| *** lhcheng has quit IRC | 18:52 | |
| *** tqtran has joined #openstack-keystone | 18:52 | |
| *** jsavak has joined #openstack-keystone | 18:53 | |
| *** dsirrine_ has quit IRC | 18:56 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/197277 | 18:57 |
| stevemar | morganfainberg: if you could verify you want to proceed with this: https://review.openstack.org/#/c/177620/ that would be super awesomo | 18:58 |
| samueldmq | ayoung: somehting from linkedin ? let me see yours | 18:59 |
| samueldmq | ayoung: so I can create mine (I've never did this before) | 19:00 |
| ayoung | samueldmq, I'm sitting next to another Brazilian RHer, but from Sao Paulo. We were comparing notes. | 19:00 |
| morganfainberg | stevemar: nope definitely don't want that... no making people's lives better... nope nope nope nope +1 ;) | 19:00 |
| ayoung | sp4wnr0ot_, meet samueldmq | 19:00 |
| morganfainberg | stevemar: lgtm | 19:00 |
| samueldmq | ayoung: cool | 19:00 |
| samueldmq | sp4wnr0ot_: olá o/ | 19:00 |
| sp4wnr0ot_ | samueldmq, e ae cara vc tá famoso por aqui =D | 19:01 |
| samueldmq | sp4wnr0ot_: haha that's funny :) | 19:01 |
| samueldmq | sp4wnr0ot_: I am trying to do some good work with ayoung and keystone guys | 19:01 |
| morganfainberg | stevemar: hope that merges soon(ish) | 19:01 |
| *** jkomg has quit IRC | 19:01 | |
| stevemar | morganfainberg: thanks :) | 19:01 |
| stevemar | morganfainberg: bug some of your infra hp folks if you want it merged :P | 19:02 |
| * morganfainberg goes on holiday hours early...or someting | 19:02 | |
| sp4wnr0ot_ | samueldmq, that's cool! I'm gonna send you an invite in linkedin just to keep in touch | 19:02 |
| samueldmq | sp4wnr0ot_: sure, let me know whenever you have any question, etc in keystone | 19:02 |
| samueldmq | sp4wnr0ot_: (I am not sure how familiar you are with this project) | 19:03 |
| ayoung | samueldmq, can you send me a bio, and I'll add you to the presentation as a speaker? | 19:03 |
| ayoung | presentation proposal, that is | 19:03 |
| samueldmq | sp4wnr0ot_: and I am assuming you will be working here :) | 19:03 |
| *** ajayaa has joined #openstack-keystone | 19:03 | |
| ayoung | https://www.openstack.org/summit/tokyo-2015/call-for-speakers/manage/3995/summary samueldmq | 19:04 |
| *** jkomg has joined #openstack-keystone | 19:04 | |
| *** jsavak has quit IRC | 19:04 | |
| samueldmq | ayoung: can I see your bio ? | 19:04 |
| *** jsavak has joined #openstack-keystone | 19:05 | |
| samueldmq | ayoung: just to see what it looks like .. I've never written one myself :p | 19:05 |
| *** stevemar has quit IRC | 19:05 | |
| ayoung | samueldmq, sure...let me see if it is public yet | 19:05 |
| ayoung | http://fpaste.org/239366/43586396/ | 19:06 |
| janonymous_ | o/ | 19:09 |
| *** dsirrine_ has joined #openstack-keystone | 19:12 | |
| *** tjcocozz has quit IRC | 19:12 | |
| *** ajayaa has quit IRC | 19:12 | |
| *** arunkant_ has joined #openstack-keystone | 19:17 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Dynamic Policies Delivering Mechanism https://review.openstack.org/197980 | 19:18 |
| samueldmq | ayoung: morganfainberg ^ this one describes the caching strategy we discussed last week, including avoiding thundering herd, etc | 19:18 |
| samueldmq | ayoung: morganfainberg now we have a set of specs that define all we want for L | 19:19 |
| *** tqtran is now known as tqtran-afk | 19:19 | |
| samueldmq | ayoung: morganfainberg I am going to write up the FFE email now ... will ask you before sending it | 19:19 |
| samueldmq | I mean ... finally >.> >.> >.> \o/ <.< <.< <.< | 19:20 |
| *** arunkant has quit IRC | 19:21 | |
| *** ankita_w_ has quit IRC | 19:22 | |
| *** shaleh has quit IRC | 19:23 | |
| *** amerine has joined #openstack-keystone | 19:25 | |
| *** lhcheng has joined #openstack-keystone | 19:27 | |
| *** ChanServ sets mode: +v lhcheng | 19:27 | |
| *** jkomg has quit IRC | 19:27 | |
| *** amakarov is now known as amakarov_away | 19:28 | |
| raildo | topol, ping, do you had the opportunity to read the htruta's answers here? https://review.openstack.org/#/c/153007/36 | 19:28 |
| *** rm_work|away is now known as rm_work | 19:29 | |
| *** jsavak has quit IRC | 19:30 | |
| *** janonymous_ has quit IRC | 19:30 | |
| *** amerine has left #openstack-keystone | 19:31 | |
| samueldmq | ayoung: I don't know my openstack-id | 19:31 |
| samueldmq | ayoung: I don't even remember if I have one | 19:31 |
| *** jsavak has joined #openstack-keystone | 19:32 | |
| topol | Hi raildo, not yet | 19:32 |
| raildo | topol, ok, just to know if it was clear enough :) | 19:34 |
| topol | raildo, so how do folks distinguish between the two projects if they have the exact same name? | 19:36 |
| topol | whats different between the two? Are they nested under different projects | 19:36 |
| topol | raildo^ | 19:37 |
| *** jkomg has joined #openstack-keystone | 19:37 | |
| ayoung | On HMT, have we made any effort to define how a user can assign roles? | 19:37 |
| ayoung | raildo, htruta like, in order to assign a role on this project, I must be an admin on this project? And made sure that was enforced? | 19:39 |
| topol | raildo I added more comments | 19:41 |
| ayoung | dstanek, I'll give you and example of why this Dynamic policy stuff is tricky | 19:41 |
| ayoung | one thing that we want to do is let end operators over ride the policy. But in doing so, they could easily break things so that either too many people can execute the API, or too few | 19:42 |
| raildo | topol, I was answering from here, but I think that can be better if I put in the spec | 19:42 |
| ayoung | when enforcing policy, there are two pieces: role and scope | 19:42 |
| ayoung | role is not even checked for most things right now, but lets assume that is what people are going to want to customize | 19:42 |
| ayoung | one the other side is scope: I want to make sure the project as specified in the token matches the project as specified on the resource: VM, block device, whatever. | 19:43 |
| ayoung | I'd actually like to split policy down the middle here, and say the role part can be customized, but not the scope check. Scope check should be determined by the Nova engineers | 19:44 |
| raildo | ayoung, we don't changed anything about this, so we will follow the policy.v3cloudsample behaviour (cloud, domain and project admin, will be able do grant roles assignments) | 19:44 |
| ayoung | does that get files as a Keystone spec, and oslo,policy spec, or a nova spec | 19:44 |
| ayoung | raildo, we should test that... | 19:45 |
| mylu | ayoung: Hi a quick update on the problem I bumped into......so the correct header should be 'x-auth-token' instead of 'X-Auth-Token'.......It would be nice if it can be fixed? All the documentation refers to 'X-Auth-Token' | 19:46 |
| raildo | ayoung, ++ I'll put it in my todo list | 19:46 |
| *** jk|osx has joined #openstack-keystone | 19:46 | |
| ayoung | mylu, really? Strange that is has not come up before. | 19:47 |
| ayoung | please file it as a bug in launchpad | 19:47 |
| mylu | ayoung: Yeah I'm not quite sure why it pops up. and will do. Thanks for the help! :) | 19:48 |
| *** topol has quit IRC | 19:48 | |
| samueldmq | ayoung: morganfainberg please take a look at this draft of the ffe email and give me some feedback :) | 19:49 |
| samueldmq | ayoung: morganfainberg https://etherpad.openstack.org/p/dynamic-policies-liberty-ffe | 19:49 |
| *** jkomg has quit IRC | 19:50 | |
| *** jecarey has quit IRC | 19:50 | |
| *** shaleh has joined #openstack-keystone | 19:52 | |
| *** Lactem has joined #openstack-keystone | 19:54 | |
| *** e0ne has quit IRC | 19:55 | |
| *** tqtran-afk is now known as tqtran | 19:56 | |
| morganfainberg | samueldmq: will look after lunch. | 19:56 |
| samueldmq | morganfainberg: great thanks, btw bon apetit | 19:57 |
| morganfainberg | samueldmq: also keep in mind it is independance day for us here in the us tomorrow (observed) so might be getting quiet for those on eastern time (its almost 4pm) | 19:57 |
| morganfainberg | With a 3 day weekend pending. | 19:58 |
| *** piyanai has quit IRC | 20:00 | |
| *** packet has quit IRC | 20:01 | |
| *** sp4wnr0ot_ has quit IRC | 20:01 | |
| iurygregory | could any of the cores that a look at 'add federation docs for mod_auth_mellon' (https://review.openstack.org/#/c/198083/) in order to get it approved | 20:03 |
| iurygregory | it has a +2 already | 20:03 |
| iurygregory | dstanek, marekd, cc ^ | 20:03 |
| Lactem | iurygregory: I'm trying to get a second +2 also. :D | 20:03 |
| iurygregory | nice Lactem ^^ | 20:04 |
| Lactem | I'll just put the link here. https://bugs.launchpad.net/keystone/+bug/1098564 | 20:04 |
| openstack | Launchpad bug 1098564 in Keystone "Cannot delete a service or endpoint" [Low,In progress] - Assigned to Theodore Ilie (theoilie-ti) | 20:04 |
| Lactem | Ooops that's the bug, not the patch. https://review.openstack.org/#/c/196883 | 20:04 |
| samueldmq | morganfainberg: hmm, yes .. :) independence day o/ | 20:05 |
| *** piyanai has joined #openstack-keystone | 20:05 | |
| *** jsavak has quit IRC | 20:05 | |
| *** jsavak has joined #openstack-keystone | 20:05 | |
| *** stevemar has joined #openstack-keystone | 20:05 | |
| *** stevemar has quit IRC | 20:09 | |
| *** boris-42 has quit IRC | 20:12 | |
| *** edmondsw has quit IRC | 20:14 | |
| *** lastops has quit IRC | 20:14 | |
| *** e0ne has joined #openstack-keystone | 20:15 | |
| *** ayoung has quit IRC | 20:15 | |
| *** browne has joined #openstack-keystone | 20:16 | |
| *** hogepodge has quit IRC | 20:17 | |
| *** hogepodge has joined #openstack-keystone | 20:18 | |
| *** csoukup has joined #openstack-keystone | 20:32 | |
| *** shaleh has quit IRC | 20:33 | |
| *** jsavak has quit IRC | 20:35 | |
| *** TheIntern has joined #openstack-keystone | 20:53 | |
| *** stevemar has joined #openstack-keystone | 21:07 | |
| *** Rockyg has joined #openstack-keystone | 21:08 | |
| *** Lactem has quit IRC | 21:09 | |
| *** stevemar has quit IRC | 21:09 | |
| *** r-daneel has quit IRC | 21:11 | |
| *** e0ne has quit IRC | 21:20 | |
| *** Lactem has joined #openstack-keystone | 21:24 | |
| Lactem | Any core devs around? | 21:24 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v2_token() https://review.openstack.org/197706 | 21:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor _supports_bind_authentication method https://review.openstack.org/197699 | 21:25 |
| dstanek | Lactem: yup | 21:26 |
| dstanek | what's up? | 21:26 |
| Lactem | dstanek: You already reviewed my patch. : P | 21:26 |
| *** piyanai has quit IRC | 21:26 | |
| dstanek | Lactem: ah, yeah there are lots and lots of patches to review - it might take a while for another to come across it | 21:26 |
| dstanek | plus people are probably preparing for the holiday and the upcoming mid-cycle | 21:27 |
| Lactem | Alright I'll be patient. I'm just excited to be this close to a merge. | 21:27 |
| Lactem | Haha yeah I'm going for holidays in a couple hours, too. | 21:27 |
| dstanek | not if brant gets his hands on it! he pickier than me :-) | 21:27 |
| lbragstad | Lactem: do you have a link? | 21:27 |
| Lactem | I'll try to advertise to someone other than Brant. lol | 21:28 |
| Lactem | https://review.openstack.org/#/c/196883 | 21:28 |
| *** rletrocquer has quit IRC | 21:30 | |
| *** Rockyg has quit IRC | 21:31 | |
| *** piyanai has joined #openstack-keystone | 21:32 | |
| Lactem | lbragstad: Do you want me to review anything of yours? | 21:34 |
| lbragstad | Lactem: sure! https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:consolidate-fernet-provider,n,z | 21:34 |
| *** mylu has quit IRC | 21:35 | |
| Lactem | I would -1 to make 2 minor grammar/spelling changes to your commit message, but you already have a +2 and x2 +1s. | 21:36 |
| Lactem | lbragstad: Hey you're on patch set 8 like me. | 21:37 |
| lbragstad | Lactem: you can go ahead and make the comments, it's nice to have a reminder to catch those in case I respin for other comments | 21:37 |
| dstanek | lbragstad: i'm intending to go through all of your fernet stuff tonight | 21:37 |
| lbragstad | dstanek: ++ | 21:37 |
| lbragstad | dstanek: awesome, | 21:37 |
| *** piyanai has quit IRC | 21:39 | |
| Lactem | David is the best reviewer for me. | 21:39 |
| *** piyanai has joined #openstack-keystone | 21:39 | |
| *** piyanai has quit IRC | 21:40 | |
| Lactem | lbragstad: So that doesn't close any bug or anything? Shouldn't you submit a bug report so that you can use that patch to close it? | 21:41 |
| Lactem | I reviewed you by the way. <3 | 21:42 |
| Lactem | IRC hearts look weird to me. | 21:42 |
| Lactem | lbragstad: Feel free to review mine as well if you'd like. | 21:43 |
| dstanek | Lactem: not everything requires a bug report; especially a refactoring | 21:44 |
| lbragstad | Lactem: we could have a bug report I suppose, but it's more of less clean up. I can open one if people want to see one filed for it. | 21:44 |
| *** lastops has joined #openstack-keystone | 21:44 | |
| Lactem | Oh okay. | 21:44 |
| Lactem | I thought it would be wishlist or something. | 21:44 |
| *** lastops has quit IRC | 21:48 | |
| *** boris-42 has joined #openstack-keystone | 21:49 | |
| *** csoukup has quit IRC | 21:53 | |
| *** TheIntern has quit IRC | 21:56 | |
| *** marzif_ has joined #openstack-keystone | 21:58 | |
| Lactem | lbragstad: I replied to your comment. | 21:59 |
| *** crc32_lunch has quit IRC | 22:00 | |
| *** Kennan2 has joined #openstack-keystone | 22:03 | |
| *** lhcheng has quit IRC | 22:03 | |
| *** Kennan has quit IRC | 22:03 | |
| *** r-daneel has joined #openstack-keystone | 22:04 | |
| *** rwsu has quit IRC | 22:05 | |
| *** csoukup has joined #openstack-keystone | 22:09 | |
| *** marzif_ has quit IRC | 22:10 | |
| *** shaleh has joined #openstack-keystone | 22:11 | |
| *** arunkant__ has joined #openstack-keystone | 22:14 | |
| *** csoukup has quit IRC | 22:14 | |
| *** arunkant_ has quit IRC | 22:17 | |
| *** roxanaghe has quit IRC | 22:17 | |
| *** chlong has joined #openstack-keystone | 22:18 | |
| *** gordc is now known as gordc_afk | 22:19 | |
| *** arunkant_ has joined #openstack-keystone | 22:22 | |
| *** arunkant__ has quit IRC | 22:25 | |
| *** dsirrine_ has quit IRC | 22:31 | |
| *** briancurtin has quit IRC | 22:36 | |
| *** briancurtin has joined #openstack-keystone | 22:39 | |
| *** amit213 has quit IRC | 22:42 | |
| *** mancdaz has quit IRC | 22:43 | |
| *** mancdaz has joined #openstack-keystone | 22:44 | |
| *** hrou has quit IRC | 22:47 | |
| *** lhcheng has joined #openstack-keystone | 23:00 | |
| *** ChanServ sets mode: +v lhcheng | 23:00 | |
| *** rharwood has quit IRC | 23:01 | |
| *** rharwood has joined #openstack-keystone | 23:04 | |
| *** Lactem has quit IRC | 23:05 | |
| *** jk|osx has quit IRC | 23:06 | |
| *** r-daneel has quit IRC | 23:09 | |
| openstackgerrit | Victor Stinner proposed openstack/keystone: Fix tox -e py34 https://review.openstack.org/198165 | 23:12 |
| *** raildo_ has joined #openstack-keystone | 23:20 | |
| *** hrou has joined #openstack-keystone | 23:23 | |
| *** zzzeek has quit IRC | 23:33 | |
| *** chlong has quit IRC | 23:36 | |
| morganfainberg | samueldmq: email looks good-ish to me | 23:37 |
| *** anhhuynx has quit IRC | 23:39 | |
| *** zzzeek has joined #openstack-keystone | 23:42 | |
| morganfainberg | huh, adam is gone for the weekend i guess. | 23:43 |
| morganfainberg | i had something that might make his policy stuff easier... ah well | 23:44 |
| *** browne has quit IRC | 23:51 | |
| bigjools | morganfainberg: does the ldap backend create ephemeral users? | 23:56 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!