| morganfainberg | uhm | 00:01 |
|---|---|---|
| morganfainberg | bigjools: it does a mapping to deconflict, but it's not really an ephemeral user | 00:01 |
| morganfainberg | they are real users you can target roles to | 00:02 |
| bigjools | just trying to get my head around things - do they count the same as local DB users? | 00:02 |
| morganfainberg | bigjools: and the mapping is only if you have multiple ldap backends (per-domain identity) | 00:02 |
| morganfainberg | bigjools: they would count as local users | 00:02 |
| morganfainberg | you don't need to assign exclusively to the group | 00:02 |
| bigjools | cool thanks, just what I needed to know | 00:02 |
| morganfainberg | if they aren't part of the default identity backend, you'll need to do a "get" or something to create the deconflicted id | 00:03 |
| *** tqtran has quit IRC | 00:03 | |
| morganfainberg | because the deconflicted id is SHA256(<dn bit>, domain_id) | 00:03 |
| bigjools | what do you mean by deconflict? | 00:03 |
| bigjools | same users in diff backends? | 00:04 |
| *** zzzeek has quit IRC | 00:04 | |
| morganfainberg | so if you have 2 ldap backends | 00:04 |
| morganfainberg | one per domain | 00:04 |
| morganfainberg | we only use a bit of the DN | 00:05 |
| morganfainberg | like CN=<username> | 00:05 |
| morganfainberg | well, that isn't globally unique | 00:05 |
| morganfainberg | so we force a hash of the DN bit and the domain_id (something from the LDAP server and something keystone controls) | 00:05 |
| morganfainberg | so we can ensure globally unique ids | 00:05 |
| morganfainberg | which is a requirement for keystone user id | 00:05 |
| morganfainberg | s | 00:05 |
| samueldmq | morganfainberg: I'd like to hear what you have to make the policy thing easier :) | 00:06 |
| bigjools | morganfainberg: gotcha, thanks | 00:06 |
| samueldmq | morganfainberg: and thanks for taking a look at the email | 00:06 |
| morganfainberg | samueldmq: so if we move to consul as a service catalog backend | 00:08 |
| morganfainberg | it would be possible to use that to either A) communicate (live) the new policy | 00:08 |
| morganfainberg | or for keystone to source in the local (authoritative) policy | 00:08 |
| samueldmq | morganfainberg: I am not aware of exactly mean being a service catalog backend | 00:09 |
| morganfainberg | consul is something i'm looking at to replace the service catalog in the db | 00:10 |
| samueldmq | morganfainberg: lacking some context, sorry :-( | 00:10 |
| *** dims__ has joined #openstack-keystone | 00:10 | |
| samueldmq | morganfainberg: hmm | 00:10 |
| morganfainberg | it can handle communication to / from keystone | 00:10 |
| morganfainberg | and handle live-catalog state | 00:10 |
| morganfainberg | aka: if nova api (one of them) stops responding, it could drop out of the catalog | 00:10 |
| morganfainberg | and a new one would just appear when it is registered/starts responding | 00:10 |
| morganfainberg | plus it has a built-in DNS interface | 00:10 |
| samueldmq | morganfainberg: ohhh | 00:10 |
| samueldmq | morganfainberg: that manages a live catalog | 00:11 |
| morganfainberg | it also has a key-value store | 00:11 |
| samueldmq | ? | 00:11 |
| morganfainberg | so the serivice could push it's local policy into the KVS | 00:11 |
| morganfainberg | (msgpacked) | 00:11 |
| morganfainberg | and keystone could push down dynamic policy files and such | 00:11 |
| morganfainberg | some ideas i'm playing with | 00:12 |
| morganfainberg | i'll go over it at the midcycle | 00:12 |
| samueldmq | morganfainberg: so using the consul "connection" to transmit policies | 00:12 |
| *** dims_ has quit IRC | 00:12 | |
| morganfainberg | you could. | 00:13 |
| samueldmq | morganfainberg: this looks interesting .. this way the deployer wouln't need to register endpoints by hand , right ? (registering in keystone I mean) | 00:13 |
| morganfainberg | thats the idea. | 00:13 |
| samueldmq | morganfainberg: it should be configuring consul-client in the endpoints | 00:13 |
| samueldmq | morganfainberg: and they register themselves | 00:13 |
| samueldmq | morganfainberg: everything via api | 00:13 |
| morganfainberg | thats is part of the idea | 00:13 |
| samueldmq | morganfainberg: and they tell keystone what their policy is .. | 00:13 |
| *** shaleh has quit IRC | 00:13 | |
| samueldmq | morganfainberg: hmm ... | 00:14 |
| samueldmq | morganfainberg: target ? I'd like to see how that fits with how we're planning to implement the dynamic policy stuff | 00:14 |
| samueldmq | morganfainberg: if this would invalidate our current proposal (those specs in the email) or not | 00:14 |
| morganfainberg | it would change the fetch model | 00:14 |
| morganfainberg | but the rest would be the same | 00:15 |
| morganfainberg | again something to talk over @ midcycle | 00:15 |
| samueldmq | morganfainberg: ok, so we can keep the current plans .. and start implementing as we've planned | 00:16 |
| samueldmq | morganfainberg: starting by oslo, etc .. the basics | 00:16 |
| samueldmq | morganfainberg: unfortunatelly I won't attend the micycle meetup :/ I'd love to hear about this | 00:16 |
| morganfainberg | i'll have a better idea in a couple weeks | 00:18 |
| morganfainberg | if this is viable | 00:18 |
| morganfainberg | there are some gaps that i need to work through | 00:18 |
| *** darrenc is now known as darrenc_afk | 00:20 | |
| samueldmq | morganfainberg: I kind of just trust when you say you'll have a better idea in a couple of weeks | 00:20 |
| samueldmq | morganfainberg: I don't know how your mind works | 00:21 |
| morganfainberg | this may not work at all | 00:21 |
| morganfainberg | i'm seeing what data can go into consul and how it handles different states | 00:21 |
| samueldmq | morganfainberg: but that worked when you said you'd have a good idea on the fetch & cache thing | 00:21 |
| samueldmq | morganfainberg: sure | 00:22 |
| samueldmq | morganfainberg: let me know if you need somethin on that front | 00:23 |
| samueldmq | morganfainberg: it's what is in www.consul.io,right ? | 00:23 |
| morganfainberg | samueldmq: yeah | 00:24 |
| *** shaleh has joined #openstack-keystone | 00:26 | |
| samueldmq | morganfainberg: kk | 00:26 |
| *** shaleh_ has joined #openstack-keystone | 00:27 | |
| *** raildo_ has quit IRC | 00:27 | |
| *** shaleh has quit IRC | 00:30 | |
| sigmavirus24 | Is anyone running keystone v3 with Nova? I keep seeing "ERROR (BadRequest): Expecting to find domain in project - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error. (HTTP 400)" when trying to use novaclient, but I'm not sure what's missing from my openrc | 00:32 |
| morganfainberg | sigmavirus24: with neutron or nova net? and what release? | 00:37 |
| morganfainberg | there are some issues with v3 keystone in some releases | 00:37 |
| sigmavirus24 | Running with master right now. | 00:37 |
| sigmavirus24 | (master keystone, master nova) | 00:37 |
| sigmavirus24 | And I'm just trying to do a nova list | 00:37 |
| morganfainberg | it should work. | 00:37 |
| morganfainberg | but i mean... i don't know off hand right this second | 00:37 |
| sigmavirus24 | No worries | 00:38 |
| sigmavirus24 | Am I missing something here? http://paste.openstack.org/show/336925/ | 00:38 |
| sigmavirus24 | I imagine it must be something trivial but I'm not sure what's going on | 00:39 |
| sigmavirus24 | I can auth with keystone client without an issue | 00:39 |
| sigmavirus24 | (keystoneclient.v3.client.Client) | 00:39 |
| *** mhu has quit IRC | 00:42 | |
| *** mhu has joined #openstack-keystone | 00:42 | |
| lhcheng | sigmavirus24: try changing OS_DOMAIN_NAME=default to OS_DOMAIN_NAME=Default | 00:50 |
| sigmavirus24 | lhcheng: Oh, Let me try that. `default` was working as the domain_id, the name is probably different | 00:50 |
| lhcheng | 'default' is the domain_id, and 'Default' is the domain name | 00:50 |
| jamielennox | sigmavirus24: yea, in devstack (and therefore most setups) id=default and name=Default | 00:51 |
| sigmavirus24 | Didn't work =/ | 00:51 |
| jamielennox | sigmavirus24: oh - in project | 00:51 |
| sigmavirus24 | Looks this is using keystoneclient.auth ... let me see if I can reproduce this there | 00:51 |
| sigmavirus24 | jamielennox: ? | 00:52 |
| jamielennox | um, you don't want OS_DOMAIN_X thats for scoping to domains | 00:52 |
| jamielennox | you want OS_PROJECT_DOMAIN_X | 00:52 |
| *** shaleh_ has quit IRC | 00:52 | |
| sigmavirus24 | Ohhh | 00:52 |
| lhcheng | jamielennox: good catch | 00:52 |
| jamielennox | OSC does some hacks around that to make it easier from the CLI, but for working with plugins you need to be explicit | 00:52 |
| sigmavirus24 | jamielennox: I think I'm doing it wrong: http://paste.openstack.org/show/336935/ | 00:55 |
| jamielennox | sigmavirus24: this is for OSC? | 00:56 |
| sigmavirus24 | jamielennox: nope. Just plain old novaclient | 00:56 |
| jamielennox | ergh, i'll need to look | 00:56 |
| *** chlong has joined #openstack-keystone | 00:56 | |
| jamielennox | but i expect you need at least OS_USER_DOMAIN_X | 00:56 |
| sigmavirus24 | Although I get the same problem with osc | 00:57 |
| sigmavirus24 | e.g., OS_USER_DOMAIN_NAME=Default? | 00:57 |
| jamielennox | yea | 00:57 |
| sigmavirus24 | Oh that did it for nova | 00:57 |
| *** browne has joined #openstack-keystone | 00:57 | |
| sigmavirus24 | I still get "Error: openstack" from osc with no other details with that though | 00:58 |
| sigmavirus24 | Thanks jamielennox | 00:58 |
| jamielennox | for OSC you probably want OS_IDENTITY_API_VERSION=3 | 00:58 |
| jamielennox | np | 00:58 |
| sigmavirus24 | Ah | 01:00 |
| sigmavirus24 | That was it | 01:01 |
| sigmavirus24 | Thanks | 01:01 |
| jamielennox | morganfainberg: https://review.openstack.org/#/c/194470/ when you have a moment | 01:05 |
| jamielennox | also https://review.openstack.org/#/c/196950/ | 01:05 |
| jamielennox | or lhcheng ^ do you mind? | 01:06 |
| lhcheng | jamielennox: will take a look | 01:06 |
| *** ayoung has joined #openstack-keystone | 01:09 | |
| *** ChanServ sets mode: +v ayoung | 01:09 | |
| *** davechen has joined #openstack-keystone | 01:13 | |
| *** dhellmann has quit IRC | 01:15 | |
| *** dhellmann has joined #openstack-keystone | 01:15 | |
| *** mfisch has quit IRC | 01:20 | |
| *** darrenc_afk is now known as darrenc | 01:20 | |
| *** woodster_ has quit IRC | 01:21 | |
| *** davechen1 has joined #openstack-keystone | 01:26 | |
| *** _cjones_ has quit IRC | 01:27 | |
| *** davechen has quit IRC | 01:28 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 01:30 | |
| *** stevemar has joined #openstack-keystone | 01:46 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Add token_auth helper to request https://review.openstack.org/196950 | 01:55 |
| *** Kennan has joined #openstack-keystone | 02:02 | |
| *** Kennan2 has quit IRC | 02:03 | |
| morganfainberg | jamielennox: its a holiday for us now :P | 02:04 |
| jamielennox | morganfainberg: i thought that was tomorrow | 02:04 |
| morganfainberg | jamielennox: when i get home will look. | 02:04 |
| morganfainberg | Its 7pm here :P | 02:04 |
| jamielennox | morganfainberg: ok - there's no rush, you're just normally around at this time so i was pushing things forward | 02:05 |
| jamielennox | morganfainberg: go enjoy the holiday | 02:05 |
| morganfainberg | Hehe. | 02:05 |
| miguelgrinberg | jamielennox: are you up for a quick auth related question? | 02:12 |
| jamielennox | miguelgrinberg: sure | 02:13 |
| * jamielennox mentally prepares | 02:13 | |
| miguelgrinberg | I have a horizon running with a federated user (ADFS IdP), and when it sends requests to APIs it gets errors. | 02:13 |
| miguelgrinberg | the error from nova is Malformed request URL: URL's project_id '69f5cff441e04554b285d7772630dec1' doesn't match Context's project_id 'None' | 02:14 |
| miguelgrinberg | I was wondering if you've seen this and can tell me where to go chase this | 02:14 |
| miguelgrinberg | somehow the context's project id is missing | 02:14 |
| jamielennox | so no, i've never seen it | 02:14 |
| miguelgrinberg | okay, it was true that it was a qucik question then :) | 02:14 |
| jamielennox | it's weird because the project_id in the url is being added to the catalog | 02:14 |
| jamielennox | so that's happening at token creation time, so the project_id should be a part of the token | 02:15 |
| miguelgrinberg | when nova says "context's project id" it means a project derived from the token, correct? | 02:15 |
| jamielennox | yes, | 02:15 |
| jamielennox | so it's like you're trying to access it with an unscoped token | 02:15 |
| *** stevemar has quit IRC | 02:16 | |
| jamielennox | my first step would be to have a look at the token you're using | 02:16 |
| miguelgrinberg | well, I'll have to debug it some more to find out. This is horizon getting the token, so I have no idea how it got it. | 02:16 |
| *** stevemar has joined #openstack-keystone | 02:16 | |
| jamielennox | sure, but you can probably capture the token id and then just get keystone to validate it for you | 02:16 |
| miguelgrinberg | yes, I'll start from there. We are so close to get this federation thing working... | 02:17 |
| *** chenhong has joined #openstack-keystone | 02:19 | |
| miguelgrinberg | jamielennox: and since we are talking, I was wondering if there is anything I can help with to get the heat trustee changes over the finish line. If I can help let me know. | 02:19 |
| *** lhcheng has quit IRC | 02:19 | |
| *** chenhong has quit IRC | 02:19 | |
| jamielennox | miguelgrinberg: yea, i just haven't got back to looking at the heat stuff | 02:20 |
| jamielennox | talking at summit we decided we needed to simplify the way contexts were being created in heat, so have one context always and have multiple plugins that you can use from it | 02:20 |
| jamielennox | but that's a lot of refactoring and test rearrangements | 02:20 |
| *** stevemar has quit IRC | 02:21 | |
| miguelgrinberg | yes, sounds like a good idea, but I think a shorter term goal would be to enable heat to use v3, which I think is much smaller in scope. | 02:21 |
| miguelgrinberg | it basically involves eliminating the accesses to the [keystone_authtoken] section | 02:22 |
| openstackgerrit | Deepti Ramakrishna proposed openstack/keystone: Reject user creation using admin_token. https://review.openstack.org/196942 | 02:23 |
| jamielennox | miguelgrinberg: yes, i need to get those patches revised, there was a fairly serious merge conflict i think but i will get back into it | 02:25 |
| jamielennox | miguelgrinberg: if you want to push it quicker than that i have no issue with you having a go at it | 02:25 |
| *** richm has quit IRC | 02:25 | |
| jamielennox | either starting from those patches or from scratch | 02:25 |
| miguelgrinberg | jamielennox: there is one that needs a quick improvement, you had a method defined as a @property and it's not memoizing the result. I'll see if I can get that one fixed for a start. | 02:26 |
| jamielennox | miguelgrinberg: that'd be great, thanks | 02:27 |
| *** gyee has quit IRC | 02:33 | |
| *** mhu has quit IRC | 02:38 | |
| *** topol has joined #openstack-keystone | 02:41 | |
| *** ChanServ sets mode: +v topol | 02:41 | |
| *** mfisch has joined #openstack-keystone | 02:42 | |
| *** mfisch is now known as Guest61548 | 02:42 | |
| *** mhu has joined #openstack-keystone | 02:47 | |
| *** stevemar has joined #openstack-keystone | 02:48 | |
| *** stevemar has quit IRC | 02:51 | |
| *** hakimo_ has joined #openstack-keystone | 02:52 | |
| *** hakimo has quit IRC | 02:54 | |
| *** hogepodge has quit IRC | 03:06 | |
| *** kiran-r has joined #openstack-keystone | 03:15 | |
| *** stevemar has joined #openstack-keystone | 03:35 | |
| *** raildo has quit IRC | 03:48 | |
| *** samueldmq has quit IRC | 03:48 | |
| *** ericksonsantos has quit IRC | 03:48 | |
| *** iurygregory has quit IRC | 03:48 | |
| *** htruta has quit IRC | 03:48 | |
| *** tellesnobrega has quit IRC | 03:49 | |
| *** hogepodge has joined #openstack-keystone | 03:51 | |
| *** dims__ has quit IRC | 03:52 | |
| *** hogepodge has quit IRC | 03:56 | |
| *** hogepodge has joined #openstack-keystone | 04:00 | |
| *** hogepodge has quit IRC | 04:05 | |
| *** hogepodge has joined #openstack-keystone | 04:08 | |
| *** kiran-r has quit IRC | 04:10 | |
| *** stevemar has quit IRC | 04:13 | |
| *** stevemar has joined #openstack-keystone | 04:13 | |
| *** jkomg has joined #openstack-keystone | 04:14 | |
| *** kiran-r has joined #openstack-keystone | 04:17 | |
| *** hogepodge has quit IRC | 04:17 | |
| *** jkomg has quit IRC | 04:19 | |
| *** _cjones_ has joined #openstack-keystone | 04:19 | |
| *** kiran-r has quit IRC | 04:22 | |
| *** hogepodge has joined #openstack-keystone | 04:25 | |
| *** _cjones_ has quit IRC | 04:26 | |
| *** _cjones_ has joined #openstack-keystone | 04:26 | |
| *** hrou has quit IRC | 04:33 | |
| openstackgerrit | Deepti Ramakrishna proposed openstack/keystone: Reject user creation using admin_token. https://review.openstack.org/196942 | 04:46 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Return correct token id in response https://review.openstack.org/198215 | 04:57 |
| *** rushiagr_away is now known as rushiagr | 04:58 | |
| *** topol has quit IRC | 04:59 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Add service token to user token plugin https://review.openstack.org/141614 | 04:59 |
| *** stevemar has quit IRC | 05:03 | |
| *** stevemar has joined #openstack-keystone | 05:04 | |
| *** drjones has joined #openstack-keystone | 05:05 | |
| *** _cjones_ has quit IRC | 05:07 | |
| *** stevemar has quit IRC | 05:10 | |
| *** stevemar has joined #openstack-keystone | 05:11 | |
| *** ajayaa has joined #openstack-keystone | 05:14 | |
| *** _cjones_ has joined #openstack-keystone | 05:19 | |
| *** vg_ has joined #openstack-keystone | 05:22 | |
| *** drjones has quit IRC | 05:23 | |
| *** ayoung has quit IRC | 05:25 | |
| *** _cjones_ has quit IRC | 05:28 | |
| *** vg___ has joined #openstack-keystone | 05:31 | |
| *** vg_ has quit IRC | 05:32 | |
| *** Kennan has quit IRC | 06:02 | |
| *** Kennan has joined #openstack-keystone | 06:02 | |
| *** lhcheng has joined #openstack-keystone | 06:15 | |
| *** ChanServ sets mode: +v lhcheng | 06:15 | |
| openstackgerrit | Masaki Matsushita proposed openstack/keystone: Make max_header_line configurable https://review.openstack.org/166125 | 06:23 |
| *** tobe has joined #openstack-keystone | 06:24 | |
| *** belmoreira has joined #openstack-keystone | 06:46 | |
| *** stevemar has quit IRC | 06:53 | |
| *** dims_ has joined #openstack-keystone | 06:53 | |
| *** stevemar has joined #openstack-keystone | 06:53 | |
| *** stevemar has quit IRC | 06:56 | |
| *** stevemar has joined #openstack-keystone | 06:57 | |
| *** dims_ has quit IRC | 06:58 | |
| *** lufix2 has quit IRC | 07:10 | |
| *** dguerri` has quit IRC | 07:10 | |
| *** dguerri` has joined #openstack-keystone | 07:10 | |
| *** med_ has quit IRC | 07:10 | |
| *** dguerri` is now known as dguerri | 07:10 | |
| *** afazekas has quit IRC | 07:10 | |
| *** lufix has joined #openstack-keystone | 07:11 | |
| *** lufix has joined #openstack-keystone | 07:11 | |
| *** josecastroleon1 has joined #openstack-keystone | 07:11 | |
| *** med_` has joined #openstack-keystone | 07:11 | |
| *** dguerri has quit IRC | 07:11 | |
| *** dguerri has joined #openstack-keystone | 07:11 | |
| *** afazekas has joined #openstack-keystone | 07:11 | |
| *** josecastroleon has quit IRC | 07:11 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch to oslo.cache https://review.openstack.org/195873 | 07:27 |
| *** rharwood has quit IRC | 07:32 | |
| *** albertom has quit IRC | 07:32 | |
| *** andreaf has quit IRC | 07:32 | |
| *** _afazekas has joined #openstack-keystone | 07:33 | |
| *** e0ne has joined #openstack-keystone | 07:33 | |
| *** fhubik has joined #openstack-keystone | 07:33 | |
| *** andreaf_ has joined #openstack-keystone | 07:33 | |
| *** browne has quit IRC | 07:33 | |
| *** chlong has quit IRC | 07:33 | |
| *** powerbsd has joined #openstack-keystone | 07:33 | |
| *** rharwood_ has joined #openstack-keystone | 07:33 | |
| *** andreaf_ is now known as andreaf | 07:33 | |
| *** rharwood_ is now known as rharwood | 07:33 | |
| *** powerbsd is now known as albertom | 07:33 | |
| *** fhubik has quit IRC | 07:33 | |
| *** fhubik has joined #openstack-keystone | 07:33 | |
| *** rharwood has quit IRC | 07:33 | |
| *** rharwood has joined #openstack-keystone | 07:33 | |
| *** albertom has quit IRC | 07:33 | |
| *** albertom has joined #openstack-keystone | 07:33 | |
| *** afazekas has quit IRC | 07:33 | |
| *** e0ne has quit IRC | 07:36 | |
| *** jistr has joined #openstack-keystone | 07:39 | |
| *** lhcheng has quit IRC | 07:41 | |
| *** stevemar has quit IRC | 07:41 | |
| *** lhcheng has joined #openstack-keystone | 07:41 | |
| *** ChanServ sets mode: +v lhcheng | 07:41 | |
| *** stevemar has joined #openstack-keystone | 07:42 | |
| *** bdossant has joined #openstack-keystone | 07:42 | |
| openstackgerrit | Masaki Matsushita proposed openstack/keystone: Make max_header_line configurable https://review.openstack.org/166125 | 07:43 |
| *** dguerri has quit IRC | 07:48 | |
| *** openstackstatus has quit IRC | 07:49 | |
| *** dguerri has joined #openstack-keystone | 07:50 | |
| *** dguerri is now known as dguerri` | 07:50 | |
| *** aix has joined #openstack-keystone | 07:50 | |
| *** openstackstatus has joined #openstack-keystone | 07:51 | |
| *** ChanServ sets mode: +v openstackstatus | 07:51 | |
| *** bdossant has quit IRC | 07:52 | |
| *** bdossant has joined #openstack-keystone | 07:53 | |
| *** browne has joined #openstack-keystone | 07:54 | |
| *** amaretskiy has joined #openstack-keystone | 08:05 | |
| *** fhubik is now known as fhubik_afk | 08:06 | |
| *** bdossant has quit IRC | 08:06 | |
| *** bdossant has joined #openstack-keystone | 08:10 | |
| *** browne has quit IRC | 08:19 | |
| *** stevemar has quit IRC | 08:20 | |
| *** fhubik_afk is now known as fhubik | 08:33 | |
| openstackgerrit | Merged openstack/keystone: Add test case for deleting endpoint with space in url https://review.openstack.org/196883 | 08:33 |
| *** henrynash has joined #openstack-keystone | 08:34 | |
| *** ChanServ sets mode: +v henrynash | 08:34 | |
| *** afazekas has joined #openstack-keystone | 08:37 | |
| *** bdossant has quit IRC | 08:38 | |
| *** bdossant has joined #openstack-keystone | 08:42 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/196485 | 08:45 |
| *** bdossant has quit IRC | 08:47 | |
| *** bdossant has joined #openstack-keystone | 08:50 | |
| *** bdossant has quit IRC | 08:55 | |
| *** openstackgerrit has quit IRC | 08:57 | |
| *** openstackgerrit has joined #openstack-keystone | 08:58 | |
| *** henrynash_ has joined #openstack-keystone | 09:05 | |
| *** ChanServ sets mode: +v henrynash_ | 09:05 | |
| *** henrynash has quit IRC | 09:05 | |
| *** henrynash_ is now known as henrynash | 09:05 | |
| *** e0ne has joined #openstack-keystone | 09:08 | |
| *** mflobo has quit IRC | 09:09 | |
| *** josecastroleon1 has quit IRC | 09:10 | |
| *** belmoreira has quit IRC | 09:11 | |
| openstackgerrit | Ivan Mironov proposed openstack/keystone: Do not specify 'objectClass' twice in LDAP filter string. https://review.openstack.org/198270 | 09:11 |
| *** Qlawy has quit IRC | 09:12 | |
| *** stevemar has joined #openstack-keystone | 09:21 | |
| *** bdossant has joined #openstack-keystone | 09:22 | |
| *** josecastroleon has joined #openstack-keystone | 09:23 | |
| *** stevemar has quit IRC | 09:24 | |
| *** Qlawy has joined #openstack-keystone | 09:30 | |
| *** Qlawy has quit IRC | 09:30 | |
| *** Qlawy has joined #openstack-keystone | 09:30 | |
| *** rdo has quit IRC | 09:31 | |
| *** rdo has joined #openstack-keystone | 09:32 | |
| *** marzif_ has joined #openstack-keystone | 09:37 | |
| *** belmoreira has joined #openstack-keystone | 09:39 | |
| odyssey4me | rodrigods marekd Could you help me work through a problem with federation sso with saml auth? it would appear that for some reason horizon is able to auth initially with an unscoped token, but it doesn't then request a scoped token and thus errors out. We've set Horizon into debug mode and done a bit more hacking to expose the exception. | 09:42 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Show helpful message when request body is not provided https://review.openstack.org/198280 | 09:46 |
| *** davechen1 has left #openstack-keystone | 09:49 | |
| odyssey4me | rodrigods marekd the clue is in the error itself returned by the nova api: project_id '<...>' doesn't match Context's project_id | 10:02 |
| *** alex_xu has quit IRC | 10:06 | |
| *** hughsaunders has quit IRC | 10:07 | |
| *** alex_xu has joined #openstack-keystone | 10:07 | |
| *** hughsaunders has joined #openstack-keystone | 10:07 | |
| *** SpamapS has quit IRC | 10:09 | |
| *** SpamapS has joined #openstack-keystone | 10:09 | |
| *** fhubik is now known as fhubik_afk | 10:11 | |
| *** alex_xu has quit IRC | 10:15 | |
| *** alex_xu has joined #openstack-keystone | 10:15 | |
| *** lhcheng has quit IRC | 10:23 | |
| *** dims_ has joined #openstack-keystone | 10:25 | |
| *** fhubik_afk is now known as fhubik | 10:40 | |
| *** henrynash has quit IRC | 11:09 | |
| marekd | odyssey4me: i am here | 11:10 |
| odyssey4me | marekd :) | 11:10 |
| *** stevemar has joined #openstack-keystone | 11:10 | |
| marekd | odyssey4me: i have never spotted anything like that. | 11:10 |
| marekd | odyssey4me: have you tried private session so other cookies do not interfere ? | 11:11 |
| odyssey4me | marekd just done that with the same result | 11:13 |
| odyssey4me | this looks curious to me though: | 11:13 |
| marekd | quite | 11:13 |
| odyssey4me | u'user': {u'OS-FEDERATION': {u'identity_provider': {u'id': u'adfs-idp'}, u'protocol': {u'id': u'saml2'}, u'groups': []}, u'id': u'My%20Self', u'name': u'My%20Self'}}} | 11:13 |
| *** stevemar has quit IRC | 11:14 | |
| odyssey4me | it would seem that no groups are coming through - does that look like it could be problem? | 11:14 |
| marekd | odyssey4me: did you copy this or rewrite? | 11:14 |
| marekd | there should be group_ids | 11:14 |
| odyssey4me | copy | 11:14 |
| marekd | 0_o | 11:15 |
| marekd | ah no | 11:15 |
| marekd | maybe it's fine :P | 11:15 |
| marekd | anyway, empty groups is bad. | 11:16 |
| marekd | it should not authN you. | 11:16 |
| *** tobe has quit IRC | 11:16 | |
| odyssey4me | so you suspect a mapping issue then? | 11:16 |
| marekd | yes | 11:17 |
| *** samueldmq has joined #openstack-keystone | 11:19 | |
| odyssey4me | marekd this appears to show that it's done the right thing? 2015-07-03 11:21:18.017 15349 ERROR keystone.auth.plugins.mapped [-] {'group_ids': [u'5a4d1d4af1fc4f54aba6ab8831c05efd'], 'user': {'domain': {'id': 'Federated'}, 'type': 'ephemeral', u'name': u'My Self', u'email': u'myself@pigeonbrawl.local'}, 'group_names': [{u'domain': {u'name': u'Default'}, u'name': u'fedgroup'}]} | 11:23 |
| samueldmq | morning | 11:25 |
| odyssey4me | marekd some info for review: http://pastebin.com/P44jxRG7 and a partial keystone debug log from the above-mentioned line onwards: http://pastebin.com/4kAZ12nX | 11:26 |
| marekd | odyssey4me: i see you are using fernet tokens. | 11:28 |
| *** vg___ has quit IRC | 11:29 | |
| odyssey4me | marekd yep, do you think that may be an issue? | 11:29 |
| marekd | odyssey4me: maybe, can we make a quick test and switch to uuid for a second and see if it works? | 11:31 |
| odyssey4me | marekd I just noticed in the above-mentioned log line is has the domain id as 'Federated', whereas my mapping is to the 'Default' domain... I see that the group is correctly mapped to the Default domain | 11:32 |
| *** mflobo has joined #openstack-keystone | 11:36 | |
| *** radez is now known as radez_g0n3 | 11:37 | |
| marekd | odyssey4me: oh yes! | 11:39 |
| marekd | that means it mapped to an existing user. | 11:39 |
| marekd | and this explains empty group list. | 11:39 |
| marekd | i think you wanted to have ephemeral user, right? | 11:39 |
| odyssey4me | marekd yep, what is odd is that there is no such domain as 'Federated' | 11:40 |
| marekd | odyssey4me: true | 11:40 |
| marekd | it's a service domain :-) | 11:40 |
| odyssey4me | notice that the type is ephemeral | 11:40 |
| *** dguerri` is now known as dguerri | 11:46 | |
| odyssey4me | heh marekd switching to uuid instead of fernet appears to work | 11:52 |
| *** ericksonsantos has joined #openstack-keystone | 11:53 | |
| *** gordc_afk has quit IRC | 11:55 | |
| odyssey4me | it's a pity that dolphm and dstanek have a holiday today :p | 12:00 |
| *** amakarov_away is now known as amakarov | 12:03 | |
| *** gordc has joined #openstack-keystone | 12:03 | |
| *** gordc has quit IRC | 12:04 | |
| dstanek | odyssey4me: what's up? | 12:05 |
| *** gordc has joined #openstack-keystone | 12:05 | |
| odyssey4me | dstanek you should be holidaying :p | 12:06 |
| dstanek | odyssey4me: nah. it's 8am and there's work to be done :-) | 12:06 |
| odyssey4me | dstanek it would appear that using fernet tokens with federation breaks federation | 12:07 |
| *** e0ne is now known as e0ne_ | 12:08 | |
| *** raildo has joined #openstack-keystone | 12:08 | |
| odyssey4me | using uuid seems to work fine, but with fernet tokens the context switching doesn't work properly | 12:08 |
| *** arunkant__ has joined #openstack-keystone | 12:08 | |
| dstanek | wow, really? what are you seeing? | 12:08 |
| odyssey4me | (when using horizon's websso) | 12:08 |
| *** lhcheng has joined #openstack-keystone | 12:09 | |
| *** ChanServ sets mode: +v lhcheng | 12:09 | |
| *** iurygregory has joined #openstack-keystone | 12:09 | |
| odyssey4me | nova api returns project_id '<...>' doesn't match Context's project_id | 12:09 |
| *** marzif__ has joined #openstack-keystone | 12:10 | |
| dstanek | so nova is given a fernet token that contains project id X and returns a project id Y? | 12:10 |
| odyssey4me | dstanek yeah, either that or: 1) the project id isn't passed properly; 2) nova doesn't understand the project id properly | 12:11 |
| *** arunkant_ has quit IRC | 12:11 | |
| *** e0ne_ is now known as e0ne | 12:12 | |
| odyssey4me | dstanek what info can I extract to help, or should I give you access to the test box to debug on? | 12:12 |
| *** lhcheng has quit IRC | 12:13 | |
| *** marzif_ has quit IRC | 12:13 | |
| dstanek | odyssey4me: i can send you my public key | 12:14 |
| odyssey4me | dstanek go for it | 12:14 |
| dstanek | do you know where nova gets the project id? it shouldn't be able to see into the token so it should get it from keystone during a validate | 12:14 |
| *** tellesnobrega has joined #openstack-keystone | 12:16 | |
| odyssey4me | dstanek it looks to me like nova does a validation against keystone, but keystone always gives an unscoped token back | 12:22 |
| odyssey4me | the last nova req before it pukes is | 12:23 |
| odyssey4me | 2015-07-03 12:13:19.637 8105 DEBUG keystoneclient.session [-] REQ: curl -g -i --insecure -X GET https://sp.pigeonbrawl.net:5000/v3/auth/tokens -H "X-Subject-Token: {SHA1}28765a35fdf7f49b05e595fb50a08eb1e1f2b2bc" -H "User-Agent: python-keystoneclient" -H "Accept: application/json" -H "X-Auth-Token: {SHA1}3795f43af3b06e82d7c8c83e854816a265b68c92" _http_log_request /usr/local/lib/python2.7/dist-packages/keystoneclient/ses | 12:23 |
| odyssey4me | sion.py:193 | 12:23 |
| odyssey4me | 2015-07-03 12:13:19.706 8105 DEBUG keystoneclient.session [-] RESP: [200] content-length: 330 x-subject-token: {SHA1}28765a35fdf7f49b05e595fb50a08eb1e1f2b2bc vary: X-Auth-Token keep-alive: timeout=5, max=100 server: Apache/2.4.7 (Ubuntu) connection: Keep-Alive date: Fri, 03 Jul 2015 12:13:19 GMT content-type: application/json x-openstack-request-id: req-6d9365a0-9b54-47b3-859c-b3a219f8755a | 12:23 |
| odyssey4me | RESP BODY: {"token": {"methods": ["token"], "expires_at": "2015-07-04T00:13:19.000000Z", "extras": {}, "user": {"OS-FEDERATION": {"identity_provider": {"id": "adfs-idp"}, "protocol": {"id": "saml2"}, "groups": []}, "id": "My%20Self", "name": "My%20Self"}, "audit_ids": ["oIesbmVAT2K_MIA_x6ywBA"], "issued_at": "2015-07-03T12:13:19.000000Z"}} | 12:23 |
| odyssey4me | _http_log_response /usr/local/lib/python2.7/dist-packages/keystoneclient/session.py:209 | 12:23 |
| odyssey4me | notice the groups are empty in the RESP BODY | 12:23 |
| dstanek | is this v2 or v3? | 12:25 |
| odyssey4me | dstanek should be v3 (see above REQ) | 12:25 |
| *** e0ne_ has joined #openstack-keystone | 12:25 | |
| * dstanek is trying to remember how horizon works | 12:27 | |
| odyssey4me | dstanek yeah, so horizon is set to use the v3 api | 12:27 |
| *** e0ne has quit IRC | 12:28 | |
| dstanek | odyssey4me: hmmm...i wonder if maybe you don't have default_project_id set on the user data | 12:28 |
| odyssey4me | and I adjusted the ebug output of nova-os-api to dump more data | 12:28 |
| odyssey4me | dstanek well, there is no user data as it's a federated user | 12:28 |
| odyssey4me | I could fix that in the mapping? | 12:28 |
| dstanek | not sure.... | 12:29 |
| dstanek | so doesn't horizon always get an unscoped token until the user picks a project? | 12:29 |
| dstanek | it can't be the default project...because you said uuid works and that would have the same data | 12:30 |
| odyssey4me | dstanek good question - not sure... and I did think of trying to set the default project id earlier... but never did | 12:30 |
| openstackgerrit | Ivan Mironov proposed openstack/keystone: Do not specify 'objectClass' twice in LDAP filter string. https://review.openstack.org/198270 | 12:32 |
| odyssey4me | interestingly, I've added the default project id to the mapping and it is getting through to nova api - but still failing: 'HTTP_X_AUTH_PROJECT_ID': '69f5cff441e04554b285d7772630dec1' | 12:34 |
| *** arunkant_ has joined #openstack-keystone | 12:36 | |
| dstanek | odyssey4me: the X-Auth-Token i see in the stacktrace doesn't look like a fernet token: gAAAAABVln7XPWiYMgh7UdewUiad8Pxgr1loj9faVD_MlFQtQLjJQaelHj6oE3W1XRNKszPhv0lCB2u4eEsBFYnqXJPzdXHbnwfEUoisnpOlbPAxhKry8EISy3rNUdFfqrXgANGVOT5tSxRzY5GVT1fM0GtrU-nCsA%3D%3D | 12:39 |
| *** arunkant__ has quit IRC | 12:39 | |
| openstackgerrit | Merged openstack/keystone: Fix tox -e py34 https://review.openstack.org/198165 | 12:41 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/196485 | 12:42 |
| odyssey4me | dstanek I just did a fresh one, and it looks similar: gAAAAABVloNjiIscHvUElgNmfOMcA6tnyaT3-6Os39hw2QJQJiiNahnc4CebKUDzhGn3S1A8knf9lQ-PQYq62kY3ceUovGo4mv3K5x8gvZtxngzO2wQcve7KqvvloRarWQ-Lzntwhbbakme5vahuRbkZpXrENR_2_g%3D%3D | 12:44 |
| dstanek | oh, wait. don't listen to me. | 12:45 |
| dstanek | i probably got up too early | 12:46 |
| *** hogepodge has quit IRC | 12:46 | |
| *** hogepodge has joined #openstack-keystone | 12:48 | |
| *** markvoelker has quit IRC | 12:53 | |
| marekd | odyssey4me: sorry, i had to leave | 12:56 |
| marekd | odyssey4me: did you check uuid tokens? | 12:56 |
| marekd | odyssey4me: just noticed it works. | 12:57 |
| marekd | odyssey so oups, we have a problem. | 12:57 |
| marekd | odyssey4me: can you confirm whether the problem is with CLI or websso only? | 12:57 |
| odyssey4me | marekd yep, now we're trying to figure out why - dstanek's taking a peek too | 12:57 |
| marekd | odyssey4me: does CLI version works? | 12:57 |
| odyssey4me | marekd hmm, let me check | 12:58 |
| *** markvoelker has joined #openstack-keystone | 13:00 | |
| marekd | odyssey4me: please do | 13:01 |
| *** e0ne has joined #openstack-keystone | 13:05 | |
| dstanek | shiite - how do i tell openstack client to forget about cert issues? | 13:06 |
| marekd | dstanek: --insecure ? | 13:06 |
| dstanek | marekd: ah, right! thanks | 13:06 |
| *** henrynash has joined #openstack-keystone | 13:06 | |
| *** ChanServ sets mode: +v henrynash | 13:06 | |
| dstanek | it's been so long since i've had to do that | 13:06 |
| odyssey4me | dstanek yep, it's a pain | 13:07 |
| odyssey4me | I'm trying to figure out how to get an assertion from adfs :p | 13:07 |
| odyssey4me | (via cli) | 13:07 |
| *** e0ne_ has quit IRC | 13:08 | |
| dstanek | odyssey4me: 'shutdown now' will usually do the trick | 13:08 |
| odyssey4me | dstanek wrong sort of assertion :p | 13:08 |
| amaretskiy | Hi all! Please someone review https://review.openstack.org/#/c/188457/ | 13:09 |
| marekd | odyssey4me: aaaand? :-) | 13:09 |
| *** hrou has joined #openstack-keystone | 13:11 | |
| *** nzeer has quit IRC | 13:12 | |
| *** nzeer has joined #openstack-keystone | 13:12 | |
| * dstanek thinks he found an unrelated client bug... | 13:13 | |
| dstanek | amaretskiy: i'm curious about what brant meant | 13:17 |
| amaretskiy | dstanek: in patch set 2 scenarios had heavy values so jobs run long time, now input values reduced so job run 28 min | 13:19 |
| amaretskiy | dstanek: so Brant's comment is fixed | 13:20 |
| *** haypo has joined #openstack-keystone | 13:22 | |
| dstanek | odyssey4me: marekd: i'm trying to use the fernet token against nova and running into issues - unfortunately i don't understand nova's context stuff just yet | 13:26 |
| odyssey4me | dstanek so you're finding the issue without federation even being involved then? | 13:35 |
| dstanek | odyssey4me: well, i took the fernet token generated by the federation flow and tried to use it against nova from the cli | 13:37 |
| dstanek | jas...i'll PM you the command | 13:37 |
| dstanek | that will cause nova to 500 because it seems that the context doesn't have the project | 13:38 |
| dstanek | but according to nova/api/auth.py that comes from headers...so is it the client that is messing me up? | 13:38 |
| odyssey4me | dstanek so that's why I had the API output the headers for the websso - you'll notice the lack of project in the headers there too | 13:39 |
| *** browne has joined #openstack-keystone | 13:41 | |
| odyssey4me | does it make sense that this is simply an unscoped token? | 13:44 |
| dstanek | odyssey4me: that's what i was wondering earlier....i thought horizon got an unscoped token until the user picked a project in the UI, but then again i have no idea. just a guess | 13:49 |
| dstanek | that maybe a good question for horizon folks if any are around | 13:49 |
| odyssey4me | dstanek well, I think there must be logic to choose the default project id or the first in the list | 13:50 |
| odyssey4me | when you land in horizon you get the instances view for a project | 13:50 |
| odyssey4me | but you're right in saying that if it works for uuid tokens, then what's different here | 13:50 |
| dstanek | so adding '--os-project-name fedproject' still blows up | 13:52 |
| dstanek | not sure why nova thinks forbidden is a 500 | 13:52 |
| *** henrynash has quit IRC | 13:53 | |
| *** henrynash has joined #openstack-keystone | 13:53 | |
| *** lhcheng has joined #openstack-keystone | 13:58 | |
| *** ChanServ sets mode: +v lhcheng | 13:58 | |
| *** raildo has quit IRC | 14:00 | |
| *** tellesnobrega has quit IRC | 14:00 | |
| *** lhcheng has quit IRC | 14:02 | |
| *** ericksonsantos has quit IRC | 14:05 | |
| *** iurygregory has quit IRC | 14:05 | |
| *** samueldmq has quit IRC | 14:05 | |
| *** ericksonsantos has joined #openstack-keystone | 14:07 | |
| *** raildo has joined #openstack-keystone | 14:08 | |
| odyssey4me | dstanek but when doing the request with '--os-project-name fedproject' the error is different, the context validation fails | 14:08 |
| *** tellesnobrega has joined #openstack-keystone | 14:09 | |
| *** samueldmq has joined #openstack-keystone | 14:11 | |
| *** iurygregory has joined #openstack-keystone | 14:11 | |
| *** fhubik has quit IRC | 14:17 | |
| odyssey4me | dstanek for giggles I've double-checked that nova reacts properly to an internal user's token properly - it does | 14:21 |
| dstanek | a 500? | 14:21 |
| odyssey4me | nope, it's fine | 14:21 |
| dstanek | so it's just the federated fernet token that makes it shit the bed? | 14:22 |
| odyssey4me | dstanek yep | 14:22 |
| *** lhcheng has joined #openstack-keystone | 14:22 | |
| *** ChanServ sets mode: +v lhcheng | 14:22 | |
| dstanek | have you cracked open the tokens to compare? | 14:23 |
| odyssey4me | dstanek what's the best way to do that? | 14:24 |
| *** lhcheng has quit IRC | 14:26 | |
| dstanek | odyssey4me: something like this should work: http://paste.openstack.org/show/338845/ | 14:27 |
| *** topol has joined #openstack-keystone | 14:29 | |
| *** ChanServ sets mode: +v topol | 14:29 | |
| odyssey4me | dstanek the key is the fernet key file patch right? | 14:30 |
| odyssey4me | *path | 14:30 |
| odyssey4me | ie '/etc/keystone/fernet-keys/0' ? | 14:30 |
| dstanek | yeah, likely the highest numbered file | 14:32 |
| odyssey4me | hmm, TypeError: Incorrect padding | 14:33 |
| odyssey4me | check /root/decode-token-test.py in the keystone container | 14:34 |
| raildo | dstanek, Do you know what is the best way to test a change that have cross-repository dependency? I have a change in the keystonemiddleware that depends from a change in keystone client. I'm trying to put the keystoneclient patch in the requeriments.txt but it doesn't work very well | 14:35 |
| dstanek | odyssey4me: use the contents of the key itself | 14:36 |
| dstanek | odyssey4me: try that..just fixed it | 14:36 |
| *** henrynash has joined #openstack-keystone | 14:36 | |
| *** ChanServ sets mode: +v henrynash | 14:36 | |
| dstanek | raildo: yes...well no....there is a tag that you can put in the commit message. maybe 'Depends-on' | 14:36 |
| dstanek | raildo: nailed it! http://docs.openstack.org/infra/manual/developers.html#cross-repository-dependencies | 14:37 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Project tree deletion https://review.openstack.org/148730 | 14:37 |
| odyssey4me | dstanek ah, need to print the contents out | 14:37 |
| dstanek | ok, be back in a little bit. going for a vacation run | 14:37 |
| raildo | I use this tag in the patch, but I don't know how to test locally (tun tox with this dependency) | 14:38 |
| raildo | dstanek, ^ | 14:38 |
| *** r-daneel has joined #openstack-keystone | 14:42 | |
| dstanek | raildo: you'll have to install it in your virtual env | 14:44 |
| *** e0ne is now known as e0ne_ | 14:44 | |
| dstanek | if your experimental patch is in /opt/stack/oslo.config and keystone is in /opt/stack/keystone | 14:45 |
| dstanek | i would 'cd /opt/stack/oslo.config; /opt/stack/keystone/.tox/py27/bin/python setup.py develop' | 14:45 |
| dstanek | that will install whatever version os oslo.config you have there into keystone's py27 virtualenv | 14:46 |
| *** e0ne_ is now known as e0ne | 14:46 | |
| *** haypo has left #openstack-keystone | 14:46 | |
| dstanek | then when you run tox -e py27 you'll have the correct version | 14:46 |
| dstanek | there may be magic -infra tooling for this, but in general it's just Python venv stuff | 14:46 |
| dstanek | of source change olso.config and keystone to be what ever projects you are working on | 14:47 |
| dstanek | ok...really taking off now - be back in an hour or so | 14:47 |
| raildo | dstanek, great, i'll try this, thank you :) | 14:47 |
| *** stevemar has joined #openstack-keystone | 14:47 | |
| marekd | dstanek: are you talking fernet + federation or just fernet? | 14:48 |
| marekd | dstanek: for tht you need to ping lbragstad or dolphm | 14:48 |
| *** htruta has joined #openstack-keystone | 14:50 | |
| *** stevemar has quit IRC | 14:51 | |
| odyssey4me | marekd fernet works just fine for internal users, but when using fernet + federation then nova blows up cc dstanek | 14:53 |
| odyssey4me | the decoded token for federation has more data in it | 14:54 |
| marekd | odyssey4me: so it works with keystone ? (fernet + fed) | 14:54 |
| *** belmoreira has quit IRC | 14:54 | |
| odyssey4me | marekd keystone auth is working fine - haven't really tried doing anything privileged inside keystone with a federated token | 14:55 |
| marekd | odyssey4me: maybe you can try doing that? I will test it myself on Monday...and it's a pity that all the interesting bugs come up just before a break (i am going for holiday next Tuesday) | 14:58 |
| *** lufix has quit IRC | 14:58 | |
| marekd | odyssey4me: please, file a bug and assign it to me. | 14:58 |
| odyssey4me | marekd see the difference in interaction in the nova log when verifying the token: http://pastebin.com/BTXENh81 | 15:00 |
| *** jraim has quit IRC | 15:00 | |
| *** markvoelker has quit IRC | 15:00 | |
| *** jraim has joined #openstack-keystone | 15:00 | |
| odyssey4me | marekd the internal user has "user": {"domain": {"id": "default", "name": "Default"}, "id": "76c8c3017c954d88a6ad69ee4cb656d6", "name": "test"} | 15:02 |
| odyssey4me | the federated user has "user": {"OS-FEDERATION": {"identity_provider": {"id": "adfs-idp"}, "protocol": {"id": "saml2"}, "groups": []}, "id": "S-1-5-21-2917001131-1385516553-613696311-1108", "name": "S-1-5-21-2917001131-1385516553-613696311-1108"} | 15:02 |
| odyssey4me | the whole data structure is different | 15:02 |
| *** bdossant has quit IRC | 15:03 | |
| odyssey4me | I see that the 'roles' and 'project' data structures aren't there either | 15:03 |
| odyssey4me | marekd a bug in keystone, or in nova? | 15:05 |
| marekd | odyssey4me: it's strange that goups are empty. | 15:08 |
| *** henrynash has quit IRC | 15:08 | |
| marekd | odyssey4me: so it may be agains bug | 15:08 |
| marekd | against keystone | 15:09 |
| odyssey4me | marekd great will do - what's good information to add to the bug :) | 15:11 |
| marekd | odyssey4me: everything :-) | 15:16 |
| marekd | logs, environment etc. | 15:16 |
| marekd | how to reproduce... | 15:16 |
| *** afazekas has quit IRC | 15:26 | |
| *** henrynash has joined #openstack-keystone | 15:26 | |
| *** ChanServ sets mode: +v henrynash | 15:26 | |
| *** browne1 has joined #openstack-keystone | 15:29 | |
| *** browne has quit IRC | 15:29 | |
| *** _cjones_ has joined #openstack-keystone | 15:31 | |
| *** bdossant has joined #openstack-keystone | 15:31 | |
| *** bdossant has quit IRC | 15:37 | |
| *** viktors is now known as viktors|afk | 15:38 | |
| *** hrou has quit IRC | 15:42 | |
| *** henrynash has quit IRC | 15:42 | |
| *** hrou has joined #openstack-keystone | 15:44 | |
| *** vilobhmm has joined #openstack-keystone | 15:45 | |
| *** e0ne has quit IRC | 15:45 | |
| *** hrou has quit IRC | 15:46 | |
| odyssey4me | marekd you don't appear to be on launchpad? | 15:47 |
| marekd | odyssey4me: marek-denis | 15:47 |
| odyssey4me | the bug is registered: https://bugs.launchpad.net/keystone/+bug/1471289 | 15:47 |
| openstack | Launchpad bug 1471289 in Keystone "Fernet tokens and Federated Identities result in token scope failures" [Undecided,New] | 15:47 |
| odyssey4me | marekd ah, it seems that I can't assign it to you for some reason :/ | 15:49 |
| marekd | done | 15:49 |
| odyssey4me | marekd great - I hope that's enough information to go on | 15:50 |
| *** henrynash has joined #openstack-keystone | 15:50 | |
| *** ChanServ sets mode: +v henrynash | 15:50 | |
| *** _cjones_ has quit IRC | 15:51 | |
| *** _cjones_ has joined #openstack-keystone | 15:52 | |
| *** ericksonsantos has quit IRC | 15:52 | |
| *** zzzeek has joined #openstack-keystone | 15:59 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Materialized path mixin https://review.openstack.org/198418 | 16:00 |
| amakarov | samueldmq, hi! Are you here? Can you please take a look ^^ ? | 16:02 |
| *** dims_ has quit IRC | 16:08 | |
| *** stevemar has joined #openstack-keystone | 16:15 | |
| *** jistr has quit IRC | 16:24 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Dynamic Policies Fetch and Cache https://review.openstack.org/134655 | 16:24 |
| *** ctracey has quit IRC | 16:28 | |
| *** ctracey has joined #openstack-keystone | 16:28 | |
| samueldmq | amakarov: just reviewed, let me know if you have any question, agree/disagree with the points I've put there | 16:31 |
| *** hrou has joined #openstack-keystone | 16:31 | |
| *** zzzeek has quit IRC | 16:34 | |
| *** zzzeek has joined #openstack-keystone | 16:34 | |
| *** vilobhmm1 has joined #openstack-keystone | 16:37 | |
| *** vilobhmm has quit IRC | 16:37 | |
| *** dguerri is now known as dguerri` | 16:47 | |
| *** drjones has joined #openstack-keystone | 16:47 | |
| *** jdennis has quit IRC | 16:47 | |
| *** drjones has quit IRC | 16:48 | |
| *** drjones has joined #openstack-keystone | 16:48 | |
| *** markvoelker has joined #openstack-keystone | 16:49 | |
| *** _cjones_ has quit IRC | 16:49 | |
| *** dims_ has joined #openstack-keystone | 16:51 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Dynamic Policies Delivering Mechanism https://review.openstack.org/197980 | 16:59 |
| *** browne1 has quit IRC | 17:00 | |
| *** dims_ has quit IRC | 17:01 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Dynamic Policies with Custom IDs https://review.openstack.org/198000 | 17:01 |
| *** amaretskiy has quit IRC | 17:02 | |
| *** serverascode has quit IRC | 17:04 | |
| *** serverascode has joined #openstack-keystone | 17:06 | |
| *** Kiall has quit IRC | 17:15 | |
| *** Kiall has joined #openstack-keystone | 17:16 | |
| *** mgarza_ has joined #openstack-keystone | 17:24 | |
| *** _cjones_ has joined #openstack-keystone | 17:44 | |
| *** drjones has quit IRC | 17:44 | |
| *** vilobhmm1 has quit IRC | 17:45 | |
| *** drjones has joined #openstack-keystone | 17:46 | |
| amakarov | samueldmq, I argee about naming - will rename | 17:46 |
| *** drjones has quit IRC | 17:47 | |
| *** drjones has joined #openstack-keystone | 17:47 | |
| *** _cjones_ has quit IRC | 17:48 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Materialized path mixin https://review.openstack.org/198418 | 17:48 |
| *** henrynash has quit IRC | 17:52 | |
| *** jecarey has joined #openstack-keystone | 17:56 | |
| *** BrAsS_mOnKeY has quit IRC | 18:06 | |
| *** mgarza_ has quit IRC | 18:06 | |
| *** mgarza_ has joined #openstack-keystone | 18:10 | |
| *** stevemar has quit IRC | 18:10 | |
| *** stevemar has joined #openstack-keystone | 18:10 | |
| *** boris-42 has quit IRC | 18:12 | |
| *** arunkant__ has joined #openstack-keystone | 18:15 | |
| *** arunkant_ has quit IRC | 18:18 | |
| *** zigo has quit IRC | 18:18 | |
| *** zigo has joined #openstack-keystone | 18:22 | |
| *** dguerri` is now known as dguerri | 18:34 | |
| *** _cjones_ has joined #openstack-keystone | 18:36 | |
| *** dguerri is now known as dguerri` | 18:36 | |
| *** dguerri` is now known as dguerri | 18:36 | |
| *** dguerri is now known as dguerri` | 18:38 | |
| *** drjones has quit IRC | 18:39 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 18:39 | |
| *** BrAsS_mOnKeY has quit IRC | 18:39 | |
| *** zhiyan has quit IRC | 18:41 | |
| *** zhiyan has joined #openstack-keystone | 18:41 | |
| *** stevemar has quit IRC | 18:43 | |
| *** janonymous_ has joined #openstack-keystone | 18:46 | |
| *** topol has quit IRC | 18:49 | |
| *** mgarza_ has quit IRC | 18:49 | |
| *** edmondsw has joined #openstack-keystone | 18:52 | |
| *** edmondsw has quit IRC | 18:52 | |
| *** mgarza_ has joined #openstack-keystone | 18:57 | |
| -openstackstatus- NOTICE: etherpad.openstack.org is offline for scheduled database maintenance, ETA 19:30 UTC | 19:03 | |
| *** ChanServ changes topic to "etherpad.openstack.org is offline for scheduled database maintenance, ETA 19:30 UTC" | 19:03 | |
| brad[] | Is it possible to use an LDAP backend for non-service users only, with API v2? | 19:12 |
| brad[] | Or is that only possible because of the capabilities of v3? | 19:12 |
| breton | you can do it using domains. domains are available only when you auth via v3. | 19:21 |
| -openstackstatus- NOTICE: etherpad.openstack.org is still offline for scheduled database maintenance, ETA 19:45 UTC | 19:31 | |
| *** ChanServ changes topic to "etherpad.openstack.org is still offline for scheduled database maintenance, ETA 19:45 UTC" | 19:31 | |
| *** drjones has joined #openstack-keystone | 19:32 | |
| *** _cjones_ has quit IRC | 19:34 | |
| *** drjones has quit IRC | 19:47 | |
| *** _cjones_ has joined #openstack-keystone | 19:47 | |
| *** ajayaa has quit IRC | 19:49 | |
| *** mgarza_ has quit IRC | 19:49 | |
| *** mgarza has joined #openstack-keystone | 19:49 | |
| *** ChanServ changes topic to "| Review Code, Specs, Etc | Keystone MidCycle 15, 16, 17 | US Independence Day is observed 7/3 (Friday)" | 19:53 | |
| *** Ephur has joined #openstack-keystone | 20:02 | |
| *** jistr has joined #openstack-keystone | 20:08 | |
| *** ajayaa has joined #openstack-keystone | 20:08 | |
| *** fifieldt_ has joined #openstack-keystone | 20:19 | |
| *** fifieldt has quit IRC | 20:22 | |
| *** amakarov is now known as amakarov_away | 20:24 | |
| *** dguerri` is now known as dguerri | 20:24 | |
| *** ajayaa has quit IRC | 20:25 | |
| *** dguerri is now known as dguerri` | 20:25 | |
| *** raildo has quit IRC | 20:29 | |
| *** stevemar has joined #openstack-keystone | 20:31 | |
| *** stevemar has quit IRC | 20:35 | |
| *** drjones has joined #openstack-keystone | 20:42 | |
| *** drjones has quit IRC | 20:42 | |
| *** drjones has joined #openstack-keystone | 20:43 | |
| *** _cjones_ has quit IRC | 20:43 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/197254 | 20:44 |
| *** jistr has quit IRC | 20:50 | |
| *** HT_sergio has joined #openstack-keystone | 20:52 | |
| brad[] | breton: This'll sound like I haven't done any research (I swear I have!) - is keystone v3 ready for general use? | 20:53 |
| brad[] | The info I've found has been ambiguous about that | 20:53 |
| brad[] | API v3 I should say | 20:53 |
| openstackgerrit | Alberto Murillo proposed openstack/keystone: disable admin_token by default https://review.openstack.org/185464 | 20:57 |
| *** _cjones_ has joined #openstack-keystone | 21:01 | |
| *** drjones has quit IRC | 21:04 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 21:12 | |
| *** BrAsS_mOnKeY has quit IRC | 21:26 | |
| *** gordc has quit IRC | 21:30 | |
| *** stevemar has joined #openstack-keystone | 21:32 | |
| *** gabriel-bezerra has quit IRC | 21:35 | |
| *** stevemar has quit IRC | 21:36 | |
| *** _cjones_ has quit IRC | 21:42 | |
| *** _cjones_ has joined #openstack-keystone | 21:42 | |
| *** hrou has quit IRC | 21:46 | |
| *** r-daneel has quit IRC | 21:58 | |
| *** henrynash has joined #openstack-keystone | 22:04 | |
| *** ChanServ sets mode: +v henrynash | 22:04 | |
| *** henrynash has quit IRC | 22:07 | |
| *** ajayaa has joined #openstack-keystone | 22:12 | |
| *** htruta_ has joined #openstack-keystone | 22:14 | |
| *** HT_sergio has quit IRC | 22:15 | |
| *** gabriel-bezerra has joined #openstack-keystone | 22:17 | |
| breton | brad[]: it is stable and should be used. | 22:17 |
| breton | brad[]: http://adam.younglogic.com/2015/05/rdo-v3-only/ how to switch components to use it, ayoung here wrote it | 22:17 |
| *** Ephur has quit IRC | 22:18 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 22:21 | |
| *** rushiagr is now known as rushiagr_away | 22:23 | |
| *** mgarza has quit IRC | 22:26 | |
| *** drjones has joined #openstack-keystone | 22:32 | |
| *** _cjones_ has quit IRC | 22:32 | |
| *** zzzeek has quit IRC | 22:36 | |
| *** stevemar has joined #openstack-keystone | 22:48 | |
| *** stevemar has quit IRC | 22:50 | |
| *** dims_ has joined #openstack-keystone | 23:01 | |
| *** dims_ has quit IRC | 23:07 | |
| *** hrou has joined #openstack-keystone | 23:14 | |
| *** dims_ has joined #openstack-keystone | 23:14 | |
| *** stevemar has joined #openstack-keystone | 23:18 | |
| *** dims_ has quit IRC | 23:18 | |
| *** _cjones_ has joined #openstack-keystone | 23:27 | |
| *** stevemar has quit IRC | 23:27 | |
| *** stevemar has joined #openstack-keystone | 23:28 | |
| *** drjones has quit IRC | 23:29 | |
| *** _cjones_ has quit IRC | 23:50 | |
| *** _cjones_ has joined #openstack-keystone | 23:51 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!