| *** jecarey has joined #openstack-keystone | 00:05 | |
| *** dims_ has joined #openstack-keystone | 00:06 | |
| *** chlong has joined #openstack-keystone | 00:20 | |
| *** hrou has joined #openstack-keystone | 00:21 | |
| *** nkinder has quit IRC | 00:32 | |
| *** nkinder has joined #openstack-keystone | 00:35 | |
| *** piyanai has quit IRC | 00:35 | |
| *** piyanai has joined #openstack-keystone | 00:37 | |
| *** piyanai has quit IRC | 00:37 | |
| *** stevemar has quit IRC | 00:54 | |
| *** stevemar has joined #openstack-keystone | 00:54 | |
| *** ChanServ sets mode: +v stevemar | 00:54 | |
| *** jecarey has quit IRC | 00:55 | |
| *** stevemar has quit IRC | 00:58 | |
| openstackgerrit | liusheng proposed openstack/keystone: Remove the unused config_files parameter of service entry https://review.openstack.org/203456 | 01:05 |
|---|---|---|
| *** jiaxi has joined #openstack-keystone | 01:12 | |
| jiaxi | Good Morning,everyone. | 01:12 |
| *** stevemar has joined #openstack-keystone | 01:21 | |
| *** ChanServ sets mode: +v stevemar | 01:21 | |
| *** davechen has joined #openstack-keystone | 01:28 | |
| *** davechen1 has joined #openstack-keystone | 01:31 | |
| *** davechen has quit IRC | 01:33 | |
| *** piyanai has joined #openstack-keystone | 01:36 | |
| *** davechen1 is now known as davechen | 01:38 | |
| *** davechen1 has joined #openstack-keystone | 01:40 | |
| *** davechen has quit IRC | 01:43 | |
| *** ankita_wagh has quit IRC | 01:46 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Let `region` field be effective both in the testcase and API https://review.openstack.org/167534 | 01:53 |
| *** Kennan2 has joined #openstack-keystone | 02:05 | |
| *** Kennan has quit IRC | 02:05 | |
| *** Kennan2 is now known as Kennan | 02:07 | |
| *** btully has quit IRC | 02:13 | |
| *** dims_ has quit IRC | 02:14 | |
| *** afazekas has quit IRC | 02:17 | |
| *** afazekas has joined #openstack-keystone | 02:18 | |
| *** dims_ has joined #openstack-keystone | 02:29 | |
| *** ankita_wagh has joined #openstack-keystone | 02:39 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint_filter migrations into keystone core https://review.openstack.org/186988 | 02:52 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint filter into keystone core https://review.openstack.org/183377 | 02:52 |
| *** hakimo has joined #openstack-keystone | 02:52 | |
| *** hakimo_ has quit IRC | 02:55 | |
| *** stevemar has quit IRC | 02:55 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 02:55 |
| *** stevemar has joined #openstack-keystone | 02:55 | |
| *** ChanServ sets mode: +v stevemar | 02:55 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 02:56 |
| *** tobe has joined #openstack-keystone | 03:06 | |
| *** dims_ has quit IRC | 03:08 | |
| *** ankita_wagh has quit IRC | 03:25 | |
| *** ankita_wagh has joined #openstack-keystone | 03:41 | |
| *** ankita_wagh has joined #openstack-keystone | 03:42 | |
| *** stevemar has quit IRC | 03:54 | |
| *** stevemar has joined #openstack-keystone | 03:55 | |
| *** ChanServ sets mode: +v stevemar | 03:55 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move resource related testcase into their own module https://review.openstack.org/195449 | 03:57 |
| *** tobe has quit IRC | 04:02 | |
| *** chenhong has joined #openstack-keystone | 04:04 | |
| *** tobe has joined #openstack-keystone | 04:05 | |
| *** dims_ has joined #openstack-keystone | 04:10 | |
| *** tobe has quit IRC | 04:13 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 04:14 |
| *** htruta has quit IRC | 04:15 | |
| *** dims_ has quit IRC | 04:15 | |
| *** tobe has joined #openstack-keystone | 04:16 | |
| *** darrenc is now known as darrenc_afk | 04:20 | |
| *** darrenc_afk is now known as darrenc | 04:35 | |
| *** tobe has quit IRC | 04:41 | |
| *** ankita_w_ has joined #openstack-keystone | 04:42 | |
| *** piyanai has quit IRC | 04:43 | |
| *** ankita_wagh has quit IRC | 04:46 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 04:54 |
| *** briancurtin has quit IRC | 04:58 | |
| *** briancurtin has joined #openstack-keystone | 04:59 | |
| *** ctracey has quit IRC | 05:00 | |
| *** ctracey has joined #openstack-keystone | 05:03 | |
| *** topol has quit IRC | 05:06 | |
| *** btully has joined #openstack-keystone | 05:13 | |
| *** stevemar has quit IRC | 05:14 | |
| *** browne has joined #openstack-keystone | 05:18 | |
| *** chlong has quit IRC | 05:27 | |
| *** dims_ has joined #openstack-keystone | 05:31 | |
| *** Protux has quit IRC | 05:35 | |
| *** serverascode has quit IRC | 05:35 | |
| *** h00327910_ has quit IRC | 05:36 | |
| *** briancurtin has quit IRC | 05:36 | |
| *** ctracey has quit IRC | 05:36 | |
| *** dims_ has quit IRC | 05:36 | |
| *** chlong has joined #openstack-keystone | 05:40 | |
| *** serverascode has joined #openstack-keystone | 05:41 | |
| *** briancurtin has joined #openstack-keystone | 05:44 | |
| *** h00327910_ has joined #openstack-keystone | 05:48 | |
| *** Protux has joined #openstack-keystone | 05:48 | |
| *** ctracey has joined #openstack-keystone | 05:51 | |
| *** lhcheng has joined #openstack-keystone | 05:52 | |
| *** ChanServ sets mode: +v lhcheng | 05:52 | |
| *** ankita_w_ has quit IRC | 05:55 | |
| *** hrou has quit IRC | 06:03 | |
| *** ParsectiX has joined #openstack-keystone | 06:06 | |
| *** mflobo has joined #openstack-keystone | 06:10 | |
| *** lsmola has joined #openstack-keystone | 06:12 | |
| *** e0ne has joined #openstack-keystone | 06:13 | |
| *** tsymanczyk has quit IRC | 06:13 | |
| *** alexus is now known as alex_xu | 06:14 | |
| *** rdo has quit IRC | 06:16 | |
| *** rdo has joined #openstack-keystone | 06:17 | |
| *** e0ne has quit IRC | 06:17 | |
| *** tsymanczyk has joined #openstack-keystone | 06:18 | |
| *** chlong has quit IRC | 06:20 | |
| *** e0ne has joined #openstack-keystone | 06:21 | |
| *** e0ne has quit IRC | 06:29 | |
| *** e0ne has joined #openstack-keystone | 06:33 | |
| *** _afazekas has quit IRC | 06:33 | |
| *** chlong has joined #openstack-keystone | 06:36 | |
| *** boris-42 has joined #openstack-keystone | 06:38 | |
| *** pnavarro has joined #openstack-keystone | 06:41 | |
| *** tobe has joined #openstack-keystone | 06:42 | |
| *** ankita_wagh has joined #openstack-keystone | 06:44 | |
| marekd | https://review.openstack.org/#/c/202282/ is it eligible for a single-core +A? | 06:45 |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 06:51 |
| *** browne has quit IRC | 06:51 | |
| marekd | lbragstad: hi :-) Do you mind pushing whatever you have on the https://review.openstack.org/#/c/202176 topic? :-) | 06:54 |
| *** e0ne has quit IRC | 06:56 | |
| *** e0ne has joined #openstack-keystone | 07:00 | |
| *** ig0r_ has joined #openstack-keystone | 07:01 | |
| *** christx2 has joined #openstack-keystone | 07:08 | |
| *** afazekas_ has joined #openstack-keystone | 07:09 | |
| *** dims_ has joined #openstack-keystone | 07:19 | |
| *** e0ne has quit IRC | 07:22 | |
| *** josecastroleon has quit IRC | 07:23 | |
| *** dims_ has quit IRC | 07:25 | |
| *** e0ne has joined #openstack-keystone | 07:26 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Fernet payloads for federated scoped tokens. https://review.openstack.org/202176 | 07:27 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Clarify project hierachy and parent usage within the API https://review.openstack.org/200624 | 07:27 |
| *** e0ne has quit IRC | 07:29 | |
| *** e0ne has joined #openstack-keystone | 07:29 | |
| *** e0ne has quit IRC | 07:30 | |
| *** ctracey has quit IRC | 07:31 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Clarify project hierachy and parent usage within the API https://review.openstack.org/200624 | 07:31 |
| *** Protux has quit IRC | 07:31 | |
| *** zhiyan has quit IRC | 07:31 | |
| *** serverascode has quit IRC | 07:31 | |
| *** chlong has quit IRC | 07:34 | |
| *** belmoreira has joined #openstack-keystone | 07:36 | |
| *** ankita_wagh has quit IRC | 07:39 | |
| *** pcaruana has quit IRC | 07:42 | |
| *** zhiyan has joined #openstack-keystone | 07:48 | |
| *** btully has quit IRC | 07:49 | |
| *** jistr has joined #openstack-keystone | 07:54 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: IDP specific websso https://review.openstack.org/199339 | 07:54 |
| *** ctracey has joined #openstack-keystone | 07:54 | |
| *** serverascode has joined #openstack-keystone | 07:59 | |
| *** Protux has joined #openstack-keystone | 08:02 | |
| *** fhubik has joined #openstack-keystone | 08:05 | |
| *** fhubik is now known as fhubik_afk | 08:05 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Clarify project hierachy and parent usage within the API https://review.openstack.org/200624 | 08:10 |
| *** amirosh has joined #openstack-keystone | 08:21 | |
| *** christx2 has quit IRC | 08:23 | |
| *** christx2 has joined #openstack-keystone | 08:23 | |
| *** fhubik_afk is now known as fhubik | 08:23 | |
| *** rletrocquer has quit IRC | 08:25 | |
| *** belmoreira has quit IRC | 08:30 | |
| *** lhcheng has quit IRC | 08:31 | |
| *** btully has joined #openstack-keystone | 08:40 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Refactor websso ``origin`` validation https://review.openstack.org/203525 | 08:41 |
| *** pcaruana has joined #openstack-keystone | 08:43 | |
| *** btully has quit IRC | 08:45 | |
| *** e0ne has joined #openstack-keystone | 08:55 | |
| breton | folks, should https://bugs.launchpad.net/keystone/+bug/1471289 be kilo-backport-potential? | 08:58 |
| openstack | Launchpad bug 1471289 in Keystone "Fernet tokens and Federated Identities result in token scope failures" [High,In progress] - Assigned to Marek Denis (marek-denis) | 08:58 |
| uvirtbot | Launchpad bug 1471289 in keystone "Fernet tokens and Federated Identities result in token scope failures" [High,In progress] | 08:58 |
| breton | marekd: lbragstad: ^ | 08:58 |
| breton | (also, why do we have 2 bots?) | 08:58 |
| *** dims_ has joined #openstack-keystone | 09:08 | |
| *** dims_ has quit IRC | 09:14 | |
| *** christx2 has quit IRC | 09:20 | |
| openstackgerrit | Merged openstack/keystone: Document use of wip up to developer https://review.openstack.org/195335 | 09:20 |
| marekd | breton: think so. | 09:20 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/202282 | 09:28 |
| *** aix has quit IRC | 09:41 | |
| *** belmoreira has joined #openstack-keystone | 09:48 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Avoid the hard coding of admin token https://review.openstack.org/203546 | 09:54 |
| *** davechen1 has left #openstack-keystone | 09:54 | |
| *** dims_ has joined #openstack-keystone | 09:54 | |
| *** fhubik is now known as fhubik_afk | 10:01 | |
| *** fhubik_afk is now known as fhubik | 10:03 | |
| *** Mohammad has joined #openstack-keystone | 10:13 | |
| *** Mohammad is now known as Guest50296 | 10:13 | |
| Guest50296 | Hi there, How can I config devstack , to use keystone version 3 apis? | 10:14 |
| marekd | Guest50296: you just need to configure client to use it - chane OS_AUTH_URL so the suffix is /v3 instead of v/2.0 and set OS_IDENTITY_API_VERSION=3 | 10:15 |
| Guest50296 | <+marekd>: Thanks but what about horizon? | 10:16 |
| marekd | Guest50296: that i don't know from head. | 10:16 |
| *** belmoreira has quit IRC | 10:16 | |
| *** hakimo has quit IRC | 10:17 | |
| Guest50296 | <+marekd>: Thanks, I find it. for horizon it can be changed from /openstack_dashboard/local/local_settings.py | 10:19 |
| *** Guest50296 has quit IRC | 10:19 | |
| *** hakimo has joined #openstack-keystone | 10:20 | |
| marekd | Guest52591: thanks | 10:20 |
| *** ig0r_ has quit IRC | 10:24 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Fix docs in federation.routers https://review.openstack.org/203572 | 10:29 |
| * marekd cleaning day | 10:32 | |
| breton | marekd: {var} and $var are used inconsistently in the whole codebase | 10:37 |
| *** tobe has quit IRC | 10:40 | |
| *** piyanai has joined #openstack-keystone | 10:41 | |
| *** jiaxi has quit IRC | 10:44 | |
| *** tobe has joined #openstack-keystone | 10:52 | |
| samueldmq | morning | 10:57 |
| samueldmq | ayoung: hi, let me know when you are available to talk about the outcomes of the micycle meetup | 10:57 |
| *** albertom has quit IRC | 11:04 | |
| *** topol has joined #openstack-keystone | 11:07 | |
| *** ChanServ sets mode: +v topol | 11:07 | |
| *** ig0r_ has joined #openstack-keystone | 11:08 | |
| *** chenhong has quit IRC | 11:09 | |
| *** albertom has joined #openstack-keystone | 11:11 | |
| *** topol has quit IRC | 11:12 | |
| *** boris-42 has quit IRC | 11:22 | |
| *** nllrte has joined #openstack-keystone | 11:24 | |
| *** davidckennedy has joined #openstack-keystone | 11:30 | |
| davidckennedy | Anybody got time to take a look at my patch 'Move endpoint catalog filtering to default driver' at 167675 ? | 11:37 |
| *** fhubik is now known as fhubik_afk | 11:42 | |
| *** piyanai has quit IRC | 11:43 | |
| *** piyanai has joined #openstack-keystone | 11:44 | |
| *** fhubik_afk is now known as fhubik | 11:45 | |
| marekd | breton: you mean everywhere or in federation.routers ? | 11:45 |
| breton | marekd: everywhere | 11:47 |
| ayoung | samueldmq, about 1.5 hours. | 11:48 |
| *** ayoung has quit IRC | 11:49 | |
| breton | marekd: I think I'll propose my patch now | 11:49 |
| marekd | breton: go ahead. | 11:52 |
| *** fhubik is now known as fhubik_afk | 11:56 | |
| *** gordc has joined #openstack-keystone | 11:56 | |
| *** aix has joined #openstack-keystone | 12:00 | |
| *** woodster_ has joined #openstack-keystone | 12:00 | |
| *** piyanai has quit IRC | 12:04 | |
| bknudson | marekd: proposal bot change like https://review.openstack.org/#/c/202282/ only needs one +2 | 12:05 |
| bknudson | although there seems to be something wrong with the code since it's got 2 change-ids. | 12:05 |
| *** ig0r_ has quit IRC | 12:05 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Fix docstrings in contrib https://review.openstack.org/203607 | 12:06 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Avoid the hard coding of admin token https://review.openstack.org/203546 | 12:06 |
| *** lhcheng has joined #openstack-keystone | 12:08 | |
| *** ChanServ sets mode: +v lhcheng | 12:08 | |
| *** raildo has joined #openstack-keystone | 12:10 | |
| *** lhcheng has quit IRC | 12:12 | |
| *** fhubik_afk is now known as fhubik | 12:15 | |
| *** markvoelker has joined #openstack-keystone | 12:16 | |
| *** gordc has quit IRC | 12:17 | |
| *** gordc has joined #openstack-keystone | 12:17 | |
| *** htruta has joined #openstack-keystone | 12:18 | |
| *** bknudson has quit IRC | 12:23 | |
| *** edmondsw has joined #openstack-keystone | 12:29 | |
| *** tobe has quit IRC | 12:34 | |
| *** chlong has joined #openstack-keystone | 12:35 | |
| *** hrou has joined #openstack-keystone | 12:36 | |
| *** edmondsw has quit IRC | 12:40 | |
| *** bknudson has joined #openstack-keystone | 12:45 | |
| *** ChanServ sets mode: +v bknudson | 12:45 | |
| lbragstad | dolphm: yeah, I have a change to get all the fernet/core.py stuff consolidated, so we can use the BaseProvider for everything | 13:01 |
| lbragstad | marekd: yep, I can push a new version | 13:01 |
| lbragstad | marekd: I have changes locally | 13:01 |
| *** topol has joined #openstack-keystone | 13:02 | |
| *** ChanServ sets mode: +v topol | 13:02 | |
| lbragstad | dolphm: https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:consolidate-fernet-provider,n,z | 13:02 |
| marekd | lbragstad: ok, so beware cause i rebased it on top of master. | 13:03 |
| lbragstad | marekd: yep, I'll repull the patch and apply whatever the delta is | 13:04 |
| lbragstad | marekd: this is the diff of what I have locally (http://cdn.pasteraw.com/f5x9jsr5l48pzrd2yvcf8kc6kxkx3jr) | 13:04 |
| *** rltrocquer has joined #openstack-keystone | 13:08 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Fernet payloads for federated scoped tokens. https://review.openstack.org/202176 | 13:13 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor: rename Fernet's unscoped federated payload https://review.openstack.org/202190 | 13:16 |
| dstanek | breton: two bots? | 13:17 |
| *** edmondsw has joined #openstack-keystone | 13:18 | |
| *** zzzeek has joined #openstack-keystone | 13:24 | |
| *** boris-42 has joined #openstack-keystone | 13:28 | |
| *** dims_ has quit IRC | 13:35 | |
| *** jecarey has joined #openstack-keystone | 13:40 | |
| breton | dstanek: https://bugs.launchpad.net/keystone/+bug/1471289 | 13:41 |
| openstack | Launchpad bug 1471289 in Keystone "Fernet tokens and Federated Identities result in token scope failures" [High,In progress] - Assigned to Lance Bragstad (lbragstad) | 13:41 |
| uvirtbot | Launchpad bug 1471289 in keystone "Fernet tokens and Federated Identities result in token scope failures" [High,In progress] | 13:41 |
| breton | dstanek: see? | 13:41 |
| *** piyanai has joined #openstack-keystone | 13:41 | |
| dolphm | lbragstad: looking | 13:41 |
| *** jdandrea has joined #openstack-keystone | 13:42 | |
| dolphm | dstanek: i assume we don't need uvirtbot anymore? | 13:42 |
| dstanek | breton: haha, nice | 13:42 |
| dstanek | dolphm: looks like maybe not | 13:42 |
| bknudson | uvirtbot: shutdown -h now | 13:43 |
| uvirtbot | bknudson: Error: "shutdown" is not a valid command. | 13:43 |
| bknudson | uvirtbot: sudo shutdown -h now | 13:43 |
| uvirtbot | bknudson: Error: "sudo" is not a valid command. | 13:43 |
| samueldmq | hahah | 13:43 |
| lbragstad | bknudson: lol | 13:43 |
| *** uvirtbot was kicked by dolphm (Your behavior is not conducive to the desired environment.) | 13:43 | |
| *** uvirtbot has joined #openstack-keystone | 13:43 | |
| samueldmq | dolphm: lol | 13:43 |
| lbragstad | bah | 13:43 |
| lbragstad | poor uvirtbot... | 13:43 |
| samueldmq | it's very insistent :) | 13:44 |
| *** chenhong has joined #openstack-keystone | 13:44 | |
| breton | https://bugs.launchpad.net/keystone/+bug/1471289 | 13:44 |
| openstack | Launchpad bug 1471289 in Keystone "Fernet tokens and Federated Identities result in token scope failures" [High,In progress] - Assigned to Lance Bragstad (lbragstad) | 13:44 |
| uvirtbot | Launchpad bug 1471289 in keystone "Fernet tokens and Federated Identities result in token scope failures" [High,In progress] | 13:44 |
| dolphm | uvirtbot: don't make me ban you | 13:44 |
| uvirtbot | dolphm: Error: "don't" is not a valid command. | 13:44 |
| samueldmq | dolphm: it's kidding you :) | 13:45 |
| lbragstad | dolphm: the patch that consolidated the issue_v3_token() method already merged. | 13:45 |
| dolphm | lbragstad: have a link to it? | 13:45 |
| lbragstad | dolphm: https://review.openstack.org/#/c/196774/ | 13:46 |
| dolphm | lbragstad: i had a patch to modify that method | 13:46 |
| lbragstad | dolphm: that was the start of my refactor | 13:46 |
| lbragstad | dolphm: my refactor to consolidate all the extended/duplicated methods in fernet/core.py to use BaseProvider() | 13:47 |
| lbragstad | dolphm: the next logical one would be https://review.openstack.org/#/c/196877/ | 13:47 |
| *** chenhong has quit IRC | 13:48 | |
| *** pnavarro has quit IRC | 13:51 | |
| *** TheIntern has joined #openstack-keystone | 13:51 | |
| *** jsavak has joined #openstack-keystone | 13:51 | |
| *** chenhong has joined #openstack-keystone | 13:53 | |
| *** browne has joined #openstack-keystone | 13:58 | |
| *** stevemar has joined #openstack-keystone | 14:00 | |
| *** ChanServ sets mode: +v stevemar | 14:00 | |
| *** stevemar has quit IRC | 14:03 | |
| *** jecarey has quit IRC | 14:03 | |
| *** ParsectiX has quit IRC | 14:04 | |
| morganfainberg | Yay consolidate fernet issue | 14:09 |
| *** tjx has joined #openstack-keystone | 14:10 | |
| tjx | Hello,everyone. | 14:10 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:16 | |
| tjx | https://review.openstack.org/#/c/200512/ | 14:18 |
| *** ayoung has joined #openstack-keystone | 14:23 | |
| *** ChanServ sets mode: +v ayoung | 14:23 | |
| ayoung | samueldmq, https://bugs.launchpad.net/keystone/+bug/1476264 | 14:23 |
| openstack | Launchpad bug 1476264 in Keystone "Cannot delete resources in remote services once project is deleted" [High,New] - Assigned to Adam Young (ayoung) | 14:23 |
| uvirtbot | Launchpad bug 1476264 in keystone "Cannot delete resources in remote services once project is deleted" [High,New] | 14:23 |
| *** jecarey has joined #openstack-keystone | 14:23 | |
| *** mylu has joined #openstack-keystone | 14:24 | |
| *** pgbridge has quit IRC | 14:25 | |
| *** dims_ has joined #openstack-keystone | 14:25 | |
| *** dims_ has quit IRC | 14:25 | |
| *** dims_ has joined #openstack-keystone | 14:26 | |
| *** _hrou_ has joined #openstack-keystone | 14:35 | |
| *** amirosh_ has joined #openstack-keystone | 14:35 | |
| *** ChanServ sets mode: +o morganfainberg | 14:37 | |
| *** browne1 has joined #openstack-keystone | 14:37 | |
| *** darrenc_ has joined #openstack-keystone | 14:38 | |
| *** ctracey_ has joined #openstack-keystone | 14:38 | |
| *** Nakato_ has joined #openstack-keystone | 14:39 | |
| *** amirosh has quit IRC | 14:39 | |
| *** kfox1111_ has joined #openstack-keystone | 14:39 | |
| *** telemons1er has joined #openstack-keystone | 14:40 | |
| *** cloudkiller has joined #openstack-keystone | 14:40 | |
| *** powerbsd has joined #openstack-keystone | 14:40 | |
| *** krotscheck_ has joined #openstack-keystone | 14:41 | |
| *** albertom has quit IRC | 14:42 | |
| *** ctracey has quit IRC | 14:42 | |
| *** powerbsd is now known as albertom | 14:42 | |
| *** krotscheck has quit IRC | 14:42 | |
| *** rm_work|away has quit IRC | 14:42 | |
| *** jamiec has quit IRC | 14:42 | |
| *** hogepodge has quit IRC | 14:42 | |
| *** wasmum- has quit IRC | 14:42 | |
| *** sudorandom has quit IRC | 14:42 | |
| *** browne has quit IRC | 14:42 | |
| *** flwang1 has quit IRC | 14:42 | |
| *** gabriel-bezerra has quit IRC | 14:42 | |
| *** jamielennox has quit IRC | 14:42 | |
| *** kfox1111 has quit IRC | 14:42 | |
| *** hrou has quit IRC | 14:42 | |
| *** telemonster has quit IRC | 14:42 | |
| *** cloudnull has quit IRC | 14:42 | |
| *** Nakato has quit IRC | 14:42 | |
| *** darrenc has quit IRC | 14:42 | |
| *** gus has quit IRC | 14:42 | |
| *** Tedster has quit IRC | 14:42 | |
| *** sudorandom has joined #openstack-keystone | 14:42 | |
| *** flwang has joined #openstack-keystone | 14:42 | |
| *** hogepodge has joined #openstack-keystone | 14:42 | |
| *** wasmum has joined #openstack-keystone | 14:42 | |
| *** cloudkiller is now known as cloudnull | 14:42 | |
| *** krotscheck_ is now known as krotscheck | 14:42 | |
| *** rm_work|away has joined #openstack-keystone | 14:42 | |
| dstanek | lbragstad: my new goal in life is to be able to keep up with you for a full 5k | 14:42 |
| *** gus has joined #openstack-keystone | 14:42 | |
| *** jamielennox has joined #openstack-keystone | 14:42 | |
| *** ChanServ sets mode: +v jamielennox | 14:42 | |
| *** rm_work|away is now known as rm_work | 14:42 | |
| *** rm_work has joined #openstack-keystone | 14:42 | |
| *** Tedster has joined #openstack-keystone | 14:43 | |
| *** ctracey_ is now known as ctracey | 14:43 | |
| *** jamiec has joined #openstack-keystone | 14:43 | |
| bknudson | dstanek: shave the beard for better airflow | 14:43 |
| dstanek | bknudson: unfortunately that alone won't cut it | 14:44 |
| lbragstad | dstanek: keep the beard, it's like magic, it makes you faster despite wind resistance | 14:44 |
| *** morganfainberg sets mode: +q uvirbot!*@* | 14:45 | |
| lbragstad | dstanek: want me to check and see if there is a 5k here in August? | 14:45 |
| morganfainberg | https://bugs.launchpad.net/keystone/+bug/1476264 | 14:45 |
| openstack | Launchpad bug 1476264 in Keystone "Cannot delete resources in remote services once project is deleted" [High,New] - Assigned to Adam Young (ayoung) | 14:45 |
| uvirtbot | Launchpad bug 1476264 in keystone "Cannot delete resources in remote services once project is deleted" [High,New] | 14:45 |
| lbragstad | morganfainberg: your test failed ;) | 14:45 |
| *** gabriel-bezerra has joined #openstack-keystone | 14:45 | |
| dstanek | lbragstad: sure | 14:46 |
| lbragstad | dstanek: I did this one last year http://www.tap-tober5kbeerrun.com/ | 14:46 |
| *** morganfainberg sets mode: +q uvirtbot!*@* | 14:47 | |
| morganfainberg | https://bugs.launchpad.net/keystone/+bug/1476261 | 14:47 |
| openstack | Launchpad bug 1476261 in OpenContrail "Scons fails when building in parallel" [Undecided,New] | 14:47 |
| morganfainberg | there we go | 14:47 |
| morganfainberg | dolphm, ^ :) | 14:48 |
| openstackgerrit | ayoung proposed openstack/keystone: remove assignments when deleting a domain https://review.openstack.org/127433 | 14:48 |
| dolphm | morganfainberg: much better | 14:49 |
| anteaya | morganfainberg: it worked! | 14:49 |
| tjx | Hello.everyone. Who can help me to review my patch set ? https://review.openstack.org/#/c/200512/ | 14:50 |
| tjx | Thank you in advance | 14:50 |
| * morganfainberg neeeeeeeeeds coooooofffffeeeeee | 14:50 | |
| morganfainberg | and a bike ride... preferably sans migrane today | 14:50 |
| ayoung | rodrigods, can you follow up on https://review.openstack.org/#/c/184651/ as you were the last to review. I added the service provider, and I think I'd like you to look again before this goes in | 14:55 |
| ayoung | tjx, I'll trade you review for review; | 14:55 |
| tjx | coffee is not good | 14:55 |
| ayoung | look at https://review.openstack.org/#/c/184651/ and I will look at https://review.openstack.org/#/c/200512/ | 14:55 |
| ayoung | deal? | 14:55 |
| tjx | Ok, good | 14:55 |
| *** stevemar has joined #openstack-keystone | 14:56 | |
| *** ChanServ sets mode: +v stevemar | 14:56 | |
| jamielennox | stevemar: does OSC do something funny with SSL certs | 14:56 |
| *** amakarov has joined #openstack-keystone | 14:59 | |
| *** henrynash has joined #openstack-keystone | 15:03 | |
| *** ChanServ sets mode: +v henrynash | 15:03 | |
| rodrigods | ayoung, looking, thx | 15:10 |
| *** fhubik is now known as fhubik_afk | 15:12 | |
| *** jistr is now known as jistr|mtg | 15:13 | |
| ayoung | tjx, why do you explicitly list the endpoint rtypes and andd them https://review.openstack.org/#/c/200512/16/keystone/catalog/controllers.py,cm | 15:13 |
| ayoung | jamielennox, did you forget to go to bed? | 15:15 |
| jamielennox | ayoung: i've been going to bed as soon as i figure out wtf is wrong with this SSL problem for like 4 hours | 15:15 |
| tjx | What't the time now in US | 15:15 |
| tjx | It's 23:15 in China | 15:15 |
| ayoung | tjx he's in Australia | 15:16 |
| lbragstad | tjx: 10:15 Central (US) | 15:16 |
| jamielennox | 1:15, for some reason i can make requests using keystone CLI, but not openstack cli | 15:18 |
| dstanek | tjx: did you check to see if null is valid for URLs? | 15:18 |
| jamielennox | but if i put OSC in a venv it works | 15:18 |
| jamielennox | which i can only assume means that RHEL has screwed up it's version of requests | 15:18 |
| ayoung | jamielennox, but keystoneclient is not in a venv? | 15:18 |
| jamielennox | or not... | 15:18 |
| jamielennox | on | 15:19 |
| jamielennox | no | 15:19 |
| dstanek | jamielennox: what issue are you having? | 15:19 |
| jamielennox | dstanek: ValueError: empty or no certificate | 15:19 |
| jamielennox | socket.getpeercert() is returning an empty dict | 15:19 |
| *** gyee has joined #openstack-keystone | 15:19 | |
| *** ChanServ sets mode: +v gyee | 15:19 | |
| dstanek | that's strange...only in a venv or only outside of it? | 15:20 |
| jamielennox | which apparently means it wasn't validated, but i don't see how | 15:20 |
| ayoung | jamielennox, sounds like a config error to me. Maybe OSC is overwriting the cert path somehow | 15:20 |
| *** dims_ has quit IRC | 15:20 | |
| jamielennox | dstanek: outside | 15:20 |
| jamielennox | ayoung: same options being provided to keystoneclient, also from rpms | 15:20 |
| jamielennox | and i can make a request using requests directly and it works, i can make a request with keystoneclient and sesion and it's fine | 15:20 |
| jamielennox | just for some reason going through OSC is screwing up | 15:21 |
| ayoung | jamielennox, put a breakpoint in the session code and try. See if maybe it is screwing up the path\ | 15:21 |
| ayoung | when called from OSC | 15:22 |
| jamielennox | ayoung: i have, i don't see it different at all | 15:22 |
| jamielennox | if i git checkout the same version of OSC it seems to work in a venv | 15:22 |
| ayoung | tjx, so long as you put my name at the start of a line, it will notify me | 15:22 |
| tjx | ayoung like this? | 15:23 |
| ayoung | jamielennox, maybe inside the venv it is reading from a cached file inside the venv, but outside it is getting the standard certs from /etc/pki etc | 15:23 |
| ayoung | tjx, yep | 15:23 |
| jamielennox | ayoung: i'm override with --os-cacert in both | 15:23 |
| ayoung | jamielennox, inside the venv, does that maybe map to a different file than outside? | 15:24 |
| tjx | ayoung, urls = []106 ayoung11:14 PM why is this necessary? | 15:24 |
| *** jistr|mtg is now known as jistr | 15:24 | |
| *** diazjf has joined #openstack-keystone | 15:24 | |
| ayoung | tjx, yeah | 15:24 |
| tjx | Do you want me to delete it ? | 15:24 |
| jamielennox | ayoung: that doesn't make sense for a venv | 15:24 |
| ayoung | tjx, the rest of the change makes sense, but why did you explicitly add in the 3 urls? | 15:24 |
| ayoung | tjx, it was not in the code before hand, so it seems strange to add it in here | 15:25 |
| tjx | I want to check the three urls. | 15:25 |
| tjx | in a for sentence | 15:25 |
| ayoung | tjx, ah...those are not returned...I see. | 15:25 |
| *** richm has joined #openstack-keystone | 15:26 | |
| ayoung | tjx, so there is no need to make a list and iterate, right? code could reduct to | 15:26 |
| ayoung | if endpoint.get('publicurl'): | 15:26 |
| tjx | ayoung, So, it's right. Right | 15:26 |
| ayoung | if not clean.check_endpoint_url( endpoint['internalurl'] , core.WHITELISTED_PROPERTIES): | 15:27 |
| ayoung | raise exception.ValidationURLError(url) | 15:27 |
| tjx | ayoung, then ? | 15:27 |
| tjx | ayoung, what do you mean ? | 15:27 |
| ayoung | tjx, use the collection at the top of the file then | 15:27 |
| ayoung | tjx, line 32 | 15:28 |
| ayoung | for interface in INTERFACES .... : | 15:28 |
| tjx | ayoung, only check endpoint['internalurl'] ? I need to check the three. | 15:29 |
| lbragstad | dolphm: one comment https://review.openstack.org/#/c/192739/ | 15:29 |
| tjx | Need a list. | 15:29 |
| lbragstad | dstanek: probably has a better answer for that than I do | 15:29 |
| ayoung | tjx, look at line 32 of that file | 15:30 |
| *** jorge_munoz has quit IRC | 15:30 | |
| ayoung | tjx, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/catalog/controllers.py?id=d7e529911c496c71effa1d51e1ecf2399ef359f1#n30 | 15:30 |
| *** jorge_munoz has joined #openstack-keystone | 15:31 | |
| *** rdo has quit IRC | 15:32 | |
| tjx | ayoung, I got it. | 15:32 |
| *** piyanai has quit IRC | 15:33 | |
| breton | ayoung: reviewed https://review.openstack.org/#/c/184651/. You owe me a review now! | 15:34 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Additional Fernet test coverage https://review.openstack.org/192739 | 15:34 |
| dolphm | lbragstad: updated to use @wip() ^ | 15:34 |
| *** dims_ has joined #openstack-keystone | 15:34 | |
| *** marzif has joined #openstack-keystone | 15:35 | |
| dolphm | lbragstad: the benefit is that it runs @wip'd tests to ensure that they're failing | 15:36 |
| dstanek | dolphm: ++ | 15:36 |
| *** piyanai has joined #openstack-keystone | 15:37 | |
| *** dims__ has joined #openstack-keystone | 15:38 | |
| *** dims__ has quit IRC | 15:40 | |
| *** dims_ has quit IRC | 15:40 | |
| *** dims_ has joined #openstack-keystone | 15:41 | |
| *** amick has joined #openstack-keystone | 15:41 | |
| *** dims_ has quit IRC | 15:45 | |
| ayoung | breton, saw that. | 15:45 |
| ayoung | breton, you have a preference for which? | 15:45 |
| *** fhubik_afk is now known as fhubik | 15:46 | |
| breton | ayoung: I'll save it for some other day :p | 15:46 |
| *** browne1 has quit IRC | 15:47 | |
| *** tjx has quit IRC | 15:47 | |
| henrynash | looking for a bit of review time on: https://review.openstack.org/#/c/200624/ (trying to make how we use parent_id, domain_id and is_domain clearer in the identity spec) | 15:48 |
| dstanek | breton: yeah, hold on to it until you get have a gnarly one that nobody else wants to review :-) | 15:49 |
| *** mgarza_ has joined #openstack-keystone | 15:51 | |
| *** mylu has quit IRC | 15:53 | |
| *** mylu has joined #openstack-keystone | 15:54 | |
| *** amick is now known as help | 15:56 | |
| *** help is now known as Guest56954 | 15:56 | |
| *** afazekas_ has quit IRC | 15:57 | |
| *** rdo has joined #openstack-keystone | 15:57 | |
| *** Guest56954 has left #openstack-keystone | 15:57 | |
| *** amickus has joined #openstack-keystone | 16:01 | |
| *** fhubik has quit IRC | 16:03 | |
| lbragstad | dstanek: your federation devstack stuff is done on 14.04, right? | 16:03 |
| lbragstad | dstanek: I'm going to pull it down locally and run federated devstack | 16:03 |
| dstanek | lbragstad: i may have been using 15.04 | 16:07 |
| lbragstad | dstanek: I'll try it and see if it breaks | 16:07 |
| dstanek | lbragstad: been trying to move everything over to fedora, but that's been lagging since osad doesn't work with it yet | 16:08 |
| *** davidckennedy has quit IRC | 16:08 | |
| lbragstad | dstanek: moving everything to fedora for the devstack + federation stuff? | 16:10 |
| *** gyee has quit IRC | 16:11 | |
| *** mylu has quit IRC | 16:11 | |
| dstanek | lbragstad: i've been trying to go to fedora for everything i do | 16:12 |
| lbragstad | dstanek: gotcha | 16:12 |
| dstanek | i wish ansible (or maybe the task it's performing) went faster. i hate sitting around and waiting | 16:14 |
| lbragstad | dstanek: a single task or the whole playbook? | 16:14 |
| dstanek | lbragstad: the playbooks | 16:14 |
| lbragstad | dstanek: are you able to use tags? | 16:15 |
| lbragstad | or are the tasks just long running in general? | 16:15 |
| *** gyee has joined #openstack-keystone | 16:15 | |
| *** ChanServ sets mode: +v gyee | 16:15 | |
| dstanek | lbragstad: yes, i'm using tags and had to resort to 'start-at-task' | 16:15 |
| lbragstad | ahhh, that's what I was going to suggest | 16:16 |
| *** ajayaa has joined #openstack-keystone | 16:16 | |
| dstanek | i think when i checks if a system package is installed it sends a carrier pigeon | 16:17 |
| *** e0ne has quit IRC | 16:18 | |
| *** _cjones_ has joined #openstack-keystone | 16:22 | |
| lbragstad | dstanek: for the changes you have in openstack/keystone, do they have to live in /opt/stack/keystone in order for devstack to pick them up? | 16:22 |
| *** mylu has joined #openstack-keystone | 16:22 | |
| *** ankita_wagh has joined #openstack-keystone | 16:23 | |
| dstanek | lbragstad: i typically do | 16:24 |
| breton | lbragstad: I am reviewing https://review.openstack.org/#/c/197647/8/keystone/token/providers/fernet/core.py now. What's bind? Lines 49-52 do something about it | 16:24 |
| *** jistr has quit IRC | 16:24 | |
| lbragstad | breton: bind is something that you can do to get a token, ayoung knows more about it | 16:25 |
| dstanek | alright i'm not feeling well today - going to grab a quick lunch | 16:25 |
| lbragstad | feel better | 16:26 |
| *** morganfainberg changes topic to "Welcome back from the meetup | MidCycle Etherpad: https://etherpad.openstack.org/p/keystone-liberty-midcycle-meetup" | 16:26 | |
| *** mylu has quit IRC | 16:28 | |
| breton | OK, I've found this -- https://review.openstack.org/#/c/36166/8/openstack-identity-api/v3/src/markdown/identity-api-v3.md | 16:28 |
| breton | does anybody use it? | 16:28 |
| *** chenhong has quit IRC | 16:31 | |
| lbragstad | breton: I'm not sure | 16:31 |
| bknudson | breton: I think there's a bug in auth_token where it doesn't even work. | 16:32 |
| lbragstad | breton: not that I'm aware of | 16:32 |
| *** lhcheng has joined #openstack-keystone | 16:34 | |
| *** ChanServ sets mode: +v lhcheng | 16:34 | |
| ayoung | breton, token binding was to limit the token itslef to only communicating authorization information, but to still require using strict authentication (crypto) when talking to the endpoint. It never caught on and I stopped pushing it | 16:34 |
| *** afaranha has joined #openstack-keystone | 16:35 | |
| *** jsavak has quit IRC | 16:35 | |
| *** mylu has joined #openstack-keystone | 16:35 | |
| *** afaranha has left #openstack-keystone | 16:35 | |
| ayoung | breton, so if I used a Kerberos principal to get a token, I could say "require this same Kerberos principal to be used when handing the token over to a services" | 16:35 |
| breton | maybe we should deprecate and drop it? | 16:35 |
| *** browne has joined #openstack-keystone | 16:35 | |
| samueldmq | ayoung: o/ | 16:36 |
| ayoung | hey sam | 16:36 |
| samueldmq | ayoung: hey, how are you ? | 16:36 |
| ayoung | breton, not willing to, yet....we might go that way after all. | 16:37 |
| samueldmq | ayoung: how was the meetup last week ? | 16:37 |
| ayoung | samueldmq, exhausting, but ultimately successful | 16:37 |
| ayoung | I think I have a clear view of the next steps for policy, anyway | 16:37 |
| samueldmq | ayoung: that's great news | 16:37 |
| ayoung | samueldmq, BTW, the fact that we are starting with "endpoint ID" needs to be syncronized with t gyee 's team doing the endpoint binding of tokens | 16:38 |
| samueldmq | ayoung: yeah, tell me what have been agreed there | 16:38 |
| ayoung | samueldmq, I think it was more that people finally started to see the big picture | 16:38 |
| samueldmq | ayoung: ok so the fetch is going to be by endpoint id | 16:38 |
| samueldmq | ayoung: not by url nor policy id | 16:38 |
| ayoung | samueldmq, I think we need the ability to kill "global admin" which means...I think, create project with a specified ID | 16:38 |
| ayoung | samueldmq, yes fetch is going to be by endpoint_id | 16:39 |
| samueldmq | ayoung: nice | 16:39 |
| ayoung | and then we will put more logic into the middleware to calculate endpoint_id from other known things | 16:39 |
| samueldmq | gyee: ping - I'll propose a patch that simply introduces endpoint_id as a config option, then my patch and yours can be based on that first one | 16:39 |
| ayoung | samueldmq, so we probably need a spec for "caluclate endpoint_id from url" | 16:40 |
| ayoung | samueldmq, I think someone else on his team is writing that...let me look | 16:40 |
| samueldmq | ayoung: didn't that have known problems as pointed out by morgan ? | 16:40 |
| samueldmq | ayoung: I mean the id from url | 16:40 |
| ayoung | samueldmq, its imperfect, but "good enough" | 16:40 |
| samueldmq | ayoung: like the URL could be rewriteen at some point .. eg the ssl termination | 16:40 |
| ayoung | URL can either be from request or in config file | 16:41 |
| ayoung | either way, logic will still be to deduce from the catalog | 16:41 |
| samueldmq | ayoung: then we document that, if you do URL re-write put it in the config | 16:41 |
| ayoung | yep | 16:41 |
| samueldmq | ayoung: if you don't, we will discover that for you | 16:41 |
| ayoung | yep | 16:41 |
| samueldmq | like .. magic | 16:41 |
| samueldmq | :) | 16:41 |
| ayoung | and if we can't...we asplode | 16:41 |
| samueldmq | ayoung: asplode == self.explode ? | 16:42 |
| ayoung | stevemar, I like https://review.openstack.org/#/c/203262/ but would check with dstanek that it is not going to set back his Flask work | 16:42 |
| ayoung | samueldmq, yep | 16:43 |
| samueldmq | ayoung: k got it sir | 16:43 |
| samueldmq | ayoung: and regarding the scope, we keep the dynamic distribution targeted to L, right ? | 16:43 |
| ayoung | samueldmq, wanna take https://bugs.launchpad.net/keystone/+bug/1476264 | 16:43 |
| openstack | Launchpad bug 1476264 in Keystone "Cannot delete resources in remote services once project is deleted" [High,New] - Assigned to Adam Young (ayoung) | 16:43 |
| ayoung | samueldmq, ^^ probably needs to be both domain and project, but project is the important one | 16:44 |
| ayoung | I think we need that fixed in order to write policy to always require a scoped token | 16:44 |
| ayoung | we also, probably, need endpoint scoped tokens, but still thinking through that. I would rather reuse the project abstraction than create a new type of scope\ | 16:45 |
| samueldmq | ayoung: I can grab that later today, not now because I have to report/confirm dynmaic policies roadmap to my managers | 16:46 |
| ayoung | samueldmq, this falls under dynamic policy | 16:46 |
| ayoung | so, want to know if you plan on grabbing it, or I can do it | 16:47 |
| *** jasonsb has quit IRC | 16:47 | |
| samueldmq | ayoung: keep with it for now, if I am going to grab it later and you haven't start, I ping you | 16:47 |
| samueldmq | ayoung: sounds good ? | 16:47 |
| ayoung | yep | 16:47 |
| *** roxanaghe has joined #openstack-keystone | 16:48 | |
| samueldmq | ayoung: I thought a project's resources were deleted somehow if we delete the project in keystone side .. | 16:48 |
| samueldmq | ayoung: but that seems to not be the case | 16:48 |
| ayoung | samueldmq, not if they are not listening, etc. | 16:48 |
| ayoung | samueldmq, it is one case where being able to re-create a project would be essential. I think all other cases for global admin for project scoped resources are covered | 16:49 |
| samueldmq | ayoung: and that's the case you reported | 16:49 |
| ayoung | need to figure out what to do baout not-project-scoped, though | 16:49 |
| samueldmq | ayoung: should a domain admin be able to manage resources within a project ? | 16:50 |
| *** ankita_wagh has quit IRC | 16:50 | |
| ayoung | samueldmq, it should be "possible" to do so with HTM | 16:50 |
| ayoung | HMT | 16:50 |
| samueldmq | ayoung: actually how the delete is done depends in the policy in place, right ? | 16:50 |
| samueldmq | ayoung: so what you report is with the current default policies | 16:50 |
| samueldmq | ayoung: and what makes me sad is this fact: https://github.com/openstack/glance/blob/master/etc/policy.json#L6 | 16:51 |
| samueldmq | ayoung: so the project scope checking looks to be hard coded | 16:51 |
| samueldmq | :( | 16:51 |
| ayoung | samueldmq, yep | 16:51 |
| samueldmq | ayoung: the tricky part of fixing 968696 is that it isn't "simply" fixing our default policies | 16:53 |
| samueldmq | ayoung: there are hardcoded things around that as well :( | 16:53 |
| ayoung | samueldmq, I know, it is removing the reasons that we have those default policies in the first place | 16:53 |
| ayoung | like this | 16:53 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: clean up TokenAPITests https://review.openstack.org/203250 | 16:54 |
| samueldmq | ayoung: yep | 16:54 |
| ayoung | samueldmq, if there project is deisabled, we can enable it to delte | 16:54 |
| ayoung | the normal case will use HMT | 16:54 |
| ayoung | but if the project is deleted, I don't know what else we can do but recreate it | 16:54 |
| samueldmq | ayoung: in HMT .. I was thinking about something to be added in the code as well | 16:54 |
| ayoung | put it under some different, admin los-tand-found project and delete resources, then re-delete the project | 16:54 |
| samueldmq | ayoung: look: galnce will need to know the project hierarchy to quota operations, for example, right ? | 16:55 |
| samueldmq | ayoung: we could allow a policy operation like: project_id:%(any(project.parents)s | 16:56 |
| samueldmq | ayoung: to allow, for example, an admin in any parent to set the quota to that children.. | 16:57 |
| *** lhcheng has quit IRC | 16:57 | |
| *** lhcheng has joined #openstack-keystone | 16:57 | |
| *** ChanServ sets mode: +v lhcheng | 16:57 | |
| samueldmq | ayoung: anyway that's just a thought I had, I know making the policy rules more powerful is in your plans | 16:57 |
| ayoung | samueldmq, while we *(can* do stuff like that, I don't think we should | 16:58 |
| ayoung | policy should not allow hierarchical operations. Shooting to limit the exposure in a token, not widen it | 16:59 |
| *** stevemar has quit IRC | 16:59 | |
| *** lhcheng has quit IRC | 16:59 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Fix docs in federation.routers https://review.openstack.org/203572 | 16:59 |
| *** lhcheng has joined #openstack-keystone | 17:00 | |
| *** ChanServ sets mode: +v lhcheng | 17:00 | |
| *** dims_ has joined #openstack-keystone | 17:05 | |
| *** stevemar has joined #openstack-keystone | 17:08 | |
| *** ChanServ sets mode: +v stevemar | 17:08 | |
| *** amirosh_ has quit IRC | 17:10 | |
| samueldmq | ayoung: k | 17:10 |
| samueldmq | ayoung: did you have a chance to take a look at Dynamic Policies Delivering Mechanism ? | 17:10 |
| ayoung | samueldmq, I d8id, but you still had work to do on it, I thought | 17:11 |
| samueldmq | ayoung: that's the missing part to have true policy delivery (behind policies, etc) | 17:11 |
| *** amirosh has joined #openstack-keystone | 17:11 | |
| samueldmq | ayoung: I think I will implement it + policy by endpoint id to have a TRUE demo in ~3 weeks | 17:12 |
| ayoung | samueldmq, there is a long way to get this to where it should be, delivery is key, but not the whole story. | 17:12 |
| samueldmq | ayoung: what do you think ? | 17:12 |
| *** ankita_wagh has joined #openstack-keystone | 17:12 | |
| ayoung | samueldmq, just get the "by ID" working and posted. THe url-to-id can happen second | 17:12 |
| ayoung | you just had the field as policy_id, which you needed to change to endpoint_id, I think | 17:13 |
| samueldmq | ayoung: yes, and the ksclient must support the get_policy_by_endpoint_id thing | 17:13 |
| ayoung | but, yeah, the rest of it is important. Drive on | 17:13 |
| samueldmq | ayoung: what do I do in the case the URL match multiple endpoints ? keystone server returns all available ids right ? | 17:14 |
| morganfainberg | you could unique constrain URL | 17:14 |
| samueldmq | morganfainberg: how about migrations ? | 17:15 |
| *** amirosh has quit IRC | 17:15 | |
| samueldmq | morganfainberg: and hey, you there listening .. :) | 17:15 |
| *** e0ne has joined #openstack-keystone | 17:15 | |
| morganfainberg | if multiple endpoints map to the same URL - you have other issues in the catalog | 17:15 |
| morganfainberg | you could squash them - unless the bridge services -- and even then... I think your cloud is broken | 17:16 |
| samueldmq | morganfainberg: maybe, but we must adopt an approach to decide what to do in the case we find that in the db | 17:16 |
| *** openstackgerrit has quit IRC | 17:16 | |
| morganfainberg | true - like i said, my guess is we could squash it -- unless it is across multiple serviceIDs. then something is really broken | 17:17 |
| *** openstackgerrit has joined #openstack-keystone | 17:17 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Fix docs in federation.routers https://review.openstack.org/203572 | 17:17 |
| samueldmq | morganfainberg: by squash you mean concatenate ? suppose I have (id1,url1) (id2,url1) (id3,url1), what shoudl htat look like at the end ? | 17:18 |
| morganfainberg | samueldmq: those endpoints are likely the same thing. | 17:19 |
| morganfainberg | if the url is the *exact* same | 17:19 |
| samueldmq | morganfainberg: yeah, but they have different interface types | 17:19 |
| samueldmq | morganfainberg: what to do ? I think we should have a single ID even for different interface tyeps | 17:19 |
| samueldmq | tbh .. :) | 17:19 |
| morganfainberg | you could also change the DB data normalization scheme | 17:20 |
| morganfainberg | samueldmq: basically yes, same ID, just type is different | 17:20 |
| morganfainberg | (interface type( | 17:20 |
| morganfainberg | not to be confused with... gah, I hate our data model sometime | 17:20 |
| morganfainberg | ss | 17:20 |
| samueldmq | morganfainberg: and the object is duplicated into db, or do we create another table for the association ? | 17:20 |
| samueldmq | hehe | 17:21 |
| morganfainberg | samueldmq: basically we'd end up with a new table layout. | 17:21 |
| morganfainberg | samueldmq: with a many->one type relationship | 17:21 |
| morganfainberg | vs. the one-to-one | 17:21 |
| morganfainberg | we have today | 17:21 |
| morganfainberg | or mixed into a single table | 17:21 |
| morganfainberg | it would be a total restructure of the db schema for this bit. | 17:22 |
| samueldmq | morganfainberg: yes, and the many side is (interface, url) ? as different interfaces can have different urls, but the same id though | 17:22 |
| morganfainberg | the many side would be interface-type/interface | 17:22 |
| morganfainberg | the URL would be the one, and then a many url -> one endpoint id | 17:23 |
| *** diegoadolfo has joined #openstack-keystone | 17:23 | |
| morganfainberg | it's a lot of moving things around | 17:23 |
| morganfainberg | might not be worth the headache | 17:23 |
| morganfainberg | might be easier to go with something a lot simpler | 17:23 |
| samueldmq | like ? | 17:23 |
| morganfainberg | what you descibed | 17:24 |
| morganfainberg | return them all | 17:24 |
| morganfainberg | or something | 17:24 |
| samueldmq | and a fix for the endpoints datamodel could come later | 17:24 |
| samueldmq | in the history | 17:24 |
| * morganfainberg shrugs | 17:24 | |
| morganfainberg | something like that | 17:24 |
| *** piyanai has quit IRC | 17:25 | |
| samueldmq | morganfainberg: I prefer to fix all that .. but time's short :) L is running | 17:25 |
| morganfainberg | yes | 17:25 |
| morganfainberg | i'd like to use consul for the catalog, but that might be out of scope for L as well | 17:25 |
| morganfainberg | :P) | 17:25 |
| diegoadolfo | lbragstad, | 17:25 |
| samueldmq | morganfainberg: how do deployers (CMS) associate policy to endpoint ? | 17:26 |
| samueldmq | morganfainberg: do we keep associating the policy by enpoint ID ? | 17:26 |
| morganfainberg | samueldmq: dump it on disk for the server | 17:26 |
| morganfainberg | :P | 17:27 |
| samueldmq | morganfainberg: and yeah, I like consul, but it's a long road though | 17:27 |
| morganfainberg | oh in the future | 17:27 |
| morganfainberg | yeahhh | 17:27 |
| samueldmq | morganfainberg: lol | 17:27 |
| lbragstad | diegoadolfo: o/ | 17:27 |
| samueldmq | morganfainberg: and the bad UX comes here: in that case, what id do deployers use to associate the policy ? | 17:28 |
| morganfainberg | samueldmq: go with ayoung's suggestion SHA256 | 17:28 |
| morganfainberg | :P | 17:28 |
| samueldmq | morganfainberg: the answer can be: any of them, as the middleware will know the list of endpoint-ids for that URL, it fetch the first valid policy | 17:28 |
| morganfainberg | i like the url model though | 17:28 |
| morganfainberg | but if we can just use any url, doesn't matter | 17:29 |
| ayoung | morganfainberg, reading up | 17:29 |
| *** Ephur has joined #openstack-keystone | 17:29 | |
| morganfainberg | data model can be fixed later | 17:29 |
| morganfainberg | if it really has no impact | 17:29 |
| samueldmq | morganfainberg: I don't think it has :) | 17:29 |
| morganfainberg | then go for easiest | 17:29 |
| morganfainberg | best ux for deployer | 17:29 |
| ayoung | morganfainberg, so...it might be possible that both admin and public endpoints have the same URL. There is only an issue if they have different policy files, and if that is the case, then, yes, there is a problem. But, I think we can punt on that from the fetch side | 17:30 |
| ayoung | we need to identify that on the assignment side | 17:30 |
| samueldmq | so .. when getting endpoints by URL, middleware can get a list of IDs, then it asks keystone for policies associated with those IDs, and stores the first valid one | 17:30 |
| samueldmq | if that makes sense | 17:30 |
| *** tqtran has joined #openstack-keystone | 17:30 | |
| ayoung | endpoint_policy should enforce: if two endpoints have the same URL, they must resolve to the same policy file | 17:31 |
| samueldmq | ayoung: ^ yeah we just consider the first ID in the list which has a valid policy associated with | 17:31 |
| ayoung | samueldmq, right. and at the middleware layer, we will not know if they would resolve to different policy files | 17:31 |
| ayoung | so, lets file a bug against endpoint_poicy and then drive on with this approach in middleware | 17:31 |
| ayoung | morganfainberg, make sense? | 17:32 |
| samueldmq | ayoung: we don't care, if the deployer has different policies to the same endpoint (which is a process running a service), it's his bad deployment :p | 17:32 |
| samueldmq | ayoung: fixing our endpoint model would result on fixing this as well, see above conversation | 17:33 |
| ayoung | samueldmq, Yep, but we'll help to straighten out those issues over time, too. | 17:33 |
| *** Ephur has quit IRC | 17:33 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Fix docstrings in contrib https://review.openstack.org/203607 | 17:34 |
| *** ChanServ sets mode: +o stevemar | 17:34 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Fix docs in federation.routers https://review.openstack.org/203572 | 17:34 |
| samueldmq | ayoung: where we have a single endpoint_id associated to multiple interfaces, instead of needing to have multiple endpoitn_ids for multiple interfaces | 17:34 |
| samueldmq | ayoung: so that would fix the above issue as well | 17:34 |
| samueldmq | ayoung: if that makes sense to you :) | 17:35 |
| *** btully has joined #openstack-keystone | 17:35 | |
| lbragstad | diegoadolfo: something simple to implemented? | 17:36 |
| ayoung | samueldmq, yeah, it really is addressing the same issue, and addressing it at the core | 17:36 |
| lbragstad | s/implemented/implement/ | 17:37 |
| samueldmq | ayoung: exactly sir ! | 17:37 |
| samueldmq | ayoung: you ok with that addressed later ? :) | 17:37 |
| samueldmq | ayoung: and we do it the simplest way for now | 17:37 |
| ayoung | morganfainberg, so..any problem with me fixing https://bugs.launchpad.net/keystone/+bug/1476264 via "specify ID when creating project"? | 17:38 |
| openstack | Launchpad bug 1476264 in Keystone "Cannot delete resources in remote services once project is deleted" [High,New] - Assigned to Adam Young (ayoung) | 17:38 |
| morganfainberg | i don't really mind it being changed. | 17:38 |
| samueldmq | morganfainberg: if we don't associate a policy by URL, we'll do it by endpoint_id, as we do today ... which is not known a priori | 17:40 |
| ayoung | morganfainberg, cool | 17:40 |
| samueldmq | morganfainberg: and doesn't fit your previous requirement .. are you ok with that ? i.e we fetch by URL, but associate by id ? | 17:41 |
| morganfainberg | ayoung: make sure conflicts can't occur and make sure if not specified a id is generated, last thing - ids are immutable - no changing then after the fact | 17:41 |
| samueldmq | (fetch by URL means resolving the ID thoguth the UR) | 17:41 |
| morganfainberg | ayoung: if we're doing that change. | 17:41 |
| ayoung | morganfainberg, basically, it is a change on the controller. If the id is specified, do a sanity check on it, and then leave it in place. id has a unique constraint in the database | 17:42 |
| morganfainberg | ayoung: sure. and make sure update doens't let ids change | 17:42 |
| morganfainberg | it should already check that..but you know... | 17:42 |
| morganfainberg | worth 2x checking | 17:43 |
| ayoung | morganfainberg, will do | 17:43 |
| morganfainberg | last bit - highly recommend constraining the id to hex/uuid format | 17:43 |
| morganfainberg | this isn't so people can make a project id: "my nifty <utf-8-char-string> project thing" | 17:44 |
| samueldmq | morganfainberg: what about LDAP resource backends ? I think we support that today | 17:44 |
| morganfainberg | samueldmq: assume LDAP assignment is dead | 17:44 |
| samueldmq | morganfainberg: I am talking about LDAP resource | 17:44 |
| morganfainberg | it is being removed next cycle | 17:44 |
| *** topol has quit IRC | 17:44 | |
| morganfainberg | samueldmq: same thing | 17:44 |
| morganfainberg | dead next cycle | 17:44 |
| samueldmq | morganfainberg: k they never existed to me anyway | 17:45 |
| samueldmq | o/ | 17:45 |
| morganfainberg | :( | 17:45 |
| morganfainberg | :) | 17:45 |
| morganfainberg | even | 17:45 |
| lbragstad | diegoadolfo: maybe look at solving one of these? https://bugs.launchpad.net/keystone/+bugs?field.searchtext=&orderby=-importance&search=Search&field.status%3Alist=NEW&field.status%3Alist=CONFIRMED&field.status%3Alist=TRIAGED&field.status%3Alist=INPROGRESS&field.status%3Alist=FIXCOMMITTED&field.status%3Alist=INCOMPLETE_WITH_RESPONSE&field.status%3Alist=INCOMPLETE_WITHOUT_RESPONSE&assignee_option=any&fiel | 17:45 |
| lbragstad | d.assignee=&field.bug_reporter=&field.bug_commenter=&field.subscriber=&field.structural_subscriber=&field.tag=low-hanging-fruit+&field.tags_combinator=ANY&field.has_cve.used=&field.omit_dupes.used=&field.omit_dupes=on&field.affects_me.used=&field.has_patch.used=&field.has_branches.used=&field.has_branches=on&field.has_no_branches.used=&field.has_no_branches=on&field.has_blueprints.used=&field.has_bluepr | 17:45 |
| lbragstad | ints=on&field.has_no_blueprints.used=&field.has_no_blueprints=on | 17:45 |
| lbragstad | ooo... | 17:45 |
| samueldmq | lbragstad: lol | 17:45 |
| lbragstad | sorry | 17:45 |
| morganfainberg | lbragstad: tinyurl! | 17:45 |
| morganfainberg | :P | 17:45 |
| lbragstad | diegoadolfo: https://goo.gl/CIeYO8 | 17:45 |
| *** rltrocquer has quit IRC | 17:46 | |
| ayoung | morganfainberg, I was going with UUID, but going to be forgiving on length, up to 128 chars | 17:46 |
| ayoung | allow for SHA256 | 17:46 |
| samueldmq | lbragstad: my mind is processing that URL in bash, will be back in ~1 hour | 17:46 |
| lbragstad | samueldmq: lol | 17:46 |
| ayoung | samueldmq, going to ignore ldap resources for this | 17:46 |
| *** aix has quit IRC | 17:46 | |
| morganfainberg | ayoung: hm. i don't think projects are anything but uuid atm | 17:46 |
| ayoung | morganfainberg, that is correct | 17:46 |
| samueldmq | ayoung: yeah they'll die in M | 17:46 |
| morganfainberg | ayoung: I'd rather over constrain the input and ease the constraint back later than too open right now | 17:47 |
| ayoung | morganfainberg, I guess we can expand the length on both sides when we do | 17:47 |
| ayoung | cool. I'll go with UUID length | 17:47 |
| morganfainberg | ayoung: i wouldn't -1 or -2 a sha256 allowance, but UUID is probably better for today | 17:47 |
| samueldmq | morganfainberg: ++ | 17:47 |
| samueldmq | morganfainberg: btw we didn't deprecate LDAP resource ... | 17:48 |
| samueldmq | morganfainberg: just assignment | 17:48 |
| morganfainberg | samueldmq: we deprecated ldap assignment | 17:48 |
| morganfainberg | it's the same thing | 17:48 |
| morganfainberg | we did the split and resource lost the deprecation warning - but lets be clear, both are going away in M | 17:48 |
| samueldmq | morganfainberg: ah yes, we deprecated that before the assignment/resource split | 17:48 |
| morganfainberg | samueldmq: it's worth adding the warning to resouce fwiw | 17:48 |
| *** piyanai has joined #openstack-keystone | 17:48 | |
| morganfainberg | (If we could have rm -rf'd it for Liberty, I would have) | 17:49 |
| samueldmq | morganfainberg: yes that's my concern, just to be clear, not against the removal at all :) | 17:49 |
| morganfainberg | samueldmq: it's still being removed next cycle - just add the warning in a patchset | 17:49 |
| samueldmq | morganfainberg: k | 17:49 |
| ayoung | morganfainberg, this regex "[0-9a-f]{32}" | 17:50 |
| morganfainberg | ayoung: i think we have a uuid schema | 17:51 |
| morganfainberg | for json schema you can use | 17:51 |
| morganfainberg | this is a json schema thing not a controller matching thing [or should be] | 17:51 |
| morganfainberg | or... not | 17:52 |
| morganfainberg | ah | 17:52 |
| ayoung | morganfainberg, needs to be called from the controller. We could do a json schema, too | 17:52 |
| morganfainberg | https://github.com/openstack/keystone/blob/master/keystone/resource/schema.py#L22 | 17:53 |
| *** dims_ has quit IRC | 17:53 | |
| ayoung | morganfainberg, that is not quite strict enough. | 17:53 |
| morganfainberg | ayoung: we should add a uuid-strict then | 17:53 |
| *** jsavak has joined #openstack-keystone | 17:53 | |
| morganfainberg | to https://github.com/openstack/keystone/blob/master/keystone/common/validation/parameter_types.py#L36-L44 | 17:53 |
| ayoung | morganfainberg, I'd like to keep this as saying "it must match an old UUID" for now | 17:54 |
| ayoung | even though there is no way we can enforce it | 17:54 |
| ayoung | and the API can get more forgiving in the future without an API spec change | 17:54 |
| morganfainberg | how do you know the old uuid? | 17:54 |
| ayoung | you don't. Like most things, we jusrt lie | 17:54 |
| morganfainberg | i was thinking we just make it a schema validation above the controller and similarly then lie | 17:55 |
| morganfainberg | :P | 17:55 |
| *** piyanai has quit IRC | 17:55 | |
| morganfainberg | controller doesn't need any logic - if the json schema prevents anything non-uuid landing | 17:55 |
| morganfainberg | we're pretty good. | 17:55 |
| morganfainberg | then just loosen the controller "generate_an_id" line | 17:55 |
| ayoung | we only guarantee it to work if it matches an old UUID | 17:56 |
| ayoung | if gyee wants to do soft deletes, he can use this to bring things back to life without an API change | 17:56 |
| morganfainberg | pushng this to json schema doesn't really change that. | 17:56 |
| *** dims_ has joined #openstack-keystone | 17:56 | |
| morganfainberg | gyee's change would be in the driver in either case | 17:56 |
| morganfainberg | or a change in driver *and* controller in both cases | 17:57 |
| morganfainberg | since today controller can't know if a uuid used to exist or not | 17:57 |
| morganfainberg | again, I wont -2 or -1 either approach | 17:57 |
| *** diegoadolfo_ has joined #openstack-keystone | 17:58 | |
| ayoung | cool | 17:58 |
| ayoung | let me a get a WIP posted | 17:58 |
| *** dims_ has quit IRC | 17:58 | |
| morganfainberg | sounds good to me | 17:58 |
| *** albertom has quit IRC | 17:58 | |
| *** ajayaa has quit IRC | 17:59 | |
| morganfainberg | ayoung: fwiw you're going to need to make some json schema validation changed in either case (to accept, optionally, the id) | 17:59 |
| *** piyanai has joined #openstack-keystone | 18:00 | |
| *** pcaruana has quit IRC | 18:00 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Deprecates LDAP Resource https://review.openstack.org/203748 | 18:00 |
| samueldmq | morganfainberg: ^ | 18:00 |
| morganfainberg | samueldmq: open a bug, don't attach to an old BP | 18:01 |
| morganfainberg | otherwise - yes. | 18:01 |
| lbragstad | dstanek: I'm running devstack with your change, it doesn't look like there is any thing config wise to enable federation? | 18:02 |
| *** fangzhou has joined #openstack-keystone | 18:03 | |
| *** ParsectiX has joined #openstack-keystone | 18:04 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Deprecate LDAP Resource Backend https://review.openstack.org/203748 | 18:05 |
| samueldmq | morganfainberg: ^ done | 18:05 |
| samueldmq | Mitaka ftw | 18:06 |
| stevemar | lhcheng: you approved just before i could :( | 18:06 |
| *** albertom has joined #openstack-keystone | 18:06 | |
| *** ParsectiX has quit IRC | 18:06 | |
| lhcheng | I thought you just updated a patch on osc | 18:07 |
| lhcheng | we're in sync on the sequence of patches being looked at | 18:07 |
| lhcheng | lol | 18:07 |
| *** TheIntern has quit IRC | 18:11 | |
| *** TheIntern has joined #openstack-keystone | 18:11 | |
| breton | I think it's weird to make a commit in L that is marking something as deprecated starting from K | 18:13 |
| samueldmq | ayoung: i) fix middleware patch to fetch by endpoint_id | 18:14 |
| samueldmq | ayoung: ii) resolve endpoint_id from URL | 18:14 |
| samueldmq | ayoung: iii) implement keystone server cache logic to deal with that case where multiple service processes are behind a HAProxy | 18:14 |
| *** arunkant has joined #openstack-keystone | 18:14 | |
| morganfainberg | breton: the deprecation warning was missed from the split | 18:15 |
| stevemar | bknudson: with create_region now in oslo.cache, how did you envision passing the region around to all the memoization decorators? | 18:15 |
| breton | morganfainberg: yeah, I understand | 18:15 |
| morganfainberg | breton: the driver was already deprecated but assignment -> [assignment|resource] should have been maintained | 18:15 |
| morganfainberg | we can backport the warning too | 18:15 |
| bknudson | stevemar: you'll have to create_region statically | 18:15 |
| morganfainberg | [and probably should] | 18:15 |
| bknudson | then ref it from somewhere | 18:15 |
| breton | it's just my... inner perfectionist riots | 18:15 |
| breton | morganfainberg: ++ | 18:16 |
| stevemar | bknudson: ... | 18:16 |
| samueldmq | ayoung: we then should have the same demo as we had last week, but much more robust | 18:16 |
| stevemar | bknudson: thats more work :P | 18:16 |
| bknudson | stevemar: I mean, you'll have to reference the static region in all the decorators | 18:16 |
| morganfainberg | breton: this case, your inner perfectionist will need to let it go ;) | 18:16 |
| breton | morganfainberg: he is ok with backporting to kilo | 18:16 |
| bknudson | stevemar: the previous way it was done didn't make any sense. | 18:16 |
| samueldmq | morganfainberg: actually the warning came after the split, however its true semantic was to apply for both of them (assignment,resource) | 18:16 |
| morganfainberg | sure sure | 18:17 |
| stevemar | bknudson: i gotta save the region in backends.py now and reference the global variable from there? | 18:27 |
| bknudson | stevemar: that works. | 18:28 |
| bknudson | I don't know where the best place is for it. | 18:29 |
| stevemar | bknudson: you stink, that means i gotta change a whole bunch of stuff now :P | 18:29 |
| bknudson | the code should have been written correctly to begin with | 18:29 |
| bknudson | global variables are an abomination | 18:30 |
| *** spandhe has joined #openstack-keystone | 18:30 | |
| *** piyanai has quit IRC | 18:30 | |
| *** jasonsb has joined #openstack-keystone | 18:30 | |
| stevemar | bknudson: we should have some sort of get_region() for oslo.cache | 18:31 |
| *** piyanai has joined #openstack-keystone | 18:32 | |
| dstanek | lbragstad: what are you doing exactly? | 18:33 |
| *** piyanai has quit IRC | 18:33 | |
| lbragstad | dstanek: just trying to run devstack with the federation stuff you have up for review https://review.openstack.org/#/c/151311/9 | 18:33 |
| lbragstad | I have a VM with devstack and keystone + your patch | 18:34 |
| *** mylu has quit IRC | 18:34 | |
| *** piyanai has joined #openstack-keystone | 18:34 | |
| dstanek | lbragstad: ah, i see, i see. that will install keystone/apache/etc, but doesn't load the federation data | 18:35 |
| lbragstad | dstanek: yep, I stacked and that's what the result was | 18:35 |
| dstanek | to run that you'll need to make sure you have the right local.conf | 18:35 |
| lbragstad | dstanek: I figured i was missing the "enabled keystone-federation" part in my devstack config somewhere | 18:36 |
| dstanek | lbragstad: that's the review that i wanted to steal your stuff | 18:36 |
| dstanek | lbragstad: did it actually configure apache and shib for you? | 18:36 |
| *** piyanai has quit IRC | 18:36 | |
| lbragstad | dstanek: the ansible stuff? | 18:36 |
| *** piyanai has joined #openstack-keystone | 18:37 | |
| dstanek | lbragstad: this patch actually does the devstack configuration to use keystone-federation | 18:37 |
| dstanek | https://review.openstack.org/#/c/139137/ | 18:37 |
| dstanek | lbragstad: yes | 18:37 |
| *** piyanai has quit IRC | 18:37 | |
| *** mylu has joined #openstack-keystone | 18:37 | |
| dstanek | lbragstad: specifically i need to get this working again: https://review.openstack.org/#/c/151311/9/dsvm/federation/devstack/files/key-federation-setup.py | 18:38 |
| lbragstad | dstanek: my federation ansible branch installs mod_shib and sets it up, but I think there are still issues, | 18:38 |
| dolphm | are you going to be at castle tomorrow? | 18:39 |
| dolphm | lbragstad: ^ whoops lol | 18:39 |
| lbragstad | dstanek: this is what you need? https://github.com/lbragstad/keystone-deploy/blob/federation/test_federation_exercises.py#L24-L33 | 18:39 |
| lbragstad | dolphm: yep | 18:39 |
| lbragstad | I'll be out thursday and friday | 18:39 |
| dstanek | lbragstad: yep, exactly | 18:39 |
| *** jsavak has quit IRC | 18:40 | |
| *** jsavak has joined #openstack-keystone | 18:40 | |
| lbragstad | dstanek: so, if I checkout 139137 locally | 18:40 |
| lbragstad | I should be able to use the local.conf there | 18:41 |
| lbragstad | and restack | 18:41 |
| *** topol has joined #openstack-keystone | 18:41 | |
| *** ChanServ sets mode: +v topol | 18:41 | |
| dstanek | lbragstad: yes, i'm guessing that there will be some issues since it has been so long | 18:41 |
| lbragstad | dstanek: I'm about to find out | 18:42 |
| dstanek | i have my fingers crossed | 18:43 |
| *** piyanai has joined #openstack-keystone | 18:44 | |
| samueldmq | morganfainberg: just to be clear, with the solution we were talking about earlier today, you're ok with the policy association by id | 18:45 |
| *** ayoung has quit IRC | 18:45 | |
| samueldmq | morganfainberg: as it is today.... | 18:45 |
| samueldmq | is that right ? | 18:45 |
| *** topol has quit IRC | 18:45 | |
| samueldmq | well... at least for now | 18:46 |
| lbragstad | dstanek: ... ummm | 18:50 |
| lbragstad | dstanek: it worked? | 18:50 |
| dstanek | woot? | 18:50 |
| * lbragstad blinks blankly at devstack | 18:50 | |
| lbragstad | dstanek: does your bootstrap stuff work to set up a user that the idp can valid? | 18:51 |
| *** davi8784 has joined #openstack-keystone | 18:54 | |
| *** davi8784 has quit IRC | 18:55 | |
| dstanek | lbragstad: right now i don't think any of the data is actually setup - the ipd is running, keystone is running, but they are not communicating yet | 18:55 |
| dstanek | i think the key exchange is done as well as the metadata exchange | 18:55 |
| *** TheIntern has quit IRC | 18:56 | |
| *** geoffarnold has joined #openstack-keystone | 18:57 | |
| *** adam_g` is now known as adam_g | 19:01 | |
| *** adam_g has quit IRC | 19:01 | |
| *** adam_g has joined #openstack-keystone | 19:01 | |
| *** piyanai has quit IRC | 19:02 | |
| *** losingle has joined #openstack-keystone | 19:05 | |
| *** piyanai has joined #openstack-keystone | 19:06 | |
| *** tsymanczyk has quit IRC | 19:06 | |
| *** dims_ has joined #openstack-keystone | 19:10 | |
| *** topol has joined #openstack-keystone | 19:20 | |
| *** ChanServ sets mode: +v topol | 19:20 | |
| *** piyanai has quit IRC | 19:21 | |
| *** piyanai has joined #openstack-keystone | 19:24 | |
| openstackgerrit | Ian Cordasco proposed openstack/keystoneauth: Fix test-requirements for python 2.6 https://review.openstack.org/202816 | 19:24 |
| *** tsymancz1k has joined #openstack-keystone | 19:25 | |
| gyee | samueldmq, ayoung, sure, support endpoint_id as a option would be great | 19:27 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add better user feedback when bind is not implemented https://review.openstack.org/203788 | 19:29 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 19:31 |
| *** nllrte has quit IRC | 19:32 | |
| *** piyanai has quit IRC | 19:33 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Federated tokens do not require group IDs https://review.openstack.org/203791 | 19:34 |
| stevemar | lhcheng: can you quickly review an osc patch? | 19:35 |
| *** miand has joined #openstack-keystone | 19:35 | |
| lhcheng | stevemar: sure, which one? | 19:35 |
| stevemar | lhcheng: https://review.openstack.org/#/c/203455/ | 19:35 |
| *** miand has quit IRC | 19:35 | |
| gyee | stevemar, lhcheng, https://review.openstack.org/#/c/194733/ | 19:37 |
| gyee | easy one :) | 19:37 |
| samueldmq | gyee: I was wondering if that should be endpoint_ids ... you know, multiple URLs (internal,public) -> multiple IDs | 19:41 |
| samueldmq | gyee: if you have public or internal or admin endpoint in your token, any of them should be valid (in your constraint enforcement) | 19:42 |
| samueldmq | gyee: so it should be a list of endpoint ids : endpoint_ids config option .. | 19:42 |
| gyee | samueldmq, yes | 19:42 |
| *** piyanai has joined #openstack-keystone | 19:43 | |
| gyee | I agree | 19:43 |
| samueldmq | gyee: if that makes sense to you | 19:43 |
| gyee | samueldmq, yes, make sense | 19:43 |
| samueldmq | gyee: great sir, I will create a patch that introduces this as a config option, then you (and I) rebase the work on it | 19:43 |
| gyee | samueldmq, thanks! | 19:43 |
| samueldmq | gyee: great, sounds like we have a plan :) | 19:44 |
| gyee | lets do this! | 19:44 |
| samueldmq | ++ | 19:45 |
| samueldmq | bknudson, dolphm : hi - are you ok with backporting this to kilo ? https://review.openstack.org/#/c/203748/ | 19:48 |
| bknudson | samueldmq: no | 19:48 |
| dolphm | samueldmq: no, we don't backport deprecations | 19:49 |
| samueldmq | bknudson: why ? is it just, it doesn't need to or .. | 19:49 |
| samueldmq | bknudson: dolphm got it, thanks | 19:49 |
| samueldmq | morganfainberg: cc ^ | 19:49 |
| *** amakarov is now known as amakarov_away | 19:49 | |
| dolphm | samueldmq: it's not fair to end users, at all | 19:49 |
| samueldmq | dolphm: yes I see the point, but you're ok with that change in master right ? ^ | 19:50 |
| dolphm | samueldmq: no | 19:50 |
| *** ayoung has joined #openstack-keystone | 19:51 | |
| *** ChanServ sets mode: +v ayoung | 19:51 | |
| dolphm | samueldmq: https://review.openstack.org/#/c/203748/2/keystone/resource/backends/ldap.py,unified cc- morganfainberg | 19:51 |
| *** esp has left #openstack-keystone | 19:53 | |
| lhcheng | stevemar: comments added on the osc patch | 19:53 |
| stevemar | lhcheng: thx! | 19:56 |
| samueldmq | dolphm: I understand your point, even if we meant to do that, we didn't do .. :( let's see that together with morgan, thanks | 20:01 |
| dolphm | samueldmq: that's unfortunate, i agree | 20:01 |
| lbragstad | dstanek: awesome, I'll see if I can create a script with the setup data | 20:01 |
| samueldmq | dolphm: btw, I was looking into that keystone-deploy stuff ... do you have an Ansible repo to deploy devstack and run a kind of test_exercises against the cloud ? | 20:03 |
| samueldmq | dolphm: I mean, to then use travis-ci :) | 20:03 |
| dolphm | samueldmq: devstack deploys itself -- why do you need ansible? | 20:04 |
| samueldmq | dolphm: my usecase is to make demonstrations, like the one I did in the midcycle (hope you saw that one) | 20:05 |
| samueldmq | dolphm: so I could just run Ansible on travis-ci, then run my demo.sh and get the results on the travis-ci build, something like that | 20:05 |
| samueldmq | dolphm: if that makes sense .. | 20:05 |
| dolphm | samueldmq: i did not - i was not at the midcycle | 20:06 |
| lbragstad | dstanek: after your devstack patch runs, should ssh be up and running? | 20:06 |
| samueldmq | dolphm: in the case you want to check that out | 20:07 |
| samueldmq | dolphm: https://drive.google.com/open?id=0B2vU1iAv61nDSEVaZGw3M0xlNXc | 20:07 |
| dolphm | samueldmq: there's so many limitations to travis that i don't know if it's worth it to pursue that, honestly | 20:07 |
| samueldmq | dolphm: k then :( | 20:08 |
| *** btully has quit IRC | 20:09 | |
| samueldmq | dolphm: tbh I have a lot of work to be done in dynamic policy, I shouldn't be looking for more work :) | 20:09 |
| *** mylu has quit IRC | 20:10 | |
| samueldmq | dolphm: thanks | 20:10 |
| dstanek | lbragstad: as in system ssh? | 20:10 |
| dstanek | lbragstad: the plugin shouldn't do anything to that | 20:10 |
| lbragstad | dstanek: sorry s/ssh/ssl/ | 20:11 |
| samueldmq | morganfainberg: fyi, I've put 2 points in dynamic policies to the meeting tomorrow: SFE decision + request for spec reviews | 20:11 |
| dstanek | lbragstad: i don't know that i was running in SSL...let me see | 20:11 |
| samueldmq | morganfainberg: let me know if that sounds sane | 20:11 |
| lbragstad | dstanek: I thought I saw something along those lines | 20:12 |
| dstanek | lbragstad: you probably did because i tend to run everything behind ssl | 20:12 |
| dstanek | lbragstad: actually i think i just attach on to what devstack is already doing | 20:14 |
| lbragstad | dstanek: makes sense | 20:14 |
| lbragstad | dstanek: I want to see if I can get my service provider ansible stuff to work with test shib... | 20:14 |
| *** mylu has joined #openstack-keystone | 20:14 | |
| *** spandhe has quit IRC | 20:32 | |
| *** spandhe has joined #openstack-keystone | 20:32 | |
| *** ankita_w_ has joined #openstack-keystone | 20:39 | |
| *** ankita_wagh has quit IRC | 20:42 | |
| *** geoffarnold has quit IRC | 20:51 | |
| *** geoffarnold has joined #openstack-keystone | 20:52 | |
| *** jsavak has quit IRC | 20:55 | |
| *** diegoadolfo_ has quit IRC | 20:55 | |
| *** diegoadolfo has quit IRC | 20:55 | |
| *** raildo has quit IRC | 20:56 | |
| *** pnavarro has joined #openstack-keystone | 20:56 | |
| *** jsavak has joined #openstack-keystone | 20:57 | |
| lbragstad | does this seems like a federation bug or is it just me? http://cdn.pasteraw.com/oavk5srm2kbunn8t28wjf8wyb14pt24 | 21:01 |
| lbragstad | cc stevemar marekd ^ | 21:01 |
| _cjones_ | Hi guys. We're merging our code with upstream stable/kilo and I've run into this issue with devstack/keystone: | 21:03 |
| _cjones_ | "2015-07-20 13:55:35.199175 ArgsAlreadyParsedError: arguments already parsed: cannot register CLI option" | 21:04 |
| *** btully has joined #openstack-keystone | 21:04 | |
| lbragstad | ah nevermind, possibly a dependency issue http://cdn.pasteraw.com/txqrkhcuzgm6kdadi6h37quv4pex4w | 21:04 |
| bknudson | _cjones_: sounds similar to https://review.openstack.org/#/c/201352/ ? | 21:05 |
| bknudson | oh, no, that's different... I haven't seen that error reported. | 21:05 |
| _cjones_ | Via ayoung:s page: http://adam.younglogic.com/2012/04/keystone-httpd/comment-page-1/#comment-760486 | 21:06 |
| ayoung | Uh oh | 21:06 |
| *** crinkle has quit IRC | 21:06 | |
| *** crinkle_ has joined #openstack-keystone | 21:07 | |
| _cjones_ | Sorry my gist isn't working, but essentially looks to be the same-ish error message. | 21:07 |
| bknudson | it must be ayoung's fault since it's on his blog. | 21:07 |
| ayoung | Oh, I saw this before, not long ago | 21:07 |
| ayoung | bknudson, everything is my fault. I thought that was well established | 21:07 |
| bknudson | actually, I think we were seeing that in the gate (during grenade run) | 21:08 |
| ayoung | _cjones_, I thought before that it happens when you have multiple parts of the apache file refer to the same WSGI process, but now I think that it is a false error message | 21:08 |
| ayoung | I think it comes from improper parse of the config options | 21:08 |
| *** btully has quit IRC | 21:08 | |
| _cjones_ | So, I may have missed a commit (from upstream) either in devstack (config issue) or something in keystone (code issue). Just wondering which to start digging at? | 21:09 |
| bknudson | _cjones_: https://bugs.launchpad.net/keystone/+bug/1466485 ? | 21:09 |
| openstack | Launchpad bug 1466485 in grenade "keystone fails with: ArgsAlreadyParsedError: arguments already parsed: cannot register CLI option" [Undecided,In progress] - Assigned to Ihar Hrachyshka (ihar-hrachyshka) | 21:09 |
| ayoung | _cjones_, put a breakpoint in the config procesing code I think.... | 21:09 |
| ayoung | I forget how I solved it, | 21:09 |
| ayoung | _cjones_, try just cranking up the logging in Keystone and restarting the server | 21:10 |
| _cjones_ | ayoung: No problem. I'll look at the bug too. | 21:10 |
| ayoung | there was a stack trace | 21:10 |
| ayoung | I think that the error ^^ you see after the real error | 21:10 |
| marekd | lbragstad: it's rather you | 21:12 |
| marekd | lbragstad: you seem to be touching keystone-idp stuff | 21:12 |
| marekd | and with testshib you don't want to do that... | 21:12 |
| lbragstad | marekd: yep, I think it was a dep issue | 21:13 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/idp.py | 21:13 |
| lbragstad | wrong link https://github.com/openstack/oslo.utils/commit/36d599f477b38be2899604304523e07d998bd0d6 | 21:13 |
| lbragstad | marekd: I verified that my service provider is set up properly, I was able to test it against testshib | 21:13 |
| lbragstad | so that's cool! | 21:13 |
| marekd | lbragstad: GREAT!!!!!!!!! | 21:14 |
| marekd | good to know! | 21:14 |
| lbragstad | and that's with the ansible playbooks | 21:14 |
| lbragstad | now I'm trying to get the idp setup so I can have it all | 21:14 |
| lbragstad | in ansible | 21:14 |
| marekd | idp is much much easier. | 21:14 |
| marekd | with sp done i consider job almost done (you can open that cold beer) | 21:15 |
| * lbragstad wishes | 21:15 | |
| lbragstad | marekd: I'm getting http://cdn.pasteraw.com/2f4g667yzk8q6d28z6hy68xhnwrvlmm so I think we need to update the dependency for oslo.utils one stevemar's fix is released? | 21:15 |
| lbragstad | marekd: but, when I fire up the python interpreter on the idp, I can confirm the following: | 21:16 |
| *** crinkle_ is now known as crinkle | 21:17 | |
| lbragstad | marekd: http://cdn.pasteraw.com/izsij2xfc19bda04t4phgq57cwtu889 | 21:17 |
| *** mylu has quit IRC | 21:17 | |
| _cjones_ | ayoung: "2015-07-20 14:18:17.271517 LookupError: No section 'xml_body_v2' (prefixed by 'filter') found in config /etc/keystone/keystone-paste.ini" | 21:19 |
| dstanek | _cjones_: do you still have XML configured in you paste.ini? | 21:19 |
| ayoung | _cjones_, yeah, get rid of that | 21:20 |
| _cjones_ | Okay. | 21:20 |
| stevemar | lbragstad: oslo_utils should have been bumped up in keystones reqs.txt | 21:20 |
| *** dims_ has quit IRC | 21:22 | |
| *** losingle has quit IRC | 21:23 | |
| ankita_w_ | Hi gordc : I am trying to catch nova 500 errors using ceilometer. I see all 200s and 400s in ceilometer but when a 500 error is generated. The outcome says "unknown" . I have enabled the audit middleware | 21:25 |
| ankita_w_ | Is this a known issue? | 21:25 |
| *** topol has quit IRC | 21:27 | |
| *** pgbridge has joined #openstack-keystone | 21:29 | |
| _cjones_ | ayoung/dstanek: Good catch guys. I realize what my mistake was: Did a stack.sh with some variables pointing to our old branch. Realized my mistake: "rm -rf /opt/stack", fix branch variables, ./stack.sh (but this left old configuration in /etc/keystone). | 21:30 |
| ayoung | _cjones_, cool, respond to blog post so the next person sees it, please | 21:30 |
| breton | ankita_w_: I'm not, but I can test that now | 21:30 |
| *** fangzhou_ has joined #openstack-keystone | 21:31 | |
| breton | ankita_w_: *it's not for me | 21:31 |
| *** zzzeek has quit IRC | 21:31 | |
| *** fangzhou has quit IRC | 21:32 | |
| *** fangzhou_ is now known as fangzhou | 21:32 | |
| breton | ankita_w_: ok, I can't, my env broke. I suggest to file a bugreport anyway | 21:36 |
| ankita_w_ | Hi breton : I dont see any events at all | 21:37 |
| ankita_w_ | The unknowns are a seperate issue | 21:37 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Document policy target for operation https://review.openstack.org/168521 | 21:44 |
| *** zzzeek has joined #openstack-keystone | 21:46 | |
| *** e0ne has quit IRC | 21:48 | |
| *** htruta_ has joined #openstack-keystone | 21:48 | |
| htruta_ | henrynash, ping | 21:48 |
| *** e0ne has joined #openstack-keystone | 21:48 | |
| stevemar | htruta_: its midnight for mr nash :| | 21:51 |
| dstanek | stevemar: so what you are saying is he's probably at the pub? | 21:55 |
| stevemar | dstanek: if he's working on keystone, probably | 21:56 |
| stevemar | working on keystone promotes consuming keystone lite | 21:56 |
| breton | oh gawd, why I didn't see https://review.openstack.org/#/c/168521/ before | 21:58 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:58 | |
| *** jsavak has quit IRC | 21:59 | |
| lbragstad | stevemar: http://i.imgur.com/MvGmLie.jpg | 21:59 |
| breton | oh, no, wait, it's not what I thought. | 21:59 |
| *** jsavak has joined #openstack-keystone | 21:59 | |
| breton | good patch anyway. | 22:00 |
| htruta_ | stevemar, ops... kind of forgot it... but he's just reviewed a patch... who knows? | 22:00 |
| htruta_ | anyway, he's probably on keystone light :P | 22:02 |
| *** pnavarro has quit IRC | 22:02 | |
| lbragstad | htruta_: that's Keith Stone | 22:03 |
| bknudson | lbragstad: we need a t-shirt with keith stone | 22:06 |
| bknudson | he sounds tough | 22:06 |
| lbragstad | bknudson: ++, the next time we get jackets we should have Keith Stone as our mascot | 22:06 |
| *** jecarey has quit IRC | 22:06 | |
| htruta_ | lbragstad, lol | 22:07 |
| htruta_ | lbragstad, https://www.youtube.com/watch?v=hNz0kdGLX-E | 22:11 |
| htruta_ | lbragstad, I don't have any words for keith stone lol | 22:11 |
| *** mylu has joined #openstack-keystone | 22:17 | |
| *** edmondsw has quit IRC | 22:19 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch to oslo.cache https://review.openstack.org/195873 | 22:21 |
| *** e0ne has quit IRC | 22:25 | |
| *** topol has joined #openstack-keystone | 22:28 | |
| *** ChanServ sets mode: +v topol | 22:28 | |
| *** stevemar has quit IRC | 22:29 | |
| *** topol has quit IRC | 22:32 | |
| *** geoffarnold has quit IRC | 22:35 | |
| *** geoffarnold has joined #openstack-keystone | 22:36 | |
| *** fangzhou has quit IRC | 22:40 | |
| *** _hrou_ has quit IRC | 22:42 | |
| *** diazjf has left #openstack-keystone | 22:45 | |
| *** esp has joined #openstack-keystone | 22:48 | |
| *** fangzhou has joined #openstack-keystone | 22:52 | |
| *** btully has joined #openstack-keystone | 22:52 | |
| *** rm_work is now known as rm_work|away | 22:53 | |
| *** jsavak has quit IRC | 22:53 | |
| *** jsavak has joined #openstack-keystone | 22:54 | |
| *** gordc has quit IRC | 22:54 | |
| *** chlong has quit IRC | 22:54 | |
| openstackgerrit | ayoung proposed openstack/keystone: Specify ID for Project or domain creation https://review.openstack.org/203852 | 22:57 |
| *** btully has quit IRC | 22:57 | |
| *** jsavak has quit IRC | 22:57 | |
| ayoung | samueldmq, there you go. Need to think about things like "cells and hypervisors" next | 22:57 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: test_base64utils works with py34 https://review.openstack.org/203853 | 22:59 |
| *** bknudson has quit IRC | 23:04 | |
| *** tqtran is now known as tqtran-afk | 23:08 | |
| *** hrou has joined #openstack-keystone | 23:11 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 23:12 | |
| *** zzzeek has quit IRC | 23:14 | |
| *** mylu has quit IRC | 23:14 | |
| *** jsavak has joined #openstack-keystone | 23:15 | |
| *** jsavak has quit IRC | 23:18 | |
| *** bitblt has joined #openstack-keystone | 23:20 | |
| *** henriquetruta has joined #openstack-keystone | 23:24 | |
| *** htruta_ has quit IRC | 23:28 | |
| *** stevemar has joined #openstack-keystone | 23:30 | |
| *** ChanServ sets mode: +v stevemar | 23:30 | |
| *** roxanaghe has quit IRC | 23:31 | |
| *** stevemar has quit IRC | 23:33 | |
| *** mylu has joined #openstack-keystone | 23:37 | |
| *** geoffarnold has quit IRC | 23:37 | |
| *** geoffarnold has joined #openstack-keystone | 23:38 | |
| *** stevemar has joined #openstack-keystone | 23:44 | |
| *** ChanServ sets mode: +v stevemar | 23:44 | |
| *** mgarza_ has quit IRC | 23:47 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch to oslo.cache https://review.openstack.org/195873 | 23:57 |
| *** stevemar has quit IRC | 23:58 | |
| *** darrenc_ is now known as darrenc | 23:58 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
