| *** topol has quit IRC | 00:01 | |
| *** zzzeek has quit IRC | 00:13 | |
| *** ankita_wagh has quit IRC | 00:22 | |
| *** btully has quit IRC | 00:26 | |
| *** 77CAAEJLH has quit IRC | 00:28 | |
| *** snapdey has joined #openstack-keystone | 00:28 | |
| *** gyee has quit IRC | 00:33 | |
| *** snapdey has quit IRC | 00:35 | |
| *** ankita_wagh has joined #openstack-keystone | 00:35 | |
| *** dguerri is now known as dguerri` | 00:39 | |
| *** btully has joined #openstack-keystone | 00:41 | |
| *** bknudson has joined #openstack-keystone | 00:47 | |
| *** ChanServ sets mode: +v bknudson | 00:47 | |
| *** hightall has joined #openstack-keystone | 00:48 | |
| openstackgerrit | Merged openstack/keystone: Move cli.py into keystone.cmd https://review.openstack.org/203224 | 00:49 |
|---|---|---|
| openstackgerrit | Merged openstack/keystone: move clean.py into keystone/common https://review.openstack.org/203297 | 00:52 |
| *** chlong has quit IRC | 00:52 | |
| openstackgerrit | Merged openstack/keystone: Move backends.py to keystone.server https://review.openstack.org/203301 | 00:52 |
| *** esp has left #openstack-keystone | 00:53 | |
| *** ankita_wagh has quit IRC | 00:53 | |
| *** browne has quit IRC | 00:56 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/204300 | 00:56 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/204300 | 00:57 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/204300 | 00:58 |
| *** lhcheng has quit IRC | 01:01 | |
| *** mylu has joined #openstack-keystone | 01:07 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Documentation for other services https://review.openstack.org/204801 | 01:07 |
| *** drjones has joined #openstack-keystone | 01:10 | |
| bigjools | morganfainberg: I want to do a new ldap driver that doesn't depend on any ldap info for group memberships | 01:12 |
| *** _cjones_ has quit IRC | 01:12 | |
| *** drjones has quit IRC | 01:12 | |
| *** _cjones_ has joined #openstack-keystone | 01:13 | |
| *** piyanai has joined #openstack-keystone | 01:21 | |
| *** ankita_wagh has joined #openstack-keystone | 01:30 | |
| *** hightall has quit IRC | 01:31 | |
| jamielennox | <bigjools> i love the pain | 01:31 |
| bigjools | my life is one large pain | 01:31 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix s3.core for py34 https://review.openstack.org/204804 | 01:42 |
| *** hightall has joined #openstack-keystone | 01:44 | |
| *** dguerri` is now known as dguerri | 01:48 | |
| *** _cjones_ has quit IRC | 01:49 | |
| *** topol has joined #openstack-keystone | 01:50 | |
| *** ChanServ sets mode: +v topol | 01:50 | |
| *** EmilienM|off is now known as EmilienM | 01:52 | |
| *** topol has quit IRC | 01:54 | |
| *** spandhe has quit IRC | 01:55 | |
| *** dguerri is now known as dguerri` | 01:58 | |
| *** shangxdy has joined #openstack-keystone | 01:59 | |
| *** fangzhou has quit IRC | 02:05 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix test_exception.py for py34 https://review.openstack.org/204807 | 02:07 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix test_exception.py for py34 https://review.openstack.org/204807 | 02:08 |
| *** chenhong has joined #openstack-keystone | 02:10 | |
| *** mylu has quit IRC | 02:10 | |
| *** chlong has joined #openstack-keystone | 02:11 | |
| *** chenhong1 has joined #openstack-keystone | 02:12 | |
| *** chenhong has quit IRC | 02:13 | |
| *** mylu has joined #openstack-keystone | 02:14 | |
| *** chenhong has joined #openstack-keystone | 02:15 | |
| *** mylu has quit IRC | 02:16 | |
| *** chenhong1 has quit IRC | 02:17 | |
| *** mylu has joined #openstack-keystone | 02:17 | |
| *** mylu has quit IRC | 02:20 | |
| *** mylu has joined #openstack-keystone | 02:20 | |
| *** mylu has quit IRC | 02:21 | |
| *** mylu has joined #openstack-keystone | 02:22 | |
| *** iamjarvo has joined #openstack-keystone | 02:23 | |
| morganfainberg | bigjools: sure - though, to include it in tree youll need to also convince the other cores. | 02:31 |
| morganfainberg | bigjools: fyi, we are going to start working on moving to ldap3 and away from python-ldap | 02:31 |
| bigjools | morganfainberg: this all stems from the fact that the federation mapping would now require group memberships in the json blob | 02:32 |
| bigjools | I was thinking that the option to map to local users, which also come from the ldap, solves the problem of unwieldy json blobs | 02:34 |
| bigjools | maybe I should start a ML thread | 02:35 |
| *** mylu has quit IRC | 02:37 | |
| *** ankita_wagh has quit IRC | 02:39 | |
| openstackgerrit | jiaxi proposed openstack/keystone: Suppressing the request when creating endpoint with invalid urls https://review.openstack.org/200512 | 02:43 |
| *** iamjarvo has quit IRC | 02:44 | |
| *** iamjarvo has joined #openstack-keystone | 02:45 | |
| *** richm has quit IRC | 02:47 | |
| *** browne has joined #openstack-keystone | 02:48 | |
| *** hakimo_ has joined #openstack-keystone | 02:52 | |
| *** iamjarvo has quit IRC | 02:52 | |
| *** hakimo has quit IRC | 02:55 | |
| *** piyanai has quit IRC | 02:57 | |
| *** btully has quit IRC | 02:58 | |
| *** kiran-r has joined #openstack-keystone | 03:03 | |
| *** bradjones has quit IRC | 03:03 | |
| *** bradjones has joined #openstack-keystone | 03:04 | |
| *** bradjones has quit IRC | 03:04 | |
| *** bradjones has joined #openstack-keystone | 03:04 | |
| *** stevemar has joined #openstack-keystone | 03:06 | |
| *** ChanServ sets mode: +v stevemar | 03:06 | |
| *** piyanai has joined #openstack-keystone | 03:07 | |
| *** htruta_ has quit IRC | 03:08 | |
| *** stevemar has quit IRC | 03:11 | |
| *** kiran-r has quit IRC | 03:13 | |
| *** ankita_wagh has joined #openstack-keystone | 03:14 | |
| *** shangxdy has quit IRC | 03:16 | |
| morganfainberg | bigjools: ++ ml thread will help | 03:17 |
| *** hightall has quit IRC | 03:19 | |
| *** stevemar has joined #openstack-keystone | 03:22 | |
| *** ChanServ sets mode: +v stevemar | 03:22 | |
| *** davechen has joined #openstack-keystone | 03:25 | |
| *** jasonsb has joined #openstack-keystone | 03:35 | |
| *** dguerri` is now known as dguerri | 03:36 | |
| *** snapdey has joined #openstack-keystone | 03:36 | |
| *** snapdey has joined #openstack-keystone | 03:37 | |
| *** snapdey has quit IRC | 03:42 | |
| *** topol has joined #openstack-keystone | 03:45 | |
| *** ChanServ sets mode: +v topol | 03:45 | |
| *** dguerri is now known as dguerri` | 03:46 | |
| *** lhcheng has joined #openstack-keystone | 03:48 | |
| *** ChanServ sets mode: +v lhcheng | 03:48 | |
| *** piyanai has quit IRC | 03:49 | |
| *** topol has quit IRC | 03:50 | |
| *** HenryG has quit IRC | 04:09 | |
| *** mordred has quit IRC | 04:11 | |
| *** HenryG has joined #openstack-keystone | 04:12 | |
| *** ayoung has quit IRC | 04:17 | |
| *** mordred has joined #openstack-keystone | 04:24 | |
| *** iamjarvo has joined #openstack-keystone | 04:37 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/204836 | 04:39 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/197254 | 04:39 |
| *** Kennan has quit IRC | 04:41 | |
| *** Kennan has joined #openstack-keystone | 04:42 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Make OAuth testcase use actual request headers https://review.openstack.org/204678 | 04:45 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch to oslo.cache https://review.openstack.org/195873 | 04:49 |
| *** fangzhou has joined #openstack-keystone | 04:53 | |
| *** rm_work|away is now known as rm_work | 05:01 | |
| *** kiran-r has joined #openstack-keystone | 05:05 | |
| *** ankita_wagh has quit IRC | 05:09 | |
| *** ankita_wagh has joined #openstack-keystone | 05:10 | |
| *** btully has joined #openstack-keystone | 05:10 | |
| *** ankita_wagh has quit IRC | 05:14 | |
| *** kiran-r has quit IRC | 05:18 | |
| *** dguerri` is now known as dguerri | 05:24 | |
| *** chenhong1 has joined #openstack-keystone | 05:27 | |
| *** chenhong has quit IRC | 05:29 | |
| *** iamjarvo has quit IRC | 05:29 | |
| *** dguerri is now known as dguerri` | 05:34 | |
| openstackgerrit | jiaxi proposed openstack/keystone: Suppressing the request when creating endpoint with invalid urls https://review.openstack.org/200512 | 05:38 |
| *** iamjarvo has joined #openstack-keystone | 05:38 | |
| *** henrynash has joined #openstack-keystone | 05:48 | |
| *** ChanServ sets mode: +v henrynash | 05:48 | |
| *** hrou has quit IRC | 05:50 | |
| *** iamjarvo has quit IRC | 05:51 | |
| *** fangzhou has quit IRC | 05:51 | |
| *** afazekas_ has joined #openstack-keystone | 05:56 | |
| marekd | stevemar: still here? | 05:56 |
| *** Moh_ has joined #openstack-keystone | 05:56 | |
| stevemar | marekd: yep | 05:56 |
| marekd | stevemar: thanks for the fixing oauthlib. I am wondering what happens now if I install ksc from pip? will it fetch oauthlib1.0.0 ? | 05:57 |
| *** ankita_wagh has joined #openstack-keystone | 05:57 | |
| Moh_ | Hi there, is it possible to assign roles to group instead of users, via keystone APIs V3? | 05:57 |
| marekd | Moh_: yes. | 05:58 |
| Moh_ | <+marekd>: Thanks, but I found nothing at: http://developer.openstack.org/api-ref-identity-v3.html | 05:58 |
| marekd | Moh_: for instance in openstack command line simply use --group <gid> swtich instead of --user <id> | 05:58 |
| marekd | i suggest examining openstack help role add | 05:58 |
| Moh_ | <+marekd>: fine, but what about assigning roles to a pair of both group-domain or group-project? I found this concept here: http://www.madorn.com/keystone-v3-api.html#.VbCAZjuUe02 | 06:00 |
| marekd | $ openstack Moh_ what stops you from creating two requests ? | 06:00 |
| marekd | i would then create two role assignments. | 06:01 |
| stevemar | marekd: np - if you install from master ksc it'll install 1.0.0 | 06:02 |
| stevemar | oauthlib1.0.0 | 06:02 |
| Moh_ | <+marekd>: What do you mean? | 06:02 |
| stevemar | Moh_: just create 2 requests | 06:03 |
| stevemar | Moh_: `os role add my_role --group the_group --domain the_domain` | 06:04 |
| stevemar | Moh_: `os role add my_role --group the_group --project the_project` | 06:04 |
| stevemar | what the heck is madorn.com | 06:04 |
| marekd | stevemar: not master, the frozen version from pip. | 06:04 |
| marekd | stevemar: Matt Dorn :P | 06:05 |
| Moh_ | <+marekd>: Oh, the first one assigns a role to a group in a domain scope, and the second one assign role in project scope. Is it? | 06:05 |
| stevemar | marekd: i have no idea who he is | 06:05 |
| stevemar | Moh_: you got it boss | 06:05 |
| marekd | Moh_: yes | 06:05 |
| marekd | stevemar: neither do I know him | 06:05 |
| stevemar | marekd: i think it'll still install oauthlib1.0.0 since it's uncapped in requirements | 06:05 |
| Moh_ | <+marekd>: Thanks alot. | 06:06 |
| marekd | Moh_: you are welcome | 06:06 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/204903 | 06:06 |
| stevemar | marekd: 99% sure that will happen (install 1.0.0) | 06:06 |
| marekd | stevemar: ah, actually never mind....oauthlib sits in test-requirements so it doesn't matter in a 'daily use' | 06:06 |
| stevemar | marekd: correct | 06:08 |
| stevemar | just for tests and shtuffff | 06:09 |
| stevemar | marekd: you are up late | 06:10 |
| stevemar | err... early | 06:10 |
| *** boris-42 has quit IRC | 06:12 | |
| *** ankita_wagh has quit IRC | 06:13 | |
| *** afazekas_ has quit IRC | 06:14 | |
| *** Moh_ has quit IRC | 06:14 | |
| *** lhcheng has quit IRC | 06:18 | |
| marekd | i need to wake up early (6.30am) if i have a car in Geneva and don't want to get stuck in the traffic. | 06:20 |
| marekd | but, the good side is that i can meet then some late folks and I am not completely alone here :-) | 06:20 |
| *** woodster_ has quit IRC | 06:22 | |
| stevemar | marekd: that's true! | 06:29 |
| *** spandhe has joined #openstack-keystone | 06:30 | |
| *** pnavarro has joined #openstack-keystone | 06:33 | |
| *** snapdey has joined #openstack-keystone | 06:43 | |
| *** kiran-r has joined #openstack-keystone | 06:43 | |
| *** pnavarro has quit IRC | 06:44 | |
| *** snapdey has quit IRC | 06:47 | |
| *** chlong has quit IRC | 06:49 | |
| *** stevemar has quit IRC | 06:52 | |
| *** stevemar has joined #openstack-keystone | 06:52 | |
| *** ChanServ sets mode: +v stevemar | 06:52 | |
| *** stevemar has quit IRC | 06:55 | |
| *** browne has quit IRC | 07:10 | |
| *** dguerri` is now known as dguerri | 07:13 | |
| *** e0ne has joined #openstack-keystone | 07:15 | |
| openstackgerrit | Merged openstack/keystone: Implement backend filtering on membership queries https://review.openstack.org/179758 | 07:15 |
| *** fhubik has joined #openstack-keystone | 07:18 | |
| *** fhubik is now known as fhubik_afk | 07:18 | |
| *** rletrocquer has joined #openstack-keystone | 07:20 | |
| *** ParsectiX has joined #openstack-keystone | 07:21 | |
| *** dguerri is now known as dguerri` | 07:22 | |
| openstackgerrit | Boris Bobrov proposed openstack/python-keystoneclient: Remove unused time_patcher https://review.openstack.org/204771 | 07:22 |
| *** spandhe has quit IRC | 07:37 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/204836 | 07:41 |
| *** tsubic has joined #openstack-keystone | 07:42 | |
| *** fhubik_afk is now known as fhubik | 07:43 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/203137 | 07:44 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/204836 | 07:47 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/204937 | 07:50 |
| *** btully has quit IRC | 07:53 | |
| *** bdossant has joined #openstack-keystone | 07:53 | |
| *** fhubik has quit IRC | 07:59 | |
| *** fhubik has joined #openstack-keystone | 07:59 | |
| *** jistr has joined #openstack-keystone | 08:02 | |
| *** dguerri` is now known as dguerri | 08:06 | |
| *** lhcheng has joined #openstack-keystone | 08:07 | |
| *** ChanServ sets mode: +v lhcheng | 08:07 | |
| openstackgerrit | Merged openstack/keystone: Updating sample configuration file https://review.openstack.org/204300 | 08:11 |
| *** lhcheng has quit IRC | 08:11 | |
| *** spandhe has joined #openstack-keystone | 08:15 | |
| *** jecarey has quit IRC | 08:16 | |
| *** ParsectiX_ has joined #openstack-keystone | 08:21 | |
| *** spandhe_ has joined #openstack-keystone | 08:24 | |
| *** Kennan has quit IRC | 08:26 | |
| *** ParsectiX has quit IRC | 08:26 | |
| *** spandhe has quit IRC | 08:26 | |
| *** spandhe_ is now known as spandhe | 08:26 | |
| *** Kennan has joined #openstack-keystone | 08:26 | |
| *** fhubik is now known as fhubik_afk | 08:27 | |
| *** fhubik_afk is now known as fhubik | 08:29 | |
| openstackgerrit | jiaxi proposed openstack/keystone: Suppressing the request when creating endpoint with invalid urls https://review.openstack.org/204952 | 08:34 |
| *** fhubik is now known as fhubik_afk | 08:35 | |
| tsubic | Hey guys, quick question, why is it that sometimes (1 out of 5) when I send a simple request (for example just swift list using the CLI) I get an Authorization error, something about cms_hash_token() getting a unexpected keyword argument 'mode'? Thanks! | 08:40 |
| *** fhubik_afk is now known as fhubik | 08:40 | |
| *** kiran-r has quit IRC | 08:44 | |
| *** kiran-r has joined #openstack-keystone | 08:46 | |
| *** ParsectiX_ has quit IRC | 08:47 | |
| *** ParsectiX has joined #openstack-keystone | 08:48 | |
| *** ParsectiX has quit IRC | 08:49 | |
| *** aix has joined #openstack-keystone | 09:02 | |
| *** fhubik is now known as fhubik_afk | 09:06 | |
| *** spandhe has quit IRC | 09:07 | |
| *** fhubik_afk is now known as fhubik | 09:12 | |
| *** ParsectiX has joined #openstack-keystone | 09:19 | |
| *** marzif_ has joined #openstack-keystone | 09:22 | |
| *** marzif_ has quit IRC | 09:23 | |
| *** marzif_ has joined #openstack-keystone | 09:24 | |
| *** marzif_ has quit IRC | 09:24 | |
| *** marzif_ has joined #openstack-keystone | 09:25 | |
| breton | tsubic: could you please copypaste the exact error? | 09:27 |
| tsubic | breton: Authorization Failure. Authorization Failed: cms_hash_token() got an unexpected keyword argument 'mode' (HTTP 400) | 09:29 |
| *** marzif_ has quit IRC | 09:30 | |
| *** stevemar has joined #openstack-keystone | 09:42 | |
| *** ChanServ sets mode: +v stevemar | 09:42 | |
| *** henrynash has quit IRC | 09:44 | |
| *** stevemar has quit IRC | 09:46 | |
| *** davechen has left #openstack-keystone | 09:53 | |
| *** lhcheng has joined #openstack-keystone | 09:56 | |
| *** ChanServ sets mode: +v lhcheng | 09:56 | |
| *** ParsectiX has quit IRC | 09:57 | |
| *** ParsectiX has joined #openstack-keystone | 09:57 | |
| breton | tsubic: what are the versions of keystone and python-keystoneclient? | 10:00 |
| *** lhcheng has quit IRC | 10:00 | |
| *** ParsectiX has quit IRC | 10:02 | |
| tsubic | It is the latest devstack installation of swift and keystone, I have tried with the python keystoneclient versions 0.3.1 and 0.7.1 | 10:03 |
| tsubic | keystone is 8.0 I believe | 10:04 |
| tsubic | or that is what pip says | 10:10 |
| *** pnavarro has joined #openstack-keystone | 10:17 | |
| *** fhubik is now known as fhubik_afk | 10:19 | |
| *** chenhong1 has quit IRC | 10:20 | |
| *** lhcheng has joined #openstack-keystone | 10:21 | |
| *** ChanServ sets mode: +v lhcheng | 10:21 | |
| *** lhcheng has quit IRC | 10:25 | |
| *** akscram has quit IRC | 10:33 | |
| *** akscram has joined #openstack-keystone | 10:35 | |
| breton | tsubic: that's very weird, because keystoneclient has that function at least since icehouse | 10:46 |
| breton | tsubic: and many our tests use it | 10:47 |
| *** dims_ has joined #openstack-keystone | 10:52 | |
| *** ParsectiX has joined #openstack-keystone | 11:04 | |
| *** chlong has joined #openstack-keystone | 11:08 | |
| *** piyanai has joined #openstack-keystone | 11:11 | |
| *** pnavarro has quit IRC | 11:13 | |
| *** fhubik_afk is now known as fhubik | 11:21 | |
| *** marzif has joined #openstack-keystone | 11:23 | |
| *** pnavarro has joined #openstack-keystone | 11:25 | |
| *** aix has quit IRC | 11:27 | |
| *** ParsectiX has quit IRC | 11:28 | |
| *** ParsectiX has joined #openstack-keystone | 11:28 | |
| *** stevemar has joined #openstack-keystone | 11:30 | |
| *** ChanServ sets mode: +v stevemar | 11:30 | |
| *** stevemar has quit IRC | 11:34 | |
| *** daemontool_ has joined #openstack-keystone | 11:36 | |
| *** daemontool_ has quit IRC | 11:36 | |
| *** daemontool_ has joined #openstack-keystone | 11:37 | |
| *** ajayaa has joined #openstack-keystone | 11:43 | |
| ajayaa | Hi Jamielennox, I want to get tokens using keystoneclient. | 11:44 |
| ajayaa | How do I do that? | 11:44 |
| jamielennox | ajayaa: why do you want a token rather than do things with keystoneclient | 11:44 |
| ajayaa | To stress my keystone deployment and see how many tokens it can generate. | 11:44 |
| *** fhubik is now known as fhubik_afk | 11:44 | |
| ajayaa | jamielennox | 11:45 |
| ajayaa | ^^ | 11:45 |
| *** gordc has joined #openstack-keystone | 11:45 | |
| ajayaa | Do I have to use requests library to do that or is there a way to do that with keystoneclient? | 11:45 |
| jamielennox | so you would need to authenticate over and over again | 11:45 |
| ajayaa | The client.Client call? | 11:45 |
| ajayaa | jamielennox ^^ | 11:46 |
| jamielennox | so if you created a session and an auth plugin you could do an invalidate between calls and just do get_token() over and over | 11:46 |
| *** fhubik_afk is now known as fhubik | 11:46 | |
| jamielennox | or you could do heaps of client.Client calls | 11:46 |
| ajayaa | okay. That's helpful. | 11:47 |
| ajayaa | As it stands these calls synchronous. Is there a way to make these calls async? | 11:47 |
| ajayaa | insert *are | 11:47 |
| ajayaa | and not rewrite keystoneclient in the process. | 11:48 |
| ajayaa | jamielennox ^^ | 11:48 |
| jamielennox | ajayaa: i haven't done that specifically with keystoneclient | 11:49 |
| jamielennox | you could do eventlet monkey patching and make a bunch of green threads | 11:49 |
| jamielennox | it will work just fin | 11:49 |
| jamielennox | e | 11:49 |
| *** fhubik is now known as fhubik_afk | 11:51 | |
| ajayaa | Thank you jamielennox | 11:51 |
| marekd | jamielennox: Hi. I'd like to finally get rid of this patch from my gerrit list: https://review.openstack.org/#/c/186854/ Would you take a look? | 11:51 |
| jamielennox | marekd: that's not that old | 11:52 |
| jamielennox | ) | 11:53 |
| *** jaosorior has joined #openstack-keystone | 11:53 | |
| marekd | well, so at least enqueue it on the reviews pile :-) | 11:53 |
| openstackgerrit | Merged openstack/keystone: Clean up docs before creating new ones https://review.openstack.org/203925 | 11:57 |
| openstackgerrit | Merged openstack/keystone: Minor fix in the `configuration.rst` https://review.openstack.org/204529 | 11:57 |
| openstackgerrit | Merged openstack/keystone: Moves keystone.hacking into keystone.tests https://review.openstack.org/202895 | 11:57 |
| openstackgerrit | Merged openstack/keystone: Docs link to ACTIONS https://review.openstack.org/203433 | 11:58 |
| *** dims_ has quit IRC | 12:02 | |
| samueldmq | git commit -a --amend | 12:13 |
| samueldmq | oooooops | 12:13 |
| samueldmq | :) | 12:13 |
| *** bdossant has quit IRC | 12:15 | |
| *** gordc is now known as gordc_offsite | 12:18 | |
| *** ajayaa has quit IRC | 12:18 | |
| *** geoffarnold has quit IRC | 12:23 | |
| *** geoffarnold has joined #openstack-keystone | 12:23 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Documentation for other services https://review.openstack.org/204801 | 12:24 |
| *** aix has joined #openstack-keystone | 12:28 | |
| *** mflobo has quit IRC | 12:28 | |
| *** mflobo has joined #openstack-keystone | 12:37 | |
| openstackgerrit | jiaxi proposed openstack/keystone: Suppressing the request when creating endpoint with invalid urls https://review.openstack.org/204952 | 12:42 |
| *** geoffarnold has quit IRC | 12:44 | |
| *** geoffarnold has joined #openstack-keystone | 12:44 | |
| openstackgerrit | Merged openstack/keystoneauth-saml2: Updated from global requirements https://review.openstack.org/201856 | 12:46 |
| *** kiran-r has quit IRC | 12:48 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/204937 | 12:50 |
| *** amakarov_away is now known as amakarov | 12:51 | |
| *** htruta has quit IRC | 12:51 | |
| *** htruta has joined #openstack-keystone | 12:54 | |
| *** edmondsw has joined #openstack-keystone | 12:56 | |
| *** jsavak has joined #openstack-keystone | 13:01 | |
| *** geoffarnold has quit IRC | 13:05 | |
| *** geoffarnold has joined #openstack-keystone | 13:06 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystonemiddleware: Introduce endpoint_ids config https://review.openstack.org/205049 | 13:06 |
| *** fhubik_afk is now known as fhubik | 13:15 | |
| *** stevemar has joined #openstack-keystone | 13:19 | |
| *** ChanServ sets mode: +v stevemar | 13:19 | |
| *** fhubik is now known as fhubik_afk | 13:21 | |
| *** fhubik_afk is now known as fhubik | 13:21 | |
| *** fhubik is now known as fhubik_afk | 13:21 | |
| *** stevemar has quit IRC | 13:22 | |
| *** ajayaa has joined #openstack-keystone | 13:23 | |
| *** geoffarnold has quit IRC | 13:25 | |
| *** geoffarnold has joined #openstack-keystone | 13:26 | |
| *** yottatsa has joined #openstack-keystone | 13:28 | |
| yottatsa | happy #openstack5bday | 13:28 |
| yottatsa | hey, just found some disgusting problem with Validate token HTTP API | 13:29 |
| yottatsa | http://developer.openstack.org/api-ref-identity-admin-v2.html#admin-validateToken here is said that "An itemNotFound (404) fault is returned for a token that is not valid." | 13:29 |
| yottatsa | And I've got 401 for invalid fernet token in Kilo | 13:30 |
| *** janonymous has joined #openstack-keystone | 13:30 | |
| openstackgerrit | janonymous proposed openstack/keystone: Python 3: Replace assertRaisesRegexp to its six implementation https://review.openstack.org/193866 | 13:30 |
| *** yottatsa has quit IRC | 13:30 | |
| *** yottatsa has joined #openstack-keystone | 13:31 | |
| *** jdandrea has joined #openstack-keystone | 13:34 | |
| *** ninag has joined #openstack-keystone | 13:36 | |
| *** hrou has joined #openstack-keystone | 13:36 | |
| yottatsa | looks like it was broken by dolphm it 2012 | 13:39 |
| yottatsa | https://github.com/openstack/keystone/commit/4e2be8a8880f03b1c6d1dc663d7259dbb45ddf67 | 13:39 |
| *** stevemar has joined #openstack-keystone | 13:39 | |
| *** ChanServ sets mode: +v stevemar | 13:39 | |
| marekd | stevemar: Bonjour monsieur Steve~ | 13:40 |
| *** jecarey has joined #openstack-keystone | 13:40 | |
| marekd | stevemar: are there any plans on switchng OSC to keystoneauth once it's eventually released? | 13:40 |
| stevemar | marekd: o/ | 13:40 |
| marekd | I mean is somebody willing to take a leap on it? | 13:40 |
| yottatsa | and test is also incorrect https://github.com/openstack/keystone/blob/master/keystone/tests/unit/token/test_fernet_provider.py#L51 | 13:40 |
| *** bknudson has quit IRC | 13:40 | |
| stevemar | for sure | 13:40 |
| marekd | or it's a non determined state "it'd be good to have it...one day..in the future" | 13:40 |
| stevemar | we still need ksc | 13:41 |
| marekd | stevemar: for CRUD of coruse | 13:41 |
| marekd | but i am saying on auth with KSA | 13:41 |
| marekd | stevemar: I am basically thinking about "K2K from OSC" and for that I need KSA in OSC or porting K2K to KSC. | 13:42 |
| *** fhubik_afk is now known as fhubik | 13:42 | |
| *** ayoung has joined #openstack-keystone | 13:42 | |
| *** ChanServ sets mode: +v ayoung | 13:42 | |
| stevemar | marekd: osc picks up all plugins anyway | 13:43 |
| stevemar | https://github.com/openstack/python-openstackclient/blob/master/openstackclient/api/auth.py | 13:43 |
| yottatsa | it's like https://bugs.launchpad.net/python-keystoneclient/+bug/1243336 but it's broke keystoneclient | 13:43 |
| openstack | Launchpad bug 1243336 in python-keystoneclient "Rescope in V3 for invalid/expired token should return unauthorized (returns 404 currently)" [Wishlist,Opinion] | 13:43 |
| *** richm has joined #openstack-keystone | 13:44 | |
| *** dims_ has joined #openstack-keystone | 13:44 | |
| *** dims_ has quit IRC | 13:45 | |
| breton | yottatsa: is it for fernet only or for all types of token? | 13:45 |
| *** dims_ has joined #openstack-keystone | 13:45 | |
| marekd | dolphm: stevemar yeah, but from KSC | 13:45 |
| yottatsa | breton, I'm diggin the problem right now | 13:46 |
| yottatsa | it looks like fernet only problem | 13:47 |
| breton | yottatsa: thank you. Please make a bugreport, I will be happy to have a look at it | 13:47 |
| marekd | dolphm: is fernet marked as stable/experimental/nothing ? | 13:48 |
| *** zzzeek has joined #openstack-keystone | 13:48 | |
| *** htruta has quit IRC | 13:51 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch to oslo.cache https://review.openstack.org/195873 | 13:51 |
| *** btully has joined #openstack-keystone | 13:52 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Show config option changes for oslo.cache https://review.openstack.org/205066 | 13:54 |
| breton | marekd: it's marked as none I guess | 13:54 |
| *** fhubik_afk has joined #openstack-keystone | 13:54 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/203137 | 13:54 |
| *** fhubik has quit IRC | 13:55 | |
| *** woodster_ has joined #openstack-keystone | 13:55 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Remove unused time_patcher https://review.openstack.org/204771 | 13:55 |
| *** yottatsa has quit IRC | 13:57 | |
| *** raildo has joined #openstack-keystone | 13:59 | |
| *** mylu has joined #openstack-keystone | 13:59 | |
| *** yottatsa has joined #openstack-keystone | 13:59 | |
| yottatsa | breton, https://bugs.launchpad.net/keystone/+bug/1477600 | 13:59 |
| openstack | Launchpad bug 1477600 in Keystone "Token Validation API returns 401 not 404 on invalid token" [Undecided,New] | 13:59 |
| *** dgrauet has joined #openstack-keystone | 13:59 | |
| stevemar | marekd: i think its experimental | 13:59 |
| dstanek | yottatsa: a 404 just seems wrong there | 14:02 |
| yottatsa | dstanek, you're wrong, because spec requires 404 | 14:02 |
| dstanek | yottatsa: i'm not saying the spec doesn't say that :-) | 14:03 |
| dstanek | yottatsa: in reality i don't think a 404 is the right response code | 14:03 |
| yottatsa | dstanek, https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/middleware/auth_token.py#L1147 | 14:03 |
| *** jsavak has quit IRC | 14:03 | |
| yottatsa | in ksc auth middleware we're expect 404 for invalid token | 14:04 |
| dstanek | yottatsa: yeah, that logic seems strange | 14:04 |
| yottatsa | and 401 for invalid ADMIN token | 14:04 |
| yottatsa | so 401 for invalid user token makes middleware go for new admin token | 14:04 |
| *** piyanai has quit IRC | 14:05 | |
| *** belmoreira has joined #openstack-keystone | 14:08 | |
| *** piyanai has joined #openstack-keystone | 14:08 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:08 | |
| dstanek | yottatsa: wow, that seems very wrong. i wonder why we did that | 14:08 |
| yottatsa | I think it's just a bug to be fixed | 14:09 |
| yottatsa | Should I make a patch? | 14:09 |
| dstanek | yottatsa: sure, i suspect you just want to patch fernet to have the same odd behavior? | 14:09 |
| *** ParsectiX has quit IRC | 14:10 | |
| *** jsavak has joined #openstack-keystone | 14:11 | |
| *** bknudson has joined #openstack-keystone | 14:11 | |
| *** ChanServ sets mode: +v bknudson | 14:11 | |
| yottatsa | dstanek, I'm afraid I broke things if I patch token_formatters. I think I need to patch it here https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/core.py#L152 and raise 404 on same manner as UUID do https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L679 | 14:12 |
| dstanek | yottatsa: i would guess you'll have to isolate your patch to the fernet code | 14:13 |
| dstanek | yottatsa: i'm going to file a bug about the 404 being the wrong status code. it's probably too hard to fix that now though | 14:15 |
| yottatsa | dstanek, it's not true that 404 is wrong | 14:16 |
| yottatsa | 404 mean we're could not find a token | 14:16 |
| yottatsa | 401 mean our request is not authorized | 14:16 |
| *** piyanai has quit IRC | 14:18 | |
| *** piyanai has joined #openstack-keystone | 14:18 | |
| *** thedodd has joined #openstack-keystone | 14:18 | |
| *** topol has joined #openstack-keystone | 14:19 | |
| *** ChanServ sets mode: +v topol | 14:19 | |
| *** belmoreira has quit IRC | 14:19 | |
| *** jsavak has quit IRC | 14:19 | |
| dstanek | yottatsa: i believe 404 is wrong because it fails validation - not that the resource doesn't exist | 14:20 |
| *** jsavak has joined #openstack-keystone | 14:20 | |
| dstanek | we shouldn't have different HTTP code for different types of tokens coming from the same resource | 14:20 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change project name constraints https://review.openstack.org/158372 | 14:21 |
| yottatsa | dstanek, again, UUID is working correct and returns 404 here | 14:21 |
| *** piyanai has quit IRC | 14:21 | |
| *** htruta has joined #openstack-keystone | 14:21 | |
| lbragstad | yottatsa: returns 404 when you give a non-existant token ID? | 14:21 |
| yottatsa | lbragstad, yep | 14:21 |
| dstanek | yottatsa: i'm saying that i think a 404 was the wrong implementation choice | 14:21 |
| yottatsa | maybe 403? | 14:22 |
| lbragstad | yeah, we do a lot of obfuscation in the token provider with 401, so we don't give much information | 14:22 |
| dstanek | lbragstad: i think it's worse than that - https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/middleware/auth_token.py#L1147 | 14:23 |
| lbragstad | dstanek: oh, so *everything* that is a 404 is returned as a 401? | 14:24 |
| dstanek | lbragstad: seems like the keystone server returns 401 for admin tokens and a 404 for other validation failures | 14:24 |
| lbragstad | strange... | 14:26 |
| dstanek | yottatsa: a 403 is probably correct - it seems like 401 must have a WWW-Authenticate header on the return and i'm pretty sure we don't do that | 14:26 |
| dstanek | unless webob is helping us out | 14:27 |
| yottatsa | lbragstad, dstanek, it was chosen because on v2.0 API token was an URI component like /v2.0/auth/token/TOKENHERE | 14:27 |
| yottatsa | so no token, no resource, 404 | 14:27 |
| dstanek | yottatsa: but that's not the case anymore right? | 14:28 |
| *** jecarey has quit IRC | 14:28 | |
| yottatsa | for v3 it's not the case | 14:28 |
| yottatsa | but I believe v2.0 is not a subject to change | 14:28 |
| morganfainberg | Correct v2 is frozen | 14:30 |
| dstanek | v2.0 is all but dead | 14:30 |
| morganfainberg | Dont change v2 unless it is an egregious error / security | 14:30 |
| dstanek | i'll file a bug on that because even if we can't fix it i think it | 14:30 |
| dstanek | 's wrong | 14:30 |
| *** briancurtin has quit IRC | 14:31 | |
| dstanek | morganfainberg: no changes to v2. v3 has some stupid encoded into it as a side effect of the way v2 was implemented | 14:31 |
| *** briancurtin has joined #openstack-keystone | 14:31 | |
| dstanek | yottatsa: does fernet responding with a 401 break anything or did you must find it inconsistent? | 14:32 |
| morganfainberg | dstanek: yep | 14:32 |
| *** jsavak has quit IRC | 14:33 | |
| *** gordc_offsite has quit IRC | 14:34 | |
| yottatsa | I believe https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/token_formatters.py#L201 fernet token_formatter.validate_token SHOUD return exception.ValidationError instead of exception.Unauthorized | 14:34 |
| yottatsa | and it shoud be handled properly | 14:34 |
| *** jsavak has joined #openstack-keystone | 14:35 | |
| morganfainberg | A strict 400 is sufficient here. But it has to be in the 400 class. | 14:35 |
| dstanek | yottatsa: but does it cause an issue being a 401? or are you just looking to make it match the docs? | 14:35 |
| yottatsa | dstanek, it's breaking API services on heavy load | 14:36 |
| morganfainberg | yottatsa: how? | 14:36 |
| lbragstad | just under *heavy* load? | 14:36 |
| dstanek | yottatsa: really? this should be load related | 14:36 |
| morganfainberg | How does an error code break api services under heavy load? | 14:36 |
| lbragstad | if it breaks api service it should break them under light load, too :) | 14:36 |
| morganfainberg | lbragstad: ++ | 14:37 |
| lbragstad | services* | 14:37 |
| yottatsa | Here is the debug log of glance-api for example | 14:38 |
| yottatsa | https://gist.github.com/anonymous/c2040eb89e23fc1a4af0 | 14:38 |
| *** henrynash has joined #openstack-keystone | 14:38 | |
| *** ChanServ sets mode: +v henrynash | 14:39 | |
| morganfainberg | Again, why is load a factor | 14:39 |
| dstanek | yottatsa: that just means your token was invalid | 14:39 |
| dstanek | the 'admin token' in the error message is the unfortunate part | 14:39 |
| yottatsa | dstanek, if USER token is invalid, why do middleware reissue ADMIN token? | 14:40 |
| yottatsa | note that line 2 and 4 contains differrent admin tokens | 14:40 |
| morganfainberg | yottatsa: does the same thing occur with uuid tokens and v3? | 14:41 |
| morganfainberg | I have to ask because *i* think i know why this is happening | 14:41 |
| *** TheIntern has joined #openstack-keystone | 14:41 | |
| * morganfainberg ignores v2 | 14:41 | |
| dstanek | morganfainberg: i would guess no because of the 404 | 14:41 |
| yottatsa | so instead of 10 ms on request, we've got 10 + 60 + 10, and +60 on next request (where 10ms is a validation time and 60ms is issue time) | 14:42 |
| yottatsa | morganfainberg, no, UUID is working just fine on v2.0 and v3 | 14:42 |
| morganfainberg | dstanek: this is another "edge" case that is occuring because fernet doesnt wrap the same way as the other providers. So, a validate is raisng a 401. I fixed this in uuid | 14:42 |
| morganfainberg | But fernet didnt lean on any of the other provider's code | 14:43 |
| *** marzif has quit IRC | 14:43 | |
| morganfainberg | This is a medium prio bug, but it is effectively a regression | 14:43 |
| dstanek | morganfainberg: yeah, that what yottatsa's bug says. that fernet isn't returning a 404. what i was saying is that a 404 isn't correct, but not sure that we can fix that now. | 14:43 |
| morganfainberg | We could change to a 400 and be ok | 14:44 |
| *** marzif has joined #openstack-keystone | 14:44 | |
| morganfainberg | Same class of error | 14:44 |
| yottatsa | morganfainberg, just don't forget about ksc | 14:44 |
| morganfainberg | Or we can go to 404 in fernet | 14:44 |
| morganfainberg | yottatsa: dont care about ksc | 14:44 |
| dstanek | morganfainberg: no, because auth_token would be broken. you have to use a 404. - it's being dumb here: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/middleware/auth_token.py#L1147 | 14:45 |
| morganfainberg | Care about middleware | 14:45 |
| morganfainberg | dstanek: so we fix middleware too | 14:45 |
| morganfainberg | ;) | 14:45 |
| morganfainberg | 404 or 400 both fine ;) | 14:45 |
| yottatsa | morganfainberg, I mean middleware :) | 14:45 |
| dstanek | morganfainberg: yeah, that's what i was thinking. | 14:45 |
| morganfainberg | We *can* fix this was my point | 14:45 |
| dstanek | what i don't know if how to differentiate between a user and admin token for the client | 14:46 |
| morganfainberg | dstanek: also how does keystonemiddleware work? | 14:46 |
| morganfainberg | Not ksc version | 14:46 |
| morganfainberg | Ksc version is dead | 14:46 |
| morganfainberg | dstanek: i dont understand your problem. Middleware holds admin token in session | 14:47 |
| morganfainberg | User token is separate | 14:47 |
| morganfainberg | Again, dont look at middleware in keystoneclient, look in the keystonemiddleware package | 14:47 |
| morganfainberg | Keystoneclient version has been bit rottibg/dead for cycles | 14:48 |
| dstanek | morganfainberg: yeah, i'm looking how to see what it does. i'm hoping it's been fixed | 14:48 |
| dstanek | morganfainberg: i can't find anything to catch the 404, so maybe it's working fine | 14:49 |
| dstanek | yottatsa: can you switch over to keystonemiddleware to test? | 14:50 |
| rletrocquer | hi, currently is-it possible for an user that is authenticated to an openstack site A to switch to an other openstack site B without re-authenticate on dashboard ? (site with own keystone and not sharing or synchronize database) | 14:50 |
| *** jecarey has joined #openstack-keystone | 14:50 | |
| morganfainberg | yottatsa: if you are using keystoneclient's version of middleware - it is not supported | 14:50 |
| morganfainberg | We are removing it in a very soon release of keystoneclient | 14:50 |
| morganfainberg | dstanek: i am going to guess this is still an issue with fernet | 14:51 |
| morganfainberg | rletrocquer: nope | 14:51 |
| morganfainberg | rletrocquer: not really unless you're using fernet and synchronising dbs | 14:52 |
| morganfainberg | rletrocquer: or synchronisng the token table for other token types. | 14:52 |
| dstanek | morganfainberg: do you think fernet should 404 like the other providers? (i have not validated that they do that) | 14:52 |
| morganfainberg | Or sharing the db | 14:52 |
| janonymous | Hi, Could someone help me out on : https://review.openstack.org/#/c/193866/ | 14:53 |
| morganfainberg | dstanek: it should re-raise 404 (or everything move to 400) on a validate | 14:53 |
| janonymous | I donno what is going wrong with the patch | 14:53 |
| morganfainberg | dstanek: once the admin token has passed | 14:53 |
| yottatsa | dstanek, I'll switch on keystonemiddleware in next two weeks. Now part of our production is still on Icehouse | 14:53 |
| lbragstad | I have some patches up for the consolidation of the fernet code path, I wonder if it's changed in there? | 14:53 |
| * lbragstad has to double check | 14:54 | |
| morganfainberg | dstanek: 401 - admin token broken, 404/400 user token bad | 14:54 |
| morganfainberg | lbragstad: worth checking. | 14:54 |
| dstanek | morganfainberg: why not a 401/403 for the user token? | 14:55 |
| lbragstad | i think it will still be subject to the same bug https://review.openstack.org/#/c/196877/11 | 14:55 |
| dstanek | 400 seems too generic and 404 doesn't fit because the resource is actually there | 14:56 |
| morganfainberg | dstanek: 401 is used for indicating x-auth-token is wrong | 14:56 |
| openstackgerrit | Boris Bobrov proposed openstack/keystoneauth: Expose bug in AccessToken https://review.openstack.org/205094 | 14:56 |
| morganfainberg | Erm invalid | 14:56 |
| morganfainberg | You cant access keystone | 14:56 |
| morganfainberg | X-subject-token invalid is an indicator the resource is not valid | 14:57 |
| morganfainberg | So 401 is incorrect | 14:57 |
| breton | what do you think about ^? Should these properties be None or should an exception be raised? | 14:57 |
| morganfainberg | A 403 would also be incorrect | 14:57 |
| morganfainberg | As you are not forbidden from seeing the resource | 14:57 |
| yottatsa | dstanek morganfainberg, speaking about ksmiddleware, it's relies on ksc, so validation is just get: https://github.com/openstack/python-keystoneclient/blob/795b8567174f1d210eab6a4585d7339a302b0a69/keystoneclient/v2_0/tokens.py#L87 https://github.com/openstack/python-keystoneclient/blob/795b8567174f1d210eab6a4585d7339a302b0a69/keystoneclient/v3/tokens.py#L75 | 14:58 |
| morganfainberg | dstanek: so we need this to be a bad request - the 404 is correct in v2, in v3 it is sinply a resource that is incorrect in the request, so 400 | 14:59 |
| morganfainberg | yottatsa: keystoneclient is really mostly irrelevant here | 14:59 |
| yottatsa | morganfainberg, rly? | 14:59 |
| morganfainberg | Yep. | 14:59 |
| *** jasonsb has quit IRC | 15:00 | |
| yottatsa | morganfainberg, https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_identity.py#L76 | 15:00 |
| morganfainberg | This is a question of how the server responds | 15:00 |
| morganfainberg | We would fix the client to match | 15:00 |
| morganfainberg | Hence irrelvant | 15:00 |
| *** jasonsb has joined #openstack-keystone | 15:00 | |
| *** pnavarro has quit IRC | 15:01 | |
| dstanek | morganfainberg: hmmm...i was thinking 403 because the credentials were invalid | 15:01 |
| yottatsa | morganfainberg, I think 404 is just fine for v2.0 because of semantics | 15:01 |
| morganfainberg | V2 cant be changed itll be a 404 | 15:01 |
| morganfainberg | This is a convo about v3 | 15:02 |
| yottatsa | morganfainberg, and 403 for v3 is good to | 15:02 |
| morganfainberg | No 403 is incorrext | 15:02 |
| morganfainberg | You are not forbidden from accessing the url | 15:02 |
| dstanek | what is the actual error then? | 15:02 |
| morganfainberg | dstanek: but the credentials arent invalid, x-subject-token arent credentials | 15:02 |
| morganfainberg | X-auth-token is | 15:02 |
| yottatsa | morganfainberg, I think that passing Subject token in headers IS incorrect | 15:03 |
| yottatsa | it broke semantics | 15:03 |
| morganfainberg | yottatsa: that is a security thing | 15:03 |
| morganfainberg | It should have been in a body | 15:03 |
| morganfainberg | But it meant we couldnt use a get | 15:03 |
| yottatsa | how about 402? ;) | 15:03 |
| morganfainberg | 400 imo is the most correct when x-subject-token is invalid | 15:04 |
| *** fhubik_lunch has joined #openstack-keystone | 15:04 | |
| morganfainberg | yottatsa: i keep wanting to use 402: pay me to fix this bug | 15:04 |
| morganfainberg | :P | 15:04 |
| rletrocquer | thanks morganfainberg for your answer. | 15:04 |
| dstanek | morganfainberg: hmmm...yeah that probably makes sense | 15:04 |
| *** jasonsb has quit IRC | 15:05 | |
| dstanek | 402's everywhere! | 15:05 |
| *** topol has quit IRC | 15:05 | |
| morganfainberg | There is no question that 404 is correct for v2 | 15:05 |
| lbragstad | I would be fine with 400, | 15:05 |
| lbragstad | since here https://github.com/openstack/keystone/blob/2a3f9b45faf833bfed587ecc217d83f37e90ddcb/keystone/token/providers/fernet/token_formatters.py#L199-L203 we might not be "unauthorized" explicitly. | 15:05 |
| morganfainberg | And v3 should probably just raise the same as uuid for now - with a followup to do 400 | 15:05 |
| *** fhubik_afk has quit IRC | 15:06 | |
| morganfainberg | But that requires client/middleware changes | 15:06 |
| morganfainberg | So as a followup | 15:06 |
| lbragstad | I think when the fernet stuff was written, we appoarched it from the fact it was a tampered token | 15:06 |
| morganfainberg | lbragstad: that is fine - validate code path is used for both admin and user tokens | 15:06 |
| morganfainberg | You need to reraise down in the controller | 15:07 |
| morganfainberg | We reraise unauthorized in the auth process | 15:07 |
| yottatsa | so: 1. I'll fix keystone.token.providers.fernet.token_formatters.TokenFormatter#validate_token and replace exception.Unauthorized with exception.ValidationError; 2. I'll fix all the code around validate_token to handle exception properly; 3. somebody propose API change and replace 404 with 400 | 15:07 |
| *** fhubik_lunch has quit IRC | 15:07 | |
| yottatsa | morganfainberg, how about it? | 15:08 |
| morganfainberg | yottatsa: you may need the controller to reraise a 404 instead of fixing the provider | 15:08 |
| lbragstad | I believe dolphm was around writing some of that too, so he might have some more context around that ^ | 15:08 |
| morganfainberg | yottatsa: the move from 404-400 should be a wishlist item for v3 | 15:09 |
| *** daemontool_ is now known as marzif_ | 15:10 | |
| *** alex_xu has quit IRC | 15:10 | |
| *** alex_xu has joined #openstack-keystone | 15:11 | |
| yottatsa | how about 498? | 15:13 |
| yottatsa | 498 Token expired/invalid (Esri) | 15:14 |
| yottatsa | Returned by ArcGIS for Server. A code of 498 indicates an expired or otherwise invalid token.[28] | 15:14 |
| yottatsa | https://en.wikipedia.org/wiki/List_of_HTTP_status_codes#4xx_Client_Error | 15:14 |
| *** esp has joined #openstack-keystone | 15:14 | |
| *** pnavarro has joined #openstack-keystone | 15:15 | |
| *** david-lyle has joined #openstack-keystone | 15:17 | |
| *** dgrauet has quit IRC | 15:17 | |
| morganfainberg | Nope. Want to use http standards | 15:17 |
| morganfainberg | 498 is esri specifif | 15:17 |
| morganfainberg | Specific | 15:17 |
| morganfainberg | We could make our own code, but have historically avoided that | 15:19 |
| *** diazjf has joined #openstack-keystone | 15:20 | |
| *** piyanai has joined #openstack-keystone | 15:21 | |
| morganfainberg | mfisch: so I think I see another optimization we can do to help with the revoke issues | 15:23 |
| morganfainberg | mfisch: but I'd need to get some time to profile it | 15:24 |
| morganfainberg | mfisch: effectively we also load from the DB every time w/o caching. | 15:24 |
| morganfainberg | mfisch: though profiling this could be easy with memcache vs non-memcache enabled revoke | 15:24 |
| *** arunkant_ has joined #openstack-keystone | 15:25 | |
| morganfainberg | lbragstad: ^ cc | 15:26 |
| *** marzif_ has quit IRC | 15:28 | |
| *** piyanai has quit IRC | 15:29 | |
| mfisch | morganfainberg: I did some numbers last night after enabling memcached | 15:30 |
| mfisch | the test is pretty biased in favor of caching since I'm validating the same token over and over | 15:30 |
| mfisch | it was way faster of course, but still had the slow down affect | 15:30 |
| morganfainberg | mfisch: so only enable caching of revoke | 15:30 |
| morganfainberg | not token | 15:30 |
| mfisch | right I can try that some time | 15:31 |
| morganfainberg | mfisch: but this tells me what I've been asserting in the ML thread | 15:31 |
| morganfainberg | we have an expensive matching algorithm | 15:31 |
| *** jsavak has quit IRC | 15:31 | |
| mfisch | I agree | 15:32 |
| morganfainberg | i think it is because we do string subs | 15:32 |
| *** jsavak has joined #openstack-keystone | 15:32 | |
| morganfainberg | vs. just string matching | 15:32 |
| morganfainberg | even when the tree itself is cached | 15:32 |
| *** Guest24740 has joined #openstack-keystone | 15:32 | |
| morganfainberg | subtree = revoke_map.get('%s=%s' % (name, key)) | 15:32 |
| dstanek | can we unroll it a little and explicitly add entries for each token instead of adding a single entry to bundle them? | 15:32 |
| morganfainberg | dstanek: no - we end up back to a TRL | 15:33 |
| morganfainberg | which causes more issues | 15:33 |
| *** piyanai has joined #openstack-keystone | 15:33 | |
| morganfainberg | i'd rather have a slow validate than a unbounded list of 10s of thousands of tokens | 15:33 |
| morganfainberg | we end up back to just storing tokens in the db | 15:33 |
| dstanek | hmmm... not sure how much we can do with the current algorithm. | 15:34 |
| *** mylu has quit IRC | 15:34 | |
| morganfainberg | dstanek: we move back to something a bit more liniar | 15:34 |
| morganfainberg | that doesn't need stringsubs eat each level | 15:34 |
| morganfainberg | a == b | 15:35 |
| morganfainberg | will be faster than ('%s' % a) == b | 15:35 |
| morganfainberg | plus other magic string manipulations | 15:35 |
| dstanek | i'll have to look at the linear algorithm that ayoung posted. why was the tree chosen over linear | 15:36 |
| janonymous | __eq__ | 15:36 |
| morganfainberg | dstanek: because someone rewrote it as a drive-by | 15:36 |
| morganfainberg | in the initial review process | 15:36 |
| dstanek | that particular example will be microscopically different | 15:36 |
| morganfainberg | and those working on it didn't push hard enough to go back to something readable | 15:37 |
| dstanek | drive-bys are fun | 15:37 |
| morganfainberg | dstanek: well it's doing things like name=key in a dict lookup and then doing a name=* for a wildcard match | 15:38 |
| morganfainberg | its a lot of extra string manipulations | 15:38 |
| morganfainberg | we could just check does value == thing from token value | 15:38 |
| morganfainberg | and at the very least, could be a bit easier to read | 15:38 |
| dstanek | morganfainberg: i thought that the tree did that so that it could rely on less revocation entries. now i'm interested in what it's actually doing :-) | 15:40 |
| morganfainberg | the tree is just so you are doing an "optimised" search | 15:40 |
| morganfainberg | not changing the entries | 15:40 |
| morganfainberg | and i don't think ayoung's linear search is really better ir's doing other expensive things at each setp | 15:40 |
| morganfainberg | step* | 15:40 |
| *** pnavarro has quit IRC | 15:41 | |
| *** mylu has joined #openstack-keystone | 15:42 | |
| morganfainberg | the best solution is to avoid the dict constructor(s) and break early if the token matches | 15:42 |
| ayoung | morganfainberg, so, the question is where are things slow right now? Is it in the building of the treee, and we are creating the treee too many times, or is in the lookup? | 15:42 |
| morganfainberg | not run through the entire list of event matching | 15:42 |
| morganfainberg | ayoung: we cached the treee with mfisch's envifonrment | 15:43 |
| ayoung | morganfainberg, normal case is going to be "token is valid" | 15:43 |
| mfisch | what about limiting the query some? you are loading the entire table each time | 15:43 |
| mfisch | you should be able to limit it by user right? | 15:43 |
| ayoung | so , yeah, early failur is good, but will minimize the speedup | 15:43 |
| morganfainberg | ayoung: it still suffered in slowdown | 15:43 |
| ayoung | morganfainberg, my guess is that we are creating the tree each time instead of caching it somehow | 15:43 |
| morganfainberg | ayoung: it's 3 bad things: 1) load from DB every time [inefficient model->usable python struct], tree build, and match | 15:43 |
| *** mestery has joined #openstack-keystone | 15:43 | |
| morganfainberg | ayoung: we don't cache by default it's a memoize | 15:44 |
| ayoung | remember, I wrote this with an eye to being fetched and cached in ATM...so the assumptions do not hold | 15:44 |
| morganfainberg | ayoung: so i think we need to just rethink the thing top to bottom | 15:44 |
| ayoung | memoize the tree...should work, but be expensive, IIUC? | 15:44 |
| ayoung | morganfainberg, kill all revocations and make tokens 5 minutes long? | 15:44 |
| morganfainberg | ayoung: memoize helped. memoize = memcache | 15:44 |
| morganfainberg | here | 15:44 |
| morganfainberg | ayoung: we *cant* do that | 15:44 |
| morganfainberg | ayoung: you know that | 15:44 |
| morganfainberg | not today | 15:45 |
| ayoung | will memoize be fast for hashtables? | 15:45 |
| morganfainberg | memoize is fast enough in this case. since it's storing a dict | 15:45 |
| morganfainberg | it is faster than db->dict | 15:45 |
| morganfainberg | but it has to be memcache it can't be internal | 15:45 |
| *** jsavak has quit IRC | 15:45 | |
| morganfainberg | due to multiprocess | 15:45 |
| morganfainberg | has to be a shared cache. | 15:45 |
| *** jsavak has joined #openstack-keystone | 15:46 | |
| dstanek | morganfainberg: and memory constraints! | 15:46 |
| morganfainberg | so setting that aside | 15:46 |
| ayoung | right...so... | 15:46 |
| ayoung | mfisch, what are the classes of revocation you are actually seeing? | 15:46 |
| ayoung | you said it was mostly from users logging out of Horizon, right? | 15:46 |
| morganfainberg | lets look at how we store events, since ATM no longer needs to fetch. then look at the event model -> python struct | 15:46 |
| mfisch | in the real world yes | 15:46 |
| mfisch | we also have a regression test that is sometimes run that generates a bunch of user and role deletes/removes | 15:46 |
| morganfainberg | the horizon deleting tokens is just such an awful case | 15:46 |
| ayoung | those are done by userid. | 15:46 |
| mfisch | for my testing I just straight up generate and revoke a token | 15:47 |
| clayton | morganfainberg: I suspect the memoize is still slow because it still has to deserialize the entire tree every time | 15:47 |
| mfisch | becuase thats easy | 15:47 |
| clayton | that's a lot of memory allocations that get thrown away every time | 15:47 |
| ayoung | if we maintained a sorted (by userid ) list of those, searching would be O(log N) | 15:47 |
| morganfainberg | clayton: it's not that slow - it's mostly the same as anything else in openstack | 15:47 |
| morganfainberg | clayton: but when we also need to do tons of transforms | 15:48 |
| ayoung | and the database can help us with those, right? | 15:48 |
| morganfainberg | that's where it gets ugly | 15:48 |
| morganfainberg | ayoung: thats one thing we can do. | 15:48 |
| ayoung | seklect * from revoke_events where (not expired) order_by user_id; | 15:48 |
| morganfainberg | lets kill the KVS revoke event driver | 15:48 |
| morganfainberg | then we can focus on makeing the SQL one behave like SQL should | 15:49 |
| morganfainberg | rather than trying to make SQL and KVS both handle things sanely | 15:49 |
| ayoung | morganfainberg, I think I want to suggest a straight up linear search. | 15:49 |
| *** nkinder has joined #openstack-keystone | 15:49 | |
| ayoung | I think that any other operation performed on a per-check basis will be more overhead than gain | 15:49 |
| morganfainberg | ayoung: that's fine - if we're doing that, lets avoid the dict transform stuff we're doing in db -> python struct | 15:49 |
| morganfainberg | ayoung: which is what i was noticing in your original code. | 15:50 |
| clayton | has anyone profiled the tree code? | 15:50 |
| morganfainberg | clayton: in all cases it has always been slow in test, in validate, etc | 15:50 |
| morganfainberg | clayton: not in the strictest search sense but it was a sub-optimial idea when we started | 15:51 |
| clayton | sure, it seems overly complex for something you throw away every time you use it | 15:51 |
| morganfainberg | clayton: i want to throw it out based on its lack of maintainablility anyway - this all came from the idea that auth_token middleware would be fetching the events and checking on the endpoint side | 15:51 |
| ayoung | morganfainberg, somewhere in that patch set I had both code paths...the lienar was in the test case. I had ideas back then to be able to compare a run of one with the other | 15:51 |
| morganfainberg | since that is no longer true, we can reimagine everything in a way that isn't assuming something is fetching externally | 15:51 |
| morganfainberg | clayton: ^ | 15:52 |
| ayoung | mfisch, you said you had a trivial number of revocations right? | 15:52 |
| mfisch | normally its like 30 or so | 15:52 |
| mfisch | maybe up to 100 | 15:52 |
| mfisch | from general use | 15:52 |
| ayoung | yeah...lets linear search that | 15:52 |
| mfisch | but once it gets to 500 perf is cut in half | 15:53 |
| ayoung | ok...let me see if I can get a build of the code to work with the linear.... | 15:53 |
| clayton | yeah, and 500 isn't a particularly crazy number | 15:53 |
| *** ankita_wagh has joined #openstack-keystone | 15:53 | |
| mfisch | the issue is that validation is pretty much the fundamental building block of openstack | 15:53 |
| ayoung | the degrataion should be....wait for it...linear.... | 15:53 |
| mfisch | everything in the entire cloud hinges on it | 15:53 |
| morganfainberg | mfisch: so i hate to ask | 15:53 |
| morganfainberg | what is 50% performance | 15:53 |
| morganfainberg | at 500? | 15:53 |
| *** federico3 has quit IRC | 15:53 | |
| morganfainberg | what is the wallclock validate? | 15:53 |
| clayton | mfisch: you have a link to the graph you shared with me? | 15:53 |
| mfisch | thinking | 15:54 |
| morganfainberg | because frankly... if it's <.5s I'm viewing this as medium | 15:54 |
| mfisch | most of the benchmarks I did were done with concurrent validations let me see if it captures info | 15:54 |
| morganfainberg | if is .5-1s validate, it's a little higher priority | 15:54 |
| morganfainberg | if its 5s+ that is serious | 15:55 |
| *** kiran-r has joined #openstack-keystone | 15:55 | |
| mfisch | the measurements are more about throughput | 15:55 |
| clayton | morganfainberg: the issue isn't so much the wall clock time, it's when we have some something go slightly wonky and token validation rate goes up by 5x, everything falls over. | 15:55 |
| mfisch | my recent ones are on a virtual environment, let me see if I have prod numbers | 15:55 |
| *** _kiran_ has joined #openstack-keystone | 15:56 | |
| morganfainberg | clayton: again, if validations take up to 2s in "OMG IO latency" or some wacky thing | 15:56 |
| morganfainberg | we need to make that more resilient | 15:56 |
| morganfainberg | assuming 500ms -> 5x | 15:56 |
| morganfainberg | for a wonky omg moment | 15:56 |
| morganfainberg | if that is the case - i don't think we're looking at the right bits | 15:56 |
| mfisch | two thoughts: first this would hurt less except that fernet token validation slowed us down quite a bit and made me focus on this, and second, we will be enabling caching which will help improve the base rate substantially | 15:56 |
| *** jiaxi has joined #openstack-keystone | 15:57 | |
| mfisch | let me look at my prod #s | 15:57 |
| clayton | morganfainberg: the issue is validations start failing because you run out of capacity. | 15:57 |
| *** pnavarro has joined #openstack-keystone | 15:57 | |
| morganfainberg | clayton: again - we're attacking the wrong thing in the 2s model | 15:57 |
| mfisch | morganfainberg: let me get you some numbers on individual times with 500 revocations in my staging env, dont want to hack prod | 15:58 |
| morganfainberg | mfisch: ok | 15:58 |
| *** zhiyan has quit IRC | 15:58 | |
| mfisch | give me a bit | 15:58 |
| morganfainberg | isolated environment is fine as long as we have consistent numbers | 15:58 |
| *** zhiyan has joined #openstack-keystone | 15:58 | |
| morganfainberg | and we keep benchmarking the same thing | 15:58 |
| morganfainberg | clayton: my argument is if we can't handle a 2s validate storm - we have resiliency issues | 15:59 |
| morganfainberg | not latency issues | 15:59 |
| morganfainberg | if everything is always 2s | 15:59 |
| morganfainberg | then we have another problem because 10s is really unreasonable | 15:59 |
| morganfainberg | clayton: 500ms normal, with bursts into 2s in wonkyness, i'd focus on making sure we're resilent/optional tuning to help with scale-out resiliency | 16:00 |
| *** kiran-r has quit IRC | 16:00 | |
| morganfainberg | if that makes sense | 16:00 |
| morganfainberg | we can always work to improve. | 16:00 |
| * morganfainberg also thinks part of the problem is the chatty-ness to the backends in keystone | 16:00 | |
| morganfainberg | but that is a bigger issue to address | 16:01 |
| *** jistr has quit IRC | 16:01 | |
| bknudson | if you've got a few minutes I'd like some input on https://etherpad.openstack.org/p/keystone-info -- nova meetup folks are asking for a "keystone overview for nova devs" | 16:01 |
| clayton | morganfainberg: the issue we tend to see is some other service getting slammed, DoS'ing keystone and everything else falls over because keystone does. | 16:01 |
| bknudson | to help them understand what v3 is. | 16:01 |
| *** ninag has quit IRC | 16:02 | |
| *** jsavak has quit IRC | 16:02 | |
| *** marzif has quit IRC | 16:02 | |
| morganfainberg | bknudson: simple: v3 is the CRUD api version - unfortunately, auth is also tied to it. | 16:02 |
| morganfainberg | bknudson: there should be almost nothing nova *needs* from the crud interface. | 16:02 |
| *** jsavak has joined #openstack-keystone | 16:03 | |
| *** browne has joined #openstack-keystone | 16:03 | |
| morganfainberg | bknudson: i know oyu know this | 16:03 |
| *** ninag has joined #openstack-keystone | 16:03 | |
| morganfainberg | but i'm honestly kindof tired of the conversation | 16:03 |
| bknudson | morganfainberg: somebody is proposing using HMT to nova so they need to know how it works. | 16:03 |
| bknudson | morganfainberg: I'm tired of the conversations, too. | 16:03 |
| * morganfainberg thinks we should just roll auth back into nova and glance and cinder | 16:04 | |
| bknudson | because it seems like everyone's making more of v2 -> v3 than they should be. | 16:04 |
| bknudson | making it a lot more complicated than it is | 16:04 |
| morganfainberg | bknudson: it's an auth mechanism - and the auth details changed slightly | 16:04 |
| morganfainberg | thats the line i'm going with now | 16:04 |
| morganfainberg | unless they are heat | 16:04 |
| morganfainberg | but funny, heat isn't the issue here | 16:04 |
| *** _cjones_ has joined #openstack-keystone | 16:05 | |
| morganfainberg | bknudson: your etherpad looks good to me, but i'd tell them to stop asking about the internals of keystone crud stuff | 16:05 |
| morganfainberg | it's irrelevant | 16:05 |
| *** _kiran_ has quit IRC | 16:06 | |
| morganfainberg | the HMT bits | 16:06 |
| morganfainberg | if they have a way to ask for the hierarchy, that is good enogh | 16:07 |
| *** TheIntern has quit IRC | 16:07 | |
| morganfainberg | and they can know the hierarchy is immutable | 16:07 |
| * morganfainberg tries to boil it down | 16:07 | |
| morganfainberg | how does it "work" is the same as asking "how does storing data in RBD work?" do you just consume the block device that cinder tells you to? yes, ok same deal | 16:07 |
| bknudson | nova folks think about v2 more than we do. | 16:07 |
| morganfainberg | i don't know why | 16:08 |
| bknudson | me neither... we assume everyone uses v3 all the time and they think they're still using v2. | 16:08 |
| morganfainberg | try and convince them to just think about the authorization data | 16:08 |
| morganfainberg | and not care what API version it comes from | 16:09 |
| *** htruta has quit IRC | 16:09 | |
| morganfainberg | if you feel bold | 16:09 |
| *** htruta has joined #openstack-keystone | 16:10 | |
| *** dguerri is now known as dguerri` | 16:11 | |
| *** serverascode has quit IRC | 16:14 | |
| *** marzif has joined #openstack-keystone | 16:15 | |
| *** serverascode has joined #openstack-keystone | 16:16 | |
| *** mylu has quit IRC | 16:18 | |
| jiaxi | http://webchat.freenode.net/?channels=openstack,openstack-101 | 16:19 |
| jiaxi | It's 00:19 in China. Please help me to review my patch set http://webchat.freenode.net/?channels=openstack,openstack-101 | 16:19 |
| jiaxi | Thank you | 16:19 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Tweak memcache lock sleep time and attempts number https://review.openstack.org/205139 | 16:20 |
| jiaxi | Too sleepy. I'm going to go to bed. Good night. https://review.openstack.org/204952 | 16:22 |
| *** jiaxi has quit IRC | 16:22 | |
| *** piyanai has quit IRC | 16:27 | |
| *** ankita_wagh has quit IRC | 16:28 | |
| *** ctracey has quit IRC | 16:31 | |
| *** lhcheng has joined #openstack-keystone | 16:31 | |
| *** ChanServ sets mode: +v lhcheng | 16:31 | |
| *** ctracey has joined #openstack-keystone | 16:31 | |
| *** jsavak has quit IRC | 16:33 | |
| *** jsavak has joined #openstack-keystone | 16:34 | |
| *** dguerri` is now known as dguerri | 16:34 | |
| mfisch | morganfainberg: I have some prelim numbers for you | 16:34 |
| *** lhcheng has quit IRC | 16:34 | |
| morganfainberg | mfisch: cool | 16:35 |
| mfisch | with 0 revocation events | 16:35 |
| mfisch | 104.67 [#/sec] | 16:35 |
| mfisch | average time per | 16:35 |
| mfisch | 191.071 [ms] | 16:35 |
| mfisch | with 500 events | 16:35 |
| morganfainberg | Acceptable baseline | 16:35 |
| mfisch | 52.48 [#/sec] | 16:35 |
| mfisch | 381.103 [ms] | 16:35 |
| mfisch | non-concurrent is about the same | 16:35 |
| morganfainberg | Ok so i think we need to focus on resiliency. Now. We can improve the event bit too as part of it. | 16:35 |
| mfisch | 225.707 [ms] to 387 ms | 16:35 |
| morganfainberg | Yeah. | 16:36 |
| mfisch | any improvements here make all of openstack better which is ince | 16:36 |
| mfisch | nice | 16:36 |
| morganfainberg | Great. Can you toss those numbers on the ML thread too? | 16:36 |
| mfisch | sure | 16:36 |
| bknudson | mfisch: did you try defining an index? | 16:36 |
| mfisch | negative bknudson | 16:36 |
| *** aix has quit IRC | 16:37 | |
| morganfainberg | Im going to go out on a limb and say 381ms validate is not awful | 16:37 |
| mfisch | I did see your blog comment this morning | 16:37 |
| morganfainberg | Not great, but not awful | 16:37 |
| clayton | I thought the only query it did was basically "SELECT * from <table> ORDER BY expires_at" | 16:37 |
| bknudson | oh, I thought it was the cleanup that was too slow | 16:37 |
| clayton | oh, you mean to help with deletes? | 16:37 |
| morganfainberg | clayton: it is. | 16:37 |
| morganfainberg | The cleanup was being hit everytime | 16:37 |
| morganfainberg | So we moved when cleanup happened to on new event | 16:38 |
| bknudson | it must do WHERE expires_at > ? | 16:38 |
| clayton | nope | 16:38 |
| bknudson | ok... getting the current revocation events doesn't need all the rows, only the active ones | 16:39 |
| clayton | bknudson: https://github.com/openstack/keystone/blob/master/keystone/contrib/revoke/backends/sql.py#L85-L86 | 16:40 |
| bknudson | same with cleanup -- it only needs to look at the inactive ones. | 16:40 |
| morganfainberg | Yes | 16:40 |
| bknudson | that's fetching revocation events, as in if keystonemiddleware was checking events | 16:40 |
| bknudson | but we never implemented revocation events in auth_token. | 16:40 |
| samueldmq | morganfainberg: mfisch what is that you were talking about ? performance in tokens revocations ? looks interesting ... | 16:40 |
| mfisch | yes | 16:40 |
| mfisch | samueldmq: http://www.mattfischer.com/blog/?p=672 | 16:41 |
| samueldmq | mfisch: great, I will take a look thanks | 16:41 |
| dolphm | bknudson: https://review.openstack.org/#/c/203900 vs https://bugs.launchpad.net/keystone/+bug/1474491 | 16:43 |
| openstack | Launchpad bug 1474491 in Keystone "keystone.tests.unit.test_config fails in isolation" [Low,In progress] - Assigned to lei zhang (zhang-lei) | 16:43 |
| *** TheIntern has joined #openstack-keystone | 16:43 | |
| bknudson | dolphm: stragely the tests didn't fail on py27, but I guess it would fix the prob. | 16:44 |
| dolphm | bknudson: the tests fail on py27 if you run that module in isolation | 16:45 |
| *** TheIntern has quit IRC | 16:45 | |
| dolphm | bknudson: and i verified that your patch fixes that | 16:45 |
| *** mylu has joined #openstack-keystone | 16:45 | |
| bknudson | dolphm: y, that fails for me too | 16:46 |
| dolphm | bknudson: dstanek just +A'd, but can you slap a Closes-Bug on there? | 16:46 |
| bknudson | sure | 16:46 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Ensure database options registered for tests https://review.openstack.org/203900 | 16:46 |
| dstanek | dolphm: hey! | 16:47 |
| janonymous | Hi guys : @dstanek , @bknudson, @boris, : Could you please suggest something on, i think i am stuck somewhat here: https://review.openstack.org/#/c/193866/ | 16:49 |
| *** ninag has quit IRC | 16:49 | |
| samueldmq | bknudson: hey, I was looking at that patch .. the explanation leads me to think something very similar is happening here | 16:50 |
| samueldmq | bknudson: https://bugs.launchpad.net/keystone/+bug/1474490 | 16:50 |
| openstack | Launchpad bug 1474490 in Keystone "keystone.tests.unit.common.test_notifications.NotificationsTestCase fails in isolation" [Low,In progress] - Assigned to Diego Adolfo (diegoado) | 16:50 |
| samueldmq | bknudson: but in that ^ case, some other test may be registering the options | 16:51 |
| bknudson | without python3 support in dogpile.cache there's not much that works. | 16:52 |
| bknudson | so if someone was working on that we'd be able to increase coverage a lot | 16:52 |
| bknudson | although for some reason oslo.cache doesn't seem to have a problem with python3, which is odd. | 16:52 |
| samueldmq | interesting, tbh I haven't looked at oslo.cache yet :( | 16:53 |
| *** e0ne has quit IRC | 16:53 | |
| *** thedodd has quit IRC | 16:54 | |
| *** snapdey has joined #openstack-keystone | 16:56 | |
| *** pnavarro has quit IRC | 16:58 | |
| dstanek | dolphm: bknudson: it's even better if it fixes a bug! | 16:58 |
| *** piyanai has joined #openstack-keystone | 16:58 | |
| dstanek | bknudson: i am looking at that now | 16:59 |
| *** dramakri has joined #openstack-keystone | 17:00 | |
| dstanek | bknudson: it's not dogpile it's us or at least can be controlled by us | 17:00 |
| bknudson | dstanek: oh, oops | 17:00 |
| *** ankita_wagh has joined #openstack-keystone | 17:00 | |
| dstanek | bknudson: i have a couple py3 patches baking right now. | 17:01 |
| dolphm | dstanek: hi! | 17:01 |
| dstanek | samueldmq: that's why i have a problem with the whole option registration stuff. feel wrong to me | 17:02 |
| *** ninag has joined #openstack-keystone | 17:05 | |
| *** jraim has quit IRC | 17:07 | |
| *** jraim has joined #openstack-keystone | 17:08 | |
| *** ninag has quit IRC | 17:10 | |
| *** mylu has quit IRC | 17:11 | |
| *** ninag has joined #openstack-keystone | 17:11 | |
| *** dims_ has quit IRC | 17:12 | |
| *** spandhe has joined #openstack-keystone | 17:13 | |
| janonymous | any comment relating to my link..? | 17:15 |
| breton | janonymous: I had the same issue with https://review.openstack.org/#/c/188796/ | 17:17 |
| breton | janonymous: the issue is that either some exception, or some marked for translation string does not want to be coerced to unicode | 17:17 |
| breton | oh, no, it was not ready to be coerced to str | 17:18 |
| breton | File "/home/jenkins/workspace/gate-keystone-python27/.tox/py27/local/lib/python2.7/site-packages/oslo_i18n/_message.py", line 208, in __str__ | 17:18 |
| breton | right, a string marked for translation doesn't want to be come a string | 17:19 |
| breton | python's assertRaisesRegexp tries to do str() | 17:19 |
| dstanek | janonymous: i think the python2.7 version of the assertion method just doesn't play well with translation messages | 17:20 |
| breton | if you really-really want to use the assertion, you need to make some changes in oslo_i18n | 17:20 |
| dstanek | we may be stuck wrapping it after all to compensate | 17:20 |
| *** nzeer has quit IRC | 17:20 | |
| *** nzeer has joined #openstack-keystone | 17:20 | |
| breton | When I wrote my patch, I decided that it doesn't worth the pain. | 17:21 |
| dstanek | breton: which patch? | 17:21 |
| breton | dstanek: https://review.openstack.org/#/c/188796/ | 17:22 |
| breton | dstanek: patchsets 1 and 2 | 17:23 |
| dstanek | ah, i see | 17:23 |
| dstanek | yeah i agree that this may not be worth it right now | 17:23 |
| breton | if ever | 17:23 |
| janonymous | ohh.. i see , is thr any workaround for this...? | 17:24 |
| *** lhcheng has joined #openstack-keystone | 17:24 | |
| *** ChanServ sets mode: +v lhcheng | 17:24 | |
| janonymous | or shoul i keep it on hold for some time.. | 17:24 |
| dramakri | bknudson: ping.. when you get a chance, can you please take a look at https://review.openstack.org/#/c/196942/ ? I have addressed your comments. Thanks! | 17:24 |
| breton | I know! | 17:24 |
| breton | make a comment there: | 17:24 |
| *** lhcheng has quit IRC | 17:24 | |
| *** piyanai has quit IRC | 17:24 | |
| breton | "Do not try to remove it. Developers, who already tried and failed: 2. Increase the number when you do." | 17:25 |
| *** lhcheng has joined #openstack-keystone | 17:25 | |
| *** ChanServ sets mode: +v lhcheng | 17:25 | |
| *** mylu has joined #openstack-keystone | 17:25 | |
| bknudson | dramakri: thanks. I'll add it to my list | 17:27 |
| dramakri | bknudson: sure, thanks! | 17:27 |
| *** r-daneel has joined #openstack-keystone | 17:28 | |
| *** ankita_w_ has joined #openstack-keystone | 17:31 | |
| *** piyanai has joined #openstack-keystone | 17:33 | |
| *** ankita_wagh has quit IRC | 17:34 | |
| *** e0ne has joined #openstack-keystone | 17:35 | |
| *** Zanatoz has joined #openstack-keystone | 17:37 | |
| *** ankita_wagh has joined #openstack-keystone | 17:38 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystonemiddleware: Dynamic Policies Fetch and Cache https://review.openstack.org/188561 | 17:40 |
| samueldmq | lhcheng: add unit tests, as you requested :) | 17:40 |
| *** ankita_w_ has quit IRC | 17:41 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: clean up TokenAPITests https://review.openstack.org/203250 | 17:42 |
| lhcheng | samueldmq: thanks for adding that | 17:42 |
| *** mylu has quit IRC | 17:42 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystoneauth: Expose bug in AccessToken https://review.openstack.org/205094 | 17:42 |
| *** TheIntern has joined #openstack-keystone | 17:43 | |
| lhcheng | samueldmq: I am wondering if we should the "Dynamic" in the commit msg. It seems like it is really just policy fetch and cache. | 17:43 |
| lhcheng | *should remove | 17:43 |
| *** mylu has joined #openstack-keystone | 17:44 | |
| samueldmq | lhcheng: hmm, look at henrynash's comment at https://review.openstack.org/#/c/134655/, you may agree with him | 17:45 |
| dstanek | lhcheng: i agree... in one of the dynamic policy reviews (i think a spec), dolphm mentioned that this isn't dynamic, but rather consolidated | 17:45 |
| samueldmq | lhcheng: actually I just saw there are comments from dstanek and dolphm tehre as well :) | 17:45 |
| *** marzif has quit IRC | 17:45 | |
| lhcheng | We have a system similar that does policy management, I am going to look it up what feature/config might be helpful for us. | 17:45 |
| *** dims has joined #openstack-keystone | 17:45 | |
| dstanek | samueldmq: that's the one | 17:45 |
| samueldmq | ok I am very open, if you guys think the terminology have to be changed I will be happy to change that | 17:45 |
| lhcheng | samueldmq: we also have a requirement for this centralized policy, will try to find more info and provide more feedback in the review. | 17:46 |
| samueldmq | lhcheng: nice please do o/ | 17:47 |
| samueldmq | dstanek: lhcheng henrynash are you ok with dolphm's suggested terminology: 'centralized policy'? | 17:47 |
| lhcheng | dstanek: yeah.. "dynamic" sounds like it changes on runtime, or have some self managing algorithm :) | 17:47 |
| dstanek | ++ | 17:48 |
| *** rletrocquer has quit IRC | 17:48 | |
| ayoung | samueldmq, did you see dolphm 's comments on the Spec for the SFE? Those need to be answered, or the extension is going to be turned down. | 17:48 |
| lhcheng | samueldmq: Yeah, I'll be cool with that. The feature is just specific for fetching anyway. | 17:48 |
| *** mylu has quit IRC | 17:48 | |
| samueldmq | ayoung: will look | 17:48 |
| openstackgerrit | Deepti Ramakrishna proposed openstack/keystone: Reuse token_ref fetched in AuthContextMiddleware. https://review.openstack.org/190863 | 17:49 |
| samueldmq | ayoung: this spec https://review.openstack.org/#/c/134655/9/specs/backlog/dynamic-policies-fetch-cache.rst | 17:49 |
| samueldmq | ? | 17:49 |
| *** mylu has joined #openstack-keystone | 17:50 | |
| rodrigods | morganfainberg, ping... is there a release planned for keystoneauth? (k2k support in horizon is waiting for it), otherwise we can do as marekd suggested yesterday and add k2kauthplugin in keystoneclient | 17:50 |
| samueldmq | ayoung: ok so we're going to call it 'centralized policy' | 17:50 |
| samueldmq | ayoung: sounds good ? | 17:50 |
| morganfainberg | rodrigods: we need to remoce | 17:50 |
| *** e0ne has quit IRC | 17:51 | |
| morganfainberg | Remove oslo.config and land 2-3 more patches before we can do 1.x | 17:51 |
| *** janonymous has quit IRC | 17:51 | |
| morganfainberg | Unfortunately, this needs jamielennox and i havent been able to get time to figure that out | 17:51 |
| rodrigods | morganfainberg, how can I help? | 17:51 |
| morganfainberg | rodrigods: figure out how to remove oslo.config and/or work with jamielennox on that front | 17:52 |
| dramakri | henrynash: ping.. removed the comments as per your suggestion. Please take a look at it - https://review.openstack.org/#/c/190863/ ? Thanks! | 17:52 |
| rodrigods | morganfainberg, great, will ping him later today | 17:53 |
| rodrigods | morganfainberg, added a topic in next week meeting anyway | 17:53 |
| morganfainberg | the big blocker is oslo.config removal | 17:53 |
| *** piyanai has quit IRC | 17:53 | |
| morganfainberg | we can't have oslo dependencies in keystoneauth | 17:53 |
| morganfainberg | or at least we can't have them as "default" dependencies. | 17:53 |
| rodrigods | I see | 17:54 |
| *** doug-fish has joined #openstack-keystone | 17:54 | |
| *** zzzeek has quit IRC | 17:55 | |
| rodrigods | doug-fish, ^ http://paste.openstack.org/show/404442/ | 17:55 |
| *** zzzeek has joined #openstack-keystone | 17:55 | |
| doug-fish | thx! | 17:56 |
| samueldmq | btw, I am feeling so good to see all those -1s on that spec, let's improve it o/ | 17:56 |
| *** snapdey has quit IRC | 18:03 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystoneauth: Expose bug in AccessToken https://review.openstack.org/205094 | 18:05 |
| *** snapdey has joined #openstack-keystone | 18:06 | |
| amakarov | geoffarnold, greetings! Do you develop a congress service? | 18:14 |
| amakarov | s/a/the/ | 18:15 |
| *** yottatsa has quit IRC | 18:16 | |
| doug-fish | rodrigods: so just to review on k2k - next step is to follow up with jamielennox to sort out how soon keystoneauth can be brought up to speed/what work remains on getting olso dependency removed and a couple of other needed patches - is that right? | 18:16 |
| geoffarnold | amakarov We're not using Congress right now. Ideally we'd like OpenStack to move to a comprehensive HMT-aware quota system, and that should probably be built on Congress | 18:16 |
| rodrigods | doug-fish, yes, otherwise I'll submit the k2k plugin to keystoneclient | 18:16 |
| openstackgerrit | Boris Bobrov proposed openstack/keystoneauth: Fix decorators of properties in AccessToken https://review.openstack.org/205209 | 18:17 |
| doug-fish | rodrigods: perfect! thanks for being on top of this! | 18:17 |
| rodrigods | doug-fish, np, hope to have eveything working soon | 18:17 |
| *** yottatsa has joined #openstack-keystone | 18:18 | |
| amakarov | geoffarnold, aha... I have a question: there are some Horizon folks sitting not far from me interesting in development of a policy editor. They've asked Horizon team about it and were told that Congress already does the policy editing. Is it so, or I can encourage them to create the feature? | 18:19 |
| doug-fish | FWIW adding the k2k plugin to keystone client is an easier path to getting Horizon working - otherwise there are a number of other changes needed for django_openstack_auth to use keystoneauth | 18:19 |
| geoffarnold | amakarov Not sure how to move this kind of cross-functional multiple release effort forward. One approach would be to have a couple of the user communities (large scale deployments, for instance) to put together a set of requirements, then use the ProductWG to move it forward as part of a coordinated roadmap | 18:19 |
| *** mylu has quit IRC | 18:19 | |
| geoffarnold | amakarov I'm not enthusiastic about "generic policy" and "generic policy editors". I prefer a domain-specific approach. DSL FTW | 18:20 |
| geoffarnold | I like a generic engine underneath, but keep the UX close to the use case | 18:21 |
| *** mylu has joined #openstack-keystone | 18:22 | |
| amakarov | geoffarnold, I presume iterative approach can help: they can start working on a prototype improving it according to a feedback | 18:22 |
| geoffarnold | Sure. But use cases are needed to drive the x-project aspects, amakarov | 18:23 |
| amakarov | geoffarnold, their concern is that there may be an overlapping feature that already performs everything :) | 18:23 |
| *** doug-fish has quit IRC | 18:24 | |
| geoffarnold | amakarov Just because chisels exist doesn't remove the need for scalpels! | 18:24 |
| pauloewerton | doug-fish, +1. having a little test nightmare in d-0-a right now ;-) | 18:25 |
| samueldmq | ayoung: quota subject.. suppose a user having project_admin (noninherited) and quota_admin (inherited) in the same project | 18:25 |
| amakarov | geoffarnold, :) | 18:25 |
| samueldmq | ayoung: requiring a token in specific scope for the project one to control quota may make sense this way ^ | 18:25 |
| amakarov | geoffarnold, so what would you suggest about it? | 18:25 |
| ayoung | samueldmq, its an "or" and it depends on what would be assigned on the token iteslf | 18:26 |
| *** doug-fish has joined #openstack-keystone | 18:26 | |
| ayoung | tokens should always be specific to scope | 18:26 |
| ayoung | but...nova might not be able to handle this...without HMT.... | 18:26 |
| geoffarnold | amakarov is there a BP or set of user stories that we can start with? | 18:26 |
| *** tsufiev has joined #openstack-keystone | 18:27 | |
| geoffarnold | amakarov Also we should loop in Congress and Quota experts... (I'm not - I'm an operator who wants to use HMT for federation, and who needs policy-based quotas and stuff) | 18:28 |
| amakarov | geoffarnold, no, it's just an idea for now. I need to validate if first to understand the need | 18:28 |
| samueldmq | ayoung: if we require one to have quota_admin in the project he's trying to change quota, the current policy enforcement works pretty fine | 18:28 |
| geoffarnold | amakarov Sounds good. I've got to go to a meeting now; let's follow up in email: geoff@geoffarnold.com | 18:29 |
| *** hrou has quit IRC | 18:30 | |
| samueldmq | dolphm: dstanek would you suggest to send an email to operators list asking for feedback on this 'centralized policy' delivery ? | 18:30 |
| *** hrou has joined #openstack-keystone | 18:30 | |
| ayoung | samueldmq, yeah. It works fine, excpet that it makes no sense. But, hey. Sure. | 18:33 |
| samueldmq | ayoung: well .. I think we should listen from nova/cinder guys on that alternative | 18:34 |
| samueldmq | ayoung: since that changes very little of the current mechanism | 18:34 |
| ayoung | samueldmq, so, if the role is on the project, then, sure, you can add/edit quota for that proejct | 18:35 |
| ayoung | lets see what they say on the ML | 18:35 |
| samueldmq | ayoung: yes, the quota_admin role | 18:35 |
| samueldmq | ayoung: on a project would grant you permission to hit the quota of that project | 18:35 |
| samueldmq | ayoung: that's kind of Melanie proposed in her message :) | 18:37 |
| *** ayoung has quit IRC | 18:40 | |
| *** geoffarnold has quit IRC | 18:42 | |
| *** e0ne has joined #openstack-keystone | 18:42 | |
| *** browne has quit IRC | 18:52 | |
| *** bitblt has joined #openstack-keystone | 18:55 | |
| *** davi8784 has joined #openstack-keystone | 18:57 | |
| *** snapdey has quit IRC | 18:57 | |
| *** bitblt has quit IRC | 18:58 | |
| *** TheIntern has quit IRC | 18:59 | |
| *** piyanai has joined #openstack-keystone | 19:01 | |
| *** jaosorior has quit IRC | 19:06 | |
| *** mylu has quit IRC | 19:08 | |
| *** Guest24740 has quit IRC | 19:10 | |
| *** mylu has joined #openstack-keystone | 19:10 | |
| *** diazjf has quit IRC | 19:11 | |
| *** jsavak has quit IRC | 19:12 | |
| *** jsavak has joined #openstack-keystone | 19:13 | |
| *** davi8784 has quit IRC | 19:17 | |
| *** lhcheng is now known as lhcheng_away | 19:20 | |
| *** amirosh has joined #openstack-keystone | 19:21 | |
| *** ajayaa has quit IRC | 19:22 | |
| amirosh | Hello, need help to understand how public_endpoint & admin_endpoint settings work in WSGI env, I assume both apps (in V2) are on the same port | 19:24 |
| *** petertr7_away is now known as petertr7 | 19:24 | |
| *** mylu has quit IRC | 19:24 | |
| bknudson | public_endpoint and admin_endpoint are put into the links in the responses. | 19:26 |
| *** mylu has joined #openstack-keystone | 19:27 | |
| amirosh | right, that's why I'm asking - "Keystone API GET 5000/v3 returns wrong endpoint URL in response body" https://bugs.launchpad.net/keystone/+bug/1381961 | 19:28 |
| openstack | Launchpad bug 1381961 in Keystone "Keystone API GET 5000/v3 returns wrong endpoint URL in response body" [Low,In progress] - Assigned to Alexey Miroshkin (amirosh) | 19:28 |
| *** jsavak has quit IRC | 19:28 | |
| *** jsavak has joined #openstack-keystone | 19:28 | |
| openstackgerrit | Merged openstack/keystoneauth-saml2: py34 not py33 is tested and supported https://review.openstack.org/201091 | 19:29 |
| amirosh | In V3 we have only one app now, so In case of eventlet I can check port and decide if it was request to admin or main app to return the right endpoint | 19:29 |
| bknudson | I think that problem happens when you're running in eventlet | 19:29 |
| bknudson | if you're running in wsgi then the applications are invoked independently so they know if they're admin or public | 19:30 |
| samueldmq | morganfainberg: in HTTP, max-age is applied on the time the distant server generated the response (Date header) instead of local time | 19:30 |
| samueldmq | morganfainberg: otherwise the cache_timeout would be 'misunderstood' because of the time the response takes to arrive (time spent in the web) | 19:31 |
| samueldmq | does that make sense ? | 19:31 |
| amirosh | bknudson: there is only one app for V3 (public), so it must be smart enough | 19:31 |
| samueldmq | morganfainberg: actually I am supposed to be asking .. and I did'nt put any interrogation markers there :) | 19:31 |
| morganfainberg | max-age is # of seconds | 19:32 |
| morganfainberg | iirc | 19:32 |
| samueldmq | morganfainberg: yes it is | 19:32 |
| morganfainberg | so we don't care what datestamp it is applied to | 19:32 |
| dstanek | morganfainberg: yes it is | 19:32 |
| samueldmq | morganfainberg: in our case we should | 19:32 |
| morganfainberg | no[e | 19:32 |
| morganfainberg | nope* | 19:33 |
| samueldmq | take the following example | 19:33 |
| morganfainberg | we still only care about a fixed offset | 19:33 |
| samueldmq | yes it should, listen :) | 19:33 |
| morganfainberg | what is the difference between localtime + 120s vs remote_time + 120? | 19:33 |
| samueldmq | you are the server, you generate the policy and say me it's valid for 30 seconds | 19:33 |
| morganfainberg | they are still +120 | 19:33 |
| samueldmq | the response took 10 seconds to arrive to me | 19:33 |
| bknudson | amirosh: v3 is handled on both public and admin. | 19:33 |
| samueldmq | I'll be using that for 10 seconds more than you expect me to be using | 19:34 |
| samueldmq | morganfainberg: ^ | 19:34 |
| dstanek | samueldmq: why does that matter? | 19:34 |
| htruta | bknudson: in the mood for a +2 https://review.openstack.org/#/c/167613/3 ? | 19:34 |
| samueldmq | morganfainberg: the difference is the time the response spend in the network | 19:34 |
| *** topol has joined #openstack-keystone | 19:34 | |
| *** ChanServ sets mode: +v topol | 19:34 | |
| dstanek | samueldmq: max-age is basically saying "hold on to this for the next X seconds" | 19:34 |
| morganfainberg | network speed should be assumed to be near 0 | 19:34 |
| morganfainberg | at a certain point you're overthinking it ;) | 19:35 |
| *** snapdey has joined #openstack-keystone | 19:35 | |
| morganfainberg | if we are distributing policy with a 10s latency [ or anything ], my answer is "uhh... fix your network" | 19:35 |
| dstanek | even if it were not 0 we should assume the cache lifetimes are somewhat fluid and can never be exact | 19:35 |
| samueldmq | morganfainberg: hmm .. dunno | 19:35 |
| samueldmq | morganfainberg: that was just an example .. | 19:35 |
| morganfainberg | dstanek: I figure within a avg of 1s should be more than enough fluidity within an openstack deployment | 19:36 |
| morganfainberg | and under 1s, i call it "0" for purposes of cache | 19:36 |
| morganfainberg | since... | 19:36 |
| samueldmq | dstanek: but if I applied the max-age to the server time, that would be exact, wouldn't it? | 19:36 |
| morganfainberg | cache has no resolution below 0 in these cases | 19:36 |
| morganfainberg | erm below 1 | 19:36 |
| dstanek | samueldmq: no - you are telling the client to hold on to something for X seconds | 19:36 |
| samueldmq | what if I defined Expires instead of max-age | 19:37 |
| dstanek | samueldmq: also it's important to remember that clients sometimes use the cached values slight longer than you say anyway | 19:37 |
| samueldmq | that's basically my point | 19:37 |
| morganfainberg | dstanek: in this case we control both sides | 19:37 |
| morganfainberg | so we don't need to worry too much on over-aggressive caching | 19:37 |
| samueldmq | morganfainberg: ++ | 19:38 |
| morganfainberg | and iirc expires is the "old" way to do things | 19:38 |
| amirosh | bknudson: conceptually public and admin in V3 are identical, but technically there is only one app (public), but we need to return correct endpoint url in any case https://review.openstack.org/#/c/118522/ | 19:38 |
| morganfainberg | if we can assume we are within a 1s window of network transit [a fair assertion for an openstack deployment, over 1s is going to be other types of wonky] | 19:38 |
| samueldmq | morganfainberg: dstanek k if we can assume network time to be 0 (<1s) I agree completely with you then | 19:38 |
| morganfainberg | I think we're generally safe to assume network transit is effectively 0 | 19:38 |
| bknudson | amirosh: eventlet only has one app but when running in apache you get separate apps. | 19:39 |
| samueldmq | I thought some installations could have some issues and take longer than that | 19:39 |
| morganfainberg | and a spike above 1s isn't going to realllllly break things | 19:39 |
| *** topol has quit IRC | 19:39 | |
| morganfainberg | but consistent over 1s, i'm going to be shocked that openstack is really working | 19:39 |
| dstanek | samueldmq: i wouldn't worry about that | 19:39 |
| samueldmq | morganfainberg: that would give inconsistent results for calls in a service behind a HAProxy | 19:39 |
| samueldmq | morganfainberg: in the case of spikes over 1 s | 19:39 |
| morganfainberg | samueldmq: this follows with rule 1 of optimization: don't | 19:40 |
| morganfainberg | if the whole network is spiking over 1s latency, then so are user requests and it should normalize out | 19:40 |
| dstanek | samueldmq: the real question is how are you calculating the max-age? expiry_time - now? | 19:40 |
| morganfainberg | dstanek: that was the thought (on the server side) | 19:41 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 19:41 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 19:41 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change project name constraints https://review.openstack.org/158372 | 19:41 |
| samueldmq | dstanek: L36 https://review.openstack.org/#/c/188561/5/keystonemiddleware/auth_token/_policy.py | 19:41 |
| amirosh | bknudson: great, that's what I'm asking, will check details, appreciate any doc references, thanks! | 19:41 |
| samueldmq | dstanek: btw we don't need the policy_cache_time as you noticed in the spec .. :) | 19:41 |
| dstanek | samueldmq: that's the client side right? _cache_timeout will come from the server's max-age? | 19:43 |
| samueldmq | morganfainberg: dstanek so .... I am trying to overthink the things to do the better I/we can, so you can prune my thoughts where thinking too much isn't a necessary optimization | 19:43 |
| bknudson | amirosh: https://review.openstack.org/#/c/118522/ just made the code less confusing, didn't actually fix eventlet server to work right. | 19:43 |
| samueldmq | if that makes sense :) | 19:43 |
| bknudson | the pipelines need to communicate somehow and there's no really good way to do it. | 19:43 |
| samueldmq | dstanek: yes that will ! that's in the server spec https://review.openstack.org/#/c/197980/ | 19:43 |
| dstanek | samueldmq: i'll take a look at these reviews again then | 19:44 |
| samueldmq | dstanek: (might need an update after the client one, which is what I am doing right now, after dolph and you 'throttling' it) | 19:45 |
| amirosh | bknudson: yes, I understand, there was always only one app | 19:45 |
| samueldmq | dstanek: I'll be sending a new version of the middleware spec in a couple of minutes ... | 19:45 |
| samueldmq | dstanek: thanks! | 19:45 |
| dstanek | samueldmq: cool....i'm trying to get some unicodey things worked out anyway | 19:45 |
| samueldmq | dstanek: ++ | 19:46 |
| dstanek | morganfainberg: our str -> bytes -> str -> bytes -> bytes is driving me crazy | 19:46 |
| morganfainberg | dstanek: can we get a bytes->unicode->str->unicode->bytes->bytes->bytes->burger->bytes? | 19:47 |
| *** browne has joined #openstack-keystone | 19:47 | |
| morganfainberg | and when that fails, cast it all to an int and call it done | 19:47 |
| *** ayoung has joined #openstack-keystone | 19:47 | |
| *** ChanServ sets mode: +v ayoung | 19:47 | |
| raildo | git loh | 19:48 |
| *** mylu has quit IRC | 19:48 | |
| samueldmq | morganfainberg: ahahahaha | 19:48 |
| dstanek | morganfainberg: i'll create 'def burger' do the the conversions | 19:49 |
| morganfainberg | :) | 19:49 |
| *** topol has joined #openstack-keystone | 19:49 | |
| *** ChanServ sets mode: +v topol | 19:49 | |
| rodrigods | git log ^ raildo | 19:49 |
| *** mylu has joined #openstack-keystone | 19:49 | |
| raildo | rodrigods: ++ :P | 19:49 |
| rodrigods | :w :P | 19:50 |
| dstanek | raildo: i do have a 'git lol' alias for git blame | 19:50 |
| rodrigods | dsirrine, lol | 19:50 |
| raildo | dstanek: hahaha | 19:50 |
| rodrigods | oops | 19:50 |
| rodrigods | dstanek, | 19:50 |
| ayoung | morganfainberg, so, I have the absolute basics of a WIP patch. | 19:51 |
| dstanek | i also have it aliased to 'git wtf' - do depending on my mood i get to choose | 19:51 |
| ayoung | for revoke events, but I cannot spend the time to bring it to production right now | 19:51 |
| dstanek | ayoung: post it! | 19:51 |
| raildo | dstanek: we can suggest more options to git | 19:52 |
| openstackgerrit | ayoung proposed openstack/keystone: Revoke Events in list https://review.openstack.org/205266 | 19:52 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 19:52 |
| *** geoffarnold has joined #openstack-keystone | 19:52 | |
| ayoung | dstanek, morganfainberg mfisch feel free to take it and run with it | 19:53 |
| ayoung | I'll be happy to review any further changes. | 19:54 |
| *** diazjf has joined #openstack-keystone | 19:54 | |
| mfisch | ayoung: thanks, I'm about to leave town for a trip but I can follow-along | 19:54 |
| ayoung | mfisch, I thought you were actually going to code this. | 19:55 |
| *** hockeynut_afk has joined #openstack-keystone | 19:55 | |
| ayoung | samueldmq, so, what we were saying about "all permissions come from root" is true of quotas as well, I think. All quota's should come from root, too. quota really is a delegation, just like a role assignment | 19:56 |
| *** Zanatoz has quit IRC | 19:56 | |
| *** dims has quit IRC | 19:58 | |
| *** geoffarnold has quit IRC | 19:58 | |
| samueldmq | ayoung: if you use role delegation mechanism (inherited assignment?) for quota operation, you are kind of delegating the quota management, aren't you ? | 19:59 |
| samueldmq | ayoung: for that living in the policy (checking if you are scoped to a parent project) we'd need new checks, etc | 19:59 |
| *** piyanai has quit IRC | 19:59 | |
| samueldmq | ayoung: I am not against, but we should consider the available alternatives | 19:59 |
| *** amirosh has quit IRC | 20:01 | |
| ayoung | samueldmq, setting the quota is a delegation | 20:02 |
| ayoung | no quote means nothing delegated | 20:02 |
| ayoung | samueldmq, just, the quota is delegated *to* the project | 20:03 |
| openstackgerrit | Merged openstack/python-keystoneclient: Add get_token_data to token CRUD https://review.openstack.org/194484 | 20:04 |
| ayoung | samueldmq, I'm not really suggesting that we do it, just that...well, it makes sense | 20:04 |
| *** e0ne has quit IRC | 20:04 | |
| *** mylu has quit IRC | 20:05 | |
| samueldmq | ayoung: so you think it does make sense to update a quota of a child project with a token scoped to one of its parents | 20:05 |
| samueldmq | ayoung: that makes sense to me too, as the other option does as well :) | 20:05 |
| *** amakarov is now known as amakarov_away | 20:06 | |
| *** mylu has joined #openstack-keystone | 20:07 | |
| mfisch | ayoung: I plan on sitting on the beach with a beer in my hand for 2 solid weeks, if I don't think at all about openstack it will be a good trip | 20:10 |
| ayoung | mfisch, so when you said "... but I can follow-along" I should have mentally added "but you won't" | 20:11 |
| mfisch | lol, I can't like I'll likely be doing reviews and what not while I'm gone.. | 20:12 |
| morganfainberg | mfisch: you should totally unplug from the ML and irc for the trip | 20:12 |
| morganfainberg | just sayin' | 20:12 |
| ayoung | samueldmq, I think that setting the quote of a child should be done using the token of exactly its parent, no higher, no lower | 20:12 |
| morganfainberg | ;) | 20:12 |
| openstackgerrit | Ian Cordasco proposed openstack/python-keystoneclient: Set reasonable defaults for TCP Keep-Alive https://review.openstack.org/204741 | 20:12 |
| morganfainberg | mfisch: otherwise you're clearly doing vacation wrong | 20:13 |
| mfisch | true | 20:13 |
| morganfainberg | mfisch: beer and beach - it's a good start | 20:13 |
| * morganfainberg is planning vacation post summit | 20:13 | |
| morganfainberg | and you know I'll be disappearing for $vacation_time | 20:13 |
| mfisch | I skipped last summer b/c I was in the process of selling my house | 20:13 |
| openstackgerrit | Merged openstack/python-keystoneclient: Unit tests catch deprecated function usage https://review.openstack.org/189145 | 20:14 |
| samueldmq | ayoung: yes, that makes sense | 20:15 |
| ayoung | samueldmq, so, this was floated in the past. The reasons why quota are not in Keystone are: | 20:15 |
| *** yottatsa has quit IRC | 20:15 | |
| ayoung | 1. It is based on values that are specific to the services | 20:15 |
| ayoung | 2. quota enforcement can't be done by keystone | 20:16 |
| ayoung | 3. quota distribution would be strange. You really would not want to put it in the token ,and notifications would be messy, too | 20:16 |
| ayoung | now...per user quotas, maybe those could go in a token, but quotas tend to be per project | 20:17 |
| samueldmq | ayoung: if we only allow the immediate parent to update | 20:17 |
| samueldmq | ayoung: the issue with knowing the hierarhcy would be solved by including the immediate children in the token | 20:17 |
| *** petertr7 is now known as petertr7_away | 20:17 | |
| ayoung | samueldmq, the problem is that existing distributions don't have HMT | 20:18 |
| ayoung | so there are no "parent projects" | 20:18 |
| ayoung | and ruight now, nova does not know about domains | 20:18 |
| openstackgerrit | Ian Cordasco proposed openstack/keystoneauth: Set reasonable defaults for TCP Keep-Alive https://review.openstack.org/205276 | 20:19 |
| samueldmq | ayoung: I think we shouldn't care about existing distributions at this point ... they shouldn't be using hierarchical quotas if they don't have HMT | 20:19 |
| samueldmq | ayoung: and nova won't need to know about domains once we have reseller, that will be just projects, right ? | 20:20 |
| *** petertr7_away is now known as petertr7 | 20:20 | |
| ayoung | samueldmq, call it a proejct or a domain, but in an HMT setup, you always need to have aparent if you are setting a quota | 20:21 |
| stevemar | bknudson: thanks for the infra fix | 20:22 |
| bknudson | stevemar: no problem. | 20:22 |
| samueldmq | ayoung: yes, so including the immediate children solves the problem, that defines the project which you can define the quota (in the approach you described) | 20:22 |
| samueldmq | ayoung: (including in the token) | 20:22 |
| ayoung | samueldmq, not gonna do that | 20:22 |
| ayoung | samueldmq, they should reco0rd that info in Nova | 20:22 |
| ayoung | policy should be target.parent_proejhct_id = %{project_id} | 20:23 |
| samueldmq | ayoung: makes sene | 20:24 |
| samueldmq | sense yes | 20:24 |
| samueldmq | anyway I think ericksonsantos is the right person to talk about all this quota stuff :) | 20:24 |
| samueldmq | ayoung: I am just having parallel thoughts all the time and sharing :) (I think you know what I mean) | 20:25 |
| samueldmq | hehe | 20:25 |
| raildo | ayoung: since we don't have the parent information in the token, we can't do this in the nova policy | 20:25 |
| ayoung | raildo, its not in the token | 20:26 |
| ayoung | its on the project object | 20:26 |
| ayoung | target is the object fetched from the DB, in this case it is a project | 20:26 |
| raildo | ayoung: right, but we need to put this information in the nova context, right? | 20:26 |
| *** piyanai has joined #openstack-keystone | 20:27 | |
| ayoung | raildo, it should be there already, but maybe their project object does not have parent ID? | 20:28 |
| ericksonsantos | ayoung, if this info is already in the token, we won't need to make calls to keystone in order to know hierarchy info | 20:29 |
| openstackgerrit | sonu proposed openstack/keystone: Replacing print with print() to provide py 2/3 compatibility https://review.openstack.org/205281 | 20:29 |
| ayoung | ericksonsantos, it does not belong in the token | 20:29 |
| ayoung | ericksonsantos, the token does not care about nova | 20:30 |
| ericksonsantos | ayoung, I know, but I think it should be | 20:30 |
| ayoung | the token is above it all, aloof, unmoving | 20:30 |
| *** fangzhou has joined #openstack-keystone | 20:30 | |
| ayoung | ericksonsantos, seriously, though the hierarchy is outside the token contract | 20:30 |
| ayoung | a tokne is scoped to a proejct. THe fact that is a parent/child is irrelevant | 20:31 |
| ericksonsantos | ayoung, hmm.. | 20:31 |
| ayoung | ericksonsantos, now...I had myslef 1/2 convince a moment ago that quotas should go into Keystone. BUt I recovered | 20:31 |
| raildo | haha | 20:31 |
| ericksonsantos | ayoung, lol | 20:32 |
| *** richm has quit IRC | 20:33 | |
| ayoung | ericksonsantos, I could see a "resource_type" field on the service, with a units measurement, and then a quota would be set by that...and if you request a token scoped to an endpoint, you would get the quota appropraite for the service you are trying to call on | 20:34 |
| ayoung | then the quota value would be just another attribute for a policy check. | 20:35 |
| *** jaosorior has joined #openstack-keystone | 20:35 | |
| ayoung | at this point, morganfainberg is contemplating taking out a contract on my life to stop this type of mindless prattling | 20:36 |
| morganfainberg | nah, i can hold out until october | 20:36 |
| morganfainberg | :P | 20:37 |
| ericksonsantos | ayoung, haha | 20:37 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Centralized Policies Fetch and Cache https://review.openstack.org/134655 | 20:38 |
| ericksonsantos | ayoung, I'm still trying to understand what you've said | 20:38 |
| samueldmq | dstanek: dolphm lhcheng_away ^ just sent a new version, there is a *massive* change in that spec, thanks for your review | 20:39 |
| *** snapdey has quit IRC | 20:39 | |
| *** richm has joined #openstack-keystone | 20:39 | |
| ayoung | ericksonsantos, http://www.goodreads.com/quotes/9347-i-know-that-you-believe-you-understand-what-you-think | 20:39 |
| ericksonsantos | ayoung, hahahah | 20:40 |
| dolphm | samueldmq: thanks, i'll give it another pass. is there an email out to operators? | 20:40 |
| samueldmq | dolphm: I will send it, just finished updating that spec .. too much things to fix :) | 20:40 |
| samueldmq | dolphm: btw I will be thinking more about the security aspects and enumerating potential attack vectors in the next version | 20:40 |
| samueldmq | dolphm: I didn't want to take longer to send a new patch set | 20:40 |
| *** snapdey has joined #openstack-keystone | 20:41 | |
| *** markvoelker has quit IRC | 20:42 | |
| ericksonsantos | ayoung, I thought tokens could just be scoped to projects and domains | 20:42 |
| samueldmq | dolphm: morganfainberg ayoung I will draft the email message to operators and ask you guys to validate it | 20:43 |
| *** e0ne has joined #openstack-keystone | 20:51 | |
| *** piyanai has quit IRC | 20:53 | |
| *** e0ne has quit IRC | 20:55 | |
| *** lhcheng_away is now known as lhcheng | 20:56 | |
| *** zzzeek has quit IRC | 21:01 | |
| *** arun_kant has joined #openstack-keystone | 21:02 | |
| *** arunkant_ has quit IRC | 21:02 | |
| *** zzzeek has joined #openstack-keystone | 21:04 | |
| *** snapdey has quit IRC | 21:06 | |
| *** lhcheng has quit IRC | 21:10 | |
| *** mylu has quit IRC | 21:10 | |
| *** petertr7 is now known as petertr7_away | 21:11 | |
| samueldmq | dolphm: morganfainberg ayoung this is the message I am thinking now .. https://etherpad.openstack.org/p/centralized-policy-delivery-operators | 21:12 |
| samueldmq | let me know your thoughts on it | 21:12 |
| *** e0ne has joined #openstack-keystone | 21:12 | |
| pauloewerton | hi there! can anyone confirm whether this is indeed a bug in keystoneauth: https://review.openstack.org/#/c/204253/? | 21:12 |
| dolphm | samueldmq: s/for already in place mechanisms/for existing mechanisms/ | 21:13 |
| samueldmq | dolphm: done | 21:13 |
| dolphm | samueldmq: s/on that features/on this feature/ | 21:13 |
| samueldmq | dolphm: yes this one was very bad English, thanks | 21:14 |
| dolphm | samueldmq: s/distribution of the Centralized Policies/centralized distribution of policies/ | 21:14 |
| *** lhcheng has joined #openstack-keystone | 21:14 | |
| *** ChanServ sets mode: +v lhcheng | 21:14 | |
| *** lhcheng has quit IRC | 21:15 | |
| *** lhcheng has joined #openstack-keystone | 21:15 | |
| *** ChanServ sets mode: +v lhcheng | 21:15 | |
| samueldmq | dolphm: done, btw feel free to add something if you think appropriate/needed | 21:17 |
| dolphm | samueldmq: i'd suggest adding a more specific question to inspire feedback, rather than just "let me know your thoughts." for example, ask if deployers would be interested in managing policies via an API, rather than strictly through their configuration management systems. | 21:19 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Clarify project hierarchy and parent usage within the API https://review.openstack.org/200624 | 21:19 |
| *** snapdey has joined #openstack-keystone | 21:20 | |
| dolphm | samueldmq: you'll be more likely to get responses that way | 21:20 |
| *** mgarza_ has joined #openstack-keystone | 21:20 | |
| *** dguerri is now known as dguerri` | 21:21 | |
| dolphm | samueldmq: also "centralized distribution" is a fairly common and well understood term... "centralized policy fetch and cache" would read much more naturally as "centralized policy distribution." caching should be assumed, IMO, but you can include it in the body if you think anyone will be concerned about it being missing | 21:22 |
| ayoung | samueldmq, um.....hmmmm | 21:24 |
| ayoung | I don't think so....the centralized is only part of the the overall approach, just the first step, and that does not explain what we are trying to do. I think if we only got that much through, the answer would be "don't do it" | 21:24 |
| ayoung | centralized by itself does not get us much, and I would not suggest it without hierarchical roles, database management of policy, and so on. | 21:25 |
| ayoung | just, you can't do any of that other stuff withou the distribution | 21:26 |
| *** ninag has quit IRC | 21:28 | |
| *** r-daneel has quit IRC | 21:30 | |
| *** bknudson has quit IRC | 21:31 | |
| *** raildo has quit IRC | 21:32 | |
| *** snapdey has quit IRC | 21:33 | |
| *** zzzeek has quit IRC | 21:33 | |
| ayoung | samueldmq, I think the response you are going to get from that email is "why are you trying to replace puppet" or ansible | 21:33 |
| *** zzzeek has joined #openstack-keystone | 21:34 | |
| samueldmq | dolphm: ok I will add more specific questions rather than asking for a general feedback | 21:34 |
| dolphm | samueldmq: you can ask for general feedback as well, but direct questions will be more useful | 21:35 |
| samueldmq | ayoung: makes sense, I will add something to say that's the base for the work that will be coming next | 21:35 |
| samueldmq | dolphm: ++ | 21:35 |
| *** snapdey has joined #openstack-keystone | 21:35 | |
| *** zzzeek has quit IRC | 21:35 | |
| dolphm | samueldmq: as ayoung just suggested, you could also allude to the additional features this opens this door for | 21:35 |
| *** hakimo has joined #openstack-keystone | 21:36 | |
| *** hakimo_ has quit IRC | 21:36 | |
| *** e0ne has quit IRC | 21:38 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:43 | |
| *** TheIntern has joined #openstack-keystone | 21:44 | |
| *** pauloewerton has quit IRC | 21:46 | |
| *** ankita_w_ has joined #openstack-keystone | 21:46 | |
| *** ankita_wagh has quit IRC | 21:49 | |
| samueldmq | dolphm: ayoung I just clarified/added the points you asked | 21:53 |
| ayoung | samueldmq, people will still focus on the distribution of it. Its why this has been so hard to communicate | 21:54 |
| *** thedodd has joined #openstack-keystone | 21:55 | |
| samueldmq | ayoung: for now we are talking about what we propose for this cycle, that is th edistribution | 22:00 |
| samueldmq | ayoung: I think it's clear it opens the door for other features | 22:00 |
| ayoung | samueldmq, I know...beacuse that is all we could get in, because of the development process...and people are now going to suggest we postpone this because.... | 22:00 |
| samueldmq | ayoung: I don't see how we can talk more about the other things if we are proposing that :/ | 22:00 |
| samueldmq | ayoung: no I think we will get it ... we have the other bits already (defining the policy and associating to endpoints) | 22:02 |
| samueldmq | ayoung: we just don't distribute :( | 22:02 |
| samueldmq | ayoung: I really hope people aren't going to postpone this | 22:03 |
| ayoung | samueldmq, at this point, I would not push for a general discussion of it | 22:03 |
| ayoung | its a keystone decision, and I think the best we can do is educate the smaller team about what we are trying to do. The larger discussions need to happen at the summit | 22:04 |
| samueldmq | dstanek: dolphm cc ^ as this was originally proposed by you guys | 22:05 |
| samueldmq | ayoung: I am ok with both, experience/opinion of the cores should decide it | 22:05 |
| *** lhcheng_ has joined #openstack-keystone | 22:07 | |
| *** lhcheng has quit IRC | 22:07 | |
| dolphm | samueldmq: ayoung: without educating deployers on the benefits as early as possible, you're going to face a backlash by introducing extra complexity where both other projects and deployers have previously expressed a strong preference for the existing model: services own their own policy files and the distribution method is trivial | 22:07 |
| *** cloudnull is now known as cloudull_zzz | 22:08 | |
| *** lhcheng_ has quit IRC | 22:08 | |
| *** htruta_ has joined #openstack-keystone | 22:08 | |
| *** lhcheng has joined #openstack-keystone | 22:08 | |
| *** ChanServ sets mode: +v lhcheng | 22:08 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Restrict inherited role assignments to subdomains https://review.openstack.org/164180 | 22:09 |
| ayoung | dolphm, I agree. Just that this one piece is just that; the first step. I had a presentation on dynamic policy at the last summit, as well as a cross project session there. We'll do the same at the next. I do have a presetnation that I gave at the midcycle. I'm just worried that bringing up just the distro piece is going to be counter productive | 22:09 |
| mfisch | lbragstad: dolphm you guys need to fix your bio on the fernet talk right now it just has your name and no pic or bio | 22:10 |
| ayoung | so, if we are going to make this a wider discussion, I'd recommen framing it in that context; not just a bout distributuion, but about giveing policy a logical framework | 22:10 |
| samueldmq | dolphm: ayoung another point is that people may focus only in the distribution, and then postpone it .. but the distribution is just openning the door to other things | 22:10 |
| *** geoffarnold has joined #openstack-keystone | 22:10 | |
| samueldmq | ayoung: yes, actuall that's what I tried to make clear with the text I added there .. | 22:10 |
| samueldmq | ayoung: to make very clear that's more than just distribution | 22:11 |
| samueldmq | "this feature opens the door for other potential features the Keystone team considers for future versions, including: ..." | 22:11 |
| *** hakimo has quit IRC | 22:12 | |
| *** hakimo has joined #openstack-keystone | 22:13 | |
| *** mgarza_ has quit IRC | 22:15 | |
| *** jecarey has quit IRC | 22:16 | |
| *** TheIntern has quit IRC | 22:19 | |
| samueldmq | morganfainberg: henrynash ^^ I'd like to hear your toughts on this as well :) | 22:20 |
| ayoung | samueldmq, if you can get the message clear, please do so. | 22:20 |
| samueldmq | ayoung: the email message clearer? did you see the version that is in there now? | 22:21 |
| samueldmq | ayoung: I can try to improve more that, to make clearer that this is the first step .. | 22:22 |
| *** max_ has joined #openstack-keystone | 22:22 | |
| *** max_ is now known as Guest3220 | 22:22 | |
| *** Guest3220 has quit IRC | 22:23 | |
| *** jsavak has quit IRC | 22:23 | |
| *** maxabidi has joined #openstack-keystone | 22:23 | |
| flwang | ayoung: ping | 22:26 |
| samueldmq | ayoung: will improve in a bit, brb | 22:27 |
| flwang | ayoung: may i know is there any way to create a role which can only access a given service? like swift only | 22:27 |
| *** edmondsw has quit IRC | 22:27 | |
| flwang | or anybody can give me a tip how to create a role which can only access a given service? like swift only or zaqar only, thanks a lot | 22:29 |
| *** nkinder has quit IRC | 22:30 | |
| *** snapdey has quit IRC | 22:31 | |
| *** snapdey has joined #openstack-keystone | 22:34 | |
| *** ankita_w_ has quit IRC | 22:37 | |
| *** maxabidi has quit IRC | 22:37 | |
| *** max_a has joined #openstack-keystone | 22:38 | |
| *** dims has joined #openstack-keystone | 22:39 | |
| htruta_ | hey ayoung (or any other cores) | 22:40 |
| htruta_ | do you feel like reviewing some reseller patches? | 22:40 |
| htruta_ | henrynash is already enjoying | 22:40 |
| *** geoffarnold has quit IRC | 22:41 | |
| *** mkoderer has quit IRC | 22:44 | |
| *** stevemar has quit IRC | 22:46 | |
| *** doug-fish has left #openstack-keystone | 22:50 | |
| *** ankita_wagh has joined #openstack-keystone | 22:51 | |
| *** chlong has quit IRC | 22:52 | |
| *** diazjf has quit IRC | 22:53 | |
| *** david-lyle has quit IRC | 23:02 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 23:03 |
| *** hrou has quit IRC | 23:05 | |
| *** piyanai has joined #openstack-keystone | 23:06 | |
| ayoung | flwang, you can create a role that only swift knows about by editing the policy file | 23:12 |
| ayoung | if you create a role called swiftinator and then in the swift policy file you would put a check role:swiftinator for the API you want it to protext | 23:12 |
| flwang | ayoung: so, I just need to create a role in keystone, and update the policy.json of swfit to let it understand, right? | 23:15 |
| flwang | but meanwhile, should I update all the other policy.json, such as nova, cinder, glance, to ask them don't honour the role? | 23:15 |
| flwang | ayoung: in other words, can I create a role like 'swift_only' and don't have default role 'Member'? not sure if there is any limitation in Keystone to allow a user just has a new role but doesn't have 'Member' or '_member_' | 23:17 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Remove domain table references https://review.openstack.org/165936 | 23:18 |
| *** gyee has joined #openstack-keystone | 23:20 | |
| *** ChanServ sets mode: +v gyee | 23:20 | |
| *** dims_ has joined #openstack-keystone | 23:24 | |
| *** dims has quit IRC | 23:27 | |
| *** jsavak has joined #openstack-keystone | 23:29 | |
| *** bknudson has joined #openstack-keystone | 23:31 | |
| *** ChanServ sets mode: +v bknudson | 23:31 | |
| *** browne has quit IRC | 23:33 | |
| *** gyee has quit IRC | 23:36 | |
| *** david-lyle has joined #openstack-keystone | 23:36 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Bye Bye Domain Table https://review.openstack.org/161854 | 23:38 |
| *** gyee has joined #openstack-keystone | 23:38 | |
| *** ChanServ sets mode: +v gyee | 23:38 | |
| *** snapdey has quit IRC | 23:42 | |
| *** gordc has joined #openstack-keystone | 23:44 | |
| *** darrenc is now known as darrenc_afk | 23:44 | |
| *** dims_ has quit IRC | 23:46 | |
| *** snapdey has joined #openstack-keystone | 23:48 | |
| *** jsavak has quit IRC | 23:50 | |
| *** thedodd has quit IRC | 23:50 | |
| *** snapdey has quit IRC | 23:50 | |
| *** jsavak has joined #openstack-keystone | 23:50 | |
| *** jiaxi has joined #openstack-keystone | 23:52 | |
| *** jsavak has quit IRC | 23:52 | |
| jiaxi | Good morning. everyone. | 23:53 |
| *** darrenc_afk is now known as darrenc | 23:54 | |
| jiaxi | https://review.openstack.org/#/c/204952/ | 23:55 |
| *** bhenderson has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!