| dstanek | morgan: just pushed up my zone files | 00:01 |
|---|---|---|
| dstanek | hmm....i should have probably checked them for profanity | 00:02 |
| morgan | dstanek: LOL | 00:02 |
| dstanek | nah, looks like i'm all good | 00:02 |
| morgan | jamielennox: +2 | 00:03 |
| morgan | jamielennox: looks good to me | 00:03 |
| dstanek | jamielennox: with all the kwargs i can't tell where the endpoint_type is coming from | 00:04 |
| *** david-ly_ has joined #openstack-keystone | 00:04 | |
| jamielennox | dstanek: yea, i never wanted to define all the options because they are going to be plugin specific | 00:04 |
| *** EinstCrazy has quit IRC | 00:05 | |
| jamielennox | dstanek: it's passed as endpoint_filter to request() | 00:05 |
| jamielennox | or get() or anything else | 00:05 |
| *** david-lyle has quit IRC | 00:05 | |
| dstanek | so the endpoint_filter kwarg seems to have the v2 interface name, but i'm not sure why it's using that | 00:06 |
| jamielennox | v2 interface name? | 00:06 |
| dstanek | publicURL | 00:06 |
| jamielennox | it just passes that through to the plugin, it's the service catalog that's accepting those arguments | 00:07 |
| jamielennox | 'public' will work just fine there on v2 and v3 plugins | 00:07 |
| *** tull has quit IRC | 00:09 | |
| dstanek | jamielennox: because you have a compat function :-) | 00:09 |
| dstanek | _normalize_endpoint_type)_ | 00:09 |
| jamielennox | yea, layers on layers of horrible | 00:10 |
| *** su_zhang has quit IRC | 00:10 | |
| dstanek | jamielennox: i couldn't figure out the auth plugin thing so for now i'm just going to tidy up the ServiceCatalog | 00:11 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: AuthContextMiddleware admin token handling https://review.openstack.org/198931 | 00:11 |
| stevemar_ | so many reviews to look at | 00:12 |
| stevemar_ | mordred: it's a wonder you ever did a single patch | 00:12 |
| stevemar_ | s/did/committed | 00:13 |
| *** topol has joined #openstack-keystone | 00:13 | |
| *** ChanServ sets mode: +v topol | 00:13 | |
| *** devkulkarni has quit IRC | 00:13 | |
| mordred | stevemar_: I think you wanted morgan | 00:15 |
| stevemar_ | mordred: yep | 00:15 |
| morgan | stevemar_: welcome to the craziness. | 00:15 |
| stevemar_ | mordred: why do you guys need to share the first three characters | 00:15 |
| *** morgan is now known as mordgan | 00:16 | |
| mordgan | stevemar_: better? | 00:16 |
| mordgan | *shiftyeyes* | 00:16 |
| *** mordgan is now known as morgan | 00:16 | |
| *** mordred is now known as morgred | 00:16 | |
| * morgred can play that game too | 00:16 | |
| *** zzzeek has quit IRC | 00:16 | |
| *** morgan is now known as mordan | 00:16 | |
| mordan | oh this wont confuse anyone | 00:16 |
| *** mordan is now known as mordgan | 00:16 | |
| mordgan | at all | 00:17 |
| mordgan | morgred: :P | 00:17 |
| morgred | mordgan: \o/ | 00:17 |
| *** topol has quit IRC | 00:18 | |
| dims | dear god! | 00:18 |
| dstanek | stevemar_: jamielennox: is there a way to force osc not to get the catalog? | 00:18 |
| dstanek | dims: sounds like the start of a very personal letter | 00:18 |
| stevemar_ | dstanek: nope, we always call /auth/tokens (no &no_catalog option) | 00:18 |
| jamielennox | dstanek: not really | 00:19 |
| jamielennox | it doesn't really make sense for OSC | 00:19 |
| stevemar_ | morgred mordgan i have no idea who is who (i disable renames from showing up in irc client) | 00:19 |
| jamielennox | though you can make an auth plugin that does whatever you like :) | 00:19 |
| stevemar_ | jamielennox: true | 00:19 |
| mordgan | stevemar_: the last characters of the name are most significant in this case | 00:19 |
| morgred | dstanek: what are you trying to do | 00:19 |
| dims | dstanek: i was just getting used to nova's friday nicks! | 00:19 |
| dstanek | morgred: i just don't want the catalog returned ever | 00:20 |
| dstanek | i'll just leave my hack in for now | 00:20 |
| morgred | dstanek: yah - but why? mostly want to grok all the various ways in which people get unhappy | 00:20 |
| stevemar_ | dstanek: any plans on our surprise event tomorrow? :) | 00:20 |
| openstackgerrit | David Stanek proposed openstack/python-keystoneclient: WIP: DNS-SD proof of concept https://review.openstack.org/232822 | 00:21 |
| dstanek | i'm proud to say that ^ may be the crappiest code i've ever written | 00:22 |
| *** shadower has joined #openstack-keystone | 00:23 | |
| *** gildub has joined #openstack-keystone | 00:23 | |
| dstanek | stevemar_: ugg.... let me finish my email - i've been distracted all day | 00:27 |
| mordgan | stevemar_ uses distract on dstanek! It is highly effective | 00:28 |
| stevemar_ | dstanek: no pressure dude, send it over to me in IRC and i'll polish it off | 00:28 |
| stevemar_ | mordgan: hehe | 00:28 |
| stevemar_ | mordgan: i wasn't the one distracting him! | 00:28 |
| dstanek | it was ayoung.... he mentioned the DNS stuff the other day i wanted to finish while the code was fresh in my head | 00:29 |
| *** markvoelker has quit IRC | 00:29 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Common arguments for fernet payloads assembly https://review.openstack.org/230165 | 00:31 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Normalize fernet payload disassembly https://review.openstack.org/230181 | 00:31 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: De-duplicate fernet payload tests https://review.openstack.org/230193 | 00:31 |
| *** phalmos has quit IRC | 00:32 | |
| *** morgred is now known as morgblue | 00:34 | |
| *** sdake has joined #openstack-keystone | 00:35 | |
| *** tqtran has quit IRC | 00:35 | |
| *** morgblue is now known as morgred | 00:36 | |
| *** gyee has quit IRC | 00:41 | |
| *** EinstCrazy has joined #openstack-keystone | 00:54 | |
| *** ayoung has joined #openstack-keystone | 00:55 | |
| *** ChanServ sets mode: +v ayoung | 00:55 | |
| *** gildub has quit IRC | 01:10 | |
| *** telemonster has joined #openstack-keystone | 01:12 | |
| *** topol has joined #openstack-keystone | 01:13 | |
| *** ChanServ sets mode: +v topol | 01:13 | |
| *** david-ly_ has quit IRC | 01:14 | |
| *** dims has quit IRC | 01:18 | |
| *** dims has joined #openstack-keystone | 01:18 | |
| *** david-lyle has joined #openstack-keystone | 01:22 | |
| *** dims has quit IRC | 01:23 | |
| *** lhcheng has quit IRC | 01:26 | |
| *** david-lyle has quit IRC | 01:29 | |
| *** davechen has joined #openstack-keystone | 01:32 | |
| *** davechen1 has joined #openstack-keystone | 01:35 | |
| *** davechen has quit IRC | 01:37 | |
| *** davechen has joined #openstack-keystone | 01:40 | |
| *** topol has quit IRC | 01:41 | |
| *** davechen1 has quit IRC | 01:43 | |
| *** geoffarnold is now known as geoffarnoldX | 01:43 | |
| *** sdake has quit IRC | 01:44 | |
| *** wwwjfy has quit IRC | 01:44 | |
| *** jamielennox is now known as jamielennox|away | 01:46 | |
| *** hrou has joined #openstack-keystone | 01:47 | |
| *** mylu has joined #openstack-keystone | 01:52 | |
| *** jasonsb has quit IRC | 01:52 | |
| *** btully has quit IRC | 01:54 | |
| *** devkulkarni has joined #openstack-keystone | 01:55 | |
| openstackgerrit | Merged openstack/oslo.policy: Custom fixture to avoid external call in HttpCheck https://review.openstack.org/232725 | 01:56 |
| stevemar_ | jamielennox|away: you are in serious janitor mode with the cache bits for keystonemiddleware | 02:13 |
| *** mylu_ has joined #openstack-keystone | 02:16 | |
| *** devkulkarni has quit IRC | 02:18 | |
| *** lhcheng has joined #openstack-keystone | 02:19 | |
| *** ChanServ sets mode: +v lhcheng | 02:19 | |
| *** dims has joined #openstack-keystone | 02:19 | |
| *** mylu has quit IRC | 02:20 | |
| *** dims has quit IRC | 02:24 | |
| *** stevemar_ has quit IRC | 02:24 | |
| *** stevemar_ has joined #openstack-keystone | 02:25 | |
| *** ChanServ sets mode: +o stevemar_ | 02:25 | |
| *** stevemar_ has quit IRC | 02:33 | |
| *** ngupta has joined #openstack-keystone | 02:34 | |
| *** stevemar_ has joined #openstack-keystone | 02:34 | |
| *** ChanServ sets mode: +o stevemar_ | 02:34 | |
| stevemar_ | mordgan: morgred whichever one morgan is: https://review.openstack.org/#/c/232764/ | 02:37 |
| *** lhcheng has quit IRC | 02:44 | |
| *** spandhe has quit IRC | 02:47 | |
| *** wwwjfy has joined #openstack-keystone | 02:51 | |
| *** hidekazu has joined #openstack-keystone | 02:52 | |
| *** lhcheng has joined #openstack-keystone | 02:52 | |
| *** ChanServ sets mode: +v lhcheng | 02:52 | |
| *** ayoung has quit IRC | 02:58 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Create Environment cache pool https://review.openstack.org/212342 | 03:03 |
| openstackgerrit | Merged openstack/keystonemiddleware: Import _memcache_pool normally https://review.openstack.org/212343 | 03:07 |
| *** lhcheng has quit IRC | 03:13 | |
| *** Kennan has quit IRC | 03:43 | |
| *** Kennan has joined #openstack-keystone | 03:43 | |
| *** gildub has joined #openstack-keystone | 03:45 | |
| *** david-lyle has joined #openstack-keystone | 03:47 | |
| *** vivekd has joined #openstack-keystone | 03:50 | |
| *** sdake has joined #openstack-keystone | 03:51 | |
| *** topol has joined #openstack-keystone | 03:52 | |
| *** ChanServ sets mode: +v topol | 03:52 | |
| *** links has joined #openstack-keystone | 03:53 | |
| *** markvoelker has joined #openstack-keystone | 03:55 | |
| *** topol has quit IRC | 03:57 | |
| hidekazu | rodrigods is in? | 03:59 |
| *** chlong has joined #openstack-keystone | 04:00 | |
| hidekazu | I have a question about spec: Add is_domain to the token for projects acting as a domain | 04:00 |
| *** chlong has quit IRC | 04:05 | |
| *** roxanagh_ has joined #openstack-keystone | 04:06 | |
| *** dims has joined #openstack-keystone | 04:08 | |
| hidekazu | He seems to be not here now.. | 04:08 |
| *** mylu has joined #openstack-keystone | 04:13 | |
| *** mylu_ has quit IRC | 04:16 | |
| *** yasu has joined #openstack-keystone | 04:16 | |
| *** chlong has joined #openstack-keystone | 04:18 | |
| *** hidekazu has quit IRC | 04:19 | |
| gildub | stevemar_, how to make bug/1475091 evolve? | 04:21 |
| *** fawadkhaliq has joined #openstack-keystone | 04:28 | |
| stevemar_ | gildub: evolve? | 04:30 |
| gildub | gildub, yeah, as opposed to stay in limbo | 04:30 |
| gildub | gildub, move maybe? | 04:31 |
| gildub | stevemar_, ^ ^^ | 04:31 |
| gildub | stevemar_, I've sent an email to ayoung | 04:31 |
| stevemar_ | ahhh that bug | 04:32 |
| gildub | stevemar_, yep | 04:32 |
| *** flwang has quit IRC | 04:35 | |
| stevemar_ | gildub: i'm not really sure how to evolve the bug :( | 04:35 |
| *** roxanagh_ has quit IRC | 04:35 | |
| *** su_zhang has joined #openstack-keystone | 04:36 | |
| gildub | stevemar_, create an extra field (or use an already there but hidden), like a name or description. But ayoung was against (not really sure why actually, security?) | 04:36 |
| gildub | jamielennox|away, ^ | 04:36 |
| gildub | stevemar_, for openstack puppet, no trust means not heat setup | 04:38 |
| *** jlk has joined #openstack-keystone | 04:38 | |
| stevemar_ | gildub: gah | 04:38 |
| *** markvoelker_ has joined #openstack-keystone | 04:40 | |
| *** sdake_ has joined #openstack-keystone | 04:41 | |
| *** wwwjfy has quit IRC | 04:42 | |
| *** markvoelker has quit IRC | 04:43 | |
| stevemar_ | gildub: i think richm's suggestion is reasonable... a hash of project/trustee/trustor/expiration | 04:43 |
| stevemar_ | i'm trying to recall if expiration has a reasonable default | 04:43 |
| *** sdake has quit IRC | 04:44 | |
| stevemar_ | oh it just doesn't expire if there is no expires_at | 04:46 |
| stevemar_ | that's super | 04:46 |
| stevemar_ | actually, i think that'll be OK | 04:47 |
| stevemar_ | commenting ... | 04:47 |
| gildub | stevemar_, it doesn't guarantee uniqueness of the trust | 04:47 |
| stevemar_ | you are absolutely correct | 04:49 |
| mordgan | Which bug is this? | 04:49 |
| * mordgan needs to shutup and be better about lurking | 04:49 | |
| gildub | stevemar_, so basically we are going to have to explain to the users, look keystone guys could have provided a field but they don't want to because that's bad then use the timestamp as a side effect and screw the timestamp initial purpose | 04:49 |
| gildub | mordgan, https://bugs.launchpad.net/keystone/+bug/1475091 | 04:49 |
| openstack | Launchpad bug 1475091 in Keystone "Missing name field for trusts" [Wishlist,Won't fix] | 04:49 |
| *** jaosorior has joined #openstack-keystone | 04:49 | |
| *** dims has quit IRC | 04:51 | |
| mordgan | Hmm | 04:52 |
| mordgan | Name isnt going yo ensure uniqueness either. | 04:52 |
| mordgan | To* | 04:52 |
| mordgan | it could, but that gets wonky | 04:52 |
| stevemar_ | gildub: commented, basically ... yes, it doesn't guarantee uniqueness, but it shows duplication | 04:52 |
| stevemar_ | if you create the same trusts (with those fields), then they do the same about of delegation | 04:53 |
| * mordgan refrains from snarky overengineering remark | 04:53 | |
| stevemar_ | so if you find either, then you get the one you want | 04:53 |
| gildub | stevemar_, mordgan, ok, yes both name or timestamp would shows duplication | 04:53 |
| mordgan | Actually, this is a case where probably description is a better tool. | 04:53 |
| mordgan | But same net effect | 04:53 |
| gildub | stevemar_, mordgan, exactly ^, because otherwise what happens when the user needs the timestamp | 04:54 |
| stevemar_ | mordgan: i'm sad that trusts don't have a unique id | 04:54 |
| mordgan | stevemar_: they do | 04:54 |
| mordgan | Just it is auto generated | 04:54 |
| stevemar_ | gildub: is there no way to save a returned value? | 04:54 |
| *** hrou has quit IRC | 04:55 | |
| stevemar_ | oh right.. of course they do, i remember writing the client code | 04:55 |
| mordgan | You know we could just unique contrain trsutor, trustee, expiry, roles | 04:55 |
| gildub | mordgan, any way to tap into that autogeneration ? Basically, here is the next primary key to use (if not in use yet)? | 04:55 |
| mordgan | Auto generate is a uuid | 04:55 |
| mordgan | Not an autoincremebt | 04:55 |
| gildub | mordgan, sure but a user provided uuid? | 04:55 |
| *** topol has joined #openstack-keystone | 04:55 | |
| *** ChanServ sets mode: +v topol | 04:55 | |
| mordgan | No. | 04:56 |
| stevemar_ | gildub: it's returned in the response (it's random) | 04:56 |
| mordgan | Uuid.uuid4() | 04:56 |
| stevemar_ | it's always in the ID field | 04:56 |
| stevemar_ | gildub: you guys are calling openstackclient for this right? | 04:56 |
| mordgan | stevemar_: we could just unique the values in the schema | 04:56 |
| gildub | stevemar_, yes | 04:56 |
| mordgan | It would raise conflict if the exact same trust was created again | 04:56 |
| mordgan | Including expiration time that is. | 04:57 |
| stevemar_ | gildub: is there no way to parse the output? and save the uuid that is returned | 04:57 |
| stevemar_ | mordgan: yes, we could do that | 04:57 |
| mordgan | stevemar_: parsing/storing output is icky | 04:57 |
| mordgan | CMS can do it but it is a lot of work and prone to break | 04:57 |
| stevemar_ | mordgan: shame | 04:58 |
| *** mylu has quit IRC | 04:58 | |
| mordgan | It is better if the truthyness comes from the cms not from the cms and responses from what the cms does | 04:58 |
| mordgan | Because then you dont need to guess if the trust was created (for example) if a timeout occured | 04:59 |
| mordgan | You could try and just create it again and get an e_already_exists | 04:59 |
| mordgan | Vs list/iterate through every trust to find out or to duplicate the trust | 05:00 |
| gildub | mordgan, why an infinite number of the same trusts can be created? | 05:00 |
| mordgan | I think the easiest is to unique the fields together | 05:00 |
| mordgan | Then you cannot duplicate the trust | 05:00 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/232873 | 05:00 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/230464 | 05:00 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/232874 | 05:00 |
| *** ngupta has quit IRC | 05:00 | |
| mordgan | It is more of a defensive coding to prevent dos like actions | 05:00 |
| mordgan | And it probably needs an api to say "find me trusts with values x,y,z" | 05:01 |
| *** sdake_ has quit IRC | 05:01 | |
| mordgan | gildub: it is silly to allow 100% duplicated trusts. It just allows cluttering of the db | 05:02 |
| mordgan | If we unique constrain trusts - we solve both issues (a name is still superfluous and/or could be added) but the values are the important part | 05:02 |
| mordgan | stevemar_: ^ any thoughts? | 05:03 |
| *** roxanagh_ has joined #openstack-keystone | 05:03 | |
| gildub | mordgan, so there was not use case for such need, it just happened to be? | 05:03 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/232885 | 05:03 |
| mordgan | gildub: as far as i can tell, there is no use-case for an exactly duplicated trust | 05:04 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/232893 | 05:04 |
| gildub | mordgan, ok | 05:04 |
| mordgan | Duplicated trust is: tustor, trustee, scope, roles, and expiration | 05:05 |
| mordgan | If those are identical, the trust already exists. Why add another record for it? | 05:06 |
| stevemar_ | mordgan: i agree, that was my thought on why it is safe to use that as a has | 05:06 |
| stevemar_ | i delegate to you a role on a project, set to expire tomorrow | 05:07 |
| stevemar_ | why would i redo that? | 05:07 |
| stevemar_ | it's still there and valid | 05:07 |
| openstackgerrit | Dave Chen proposed openstack/keystonemiddleware: Configuration is outdated https://review.openstack.org/220545 | 05:07 |
| *** sdake has joined #openstack-keystone | 05:07 | |
| gildub | mordgan, but then that would mean addressing that one too https://bugs.launchpad.net/keystone/+bug/1473292 | 05:08 |
| openstack | Launchpad bug 1473292 in Keystone "Cannot delete or show a trust with an expired date" [High,Triaged] | 05:08 |
| gildub | stevemar_, ^^ | 05:08 |
| mordgan | Eh | 05:08 |
| stevemar_ | gildub: nice | 05:08 |
| mordgan | Sure | 05:08 |
| mordgan | Easy to add a "find me a trust that looks like x" api | 05:08 |
| mordgan | And allow that api to show expired trusts | 05:09 |
| mordgan | I think that bug doesn't matter though. I Would also make it impossible to create a trust that is already expired | 05:09 |
| mordgan | Because it is already invalid why does deleting it matter? If anything a keystone-manage command can do "cleanup" on the db table | 05:10 |
| mordgan | Deletion shouldnt need to be an api call to "prune" the db | 05:10 |
| gildub | mordgan, but I still don't understand why I cannot revoke (destroy/whatever) a trust I created, that has expired, doesn't make sense to me | 05:10 |
| mordgan | It just doesnt matter. The trust wont issue tokens. It is like an expired keystone token, it no longer exists | 05:11 |
| gildub | mordgan, but it's there, I can see it | 05:12 |
| gildub | mordgan, or I can list it but I can't touch it | 05:12 |
| mordgan | We can hide it. I mean that is fine | 05:12 |
| mordgan | List should probably omit expired trusts | 05:12 |
| gildub | mordgan, ok hide it then. | 05:12 |
| mordgan | That is more likely the bug | 05:12 |
| *** btully has joined #openstack-keystone | 05:12 | |
| stevemar_ | gildub: agreed that we should remove expired trusts from the list | 05:12 |
| gildub | stevemar_, mordgan, ok, I understand the expired are not an issue | 05:14 |
| stevemar_ | i'll see if someone wants to pick this up, seems like a good candidate for a fix | 05:14 |
| mordgan | Should be low hanging fruit too | 05:14 |
| mordgan | Just a sql migration and some api docs | 05:15 |
| mordgan | And a spec | 05:15 |
| gildub | stevemar_, mordgan, thanks, at least I feel I've achieved something today, because puppet makes me feel to go hide in a cave and develop only with Elixir | 05:15 |
| stevemar_ | mordgan: spec? | 05:15 |
| stevemar_ | gildub: \o/ | 05:15 |
| mordgan | stevemar_: it is an api change | 05:15 |
| stevemar_ | gildub: now we need someone to actually do it | 05:15 |
| stevemar_ | :) | 05:15 |
| mordgan | Need to change the api spec | 05:16 |
| stevemar_ | mordgan: not an entire new spec though | 05:16 |
| mordgan | V4! | 05:16 |
| mordgan | *ducks* | 05:16 |
| stevemar_ | it's pretty much just adding a note here: http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-trust-ext.html#list-trusts | 05:16 |
| mordgan | the create also needs to indicate conflict is now raised | 05:17 |
| *** wwwjfy has joined #openstack-keystone | 05:18 | |
| mordgan | stevemar_: filgtm? ;) | 05:18 |
| mordgan | stevemar_: how ya liking PTL job? | 05:19 |
| stevemar_ | mordgan: added that bit to the bug | 05:20 |
| stevemar_ | mordgan: it's constant firefighter duty | 05:20 |
| mordgan | Make sure you delegate | 05:20 |
| mordgan | Super important | 05:20 |
| stevemar_ | mordgan: wife and I have been yelling "I'm PTL'ing all the things" to each other | 05:20 |
| mordgan | You do not scale ;) | 05:20 |
| stevemar_ | the weight scale says otherwise | 05:21 |
| stevemar_ | i've pretty much given up on trying to make a commit | 05:21 |
| mordgan | I think I lost like 20lbs while being PTL | 05:21 |
| gildub | Cheaper than a gym subscription ^ | 05:22 |
| mordgan | You'll get some basic commits added because you'll be like "omg just fix it!!!1111" | 05:22 |
| stevemar_ | mordgan: oh i need you here: https://review.openstack.org/#/c/232764/ | 05:22 |
| stevemar_ | mordgan: and from tagging releases :) | 05:22 |
| mordgan | That may not be needed anymore actually | 05:23 |
| mordgan | Let me check | 05:23 |
| mordgan | So. I think if we just swap tonusing https://bitbucket.org/zzzeek/dogpile.cache/src/3a7c719ede4e944f2e73edf5faadde348fa9215d/dogpile/cache/backends/memory.py?at=rel_0_2&fileviewer=file-view-default#memory.py-93 the isolating proxy can be removed | 05:26 |
| mordgan | The downside is we can't inspect the values directly as easily | 05:26 |
| *** roxanagh_ has quit IRC | 05:27 | |
| *** spandhe has joined #openstack-keystone | 05:27 | |
| *** chlong has quit IRC | 05:31 | |
| *** Nirupama has joined #openstack-keystone | 05:33 | |
| *** gildub has quit IRC | 05:35 | |
| *** jbell8 has quit IRC | 05:37 | |
| *** kiran-r has joined #openstack-keystone | 05:47 | |
| *** dims has joined #openstack-keystone | 05:52 | |
| *** csoukup has quit IRC | 05:56 | |
| *** itlinux has joined #openstack-keystone | 05:58 | |
| *** kiranr has joined #openstack-keystone | 06:07 | |
| *** lhcheng has joined #openstack-keystone | 06:07 | |
| *** ChanServ sets mode: +v lhcheng | 06:07 | |
| *** kiran-r has quit IRC | 06:10 | |
| *** itlinux has quit IRC | 06:11 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Zanata https://review.openstack.org/232921 | 06:13 |
| *** akanksha_ has quit IRC | 06:18 | |
| *** topol has quit IRC | 06:19 | |
| *** ParsectiX has joined #openstack-keystone | 06:22 | |
| *** dims has quit IRC | 06:25 | |
| *** spandhe has quit IRC | 06:26 | |
| *** yasu has quit IRC | 06:29 | |
| *** GB21 has joined #openstack-keystone | 06:32 | |
| *** GB21_ has joined #openstack-keystone | 06:32 | |
| *** GB21_ has quit IRC | 06:33 | |
| *** sdake has quit IRC | 06:33 | |
| *** rudolfvriend has joined #openstack-keystone | 06:35 | |
| *** chlong has joined #openstack-keystone | 06:39 | |
| *** yasu has joined #openstack-keystone | 06:42 | |
| *** fawadkhaliq has quit IRC | 06:43 | |
| *** jaosorior has quit IRC | 06:44 | |
| *** jaosorior has joined #openstack-keystone | 06:44 | |
| *** jaosorior has quit IRC | 06:47 | |
| *** jaosorior has joined #openstack-keystone | 06:48 | |
| *** browne has quit IRC | 06:49 | |
| *** jaosorior has quit IRC | 06:49 | |
| *** dims has joined #openstack-keystone | 06:49 | |
| *** jaosorior has joined #openstack-keystone | 06:49 | |
| *** jaosorior has quit IRC | 06:50 | |
| *** jaosorior has joined #openstack-keystone | 06:50 | |
| *** dims has quit IRC | 06:54 | |
| *** lhcheng has quit IRC | 06:57 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Using the right format to render the docstring correctly https://review.openstack.org/226225 | 07:03 |
| *** henrynash has joined #openstack-keystone | 07:09 | |
| *** ChanServ sets mode: +v henrynash | 07:09 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:11 | |
| *** stevemar_ has quit IRC | 07:16 | |
| openstackgerrit | Dave Chen proposed openstack/keystonemiddleware: Deprecate class AuthTokenPlugin properly https://review.openstack.org/220509 | 07:18 |
| *** su_zhang has quit IRC | 07:19 | |
| *** itlinux has joined #openstack-keystone | 07:23 | |
| *** henrynash has quit IRC | 07:27 | |
| *** henrynash has joined #openstack-keystone | 07:27 | |
| *** ChanServ sets mode: +v henrynash | 07:27 | |
| *** henrynash has quit IRC | 07:29 | |
| *** ParsectiX has quit IRC | 07:30 | |
| *** ParsectiX has joined #openstack-keystone | 07:36 | |
| *** ParsectiX has quit IRC | 07:37 | |
| *** marzif has joined #openstack-keystone | 07:45 | |
| *** dims has joined #openstack-keystone | 07:50 | |
| *** fhubik has joined #openstack-keystone | 07:51 | |
| *** btully has quit IRC | 07:53 | |
| *** pnavarro has joined #openstack-keystone | 07:53 | |
| *** afazekas_ has quit IRC | 07:54 | |
| *** vivekd_ has joined #openstack-keystone | 07:55 | |
| *** ParsectiX has joined #openstack-keystone | 07:55 | |
| *** vivekd has quit IRC | 07:56 | |
| *** vivekd_ is now known as vivekd | 07:56 | |
| *** dims has quit IRC | 07:56 | |
| *** openstackstatus has quit IRC | 08:02 | |
| *** jbell8 has joined #openstack-keystone | 08:02 | |
| *** openstackstatus has joined #openstack-keystone | 08:03 | |
| *** ChanServ sets mode: +v openstackstatus | 08:03 | |
| *** chlong has quit IRC | 08:09 | |
| *** ozialien has joined #openstack-keystone | 08:13 | |
| *** akanksha_ has joined #openstack-keystone | 08:13 | |
| *** ozialien has quit IRC | 08:19 | |
| *** ozialien has joined #openstack-keystone | 08:20 | |
| *** e0ne has joined #openstack-keystone | 08:20 | |
| *** Burgosz has joined #openstack-keystone | 08:25 | |
| *** ozialien has quit IRC | 08:27 | |
| *** ozialien has joined #openstack-keystone | 08:28 | |
| *** topol has joined #openstack-keystone | 08:31 | |
| *** ChanServ sets mode: +v topol | 08:31 | |
| *** topol has quit IRC | 08:35 | |
| *** ozialien has quit IRC | 08:37 | |
| *** ozialien has joined #openstack-keystone | 08:37 | |
| *** btully has joined #openstack-keystone | 08:38 | |
| *** jistr has joined #openstack-keystone | 08:41 | |
| *** btully has quit IRC | 08:43 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: test_backend_sql work with python34 https://review.openstack.org/205352 | 08:45 |
| *** jbell8 has quit IRC | 08:46 | |
| *** jbell8 has joined #openstack-keystone | 08:47 | |
| *** ozialien has quit IRC | 08:48 | |
| *** ozialien has joined #openstack-keystone | 08:48 | |
| *** ParsectiX has quit IRC | 08:48 | |
| *** dims has joined #openstack-keystone | 08:53 | |
| *** dims has quit IRC | 08:58 | |
| *** amakarov_away is now known as amakarov | 09:04 | |
| *** marzif has quit IRC | 09:10 | |
| *** kiranr_ has joined #openstack-keystone | 09:12 | |
| *** aix has joined #openstack-keystone | 09:13 | |
| *** kiranr has quit IRC | 09:15 | |
| *** ParsectiX has joined #openstack-keystone | 09:19 | |
| *** jraim has quit IRC | 09:33 | |
| *** ctracey has quit IRC | 09:34 | |
| *** zhiyan has quit IRC | 09:34 | |
| *** nzeer has quit IRC | 09:34 | |
| *** serverascode has quit IRC | 09:34 | |
| *** briancurtin has quit IRC | 09:36 | |
| *** kodokuu has joined #openstack-keystone | 09:39 | |
| kodokuu | Hi, Is it possible to force the tenant ID when create project ? | 09:40 |
| *** ozialien has quit IRC | 09:40 | |
| *** fawadkhaliq has quit IRC | 09:45 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:46 | |
| *** fawadkhaliq has quit IRC | 09:51 | |
| *** davechen has left #openstack-keystone | 09:54 | |
| *** zhiyan has joined #openstack-keystone | 09:56 | |
| *** zhiyan has quit IRC | 09:57 | |
| *** kodokuu has quit IRC | 09:59 | |
| *** marzif has joined #openstack-keystone | 10:00 | |
| *** nzeer has joined #openstack-keystone | 10:00 | |
| *** jraim has joined #openstack-keystone | 10:03 | |
| *** pnavarro is now known as pnavarro|lunch | 10:04 | |
| jvarlamova | Hello, Keystone team! I have a small question. Is it planned to make a release of keystoneclient stable/kilo branch with fix of https://bugs.launchpad.net/python-keystoneclient/+bug/1480314? I am wondering because we have a related change in manilaclient project - https://review.openstack.org/#/c/207822/ | 10:06 |
| openstack | Launchpad bug 1480314 in python-keystoneclient "Branch "stable/kilo" is broken" [Undecided,In progress] - Assigned to Julia Varlamova (jvarlamova) | 10:06 |
| *** ericksonsantos has joined #openstack-keystone | 10:06 | |
| *** yasu has quit IRC | 10:08 | |
| *** ctracey has joined #openstack-keystone | 10:10 | |
| *** serverascode has joined #openstack-keystone | 10:16 | |
| *** Burgosz has quit IRC | 10:18 | |
| *** zhiyan has joined #openstack-keystone | 10:18 | |
| *** chlong has joined #openstack-keystone | 10:25 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Use search_ext_s instead of search_s in ldap https://review.openstack.org/232995 | 10:25 |
| *** btully has joined #openstack-keystone | 10:26 | |
| *** briancurtin has joined #openstack-keystone | 10:29 | |
| *** btully has quit IRC | 10:31 | |
| *** jbell8 has quit IRC | 10:31 | |
| *** GB21 has quit IRC | 10:35 | |
| *** vivekd_ has joined #openstack-keystone | 10:35 | |
| *** vivekd has quit IRC | 10:36 | |
| *** vivekd_ is now known as vivekd | 10:36 | |
| *** EinstCrazy has quit IRC | 10:51 | |
| *** EinstCrazy has joined #openstack-keystone | 10:52 | |
| openstackgerrit | Sonali proposed openstack/keystone: Do not rebuild revoke_tree on each validate-token https://review.openstack.org/232715 | 10:54 |
| *** fawadkhaliq has joined #openstack-keystone | 10:55 | |
| *** EinstCrazy has quit IRC | 10:58 | |
| *** lhcheng has joined #openstack-keystone | 10:59 | |
| *** ChanServ sets mode: +v lhcheng | 10:59 | |
| *** fawadkhaliq has quit IRC | 10:59 | |
| openstackgerrit | Merged openstack/keystone: Fixed missed translatable string inside exception https://review.openstack.org/232544 | 10:59 |
| *** pnavarro|lunch is now known as pnavarro | 11:04 | |
| *** kiranr_ has quit IRC | 11:05 | |
| *** e0ne has quit IRC | 11:08 | |
| *** wwwjfy has quit IRC | 11:14 | |
| *** chlong has quit IRC | 11:15 | |
| *** kiran-r has joined #openstack-keystone | 11:16 | |
| *** vivekd has quit IRC | 11:19 | |
| *** EinstCrazy has joined #openstack-keystone | 11:20 | |
| *** lhcheng has quit IRC | 11:24 | |
| *** e0ne has joined #openstack-keystone | 11:24 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:25 | |
| *** fawadkhaliq has quit IRC | 11:28 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:28 | |
| *** GB21 has joined #openstack-keystone | 11:29 | |
| *** Nirupama has quit IRC | 11:31 | |
| *** Nirupama has joined #openstack-keystone | 11:31 | |
| *** alejandrito has joined #openstack-keystone | 11:32 | |
| *** kiran-r has quit IRC | 11:38 | |
| *** gordc has joined #openstack-keystone | 11:38 | |
| *** exploreshaifali has joined #openstack-keystone | 11:40 | |
| *** lhcheng has joined #openstack-keystone | 11:44 | |
| *** ChanServ sets mode: +v lhcheng | 11:44 | |
| *** weihan has joined #openstack-keystone | 11:48 | |
| *** exploreshaifali has quit IRC | 11:49 | |
| *** Nirupama has quit IRC | 12:02 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Use search_ext_s instead of search_s in ldap https://review.openstack.org/232995 | 12:04 |
| *** wwwjfy has joined #openstack-keystone | 12:14 | |
| *** weihan has quit IRC | 12:15 | |
| *** weihan has joined #openstack-keystone | 12:15 | |
| *** dims has joined #openstack-keystone | 12:16 | |
| *** topol has joined #openstack-keystone | 12:19 | |
| *** ChanServ sets mode: +v topol | 12:19 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/232873 | 12:20 |
| *** lhcheng has quit IRC | 12:20 | |
| *** topol has quit IRC | 12:21 | |
| *** topol has joined #openstack-keystone | 12:21 | |
| *** ChanServ sets mode: +v topol | 12:21 | |
| *** weihan_ has joined #openstack-keystone | 12:21 | |
| *** raildo-afk is now known as raildo | 12:21 | |
| *** weihan has quit IRC | 12:24 | |
| *** chlong has joined #openstack-keystone | 12:26 | |
| *** aix has quit IRC | 12:31 | |
| *** edmondsw has joined #openstack-keystone | 12:34 | |
| *** devkulkarni has joined #openstack-keystone | 12:38 | |
| *** Nirupama has joined #openstack-keystone | 12:40 | |
| *** dsirrine has quit IRC | 12:41 | |
| *** dims is now known as dimsum__ | 12:42 | |
| *** morgred is now known as mordred | 12:46 | |
| *** akanksha_ has quit IRC | 12:48 | |
| *** weihan_ has quit IRC | 12:50 | |
| *** weihan has joined #openstack-keystone | 12:50 | |
| *** dsirrine has joined #openstack-keystone | 12:50 | |
| *** Nirupama has quit IRC | 12:52 | |
| *** marzif has quit IRC | 12:52 | |
| *** marzif has joined #openstack-keystone | 12:53 | |
| *** markvoelker has joined #openstack-keystone | 12:54 | |
| *** fawadkhaliq has quit IRC | 12:55 | |
| *** jsavak has joined #openstack-keystone | 12:56 | |
| *** markvoelker_ has quit IRC | 12:58 | |
| *** fawadkhaliq has joined #openstack-keystone | 13:01 | |
| *** aix has joined #openstack-keystone | 13:02 | |
| *** devkulkarni has quit IRC | 13:03 | |
| *** su_zhang has joined #openstack-keystone | 13:05 | |
| *** fawadkhaliq has quit IRC | 13:06 | |
| *** zzzeek has joined #openstack-keystone | 13:09 | |
| *** hrou has joined #openstack-keystone | 13:11 | |
| *** devkulkarni has joined #openstack-keystone | 13:12 | |
| *** boris-42 has quit IRC | 13:18 | |
| *** links has quit IRC | 13:19 | |
| *** doug-fish has joined #openstack-keystone | 13:20 | |
| tjcocozz | has anyone while doing a backport ran into merge conflicts within the translations? | 13:21 |
| *** kiran-r has joined #openstack-keystone | 13:22 | |
| tjcocozz | Its saying the only differece is the project-id-version and the timestamp in the header | 13:22 |
| *** exploreshaifali has joined #openstack-keystone | 13:22 | |
| *** njohnston is now known as nate_gone | 13:24 | |
| doug-fish | tjcocozz: are you trying to explicitly backport the translations? | 13:27 |
| tjcocozz | doug-fish: no the backport has nothing to do with the translations | 13:28 |
| doug-fish | I'm surprised an unrelated backport is picking up translations | 13:28 |
| doug-fish | I'd expect them to be pretty independent | 13:28 |
| tjcocozz | yeah i am confused how it is doing it since i am checking out the branch, cherry picking my code on top then doing a git-review. | 13:29 |
| tjcocozz | Within all this I never touch these files | 13:29 |
| doug-fish | which patch are you cherry-picking? | 13:29 |
| tjcocozz | https://review.openstack.org/#/c/213742/ | 13:29 |
| tjcocozz | https://review.openstack.org/#/c/226557/ | 13:29 |
| tjcocozz | this bug has two seperate commits for it: https://bugs.launchpad.net/keystone/+bug/1500459 | 13:30 |
| openstack | Launchpad bug 1500459 in Keystone "Validating federated fernet token loses user domain info" [Medium,Fix committed] - Assigned to Brant Knudson (blk-u) | 13:30 |
| *** kiran-r has quit IRC | 13:30 | |
| doug-fish | tjcocozz: this isn't really a direct answer, but have you tried just using the "cherry pick to" button in gerrit? | 13:31 |
| doug-fish | if there are no conflicts that should work | 13:31 |
| *** Ephur has joined #openstack-keystone | 13:33 | |
| *** Ephur has quit IRC | 13:33 | |
| *** Ephur has joined #openstack-keystone | 13:34 | |
| * tjcocozz is trying it now | 13:35 | |
| *** exploreshaifali has quit IRC | 13:40 | |
| *** devkulkarni1 has joined #openstack-keystone | 13:43 | |
| *** devkulkarni has quit IRC | 13:46 | |
| *** jaosorior_ has joined #openstack-keystone | 13:52 | |
| *** jaosorior_ has quit IRC | 13:52 | |
| *** jaosorior_ has joined #openstack-keystone | 13:53 | |
| *** jaosorior has quit IRC | 13:54 | |
| *** nate_gone is now known as njohnston | 13:57 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Make @truncated common for all backends https://review.openstack.org/233069 | 13:57 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Use @truncated in ldap https://review.openstack.org/233070 | 13:57 |
| krotscheck | Hey everyone. | 13:58 |
| doug-fish | hi Mr NodeJS! | 13:59 |
| doug-fish | (wait - wrong community) | 13:59 |
| * krotscheck slaps doug-fish | 13:59 | |
| krotscheck | So, a question on middleware. | 14:00 |
| *** jtomasek has joined #openstack-keystone | 14:00 | |
| *** jaosorior_ has quit IRC | 14:00 | |
| *** jaosorior has joined #openstack-keystone | 14:01 | |
| krotscheck | We've got an order-of-operations situation where the a client is trying to make an API OPTIONS request to check for valid CORS headers. | 14:01 |
| krotscheck | However the middleware chain appears to be first keystone, then cors. And keystone rejects the options request because it doesn't have a valid auth header. | 14:01 |
| *** fawadkhaliq has joined #openstack-keystone | 14:02 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:05 | |
| *** jrist has joined #openstack-keystone | 14:05 | |
| *** fawadkhaliq has quit IRC | 14:06 | |
| *** devkulkarni1 has quit IRC | 14:07 | |
| *** florianf has joined #openstack-keystone | 14:07 | |
| *** devkulkarni has joined #openstack-keystone | 14:07 | |
| florianf | krotscheck, jtomasek: hi | 14:08 |
| bknudson | putting cors header ahead of auth_token makes sense. | 14:08 |
| bknudson | cors middleware ahead of auth_token | 14:08 |
| krotscheck | bknudson: It does, however one is configured at the app level, while keystone is configured at the middleware level. | 14:08 |
| krotscheck | CORS is baked into ironic (and a few other services) | 14:08 |
| florianf | bknudson: I agree. Even if authentication fails, it's still a valid request (from an http/cors perspective) | 14:09 |
| krotscheck | (Like swift) | 14:09 |
| bknudson | keystone can be at the app level too | 14:09 |
| krotscheck | bknudson: Not all services are explicitly dependent on keystone. | 14:10 |
| krotscheck | bknudson: or want to be. | 14:10 |
| *** browne has joined #openstack-keystone | 14:10 | |
| bknudson | they're all explicitly dependent on cors? | 14:10 |
| lbragstad | bknudson question about https://review.openstack.org/#/c/227004/3/keystone/tests/unit/token/test_fernet_provider.py | 14:11 |
| *** ParsectiX has quit IRC | 14:11 | |
| krotscheck | bknudson: In the case of ironic, it's a documented feature, yes. | 14:11 |
| *** slberger has joined #openstack-keystone | 14:11 | |
| lbragstad | bknudson you don't recall a patch to change all the method names to not have 404 in them, do you? | 14:11 |
| bknudson | https://review.openstack.org/#/q/file:keystone/tests/unit/token/test_fernet_provider.py,n,z | 14:12 |
| bknudson | krotscheck: the auth_token middleware has an option where it won't reject requests but instead set an env var to indicate whether the request had a valid token or not | 14:14 |
| bknudson | so you could take advantage of that | 14:14 |
| krotscheck | jtomasek: ^^ Will that work for you? | 14:15 |
| bknudson | http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token/__init__.py#n257 | 14:16 |
| *** tonytan4ever has joined #openstack-keystone | 14:16 | |
| bknudson | lbragstad: I didn't check all those reviews but I don't see one that changes the method names | 14:17 |
| jtomasek | krotscheck: not sure, does it mean that if we subsequentially do an ordinary requests such as GET /v1/nodes, without auth token, it will pass? | 14:18 |
| krotscheck | jtomasek: You'd want to add bknudson the question, I'm not that familiar with the middleware. | 14:19 |
| bknudson | jtomasek: your application will have to check the HTTP_X_IDENTITY_STATUS and HTTP_X_SERVICE_IDENTITY_STATUS values in the env, see http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token/__init__.py#n64 | 14:20 |
| *** timcline has joined #openstack-keystone | 14:20 | |
| lbragstad | bknudson cool, thanks... working on a patch to change those, too | 14:21 |
| *** btully has joined #openstack-keystone | 14:21 | |
| lbragstad | bknudson i mean, i think they should be changed, right? | 14:22 |
| jtomasek | bknudson, krotscheck I am not sure that clientside js app will be able to access those env variables | 14:22 |
| *** EinstCrazy has quit IRC | 14:23 | |
| bknudson | lbragstad: "TokenNotFound" would be easier to understand than "404" is. | 14:23 |
| bknudson | jtomasek: the client will get a 401 error if it didn't provide a valid auth token. | 14:24 |
| bknudson | or, the application can do whatever it wants if it bypasses auth_token responses using delay_auth_decision | 14:25 |
| jtomasek | bknudson: ok, I am going to test it, so to make it work I need to add delay_auth_decision=true to keystone.conf? | 14:25 |
| bknudson | jtomasek: no, that goes in the server's configs in the keystoneauth section. | 14:26 |
| krotscheck | bknudson: why is keystone middlewrae intercepting the OPTIONS request? I'm looking at the HTTP spec and can't really figure out why it should be ACL-gated | 14:26 |
| bknudson | krotscheck: that's a good question... it intercepts all requests. | 14:26 |
| *** r-daneel has joined #openstack-keystone | 14:27 | |
| krotscheck | bknudson: I suppose some people care about even exposing OPTIONS things to the outside world? | 14:27 |
| *** devkulkarni has quit IRC | 14:27 | |
| bknudson | some applications might want to hide the existence of a resource | 14:28 |
| bknudson | so that only authenticated users can tell if it exists | 14:28 |
| *** david_cu has joined #openstack-keystone | 14:28 | |
| *** markvoelker has quit IRC | 14:29 | |
| *** stevemar_ has joined #openstack-keystone | 14:29 | |
| *** ChanServ sets mode: +o stevemar_ | 14:29 | |
| john5223 | in openstack_auth for horizon it calls python-keystoneclient like this: unscoped_auth = plugin.get_plugin(auth_url=auth_url, **kwargs) , which is the Password plugin in auth/v3/identity/password.py | 14:31 |
| john5223 | and then it calls: unscoped_auth_ref = unscoped_auth.get_access(session) | 14:31 |
| john5223 | what if you wanted to use more than one method? for example: "methods": ["password", "otp"] | 14:31 |
| *** itlinux has quit IRC | 14:31 | |
| john5223 | b/c i was trying to make a keystoneclient method similiar to this: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/identity/v3/password.py#L51 | 14:32 |
| john5223 | but noticed it only has one part of the keystone request, the password part | 14:32 |
| john5223 | and my keystone plugin has a seperate plugin / method for otp | 14:33 |
| john5223 | like so... https://gist.github.com/john5223/5cf071648dedf30c93ba | 14:33 |
| florianf | bknudson: But wouldn't it be better if the application using keystonemiddleware would explicitely hide the resource from non-auth'd users if they want to? as opposed to making it an automatism in keystonemiddleware? | 14:35 |
| john5223 | but... looks like openstack only uses only one plugin for keystone and then calls .get_access() here: https://github.com/openstack/django_openstack_auth/blob/master/openstack_auth/backend.py#L96 | 14:35 |
| *** EinstCrazy has joined #openstack-keystone | 14:35 | |
| *** ayoung has joined #openstack-keystone | 14:39 | |
| *** ChanServ sets mode: +v ayoung | 14:39 | |
| *** GB21 has quit IRC | 14:39 | |
| *** devkulkarni has joined #openstack-keystone | 14:40 | |
| *** devkulkarni has quit IRC | 14:40 | |
| *** hurgleburgler has joined #openstack-keystone | 14:40 | |
| *** hurgleburgler has left #openstack-keystone | 14:40 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/232873 | 14:42 |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/232893 | 14:45 |
| *** petertr7 is now known as petertr7_away | 14:50 | |
| *** petertr7_away is now known as petertr7 | 14:52 | |
| openstackgerrit | Monty Taylor proposed openstack/python-keystoneclient: Accept v2 params to v3 service create https://review.openstack.org/233102 | 14:57 |
| *** markvoelker has joined #openstack-keystone | 14:57 | |
| mordred | stevemar_: I actually do not care if that lands ^^ but that's how I would argue stuff like this should be done | 14:57 |
| mordred | stevemar_: breaking users because someone decided to make niggly pedantic wording changes is just mean | 14:57 |
| mordred | stevemar_: I'd ACTUALLY argue that the REST API should do that, but that would take way more work for me to rage-code a quick patch for :) | 14:59 |
| *** jsavak has quit IRC | 15:00 | |
| *** jsavak has joined #openstack-keystone | 15:01 | |
| *** timcline has quit IRC | 15:01 | |
| *** timcline has joined #openstack-keystone | 15:02 | |
| ayoung | mordred, stevemar_ just ran off to a dentist appt | 15:02 |
| mordred | ayoung: mmm. dentist | 15:03 |
| ayoung | mordred, but you can argue ^^ with Jamie. I think that is his doing, and expect him to argue convincingly for his views | 15:03 |
| mordred | ayoung: I'm sure his arguments are convincing - he's a very sound and rational person | 15:03 |
| *** fawadkhaliq has joined #openstack-keystone | 15:03 | |
| mordred | ayoung: my counter arguments would be that I think the fundamental reality we are operating in might be different than it was assumed to be when that decision was made | 15:04 |
| mordred | which is mainly that multi-cloud is a real thing, and that expecting interoperability across clouds is not insane, and that "just use the latest version" or even "be aware of the version of a service your cloud is running" are not tennable | 15:04 |
| mordred | if that was different, then making a nice new clean API would be a completely reasonable thing to do | 15:05 |
| mordred | or if the only market was private clouds, where you'd never expect people to want to use the same consume code on more than one cloud | 15:05 |
| ayoung | mordred, so...two different sessions, one percloud | 15:05 |
| mordred | ayoung: yes. one typically has two different sessions, one per cloud | 15:06 |
| ayoung | ah...yeah, service catalog... | 15:06 |
| mordred | ayoung: for context, I just had to write this: https://review.openstack.org/#/c/232530/ | 15:06 |
| ayoung | mordred, that is probably the most significant difference between the the two APIs. for most of the other entities, it is just taking domain into account | 15:06 |
| mordred | ayoung: yah - and having domain or not having domain is actually not terrible and keystone auth does a great job of making it not terrible | 15:07 |
| mordred | they way ksa discovery works is a shining example of it being done really well for the end user | 15:07 |
| *** fawadkhaliq has quit IRC | 15:08 | |
| *** csoukup has joined #openstack-keystone | 15:08 | |
| *** GB21 has joined #openstack-keystone | 15:08 | |
| ayoung | mordred, so, if jamie can be convinced, the rest of us will roll over. | 15:08 |
| mordred | \o/ | 15:08 |
| ayoung | In his absense, bknudson is probably your best point of contact | 15:08 |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Zanata https://review.openstack.org/232921 | 15:09 |
| mordred | I can wait for jamie - it's not urgent | 15:09 |
| mordred | this is more "I encountered pain as a consumer, I should communicate the pain back and also make a suggestion as to how I might not experience that pain" | 15:09 |
| mordred | I've already worked around it :) | 15:09 |
| *** sdake has joined #openstack-keystone | 15:13 | |
| *** mordgan is now known as morgan | 15:14 | |
| *** fawadkhaliq has joined #openstack-keystone | 15:14 | |
| *** davidsha has joined #openstack-keystone | 15:16 | |
| davidsha | Hey, quick question! are there any bugs in keystone master related to the database atm | 15:16 |
| *** lastops has joined #openstack-keystone | 15:17 | |
| morgan | mordred: do you have a good doc for znc setup thesedays? | 15:17 |
| *** ozialien has joined #openstack-keystone | 15:18 | |
| morgan | mordred: stevemar_ needs it | 15:18 |
| mordred | morgan: I stopped doing znc a while ago - I think sdague and dhellmann have some good docs on it | 15:18 |
| *** topol has quit IRC | 15:18 | |
| hogepodge | mordred: fwiw, on the defcore/interop side we're starting to push clouds to upgrade to v2 | 15:18 |
| mordred | morgan: I just run weechat in a tmux session | 15:18 |
| morgan | Will send stevemar_ their way | 15:18 |
| mordred | hogepodge: v2 of? | 15:18 |
| *** browne has quit IRC | 15:18 | |
| hogepodge | mordred: these api transitions that take years to happen gets a bit old, and creates many more special snowflakes | 15:19 |
| morgan | mordred: glance? | 15:19 |
| hogepodge | mordred: v3 on | 15:19 |
| hogepodge | mordred: keystone, glance, cinder | 15:19 |
| hogepodge | mordred: none have really completely transitioned, to be fair, it's a really difficult problem | 15:19 |
| mordred | hogepodge: nod. awesome. so - the main thing from my point of view is that we cannot have these transitions ever again | 15:19 |
| mordred | hogepodge: like, I don't care whether the API is semver marked - we, as a tech community quite simply cannot agree to breaking API changes | 15:20 |
| morgan | mordred: the biggest issue with keystone v3 adoption was the hard tie of auth to the crud api | 15:20 |
| hogepodge | mordred: I don't have any idea how we would handle a new api transition from an interop point of view | 15:20 |
| mordred | because they ALWAYS will take years to happen | 15:20 |
| mordred | hogepodge: new API transition can only be incremental adds | 15:20 |
| mordred | hogepodge: we've passed the point where removing something is acceptable | 15:20 |
| morgan | Because otherwise the v2v3 concern would have been narrow | 15:20 |
| mordred | hogepodge: like, I dont mean long deprecation - I mean NEVER | 15:21 |
| *** geoffarnoldX has quit IRC | 15:22 | |
| morgan | And fwiw I agree that v2 needed to die way earlier and only for one reason - security model | 15:22 |
| hogepodge | I'm ok if you deprecate like you mean it. | 15:22 |
| mordred | I'm not | 15:22 |
| morgan | Otherwise v2 could live on forever as frozen | 15:22 |
| morgan | No new features | 15:22 |
| mordred | the ones that are in deprecation alreayd - k2, g1, nova-net - the cat is already out of the bag on those transitions and we can't fix it | 15:23 |
| mordred | but we cannot do any more of these | 15:23 |
| mordred | because 'deprecation' is meaningless when there are 100s of clouds out there with different lifecycles | 15:23 |
| morgan | But didnt need to be removed. If auth was separate and the security model wasnt awful v2 keystone could just be "deprecated" or frozen forever never removed | 15:23 |
| mordred | morgan: yup | 15:23 |
| morgan | To be fair we could probably fix v2 security model and still split auth out. But.. Hard to do right | 15:24 |
| mordred | yah | 15:25 |
| openstackgerrit | Merged openstack/oslo.policy: Updated from global requirements https://review.openstack.org/232885 | 15:26 |
| ayoung | mordred, we should have just made projects hierarchical and not introduced domains | 15:26 |
| *** mylu has joined #openstack-keystone | 15:26 | |
| hogepodge | "It's projects all the way down" | 15:26 |
| ayoung | hogepodge, It worked for the File system | 15:28 |
| mordred | ayoung: I agree. but then, there are many things we should have done | 15:30 |
| *** roxanagh_ has joined #openstack-keystone | 15:30 | |
| ayoung | mordred, In this case, though, I suggested it back then, and I regret not sticking to my guns. | 15:31 |
| jrist | krotscheck: is your name pronounced how it looks? krots check ? | 15:31 |
| *** su_zhang has quit IRC | 15:32 | |
| *** BAKfr has quit IRC | 15:32 | |
| krotscheck | jrist: emphasis on the first syllable, 'kro'-scheck | 15:33 |
| *** BAKfr has joined #openstack-keystone | 15:33 | |
| odyssey4me | I'm busy working through liberty configs, and as far as I know we're supposed to be configuring 'user_name' under the keystone_authtoken section for all services. Is that correct? | 15:34 |
| jrist | krotscheck: ah cool. neat name | 15:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor: change 404 status codes in test names https://review.openstack.org/233124 | 15:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor: change 400 status codes in test names https://review.openstack.org/233125 | 15:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor: change 410 status codes in test names https://review.openstack.org/233126 | 15:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor: change 403 status codes in test names https://review.openstack.org/233127 | 15:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor: Don't hard code 409 Conflict error codes https://review.openstack.org/233128 | 15:34 |
| *** EinstCrazy has quit IRC | 15:35 | |
| *** EinstCrazy has joined #openstack-keystone | 15:35 | |
| *** marzif has quit IRC | 15:35 | |
| *** marzif has joined #openstack-keystone | 15:36 | |
| *** e0ne has quit IRC | 15:37 | |
| *** ozialien has quit IRC | 15:37 | |
| *** e0ne has joined #openstack-keystone | 15:39 | |
| mordred | GAH | 15:40 |
| mordred | morgan, stevemar_: SAD PANDA v2 and v3 endpoint creation is completely different | 15:41 |
| *** e0ne has quit IRC | 15:43 | |
| odyssey4me | lbragstad dolphm got a minute? I need to puzzle out the appropriate way to configure keystone middleware for the services | 15:44 |
| lbragstad | odyssey4me sure, what's up? | 15:45 |
| ayoung | marekd, OK, Federation queston for you. If I have an Ephemeral user identified vi a Principal, should I use this field as the username, and then use it to generat the userid, or can I feed this in as the user id, and the whole thing will be hashed to create the actual userid? | 15:46 |
| odyssey4me | lbragstad well, I thought that the config needed to switch from https://github.com/openstack/openstack-ansible/blob/master/playbooks/roles/os_glance/templates/glance-api.conf.j2#L61-L71 to use 'user_name' in the configuration | 15:46 |
| odyssey4me | lbragstad but that doesn't work - then this tells me a totally different story: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_auth.py#L180-L187 | 15:47 |
| odyssey4me | lbragstad but I've seen hints all over the place that the right way to do it from now on is to use the plugin method, but I can't seem to find a useful reference for how that works | 15:48 |
| odyssey4me | lbragstad this perhaps needs to move along, along with the patch behind it: https://review.openstack.org/#/c/219162/ | 15:48 |
| *** fhubik has quit IRC | 15:50 | |
| ayoung | morgan, bknudson lbragstad is there any reason we need to make the local_id of the identity mapping field varchar(64) or can we expand it? As I recally, we don't take a hit until > 255, right? | 15:50 |
| lbragstad | odyssey4me interesting, according to dave's patch, you still need to have the username in the keystone_authtoken section, right? | 15:52 |
| *** jbell8 has joined #openstack-keystone | 15:52 | |
| lbragstad | ayoung for the overall length of the token, eys | 15:52 |
| lbragstad | yes* | 15:52 |
| odyssey4me | lbragstad it's inconsistent - line 250 says admin_user | 15:53 |
| odyssey4me | lbragstad but line 261 says this method is deprecated | 15:53 |
| odyssey4me | lbragstad then line 316 uses username | 15:54 |
| lbragstad | odyssey4me ah, right... checking the code | 15:54 |
| odyssey4me | lbragstad it would appear that the right method is outlined in 308-318 - but other stuff I've read seems to indicate that when you have 'auth_plugin = foo' then the config file needs a section '[foo] | 15:55 |
| *** dims_ has joined #openstack-keystone | 15:56 | |
| *** dims_ has quit IRC | 15:56 | |
| odyssey4me | lbragstad eg: http://www.jamielennox.net/blog/2015/02/17/loading-authentication-plugins/ | 15:56 |
| lbragstad | odyssey4me this shows that the admin_token option is deprecated - https://github.com/openstack/keystonemiddleware/blob/647f2ab9c437e2bcd6fd9a12a6f52a39553c9a80/keystonemiddleware/auth_token/_auth.py#L171-L179 | 15:56 |
| odyssey4me | yep, that is not where the confusion is :p | 15:57 |
| odyssey4me | it's whether it should be admin_user, username or a whole separate section of options | 15:57 |
| *** ankurgupta has joined #openstack-keystone | 15:58 | |
| ayoung | lbragstad, Heh..you are carrying too many conversations. I mean at the database level for that table. I have some really long REMOTE_USER values coming from Kerberos, and I'd rather not truncate them | 15:58 |
| *** dimsum__ has quit IRC | 15:59 | |
| *** phalmos has joined #openstack-keystone | 16:00 | |
| lbragstad | ayoung oh, in that case, i don't know if there was a reason we stuck to varchar(64) | 16:02 |
| lbragstad | ayoung stevemar_ might know? | 16:02 |
| *** _cjones_ has quit IRC | 16:02 | |
| *** phalmos has quit IRC | 16:02 | |
| *** phalmos has joined #openstack-keystone | 16:03 | |
| ayoung | lbragstad, actually, I think it is the public_id field I need. I'm going to see if I can chop off the REALM section of that. | 16:03 |
| ayoung | lbragstad, he has hands in his mouth at the moment | 16:03 |
| lbragstad | ayoung oh, that's right.. | 16:03 |
| lbragstad | odyssey4me i'm going to do some digging and see if i can come up with some better information | 16:05 |
| odyssey4me | thanks lbragstad :) | 16:06 |
| *** sdake_ has joined #openstack-keystone | 16:06 | |
| *** sdake has quit IRC | 16:06 | |
| stevemar_ | lbragstad: ayoung back, no more hands in my mouth | 16:08 |
| *** jistr has quit IRC | 16:08 | |
| *** ozialien has joined #openstack-keystone | 16:08 | |
| stevemar_ | so there wasn't a good reason to keep it at varchar(64) other than 'that's what user ids in keystone are limited to' | 16:08 |
| ayoung | stevemar_, so its the remote that I care about | 16:09 |
| ayoung | I have service principals that are pretty long | 16:09 |
| ayoung | we used to have a mechanism for splitting on the @ sign, but I think that does not work with mapping | 16:09 |
| *** dimsum__ has joined #openstack-keystone | 16:09 | |
| stevemar_ | ayoung: that remote_user id from a federated source is still be shoved into a token | 16:09 |
| *** dimsum__ has quit IRC | 16:09 | |
| ayoung | regex is just for matching, not for splitting | 16:09 |
| *** kiran-r has joined #openstack-keystone | 16:09 | |
| *** dimsum__ has joined #openstack-keystone | 16:10 | |
| stevemar_ | yep | 16:10 |
| mordred | so - in k2, you have one API call to set public/internal/admin ... what happens if you do create_endpoint(service, region, publicurl='foo') and then create_endpoint(service, region, adminurl='foo') | 16:10 |
| mordred | ? | 16:10 |
| mordred | is that permissable? | 16:11 |
| ayoung | stevemar_, going to hack my install to let it be 200 chars long, but I suspect we will want to do a mix: | 16:11 |
| mordred | or does that break something? | 16:11 |
| ayoung | we should be able to select the domain based on REALM, and only use the user specific portion of the principal as the user name | 16:11 |
| *** pnavarro is now known as pnavarro|off | 16:11 | |
| *** gyee has joined #openstack-keystone | 16:12 | |
| *** ChanServ sets mode: +v gyee | 16:12 | |
| ayoung | mordred, no idea. | 16:12 |
| stevemar_ | mordred: that should work | 16:12 |
| ayoung | I think Keystone would be fine, but the other services? | 16:12 |
| *** kiran-r has quit IRC | 16:12 | |
| stevemar_ | mordred: in v3 it's 3 calls to create_endpoint to do what was done in 1 call in v2 | 16:12 |
| mordred | stevemar_: yup. but if I can do it in 3 calls in v2 as well, then it simplifies the consolidation interface in ansible | 16:13 |
| mordred | stevemar_: so I'm going to go with that for now and see what breaks | 16:13 |
| *** tonytan4ever has quit IRC | 16:18 | |
| *** lsmola_ has quit IRC | 16:18 | |
| stevemar_ | ayoung: yeah, jamie showed me the error a few days ago | 16:19 |
| *** phalmos has quit IRC | 16:19 | |
| *** topol has joined #openstack-keystone | 16:19 | |
| *** ChanServ sets mode: +v topol | 16:19 | |
| ayoung | stevemar_, did it have this in it:2015-10-09 12:18:04.622 3136 TRACE keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/contrib/federation/utils.py", line 615, in _update_local_mapping | 16:19 |
| ayoung | 2015-10-09 12:18:04.622 3136 TRACE keystone.common.wsgi new_value = v.format(*direct_maps) | 16:19 |
| ayoung | I'm wondering if this is a different issue. | 16:19 |
| stevemar_ | but agreed, we should either fix the mapping to pick up the user name, or change it from varchar64 to something bigger.. | 16:19 |
| stevemar_ | ayoung: i was only shown the mapping output and generated username (how it's greater than 64 chars) | 16:20 |
| ayoung | stevemar_, there was an option on mod_auth_kerb to chop out the REALM name, but I think that only works for very limited cases. | 16:20 |
| ayoung | stevemar_, local_id is the user_id, post mopping, and public_id is the value from REMOTE_USER, right? | 16:22 |
| *** topol has quit IRC | 16:23 | |
| *** davidsha has left #openstack-keystone | 16:24 | |
| *** mylu has quit IRC | 16:24 | |
| ayoung | #success proton driver running with Kerberos for encryption and authentication | 16:24 |
| openstackstatus | ayoung: Added success to Success page | 16:24 |
| *** mylu has joined #openstack-keystone | 16:25 | |
| ayoung | Heh | 16:25 |
| *** itlinux has joined #openstack-keystone | 16:25 | |
| stevemar_ | #success unlocked secret success bot | 16:26 |
| openstackstatus | stevemar_: Added success to Success page | 16:26 |
| stevemar_ | how am i just learning about this NOW?!? | 16:26 |
| stevemar_ | ayoung: that's cool, glad there is an option in kerb | 16:26 |
| ayoung | stevemar_, Yeah, this is very good. I need to solve this issue with principal names for the long term. I can fake it by keeping my princiapls short for the demo | 16:27 |
| ayoung | but...meh | 16:27 |
| *** _cjones_ has joined #openstack-keystone | 16:28 | |
| *** sdake_ is now known as sdake | 16:28 | |
| *** mylu has quit IRC | 16:29 | |
| *** browne has joined #openstack-keystone | 16:32 | |
| *** browne1 has joined #openstack-keystone | 16:35 | |
| *** browne has quit IRC | 16:35 | |
| *** su_zhang has joined #openstack-keystone | 16:37 | |
| *** mylu has joined #openstack-keystone | 16:41 | |
| *** tonytan4ever has joined #openstack-keystone | 16:43 | |
| *** jsavak has quit IRC | 16:44 | |
| *** jsavak has joined #openstack-keystone | 16:45 | |
| *** stevemar_ has quit IRC | 16:46 | |
| *** phalmos has joined #openstack-keystone | 16:49 | |
| *** mdavidson has quit IRC | 16:49 | |
| *** thiagop has joined #openstack-keystone | 16:53 | |
| *** BAKfr has quit IRC | 16:53 | |
| *** BAKfr has joined #openstack-keystone | 16:55 | |
| *** zzzeek_ has joined #openstack-keystone | 16:56 | |
| *** zzzeek has quit IRC | 16:58 | |
| *** zzzeek_ is now known as zzzeek | 16:58 | |
| *** weihan has quit IRC | 16:59 | |
| *** jaosorior has quit IRC | 17:00 | |
| *** aix has quit IRC | 17:02 | |
| *** phalmos has quit IRC | 17:06 | |
| *** spandhe has joined #openstack-keystone | 17:08 | |
| *** amakarov is now known as amakarov_away | 17:08 | |
| *** markvoelker has quit IRC | 17:12 | |
| morgan | #success Survived PTLing for two cycles and am able to now write code again. | 17:14 |
| openstackstatus | morgan: Added success to Success page | 17:14 |
| morgan | :P | 17:14 |
| *** alextricity has joined #openstack-keystone | 17:15 | |
| *** GB21 has quit IRC | 17:18 | |
| *** fawadkhaliq has quit IRC | 17:18 | |
| *** stevemar_ has joined #openstack-keystone | 17:20 | |
| *** ChanServ sets mode: +o stevemar_ | 17:20 | |
| *** stevemar_ has quit IRC | 17:20 | |
| *** diazjf has joined #openstack-keystone | 17:21 | |
| *** GB21 has joined #openstack-keystone | 17:24 | |
| samueldmq | morgan: ++ :) | 17:24 |
| *** fawadkhaliq has joined #openstack-keystone | 17:24 | |
| *** fawadkhaliq has joined #openstack-keystone | 17:24 | |
| *** fawadkhaliq has quit IRC | 17:25 | |
| *** thiagop has quit IRC | 17:29 | |
| *** jbell8 has quit IRC | 17:30 | |
| *** henrynash has joined #openstack-keystone | 17:31 | |
| *** ChanServ sets mode: +v henrynash | 17:31 | |
| *** itlinux has quit IRC | 17:31 | |
| *** nicodemos has joined #openstack-keystone | 17:33 | |
| *** itlinux has joined #openstack-keystone | 17:33 | |
| *** dsirrine has quit IRC | 17:34 | |
| *** dsirrine has joined #openstack-keystone | 17:35 | |
| *** marzif has quit IRC | 17:37 | |
| *** jbell8 has joined #openstack-keystone | 17:38 | |
| *** timcline has quit IRC | 17:38 | |
| *** thiagop has joined #openstack-keystone | 17:40 | |
| *** lhcheng has joined #openstack-keystone | 17:42 | |
| *** ChanServ sets mode: +v lhcheng | 17:42 | |
| *** ankurgupta has left #openstack-keystone | 17:47 | |
| *** mylu has quit IRC | 17:49 | |
| *** mylu has joined #openstack-keystone | 17:51 | |
| *** sdake has quit IRC | 17:53 | |
| *** sdake has joined #openstack-keystone | 17:54 | |
| *** timcline has joined #openstack-keystone | 17:57 | |
| *** alextricity has quit IRC | 17:59 | |
| *** pnavarro|off has quit IRC | 17:59 | |
| *** mylu has quit IRC | 18:00 | |
| *** fhubik has joined #openstack-keystone | 18:00 | |
| *** timcline has quit IRC | 18:02 | |
| *** stevemar_ has joined #openstack-keystone | 18:02 | |
| *** ChanServ sets mode: +o stevemar_ | 18:02 | |
| *** fhubik has quit IRC | 18:03 | |
| *** jbell8 has quit IRC | 18:03 | |
| *** lastops has quit IRC | 18:03 | |
| *** jbell8 has joined #openstack-keystone | 18:03 | |
| *** spandhe has quit IRC | 18:05 | |
| *** mylu has joined #openstack-keystone | 18:06 | |
| *** sdake has quit IRC | 18:07 | |
| openstackgerrit | Merged openstack/keystone: Enable password_config_option_not_marked_secret Bandit test https://review.openstack.org/225691 | 18:07 |
| *** roxanaghe has quit IRC | 18:07 | |
| *** jbell8 has quit IRC | 18:08 | |
| *** ayoung has quit IRC | 18:08 | |
| *** jbell8 has joined #openstack-keystone | 18:08 | |
| *** jbell8 has quit IRC | 18:09 | |
| *** timcline has joined #openstack-keystone | 18:09 | |
| *** timcline_ has joined #openstack-keystone | 18:10 | |
| *** roxanagh_ has quit IRC | 18:12 | |
| *** fawadkhaliq has joined #openstack-keystone | 18:13 | |
| *** roxanaghe has joined #openstack-keystone | 18:14 | |
| *** timcline has quit IRC | 18:14 | |
| *** timcline has joined #openstack-keystone | 18:15 | |
| *** fawadk has joined #openstack-keystone | 18:15 | |
| *** spandhe has joined #openstack-keystone | 18:16 | |
| *** jbell8 has joined #openstack-keystone | 18:16 | |
| *** fawadkhaliq has quit IRC | 18:17 | |
| *** mylu has quit IRC | 18:18 | |
| *** timcline_ has quit IRC | 18:18 | |
| *** mylu has joined #openstack-keystone | 18:18 | |
| *** spandhe has quit IRC | 18:19 | |
| *** timcline_ has joined #openstack-keystone | 18:19 | |
| *** topol has joined #openstack-keystone | 18:20 | |
| *** ChanServ sets mode: +v topol | 18:20 | |
| *** ayoung has joined #openstack-keystone | 18:20 | |
| *** ChanServ sets mode: +v ayoung | 18:20 | |
| *** jbell8 has quit IRC | 18:20 | |
| *** itlinux has quit IRC | 18:22 | |
| *** timcline has quit IRC | 18:22 | |
| *** itlinux has joined #openstack-keystone | 18:23 | |
| *** mylu has quit IRC | 18:23 | |
| *** mylu has joined #openstack-keystone | 18:23 | |
| *** spandhe has joined #openstack-keystone | 18:26 | |
| *** sdake has joined #openstack-keystone | 18:31 | |
| *** woodster_ has joined #openstack-keystone | 18:33 | |
| *** jsavak has quit IRC | 18:34 | |
| *** jbell8 has joined #openstack-keystone | 18:34 | |
| *** jbell8 has quit IRC | 18:34 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 18:34 | |
| *** jsavak has joined #openstack-keystone | 18:34 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:35 | |
| *** su_zhang has quit IRC | 18:36 | |
| *** jbell8 has joined #openstack-keystone | 18:37 | |
| *** jistr has joined #openstack-keystone | 18:40 | |
| *** jbell8 has joined #openstack-keystone | 18:40 | |
| *** itlinux has quit IRC | 18:43 | |
| *** mylu has quit IRC | 18:45 | |
| *** GB21 has quit IRC | 18:46 | |
| *** fawadkhaliq has joined #openstack-keystone | 18:49 | |
| *** jsavak has quit IRC | 18:49 | |
| *** jsavak has joined #openstack-keystone | 18:50 | |
| *** jistr is now known as jistr|afk | 18:50 | |
| *** petertr7 is now known as petertr7_away | 18:52 | |
| *** fawadk has quit IRC | 18:52 | |
| *** tsymancz4k has quit IRC | 18:59 | |
| *** tsymanczyk has quit IRC | 18:59 | |
| *** petertr7_away is now known as petertr7 | 19:00 | |
| *** exploreshaifali has joined #openstack-keystone | 19:00 | |
| *** tsymanczyk has joined #openstack-keystone | 19:01 | |
| *** fawadk has joined #openstack-keystone | 19:01 | |
| *** tsymanczyk is now known as Guest37591 | 19:02 | |
| *** jsavak has quit IRC | 19:03 | |
| *** roxanaghe has quit IRC | 19:03 | |
| *** fawadkhaliq has quit IRC | 19:03 | |
| *** pnavarro|off has joined #openstack-keystone | 19:04 | |
| *** jistr|afk has quit IRC | 19:05 | |
| *** jsavak has joined #openstack-keystone | 19:07 | |
| *** Guest37591 has quit IRC | 19:09 | |
| *** spandhe has quit IRC | 19:10 | |
| *** lhcheng has quit IRC | 19:12 | |
| *** harlowja has quit IRC | 19:12 | |
| *** mylu has joined #openstack-keystone | 19:15 | |
| *** pnavarro|off has quit IRC | 19:18 | |
| *** lhcheng has joined #openstack-keystone | 19:19 | |
| *** ChanServ sets mode: +v lhcheng | 19:19 | |
| *** itlinux has joined #openstack-keystone | 19:19 | |
| *** mylu has quit IRC | 19:19 | |
| *** mylu has joined #openstack-keystone | 19:20 | |
| *** mylu_ has joined #openstack-keystone | 19:22 | |
| *** mylu has quit IRC | 19:23 | |
| *** harlowja has joined #openstack-keystone | 19:24 | |
| *** diazjf has quit IRC | 19:25 | |
| *** diazjf has joined #openstack-keystone | 19:26 | |
| *** itlinux has quit IRC | 19:26 | |
| dstanek | stevemar_: until recently i didn't know what el capitan was :-) | 19:30 |
| *** tonytan4ever has quit IRC | 19:31 | |
| *** hrou has quit IRC | 19:36 | |
| *** spandhe has joined #openstack-keystone | 19:36 | |
| samueldmq | dstanek: I didn't know until .. now | 19:36 |
| *** su_zhang has joined #openstack-keystone | 19:37 | |
| samueldmq | ayoung: henrynash so we will probably have an outreachy student this year | 19:38 |
| *** ayoung has quit IRC | 19:38 | |
| samueldmq | and I am thinking about (with her) potential project proposals | 19:38 |
| samueldmq | I am thinking about something policy related, but we can't have something more concrete pre-summit | 19:38 |
| samueldmq | and I don't want to leave her fustrated by working in a subject in which we haven't 100% agreement | 19:39 |
| samueldmq | henrynash: dstanek: gyee: stevemar_: anyoneelse: any idea in your mind already ? ^ | 19:40 |
| dstanek | samueldmq: she should start with fixing bugs and getting used to the process | 19:40 |
| dstanek | imo, stability is the most important thing | 19:41 |
| *** su_zhang has quit IRC | 19:41 | |
| samueldmq | dstanek: yes, she started looking at it already, but we need to create a project proposal too, that's why I wonder about the specific subject | 19:41 |
| samueldmq | dstanek: so maybe something about functional tests ? | 19:42 |
| samueldmq | (I don't know how far we are in that front) | 19:42 |
| *** itlinux has joined #openstack-keystone | 19:42 | |
| *** tonytan4ever has joined #openstack-keystone | 19:44 | |
| stevemar_ | dstanek: i just learned what it is | 19:45 |
| *** tsymanczyk has joined #openstack-keystone | 19:48 | |
| *** tsymanczyk is now known as Guest71979 | 19:48 | |
| *** itlinux has quit IRC | 19:48 | |
| *** e0ne has joined #openstack-keystone | 19:49 | |
| *** nicodemos has quit IRC | 19:50 | |
| dstanek | samueldmq: so some sort of school requirement? | 19:55 |
| *** timcline_ has quit IRC | 19:55 | |
| samueldmq | stevemar_: for the program it's required to ahve a project proposal, like what you will do during the program, etc | 19:55 |
| samueldmq | stevemar_: oops, sorry .. dstanek ^ | 19:56 |
| dstanek | yeah, no idea then. best advice i have is to stick the non-controversial topics | 19:58 |
| *** tsymancz1k has joined #openstack-keystone | 19:58 | |
| *** fawadkhaliq has joined #openstack-keystone | 19:58 | |
| *** timcline has joined #openstack-keystone | 19:58 | |
| *** florianf is now known as florianf|away | 19:58 | |
| samueldmq | dstanek: yes I agree with you | 19:59 |
| dstanek | samueldmq: what about picking a topic that has lots of bugs write a proposal to fix them all :-) | 19:59 |
| samueldmq | dstanek: so that we avoid frustation | 19:59 |
| samueldmq | dstanek: can be a good idea, you have an example in mind ? | 19:59 |
| dstanek | unfortunately with open source there is a lot of frustration | 20:00 |
| * samueldmq should look at the existing bugs | 20:00 | |
| dstanek | not to pick on federation, but i was just looking at the list of bugs with that tag http://bit.ly/1huJrbO | 20:02 |
| dstanek | there are 300 bugs so there should be no shortage of bugs to fix | 20:02 |
| lbragstad | dstanek ++ i love the idea | 20:02 |
| *** fawadk has quit IRC | 20:02 | |
| dstanek | keystone is getting too feature heavy imo and we need to fix and stabilize what we have | 20:03 |
| *** timcline has quit IRC | 20:03 | |
| *** tsymancz1k has quit IRC | 20:04 | |
| *** Guest71979 has quit IRC | 20:04 | |
| stevemar_ | dstanek: agreeeed | 20:06 |
| *** tsymancz1k has joined #openstack-keystone | 20:08 | |
| *** gordc has quit IRC | 20:09 | |
| samueldmq | dstanek: ++ | 20:09 |
| samueldmq | like hardening exisitng features by testint them more (functional ?), maybe looking at performance too ? | 20:10 |
| alejandrito | hi all, how a bad practice is to have for example an openstack kilo production deployment with admin_token configured on keystone ? | 20:11 |
| dstanek | alejandrito: i'm going to go with super bad | 20:11 |
| dstanek | alejandrito: depends on the risk that you could leak that value | 20:12 |
| alejandrito | so, what would be the BEST PRACTICE knowing that i dont have SSL communication between apis ? | 20:14 |
| alejandrito | dstanek, ^^ | 20:14 |
| dstanek | alejandrito: why do you have it on? if you don't have SSL it's even worse | 20:14 |
| *** tsymancz4k has joined #openstack-keystone | 20:15 | |
| dstanek | alejandrito: you can also leak regular tokens without SSL | 20:15 |
| alejandrito | so, doesnt having SSL its the same having or not admin_token because i can also leak normal tokens right ? | 20:16 |
| alejandrito | dstanek, ^^ | 20:16 |
| dstanek | alejandrito: the recommendation from the docs is to use it to bootstrap and turn it off after | 20:16 |
| dstanek | without SSL everything leaks. | 20:16 |
| dstanek | alejandrito: is there any reason you need admin tokens? | 20:18 |
| stevemar_ | lbragstad: i find your test refactoring to be pointless, and i mean that in the nicest way possible | 20:18 |
| dstanek | #fail | 20:18 |
| stevemar_ | you went to a lot of effort for it, so i still +2'ed but mehhhh | 20:19 |
| dstanek | alejandrito: also any reason why you don't use SSL in production? | 20:19 |
| alejandrito | dstanek, mainly cause the documentation on each project its not clear about how to enable ssl communication between them, or i dont have enough experience | 20:20 |
| dstanek | alejandrito: it's easy at least for Keystone. | 20:21 |
| stevemar_ | alejandrito: sounds like it's not quite production yet then | 20:21 |
| dstanek | alejandrito: if nothing else turn off the admin token in production | 20:21 |
| *** jsavak has quit IRC | 20:22 | |
| alejandrito | stevemar_, sure ... seems not | 20:22 |
| stevemar_ | dstanek: alejandrito yes, definitely turn off admin token in your live environment | 20:22 |
| *** jsavak has joined #openstack-keystone | 20:23 | |
| *** roxanaghe has joined #openstack-keystone | 20:24 | |
| *** e0ne has quit IRC | 20:26 | |
| *** diazjf has quit IRC | 20:29 | |
| alejandrito | stevemar_, dstanek thanks so much for the advices | 20:30 |
| stevemar_ | np | 20:31 |
| dstanek | alejandrito: np | 20:32 |
| *** tsymancz4k has quit IRC | 20:35 | |
| *** tsymancz1k has quit IRC | 20:35 | |
| *** roxanaghe has quit IRC | 20:36 | |
| *** roxanaghe has joined #openstack-keystone | 20:36 | |
| *** hrou has joined #openstack-keystone | 20:36 | |
| *** jsavak has quit IRC | 20:37 | |
| *** jsavak has joined #openstack-keystone | 20:38 | |
| *** tsymancz2k has joined #openstack-keystone | 20:40 | |
| *** su_zhang has joined #openstack-keystone | 20:41 | |
| *** mylu_ has quit IRC | 20:42 | |
| *** mylu has joined #openstack-keystone | 20:42 | |
| *** akanksha_ has joined #openstack-keystone | 20:42 | |
| *** jsavak has quit IRC | 20:42 | |
| *** jsavak has joined #openstack-keystone | 20:43 | |
| *** tsymanczyk has joined #openstack-keystone | 20:46 | |
| *** tsymanczyk is now known as Guest98899 | 20:46 | |
| *** njohnston is now known as nate_gone | 20:46 | |
| *** su_zhang has quit IRC | 20:49 | |
| *** su_zhang has joined #openstack-keystone | 20:49 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Tests for projects acting as domains https://review.openstack.org/211219 | 20:50 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 20:50 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Removes project.domain_id FK https://review.openstack.org/233274 | 20:50 |
| *** roxanaghe has quit IRC | 20:50 | |
| *** roxanaghe has joined #openstack-keystone | 20:51 | |
| *** raildo is now known as raildo-afk | 20:55 | |
| *** petertr7 is now known as petertr7_away | 21:00 | |
| *** marzif has joined #openstack-keystone | 21:02 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 21:04 |
| *** sdake_ has joined #openstack-keystone | 21:04 | |
| *** sdake has quit IRC | 21:06 | |
| *** david_cu has quit IRC | 21:08 | |
| *** edmondsw has quit IRC | 21:12 | |
| *** edmondsw has joined #openstack-keystone | 21:12 | |
| *** jsavak has quit IRC | 21:13 | |
| *** sdake_ has quit IRC | 21:14 | |
| *** csoukup has quit IRC | 21:15 | |
| *** edmondsw has quit IRC | 21:17 | |
| *** sdake has joined #openstack-keystone | 21:19 | |
| *** exploreshaifali has quit IRC | 21:21 | |
| *** EinstCrazy has quit IRC | 21:21 | |
| *** EinstCrazy has joined #openstack-keystone | 21:24 | |
| *** phalmos has joined #openstack-keystone | 21:26 | |
| breton | btw | 21:28 |
| breton | what happened to the previous student who worked with henrynash? | 21:29 |
| *** fawadkhaliq has quit IRC | 21:30 | |
| *** mylu has quit IRC | 21:30 | |
| *** fawadkhaliq has joined #openstack-keystone | 21:31 | |
| *** jbell8 has quit IRC | 21:33 | |
| *** fawadkhaliq has quit IRC | 21:34 | |
| *** hrou has quit IRC | 21:38 | |
| *** phalmos has quit IRC | 21:39 | |
| *** browne1 has quit IRC | 21:43 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:58 | |
| *** shaleh has joined #openstack-keystone | 21:58 | |
| *** stevemar_ has quit IRC | 22:06 | |
| *** slberger has left #openstack-keystone | 22:14 | |
| harlowja | btw example in http://lists.openstack.org/pipermail/openstack-dev/2015-October/076664.html could also be how keystone discovers services :-P | 22:21 |
| harlowja | wink wink, ha | 22:21 |
| harlowja | relabel resource watcher in http://paste.openstack.org/show/475938/ ---> 'service watcher' , lol | 22:22 |
| *** henrynash has quit IRC | 22:34 | |
| *** alejandrito has quit IRC | 22:34 | |
| *** mfisch has quit IRC | 22:34 | |
| *** mfisch has joined #openstack-keystone | 22:35 | |
| *** mfisch is now known as Guest27764 | 22:35 | |
| *** Guest27764 is now known as mfisch | 22:37 | |
| *** mfisch has joined #openstack-keystone | 22:37 | |
| *** tonytan4ever has quit IRC | 22:39 | |
| harlowja | or even better, http://paste.openstack.org/show/475941/ | 22:39 |
| *** diazjf has joined #openstack-keystone | 22:41 | |
| samueldmq | dstanek: ++ on keystone office hours :) | 22:42 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/232874 | 22:46 |
| *** dims_ has joined #openstack-keystone | 22:50 | |
| *** marzif has quit IRC | 22:51 | |
| *** dimsum__ has quit IRC | 22:53 | |
| *** miguelgrinberg has quit IRC | 22:53 | |
| *** miguelgrinberg has joined #openstack-keystone | 22:53 | |
| *** r-daneel has quit IRC | 23:07 | |
| *** dims_ has quit IRC | 23:07 | |
| harlowja | interesting i see why u guys wouldn't mind consul, it pretty much provides the stuff keystone wants, haha | 23:09 |
| harlowja | http://python-consul.readthedocs.org/en/latest/#consul-catalog :-P | 23:09 |
| *** markvoelker_ has joined #openstack-keystone | 23:10 | |
| harlowja | seems like the python client though doesn't have watch apis :( | 23:11 |
| harlowja | http://python-consul.readthedocs.org/en/latest/#consul-event seems nice though | 23:11 |
| *** topol has quit IRC | 23:25 | |
| *** sdake has quit IRC | 23:26 | |
| *** woodster_ has quit IRC | 23:29 | |
| *** btully has quit IRC | 23:41 | |
| *** hrou has joined #openstack-keystone | 23:54 | |
| *** jsavak has joined #openstack-keystone | 23:56 | |
| *** su_zhang has quit IRC | 23:57 | |
| *** mylu has joined #openstack-keystone | 23:57 | |
| *** jsavak has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!