| gyee | does it work with emojis? | 00:00 |
|---|---|---|
| gyee | just kidding :) | 00:00 |
| shaleh | gyee: there is a probably a way. But I am over 30 :-) | 00:01 |
| *** aginwal__ has quit IRC | 00:02 | |
| shaleh | ayoung: flyspell-prog-mode runs spell check in comments. Very handy. | 00:05 |
| notmorgan | gyee: oh hai | 00:06 |
| *** pushkaru has quit IRC | 00:07 | |
| *** adelia has quit IRC | 00:07 | |
| *** adelia has joined #openstack-keystone | 00:08 | |
| *** spandhe has quit IRC | 00:09 | |
| gyee | notmorgan, yes sir | 00:09 |
| notmorgan | just forgot what i was going to ask | 00:10 |
| notmorgan | ugh | 00:10 |
| *** adelia has quit IRC | 00:10 | |
| *** adelia has joined #openstack-keystone | 00:10 | |
| notmorgan | gyee: oh right. want to get any performance information you're currently running across in deployments (not public cloud obv.) when you have time of course | 00:10 |
| notmorgan | no rush | 00:10 |
| *** aginwala has joined #openstack-keystone | 00:10 | |
| notmorgan | gyee: as in... bottlenecks you've seen [email is fine] | 00:10 |
| gyee | notmorgan, yes, let me gather the information and email you | 00:11 |
| notmorgan | sounds good | 00:11 |
| gyee | role caching is one issue off the top of my head | 00:11 |
| gyee | we don't cache roles | 00:11 |
| stevemar_ | notmorgan: morgan!!!!!! | 00:11 |
| notmorgan | stevemar_: hi there. | 00:11 |
| notmorgan | stevemar_: what can i do fer you? | 00:11 |
| gyee | but I can send you the numbers from our perf clusters | 00:11 |
| stevemar_ | notmorgan: nothing, just saying hi | 00:12 |
| stevemar_ | :) | 00:12 |
| notmorgan | ah but i'm "notmorgan" | 00:12 |
| notmorgan | :P | 00:12 |
| *** jbell8 has quit IRC | 00:12 | |
| ayoung | shaleh, yeah, that was actually what I meant...I didn't know about flyspell, either | 00:13 |
| *** josecastroleon has quit IRC | 00:14 | |
| kfox1111 | do you need memcached with keystone if your using fernet tokens? | 00:14 |
| *** adelia has quit IRC | 00:14 | |
| notmorgan | kfox1111: you don't need memcached with keystone | 00:14 |
| *** aginwala has quit IRC | 00:14 | |
| notmorgan | kfox1111: no matter what you are using for tokens | 00:15 |
| *** aginwala_ has joined #openstack-keystone | 00:15 | |
| kfox1111 | s/keystone/horizon | 00:15 |
| notmorgan | kfox1111: shouldn't need it with horizon in either case. | 00:15 |
| kfox1111 | pki + keystone = horizon + memcached... | 00:15 |
| *** jbell8 has joined #openstack-keystone | 00:15 | |
| kfox1111 | the cookies ended up being too big without memcached. | 00:15 |
| *** aginwala_ has quit IRC | 00:15 | |
| notmorgan | you can use the db backing | 00:15 |
| notmorgan | in either case | 00:15 |
| notmorgan | but memcache works better | 00:16 |
| ayoung | gyee, shaleh thanks for the review. I will actually make the changes you suggest in the next review, when I post it over to Mitaka as well | 00:16 |
| gyee | ayoung, no problem, will wait for your next patch then | 00:16 |
| kfox1111 | yeah, but by the look of it,fernet tokens are small, so you don't need to persist it at all, and can just use cookies? | 00:16 |
| notmorgan | kfox1111: i would move away from PKI if you can and to fernet, fernet tokens shouldn't blow out the cookie sizes | 00:16 |
| shaleh | ayoung: np. Good to see this going somewhere | 00:16 |
| notmorgan | kfox1111: yeah | 00:16 |
| ayoung | gyee, its workflow +1. I'm going to let that go in | 00:16 |
| kfox1111 | k. was planning on it. just double checking if I can safely get rid of memcached when I do. | 00:17 |
| gyee | ayoung, that's fine | 00:17 |
| notmorgan | kfox1111: yeah you should be able to | 00:17 |
| ayoung | shaleh, not only is there no d in priveledged there is an i in privileged | 00:17 |
| shaleh | ayoung: :-) | 00:17 |
| gyee | damn spellcheck | 00:18 |
| *** aginwala has joined #openstack-keystone | 00:18 | |
| shaleh | ayoung: I still have scars from English teachers past. I am a pretty decent red ink wielder. | 00:18 |
| ayoung | shaleh, as I said, I wish this was end user documentation | 00:19 |
| ayoung | this degree of dilligence is awesome, its just that the spec effort is a dead end. | 00:19 |
| shaleh | ayoung: the next step is having docs people digest the specs | 00:20 |
| shaleh | ayoung: we devels are good at writing for each other. Real users needs a different level and approach. | 00:21 |
| *** jbell8 has quit IRC | 00:21 | |
| shaleh | ayoung: I beat up on grammar because it makes it easier for ESL folk to read and follow along. Hard enough dealing with proper English :-) | 00:21 |
| *** sthillma has joined #openstack-keystone | 00:27 | |
| gyee | shaleh, I was in ESL | 00:28 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Implied Roles https://review.openstack.org/125704 | 00:28 |
| ayoung | allright you pedants...I did clean it up | 00:29 |
| ayoung | shaleh, there is nothing proper about English | 00:29 |
| shaleh | ayoung: hey, you know you like the attention | 00:29 |
| shaleh | ayoung: that is way, way, true | 00:29 |
| shaleh | or is that weight, way, whey true? | 00:29 |
| *** aginwala has quit IRC | 00:29 | |
| ayoung | sthillma, mind if I discuss it here? | 00:29 |
| sthillma | ayoung, sure we can | 00:30 |
| ayoung | sthillma, why is your service catalog empty? | 00:30 |
| ayoung | Youi can certainly repopulate, but...it indicates larger problems | 00:30 |
| sthillma | seems like that might be more an issue on the installer/OSP-D side, unfortunately we were adding nodes and hitting other issues so inital deployment was a week+ ago | 00:31 |
| sthillma | if there’s anything in particular I should check for in the logs I can (this also isn’t my setup so I’m not 100% every step that was done), otherwise if it makes sense to repopulate, I’m open to giving it a shot | 00:34 |
| kfox1111 | it looks like embeding keystone in apache is prefered these days? | 00:36 |
| kfox1111 | what about https support? Is that best put in apache as well, or in haproxy? | 00:36 |
| *** akanksha_ has quit IRC | 00:38 | |
| *** jasonsb_ has quit IRC | 00:42 | |
| ayoung | sthillma, so...I would still wonder wjhy the service catalog was gone. Was it deleted? Was it never populated? I would think that your install was seriously cmpromised | 00:42 |
| ayoung | Its easy enough to create the catalog entries, but I wouldn't trust the rest of the stack | 00:42 |
| *** jasonsb has joined #openstack-keystone | 00:42 | |
| ayoung | kfox1111, https can be done either way. | 00:42 |
| ayoung | kfox1111, if you are using HA Proxy for other things, and you want to include Keystone in there, then HTTPS can be done to the proxy. | 00:43 |
| ayoung | If you are doing client cert auth, you want to go right to the HTTPD server, and do HTTPS out of there. You have options | 00:43 |
| kfox1111 | k. thx. | 00:46 |
| sthillma | ayoung- yeah, agreed, so the likely explaination I was given was that the OSP-D post-deployment config didn’t run for some reason (if the initial deploy was more recent I’d try and find out). Right now though, I’m thinking we try restoring the catalog, then if we hit any other issues at all, call it borked and start over | 00:46 |
| *** jasonsb has quit IRC | 00:47 | |
| *** RichardRaseley has quit IRC | 00:53 | |
| ayoung | sthillma, if you didn't get a catalog, why would you think that anything else worked? I'd reinstall. | 00:54 |
| *** jerrygb has quit IRC | 00:55 | |
| *** hrou has joined #openstack-keystone | 00:55 | |
| sthillma | ayoung, sure, will do that then, thanks! | 00:56 |
| *** mylu has quit IRC | 00:56 | |
| *** aginwala has joined #openstack-keystone | 00:56 | |
| *** mylu has joined #openstack-keystone | 00:56 | |
| *** spandhe has joined #openstack-keystone | 00:57 | |
| *** gyee has quit IRC | 00:57 | |
| *** spandhe_ has joined #openstack-keystone | 01:00 | |
| *** spandhe has quit IRC | 01:01 | |
| *** spandhe_ is now known as spandhe | 01:01 | |
| *** mylu has quit IRC | 01:01 | |
| *** hrou has quit IRC | 01:04 | |
| *** EinstCrazy has joined #openstack-keystone | 01:07 | |
| *** jamielennox is now known as jamielennox|away | 01:10 | |
| *** shaleh has quit IRC | 01:21 | |
| *** aginwala has quit IRC | 01:23 | |
| *** stevemar_ has quit IRC | 01:23 | |
| *** aginwala has joined #openstack-keystone | 01:27 | |
| *** aginwala has quit IRC | 01:27 | |
| *** topol has joined #openstack-keystone | 01:29 | |
| *** ChanServ sets mode: +v topol | 01:29 | |
| ayoung | henrynash, https://review.openstack.org/#/c/125704/20 still OK to +2? | 01:33 |
| openstackgerrit | Merged openstack/keystone: Fix the wrong method name https://review.openstack.org/243951 | 01:33 |
| *** topol has quit IRC | 01:33 | |
| *** mylu has joined #openstack-keystone | 01:41 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/246197 | 01:45 |
| openstackgerrit | ayoung proposed openstack/keystone: set `is_admin` on tokens for admin project https://review.openstack.org/240719 | 01:46 |
| *** spandhe has quit IRC | 01:49 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Clean up new_credential_ref usage and surrounding code https://review.openstack.org/246713 | 01:49 |
| *** spandhe has joined #openstack-keystone | 01:50 | |
| *** boris-42 has joined #openstack-keystone | 01:50 | |
| *** sthillma has quit IRC | 02:01 | |
| openstackgerrit | Merged openstack/keystone: Use unit.new_user_ref consistently https://review.openstack.org/243877 | 02:05 |
| ayoung | bknudson_, can you give this a once over? I think it would help if you look it over as early as possible. WOuld be wonderful to have it in for M1 https://review.openstack.org/#/c/240719/ | 02:07 |
| *** tqtran has quit IRC | 02:08 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/246197 | 02:10 |
| *** stevemar_ has joined #openstack-keystone | 02:14 | |
| *** ChanServ sets mode: +o stevemar_ | 02:14 | |
| *** jasonsb has joined #openstack-keystone | 02:20 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move federation extension into keystone core https://review.openstack.org/214775 | 02:26 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move federation sql migrations to common https://review.openstack.org/234537 | 02:26 |
| *** aginwala has joined #openstack-keystone | 02:28 | |
| *** jerrygb has joined #openstack-keystone | 02:29 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move oauth1 extension into core https://review.openstack.org/234598 | 02:30 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move oauth1 sql migrations to common https://review.openstack.org/235121 | 02:30 |
| *** dims_ has quit IRC | 02:30 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move revoke extension into core https://review.openstack.org/235704 | 02:30 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move revoke sql migrations to common https://review.openstack.org/235712 | 02:30 |
| *** LZ has joined #openstack-keystone | 02:32 | |
| *** aginwala has quit IRC | 02:32 | |
| *** stevemar_ has quit IRC | 02:42 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:42 | |
| *** stevemar_ has joined #openstack-keystone | 02:42 | |
| *** ChanServ sets mode: +o stevemar_ | 02:42 | |
| notmorgan | stevemar_: busy eh? | 02:48 |
| *** lhcheng has quit IRC | 02:49 | |
| *** lhcheng has joined #openstack-keystone | 02:50 | |
| *** ChanServ sets mode: +v lhcheng | 02:50 | |
| *** lhcheng has quit IRC | 02:50 | |
| *** spandhe has quit IRC | 02:53 | |
| *** mylu has quit IRC | 02:59 | |
| stevemar_ | notmorgan: just a pinch :) | 03:00 |
| notmorgan | stevemar_: i'm approving a spec unless you want more than 2x cores looking at it | 03:01 |
| notmorgan | stevemar_: but it's been through a bunch of iterations and looks solid now. | 03:01 |
| notmorgan | stevemar_: https://review.openstack.org/#/c/125704/21 | 03:01 |
| notmorgan | stevemar_: implied roles thing | 03:01 |
| stevemar_ | notmorgan: leave your +2 | 03:02 |
| stevemar_ | i was going to take one last look at it tonight | 03:02 |
| notmorgan | stevemar_: ah ok will hold on +A then | 03:02 |
| stevemar_ | and possibly issue a follow on to clean things up | 03:02 |
| notmorgan | yeah. that's the view I have on it, anything outstanding really should be a followup | 03:02 |
| notmorgan | its close enough that it wont be materially different | 03:03 |
| *** aginwala has joined #openstack-keystone | 03:04 | |
| stevemar_ | notmorgan: review 'domain specific roles' now? :) | 03:04 |
| notmorgan | stevemar_: uh. | 03:05 |
| *** roxanaghe has quit IRC | 03:05 | |
| notmorgan | stevemar_: <whine>but i already reviewed one spec</whine> | 03:05 |
| *** richm has quit IRC | 03:05 | |
| stevemar_ | notmorgan: hehe | 03:07 |
| stevemar_ | ayoung: oh adam :) | 03:08 |
| stevemar_ | if only you read 10 lines of scroll up :) | 03:08 |
| *** aginwala_ has joined #openstack-keystone | 03:09 | |
| *** browne has joined #openstack-keystone | 03:09 | |
| *** aginwala_ has quit IRC | 03:10 | |
| openstackgerrit | Merged openstack/keystone-specs: Implied Roles https://review.openstack.org/125704 | 03:11 |
| *** aginwala has quit IRC | 03:12 | |
| *** aginwala has joined #openstack-keystone | 03:12 | |
| notmorgan | stevemar_: shhhhh ayoung is doing family things i'm sure | 03:15 |
| *** aginwala has quit IRC | 03:16 | |
| notmorgan | stevemar_: oh i can't review domain specific roles, merge conflict </cop out reason> | 03:16 |
| ayoung | notmorgan, I can rebase.... | 03:17 |
| notmorgan | ayoung: don't make it easy :P it means i'll need to review more things | 03:17 |
| notmorgan | actually... technically i'm still trying to un-burnout for another couple week | 03:17 |
| notmorgan | s | 03:17 |
| ayoung | notmorgan, glad you will be there to help keep Portland weird. | 03:18 |
| notmorgan | ayoung: portland is kindof awesome | 03:18 |
| notmorgan | ayoung: like... seriously so. | 03:18 |
| notmorgan | ayoung: i know it isn't east coast (timezone offset still) | 03:19 |
| ayoung | notmorgan, while I don't disagree, I suspect you are in the Honeymoon period there... | 03:19 |
| ayoung | Always fun to have a fresh start | 03:19 |
| notmorgan | ayoung: i've kindof spent a lot of time up here though. more than east coast. | 03:20 |
| ayoung | when it is assumed willingly, that is | 03:20 |
| notmorgan | ayoung: i've found LA to suck a lot. escaping LA has been a "must do" for like the last 5 years | 03:20 |
| *** spandhe has joined #openstack-keystone | 03:20 | |
| notmorgan | ayoung: so almost anywhere that isn't LA is a good change (real city wise) | 03:20 |
| ayoung | stevemar_, if it makes you feel better, the recent set of changes to the API doc means I have a serious bit of rewriting to do on the Implied Roles implementation | 03:20 |
| ayoung | "I've spent four lonely days in a a brown LA haze..." | 03:21 |
| notmorgan | ooh i found another CFL in my apartment i need to replace with an LED lightbulb | 03:21 |
| * notmorgan finds CFLs still flicker too much | 03:21 | |
| *** lhcheng has joined #openstack-keystone | 03:23 | |
| *** ChanServ sets mode: +v lhcheng | 03:23 | |
| *** spandhe_ has joined #openstack-keystone | 03:23 | |
| ayoung | and they have mercury | 03:24 |
| ayoung | GAH...Did something chqange that would make unit tests fail reading policy files? DO I need to recreate the tox venv? | 03:24 |
| *** spandhe has quit IRC | 03:25 | |
| *** spandhe_ is now known as spandhe | 03:25 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move revoke sql migrations to common https://review.openstack.org/235712 | 03:27 |
| ayoung | stevemar_, somfing broken http://paste.openstack.org/show/479199/ | 03:28 |
| ayoung | I can try a git bisect to figure out what... | 03:28 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint_filter migrations into keystone core https://review.openstack.org/186988 | 03:29 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint filter into keystone core https://review.openstack.org/183377 | 03:29 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles https://review.openstack.org/242614 | 03:31 |
| *** jasonsb has quit IRC | 03:33 | |
| *** aj2 has joined #openstack-keystone | 03:33 | |
| stevemar_ | ayoung: that on master? | 03:46 |
| ayoung | stevemar_, yep | 03:46 |
| stevemar_ | ayoung: rm -rf .tox; tox -e py27 | 03:47 |
| ayoung | stevemar_, I just submitted an updated patch that should pass unit tests. Lets see if it is my machine or the code base. | 03:47 |
| ayoung | stevemar_, I did tox -r | 03:47 |
| ayoung | but... let me be certain and sure... | 03:47 |
| ayoung | stevemar_, yep./..still happens... | 03:50 |
| ayoung | ah..but that was not master....let me try master... | 03:50 |
| ayoung | stevemar_, yep, consistent. | 03:52 |
| *** aj2 has quit IRC | 03:54 | |
| *** mylu has joined #openstack-keystone | 03:56 | |
| *** mylu_ has joined #openstack-keystone | 03:57 | |
| *** mylu has quit IRC | 04:00 | |
| *** jasonsb has joined #openstack-keystone | 04:04 | |
| *** mylu_ has quit IRC | 04:04 | |
| *** fawadkhaliq has quit IRC | 04:06 | |
| *** jasonsb has quit IRC | 04:09 | |
| stevemar_ | ayoung: you commit to master or something? | 04:10 |
| ayoung | stevemar_, noope | 04:10 |
| ayoung | git log shows commit 051aeffc164bff5b0267f8cc6ccd14fe8b7b5d76 | 04:10 |
| ayoung | Merge: fb0e603 5784285 | 04:10 |
| ayoung | Author: Jenkins <jenkins@review.openstack.org> | 04:10 |
| ayoung | Date: Wed Nov 18 02:05:25 2015 +0000 | 04:10 |
| ayoung | Merge "Use unit.new_user_ref consistently" | 04:10 |
| *** mylu has joined #openstack-keystone | 04:12 | |
| *** spandhe has quit IRC | 04:12 | |
| stevemar_ | weird | 04:15 |
| ayoung | stevemar_, gotta head to bed...if it is just my machine, not a big deal. If it is a real breakage, others will see it. | 04:16 |
| stevemar_ | yep | 04:17 |
| stevemar_ | n | 04:17 |
| stevemar_ | gn | 04:17 |
| *** spandhe has joined #openstack-keystone | 04:17 | |
| openstackgerrit | Merged openstack/keystone-specs: Clarify is_domain project attribute in API version 3.5 https://review.openstack.org/228469 | 04:24 |
| *** fawadkhaliq has joined #openstack-keystone | 04:27 | |
| openstackgerrit | Merged openstack/keystone: Add testcases to check cache invalidation in endpoint filter extension https://review.openstack.org/245633 | 04:33 |
| *** markvoelker_ has quit IRC | 04:40 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/246197 | 04:40 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Domain Specific Roles https://review.openstack.org/226661 | 04:43 |
| *** hrou has joined #openstack-keystone | 04:43 | |
| *** aj2 has joined #openstack-keystone | 04:44 | |
| *** jasonsb has joined #openstack-keystone | 04:52 | |
| *** spandhe_ has joined #openstack-keystone | 04:53 | |
| *** jamielennox|away is now known as jamielennox | 04:54 | |
| *** spandhe has quit IRC | 04:55 | |
| *** spandhe_ is now known as spandhe | 04:55 | |
| *** sthillma has joined #openstack-keystone | 05:01 | |
| *** sthillma_ has joined #openstack-keystone | 05:03 | |
| *** sthillma has quit IRC | 05:06 | |
| *** sthillma_ is now known as sthillma | 05:06 | |
| *** LZ has quit IRC | 05:13 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/246197 | 05:15 |
| spandhe | lhcheng: Hi Lin | 05:18 |
| lhcheng | spandhe: hey! | 05:18 |
| spandhe | lhcheng: hey, have a qn.. what should we set KSCTEST_PATH value for tests? should be the repo or keystoneclient directory? | 05:20 |
| spandhe | lhcheng: our unittests started failing since https://github.com/openstack/python-keystoneclient/commit/d9031c252848d89270a543b67109a46f9c505c86 | 05:20 |
| spandhe | and we realized that keystone was using master for keystoneclient | 05:21 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add release notes for mitaka thus far https://review.openstack.org/246749 | 05:23 |
| lhcheng | spandhe: where is KSCTEST_PATH set? Is that on our jenkins job? | 05:23 |
| *** jerrygb has quit IRC | 05:25 | |
| stevemar_ | lhcheng: hey can you do me a simple favor | 05:27 |
| stevemar_ | lhcheng: i'm heading to bed, but in ~5 minutes, can you recheck this patch: https://review.openstack.org/#/c/246145/ i looked at zuul and it's going to fail :( | 05:27 |
| stevemar_ | see you all tmrw! | 05:27 |
| *** stevemar_ has quit IRC | 05:27 | |
| lhcheng | stevemar_: sure, I'll baby sit the patch :) | 05:27 |
| lhcheng | good night! | 05:28 |
| *** stevemar_ has joined #openstack-keystone | 05:28 | |
| *** ChanServ sets mode: +o stevemar_ | 05:28 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint_filter migrations into keystone core https://review.openstack.org/186988 | 05:28 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint filter into keystone core https://review.openstack.org/183377 | 05:28 |
| *** lhcheng_ has joined #openstack-keystone | 05:29 | |
| *** topol has joined #openstack-keystone | 05:29 | |
| *** ChanServ sets mode: +v topol | 05:29 | |
| *** stevemar_ has quit IRC | 05:30 | |
| *** akanksha_ has joined #openstack-keystone | 05:31 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Move inherited assignments to core, and support new inheritance rules https://review.openstack.org/200434 | 05:32 |
| *** lhcheng has quit IRC | 05:32 | |
| *** roxanaghe has joined #openstack-keystone | 05:40 | |
| *** topol has quit IRC | 05:50 | |
| *** gildub_ has quit IRC | 05:53 | |
| *** sthillma has quit IRC | 05:54 | |
| *** yangyapeng has joined #openstack-keystone | 05:57 | |
| *** hrou has quit IRC | 06:00 | |
| *** mylu has quit IRC | 06:08 | |
| *** mylu has joined #openstack-keystone | 06:09 | |
| *** mylu has quit IRC | 06:13 | |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: remove assignments when deleting a domain https://review.openstack.org/127433 | 06:20 |
| *** clayton has quit IRC | 06:22 | |
| *** clayton has joined #openstack-keystone | 06:23 | |
| *** tyagiprince has joined #openstack-keystone | 06:28 | |
| *** spandhe has quit IRC | 06:30 | |
| *** chirag has joined #openstack-keystone | 06:32 | |
| *** rcernin has joined #openstack-keystone | 06:37 | |
| *** lhcheng has joined #openstack-keystone | 06:39 | |
| *** ChanServ sets mode: +v lhcheng | 06:39 | |
| *** markvoelker has joined #openstack-keystone | 06:40 | |
| *** lhcheng_ has quit IRC | 06:42 | |
| *** roxanaghe has quit IRC | 06:43 | |
| *** markvoelker has quit IRC | 06:45 | |
| *** gildub_ has joined #openstack-keystone | 07:03 | |
| chirag | Hello Keystone team, can anyone help me with"Not Implemented (HTTP 501)" error received during execution of keystone user-role-add. its a bit urgent any leads would be greats | 07:07 |
| *** josecastroleon has joined #openstack-keystone | 07:10 | |
| *** jaosorior has joined #openstack-keystone | 07:12 | |
| *** sthillma has joined #openstack-keystone | 07:12 | |
| *** jaosorior has quit IRC | 07:13 | |
| *** jaosorior has joined #openstack-keystone | 07:14 | |
| *** sthillma has quit IRC | 07:17 | |
| chirag | Hello Keystone team, can anyone help me with"Not Implemented (HTTP 501)" error received during execution of keystone user-role-add. its a bit urgent any leads would be great. | 07:21 |
| *** gildub_ has quit IRC | 07:24 | |
| *** jerrygb has joined #openstack-keystone | 07:25 | |
| *** jerrygb has quit IRC | 07:30 | |
| *** LZ has joined #openstack-keystone | 07:32 | |
| lhcheng | chirag: more details on the error? | 07:38 |
| lhcheng | logs? | 07:38 |
| *** Nirupama has joined #openstack-keystone | 07:39 | |
| chirag | thanks lhcheng for reply | 07:40 |
| *** gildub_ has joined #openstack-keystone | 07:41 | |
| *** markvoelker has joined #openstack-keystone | 07:41 | |
| chirag | there are no error logs being recieved | 07:41 |
| chirag | DEBUG:urllib3.connectionpool:"PUT http://***:35357/v2.0/tenants/db041652bebb474b9a2100525bc04c41/users/b7d03ef364294c6193265d79dd06c294/roles/OS-KSADM/fee42af040fb465c9f01476a86c9d464 HTTP/1.1" 501 None DEBUG:keystoneclient.session:RESP: DEBUG:keystoneclient.session:Request returned failure status: 501 Not Implemented (HTTP 501) | 07:42 |
| chirag | this is the output of the debug mode | 07:42 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/246197 | 07:43 |
| lhcheng | what version of keystone are you running? | 07:44 |
| *** markvoelker has quit IRC | 07:46 | |
| chirag | its is 1.2.0 (keystone --version 1.2.0) | 07:46 |
| lhcheng | I tried the same command, the REST endpoint you're hitting looks right | 07:46 |
| chirag | I am really blank why only this command is failing. Rest all command are running fine. | 07:47 |
| lhcheng | so user-list works fine on port 35357 ? | 07:48 |
| chirag | Yes | 07:48 |
| *** jmccrory has quit IRC | 07:49 | |
| chirag | I am getting proper output for user-list | 07:49 |
| lhcheng | are you using sql role assignment driver? | 07:49 |
| *** urulama has joined #openstack-keystone | 07:50 | |
| chirag | I am not sure of that how can I verify it? | 07:51 |
| lhcheng | from keystone.conf | 07:51 |
| chirag | which variable are you taking about [assignment] # # From keystone # # Assignment backend driver. (string value) #driver = <None> | 07:52 |
| *** browne has quit IRC | 07:52 | |
| chirag | snippet of keystone.conf =====[assignment] # # From keystone # # Assignment backend driver. (string value) #driver = <None>===== | 07:53 |
| *** jmccrory has joined #openstack-keystone | 07:54 | |
| lhcheng | that looks right, should default to sql | 07:57 |
| *** belmoreira has joined #openstack-keystone | 07:57 | |
| lhcheng | what does your keystone logs show? | 07:57 |
| *** breitz has quit IRC | 07:58 | |
| *** breitz1 has joined #openstack-keystone | 07:58 | |
| chirag | ==INFO eventlet.wsgi.server [-] 10.128.101.11 - - [18/Nov/2015 17:43:08] "GET /v2.0/users/b7d03ef364294c6193265d79dd06c294 HTTP/1.1" 200 411 0.013134== | 08:01 |
| chirag | ==eventlet.wsgi.server [-] 10.128.101.11 - - [18/Nov/2015 17:43:08] "GET /v2.0/OS-KSADM/roles/fee42af040fb465c9f01476a86c9d464 HTTP/1.1" 200 311 0.011922== | 08:01 |
| chirag | ==ventlet.wsgi.server [-] 10.128.101.11 - - [18/Nov/2015 17:43:08] "GET /v2.0/tenants/db041652bebb474b9a2100525bc04c41 HTTP/1.1" 200 351 0.006384== | 08:01 |
| chirag | All logs for req | 08:03 |
| chirag | ventlet.wsgi.server [-] 10.128.101.11 - - [18/Nov/2015 17:43:08] "GET /v2.0/tenants/db041652bebb474b9a2100525bc04c41 HTTP/1.1" 200 351 0.006384 | 08:03 |
| chirag | @lhcheng could you please help ?? any idea? | 08:04 |
| lhcheng | what openstack version are you running? | 08:05 |
| lhcheng | the keystone version you gave is the version of keystoneclient | 08:05 |
| lhcheng | can you also put in paste the config (cleanup the credentials before posting) | 08:06 |
| chirag | I am using openstack Kilo release | 08:06 |
| openstackgerrit | henry-nash proposed openstack/keystone: Create new version of assignment driver interface https://review.openstack.org/242853 | 08:09 |
| *** jaosorior has quit IRC | 08:10 | |
| lhcheng | so I noticed that if you didn't pass the --tenant it returns a 501 error :( | 08:10 |
| lhcheng | could that be the case | 08:10 |
| lhcheng | ? | 08:10 |
| chirag | Yes I have seen that | 08:11 |
| chirag | I passed tenantid with the same but no help | 08:11 |
| chirag | it returned same error | 08:11 |
| chirag | admin_token = *** debug = true verbose = True log_dir = /var/log/keystone connection = mysql://keystone:***@controller/keystone servers = localhost:11211 driver = keystone.contrib.revoke.backends.sql.Revoke provider = keystone.token.providers.uuid.Provider driver = keystone.token.persistence.backends.memcache.Token Distribution = Ubuntu | 08:12 |
| *** stevemar_ has joined #openstack-keystone | 08:12 | |
| *** ChanServ sets mode: +o stevemar_ | 08:12 | |
| chirag | above are the params defined in keystone.conf file | 08:13 |
| *** jvarlamova has joined #openstack-keystone | 08:13 | |
| *** mkoderer has quit IRC | 08:15 | |
| chirag | ? | 08:15 |
| *** stevemar_ has quit IRC | 08:16 | |
| *** mkoderer has joined #openstack-keystone | 08:17 | |
| lhcheng | do other commands user-create works? | 08:18 |
| lhcheng | the conf seems ok.. | 08:18 |
| chirag | Yes other commands work fine | 08:18 |
| chirag | I have created few tenants,users,roles | 08:19 |
| *** pnavarro has joined #openstack-keystone | 08:19 | |
| lhcheng | the only reason I could think of is you used a custom assignment driver and have missing implementation | 08:20 |
| lhcheng | but looks like you just used the default driver | 08:20 |
| lhcheng | how about explicitly setting the driver value? | 08:20 |
| henrynash | lncheng, chirag: are we using domain specific identity backends | 08:21 |
| lhcheng | no idea, chirag ^ | 08:22 |
| chirag | Sorry no idea | 08:22 |
| lhcheng | chirag: can you try setting the driver explicitly for assignment | 08:22 |
| lhcheng | [assignment] | 08:22 |
| lhcheng | driver = sql | 08:22 |
| henrynash | chirag: try (for an experiment) specifying a domain filter in your use list command | 08:22 |
| chirag | Ok wait I would try driver = sql, please lemme know in which filter should I define it? | 08:23 |
| henrynash | first, I may be jumping back into a problem I saw you raise earlier…and it may ahvemoved on….is your problem still that user list doesn’t wokrk? | 08:24 |
| chirag | No, except role-add every other command is working | 08:25 |
| henrynash | ok, sorry, my mistake….things have moved on!!!! | 08:25 |
| *** shardy has joined #openstack-keystone | 08:26 | |
| chirag | @lhcheng I tried but failed error recieved is ===Unable to establish connection to http://*****:35357/v2.0/users/b7d03ef364294c6193265d79dd06c294=== | 08:28 |
| lhcheng | error during keystone startup? | 08:29 |
| chirag | No | 08:30 |
| chirag | it was restarted succesfully | 08:30 |
| chirag | keystone logs ====CRITICAL keystone [-] ValueError: Empty module name==== | 08:31 |
| *** tyagiprince has quit IRC | 08:31 | |
| chirag | reverted back to default config | 08:32 |
| *** tyagiprince has joined #openstack-keystone | 08:33 | |
| lhcheng | oops try this driver = keystone.assignment.backends.sql.Assignment | 08:33 |
| chirag | :) ok would try again | 08:33 |
| *** ygk has joined #openstack-keystone | 08:34 | |
| ygk | Hi All | 08:34 |
| lhcheng | ygk: hello! | 08:34 |
| ygk | i am facing an issue with keystone commands on openstack kilo version | 08:34 |
| ygk | HI lhcheng | 08:34 |
| ygk | can anyone help me with this | 08:35 |
| lhcheng | uh oh another kilo customer :P | 08:35 |
| ygk | yes | 08:35 |
| lhcheng | ygk: what's up? | 08:35 |
| ygk | i have kilo on centos 7 | 08:35 |
| ygk | when I setup a server wide proxy env variable for reaching internet, keystone related commands are failing | 08:36 |
| ygk | but when I remove the proxy , it is working fine | 08:36 |
| ygk | wats the relation between keystone and proxy server ? | 08:36 |
| lhcheng | you running keystone as eventlet or in apache server? | 08:37 |
| ygk | in apache server | 08:37 |
| ygk | this is the error | 08:37 |
| ygk | ERROR: openstack Could not determine a suitable URL for the plugin | 08:37 |
| lhcheng | that's an error on the openstackclient? | 08:37 |
| ygk | yes | 08:38 |
| ygk | i am using this command | 08:39 |
| ygk | openstack --os-auth-url http://controller:35357 --os-project-name admin --os-username admin --os-auth-type password user list | 08:39 |
| ygk | it is working fine if I remove the proxy env variable | 08:39 |
| chirag | YESSSSS it worked thansk a lot @lhcheng | 08:39 |
| ygk | but doesnt work when I set it | 08:39 |
| lhcheng | chirag: awesome! | 08:39 |
| ygk | what could be the issue with proxy server and keystone | 08:40 |
| lhcheng | chirag: I thought the driver would set some smart default value. | 08:40 |
| chirag | @ygk try setting no_proxy export no_proxy="local, localhost, 127.0.0.1, IP of your system" | 08:40 |
| lhcheng | chirag: glad it worked | 08:40 |
| ygk | where should I set it ? | 08:40 |
| chirag | Yes, it should have worked by default. But anyhow glad you suggested | 08:41 |
| lhcheng | try on the terminal where you run the openstack command | 08:41 |
| *** fawadkhaliq has quit IRC | 08:41 | |
| chirag | On your console itself define it in evn variables | 08:41 |
| *** jaosorior has joined #openstack-keystone | 08:41 | |
| ygk | what exactly should I export and how ? | 08:42 |
| *** fawadkhaliq has joined #openstack-keystone | 08:42 | |
| chirag | just type export no_proxy="local, localhost, 127.0.0.1, IP address of your system" | 08:42 |
| ygk | should I export it while retaining the proxy server env variable or without it ? | 08:43 |
| chirag | Yes please retain your proxy server env variable | 08:45 |
| lhcheng | ygk: its almost 1am here, I'm logging out. chirag can help you out :) | 08:45 |
| lhcheng | night everyone | 08:45 |
| chirag | THanks . .Tc | 08:45 |
| chirag | Would try my best to help | 08:45 |
| *** lhcheng has quit IRC | 08:45 | |
| ygk | thanks lhcheng | 08:46 |
| ygk | good night | 08:46 |
| ygk | @chirag. its not working when i setup noproxy | 08:46 |
| ygk | its throwing this error | 08:46 |
| ygk | ERROR: openstack Could not determine a suitable URL for the plugin | 08:46 |
| chirag | same error? | 08:46 |
| ygk | yes | 08:47 |
| ygk | this is what i setup | 08:47 |
| ygk | no_proxy=local, localhost, 127.0.0.1, 20.20.20.120 | 08:47 |
| chirag | please define them in "" as "local, localhost, 127.0.0.1, 20.20.20.120" | 08:48 |
| ygk | i did that | 08:48 |
| chirag | also have you defined your controller IP in /etc/hosts ? | 08:48 |
| *** akanksha_ has quit IRC | 08:48 | |
| ygk | yes | 08:49 |
| *** fhubik has joined #openstack-keystone | 08:50 | |
| ygk | so any idea | 08:50 |
| chirag | any logs? | 08:51 |
| ygk | no logs | 08:51 |
| ygk | its not populating log files either | 08:51 |
| chirag | please provide output of the command | 08:52 |
| ygk | ok | 08:52 |
| ygk | [root@controller ~]# openstack --os-auth-url http://controller:35357 --os-project-name admin --os-username admin --os-auth-type password user list WARNING: keystoneclient.auth.identity.generic.base Discovering versions from the identity service failed when creating the password plugin. Attempting to determine version from URL. WARNING: keystoneclient.auth.identity.generic.base Discovering versions from the identity service f | 08:52 |
| ygk | thats the output | 08:52 |
| ygk | ERROR: openstack Could not determine a suitable URL for the plugin | 08:53 |
| *** fhubik is now known as fhubik_brb | 08:56 | |
| *** fawadkhaliq has quit IRC | 08:57 | |
| ygk | @chirag: any idea | 09:00 |
| chirag | try url http://controller35357/v2.0/ | 09:00 |
| ygk | oops it did not work either | 09:01 |
| ygk | i tried it | 09:01 |
| *** fhubik_brb is now known as fhubik | 09:01 | |
| ygk | but it is working once I remove the proxy settings | 09:01 |
| chirag | I am also using the same environemnt | 09:01 |
| chirag | Mine is working great | 09:02 |
| openstackgerrit | Marian Horban proposed openstack/python-keystoneclient: Remove lock object from BaseIdentityPlugin https://review.openstack.org/246521 | 09:03 |
| chirag | You must have defined OS_SERVICE_TOKEN & OS_SERVICE_ENDPOINT | 09:03 |
| *** tyagiprince has quit IRC | 09:04 | |
| *** stevemar_ has joined #openstack-keystone | 09:13 | |
| *** ChanServ sets mode: +o stevemar_ | 09:13 | |
| *** stevemar_ has quit IRC | 09:17 | |
| *** fhubik is now known as fhubik_brb | 09:31 | |
| *** e0ne has joined #openstack-keystone | 09:32 | |
| *** xek has joined #openstack-keystone | 09:37 | |
| *** markvoelker has joined #openstack-keystone | 09:42 | |
| *** jistr has joined #openstack-keystone | 09:42 | |
| *** markvoelker has quit IRC | 09:46 | |
| *** topol has joined #openstack-keystone | 09:47 | |
| *** ChanServ sets mode: +v topol | 09:47 | |
| *** fhubik_brb is now known as fhubik | 09:51 | |
| *** topol has quit IRC | 09:51 | |
| *** tyagiprince has joined #openstack-keystone | 09:57 | |
| *** topol has joined #openstack-keystone | 10:01 | |
| *** ChanServ sets mode: +v topol | 10:01 | |
| *** chirag has quit IRC | 10:05 | |
| *** topol has quit IRC | 10:06 | |
| marekd | ayoung: looks like you don't need my help anymore ;-) | 10:08 |
| *** aix has joined #openstack-keystone | 10:08 | |
| openstackgerrit | Andrey Pavlov proposed openstack/keystone: Fix string conversion in s3 handler for python 2 https://review.openstack.org/246844 | 10:25 |
| *** jerrygb has joined #openstack-keystone | 10:26 | |
| *** daemontool has joined #openstack-keystone | 10:28 | |
| *** ygk has left #openstack-keystone | 10:30 | |
| *** daemontool has quit IRC | 10:30 | |
| *** daemontool has joined #openstack-keystone | 10:30 | |
| *** jerrygb has quit IRC | 10:31 | |
| *** daemontool has quit IRC | 10:31 | |
| *** fawadkhaliq has joined #openstack-keystone | 10:36 | |
| *** e0ne has quit IRC | 10:43 | |
| *** LZ has quit IRC | 10:52 | |
| *** fhubik is now known as fhubik_brb | 10:53 | |
| tyagiprince | hey i was working with keystone service.. now when i send a command to get the project list.. the logs are as follows.. | 10:57 |
| tyagiprince | hey i was working with keystone service.. now when i send a command to get the project list.. the logs are as follows.. | 10:57 |
| tyagiprince | hey i was working with keystone service.. now when i send a command to get the project list.. the logs are as follows.. | 10:57 |
| tyagiprince | 10.41.0.121 - - [18/Nov/2015:16:23:19 +0530] "GET / HTTP/1.1" 300 845 "-" "python-keystoneclient" | 10:57 |
| tyagiprince | 10.41.0.121 - - [18/Nov/2015:16:23:19 +0530] "POST /v2.0/tokens HTTP/1.1" 200 1125 "-" "python-keystoneclient" | 10:57 |
| tyagiprince | 10.41.0.121 - - [18/Nov/2015:16:23:20 +0530] "POST /v2.0/tokens HTTP/1.1" 200 1125 "-" "python-keystoneclient" | 10:57 |
| tyagiprince | 10.41.0.121 - - [18/Nov/2015:16:23:20 +0530] "GET / HTTP/1.1" 300 844 "-" "python-keystoneclient" | 10:57 |
| tyagiprince | 10.41.0.121 - - [18/Nov/2015:16:23:20 +0530] "GET /v2.0/tenants HTTP/1.1" 200 671 "-" "python-keystoneclient" | 10:57 |
| tyagiprince | why are there 2 POSTs and GETs at the end | 10:57 |
| tyagiprince | ? | 10:57 |
| tyagiprince | I am using uuid currently.. but will be shifting to pki soon.. | 10:58 |
| *** e0ne has joined #openstack-keystone | 11:04 | |
| *** exploreshaifali has joined #openstack-keystone | 11:05 | |
| *** dims has joined #openstack-keystone | 11:07 | |
| *** dims has quit IRC | 11:12 | |
| *** EinstCrazy has quit IRC | 11:13 | |
| *** yangyapeng has quit IRC | 11:13 | |
| *** stevemar_ has joined #openstack-keystone | 11:14 | |
| *** ChanServ sets mode: +o stevemar_ | 11:14 | |
| *** fhubik_brb is now known as fhubik | 11:15 | |
| *** daemontool has joined #openstack-keystone | 11:17 | |
| *** stevemar_ has quit IRC | 11:18 | |
| *** dims has joined #openstack-keystone | 11:18 | |
| *** daemontool has quit IRC | 11:18 | |
| *** daemontool has joined #openstack-keystone | 11:19 | |
| *** daemontool has quit IRC | 11:21 | |
| *** daemontool has joined #openstack-keystone | 11:24 | |
| *** pgreg has joined #openstack-keystone | 11:24 | |
| *** pgreg has quit IRC | 11:24 | |
| openstackgerrit | Kseniya Tychkova proposed openstack/oslo.policy: Draft implementation of LDAP RBAC blueprint https://review.openstack.org/244059 | 11:24 |
| *** fhubik is now known as fhubik_brb | 11:26 | |
| *** aix has quit IRC | 11:31 | |
| *** aswadr has joined #openstack-keystone | 11:32 | |
| *** aix has joined #openstack-keystone | 11:32 | |
| *** urulama has quit IRC | 11:33 | |
| *** urulama has joined #openstack-keystone | 11:33 | |
| *** aj2 has quit IRC | 11:42 | |
| *** markvoelker has joined #openstack-keystone | 11:43 | |
| *** daemontool has quit IRC | 11:47 | |
| *** markvoelker has quit IRC | 11:47 | |
| *** daemontool has joined #openstack-keystone | 11:47 | |
| *** exploreshaifali has quit IRC | 11:49 | |
| *** fhubik_brb is now known as fhubik | 11:49 | |
| *** exploreshaifali has joined #openstack-keystone | 11:52 | |
| *** topol has joined #openstack-keystone | 11:56 | |
| *** ChanServ sets mode: +v topol | 11:56 | |
| *** gildub_ has quit IRC | 11:59 | |
| *** doug-fish has joined #openstack-keystone | 12:02 | |
| *** exploreshaifali has quit IRC | 12:03 | |
| *** gildub_ has joined #openstack-keystone | 12:03 | |
| *** EinstCrazy has joined #openstack-keystone | 12:06 | |
| *** pnavarro is now known as pnavarro|lunch | 12:07 | |
| *** Nirupama has quit IRC | 12:11 | |
| *** aswadr has quit IRC | 12:15 | |
| *** gildub_ has quit IRC | 12:17 | |
| *** wolsen has quit IRC | 12:20 | |
| *** alejandrito has joined #openstack-keystone | 12:23 | |
| *** pauloewerton has joined #openstack-keystone | 12:27 | |
| *** hrou has joined #openstack-keystone | 12:29 | |
| *** jsheeren has joined #openstack-keystone | 12:29 | |
| *** yangyapeng has joined #openstack-keystone | 12:32 | |
| *** hrou has quit IRC | 12:34 | |
| *** fhubik is now known as fhubik_brb | 12:37 | |
| *** aj2 has joined #openstack-keystone | 12:38 | |
| *** fawadkhaliq has quit IRC | 12:42 | |
| *** markvoelker has joined #openstack-keystone | 12:43 | |
| *** fhubik_brb is now known as fhubik | 12:45 | |
| *** markvoelker has quit IRC | 12:48 | |
| *** NM has joined #openstack-keystone | 12:54 | |
| *** e0ne has quit IRC | 12:57 | |
| *** jerrygb has joined #openstack-keystone | 13:06 | |
| raildo | henrynash: nice email for ML :) | 13:07 |
| *** gordc has joined #openstack-keystone | 13:07 | |
| henrynash | raildo: thx, gotta spell it out! | 13:07 |
| *** markvoelker has joined #openstack-keystone | 13:09 | |
| *** gordc_ has joined #openstack-keystone | 13:09 | |
| *** jerrygb has quit IRC | 13:10 | |
| *** e0ne has joined #openstack-keystone | 13:10 | |
| *** aj2 has quit IRC | 13:12 | |
| *** gordc has quit IRC | 13:13 | |
| *** stevemar_ has joined #openstack-keystone | 13:15 | |
| *** ChanServ sets mode: +o stevemar_ | 13:15 | |
| *** stevemar_ has quit IRC | 13:18 | |
| *** pnavarro|lunch is now known as pnavarro | 13:25 | |
| *** peter-hamilton has joined #openstack-keystone | 13:28 | |
| *** topol has quit IRC | 13:30 | |
| ayoung | henrynash, I know we want the feature for "domain specific roles" but can we perhaps give it a more generic name? It will have wider application. | 13:33 |
| * ayoung just saw reseller email | 13:34 | |
| *** peter-hamilton has quit IRC | 13:34 | |
| *** gordc_ has quit IRC | 13:34 | |
| henrynash | ayoung: suggestions (on the domain specific roles)? | 13:38 |
| ayoung | henrynash, I think I withdraw the comment...everything I've thought of sucks | 13:39 |
| ayoung | lets go with domain specific | 13:39 |
| henrynash | ayoung: ha! | 13:40 |
| ayoung | henrynash, I've got a couple engineers I'm walking through things...your DSR specs comes right after | 13:40 |
| henrynash | ayoung: sure, thx | 13:40 |
| ayoung | henrynash, I might broaden it in the future, but use the same mechanism | 13:40 |
| ayoung | but future...progres... | 13:40 |
| henrynash | ayoung: ok | 13:40 |
| *** kashyap has joined #openstack-keystone | 13:45 | |
| kashyap | With today's DevStack, I'm hitting this 'Could not determine a suitable URL for the plugin' while DevStack attempts to import a disk image into Glance | 13:46 |
| kashyap | Fails here: | 13:46 |
| kashyap | ... | 13:47 |
| kashyap | 2015-11-18 13:16:57.406 | + openstack --os-cloud=devstack-admin image create cirros-0.3.3-x86_64-disk --public --container-format=bare --disk-format qcow2 | 13:47 |
| kashyap | 2015-11-18 13:16:58.198 | Could not determine a suitable URL for the plugin | 13:47 |
| kashyap | ... | 13:47 |
| kashyap | Anyone else see this too? | 13:47 |
| kashyap | Seems like it's coming from here: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/identity/generic/base.py#L179 | 13:47 |
| * kashyap checks w/ Glance folks, too. | 13:48 | |
| *** jsheeren has quit IRC | 13:51 | |
| *** thiagop has joined #openstack-keystone | 13:52 | |
| *** richm has joined #openstack-keystone | 13:52 | |
| *** bill_az has joined #openstack-keystone | 13:53 | |
| samueldmq | henrynash: hi, you around ? :) | 13:56 |
| *** doug-fish has quit IRC | 13:58 | |
| *** tjcocozz has joined #openstack-keystone | 13:58 | |
| samueldmq | henrynash: re: name clashing | 13:58 |
| *** hrou has joined #openstack-keystone | 13:59 | |
| *** tjcocozz has quit IRC | 13:59 | |
| *** peter-hamilton has joined #openstack-keystone | 13:59 | |
| henrynash | samuedlmq: hi | 14:02 |
| henrynash | samueldmq: I’ll be back on in a while…willping you back | 14:03 |
| *** henrynash has quit IRC | 14:03 | |
| *** ktychkova_ has quit IRC | 14:03 | |
| *** opilotte has joined #openstack-keystone | 14:04 | |
| *** exploreshaifali has joined #openstack-keystone | 14:04 | |
| *** LukeHinds has joined #openstack-keystone | 14:06 | |
| openstackgerrit | Olivier Pilotte proposed openstack/keystone-specs: Accepts Group IDs from the IdP without domain https://review.openstack.org/216308 | 14:07 |
| *** bapalm has joined #openstack-keystone | 14:08 | |
| *** boris-42 has quit IRC | 14:08 | |
| *** fhubik is now known as fhubik_brb | 14:09 | |
| *** tjcocozz has joined #openstack-keystone | 14:14 | |
| *** tjcocozz_ has joined #openstack-keystone | 14:14 | |
| *** chirag has joined #openstack-keystone | 14:15 | |
| chirag | Urgent help needed : I am trying to authenticate glance with my keystone server but again again receiving authentication errors. logs from keystone says ==keystone.token.controllers [-] User 050ce8abbfe24c82be59778e9155a9c9 is unauthorized for tenant service== | 14:17 |
| chirag | Can anyone help me out with this?? | 14:17 |
| chirag | command being executed is ==glance member-list The request you have made requires authentication. (HTTP 401) (Request-ID: req-127f74a0-286d-43e9-9337-147bbee95d4c)== | 14:17 |
| samueldmq | chirag: looks like a clear message from a keystone pov | 14:18 |
| samueldmq | chirag: the given user has no role assignnment on that project | 14:19 |
| chirag | Yes, but I have added glance user under my service tenant | 14:19 |
| samueldmq | chirag: check the role assignments (grants) | 14:19 |
| opilotte | marekd, dolphm, dstanek: can we proceed with the review of https://review.openstack.org/#/c/210581 and https://review.openstack.org/#/c/216308/ ? thanks | 14:19 |
| mordred | notmorgan, jamielennox: https://review.openstack.org/#/c/245304/ (or anyone else) I'd love some feedback as to whether this is good, good but needs more work, or a no-go | 14:20 |
| chirag | I have assigned admin role to the same | 14:20 |
| samueldmq | chirag: I need to leave now, I will be back in a bit and help you digging a bit more on this if anyone else doesn't | 14:20 |
| mordred | if it's a no-go, I can work on putting the same sort of thing elsewhere | 14:20 |
| *** fhubik_brb is now known as fhubik | 14:20 | |
| chirag | no issues . . . | 14:20 |
| *** doug-fish has joined #openstack-keystone | 14:21 | |
| notmorgan | mordred: I don't have any issues with it, with exception of not seeing tests/in action example | 14:21 |
| samueldmq | mordred: so basically authenticate using the data passed as arguments with --etc | 14:21 |
| notmorgan | mordred: I think it is a reasonable addition | 14:22 |
| samueldmq | mordred: I will take a look in a bit :) | 14:22 |
| mordred | notmorgan: k. so writing tests is worth the effort? | 14:22 |
| notmorgan | check with jamielennox, but I don't see why this isn't a good idea | 14:22 |
| mordred | notmorgan: in-action example here: https://review.openstack.org/#/c/245200/ via https://review.openstack.org/#/c/241715/ | 14:23 |
| notmorgan | looking | 14:23 |
| notmorgan | this makes sense to me | 14:25 |
| *** daemontool_ has joined #openstack-keystone | 14:25 | |
| *** daemontool_ has quit IRC | 14:26 | |
| *** lsmola has quit IRC | 14:26 | |
| *** daemontool_ has joined #openstack-keystone | 14:27 | |
| notmorgan | the adapter feels like the right place to manage these args | 14:27 |
| *** daemontool has quit IRC | 14:27 | |
| *** daemontool_ has quit IRC | 14:28 | |
| *** daemontool_ has joined #openstack-keystone | 14:29 | |
| *** lsmola has joined #openstack-keystone | 14:29 | |
| chirag | Urgent help needed : I am trying to authenticate glance with my keystone server but again again receiving authentication errors. logs from keystone says ==keystone.token.controllers [-] User 050ce8abbfe24c82be59778e9155a9c9 is unauthorized for tenant service== | 14:29 |
| *** hrou has left #openstack-keystone | 14:30 | |
| chirag | It would be really helpful if anyone could provide any lead | 14:30 |
| *** timcline has joined #openstack-keystone | 14:31 | |
| *** lsmola has quit IRC | 14:31 | |
| *** openstackgerrit has quit IRC | 14:31 | |
| *** openstackgerrit has joined #openstack-keystone | 14:32 | |
| notmorgan | l | 14:34 |
| *** timcline has quit IRC | 14:37 | |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles https://review.openstack.org/242614 | 14:40 |
| *** bapalm has quit IRC | 14:43 | |
| *** tjcocozz has quit IRC | 14:43 | |
| *** bapalm has joined #openstack-keystone | 14:43 | |
| *** chirag has quit IRC | 14:44 | |
| *** tjcocozz has joined #openstack-keystone | 14:44 | |
| *** fawadkhaliq has joined #openstack-keystone | 14:44 | |
| *** raildo is now known as raildo-afk | 14:46 | |
| *** asd has joined #openstack-keystone | 14:47 | |
| *** asd has left #openstack-keystone | 14:47 | |
| *** opilotte has quit IRC | 14:50 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Refactor test use of new_*_ref https://review.openstack.org/237205 | 14:50 |
| *** daemontool_ has quit IRC | 14:51 | |
| *** petertr7_away is now known as petertr7 | 14:52 | |
| *** mhickey has joined #openstack-keystone | 14:55 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove keystoneclient tests https://review.openstack.org/240474 | 14:56 |
| *** tyagiprince has quit IRC | 15:00 | |
| dstanek | opilotte-: ? | 15:00 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Fix exposition of bug about limiting with ldap https://review.openstack.org/234226 | 15:00 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Simplify LimitTests https://review.openstack.org/234300 | 15:00 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Enable limiting in ldap for groups https://review.openstack.org/234849 | 15:00 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Make @truncated common for all backends https://review.openstack.org/233069 | 15:00 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Use @truncated in ldap for users https://review.openstack.org/233070 | 15:00 |
| *** daemontool has joined #openstack-keystone | 15:01 | |
| *** topol has joined #openstack-keystone | 15:04 | |
| *** ChanServ sets mode: +v topol | 15:04 | |
| *** akanksha_ has joined #openstack-keystone | 15:06 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Enable limiting in ldap for groups https://review.openstack.org/234849 | 15:11 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Use @truncated in ldap for users https://review.openstack.org/233070 | 15:11 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move federation extension into keystone core https://review.openstack.org/214775 | 15:11 |
| *** exploreshaifali has quit IRC | 15:12 | |
| *** jaosorior has quit IRC | 15:13 | |
| *** jaosorior has joined #openstack-keystone | 15:13 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move federation sql migrations to common https://review.openstack.org/234537 | 15:13 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move oauth1 extension into core https://review.openstack.org/234598 | 15:13 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move oauth1 sql migrations to common https://review.openstack.org/235121 | 15:13 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move revoke extension into core https://review.openstack.org/235704 | 15:14 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move revoke sql migrations to common https://review.openstack.org/235712 | 15:14 |
| *** davechen has joined #openstack-keystone | 15:15 | |
| *** henrynash has joined #openstack-keystone | 15:16 | |
| *** ChanServ sets mode: +v henrynash | 15:16 | |
| *** stevemar_ has joined #openstack-keystone | 15:16 | |
| *** ChanServ sets mode: +o stevemar_ | 15:16 | |
| *** sborkows has joined #openstack-keystone | 15:16 | |
| *** andrewbogott has quit IRC | 15:16 | |
| henrynash | samueldmq: hi | 15:16 |
| *** d34dh0r53 has quit IRC | 15:17 | |
| *** Nakato has quit IRC | 15:17 | |
| *** d34dh0r53 has joined #openstack-keystone | 15:17 | |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles https://review.openstack.org/242614 | 15:17 |
| *** andrewbogott has joined #openstack-keystone | 15:18 | |
| *** jaosorior has quit IRC | 15:18 | |
| *** Nakato has joined #openstack-keystone | 15:18 | |
| *** pumaranikar has joined #openstack-keystone | 15:18 | |
| *** jaosorior has joined #openstack-keystone | 15:18 | |
| *** stevemar_ has quit IRC | 15:18 | |
| samueldmq | henrynash: hey | 15:20 |
| henrynash | samueldmq: I think you had a question/comment on project names.... | 15:20 |
| *** tonytan4ever has joined #openstack-keystone | 15:21 | |
| *** timcline has joined #openstack-keystone | 15:21 | |
| *** timcline has quit IRC | 15:22 | |
| *** kashyap has left #openstack-keystone | 15:22 | |
| *** timcline has joined #openstack-keystone | 15:23 | |
| *** aj2 has joined #openstack-keystone | 15:23 | |
| *** andrewbogott has quit IRC | 15:23 | |
| *** andrewbogott has joined #openstack-keystone | 15:23 | |
| samueldmq | henrynash: ah yes, name clashing | 15:24 |
| samueldmq | henrynash: so, the issue is when we have a project and a domain with the same name | 15:24 |
| samueldmq | henrynash: and we want to get a project scoped token in the is-domain project, so that becomes confusing | 15:24 |
| samueldmq | henrynash: is that right ? | 15:24 |
| *** slberger has joined #openstack-keystone | 15:24 | |
| *** urulama has quit IRC | 15:25 | |
| henrynash | samueldmq: well, yes, that’s the thing we would not support if we allow name clashing projects | 15:25 |
| *** raildo-afk is now known as raildo | 15:25 | |
| *** urulama has joined #openstack-keystone | 15:25 | |
| henrynash | samueldmq: you can use projectID of course, but not project name | 15:26 |
| henrynash | samueldmq: although I’m alos suggesting that we might just want to avoid the confusion for now by making it illegal (as per my mail) | 15:26 |
| samueldmq | henrynash: what if we don't allow pure project scoped tokens in is-domain projects ? | 15:26 |
| samueldmq | henrynash: and just is-domain project scoped tokens on them ? | 15:27 |
| henrynash | samuedmq: what’s an is-domain project scoped token? | 15:27 |
| samueldmq | henrynash: a domain scoped token | 15:27 |
| samueldmq | henrynash: but in the project format | 15:27 |
| samueldmq | henrynash: containing the is_domain=true in it | 15:27 |
| *** csoukup has joined #openstack-keystone | 15:27 | |
| samueldmq | henrynash: that we keep our current behavior, but just adding the alternative representation, that brings the advantage of easier adoption by other projects (and policies) | 15:28 |
| henrynash | samueldmq: so I suggested that way back…and some people really did not like it (and Im still not sure why) | 15:28 |
| samueldmq | henrynash: at the worst we arent' removing something; we are just not adding it | 15:28 |
| ayoung | henrynash, I think we need to solve hierarchical naming before we can nest domains, or we will get ourselves stuck | 15:29 |
| samueldmq | henrynash: at the end, that means you won't be able to create openstack resources (like instances) on domains, which is the current behavior | 15:29 |
| ayoung | can we tackle that first? | 15:29 |
| ayoung | Say we have a domain "customers" | 15:29 |
| ayoung | and we want "customers"."pepsi" and "customers"."coke" as subdomains | 15:29 |
| henrynash | ayoung: I really don’t want to solve that problem now…and for many cloud providers we don’t need to solve that problem now…we debated this at length during Liberty and agreed we didn’t need to (yet) | 15:30 |
| ayoung | henrynash, nested domains but a flat namespace will be a mistake we can't reverse | 15:30 |
| ayoung | henrynash, I know, but without it, I am kindo fixed on domains have to be flat | 15:31 |
| ayoung | henrynash, the solution might be some horrible naming approach now, with maybe more constraints: | 15:31 |
| henrynash | ayoung: why, it’s more restrictive than we need when we solve hierarchical naming, so not sure what we are blocking off for teh future | 15:31 |
| ayoung | domain names must be limited to a-zA-Z | 15:31 |
| ayoung | henrynash, so if the dom,ains are hierarchical but the names are not, we can never move to hierarchical names. | 15:32 |
| ayoung | it blocks us | 15:32 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint_filter migrations into keystone core https://review.openstack.org/186988 | 15:32 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint filter into keystone core https://review.openstack.org/183377 | 15:32 |
| henrynash | ayoung: maybe I’m being dumb, but how? | 15:32 |
| ayoung | and a local change having globally side effects will lead to security issues | 15:32 |
| ayoung | it effectively breaks the encapsulation of our scoped RBAC | 15:32 |
| ayoung | and I want to get you where you need to be on this...so I am not blocking, I am activekly tyring to solve | 15:33 |
| samueldmq | henrynash: please let me know what you think about my proposal above, I think we need to consider it as a strong option :) | 15:33 |
| samueldmq | henrynash: my proposal/the idea you had too :) | 15:33 |
| ayoung | henrynash, lets define the burning problem you are trying to solve here. Is it "let a customer add and manage their own users?" | 15:34 |
| ayoung | henrynash, here is a really dumb idea...tell me if you like it | 15:35 |
| ayoung | lets assume we scewed the pooch on domain names | 15:35 |
| henrynash | samueldmq: so the only issue I do have with that is that you must now explictely ask for a domain token..mayeb that’s ok, but wonder ow long to get support for it | 15:35 |
| ayoung | we should have limited the charachters, but we didn't | 15:35 |
| ayoung | so... | 15:35 |
| ayoung | lets add a new value...domain URL | 15:35 |
| ayoung | domain URLS must be nestable | 15:35 |
| ayoung | names are only usable for top level domains. | 15:36 |
| samueldmq | henrynash: that way you'd have to explicitly ask for an is-domain project scoped token (domain token); but thta's what we do today already | 15:36 |
| samueldmq | henrynash: + the facility of handling it on other projects + policies | 15:36 |
| *** jaosorior has quit IRC | 15:36 | |
| ayoung | in order to get a token for a subdomain, you set OS_USER_DOMAIN_URL=http://keystone:443/v3/doms/parent/child1/child2 | 15:36 |
| *** jaosorior has joined #openstack-keystone | 15:36 | |
| samueldmq | henrynash: and is a smaller step for now; making it less confusing | 15:37 |
| henrynash | samueldmq: understand what you are suggesting, let me mull on it | 15:37 |
| *** tjcocozz_ has quit IRC | 15:37 | |
| ayoung | henrynash, alternatively...we can add a config option the restricts domain names to the safe segment of a URL, and then in order to have nested domains..URL again.... | 15:38 |
| samueldmq | henrynash: glad you got it, yes please mull on it a bit more; as it definitely makes sense to me :) | 15:38 |
| ayoung | but using the exisiting env vars | 15:39 |
| samueldmq | henrynash: thanks | 15:39 |
| henrynash | ayoung: and where is this URL specified…in the auth call? | 15:39 |
| ayoung | henrynash, yes | 15:40 |
| mhickey | Hey. Does anyone know what modulw I need to include to get config items :'auth_section' and 'auth_plugin'? | 15:40 |
| ayoung | henrynash, if we can make domain naming hierarchical, all my objects melt away | 15:40 |
| mhickey | *module* | 15:40 |
| *** stevemar_ has joined #openstack-keystone | 15:40 | |
| *** ChanServ sets mode: +o stevemar_ | 15:40 | |
| ayoung | as that allows names to stay global, without bleed over | 15:40 |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: remove assignments when deleting a domain https://review.openstack.org/127433 | 15:40 |
| ayoung | mhickey, keystonemiddleware.auth | 15:41 |
| *** adelia has joined #openstack-keystone | 15:41 | |
| henrynash | ayoung: (just making sure I understand the scope of the change you are suggesting) - so we would add an alternate scope option to auth which allowed domain_url rather than domain_name (and ID) | 15:42 |
| mhickey | ayoung: thanks. :) | 15:42 |
| ayoung | henrynash, I would suggest that, but it would cause serious retooling. I tjhink that we need to make domkain names fit into a URL scheme | 15:42 |
| ayoung | henrynash, so, let me find the right term... | 15:43 |
| *** adelia has quit IRC | 15:43 | |
| *** tjcocozz_ has joined #openstack-keystone | 15:44 | |
| sborkows | Hi, I have a problem with accessing keystone through python client. The listing: http://paste.openstack.org/show/479266/ . The token was generated by 'keystone token-get' from admin account. However, when I typed 'keystone user-list' in terminal I got normal response with 5 users. What am I doing wrong? | 15:45 |
| *** annasort_ has quit IRC | 15:54 | |
| *** jerrygb has joined #openstack-keystone | 15:57 | |
| *** hrou has joined #openstack-keystone | 15:58 | |
| *** fhubik has quit IRC | 15:58 | |
| *** daemontool has quit IRC | 15:58 | |
| *** daemontool has joined #openstack-keystone | 15:59 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Enable retrieval of default values of domain config options https://review.openstack.org/185650 | 15:59 |
| samueldmq | would a documentation on keystone dev docs to list our current gate jobs | 16:02 |
| henrynash | samuedlmq: so just trying to (re-understand) what you are suggesting….we already saying we will add is_domain to the token, so that part (and whether policy files let callers create VMs in projects acting as a domain) is already covered | 16:02 |
| samueldmq | and to show what each one is supposed to test | 16:02 |
| samueldmq | would that be useful ? | 16:02 |
| samueldmq | bknudson_: dstanek ? ^ | 16:02 |
| henrynash | samueldmq: I assume the new bit youare suggetsing is that teh auth request must have is_domain in it? | 16:02 |
| samueldmq | henrynash: so with a project scoped token with is_domain=true, is one expected to execute only domain actions or domain+project actions | 16:05 |
| henrynash | sameuldmq: that’s up to how people write their policy rule | 16:05 |
| henrynash | sameuldmq: this is already what we are proposing | 16:05 |
| samueldmq | henrynash: I agree, so let's add is_domain in the token request | 16:06 |
| samueldmq | henrynash: what I propose is to NOT be able to get a project scoped token (without is_domain in the token request) for an is-domain project | 16:06 |
| henrynash | samueldmq: and is your suggestion taht you MUST provide is_domain=True in order to get a project toke on a project acting as a domain? | 16:06 |
| samueldmq | henrynash: yes that's it | 16:06 |
| henrynash | right! | 16:06 |
| samueldmq | henrynash: that way there is NO confusion at all | 16:07 |
| samueldmq | henrynash: this is a new special type of project, and there is a new special type of request for tokens on it | 16:07 |
| henrynash | samuedlmq: my anuease that we have a special type of tolen requst/response today (its called a domain request) and it’s taken us yeards to get anyone to use it! | 16:08 |
| *** rcernin has quit IRC | 16:09 | |
| samueldmq | henrynash: domains are different than projects, so we need a difference in the token request | 16:09 |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: remove assignments when deleting a domain https://review.openstack.org/127433 | 16:09 |
| samueldmq | henrynash: we have been having this since we introduced domain | 16:09 |
| samueldmq | henrynash: but now, we are making the token request and the token response much closer to a project one (which people already support) | 16:10 |
| samueldmq | henrynash: so it will be much easier for adoption imo | 16:10 |
| henrynash | samuedlmq: I know, and I guess conceptaiully I want to remove this difference unless you NEED to know….and if you ahve a role on a project acting as a domain, you should just ask for a project scoped token on it | 16:10 |
| openstackgerrit | henry-nash proposed openstack/keystone: Use list_role_assignments to get projects/domains for user https://review.openstack.org/242513 | 16:11 |
| *** wuhg has quit IRC | 16:11 | |
| ayoung | henrynash, lets add a config option that limits domain names to path segments. Any domain name that does not meet that criteria will be conisdered invalid | 16:12 |
| openstackgerrit | henry-nash proposed openstack/keystone: Show defect in list_user_ids that only lists direct user assignments https://review.openstack.org/242564 | 16:12 |
| ayoung | then we can make domain names into URLs | 16:12 |
| *** sthillma has joined #openstack-keystone | 16:13 | |
| henrynash | ayoung: meaning you can’t have ‘/‘ in a domain name, I assume | 16:13 |
| ayoung | henrynash, at least that, yes | 16:13 |
| ayoung | henrynash, plus any other non-url safe characters | 16:13 |
| ayoung | no @ | 16:13 |
| ayoung | no ? | 16:13 |
| samueldmq | henrynash: does that make sense to completely remove that difference ? I mean, projects and domains have different entities and responsabilities | 16:13 |
| samueldmq | henrynash: I still think keeping domains for identity and projects for other openstack resources is a good thing, but making the auth requests/responses close is a great step torwards adoption | 16:14 |
| henrynash | ayoung: and on migration, if we find a bad character we…….? change it? | 16:14 |
| ayoung | henrynash, no migration. It is a config option. If it is set, and a domain does not match it, treat the domain as disabled | 16:15 |
| ayoung | henrynash, we could do that for all names...call it "strict_url_checking" ... | 16:15 |
| ayoung | henrynash, so, in order to get hierarchical domains, you need to have that option set | 16:16 |
| henrynash | ayoung: ouch! I see what this might be a good thing in the longer run…would this config switch by on or off by default!!?!?!? | 16:16 |
| *** david8hu has quit IRC | 16:16 | |
| ayoung | off by default | 16:17 |
| henrynash | ok, get that | 16:17 |
| *** yangyapeng has quit IRC | 16:17 | |
| ayoung | henrynash, it means that people who want hierarchical domains have to opt in, and do the due dilligence prior to enabling | 16:17 |
| henrynash | and how do you acually speciify the url…just in the domain name attribute in the scope of he auth request? | 16:17 |
| ayoung | henrynash, and...with that option, domain names are globally unique without breaking RBAC | 16:18 |
| ayoung | henrynash, the domain name value would then be either the full URL or the relative URL from http://hostname:port/v3/domains I would thing | 16:18 |
| ayoung | think | 16:18 |
| henrynash | ayoung: Oh! You’re saying we actually store the url-style name in the entity | 16:19 |
| *** wolsen has joined #openstack-keystone | 16:19 | |
| henrynash | ayoung: or maybe not? | 16:19 |
| ayoung | henrynash, right, we restrict domain.name to be a proper url-fgragment, and then the name is the full path | 16:19 |
| *** edmondsw has quit IRC | 16:19 | |
| ayoung | we can use DOMAIN_URL if we want to do it as a proper URL in the future...name should be the relative URL I think, from http://hostname:port/v3/domains | 16:20 |
| *** Ephur has joined #openstack-keystone | 16:20 | |
| *** fawadkhaliq has quit IRC | 16:20 | |
| henrynash | ayoung: just to be clear, in the domain entity we store the just the fragment of the url (i.e. a simple name), and then the requeust uses a “url”? | 16:20 |
| ayoung | henrynash, not quite | 16:21 |
| henrynash | ayoung: or the entity name is the “url from the root" | 16:21 |
| ayoung | henrynash, "in the domain entity we store the just the fragment of the url" yes | 16:21 |
| ayoung | and then the domain name is the fully composed name from parent to node | 16:21 |
| ayoung | so if the top level domain is "customers" | 16:21 |
| ayoung | and the subdomain is "pepsi" | 16:21 |
| ayoung | the domain name is "customers/pepsi" | 16:22 |
| henrynash | ayoung: “customers/pepsi “is what is stored ias the project name n the project acting as a domain that is pepsi | 16:22 |
| *** dims_ has joined #openstack-keystone | 16:22 | |
| ayoung | henrynash, so in the SQL entry domain_name="pepsi" | 16:23 |
| *** urulama has quit IRC | 16:23 | |
| *** urulama has joined #openstack-keystone | 16:23 | |
| henrynash | ayoung: Ok | 16:23 |
| *** dims has quit IRC | 16:24 | |
| *** belmoreira has quit IRC | 16:24 | |
| *** exploreshaifali has joined #openstack-keystone | 16:25 | |
| henrynash | ayoung: so I get what you are suggesting, and so just let me go back to understand why you think the current proposal (e.e. without hierarchical naming) kills our future | 16:27 |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: removed conflict wrapper on delete_project https://review.openstack.org/247017 | 16:27 |
| *** jbell8 has joined #openstack-keystone | 16:27 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Bye Bye Domain Table https://review.openstack.org/161854 | 16:28 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Remove domain table references https://review.openstack.org/165936 | 16:28 |
| henrynash | ayoung: is that that you think we couldn’t migrate to a more restrictive scheme (like you are suggetsing), or that it is that once people get used to being able to just speciify a simple name (and it will find the doamin whatever level it is), then we’ll never be able to wean them off it> | 16:28 |
| henrynash | ? | 16:28 |
| *** edmondsw has joined #openstack-keystone | 16:28 | |
| ayoung | henrynash, ok...so the first is closer. The issue is that if we allow people to make changes that can have global effects based on a project or domain scoped token, we are breaking the RBAC side of things. It means that we can't let a user ever have admin on a project, as they could then allocate a domain name we don;t want them to have | 16:30 |
| ayoung | if admin means "you can assign all roles to a user on this project" | 16:30 |
| ayoung | and one of those roles is "you can create a subdomain" | 16:30 |
| ayoung | then any admin user can create any domain name, and we are back in the land of 968696 | 16:31 |
| henrynash | (thinking) | 16:31 |
| henrynash | (it’s a slow process) | 16:32 |
| *** sthillma has quit IRC | 16:32 | |
| henrynash | ayoung: Ok, i get your specific concern…let me think on it for an hour or two | 16:33 |
| ayoung | henrynash, I really like the idea of URLs as our primary tool for naming. Making it an opt-in is a powerful incentive | 16:34 |
| henrynash | ayoung: I do agree with that…i | 16:34 |
| ayoung | I bet that most things domain names will work fine. So, we should have a plan to help those few that don't | 16:35 |
| *** roxanaghe has joined #openstack-keystone | 16:36 | |
| aj2 | Hi henrynash. Regarding 127433, If we put the method delete_domain_assignments in V9 driver, then how do we backport it to Kilo? | 16:39 |
| ayoung | henrynash, it still means only domaiuns under domains | 16:39 |
| slberger | I am doing testing trying to upgrade keystone from kilo to liberty, and everything is going good but I get an error with verifying the certificate when using the keystone client, which is an updated version of what was being previously used: was 1.3 now 1.6. I don't get this error with the openstack client or if I use --insecure or define the path to the certificate in the keystone client call. | 16:39 |
| slberger | Is this just new functionality from the keystone client or is there something that must be set in keystone now that it is at liberty? | 16:39 |
| aj2 | I apologize if I am interrupting. | 16:39 |
| henrynash | aj2: hmm…I think you’d have to manually port it into the (non versioned ) driver in Kilo | 16:40 |
| henrynash | aj2: sorry, have to drop off, be back on line later | 16:41 |
| *** henrynash has quit IRC | 16:41 | |
| sborkows | Hi, I have a problem with accessing keystone through python client. The listing: http://paste.openstack.org/show/479266/ . The token was generated by 'keystone token-get' from admin account. However, when I typed 'keystone user-list' in terminal I got normal response with 5 users. What am I doing wrong? | 16:42 |
| notmorgan | aj2: what henrynash said is correct. for backporting to non-versioned driver(s), it's just manual. | 16:44 |
| *** EinstCrazy has quit IRC | 16:46 | |
| *** slberger1 has joined #openstack-keystone | 16:46 | |
| *** jbell8 has quit IRC | 16:47 | |
| *** slberger has quit IRC | 16:48 | |
| aj2 | notmorgan, Do you think it is a good candidate for backporting to Kilo and Liberty? | 16:49 |
| notmorgan | aj2: i hve not looked at the code | 16:49 |
| notmorgan | aj2: so not sure. | 16:49 |
| aj2 | https://review.openstack.org/#/c/127433 | 16:49 |
| aj2 | Please have a look if you have some time. | 16:49 |
| *** pumaranikar has quit IRC | 16:50 | |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: Removed conflict wrapper on delete_project https://review.openstack.org/247017 | 16:50 |
| *** pumaranikar has joined #openstack-keystone | 16:50 | |
| *** petertr7 is now known as petertr7_away | 16:52 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:54 | |
| *** fawadkhaliq has quit IRC | 16:55 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:55 | |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: remove assignments when deleting a domain https://review.openstack.org/127433 | 16:56 |
| *** belmoreira has joined #openstack-keystone | 16:58 | |
| *** tjcocozz_ has quit IRC | 16:58 | |
| *** stevemar_ has quit IRC | 16:59 | |
| *** sborkows has quit IRC | 16:59 | |
| *** e0ne has quit IRC | 17:01 | |
| *** lhcheng has joined #openstack-keystone | 17:01 | |
| *** ChanServ sets mode: +v lhcheng | 17:01 | |
| *** lhcheng_ has joined #openstack-keystone | 17:02 | |
| *** lhcheng has quit IRC | 17:02 | |
| *** mylu has joined #openstack-keystone | 17:03 | |
| *** mylu has quit IRC | 17:05 | |
| *** lhcheng_ is now known as lhcheng | 17:05 | |
| *** ChanServ sets mode: +v lhcheng | 17:05 | |
| *** mylu has joined #openstack-keystone | 17:05 | |
| kfox1111 | any idea why I might see this: http://pastebin.com/q46evsZU | 17:06 |
| kfox1111 | trying to do a keystone tenant-list on the cli. | 17:07 |
| kfox1111 | same happens with an 'openstack project list' | 17:08 |
| bknudson_ | samueldmq: I don't think it would be useful to document in keystone what the jobs are. the jobs are defined in infra not in keystone | 17:08 |
| bknudson_ | we could have a link in the keystone dev docs to infra docs | 17:08 |
| *** akanksha_ has quit IRC | 17:08 | |
| kfox1111 | or just a 'keystone token-get' | 17:09 |
| *** petertr7_away is now known as petertr7 | 17:09 | |
| *** mylu has quit IRC | 17:10 | |
| *** sileht has quit IRC | 17:10 | |
| *** sileht has joined #openstack-keystone | 17:11 | |
| *** jistr has quit IRC | 17:11 | |
| *** mylu has joined #openstack-keystone | 17:12 | |
| dstanek | kfox1111: that looks like a bug. what version are you using? | 17:15 |
| *** mylu has quit IRC | 17:16 | |
| kfox1111 | openstack-keystone-8.0.0-1.el7.noarch | 17:18 |
| *** henrynash has joined #openstack-keystone | 17:18 | |
| *** ChanServ sets mode: +v henrynash | 17:18 | |
| kfox1111 | trying it in apache. | 17:18 |
| *** opilotte has joined #openstack-keystone | 17:19 | |
| *** daemontool has quit IRC | 17:20 | |
| *** browne has joined #openstack-keystone | 17:20 | |
| *** gyee has joined #openstack-keystone | 17:20 | |
| *** ChanServ sets mode: +v gyee | 17:20 | |
| *** mylu has joined #openstack-keystone | 17:20 | |
| *** exploreshaifali has quit IRC | 17:22 | |
| *** exploreshaifali has joined #openstack-keystone | 17:23 | |
| *** tyagiprince has joined #openstack-keystone | 17:23 | |
| *** belmoreira has quit IRC | 17:25 | |
| henrynash | aj2: hi | 17:27 |
| henrynash | aj2: just checking if you have any other questions on that driver interface | 17:27 |
| *** tyagiprince has quit IRC | 17:27 | |
| kfox1111 | dstanek: any idea what may be wrong? | 17:29 |
| *** stevemar_ has joined #openstack-keystone | 17:31 | |
| *** ChanServ sets mode: +o stevemar_ | 17:31 | |
| *** tyagiprince has joined #openstack-keystone | 17:32 | |
| *** jaosorior has quit IRC | 17:33 | |
| *** david8hu has joined #openstack-keystone | 17:33 | |
| *** gordc has joined #openstack-keystone | 17:33 | |
| *** tonytan4ever has quit IRC | 17:33 | |
| davechen | marekd: you can pick up other two pieces from the chain now, they are in good shape now. :) | 17:34 |
| dstanek | kfox1111: hmm...not really. the comment in oslo.i18n is a little confusing since it talks about 2.6 | 17:35 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Optionally return names in the list assignment API. https://review.openstack.org/240466 | 17:35 |
| *** mylu has quit IRC | 17:35 | |
| *** mylu has joined #openstack-keystone | 17:36 | |
| *** urulama has quit IRC | 17:36 | |
| *** mylu has quit IRC | 17:36 | |
| tyagiprince | chirag: yes chirag.. paste the logs in pastebin.. | 17:36 |
| kfox1111 | ah.... think I figured it out... | 17:36 |
| kfox1111 | strace showed it trying to open the cert file for the ldap server and not finding it. | 17:36 |
| *** urulama has joined #openstack-keystone | 17:36 | |
| tyagiprince | chirag: does glance image-list works?? | 17:37 |
| henrynash | dstanek, notmorgan: sorry to bug, but could do with your combined wisdom on https://review.openstack.org/#/c/242853/ since there are a number of changes building up needing a new V9 assignment driver | 17:39 |
| dstanek | kfox1111: it's bad that the error doesn't bubble up | 17:40 |
| dstanek | kfox1111: i tried to quickly reproduce form the command line but couldn't - http://pastebin.com/EXE9VY3P | 17:40 |
| *** tyagiprince1 has joined #openstack-keystone | 17:40 | |
| *** tyagiprince has quit IRC | 17:41 | |
| *** tyagiprince1 is now known as tyagiprince | 17:41 | |
| dstanek | kfox1111: i'll see if i can setup the same case that you had. was the cert not found because it didn't exist or was it a permissions thing? | 17:41 |
| dstanek | henrynash: sure i can take a look. i think it's already on my list for today anyway | 17:42 |
| henrynash | dtsanek: great, thanks! | 17:42 |
| henrynash | dstanek: great, thanks! | 17:43 |
| *** jbell8 has joined #openstack-keystone | 17:44 | |
| *** exploreshaifali has quit IRC | 17:47 | |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles https://review.openstack.org/242614 | 17:47 |
| *** exploreshaifali has joined #openstack-keystone | 17:48 | |
| *** aix has quit IRC | 17:51 | |
| *** petertr7 is now known as petertr7_away | 17:53 | |
| *** jerrygb_ has joined #openstack-keystone | 17:54 | |
| *** shaleh has joined #openstack-keystone | 17:54 | |
| *** jerrygb_ has quit IRC | 17:54 | |
| *** jerrygb_ has joined #openstack-keystone | 17:55 | |
| kfox1111 | dstanek: I have a file: /etc/keystone/domains/keystone.Default.conf | 17:55 |
| kfox1111 | in it is an ldap domain, with: | 17:56 |
| kfox1111 | use_tls = True | 17:56 |
| kfox1111 | tls_cacertfile = /etc/openldap/certs/pnnlca02r3.cer | 17:56 |
| kfox1111 | the cacertfile didn't exist. | 17:56 |
| *** tyagiprince1 has joined #openstack-keystone | 17:56 | |
| *** jerrygb has quit IRC | 17:57 | |
| *** EinstCrazy has joined #openstack-keystone | 17:58 | |
| *** jerrygb_ has quit IRC | 17:59 | |
| *** tyagiprince has quit IRC | 17:59 | |
| *** tyagiprince1 is now known as tyagiprince | 17:59 | |
| *** jerrygb_ has joined #openstack-keystone | 18:01 | |
| *** jerrygb_ has quit IRC | 18:01 | |
| *** itlinux has joined #openstack-keystone | 18:01 | |
| *** jerrygb_ has joined #openstack-keystone | 18:01 | |
| *** mylu has joined #openstack-keystone | 18:04 | |
| *** belmoreira has joined #openstack-keystone | 18:04 | |
| *** EinstCrazy has quit IRC | 18:05 | |
| *** daemontool has joined #openstack-keystone | 18:05 | |
| *** mylu has quit IRC | 18:05 | |
| *** belmoreira has quit IRC | 18:05 | |
| *** mylu has joined #openstack-keystone | 18:06 | |
| *** tyagiprince has quit IRC | 18:06 | |
| *** tyagiprince1 has joined #openstack-keystone | 18:06 | |
| ayoung | henrynash, reviewed. | 18:06 |
| *** tyagiprince1 is now known as tyagiprince | 18:08 | |
| *** mylu has quit IRC | 18:10 | |
| *** mylu has joined #openstack-keystone | 18:11 | |
| *** mylu has quit IRC | 18:11 | |
| *** lhinds has joined #openstack-keystone | 18:12 | |
| *** mylu has joined #openstack-keystone | 18:12 | |
| *** mylu has quit IRC | 18:13 | |
| *** mylu has joined #openstack-keystone | 18:13 | |
| *** lhinds has left #openstack-keystone | 18:13 | |
| *** e0ne has joined #openstack-keystone | 18:15 | |
| *** tonytan4ever has joined #openstack-keystone | 18:15 | |
| *** daemontool has quit IRC | 18:16 | |
| *** jerrygb_ has quit IRC | 18:17 | |
| samueldmq | bknudson_: something like : tempest-dsvm-whatever; this job runs on this and that condition and ensures keystone isn't introducing a regression that affects tempest tests, etc | 18:20 |
| samueldmq | bknudson_: I mean, describing what benefit having those jobs bring to keystone | 18:21 |
| *** fawadkhaliq has quit IRC | 18:21 | |
| *** tyagiprince has quit IRC | 18:22 | |
| *** tyagiprince has joined #openstack-keystone | 18:23 | |
| samueldmq | stevemar_: marekd: hey, iurygregory is working on federation scripts for puppet-keystone | 18:24 |
| samueldmq | stevemar_: marekd: puppet folks (cc crinkle ) are looking at the change from a puppet point of view | 18:25 |
| samueldmq | stevemar_: marekd: it'd be nice to have your expertise on federation and evaluate that patch from a federation point of view too | 18:25 |
| samueldmq | stevemar_: marekd: if you don't mind: https://review.openstack.org/#/c/216821/ | 18:25 |
| *** pnavarro has quit IRC | 18:27 | |
| *** ayoung has quit IRC | 18:27 | |
| *** mylu has quit IRC | 18:28 | |
| *** mylu has joined #openstack-keystone | 18:29 | |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: Remove assignments when deleting a domain https://review.openstack.org/127433 | 18:30 |
| *** tyagiprince1 has joined #openstack-keystone | 18:31 | |
| *** tyagiprince has quit IRC | 18:33 | |
| *** tyagiprince1 is now known as tyagiprince | 18:33 | |
| *** timcline has quit IRC | 18:33 | |
| *** mylu has quit IRC | 18:34 | |
| *** timcline has joined #openstack-keystone | 18:35 | |
| *** tonytan4ever has quit IRC | 18:37 | |
| *** jerrygb has joined #openstack-keystone | 18:44 | |
| *** petertr7_away is now known as petertr7 | 18:45 | |
| mhickey | Hey. I tried the following 'namespace = keystonemiddleware.auth; to include 'auth_section' and 'authplugin' config items when generating config file using oslo generation. However, the module inclusion does not generate any config items. Anyone know what might be going wrong? | 18:52 |
| *** timcline has quit IRC | 18:53 | |
| *** timcline has joined #openstack-keystone | 18:53 | |
| *** tyagiprince1 has joined #openstack-keystone | 18:54 | |
| *** tonytan4ever has joined #openstack-keystone | 18:55 | |
| *** tyagiprince has quit IRC | 18:57 | |
| *** tyagiprince1 is now known as tyagiprince | 18:57 | |
| *** mylu has joined #openstack-keystone | 18:59 | |
| *** petertr7 is now known as petertr7_away | 19:00 | |
| *** doug-fis_ has joined #openstack-keystone | 19:00 | |
| *** mylu has quit IRC | 19:01 | |
| *** mylu has joined #openstack-keystone | 19:01 | |
| *** doug-fi__ has joined #openstack-keystone | 19:03 | |
| *** mylu_ has joined #openstack-keystone | 19:04 | |
| *** doug-fish has quit IRC | 19:04 | |
| mhickey | I have tried 'keystoneclient.auth.conf' as well but no good either even though it is defined in keystoneclient/auth/conf.py | 19:04 |
| *** doug-fi__ has quit IRC | 19:04 | |
| *** tyagiprince has quit IRC | 19:04 | |
| *** Guest12059 is now known as med_ | 19:04 | |
| *** mylu has quit IRC | 19:04 | |
| *** med_ has quit IRC | 19:04 | |
| *** med_ has joined #openstack-keystone | 19:04 | |
| *** tyagiprince1 has joined #openstack-keystone | 19:04 | |
| *** doug-fish has joined #openstack-keystone | 19:04 | |
| *** doug-fish has quit IRC | 19:04 | |
| *** doug-fis_ has quit IRC | 19:05 | |
| *** doug-fish has joined #openstack-keystone | 19:05 | |
| *** harlowja has quit IRC | 19:05 | |
| stevemar_ | samueldmq: i'll take a peek | 19:06 |
| *** doug-fish has quit IRC | 19:06 | |
| *** doug-fish has joined #openstack-keystone | 19:07 | |
| *** tyagiprince1 is now known as tyagiprince | 19:07 | |
| stevemar_ | mhickey: you have a change up for review? | 19:07 |
| samueldmq | stevemar_: thanks! I appreciate your time | 19:07 |
| *** itlinux_ has joined #openstack-keystone | 19:07 | |
| mhickey | stevemar_: yes; trying to close out wip. missing the above config items! :) | 19:08 |
| *** harlowja has joined #openstack-keystone | 19:08 | |
| *** itlinux has quit IRC | 19:08 | |
| *** ChanServ sets mode: +o dolphm | 19:10 | |
| *** mylu_ has quit IRC | 19:11 | |
| *** mylu has joined #openstack-keystone | 19:11 | |
| stevemar_ | mhickey: link us! | 19:11 |
| mhickey | stevemar_: sorry but not sure what you mean? | 19:12 |
| bknudson_ | samueldmq: we (keystone) don't pick what the jobs are. infra does. | 19:16 |
| bknudson_ | and they can change it any time they feel like it | 19:16 |
| stevemar_ | mhickey: oh i thought you had an open patch that i could review | 19:17 |
| *** tyagiprince1 has joined #openstack-keystone | 19:17 | |
| mhickey | stevemar_: sorry just looking for info on config items.. | 19:18 |
| *** tyagiprince has quit IRC | 19:19 | |
| *** tyagiprince1 is now known as tyagiprince | 19:19 | |
| samueldmq | bknudson_: okay, I thought it was we that proposed o add/remove jobs | 19:20 |
| stevemar_ | mhickey: try #openstack-oslo or ping dims_ | 19:20 |
| stevemar_ | will a wild dims_ appear? | 19:20 |
| * dims_ says your wish is my command sir! | 19:21 | |
| *** petertr7_away is now known as petertr7 | 19:21 | |
| *** doug-fish has quit IRC | 19:22 | |
| *** browne has quit IRC | 19:22 | |
| *** doug-fish has joined #openstack-keystone | 19:23 | |
| *** bapalm has quit IRC | 19:23 | |
| *** tjcocozz has quit IRC | 19:23 | |
| mhickey | stevemar_: thanks Steve. Just chatting to dims_ on oslo channel | 19:25 |
| openstackgerrit | Merged openstack/keystone-specs: Accepts Group IDs from the IdP without domain https://review.openstack.org/216308 | 19:25 |
| *** bapalm has joined #openstack-keystone | 19:26 | |
| *** tjcocozz has joined #openstack-keystone | 19:26 | |
| *** tyagiprince has quit IRC | 19:29 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Clean up new_credential_ref usage and surrounding code https://review.openstack.org/246713 | 19:33 |
| *** LukeHinds has quit IRC | 19:36 | |
| shaleh | stevemar_: I replied to your question about the deletes on my project_ref review. This is more of the unexpected optional values stuff. Since the tests created their refs locally there was quite a bit of inconsistency. | 19:40 |
| *** aj2 has quit IRC | 19:40 | |
| shaleh | stevemar_: I can either lop off the values like I was or attempt to fix the tests. | 19:40 |
| *** mylu has quit IRC | 19:42 | |
| stevemar_ | shaleh: coolio | 19:42 |
| stevemar_ | shaleh: oh, pfft | 19:43 |
| *** mylu has joined #openstack-keystone | 19:43 | |
| stevemar_ | shaleh: you can lop them off, just leave a TODO comment saying the test needs to be fixed | 19:43 |
| shaleh | stevemar_: long term I am down with bknudson's suggestion of dropping optional values completely | 19:43 |
| stevemar_ | shaleh: when i was reviewing i was surprised, so just needed some context there | 19:44 |
| shaleh | stevemar_: I appreciate. People kept asking about the deletes in places. All of them were to bypass test issues. LDAP in particular went crazy when 'description' was present. | 19:45 |
| *** ayoung has joined #openstack-keystone | 19:45 | |
| *** ChanServ sets mode: +v ayoung | 19:45 | |
| shaleh | stevemar_: I refreshed the credential ref patchset. Should be what you were looking for | 19:46 |
| *** gildub_ has joined #openstack-keystone | 19:46 | |
| *** jasonsb has quit IRC | 19:55 | |
| *** itlinux_ has quit IRC | 19:59 | |
| *** itlinux has joined #openstack-keystone | 20:02 | |
| *** peter-hamilton has quit IRC | 20:06 | |
| *** NM has quit IRC | 20:09 | |
| *** petertr7 is now known as petertr7_away | 20:09 | |
| *** itlinux has quit IRC | 20:10 | |
| *** itlinux has joined #openstack-keystone | 20:11 | |
| *** e0ne has quit IRC | 20:13 | |
| *** NM has joined #openstack-keystone | 20:17 | |
| *** mylu has quit IRC | 20:17 | |
| *** mylu has joined #openstack-keystone | 20:18 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone-specs: Shadow users: unified identity https://review.openstack.org/240595 | 20:18 |
| *** ccard has quit IRC | 20:19 | |
| *** mylu_ has joined #openstack-keystone | 20:20 | |
| ayoung | samueldmq, shaleh, bknudson_ https://review.openstack.org/#/c/240719/ please. That might be the most important review of the release. Would love to get it beat on early. | 20:21 |
| ayoung | lbragstad, you too ^^ | 20:21 |
| *** mylu has quit IRC | 20:21 | |
| openstackgerrit | Merged openstack/keystone: Fix inaccurate debug mode response https://review.openstack.org/238636 | 20:21 |
| samueldmq | ayoung: will look for sure | 20:21 |
| *** mylu_ has quit IRC | 20:22 | |
| samueldmq | lbragstad: looking at your patch now (assignments cache) | 20:22 |
| shaleh | ayoung: so this is the code to implement the project blessed as the admin project? | 20:22 |
| *** mylu has joined #openstack-keystone | 20:22 | |
| ayoung | shaleh, yep | 20:22 |
| openstackgerrit | Ron De Rose proposed openstack/keystone-specs: Shadow users: unified identity https://review.openstack.org/240595 | 20:23 |
| *** petertr7_away is now known as petertr7 | 20:24 | |
| *** mylu_ has joined #openstack-keystone | 20:24 | |
| lbragstad | dolphm stevemar_ @all ZOMG! https://review.openstack.org/#/c/231191/5 | 20:24 |
| *** mylu has quit IRC | 20:25 | |
| *** ccard has joined #openstack-keystone | 20:25 | |
| shaleh | lbragstad: high five! | 20:25 |
| lbragstad | I'm so excited to see that ^ my hands are sweating | 20:26 |
| * lbragstad wonders if that's normal | 20:26 | |
| *** henrynash has quit IRC | 20:27 | |
| *** henrynash has joined #openstack-keystone | 20:28 | |
| *** ChanServ sets mode: +v henrynash | 20:28 | |
| *** itlinux has quit IRC | 20:33 | |
| samueldmq | lbragstad: left a comment on #215715 | 20:34 |
| samueldmq | lbragstad: just a few more cases and we're good to go! | 20:34 |
| samueldmq | lbragstad: thanks for working on that | 20:34 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/247107 | 20:35 |
| *** lhcheng has quit IRC | 20:35 | |
| *** harlowja has quit IRC | 20:36 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/247113 | 20:39 |
| *** harlowja has joined #openstack-keystone | 20:41 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Use unit.new_project_ref consistently https://review.openstack.org/244523 | 20:43 |
| *** tonytan4ever has quit IRC | 20:45 | |
| stevemar_ | lbragstad: what i miss?! | 20:45 |
| stevemar_ | ohhh https://review.openstack.org/#/c/231191/5 | 20:45 |
| stevemar_ | dayuuum | 20:46 |
| lbragstad | stevemar_ we should be able to retrigger bknudson_ 's patch to flip fernet as the default in devstack | 20:46 |
| lbragstad | after that merges | 20:46 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/247113 | 20:47 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/243925 | 20:47 |
| stevemar_ | lbragstad: dolphm i'm gonna start starring things ! https://gist.github.com/stevemart/46d664e486e2edce4972 | 20:47 |
| *** jasonsb has joined #openstack-keystone | 20:50 | |
| *** jasonsb has quit IRC | 20:50 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/247140 | 20:50 |
| *** itlinux has joined #openstack-keystone | 20:51 | |
| *** jasonsb has joined #openstack-keystone | 20:51 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/247154 | 20:51 |
| *** EinstCrazy has joined #openstack-keystone | 20:58 | |
| *** mhickey has quit IRC | 21:00 | |
| *** openstack has joined #openstack-keystone | 21:03 | |
| *** EinstCrazy has quit IRC | 21:03 | |
| *** tonytan4ever has joined #openstack-keystone | 21:03 | |
| *** alejandrito has quit IRC | 21:04 | |
| *** itlinux has quit IRC | 21:05 | |
| *** petertr7 is now known as petertr7_away | 21:08 | |
| *** e0ne has joined #openstack-keystone | 21:09 | |
| *** petertr7_away is now known as petertr7 | 21:09 | |
| *** pumaranikar has quit IRC | 21:09 | |
| *** pumaranikar has joined #openstack-keystone | 21:10 | |
| *** jistr has joined #openstack-keystone | 21:10 | |
| *** jerrygb_ has joined #openstack-keystone | 21:12 | |
| *** NM has quit IRC | 21:12 | |
| *** jerrygb has quit IRC | 21:15 | |
| *** mylu_ has quit IRC | 21:15 | |
| *** raildo is now known as raildo-afk | 21:15 | |
| *** jerrygb_ has quit IRC | 21:22 | |
| *** jerrygb_ has joined #openstack-keystone | 21:23 | |
| *** lhcheng has joined #openstack-keystone | 21:24 | |
| *** ChanServ sets mode: +v lhcheng | 21:24 | |
| *** breitz1 is now known as breitz | 21:25 | |
| *** tonytan4ever has quit IRC | 21:25 | |
| *** jerrygb__ has joined #openstack-keystone | 21:26 | |
| shaleh | credential_id = hashlib.sha256(blob['access']).hexdigest() <--- That line of code is failing the py34 gate now. All I did was move it from one file to a different one. The complaint is that you cannot hash a unicode string it needs to be bytes. Why is this triggering now? | 21:27 |
| *** jerrygb__ has quit IRC | 21:27 | |
| *** pauloewerton has quit IRC | 21:28 | |
| *** tonytan4ever has joined #openstack-keystone | 21:28 | |
| *** jerrygb has joined #openstack-keystone | 21:28 | |
| *** jerrygb_ has quit IRC | 21:28 | |
| dstanek | shaleh: was it being tested before? or was blob['access'] bytes in the other file? | 21:30 |
| *** e0ne has quit IRC | 21:31 | |
| shaleh | I moved code from test_v3_credential.py to core.py in tests/unit. No fundamental change, just pulled them up to a top level function | 21:31 |
| *** opilotte_ has joined #openstack-keystone | 21:33 | |
| dstanek | maybe is wasn't being executed before | 21:34 |
| dstanek | do you have a link to the review? | 21:34 |
| *** opilotte_ has quit IRC | 21:35 | |
| shaleh | dstanek: https://review.openstack.org/#/c/246713/ | 21:36 |
| *** urulama has quit IRC | 21:36 | |
| shaleh | as expected if I call .encode() on the data the test passes. It fails under py27 because a test depends on the order of a dictionary. Sigh. | 21:36 |
| shaleh | looks like the popular '' v. u'' issue | 21:37 |
| shaleh | yay | 21:37 |
| dstanek | shaleh: some of the files you are changing are not tested on 3.4 yet because they don't work | 21:38 |
| shaleh | dstanek: what controls that? | 21:39 |
| dstanek | tox.ini | 21:39 |
| shaleh | dstanek: and it looks like i get to make it work now :-) | 21:39 |
| shaleh | dstanek: BTW, how goes your speedup branch? | 21:39 |
| dstanek | not terrible....i'm hacking on it now. some things that merged while i was on vacation are giving me a little trouble | 21:40 |
| dstanek | gonna grab some dinner now, but i'll be back on in a few hours | 21:40 |
| *** jistr has quit IRC | 21:41 | |
| *** opilotte has quit IRC | 21:41 | |
| *** opilotte has joined #openstack-keystone | 21:42 | |
| *** mylu has joined #openstack-keystone | 21:42 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Domain Specific Roles https://review.openstack.org/226661 | 21:45 |
| *** opilotte has quit IRC | 21:45 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: do not review, test https://review.openstack.org/247190 | 21:46 |
| *** e0ne has joined #openstack-keystone | 21:47 | |
| *** NM has joined #openstack-keystone | 21:47 | |
| *** e0ne has quit IRC | 21:50 | |
| *** ayoung has quit IRC | 21:54 | |
| *** muralia has joined #openstack-keystone | 21:58 | |
| *** jerrygb has quit IRC | 22:00 | |
| muralia | Hi, Can someone tell me how I can generate a trust token using the openstack CLI? I have a trust_id and want to generate the trust token. | 22:01 |
| *** opilotte has joined #openstack-keystone | 22:02 | |
| *** lhcheng has quit IRC | 22:04 | |
| *** mylu has quit IRC | 22:06 | |
| *** mylu has joined #openstack-keystone | 22:07 | |
| *** doug-fish has quit IRC | 22:10 | |
| *** mylu has quit IRC | 22:11 | |
| *** lhcheng has joined #openstack-keystone | 22:15 | |
| *** ChanServ sets mode: +v lhcheng | 22:15 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Clean up new_credential_ref usage and surrounding code https://review.openstack.org/246713 | 22:17 |
| *** davechen has quit IRC | 22:22 | |
| *** mylu has joined #openstack-keystone | 22:24 | |
| *** mylu has quit IRC | 22:26 | |
| *** mylu has joined #openstack-keystone | 22:27 | |
| *** jasonsb has quit IRC | 22:28 | |
| *** jasonsb has joined #openstack-keystone | 22:30 | |
| *** mylu has quit IRC | 22:31 | |
| *** mylu has joined #openstack-keystone | 22:33 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Use unit.new_project_ref consistently https://review.openstack.org/244523 | 22:34 |
| *** petertr7 is now known as petertr7_away | 22:35 | |
| *** mylu has quit IRC | 22:36 | |
| *** mylu has joined #openstack-keystone | 22:36 | |
| *** browne has joined #openstack-keystone | 22:39 | |
| *** tonytan4ever has quit IRC | 22:40 | |
| *** browne has quit IRC | 22:41 | |
| *** mylu has quit IRC | 22:41 | |
| *** mylu has joined #openstack-keystone | 22:42 | |
| *** mylu has quit IRC | 22:45 | |
| *** mylu has joined #openstack-keystone | 22:46 | |
| *** henrynash has quit IRC | 22:46 | |
| *** csoukup has quit IRC | 22:48 | |
| *** edmondsw has quit IRC | 22:49 | |
| *** ayoung has joined #openstack-keystone | 22:50 | |
| *** ChanServ sets mode: +v ayoung | 22:50 | |
| *** mylu has quit IRC | 22:50 | |
| *** gordc has quit IRC | 22:50 | |
| *** topol has quit IRC | 22:57 | |
| *** topol has joined #openstack-keystone | 22:57 | |
| *** ChanServ sets mode: +v topol | 22:57 | |
| *** topol has quit IRC | 23:01 | |
| *** jerrygb has joined #openstack-keystone | 23:05 | |
| *** jerrygb has quit IRC | 23:09 | |
| *** mylu has joined #openstack-keystone | 23:10 | |
| *** jerrygb has joined #openstack-keystone | 23:14 | |
| *** pumaranikar has quit IRC | 23:16 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Config option for insecure responses https://review.openstack.org/207226 | 23:17 |
| *** slberger1 has left #openstack-keystone | 23:18 | |
| *** timcline has quit IRC | 23:30 | |
| *** mylu has quit IRC | 23:38 | |
| *** mylu has joined #openstack-keystone | 23:40 | |
| *** mylu has quit IRC | 23:42 | |
| *** mylu has joined #openstack-keystone | 23:42 | |
| *** mylu has quit IRC | 23:44 | |
| *** mylu has joined #openstack-keystone | 23:44 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Clean up new_credential_ref usage and surrounding code https://review.openstack.org/246713 | 23:45 |
| *** gildub_ has quit IRC | 23:51 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!