| *** _cjones_ has quit IRC | 00:00 | |
| *** _cjones_ has joined #openstack-keystone | 00:03 | |
| *** drjones has quit IRC | 00:03 | |
| *** drjones has joined #openstack-keystone | 00:07 | |
| *** _cjones_ has quit IRC | 00:08 | |
| *** spzala has joined #openstack-keystone | 00:10 | |
| *** diazjf has quit IRC | 00:10 | |
| *** gildub has quit IRC | 00:11 | |
| *** drjones has quit IRC | 00:12 | |
| *** _cjones_ has joined #openstack-keystone | 00:13 | |
| *** phalmos has joined #openstack-keystone | 00:19 | |
| *** lhcheng has quit IRC | 00:22 | |
| *** shoutm_ has joined #openstack-keystone | 00:33 | |
| *** phalmos has quit IRC | 00:34 | |
| *** shoutm has quit IRC | 00:35 | |
| *** _cjones_ has quit IRC | 00:37 | |
| *** drjones has joined #openstack-keystone | 00:37 | |
| notmorgan | stevemar: OMG it's PASSING CHECK https://review.openstack.org/#/c/231872/ | 00:37 |
|---|---|---|
| stevemar | notmorgan: i left a comment on it | 00:40 |
| stevemar | just now | 00:40 |
| notmorgan | LDAP role? | 00:40 |
| notmorgan | uhmm.. | 00:41 |
| *** _cjones_ has joined #openstack-keystone | 00:41 | |
| stevemar | notmorgan: it's not like it'll work without LDAP assignment and LDAP resource, but ... we never did deprecate it when we split it out | 00:41 |
| notmorgan | god | 00:41 |
| notmorgan | who PUT THAT IN | 00:41 |
| notmorgan | seriously. | 00:41 |
| stevemar | =\ | 00:42 |
| notmorgan | really?! ldap as a role store? | 00:42 |
| *** drjones has quit IRC | 00:42 | |
| stevemar | it's back when EVERYTHING was in ldap | 00:42 |
| stevemar | it was an all or nothing remember | 00:43 |
| notmorgan | i don't think that'll actually work | 00:43 |
| notmorgan | fwiw | 00:43 |
| stevemar | what won't work? | 00:44 |
| notmorgan | it's only sortof been tested for a looong time | 00:44 |
| notmorgan | i am expecting it to be massively broken if it's really tried | 00:44 |
| notmorgan | thats all | 00:44 |
| *** lhcheng has joined #openstack-keystone | 00:44 | |
| *** ChanServ sets mode: +v lhcheng | 00:44 | |
| notmorgan | also i still disagree with the split of roles like we have it now | 00:45 |
| * notmorgan sees it as relatively pointless to put roles in a separate backend still. | 00:45 | |
| *** _cjones_ has quit IRC | 00:48 | |
| *** _cjones_ has joined #openstack-keystone | 00:48 | |
| notmorgan | stevemar: replied to your comment | 00:53 |
| *** diazjf has joined #openstack-keystone | 00:54 | |
| *** fawadkhaliq has joined #openstack-keystone | 01:00 | |
| *** fawadkhaliq has quit IRC | 01:00 | |
| *** dims has quit IRC | 01:01 | |
| *** diazjf has quit IRC | 01:03 | |
| *** _cjones_ has quit IRC | 01:04 | |
| *** gildub has joined #openstack-keystone | 01:11 | |
| *** shoutm_ has quit IRC | 01:12 | |
| stevemar | breton: can you create a release note for: https://review.openstack.org/#/c/233070/ | 01:12 |
| *** markvoelker has quit IRC | 01:14 | |
| *** shoutm has joined #openstack-keystone | 01:14 | |
| *** davechen has joined #openstack-keystone | 01:14 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove LDAP Resource and LDAP Assignment backends https://review.openstack.org/231872 | 01:21 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove LDAP Role Backend https://review.openstack.org/269385 | 01:21 |
| *** dims has joined #openstack-keystone | 01:23 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove LDAP Role Backend https://review.openstack.org/269385 | 01:24 |
| *** jasonsb has quit IRC | 01:29 | |
| *** roxanaghe has quit IRC | 01:36 | |
| openstackgerrit | ayoung proposed openstack/keystone: Implied roles driver and manager https://review.openstack.org/264260 | 01:39 |
| ayoung | "notmorgan> who PUT THAT IN" git blame....You'll find that I did. | 01:41 |
| notmorgan | ayoung: nope | 01:41 |
| notmorgan | ayoung: was henrynash in this case | 01:41 |
| notmorgan | when he split things out | 01:41 |
| ayoung | notmorgan, he just split it | 01:41 |
| ayoung | I put it in there in the first place | 01:41 |
| notmorgan | ayoung: yeaj not just role assigments but the ldap role backend specifically | 01:41 |
| notmorgan | you didn't do that i blame henry for splitting it ;) | 01:42 |
| ayoung | that waws me...needed it back then | 01:42 |
| *** ccard_ has quit IRC | 01:42 | |
| ayoung | the whole thing is ready for the long sleep | 01:42 |
| notmorgan | yes notice i posted a followup to remove it | 01:42 |
| notmorgan | ;) | 01:42 |
| ayoung | notmorgan, in a test like this https://review.openstack.org/#/c/258650/14/keystone/tests/unit/test_v3_assignment.py what user would you expect to be used to do the GET | 01:44 |
| ayoung | line 151 | 01:44 |
| ayoung | admin or this.user? | 01:45 |
| notmorgan | no idea | 01:45 |
| notmorgan | prob admin if i was guessing | 01:45 |
| notmorgan | but... that is a guess at best | 01:45 |
| *** ccard_ has joined #openstack-keystone | 01:46 | |
| ayoung | need to fix that test to get Fernet working...but I;m not sure what the original intent was | 01:46 |
| notmorgan | make it up | 01:47 |
| lbragstad | ayoung what intent? | 01:47 |
| ayoung | lbragstad, so here is why that test fails | 01:47 |
| lbragstad | ayoung just catching up | 01:47 |
| ayoung | lbragstad, so the user that is used earlier in the test is the user associated with the token used to do the GET | 01:48 |
| ayoung | in the above stuff I pasted, user_id = 1fd3dd98bf924fd786e6c8392dcca3d5 | 01:48 |
| ayoung | lbragstad, if the user got a new token, or a token for a different domain, the call would pass | 01:49 |
| ayoung | it fails because the token is invalid, because the user no longer has a role on the domain: the delete right before got rid of that assignment | 01:49 |
| ayoung | lbragstad, I'd be temped to debug on master and see what happens. | 01:49 |
| ayoung | Either the GET origianlly was called with the admin user or the user got a new token | 01:50 |
| lbragstad | ayoung ahh... | 01:52 |
| lbragstad | ayoung so most of those failures were a result of the testing setup? | 01:53 |
| ayoung | lbragstad, I was looking at the rest of the review, maybe due to the change in the v3_test.py? | 01:53 |
| ayoung | lbragstad, but it does not look like that would change things | 01:53 |
| lbragstad | this - https://review.openstack.org/#/c/258650/14/keystone/tests/unit/test_v3.py ? | 01:54 |
| ayoung | lbragstad, It shouldn't should it? | 01:59 |
| ayoung | lbragstad, I'm going to see what happens on master | 02:00 |
| lbragstad | ayoung I wouldn't think so - that's just making sure a key repository exists | 02:00 |
| ayoung | lbragstad, that is all we *think* it is doing | 02:00 |
| lbragstad | ayoung yeah, exactly | 02:01 |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/268452 | 02:04 |
| *** dslev has joined #openstack-keystone | 02:08 | |
| ayoung | lbragstad, so the master code def gets a new token | 02:09 |
| lbragstad | ayoung I think I just rebased all those patches today? | 02:10 |
| lbragstad | ayoung starting with the oauth + fernet ones | 02:10 |
| lbragstad | ayoung https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:isadmin_protection | 02:10 |
| ayoung | lbragstad, so the problem is before the call, I think. I think it is the test getting a new token | 02:18 |
| ayoung | and the new token is requesting with the domain role... | 02:18 |
| ayoung | let me run it again to confirm, I kindof skipped that | 02:18 |
| lbragstad | so the token is domain-scoped? | 02:18 |
| ayoung | lbragstad, nope, I was wrong | 02:21 |
| ayoung | requesting that token succeeds. And it is a project scoped token | 02:22 |
| lbragstad | but it doesn't succeed with a domain-scoped token? | 02:22 |
| *** david-lyle has joined #openstack-keystone | 02:22 | |
| ayoung | lbragstad, it builds the toke request that you see here: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/test_v3.py#n287 | 02:28 |
| lbragstad | ayoung ah - that looks project scoped | 02:28 |
| ayoung | lbragstad, it passed | 02:28 |
| ayoung | the delaty due to debugger, I think | 02:28 |
| ayoung | let me remove the rpdb line | 02:28 |
| lbragstad | ayoung ok | 02:28 |
| ayoung | lbragstad, ok that failed. I'm going to put a sleep 1 in there | 02:29 |
| lbragstad | ayoung do our tests get two different tokens based on time? | 02:29 |
| davechen | marekd, henrynash: I will work out a patch to support v9 version of catalog driver interface to support the change for service provider filtering. | 02:30 |
| davechen | marekd, henrynash: let me have a try. | 02:30 |
| ayoung | lbragstad, yep, that passes | 02:30 |
| lbragstad | strange... | 02:30 |
| ayoung | lbragstad, I think that the new token is getting marked as revoked | 02:30 |
| lbragstad | ayoung sql datetime issues... | 02:31 |
| lbragstad | truncation stuff | 02:31 |
| ayoung | lbragstad, OK, new hypothesis | 02:31 |
| *** dslev has quit IRC | 02:31 | |
| ayoung | when we call: self.delete(member_url) | 02:31 |
| ayoung | it revokes all for the project | 02:32 |
| ayoung | for that user | 02:32 |
| ayoung | it gets a token, and then uses it within a second | 02:32 |
| ayoung | and the old event is still showing it as revoked. | 02:32 |
| ayoung | Its the timestamp thing you were working on before | 02:32 |
| lbragstad | ayoung yeah - but do our tests use sql or sqlite? | 02:33 |
| lbragstad | sqlite supports subsecond precision, right? | 02:33 |
| ayoung | lbragstad, you know, I can't remember. We've waffled on that so many times | 02:33 |
| lbragstad | ayoung i completely agree that it smells very familiar | 02:33 |
| ayoung | lbragstad, again I am shrugging | 02:34 |
| lbragstad | if a sleep(1) causes a different outcome that would seem to make sense | 02:34 |
| ayoung | lbragstad, so...we order things like this: | 02:34 |
| ayoung | 1. make UUID use the same thing as Fernet | 02:34 |
| lbragstad | maybe we focus on getting https://review.openstack.org/#/c/243742/ in? | 02:34 |
| ayoung | 2. Kill the unnecessary revoke events | 02:35 |
| ayoung | 3. Make ferent default | 02:35 |
| lbragstad | ayoung I have patches up for all three of those | 02:35 |
| lbragstad | ayoung and so does jorge_munoz :) | 02:35 |
| ayoung | lbragstad, looking | 02:36 |
| lbragstad | 1 - https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:consolidate-fernet-provider | 02:37 |
| lbragstad | 2 - https://review.openstack.org/#/c/253273/ | 02:38 |
| lbragstad | 3 - https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:isadmin_protection | 02:38 |
| ayoung | lbragstad, do we need to focus on https://review.openstack.org/#/c/266052/1 frist then? | 02:38 |
| lbragstad | ayoung I think that was specific to the removal of the revocation events stuff | 02:38 |
| ayoung | lbragstad, I think there are tests that have been +2ed but that can;'t go in until that one edes | 02:39 |
| ayoung | does | 02:39 |
| lbragstad | ayoung jorge_munoz has been digging into those a lot in the last few days - he knows more about trusts than I do at this point | 02:39 |
| ayoung | https://review.openstack.org/#/c/253273/ is all he has up | 02:40 |
| lbragstad | the removal of the domain id and project id from revocation events sparked the trust discussion - which led to all the refacots | 02:40 |
| lbragstad | refactors* | 02:40 |
| lbragstad | ayoung I think he has a couple patches locally? | 02:40 |
| ayoung | lbragstad, those don't do us any good. | 02:40 |
| lbragstad | I know he was working on one today for the redelegation conversation we had friday | 02:41 |
| lbragstad | ayoung he found another issue we redelegation, specifically with trust chaining? | 02:41 |
| lbragstad | s/we/with/ | 02:41 |
| ayoung | lbragstad, OK...I'm going to put this aside for now. lbragstad you can keep on with this patch by putting a delay in. | 02:42 |
| ayoung | Once we fix the other isseus, you should be able to pull the delay | 02:42 |
| lbragstad | ayoung I'll work with jorge_munoz tomorrow to get everything he has locally pushed up | 02:42 |
| lbragstad | ayoung can we reconvene sometime tomorrow? | 02:42 |
| ayoung | lbragstad, sounds good | 02:43 |
| lbragstad | ayoung thanks for all your help | 02:43 |
| ayoung | lbragstad, I have to make Tripleo use Keystone HTTPD....highest priority for us | 02:43 |
| ayoung | and I think we all agree that Eventlet needs to die, that is another anchor we can cut | 02:43 |
| lbragstad | gotcha | 02:44 |
| *** markvoelker has joined #openstack-keystone | 02:52 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove LDAP Resource and LDAP Assignment backends https://review.openstack.org/231872 | 02:55 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove LDAP Role Backend https://review.openstack.org/269385 | 02:55 |
| *** markvoelker_ has joined #openstack-keystone | 02:56 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove LDAP Role Backend https://review.openstack.org/269385 | 02:57 |
| *** e0ne has quit IRC | 02:59 | |
| *** e0ne has joined #openstack-keystone | 03:00 | |
| *** markvoelker has quit IRC | 03:00 | |
| *** markvoelker_ has quit IRC | 03:01 | |
| *** e0ne has quit IRC | 03:01 | |
| stevemar | lbragstad: dolphm heads up, i bumped shadow users to mitaka-3 | 03:04 |
| stevemar | https://blueprints.launchpad.net/keystone/+spec/shadow-users | 03:04 |
| *** markvoelker has joined #openstack-keystone | 03:06 | |
| *** avarner has quit IRC | 03:07 | |
| ayoung | lbragstad, can you please +2A the damn Implied roles patch so I can beat the rebase race with LDAP ? | 03:11 |
| ayoung | https://review.openstack.org/#/c/264260/ | 03:11 |
| ayoung | or at least +2 it and I'll get henrynash to +A | 03:11 |
| *** dims has quit IRC | 03:20 | |
| stevemar | lhcheng: ping, if you have a few minutes: https://review.openstack.org/#/c/257376/ you reviewed some of the previous patches from this bp, this should be the last one | 03:26 |
| *** links has joined #openstack-keystone | 03:27 | |
| lhcheng | stevemar: sure will take a look | 03:30 |
| *** jasonsb has joined #openstack-keystone | 03:31 | |
| *** ccard_ has quit IRC | 03:31 | |
| *** ccard_ has joined #openstack-keystone | 03:32 | |
| *** woodster_ has quit IRC | 03:36 | |
| lbragstad | ayoung responded in line | 03:45 |
| ayoung | lbragstad, umm...c;mon | 03:47 |
| ayoung | its a nit...and that is where it is in every other SQL class | 03:47 |
| ayoung | lbragstad, let's just put the damn thing to rest... | 03:47 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Implied roles driver and manager https://review.openstack.org/264260 | 03:48 |
| ayoung | or we could see what Lin has for us | 03:48 |
| lhcheng | I fixed the comment from lbragstad, and also the typo from my last comment. | 03:48 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for strict url safe option on new projects and domains https://review.openstack.org/257376 | 03:49 |
| ayoung | lhcheng, thanks. diffed and +2ed already. If you feel OK +2ing now... | 03:49 |
| ayoung | lhcheng, coulda swore I made that change | 03:50 |
| ayoung | proir? | 03:50 |
| lhcheng | ayoung: there were two instances from the two classes | 03:50 |
| lhcheng | ayoung: I did the comment were first on the first instance | 03:51 |
| ayoung | lhcheng, +2 other than that? | 03:51 |
| lhcheng | ayoung: +A -ing mine and other folks comments are addressed in the latest patch | 03:53 |
| ayoung | lhcheng, TYVM | 03:53 |
| ayoung | lhcheng, thanks for inspiring me to refactor the tests on https://review.openstack.org/#/c/242614/53/keystone/tests/unit/test_v3_assignment.py | 03:56 |
| ayoung | I think they are much more readable now | 03:56 |
| ayoung | did I post those for review? | 03:56 |
| ayoung | yes | 03:56 |
| lhcheng | ayoung: don't think it was me, I haven't reviewed that patch :) | 03:57 |
| ayoung | lhcheng, it was Dave CHen...sorry...but please take a look when you can. It is the follow on to the Driver one, and might be easier with the driver code fresh in mind | 03:57 |
| lhcheng | ayoung: I have to step out for a bit, starred the patch, will take a look first thing in the morning | 03:58 |
| ayoung | lhcheng, thanks. | 03:58 |
| openstackgerrit | Merged openstack/oslo.policy: Updated from global requirements https://review.openstack.org/269338 | 03:59 |
| ayoung | lhcheng, we have all of henrynash 's that are based on it, so I'd like to get the process moving. THanks for your help thus far | 03:59 |
| lhcheng | ayoung: any other patch that needs immediate attention? | 03:59 |
| ayoung | put the time in to the API one. | 04:00 |
| ayoung | lhcheng, there is a remove LDAP one that I'll be rebasing now that you've helped me get mine in | 04:00 |
| lhcheng | ayoung: gotcha, will focus on the API one | 04:00 |
| ayoung | notmorgan was working on it, and it removes the LDAP assignemtn driver (yay) | 04:01 |
| ayoung | lhcheng, after that, for this path it is DOmain specific roles, which I expect to be a topic of discussion at the midcycle | 04:01 |
| notmorgan | ayoung: warning there are two and one maaaaay be grumpy at the gate, i gave up and made food instead | 04:01 |
| ayoung | that is henrynash 's work, and I think its on target, but needs people's full attention. THose are based on the role inference rules from this patch, so its a direct chain | 04:01 |
| lhcheng | ayoung: are you aware of any issue using v3 and LDAP assignment? | 04:02 |
| notmorgan | lhcheng: ldap assignment is dead | 04:02 |
| notmorgan | lhcheng: seriously | 04:02 |
| ayoung | lhcheng, yeah so v3 and LDAP assignm,ent would never work anyway | 04:02 |
| ayoung | no domains | 04:02 |
| lhcheng | someone from wiki have that issue | 04:02 |
| lhcheng | they're still running an older release | 04:02 |
| notmorgan | they already had plans to move away | 04:02 |
| notmorgan | it was wiki and cern as the only two running ldap assignment | 04:03 |
| notmorgan | they started making plans back when i sent the original email ~1yr ago | 04:03 |
| notmorgan | so i am not worried about wiki | 04:03 |
| notmorgan | and if they are broken, it really isn't a lot we can do to save them because LDAP assignment was pretty broken / unfixable back in juno, and has bitrotted at best since :( | 04:04 |
| lhcheng | notmorgan: sounds like they are sticking to it until we remove it.. | 04:04 |
| lhcheng | so they are upgrading right now to a newer version.. | 04:04 |
| notmorgan | lhcheng: well. in Mitaka ldap assigment is gone | 04:04 |
| lhcheng | Liberty I think | 04:04 |
| notmorgan | if my patch lands | 04:04 |
| notmorgan | liberty it's there but they should ditch it. | 04:04 |
| notmorgan | you can't really do V3 with LDAP assignment | 04:04 |
| lhcheng | I guess they should hold their move to V3 until they move out of LDAP assignment | 04:04 |
| lhcheng | okay | 04:04 |
| notmorgan | yes | 04:04 |
| ayoung | lhcheng, they knew this, but then the one dev that had this all in his head left | 04:05 |
| notmorgan | ayoung: LDAP assignment is pinning for the fjords | 04:05 |
| ayoung | notmorgan, its not pining its passed on | 04:05 |
| ayoung | bereft of life | 04:05 |
| ayoung | it rests in peace | 04:05 |
| notmorgan | ayoung: it's passed on, is no more, has ceaded to be, e's expired and gone to meet 'is maker | 04:05 |
| ayoung | joined the bleeding choir invisibule | 04:06 |
| notmorgan | ayoung: bereft of life, rests in peiease... kicked the bucket, shuffed off the mortal coil | 04:06 |
| ayoung | well...not yet. | 04:06 |
| notmorgan | haha | 04:06 |
| notmorgan | soon | 04:06 |
| ayoung | but its been very ill | 04:06 |
| notmorgan | this is an EX Assignment driver | 04:06 |
| * notmorgan sees himself out | 04:06 | |
| lhcheng | notmorgan: cool, will let them know about V3 with LDAP assignment not possible. And maybe convince them to try to go away from LDAP assignment as early as now. | 04:06 |
| notmorgan | lhcheng: ++ | 04:06 |
| notmorgan | i know i talked to ~3 different people there on this topic as ptl | 04:07 |
| notmorgan | soooo | 04:07 |
| * notmorgan shrugs. | 04:07 | |
| lhcheng | notmorgan: sometimes code just have to be removed to get people moving :P | 04:07 |
| notmorgan | lhcheng: say that for https://review.openstack.org/#/c/269385/ | 04:08 |
| notmorgan | lhcheng: https://review.openstack.org/#/c/231872/17 this is the removal patch fwiw | 04:09 |
| lhcheng | what is it still waiting for? | 04:09 |
| ayoung | notmorgan, its not dead yet. Its thinking of going for a walk.. | 04:09 |
| notmorgan | ayoung: hah | 04:09 |
| notmorgan | ayoung: god no. | 04:09 |
| lhcheng | lol | 04:09 |
| notmorgan | ayoung: i need whiskey if that is the case | 04:09 |
| ayoung | it feels happy! | 04:09 |
| notmorgan | and sadly, i am bereft of whiskey | 04:09 |
| ayoung | notmorgan, not I | 04:10 |
| lhcheng | notmorgan: ah waiting for the other patch, I have to get used to reading the dep chain in the new gerrit ui. | 04:10 |
| notmorgan | ok i feel good, i got to use bereft in a sentece today | 04:10 |
| notmorgan | lhcheng: yeah | 04:10 |
| notmorgan | ayoung: i have plenty of wine | 04:10 |
| ayoung | Balvenies | 04:10 |
| notmorgan | but i ran out of whiskey | 04:10 |
| notmorgan | just finished my bottle of Freya :( | 04:10 |
| lhcheng | notmorgan: I'll add to my review list | 04:10 |
| notmorgan | the balvennie i had was gone a few weeks ago | 04:10 |
| notmorgan | ayoung: and i haven't made it to a liquor store [gah oregon liquor laws suck... whyyyyyy does it have to be a state-run store] | 04:11 |
| notmorgan | also the really good stuff is hard to find. | 04:11 |
| ayoung | notmorgan, works well in NJH | 04:11 |
| ayoung | NH | 04:11 |
| notmorgan | i like the california model | 04:12 |
| notmorgan | stores can sell alcohol and wine and such | 04:12 |
| notmorgan | so go to a supermarket and you can get things like brandy or such for cooking | 04:12 |
| jamielennox | notmorgan: at some point can you have a look at https://review.openstack.org/268664 | 04:12 |
| notmorgan | jamielennox: maaaaybe | 04:12 |
| notmorgan | wait wut, really? | 04:12 |
| jamielennox | notmorgan: afaik you're the only person who understands oslo.cache so i just want to know if that's sane | 04:13 |
| notmorgan | oh oh oslo.cache | 04:13 |
| notmorgan | dude i read that as oslo_config | 04:13 |
| notmorgan | derrrrrp | 04:13 |
| notmorgan | hah | 04:13 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Add filter to control listing projects acting as domains https://review.openstack.org/269422 | 04:13 |
| notmorgan | your commit subject says oslo_config | 04:13 |
| notmorgan | >.> | 04:13 |
| jamielennox | huh, so it does, i mistyped that a lot | 04:13 |
| notmorgan | sadly caching is freaking hard for people to understand | 04:14 |
| notmorgan | and dogpile doesn't make a lot of steps to make that easier | 04:14 |
| henrynash | htruta, samueldmq: what do you think of this: https://review.openstack.org/269422 | 04:15 |
| jamielennox | notmorgan: right, and i learnt more reading the code than from the docs | 04:15 |
| notmorgan | jamielennox: ok i'll look at that, it's going to take a bit of time | 04:15 |
| notmorgan | cause ksm caching always makes my head hurt to begin with | 04:15 |
| jamielennox | notmorgan: well, docs are ok, but they assume you want to do MEMOIZE and i can't do that | 04:15 |
| notmorgan | righr | 04:15 |
| notmorgan | right | 04:15 |
| notmorgan | very few people understand the kvs interface | 04:15 |
| notmorgan | and they get the memoize cause we use it in keystone now. | 04:16 |
| notmorgan | but even that is pretty opaque to most folks :( | 04:16 |
| jamielennox | notmorgan: so what i know already is that i can't see any way to make it work with the paste interface | 04:16 |
| notmorgan | you mean as an in-line paste thing? | 04:16 |
| notmorgan | no. | 04:16 |
| notmorgan | that really isn't doable, dogpile wasn't written for that | 04:17 |
| jamielennox | swift requires it | 04:17 |
| notmorgan | you'd need to write something that is cache-control header aware and the like | 04:17 |
| jamielennox | no, not like that | 04:17 |
| notmorgan | well... i could probably do horrible metaprogramming and get it | 04:17 |
| notmorgan | oh the swift case? | 04:17 |
| jamielennox | as in using the paste interface to pass options to auth_token | 04:17 |
| notmorgan | yeah the swift case makes me sate | 04:17 |
| notmorgan | sad | 04:17 |
| notmorgan | didn't we tell them that is going away | 04:18 |
| notmorgan | cause it's terribad | 04:18 |
| * notmorgan grumbles | 04:18 | |
| jamielennox | we did, they complained, we added support back for them, they never changed | 04:18 |
| notmorgan | so it is doable to use $random_thing_passed_from_paste$ and lazy config the region | 04:18 |
| notmorgan | it's just expensive, complex, and painful code | 04:19 |
| notmorgan | and will be damn near impossible to maintain | 04:19 |
| notmorgan | but... for swift, the special child of openstack that it is (that refuses to play like the other kids), we can do it | 04:19 |
| notmorgan | and shove it in their tree | 04:19 |
| notmorgan | so they have to maintain it | 04:19 |
| notmorgan | imo | 04:20 |
| jamielennox | that's nice, but they wont maintain it and as we are still trying to force people off of v2 auth in 2 years we'll say wtf why is this still configured this way | 04:21 |
| jamielennox | and have to change it all anyway | 04:21 |
| notmorgan | i actually want to just tell them that if they don't maintain it, it wont continue to work | 04:22 |
| notmorgan | honestly | 04:22 |
| notmorgan | if they are going to be the special "WE DONT DO IT ANY OTHER WAY" people it is on them imo | 04:22 |
| notmorgan | now that being said, i can wire something up. i just hate being the only one who can do this bit. | 04:23 |
| notmorgan | or one of 2 or three at most | 04:23 |
| notmorgan | cause... $reasons | 04:24 |
| *** markvoelker has quit IRC | 04:39 | |
| *** markvoelker has joined #openstack-keystone | 04:40 | |
| jamielennox | notmorgan: it's kind of unintuitive when oslo.cache has a memcache_servers variable to have to configure backend = as well | 04:50 |
| notmorgan | jamielennox: yes.. and :( | 04:51 |
| jamielennox | it caught me out, i assume it will for many others as well | 04:52 |
| notmorgan | always | 04:52 |
| notmorgan | welcome to my world | 04:52 |
| notmorgan | :( | 04:52 |
| notmorgan | also.. my bottle of wine is far too empty to think too hard about caching | 04:52 |
| jamielennox | we can't set default backend to memcache if memcache_servers != None? | 04:52 |
| notmorgan | well.. that depends | 04:52 |
| notmorgan | what do you want the default behavior to be | 04:53 |
| notmorgan | localhost? no-op[cache nothing]? cache in memory? | 04:53 |
| notmorgan | do something else? | 04:53 |
| jamielennox | no-op would be default | 04:53 |
| jamielennox | has to be | 04:53 |
| notmorgan | then sure we can no-op it | 04:53 |
| notmorgan | if you look @ keystone we pretty much no-op it in that case | 04:53 |
| jamielennox | and it's noop onw | 04:53 |
| notmorgan | paste sucks. | 04:54 |
| jamielennox | yep | 04:54 |
| notmorgan | what swift really needs is a caching proxy | 04:55 |
| notmorgan | paste does not fill that role | 04:55 |
| jamielennox | hmm, good for somethings, nice idea | 04:55 |
| jamielennox | had to rewrite the echo service to test this all, paste is a pain from scratch | 04:56 |
| stevemar | henrynash: ayoung: left you guys some comments here: https://review.openstack.org/#/c/264260/26 nothing major | 04:56 |
| *** lhcheng has quit IRC | 04:58 | |
| *** jasonsb has quit IRC | 05:04 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove LDAP Resource and LDAP Assignment backends https://review.openstack.org/231872 | 05:06 |
| jamielennox | ayoung: still here? | 05:08 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove LDAP Role Backend https://review.openstack.org/269385 | 05:08 |
| stevemar | henrynash: poke, i rebased the LDAP removal stuff, if you're so inclined | 05:09 |
| stevemar | (and fixed the test error) | 05:09 |
| ayoung | jamielennox, sort of | 05:10 |
| jamielennox | ayoung: was just going to write some test scripts for adding implied roles etc, thought you might have one or two handy | 05:10 |
| jamielennox | ayoung: no matter if not | 05:10 |
| ayoung | jamielennox, not yet, no | 05:11 |
| ayoung | was doing everything in server thus far | 05:11 |
| jamielennox | ayoung: ok, i'll write some up and share them somewhere | 05:11 |
| ayoung | I jamielennox sounds good. | 05:11 |
| ayoung | jamielennox, You going to use curl against the API? | 05:12 |
| jamielennox | ayoung: at this point i'm probably faster at doing it against the python apis | 05:12 |
| jamielennox | ayoung: not going to add it to keystoneclient yet, just use session etc | 05:12 |
| ayoung | jamielennox, from client? We don't have those yet | 05:12 |
| ayoung | ah, OK | 05:12 |
| ayoung | got it | 05:12 |
| notmorgan | stevemar: sorry on the test error | 05:14 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Enhance manager list_role_assignments to support group listing https://review.openstack.org/265650 | 05:15 |
| notmorgan | stevemar: but food > code | 05:15 |
| stevemar | notmorgan: it wasn't you, don't worry | 05:15 |
| notmorgan | yeah but food > code | 05:15 |
| stevemar | its the damn relationship between assignment ldap and role functionality | 05:15 |
| notmorgan | so i wasn't watching it | 05:15 |
| notmorgan | stevemar: solution rebase and squash we had that all 100% working combined | 05:15 |
| stevemar | notmorgan: it was this code: https://github.com/openstack/keystone/blob/master/keystone/assignment/backends/ldap.py#L304 | 05:16 |
| notmorgan | lol | 05:16 |
| stevemar | notmorgan: i just skipped the test in the initial patch | 05:16 |
| notmorgan | like i said, i had it ALL working :P | 05:16 |
| stevemar | and deleted them in the subsequent ones | 05:16 |
| stevemar | notmorgan: yeah, taht's why i said MY FAULT! | 05:16 |
| stevemar | jeez no need to rub it in! | 05:16 |
| stevemar | :) | 05:16 |
| notmorgan | ^_^ | 05:17 |
| notmorgan | i'll let you know what hotel and such im in for midcycle tomorrow | 05:17 |
| notmorgan | do you have an address for where this is all happening? | 05:17 |
| stevemar | notmorgan: it's in the email i sent out and the wiki | 05:19 |
| stevemar | IBM Austin - Building 904, Executive Briefing Centre 11501 Burnet Rd, Austin, TX 78758, USA | 05:19 |
| notmorgan | cool | 05:19 |
| notmorgan | thnx | 05:19 |
| notmorgan | yeah but ... E_WINE | 05:19 |
| notmorgan | :P | 05:20 |
| notmorgan | and i need to book travel so i was going to look @ hotels befor esleep | 05:20 |
| stevemar | notmorgan: makes sense | 05:20 |
| *** _cjones_ has joined #openstack-keystone | 05:29 | |
| *** _cjones_ has quit IRC | 05:29 | |
| *** _cjones_ has joined #openstack-keystone | 05:30 | |
| *** EinstCra_ has joined #openstack-keystone | 05:30 | |
| *** EinstCr__ has joined #openstack-keystone | 05:32 | |
| *** EinstCrazy has quit IRC | 05:32 | |
| *** _cjones_ has quit IRC | 05:33 | |
| *** EinstCra_ has quit IRC | 05:34 | |
| henrynash | stevemar: looks good…will give it a quick look through, but initial galnce looks ncie | 05:35 |
| *** jasonsb has joined #openstack-keystone | 05:38 | |
| *** henrynash has quit IRC | 05:39 | |
| *** jaosorior has joined #openstack-keystone | 05:45 | |
| *** EinstCr__ is now known as EinstCrazy | 05:47 | |
| *** vivekd has joined #openstack-keystone | 05:49 | |
| *** jamielennox is now known as jamielennox|away | 05:59 | |
| *** gildub has quit IRC | 06:13 | |
| *** vivekd has quit IRC | 06:15 | |
| *** vgridnev has joined #openstack-keystone | 06:22 | |
| *** tyagiprince has joined #openstack-keystone | 06:23 | |
| openstackgerrit | xu-haiwei proposed openstack/keystoneauth: HTTPError should contain 'retry_after' parameter https://review.openstack.org/255128 | 06:25 |
| *** EinstCrazy has quit IRC | 06:37 | |
| *** EinstCrazy has joined #openstack-keystone | 06:37 | |
| *** vivekd has joined #openstack-keystone | 06:39 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: deprecate write support for identity LDAP https://review.openstack.org/256257 | 06:42 |
| *** vgridnev has quit IRC | 06:45 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Deprecate `hash_algorithm` config option https://review.openstack.org/256260 | 06:51 |
| * stevemar continues to baby sit the gate | 06:51 | |
| *** GB21 has joined #openstack-keystone | 06:55 | |
| *** spzala has quit IRC | 06:59 | |
| *** spzala has joined #openstack-keystone | 07:00 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Removes KVS catalog backend https://review.openstack.org/158442 | 07:03 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Create V9 version of catalog driver interface https://review.openstack.org/269455 | 07:03 |
| *** spzala has quit IRC | 07:04 | |
| openstackgerrit | Merged openstack/keystone: document the bootstrapping process https://review.openstack.org/259730 | 07:05 |
| stevemar | davechen: you kicked https://review.openstack.org/#/c/158442/14 out of the gate :( | 07:06 |
| davechen | looks like i updated dstanek's patches. :( | 07:06 |
| davechen | i am sorry. :( | 07:06 |
| davechen | stevemar: something i did should rebase on that one, but i forgot i have rebased to the latest code. | 07:07 |
| stevemar | davechen: it happens, you did a rebase before merging your changes right? | 07:07 |
| davechen | stevemar: yep. | 07:07 |
| davechen | stevemar: i forgot did that before push the review. sigh. | 07:07 |
| stevemar | davechen: yeah, you can normally do that, but it was just about to merge :( | 07:07 |
| stevemar | it happens | 07:07 |
| davechen | stevemar: boss, could you pls +A on that. | 07:08 |
| stevemar | davechen: done already | 07:08 |
| davechen | stevemar: okay, thanks! | 07:08 |
| davechen | hope dstanek haven't found this. :P | 07:08 |
| *** GB21 has quit IRC | 07:09 | |
| davechen | I think henrynash is not here. | 07:10 |
| davechen | so, I guess the co-author lost the power to +2 on a patch, but anyway there should be other experts kown what this patch want to address - https://review.openstack.org/#/c/269455/ | 07:11 |
| *** markvoelker_ has joined #openstack-keystone | 07:11 | |
| davechen | marekd: i will rebase your patch on this one as well. - https://review.openstack.org/#/c/269455/ | 07:11 |
| stevemar | davechen: i would say henry can still +2 it | 07:12 |
| davechen | henrynash, stevemar: i just followed the henry's example to add a new driver interface for catalog. | 07:13 |
| davechen | stevemar: cool. | 07:13 |
| stevemar | davechen: yeah, that's fine, he knows it best :P | 07:13 |
| davechen | stevemar: i will add you as a reviewer if you don't mind, just in the queue. | 07:14 |
| stevemar | davechen: sure | 07:14 |
| stevemar | man, the gate is SOOOO long | 07:14 |
| stevemar | its so backed up | 07:14 |
| *** markvoelker has quit IRC | 07:15 | |
| davechen | too rush! | 07:15 |
| davechen | stevemar: looks like infra team is still working on that? | 07:15 |
| stevemar | davechen: nothing they can do | 07:15 |
| davechen | not stable so far. | 07:16 |
| *** vgridnev has joined #openstack-keystone | 07:16 | |
| stevemar | davechen: oh *that* issue | 07:16 |
| davechen | i saw they might have restart the server. | 07:16 |
| davechen | but looks like it still doesn't work well. | 07:16 |
| stevemar | davechen: btw, this landed: https://review.openstack.org/#/c/268826/ | 07:16 |
| stevemar | so those eventlet timeouts won't happen any more | 07:16 |
| stevemar | well, they will still happen, but it won't stop us | 07:16 |
| stevemar | davechen: otherwise, it's just everyone trying to get patches in for mitaka-2 :( | 07:17 |
| davechen | stevemar: that's great, i think the issue will gone if the CI is gone. | 07:17 |
| davechen | stevemar: let's do the recheck. :) | 07:18 |
| stevemar | davechen: which patch? | 07:18 |
| stevemar | davechen: they should all be gating, the approved ones anway | 07:18 |
| davechen | stevemar: i meant if your patch is not landing, we will keep the recheck. | 07:18 |
| stevemar | yep | 07:19 |
| stevemar | davechen: as punishment for removing the kvs backend patch, you must review this one: https://review.openstack.org/#/c/265650/ :) | 07:19 |
| stevemar | removing the kvs backend patch from the gate... * | 07:20 |
| davechen | stevemar: :) sure | 07:20 |
| davechen | henry works too hard in those days. | 07:21 |
| stevemar | davechen: btw, there's the meeting tomorrow, i have most of the agenda up already: https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting is there anything you wanted to talk about | 07:21 |
| stevemar | davechen: i feel bad since it's hard for you to attend, so you can ping me now for any questions | 07:22 |
| davechen | stevemar: you are so nice. | 07:22 |
| davechen | stevemar: it's pain for me if i want to talk someting in the meeting. | 07:22 |
| davechen | stevemar: unless take one leave and got my boss's approval if i want to join in the meeting from my region. | 07:23 |
| stevemar | davechen: don't worry about that for now. if it's easy we can have a short one on one time now, i don't mind a few questions | 07:24 |
| stevemar | if you have questions about the topics or any thing you want to bring up, i can mention it tomorrow | 07:24 |
| davechen | stevemar: no question so far, but i think i will have question in the future, so if you don't mind pls expect my ping to you. | 07:24 |
| stevemar | davechen: i don't mind at all | 07:25 |
| davechen | what's liaison we have? | 07:25 |
| *** GB21 has joined #openstack-keystone | 07:26 | |
| davechen | oslo? nova? or .. | 07:26 |
| *** sshen_ has quit IRC | 07:27 | |
| *** sshen has joined #openstack-keystone | 07:27 | |
| davechen | stevemar: i will take a look at the liaison, and see if there is anything i can help. | 07:30 |
| stevemar | davechen: so there are a lot of "liaison" positions | 07:30 |
| stevemar | davechen: they're all here: https://wiki.openstack.org/wiki/CrossProjectLiaisons | 07:30 |
| davechen | stevemar: yep, too many | 07:30 |
| stevemar | i think the most active ones are oslo, release, qa, stable, docs, vmt | 07:31 |
| davechen | and the api | 07:31 |
| stevemar | davechen: bknudson does oslo, i do release, stable is a mix of us | 07:31 |
| davechen | stevemar: got you, thanks for the info. | 07:32 |
| stevemar | davechen: the API group is not as busy, you can ask dolphm about it, i don't know how much work it is | 07:32 |
| davechen | stevemar: okay. | 07:32 |
| stevemar | davechen: and now there's a new one "cross-proejct", someone to review these specs: http://specs.openstack.org/openstack/openstack-specs/ i think... | 07:33 |
| davechen | this is the spec for all the projects i think. | 07:33 |
| stevemar | yep | 07:36 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Deprecate `hash_algorithm` config option https://review.openstack.org/256260 | 07:36 |
| *** GB21 has quit IRC | 07:37 | |
| *** EinstCrazy has quit IRC | 07:39 | |
| *** EinstCrazy has joined #openstack-keystone | 07:39 | |
| *** GB21 has joined #openstack-keystone | 07:40 | |
| *** tyagiprince has quit IRC | 07:41 | |
| *** tyagiprince has joined #openstack-keystone | 07:42 | |
| *** vgridnev has quit IRC | 07:49 | |
| *** ajayaa has joined #openstack-keystone | 07:51 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 07:52 |
| *** roxanaghe has joined #openstack-keystone | 07:55 | |
| *** GB21 has quit IRC | 07:56 | |
| *** markvoelker_ has quit IRC | 07:57 | |
| *** EinstCrazy has quit IRC | 07:57 | |
| *** roxanaghe has quit IRC | 08:00 | |
| *** spzala has joined #openstack-keystone | 08:00 | |
| *** rcernin has joined #openstack-keystone | 08:01 | |
| *** EinstCrazy has joined #openstack-keystone | 08:02 | |
| *** EinstCrazy has quit IRC | 08:02 | |
| *** EinstCrazy has joined #openstack-keystone | 08:02 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Create V9 version of catalog driver interface https://review.openstack.org/269455 | 08:02 |
| *** spzala has quit IRC | 08:05 | |
| *** dancn has quit IRC | 08:06 | |
| *** Nirupama has joined #openstack-keystone | 08:14 | |
| *** tyagiprince has quit IRC | 08:14 | |
| *** vgridnev has joined #openstack-keystone | 08:19 | |
| *** wanghua has joined #openstack-keystone | 08:19 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Replace tenant for project in resource files https://review.openstack.org/248295 | 08:20 |
| *** chlong has quit IRC | 08:27 | |
| *** pnavarro has joined #openstack-keystone | 08:27 | |
| *** Nirupama has quit IRC | 08:28 | |
| *** vivekd has quit IRC | 08:32 | |
| *** markvoelker has joined #openstack-keystone | 08:38 | |
| *** daemontool has joined #openstack-keystone | 08:41 | |
| *** vivekd has joined #openstack-keystone | 08:42 | |
| *** markvoelker has quit IRC | 08:43 | |
| *** markvoelker has joined #openstack-keystone | 08:46 | |
| *** tyagiprince has joined #openstack-keystone | 08:49 | |
| *** fhubik has joined #openstack-keystone | 08:54 | |
| *** fhubik is now known as fhubik_brb | 08:54 | |
| *** Nirupama has joined #openstack-keystone | 08:56 | |
| *** vivekd has quit IRC | 08:59 | |
| *** fhubik_brb is now known as fhubik | 09:01 | |
| *** dancn has joined #openstack-keystone | 09:01 | |
| *** spzala has joined #openstack-keystone | 09:02 | |
| *** markvoelker has quit IRC | 09:02 | |
| *** daemontool has quit IRC | 09:02 | |
| *** e0ne has joined #openstack-keystone | 09:03 | |
| *** daemontool has joined #openstack-keystone | 09:03 | |
| *** vivekd has joined #openstack-keystone | 09:04 | |
| *** fhubik is now known as fhubik_brb | 09:04 | |
| *** spzala has quit IRC | 09:08 | |
| *** markvoelker has joined #openstack-keystone | 09:19 | |
| *** jistr has joined #openstack-keystone | 09:20 | |
| *** fhubik_brb is now known as fhubik | 09:23 | |
| *** markvoelker has quit IRC | 09:24 | |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: Unit test for checking cross-version migrations compatibility https://review.openstack.org/241603 | 09:24 |
| *** mhickey has joined #openstack-keystone | 09:25 | |
| *** e0ne has quit IRC | 09:34 | |
| *** aix has joined #openstack-keystone | 09:39 | |
| *** daemontool has quit IRC | 09:39 | |
| *** daemontool has joined #openstack-keystone | 09:39 | |
| *** markvoelker has joined #openstack-keystone | 09:40 | |
| *** fhubik is now known as fhubik_brb | 09:40 | |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: Unit test for checking cross-version migrations compatibility https://review.openstack.org/241603 | 09:40 |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: Online schema migration documentation https://review.openstack.org/265252 | 09:40 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Replace tenant for project in resource files https://review.openstack.org/248295 | 09:41 |
| *** boris-42 has quit IRC | 09:43 | |
| *** aix_ has joined #openstack-keystone | 09:44 | |
| *** markvoelker has quit IRC | 09:45 | |
| *** fhubik_brb is now known as fhubik | 09:46 | |
| *** aix_ has quit IRC | 09:46 | |
| *** fhubik is now known as fhubik_brb | 09:47 | |
| *** e0ne has joined #openstack-keystone | 09:48 | |
| *** davechen has left #openstack-keystone | 09:55 | |
| *** e0ne has quit IRC | 09:57 | |
| *** spzala has joined #openstack-keystone | 10:04 | |
| *** vgridnev has quit IRC | 10:06 | |
| *** vgridnev has joined #openstack-keystone | 10:07 | |
| *** daemontool has quit IRC | 10:08 | |
| *** daemontool has joined #openstack-keystone | 10:08 | |
| *** mdavidson has joined #openstack-keystone | 10:08 | |
| *** spzala has quit IRC | 10:09 | |
| *** fhubik_brb is now known as fhubik | 10:10 | |
| *** daemontool has quit IRC | 10:11 | |
| *** daemontool has joined #openstack-keystone | 10:11 | |
| *** vgridnev has quit IRC | 10:13 | |
| *** markvoelker has joined #openstack-keystone | 10:16 | |
| *** daemontool has quit IRC | 10:17 | |
| *** daemontool has joined #openstack-keystone | 10:17 | |
| *** daemontool has quit IRC | 10:19 | |
| *** daemontool has joined #openstack-keystone | 10:19 | |
| *** markvoelker has quit IRC | 10:21 | |
| *** aix has quit IRC | 10:23 | |
| *** aix has joined #openstack-keystone | 10:26 | |
| *** vgridnev has joined #openstack-keystone | 10:26 | |
| *** daemontool has quit IRC | 10:38 | |
| *** daemontool has joined #openstack-keystone | 10:42 | |
| *** roxanaghe has joined #openstack-keystone | 10:44 | |
| *** markvoelker has joined #openstack-keystone | 10:44 | |
| *** aix has quit IRC | 10:46 | |
| *** dims has joined #openstack-keystone | 10:48 | |
| *** vgridnev has quit IRC | 10:49 | |
| *** roxanaghe has quit IRC | 10:49 | |
| *** tyagiprince has quit IRC | 10:49 | |
| *** markvoelker has quit IRC | 10:49 | |
| *** aix has joined #openstack-keystone | 10:56 | |
| openstackgerrit | Merged openstack/keystone: Merge pep8 and bandit test environments https://review.openstack.org/265148 | 10:59 |
| *** tyagiprince has joined #openstack-keystone | 11:03 | |
| *** spzala has joined #openstack-keystone | 11:05 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 11:10 |
| *** spzala has quit IRC | 11:10 | |
| *** markvoelker has joined #openstack-keystone | 11:14 | |
| *** vgridnev has joined #openstack-keystone | 11:15 | |
| tyagiprince | Hey people.. I want to know which module does openstack uses for command line interaction with the services? | 11:18 |
| tyagiprince | Is it using cliff? | 11:18 |
| *** markvoelker has quit IRC | 11:20 | |
| *** jaosorior has quit IRC | 11:22 | |
| *** jaosorior has joined #openstack-keystone | 11:22 | |
| *** fhubik has quit IRC | 11:27 | |
| *** markvoelker has joined #openstack-keystone | 11:32 | |
| *** ericksonsantos has joined #openstack-keystone | 11:36 | |
| *** markvoelker has quit IRC | 11:36 | |
| amakarov | lbragstad, hi! What questions do you have? | 11:38 |
| *** e0ne has joined #openstack-keystone | 11:38 | |
| *** pauloewerton has joined #openstack-keystone | 12:00 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/269321 | 12:03 |
| *** daemontool has quit IRC | 12:05 | |
| *** daemontool has joined #openstack-keystone | 12:06 | |
| samueldmq | tyagiprince: I don't know, but perhaps #openstack-sdks is a better place to ask | 12:06 |
| *** aix has quit IRC | 12:06 | |
| *** spzala has joined #openstack-keystone | 12:06 | |
| *** EinstCrazy has quit IRC | 12:06 | |
| openstackgerrit | Merged openstack/keystone: Make sure the assignment creation use the right arguments https://review.openstack.org/268738 | 12:09 |
| *** vivekd_ has joined #openstack-keystone | 12:11 | |
| *** spzala has quit IRC | 12:11 | |
| *** markvoelker has joined #openstack-keystone | 12:11 | |
| *** vivekd has quit IRC | 12:11 | |
| *** vivekd_ is now known as vivekd | 12:11 | |
| *** vivekd_ has joined #openstack-keystone | 12:12 | |
| *** vivekd has quit IRC | 12:16 | |
| *** vivekd_ is now known as vivekd | 12:16 | |
| *** markvoelker has quit IRC | 12:16 | |
| *** tyagiprince has quit IRC | 12:17 | |
| *** aix has joined #openstack-keystone | 12:18 | |
| *** tyagiprince has joined #openstack-keystone | 12:19 | |
| *** raildo-afk is now known as raildo | 12:27 | |
| samueldmq | ayoung: hi, about implied roles spec | 12:29 |
| *** davechen has joined #openstack-keystone | 12:30 | |
| *** roxanaghe has joined #openstack-keystone | 12:32 | |
| *** Nirupama has quit IRC | 12:34 | |
| *** tyagiprince has quit IRC | 12:37 | |
| *** roxanaghe has quit IRC | 12:37 | |
| rodrigods | dstanek ping, regarding functional tests... let me know when you are available to talk about it :) | 12:40 |
| dstanek | rodrigods: i'm here now | 12:42 |
| rodrigods | dstanek so, has been a while that I don't follow the functional tests efforts | 12:43 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Fixes implied roles example https://review.openstack.org/269604 | 12:43 |
| dstanek | rodrigods: there has not been much movement on it | 12:43 |
| samueldmq | ayoung: this ^, just a nit on the spec | 12:43 |
| rodrigods | dstanek what are the current blockers? | 12:44 |
| dstanek | rodrigods: i wanted to have all the work rebase and fixed up before the mid-cycle - just trying to knock out some reviews first | 12:44 |
| *** shoutm_ has joined #openstack-keystone | 12:44 | |
| rodrigods | dstanek can you point me to them? | 12:44 |
| *** shoutm has quit IRC | 12:45 | |
| *** links has quit IRC | 12:46 | |
| samueldmq | ayoung: revisited the spec, now at | 12:46 |
| samueldmq | Implied roles driver and manager | 12:46 |
| dstanek | rodrigods: the most recently published ones are https://review.openstack.org/#/c/151310/8 . i still have to push up some local changes | 12:46 |
| dstanek | rodrigods: if you are interested in this i can do that today | 12:47 |
| rodrigods | dstanek I am :) I will take a look in the reviews to be aware about the big picture to help you out with it | 12:48 |
| *** markvoelker has joined #openstack-keystone | 12:49 | |
| *** markvoelker has quit IRC | 12:54 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Create V9 version of catalog driver interface https://review.openstack.org/269455 | 12:57 |
| *** spzala has joined #openstack-keystone | 13:07 | |
| *** markvoelker has joined #openstack-keystone | 13:10 | |
| *** daemontool_ has joined #openstack-keystone | 13:10 | |
| *** daemontool has quit IRC | 13:11 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 13:11 |
| *** gordc has joined #openstack-keystone | 13:11 | |
| *** spzala has quit IRC | 13:12 | |
| *** vgridnev has quit IRC | 13:12 | |
| *** alejandrito has joined #openstack-keystone | 13:14 | |
| *** vgridnev has joined #openstack-keystone | 13:14 | |
| *** markvoelker has quit IRC | 13:15 | |
| samueldmq | ayoung: what about limiting the height of a implied roles hierarchy ? | 13:17 |
| samueldmq | ayoung: I saw in the spec there were some concerns about perfomance | 13:17 |
| samueldmq | ayoung: and this is basically what we did for hierarchical projects | 13:18 |
| *** ekarlso has quit IRC | 13:18 | |
| *** ekarlso has joined #openstack-keystone | 13:18 | |
| *** ninag has joined #openstack-keystone | 13:21 | |
| raildo | dstanek: regarding about your comment on v2.0 deprecation patch, are you saying that it will be returned this message on that case, right? https://github.com/openstack/oslo.log/blob/master/oslo_log/versionutils.py#L135 | 13:23 |
| dstanek | raildo: yes | 13:23 |
| raildo | dstanek: right, so I'll remove that part of the message, thanks :) | 13:24 |
| dstanek | raildo: np | 13:24 |
| *** dslev has joined #openstack-keystone | 13:30 | |
| *** edmondsw has joined #openstack-keystone | 13:30 | |
| mnaser | I've tried searching around but wasn't successful in finding answers, what happens to projects (or tenants in v2 terms) that are created under a domain using the v3 api when accesing them via the v2 api? | 13:32 |
| mnaser | are they simply just not visible at all via the v2 api? | 13:32 |
| samueldmq | ayoung: stevemar: sorry for the -1 on https://review.openstack.org/#/c/264260/ | 13:34 |
| samueldmq | ayoung: stevemar: let me know if you agree with some of the comments and I can submit a followon patch if needed | 13:35 |
| mnaser | my bad, i just ran into this - https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-v2-comparison.rst | 13:35 |
| openstackgerrit | Merged openstack/keystone: Test enabled emulation with special user_tree_dn https://review.openstack.org/265462 | 13:35 |
| openstackgerrit | Merged openstack/keystone: Escape DN in enabled query https://review.openstack.org/262334 | 13:36 |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Zanata https://review.openstack.org/268567 | 13:37 |
| *** vivekd_ has joined #openstack-keystone | 13:42 | |
| *** vivekd has quit IRC | 13:45 | |
| *** vivekd_ is now known as vivekd | 13:45 | |
| *** EinstCrazy has joined #openstack-keystone | 13:46 | |
| *** spzala has joined #openstack-keystone | 13:46 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/269321 | 13:48 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/268453 | 13:48 |
| *** jaosorior has quit IRC | 13:48 | |
| *** jaosorior has joined #openstack-keystone | 13:48 | |
| *** roxanaghe has joined #openstack-keystone | 13:49 | |
| *** daemontool__ has joined #openstack-keystone | 13:49 | |
| *** daemontool_ has quit IRC | 13:50 | |
| *** markvoelker has joined #openstack-keystone | 13:52 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/269643 | 13:52 |
| *** roxanaghe has quit IRC | 13:53 | |
| *** daemontool__ is now known as daemontool | 13:54 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 13:55 |
| *** Ephur has joined #openstack-keystone | 13:56 | |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: Deprecating API v2.0 https://review.openstack.org/251530 | 13:56 |
| *** markvoelker has quit IRC | 13:57 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 13:57 |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: Deprecating API v2.0 https://review.openstack.org/251530 | 13:57 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 13:59 |
| *** markvoelker has joined #openstack-keystone | 14:00 | |
| dstanek | stevemar: doesn't look like there is a lot planned for the midcycle. is there other stuff on your radar? | 14:00 |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: Deprecating API v2.0 https://review.openstack.org/251530 | 14:00 |
| *** markvoelker_ has joined #openstack-keystone | 14:01 | |
| *** EinstCrazy has quit IRC | 14:02 | |
| *** EinstCrazy has joined #openstack-keystone | 14:02 | |
| *** markvoelker has quit IRC | 14:05 | |
| *** daemontool has quit IRC | 14:06 | |
| *** daemontool has joined #openstack-keystone | 14:07 | |
| *** doug-fish has joined #openstack-keystone | 14:10 | |
| *** EinstCrazy has quit IRC | 14:10 | |
| *** EinstCrazy has joined #openstack-keystone | 14:10 | |
| *** vivekd has quit IRC | 14:16 | |
| *** vivekd has joined #openstack-keystone | 14:16 | |
| *** EinstCrazy has quit IRC | 14:17 | |
| *** EinstCrazy has joined #openstack-keystone | 14:18 | |
| *** EinstCrazy has quit IRC | 14:18 | |
| *** EinstCrazy has joined #openstack-keystone | 14:18 | |
| *** petertr7_away is now known as petertr7 | 14:19 | |
| *** jsavak has joined #openstack-keystone | 14:23 | |
| notmorgan | mnaser: yeah you found it :) | 14:24 |
| notmorgan | mnaser: but yes, projects/tenants not in the default domain are not really visible in v2 [by design] | 14:24 |
| mnaser | notmorgan: evaluating switching from single user + single project assigned to it to a domain based system | 14:24 |
| mnaser | and mostly worried about things breaking for customers that depend on it, it doesn't look feasible at the moment | 14:25 |
| notmorgan | mnaser: so, the best bet is to offer a domain in conjunction with the default domain project. new users could be v3 only [v2/v3 exist side-by-side, it's not mtually exclusive] | 14:26 |
| notmorgan | mnaser: projects can't be moved to new domains (for security reasons), so it lets customers migrate on their own. | 14:27 |
| notmorgan | mnaser: you could also [for v3 only users] not offer quota in the default domain. | 14:27 |
| mnaser | yeah, we have a bit more flexibility because we're moving to horizon now | 14:27 |
| notmorgan | mnaser: if you offered a domain setup, i'd totally jump on board using it fwiw :) | 14:27 |
| mnaser | my only other concern in this big switch up is SSO | 14:27 |
| notmorgan | mnaser: right. | 14:28 |
| mnaser | SSO works nice for web auth like openid connect, but right now we're creating a "group" per user and then the mapping rules map said user to that group | 14:28 |
| mnaser | which has access to the tenant/project | 14:28 |
| mnaser | this works for our existing setup.. but, i'm not sure how API access would work in this case | 14:29 |
| mnaser | this is where domains would be nice because customers could just come in and create their own users.. | 14:29 |
| notmorgan | right | 14:29 |
| *** daemontool_ has joined #openstack-keystone | 14:30 | |
| mnaser | so this is where we're a bit stuck in terms of decision making or how to do this in the best way possible | 14:30 |
| *** daemontool has quit IRC | 14:31 | |
| notmorgan | this is a bit harder for me to provide a recommendation on =/ i'd have to spend some time talking over your deployment to offer much help. | 14:31 |
| mnaser | yeah.. it's a tad bit hard | 14:32 |
| mnaser | and finally one last thing is how keystone falls over with mappings, it just prints out a json error to the screen, be nice if there was a bit more control (or even an html page template) | 14:32 |
| mnaser | but that's all just noise.. still quite a bit far from getting properly up and running | 14:33 |
| *** davechen has left #openstack-keystone | 14:34 | |
| *** daemontool_ has quit IRC | 14:34 | |
| *** daemontool_ has joined #openstack-keystone | 14:34 | |
| ayoung | samueldmq, -1 won't stop the merge. Submit what you want as a follow on patch, please | 14:34 |
| *** gordc has quit IRC | 14:36 | |
| *** daemontool_ has quit IRC | 14:37 | |
| *** daemontool_ has joined #openstack-keystone | 14:37 | |
| *** shoutm_ has quit IRC | 14:38 | |
| *** vivekd_ has joined #openstack-keystone | 14:39 | |
| *** fhubik has joined #openstack-keystone | 14:41 | |
| *** vivekd has quit IRC | 14:42 | |
| *** vivekd_ is now known as vivekd | 14:42 | |
| *** gordc has joined #openstack-keystone | 14:48 | |
| *** notmorgan has quit IRC | 14:51 | |
| *** richm has joined #openstack-keystone | 14:53 | |
| *** notmorgan has joined #openstack-keystone | 15:00 | |
| *** notmorgan has joined #openstack-keystone | 15:00 | |
| *** ChanServ sets mode: +v notmorgan | 15:00 | |
| *** notmorgan has quit IRC | 15:01 | |
| *** notmorgan has joined #openstack-keystone | 15:01 | |
| *** notmorgan has quit IRC | 15:01 | |
| *** notmorgan has joined #openstack-keystone | 15:01 | |
| *** ChanServ sets mode: +v notmorgan | 15:01 | |
| openstackgerrit | Grzegorz Grasza (xek) proposed openstack/keystone: Add binary UUID field https://review.openstack.org/269693 | 15:03 |
| *** pumaranikar has joined #openstack-keystone | 15:03 | |
| *** dslev has quit IRC | 15:11 | |
| *** daemontool_ has quit IRC | 15:12 | |
| *** vivekd has quit IRC | 15:13 | |
| *** tonytan4ever has joined #openstack-keystone | 15:14 | |
| *** rderose has joined #openstack-keystone | 15:19 | |
| stevemar | dstanek: i haven't given it much thought since i posted the schedule | 15:23 |
| stevemar | dstanek: we normally have to go through specs, but it's so late that we have no specs to go through | 15:24 |
| *** daemontool_ has joined #openstack-keystone | 15:24 | |
| bknudson | we can get started on specs for N | 15:26 |
| *** timcline has joined #openstack-keystone | 15:27 | |
| *** EinstCrazy has quit IRC | 15:27 | |
| *** EinstCrazy has joined #openstack-keystone | 15:28 | |
| *** woodster_ has joined #openstack-keystone | 15:29 | |
| bknudson | at the security summit we followed unconference where we proposed topics then voted on topics then the topics with the most votes got slots | 15:29 |
| *** EinstCrazy has quit IRC | 15:30 | |
| dstanek | bknudson: i like that idea in principle, but it doesn't give me time to prepare | 15:30 |
| lbragstad | rderose o/ | 15:30 |
| lbragstad | rderose stevemar had a few questions yesterday around shadow users. | 15:31 |
| bknudson | it would be nice to have the topics voted on in advance so people can prepare if they want | 15:31 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:31 | |
| lbragstad | dstanek you've had some good ideas around refactoring keystone to not have so many db calls - maybe we can work on that? | 15:32 |
| dstanek | lbragstad: i'd love to pair with someone on that | 15:32 |
| dstanek | bknudson: ++ | 15:32 |
| lbragstad | dstanek I'd like to do that | 15:32 |
| bknudson | I've got my list of things that are my priority items... maybe everyone else has a list too and we can see how they match up. | 15:33 |
| *** henrynash has joined #openstack-keystone | 15:33 | |
| stevemar | bknudson: specs for N, oh you are ambitious | 15:33 |
| *** ChanServ sets mode: +v henrynash | 15:33 | |
| stevemar | bknudson: i thought we all agreed that there will be no specs for N :P | 15:33 |
| notmorgan | stevemar: i just -2'd a move to use Binary uuid field in SQL, this could cause a lot of strange behaviors / breakages. | 15:33 |
| notmorgan | stevemar: just an fyi https://review.openstack.org/#/c/269693/ | 15:33 |
| bknudson | let's take a release off. | 15:33 |
| bknudson | see if anyone complains | 15:34 |
| stevemar | bknudson: hehe | 15:34 |
| stevemar | bknudson: maybe we should just fix our bugs | 15:34 |
| stevemar | and you know, include functionality in our clients | 15:34 |
| stevemar | since we have a ton of crap in server that no one can use | 15:34 |
| rderose | lbragstad okay | 15:34 |
| dstanek | stevemar: we are getting much better on the bug front | 15:35 |
| lbragstad | stevemar not sure if you still have questions on the shadow user stuff, or if i addressed them yesterday | 15:35 |
| stevemar | rderose lbragstad the only question i had was if there is more work to be done in the blueprint after that initial patch? | 15:35 |
| stevemar | rderose: lbragstad i assume there has to be some re-wiring of the create calls to actually call and save stuff in the newly made database tables? | 15:35 |
| rderose | stevemar yes, the initial patch is to just break up the user table into identity and password tables. more work still needs to be done on federated identity | 15:36 |
| rderose | stevemar the current patch will write to the new identity and password tables, but again, still have work to do on the new federated table | 15:37 |
| stevemar | lbragstad: rderose: alright, that's what i thought, based on that I've bumped this to mitaka-3 | 15:39 |
| lbragstad | jorge_munoz not sure if you saw the scroll back yet - but ayoung and I had a long discussion last night around the restructuring of all the patches we have up | 15:39 |
| dstanek | lbragstad: i was actually going to ask dolphm about shadow users; the progress and if help was needed | 15:39 |
| lbragstad | jorge_munoz the conversation started here - http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2016-01-18.log.html#t2016-01-18T21:45:04 | 15:40 |
| lbragstad | dstanek i've just been trying to stay up on the reviews for it - i think the code is looking pretty good. | 15:40 |
| lbragstad | dstanek i think rderose probably has a better idea of what is left | 15:40 |
| lbragstad | work-wise | 15:40 |
| dstanek | lbragstad: where's the starting point? | 15:40 |
| lbragstad | dstanek let me grab you a link | 15:40 |
| openstackgerrit | Merged openstack/keystone-specs: Fixes implied roles example https://review.openstack.org/269604 | 15:41 |
| *** narengan12 has joined #openstack-keystone | 15:41 | |
| lbragstad | dstanek here is the first/only patch - https://review.openstack.org/#/c/262045/ | 15:41 |
| dstanek | lbragstad: cool, added to the top of the pile :-) | 15:41 |
| lbragstad | #success! | 15:42 |
| openstackstatus | lbragstad: Added success to Success page | 15:42 |
| lbragstad | \o/ | 15:42 |
| *** jbell8 has joined #openstack-keystone | 15:42 | |
| bknudson | #success browns got rid of johnny football | 15:43 |
| openstackstatus | bknudson: Added success to Success page | 15:43 |
| rderose | lbragstad dstanek Mostly what's left is to modify the underlying code to utitlize the new shadow table for mapping LDAP and federated users to local identities. | 15:45 |
| lbragstad | rderose so, that would be the rewiring that stevemar was talking about | 15:45 |
| bknudson | is there another mapping backend? | 15:45 |
| stevemar | my reaction when i see that bknudson is pulled into the same meeting as me: https://s-media-cache-ak0.pinimg.com/originals/c8/43/ca/c843ca5082f66324508f63c7ef045b26.gif | 15:46 |
| ayoung | lbragstad, let me know if jorge_munoz shows up. | 15:46 |
| bknudson | the inmates are running the asylum | 15:46 |
| lbragstad | jorge_munoz more context - http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2016-01-19.log.html#t2016-01-19T01:46:57 | 15:46 |
| jorge_munoz | o/ | 15:46 |
| ayoung | jorge_munoz, lbragstad had updated the "Make fernet default" review | 15:47 |
| ayoung | but its failing due to, it looks like | 15:47 |
| ayoung | subsecond revoke issues | 15:47 |
| ayoung | same kind of things we saw | 15:47 |
| ayoung | jorge_munoz, and that gets at the fact that we are revoking on way too many different events | 15:48 |
| ayoung | but before we can revoke on fewer events, we need uuid to use the same rules as Fernet in validation | 15:48 |
| rderose | lbragstad I don't know if rewiring is correct, but essentially we now need to "shadow" federated and ldap users in the new federated table | 15:48 |
| ayoung | jorge_munoz, so there is an ordering that we can infer | 15:49 |
| jorge_munoz | ah yes, but for revocation events, we were only working on enabled object. We still need revocation events for tokens. | 15:49 |
| jorge_munoz | enabled check* | 15:49 |
| notmorgan | stevemar: i am thining https://bugs.launchpad.net/keystone/+bug/1524124 needs to be a wont fix | 15:49 |
| openstack | Launchpad bug 1524124 in OpenStack Identity (keystone) "unscalable database schema design" [Undecided,New] - Assigned to Grzegorz Grasza (xek) | 15:50 |
| ayoung | jorge_munoz, lbragstad and that starts with the commit to redo UUID tokens to store only the same subset of data that a Fernet token contains, and to reconstitute the whole access_info structure upon validation | 15:50 |
| notmorgan | stevemar: the problem statement / proposed fix would be highly backwards incompat | 15:50 |
| ayoung | jorge_munoz, while it would be strange, we have to assume somone is using revocation events with UUID | 15:50 |
| notmorgan | ayoung: i thought we decided to just stop doing subsecond on tokens. | 15:51 |
| ayoung | even PKI could work this way; ignore the body of the token, and reconstitute the data upon validation | 15:51 |
| ayoung | notmorgan, and then unit tests fail | 15:51 |
| notmorgan | ayoung: because fernet doesn't and it is no longer neeed | 15:51 |
| ayoung | notmorgan, we 've alwasy done subsecond due to unit tests | 15:51 |
| notmorgan | no we didn't we added it when we added pki | 15:51 |
| *** markvoelker_ has quit IRC | 15:51 | |
| notmorgan | because we needed unique "data" | 15:51 |
| ayoung | issue, revoke, issue, validate fails | 15:51 |
| ayoung | notmorgan, revoke events recreates that need. We revoke based on time | 15:52 |
| notmorgan | i am sure i had unwound this at somepoint | 15:52 |
| notmorgan | in the unit tests | 15:52 |
| notmorgan | it might have been a heavy dose of mock | 15:52 |
| notmorgan | to adjust time | 15:52 |
| lbragstad | jorge_munoz how many patches do you have locally for the trust issues? | 15:52 |
| notmorgan | when issuing a test rev event | 15:52 |
| ayoung | notmorgan, well it is possible you broke something, but this is kindof a law of nature | 15:52 |
| bknudson | we've got a mock to control the clock. tests shouldn't depend on the external environment | 15:52 |
| stevemar | bknudson: yay we're inmates! | 15:52 |
| lbragstad | jorge_munoz s/trust/redelegation/ | 15:52 |
| notmorgan | bknudson: +++++++ | 15:53 |
| lbragstad | bknudson dolphm had a patch for using freezegun to do that | 15:53 |
| ayoung | I balk as using mock to control the clock. | 15:53 |
| ayoung | at | 15:53 |
| bknudson | freezegun looks like a neat library | 15:53 |
| jorge_munoz | lbragstad: I was just finishing up fixing redelegation, I still need to work fixing the policy file. Also, we need to handle trust when someone tries to using redelegation with impersonation. | 15:53 |
| notmorgan | ayoung: relying on the external environment when you want tests to run fast and have clock based things is a bit insane | 15:53 |
| stevemar | dstanek: oh btw, in here: https://review.openstack.org/#/c/231872/ we don't remove default_assignment_driver cause we never deprecated that function | 15:54 |
| lbragstad | jorge_munoz and that stuff is required to consolidate the trust tests, right? | 15:54 |
| notmorgan | ayoung: also we are locked into not using subsecond for fernet, so lets fix the issue that make us need subsecond | 15:54 |
| notmorgan | since fernet is the way forward | 15:54 |
| ayoung | notmorgan, this will break things in the real world | 15:54 |
| stevemar | dstanek: let me try running the tests with sql as the default for assignment | 15:54 |
| ayoung | if you revoke, issue and validate too fast, things will break. AUtomated operations tend to do things like that | 15:54 |
| jorge_munoz | lbragstad: Yes, I don’t think trust is being tested correctly. | 15:55 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: More validation of unscoped token attributes https://review.openstack.org/269725 | 15:55 |
| stevemar | dstanek: notmorgan can tell you that https://review.openstack.org/#/c/231872/ has been a real toughie to unwind | 15:55 |
| dstanek | stevemar: should it be deprecated then? if we don't use if we've effectively removed it anyway | 15:55 |
| notmorgan | ayoung: we already have to solve this. | 15:55 |
| notmorgan | ayoung: with non-subsecond tokens. | 15:55 |
| lbragstad | ayoung notmorgan i thought we asked operators if they cared about this in tokyo? | 15:56 |
| bknudson | lbragstad: what do you think about merging https://review.openstack.org/#/c/269725/ into the parent? | 15:56 |
| *** Ephur has quit IRC | 15:56 | |
| notmorgan | lbragstad: care about waht? subsecond? | 15:56 |
| ayoung | notmorgan well...regardless, the ordering is still what I suggest: | 15:56 |
| lbragstad | bknudson yes - i would be totally fine with that | 15:56 |
| ayoung | make UUID use the Fernet mechanism, remove revocation events for disabled/deleted objects, make fernet the default | 15:56 |
| ayoung | the time thing...I really don't care about, if we have abetter way to solve | 15:57 |
| bknudson | lbragstad: alright, I'll just squash it. | 15:57 |
| lbragstad | notmorgan yes - i thought we asked operators if they are ok with not being able to do those operations within a second (i.e. just try again if you get a 401). | 15:57 |
| lbragstad | bknudson thanks! | 15:57 |
| ayoung | bknudson, that is 100% backwards IIUC | 15:57 |
| notmorgan | lbragstad: fairly certain everyone was ok with it... but. | 15:57 |
| ayoung | bknudson, is that checking the data, or just the format? | 15:58 |
| notmorgan | ayoung: uuid use the fernet mechanism? | 15:58 |
| ayoung | notmorgan, yeah; | 15:58 |
| notmorgan | ayoung: as in.. change what is stored in the DB? | 15:58 |
| ayoung | notmorgan, instead of copying the token to the database | 15:58 |
| *** phalmos has joined #openstack-keystone | 15:58 | |
| notmorgan | and reconstruct like fernet? | 15:58 |
| notmorgan | sure. | 15:58 |
| ayoung | only store the subset required by fernet | 15:58 |
| bknudson | ayoung: what is 100% backwards? | 15:58 |
| ayoung | yes 100% | 15:58 |
| ayoung | bknudson, nevermind | 15:58 |
| *** bradjones has joined #openstack-keystone | 15:58 | |
| *** bradjones has quit IRC | 15:58 | |
| *** bradjones has joined #openstack-keystone | 15:58 | |
| bknudson | ok | 15:58 |
| notmorgan | that is in line with what i wanted to do anywa | 15:58 |
| ayoung | I realize you are just talking format...I thouht you meant data in that patch | 15:59 |
| notmorgan | doesn't change that we need to solve the subsecond thing. | 15:59 |
| lbragstad | notmorgan make it so that uuid tokens rebuild context | 15:59 |
| notmorgan | lbragstad: yeah thats 100% in line with what i'd like to see. | 15:59 |
| lbragstad | notmorgan note that we will see a performance hit | 15:59 |
| ayoung | notmorgan, yeah...and it might mean that the ordering is less essential. It might give lbragstad a path forward with the fernet-as-default now | 15:59 |
| notmorgan | i'm fine with it. | 15:59 |
| notmorgan | it means we can focus on improving that performance across the board | 16:00 |
| ayoung | lbragstad, we'll not likely see a performance hit. All that data should be held in cache | 16:00 |
| lbragstad | notmorgan it won't be as bad once https://review.openstack.org/#/c/215715/ merges | 16:00 |
| lbragstad | ayoung ^ that needs to merge | 16:00 |
| ayoung | a recently issued token will be based on data fetched from the DB | 16:00 |
| notmorgan | i also want to point out it doesn't matter much. | 16:00 |
| *** diazjf has joined #openstack-keystone | 16:01 | |
| lbragstad | ayoung I was waiting on something from dstanek though | 16:02 |
| ayoung | lbragstad, he's right about the assignment dependency | 16:02 |
| notmorgan | ayoung: are pki tokens slated for removal or just deprecated with no plans for removal? | 16:02 |
| notmorgan | cc stevemar ^ | 16:02 |
| ayoung | notmorgan, if we don't have a fixed time to kill them, we should | 16:02 |
| *** jbell8 has quit IRC | 16:02 | |
| dstanek | lbragstad: maybe we can add it in there and just take it out later? | 16:03 |
| lbragstad | dstanek add what in where? | 16:03 |
| bknudson | for PKI tokens there's an alternative... not sure we even have to deprecate. | 16:03 |
| dstanek | lbragstad: the dependency | 16:03 |
| *** jbell8 has joined #openstack-keystone | 16:03 | |
| *** boris-42 has joined #openstack-keystone | 16:03 | |
| lbragstad | dstanek ah - right | 16:03 |
| lbragstad | dstanek that's up to you | 16:03 |
| ayoung | bknudson, you talking about the fix revoke by audit id? | 16:03 |
| *** jsavak has quit IRC | 16:03 | |
| bknudson | I mean, not deprecate, just remove PKI tokens and have the server use whatever. | 16:04 |
| notmorgan | bknudson: we did deprecate already | 16:04 |
| lbragstad | dstanek i just want to make sure your concerns are addressed. | 16:04 |
| bknudson | could use UUID or fernet | 16:04 |
| notmorgan | bknudson: i agree... but that breaks the deprecation contract | 16:04 |
| notmorgan | sadly | 16:04 |
| bknudson | PKI tokens aren't an API | 16:05 |
| notmorgan | dstanek: responded to your comments onthe LDAP thing-a-ma-bob | 16:05 |
| bknudson | there's no migration required to switch from PKI to UUID | 16:05 |
| notmorgan | bknudson: it isn't. but just like we have to be careful about not breaking deployments on upgrade | 16:05 |
| *** aix has quit IRC | 16:05 | |
| notmorgan | bknudson: this is similar. there are deployments that use PKI tokens for keystone offload | 16:05 |
| bknudson | deprecating is nice, so might as well follow it. | 16:05 |
| notmorgan | and would be unhappy if it just disappeared | 16:06 |
| notmorgan | at least this way we are communicating "fernet, no really fernet...use fernet" | 16:06 |
| notmorgan | ;) | 16:06 |
| *** ninag has quit IRC | 16:06 | |
| *** rderose has quit IRC | 16:07 | |
| notmorgan | ayoung: so https://review.openstack.org/#/c/265023/ - sadly we have broken people and made it so their deployments no longer work. | 16:08 |
| dstanek | notmorgan: can the resource backend be different from assignment? | 16:08 |
| notmorgan | dstanek: yes it can. in practice it never is | 16:08 |
| bknudson | if the resource backend can't be different from assignment then why split them up. | 16:09 |
| dstanek | notmorgan: that's why i thought the default could be changed. instead of hard coding the default in code it would be in the config | 16:09 |
| notmorgan | ayoung: i am not happy about the "regression" but breaking people in production for a not-really-security issue [username is mutable, don't use it] and the only place you see duplicate names is in the token body, you can't auth with a username that isn't in the defualt domain via v2 | 16:10 |
| bknudson | dstanek: didn't we deprecate the hard-coded default? | 16:10 |
| notmorgan | dstanek: i guess we could do the same treatment. | 16:10 |
| notmorgan | dstanek: i can roll that as a followup | 16:10 |
| ayoung | notmorgan, no | 16:11 |
| notmorgan | i really don't want to add more into that patch due to the hell that is there. | 16:11 |
| dstanek | bknudson: not for resource. that patch does that for identity | 16:11 |
| notmorgan | dstanek: in the unrolling | 16:11 |
| ayoung | notmorgan, how did it ever work? | 16:11 |
| bknudson | :( | 16:11 |
| dstanek | notmorgan: i'm happy with that | 16:11 |
| ayoung | V2 should do nothing domain wise | 16:11 |
| notmorgan | ayoung: you can validate a v3 token with a project or user not in the default domain via v2 | 16:11 |
| notmorgan | that is all that the hole was. we didn't check | 16:11 |
| notmorgan | so people wrote code to rely on that behavior | 16:11 |
| notmorgan | and use it. | 16:12 |
| ayoung | notmorgan, but the result is garbage | 16:12 |
| ayoung | does it have the domain data in there? | 16:12 |
| notmorgan | no | 16:12 |
| notmorgan | but the scope is still by id | 16:12 |
| notmorgan | so security outside of keystone is fine. | 16:12 |
| notmorgan | and user_id is globally unique | 16:12 |
| notmorgan | has to be | 16:12 |
| bknudson | are any other projects using domain ID in the policy.json? | 16:13 |
| dstanek | bknudson: did you want a final word before i +A? https://review.openstack.org/#/c/231872/18 | 16:13 |
| notmorgan | bknudson: heat? | 16:13 |
| notmorgan | but they use v3 | 16:13 |
| ayoung | bknudson, nope | 16:13 |
| ayoung | bknudson, none user username either | 16:13 |
| notmorgan | and keystone uses ids for any authz | 16:13 |
| bknudson | dstanek: I can take a look at https://review.openstack.org/#/c/231872/ in a couple minutes. | 16:13 |
| notmorgan | ayoung: so i 100% agree this is a sucky situation, i don't think we can break behavior =/ | 16:13 |
| lbragstad | ajayaa do you have any outstanding issues with https://review.openstack.org/#/c/215715/ ? | 16:13 |
| notmorgan | ayoung: so the revert makes sense and we keep driving at v2 needs to die | 16:14 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add checks for token data creep using jsonschema https://review.openstack.org/254258 | 16:14 |
| notmorgan | ayoung: so we can walk away from the v2<->v3 intermix issues | 16:14 |
| notmorgan | [at least v2 auth is slated for death, crud interfaces... who knows] | 16:14 |
| ayoung | notmorgan, tell you what...get dolphm here to discuss. You convince him, I'll go along | 16:14 |
| ayoung | notmorgan, and if he abstains...I'll think long and hard about it | 16:14 |
| notmorgan | ayoung: i've just pointed steve to make a call here. | 16:14 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add checks for token data creep using jsonschema https://review.openstack.org/254258 | 16:14 |
| notmorgan | ayoung: because we have people on opposite sides of the fense | 16:15 |
| notmorgan | this is more of a PTL call at this point | 16:15 |
| *** fhubik is now known as fhubik_brb | 16:15 | |
| *** fhubik_brb is now known as fhubik | 16:15 | |
| notmorgan | either push the reverts to stable or revert the revert in master and tell people that we are sorry they are broken | 16:15 |
| ayoung | notmorgan, OK...let's talk this through. | 16:15 |
| ayoung | A user gets a V3 token, somehow | 16:15 |
| ayoung | passes it to a servciie that only knows V2 | 16:15 |
| notmorgan | for a user not in default domain. | 16:15 |
| ayoung | and the token is valid...so far so good | 16:16 |
| ayoung | the only things that are wonky is that now she is going to see names without domain scoping on them...but all resources should be accessed by ID. | 16:16 |
| *** jsavak has joined #openstack-keystone | 16:16 | |
| notmorgan | yep | 16:16 |
| ayoung | THe question is "are all those assumptions valid across the board" | 16:16 |
| *** slberger has joined #openstack-keystone | 16:16 | |
| notmorgan | they are. | 16:16 |
| notmorgan | with one exception | 16:17 |
| notmorgan | swift supports username ACLs. | 16:17 |
| ayoung | fuck swift | 16:17 |
| ayoung | that is bad | 16:17 |
| notmorgan | but that was an issue and the answer was "don't use v2 only middleware with username acls" | 16:17 |
| notmorgan | so that is addressed | 16:17 |
| notmorgan | and that was swift's official answer when you look at the bug | 16:17 |
| ayoung | notmorgan, is there a deprecation date on the V2 validation API? | 16:18 |
| *** avarner has joined #openstack-keystone | 16:18 | |
| notmorgan | ayoung: there is a patch up to deprecate v2 auth this cycle | 16:18 |
| notmorgan | 4 cycle run to removal | 16:18 |
| ayoung | notmorgan, OK...I can back this | 16:18 |
| notmorgan | ayoung: yeah i did circles with a number of folks on the security implications | 16:18 |
| notmorgan | and it really was "eh, it's weird but nothing stands out" | 16:18 |
| ayoung | notmorgan, I'm not core on stable | 16:19 |
| notmorgan | ayoung: i know, there aren't many of us | 16:19 |
| ayoung | notmorgan, who else can +2 it? | 16:19 |
| notmorgan | sadly steve and I are the most common stavle reviewers iirc | 16:19 |
| notmorgan | ayoung: dolphm or the stable-core [global] | 16:19 |
| notmorgan | i think there is one other stable core, bknudson maybe | 16:19 |
| dstanek | not it! | 16:20 |
| notmorgan | lol | 16:20 |
| notmorgan | ayoung: unrelated to all this. going to push a change to make it so keystone can use read slaves later this week | 16:21 |
| ayoung | lin | 16:21 |
| notmorgan | and fix some use of deprecated things in oslo_db | 16:21 |
| ayoung | https://openstack.nimeyo.com/65580/openstack-keystone-stable-nominating-cheng-keystone-stable | 16:21 |
| notmorgan | while i wait for your rev. event unwinds before changing the sql stuff | 16:21 |
| dstanek | there aren't that many high priority bugs left on the server | 16:22 |
| notmorgan | bknudson: and you are working on the devstack uwsgi thing? [don't want to duplicate effort if you are] | 16:22 |
| *** petertr7 is now known as petertr7_away | 16:23 | |
| bknudson | notmorgan: here's the proposal for uwsgi deploy -- https://review.openstack.org/#/c/257571/ | 16:23 |
| notmorgan | cool | 16:23 |
| notmorgan | looking at it shorty | 16:23 |
| bknudson | it's got a -1 and so I'm going to do some refactoring. | 16:23 |
| *** jbell8 has quit IRC | 16:24 | |
| bknudson | (when I get to it... I need to spend more time doing reviews) | 16:24 |
| notmorgan | ah not a terrible set of comments | 16:24 |
| notmorgan | looks pretty straightforward. also nice! | 16:24 |
| *** fawadkhaliq has joined #openstack-keystone | 16:24 | |
| stevemar | bknudson: apparently dstanek wants you to have a last look at: https://review.openstack.org/#/c/231872/ :) | 16:24 |
| dstanek | stevemar: yeah, i already poked him here :-) | 16:25 |
| bknudson | also, it takes a lot of time to respond to pings on irc. | 16:25 |
| stevemar | bknudson: ping ping ping | 16:25 |
| stevemar | bknudson: maybe you like sametime pings instead ? | 16:26 |
| lbragstad | mmmm sametime | 16:26 |
| stevemar | dstanek: i approved it, if bknudson has issues with it, i'll pull it out of the queue | 16:26 |
| dstanek | stevemar: sounds good to me | 16:26 |
| stevemar | dstanek: at this rate, it's taking nearly 20hrs to get things in | 16:26 |
| dstanek | stevemar: what exactly is happening? | 16:27 |
| stevemar | dstanek: big last minute push by all projects to get things in | 16:27 |
| bknudson | and this change can't wait 21 hours! | 16:27 |
| stevemar | http://status.openstack.org/zuul/ | 16:27 |
| stevemar | bknudson: damn straight it can't (i know you're being sarcastic) | 16:27 |
| dstanek | stevemar: let's see if we can get enough stuff int he queue today to beak it all! | 16:28 |
| dstanek | i think today is when all of the quality happens | 16:28 |
| stevemar | dstanek: hahaha | 16:28 |
| bknudson | regarding https://review.openstack.org/#/c/231872/18/keystone/assignment/core.py -- I don't see why we can get rid of getting the assignment driver from the identity driver? | 16:31 |
| bknudson | we never deprecated that. | 16:32 |
| bknudson | and deployments might be relying on it | 16:32 |
| *** usr2 has joined #openstack-keystone | 16:33 | |
| notmorgan | bknudson: i am unsure if that is really the case. | 16:33 |
| bknudson | if we don't know then we should go the conservative route and deprecate it before removing it. | 16:34 |
| notmorgan | bknudson: i can add that back in as a followup, already have another followup to do. | 16:34 |
| bknudson | notmorgan: ok. | 16:34 |
| notmorgan | i'm just trying to avoid another round of review/check/check/review/check/fail/recheck/fail/recheck on that patch ;) | 16:34 |
| notmorgan | also easier to see that things are added back in in a smaller re-add patch. [make sure to comment this and i'll tack it back in] | 16:35 |
| notmorgan | ayoung: could use eyes on this https://bugs.launchpad.net/keystoneauth/+bug/1469847 (cc jamielennox|away ) | 16:35 |
| openstack | Launchpad bug 1469847 in keystoneauth "authenticating with kerberos (via openstack token issue) reports Error with "Success" followed by non-ascii chracters" [Undecided,New] | 16:35 |
| *** markvoelker has joined #openstack-keystone | 16:36 | |
| ayoung | notmorgan, oh god. not those... | 16:40 |
| notmorgan | ayoung: feel free to squash the bug as "we don't care..." but...... | 16:40 |
| notmorgan | figured you were the best person to ask about that | 16:41 |
| *** alejandrito has quit IRC | 16:41 | |
| ayoung | notmorgan, there are many ways GSSAPI can fail, and reporting the errors through to Keystone could be maddening | 16:41 |
| ayoung | I'm not sure | 16:41 |
| notmorgan | right | 16:42 |
| ayoung | I have a Kerberos person I can pass it on to, but he's heads down working a platform release atm.. | 16:42 |
| notmorgan | thats fine | 16:42 |
| notmorgan | just doing the triage for ksa and ksm | 16:42 |
| notmorgan | ayoung: oh neat https://review.openstack.org/#/c/251530/ v2auth deprecation is gating | 16:44 |
| bknudson | stevemar: I posted my comments on https://review.openstack.org/#/c/231872/18 . You can decide if it should be corrected before merged or not. | 16:44 |
| stevemar | ayoung: henrynash quite a few comments on https://review.openstack.org/#/c/264260/26 please don't forget to submit a follow on | 16:45 |
| notmorgan | bknudson: stevemar +A'd it, i'll roll a followup few patches for things today | 16:45 |
| *** henrynash has quit IRC | 16:46 | |
| stevemar | bknudson: btw, your comment here: https://review.openstack.org/#/c/231872/18/keystone/tests/unit/backend/role/test_ldap.py | 16:46 |
| stevemar | bknudson: we can't get rid of the file unless we get rid of the ldap role backend as well | 16:46 |
| stevemar | so it's removed in a follow up | 16:47 |
| notmorgan | bknudson: see followup patch ;) | 16:47 |
| bknudson | well then the comment is wrong. | 16:47 |
| bknudson | since it's not testing in an all-LDAP configuration | 16:47 |
| notmorgan | bknudson: it was split because the official in-code deprecation was missed when the original email was sent | 16:47 |
| bknudson | The docstring says it's testing in an all-LDAP configuration, which apparently it's not since there is no all-LDAP configuration | 16:48 |
| notmorgan | right | 16:48 |
| notmorgan | that is historical from the split henry did | 16:48 |
| notmorgan | afaict | 16:48 |
| notmorgan | that should have been updated back then. | 16:48 |
| notmorgan | we can either fix it or remove it as i've proposed | 16:49 |
| *** stack_ has joined #openstack-keystone | 16:49 | |
| stevemar | notmorgan: it's probably from here: https://github.com/openstack/keystone/tree/diablo-eol/keystone/backends/ldap/api | 16:51 |
| notmorgan | lol | 16:51 |
| notmorgan | yeah | 16:51 |
| notmorgan | kindof ancient | 16:51 |
| stevemar | then it got combined into all in one: https://github.com/openstack/keystone/blob/essex-eol/keystone/identity/backends/ldap/core.py :( | 16:51 |
| *** avarner has quit IRC | 16:52 | |
| stevemar | and now we've come full circle by splitting them back out | 16:52 |
| *** narengan12 has quit IRC | 16:52 | |
| *** avarner has joined #openstack-keystone | 16:52 | |
| *** gyee has joined #openstack-keystone | 16:53 | |
| *** ChanServ sets mode: +v gyee | 16:53 | |
| *** rderose has joined #openstack-keystone | 16:53 | |
| *** rcernin has quit IRC | 16:53 | |
| openstackgerrit | Fernando Diaz proposed openstack/keystone: Strengthen Mapping Validation in Federation Mappings https://review.openstack.org/250162 | 16:54 |
| notmorgan | stevemar: got to get those LOC metrics up :P | 16:55 |
| stevemar | for sure | 16:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Reuse project scoped token check for trusts https://review.openstack.org/253672 | 16:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add checks for domain scoped data creep https://review.openstack.org/253671 | 16:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add checks for project scoped data creep to tests https://review.openstack.org/253670 | 16:55 |
| lbragstad | bknudson rebased all the other patches on the first one you just updated ^ | 16:55 |
| *** Ephur has joined #openstack-keystone | 16:55 | |
| lbragstad | dolphm addressed your 'additionalProperties' comment and included it into all the patches ^ | 16:56 |
| bknudson | lbragstad: btw, I tried to set minItems for methods to 1 but somehow there are some tests that generated 0 methods. I thought that was weird. | 16:57 |
| bknudson | I didn't look into it much. looked like it had to do with external. | 16:57 |
| *** stack_ is now known as narengan12 | 16:58 | |
| *** david-lyle has quit IRC | 16:58 | |
| *** jsavak has quit IRC | 17:00 | |
| *** jsavak has joined #openstack-keystone | 17:00 | |
| *** e0ne has quit IRC | 17:01 | |
| *** diazjf has quit IRC | 17:03 | |
| *** david-lyle has joined #openstack-keystone | 17:06 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: deprecate write support for identity LDAP https://review.openstack.org/256257 | 17:08 |
| stevemar | notmorgan: ayoung dstanek ^ | 17:08 |
| *** rcernin has joined #openstack-keystone | 17:09 | |
| samueldmq | ayoung: okay, I will add a cyclic reference check and address a few nits in a follow-on patch | 17:13 |
| ayoung | samueldmq, thanks. Long chain of patches depends on that one | 17:13 |
| *** lhcheng has joined #openstack-keystone | 17:13 | |
| *** ChanServ sets mode: +v lhcheng | 17:13 | |
| samueldmq | ayoung: yes, I will get throught them today/tomorrow, reviewing them carefully takes time | 17:14 |
| samueldmq | through* | 17:14 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Split identity backend tests https://review.openstack.org/269148 | 17:14 |
| *** diazjf has joined #openstack-keystone | 17:16 | |
| openstackgerrit | Merged openstack/keystone: Add linters environment, keep pep8 as alias https://review.openstack.org/269248 | 17:18 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 17:19 |
| stevemar | dstanek: i improved https://etherpad.openstack.org/p/keystone-mitaka-midcycle a bit, with a list of possible things to do | 17:24 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: deprecate write support for identity LDAP https://review.openstack.org/256257 | 17:29 |
| *** petertr7_away is now known as petertr7 | 17:30 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Deprecate `hash_algorithm` config option https://review.openstack.org/256260 | 17:31 |
| stevemar | lhcheng: dstanek ayoung i fixed up https://review.openstack.org/#/c/256257/4 and https://review.openstack.org/#/c/256260/4 so the "deprecated_reason" matches | 17:31 |
| * stevemar needs food before keystone meeting! | 17:32 | |
| lhcheng | stevemar: thanks! | 17:32 |
| stevemar | marekd: rodrigods head up that i moved https://blueprints.launchpad.net/keystone/+spec/service-provider-filters to mitaka 3 | 17:35 |
| *** ninag has joined #openstack-keystone | 17:35 | |
| stevemar | thanks guys! | 17:41 |
| *** henrynash has joined #openstack-keystone | 17:41 | |
| *** ChanServ sets mode: +v henrynash | 17:41 | |
| openstackgerrit | Merged openstack/keystone: Add release note for revert of c4723550aa95be403ff591dd132c9024549eff10 https://review.openstack.org/265024 | 17:45 |
| openstackgerrit | Merged openstack/keystone: Fix indentation for oauth context https://review.openstack.org/267649 | 17:45 |
| openstackgerrit | Merged openstack/keystone: Enable `id`, `enabled` attributes filtering for list IdP API https://review.openstack.org/215041 | 17:45 |
| lbragstad | dstanek can i update https://review.openstack.org/#/c/215715/ with a FIXME comment saying that we will remove the dependency? | 17:47 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 17:47 |
| dstanek | lbragstad: yes, thx! | 17:48 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 17:48 |
| *** jistr has quit IRC | 17:48 | |
| *** pnavarro has quit IRC | 17:49 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add caching to role assignments https://review.openstack.org/215715 | 17:50 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 17:50 |
| lbragstad | dstanek done ^ | 17:50 |
| dstanek | lbragstad: +2ed. thx | 17:53 |
| mnaser | i know it's a bit of a deadline and devs might be busy, but I was wondering if anyone had ideas on the best way to hook into keystone's federated login process? when using websso, we'd ideally like to provision a domain for the user if it does not exist, however, i can't seem to run into a clean way of doing this | 17:53 |
| ayoung | mnaser, there is none | 17:54 |
| ayoung | mnaser, I was trying to get people to discuss that last summit | 17:54 |
| mnaser | alright, i'll look at other alternatives in this case | 17:54 |
| ayoung | mnaser, it is not a keystone only problem | 17:54 |
| lbragstad | dstanek thank you | 17:54 |
| dstanek | mnaser: you want a different domain for each user? | 17:54 |
| ayoung | as there are other resources to provision that are not Keysrtone specific | 17:54 |
| mnaser | my domain ID is the users oidc_sub, but i dont have that info until the user signs in the first time.. so its a a bit of an iffy weird thing | 17:54 |
| mnaser | dstanek: ideally yes, each user has a domain where they can create their own projects, users, etc. (public cloud setup) | 17:55 |
| ayoung | he wants HMT | 17:55 |
| notmorgan | not really that | 17:55 |
| notmorgan | just a customer has a domain with SSO login | 17:55 |
| notmorgan | that is not HMT | 17:55 |
| ayoung | notmorgan, coming from the same OIDC? | 17:56 |
| mnaser | yes, same oidc | 17:56 |
| notmorgan | mnaser: for the customer's users? | 17:56 |
| ayoung | still think we should do 1 to 1 IdP to domain for users | 17:56 |
| mnaser | the customers (domain) users would just be keystone users that can access it directly without sso/oidc | 17:57 |
| notmorgan | mnaser: thats what i thought | 17:57 |
| mnaser | really, in our case, only the "domain admin" logs in using oidc | 17:57 |
| *** _cjones_ has joined #openstack-keystone | 17:57 | |
| notmorgan | ok:) | 17:57 |
| notmorgan | yeah | 17:57 |
| notmorgan | ayoung: ^ | 17:57 |
| openstackgerrit | guang-yee proposed openstack/keystone: wsgi: fix base_url finding https://review.openstack.org/226464 | 17:58 |
| ayoung | mnaser, so the auto provisioning thing.... | 17:58 |
| notmorgan | you might need to provision the domain directly vs on login. | 17:58 |
| ayoung | assuming you can listned for a keystone notification, you could get something that tells you when a user logs in. | 17:58 |
| *** usr2 has quit IRC | 17:58 | |
| ayoung | I don't think we have a part that says :this is a new user never in before | 17:58 |
| mnaser | ayoung: the problem is the login fails in keystone with "failed to map user" | 17:59 |
| *** shaleh has joined #openstack-keystone | 17:59 | |
| notmorgan | right | 17:59 |
| mnaser | so the domain must exist before hand | 17:59 |
| stevemar | meeting time soon :) | 17:59 |
| mnaser | my oidc provider sub value isn't accessible beforehand | 17:59 |
| stevemar | courtesy ping for ajayaa, amakarov, ayoung, breton, browne, davechen, david8hu, dolphm, dstanek, ericksonsantos, geoffarnold, gyee, henrynash, hogepodge, htruta, jamielennox, joesavak, lbragstad, lhcheng, marekd, morganfainberg, nkinder, raildo, rodrigods, roxanaghe, samueldmq, shaleh, stevemar, tsymanczyk, topol, vivekd, wanghong, claudiub, rderose, samleon, xek, MaxPC, tjcocozz | 17:59 |
| notmorgan | mnaser: let me think on this for a moment. i might have a solution... might... | 18:00 |
| notmorgan | mnaser: but meeting first, so back in like an hour | 18:00 |
| mnaser | notmorgan: sure :) | 18:00 |
| samueldmq | henrynash: may we talk post-meeting about how to deal with circular references there ? | 18:00 |
| samueldmq | ayoung: ^ | 18:00 |
| henrynash | samueldmq: sure | 18:00 |
| ayoung | samueldmq, circular is dealt with alrady | 18:00 |
| samueldmq | henrynash: ayoung: it's hard because we allow duplicates we expanding the lists, so we might want to avoid them at all (checking at creation time ?) | 18:01 |
| samueldmq | we/when | 18:01 |
| *** fawadkhaliq has quit IRC | 18:08 | |
| *** e0ne has joined #openstack-keystone | 18:16 | |
| *** narengan12 has quit IRC | 18:23 | |
| *** mhickey has quit IRC | 18:23 | |
| *** spandhe has joined #openstack-keystone | 18:25 | |
| openstackgerrit | Fernando Diaz proposed openstack/keystone: Strengthen Mapping Validation in Federation Mappings https://review.openstack.org/250162 | 18:28 |
| *** fhubik has quit IRC | 18:30 | |
| *** zhiyan has quit IRC | 18:33 | |
| *** odyssey4me has quit IRC | 18:33 | |
| openstackgerrit | Fernando Diaz proposed openstack/keystone: Strengthen Mapping Validation in Federation Mappings https://review.openstack.org/250162 | 18:34 |
| *** tpeoples has quit IRC | 18:34 | |
| *** woodster_ has quit IRC | 18:34 | |
| *** jraim has quit IRC | 18:34 | |
| *** pumarani- has quit IRC | 18:35 | |
| *** hockeynut has quit IRC | 18:36 | |
| *** odyssey4me has joined #openstack-keystone | 18:36 | |
| *** tpeoples has joined #openstack-keystone | 18:36 | |
| *** zhiyan has joined #openstack-keystone | 18:36 | |
| *** hockeynut has joined #openstack-keystone | 18:36 | |
| *** jraim has joined #openstack-keystone | 18:37 | |
| *** woodster_ has joined #openstack-keystone | 18:37 | |
| *** jsavak has quit IRC | 18:44 | |
| *** jsavak has joined #openstack-keystone | 18:44 | |
| *** avarner_ has joined #openstack-keystone | 18:47 | |
| *** avarner has quit IRC | 18:50 | |
| *** narengan12 has joined #openstack-keystone | 18:53 | |
| *** boris-42 has quit IRC | 18:53 | |
| *** petertr7 is now known as petertr7_away | 18:56 | |
| gyee | if we allow service users to lookup project that should do it right? | 19:00 |
| *** jgregor has joined #openstack-keystone | 19:00 | |
| ayoung | henrynash, I will +1 https://review.openstack.org/#/c/242614/ for your changes. Please +2 the overall review | 19:00 |
| notmorgan | samueldmq: you shouldn't ever allow a circular reference | 19:00 |
| notmorgan | samueldmq: just catching up on your ^ above convo | 19:00 |
| ayoung | notmorgan, if he is talking about implied roles, then the issue is handled | 19:00 |
| notmorgan | ayoung: in whichever context ;) | 19:01 |
| samueldmq | notmorgan: yes that's the point, so we should avoid the circular reference at creation time | 19:01 |
| ayoung | even if there is a circular reference, building the implied roles set will not be a problem. | 19:01 |
| gyee | ayoung, how, that while loop will go forever | 19:01 |
| lhcheng | gyee: yup, that's what cinder is looking for: either allow the project query or add the parent_id in the token. | 19:01 |
| samueldmq | notmorgan: what I think we DON'T do for hierarchical projects | 19:01 |
| ayoung | gyee, nope...only follow a new node, not onw you;ve seen before | 19:01 |
| raildo | lhcheng: ++ | 19:01 |
| notmorgan | eh we could also just do an "entry ref" and break but | 19:01 |
| notmorgan | yeah | 19:01 |
| samueldmq | gyee: yes | 19:01 |
| mc_nair | ayoung:didn't realize about the parent_id being immutable. So the caching would help. My understanding is that we could then make this work if we just let a non-admin of the current project do a get_project | 19:01 |
| ayoung | we are building a set. Add the explicit roles to the set, then follow each. If that one is not in the set, add it and follow | 19:02 |
| ayoung | mc_nair, implied roles! | 19:02 |
| notmorgan | samueldmq: hierarchical projects has anti circular code already | 19:02 |
| ayoung | mc_nair, we get implied roles implemented, we fix a lot of brokeness | 19:02 |
| gyee | ayoung, that while loop will keep appending roles for circular reference, that's what samueldmq's seeing | 19:02 |
| notmorgan | samueldmq: but that is cause it would be broken to have a circular ref there, conceptually | 19:02 |
| ayoung | or at least have the tool to fix it | 19:03 |
| samueldmq | notmorgan: only to avoid staying in the loop, but they can be created I think | 19:03 |
| ayoung | gyee, nope | 19:03 |
| mc_nair | ayoung: I have zero Keystone experience, so other than sounding like total magic to me I don't understand how it solves grabbing the project for non-admin user | 19:03 |
| gyee | ayoung, I'll rest my case with a test case :) | 19:03 |
| samueldmq | notmorgan: eg https://github.com/openstack/keystone/blob/master/keystone/resource/backends/sql.py#L114-L132 | 19:03 |
| notmorgan | samueldmq: if they can be created, it was a bug in the logic. i remember creation was meant to prevent that. and parent_id is immutable | 19:03 |
| *** jsavak has quit IRC | 19:03 | |
| raildo | ayoung: by default, a member role, will be a subset for admin, right? | 19:03 |
| ayoung | mc_nair, with iplied roles, we can easily make more fine grained roles, and make rules that say "if you are memeber, you also get projectreader" | 19:03 |
| notmorgan | samueldmq: we also added in creation code. | 19:03 |
| ayoung | raildo, that is the plan! | 19:04 |
| gyee | lcheung, ++, lets relax the policy | 19:04 |
| *** alex_xu has quit IRC | 19:04 | |
| ayoung | samueldmq, let me walk youy through it | 19:04 |
| samueldmq | notmorgan: did we ? https://github.com/openstack/keystone/blob/master/keystone/resource/backends/sql.py#L140-L146 | 19:04 |
| raildo | ayoung: right, but if on keystone the get_project operation is enforced just for admin, how the member user (using implied roles) will do the operation without change the policy? | 19:04 |
| *** gonzalo2kx has joined #openstack-keystone | 19:04 | |
| samueldmq | notmorgan: and https://github.com/openstack/keystone/blob/master/keystone/resource/core.py#L179-L212 | 19:05 |
| ayoung | https://review.openstack.org/#/c/264260/24/keystone/assignment/core.py samueldmq start here on line 621 | 19:05 |
| samueldmq | notmorgan: I don't think we did | 19:05 |
| mc_nair | ayoung: ok, that helps some. Couldn't we already do something like that with a role like this in policy.json - https://github.com/openstack/cinder/blob/master/etc/cinder/policy.json#L3 | 19:05 |
| gonzalo2kx | Hello everyone | 19:05 |
| notmorgan | samueldmq: then someone screwed up. because that was a requirement to be added for landing HMT | 19:05 |
| ayoung | mc_nair, so implied roles are going to be served out by keystone, you will see them in the token | 19:05 |
| samueldmq | notmorgan: bug ? | 19:05 |
| notmorgan | samueldmq: it was one of the minimal things i required for accepting it | 19:05 |
| henrynash | mc_nair: I *think* we all agree that someone with a role on a project should be able to do a get_project on it | 19:05 |
| rodrigods | it is impossible to create circular references in hierarchical projects, it needs a update | 19:05 |
| notmorgan | samueldmq: no idea if there is a bug. but this means yet again someone just skipped on writing code. | 19:05 |
| ayoung | mc_nair, I started off by trying to do them in the policy files, but it failed under the weight of organizational inertia | 19:05 |
| rodrigods | and update of parent_id is not possible | 19:06 |
| notmorgan | rodrigods: right. | 19:06 |
| gonzalo2kx | Could someone aid me on how I could change the endpoint IP for Keystone V3? | 19:06 |
| notmorgan | rodrigods: i was almost sure that was impossible. | 19:06 |
| samueldmq | notmorgan: yes so this need to be revisited and fixed accordingly | 19:06 |
| notmorgan | samueldmq: it is impossible | 19:06 |
| notmorgan | samueldmq: you can't ever update parent_id | 19:06 |
| ayoung | samueldmq, OK, so lets say that we have the loop R1->R2->R3->R1 | 19:06 |
| gonzalo2kx | I am able to change the v2 enpoins on mysql but no clue on how to change the v3s endpoints | 19:06 |
| notmorgan | samueldmq: you can't create a project with a child | 19:06 |
| notmorgan | samueldmq: you can't make a circular loop | 19:06 |
| ayoung | samueldmq, and...say R3 is implicitly assigned | 19:06 |
| samueldmq | ayoung: they will also be appended to the ending of the list, then revisited | 19:06 |
| ayoung | hold on | 19:06 |
| *** alex_xu has joined #openstack-keystone | 19:07 | |
| ayoung | refs_to_check is the set of ones that we followe | 19:07 |
| notmorgan | rodrigods: phew, i was gonna get upset. :P | 19:07 |
| ayoung | that gets initialized at 622 | 19:07 |
| notmorgan | rodrigods: i was sure we made sure you can't make circular refs in hierarchical projects | 19:07 |
| raildo | notmorgan: yeap, we have tests for this case | 19:08 |
| *** petertr7_away is now known as petertr7 | 19:08 | |
| rodrigods | notmorgan, yep... we discussed this a lot | 19:08 |
| notmorgan | raildo: ++ :) | 19:08 |
| rodrigods | the check in list was just to make sure that anyone has messed up the DB | 19:08 |
| notmorgan | rodrigods: yeah that is why i was starting to be worried. | 19:08 |
| *** jsavak has joined #openstack-keystone | 19:08 | |
| samueldmq | cool, sorry for the confusion, I was looking at the create logic and not considering that update wasn't possible | 19:08 |
| samueldmq | notmorgan: :-) | 19:08 |
| notmorgan | samueldmq: :) | 19:08 |
| *** timcline has quit IRC | 19:08 | |
| lbragstad | dolphm fyi - http://gatewatch.dolphm.com/ is down | 19:09 |
| *** timcline has joined #openstack-keystone | 19:09 | |
| samueldmq | ayoung: sorry, available now | 19:09 |
| dolphm | lbragstad: i didn't know it was still running | 19:09 |
| *** timcline has quit IRC | 19:10 | |
| *** timcline has joined #openstack-keystone | 19:10 | |
| lbragstad | dolphm oh - were you planning on taking it down? | 19:10 |
| ayoung | samueldmq, let me map this back to how I originally wrote it. Something has changed, and you might be right | 19:10 |
| samueldmq | ayoung: exactly | 19:10 |
| raildo | ayoung: gyee, lhcheng so, what we will decide? I can create a poc to add parent_id on token, or we can discuss relax the policy, or any other option? | 19:10 |
| dolphm | lbragstad: gerrit dashboards have mostly superseded it for me | 19:10 |
| samueldmq | ayoung: the algorithm you described above works ^ which add only new nods to the list in the loop | 19:10 |
| gyee | raildo, I think relaxing the policy is a better option | 19:11 |
| notmorgan | dolphm: ++ | 19:11 |
| breton | has opensdk-meeting moved somewhere? | 19:11 |
| lbragstad | dolphm gotcha - i always use it to figure out what the gate wait time is | 19:11 |
| samueldmq | ayoung: however I agree with notmorgan that we should not even allow creating loops, even if we don't see an issue at a glance | 19:11 |
| lbragstad | dolphm but I suppose I can get that from zuul | 19:11 |
| bknudson | success - it got up to 0 degrees F. | 19:12 |
| notmorgan | it would be better if we don't allow loop creation, it avoids a whole slew of other things such as ending with weirdly orphaned roles | 19:12 |
| dolphm | lbragstad: oh, there was a bug in the calculation that made it uselessly inaccurate when the gate went past 24 hours | 19:12 |
| lbragstad | ah... | 19:12 |
| mc_nair | henrynash: ok cool. So then would you be against me making a change to the policy.v3cloudsample.json to allow member of current project to grab it by adding role like this - "admin_or_owner": "is_admin:True or project_id:%(project_id)s", | 19:12 |
| dolphm | lbragstad: that was the useful bit, for sure though | 19:12 |
| *** timcline_ has joined #openstack-keystone | 19:12 | |
| dolphm | lbragstad: i should trim it down to just that | 19:12 |
| dolphm | lbragstad: and put that back up.. | 19:12 |
| ayoung | samueldmq, I used to have this line: | 19:12 |
| ayoung | if implied_id in checked_roles: continue | 19:12 |
| lbragstad | dolphm it certainly isn't a priority - just curious | 19:13 |
| notmorgan | but i think we can survive with circular refs in the implied roles | 19:13 |
| henrynash | mc_nair: there are a number of changes in lfight for this…I’ll integrate a proposal for this into the mix | 19:13 |
| notmorgan | just it opens a lot of extra complexity | 19:13 |
| notmorgan | and edge cases to handle | 19:13 |
| raildo | henrynash: ++ thanks for that | 19:13 |
| mc_nair | henrynash: sounds good. Thank you | 19:14 |
| lhcheng | henrynash: thanks for taking care of that | 19:14 |
| *** jsavak has quit IRC | 19:14 | |
| samueldmq | #vote henrynash | 19:14 |
| henrynash | haha | 19:15 |
| *** timcline has quit IRC | 19:15 | |
| lbragstad | ayoung is there any requirements on who is allowed to delete a trust? | 19:15 |
| lbragstad | ayoung only the trustor, right? | 19:15 |
| dolphm | lbragstad: if you want the 72 hour gate load graph, it's basically this http://graphite.openstack.org/render/?from=-72hours&width=1920&height=1080&margin=0&hideLegend=true&hideAxes=true&hideGrid=true&target=color(stats.gauges.zuul.pipeline.gate.current_changes,%20%27000000%27) | 19:15 |
| ayoung | lbragstad, that was the original logic. Maybe an admin for an override, but better then to disable the user if there is some reason to think they will just recreate it | 19:16 |
| ayoung | henrynash, I think you broke it | 19:16 |
| ayoung | and I should have caught that | 19:16 |
| henrynash | htruta, samueldmq: seperate subject, on projects as a domain, I have reworked the key patch for this (combining the one for tests and the one for implementing it)….and am going to rebase the whole chain on teh removal of resource ldap backend for simplicity….so expect a reposting of all the patches soon | 19:17 |
| htruta | henrynash: great | 19:17 |
| ayoung | henrynash, I bet you thought I caught circular references on creation, but I was just paranoid that I would get it wrong, and wanted to catch them when expanding out in the token | 19:17 |
| lbragstad | jorge_munoz is what ayoung just described what you're seeing? | 19:17 |
| htruta | henrynash: I wonder how big this patch got | 19:17 |
| gonzalo2kx | Could someone aid me on how I could change the endpoint IP for Keystone V3? | 19:18 |
| lbragstad | dolphm ah, thanks! | 19:18 |
| dolphm | lbragstad: or for the black on white look, http://graphite.openstack.org/render/?from=-72hours&width=720&height=240&margin=0&hideLegend=true&hideAxes=true&hideGrid=true&target=color(stats.gauges.zuul.pipeline.gate.current_changes,%20%27white%27)&bgcolor=black | 19:18 |
| lbragstad | jorge_munoz can you push what you have locally for right now - even if it's not passing all the tests? | 19:19 |
| lbragstad | jorge_munoz that way ayoung and I can take a quick look | 19:19 |
| jorge_munoz | sure | 19:19 |
| henrynash | htruta: so it only went up by 100 lines, since I separated out the idea of using parent_id (with domain_id) to dictate where in the hierachy you should create, plus simplifcaition of some of the changes to teh tests….and then without LDAP and assuming we do https://review.openstack.org/#/c/269422 (ahead of time) we simplfiy the tests more….we’ll be down lower than just the implmentation patch was to start | 19:21 |
| raildo | henrynash: you're the guy! I owe you a pint :) | 19:24 |
| henrynash | mc_nair: sure | 19:24 |
| ayoung | henrynash, what am I missing? As you pioint out, we have an explicit test... | 19:24 |
| htruta | henrynash: awesome | 19:24 |
| henrynash | ayoung: i’mnot sure what you are missing! | 19:24 |
| *** jaosorior has quit IRC | 19:25 | |
| ayoung | henrynash, there used to be logic that prevented endlessly following circular references in the role inference code | 19:25 |
| ayoung | henrynash, I'm not seeing it now | 19:25 |
| lbragstad | ayoung dolphm think i could get a quick review on - https://review.openstack.org/#/c/215715/ | 19:25 |
| *** jaosorior has joined #openstack-keystone | 19:25 | |
| lbragstad | dolphm fyi dstanek already +2 so we'll require ayoung's vote | 19:26 |
| henrynash | ayoung: could it be that when I refactored it to work inside list_role_assignments, I removed it in error? | 19:26 |
| ayoung | lbragstad, gah..hate the cross backend code there | 19:26 |
| ayoung | henrynash, I think so... | 19:26 |
| ayoung | but do we then still have that test? | 19:26 |
| ayoung | see:test_role_assignments_directed_graph_of_implied_roles() | 19:27 |
| lbragstad | jorge_munoz here ya go - https://bugs.launchpad.net/keystone/+bug/1534834 | 19:27 |
| openstack | Launchpad bug 1534834 in OpenStack Identity (keystone) "Policy check forces impersonation for redelgation of trust" [Undecided,Confirmed] | 19:27 |
| ayoung | henrynash, yeah, I think we lost a check | 19:27 |
| ayoung | henrynash, I'll add a test and see if it breaks | 19:28 |
| ayoung | lbragstad, I really don't like that code | 19:28 |
| ayoung | lbragstad, I don't want the id backend to notify the assignement backend, because we should not do anything that does not work for Federation first off | 19:28 |
| lbragstad | ayoung alright - i can try and sit down with dstanek to figure out how he wanted to fix it | 19:29 |
| ayoung | lbragstad is the goal to cache role assignments for a specific user by pre-cacluating the role assignments for a group? | 19:29 |
| *** jgregor has quit IRC | 19:30 | |
| henrynash | ayoung: the test I wrote (and I commented about) was about showing we could have different parents and so would (and should) have “duplicates” in the resulting list from a list_role_assignmnets perspective | 19:30 |
| lbragstad | ayoung the goal is to cache roles for a user + project and cache roles for a user + domain | 19:30 |
| ayoung | henrynash, ah, no, not the same thing. I just read through that test and realized | 19:30 |
| henrynash | ayoung: agreed, I wasn’t trying to test circularity | 19:31 |
| ayoung | henrynash, I should have had a circularity test in there | 19:32 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Fix trust redelegation and associated test https://review.openstack.org/269824 | 19:33 |
| ayoung | henrynash, its hard to test, as you really need the "expand" code in there, but that really only gets tested from the assignment tests | 19:33 |
| ayoung | not backend | 19:33 |
| *** jsavak has joined #openstack-keystone | 19:35 | |
| henrynash | hey, heads up…all our jenkins are failing on the new ”linters” tests - can’t build/find the environment | 19:35 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Fix trust redelegation and associated test https://review.openstack.org/269824 | 19:35 |
| lhcheng | gonzalo2kx: have you tried using the openstackclient command "openstack endpoint set .. <endpoint_id>" ? | 19:35 |
| lhcheng | gonzalo2kx: https://github.com/openstack/python-openstackclient/blob/master/doc/source/command-objects/endpoint.rst#endpoint-set | 19:35 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Fix trust redelegation and associated test https://review.openstack.org/269824 | 19:36 |
| henrynash | who added the linters job? | 19:37 |
| bknudson | henrynash: ajaeger | 19:37 |
| bknudson | (it's in the git history) | 19:37 |
| henrynash | bknudson: thx | 19:38 |
| lbragstad | amakarov are you around? | 19:40 |
| *** jsavak has quit IRC | 19:40 | |
| *** jsavak has joined #openstack-keystone | 19:42 | |
| *** jsavak has quit IRC | 19:43 | |
| *** dslev has joined #openstack-keystone | 19:47 | |
| *** gyee has quit IRC | 19:49 | |
| henrynash | mc_nair: are you rdmcnair? | 19:49 |
| *** petertr7 is now known as petertr7_away | 19:52 | |
| *** jsavak has joined #openstack-keystone | 19:54 | |
| *** petertr7_away is now known as petertr7 | 19:56 | |
| *** PsionTheory has joined #openstack-keystone | 19:56 | |
| *** jsavak has quit IRC | 20:00 | |
| *** jsavak has joined #openstack-keystone | 20:01 | |
| *** tonytan4ever has quit IRC | 20:02 | |
| *** diazjf1 has joined #openstack-keystone | 20:03 | |
| *** rderose has quit IRC | 20:04 | |
| *** e0ne has quit IRC | 20:04 | |
| *** diazjf has quit IRC | 20:05 | |
| samueldmq | bknudson: so, about the cross-project liaison role, are you available now ? | 20:06 |
| bknudson | samueldmq: yes | 20:06 |
| henrynash | stevemar, ayoung: would be good to slip in https://review.openstack.org/#/c/265650/ into m2, means final part of a multi-patch blueprint, that we could then mark as complete | 20:07 |
| bknudson | samueldmq: btw, there might be a cross-project meeting in an hour | 20:07 |
| samueldmq | bknudson: so, first I looked at http://docs.openstack.org/project-team-guide/cross-project.html#cross-project-specification-liaisons | 20:07 |
| samueldmq | bknudson: yes, that was one question, I was looking at https://wiki.openstack.org/wiki/Meetings/CrossProjectMeeting | 20:07 |
| samueldmq | and it isn't updated | 20:07 |
| *** jaosorior has quit IRC | 20:08 | |
| samueldmq | bknudson: oh it is, "public weekly cross-project meeting" | 20:08 |
| bknudson | the cross-project meetings are often canceled due to no topics | 20:08 |
| bknudson | samueldmq: looks like it's skipped this week - http://lists.openstack.org/pipermail/openstack-dev/2016-January/084367.html | 20:09 |
| samueldmq | bknudson: from what I understand, I need to pay attention to all cross-proejct themes and | 20:10 |
| samueldmq | i) see how it applies to keystone | 20:10 |
| samueldmq | ii) how we can help other projects/get help from | 20:10 |
| *** rderose has joined #openstack-keystone | 20:10 | |
| stevemar | henrynash: yeah, that's on my list | 20:12 |
| samueldmq | henrynash: ++ assignment ackend looks much clearner/performant and beutiful now :) | 20:15 |
| henrynash | samueldmq: getting there! | 20:15 |
| *** tonytan4ever has joined #openstack-keystone | 20:15 | |
| samueldmq | o/ | 20:16 |
| bknudson | samueldmq: I think you're expected to review the proposed cross-project specs with an eye towards if this is going to cause problems for keystone | 20:16 |
| stevemar | henrynash: ayoung implied roles should land any minute now! | 20:16 |
| ayoung | stevemar, yeah..I'm watching it | 20:16 |
| henrynash | stevemar: yep | 20:16 |
| bknudson | samueldmq: and also notify keystone via the meeting if there's a new spec that we might be interested in. | 20:16 |
| samueldmq | bknudson: perfect, got it, basically just adding another repo to review :) | 20:17 |
| bknudson | samueldmq: yes, and tell keystone devs if there's anything in that repo others might be interested in. | 20:18 |
| notmorgan | ./me glares at jenkins errors. | 20:19 |
| samueldmq | bknudson: nice, thanks for sharing | 20:19 |
| stevemar | samueldmq: i believe the meeting is in 40 minutes :) | 20:20 |
| samueldmq | stevemar: they skipped it http://lists.openstack.org/pipermail/openstack-dev/2016-January/084367.html | 20:21 |
| *** e0ne has joined #openstack-keystone | 20:22 | |
| mc_nair | henrynash: correct. mc_nair is rdmcnair.... need to update that somewhere :) | 20:22 |
| henrynash | mc_nair: ok. np…! | 20:22 |
| *** e0ne has quit IRC | 20:22 | |
| *** narengan12 has quit IRC | 20:25 | |
| *** slberger has quit IRC | 20:28 | |
| *** slberger has joined #openstack-keystone | 20:29 | |
| samueldmq | ayoung: you working on this circular reference thing ? | 20:33 |
| samueldmq | henrynash: perhaps you might look at https://review.openstack.org/#/c/253219/ ? | 20:34 |
| samueldmq | henrynash: should be an easy approval | 20:34 |
| stevemar | samueldmq: this is why you are the liaison and i'm not :P | 20:34 |
| ayoung | samueldmq, yes | 20:34 |
| samueldmq | henrynash: dstanek: regarding test_backend split, patches are up to review | 20:35 |
| samueldmq | henrynash: dstanek: it would be nice if we could put some priority on them (if possible) because they will conflict a lot with others, for sure | 20:35 |
| samueldmq | at worst, perhaps at midcycle ? :) | 20:35 |
| samueldmq | ayoung: nice | 20:35 |
| samueldmq | stevemar: hehe | 20:35 |
| henrynash | samueldmq: yep, they’re achalleng to get in! | 20:36 |
| samueldmq | henrynash: ++ and the challenge starts at https://review.openstack.org/#/c/268307 | 20:37 |
| *** gildub has joined #openstack-keystone | 20:39 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: List assignments with names https://review.openstack.org/249958 | 20:41 |
| *** boris-42 has joined #openstack-keystone | 20:42 | |
| ayoung | stevemar, and back to 1 hr 27 min...for a patch that only failed due to a transient error at that | 20:46 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add is_domain parameter to get_project_by_name https://review.openstack.org/210600 | 20:47 |
| samueldmq | henrynash: thanks | 20:50 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: List assignments with names https://review.openstack.org/249958 | 20:50 |
| *** jasonsb has quit IRC | 20:54 | |
| samueldmq | henrynash: quick question about driver interface ... | 20:54 |
| henrynash | samueldmq: yep | 20:54 |
| *** dslev has quit IRC | 20:55 | |
| samueldmq | henrynash: does the implementer need to follow var names for the function params ? | 20:55 |
| *** vgridnev has quit IRC | 20:56 | |
| stevemar | ayoung: https://review.openstack.org/#/c/242614/38 hasn't been +2'ed yet, and it looks like it's the other half of implied roles | 20:56 |
| stevemar | ayoung: based on that, i'm gonna bump it to mitaka-3, but the sooner it lands the better, given that DSR depends on it | 20:57 |
| *** mhickey has joined #openstack-keystone | 20:57 | |
| ayoung | stevemar, fine by me | 20:57 |
| ayoung | stevemar, so long as it makes mitaka final | 20:57 |
| henrynash | samueldmq: so you mean, if we change a parameter name, does that require a driver version change…I’d have said no, but bknduson pointed out that IF every wrote some poor code in the manager that used parameter naming (even though it was not a positional paramater), then it would not work with anolder driver | 20:57 |
| stevemar | ayoung: should be fine, this is just procedural | 20:58 |
| stevemar | just for me to keep things organized | 20:58 |
| samueldmq | henrynash: see https://review.openstack.org/#/c/248295/ | 20:58 |
| stevemar | https://review.openstack.org/#/c/249958/ and https://review.openstack.org/#/c/265650/ are the only two that can make mitaka-2 and have a spec :O | 20:59 |
| stevemar | tjcocozz: thats you buddy! ^ | 20:59 |
| *** daemontool_ has quit IRC | 20:59 | |
| samueldmq | henrynash: that was my point, if we do call driver functions with named parameters | 20:59 |
| samueldmq | henrynash: it might not work sometimes, in the case we rename params as in this patch ^ | 20:59 |
| tjcocozz | stevemar, i've got this!! | 20:59 |
| stevemar | tjcocozz: looks like dstanek and i have reviewed it the most | 21:00 |
| tjcocozz | stevemar, yes! 1 more fix coming out right now. | 21:00 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: List assignments with names https://review.openstack.org/249958 | 21:01 |
| henrynash | samueldmq: so probably something we should get a combo of stevemar, dstanek and bknudson to chime in on….for me it seems a little overkill to require driver versioing…but given we already have nearly all the divers versioned, probably no harm to do the param swap in the wrapper | 21:01 |
| dstanek | stevemar: which review? | 21:01 |
| stevemar | dstanek: https://review.openstack.org/#/c/249958/ | 21:01 |
| stevemar | dstanek: about your comment in the commit msg | 21:02 |
| samueldmq | henrynash: yes, or simply don't call driver funcions with named params ? | 21:02 |
| stevemar | dstanek: the API is here: http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3.html#list-effective-role-assignments | 21:02 |
| stevemar | dstanek: look for "include_names" | 21:02 |
| stevemar | tjcocozz: dstanek: we're *not* including the entire entity | 21:03 |
| dstanek | stevemar: the code is not or we do not want to? | 21:03 |
| stevemar | tjcocozz: dstanek referring to the discussion here: https://review.openstack.org/#/c/249958/29..31//COMMIT_MSG | 21:03 |
| tjcocozz | stevemar, dstanek not entire entity | 21:03 |
| stevemar | dstanek: the code isn't and the spec isn't | 21:03 |
| stevemar | dstanek: the code just adds names | 21:03 |
| stevemar | dstanek: the spec just has the names | 21:03 |
| stevemar | and extra properties like description/enabled/links are not included | 21:04 |
| stevemar | in spec or code | 21:04 |
| tjcocozz | stevemar, before i was adding the entity inside list_role_assignments() | 21:04 |
| tjcocozz | now it is added in _format_entity() | 21:04 |
| stevemar | tjcocozz: hmm? i tried it out and it was just names for me | 21:04 |
| stevemar | tjcocozz: ah okay, you modified it recently to just emit names? | 21:04 |
| dstanek | stevemar: the code looked like it took the entity and just directly used it; not pulling the name out of it | 21:05 |
| stevemar | cause i tried this late last night and it was working fine | 21:05 |
| *** pauloewerton has quit IRC | 21:05 | |
| dstanek | stevemar: tjcocozz: i guess the question i have is where do we pull id and name out of the entity? | 21:06 |
| henrynash | htruta, rodigods, sameuldmq: first of the projects-as-a-domain rebased patches: https://review.openstack.org/#/c/210600/47 - I simplified this one by using a sub methods to do the caching, so we didnt have to change everywhere get_project_name() was called | 21:06 |
| tjcocozz | stevemar, dstanek i was formatting it to what the bp wanted https://review.openstack.org/#/c/240466/10/api/v3/identity-api-v3.rst | 21:06 |
| stevemar | tjcocozz: lemme take another look at the whole thing | 21:06 |
| stevemar | tjcocozz: ah you were doing it in _format_role_data | 21:07 |
| *** vgridnev has joined #openstack-keystone | 21:08 | |
| stevemar | whereas now you're creating entities with fields like 'group_name', 'group_domain_name', etc... | 21:08 |
| tjcocozz | stevemar, thanks! yes i was. I thought it was getting to cluttered in _format_entity() | 21:08 |
| henrynash | stevemar, gyee: little tweak to filtering of GET /projects to ensure no api result impact to projects acting as a domain: https://review.openstack.org/#/c/269422/ | 21:08 |
| stevemar | henrynash: SPECS! | 21:09 |
| dstanek | tjcocozz: ah, nm. you updated it since the last time i looked | 21:09 |
| stevemar | henrynash: we're talking about practice | 21:09 |
| dstanek | stevemar: what i was talking about was the changes starting on 516 here https://review.openstack.org/#/c/249958/29..32/keystone/assignment/controllers.py | 21:09 |
| tjcocozz | dstanek, yes i did. I think it what you are looking for | 21:10 |
| dstanek | stevemar: the last time i really looked it was just using the entire entity | 21:10 |
| dstanek | tjcocozz: that's exactly it, just name and id | 21:10 |
| dstanek | otherwise include_names doesn't make sense | 21:10 |
| tjcocozz | dstanek, it was using the entire entity becasue it was formatted and put into the entity in list_role_assignemnts (or atleast it used to be) | 21:11 |
| dstanek | tjcocozz: the probliem is that is list_role_assignments changes do to some requirement then you may get extra fields | 21:12 |
| dstanek | tjcocozz: stevemar: also it may be important to note that this will be an extremely heavy call compared to the include_names=False version | 21:15 |
| stevemar | dstanek: the hope is that the caching helps | 21:15 |
| henrynash | stevemar: teh reseller spec always include filtering of rpojects (teh code is already up), however, to me this seems liek a better filter | 21:15 |
| *** gildub has quit IRC | 21:17 | |
| *** gyee has joined #openstack-keystone | 21:17 | |
| *** ChanServ sets mode: +v gyee | 21:17 | |
| *** vgridnev has quit IRC | 21:19 | |
| *** henrynash has quit IRC | 21:19 | |
| *** vgridnev has joined #openstack-keystone | 21:19 | |
| *** rderose has quit IRC | 21:20 | |
| *** vgridnev has quit IRC | 21:20 | |
| dstanek | tjcocozz: i'm a little confused still; can the domain information be in there multiple times now? once in project and one in user for example | 21:22 |
| dstanek | tjcocozz: i was thinking that this would just add name to the dicts that only had ids | 21:22 |
| *** e0ne has joined #openstack-keystone | 21:23 | |
| tjcocozz | dstanek, you have the project domain and the users domain. like it is here in the response https://review.openstack.org/#/c/240466/10/api/v3/identity-api-v3.rst | 21:23 |
| dstanek | tjcocozz: very strange that the include_names=False response is so much different; oh well, it was probably thought through by the spec reviewers | 21:26 |
| bknudson | dstanek: specs aren't written in stone | 21:26 |
| tjcocozz | dstanek, i asked the same question. | 21:26 |
| dstanek | tjcocozz: what was the answer? | 21:26 |
| tjcocozz | bknudson, we can't go back now ;) | 21:27 |
| dstanek | bknudson: true, but the question is if it's worth the energy to see if it's correct or not :-) | 21:27 |
| tjcocozz | dstanek, exactly what you said. If people reviewed it... its what keystone needs | 21:27 |
| dstanek | stevemar: ^? | 21:28 |
| tjcocozz | dstanek, if you think it should be changed i am all for it | 21:28 |
| bknudson | spec reviewers don't have the advantage of seeing the code | 21:28 |
| dstanek | bknudson: true, but just looking at the spec you see the wierdness of the response | 21:28 |
| dstanek | in the original response we didn't care about adding domain to everything, but adding include_names=True now adds the names and adds domain in many different places | 21:29 |
| bknudson | dstanek: just getting the user name is useless... you need the domain, too. | 21:30 |
| bknudson | same for project | 21:31 |
| *** gordc has quit IRC | 21:31 | |
| dstanek | bknudson: right i get that because they are not globally unique, but this now feels asymmetrical | 21:32 |
| dstanek | bknudson: that's why i said i'd trust the original reviews | 21:33 |
| bknudson | if you've got a better solution then propose it. | 21:33 |
| samueldmq | ayoung: new gerrit ui confuses me | 21:33 |
| *** e0ne has quit IRC | 21:33 | |
| samueldmq | ayoung: I just spent time reviewing https://review.openstack.org/#/c/242614/38 | 21:33 |
| samueldmq | ayoung: note the /38 at the end | 21:33 |
| ayoung | samueldmq, YEAH, That got me a time or two, too | 21:34 |
| dstanek | samueldmq: i have the same issue | 21:34 |
| samueldmq | ayoung: dstanek: :( | 21:35 |
| samueldmq | looks like the version number is part of the url/cookie | 21:36 |
| samueldmq | don't know, but something is weird and I am no used to it yet :( | 21:36 |
| *** jasonsb has joined #openstack-keystone | 21:38 | |
| samueldmq | ayoung: omg, that changed a LOT from 38 to 52 | 21:38 |
| dstanek | tjcocozz: i'm not entirely convinced of the coverage, but this code really isn't all the testable right now (the original, not just your changes) | 21:41 |
| ayoung | samueldmq, OK, I think I know how henry misunderstood my intenion in the origianal code. Good eyes; his cache was, I thought, the same thing as I was originally doing | 21:41 |
| tjcocozz | dstanek, I checked it a couple times. What do you think isn't covered? | 21:41 |
| ayoung | the mistake I made was in not having a unit test for the cycles. My rationale was; if it fails, it runs forever, but that is a bad rationale | 21:42 |
| lbragstad | jorge_munoz added a few comments to https://review.openstack.org/#/c/269824/3 but wouldn't be opposed to ayoung and amakarov giving it a once over, too | 21:42 |
| dstanek | tjcocozz: the reason i say that is the number from coverage.py will tell you if the block if covered and even the cases in a single construct if you ask it, but i don't think if looks at all of the combinations of all of the if statements | 21:42 |
| tjcocozz | dstanek, oh i see what you are saying | 21:43 |
| ayoung | lbragstad, does that hande the check for trustor==user? | 21:43 |
| *** jasonsb has quit IRC | 21:43 | |
| jorge_munoz | lbragstad: Thanks, I’ll take a look. | 21:44 |
| *** dslev has joined #openstack-keystone | 21:45 | |
| tjcocozz | dstanek, i think my code has good coverage just from the fact that i am making sure the exact response that is formatted is returned. | 21:47 |
| bknudson | pics from the security meetup - https://photos.google.com/share/AF1QipNeswyo7oYY4kN7mFpi2v4u5LMfgOSOisvg4wwTnIMAROHBOsSMuvXXxQ5o6Ohckw?key=THVhZ254Y1hLd0VDODlWLXFnQjNvMEloWFNUZVdR | 21:47 |
| samueldmq | ayoung: yes, so we have a potential inifinite-loop right , | 21:47 |
| ayoung | samueldmq, right now, yes | 21:48 |
| ayoung | samueldmq, I have a test, but I have not gotten the logic right to expand the roles yet | 21:48 |
| *** jsavak has quit IRC | 21:48 | |
| *** jsavak has joined #openstack-keystone | 21:48 | |
| ayoung | I'm off by one ATM | 21:48 |
| samueldmq | ayoung: I am aware of that logic, I may help you if you want | 21:49 |
| dstanek | topol: see if my answer makes sense to you | 21:51 |
| *** spzala has quit IRC | 21:52 | |
| ayoung | samueldmq, GAH...so the problem is that if you have a role both implicit and explicit...what should you see in the token? | 21:53 |
| *** spzala has joined #openstack-keystone | 21:53 | |
| samueldmq | ayoung: does it matter ? do we add information of where that role came from ? or just we add 'roles': [...] in the token ? | 21:54 |
| ayoung | samueldmq, yeah, if a role is implied we put in | 21:54 |
| ayoung | 'indirect': {'role_id': u'0f5b38020fbf45959d36e4efe67aecd8'} | 21:54 |
| ayoung | to point to the parent | 21:55 |
| ayoung | and henry's tests look for both being in the token | 21:55 |
| samueldmq | ayoung: so we either duplicate in the token (which is bad) or remove this info | 21:55 |
| *** cburgess has quit IRC | 21:56 | |
| samueldmq | ayoung: also, what if it was implied by multiple prior role s? | 21:56 |
| tjcocozz | dstanek, stevemar here is what the output from the openstack client looks like if you were wondering: http://paste.openstack.org/show/484345/ | 21:56 |
| ayoung | samueldmq, and...if it was added by two different implied roles, I think both would be in the token the way he wrote the tests | 21:56 |
| stevemar | oh nice job tjcocozz | 21:57 |
| *** cburgess has joined #openstack-keystone | 21:57 | |
| *** spzala has quit IRC | 21:57 | |
| samueldmq | tjcocozz: too many admin assingments, be careful | 21:58 |
| samueldmq | :-) | 21:58 |
| samueldmq | ayoung: I am tired, need some rest and will give a more detailed look at that patch tomorrow morning | 21:59 |
| samueldmq | ayoung: I just left a review there, see my comments | 21:59 |
| *** Guest51217 is now known as med_ | 22:00 | |
| *** med_ has quit IRC | 22:00 | |
| *** med_ has joined #openstack-keystone | 22:00 | |
| *** lhcheng has quit IRC | 22:04 | |
| *** alejandrito has joined #openstack-keystone | 22:05 | |
| *** lhcheng has joined #openstack-keystone | 22:05 | |
| *** ChanServ sets mode: +v lhcheng | 22:05 | |
| *** jsavak has quit IRC | 22:06 | |
| *** su_zhang has joined #openstack-keystone | 22:11 | |
| *** mhickey has quit IRC | 22:15 | |
| *** gildub has joined #openstack-keystone | 22:17 | |
| dstanek | tjcocozz: that's pretty neat | 22:18 |
| tjcocozz | stevemar, dstanek thanks! | 22:18 |
| tjcocozz | samueldmq, i like living on the edge ... jk | 22:19 |
| dstanek | samueldmq: do everything as admin in openstack; like you to everything as root on unix | 22:20 |
| *** rcernin has quit IRC | 22:21 | |
| *** diazjf1 has quit IRC | 22:25 | |
| *** spzala has joined #openstack-keystone | 22:27 | |
| *** spzala has quit IRC | 22:28 | |
| *** spzala has joined #openstack-keystone | 22:28 | |
| *** ninag has quit IRC | 22:28 | |
| *** petertr7 is now known as petertr7_away | 22:32 | |
| *** jamielennox|away is now known as jamielennox | 22:35 | |
| *** tonytan4ever has quit IRC | 22:38 | |
| jamielennox | stevemar: wow, the OSC spec merged :O | 22:41 |
| jamielennox | ayoung: oh, implied roles merged as well! | 22:45 |
| jamielennox | oh, just backend | 22:47 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix docstring https://review.openstack.org/269899 | 22:51 |
| *** alejandrito has quit IRC | 22:51 | |
| *** rderose has joined #openstack-keystone | 22:52 | |
| *** rderose has quit IRC | 22:54 | |
| *** rderose has joined #openstack-keystone | 22:55 | |
| openstackgerrit | Merged openstack/keystone: Add support for strict url safe option on new projects and domains https://review.openstack.org/257376 | 22:58 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 23:01 |
| *** dslev has quit IRC | 23:07 | |
| *** timcline_ has quit IRC | 23:10 | |
| *** phalmos has quit IRC | 23:15 | |
| ajayaa | :q | 23:15 |
| *** ajayaa has quit IRC | 23:15 | |
| stevemar | tjcocozz: did you have to make any changes to keystoneclient to get the list with name in osc? | 23:21 |
| *** lhcheng has quit IRC | 23:21 | |
| stevemar | tjcocozz: yeah, ya did :( https://review.openstack.org/#/c/255392/4/keystoneclient/v3/role_assignments.py | 23:21 |
| stevemar | stinks that we just don't have that as **kwargs there | 23:22 |
| stevemar | we could just pass in "include_name=True" and append | 23:22 |
| jamielennox | stevemar: people complained a lot about having kwargs for those | 23:22 |
| stevemar | but that probably opens up a whole can of worms | 23:22 |
| stevemar | jamielennox: yeah | 23:22 |
| stevemar | jamielennox: o hai! | 23:22 |
| jamielennox | oh o | 23:22 |
| *** lhcheng has joined #openstack-keystone | 23:23 | |
| *** ChanServ sets mode: +v lhcheng | 23:23 | |
| *** lhcheng has quit IRC | 23:23 | |
| jamielennox | i don't know how it happens dolphm but using keystone-deploy leads to a keystone that doesn't list the v3 version on the admin interface, which causes many problems | 23:27 |
| jamielennox | no idea if you still use that | 23:27 |
| *** alex_xu has quit IRC | 23:30 | |
| *** alex_xu has joined #openstack-keystone | 23:31 | |
| *** lhcheng has joined #openstack-keystone | 23:32 | |
| *** ChanServ sets mode: +v lhcheng | 23:32 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:33 | |
| *** lhcheng_ has joined #openstack-keystone | 23:33 | |
| *** lhcheng has quit IRC | 23:36 | |
| *** bill_az has joined #openstack-keystone | 23:38 | |
| *** doug-fish has quit IRC | 23:39 | |
| *** lhcheng_ has quit IRC | 23:40 | |
| jamielennox | dolphm: something is wrong with the paste file you deploy | 23:40 |
| *** lhcheng has joined #openstack-keystone | 23:41 | |
| *** ChanServ sets mode: +v lhcheng | 23:41 | |
| jamielennox | ayoung: is https://review.openstack.org/#/c/242614/ the whole crud? | 23:48 |
| *** slberger has left #openstack-keystone | 23:48 | |
| *** henrynash has joined #openstack-keystone | 23:49 | |
| *** ChanServ sets mode: +v henrynash | 23:49 | |
| *** doug-fish has joined #openstack-keystone | 23:49 | |
| *** pumaranikar has quit IRC | 23:51 | |
| *** pumaranikar has joined #openstack-keystone | 23:52 | |
| *** doug-fish has quit IRC | 23:54 | |
| *** pumaranikar has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
