| *** timcline has quit IRC | 00:01 | |
| *** darrenc_ has joined #openstack-keystone | 00:06 | |
| *** rm_work has quit IRC | 00:06 | |
| *** mjb has quit IRC | 00:06 | |
| *** darrenc has quit IRC | 00:07 | |
| *** gus has quit IRC | 00:07 | |
| *** rm_work has joined #openstack-keystone | 00:08 | |
| *** mjb has joined #openstack-keystone | 00:08 | |
| *** gus has joined #openstack-keystone | 00:08 | |
| *** mylu has joined #openstack-keystone | 00:08 | |
| *** dims has joined #openstack-keystone | 00:08 | |
| *** dims_ has quit IRC | 00:09 | |
| *** lhcheng has quit IRC | 00:10 | |
| *** dims has quit IRC | 00:10 | |
| *** fawadkhaliq has quit IRC | 00:20 | |
| *** fawadkhaliq has joined #openstack-keystone | 00:21 | |
| *** furface has quit IRC | 00:23 | |
| *** arunkant has joined #openstack-keystone | 00:25 | |
| *** darrenc_ is now known as darrenc | 00:25 | |
| *** furface has joined #openstack-keystone | 00:26 | |
| *** spandhe has quit IRC | 00:29 | |
| *** tellesnobrega_af is now known as tellesnobrega | 00:37 | |
| *** jasonsb has joined #openstack-keystone | 00:46 | |
| *** fawadkhaliq has quit IRC | 00:51 | |
| *** fawadkhaliq has joined #openstack-keystone | 00:51 | |
| *** dims has joined #openstack-keystone | 00:52 | |
| *** chlong has joined #openstack-keystone | 00:55 | |
| *** timcline has joined #openstack-keystone | 00:57 | |
| *** ebalduf has joined #openstack-keystone | 00:58 | |
| *** timcline has quit IRC | 01:02 | |
| *** odyssey4me has quit IRC | 01:04 | |
| *** mylu has quit IRC | 01:05 | |
| *** odyssey4me has joined #openstack-keystone | 01:06 | |
| *** mylu has joined #openstack-keystone | 01:09 | |
| *** ChanServ sets mode: +v samueldmq | 01:11 | |
| *** EinstCrazy has joined #openstack-keystone | 01:18 | |
| *** chlong has quit IRC | 01:18 | |
| *** sdake has quit IRC | 01:22 | |
| *** henrynash has joined #openstack-keystone | 01:24 | |
| *** ChanServ sets mode: +v henrynash | 01:24 | |
| *** henrynash has quit IRC | 01:30 | |
| *** henrynash has joined #openstack-keystone | 01:30 | |
| *** ChanServ sets mode: +v henrynash | 01:30 | |
| *** chlong has joined #openstack-keystone | 01:31 | |
| *** alex_xu has quit IRC | 01:42 | |
| *** alex_xu has joined #openstack-keystone | 01:44 | |
| *** __zouyee has joined #openstack-keystone | 01:45 | |
| stevemar | jamielennox: we could always revert | 01:45 |
|---|---|---|
| *** __zouyee has quit IRC | 01:45 | |
| jamielennox | stevemar: i'd prefer to have some more logging info around it, but it's ok, also added the nit | 01:46 |
| *** jorge_munoz has quit IRC | 01:46 | |
| *** tqtran-afk has quit IRC | 01:48 | |
| *** alex_xu has quit IRC | 01:51 | |
| *** fawadkhaliq has quit IRC | 01:52 | |
| *** dan_nguyen has quit IRC | 01:52 | |
| *** alex_xu has joined #openstack-keystone | 01:53 | |
| *** fawadkhaliq has joined #openstack-keystone | 01:53 | |
| *** woodster_ has quit IRC | 01:57 | |
| *** fawadkhaliq has quit IRC | 01:58 | |
| *** fawadkhaliq has joined #openstack-keystone | 01:58 | |
| *** timcline has joined #openstack-keystone | 01:58 | |
| *** henrynash has quit IRC | 01:59 | |
| *** browne has quit IRC | 02:03 | |
| *** timcline has quit IRC | 02:03 | |
| *** tobe has joined #openstack-keystone | 02:05 | |
| *** fawadkhaliq has quit IRC | 02:15 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:16 | |
| *** ngupta- has quit IRC | 02:18 | |
| *** ngupta has joined #openstack-keystone | 02:18 | |
| *** odyssey4me has quit IRC | 02:19 | |
| *** darrenc has quit IRC | 02:19 | |
| *** dave-mccowan has quit IRC | 02:19 | |
| *** ankur has quit IRC | 02:19 | |
| *** josecastroleon1 has quit IRC | 02:19 | |
| *** nkinder has quit IRC | 02:19 | |
| *** sileht has quit IRC | 02:19 | |
| *** jraim has quit IRC | 02:19 | |
| *** mtreinish has quit IRC | 02:19 | |
| *** ctracey has quit IRC | 02:19 | |
| *** dansmith has quit IRC | 02:19 | |
| *** dims has quit IRC | 02:20 | |
| *** dan_nguyen has joined #openstack-keystone | 02:21 | |
| *** dan_nguyen has quit IRC | 02:24 | |
| *** odyssey4me has joined #openstack-keystone | 02:25 | |
| *** darrenc has joined #openstack-keystone | 02:25 | |
| *** dave-mccowan has joined #openstack-keystone | 02:25 | |
| *** ankur has joined #openstack-keystone | 02:25 | |
| *** josecastroleon1 has joined #openstack-keystone | 02:25 | |
| *** nkinder has joined #openstack-keystone | 02:25 | |
| *** sileht has joined #openstack-keystone | 02:25 | |
| *** jraim has joined #openstack-keystone | 02:25 | |
| *** mtreinish has joined #openstack-keystone | 02:25 | |
| *** ctracey has joined #openstack-keystone | 02:25 | |
| *** dansmith has joined #openstack-keystone | 02:25 | |
| *** fawadkhaliq has quit IRC | 02:26 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:26 | |
| *** EinstCra_ has joined #openstack-keystone | 02:34 | |
| *** EinstCrazy has quit IRC | 02:37 | |
| *** fawadkhaliq has quit IRC | 02:38 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:38 | |
| *** fawadkhaliq has quit IRC | 02:43 | |
| *** mylu_ has joined #openstack-keystone | 02:59 | |
| *** timcline has joined #openstack-keystone | 02:59 | |
| *** mylu has quit IRC | 02:59 | |
| *** timcline has quit IRC | 03:03 | |
| *** lhcheng has joined #openstack-keystone | 03:07 | |
| *** ChanServ sets mode: +v lhcheng | 03:07 | |
| *** GB21 has joined #openstack-keystone | 03:09 | |
| *** GB21 has quit IRC | 03:15 | |
| *** markvoelker has quit IRC | 03:15 | |
| *** lhcheng has quit IRC | 03:18 | |
| *** lhcheng has joined #openstack-keystone | 03:36 | |
| *** ChanServ sets mode: +v lhcheng | 03:36 | |
| *** lhcheng_ has joined #openstack-keystone | 03:37 | |
| *** lhcheng has quit IRC | 03:40 | |
| *** links has joined #openstack-keystone | 03:45 | |
| *** timcline has joined #openstack-keystone | 04:00 | |
| *** dave-mccowan has quit IRC | 04:00 | |
| *** fawadkhaliq has joined #openstack-keystone | 04:01 | |
| *** timcline has quit IRC | 04:04 | |
| *** browne has joined #openstack-keystone | 04:39 | |
| *** mylu_ has quit IRC | 04:55 | |
| *** mylu has joined #openstack-keystone | 04:55 | |
| *** mylu has quit IRC | 04:58 | |
| *** timcline has joined #openstack-keystone | 05:00 | |
| *** timcline has quit IRC | 05:05 | |
| *** ebalduf has quit IRC | 05:09 | |
| *** markvoelker has joined #openstack-keystone | 05:15 | |
| *** markvoelker has quit IRC | 05:21 | |
| *** fawadkhaliq has quit IRC | 05:21 | |
| *** GB21 has joined #openstack-keystone | 05:22 | |
| *** lhcheng has joined #openstack-keystone | 05:29 | |
| *** ChanServ sets mode: +v lhcheng | 05:29 | |
| *** lhcheng_ has quit IRC | 05:29 | |
| *** lupine has quit IRC | 05:30 | |
| *** GB21 has quit IRC | 05:31 | |
| *** GB21 has joined #openstack-keystone | 05:33 | |
| *** lupine has joined #openstack-keystone | 05:38 | |
| *** lhcheng has quit IRC | 05:43 | |
| *** rk4n has joined #openstack-keystone | 05:43 | |
| *** sdake has joined #openstack-keystone | 05:44 | |
| *** sdake_ has joined #openstack-keystone | 05:45 | |
| *** sdake has quit IRC | 05:49 | |
| *** GB21 has quit IRC | 05:51 | |
| *** GB21 has joined #openstack-keystone | 05:51 | |
| *** sdake_ is now known as sdake | 05:51 | |
| *** GB21 has quit IRC | 05:57 | |
| *** GB21 has joined #openstack-keystone | 05:59 | |
| *** Nirupama has joined #openstack-keystone | 05:59 | |
| *** timcline has joined #openstack-keystone | 06:01 | |
| *** tobe has quit IRC | 06:02 | |
| *** timcline has quit IRC | 06:06 | |
| *** chlong has quit IRC | 06:08 | |
| *** roxanagh_ has joined #openstack-keystone | 06:17 | |
| *** GB21 has quit IRC | 06:19 | |
| *** chlong has joined #openstack-keystone | 06:21 | |
| *** GB21 has joined #openstack-keystone | 06:21 | |
| *** roxanagh_ has quit IRC | 06:22 | |
| *** tobe has joined #openstack-keystone | 06:29 | |
| *** tobe has quit IRC | 06:31 | |
| *** BigWillie has joined #openstack-keystone | 06:33 | |
| *** BigWillie has quit IRC | 06:34 | |
| *** rk4n has quit IRC | 06:38 | |
| *** GB21 has quit IRC | 06:49 | |
| *** GB21 has joined #openstack-keystone | 06:49 | |
| *** markvoelker has joined #openstack-keystone | 06:52 | |
| *** markvoelker has quit IRC | 06:58 | |
| *** jaosorior has joined #openstack-keystone | 06:58 | |
| *** timcline has joined #openstack-keystone | 07:02 | |
| *** timcline has quit IRC | 07:07 | |
| *** alex_xu has quit IRC | 07:10 | |
| *** alex_xu has joined #openstack-keystone | 07:12 | |
| *** GB21 has quit IRC | 07:13 | |
| *** GB21 has joined #openstack-keystone | 07:13 | |
| *** tesseract has joined #openstack-keystone | 07:15 | |
| *** tesseract is now known as Guest57182 | 07:15 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Handle cache invalidate outside cache object https://review.openstack.org/268662 | 07:21 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Use oslo_config in auth_token middleware https://review.openstack.org/268664 | 07:21 |
| *** GB21 has quit IRC | 07:24 | |
| *** bjornar has joined #openstack-keystone | 07:24 | |
| *** rcernin has joined #openstack-keystone | 07:39 | |
| *** belmoreira has joined #openstack-keystone | 07:52 | |
| *** rk4n has joined #openstack-keystone | 07:54 | |
| *** chlong has quit IRC | 07:57 | |
| *** bjornar has quit IRC | 07:57 | |
| *** GB21 has joined #openstack-keystone | 08:00 | |
| *** browne has quit IRC | 08:02 | |
| *** timcline has joined #openstack-keystone | 08:03 | |
| *** timcline has quit IRC | 08:07 | |
| *** GB21 has quit IRC | 08:15 | |
| *** GB21 has joined #openstack-keystone | 08:15 | |
| *** pcaruana has joined #openstack-keystone | 08:24 | |
| *** GB21 has quit IRC | 08:28 | |
| *** timcline has joined #openstack-keystone | 08:28 | |
| *** GB21 has joined #openstack-keystone | 08:30 | |
| *** timcline has quit IRC | 08:32 | |
| *** mhickey has joined #openstack-keystone | 08:34 | |
| *** sdake has quit IRC | 08:43 | |
| *** sdake has joined #openstack-keystone | 08:44 | |
| *** sdake has quit IRC | 08:50 | |
| *** mhickey has quit IRC | 08:51 | |
| *** links has quit IRC | 08:53 | |
| *** GB21 has quit IRC | 09:04 | |
| *** d0ugal has quit IRC | 09:13 | |
| *** d0ugal has joined #openstack-keystone | 09:14 | |
| *** henrynash has joined #openstack-keystone | 09:20 | |
| *** ChanServ sets mode: +v henrynash | 09:20 | |
| *** jistr has joined #openstack-keystone | 09:26 | |
| *** GB21 has joined #openstack-keystone | 09:28 | |
| *** timcline has joined #openstack-keystone | 09:28 | |
| *** timcline has quit IRC | 09:33 | |
| *** GB21 has quit IRC | 09:44 | |
| *** henrynash has quit IRC | 09:53 | |
| *** dims has joined #openstack-keystone | 09:57 | |
| *** henrynash has joined #openstack-keystone | 09:59 | |
| *** ChanServ sets mode: +v henrynash | 09:59 | |
| *** rk4n_ has joined #openstack-keystone | 10:03 | |
| *** rk4n_ has quit IRC | 10:06 | |
| *** rk4n has quit IRC | 10:06 | |
| *** GB21 has joined #openstack-keystone | 10:11 | |
| *** daemontool has joined #openstack-keystone | 10:14 | |
| *** jaosorior has quit IRC | 10:14 | |
| *** jaosorior has joined #openstack-keystone | 10:15 | |
| *** henrynash has quit IRC | 10:19 | |
| *** bradjones has quit IRC | 10:27 | |
| *** links has joined #openstack-keystone | 10:29 | |
| *** timcline has joined #openstack-keystone | 10:29 | |
| *** daemontool has quit IRC | 10:31 | |
| *** timcline has quit IRC | 10:34 | |
| *** bradjones has joined #openstack-keystone | 10:36 | |
| *** bradjones has quit IRC | 10:36 | |
| *** bradjones has joined #openstack-keystone | 10:36 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Zanata https://review.openstack.org/293940 | 10:40 |
| *** aj1 has joined #openstack-keystone | 10:41 | |
| *** rk4n has joined #openstack-keystone | 10:44 | |
| *** e0ne has joined #openstack-keystone | 10:50 | |
| *** rodrigods has quit IRC | 10:51 | |
| *** rodrigods has joined #openstack-keystone | 10:51 | |
| *** GB21 has quit IRC | 10:52 | |
| *** GB21 has joined #openstack-keystone | 10:52 | |
| *** GB21 has quit IRC | 10:58 | |
| *** GB21 has joined #openstack-keystone | 10:58 | |
| openstackgerrit | Dina Belova proposed openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 11:02 |
| *** GB21 has quit IRC | 11:07 | |
| *** GB21 has joined #openstack-keystone | 11:08 | |
| *** boris-42 has joined #openstack-keystone | 11:14 | |
| *** timcline has joined #openstack-keystone | 11:30 | |
| *** timcline has quit IRC | 11:35 | |
| *** wxy has quit IRC | 11:40 | |
| *** aj1 has quit IRC | 11:42 | |
| *** EinstCra_ has quit IRC | 11:45 | |
| *** aj1 has joined #openstack-keystone | 11:47 | |
| *** GB21 has quit IRC | 11:47 | |
| *** chlong has joined #openstack-keystone | 11:48 | |
| *** openstackgerrit has quit IRC | 11:48 | |
| *** openstackgerrit has joined #openstack-keystone | 11:48 | |
| *** GB21 has joined #openstack-keystone | 11:48 | |
| *** dave-mccowan has joined #openstack-keystone | 11:53 | |
| *** GB21 has quit IRC | 11:53 | |
| *** GB21 has joined #openstack-keystone | 11:55 | |
| *** aj1 has quit IRC | 11:58 | |
| *** aj1 has joined #openstack-keystone | 12:01 | |
| *** GB21 has quit IRC | 12:01 | |
| *** GB21 has joined #openstack-keystone | 12:03 | |
| *** raildo-afk is now known as raildo | 12:14 | |
| *** gordc has joined #openstack-keystone | 12:18 | |
| *** edmondsw has joined #openstack-keystone | 12:18 | |
| *** lupine has quit IRC | 12:20 | |
| *** lupine has joined #openstack-keystone | 12:20 | |
| *** GB21 has quit IRC | 12:24 | |
| *** trown|outtypewww is now known as trown | 12:25 | |
| *** dims has quit IRC | 12:25 | |
| *** timcline has joined #openstack-keystone | 12:31 | |
| dstanek | amakarov: you probably need to ask the operators about oauth1 | 12:34 |
| dstanek | amakarov: how much work is it to keep it up to date? | 12:34 |
| *** timcline has quit IRC | 12:35 | |
| amakarov | dstanek, hi! At first glance: split assess and request tokens, then use unified delegation to store request tokens. Don't know what to do with access tokens - they are just like keystone persistent tokens we are trying to replace with Fernet now | 12:37 |
| ayoung | amakarov, persistent stay around for the moment | 12:42 |
| ayoung | they are, as I see it, a proxy for authentication, not authorization | 12:42 |
| ayoung | wait... | 12:43 |
| *** ninag has joined #openstack-keystone | 12:43 | |
| amakarov | ayoung, request token has requested resource | 12:43 |
| ayoung | request tokens are become a delegation, right? | 12:43 |
| * ayoung needs a refresher on oauth | 12:43 | |
| amakarov | ayoung, right | 12:44 |
| *** dikonoor has joined #openstack-keystone | 12:44 | |
| ayoung | amakarov, access tokens are really like unscoped tokens, no? | 12:45 |
| ayoung | hmmm...ok let me go refresh myself on the flow.... | 12:45 |
| ayoung | one sec | 12:45 |
| amakarov | ayoung, not exactly: they have a scope | 12:45 |
| *** real56 has joined #openstack-keystone | 12:45 | |
| *** dikonoor has quit IRC | 12:46 | |
| *** dikonoor has joined #openstack-keystone | 12:46 | |
| ayoung | request tokens are really just like the keystone token that a user would request to do anything against Keystone. Just...the ya re the OAUTH specific tokens, right? | 12:46 |
| ayoung | is there any reason a request token could not be just a standard Keystone token? | 12:46 |
| *** dikonoor has quit IRC | 12:47 | |
| ayoung | OK I'm off | 12:47 |
| ayoung | "Request Token: Used by the Consumer to ask the User to authorize access to the Protected Resources. " | 12:47 |
| amakarov | ayoung, request token looks like an assignment to me | 12:47 |
| ayoung | amakarov, more like a request for a delegation, no? | 12:48 |
| ayoung | rodrigods, ask that here. | 12:48 |
| amakarov | ayoung, the difference in the push-pull direction: delegation is granted by somebody | 12:48 |
| amakarov | request token is a delegation that is requested to be granted | 12:49 |
| ayoung | amakarov, ok...I think the concept of a request token is something we don't have in Keystone right now | 12:49 |
| ayoung | it would be the equivalent of a user saying "Please grant me role R on proejct P" in a formal manner, right? | 12:49 |
| amakarov | so approved request token works as a delegation | 12:49 |
| ayoung | and then, the access token would be the assignment | 12:50 |
| amakarov | ayoung, ++ | 12:50 |
| amakarov | ayoung, things are even more complicated )) | 12:50 |
| ayoung | so, could we do a request token using Fernet? I don't see any reason why they would need to be persisted, just validated | 12:50 |
| *** Nirupama has quit IRC | 12:51 | |
| amakarov | request token just has the boolean field: "authorized" | 12:51 |
| amakarov | ayoung, we have GET /users/{user_id}/OS-OAUTH1/access_tokens/{access_token_id}/roles/{role_id} | 12:52 |
| amakarov | ayoung, we have GET /users/{user_id}/OS-OAUTH1/access_tokens | 12:52 |
| amakarov | that should return list of user access tokens | 12:52 |
| ayoung | amakarov, pending, or just authorized access tokens? | 12:53 |
| amakarov | ayoung, q.filter_by(authorizing_user_id=user_id) | 12:54 |
| amakarov | these are tokens authorized by the user | 12:54 |
| amakarov | ayoung, I think to sort the mess out I should look at oauth1 spec more closely | 12:55 |
| amakarov | thus the question: why support oauth1 if there is oauth2 already? | 12:55 |
| *** real56 has quit IRC | 12:56 | |
| *** Trident has quit IRC | 12:57 | |
| *** richm has joined #openstack-keystone | 12:59 | |
| *** pauloewerton has joined #openstack-keystone | 13:07 | |
| *** markvoelker has joined #openstack-keystone | 13:11 | |
| *** Trident has joined #openstack-keystone | 13:12 | |
| *** real56 has joined #openstack-keystone | 13:13 | |
| ayoung | amakarov, they are two entirely different specs | 13:15 |
| ayoung | oauth1 is a more forgiving spec, and is more used | 13:16 |
| ayoung | but, I think we can say that GET /users/{user_id}/OS-OAUTH1/access_tokens would get a set of delegations, so we can still support that. | 13:16 |
| amakarov | ayoung, I know, the question is what's used more. So it's oauth1 | 13:16 |
| ayoung | amakarov, yeah, and we've had no call to support oauth2 | 13:17 |
| amakarov | ayoung, but access token is not a delegation | 13:18 |
| ayoung | amakarov, squint at it. I think it is | 13:18 |
| stevemar | dstanek: amakarov ayoung i forwarded the note to the ops list | 13:19 |
| amakarov | ayoung, oauth1 workflow: create and then authorize request token once to allow consumer instantiate a new access token on every action | 13:20 |
| amakarov | ayoung, do you suggest faking the access token list or store short living access token along with long living request token? | 13:22 |
| amakarov | ayoung, hmm, I've read about oauth1 more closely... It looks like request token shouldn't live long too and it's not a delegation, but a delegation derivative | 13:26 |
| amakarov | for example it cannot be redelegated any further, and delegation chain is needed to validate access token in RBAC | 13:28 |
| *** links has quit IRC | 13:28 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: WIP - Generate swagger https://review.openstack.org/287499 | 13:36 |
| *** aj1 has quit IRC | 13:38 | |
| ayoung | amakarov, as I under stand it, the request token is created in a call from the consumer to the oauth server, and is in an un-approved mode. The consumer then passes this to the user, who sends it back to oauth to approve. I always liked this aspect of the protocol | 13:39 |
| ayoung | it would be like calling nova server create with no token and getting back "here is the list of roles you need for this project in order to complete it" | 13:39 |
| amakarov | ayoung, I like this explanation: http://hueniverse.com/2007/10/15/beginners-guide-to-oauth-part-ii-protocol-workflow/ | 13:40 |
| ayoung | looking amakarov | 13:40 |
| amakarov | I'm more focused on the part "exchanges request token for access token" so I wonder is it event legal to place the request token in the delegation table at all | 13:41 |
| amakarov | s/event/even/ | 13:41 |
| ayoung | " Beppa requests from Faji a Request Token." | 13:41 |
| amakarov | "While Jane waits, Beppa uses the authorized Request Token and exchanges it for an Access Token" | 13:42 |
| ayoung | amakarov, so the approved request token might have fewer permissions than initially requested, such as the one hour limitation that Faji puts on it | 13:43 |
| ayoung | so once the request token is approved, it is a delegation. Until then, it can be just a Fernet based token request. | 13:44 |
| ayoung | It can actually be larger than the fernet tokens, as it is not passed in a header | 13:44 |
| ayoung | amakarov, make sense? | 13:44 |
| amakarov | ayoung, I have to look at the code. Not sure if we can reconstruct request token to complete authorization | 13:46 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:47 | |
| *** EinstCrazy has joined #openstack-keystone | 13:48 | |
| *** knikolla has joined #openstack-keystone | 13:50 | |
| amakarov | ayoung, we should store request token. Only its ID is passed in authZ request URL | 13:51 |
| ayoung | amakarov, that ID could be a Fernet body. | 13:51 |
| ayoung | means we need to keep them under 255 bytes, I think, though | 13:51 |
| ayoung | can we do that? | 13:51 |
| amakarov | ayoung, hmm... | 13:51 |
| amakarov | considering the restriction, I think we can | 13:52 |
| ayoung | amakarov, otherwise, we have "unapproved delegations" in our database.... | 13:52 |
| ayoung | restriction is "one role" | 13:52 |
| amakarov | ayoung, we don't want that | 13:52 |
| ayoung | I do | 13:52 |
| ayoung | but I'm funny that way | 13:52 |
| ayoung | http://www.leasticoulddo.com/comic/20160317/ | 13:52 |
| *** dims has joined #openstack-keystone | 13:53 | |
| amakarov | ayoung, so the next step in the workflow: access token. I'm curios if these can be Fernet too? Can we just return empty list as a result to access token list request? | 13:55 |
| ayoung | amakarov, OOhh...I'd like that. | 13:56 |
| amakarov | ayoung, ok, I need use cases for this list then | 13:57 |
| * amakarov goes away digging | 13:57 | |
| *** e0ne has quit IRC | 13:59 | |
| *** e0ne has joined #openstack-keystone | 14:00 | |
| *** slberger has joined #openstack-keystone | 14:07 | |
| ayoung | stevemar, it appears sdague does not approve of our change to the API: https://review.openstack.org/#/c/285541/7 | 14:09 |
| patchbot | ayoung: patch 285541 - tempest - Add parent_id to create_project | 14:09 |
| *** mylu has joined #openstack-keystone | 14:10 | |
| *** timcline has joined #openstack-keystone | 14:10 | |
| *** dims has quit IRC | 14:19 | |
| *** dims has joined #openstack-keystone | 14:22 | |
| *** mylu has quit IRC | 14:23 | |
| *** dims has quit IRC | 14:25 | |
| *** GB21 has joined #openstack-keystone | 14:25 | |
| *** mylu has joined #openstack-keystone | 14:27 | |
| *** pcaruana has quit IRC | 14:28 | |
| amakarov | ayoung, According to http://oauthbible.com/ we use 3-legged auth and I was unable to find where access token list request is used. Looks like we don't need any backend for oauth1 at all )) | 14:36 |
| ayoung | amakarov, good to know. | 14:37 |
| *** mylu has quit IRC | 14:37 | |
| amakarov | ayoung, it looks like just yet another auth strategy rather then something to unify | 14:38 |
| *** mylu has joined #openstack-keystone | 14:38 | |
| ayoung | ++ | 14:38 |
| amakarov | maybe it's better be done as a separate blueprint | 14:38 |
| amakarov | ? | 14:38 |
| *** sdake has joined #openstack-keystone | 14:39 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 14:40 | |
| ayoung | amakarov, yes, but only if we can;t deprecate. Deal? | 14:40 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:41 | |
| amakarov | ayoung, well, I'll wait for the results of my little survey in ML :) | 14:41 |
| *** mylu has quit IRC | 14:41 | |
| *** jaosorior is now known as jaosorior_away | 14:43 | |
| *** jorge_munoz has joined #openstack-keystone | 14:47 | |
| stevemar | ayoung: i wouldn't say sdague doesn't like it, he is just looking for an audit trail | 14:50 |
| *** jorge_munoz has quit IRC | 14:50 | |
| *** pushkaru has joined #openstack-keystone | 14:52 | |
| ayoung | stevemar, am I right, though, in saying this is something that was unspecified in the past and that we have now changed legally, or have we really broken our contract here | 14:52 |
| *** lhinds_ has joined #openstack-keystone | 14:52 | |
| *** csoukup has joined #openstack-keystone | 14:54 | |
| *** jorge_munoz has joined #openstack-keystone | 14:58 | |
| stevemar | ayoung: i think the crux of it is that the API change is additive | 14:58 |
| stevemar | so it should be alright | 14:58 |
| ayoung | stevemar, ++ | 14:59 |
| *** belmoreira has quit IRC | 14:59 | |
| *** jorge_munoz_ has joined #openstack-keystone | 15:01 | |
| *** jorge_munoz has quit IRC | 15:02 | |
| *** jorge_munoz_ is now known as jorge_munoz | 15:03 | |
| *** zqfan has joined #openstack-keystone | 15:03 | |
| *** josecastroleon1 has quit IRC | 15:04 | |
| *** alejandrito has joined #openstack-keystone | 15:05 | |
| amakarov | dolphm, hi! Will you remove -2 on materialized path field patch if I want to use it just to store id chains without indexing? | 15:07 |
| amakarov | dolphm, https://review.openstack.org/#/c/251445/ | 15:07 |
| patchbot | amakarov: patch 251445 - keystone - SQLAlchemy column type for materialized path | 15:07 |
| *** jorge_munoz has quit IRC | 15:07 | |
| dstanek | amakarov: i think he's out the rest of this week | 15:15 |
| *** GB21 has quit IRC | 15:15 | |
| amakarov | dstanek, thank you, will be bothering him afterwards )) | 15:15 |
| *** browne has joined #openstack-keystone | 15:22 | |
| stevemar | this doesn't sound too good https://bugs.launchpad.net/manila/+bug/1555093 :\ | 15:22 |
| openstack | Launchpad bug 1555093 in Manila "Keystone v3 support broken (all clients)" [High,In progress] - Assigned to Marc Koderer (m-koderer) | 15:22 |
| *** EinstCrazy has quit IRC | 15:31 | |
| bknudson | but this looks awesome -- https://review.openstack.org/#/c/290511/13/manila/compute/nova.py | 15:31 |
| patchbot | bknudson: patch 290511 - manila - Fix keystone v3 issues for all clients | 15:31 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Add note on conflict in idp registration https://review.openstack.org/294099 | 15:33 |
| rodrigods | stevemar, ayoung, ^ | 15:34 |
| ayoung | amakarov, lets not push on materialized path. I really don't like the idea. | 15:37 |
| ayoung | its premature optimization | 15:37 |
| amakarov | ayoung, ok | 15:37 |
| rodrigods | ayoung, ++, but it is beautiful | 15:37 |
| rodrigods | :) | 15:37 |
| ayoung | amakarov, I won;t hold it up if it is "must have" | 15:37 |
| ayoung | rodrigods, I prefer normalized data | 15:37 |
| rodrigods | how normalized data can help there? | 15:38 |
| ayoung | rodrigods, materialized path means you always have the whole path...will not support subtrees. So then you hae to parse...its just something the database itself should be qable to support, even if SQL does not... | 15:39 |
| ayoung | but...when we get there. | 15:39 |
| amakarov | ayoung, I'd say it doesn't support DAG :) | 15:44 |
| *** spzala has joined #openstack-keystone | 15:46 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Add note on conflict in idp handling https://review.openstack.org/294099 | 15:52 |
| rodrigods | ayoung, missed the update ^ | 15:52 |
| rodrigods | it is easy to figure out my current task, right? :P | 15:52 |
| ayoung | rodrigods, Dilligence.... | 15:54 |
| *** shangxdy_ has joined #openstack-keystone | 16:02 | |
| *** agrebennikov has joined #openstack-keystone | 16:04 | |
| agrebennikov | hey marekd | 16:04 |
| agrebennikov | I was told you may provide a lot of useful info regarding keystone idp implementation through saml | 16:04 |
| *** dan_nguyen has joined #openstack-keystone | 16:07 | |
| *** mylu has joined #openstack-keystone | 16:09 | |
| *** mylu has quit IRC | 16:11 | |
| openstackgerrit | Merged openstack/keystone-specs: Add note on conflict in idp handling https://review.openstack.org/294099 | 16:20 |
| *** pcaruana has joined #openstack-keystone | 16:22 | |
| ayoung | dstanek, I took another stab at Dependcy injection in Python. when you have a moment, http://adam.younglogic.com/2016/03/di-python-ossipee/ | 16:22 |
| *** doug-fish has quit IRC | 16:22 | |
| *** doug-fish has joined #openstack-keystone | 16:23 | |
| *** doug-fish has quit IRC | 16:27 | |
| *** browne has quit IRC | 16:29 | |
| *** ninag has quit IRC | 16:29 | |
| *** real56_ has joined #openstack-keystone | 16:29 | |
| *** ninag has joined #openstack-keystone | 16:29 | |
| *** real56 has quit IRC | 16:30 | |
| *** real56_ is now known as real56 | 16:30 | |
| *** ninag_ has joined #openstack-keystone | 16:30 | |
| *** ninag_ has quit IRC | 16:32 | |
| *** ninag_ has joined #openstack-keystone | 16:33 | |
| *** ninag has quit IRC | 16:34 | |
| *** aimeeU has joined #openstack-keystone | 16:35 | |
| *** doug-fish has joined #openstack-keystone | 16:38 | |
| *** doug-fish has quit IRC | 16:38 | |
| *** doug-fish has joined #openstack-keystone | 16:38 | |
| *** real56 has quit IRC | 16:38 | |
| *** mhickey has joined #openstack-keystone | 16:44 | |
| *** ninag_ has quit IRC | 16:44 | |
| *** ninag has joined #openstack-keystone | 16:44 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:45 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 16:45 | |
| *** doug-fish has quit IRC | 16:45 | |
| *** doug-fish has joined #openstack-keystone | 16:46 | |
| *** doug-fish has quit IRC | 16:46 | |
| *** doug-fish has joined #openstack-keystone | 16:46 | |
| *** yarkot_ has joined #openstack-keystone | 16:48 | |
| *** alejandrito has quit IRC | 16:49 | |
| *** ninag has quit IRC | 16:49 | |
| *** timcline has quit IRC | 16:51 | |
| *** alejandrito has joined #openstack-keystone | 16:51 | |
| *** timcline has joined #openstack-keystone | 16:51 | |
| *** timcline has quit IRC | 16:55 | |
| *** real56 has joined #openstack-keystone | 16:56 | |
| *** spzala has quit IRC | 17:00 | |
| *** spzala has joined #openstack-keystone | 17:01 | |
| *** pnavarro has joined #openstack-keystone | 17:01 | |
| *** alejandrito has quit IRC | 17:01 | |
| *** jasonsb has quit IRC | 17:02 | |
| *** spzala has quit IRC | 17:05 | |
| *** ninag has joined #openstack-keystone | 17:08 | |
| *** real56 has quit IRC | 17:08 | |
| *** lhcheng has joined #openstack-keystone | 17:14 | |
| *** ChanServ sets mode: +v lhcheng | 17:14 | |
| *** browne has joined #openstack-keystone | 17:15 | |
| *** fawadkhaliq has joined #openstack-keystone | 17:16 | |
| gsilvis | Is there currently CI for K2K federation? If there isn't, I might look into making that | 17:16 |
| *** pnavarro has quit IRC | 17:18 | |
| *** spzala has joined #openstack-keystone | 17:19 | |
| *** yarkot_ has quit IRC | 17:19 | |
| *** fawadkhaliq has quit IRC | 17:20 | |
| *** fawadkhaliq has joined #openstack-keystone | 17:21 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Add `patch_cover` to keystone https://review.openstack.org/294189 | 17:22 |
| morgan | gsilvis: not really | 17:22 |
| morgan | gsilvis: adding it would be fantastic | 17:22 |
| gsilvis | morgan: cool, I'll talk to infra then | 17:23 |
| morgan | gsilvis: bleh, i wish i could take a few years off and get a PhD. | 17:23 |
| morgan | gsilvis: at this point. | 17:23 |
| morgan | gsilvis: since i am now looking for a new employer. but alas... don't have that much spare money :P | 17:23 |
| *** spzala has quit IRC | 17:23 | |
| morgan | gsilvis: i figured you'd appreciate the sentiment though :P | 17:24 |
| gsilvis | morgan: well, some phd programs have stipends! | 17:24 |
| gsilvis | morgan: but yeah, I definitely understand the feeling | 17:24 |
| morgan | gsilvis: unfortunately, I don't have a BS | 17:24 |
| morgan | or a degree in CS, so getting accepted into masters/phd program is hard | 17:24 |
| gsilvis | morgan: hm, that complicates it, yeah | 17:24 |
| *** timcline has joined #openstack-keystone | 17:24 | |
| * morgan has a BA in Theatre and Film | 17:24 | |
| *** marcusrafael has joined #openstack-keystone | 17:24 | |
| morgan | and getting the BS in CS is a *real* challenge because... it's sooooooo boring to go back and deal with being "taught" things I do every day - and also paying for it. | 17:25 |
| morgan | gsilvis: :P ah well. | 17:25 |
| morgan | maybe i should just go play with TensorFlow for fun | 17:26 |
| gsilvis | oh yeah---90% of the classes would suck, and the rest would be math | 17:26 |
| morgan | yep. | 17:26 |
| *** jistr has quit IRC | 17:27 | |
| *** e0ne has quit IRC | 17:27 | |
| *** timcline has quit IRC | 17:29 | |
| *** mhickey has quit IRC | 17:31 | |
| *** ninag has quit IRC | 17:34 | |
| *** ninag has joined #openstack-keystone | 17:35 | |
| *** ninag has quit IRC | 17:36 | |
| *** ninag has joined #openstack-keystone | 17:36 | |
| *** Guest57182 has quit IRC | 17:36 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add conflict validation for idp update https://review.openstack.org/294201 | 17:38 |
| *** ninag has quit IRC | 17:39 | |
| *** ninag has joined #openstack-keystone | 17:39 | |
| rodrigods | dstanek, do we need a bp/spec for tempest plugins? | 17:40 |
| rodrigods | maybe just a bp is enough, right? | 17:41 |
| *** spzala has joined #openstack-keystone | 17:42 | |
| *** shangxdy_ has quit IRC | 17:42 | |
| *** ninag has quit IRC | 17:43 | |
| dstanek | rodrigods: not sure. i don't really know what we'll need to do yet | 17:43 |
| dstanek | rodrigods: i'm going to create a plugin after this meeting to start experimenting | 17:44 |
| rodrigods | dstanek, ++ | 17:44 |
| *** fawadkhaliq has quit IRC | 17:46 | |
| *** spzala has quit IRC | 17:47 | |
| *** spandhe has joined #openstack-keystone | 17:47 | |
| *** fawadkhaliq has joined #openstack-keystone | 17:48 | |
| *** dims has joined #openstack-keystone | 17:50 | |
| *** rcernin has quit IRC | 17:55 | |
| *** tqtran-afk has joined #openstack-keystone | 17:56 | |
| *** spzala has joined #openstack-keystone | 17:56 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 18:00 | |
| *** doug-fish has quit IRC | 18:00 | |
| *** doug-fish has joined #openstack-keystone | 18:00 | |
| rodrigods | dstanek, found an example: https://github.com/openstack/manila/tree/master/manila_tempest_tests | 18:04 |
| *** lhcheng_ has joined #openstack-keystone | 18:05 | |
| *** doug-fish has quit IRC | 18:05 | |
| dstanek | rodrigods: yeah, writing one now. looks pretty interesting | 18:06 |
| rodrigods | dstanek, the test itself is just like a regular tempest test | 18:07 |
| *** gordc has quit IRC | 18:07 | |
| *** slberger1 has joined #openstack-keystone | 18:07 | |
| *** lhcheng has quit IRC | 18:08 | |
| dstanek | rodrigods: nice. did you push a fix? | 18:09 |
| *** slberger has quit IRC | 18:09 | |
| rodrigods | dstanek, fix to what? the bug i've found? | 18:09 |
| *** bjornar has joined #openstack-keystone | 18:10 | |
| *** tqtran-afk is now known as tqtran | 18:13 | |
| *** jaosorior_away has quit IRC | 18:14 | |
| dstanek | rodrigods: yes | 18:15 |
| *** jaosorior_away has joined #openstack-keystone | 18:15 | |
| rodrigods | dstanek, https://review.openstack.org/#/c/294201/ | 18:15 |
| patchbot | rodrigods: patch 294201 - keystone - Add conflict validation for idp update | 18:15 |
| dstanek | rodrigods: coolio, got a plugin working :-) | 18:15 |
| rodrigods | dstanek, nice | 18:15 |
| dstanek | rodrigods: do you still have some work you need to do on it? | 18:15 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Enables the notification tests in py3 https://review.openstack.org/280671 | 18:17 |
| *** ninag has joined #openstack-keystone | 18:17 | |
| rodrigods | dstanek, i didn't run the test :) | 18:17 |
| rodrigods | was having some packages issues | 18:18 |
| *** pcaruana has quit IRC | 18:18 | |
| rodrigods | running it right now | 18:18 |
| *** e0ne has joined #openstack-keystone | 18:18 | |
| rodrigods | dstanek, it worked! so will remove the WIP | 18:18 |
| dstanek | rodrigods: nice, i'll star it a take a look in a bit | 18:19 |
| rodrigods | thanks dstanek | 18:19 |
| dstanek | bknudson: thx ^ :-) | 18:20 |
| bknudson | dstanek: no problem | 18:20 |
| dstanek | i think i get signed out of gerrit about once an hour now | 18:20 |
| rodrigods | that's annoying | 18:21 |
| dstanek | bknudson: i have a few more py3 reviews on their way! | 18:21 |
| bknudson | ok | 18:21 |
| *** jaosorior_away has quit IRC | 18:26 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:28 | |
| *** pcaruana has joined #openstack-keystone | 18:30 | |
| ayoung | bknudson, morgan dstanek are we pretty much agreed that ldap3 is the right library for getting us out of the python ldap 2 trap? Is there another viable option? | 18:32 |
| bknudson | ayoung: I can't think of a better way to do it. | 18:32 |
| dstanek | ayoung: i hope not. i started playing with ldap3 last weekend :-) | 18:32 |
| ayoung | dstanek, good to hear | 18:33 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation assignment driver https://review.openstack.org/291318 | 18:34 |
| dstanek | ayoung: tbh i spent most of the time just playing with it to understand ldap better. this is my reason to really dig in a grok it | 18:34 |
| ayoung | dstanek, I started an etherpad for the Outreachy effort: https://etherpad.openstack.org/p/Keystone-LDAP-Cleanup if you want to contirbute notes. | 18:36 |
| *** gordc has joined #openstack-keystone | 18:44 | |
| *** doug-fish has joined #openstack-keystone | 18:45 | |
| *** doug-fish has quit IRC | 18:45 | |
| *** doug-fish has joined #openstack-keystone | 18:45 | |
| mkoderer___ | jamielennox: if you have a short look again: https://review.openstack.org/#/c/290511/13 hope I addressed your findings | 18:47 |
| patchbot | mkoderer___: patch 290511 - manila - Fix keystone v3 issues for all clients | 18:47 |
| dstanek | ayoung: cool, i'll take a look | 18:48 |
| *** doug-fish has quit IRC | 18:50 | |
| *** doug-fish has joined #openstack-keystone | 18:51 | |
| *** ninag has quit IRC | 18:56 | |
| morgan | ayoung: ID say yes ladp3 us right | 18:58 |
| ayoung | morgan, I'll call that a Quorum then | 18:58 |
| morgan | Is* | 18:59 |
| *** ninag has joined #openstack-keystone | 19:00 | |
| *** ninag has quit IRC | 19:05 | |
| rodrigods | stevemar, dstanek, not used yet with legacy drivers http://logs.openstack.org/01/294201/1/check/gate-keystone-tox-db-legacy_drivers/792e01d/console.html | 19:08 |
| rodrigods | where do i fix this? | 19:09 |
| *** satwant has joined #openstack-keystone | 19:09 | |
| *** ninag has joined #openstack-keystone | 19:10 | |
| morgan | ayoung: also ldap3 is far far far more pythonic. it also eliminates the need for a special library just for the "pool connection" (and i think we get to drop a number of system deps since we aren't building python-ldap). so ++ on it :) | 19:11 |
| dstanek | rodrigods: it's a bit complicated. i didn't realize that change our break backward compat. | 19:12 |
| dstanek | rodrigods: you have to either fix the wrapper or change the fix to be backward compatible | 19:12 |
| rodrigods | dstanek, think it is better to fix the wrapper? | 19:12 |
| dstanek | rodrigods: probably if you can | 19:13 |
| *** fawadkhaliq has quit IRC | 19:13 | |
| rodrigods | dstanek, where is the wrapper? heh | 19:13 |
| rodrigods | dstanek, found it | 19:17 |
| *** atiwari has joined #openstack-keystone | 19:23 | |
| satwant | Hello ayoung I am Satwant Kaur from India I wanted to apply for Outreachy round 12 I am interested in the project Keystone- LDAP Cleanup | 19:23 |
| *** e0ne has quit IRC | 19:24 | |
| ayoung | satwant, excellent. I don't know if there is any formal process, but this is a good start | 19:24 |
| ayoung | satwant, we were discussing it a little earlier: | 19:24 |
| *** atiwari has quit IRC | 19:24 | |
| ayoung | satwant, I started an etherpad for the Outreachy effort: https://etherpad.openstack.org/p/Keystone-LDAP-Cleanup | 19:24 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Add py3 debugging https://review.openstack.org/294245 | 19:24 |
| satwant | ok ayoung | 19:25 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Add py3.4 debugging https://review.openstack.org/294245 | 19:26 |
| satwant | ayoung can i start working with the bugs ? | 19:26 |
| ayoung | satwant Which bugs do you mean? You mean filing bugs? | 19:27 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: WIP - Opportunistic SQL testing https://review.openstack.org/294246 | 19:27 |
| satwant | ayoung i suppose solving bugs in keystone | 19:28 |
| ayoung | satwant, that is the idea. Have you run Keystone before? | 19:28 |
| satwant | ayoung i have setup the development environment | 19:29 |
| ayoung | satwant, excellent. For this stuff, you are going to want an LDAP server to work with, too. | 19:29 |
| satwant | Ok ayoung | 19:29 |
| ayoung | If you look in devstack, there is support for openldap, thanks to topol | 19:29 |
| ayoung | satwant, but I have no idea if it still works. Are you running devstack? | 19:30 |
| satwant | yes ayoung | 19:30 |
| ayoung | satwant, ok, look here: https://github.cohttps://github.com/openstack-dev/devstack/blob/master/lib/ldap | 19:31 |
| ayoung | I am pretty sure the right way to kick that off is by adding the LDAP server to the list of supported services and restarting devstack. You also don't need 90% of the services | 19:31 |
| satwant | ok ayoung i shall do that | 19:32 |
| ayoung | I would recommend runningwith mysql, keystone, glance, and ldap. and Rabbit MQ | 19:32 |
| ayoung | THere mighte be some other docs there too | 19:33 |
| satwant | ayoung how do i add LDAP server to the list of supported services | 19:33 |
| satwant | ? | 19:33 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Add py3 debugging https://review.openstack.org/294245 | 19:33 |
| ayoung | satwant, in the devstack folder there should be a local.conf file. DO you have that? | 19:33 |
| *** gangadhar has quit IRC | 19:33 | |
| satwant | yes | 19:34 |
| ayoung | satwant, the set of services can be determined by the line ENABLED_SERVICES | 19:34 |
| dstanek | ayoung: satwant: you also have to set KEYSTONE_IDENTITY_BACKEND and LDAP_PASSWORD i think | 19:34 |
| ayoung | for example, I have a compute node with | 19:34 |
| ayoung | ENABLED_SERVICES=n-cpu,n-net,n-api-meta,c-vol | 19:34 |
| ayoung | so I think it is | 19:34 |
| * ayoung might still have a copy..checks | 19:34 | |
| dstanek | at least that what i am doing in my ansible role | 19:35 |
| ayoung | ENABLED_SERVICES=key,n-api,n-cpu,n-net,n-cond,n-sch,n-novnc,n-crt,n-cauth,g-api,g-reg,c-sch,c-api,c-vol,horizon,rabbit,tempest,mysql,dstat | 19:35 |
| ayoung | dstanek, you are correct | 19:35 |
| satwant | thanks a lot dstanek | 19:35 |
| ayoung | satwant, you don;t need all of those | 19:35 |
| satwant | ok ayoung what all should i have ? | 19:35 |
| ayoung | ENABLED_SERVICES=key,g-api,g-reg,rabbit,mysql,ldap | 19:36 |
| ayoung | satwant, I'm going to suggest you try that list | 19:36 |
| ayoung | key is keystone, the two g-s are glance, so you have something to test | 19:36 |
| ayoung | rabbit is for notifcation, not really needed, but does not hurt | 19:36 |
| ayoung | and mysql and ldap for backend storage | 19:36 |
| satwant | ok ayoung | 19:37 |
| ayoung | satwant, if that works, please write notes on the etherpad so others can replicate | 19:37 |
| ayoung | write notes if it doesn't work, too | 19:37 |
| *** lhinds_ has quit IRC | 19:37 | |
| satwant | ok ayoung sure | 19:37 |
| satwant | ayoung i restart devstack with ./stack.sh right ? | 19:38 |
| ayoung | satwant, frist unstack.sh | 19:38 |
| ayoung | first | 19:38 |
| *** doug-fish has quit IRC | 19:38 | |
| stevemar | ayoung: will ldap even work any more? with bootstrap being used now? | 19:38 |
| ayoung | stevemar, No idea | 19:40 |
| ayoung | stevemar, if it does not, would that be considered a regression? | 19:40 |
| satwant | ayoung i am trying | 19:40 |
| stevemar | ayoung: i don't think so, it was never tested continuously in devstack or our gate | 19:41 |
| ayoung | stevemar, so, devstack does writable LDAP. I would actually expect that to work. | 19:42 |
| ayoung | the only identity operation is to create a user. Should work with the default domain. | 19:42 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: WIP - Opportunistic SQL testing https://review.openstack.org/294246 | 19:42 |
| knikolla | probably very minor, but should this be renamed to 'valid interface types'? https://github.com/openstack/keystoneauth/blob/f21def70615f079a5791da61cdb0fc6166b47c37/keystoneauth1/access/service_catalog.py#L178 | 19:42 |
| ayoung | satwant, if it does not work, you have your first bug to fix! | 19:42 |
| stevemar | knikolla: yep | 19:43 |
| *** ninag has quit IRC | 19:43 | |
| stevemar | knikolla: fix it up | 19:43 |
| *** timcline has joined #openstack-keystone | 19:43 | |
| dstanek | b 29 | 19:43 |
| andrewbogott | Why does the default keystone policy restrict access to endpoints and services (e.g. "identity:list_endpoints": "admin_required") when any keystone user can get the complete catalog which contains all of the above? Is there some subtle difference I'm missing? | 19:43 |
| dstanek | oops | 19:44 |
| andrewbogott | (interrupting, sorry) | 19:44 |
| rodrigods | dstanek, and the config for the job https://github.com/openstack/manila/blob/master/contrib/ci/post_test_hook.sh | 19:44 |
| stevemar | andrewbogott: you're not interrupting at all | 19:44 |
| rodrigods | keystone ones should be much simpler | 19:44 |
| satwant | ayoung but if it does not work how can i fix that | 19:44 |
| andrewbogott | stevemar: ok :) | 19:44 |
| andrewbogott | I'm about to change my policy to "" for the endpoint and services apis, but wondering if that's some kind of security gaffe | 19:45 |
| stevemar | andrewbogott: let me check the source code... | 19:45 |
| stevemar | andrewbogott: please don't make it "" for the create/delete/update calls :) | 19:46 |
| andrewbogott | ah, yes, just list and get :) | 19:46 |
| *** Krenair has joined #openstack-keystone | 19:47 | |
| stevemar | andrewbogott: so the bits that go in the token are generated from https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L459-L470 | 19:49 |
| stevemar | catalog_api.get_v3_catalog(user_id, project_id) | 19:49 |
| stevemar | which calls ^ | 19:49 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystoneauth: Renamed endpoint to interface in docstring https://review.openstack.org/294260 | 19:50 |
| andrewbogott | stevemar: so the catalog may be restricted based on roles? | 19:50 |
| stevemar | andrewbogott: nah, i think it just formats certain endpoints with the project id | 19:50 |
| andrewbogott | I mean, we may get a subset? | 19:50 |
| stevemar | i don't think so | 19:50 |
| andrewbogott | ok | 19:50 |
| openstackgerrit | Navid Pustchi proposed openstack/keystoneauth: Keystoneauth Authentication Plugin doc typo https://review.openstack.org/294262 | 19:51 |
| stevemar | andrewbogott: only if you are using the endpoint-filter mechanism | 19:51 |
| stevemar | andrewbogott: http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-ep-filter-ext.html | 19:51 |
| stevemar | andrewbogott: but not too many folks are using it, so i doubt that | 19:51 |
| andrewbogott | wow, ok, definitely not using that | 19:51 |
| andrewbogott | but that feature is an argument against changing the official upstream policy.json since it /might/ be filtered | 19:52 |
| ayoung | satwant, lets see what happens first. If it does fail, we'll get a sense of what is broken | 19:52 |
| stevemar | andrewbogott: it definitely muddies the water | 19:52 |
| andrewbogott | stevemar: I'll just change my local policies and not worry about it. | 19:52 |
| stevemar | andrewbogott: sure | 19:53 |
| *** doug-fish has joined #openstack-keystone | 19:53 | |
| Krenair | why do some people use the endpoint-filter mechanism? | 19:58 |
| *** doug-fish has quit IRC | 20:07 | |
| *** rk4n has quit IRC | 20:13 | |
| *** doug-fish has joined #openstack-keystone | 20:13 | |
| *** spzala has quit IRC | 20:16 | |
| *** pcaruana has quit IRC | 20:17 | |
| *** fawadkhaliq has joined #openstack-keystone | 20:19 | |
| *** e0ne has joined #openstack-keystone | 20:21 | |
| stevemar | Krenair: they will create an endpoint/service that only folks with access to a particular project can access | 20:25 |
| stevemar | Krenair: kinda like if something was a beta service | 20:25 |
| *** pcaruana has joined #openstack-keystone | 20:30 | |
| openstackgerrit | Merged openstack/keystone: Enables the notification tests in py3 https://review.openstack.org/280671 | 20:32 |
| *** ninag has joined #openstack-keystone | 20:34 | |
| knikolla | stevemar, say I have a federated scenario where I have IdentityProvider1, ServiceProvider1, and ServiceProvider2. The user makes a SAML assertion and gets a token to SP1 and makes the call, however SP1 needs to make a federated call to SP2 on behalf of the user. | 20:38 |
| knikolla | would the user need to get a token to SP2 and provide it to SP1? | 20:38 |
| *** ametts has joined #openstack-keystone | 20:42 | |
| stevemar | knikolla: oooof | 20:44 |
| stevemar | knikolla: sp1 and sp2 are keystones? | 20:45 |
| stevemar | knikolla: i think you could set it up like that | 20:45 |
| stevemar | basically sp1 will have to act as an idp to sp2 | 20:45 |
| knikolla | stevemar, i wouldn't like to have more than 1 IdP. | 20:47 |
| knikolla | yes. sp1 and sp2 are both keystones. | 20:47 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: WIP - Opportunistic SQL testing https://review.openstack.org/294246 | 20:47 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Cleanup migration tests https://review.openstack.org/294280 | 20:47 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: add placeholder migrations for mitaka https://review.openstack.org/294281 | 20:51 |
| stevemar | bknudson: ayoung ^ | 20:51 |
| stevemar | bknudson: i like SqlUpgradeTests2 | 20:53 |
| stevemar | very good naming convention | 20:53 |
| bknudson | stevemar: it's twice as good. | 20:53 |
| stevemar | evidently | 20:53 |
| bknudson | I'm going to try to switch to using SqlUpgradeTests but it was too confusing have that many tests failing already | 20:53 |
| *** spzala has joined #openstack-keystone | 20:54 | |
| *** trown is now known as trown|PTO | 20:54 | |
| bknudson | will be interesting to see if those new tests are run by the gate since I think they make the DB available for us. | 20:54 |
| stevemar | bknudson: yeah, thanks to ajaeger and his work there | 20:55 |
| *** spzala has quit IRC | 20:55 | |
| bknudson | git rm keystone/tests/unit/test_sql_livetest.py | 20:55 |
| stevemar | pretty much | 20:55 |
| navidp | stevemar, I think some of the auth plugins are not included in this doc and needs to be updated, what do you think? | 20:57 |
| navidp | stevemar, http://docs.openstack.org/developer/keystoneauth/authentication-plugins.html | 20:57 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Add py3 debugging https://review.openstack.org/294245 | 20:58 |
| navidp | stevemar, and if there is a need for a doc to explain loading plugin? | 20:58 |
| stevemar | navidp: you're better off asking jamielennox, but in general the more docs the better... | 20:58 |
| navidp | stevemar, ok sure | 20:58 |
| stevemar | navidp: there is a mention of loading here: http://docs.openstack.org/developer/keystoneauth/authentication-plugins.html#loading-plugins-by-name | 20:59 |
| jamielennox | navidp: a bunch of plugins are not in the doc, there was talk about a sphinx plugin from dhellmann that would let us go through the plugins registered in setup.cfg and document them all at once | 20:59 |
| jamielennox | i don't know how far that got | 20:59 |
| *** fawadkhaliq has quit IRC | 21:00 | |
| jamielennox | i'd love to put some sort of table together as to which plugins take which options | 21:00 |
| jamielennox | along side their entrypoint name, rather than the class name as it is now | 21:00 |
| bknudson | several oslo projects are documenting their plugins using the sphinx thing | 21:02 |
| stevemar | jamielennox: we use the sphinx thing in osc | 21:03 |
| stevemar | http://docs.openstack.org/developer/python-openstackclient/plugin-commands.html | 21:03 |
| stevemar | it's not very pretty though | 21:03 |
| jamielennox | stevemar, bknudson: yep, i had heard it was being used but i hadn't done it | 21:03 |
| *** spandhe has quit IRC | 21:04 | |
| *** e0ne has quit IRC | 21:04 | |
| navidp | stevemar bknudson jamielennox, do you agree on doc about plugins loading in ksa? | 21:07 |
| bknudson | all the behavior of ksa should be documented. | 21:07 |
| navidp | bknudson, ok then | 21:09 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Add `patch_cover` to keystone https://review.openstack.org/294189 | 21:12 |
| jamielennox | ++ | 21:12 |
| *** spandhe has joined #openstack-keystone | 21:15 | |
| *** fawadkhaliq has joined #openstack-keystone | 21:15 | |
| morgan | gyee should totally get a bouncer. | 21:18 |
| *** knikolla has quit IRC | 21:20 | |
| *** timcline has quit IRC | 21:23 | |
| *** timcline has joined #openstack-keystone | 21:24 | |
| *** gordc has quit IRC | 21:25 | |
| stevemar | morgan: yes he should | 21:27 |
| *** timcline has quit IRC | 21:28 | |
| *** sdake has quit IRC | 21:28 | |
| *** Krenair has left #openstack-keystone | 21:29 | |
| *** lhcheng has joined #openstack-keystone | 21:30 | |
| *** ChanServ sets mode: +v lhcheng | 21:30 | |
| *** satwant has quit IRC | 21:30 | |
| *** sdake has joined #openstack-keystone | 21:31 | |
| *** lhcheng_ has quit IRC | 21:33 | |
| *** pauloewerton has quit IRC | 21:34 | |
| *** doug-fish has quit IRC | 21:35 | |
| bjornar | pip3 complaints here about Routes!=2.0,!=2.1,>=1.12.3;python_version=='2.7' | 21:39 |
| *** doug-fis_ has joined #openstack-keystone | 21:40 | |
| *** ninag has quit IRC | 21:44 | |
| *** sdake has quit IRC | 21:45 | |
| *** doug-fis_ has quit IRC | 21:45 | |
| *** doug-fish has joined #openstack-keystone | 21:45 | |
| *** fawadkhaliq has quit IRC | 21:46 | |
| openstackgerrit | Merged openstack/keystoneauth: Renamed endpoint to interface in docstring https://review.openstack.org/294260 | 21:49 |
| *** raildo is now known as raildo-afk | 21:49 | |
| *** doug-fish has quit IRC | 21:50 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Update dev docs and sample script for v3/bootstrap https://review.openstack.org/290897 | 21:55 |
| *** doug-fish has joined #openstack-keystone | 21:56 | |
| *** fawadkhaliq has joined #openstack-keystone | 21:57 | |
| *** dims has quit IRC | 22:01 | |
| *** dims_ has joined #openstack-keystone | 22:01 | |
| *** zqfan has quit IRC | 22:02 | |
| *** nkinder has quit IRC | 22:04 | |
| openstackgerrit | Merged openstack/keystoneauth: Keystoneauth Authentication Plugin doc typo https://review.openstack.org/294262 | 22:04 |
| *** fawadkhaliq has quit IRC | 22:04 | |
| *** nkinder has joined #openstack-keystone | 22:04 | |
| *** mylu has joined #openstack-keystone | 22:04 | |
| *** fawadkhaliq has joined #openstack-keystone | 22:04 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move project name validation out of the driver https://review.openstack.org/294305 | 22:05 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move project name validation out of the driver https://review.openstack.org/294305 | 22:06 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move project name validation out of the driver https://review.openstack.org/294305 | 22:07 |
| *** csoukup has quit IRC | 22:08 | |
| *** csoukup has joined #openstack-keystone | 22:10 | |
| *** ametts has quit IRC | 22:14 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Change EMPHEMERAL user type to FEDERATED https://review.openstack.org/293071 | 22:16 |
| *** woodster_ has joined #openstack-keystone | 22:20 | |
| *** dims has joined #openstack-keystone | 22:23 | |
| *** dims_ has quit IRC | 22:26 | |
| *** mylu has quit IRC | 22:27 | |
| *** jasonsb has joined #openstack-keystone | 22:36 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:40 | |
| *** mylu has joined #openstack-keystone | 22:47 | |
| *** itlinux has joined #openstack-keystone | 22:49 | |
| *** slberger1 has left #openstack-keystone | 22:54 | |
| *** tqtran is now known as tqtran-afk | 22:54 | |
| *** csoukup has quit IRC | 22:57 | |
| *** tqtran-afk has quit IRC | 23:01 | |
| *** aimeeU has quit IRC | 23:07 | |
| *** dims has quit IRC | 23:08 | |
| *** pushkaru has quit IRC | 23:09 | |
| *** itlinux has quit IRC | 23:15 | |
| *** furface_ has joined #openstack-keystone | 23:15 | |
| *** furface has quit IRC | 23:16 | |
| *** pushkaru has joined #openstack-keystone | 23:19 | |
| *** jasonsb has quit IRC | 23:22 | |
| *** mylu has quit IRC | 23:22 | |
| *** sdake has joined #openstack-keystone | 23:24 | |
| *** mylu has joined #openstack-keystone | 23:24 | |
| *** dims has joined #openstack-keystone | 23:28 | |
| *** fawadkhaliq has quit IRC | 23:31 | |
| *** fawadk has joined #openstack-keystone | 23:31 | |
| *** pushkaru has quit IRC | 23:32 | |
| *** dims has quit IRC | 23:32 | |
| *** Trident has quit IRC | 23:40 | |
| *** Trident has joined #openstack-keystone | 23:40 | |
| *** alex_xu has quit IRC | 23:41 | |
| *** roxanaghe has quit IRC | 23:44 | |
| *** alex_xu has joined #openstack-keystone | 23:50 | |
| *** mylu has quit IRC | 23:54 | |
| *** markvoelker has quit IRC | 23:54 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!