| jamielennox | it won't give you the password plugin opts, it will just restore admin_user etc | 00:00 |
|---|---|---|
| zigo | Ah, that I got it already with my (probably more ugly) patch. | 00:00 |
| zigo | I'd like to really have *all* options if possible. | 00:00 |
| zigo | And especially the new ones for v3password. | 00:01 |
| zigo | These, I don't know how to have them. :( | 00:01 |
| jamielennox | so you would have to edit the values returned in that list | 00:03 |
| zigo | jamielennox: Don't you think it would make sense to have the v3password options showing by default? | 00:03 |
| zigo | That's what we want our users to switch to, no? | 00:03 |
| jamielennox | zigo: maybe - but is it confusing if they are there and people haven't set auth_type = v3password | 00:03 |
| jamielennox | zigo: probably just password - it abstracts v2/v3 | 00:04 |
| jamielennox | if we have auth_type unset and people see username and password etc options then they change all those values and then wonder why they don't work | 00:04 |
| zigo | Well, can't we set v3password as the default value? | 00:04 |
| zigo | I'd vote for it... | 00:05 |
| jamielennox | zigo: this comes full circle because that would break everyone that hasn't set an auth_type already - which is why we are getting more agressive deprecating the old options | 00:06 |
| zigo | Hum... | 00:07 |
| zigo | I see. | 00:08 |
| zigo | I'll think about it! :P | 00:08 |
| jamielennox | zigo: yea, i completely agree with everything - i'd love to have an easy way to define all this but we're in a bit of a bind | 00:08 |
| zigo | Though what we have right now is really not satisfying at all, that's for sure. | 00:08 |
| zigo | oh, and yes, what neutron does creates a *very* confusing result, I can agree with that. | 00:09 |
| zigo | It took me a while to understand what to do. | 00:09 |
| jamielennox | zigo: this has been the problem with auth plugins all along, they're very flexible but it leaves you less of an obvious default | 00:10 |
| jamielennox | what i did build in originally that has never really been used is auth_sections | 00:10 |
| jamielennox | this was the best we could come up with for doc as well | 00:11 |
| zigo | BTW, is everyone (ie: all services) already compatible with v3password auth? | 00:11 |
| jamielennox | zigo: they should be, particularly if it's a plugin they won't notice the difference | 00:11 |
| jamielennox | zigo: for auth_token everyone is | 00:11 |
| zigo | Ok. | 00:12 |
| jamielennox | because we control that | 00:12 |
| zigo | Thanks a lot for all the explanations. | 00:12 |
| jamielennox | zigo: no problem - if you can come up with a good solution i'd love to hear it | 00:12 |
| jamielennox | i think auth_section is the best we can do | 00:13 |
| zigo | jamielennox: I need to sleep on it, and think about it tomorrow when my CI runs successfully again! :) | 00:13 |
| zigo | I do like the idea, though we got to provide some working by default auth_section stuff. | 00:13 |
| zigo | I could add them manually at the packaging level too though... | 00:13 |
| jamielennox | right, it would at least let you have a section like [keystonepassword] that you could auto fill with defaults | 00:13 |
| zigo | [auth_section_v3password] | 00:14 |
| zigo | Something like that ... | 00:14 |
| jamielennox | and then it becomes obvious in auth_token when you say auth_section = keystonepassword | 00:14 |
| jamielennox | that you are actually opting it to that type of auth | 00:14 |
| zigo | Right. | 00:14 |
| jamielennox | obviously not perfect, but ... | 00:15 |
| *** tqtran has quit IRC | 00:15 | |
| jamielennox | oo, i broke the gate again overnight :) | 00:15 |
| *** spandhe_ has quit IRC | 00:15 | |
| *** pushkaru has quit IRC | 00:16 | |
| jamielennox | this is why devstack won't merge my stuff | 00:16 |
| zigo | :) | 00:17 |
| *** spandhe has joined #openstack-keystone | 00:17 | |
| zigo | If you never break the gate overnight, then you aren't really contributing upstream ! :) | 00:17 |
| jamielennox | zigo: at least my overnight is everyone else's daytime | 00:18 |
| zigo | jamielennox: Where do you live? | 00:19 |
| jamielennox | zigo: sydney, austrlaia | 00:19 |
| zigo | New zealand? | 00:19 |
| jamielennox | zigo: sydney, australia | 00:19 |
| zigo | Ah... close ! :) | 00:19 |
| *** spandhe has quit IRC | 00:19 | |
| jamielennox | zigo: don't let them hear you say that | 00:19 |
| *** henrynash has quit IRC | 00:19 | |
| jamielennox | it's like being confused for canadian | 00:19 |
| zigo | jamielennox: I moved from China a year ago, I know what it feels like: they will never be able to get ahead of us! :P | 00:20 |
| zigo | jamielennox: Anyway, I shall go sleep now, bye and thanks again. | 00:22 |
| jamielennox | zigo: no problem - talk to you later | 00:22 |
| *** pushkaru has joined #openstack-keystone | 00:25 | |
| stevemar | jamielennox: you broke the gate? | 00:30 |
| jamielennox | stevemar: devstack patch to remove /v2.0 from keystone endpoint | 00:30 |
| stevemar | https://review.openstack.org/#/c/285879/ | 00:31 |
| patchbot | stevemar: patch 285879 - openstack-dev/devstack - Use unversioned keystone endpoints (MERGED) | 00:31 |
| stevemar | i didn't realize there was fall out | 00:31 |
| *** furface has quit IRC | 00:31 | |
| jamielennox | stevemar: https://review.openstack.org/#/c/302449/ | 00:32 |
| patchbot | jamielennox: patch 302449 - openstack-dev/devstack - Revert "Use unversioned keystone endpoints" (MERGED) | 00:32 |
| stevemar | womp womp | 00:32 |
| *** furface has joined #openstack-keystone | 00:32 | |
| jamielennox | i don't know exactly what, but the tempest fix it depends-on is not in a released version | 00:32 |
| *** pushkaru has quit IRC | 00:32 | |
| jamielennox | which is admittedly not good - but tempest is installed from source so i don't know why it was a problem | 00:32 |
| stevemar | ohhh | 00:32 |
| stevemar | thats a bit weird | 00:33 |
| stevemar | unfortunate | 00:34 |
| jamielennox | based on comments they seem willing to redo it after a tempest release and version bump | 00:37 |
| jamielennox | but it doesn't help my case on getting devstack things merged ) | 00:37 |
| jamielennox | :0 | 00:37 |
| jamielennox | gah - :) | 00:37 |
| jamielennox | https://review.openstack.org/#/c/302480/1 | 00:37 |
| patchbot | jamielennox: patch 302480 - openstack-dev/devstack - Revert "Revert "Use unversioned keystone endpoints"" | 00:37 |
| *** furface has quit IRC | 00:38 | |
| *** jrist has quit IRC | 00:39 | |
| *** furface has joined #openstack-keystone | 00:39 | |
| mtreinish | jamielennox: I would have just pushed a release today to unblock things | 00:40 |
| *** lhcheng has quit IRC | 00:40 | |
| mtreinish | but with the mitaka release tomorrowish it didn't make sense | 00:41 |
| jamielennox | mtreinish: yea - people get funny about gate stuff, there are already 2 +2s on the revert revert so it's not a big deal | 00:41 |
| jamielennox | it was always supposed to wait till newton | 00:41 |
| *** jrist has joined #openstack-keystone | 00:42 | |
| *** browne has quit IRC | 00:47 | |
| *** dave-mcc_ has quit IRC | 00:51 | |
| *** spandhe has joined #openstack-keystone | 00:53 | |
| *** dave-mccowan has joined #openstack-keystone | 00:54 | |
| *** harlowja has quit IRC | 01:00 | |
| *** dan_nguyen has quit IRC | 01:02 | |
| *** dave-mccowan has quit IRC | 01:03 | |
| *** harlowja has joined #openstack-keystone | 01:03 | |
| dims | mtreinish : thanks for holding off :) | 01:08 |
| *** diazjf has joined #openstack-keystone | 01:08 | |
| dims | jamielennox : all sorted out with zigo? :) | 01:08 |
| jamielennox | dims: i think enough for now, there isn't a great solution so at least he is aware of the problem and can try and work something out from there | 01:09 |
| dims | right thanks. | 01:09 |
| dims | just making sure we are on for release tomorrow :) | 01:09 |
| *** agrebennikov has joined #openstack-keystone | 01:10 | |
| *** tqtran has joined #openstack-keystone | 01:11 | |
| *** diazjf has quit IRC | 01:12 | |
| *** tqtran has quit IRC | 01:16 | |
| *** agrebennikov has quit IRC | 01:20 | |
| *** sdake has quit IRC | 01:28 | |
| *** EinstCrazy has joined #openstack-keystone | 01:29 | |
| *** sdake has joined #openstack-keystone | 01:32 | |
| *** agrebennikov has joined #openstack-keystone | 01:32 | |
| *** stingaci has joined #openstack-keystone | 01:34 | |
| *** stingaci has quit IRC | 01:51 | |
| *** stingaci has joined #openstack-keystone | 01:51 | |
| *** zqfan has joined #openstack-keystone | 01:54 | |
| *** stingaci has quit IRC | 02:07 | |
| ayoung | jamielennox, so...I think I merged @controller.filterprotected into @controller.protected . tox running now. | 02:15 |
| *** browne has joined #openstack-keystone | 02:16 | |
| jamielennox | ayoung: that's going to be fun to review | 02:17 |
| jamielennox | ayoung: i always thought the decorator there was the wrong approach | 02:17 |
| jamielennox | it's too complex | 02:17 |
| jamielennox | you have to have the resource available to do any enforcement on it | 02:17 |
| ayoung | jamielennox, well it certainly is not simpler merged | 02:17 |
| jamielennox | it should just be a method call, | 02:18 |
| jamielennox | i did that when i attempted pecan, and then had a flag on the request object (cause it was thread local) to say it had had policy applied to make sure we didn't do anything dumb | 02:18 |
| ayoung | jamielennox, this is just a step | 02:18 |
| jamielennox | that's still the best way i can think of doing it, current system is way too complex + magic | 02:18 |
| ayoung | at least it is a single decorator | 02:19 |
| ayoung | trying to get the guts out of that function | 02:19 |
| ayoung | so the decorator can go away | 02:19 |
| *** sdake_ has joined #openstack-keystone | 02:20 | |
| jamielennox | it's a fun one | 02:20 |
| *** sdake has quit IRC | 02:22 | |
| *** richm has quit IRC | 02:33 | |
| *** EinstCrazy has quit IRC | 02:35 | |
| *** lhcheng has joined #openstack-keystone | 02:35 | |
| *** ChanServ sets mode: +v lhcheng | 02:35 | |
| *** EinstCrazy has joined #openstack-keystone | 02:36 | |
| *** edmondsw has quit IRC | 02:36 | |
| *** agrebennikov has quit IRC | 02:41 | |
| openstackgerrit | ayoung proposed openstack/keystone: enforcement logic refactored https://review.openstack.org/279263 | 02:52 |
| ayoung | samueldmq, ^^ there ya go. HOw many lines did I make it? | 02:52 |
| ayoung | Stell a net loss! | 02:53 |
| stevemar | ayoung: by 6 ;) | 02:57 |
| ayoung | stevemar, yeah, it is mostly reshuffling, but the logic between the two decorators was so duplicated | 02:57 |
| ayoung | stevemar, the reason I wanted that one cleaned up is that I want to get the policy enforcement extractable, and possibly into the middleware so that the logic is roughly the same everywhere. But we have this wonky approach to fetching resrouces from the Database that won't work for the other services | 02:59 |
| *** openstackstatus has quit IRC | 03:01 | |
| stevemar | oh i do like the re-written form: @controller.protected(filters=['domain_id', 'enabled', 'name']) | 03:05 |
| *** sdake_ has quit IRC | 03:06 | |
| stevemar | ayoung: one issue | 03:06 |
| *** jasonsb has joined #openstack-keystone | 03:06 | |
| *** sdake has joined #openstack-keystone | 03:07 | |
| ayoung | stevemar, yeah? | 03:11 |
| openstackgerrit | ayoung proposed openstack/keystone: enforcement logic refactored https://review.openstack.org/279263 | 03:13 |
| *** sdake has quit IRC | 03:17 | |
| *** sdake has joined #openstack-keystone | 03:18 | |
| *** sdake has quit IRC | 03:28 | |
| *** lhcheng has quit IRC | 03:39 | |
| *** sheel has joined #openstack-keystone | 03:41 | |
| *** mylu has quit IRC | 03:45 | |
| *** Daviey has quit IRC | 03:50 | |
| *** Daviey has joined #openstack-keystone | 03:50 | |
| *** sekrit has quit IRC | 03:51 | |
| *** dave-mccowan has joined #openstack-keystone | 03:57 | |
| *** dave-mcc_ has joined #openstack-keystone | 03:58 | |
| *** dave-mccowan has quit IRC | 04:01 | |
| *** mylu has joined #openstack-keystone | 04:02 | |
| *** lhcheng has joined #openstack-keystone | 04:03 | |
| *** ChanServ sets mode: +v lhcheng | 04:03 | |
| *** sekrit has joined #openstack-keystone | 04:05 | |
| *** links has joined #openstack-keystone | 04:12 | |
| *** shoutm has joined #openstack-keystone | 04:15 | |
| *** Nirupama has joined #openstack-keystone | 04:28 | |
| *** dflorea has joined #openstack-keystone | 04:44 | |
| *** mylu has quit IRC | 04:45 | |
| *** GB21 has joined #openstack-keystone | 05:00 | |
| *** shoutm_ has joined #openstack-keystone | 05:00 | |
| *** shoutm has quit IRC | 05:03 | |
| *** jaosorior has joined #openstack-keystone | 05:13 | |
| *** ankur has quit IRC | 05:21 | |
| *** dflorea_ has joined #openstack-keystone | 05:26 | |
| *** dflorea has quit IRC | 05:28 | |
| *** shoutm_ has quit IRC | 05:36 | |
| *** shoutm has joined #openstack-keystone | 05:39 | |
| *** rcernin has joined #openstack-keystone | 05:45 | |
| *** dflorea_ has quit IRC | 06:07 | |
| *** GB21 has quit IRC | 06:12 | |
| *** GB21 has joined #openstack-keystone | 06:12 | |
| stevemar | jamielennox: around? | 06:16 |
| *** henrynash has joined #openstack-keystone | 06:16 | |
| *** ChanServ sets mode: +v henrynash | 06:16 | |
| jamielennox | stevemar: maybe | 06:16 |
| stevemar | jamielennox: question about kerberos | 06:17 |
| stevemar | jamielennox: why is there no entrypoint for it here: https://github.com/openstack/keystoneauth/blob/master/setup.cfg ? | 06:17 |
| jamielennox | nope - not here | 06:17 |
| stevemar | :) | 06:17 |
| jamielennox | stevemar: umm, i'm guessing it got forgotten? | 06:17 |
| stevemar | how can i use kerberos via osc with auth type? | 06:18 |
| jamielennox | though that's weird | 06:18 |
| stevemar | is it because it's under "extras"? | 06:18 |
| jamielennox | extras is just the things installed with keystoneauth[extras] | 06:19 |
| jamielennox | extras is just the things installed with keystoneauth[kerberos] | 06:19 |
| stevemar | yep | 06:19 |
| jamielennox | so same thing the saml plugin isn't there | 06:19 |
| stevemar | but i'm wondering if it being optional is why we didn't create an entrypoint for it | 06:19 |
| stevemar | so, hows it supposed to be used? | 06:19 |
| jamielennox | hmm | 06:19 |
| stevemar | if you can't load the options | 06:20 |
| jamielennox | stevemar: it could be a problem | 06:20 |
| jamielennox | https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/extras/kerberos.py#L25 | 06:20 |
| stevemar | jamielennox: even here we advertise it: https://github.com/openstack/python-keystoneclient-kerberos/blob/master/setup.cfg#L25 | 06:20 |
| jamielennox | requests_kerberos is imported at the top of the file | 06:20 |
| stevemar | jamielennox: yes it is | 06:21 |
| jamielennox | so if you were to iterate plugins, like how OSC does for example, then having an entrypoint would fali | 06:21 |
| jamielennox | on the other hand, if you don't have an entry point there's just no way to use it via --os-auth-type | 06:21 |
| stevemar | jamielennox: we could try/except that | 06:21 |
| stevemar | right | 06:21 |
| jamielennox | stevemar: could, but i think it should be a plugin thing | 06:21 |
| jamielennox | stevemar: ok, that's bad | 06:22 |
| jamielennox | stevemar: actually, there's no loader for it at all | 06:23 |
| stevemar | why no loader? | 06:24 |
| jamielennox | i've no idea | 06:24 |
| jamielennox | so the saml2 one never got made public | 06:25 |
| jamielennox | i remember that because marek and i were arguing about how something would work | 06:25 |
| jamielennox | https://github.com/openstack/keystoneauth/tree/master/keystoneauth1/extras | 06:25 |
| *** pcaruana has joined #openstack-keystone | 06:26 | |
| *** GB21 has quit IRC | 06:26 | |
| stevemar | seems like something we should resolve soon :\ | 06:27 |
| jamielennox | stevemar: so, it needs a loader to make it work, and we should fix it, but i haven't tested kerberos since i left redhat | 06:28 |
| jamielennox | we should probably ping ayoung and see if he's using the keystoneauth version or the keystoneclient one | 06:28 |
| *** GB21 has joined #openstack-keystone | 06:28 | |
| stevemar | thats not unsurprising :P | 06:28 |
| stevemar | probably keystoneclient one, since the ksa can't be loaded :) | 06:28 |
| jamielennox | stevemar: that would be my guess | 06:28 |
| stevemar | okay, someone emailed me about this lately, asking if he should open a bug | 06:29 |
| stevemar | i'll tell him to do so | 06:29 |
| jamielennox | yep | 06:29 |
| stevemar | jamielennox: i'll ask morgan to chime in, ksa is his baby too | 06:30 |
| stevemar | jamielennox: i wonder if this will be helpful: http://www.jamielennox.net/blog/2015/02/12/step-by-step-kerberized-keystone/ :) | 06:31 |
| jamielennox | stevemar: everyone's a comedian | 06:31 |
| stevemar | jamielennox: <3 | 06:31 |
| jamielennox | stevemar: but we had full on kerberized deployment scripts that included using auth_token middleware with kerberos auth - that's been ksa for a while now | 06:32 |
| jamielennox | maybe they just haven't been run for a while | 06:32 |
| * stevemar shrugs | 06:32 | |
| stevemar | better poke at people with red hats -- nkinder ayoung | 06:33 |
| stevemar | off to bed, time to make the summit schedule tomorrow | 06:33 |
| *** henrynash has quit IRC | 06:39 | |
| *** tqtran has joined #openstack-keystone | 06:43 | |
| *** GB21 has quit IRC | 06:44 | |
| *** GB21 has joined #openstack-keystone | 06:44 | |
| *** tesseract has joined #openstack-keystone | 06:45 | |
| *** tesseract is now known as Guest12876 | 06:45 | |
| *** tqtran has quit IRC | 06:47 | |
| *** GB21 has quit IRC | 06:51 | |
| *** GB21 has joined #openstack-keystone | 06:54 | |
| *** woodster_ has quit IRC | 06:57 | |
| *** spandhe has quit IRC | 06:59 | |
| *** EinstCra_ has joined #openstack-keystone | 06:59 | |
| *** GB21 has quit IRC | 07:02 | |
| *** EinstCrazy has quit IRC | 07:02 | |
| *** GB21 has joined #openstack-keystone | 07:03 | |
| *** dave-mcc_ has quit IRC | 07:09 | |
| *** GB21 has quit IRC | 07:16 | |
| *** fhubik has joined #openstack-keystone | 07:23 | |
| *** GB21 has joined #openstack-keystone | 07:29 | |
| *** daemontool has joined #openstack-keystone | 07:32 | |
| *** GB21 has quit IRC | 07:37 | |
| *** jamielennox is now known as jamielennox|away | 07:45 | |
| *** lhcheng has quit IRC | 07:45 | |
| *** browne has quit IRC | 07:47 | |
| *** jaosorior has quit IRC | 07:47 | |
| *** jaosorior has joined #openstack-keystone | 07:47 | |
| *** henrynash has joined #openstack-keystone | 08:07 | |
| *** ChanServ sets mode: +v henrynash | 08:07 | |
| *** pnavarro has joined #openstack-keystone | 08:07 | |
| *** nkinder has quit IRC | 08:08 | |
| *** pnavarro has quit IRC | 08:13 | |
| *** nkinder has joined #openstack-keystone | 08:21 | |
| *** GB21 has joined #openstack-keystone | 08:26 | |
| *** openstackstatus has joined #openstack-keystone | 08:29 | |
| *** ChanServ sets mode: +v openstackstatus | 08:29 | |
| *** jistr has joined #openstack-keystone | 08:30 | |
| -openstackstatus- NOTICE: jobs depending on npm are now working again | 08:33 | |
| *** daemontool has quit IRC | 08:41 | |
| *** shoutm_ has joined #openstack-keystone | 08:43 | |
| *** shoutm has quit IRC | 08:46 | |
| *** e0ne has joined #openstack-keystone | 08:50 | |
| *** EinstCra_ is now known as EinstCrazy | 08:51 | |
| *** jaosorior has quit IRC | 08:59 | |
| *** jaosorior has joined #openstack-keystone | 09:00 | |
| *** fhubik has quit IRC | 09:07 | |
| *** fhubik has joined #openstack-keystone | 09:24 | |
| *** links has quit IRC | 09:31 | |
| *** alex_xu has quit IRC | 09:32 | |
| *** alex_xu has joined #openstack-keystone | 09:36 | |
| *** mvk has joined #openstack-keystone | 09:41 | |
| *** shoutm_ has quit IRC | 09:43 | |
| *** mkrcmari__ has quit IRC | 09:43 | |
| *** links has joined #openstack-keystone | 09:44 | |
| *** mvk_ has joined #openstack-keystone | 09:49 | |
| *** mvk has quit IRC | 09:53 | |
| *** mhickey has joined #openstack-keystone | 09:54 | |
| *** akanksha_ has joined #openstack-keystone | 10:01 | |
| *** shoutm has joined #openstack-keystone | 10:12 | |
| *** daemontool has joined #openstack-keystone | 10:22 | |
| *** GB21 has quit IRC | 10:28 | |
| *** EinstCrazy has quit IRC | 10:30 | |
| *** GB21 has joined #openstack-keystone | 10:31 | |
| *** fhubik has quit IRC | 10:34 | |
| *** mhickey has quit IRC | 10:35 | |
| *** links has quit IRC | 10:39 | |
| *** Guest12876 is now known as tesseract | 10:47 | |
| *** mvk_ has quit IRC | 10:47 | |
| *** tesseract is now known as Guest74036 | 10:48 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/300626 | 10:48 |
| *** GB21 has quit IRC | 10:49 | |
| *** mhickey has joined #openstack-keystone | 10:50 | |
| *** GB21 has joined #openstack-keystone | 10:50 | |
| *** alex_xu has quit IRC | 10:55 | |
| *** links has joined #openstack-keystone | 10:56 | |
| *** alex_xu has joined #openstack-keystone | 10:57 | |
| *** shoutm has quit IRC | 11:02 | |
| *** henrynash has quit IRC | 11:13 | |
| *** mvk_ has joined #openstack-keystone | 11:16 | |
| DinaBelova | morgan dims - I've rechecked the authtoken middleware caching on Mitaka - so yes, that was affected by the same sporadic connection issue -> marking https://bugs.launchpad.net/keystone/+bug/1566857 as invalid | 11:16 |
| openstack | Launchpad bug 1566857 in OpenStack Identity (keystone) "Keystone authtoken middleware seems to work wrong with memcached cache" [Undecided,Invalid] | 11:16 |
| DinaBelova | morgan dims although I face local cache behaviour I do not expect :( All memoized (cached) values are got from the Memcache on my env - no local context cache is used. Technically I'm tracking if I reach https://github.com/openstack/keystone/blob/master/keystone/common/cache/_context_cache.py#L78-L80 - I'm adding these operations profiling to the trace - and I should jump here if local cache is used, but I see nothing :( | 11:21 |
| DinaBelova | morgan please take a look if you'll have a moment today | 11:21 |
| *** GB21 has quit IRC | 11:21 | |
| dims | DinaBelova : thanks for the update | 11:29 |
| *** ksnihyr has joined #openstack-keystone | 11:32 | |
| ksnihyr | Hi, all ! Can someone help me to work with keystonemiddleware ? I want to retrieve service catalog from request to my api. I find this way: parse X-Service-Catalog header. It`s true way, or better exists ? | 11:36 |
| *** alex_xu has quit IRC | 11:41 | |
| *** jhesketh has joined #openstack-keystone | 11:43 | |
| *** alex_xu has joined #openstack-keystone | 11:43 | |
| *** ChanServ changes topic to "mitaka-3 done, no more features (you missed your chance) until Newton | Tag bugs as rc-potential - fix more bugs! | https://launchpad.net/keystone/+milestone/mitaka-rc1" | 11:44 | |
| *** shoutm has joined #openstack-keystone | 11:44 | |
| *** GB21 has joined #openstack-keystone | 11:52 | |
| *** gordc has joined #openstack-keystone | 11:55 | |
| *** trown|outtypewww is now known as trown | 12:04 | |
| *** EinstCrazy has joined #openstack-keystone | 12:06 | |
| *** jhesketh has quit IRC | 12:07 | |
| *** jhesketh has joined #openstack-keystone | 12:07 | |
| *** GB21 has quit IRC | 12:16 | |
| *** raildo-afk is now known as raildo | 12:18 | |
| *** edmondsw has joined #openstack-keystone | 12:23 | |
| *** doug-fish has joined #openstack-keystone | 12:26 | |
| morgan | DinaBelova: I would need to see the trace point you're adding. I know that the local cache works when enabled, but remember it only is used if that specific http request makes the same call twice. | 12:32 |
| morgan | DinaBelova: and what request you are using to test it | 12:32 |
| DinaBelova | morgan - sure - I've create https://bugs.launchpad.net/keystone/+bug/1567403 just to share the information. I used server create for testing - the html is attached to the bug. i was wrapping https://github.com/openstack/keystone/blob/master/keystone/common/cache/_context_cache.py#L78-L80 to see if it was called | 12:34 |
| openstack | Launchpad bug 1567403 in OpenStack Identity (keystone) "Local context cache seems to work unproperly" [Undecided,New] | 12:34 |
| DinaBelova | I can see that get_domain function was called twice per Keystone API call | 12:34 |
| DinaBelova | and both times it went to Memcached | 12:35 |
| morgan | Also be very careful about wrapping the cache stuff | 12:35 |
| DinaBelova | morgan - sure, for Memcache I was checking that https://bitbucket.org/zzzeek/dogpile.cache/src/c6913eb143b24b4a886124ff0da5c935ea34e3ac/dogpile/cache/region.py?at=master&fileviewer=file-view-default#region.py-617 was called | 12:35 |
| ayoung | stevemar, so last I tested this was last summer. export OS_AUTH_TYPE=v3fedkerb | 12:35 |
| DinaBelova | to say that "it was value got from memcache" | 12:36 |
| DinaBelova | morgan - if nothing was found in memcache NeedRegenerationException will be raised and then gen_value() truggered | 12:36 |
| morgan | How are you hooking into these things? Monkey patching? | 12:36 |
| morgan | Because you're examining some stuff pretty deep in the stack | 12:37 |
| DinaBelova | I'm wrapping these lines with profiler.Trace() - https://github.com/openstack/osprofiler/blob/master/osprofiler/profiler.py#L313 | 12:38 |
| DinaBelova | that is fact sends notification on entering and notification on exit | 12:38 |
| DinaBelova | with info about parent point in the tree, timestamp, etc. | 12:38 |
| morgan | How do you wrap the dogpile region line? | 12:39 |
| DinaBelova | I have several stuff added | 12:39 |
| DinaBelova | one moment | 12:39 |
| morgan | Ok | 12:39 |
| *** shoutm has quit IRC | 12:39 | |
| *** Nirupama has quit IRC | 12:39 | |
| DinaBelova | morgan http://paste.openstack.org/show/493313/ | 12:41 |
| morgan | So you are monkey patching it basically? | 12:42 |
| *** doug-fish has quit IRC | 12:42 | |
| morgan | Supplying your own gen_value? | 12:42 |
| DinaBelova | as fn_info_tuple I use info passed from cache_on_arguments | 12:42 |
| DinaBelova | it's not my own, I just wrap the line where self.backend.set(key, value) is called | 12:42 |
| DinaBelova | and that's it | 12:42 |
| *** doug-fish has joined #openstack-keystone | 12:42 | |
| DinaBelova | morgan yes | 12:43 |
| morgan | Do NOT do that | 12:43 |
| morgan | Don't monkey patch libraries | 12:43 |
| DinaBelova | morgan I need this to see if the memcahce was really called in the trace | 12:43 |
| morgan | Sorry no | 12:43 |
| morgan | I mean I won't let that land | 12:44 |
| DinaBelova | I'm not proposing to land it | 12:44 |
| morgan | Let me explain. Sec | 12:44 |
| morgan | OK. | 12:44 |
| DinaBelova | it's just for debug purposes | 12:44 |
| morgan | Phew! | 12:44 |
| morgan | Sorry, you can see why I was worried then ^_^ | 12:44 |
| DinaBelova | :D | 12:44 |
| DinaBelova | morgan I'm not crazy :D | 12:45 |
| DinaBelova | although I may look like | 12:45 |
| morgan | Hey, sometimes I have to check ;) | 12:45 |
| DinaBelova | all modifications to dogpile/cache were ONLY for debug purposes | 12:45 |
| DinaBelova | and that's it | 12:45 |
| DinaBelova | sorry for confusion :) | 12:45 |
| morgan | All good. | 12:45 |
| DinaBelova | just to generate a bit more human-readable thing | 12:45 |
| *** henrynash has joined #openstack-keystone | 12:46 | |
| *** ChanServ sets mode: +v henrynash | 12:46 | |
| DinaBelova | as I can trace almost everything from keystone, but not easilly understand what function was memoized and with waht args :( that's reachable only from dogpile code :( | 12:46 |
| morgan | The memoization stuff is not easy | 12:47 |
| morgan | To trace. | 12:47 |
| DinaBelova | indeed | 12:47 |
| DinaBelova | therefore all these stuff :( | 12:47 |
| morgan | So, the easiest way to check on the calls is using a dogpile proxy | 12:47 |
| *** doug-fish has quit IRC | 12:47 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 12:47 | |
| DinaBelova | morgan - I wanted to use it - even from your local thread context - but I won't be able to grab memoized function name, args, kwargs | 12:48 |
| morgan | If you look at how the request local cache is implemented, it actually is a proxy object that lives below the dogpile region. | 12:48 |
| morgan | You can stack proxies | 12:48 |
| morgan | So you could do region -> debug proxy -> request locla -> debug proxy -> backend | 12:49 |
| morgan | The proxies are applied in order | 12:49 |
| morgan | You can also change the generate_key_fn to debug | 12:49 |
| morgan | Which does the hashing. | 12:50 |
| DinaBelova | morgan ok, I can write this proxy and add as a specific debug proxy | 12:50 |
| morgan | So, it would output the fn, the args, etc | 12:50 |
| DinaBelova | morgan ack | 12:50 |
| morgan | Yep | 12:50 |
| DinaBelova | morgan - although still please take a look on what I've seen | 12:50 |
| morgan | I will. | 12:50 |
| morgan | It will be a bit sporadic as I have meetings all day | 12:51 |
| morgan | At the very least, i'll be back to normal schedule tomorrow. | 12:51 |
| DinaBelova | morgan I can clearly understand it, sir :) | 12:51 |
| morgan | OK, need to get moving... Breakfast soon and need to check out of the hotel. | 12:53 |
| *** doug-fish has joined #openstack-keystone | 12:54 | |
| DinaBelova | morgan good luck man :) | 12:55 |
| *** doug-fis_ has joined #openstack-keystone | 12:56 | |
| *** richm has joined #openstack-keystone | 12:56 | |
| *** pnavarro has joined #openstack-keystone | 12:58 | |
| *** doug-fish has quit IRC | 12:59 | |
| *** rodrigods has quit IRC | 13:01 | |
| *** rodrigods has joined #openstack-keystone | 13:01 | |
| *** shoutm has joined #openstack-keystone | 13:01 | |
| *** pnavarro_ has joined #openstack-keystone | 13:03 | |
| *** henrynash has quit IRC | 13:04 | |
| *** henrynash has joined #openstack-keystone | 13:05 | |
| *** ChanServ sets mode: +v henrynash | 13:05 | |
| *** pnavarro has quit IRC | 13:06 | |
| *** mvk_ has quit IRC | 13:11 | |
| *** mvk has joined #openstack-keystone | 13:13 | |
| samueldmq | ayoung: nice, will look | 13:13 |
| *** daemontool has quit IRC | 13:17 | |
| *** shoutm has quit IRC | 13:18 | |
| *** doug-fis_ has quit IRC | 13:23 | |
| *** shoutm has joined #openstack-keystone | 13:25 | |
| morgan | DinaBelova: thnx | 13:27 |
| DinaBelova | morgan btw generate_key_fn is defined in dogpile in fact | 13:28 |
| *** daemontool has joined #openstack-keystone | 13:28 | |
| DinaBelova | and the only place it's wrapped is oslo.cache that's still lib | 13:28 |
| morgan | It is. You can override it via config or via Oslo.cache | 13:28 |
| morgan | Config = dogpile config | 13:28 |
| morgan | So you can provide your own with debug logic | 13:28 |
| morgan | Knowing the fn, args, etc | 13:29 |
| DinaBelova | oh ,interesting | 13:29 |
| DinaBelova | thanks | 13:29 |
| morgan | ^_^ | 13:29 |
| DinaBelova | morgan - sorry, can you point me to the dogpile or oslo.config config option where I should change it? | 13:36 |
| *** jsavak has joined #openstack-keystone | 13:36 | |
| *** roxanaghe has joined #openstack-keystone | 13:37 | |
| *** rderose has joined #openstack-keystone | 13:37 | |
| *** pauloewerton has joined #openstack-keystone | 13:39 | |
| *** roxanaghe has quit IRC | 13:41 | |
| *** links has quit IRC | 13:46 | |
| *** rderose has quit IRC | 13:47 | |
| *** woodburn1 has joined #openstack-keystone | 13:49 | |
| *** rderose has joined #openstack-keystone | 13:49 | |
| *** woodburn has quit IRC | 13:50 | |
| *** ametts has joined #openstack-keystone | 13:56 | |
| ayoung | lbragstad, so, something looks really wrong with Fernet tokens and role assignment removal | 14:03 |
| lbragstad | ayoung ? | 14:04 |
| lbragstad | ayoung wrapping up some emails but go ahead | 14:04 |
| ayoung | lbragstad, I've been looking at the failure on the WIP default for | 14:04 |
| ayoung | keystone.tests.unit.test_v3_auth.TestFernetTokenAPIs.test_domain_scoped_token_is_invalid_after_deleting_grant | 14:04 |
| ayoung | and...its now what I thought it was | 14:04 |
| ayoung | lbragstad, I thought it was a case of there being a role left behind, so a token that was valid with 2 roles would end up being valid with only one role | 14:05 |
| ayoung | let me link to the code | 14:05 |
| ayoung | lbragstad, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/test_v3_auth.py#n291 | 14:06 |
| ayoung | lbragstad, so I added in a call to validate the token and dump the contents... | 14:07 |
| ayoung | let me paste what I get | 14:07 |
| *** sdake has joined #openstack-keystone | 14:07 | |
| ayoung | http://paste.openstack.org/show/493339/ | 14:07 |
| ayoung | lbragstad, scary part is 'roles': [{'id': '8a3c606c65824abaaa3e25fc09bbfe69', 'name': 'admin'}], | 14:08 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Add API Change Tutorial https://review.openstack.org/302789 | 14:08 |
| ayoung | lbragstad, It only happens when the role is removed. I've tried a couple probes like this: | 14:08 |
| samueldmq | ayoung: stevemar: dstanek: bknudson ^ still wip, but certainly a good thing to have | 14:08 |
| ayoung | 1. CHange the user up front. self.user = self.create_user | 14:09 |
| ayoung | that fails outright...which is strange | 14:09 |
| *** slberger has joined #openstack-keystone | 14:09 | |
| ayoung | 2. fetch a token prior to doing the role assignment. HTat gest a 40. which is what it should get | 14:10 |
| *** knikolla has joined #openstack-keystone | 14:10 | |
| ayoung | 3. Try dropping the admin role from the user. User does not have the admin role | 14:10 |
| ayoung | so, it looks like, in the fernet case, dropping the grant is sticking an admin role on the validation | 14:10 |
| ayoung | But....this only happens on the WIP.... | 14:11 |
| ayoung | which means that it probably is from the WIP changes... | 14:11 |
| lbragstad | huh | 14:12 |
| lbragstad | weird | 14:12 |
| *** sdake has quit IRC | 14:12 | |
| lbragstad | ayoung when test_domain_scoped_token_is_invalid_after_deleting_grant fails | 14:12 |
| lbragstad | how does it fail? | 14:13 |
| lbragstad | ayoung does it fail because http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/test_v3_auth.py#n304 isn't true? | 14:13 |
| ayoung | lbragstad, so, just verified it runs, and runs correctly before my patch. So it is something I am doing | 14:13 |
| lbragstad | oh | 14:13 |
| ayoung | lbragstad, that is correct | 14:13 |
| raildo | lbragstad: https://review.openstack.org/#/c/258650/30/keystone/assignment/core.py | 14:13 |
| patchbot | raildo: patch 258650 - keystone - [WIP]Make fernet default token provider | 14:13 |
| lbragstad | so it shouldn't be able to validate that token because the role assignment/grant has been removed | 14:14 |
| lbragstad | got it | 14:14 |
| ayoung | lbragstad, but I think that in the existing code, Fernet is not tested with revocation events? | 14:14 |
| raildo | lbragstad: I tried to skip the revocation event, but the tokens still valid on this case | 14:14 |
| lbragstad | ayoung we wouldn't need a revocation event in that case would we? Since we're rebuilding the auth context? | 14:14 |
| lbragstad | or rebuilding the role assignments rather? | 14:14 |
| ayoung | lbragstad, right. It should be tested only against existing role assignments, ANd, since there are none, it should fail | 14:15 |
| lbragstad | ayoung yeah - that makes sense | 14:15 |
| lbragstad | so the question is - why is it still getting role assignments? | 14:16 |
| lbragstad | right? | 14:16 |
| *** mylu has joined #openstack-keystone | 14:17 | |
| openstackgerrit | Dina Belova proposed openstack/keystone: Add DB operations tracing https://review.openstack.org/294535 | 14:18 |
| openstackgerrit | Dina Belova proposed openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 14:18 |
| openstackgerrit | Dina Belova proposed openstack/keystone: Add cache profiling https://review.openstack.org/302799 | 14:18 |
| lbragstad | this actually sounds cache related | 14:18 |
| raildo | lbragstad: I have this feeling too | 14:19 |
| lbragstad | raildo but ayoung did say that it is only occurring in the patch | 14:19 |
| lbragstad | raildo so we might be doing something in patch 258650 and not invalidating a cache | 14:20 |
| patchbot | lbragstad: https://review.openstack.org/#/c/258650/ - keystone - [WIP]Make fernet default token provider | 14:20 |
| ayoung | lbragstad, I'm going to start putting some debugging into the verification path. Its kindof a pain to do with RPDB thoug | 14:20 |
| openstackgerrit | Dina Belova proposed openstack/keystone: [WIP] Add cache profiling https://review.openstack.org/302799 | 14:20 |
| lbragstad | ayoung you're going to start debugging self.token_provider_api.validate_token ? | 14:21 |
| raildo | lbragstad: if you remove the "if self.token_provider_api._needs_persistence" on this file, you will get a forbidden for every request that you make after delete a grant | 14:21 |
| lbragstad | ayoung self.token_provider_api.validate_token is your starting point? | 14:21 |
| *** sdake has joined #openstack-keystone | 14:21 | |
| ayoung | lbragstad, yep | 14:21 |
| raildo | lbragstad: ayoung I'm thinking that it some error related to this code: https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L443-L455 | 14:22 |
| ayoung | lbragstad, ok, wait, this might be easier to debugt than I though | 14:22 |
| ayoung | does not need to go through the web layer | 14:22 |
| openstackgerrit | Dina Belova proposed openstack/keystone: [WIP] Add cache profiling https://review.openstack.org/302799 | 14:22 |
| lbragstad | ayoung right | 14:22 |
| ayoung | raildo, let me debug...I'll look | 14:22 |
| lbragstad | ayoung you could walk it down from https://github.com/openstack/keystone/blob/d0d38bec290cfe07092fd090ccbe09160b6d314d/keystone/token/provider.py#L204 | 14:22 |
| *** stingaci has joined #openstack-keystone | 14:23 | |
| *** pnavarro_ has quit IRC | 14:25 | |
| *** pnavarro_ has joined #openstack-keystone | 14:28 | |
| *** stingaci has quit IRC | 14:28 | |
| dims | stevemar : folks : this still good? https://review.openstack.org/#/c/299593/ | 14:34 |
| patchbot | dims: patch 299593 - requirements - Update keystoneclient lower bound | 14:34 |
| *** mylu has quit IRC | 14:37 | |
| openstackgerrit | Merged openstack/keystone: Merge tag '9.0.0' https://review.openstack.org/302567 | 14:41 |
| *** mylu has joined #openstack-keystone | 14:42 | |
| dstanek | / 28 | 14:43 |
| dstanek | yeah, typing with one hand | 14:44 |
| *** stingaci has joined #openstack-keystone | 14:46 | |
| dims | stevemar dstanek : this still good to release? https://review.openstack.org/#/c/300965/ | 14:46 |
| patchbot | dims: patch 300965 - releases - release keystoneauth 2.5.0 | 14:46 |
| *** ametts has quit IRC | 14:48 | |
| *** ametts has joined #openstack-keystone | 14:49 | |
| *** david_cu has joined #openstack-keystone | 14:51 | |
| *** david_cu has quit IRC | 14:52 | |
| *** stingaci has quit IRC | 14:52 | |
| lbragstad | are we not using sched for the summit schedule? | 14:52 |
| *** david_cu has joined #openstack-keystone | 14:52 | |
| *** timcline has joined #openstack-keystone | 14:52 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 14:55 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:55 | |
| *** david_cu_ has joined #openstack-keystone | 14:55 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the resource abstract base class out of core https://review.openstack.org/302826 | 14:56 |
| *** david_cu has quit IRC | 14:57 | |
| *** ametts has quit IRC | 14:57 | |
| *** ametts has joined #openstack-keystone | 14:58 | |
| *** woodster_ has joined #openstack-keystone | 15:00 | |
| *** david_cu_ has quit IRC | 15:00 | |
| ayoung | ok, so the assigned role *is* admin | 15:00 |
| ayoung | and that is the case for the master path | 15:00 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the assignment abstract base class out of core https://review.openstack.org/299635 | 15:01 |
| *** Guest74036 has quit IRC | 15:10 | |
| *** stingaci has joined #openstack-keystone | 15:12 | |
| *** real56 has joined #openstack-keystone | 15:13 | |
| *** ksnihyr has quit IRC | 15:16 | |
| *** anush_ has joined #openstack-keystone | 15:19 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/300626 | 15:22 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/302855 | 15:22 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/300764 | 15:22 |
| *** shoutm has quit IRC | 15:22 | |
| *** alex_xu has quit IRC | 15:25 | |
| *** stevemar changes topic to "MITAKA is released! Thanks to everyone that contributed!" | 15:28 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/302881 | 15:28 |
| *** alex_xu has joined #openstack-keystone | 15:29 | |
| *** david_cu has joined #openstack-keystone | 15:29 | |
| jdandrea | Is there any way to call TokenManager.validate() and have the client use the publicurl and not the adminurl? | 15:29 |
| jdandrea | (using an admin user token to create the client, ofc.) | 15:30 |
| *** arunkant_ has joined #openstack-keystone | 15:30 | |
| *** agrebennikov has joined #openstack-keystone | 15:30 | |
| bknudson | jdandrea: the interface is specified on the session -- http://docs.openstack.org/developer/keystoneauth/using-sessions.html#service-discovery | 15:32 |
| *** jsavak has quit IRC | 15:35 | |
| *** links has joined #openstack-keystone | 15:36 | |
| jdandrea | bknudson: Oh! Thank you. I think I am a bit clueless on the session aspect (though I use it). | 15:36 |
| *** EinstCrazy has quit IRC | 15:36 | |
| jdandrea | bknudson So, if I understand correctly, I can limit the interface to public and then it will default to that? | 15:36 |
| bknudson | jdandrea: you'll have to try it. I'm just going off the docs | 15:37 |
| jdandrea | bknudson *nods* | 15:37 |
| jdandrea | bknudson ... and that is using session.get, not the higher level TokenManager.validate() or authenticate() calls. Hmm. Maybe I can't then. | 15:39 |
| bknudson | jdandrea: you create the Client with the session, then you use client.tokens.validate() ?? | 15:40 |
| *** jsavak has joined #openstack-keystone | 15:40 | |
| jdandrea | bknudson: Yes, I do that now, but when I create Session I can't give it an endpoint filter. http://paste.openstack.org/show/493356/ | 15:42 |
| *** GB21 has joined #openstack-keystone | 15:42 | |
| bknudson | oh, the endpoint_filter is on the get()... hmm | 15:43 |
| jdandrea | bknudson: Oh! Check out the next to last paragraph in the Service Discovery section on that link: | 15:43 |
| *** spzala has joined #openstack-keystone | 15:43 | |
| jdandrea | "For example the keystoneauth1.token_endpoint.Token plugin (which is used when you want to always use a specific endpoint and token combination) will always return the same endpoint regardless of the parameters to endpoint_filter" | 15:43 |
| * jdandrea makes "sad trombone" noise | 15:43 | |
| jdandrea | Or I misread it. | 15:44 |
| bknudson | if you're using the token plugin you set the url when you create that plugin. | 15:44 |
| bknudson | so if you create the token plugin with the public endpoint it will use that. | 15:44 |
| jdandrea | bknudson I think I misread. I'm calling client.tokens.validate() ... is that the token plugin though? | 15:45 |
| bknudson | no, that's not the token plugin. | 15:45 |
| jdandrea | Ok. Then I'm confused. Trying to figure it out from the docs but I'm not succeeding yet. | 15:46 |
| *** roxanaghe has joined #openstack-keystone | 15:46 | |
| jdandrea | I need to figure out how to use keystoneauth1.token_endpoint.Token then, since I want to use a specific endpoint/token combo ... and THEN I call client.tokens.validate()? | 15:47 |
| *** jaosorior has quit IRC | 15:47 | |
| bknudson | you can do that... seems like there would be a way to tell keystoneclient which end point you want to use. | 15:47 |
| *** jaosorior has joined #openstack-keystone | 15:47 | |
| *** jsavak has quit IRC | 15:47 | |
| jdandrea | bknudson: Right. Seems like. It's difficult trying to figure out what that is though. :/ Looking at source and trying to tease it apart now. | 15:48 |
| * jdandrea longs to find sample code somewhere | 15:48 | |
| *** jsavak has joined #openstack-keystone | 15:48 | |
| *** links has quit IRC | 15:48 | |
| * jdandrea finds http://docs.openstack.org/developer/keystoneauth/authentication-plugins.html ... | 15:48 | |
| jdandrea | Gaah, v2 has no sample code. (Using a cluster without v3 at the moment.) | 15:49 |
| jdandrea | bknudson: Wait! I'm using v2.Password already (vs. v2.Token). Maybe I can filter it in there. | 15:50 |
| bknudson | does keystoneclient even provide validate tokens on v2 client? I haven't even tried keeping the v2 docs up to date. | 15:51 |
| *** browne has joined #openstack-keystone | 15:53 | |
| *** pcaruana has quit IRC | 15:53 | |
| jdandrea | bknudson: Not sure (there's a "validate" token?). I'm just want to validate a token and get info, using a client that was authenticated with a user bearing the admin role. | 15:54 |
| jdandrea | I can do a GET on http://controller:5000/v2.0/tokens/AUTH_TOKEN (with X-Auth-Token set to the token of someone with the admin role) and I do get info back. | 15:55 |
| bknudson | you might wind up just calling .get('/v2.0/tokens/...') on the session anyways. | 15:55 |
| *** henrynash has quit IRC | 15:55 | |
| jdandrea | But when I use the library it fails because it forces adminurl, and our adminurls are on a private network that I can't reach. Yet publicurl works (same for nova, etc.). Hmm. | 15:55 |
| bknudson | ah, I did add it: https://github.com/openstack/python-keystoneclient/blame/master/keystoneclient/v2_0/tokens.py#L78 | 15:56 |
| bknudson | probably so that authtoken could use it. | 15:56 |
| jdandrea | bknudson: Yup. That's what I tried! | 15:56 |
| *** stingaci has quit IRC | 15:56 | |
| jdandrea | If I try that it goes through adminurl and (for me) fails. If I do a direct GET (no client library use) using publicurl it succeeds. | 15:56 |
| jdandrea | So I'm trying to still use the client library but not have it go through adminurl. | 15:57 |
| bknudson | jdandrea: one of the arguments to the Client should be the interface | 16:01 |
| jdandrea | bknudson: Ah. I'm just passing the session. Looking at the source ... | 16:01 |
| *** ametts has quit IRC | 16:01 | |
| bknudson | https://github.com/openstack/python-keystoneclient/blame/master/keystoneclient/httpclient.py#L227 | 16:01 |
| *** jasonsb has quit IRC | 16:02 | |
| * jdandrea jaw drop | 16:03 | |
| *** jasonsb has joined #openstack-keystone | 16:03 | |
| jdandrea | bknudson: I swear, "The More You Know" *whooosh* ... that seems to have done it (I hope). Thank you! Trying it. | 16:03 |
| bknudson | neat | 16:03 |
| *** dave-mccowan has joined #openstack-keystone | 16:03 | |
| jdandrea | :-o | 16:05 |
| jdandrea | I think it worked! Thank you! (If there's a doc page for this, my apologies. I failed to find it.) | 16:06 |
| bknudson | http://docs.openstack.org/developer/python-keystoneclient/api/keystoneclient.v3.html#keystoneclient.v3.client.Client doesn't include interface as a parameter. | 16:07 |
| *** e0ne has quit IRC | 16:08 | |
| jdandrea | Ahh. | 16:08 |
| *** e0ne has joined #openstack-keystone | 16:09 | |
| jdandrea | bknudson That's also v3 though. | 16:10 |
| bknudson | right, I don't care about v2 | 16:11 |
| jdandrea | bknudson: Granted, but I do (stuck with it here for a bit yet, *sighs*). | 16:11 |
| jdandrea | Or is v2 EOL'ed? Please. Give me ammo. :) | 16:11 |
| bknudson | v2 has security issues that can't be fixed... specifically the token is passed in the URL which is typically logged by web servers | 16:13 |
| * jdandrea nods | 16:13 | |
| jdandrea | That's a good reason. | 16:13 |
| *** jsavak has quit IRC | 16:14 | |
| *** ksnihyr has joined #openstack-keystone | 16:14 | |
| *** jsavak has joined #openstack-keystone | 16:14 | |
| ayoung | raildo, lbragstad yep, its caching. I don't think we should cache token validations | 16:17 |
| *** ametts has joined #openstack-keystone | 16:17 | |
| lbragstad | guh | 16:17 |
| raildo | ayoung: this sounds like a big impact on tests... | 16:17 |
| *** mhickey has quit IRC | 16:17 | |
| raildo | on the performance | 16:18 |
| bknudson | token validation is what deployers want cached due to the performance. | 16:18 |
| raildo | bknudson: that was i thought | 16:18 |
| *** mylu has quit IRC | 16:19 | |
| *** mylu has joined #openstack-keystone | 16:20 | |
| *** stingaci has joined #openstack-keystone | 16:21 | |
| ayoung | lbragstad, Well, it can either be fast or correct. Which do you want? | 16:22 |
| *** lhcheng has joined #openstack-keystone | 16:22 | |
| *** ChanServ sets mode: +v lhcheng | 16:22 | |
| *** anush_ has quit IRC | 16:23 | |
| *** anush_ has joined #openstack-keystone | 16:24 | |
| *** trown is now known as trown|lunch | 16:24 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the resource abstract base class out of core https://review.openstack.org/302826 | 16:25 |
| raildo | ayoung: can we invalidate the cache only when we delete a grant (or when we call a revocation event)? this could solve our problem? | 16:28 |
| ayoung | raildo, most likely. Let me get the tests to run correctly first and then we'll optimize | 16:28 |
| ayoung | raildo, going to have to broadly invalidate on most delete actions, I think | 16:29 |
| *** jsavak has quit IRC | 16:29 | |
| *** jsavak has joined #openstack-keystone | 16:29 | |
| ayoung | that might be OK, though. I suspec that deletes are rare, and will just cause a quick blip in perf in the real word. That should work. | 16:29 |
| raildo | ayoung: agreed | 16:29 |
| raildo | bknudson: what do you think? | 16:30 |
| *** david_cu has quit IRC | 16:30 | |
| jdandrea | bknudson: Thank you so much, again, that saves me a ton of headache, you have no idea. | 16:30 |
| htruta | ayoung: that's what I thought too. Grant deletes don't seem to happen very often | 16:30 |
| *** stingaci has quit IRC | 16:31 | |
| *** pnavarro_ has quit IRC | 16:34 | |
| *** mylu has quit IRC | 16:36 | |
| *** spandhe has joined #openstack-keystone | 16:36 | |
| *** david-lyle has quit IRC | 16:36 | |
| *** browne has quit IRC | 16:37 | |
| bknudson | raildo: invalidate the cache works. That's what the customer would have to do. | 16:37 |
| bknudson | y, if it's on the same server and it requires cache invalidation then make that part of the flow | 16:38 |
| *** spzala has quit IRC | 16:38 | |
| ayoung | raildo, looking like that is the same problem with the trust tests | 16:38 |
| *** spzala has joined #openstack-keystone | 16:39 | |
| *** stingaci has joined #openstack-keystone | 16:39 | |
| ayoung | raildo, I'll get the tests to pass, and leave the caching code in but commented out, and I'll resubmit it. You can work on re-introducing the caching after that. Deal? | 16:39 |
| raildo | ayoung: deal :) | 16:40 |
| ayoung | removing the caching exposes a couple places where we need to raise different excptions | 16:40 |
| ayoung | so this should get that covered | 16:40 |
| ayoung | mostly converting not authorized to not found | 16:40 |
| *** mylu has joined #openstack-keystone | 16:42 | |
| *** e0ne has quit IRC | 16:42 | |
| *** spzala has quit IRC | 16:43 | |
| *** daemontool has quit IRC | 16:44 | |
| *** dflorea has joined #openstack-keystone | 16:45 | |
| *** spzala has joined #openstack-keystone | 16:45 | |
| *** fhubik has joined #openstack-keystone | 16:46 | |
| *** stingaci has quit IRC | 16:46 | |
| *** spzala has quit IRC | 16:47 | |
| *** spzala has joined #openstack-keystone | 16:48 | |
| *** stingaci has joined #openstack-keystone | 16:48 | |
| *** rcernin has quit IRC | 16:52 | |
| *** spzala has quit IRC | 16:53 | |
| *** stingaci has quit IRC | 16:54 | |
| *** real56 has quit IRC | 17:00 | |
| *** jistr has quit IRC | 17:01 | |
| *** mylu has quit IRC | 17:02 | |
| *** fhubik has quit IRC | 17:02 | |
| *** zqfan has quit IRC | 17:02 | |
| *** mylu has joined #openstack-keystone | 17:03 | |
| *** stingaci has joined #openstack-keystone | 17:04 | |
| *** david-lyle has joined #openstack-keystone | 17:06 | |
| *** ametts has quit IRC | 17:07 | |
| *** pcaruana has joined #openstack-keystone | 17:08 | |
| *** david-lyle has quit IRC | 17:11 | |
| lbragstad | ayoung I opt for correct | 17:12 |
| ayoung | lbragstad, I think we can make it work. We'll just have to be more aggresice on cache invalidations. But those should be rare enough that they don't impact performance | 17:13 |
| *** jasonsb has quit IRC | 17:13 | |
| lbragstad | ayoung I opt for performance because i think we went the cached route originally | 17:14 |
| lbragstad | ayoung if i recall gyee's TODO right | 17:14 |
| *** stingaci has quit IRC | 17:15 | |
| ayoung | running tox now. I knocked out a few of the errors by making the tests just check for keystone.exception.Error. It is within the API, and it probably maps to the same thing when done via the validation API anyway, just a difference of what the provider returns on a uuid vs fernet failure | 17:16 |
| lbragstad | ayoung cool | 17:16 |
| *** david-lyle has joined #openstack-keystone | 17:17 | |
| *** spzala has joined #openstack-keystone | 17:17 | |
| *** stingaci has joined #openstack-keystone | 17:18 | |
| *** ametts has joined #openstack-keystone | 17:20 | |
| dstanek | hmmm.... i thought the VM i setup yesterday was correctly configured for federation. turns out it is not. more fun in my future... | 17:21 |
| *** browne has joined #openstack-keystone | 17:21 | |
| ayoung | dstanek, Shibboleth>? | 17:21 |
| *** spzala has quit IRC | 17:22 | |
| dstanek | ayoung: yeah | 17:22 |
| ayoung | dstanek, wouldn't happend to be an RDO or RH install would it? | 17:22 |
| *** stingaci has quit IRC | 17:23 | |
| dstanek | ayoung: i'm using fedora for this vm. been trying to do that more and more lately | 17:23 |
| *** david-lyle has quit IRC | 17:23 | |
| ayoung | dstanek, ah, cool. We're supposed to confirm Shib with RH OSP . Actually, I think rodrigods tagged for that | 17:24 |
| *** trown|lunch is now known as trown | 17:24 | |
| *** akanksha_ has quit IRC | 17:27 | |
| ayoung | raildo, - Failed: 6 still working | 17:31 |
| *** dflorea has quit IRC | 17:32 | |
| *** anush_ has quit IRC | 17:32 | |
| *** anush_ has joined #openstack-keystone | 17:33 | |
| *** rcernin has joined #openstack-keystone | 17:33 | |
| *** tqtran has joined #openstack-keystone | 17:33 | |
| *** spzala has joined #openstack-keystone | 17:35 | |
| *** stingaci has joined #openstack-keystone | 17:35 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the resource abstract base class out of core https://review.openstack.org/302826 | 17:37 |
| *** spzala has quit IRC | 17:39 | |
| rodrigods | ayoung, dstanek, exactly :) | 17:39 |
| *** pnavarro_ has joined #openstack-keystone | 17:43 | |
| *** dflorea has joined #openstack-keystone | 17:43 | |
| *** timcline has quit IRC | 17:43 | |
| *** timcline has joined #openstack-keystone | 17:44 | |
| *** mvk has quit IRC | 17:45 | |
| *** timcline has quit IRC | 17:49 | |
| *** richm has quit IRC | 17:49 | |
| *** anush_ has quit IRC | 17:50 | |
| *** spzala has joined #openstack-keystone | 17:50 | |
| *** anush_ has joined #openstack-keystone | 17:50 | |
| *** aginwala has joined #openstack-keystone | 17:52 | |
| *** e0ne has joined #openstack-keystone | 17:53 | |
| *** david-lyle has joined #openstack-keystone | 17:56 | |
| *** david-lyle has quit IRC | 17:56 | |
| *** dflorea has quit IRC | 17:56 | |
| amakarov | morgan, greetings! | 17:56 |
| amakarov | I've tried splitting abstract interface into client and server | 17:57 |
| amakarov | Here's what I've got: https://gist.github.com/x-eye/7d667415db77fa024fac682858292305 | 17:57 |
| *** david-lyle has joined #openstack-keystone | 17:58 | |
| *** pushkaru has joined #openstack-keystone | 17:58 | |
| amakarov | it's definitely possible | 17:58 |
| *** dflorea has joined #openstack-keystone | 17:59 | |
| *** jsavak has quit IRC | 18:01 | |
| *** diazjf has joined #openstack-keystone | 18:02 | |
| *** anush_ has quit IRC | 18:02 | |
| *** jsavak has joined #openstack-keystone | 18:02 | |
| *** e0ne has quit IRC | 18:03 | |
| *** richm has joined #openstack-keystone | 18:05 | |
| *** real56 has joined #openstack-keystone | 18:05 | |
| *** david_cu has joined #openstack-keystone | 18:06 | |
| *** timcline has joined #openstack-keystone | 18:09 | |
| *** richm has quit IRC | 18:10 | |
| *** timcline has quit IRC | 18:10 | |
| *** timcline has joined #openstack-keystone | 18:10 | |
| *** aginwala has quit IRC | 18:10 | |
| *** e0ne has joined #openstack-keystone | 18:13 | |
| dstanek | amakarov: what are you trying to do? | 18:13 |
| *** e0ne has quit IRC | 18:14 | |
| *** diazjf has quit IRC | 18:14 | |
| *** aginwala has joined #openstack-keystone | 18:14 | |
| *** aginwala has quit IRC | 18:16 | |
| tjcocozz | bknudson, now that experimental gate job is in. all i need to do is leave a comment on a patch of "check experimental" to run it? Do i add the job name? | 18:19 |
| *** anush_ has joined #openstack-keystone | 18:19 | |
| bknudson | tjcocozz: y, pick a proposed review and check experimental it. | 18:19 |
| bknudson | that will run all the experimental jobs | 18:20 |
| tjcocozz | bknudson, done! Just wanted to double check, becuase it was just merged in this morning. | 18:20 |
| *** diazjf has joined #openstack-keystone | 18:23 | |
| *** richm has joined #openstack-keystone | 18:24 | |
| *** sdake_ has joined #openstack-keystone | 18:26 | |
| *** doug-fish has joined #openstack-keystone | 18:26 | |
| *** sdake has quit IRC | 18:26 | |
| *** dflorea has quit IRC | 18:27 | |
| amakarov | dstanek, last summer I've heard an idea to move drivers away from managers and use network to communicate between them. Reading through my federation presentation I've noticed old os-cli hadn't support for some bits. So I wanted to try do something that will remove the need to track client-server match | 18:28 |
| *** lhcheng_ has joined #openstack-keystone | 18:28 | |
| edmondsw | if I've got an auth plugin instance, how do I check the expiration date for its token? | 18:28 |
| dstanek | amakarov: communicate between the server manager instances and the server driver instances? or something else? | 18:29 |
| amakarov | dstanek, in particular | 18:29 |
| amakarov | this is just a general idea | 18:30 |
| dstanek | amakarov: what is the benefit in doing that? | 18:30 |
| *** lhcheng has quit IRC | 18:30 | |
| amakarov | dstanek, you declare an interface, implement it and it gets split to client and server part automatically thus ideally matching each other | 18:31 |
| dstanek | amakarov: what do you mean gets split to the client? | 18:31 |
| *** lhcheng has joined #openstack-keystone | 18:31 | |
| *** ChanServ sets mode: +v lhcheng | 18:31 | |
| amakarov | it may even remove the need in client library | 18:31 |
| *** lhcheng_ has quit IRC | 18:32 | |
| amakarov | dstanek, look at the client_factory() | 18:32 |
| dstanek | so you basically want code on demand? like flash or activex for the browser | 18:33 |
| amakarov | dstanek, it produces the Client class able to call everything declared in the interface | 18:33 |
| amakarov | dstanek, something like that, maybe | 18:33 |
| dstanek | amakarov: so who owns the code that knows the differences in the | 18:34 |
| dstanek | API? the user of the client? | 18:34 |
| amakarov | dstanek, the server part, I think | 18:35 |
| *** lhcheng has quit IRC | 18:35 | |
| amakarov | though you still need to import it in the client side | 18:35 |
| dstanek | amakarov: someone on the client side will have to know what methods/properties are available | 18:35 |
| bknudson | I was looking at swagger for a while -- https://review.openstack.org/#/c/287499/ -- you can generate a client from the swagger file. | 18:36 |
| patchbot | bknudson: patch 287499 - keystone - WIP - Generate swagger | 18:36 |
| *** lhcheng has joined #openstack-keystone | 18:36 | |
| *** ChanServ sets mode: +v lhcheng | 18:36 | |
| dstanek | bknudson: sorry, but i have my own swagger | 18:36 |
| amakarov | dstanek, they will know it the same way they know it now: from the import | 18:36 |
| bknudson | it's actually OpenAPI now, I guess. | 18:37 |
| *** pnavarro_ has quit IRC | 18:37 | |
| * amakarov googleing OpenAPI | 18:37 | |
| dstanek | amakarov: as a developer i install ksc 1.2.3 and i know what it's interfaces are. in the code-on-demand how will i know? | 18:38 |
| *** timcline has quit IRC | 18:38 | |
| amakarov | you have to import the interface class | 18:38 |
| bknudson | dstanek: how do you know what the interfaces are? | 18:38 |
| *** jsavak has quit IRC | 18:38 | |
| amakarov | in our case it looks like dragging entire keystone into... | 18:38 |
| amakarov | hmm | 18:38 |
| dstanek | bknudson: docs :-) | 18:39 |
| dstanek | amakarov: so you still have to have a client that matches up with server capabilities? | 18:39 |
| *** real56 has quit IRC | 18:39 | |
| dstanek | interfaces for new/removed things, etc. | 18:39 |
| bknudson | he he | 18:39 |
| bknudson | try to figure out how to create a user from the docs: http://docs.openstack.org/developer/python-keystoneclient/api/keystoneclient.v3.html#keystoneclient.v3.users.UserManager.create | 18:39 |
| *** jsavak has joined #openstack-keystone | 18:40 | |
| dstanek | bknudson: sheesh... haven't you heard of 'code as documentation' :-P | 18:40 |
| bknudson | oh, that's what you meant by docs. | 18:40 |
| bknudson | the code actually does have the args... I think the positional decorator is causing the docs to not see the right docs. | 18:41 |
| amakarov | dstanek, that thing I don't clearly understand... new/removed things | 18:41 |
| amakarov | the idea is if it changes in the server it changes on the client that very moment | 18:42 |
| *** spzala has quit IRC | 18:42 | |
| *** real56 has joined #openstack-keystone | 18:42 | |
| amakarov | because server implements the interface and client just turns it into a proxy | 18:42 |
| *** aginwala has joined #openstack-keystone | 18:43 | |
| raildo | ayoung: \o/ | 18:44 |
| *** spzala has joined #openstack-keystone | 18:44 | |
| amakarov | dstanek, I understand the situation when some 3-rd party app has tons of code relying on a function that gets removed, then it sticks to the old version - as usual... | 18:45 |
| *** stingaci has quit IRC | 18:45 | |
| ayoung | raildo, loooks like Fernte V2 TOkens and trusts still not working together | 18:45 |
| dstanek | amakarov: so working code would be broken when we remove something? | 18:45 |
| dstanek | it's the same situation as with clients known to work with certain server versions | 18:46 |
| amakarov | dstanek, indeed... how is this handled now? | 18:46 |
| dstanek | we actually do REST wrong on the client side | 18:46 |
| raildo | ayoung: maybe we need depends on this patch: https://review.openstack.org/#/c/278693/ ? | 18:47 |
| patchbot | raildo: patch 278693 - keystone - Make fernet support trust auth against v2.0 | 18:47 |
| amakarov | dstanek, faking a response of raising something? | 18:47 |
| dstanek | amakarov: if we add or change something it may require a new client to see that. not sure how often we do removals that would impact the client | 18:47 |
| ayoung | raildo, oh..I forget we hadn;t merged that | 18:47 |
| ayoung | yep...need that first | 18:47 |
| amakarov | dstanek, I think it's a corner case and can be handled in my concept the very same way | 18:48 |
| raildo | ayoung: ok | 18:48 |
| dstanek | amakarov: my biggest fear in doing code on demand is that it would make us that much further from anyone using the REST API | 18:48 |
| *** stingaci has joined #openstack-keystone | 18:48 | |
| ayoung | lbragstad, you planning on getting back to https://review.openstack.org/#/c/278693/ soon? | 18:49 |
| patchbot | ayoung: patch 278693 - keystone - Make fernet support trust auth against v2.0 | 18:49 |
| amakarov | dstanek, tbh I haven't clear vision how to implement REST here :) I'm exposing function calls thus I use RPC | 18:49 |
| *** dflorea has joined #openstack-keystone | 18:49 | |
| *** aginwala has quit IRC | 18:50 | |
| ayoung | raildo, I don't think we need to revoke anything, so long as we validate token exists at validation. | 18:50 |
| ayoung | Let me try that./... | 18:50 |
| ayoung | that one might still be tripping on the caching issues | 18:50 |
| amakarov | ayoung, o/ | 18:50 |
| *** spzala_ has joined #openstack-keystone | 18:50 | |
| raildo | ayoung: if we don't revoke anything, we have to rotationate the fernet key? | 18:51 |
| ayoung | raildo, nope | 18:52 |
| ayoung | no relation between those two things | 18:52 |
| raildo | ayoung: ok, so we just neet revalidate the related tokens? | 18:52 |
| amakarov | ayoung, please review my unified delegation patches when you have some time | 18:52 |
| raildo | need* | 18:52 |
| ayoung | amakarov, will do | 18:52 |
| dstanek | amakarov: exactly :-) RPC isn't scalable in the same way that REST is. but you were really not doing RPC, but rather dynamically splitting out the client | 18:53 |
| *** real56 has quit IRC | 18:53 | |
| *** spzala has quit IRC | 18:53 | |
| ayoung | raildo, yes, specifically, that the trust is valid | 18:53 |
| *** spzala has joined #openstack-keystone | 18:53 | |
| raildo | ayoung: got it | 18:53 |
| ayoung | raildo, I might be able to merge the heart of that patch into the big one, and see if it works... | 18:53 |
| ayoung | need to make sure the v2 tokens get tagged as trust tokens | 18:53 |
| *** dflorea has quit IRC | 18:53 | |
| amakarov | dstanek, right, that code can be called RPC only conceptually )) | 18:53 |
| raildo | ayoung: ++ | 18:54 |
| *** jsavak has quit IRC | 18:54 | |
| lbragstad | ayoung do we need that to land before the "make fernet default" patch? | 18:55 |
| *** spzala_ has quit IRC | 18:55 | |
| *** roxanaghe has quit IRC | 18:56 | |
| ayoung | lbragstad, I think so, and there might be a need to deal with the caching at the same time | 18:57 |
| *** spzala has quit IRC | 18:57 | |
| *** jsavak has joined #openstack-keystone | 18:57 | |
| ayoung | lbragstad, the fact that it passed 27 is heartening | 18:57 |
| *** aginwala has joined #openstack-keystone | 18:57 | |
| lbragstad | ayoung ++ | 18:57 |
| ayoung | lbragstad, raildo I'm going to rebase that one and see where that gets us | 18:57 |
| *** e0ne has joined #openstack-keystone | 19:00 | |
| *** GB21 has quit IRC | 19:03 | |
| *** pushkaru has quit IRC | 19:03 | |
| *** aginwala has quit IRC | 19:05 | |
| *** diazjf has quit IRC | 19:07 | |
| *** diazjf has joined #openstack-keystone | 19:08 | |
| *** david-lyle_ has joined #openstack-keystone | 19:13 | |
| *** roxanaghe has joined #openstack-keystone | 19:15 | |
| *** spzala has joined #openstack-keystone | 19:15 | |
| *** david-lyle has quit IRC | 19:15 | |
| *** real56 has joined #openstack-keystone | 19:16 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 19:17 | |
| *** aginwala has joined #openstack-keystone | 19:17 | |
| *** david-lyle_ has quit IRC | 19:19 | |
| *** diazjf1 has joined #openstack-keystone | 19:20 | |
| *** pushkaru has joined #openstack-keystone | 19:21 | |
| *** diazjf has quit IRC | 19:23 | |
| *** diazjf1 has quit IRC | 19:24 | |
| *** jaosorior has quit IRC | 19:27 | |
| openstackgerrit | ayoung proposed openstack/keystone: Make fernet support trust auth against v2.0 https://review.openstack.org/278693 | 19:29 |
| ayoung | lbragstad, raildo hmmm...seems broken still | 19:29 |
| *** david-lyle has joined #openstack-keystone | 19:29 | |
| lbragstad | ayoung wasn't all the py27 tests passing? | 19:29 |
| ayoung | lbragstad, yeah, but not after rebase | 19:29 |
| ayoung | lbragstad, maybe I messed up the rebase, but I think I put everything in the same place s | 19:30 |
| ayoung | lbragstad, actually, it looks way too different to be correct | 19:30 |
| ayoung | care to take a swipe at the rebase? | 19:31 |
| *** david-lyle has quit IRC | 19:31 | |
| *** david-lyle has joined #openstack-keystone | 19:31 | |
| lbragstad | ayoung was the latest version you pushed the rebase? ^ | 19:32 |
| ayoung | lbragstad, yep. but the tests might have been poorly merged | 19:32 |
| *** mvk has joined #openstack-keystone | 19:32 | |
| ayoung | lbragstad, feel free to take it from the top...a few things have changed in the test file since your last successful run | 19:33 |
| lbragstad | ayoung ok - i'll take a peek at it | 19:34 |
| ayoung | thanks | 19:34 |
| *** mvk_ has joined #openstack-keystone | 19:35 | |
| *** mylu has quit IRC | 19:35 | |
| lbragstad | ayoung thank you | 19:36 |
| *** david-lyle has quit IRC | 19:37 | |
| *** mylu has joined #openstack-keystone | 19:38 | |
| *** mvk has quit IRC | 19:39 | |
| *** aginwala has quit IRC | 19:45 | |
| *** alex_xu has quit IRC | 19:54 | |
| *** rderose has quit IRC | 19:55 | |
| *** alex_xu has joined #openstack-keystone | 19:55 | |
| *** rderose has joined #openstack-keystone | 19:55 | |
| ayoung | raildo, lbragstad so I think I have those changes in the fernet default tree already. Necessary but not sufficient | 19:58 |
| *** real56 has quit IRC | 19:58 | |
| ayoung | lbragstad, what I was seeing was that when reconstituting a v2 token that was built from a trust, it did not have the trust ID inside | 19:58 |
| *** anush_ has quit IRC | 19:58 | |
| raildo | ayoung: i suggestto put in the commit message or in any other place, what we have to do to finish this patch, just to make this clear for everybody | 19:59 |
| *** anush_ has joined #openstack-keystone | 20:00 | |
| raildo | ayoung: maybe reply that email about the fernet token progress | 20:00 |
| *** ametts has quit IRC | 20:01 | |
| jdandrea | Does anyone out there restrict their adminurl endpoints to private networks (separate from publicurl endpoints)? I can reach our publicurl endpoints but not our adminurl ones, and it's really tripping me up. | 20:03 |
| *** diazjf has joined #openstack-keystone | 20:05 | |
| *** diazjf1 has joined #openstack-keystone | 20:06 | |
| *** diazjf2 has joined #openstack-keystone | 20:07 | |
| *** mkrcmari__ has joined #openstack-keystone | 20:07 | |
| openstackgerrit | ayoung proposed openstack/keystone: [WIP]Make fernet default token provider https://review.openstack.org/258650 | 20:09 |
| ayoung | raildo, about 6 failures still | 20:09 |
| *** mvk_ has quit IRC | 20:10 | |
| *** diazjf1 has quit IRC | 20:10 | |
| raildo | ayoung: thanks sir! | 20:10 |
| *** diazjf has quit IRC | 20:11 | |
| *** dflorea has joined #openstack-keystone | 20:11 | |
| *** aginwala has joined #openstack-keystone | 20:11 | |
| *** agrebennikov has quit IRC | 20:13 | |
| *** jed56 has quit IRC | 20:13 | |
| *** dflorea has quit IRC | 20:14 | |
| *** dflorea has joined #openstack-keystone | 20:15 | |
| *** dflorea has quit IRC | 20:16 | |
| *** dflorea has joined #openstack-keystone | 20:16 | |
| *** ametts has joined #openstack-keystone | 20:17 | |
| *** ayoung has quit IRC | 20:18 | |
| *** stingaci has quit IRC | 20:19 | |
| *** sdake_ is now known as sdake | 20:23 | |
| *** diazjf has joined #openstack-keystone | 20:27 | |
| *** diazjf1 has joined #openstack-keystone | 20:28 | |
| *** dflorea has quit IRC | 20:29 | |
| *** aginwala has quit IRC | 20:30 | |
| *** diazjf2 has quit IRC | 20:31 | |
| *** dflorea has joined #openstack-keystone | 20:31 | |
| *** diazjf has quit IRC | 20:32 | |
| *** timcline has joined #openstack-keystone | 20:32 | |
| *** aginwala has joined #openstack-keystone | 20:40 | |
| *** spzala has quit IRC | 20:40 | |
| *** ametts has quit IRC | 20:41 | |
| *** ericksonsantos has joined #openstack-keystone | 20:41 | |
| *** mvk_ has joined #openstack-keystone | 20:46 | |
| *** mkrcmari__ has quit IRC | 20:50 | |
| *** mkrcmari__ has joined #openstack-keystone | 20:50 | |
| *** diazjf1 has quit IRC | 20:50 | |
| *** diazjf1 has joined #openstack-keystone | 20:51 | |
| *** dflorea has quit IRC | 20:52 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/302855 | 20:53 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/300764 | 20:53 |
| *** mvk_ has quit IRC | 20:54 | |
| *** mylu has quit IRC | 20:54 | |
| *** mylu has joined #openstack-keystone | 20:54 | |
| *** aginwala has quit IRC | 20:55 | |
| *** stingaci has joined #openstack-keystone | 20:55 | |
| *** mvk_ has joined #openstack-keystone | 20:55 | |
| *** aginwala has joined #openstack-keystone | 20:56 | |
| *** david-lyle has joined #openstack-keystone | 20:56 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/302881 | 20:57 |
| *** dflorea has joined #openstack-keystone | 20:58 | |
| *** rderose has quit IRC | 20:58 | |
| *** mkrcmari__ has quit IRC | 20:59 | |
| *** rderose has joined #openstack-keystone | 21:00 | |
| *** dflorea has quit IRC | 21:01 | |
| *** dflorea has joined #openstack-keystone | 21:01 | |
| *** pcaruana has quit IRC | 21:01 | |
| *** dflorea has quit IRC | 21:03 | |
| *** mylu has quit IRC | 21:04 | |
| *** e0ne has quit IRC | 21:04 | |
| *** dflorea has joined #openstack-keystone | 21:05 | |
| *** trown is now known as trown|outtypewww | 21:06 | |
| *** dflorea has quit IRC | 21:07 | |
| *** dflorea has joined #openstack-keystone | 21:08 | |
| *** ksnihyr has quit IRC | 21:09 | |
| *** ksnihyr has joined #openstack-keystone | 21:10 | |
| *** diazjf1 has quit IRC | 21:11 | |
| *** diazjf has joined #openstack-keystone | 21:11 | |
| *** raildo is now known as raildo-afk | 21:11 | |
| *** e0ne has joined #openstack-keystone | 21:11 | |
| *** dflorea has quit IRC | 21:12 | |
| *** agrebennikov has joined #openstack-keystone | 21:12 | |
| *** ksnihyr has quit IRC | 21:14 | |
| *** diazjf has quit IRC | 21:15 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Add API Change Tutorial https://review.openstack.org/302789 | 21:15 |
| samueldmq | yeah, now an initial version that makes sense | 21:15 |
| samueldmq | goal of this is to help new contributors to get familiar with the code base | 21:15 |
| samueldmq | and how API changes happen here | 21:15 |
| *** e0ne has quit IRC | 21:18 | |
| *** mylu has joined #openstack-keystone | 21:19 | |
| *** diazjf has joined #openstack-keystone | 21:19 | |
| *** mylu has quit IRC | 21:20 | |
| *** rderose has quit IRC | 21:21 | |
| *** rderose has joined #openstack-keystone | 21:22 | |
| *** jsavak has quit IRC | 21:22 | |
| *** jsavak has joined #openstack-keystone | 21:23 | |
| *** lhcheng has quit IRC | 21:23 | |
| *** mylu has joined #openstack-keystone | 21:24 | |
| *** diazjf has quit IRC | 21:26 | |
| *** mylu has quit IRC | 21:29 | |
| *** ayoung has joined #openstack-keystone | 21:32 | |
| *** ChanServ sets mode: +v ayoung | 21:32 | |
| openstackgerrit | Tim Burke proposed openstack/keystonemiddleware: Have s3_token accept identity_uri config option https://review.openstack.org/294835 | 21:44 |
| *** timcline has quit IRC | 21:45 | |
| *** timcline has joined #openstack-keystone | 21:45 | |
| *** stingaci has quit IRC | 21:46 | |
| openstackgerrit | Merged openstack/pycadf: Updated from global requirements https://review.openstack.org/302992 | 21:48 |
| *** timcline has quit IRC | 21:50 | |
| *** rderose has quit IRC | 21:51 | |
| *** rderose has joined #openstack-keystone | 21:51 | |
| *** mylu has joined #openstack-keystone | 21:52 | |
| *** pauloewerton has quit IRC | 21:54 | |
| roxanaghe | ayoung, knikolla: hey there, I think I found a way to mock the ldap3 calls at the socket level inside the ldap3 library (for our unit testing purposes) | 21:56 |
| roxanaghe | ayoung, knikolla here's my first stab at it: https://github.com/roxanagherle/ldap3/blob/master/ldap3/strategy/mockSync.py | 21:56 |
| lbragstad | dolphm mfisch want to have a meeting for our talk soon? | 21:57 |
| knikolla | roxanaghe, awesome! | 21:59 |
| *** david_cu has quit IRC | 22:00 | |
| *** slberger has left #openstack-keystone | 22:01 | |
| *** ayoung has quit IRC | 22:01 | |
| roxanaghe | knikolla also, I was wondering if we really want to have write operations implemented or just test the read operations based on a configurable mock setup | 22:05 |
| *** dave-mccowan has quit IRC | 22:06 | |
| *** stingaci has joined #openstack-keystone | 22:06 | |
| knikolla | roxanaghe, that is a very good point. i would hope that a configurable setup would remove the need for write operations at all. | 22:07 |
| openstackgerrit | Merged openstack/keystone: Bandit test results https://review.openstack.org/299373 | 22:07 |
| *** david_cu has joined #openstack-keystone | 22:08 | |
| *** mylu has quit IRC | 22:08 | |
| *** pushkaru has quit IRC | 22:08 | |
| roxanaghe | knikolla, that would make my life easier as well | 22:09 |
| *** ksnihyr has joined #openstack-keystone | 22:10 | |
| knikolla | roxanaghe, agreed. | 22:12 |
| *** david_cu has quit IRC | 22:12 | |
| knikolla | roxanaghe, good work! | 22:15 |
| *** ksnihyr has quit IRC | 22:15 | |
| *** stingaci has quit IRC | 22:16 | |
| roxanaghe | knikolla, thx! | 22:17 |
| *** stingaci has joined #openstack-keystone | 22:17 | |
| *** dave-mccowan has joined #openstack-keystone | 22:18 | |
| *** knikolla has quit IRC | 22:19 | |
| *** doug-fish has quit IRC | 22:23 | |
| *** ayoung has joined #openstack-keystone | 22:26 | |
| *** ChanServ sets mode: +v ayoung | 22:26 | |
| *** timcline has joined #openstack-keystone | 22:27 | |
| *** aginwala has quit IRC | 22:28 | |
| *** aginwala has joined #openstack-keystone | 22:28 | |
| *** rcernin has quit IRC | 22:29 | |
| *** aginwala_ has joined #openstack-keystone | 22:31 | |
| *** aginwala has quit IRC | 22:32 | |
| *** rderose has quit IRC | 22:32 | |
| *** diazjf has joined #openstack-keystone | 22:41 | |
| *** lhcheng has joined #openstack-keystone | 22:42 | |
| *** ChanServ sets mode: +v lhcheng | 22:42 | |
| *** pumarani- has joined #openstack-keystone | 22:42 | |
| *** aginwala_ has quit IRC | 22:43 | |
| *** timcline has quit IRC | 22:44 | |
| *** timcline has joined #openstack-keystone | 22:44 | |
| *** gordc has quit IRC | 22:46 | |
| *** daemontool has joined #openstack-keystone | 22:48 | |
| *** timcline has quit IRC | 22:49 | |
| *** mylu has joined #openstack-keystone | 22:52 | |
| *** aginwala has joined #openstack-keystone | 22:53 | |
| *** sdake has quit IRC | 22:54 | |
| *** aginwala has quit IRC | 22:56 | |
| *** sdake has joined #openstack-keystone | 22:58 | |
| *** aginwala has joined #openstack-keystone | 23:00 | |
| *** ksnihyr has joined #openstack-keystone | 23:11 | |
| *** sdake has quit IRC | 23:12 | |
| *** jsavak has quit IRC | 23:13 | |
| *** aginwala has quit IRC | 23:13 | |
| *** aginwala has joined #openstack-keystone | 23:13 | |
| *** dflorea has joined #openstack-keystone | 23:15 | |
| *** ksnihyr has quit IRC | 23:17 | |
| *** aginwala has quit IRC | 23:17 | |
| *** aginwala has joined #openstack-keystone | 23:20 | |
| *** henrynash has joined #openstack-keystone | 23:21 | |
| *** ChanServ sets mode: +v henrynash | 23:21 | |
| openstackgerrit | Merged openstack/oslo.policy: Updated from global requirements https://review.openstack.org/302985 | 23:22 |
| *** pumarani- has quit IRC | 23:22 | |
| *** ayoung has quit IRC | 23:26 | |
| *** diazjf has quit IRC | 23:26 | |
| *** tqtran has quit IRC | 23:27 | |
| *** markvoelker has quit IRC | 23:29 | |
| *** arunkant_ has quit IRC | 23:32 | |
| *** jamielennox|away is now known as jamielennox | 23:36 | |
| *** stingaci has quit IRC | 23:37 | |
| *** mylu has quit IRC | 23:38 | |
| *** diazjf has joined #openstack-keystone | 23:40 | |
| *** anush_ has quit IRC | 23:43 | |
| *** mylu has joined #openstack-keystone | 23:45 | |
| *** roxanaghe has quit IRC | 23:50 | |
| *** markvoelker has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!