| *** roxanaghe has quit IRC | 00:02 | |
| stevemar | morgan: yay! i'll have bknudson look at it again | 00:06 |
|---|---|---|
| *** sdake has joined #openstack-keystone | 00:06 | |
| *** mylu has quit IRC | 00:07 | |
| *** mylu has joined #openstack-keystone | 00:13 | |
| *** stingaci has quit IRC | 00:14 | |
| *** mylu has quit IRC | 00:19 | |
| *** mylu has joined #openstack-keystone | 00:21 | |
| *** ekarlso has quit IRC | 00:32 | |
| *** mylu has quit IRC | 00:44 | |
| *** ekarlso has joined #openstack-keystone | 00:44 | |
| *** mylu has joined #openstack-keystone | 00:47 | |
| dims | morgan : keystoneauth, keystonemiddleware, pycadf look good. | 00:58 |
| morgan | dims: yay | 00:58 |
| *** sdake_ has joined #openstack-keystone | 01:14 | |
| *** sdake has quit IRC | 01:18 | |
| *** EinstCrazy has joined #openstack-keystone | 01:18 | |
| *** edtubill has joined #openstack-keystone | 01:23 | |
| *** stingaci has joined #openstack-keystone | 01:26 | |
| morgan | stevemar: you know what is going to be sad.. If Windows with bash runs keystone unit tests better than OS X... | 01:39 |
| *** roxanaghe has joined #openstack-keystone | 01:46 | |
| *** browne has joined #openstack-keystone | 01:46 | |
| *** EinstCra_ has joined #openstack-keystone | 01:49 | |
| *** roxanaghe has quit IRC | 01:50 | |
| *** EinstCrazy has quit IRC | 01:52 | |
| *** mylu has quit IRC | 02:10 | |
| *** timonwong has joined #openstack-keystone | 02:18 | |
| *** alex_xu has quit IRC | 02:18 | |
| *** alex_xu has joined #openstack-keystone | 02:22 | |
| *** timonwong has quit IRC | 02:23 | |
| *** timonwong has joined #openstack-keystone | 02:23 | |
| *** browne has quit IRC | 02:26 | |
| *** timonwong has quit IRC | 02:30 | |
| *** timonwong has joined #openstack-keystone | 02:32 | |
| stevemar | ha | 02:33 |
| stevemar | morgan: i wouldn't be too optimistic | 02:33 |
| morgan | Well. *shrug* | 02:34 |
| *** zqfan has joined #openstack-keystone | 02:47 | |
| openstackgerrit | Kylin CG proposed openstack/keystone: Typo fix in tests https://review.openstack.org/306892 | 02:53 |
| *** EinstCra_ has quit IRC | 02:54 | |
| *** EinstCrazy has joined #openstack-keystone | 03:03 | |
| *** sdake_ has quit IRC | 03:30 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/305187 | 04:22 |
| *** ekarlso has quit IRC | 04:27 | |
| *** sdake has joined #openstack-keystone | 04:28 | |
| *** timonwong has quit IRC | 04:28 | |
| *** timonwong has joined #openstack-keystone | 04:37 | |
| *** ekarlso has joined #openstack-keystone | 04:40 | |
| *** links has joined #openstack-keystone | 04:41 | |
| *** mylu has joined #openstack-keystone | 05:03 | |
| *** rcernin has joined #openstack-keystone | 05:04 | |
| openstackgerrit | Merged openstack/keystone: Typo fix in tests https://review.openstack.org/306892 | 05:04 |
| *** mylu has quit IRC | 05:11 | |
| *** e0ne has joined #openstack-keystone | 05:15 | |
| *** e0ne has quit IRC | 05:18 | |
| *** roxanaghe has joined #openstack-keystone | 05:22 | |
| *** stingaci has quit IRC | 05:22 | |
| *** mylu has joined #openstack-keystone | 05:24 | |
| *** Nirupama has joined #openstack-keystone | 05:25 | |
| *** roxanaghe has quit IRC | 05:26 | |
| *** mylu has quit IRC | 05:29 | |
| morgan | ayoung: https://bugs.launchpad.net/keystoneauth/+bug/1469847 please either close this or triage this. | 05:48 |
| openstack | Launchpad bug 1469847 in keystoneauth "authenticating with kerberos (via openstack token issue) reports Error with "Success" followed by non-ascii chracters" [Undecided,New] - Assigned to Adam Young (ayoung) | 05:48 |
| morgan | yolanda: https://bugs.launchpad.net/keystoneauth/+bug/1569811 just requires an update to global-requirements | 05:51 |
| openstack | Launchpad bug 1569811 in keystoneauth "keystonauth betamax fixture shall consume latest betamax release" [Undecided,Invalid] | 05:51 |
| morgan | yolanda: should be an easy fix to propose :) and the proposal bot will handle getting it into keystoneauth. | 05:52 |
| openstackgerrit | Srushti Gadadare proposed openstack/keystone: Provide user friendly messages for db_sync https://review.openstack.org/289316 | 05:54 |
| openstackgerrit | Srushti Gadadare proposed openstack/keystone: Provide user friendly messages for db_sync https://review.openstack.org/289316 | 05:57 |
| *** edtubill has quit IRC | 06:07 | |
| *** zzxwill has joined #openstack-keystone | 06:14 | |
| *** jaosorior has joined #openstack-keystone | 06:24 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystoneauth: Make version optional for auth_url https://review.openstack.org/306922 | 06:30 |
| *** alex_xu has quit IRC | 06:40 | |
| *** alex_xu has joined #openstack-keystone | 06:41 | |
| *** henrynash has joined #openstack-keystone | 07:07 | |
| *** ChanServ sets mode: +v henrynash | 07:07 | |
| *** jaosorior has quit IRC | 07:11 | |
| *** zzxwill has quit IRC | 07:15 | |
| *** pcaruana has joined #openstack-keystone | 07:15 | |
| *** jed56 has joined #openstack-keystone | 07:16 | |
| *** e0ne has joined #openstack-keystone | 07:16 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/305187 | 07:17 |
| *** odyssey4me_ is now known as odyssey4me | 07:38 | |
| *** rha_ is now known as rha | 07:43 | |
| *** rha has joined #openstack-keystone | 07:43 | |
| *** alex_xu has quit IRC | 07:49 | |
| *** pnavarro has joined #openstack-keystone | 07:50 | |
| *** alex_xu has joined #openstack-keystone | 07:51 | |
| *** vgridnev has joined #openstack-keystone | 07:54 | |
| *** jaosorior has joined #openstack-keystone | 07:55 | |
| *** vgridnev has quit IRC | 07:56 | |
| *** jaosorior has quit IRC | 07:56 | |
| *** pnavarro has quit IRC | 08:08 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/306848 | 08:10 |
| *** daemontool has quit IRC | 08:17 | |
| *** jistr has joined #openstack-keystone | 08:21 | |
| *** pnavarro has joined #openstack-keystone | 08:22 | |
| *** stian_ has joined #openstack-keystone | 08:24 | |
| stian_ | Where can I find detailed documentation about keystone_authtoken ? Cant find any information on auth_url. | 08:35 |
| *** henrynash has quit IRC | 08:35 | |
| *** naresht has joined #openstack-keystone | 08:41 | |
| *** henrynash has joined #openstack-keystone | 08:48 | |
| *** ChanServ sets mode: +v henrynash | 08:48 | |
| *** roxanaghe has joined #openstack-keystone | 08:58 | |
| yolanda | morgan https://review.openstack.org/307000 | 08:59 |
| morgan | yolanda: you might need to adjust upper-constraints as well | 08:59 |
| yolanda | morgan, 0.6.0 is not ok? | 09:00 |
| yolanda | it's set to 0.6.0 in upper constraints | 09:00 |
| morgan | oh is that already in u-c? | 09:00 |
| morgan | cool | 09:00 |
| morgan | :) | 09:00 |
| morgan | that makes it easy | 09:00 |
| morgan | no need to change then | 09:00 |
| yolanda | yep, it was set to 0.6.0. Not sure why, because this version didn't exist | 09:00 |
| morgan | +1 | 09:01 |
| yolanda | thanks | 09:01 |
| morgan | (wish i could +2) | 09:01 |
| yolanda | let's see if that is reviewed fast | 09:01 |
| yolanda | anyway, i'm still finishing work with keystoneauth patch | 09:02 |
| morgan | :) | 09:02 |
| *** roxanaghe has quit IRC | 09:03 | |
| *** tesseract has joined #openstack-keystone | 09:03 | |
| yolanda | i will depend on JSONSerializer instead of PrettyJSONSerializer, so we can drop that dependency | 09:03 |
| morgan | cool | 09:03 |
| morgan | wfm | 09:03 |
| *** tesseract is now known as Guest30394 | 09:03 | |
| yolanda | the extra feature provided by PrettyJSONSerializer is already on my serializer anyway | 09:03 |
| *** jistr has quit IRC | 09:05 | |
| *** sdake has quit IRC | 09:07 | |
| *** sdake has joined #openstack-keystone | 09:07 | |
| *** jistr has joined #openstack-keystone | 09:12 | |
| *** sheel has joined #openstack-keystone | 09:15 | |
| openstackgerrit | James Pic proposed openstack/keystone: Typo in sysctl command example Edit https://review.openstack.org/307008 | 09:20 |
| openstackgerrit | James Pic proposed openstack/keystone: Typo in sysctl command example Edit https://review.openstack.org/307008 | 09:22 |
| openstackgerrit | yolanda.robla proposed openstack/keystoneauth: Create custom serializer for keystoneauth and betamax https://review.openstack.org/305937 | 09:23 |
| *** timonwong has quit IRC | 09:34 | |
| *** timonwong has joined #openstack-keystone | 09:35 | |
| *** vnogin1 has quit IRC | 09:39 | |
| *** vnogin has joined #openstack-keystone | 09:40 | |
| *** EinstCrazy has quit IRC | 10:09 | |
| *** andreykurilin has quit IRC | 10:10 | |
| *** timonwong has quit IRC | 10:36 | |
| *** daemontool has joined #openstack-keystone | 10:38 | |
| openstackgerrit | Srushti Gadadare proposed openstack/keystone: Provide user friendly messages for db_sync https://review.openstack.org/289316 | 10:42 |
| openstackgerrit | yolanda.robla proposed openstack/keystoneauth: Create custom serializer for keystoneauth and betamax https://review.openstack.org/305937 | 10:52 |
| *** toddnni_ has joined #openstack-keystone | 11:01 | |
| *** zhiyan_ has joined #openstack-keystone | 11:02 | |
| *** andreykurilin___ has joined #openstack-keystone | 11:02 | |
| *** haneef__ has joined #openstack-keystone | 11:03 | |
| *** wxy_ has joined #openstack-keystone | 11:03 | |
| *** ktychkova_ has joined #openstack-keystone | 11:03 | |
| *** orzel_ has joined #openstack-keystone | 11:04 | |
| *** krotscheck_ has joined #openstack-keystone | 11:04 | |
| *** jgriffith_ has joined #openstack-keystone | 11:04 | |
| *** lbragstad_ has joined #openstack-keystone | 11:04 | |
| *** tristanC_ has joined #openstack-keystone | 11:04 | |
| *** topol_ has joined #openstack-keystone | 11:04 | |
| *** BAKfr_ has joined #openstack-keystone | 11:04 | |
| *** rodrigods has quit IRC | 11:04 | |
| *** kfox1111_ has joined #openstack-keystone | 11:04 | |
| *** jaosorior has joined #openstack-keystone | 11:05 | |
| *** arunkant_ has joined #openstack-keystone | 11:05 | |
| *** rodrigods has joined #openstack-keystone | 11:05 | |
| *** dmellado_ has joined #openstack-keystone | 11:05 | |
| *** jasondotstar_ has joined #openstack-keystone | 11:05 | |
| *** hugokuo_ has joined #openstack-keystone | 11:05 | |
| *** nkinder_ has joined #openstack-keystone | 11:05 | |
| *** clayton_ has joined #openstack-keystone | 11:05 | |
| *** BAKfr has quit IRC | 11:05 | |
| *** andreykurilin__ has quit IRC | 11:05 | |
| *** wxy has quit IRC | 11:05 | |
| *** timburke has quit IRC | 11:05 | |
| *** jgriffith has quit IRC | 11:05 | |
| *** orzel has quit IRC | 11:05 | |
| *** dtroyer has quit IRC | 11:05 | |
| *** lbragstad has quit IRC | 11:05 | |
| *** topol has quit IRC | 11:05 | |
| *** jasondotstar has quit IRC | 11:05 | |
| *** baffle has quit IRC | 11:05 | |
| *** kinrui has quit IRC | 11:06 | |
| *** serverascode has quit IRC | 11:06 | |
| *** zhiyan has quit IRC | 11:06 | |
| *** harlowja has quit IRC | 11:06 | |
| *** krotscheck has quit IRC | 11:06 | |
| *** hugokuo has quit IRC | 11:06 | |
| *** dmellado has quit IRC | 11:06 | |
| *** ianw has quit IRC | 11:06 | |
| *** haneef_ has quit IRC | 11:06 | |
| *** arunkant has quit IRC | 11:06 | |
| *** jdennis has quit IRC | 11:06 | |
| *** toddnni has quit IRC | 11:06 | |
| *** tristanC has quit IRC | 11:06 | |
| *** nkinder has quit IRC | 11:06 | |
| *** ktychkova has quit IRC | 11:06 | |
| *** kfox1111 has quit IRC | 11:06 | |
| *** clayton has quit IRC | 11:06 | |
| *** BAKfr_ is now known as BAKfr | 11:06 | |
| *** jgriffith_ is now known as jgriffith | 11:06 | |
| *** serverascode_ has joined #openstack-keystone | 11:06 | |
| *** toddnni_ is now known as toddnni | 11:06 | |
| *** wxy_ is now known as wxy | 11:06 | |
| *** jasondotstar_ is now known as jasondotstar | 11:06 | |
| *** jgriffith is now known as Guest72772 | 11:06 | |
| *** jdennis has joined #openstack-keystone | 11:06 | |
| *** andreykurilin___ is now known as andreykurilin__ | 11:06 | |
| *** timburke has joined #openstack-keystone | 11:06 | |
| *** hugokuo_ is now known as hugokuo | 11:06 | |
| *** krotscheck_ is now known as krotscheck | 11:06 | |
| *** clayton_ is now known as clayton | 11:07 | |
| *** lunarlamp is now known as mariusv | 11:07 | |
| *** dtroyer has joined #openstack-keystone | 11:07 | |
| *** ianw has joined #openstack-keystone | 11:08 | |
| *** zqfan has quit IRC | 11:09 | |
| *** zhiyan_ is now known as zhiyan | 11:10 | |
| *** rcernin has quit IRC | 11:12 | |
| *** serverascode_ is now known as serverascode | 11:12 | |
| *** kinrui has joined #openstack-keystone | 11:17 | |
| *** zqfan has joined #openstack-keystone | 11:18 | |
| *** baffle has joined #openstack-keystone | 11:18 | |
| *** mugsie_ is now known as mugsie | 11:19 | |
| *** samueldm1 has quit IRC | 11:22 | |
| *** samueldmq has joined #openstack-keystone | 11:22 | |
| *** EinstCrazy has joined #openstack-keystone | 11:23 | |
| *** rcernin has joined #openstack-keystone | 11:23 | |
| *** ChanServ sets mode: +v samueldmq | 11:24 | |
| samueldmq | morning keystone | 11:24 |
| *** aimeeU has joined #openstack-keystone | 11:29 | |
| breton | morning | 11:29 |
| *** henrynash has quit IRC | 11:29 | |
| *** henrynash has joined #openstack-keystone | 11:31 | |
| *** ChanServ sets mode: +v henrynash | 11:31 | |
| henrynash | moning | 11:31 |
| henrynash | even morning | 11:31 |
| samueldmq | breton: henrynash: howdy | 11:34 |
| henrynash | samueldmq: hi | 11:34 |
| samueldmq | henrynash: you going to Austin again ? | 11:34 |
| henrynash | samueldmq: yep…you? | 11:34 |
| samueldmq | henrynash: yes :) | 11:34 |
| henrynash | sameuldmq: excellent | 11:35 |
| *** gordc has joined #openstack-keystone | 11:35 | |
| morgan | lol | 11:40 |
| morgan | so.... | 11:40 |
| morgan | i think windows with beta ubuntu bash does a better job of running keystone unit tests than OS X does. | 11:40 |
| * morgan might be running this now | 11:40 | |
| *** EinstCrazy has quit IRC | 11:40 | |
| morgan | though the terminal does a really bad job of handling curses. | 11:40 |
| samueldmq | morgan: gegege | 11:43 |
| samueldmq | ooops | 11:43 |
| samueldmq | hehehe* | 11:43 |
| morgan | hehe :) | 11:44 |
| *** dave-mccowan has joined #openstack-keystone | 11:44 | |
| morgan | and it looks like mosh doesn't work :( | 11:45 |
| *** josecastroleon has joined #openstack-keystone | 11:46 | |
| morgan | d | 11:51 |
| *** henrynash has quit IRC | 11:52 | |
| morgan | .. | 11:54 |
| morgan | boo. | 11:55 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/python-keystoneclient: Improve docs for v3 users https://review.openstack.org/305796 | 11:56 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/python-keystoneclient: Add users functional tests https://review.openstack.org/289306 | 11:58 |
| *** iurygregory has joined #openstack-keystone | 12:02 | |
| *** mtreinish has joined #openstack-keystone | 12:03 | |
| *** tellesnobrega is now known as tellesnobrega_af | 12:05 | |
| *** EinstCrazy has joined #openstack-keystone | 12:07 | |
| morgan | ugh. sooooo close | 12:07 |
| morgan | so close. | 12:07 |
| *** trown|outtypewww is now known as trown | 12:09 | |
| *** clenimar has joined #openstack-keystone | 12:11 | |
| *** raildo-afk is now known as raildo | 12:12 | |
| *** henrynash has joined #openstack-keystone | 12:13 | |
| *** ChanServ sets mode: +v henrynash | 12:13 | |
| *** mylu has joined #openstack-keystone | 12:15 | |
| morgan | samueldmq: hows it going today? | 12:16 |
| *** markvoelker has joined #openstack-keystone | 12:19 | |
| henrynash | morgan: Hi…any chance you could give you blessing to: https://review.openstack.org/#/c/288403/4 - adding tests to expose an bug that is in the process of being fixed | 12:24 |
| patchbot | henrynash: patch 288403 - keystone - Expose not clearing of user default project on pro... | 12:24 |
| amakarov | morgan, we've just discovered a problem with memcache: if revocation tree grows larger 1M it can't be memoized due to memcached restrictions | 12:25 |
| morgan | amakarov: this isn't exactly new info. | 12:25 |
| morgan | amakarov: welcome to slab-size issues :( | 12:25 |
| morgan | amakarov: this has been the same issue we've battled for many many many releases when dealing with memached | 12:25 |
| *** mylu has quit IRC | 12:26 | |
| *** edmondsw has joined #openstack-keystone | 12:26 | |
| morgan | amakarov: this is why we need to drastically reduce the size of the tree... actually... we need to just kill the whole revoke tree completely | 12:26 |
| amakarov | morgan, thanks :) can we do some workaround like "don't actually cache anything larger than..." | 12:26 |
| amakarov | ? | 12:26 |
| morgan | amakarov: sortof. though if you are hitting that you're better off just turning off revoke tree caching | 12:27 |
| morgan | amakarov: for the immediate use. long term, we'll kill the revoke tree and go with a much simpler SQL query that says "YES" or "NO" to the token being revoked. | 12:27 |
| amakarov | morgan, that'll be interesting, is there a bp for that? | 12:28 |
| morgan | nope. not yet. i figured it was a convo i needed to have with ayoung | 12:28 |
| morgan | amakarov: the alternatve if to make the @memoize decorator smart enough to split the data structure up and chain it together. [another alternative i've played with in the past] | 12:29 |
| morgan | not a good idea. | 12:29 |
| morgan | it is super fragile. | 12:29 |
| ayoung | lets focus on reducing the number of revocation events | 12:30 |
| *** ChanServ sets mode: +v topol_ | 12:30 | |
| *** topol_ is now known as topol | 12:30 | |
| ayoung | https://review.openstack.org/#/c/285134/ in progress | 12:30 |
| patchbot | ayoung: patch 285134 - keystone - Remove unneeded revocation events | 12:30 |
| ayoung | I thought the tree had been removed at one point and then re-added | 12:31 |
| ayoung | but going to the sql query will be both simpler and faster with fewer events | 12:31 |
| *** TxGVNN has joined #openstack-keystone | 12:32 | |
| *** mylu has joined #openstack-keystone | 12:33 | |
| *** roxanaghe has joined #openstack-keystone | 12:34 | |
| morgan | ayoung: ++ | 12:35 |
| morgan | henrynash: 'll take a look in a couple minutes, waiting for a very slow run of keystone unit tests to finishi | 12:35 |
| henrynash | morgan: thanks, no worries | 12:35 |
| *** mylu has quit IRC | 12:39 | |
| *** roxanaghe has quit IRC | 12:39 | |
| openstackgerrit | Kalaswan Datta proposed openstack/keystone: Clear the project ID from user information https://review.openstack.org/277707 | 12:40 |
| amakarov | morgan, ayoung: can we reach some consensus about the level where delegations should be unified? On mid-cycle I was told I can't touch managers, but I can't do some things (reach role_api for ex.) in the driver. | 12:41 |
| morgan | managers acan cross talk | 12:42 |
| morgan | drivers may not talk to managers | 12:42 |
| samueldmq | morgan: ++ | 12:42 |
| morgan | put the logic at the manager level | 12:43 |
| samueldmq | amakarov: what morgan said | 12:43 |
| morgan | if it needs to reach into multiple backends. or back out. | 12:43 |
| morgan | also.. lesson learned, CORE-M Processor doesn't like to do anything but run unit tests (even web pages... ugh) | 12:43 |
| amakarov | morgan, run tests in 1 thread then... | 12:44 |
| *** ninag has joined #openstack-keystone | 12:50 | |
| ayoung | amakarov, what morgan said is right: one driver should not call another driver, but one manager can call multiple drivers. Business logic belongs in the driver | 12:51 |
| morgan | amakarov: lol, it's just very very slow - i think running full keystone test is hitting ~30min so far | 12:51 |
| amakarov | ayoung, In the manager maybe? | 12:51 |
| morgan | amakarov: but... | 12:52 |
| morgan | https://twitter.com/MdrnStm/status/722043891508056064 | 12:52 |
| ayoung | ah right | 12:52 |
| ayoung | typo "in the driver" | 12:52 |
| ayoung | Busines logic "does not belong in the driver" | 12:53 |
| amakarov | ayoung, so should I change existing managers then or write my own and call it a driver? | 12:54 |
| ayoung | Business logic belongs in the *Manager* | 12:54 |
| *** pauloewerton has joined #openstack-keystone | 12:55 | |
| ayoung | amakarov, change existing Managers | 12:55 |
| * morgan leaves that direction to ayoung. | 12:55 | |
| ayoung | you can make helper classes if needs | 12:55 |
| amakarov | ayoung, should the unification be revertible? | 12:56 |
| amakarov | i.e. if my changes alter the manager logic how can it be used with old drivers? | 12:57 |
| amakarov | amakarov, or work that around with 'if's? | 12:57 |
| ayoung | amakarov, example? | 12:57 |
| amakarov | ayoung, looking for ancestor to create a delegation | 12:58 |
| ayoung | ah | 12:58 |
| amakarov | this part is completely incompatible with existing assignment logic | 12:58 |
| ayoung | amakarov, so you mean we need a transition plan.... | 12:58 |
| amakarov | ayoung, good idea ) | 12:58 |
| *** ninag_ has joined #openstack-keystone | 12:58 | |
| ayoung | amakarov, definite summit planning discussion | 12:59 |
| *** ninag__ has joined #openstack-keystone | 13:00 | |
| amakarov | ayoung, well, I've added it to etherpad | 13:00 |
| ayoung | amakarov, good. I'll try to come with some good ideas to get it rolling | 13:01 |
| amakarov | ayoung, I'll prepare some code too | 13:01 |
| *** ninag has quit IRC | 13:02 | |
| *** ninag_ has quit IRC | 13:03 | |
| morgan | ayoung: http://paste.openstack.org/show/494411/ lol ouch | 13:07 |
| morgan | that is a slow processor | 13:07 |
| ayoung | yep | 13:07 |
| morgan | but windows just leapfrogged over OS X as a viable OSS development platform | 13:08 |
| morgan | since you get at least 14.04 versions of dev libraries...vs... uhm... 7 year old bitrotting ones | 13:08 |
| *** kinrui is now known as fungi | 13:09 | |
| * ayoung sticks with Fedora | 13:10 | |
| *** ninag has joined #openstack-keystone | 13:16 | |
| *** ninag_ has joined #openstack-keystone | 13:17 | |
| *** ninag__ has quit IRC | 13:19 | |
| *** ninag has quit IRC | 13:21 | |
| morgan | thats fine, but the fact that i can run windows and still do openstack dev is pretty nice. :) | 13:25 |
| *** erhudy has joined #openstack-keystone | 13:25 | |
| morgan | also because the current laptop can't do linux... because the kernel doesn't support SPI devices :( | 13:25 |
| openstackgerrit | Merged openstack/keystone: Expose not clearing of user default project on project delete https://review.openstack.org/288403 | 13:25 |
| *** andreykurilin has joined #openstack-keystone | 13:26 | |
| samueldmq | morgan: is that a simple 'tox -e py27' or something like that ? | 13:30 |
| morgan | samueldmq: yeah running on the preview of windows 10 with the ubuntu native system installed | 13:30 |
| morgan | samueldmq: basically, i did the normal apt-get for all the tools you'd install on 14.04, and then ran tox (and pip installed tox/venv) | 13:31 |
| morgan | samueldmq: but this machine is very slow. so.. the test run was very slow | 13:31 |
| samueldmq | morgan: ++ | 13:32 |
| samueldmq | morgan: I was particularly looking at skipped tests | 13:32 |
| samueldmq | ~25% of all tests look a lot | 13:32 |
| morgan | pretty standard | 13:32 |
| samueldmq | morgan: is that okay ? looks like we need to restructure tests for sql/ldap | 13:33 |
| morgan | samueldmq: http://logs.openstack.org/12/277512/8/check/gate-keystone-python27-db/529e215/console.html.gz#_2016-04-14_21_20_06_667 | 13:34 |
| samueldmq | morgan: I think most of that is cuz ldap is not domain aware; then maybe we could separate such tests in another class , and not inherit them in LDAP test classses | 13:34 |
| morgan | samueldmq: keep restructuring tests to be better | 13:34 |
| samueldmq | morgan: just have lots of things to do there :) | 13:35 |
| bknudson | my goal with https://review.openstack.org/#/c/291950/13 is to eventually be able to have a much smaller set of tests in test_backends | 13:35 |
| patchbot | bknudson: patch 291950 - keystone - Define identity interface - easy cases | 13:35 |
| openstackgerrit | Kalaswan Datta proposed openstack/keystone: Create V9 driver for identity backend https://review.openstack.org/305315 | 13:36 |
| openstackgerrit | Kalaswan Datta proposed openstack/keystone: Clear the project ID from user information https://review.openstack.org/277707 | 13:36 |
| samueldmq | bknudson: ++, just voted there, it's looking great | 13:38 |
| bknudson | here's another part of the effort - https://review.openstack.org/#/c/283822/ | 13:39 |
| patchbot | bknudson: patch 283822 - keystone - Move resource manager tests out of test_backend | 13:39 |
| bknudson | although I haven't been keeping up with the merge conflicts there, just pointing it out as another thing to do | 13:39 |
| samueldmq | bknudson: so next step is basically move test cases from test_backends to identity/backends/test_base.py ? | 13:39 |
| samueldmq | bknudson: and remove duplicates | 13:39 |
| bknudson | test_backends tests the managers which are in subsystem/core.py , so they're moved to test_core.py | 13:40 |
| *** BigWillie has joined #openstack-keystone | 13:41 | |
| samueldmq | bknudson: got it, that's what you do in patch 283822 | 13:41 |
| patchbot | samueldmq: https://review.openstack.org/#/c/283822/ - keystone - Move resource manager tests out of test_backend | 13:41 |
| samueldmq | bknudson: while patch 291950 cretes the tests for the drivers themselves | 13:41 |
| patchbot | samueldmq: https://review.openstack.org/#/c/291950/ - keystone - Define identity interface - easy cases | 13:41 |
| samueldmq | bknudson: that's great | 13:41 |
| bknudson | right, rather than trying to test the drivers by writing tests against the managers, test the drivers directly | 13:42 |
| samueldmq | bknudson: ++ | 13:42 |
| samueldmq | bknudson: I am doing that for endpoint_policy and policy subsystems | 13:42 |
| samueldmq | bknudson: in patch 212006 and patch 212957 | 13:42 |
| patchbot | samueldmq: https://review.openstack.org/#/c/212006/ - keystone - Create unit tests for endpoint policy drivers | 13:42 |
| patchbot | samueldmq: https://review.openstack.org/#/c/212957/ - keystone - Create unit tests for the policy drivers | 13:42 |
| samueldmq | bknudson: I just need to restructure the subsystem's code themselves (putting a module called base.py, as we have for identity) | 13:43 |
| samueldmq | so the files called test_base.py I created there will make sense | 13:43 |
| bknudson | is there a review for creating base.py? | 13:43 |
| samueldmq | bknudson: not yet | 13:44 |
| *** martinus__ has quit IRC | 13:46 | |
| *** martinus__ has joined #openstack-keystone | 13:46 | |
| andreykurilin | hi all! | 13:47 |
| samueldmq | andreykurilin: hi | 13:47 |
| andreykurilin | I'm working on novaclient and want to deprecate our custom HTTPClient and use Keystone session always | 13:48 |
| amakarov | andreykurilin, I thought you were about nova channel ) | 13:48 |
| andreykurilin | amakarov: I have issues not at nova side:) | 13:49 |
| amakarov | andreykurilin, here is the common way to use sessions: http://docs.openstack.org/developer/keystoneauth/using-sessions.html | 13:49 |
| amakarov | andreykurilin, do you have client lib? | 13:49 |
| andreykurilin | amakarov: keystoneclient lib? | 13:50 |
| *** richm has joined #openstack-keystone | 13:50 | |
| amakarov | andreykurilin, that depends which service you want to use | 13:51 |
| raildo | andreykurilin: you have to use keystoneauth session | 13:51 |
| samueldmq | raildo: ++ | 13:51 |
| raildo | andreykurilin: we are doing a similar work on other services like swift, ironic | 13:51 |
| andreykurilin | raildo: one moment please) | 13:51 |
| andreykurilin | ok, let me share a patch :) https://review.openstack.org/#/c/304035/5/novaclient/client.py | 13:52 |
| patchbot | andreykurilin: patch 304035 - python-novaclient - WIP: Create Session instance if possible | 13:52 |
| andreykurilin | I already able to create keystone session for most cases | 13:52 |
| raildo | andreykurilin: awesome :) | 13:52 |
| andreykurilin | but I don't know how to transfer several novaclient's arguments to keystoneauth | 13:52 |
| andreykurilin | see L696-697 | 13:53 |
| andreykurilin | amakarov: ^ | 13:53 |
| raildo | andreykurilin: right, I suggest take a look ont hsi patch https://review.openstack.org/#/c/298968/6/swiftclient/client.py | 13:53 |
| patchbot | raildo: patch 298968 - python-swiftclient - Adding keystoneauth sessions support | 13:53 |
| raildo | andreykurilin: we made a similar work, since you have to get the service_type, interface, token from the session | 13:54 |
| *** Nirupama has quit IRC | 13:55 | |
| andreykurilin | raildo: thanks, will look at it | 13:55 |
| amakarov | andreykurilin, what exactly the problem there? | 13:55 |
| *** andrewbogott_ is now known as andrewbogott | 13:57 | |
| *** andrewbogott has quit IRC | 13:57 | |
| *** andrewbogott has joined #openstack-keystone | 13:57 | |
| andreykurilin | amakarov: I do not know how to create keystone session with existing token | 13:57 |
| raildo | andreykurilin: np, if you have any others doubts, I suggest ping pauloewerton, he was the guy who made this work :D | 13:57 |
| openstackgerrit | Kalaswan Datta proposed openstack/keystone: Clear the project ID from user information https://review.openstack.org/277707 | 13:57 |
| *** links has quit IRC | 13:57 | |
| amakarov | andreykurilin, Session(token=token)? | 13:58 |
| andreykurilin | amakarov: and bypass_url (Use this API endpoint instead of the Service Catalog. Defaults to env[NOVACLIENT_BYPASS_URL]) | 13:58 |
| amakarov | andreykurilin, look at this method: http://docs.openstack.org/developer/keystoneauth/api/keystoneauth1.identity.v3.html#keystoneauth1.identity.v3.TokenMethod | 14:00 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:03 | |
| amakarov | andreykurilin, not sure what do you want with service catalog | 14:04 |
| *** ametts has joined #openstack-keystone | 14:04 | |
| andreykurilin__ | amakarov: just use specific url to communicate with Nova instead of asking keystone to return endpoint for Nova | 14:04 |
| amakarov | andreykurilin__, should it be keystone session parameter rather than nova client's ? | 14:06 |
| andreykurilin__ | amakarov: yes | 14:06 |
| *** dstanek has joined #openstack-keystone | 14:07 | |
| *** ChanServ sets mode: +v dstanek | 14:07 | |
| dstanek | well, that was fun. my znc server went crazy and i couldn't connect to freenode | 14:07 |
| dstanek | dolphm: lbragstad_: http://dstanek.com/newton-sched-fixed.html <- quick hack | 14:09 |
| *** TxGVNN has quit IRC | 14:10 | |
| amakarov | andreykurilin__, ksa session doesn't do such complex logic like fetching endpoints by itself. It just provides REST client... | 14:12 |
| jaosorior | andreykurilin__: Wouldn't that be the endpoint_override option? You could have that available if you're using keystoneauth1's adapter module http://docs.openstack.org/developer/keystoneauth/api/keystoneauth1.html#module-keystoneauth1.adapter | 14:13 |
| *** naresht has quit IRC | 14:14 | |
| andreykurilin__ | jaosorior: yes, we use it:) I think it is a correct parameter | 14:16 |
| jaosorior | andreykurilin__: Awesome. So that should do the trick | 14:17 |
| *** tellesnobrega_af is now known as tellesnobrega | 14:18 | |
| *** TxGVNN has joined #openstack-keystone | 14:20 | |
| *** wasmum has quit IRC | 14:23 | |
| lbragstad_ | dstanek nice! | 14:30 |
| *** slberger has joined #openstack-keystone | 14:30 | |
| *** wasmum has joined #openstack-keystone | 14:31 | |
| *** lbragstad_ is now known as lbragstad | 14:31 | |
| *** Guest11043 is now known as redrobot | 14:40 | |
| *** tellesnobrega is now known as tellesnobrega_af | 14:41 | |
| *** phalmos has joined #openstack-keystone | 14:43 | |
| *** edtubill has joined #openstack-keystone | 14:47 | |
| *** pumaranikar has joined #openstack-keystone | 14:47 | |
| *** rderose has joined #openstack-keystone | 14:54 | |
| *** mhickey has joined #openstack-keystone | 14:59 | |
| *** doug-fish has joined #openstack-keystone | 15:06 | |
| dolphm | dstanek: are those time in CT? | 15:08 |
| dolphm | dstanek: it also needs to be re-generated ... there's been schedule changes not reflected here | 15:09 |
| dstanek | dolphm: i'm not sure what the times are in...it's straight out of their json. thanks for the heads up. i'll regenerate | 15:16 |
| dolphm | dstanek: looks like CT, just wanted to double check | 15:16 |
| *** real56 has joined #openstack-keystone | 15:17 | |
| *** spzala has joined #openstack-keystone | 15:18 | |
| *** links has joined #openstack-keystone | 15:19 | |
| *** pnavarro has quit IRC | 15:22 | |
| dstanek | dolphm: that's what i figured | 15:22 |
| dstanek | dolphm: updated | 15:23 |
| stevemar | dstanek: hehe nice | 15:23 |
| *** phalmos has quit IRC | 15:28 | |
| *** Guest72772 is now known as jgriffith | 15:28 | |
| dolphm | stevemar: i backported dims patches to stable/liberty and stable/mitaka https://review.openstack.org/#/q/I8636e7c86c6c5c608429fab88e181108ae615db9,n,z but also wondering why dims didn't do the same? the patch certainly fixes the issue there for me. dims? | 15:30 |
| * dolphm drops mic and runs to meeting | 15:30 | |
| dims | dolphm : was wanting to chase a better fix | 15:30 |
| stevemar | dims: was it even affecting master branches? | 15:31 |
| stevemar | errr stable* | 15:31 |
| stevemar | i guess we'll see if https://review.openstack.org/#/c/307254/1 passes | 15:31 |
| patchbot | stevemar: patch 307254 - keystone (stable/mitaka) - Updated from global requirements | 15:31 |
| openstackgerrit | Merged openstack/keystone-specs: Include blacklist and whitelist to mappings docs https://review.openstack.org/305866 | 15:33 |
| *** woodster_ has joined #openstack-keystone | 15:34 | |
| *** roxanaghe has joined #openstack-keystone | 15:34 | |
| *** e0ne has quit IRC | 15:34 | |
| *** Guest15381 is now known as medberry | 15:35 | |
| *** medberry is now known as med_ | 15:35 | |
| *** Kimmo_ has quit IRC | 15:38 | |
| *** gyee has joined #openstack-keystone | 15:43 | |
| *** ChanServ sets mode: +v gyee | 15:43 | |
| *** navidp has joined #openstack-keystone | 15:43 | |
| *** roxanaghe has quit IRC | 15:45 | |
| *** navidp has quit IRC | 15:48 | |
| *** TxGVNN has quit IRC | 15:56 | |
| *** stingaci has joined #openstack-keystone | 15:57 | |
| *** navidp has joined #openstack-keystone | 15:59 | |
| *** tqtran has joined #openstack-keystone | 16:00 | |
| *** links has quit IRC | 16:01 | |
| *** csoukup has joined #openstack-keystone | 16:02 | |
| *** raddaoui has joined #openstack-keystone | 16:04 | |
| *** Guest30394 has quit IRC | 16:05 | |
| *** raginbajin has quit IRC | 16:05 | |
| *** gyee has quit IRC | 16:06 | |
| dolphm | stevemar: yes, i found out about the issue because i got stable maintenance build failures over the weekend | 16:08 |
| stevemar | dolphm: wunderbar! | 16:09 |
| stevemar | dolphm: i made a comment on the patch, i think you have to remove the changes to reqs.txt | 16:09 |
| *** raginbajin has joined #openstack-keystone | 16:10 | |
| *** BjoernT has joined #openstack-keystone | 16:13 | |
| *** trown is now known as trown|lunch | 16:18 | |
| mancdaz | stevemar I found your response on the ML regarding support for TOTP. Is the current option for enabling 2fa with keystone essentially limited to totp with a sql back end? | 16:20 |
| stevemar | mancdaz: you got it | 16:20 |
| stevemar | mancdaz: hoping we have something cooler for newton | 16:21 |
| mancdaz | stevemar did anything else land in mitaka? or was that it? | 16:21 |
| *** pcaruana has quit IRC | 16:21 | |
| mancdaz | anything in liberty? | 16:21 |
| stevemar | mancdaz: that was it for mitaka; liberty had nothing like that | 16:21 |
| mancdaz | stevemar ok great thanks | 16:21 |
| *** mariusv has quit IRC | 16:22 | |
| *** mariusv has joined #openstack-keystone | 16:23 | |
| *** stingaci has quit IRC | 16:25 | |
| *** stingaci has joined #openstack-keystone | 16:26 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/305187 | 16:30 |
| kfox1111_ | ayoung: you coming to the instance user session? | 16:32 |
| *** kfox1111_ is now known as kfox1111 | 16:32 | |
| ayoung | kfox1111, yes and bringing friends | 16:32 |
| kfox1111 | awesome. thanks. :) | 16:32 |
| kfox1111 | I couldn't attend nova's last meeting, but they discussed it and still don't think its their problem. | 16:33 |
| kfox1111 | some nova folks will attend, but it sounds like no ptl or cores. :/ | 16:33 |
| andreykurilin__ | stevemar: hi! Could you look at my novaclient's change and say your opinion from keystone side? | 16:33 |
| kfox1111 | I'm hoping that if we can get enough non nova folks there, those from nova will realize it really is a real problem and bring that knowlege back to the nova team. | 16:34 |
| *** jistr has quit IRC | 16:39 | |
| *** tqtran has quit IRC | 16:40 | |
| *** itlinux has joined #openstack-keystone | 16:42 | |
| *** rcernin has quit IRC | 16:43 | |
| stevemar | andreykurilin__: link? | 16:43 |
| andreykurilin__ | stevemar: https://review.openstack.org/#/c/304035/ | 16:45 |
| patchbot | andreykurilin__: patch 304035 - python-novaclient - WIP: Create Session instance if possible | 16:45 |
| stevemar | andreykurilin__: ty, will review | 16:46 |
| andreykurilin__ | Thanks | 16:47 |
| *** EinstCrazy has quit IRC | 16:49 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone-specs: Functional testing setup https://review.openstack.org/307371 | 16:49 |
| *** martinus__ has quit IRC | 16:51 | |
| *** vgridnev_ has joined #openstack-keystone | 16:52 | |
| edtubill | Hi, I'm trying to setup keystone to keystone federation with Mitaka. I can get an ECP wrapped SAML assertion from the idp, but when I try to send it to the sdp I shibd tells me "unable to locate compatible SSO service for provider". Can someone help me? | 16:52 |
| *** martinus__ has joined #openstack-keystone | 16:52 | |
| breton | edtubill: http://shibboleth.1660669.n2.nabble.com/unable-to-locate-compatible-SSO-service-for-provider-td7594383.html | 16:54 |
| rodrigods | edtubill, breton, i think knikolla (mylu) was having the same issue but only with manual testing | 16:54 |
| rodrigods | using keystoneauth plugin it seems to work | 16:55 |
| *** mhickey has quit IRC | 16:57 | |
| edtubill | rodrigods, breton: thx, so is that a client plugin? | 16:57 |
| rodrigods | edtubill, yep... :) don't have a "ready" example here though | 16:58 |
| rodrigods | i should update my blog with it sometime | 16:58 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Restructure endpoint policy abstract driver https://review.openstack.org/307373 | 16:58 |
| edtubill | rodrigods: cool, yeah I've been looking at your blogs. they've been very helpful :). I'll go look for the docs and look through the code. | 16:59 |
| rodrigods | glad that it helps | 17:01 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 17:01 |
| rodrigods | amakarov, ping... do you have a strong position about this https://review.openstack.org/#/c/303471/ ? | 17:02 |
| patchbot | rodrigods: patch 303471 - keystone-specs - Add note about service provider fields | 17:02 |
| rodrigods | dstanek, ping ... would be nice to have your feedback at https://review.openstack.org/#/c/302299/ (and the follow up patches) whenever you have some time | 17:04 |
| patchbot | rodrigods: patch 302299 - keystone - Add identity providers integration tests | 17:04 |
| amakarov | rodrigods, hi! I believe the positive form is easier to understand: you want reader to do things right after all ) | 17:04 |
| ayoung | kfox1111, OK, so we had an internal team meeting right when you asked | 17:05 |
| amakarov | rodrigods, if you provide an example of bad practice - this is usually done after the right way | 17:05 |
| ayoung | and that was one of the topics of conversation | 17:05 |
| ayoung | kfox1111, so, rcrit is working on a BP for an automatic registration of a nova server with an identity provider, and hes' going for a driver based approach | 17:06 |
| ayoung | the result from the driver will be an additional secret pushed in to the VM via config drive | 17:06 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Restructure policy abstract driver https://review.openstack.org/307379 | 17:06 |
| samueldmq | bknudson: I've created the base.py for the policy and endpoint policy abstract drivers | 17:07 |
| samueldmq | bknudson: https://review.openstack.org/#/q/topic:restructure-abstract-drivers | 17:07 |
| samueldmq | bknudson: so my tests start making sense | 17:07 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for the policy drivers https://review.openstack.org/212957 | 17:08 |
| *** phalmos has joined #openstack-keystone | 17:08 | |
| *** tqtran has joined #openstack-keystone | 17:10 | |
| *** harlowja has joined #openstack-keystone | 17:11 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for endpoint policy drivers https://review.openstack.org/212006 | 17:11 |
| *** trown|lunch is now known as trown | 17:13 | |
| rodrigods | amakarov, hmm ok | 17:14 |
| rodrigods | will try to rephrase that | 17:14 |
| openstackgerrit | Merged openstack/keystone: Test list project hierarchy is correct for a large tree https://review.openstack.org/277512 | 17:16 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/306848 | 17:16 |
| samueldmq | henrynash: hi | 17:19 |
| samueldmq | henrynash: re: abstract drivers in endpoint policy | 17:20 |
| henrynash | samueldmq: hi | 17:20 |
| samueldmq | henrynash: so, endpoint policy driver doesn' inherit form abstract driver defined in core.py | 17:21 |
| morgan | henrynash: ok i am awake now. | 17:21 |
| morgan | henrynash: i can take a look at that patch | 17:21 |
| samueldmq | henrynash: I fixed that, but there are 2 methods (get_policy_for_endpoint, list_endpoints_for_policy) that the driver doesnt' implement | 17:21 |
| morgan | henrynash: but... i'll trade you ;) | 17:22 |
| samueldmq | henrynash: and it doesn't need to, because the manager doesn't call them | 17:22 |
| henrynash | morgan: no problems…ayoung did it for you! | 17:22 |
| harlowja | ayoung morgan so who is bringing the rope next week, me i think right? | 17:22 |
| harlowja | i just wanna check :-P | 17:22 |
| morgan | darn | 17:22 |
| henrynash | morgan: but still happy to trade | 17:22 |
| samueldmq | henrynash: question is: do I need to create a new version just for removing those 2 useless methods? | 17:22 |
| morgan | henrynash: https://review.openstack.org/#/c/249486/ | 17:22 |
| patchbot | morgan: patch 249486 - keystone - Remove eventlet support | 17:22 |
| morgan | henrynash: it's a beastly one | 17:22 |
| morgan | but it needs eyes (and a bknudson glance as well) | 17:22 |
| morgan | but more eyes on that is good. | 17:22 |
| morgan | henrynash: and the followup to it | 17:23 |
| henrynash | morgan: ok, np, will look at it afte rdinner! | 17:23 |
| morgan | perfect :) | 17:23 |
| morgan | henrynash: i am excited at the prospect of keystone sans eventlet | 17:23 |
| henrynash | morgan: ’tis time indeed | 17:23 |
| morgan | stevemar: i hate to be the bearer of bad news... but | 17:24 |
| morgan | https://review.openstack.org/#/c/294822/6/keystone/common/controller.py isn't this a breaking change? not api compat? | 17:24 |
| patchbot | morgan: patch 294822 - keystone - remove fallback to default domain id | 17:24 |
| henrynash | samuedlmq: so if the manager never called them….i.e. it wouldn’t have mattered wether a 3rd party version of the driver implemented them or not, then I’ll say it’s OK to do the change within the current version | 17:25 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:26 | |
| morgan | ayoung: ^ cc on that patch being api incompat | 17:26 |
| morgan | ayoung: as *much* as I dislike the fallback | 17:26 |
| morgan | behavior | 17:26 |
| morgan | cc henrynash ^ as well | 17:26 |
| stevemar | morgan: it was deprecated for 2 cycles | 17:27 |
| stevemar | we can keep it in, i was just doing clean up | 17:27 |
| morgan | stevemar: but it's still a public facing API - we shouldn't break behavior at all (without something like microversions) | 17:27 |
| morgan | stevemar: except in the case where we have the buyin to kill V2 | 17:28 |
| stevemar | morgan: danke | 17:28 |
| morgan | stevemar: /me says this with the TC hat on. | 17:28 |
| morgan | so. | 17:28 |
| stevemar | morgan: damn your new hat | 17:28 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 17:28 | |
| stevemar | morgan: this change merged, but not as big of a deal: https://review.openstack.org/#/c/295492/ | 17:29 |
| patchbot | stevemar: patch 295492 - tempest - include domain_id when creating groups (MERGED) | 17:29 |
| morgan | stevemar: and that is a reasonable change since tempest | 17:29 |
| stevemar | yep | 17:30 |
| morgan | in fact tempest testing that is correct. we should however not break API behavior *ever* | 17:30 |
| morgan | except in extreme cases (or experimental apis) | 17:30 |
| morgan | so, sorry -2 on yours :( | 17:30 |
| stevemar | morgan: alright. we should change the deprecation message then | 17:30 |
| henrynash | morgan, stevemar: so we live with the sins of thr father for apis marked as stable | 17:30 |
| morgan | henrynash: pretty much | 17:30 |
| henrynash | morgan: I hadn’t thought of it that way, but I find it hard to argue against | 17:31 |
| morgan | henrynash: we got special dispensation to delete v2.0 when the general view changed from deprecation cycle to "don't break behavior" | 17:31 |
| morgan | henrynash: we should TOTALLY have an awesome deprecation message *and* we should clearly say the behavior is deprecated | 17:31 |
| morgan | stevemar: i'll un -2 it when the patch changes from removal to other thing. | 17:32 |
| morgan | :) | 17:32 |
| BjoernT | dolphm: ping | 17:33 |
| dolphm | BjoernT: o/ | 17:34 |
| BjoernT | I probably know why I get the 401 , {"auth": {"scope": {"domain": {"name": "domain1"}}, "identity": {"password": {"user": {"domain": {"id": "default"}, "password": "test1", "name": "test1"}}, "methods": ["password"]}}} looking at this the token is scoped to different domains, although I only set OS_DOMAIN_NAME | 17:34 |
| BjoernT | seems like I have to set OS_USER_DOMAIN_NAME | 17:35 |
| BjoernT | at least along with OS_DOMAIN_NAME | 17:35 |
| *** timcline has joined #openstack-keystone | 17:36 | |
| samueldmq | morgan: https://review.openstack.org/#/c/277198/8/keystone/common/config.py | 17:39 |
| patchbot | samueldmq: patch 277198 - keystone - Default caching to on for request-local caching. | 17:39 |
| morgan | samueldmq: yes? | 17:39 |
| samueldmq | morgan: this is the only way we have to do it (currently), right? | 17:40 |
| *** orzel_ has quit IRC | 17:40 | |
| morgan | samueldmq: today. until oslo.cache supports set_Defaults | 17:40 |
| morgan | it's fine to say wait and do fixes there. | 17:40 |
| morgan | i just pulled it forward as a thing we should do | 17:40 |
| *** stevemar has quit IRC | 17:41 | |
| BjoernT | dolphm: I probably know why I get the 401 , {"auth": {"scope": {"domain": {"name": "domain1"}}, "identity": {"password": {"user": {"domain": {"id": "default"}, "password": "test1", "name": "test1"}}, "methods": ["password"]}}} looking at this the token is scoped to different domains, although I only set OS_DOMAIN_NAME , seems like I have to set OS_USER_DOMAIN_NAME at least along with OS_DOMAIN_NAME | 17:41 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Default caching to on for request-local caching. https://review.openstack.org/277198 | 17:41 |
| samueldmq | morgan: ^ just added something to the comment to make it clearer, and +A | 17:42 |
| morgan | samueldmq: /me nods. | 17:43 |
| morgan | samueldmq: sounds good. | 17:43 |
| *** Kimmo_ has joined #openstack-keystone | 17:43 | |
| *** stevemar has joined #openstack-keystone | 17:44 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Add note about service provider fields https://review.openstack.org/303471 | 17:45 |
| morgan | samueldmq: can i ask you a huge favor? | 17:47 |
| morgan | samueldmq: actually... nvm | 17:47 |
| samueldmq | morgan: yes you can if you still want | 17:47 |
| morgan | samueldmq: nah, i can do it. | 17:48 |
| samueldmq | morgan: as you wat :) | 17:48 |
| samueldmq | want* | 17:48 |
| *** timcline has quit IRC | 17:50 | |
| *** pumaranikar has quit IRC | 17:53 | |
| *** navidp has quit IRC | 17:56 | |
| *** henrynash has quit IRC | 17:57 | |
| *** lhcheng has joined #openstack-keystone | 17:59 | |
| *** ChanServ sets mode: +v lhcheng | 17:59 | |
| dolphm | BjoernT: are you getting a 401 in response to that auth request? | 18:00 |
| dolphm | BjoernT: or getting a 401 trying to use the subsequent token? | 18:00 |
| BjoernT | dolphm: without the OS_USER_DOMAIN_NAME yes | 18:00 |
| dolphm | BjoernT: i'm not sure i understand -- is the test1 user actually in the 'default' domain? | 18:01 |
| BjoernT | dolphm: no the user is inside the domain1 domain | 18:02 |
| dolphm | BjoernT: "the token is scoped to different domains" <-- you don't have a token yet, so i assume you're referring to the two different domain references in the auth request? | 18:02 |
| BjoernT | yes | 18:02 |
| dolphm | BjoernT: so, you need to set OS_USER_DOMAIN_NAME=domain1 | 18:02 |
| dolphm | BjoernT: and that should get you a different auth request, right? | 18:02 |
| *** jaosorior has quit IRC | 18:03 | |
| BjoernT | dplphm: Yes I did set OS_DOMAIN_NAME and OS_USER_DOMAIN_NAME and it worked, the auth request looked ok to me | 18:03 |
| BjoernT | dolphm: {"auth": {"scope": {"domain": {"name": "domain1"}}, "identity": {"password": {"user": {"domain": {"name": "domain1"}, "password": "test1", "name": "test1"}}, "methods": ["password"]}}} | 18:03 |
| dolphm | BjoernT: and the user has a role assignment on domain1? | 18:04 |
| dolphm | BjoernT: whatever role name policy requires (cloud_admin? admin?) | 18:04 |
| BjoernT | dolphm: yes on domain level and on project level for that domain. I created a custom role similar to cloud admin like "role:user_admin_role and (token.is_admin_project:True or domain_id:%(domain_id)s)" | 18:05 |
| BjoernT | dolphm: that domain_id:%(domain_id)s) fills in any domain submitted in the request right ? | 18:05 |
| *** gyee has joined #openstack-keystone | 18:07 | |
| *** ChanServ sets mode: +v gyee | 18:07 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove eventlet support https://review.openstack.org/249486 | 18:08 |
| stevemar | morgan: henrynooooobouncer i fixed the nits here ^ | 18:08 |
| samueldmq | stevemar: I will propose fixing the comment in https://github.com/openstack/keystone/blob/aabc213/keystone/version/controllers.py#L28-L36 | 18:10 |
| samueldmq | stevemar: as a follow up then | 18:11 |
| samueldmq | stevemar: I am fine with the change as it is, and given morgan and hen<tab><tab><tab> (no bouncer) +2s I think I can pull the trigger | 18:12 |
| *** roxanaghe has joined #openstack-keystone | 18:12 | |
| morgan | stevemar: my +2 stands. | 18:12 |
| ayoung | harlowja, if you can, great. | 18:12 |
| harlowja | ayoung okie dokie | 18:13 |
| harlowja | just gotta remember, ha | 18:13 |
| ayoung | harlowja, I've been working on getting back on lead. Still no where near my high water mark, but at least I can complete a climb now | 18:13 |
| harlowja | :) | 18:13 |
| harlowja | +2 | 18:13 |
| ayoung | harlowja, I have a 60m | 18:13 |
| samueldmq | bye eventlet support | 18:13 |
| ayoung | I can bring it if needed | 18:14 |
| harlowja | ayoung well pranesh (another openstack guy) will also be there, he can lead like 10a, and i can lead mostly everything < 12a (working on making that <= 12a) so we'll be good | 18:14 |
| ayoung | Excellent | 18:14 |
| harlowja | just don't fall | 18:17 |
| harlowja | lol | 18:17 |
| harlowja | j/k | 18:17 |
| ayoung | harlowja, took my latest lead test with someone I outweighed by 60 lbs. It was a fun fall. | 18:18 |
| *** tellesnobrega_af is now known as tellesnobrega | 18:18 | |
| harlowja | :-/ | 18:18 |
| harlowja | eck | 18:18 |
| ayoung | harlowja, used to climb with my Wife. Same ratio (roughly) so you get used to it. | 18:19 |
| harlowja | ya | 18:25 |
| *** ninag_ has quit IRC | 18:25 | |
| morgan | harlowja: 60lb difference... that falls into "here let me set an anchor up for you..." | 18:26 |
| * morgan also prefers climbing outdoors. | 18:26 | |
| ayoung | morgan, the first clip stops the belayer. Now, with Trad gear, you better have a directional | 18:26 |
| *** ninag has joined #openstack-keystone | 18:27 | |
| morgan | ayoung: pretty much. | 18:27 |
| morgan | or you don't fall ;) | 18:27 |
| morgan | that is always a good plan too. | 18:27 |
| ayoung | morgan, Maybe in Catalonia.... | 18:27 |
| morgan | i mean, i wouldn't rely on it. | 18:27 |
| morgan | but it's def. a better plan to not fall. | 18:27 |
| harlowja | ya, just don't fall, lol | 18:28 |
| morgan | with bolts and/or gym, yeah first clip will catch the belayer... but it wont be fun for either party usually ;) | 18:29 |
| *** ninag has quit IRC | 18:29 | |
| harlowja | ya, depending on weight imbalance, u might not be in for a good time, lol | 18:29 |
| harlowja | especially around first or second clips, lol | 18:29 |
| harlowja | or third | 18:30 |
| morgan | harlowja: at 60lbs i really would consider an anchor in outdoor climbing | 18:30 |
| harlowja | def | 18:30 |
| morgan | at least for the 1st pitch. after that | 18:30 |
| morgan | meh, you're anchored anyway. | 18:30 |
| harlowja | ya | 18:30 |
| harlowja | so when we all going outdoors, lol | 18:30 |
| harlowja | openstack rock-club | 18:30 |
| harlowja | lol | 18:30 |
| morgan | god.. i dunno if i could do a 5.9 now :( | 18:30 |
| morgan | i might top out at like 5.7 | 18:31 |
| harlowja | ok, ummm, might need to work on that, lol | 18:31 |
| morgan | and def. in no shape to lead. | 18:31 |
| harlowja | i end up leading most of the stuff, so i'm used ot it | 18:31 |
| dolphm | BjoernT: so, you assigned the "user_admin_role" to the test1 user on the test1 domain? i'm not sure what you mean by "and on project level" | 18:31 |
| morgan | it's been ~10yrs since i was on the rock | 18:31 |
| harlowja | :-p | 18:31 |
| harlowja | ya, drug-free, +2 | 18:31 |
| morgan | lol | 18:31 |
| morgan | i get my adrenaline from cycling... | 18:32 |
| dolphm | BjoernT: i'd appreciate seeing the entire policy file you have, so i understand the context & consequences of your change | 18:32 |
| harlowja | ya, still need to mountain-bike when u around | 18:32 |
| morgan | it's amazing how fast ~50mph is on the road. | 18:32 |
| harlowja | :-P | 18:32 |
| morgan | harlowja: i need to get a MTB | 18:32 |
| morgan | i have my CX bike here in portland | 18:32 |
| harlowja | ya, i don't like to go ~50mph on a road on a MTB | 18:32 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Remove comments mentioning eventlet https://review.openstack.org/307409 | 18:32 |
| samueldmq | morgan: stevemar ^ | 18:32 |
| harlowja | wheels don't work to well at that speed on a MTB | 18:32 |
| harlowja | lol | 18:32 |
| morgan | yah for sure | 18:33 |
| arunkant_ | stevemar: Hi..can you look into this audit middleware change https://review.openstack.org/#/c/279828/ . | 18:33 |
| patchbot | arunkant_: patch 279828 - keystonemiddleware - Adding audit middleware specific notification driv... | 18:33 |
| morgan | harlowja: so yosemite? | 18:33 |
| harlowja | sureeee | 18:33 |
| ayoung | Meh...falling is part of the sport. Took an intentional fall yesterday to try and get my head straight | 18:33 |
| arunkant_ | stevemar: dims, has already removed his objection and code has been adjusted with oslo.messaging changes | 18:33 |
| harlowja | ayoung agreed | 18:34 |
| morgan | ayoung: fall practice is important | 18:34 |
| morgan | the thing is... i don't like gym climbing. | 18:34 |
| ayoung | I need to get up Cannon this summer. | 18:34 |
| harlowja | there is an easy half-dome one that i was gonna try to do this year | 18:34 |
| ayoung | harlowja, Snake dike>? | 18:34 |
| harlowja | ya that one | 18:34 |
| morgan | harlowja: i am actually wanting to do mountaineering... ice climbing ;) | 18:34 |
| stevemar | samueldmq: thank you! | 18:34 |
| harlowja | ice climbing in the summer might be hard, lol | 18:34 |
| samueldmq | stevemar: my pleasure | 18:35 |
| morgan | harlowja: just in general | 18:35 |
| harlowja | :-P | 18:35 |
| harlowja | ya, also that, lol | 18:35 |
| morgan | go to the southern hemisphere | 18:35 |
| harlowja | http://www.supertopo.com/rock-climbing/Yosemite-Valley-Half-Dome-Snake-Dike seems reasonable | 18:35 |
| harlowja | and this other guy i go with i think can do it | 18:35 |
| ayoung | http://younglogic.com/jessandadam/Pictures/2001-2002/halfdome/tn/p1010006.jpg.html Its a highway | 18:35 |
| harlowja | its 5.7 (R) but i think the R is prob ok | 18:35 |
| morgan | 5.7R hm. | 18:36 |
| harlowja | i don't mind a little R | 18:36 |
| harlowja | ayoung ya, that's expected, ha | 18:36 |
| ayoung | The 5.7 and the R are separate | 18:36 |
| morgan | it should be ok-ish on 5.7 | 18:36 |
| harlowja | R == runout | 18:36 |
| ayoung | http://younglogic.com/jessandadam/Pictures/2001-2002/halfdome/tn/p1010010.jpg.html | 18:36 |
| morgan | yeah | 18:36 |
| ayoung | One bolt in the center of a 5.4 pitch? | 18:36 |
| harlowja | that's all u need right | 18:36 |
| harlowja | lol | 18:36 |
| morgan | lol | 18:36 |
| * morgan needs to go do https://en.wikipedia.org/wiki/Tahquitz_Peak again. | 18:37 | |
| ayoung | Just bring a water filter. THere is water up high, but you will go through a lot...long hike | 18:37 |
| harlowja | ayoung agreed | 18:37 |
| ayoung | http://younglogic.com/jessandadam/Pictures/2001-2002/halfdome/tn/p1010013.jpg.html That is the majority of the climbing...a ladder | 18:37 |
| *** navidp has joined #openstack-keystone | 18:38 | |
| harlowja | yup | 18:38 |
| harlowja | should be easy, minus the R part which i don't like, but will deal with, lol | 18:38 |
| *** ninag has joined #openstack-keystone | 18:39 | |
| ayoung | harlowja, You hear about the Regular Route? | 18:39 |
| harlowja | ? | 18:39 |
| harlowja | morgan i have a guy i know that does alot of the mountainerring stuff, if u want me to connect u | 18:40 |
| ayoung | http://www.rockandice.com/lates-news/she-goes-half-dome-s-regular-route-climbed-after-rockfall | 18:40 |
| harlowja | he's more of the mountainer guy, lol | 18:40 |
| morgan | harlowja: i need to get back into shape first | 18:40 |
| harlowja | kk | 18:40 |
| morgan | going to start running again post summit | 18:40 |
| harlowja | he wanted to do | 18:40 |
| harlowja | " | 18:40 |
| harlowja | I'd like to attempt this crazy hike on June 25th/26th (or 18th/19th alternatively). It's a point to point hike along the highest ridge in the San Bernardino mountains. It tags 9 summits including Mount San Gorgonio, the highest peak in Southern California. | 18:40 |
| harlowja | Total stats are 27miles, +8500ft." | 18:40 |
| morgan | then i can start looking at building the strenght up for that stuff. | 18:41 |
| harlowja | and i'm like,holy crap, lol | 18:41 |
| dolphm | BjoernT: also, "that domain_id:%(domain_id)s) fills in any domain submitted in the request right ?" yes, but i'm skeptical you'd actually want that behavior in this case | 18:41 |
| morgan | harlowja: holy crap. | 18:41 |
| morgan | also SB mountains = where i grew up ;) | 18:41 |
| *** ryanpetrello has left #openstack-keystone | 18:41 | |
| *** ninag has quit IRC | 18:41 | |
| harlowja | ya, it doesn't seem to crazy, but 27miles, i'm not sure i can do that | 18:41 |
| harlowja | lol | 18:41 |
| harlowja | *especially in 1 day | 18:42 |
| harlowja | lol | 18:42 |
| morgan | harlowja: also june is going to be MISERABLE weather there | 18:42 |
| morgan | like ~100+ | 18:42 |
| morgan | in the valleys | 18:42 |
| morgan | and upper 80s/low 90s on the hills. | 18:42 |
| *** roxanagh_ has joined #openstack-keystone | 18:43 | |
| morgan | harlowja: https://www.mountainproject.com/v/whodunit/105798191 the climb i want to do :) | 18:43 |
| *** jed56 has quit IRC | 18:43 | |
| harlowja | morgan ya, damn, 100+ ummm | 18:44 |
| openstackgerrit | Merged openstack/keystone: Remove comment from D202 rule https://review.openstack.org/301370 | 18:44 |
| harlowja | i don't wanna die, lol | 18:44 |
| openstackgerrit | Merged openstack/keystone: Moved name formatting (clean) out of the driver https://review.openstack.org/294305 | 18:44 |
| harlowja | morgan nice, let's do it :-P | 18:45 |
| morgan | harlowja: it's a fun series of (mostly) cracks.. and then the chimney. | 18:45 |
| *** roxanagh_ has quit IRC | 18:45 | |
| harlowja | cool | 18:45 |
| morgan | 8 pitches though. and i think a 1.5hr approach and 2hr walk off | 18:45 |
| harlowja | ya, early wake, and late-finish | 18:47 |
| harlowja | get er' headlamps, lol | 18:47 |
| morgan | yup | 18:47 |
| BjoernT | dolphm: Yes I need to find out what the customer really wants, in worst case we lock it to the domain the user is in or to a fixed it. Locking to the user assigned domain would be scope.domain.id ? | 18:48 |
| *** roxanagh_ has joined #openstack-keystone | 18:50 | |
| morgan | bknudson: maybe we should look at making fernet keys live in the mysql db? | 18:52 |
| morgan | cc lbragstad ^ | 18:52 |
| lbragstad | morgan why's that? | 18:52 |
| morgan | by default. it would make it easier to "auto" create the fernet keys without worrying about having mis-matched keys if we make fernet the default | 18:53 |
| morgan | over uuid in keystone itself | 18:53 |
| *** browne has joined #openstack-keystone | 18:54 | |
| morgan | and that way fernet keys are implicitly shared within a cluster. | 18:54 |
| morgan | lowers rotation overhead/headaches. | 18:54 |
| bknudson | morgan: one of the concerns with having keystone create the keys is that then the keystone user can write them. | 18:54 |
| *** roxanagh_ has quit IRC | 18:54 | |
| morgan | bknudson: agreed | 18:54 |
| lbragstad | but then we have keys used to encrypt token stored in plaintext in the database | 18:54 |
| morgan | bknudson: i really don't like that. but i am pretty much against having fernet be the default in keystone because it isnt a "sane" default | 18:55 |
| morgan | in devstack and in documentation recommending deploys, it would be the recommended way | 18:55 |
| morgan | but keystone should *just work* (mostly) out of the box | 18:55 |
| morgan | and fernet keys are like the pki signing certs, more worrysome. | 18:55 |
| morgan | iirc devstack overrode for PKI default | 18:56 |
| bknudson | y, but keystone isn't going to just work because it needs keystone-manage db_sync, too. | 18:56 |
| morgan | keystone still maintained uuid | 18:56 |
| morgan | bknudson: right, but the DB is shared amongst cluster members | 18:56 |
| morgan | bknudson: distiniction in operational overhead | 18:56 |
| morgan | as *much* as i want UUID tokens to die... | 18:56 |
| morgan | (not sometime post PKI) | 18:57 |
| bknudson | I suppose the fernet keys have a default lifetime? | 18:57 |
| lbragstad | bknudson what do you mean? | 18:57 |
| bknudson | so if keystone did create them they'd just expire. | 18:57 |
| morgan | bknudson: nope | 18:57 |
| lbragstad | nope | 18:57 |
| morgan | bknudson: fernet keys exist until rotated | 18:57 |
| lbragstad | key rotation is an operator thing | 18:57 |
| bknudson | oh, it's based on the rotation. so not a problem. | 18:57 |
| morgan | yah | 18:57 |
| lbragstad | and the fernet keys don't enforce ttl of the actual key | 18:57 |
| openstackgerrit | Merged openstack/keystone: Avoid name repetition in equality comparisons https://review.openstack.org/281296 | 18:57 |
| bknudson | other than apparently it's a security hole if you don't rotate | 18:57 |
| lbragstad | er fernet spec* | 18:57 |
| morgan | it just comes down to adding some level of shared vs not shared signing secrets/encryption secrets | 18:58 |
| * morgan kindof votes we make devstack override to start | 18:58 | |
| morgan | and then we work to improve fernet things | 18:58 |
| lbragstad | what's the problem we're hitting? | 18:59 |
| morgan | it's just the setting a default in keystone | 18:59 |
| * morgan is catching up on ML topics | 18:59 | |
| *** ametts has quit IRC | 19:00 | |
| bknudson | I don't have a problem with allowing fernet keys to be in the db. | 19:02 |
| morgan | bknudson: i would like them to be non-wriatable by keystone though. wonder if we could do something like that (the running keystone that is) | 19:03 |
| morgan | bknudson: it's so many layers of security/best practices concerns. | 19:03 |
| bknudson | if someone wants non-writable by keystone then use the filesystem driver | 19:03 |
| morgan | bknudson: yeah | 19:03 |
| morgan | bknudson: and i'd say we document that as *the* best approach | 19:03 |
| bknudson | right | 19:03 |
| lbragstad | ok - i missed something | 19:03 |
| morgan | knowing no one will do it except for folks like you | 19:03 |
| lbragstad | why are we going to put them in the database? | 19:04 |
| morgan | and nate burton. | 19:04 |
| bknudson | print out a warning if the db is used. | 19:04 |
| morgan | lbragstad: if we put them in the DB we could eliminate uuid tokens | 19:04 |
| lbragstad | morgan how? | 19:04 |
| morgan | lbragstad: because keystone could auto-create the keys | 19:04 |
| morgan | and keys are shared across the cluster by default | 19:04 |
| dolphm | BjoernT: by publicly, i meant outside of a PM | 19:05 |
| BjoernT | dolphm: https://gist.github.com/BjoernT/26d054d731b0b8cfcb5d9da13aee499b | 19:05 |
| morgan | dolphm: i'm thinking of BBQ in austin. kindof excited fwiw | 19:05 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation assignment driver https://review.openstack.org/291318 | 19:05 |
| lbragstad | what's wrong with using the tools like what OSA does for cluster syncing? | 19:05 |
| bknudson | not everybody uses OSA | 19:06 |
| morgan | lbragstad: if you require OSA or something to sync the keys, i don't feel comfortable saying fernet is a sane default in keystone | 19:06 |
| dolphm | morgan: if you're going to the core reviewer party (somehow i never got a confirmation email?), then you'll have the arguably best brisket in the world | 19:06 |
| lbragstad | no - bknudson it's an example | 19:06 |
| morgan | lbragstad: it may be the best choice. | 19:06 |
| morgan | dolphm: except i.. hold on. will send you a PM | 19:06 |
| morgan | lbragstad: but like PKI tokens you have operational overhead to manage keys (or signing certs) | 19:07 |
| lbragstad | they've automated a way to sync key repositories across a deployment | 19:07 |
| bknudson | the core reviewer party was full when I tried to RSVP. So I'll get my BBQ elsewhere. | 19:07 |
| stevemar | bknudson: i like how that is full, but exclusive invites, wut | 19:08 |
| stevemar | dolphm: lbragstad i like morgan's argument about fernet. maybe default isn't the right answer, we keep UUID default and assume some config management needs to happen | 19:09 |
| lbragstad | wasn't there a conversation about adding some logic to keystone to check if the repository was created or not? | 19:10 |
| lbragstad | and if not - keystone would do a fernet_setup for you? | 19:10 |
| morgan | lbragstad: then i'm voting for an in-db driver for the keys | 19:10 |
| dolphm | stevemar: there are silly things we can have fernet do if you don't do setup yourself | 19:11 |
| morgan | lbragstad: as the default. and a filesystem based one for real production | 19:11 |
| amakarov | ayoung, the best idea I have to right now to lift logic to the manager: https://review.openstack.org/#/c/291318/10/keystone/assignment/core.py | 19:11 |
| patchbot | amakarov: patch 291318 - keystone - Unified delegation assignment driver | 19:11 |
| stevemar | dolphm: like? | 19:11 |
| lbragstad | hmm this seems like a cluster management problem | 19:11 |
| dolphm | stevemar: like have keystone attempt to write to fernet-keys/ itself, automatically, with appropriate locking | 19:11 |
| bknudson | I can see morgan's point about having it shared in the db by default. Having separate keystones create their own directories would be pretty confusing to a deployer | 19:12 |
| dolphm | stevemar: it'd be a mess, and it'd only work for AIO's | 19:12 |
| morgan | dolphm: and i don't want to engineer for AIO | 19:12 |
| morgan | in fact that seems silly to me | 19:12 |
| dolphm | stevemar: and it'd probably cause problems for freshly deployed clusters (or freshly deployed nodes in existing clusters) | 19:12 |
| dolphm | morgan: ++ | 19:12 |
| rodrigods | bknudson, https://review.openstack.org/#/c/298696/6/zuul/layout.yaml updated :) thanks for reviewing this | 19:13 |
| patchbot | rodrigods: patch 298696 - openstack-infra/project-config - Enable non-voting keystone tempest plugin tests | 19:13 |
| morgan | dolphm: so if we make fernet the token driver in keystone, it's worth using a shared store (by default) for the keys if keystone is auto-creating them. right now that is the db | 19:13 |
| rodrigods | lbragstad, ping... can you take a second look at https://review.openstack.org/#/c/294201/ ? | 19:13 |
| patchbot | rodrigods: patch 294201 - keystone - Add conflict validation for idp update | 19:13 |
| morgan | i'm 100% ok with uuid being default in keystone and fernet being the default for devstack | 19:13 |
| dolphm | morgan: if you put them in the database, they can't be in plain text, and then you have a whole 'nother configuration challenge to deal with. what do we encrypt our encryption keys with? "ADMIN" ? | 19:13 |
| morgan | devstack is opinionated | 19:13 |
| morgan | dolphm: i'd make it a driver and warn up and down this is not the correct deployment for real cases. | 19:14 |
| dolphm | morgan: i'm okay with that in the interim, but i see no reason to support uuid if that's the only reason we keep it around | 19:14 |
| dolphm | morgan: it'll become the next kvs driver | 19:14 |
| morgan | dolphm: if we do the in-db thing... and support passing an encruption key if wanted | 19:14 |
| morgan | i mean i can engineer this in a couple hours. | 19:14 |
| dolphm | morgan: if wanted? | 19:15 |
| morgan | yeah. | 19:15 |
| *** sheel has quit IRC | 19:15 | |
| morgan | its just i feel like we should hash out the right way to share keys | 19:15 |
| morgan | we *could* implement some rudementary RAFT capabilities in keystne | 19:15 |
| dolphm | morgan: so by default, we're going to hash user passwords in the db, and also by default, store fernet token encryption keys in plaintext in the db? | 19:15 |
| dolphm | morgan: that's not a very production-friendly default, either | 19:15 |
| morgan | and the primary keystone could share the keys | 19:15 |
| dolphm | morgan: raft? | 19:15 |
| morgan | clustering | 19:15 |
| *** raginbajin has quit IRC | 19:16 | |
| morgan | like percona bootstrapping. | 19:16 |
| dolphm | morgan: let's keep that in the *could* column :P | 19:16 |
| morgan | yeah | 19:16 |
| morgan | i don't like it. | 19:16 |
| stevemar | dolphm: morgan bknudson are we down with releasing 3.0.0 for KSC today? :) | 19:16 |
| dolphm | morgan: yes it would solve the problem by creating a new problem :P | 19:16 |
| morgan | i think the best option *today* is devstack fernet, keystone uuid | 19:16 |
| morgan | and we hash out how to solve the fernet default in keystone | 19:17 |
| bknudson | stevemar: no responses from your email? | 19:17 |
| morgan | stevemar: i'm ok with breaking people :) | 19:17 |
| stevemar | bknudson: nope | 19:17 |
| morgan | lesss dooo eeet | 19:17 |
| *** ametts has joined #openstack-keystone | 19:17 | |
| dolphm | morgan: generate a key in memory? :D | 19:17 |
| bknudson | ok, try it and see. | 19:17 |
| morgan | dolphm: ahahahahahaha | 19:17 |
| stevemar | bknudson: there isn't much of a try and see here :) | 19:18 |
| stevemar | not much wiggle room for reverting :) | 19:18 |
| morgan | stevemar: sure there is. 4.0.0 | 19:18 |
| morgan | stevemar: :P | 19:18 |
| stevemar | revert 1000+ lines :) | 19:18 |
| morgan | tagged at the same point as 2.x.x was | 19:18 |
| bknudson | I'm pretty sure we'll revert it. Since even smaller changes have been reverted. | 19:18 |
| morgan | pre 3.0.0 release | 19:18 |
| morgan | stevemar: ask sdague | 19:19 |
| morgan | stevemar: before doing it | 19:19 |
| morgan | and mtreinish | 19:19 |
| stevemar | bknudson: right? we can't seem to ship a new ksc without reverting something | 19:19 |
| dolphm | morgan: it'll work great for single threaded AIO's, and the more threads and processes and nodes you add, the more 401's you'll get and the more lines you'll get in your log files about how you forgot to actually configure fernet. it's like a self-scaling misconfiguration warning system | 19:19 |
| * dolphm goes to write the release notes | 19:19 | |
| morgan | dolphm: i.. i.. you brilliant person you | 19:20 |
| morgan | dolphm: anyway so short term: devstack turns fernet on by default, we work out details aroud the keys (even if it is stupid amounts of documentation)? | 19:20 |
| morgan | and then look at killing uuid as the default in keystone once we've addressed that? | 19:21 |
| dolphm | morgan: ++ | 19:21 |
| morgan | lbragstad, bknudson: ^ | 19:21 |
| *** raginbajin has joined #openstack-keystone | 19:21 | |
| morgan | and we can look at all the options *including* db stored keys | 19:21 |
| dolphm | what does keystone do now if you configure it for fernet but fernet-keys/ doesn't exist? it just throws warnings, or does it actually fail to start? | 19:21 |
| lbragstad | so the discussion about keys in the database isn't concluded yet | 19:21 |
| bknudson | update the commit message for https://review.openstack.org/#/c/195780/ | 19:21 |
| patchbot | bknudson: patch 195780 - openstack-dev/devstack - Switch fernet to be the default token provider | 19:21 |
| morgan | dolphm: 500 | 19:21 |
| dolphm | morgan: maybe have it fail to start instead? | 19:22 |
| lbragstad | yeah - keystone throws a fit because there isn't any keys | 19:22 |
| morgan | dolphm: perhaps. | 19:22 |
| morgan | dolphm: worth going over the options. | 19:22 |
| bknudson | also we should add a job (or change the existing uwsgi job) to use uuid | 19:22 |
| morgan | i am definitely against creating keys on disk (calling keystone-manage from within the running keystone process) | 19:22 |
| dolphm | morgan: agree | 19:23 |
| dolphm | morgan: but how else can we share keys across processes? throw them in the cache? | 19:23 |
| morgan | bknudson: probably a good initial thing, but if we collapse validation of uuid down to the same data as what is held in fernet, so the validation path is the same just the difference is "look up in db, vs decrypt" i think we can safely avoid tht need | 19:23 |
| morgan | dolphm: possibly? | 19:23 |
| dolphm | morgan: dogpile get or create fernet key | 19:23 |
| morgan | dolphm: or make keystone not start - also valid | 19:24 |
| morgan | just a very clear way to force folks to do the right thing. | 19:24 |
| lbragstad | i think ^ that's a good starting point | 19:24 |
| lbragstad | yes | 19:24 |
| morgan | though i bet we will need to have the keys shared in the db. | 19:24 |
| dolphm | morgan: what if, and hear me out, we have a default fernet encryption key. that's it. that's the end of my idea. (sorry) | 19:24 |
| morgan | the operators are going to flip if they *have* to do their own syncronization. | 19:24 |
| morgan | with no other options when uuid just fell out of the box working | 19:25 |
| morgan | s/shared in the db/shared automatically | 19:25 |
| lbragstad | it would be default so it wouldn't need to be shared because it's shared by config? | 19:25 |
| morgan | dolphm: LOL. can we make it super low entropy too? | 19:25 |
| dolphm | morgan: all zeroes, yo | 19:25 |
| morgan | dolphm: PERFECT | 19:25 |
| morgan | ok so i think we do this: | 19:26 |
| morgan | 1. Devstack defaults to fernet | 19:26 |
| dolphm | and then we can all get default fernet key tattoos in austin | 19:26 |
| morgan | 2. keystone fixes validation so uuid validation and fernet validation are the same thing | 19:26 |
| morgan | 3. we do what dolph just said | 19:26 |
| morgan | 4. we profit | 19:26 |
| lbragstad | i think i missed something | 19:26 |
| morgan | basically if we make uuid tokens store exactly the same data as a fernet token would | 19:27 |
| bknudson | lbragstad: we're all getting tattoos | 19:27 |
| morgan | just with a .query() instead of .decrypt() | 19:27 |
| lbragstad | bknudson oooooo got - makes sense +2 | 19:27 |
| morgan | we can all get tattoos | 19:27 |
| morgan | no no thats not it. | 19:27 |
| lbragstad | i'm gonna get "fernet yo" across my knuckles | 19:28 |
| morgan | lbragstad: you need a couple more characters | 19:28 |
| bknudson | so one just has FERN? | 19:28 |
| morgan | bknudson: LOL | 19:28 |
| lbragstad | yup | 19:28 |
| morgan | lbragstad: do we have a bug to make fernet and uuid validate the same way? | 19:29 |
| lbragstad | morgan somewhere? ayoung ? | 19:29 |
| morgan | or... should that be a ... spec? | 19:29 |
| * morgan shudders. | 19:29 | |
| bknudson | put smiley faces on the pinkies | 19:29 |
| lbragstad | i thought ayoung had something open for that? | 19:29 |
| morgan | lbragstad: so.. i think i have a short(er) way of us getting there fwiw | 19:29 |
| morgan | lbragstad: but it involves a migration of the token table *sigh* | 19:30 |
| *** gagehugo has joined #openstack-keystone | 19:30 | |
| morgan | basically make a new token table that just is <id>, <data that would go in fernet token> | 19:30 |
| morgan | and then just pass it through the fernet validator | 19:31 |
| *** ninag has joined #openstack-keystone | 19:31 | |
| *** ninag has quit IRC | 19:31 | |
| morgan | the only difference is encrypt/fernetify or not. | 19:31 |
| * morgan goes back to lurking... clearly talking crazy | 19:31 | |
| lbragstad | hmm - technically we could get that today but if we got rid of push everything in to the token table in token create | 19:32 |
| *** timcline has joined #openstack-keystone | 19:33 | |
| * lbragstad we essentially need to fix this - https://github.com/openstack/keystone/blob/44ff9ede642756d50fdcae330d169b6f55bc9b22/keystone/token/providers/common.py#L775-L782 | 19:33 | |
| *** timcline has quit IRC | 19:33 | |
| *** timcline has joined #openstack-keystone | 19:33 | |
| morgan | harlowja: here is the climb you should do: http://home.bt.com/images/google-street-view-el-capitan-woman-scaling-136398854807303901-150624125020.jpg | 19:33 |
| harlowja | ya, eventually :-P | 19:34 |
| harlowja | and/or someday, lol | 19:34 |
| morgan | hehe | 19:34 |
| morgan | EL Cap! | 19:34 |
| morgan | the nose! | 19:34 |
| morgan | oh holy crap, i didn't realize it was just 2015 when they did the first free climb of el cap. sweet | 19:35 |
| harlowja | well that was a certain route | 19:35 |
| morgan | still | 19:35 |
| harlowja | ya, also one of the hardest routes :-P | 19:35 |
| morgan | i know it usually is like A3 | 19:35 |
| morgan | or sketchier | 19:35 |
| dolphm | f = fernet.Fernet(base64.b64encode(chr(False) * 32)) # i hereby propose the default fernet key | 19:37 |
| dolphm | >>> base64.b64encode(chr(False) * 32) | 19:37 |
| dolphm | 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=' | 19:37 |
| dolphm | >>> chr(False) * 32 | 19:38 |
| dolphm | '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' | 19:38 |
| dolphm | i call it the null key | 19:39 |
| morgan | dolphm: LOL | 19:39 |
| morgan | harlowja: https://i.guim.co.uk/img/static/sys-images/Guardian/Pix/pictures/2015/1/14/1421251219061/e29e4549-1df3-4ff8-ae33-ac04f4df79cc-2060x1236.jpeg?w=700&q=55&auto=format&usm=12&fit=max&s=7b0af218b89cefed2caa26b738ed332f | 19:41 |
| harlowja | ya, don't fuck up | 19:42 |
| harlowja | lol | 19:42 |
| harlowja | that's what i'm gonna name a route someday | 19:42 |
| harlowja | lol | 19:42 |
| morgan | harlowja: best route names: Who want's to know | 19:42 |
| morgan | harlowja: and "what's it to ya" | 19:42 |
| morgan | ;) | 19:42 |
| harlowja | lol | 19:42 |
| harlowja | i guess swear words aren't ok ? | 19:43 |
| harlowja | lol | 19:43 |
| bknudson | dolphm: might want to rot13-encrypt that. | 19:43 |
| morgan | harlowja: i think there are some fantastic innuendos | 19:44 |
| morgan | harlowja: why go vulgar when you can imply it all | 19:44 |
| harlowja | lol | 19:44 |
| harlowja | fair enough | 19:44 |
| *** e0ne has joined #openstack-keystone | 19:52 | |
| *** arunkant_ has quit IRC | 19:54 | |
| *** arunkant has joined #openstack-keystone | 19:55 | |
| *** lhcheng has quit IRC | 20:02 | |
| *** ninag has joined #openstack-keystone | 20:03 | |
| *** alex_xu has quit IRC | 20:04 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/python-keystoneclient: Improve docs for v3 users https://review.openstack.org/305796 | 20:05 |
| *** alex_xu has joined #openstack-keystone | 20:06 | |
| *** navidp has quit IRC | 20:06 | |
| *** sdake has quit IRC | 20:07 | |
| *** ninag has quit IRC | 20:08 | |
| *** e0ne has quit IRC | 20:08 | |
| *** ninag has joined #openstack-keystone | 20:09 | |
| *** ninag has quit IRC | 20:09 | |
| *** ninag has joined #openstack-keystone | 20:10 | |
| *** henrynash has joined #openstack-keystone | 20:10 | |
| *** ChanServ sets mode: +v henrynash | 20:10 | |
| *** ninag has quit IRC | 20:11 | |
| *** ninag has joined #openstack-keystone | 20:11 | |
| *** ninag has quit IRC | 20:13 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add mapping rules integration tests https://review.openstack.org/305444 | 20:13 |
| *** navidp has joined #openstack-keystone | 20:16 | |
| *** maxabidi has joined #openstack-keystone | 20:17 | |
| dstanek | dolphm: did you look into the release issue at all? | 20:20 |
| dolphm | dstanek: babel's release? | 20:21 |
| dstanek | dolphm: yeah | 20:21 |
| dstanek | for the stables | 20:21 |
| stevemar | dstanek: dolphm reported that it was affected | 20:22 |
| dolphm | dstanek: yes - i backported dims patch, which fixed py27 tox builds https://review.openstack.org/#/q/I8636e7c86c6c5c608429fab88e181108ae615db9,n,z | 20:22 |
| dolphm | stevemar: i meant to ask, how can i reproduce the requirements build failure without waiting on jenkins? | 20:22 |
| dolphm | stevemar: i know you're correct that it's going to fail, but i have no idea how to run it offline | 20:23 |
| dstanek | dolphm: nice | 20:23 |
| stevemar | dolphm: hmm, not sure... i depend on jenkins for that.. | 20:23 |
| dims | dolphm : stevemar : we'll cleanup babel from oslo.* - http://markmail.org/message/g3l5juo7dr2cnvtd soon-ish | 20:23 |
| dolphm | stevemar: i always have, too. i'll just upload a new patch | 20:23 |
| stevemar | dolphm: just backout your change to reqs.txt. | 20:23 |
| *** ninag has joined #openstack-keystone | 20:24 | |
| dolphm | dims: worth merging your fix to stable/* in the mean time? | 20:24 |
| stevemar | dims: nice, we should still fix our stable branches to respect UC anyway | 20:24 |
| dstanek | dolphm: stevemar: can you just manually install the versions you want to test against? | 20:24 |
| dims | stevemar : true. | 20:24 |
| stevemar | dstanek: it's a job that is run that checks the requirements, not sure where it coms from, somewhere from infra land | 20:25 |
| dims | dolphm : probably yes | 20:25 |
| dstanek | stevemar: ah, i see | 20:25 |
| dolphm | stevemar: i'm running tox -r -e py27 with global reqs compatible babel lines | 20:25 |
| dolphm | stevemar: on both branches | 20:25 |
| dolphm | stevemar: but i think we need to update global requirements instead | 20:28 |
| rodrigods | vim | 20:28 |
| dolphm | rodrigods: emacs | 20:28 |
| rodrigods | ^ always the wrong window | 20:28 |
| *** rderose has quit IRC | 20:28 | |
| rodrigods | dolphm, lol | 20:28 |
| *** rderose has joined #openstack-keystone | 20:28 | |
| dstanek | rodrigods: at least we know that you're using the correct editor | 20:30 |
| lbragstad | ++ | 20:30 |
| rodrigods | ++ | 20:30 |
| lbragstad | i used visudo on a base 14.04 install yesterday and it put me in nano.. | 20:31 |
| dolphm | wat | 20:31 |
| lbragstad | I seg fault'd | 20:31 |
| *** lhcheng has joined #openstack-keystone | 20:31 | |
| *** ChanServ sets mode: +v lhcheng | 20:31 | |
| dolphm | EDITOR=vi visudo ? | 20:31 |
| lbragstad | i kept :wq, :wq, :wq! and it wouldn't do anything | 20:31 |
| rodrigods | haha | 20:31 |
| rodrigods | ctrl + x, right? | 20:31 |
| lbragstad | dolphm yes - that was my solution | 20:32 |
| *** ninag has quit IRC | 20:33 | |
| *** BigWillie has quit IRC | 20:34 | |
| dolphm | lbragstad: i learned vi because i got dropped into it by default. i don't know emacs because i've never been on a system wacky enough to use it by default | 20:35 |
| lbragstad | same | 20:35 |
| rodrigods | i don't like the combos | 20:36 |
| rodrigods | like... https://www.emacswiki.org/emacs/FootSwitches | 20:36 |
| rodrigods | too many keys pressed at the same time | 20:36 |
| *** e0ne has joined #openstack-keystone | 20:38 | |
| dolphm | ha, i totally forgot about those | 20:39 |
| dstanek | i tried using emacs when i first started using linux. the book i read said to use Meta-X and since i didn't know what Meta was i used ^Z; kill %1 and started the journey with vim | 20:47 |
| rodrigods | lol | 20:48 |
| bknudson | I haven't found the undo key for vi so I gave up on it. | 20:49 |
| rodrigods | u | 20:49 |
| lbragstad | bknudson are you still rockin eclipse? | 20:50 |
| bknudson | I've been using atom for a few weeks now. | 20:50 |
| *** e0ne has quit IRC | 20:50 | |
| bknudson | although maybe I'll switch back to eclipse... it does make jumping around files easier most of the time. | 20:51 |
| lbragstad | bknudson I've never used atom | 20:52 |
| *** ninag has joined #openstack-keystone | 20:52 | |
| *** ninag has quit IRC | 20:56 | |
| *** fawadkhaliq has joined #openstack-keystone | 20:57 | |
| topol | lbragstad, bknudson I just started using atom. I like it | 20:58 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add identity providers integration tests https://review.openstack.org/302299 | 20:59 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add mapping rules integration tests https://review.openstack.org/305444 | 20:59 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add service providers integration tests https://review.openstack.org/303502 | 20:59 |
| bknudson | it took a little while to get the config the way I wanted. | 20:59 |
| rodrigods | dstanek, bknudson ^ | 20:59 |
| bknudson | until the gate's running I don't think we should add more tests. | 20:59 |
| *** sdake has joined #openstack-keystone | 21:00 | |
| rodrigods | bknudson, i agree, but i want a feedback regarding the organization and so on... | 21:02 |
| rodrigods | if possible, of course | 21:02 |
| *** BjoernT has quit IRC | 21:03 | |
| *** raildo is now known as raildo-afk | 21:05 | |
| *** ametts has quit IRC | 21:08 | |
| *** gagehugo has quit IRC | 21:10 | |
| *** spzala has quit IRC | 21:14 | |
| *** gyee has quit IRC | 21:17 | |
| *** ametts has joined #openstack-keystone | 21:17 | |
| *** trown is now known as trown|outtypewww | 21:18 | |
| openstackgerrit | Navid Pustchi proposed openstack/keystoneauth: Removing tox ignore D400. https://review.openstack.org/307486 | 21:21 |
| *** mylu has joined #openstack-keystone | 21:22 | |
| *** mylu has quit IRC | 21:24 | |
| *** mylu has joined #openstack-keystone | 21:25 | |
| *** navidp has quit IRC | 21:28 | |
| dstanek | rodrigods: nice. i'll take a look at those after dinner | 21:28 |
| rodrigods | thanks dstanek | 21:28 |
| *** timcline has quit IRC | 21:29 | |
| *** edtubill has quit IRC | 21:29 | |
| *** nkinder_ has quit IRC | 21:29 | |
| *** zqfan has quit IRC | 21:32 | |
| *** pauloewerton has quit IRC | 21:33 | |
| *** spzala has joined #openstack-keystone | 21:36 | |
| *** spzala has quit IRC | 21:36 | |
| *** spzala has joined #openstack-keystone | 21:36 | |
| *** nkinder_ has joined #openstack-keystone | 21:41 | |
| *** gyee has joined #openstack-keystone | 21:43 | |
| *** ChanServ sets mode: +v gyee | 21:43 | |
| *** edtubill has joined #openstack-keystone | 21:46 | |
| *** real56 has quit IRC | 21:47 | |
| *** aimeeU has quit IRC | 21:48 | |
| *** wasmum has quit IRC | 21:48 | |
| stevemar | topol: oh hey! you're alive! | 21:49 |
| *** BjoernT has joined #openstack-keystone | 21:51 | |
| *** sdake has quit IRC | 21:51 | |
| topol | hi stevemar | 21:52 |
| topol | stevemar whatsup | 21:53 |
| topol | stevemar I was busy reading some email where a beloved client disappeared :-) | 21:54 |
| *** timcline has joined #openstack-keystone | 21:54 | |
| stevemar | topol: that dirt keystone cli, who even needs it | 21:54 |
| *** mylu has quit IRC | 21:54 | |
| topol | stevemar Ha Ha | 21:54 |
| bknudson | apparently lots of projects need it | 21:54 |
| *** timcline has quit IRC | 21:55 | |
| topol | bknudson, the sobering voice of reason | 21:55 |
| stevemar | bknudson: those projects just don't know whats good for them | 21:55 |
| bknudson | yes, someone needs to tell people that garbage gets thrown out eventually | 21:56 |
| bknudson | another case in point https://bugs.launchpad.net/python-keystoneclient/+bug/1571833 | 21:56 |
| openstack | Launchpad bug 1571833 in python-keystoneclient "Usage example in the README does not work" [Undecided,New] | 21:56 |
| bknudson | nobody cares about v2 anymore. | 21:56 |
| topol | bkndudson, stevemar are you suggestinga new TV series: Hoarding OpenStack style | 21:56 |
| bknudson | that's a good one. | 21:57 |
| * topol I showed up at grandmas house. I saw puppet scripts and a V2 client in the living room | 21:57 | |
| stevemar | topol: there is a lot of that going on, we even have an "attic" | 21:57 |
| topol | stevemar what else is happening | 21:57 |
| topol | stevemar did you need me? | 21:58 |
| stevemar | topol: nothing else, no, just saw you on irc | 21:58 |
| topol | stevemar weird. perhaps I got disconnected and did not realize it. | 21:58 |
| topol | stevemar I saw bknudson is using atom | 21:59 |
| topol | thats news | 21:59 |
| bknudson | there's probably some great atom plugins I'm not using. | 22:00 |
| *** fawadkhaliq has quit IRC | 22:00 | |
| bknudson | removing keystone CLI, removing keystone-all... people are going to wonder if there's any code left in keystone. | 22:00 |
| stevemar | bknudson: or the eventlet bit was punted through btw | 22:01 |
| rodrigods | should we be able to add a protocol/mapping to a disabled idp? | 22:01 |
| rodrigods | https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst#listing-service-providers | 22:02 |
| stevemar | rodrigods: theres an argument for yes and no | 22:02 |
| *** pumaranikar has joined #openstack-keystone | 22:02 | |
| rodrigods | https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst#add-a-protocol-and-attribute-mapping-to-an-identity-provider | 22:02 |
| rodrigods | correct one ^ | 22:02 |
| rodrigods | stevemar, hmm we currently can | 22:02 |
| stevemar | can we change properties if a project is disabled (like description)? | 22:02 |
| rodrigods | stevemar, makes sense | 22:03 |
| rodrigods | i wasn't seeing the protocol/mapping as an idp property | 22:03 |
| stevemar | rodrigods: disabling the idp should just result in not being able to auth via federation | 22:03 |
| rodrigods | ++ | 22:03 |
| *** phalmos has quit IRC | 22:04 | |
| stevemar | yeah, but it's not a usual relationship | 22:04 |
| rodrigods | stevemar, yeah... we might have several protocols | 22:04 |
| rodrigods | but.. makes total sense | 22:04 |
| rodrigods | it is a property | 22:04 |
| morgan | o/ | 22:08 |
| morgan | topol: oh you're alive! | 22:09 |
| topol | morgan... so I've heard | 22:11 |
| topol | morgan, stevemar, everyone looking for me to buy them drinks in Austin is happy Im alive | 22:11 |
| *** gordc has quit IRC | 22:11 | |
| morgan | topol: oh so is this on Topol's dime or IBM's? :P | 22:13 |
| topol | morgan, stevemar its great to be loved | 22:13 |
| topol | morgan for drinks its irrelevant | 22:13 |
| morgan | Awwwwww yessshhhh https://review.openstack.org/#/c/249486/ | 22:13 |
| patchbot | morgan: patch 249486 - keystone - Remove eventlet support | 22:13 |
| morgan | no more eventlet! | 22:14 |
| stevemar | morgan: :) | 22:14 |
| stevemar | morgan: it'll land soon enough | 22:14 |
| *** slberger has left #openstack-keystone | 22:14 | |
| *** ninag has joined #openstack-keystone | 22:17 | |
| topol | morgan, stevemar, wow that brings back memories... It was early 2013 and I remember a heckj telling me how eventlet wasnt the real way to run Keystone but instead to use some poorly documented apache approach | 22:17 |
| stevemar | 3 years later and we're finally there! | 22:18 |
| *** ninag has quit IRC | 22:19 | |
| *** ninag has joined #openstack-keystone | 22:19 | |
| *** dave-mccowan has quit IRC | 22:19 | |
| topol | morgan, stevemar my have things changed | 22:19 |
| edtubill | Hi, I was wondering if the keystone client saml federation plugin worked with keystone as the Idp. The plugin looks like it is using basic auth and I see "There is either no auth token in the request or the certificate issuer is not trusted" in the keystone idp log when it is trying to send the idp saml2 authentication request. Can someone help me? | 22:20 |
| rodrigods | edtubill, we have a specific plugin for k2k case | 22:20 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:20 | |
| rodrigods | edtubill, see https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/identity/v3/k2k.py | 22:21 |
| dstanek | morgan: ++ i love that | 22:21 |
| dstanek | morgan: i'll rebase my flask stuff on top of that | 22:21 |
| edtubill | rodrigods: oh thanks! I was looking at the wrong plugin. I'll take a look. | 22:21 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add identity providers integration tests https://review.openstack.org/302299 | 22:22 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add mapping rules integration tests https://review.openstack.org/305444 | 22:22 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add service providers integration tests https://review.openstack.org/303502 | 22:22 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Protocol testing https://review.openstack.org/307508 | 22:22 |
| *** ayoung has quit IRC | 22:27 | |
| *** markvoelker has quit IRC | 22:28 | |
| *** vgridnev_ has quit IRC | 22:30 | |
| *** csoukup has quit IRC | 22:33 | |
| rodrigods | stevemar, we can add a protocol to an idp using an nonexistent mapping - this seemed wrong at first glance | 22:36 |
| rodrigods | but we can add the mapping later? since we define the ID | 22:36 |
| *** pumaranikar has quit IRC | 22:37 | |
| stevemar | rodrigods: that is also correct, it's a matter of enforcing steps | 22:37 |
| stevemar | i know i've done that... added a non-existent mapping and then created it later | 22:38 |
| rodrigods | stevemar, it is bad if we forget to add the mapping id | 22:38 |
| rodrigods | or mistype it (who knows) | 22:38 |
| *** pumaranikar has joined #openstack-keystone | 22:39 | |
| rodrigods | should i create a bug to discuss there? | 22:39 |
| stevemar | rodrigods: sure | 22:40 |
| rodrigods | stevemar, https://bugs.launchpad.net/keystone/+bug/1571878 | 22:43 |
| openstack | Launchpad bug 1571878 in OpenStack Identity (keystone) "Add protocol to identity provider using nonexistent mapping" [Undecided,New] | 22:43 |
| *** pumaranikar has quit IRC | 22:44 | |
| *** furface has joined #openstack-keystone | 22:48 | |
| *** neophy has joined #openstack-keystone | 22:53 | |
| *** timcline has joined #openstack-keystone | 22:53 | |
| *** timcline has quit IRC | 22:53 | |
| *** pumaranikar has joined #openstack-keystone | 22:56 | |
| *** wasmum has joined #openstack-keystone | 22:58 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add protocols integration tests https://review.openstack.org/307508 | 23:03 |
| *** doug-fish has quit IRC | 23:06 | |
| *** BjoernT has quit IRC | 23:14 | |
| *** raildo-afk is now known as raildo | 23:18 | |
| *** jaimguer has quit IRC | 23:20 | |
| *** stingaci has quit IRC | 23:26 | |
| *** markvoelker has joined #openstack-keystone | 23:28 | |
| *** stingaci has joined #openstack-keystone | 23:29 | |
| *** markvoelker has quit IRC | 23:33 | |
| *** edtubill has quit IRC | 23:33 | |
| *** pumaranikar has quit IRC | 23:35 | |
| *** BjoernT has joined #openstack-keystone | 23:51 | |
| *** ChanServ sets mode: +o stevemar | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
