| *** mylu has quit IRC | 00:02 | |
| *** sdake_ has quit IRC | 00:02 | |
| *** mylu has joined #openstack-keystone | 00:03 | |
| *** gyee has joined #openstack-keystone | 00:04 | |
| *** ChanServ sets mode: +v gyee | 00:04 | |
| *** rderose has joined #openstack-keystone | 00:04 | |
| *** mylu has quit IRC | 00:05 | |
| *** mylu has joined #openstack-keystone | 00:07 | |
| *** mylu has quit IRC | 00:09 | |
| *** sdake__ has quit IRC | 00:13 | |
| *** gyee has quit IRC | 00:14 | |
| *** spzala has joined #openstack-keystone | 00:21 | |
| *** doug-fish has joined #openstack-keystone | 00:25 | |
| *** jamielennox|away is now known as jamielennox | 00:28 | |
| *** browne1 has joined #openstack-keystone | 00:36 | |
| *** Kimmo_ has quit IRC | 00:38 | |
| *** browne has quit IRC | 00:39 | |
| *** xek has quit IRC | 00:39 | |
| *** LZ has quit IRC | 00:39 | |
| *** trey has quit IRC | 00:39 | |
| *** tqtran has quit IRC | 00:39 | |
| *** spzala has quit IRC | 00:39 | |
| *** iurygregory has quit IRC | 00:39 | |
| *** rderose has quit IRC | 00:40 | |
| *** spzala has joined #openstack-keystone | 00:40 | |
| *** trey has joined #openstack-keystone | 00:46 | |
| *** dan_nguyen has quit IRC | 00:47 | |
| *** jamielennox is now known as jamielennox|away | 00:49 | |
| *** jamielennox|away is now known as jamielennox | 00:51 | |
| *** LZ has joined #openstack-keystone | 00:52 | |
| *** iurygregory has joined #openstack-keystone | 00:55 | |
| *** spzala has quit IRC | 00:57 | |
| *** spzala has joined #openstack-keystone | 00:59 | |
| *** spzala has quit IRC | 01:04 | |
| *** rderose has joined #openstack-keystone | 01:14 | |
| *** raddaoui has quit IRC | 01:17 | |
| *** mylu has joined #openstack-keystone | 01:21 | |
| *** doug-fish has quit IRC | 01:24 | |
| *** EinstCrazy has joined #openstack-keystone | 01:30 | |
| *** mylu has quit IRC | 01:30 | |
| *** mylu has joined #openstack-keystone | 01:33 | |
| *** spzala has joined #openstack-keystone | 01:37 | |
| *** spzala has quit IRC | 01:38 | |
| *** spzala has joined #openstack-keystone | 01:38 | |
| *** spzala has quit IRC | 01:39 | |
| *** spzala has joined #openstack-keystone | 01:39 | |
| *** mylu has quit IRC | 01:43 | |
| *** mylu has joined #openstack-keystone | 01:43 | |
| *** browne1 has quit IRC | 01:51 | |
| *** rderose has quit IRC | 01:56 | |
| *** rderose has joined #openstack-keystone | 01:58 | |
| *** timonwong_ has quit IRC | 02:12 | |
| *** timonwong_ has joined #openstack-keystone | 02:12 | |
| *** timcline has quit IRC | 02:13 | |
| *** browne has joined #openstack-keystone | 02:29 | |
| *** dan_nguyen has joined #openstack-keystone | 02:30 | |
| *** timcline has joined #openstack-keystone | 02:32 | |
| *** doug-fish has joined #openstack-keystone | 02:34 | |
| *** Kimmo_ has joined #openstack-keystone | 02:37 | |
| *** richm has quit IRC | 02:46 | |
| *** timonwong_ has quit IRC | 02:47 | |
| *** lhcheng has quit IRC | 02:50 | |
| *** zqfan has quit IRC | 02:52 | |
| *** jamielennox is now known as jamielennox|away | 03:21 | |
| *** sdake has joined #openstack-keystone | 03:23 | |
| *** sdake_ has joined #openstack-keystone | 03:24 | |
| *** doug-fish has quit IRC | 03:25 | |
| *** mylu has quit IRC | 03:27 | |
| *** sdake has quit IRC | 03:27 | |
| *** doug-fish has joined #openstack-keystone | 03:27 | |
| *** lhcheng has joined #openstack-keystone | 03:30 | |
| *** ChanServ sets mode: +v lhcheng | 03:30 | |
| *** links has joined #openstack-keystone | 03:30 | |
| *** dave-mccowan has quit IRC | 03:37 | |
| *** spzala has quit IRC | 03:40 | |
| *** spzala has joined #openstack-keystone | 03:40 | |
| *** navidp has joined #openstack-keystone | 03:42 | |
| *** mylu has joined #openstack-keystone | 03:43 | |
| *** spzala has quit IRC | 03:45 | |
| *** dan_nguyen has quit IRC | 03:45 | |
| *** timonwong_ has joined #openstack-keystone | 03:54 | |
| *** wxy has joined #openstack-keystone | 03:59 | |
| *** navidp has quit IRC | 04:03 | |
| *** rderose has quit IRC | 04:04 | |
| *** browne has quit IRC | 04:05 | |
| *** bapalm has quit IRC | 04:10 | |
| *** tjcocozz has quit IRC | 04:10 | |
| *** bapalm has joined #openstack-keystone | 04:12 | |
| *** sdake_ has quit IRC | 04:13 | |
| *** doug-fish has quit IRC | 04:26 | |
| *** timonwong_ has quit IRC | 04:28 | |
| *** mylu has quit IRC | 04:32 | |
| *** mylu has joined #openstack-keystone | 04:33 | |
| *** sdake has joined #openstack-keystone | 04:36 | |
| *** Nirupama has joined #openstack-keystone | 04:40 | |
| *** spzala has joined #openstack-keystone | 04:41 | |
| *** TxGVNN has joined #openstack-keystone | 04:41 | |
| *** timonwong has joined #openstack-keystone | 04:43 | |
| *** spzala has quit IRC | 04:46 | |
| *** rcernin has quit IRC | 04:48 | |
| *** david-nesher has quit IRC | 04:49 | |
| *** doug-fish has joined #openstack-keystone | 04:50 | |
| *** jasonsb has joined #openstack-keystone | 04:51 | |
| *** doug-fish has quit IRC | 04:54 | |
| *** maestro1 has joined #openstack-keystone | 04:57 | |
| *** sheel has joined #openstack-keystone | 04:59 | |
| *** spzala has joined #openstack-keystone | 05:01 | |
| *** sdake_ has joined #openstack-keystone | 05:01 | |
| *** sdake has quit IRC | 05:03 | |
| *** maestro1 has quit IRC | 05:05 | |
| *** spzala has quit IRC | 05:05 | |
| *** maestro1 has joined #openstack-keystone | 05:06 | |
| *** jaosorior has joined #openstack-keystone | 05:07 | |
| *** mylu has quit IRC | 05:09 | |
| *** ayoung has quit IRC | 05:10 | |
| *** maestro1 has quit IRC | 05:11 | |
| *** rcernin has joined #openstack-keystone | 05:17 | |
| *** e0ne has joined #openstack-keystone | 05:23 | |
| *** lhcheng_ has joined #openstack-keystone | 05:23 | |
| *** lhcheng has quit IRC | 05:26 | |
| *** ianw_ has quit IRC | 05:28 | |
| *** ianw_ has joined #openstack-keystone | 05:29 | |
| *** ianw_ has quit IRC | 05:30 | |
| *** ianw has joined #openstack-keystone | 05:31 | |
| *** ianw has quit IRC | 05:34 | |
| *** ianw has joined #openstack-keystone | 05:34 | |
| *** browne has joined #openstack-keystone | 05:40 | |
| *** browne has quit IRC | 05:46 | |
| *** ozialien has joined #openstack-keystone | 05:48 | |
| *** roxanagh_ has joined #openstack-keystone | 05:50 | |
| *** roxanagh_ has quit IRC | 05:52 | |
| *** roxanagh_ has joined #openstack-keystone | 05:53 | |
| *** roxanagh_ has quit IRC | 05:58 | |
| *** josecastroleon has joined #openstack-keystone | 05:59 | |
| *** TxGVNN has quit IRC | 06:01 | |
| *** spzala has joined #openstack-keystone | 06:01 | |
| *** spzala has quit IRC | 06:06 | |
| *** andreykurilin has quit IRC | 06:17 | |
| openstackgerrit | Srushti Gadadare proposed openstack/keystone: Provide user friendly messages for db_sync https://review.openstack.org/289316 | 06:19 |
|---|---|---|
| *** ozialiendoze has joined #openstack-keystone | 06:22 | |
| *** ozialien has quit IRC | 06:24 | |
| *** lhcheng has joined #openstack-keystone | 06:25 | |
| *** ChanServ sets mode: +v lhcheng | 06:25 | |
| *** lhcheng_ has quit IRC | 06:29 | |
| openstackgerrit | Navid Pustchi proposed openstack/keystone: Fix D400 PEP257 https://review.openstack.org/308060 | 06:30 |
| *** yolanda has quit IRC | 06:37 | |
| *** henrynash has joined #openstack-keystone | 06:40 | |
| *** ChanServ sets mode: +v henrynash | 06:40 | |
| *** mylu has joined #openstack-keystone | 06:43 | |
| *** yolanda has joined #openstack-keystone | 06:47 | |
| *** mylu has quit IRC | 06:48 | |
| *** zqfan has joined #openstack-keystone | 06:52 | |
| *** roxanagh_ has joined #openstack-keystone | 06:54 | |
| *** roxanagh_ has quit IRC | 06:58 | |
| *** e0ne has quit IRC | 07:01 | |
| *** spzala has joined #openstack-keystone | 07:02 | |
| *** tesseract has joined #openstack-keystone | 07:03 | |
| *** henrynash has quit IRC | 07:04 | |
| *** tesseract is now known as Guest14509 | 07:04 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Zanata https://review.openstack.org/307589 | 07:07 |
| *** e0ne has joined #openstack-keystone | 07:07 | |
| *** spzala has quit IRC | 07:07 | |
| *** edtubill has quit IRC | 07:09 | |
| *** fhubik_brb has joined #openstack-keystone | 07:16 | |
| *** woodster_ has quit IRC | 07:18 | |
| *** permalac has quit IRC | 07:19 | |
| *** ozialien has joined #openstack-keystone | 07:29 | |
| *** ozialiendoze has quit IRC | 07:31 | |
| *** e0ne has quit IRC | 07:32 | |
| *** agireud has quit IRC | 07:35 | |
| *** agireud has joined #openstack-keystone | 07:42 | |
| *** hogepodge has quit IRC | 07:52 | |
| *** hogepodge has joined #openstack-keystone | 07:54 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** jed56 has joined #openstack-keystone | 08:02 | |
| *** spzala has joined #openstack-keystone | 08:05 | |
| *** spzala has quit IRC | 08:09 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/306848 | 08:10 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/306848 | 08:10 |
| *** jistr has joined #openstack-keystone | 08:13 | |
| *** pnavarro has joined #openstack-keystone | 08:13 | |
| *** fhubik_brb has quit IRC | 08:19 | |
| *** jaosorior has quit IRC | 08:22 | |
| *** lhcheng has quit IRC | 08:26 | |
| *** markvoelker has quit IRC | 08:27 | |
| *** jaosorior has joined #openstack-keystone | 08:30 | |
| *** mylu has joined #openstack-keystone | 08:44 | |
| *** mylu has quit IRC | 08:49 | |
| *** mhickey has joined #openstack-keystone | 08:57 | |
| *** dobson has quit IRC | 08:59 | |
| yolanda | sigmavirus24_awa, so you think it will be better to add a hook on before_record, instead of creating a custom serializer? | 09:04 |
| *** EinstCrazy has quit IRC | 09:04 | |
| *** spzala has joined #openstack-keystone | 09:05 | |
| *** EinstCrazy has joined #openstack-keystone | 09:05 | |
| *** dobson has joined #openstack-keystone | 09:08 | |
| *** spzala has quit IRC | 09:10 | |
| *** mou has quit IRC | 09:26 | |
| *** mou has joined #openstack-keystone | 09:26 | |
| evrardjp | good morning | 09:27 |
| *** markvoelker has joined #openstack-keystone | 09:27 | |
| *** doug-fish has joined #openstack-keystone | 09:31 | |
| *** markvoelker has quit IRC | 09:32 | |
| *** henrynash has joined #openstack-keystone | 09:36 | |
| *** ChanServ sets mode: +v henrynash | 09:36 | |
| *** doug-fish has quit IRC | 09:36 | |
| *** spzala has joined #openstack-keystone | 10:06 | |
| *** EinstCrazy has quit IRC | 10:10 | |
| *** spzala has quit IRC | 10:11 | |
| *** e0ne has joined #openstack-keystone | 10:12 | |
| *** henrynash has quit IRC | 10:21 | |
| *** mou has quit IRC | 10:22 | |
| *** Guest14509 has quit IRC | 10:22 | |
| *** mou has joined #openstack-keystone | 10:23 | |
| *** Guest14509 has joined #openstack-keystone | 10:24 | |
| -openstackstatus- NOTICE: OVH servers are down, we are working to solve it. This will cause that jobs queue is processed slowly, please have patience. | 10:37 | |
| *** LZ has quit IRC | 10:42 | |
| *** mylu has joined #openstack-keystone | 10:45 | |
| *** timonwong has quit IRC | 10:45 | |
| *** e0ne has quit IRC | 10:49 | |
| *** mylu has quit IRC | 10:50 | |
| *** jaosorior has quit IRC | 10:52 | |
| *** jaosorior has joined #openstack-keystone | 10:53 | |
| *** arunkant_ has joined #openstack-keystone | 11:06 | |
| *** spzala has joined #openstack-keystone | 11:07 | |
| *** arunkant has quit IRC | 11:08 | |
| *** sdake_ has quit IRC | 11:08 | |
| *** sdake has joined #openstack-keystone | 11:08 | |
| *** spzala has quit IRC | 11:11 | |
| *** ozialiendoze has joined #openstack-keystone | 11:12 | |
| *** ozialien has quit IRC | 11:13 | |
| *** doug-fish has joined #openstack-keystone | 11:17 | |
| *** e0ne has joined #openstack-keystone | 11:30 | |
| *** gordc has joined #openstack-keystone | 11:38 | |
| *** mylu has joined #openstack-keystone | 12:00 | |
| *** mylu has quit IRC | 12:06 | |
| *** spzala has joined #openstack-keystone | 12:07 | |
| *** csoukup has joined #openstack-keystone | 12:10 | |
| *** spzala has quit IRC | 12:12 | |
| *** krotscheck_dcm is now known as krotscheck | 12:15 | |
| *** TxGVNN has joined #openstack-keystone | 12:16 | |
| *** mou has quit IRC | 12:16 | |
| *** markvoelker has joined #openstack-keystone | 12:17 | |
| *** mou has joined #openstack-keystone | 12:17 | |
| *** huats has quit IRC | 12:26 | |
| *** huats_ has joined #openstack-keystone | 12:26 | |
| *** huats_ has quit IRC | 12:26 | |
| *** huats_ has joined #openstack-keystone | 12:26 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Closure table for HMT https://review.openstack.org/285521 | 12:32 |
| *** dave-mccowan has joined #openstack-keystone | 12:32 | |
| *** e0ne has quit IRC | 12:39 | |
| *** e0ne has joined #openstack-keystone | 12:42 | |
| *** Nirupama has quit IRC | 12:47 | |
| -openstackstatus- NOTICE: OVH provider is enabled again, please wait for the job queue to be processed | 12:48 | |
| *** richm has joined #openstack-keystone | 12:56 | |
| *** henrynash has joined #openstack-keystone | 12:56 | |
| *** ChanServ sets mode: +v henrynash | 12:56 | |
| *** mhickey has quit IRC | 12:58 | |
| *** itlinux has joined #openstack-keystone | 12:58 | |
| *** links has quit IRC | 12:59 | |
| *** e0ne has quit IRC | 13:01 | |
| *** henrynash has quit IRC | 13:02 | |
| *** ozialien has joined #openstack-keystone | 13:06 | |
| *** ozialiendoze has quit IRC | 13:06 | |
| *** mylu has joined #openstack-keystone | 13:07 | |
| *** spzala has joined #openstack-keystone | 13:08 | |
| *** ozialiendoze has joined #openstack-keystone | 13:12 | |
| *** doug-fish has quit IRC | 13:13 | |
| *** doug-fish has joined #openstack-keystone | 13:13 | |
| *** spzala has quit IRC | 13:13 | |
| *** ozialien has quit IRC | 13:13 | |
| *** doug-fish has quit IRC | 13:17 | |
| *** tellesnobrega is now known as tellesnobrega_af | 13:19 | |
| *** EinstCrazy has joined #openstack-keystone | 13:23 | |
| *** spzala has joined #openstack-keystone | 13:24 | |
| *** csoukup has quit IRC | 13:25 | |
| *** doug-fish has joined #openstack-keystone | 13:27 | |
| *** BjoernT has joined #openstack-keystone | 13:28 | |
| *** trown|outtypewww is now known as trown | 13:29 | |
| *** doug-fis_ has joined #openstack-keystone | 13:29 | |
| *** mylu has quit IRC | 13:30 | |
| *** sdake_ has joined #openstack-keystone | 13:30 | |
| *** sdake has quit IRC | 13:32 | |
| *** aimeeU has joined #openstack-keystone | 13:33 | |
| *** doug-fish has quit IRC | 13:33 | |
| *** BjoernT is now known as Bjoern_zZzZzZzZ | 13:36 | |
| *** Bjoern_zZzZzZzZ is now known as BjoernT | 13:36 | |
| *** cheneydc has joined #openstack-keystone | 13:41 | |
| *** ametts has joined #openstack-keystone | 13:43 | |
| cheneydc | In policy of keystone, " admin_required": "role:admin or is_admin:1", where is the defination of the "admin" and "is_admin"? | 13:46 |
| *** mylu has joined #openstack-keystone | 13:57 | |
| cheneydc | anyone knows? | 13:57 |
| *** sdake_ has quit IRC | 14:00 | |
| evrardjp | just to make sure of something, curl on :5000/v3/auth/tokens should give me the endpoints, right? | 14:00 |
| bknudson | evrardjp: the token will include the service catalog for the user/project | 14:01 |
| evrardjp | ok | 14:02 |
| evrardjp | what if it doesn't? | 14:02 |
| bknudson | you might have an unscoped token | 14:02 |
| evrardjp | wrong curl request? | 14:02 |
| evrardjp | ok | 14:02 |
| bknudson | or maybe your catalog is empty | 14:02 |
| *** sdake has joined #openstack-keystone | 14:02 | |
| *** BigWillie has joined #openstack-keystone | 14:02 | |
| bknudson | I think we've discussed putting the identity endpoints in an unscoped token before. | 14:03 |
| evrardjp | I'm sorry I try to reproduce what I had yesterday, point per point | 14:05 |
| sigmavirus24_awa | yolanda: I do | 14:07 |
| yolanda | sigmavirus24_awa, i'll stop the work on custom fixture until we have the hooks then | 14:09 |
| *** slberger has joined #openstack-keystone | 14:09 | |
| sigmavirus24_awa | yolanda: I just want to write some docs and integration tests and I'll be ready to ship the hooks for you | 14:10 |
| *** gagehugo has joined #openstack-keystone | 14:11 | |
| yolanda | sigmavirus24_awa, great | 14:11 |
| *** e0ne has joined #openstack-keystone | 14:12 | |
| *** raddaoui has joined #openstack-keystone | 14:14 | |
| *** daemontool has joined #openstack-keystone | 14:15 | |
| cheneydc | I install the mitaka, but after I use policy.v3cloudsample.json I cannot login horizon, I also update the horizon to use V3 api | 14:18 |
| cheneydc | Actually when I access the horizon, I will get an error page :( | 14:21 |
| *** Ephur has joined #openstack-keystone | 14:23 | |
| *** josecastroleon has quit IRC | 14:27 | |
| *** timcline has quit IRC | 14:27 | |
| *** roxanagh_ has joined #openstack-keystone | 14:29 | |
| *** itlinux has quit IRC | 14:31 | |
| *** ayoung has joined #openstack-keystone | 14:31 | |
| *** ChanServ sets mode: +v ayoung | 14:31 | |
| *** itlinux has joined #openstack-keystone | 14:31 | |
| *** roxanagh_ has quit IRC | 14:33 | |
| *** nkinder has quit IRC | 14:35 | |
| breton | i still wonder why keystone.tests.unit.test_cli.CliNoConfigTestCase.test_cli fails | 14:35 |
| amakarov | ayoung, there are guys in openstack losing their faith in keystone :) https://github.com/catalyst/stacktask/ | 14:36 |
| ayoung | amakarov, let them. I lost faith in Keystone years ago | 14:37 |
| amakarov | have you seen "new service for user management and admin tasks with keystone" ML | 14:37 |
| amakarov | ? | 14:37 |
| ayoung | amakarov, yep | 14:37 |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: Added X-Forwarding-For support https://review.openstack.org/309038 | 14:38 |
| ayoung | amakarov, cuz no one actually understands the real problems of OpenStack. THere is a reason Keystone has moved to Federation and Delegation | 14:38 |
| ayoung | Cargo cult on a hack of a bad idea .... | 14:39 |
| *** nkinder has joined #openstack-keystone | 14:39 | |
| breton | what is this reason? | 14:39 |
| *** timcline has joined #openstack-keystone | 14:40 | |
| breton | and what are the real problems? | 14:40 |
| breton | ayoung: sounds like a good subject for a blogpost | 14:40 |
| amakarov | ayoung, true. It seems no torture in the world can force other teams come and say "hey, we need this!" | 14:40 |
| ayoung | breton, read through my archive.... | 14:40 |
| ayoung | amakarov, yep | 14:41 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add other-requirements.txt https://review.openstack.org/308477 | 14:42 |
| ayoung | breton, amakarov maybe they will come up with some good ideas and we'll be able to merge them on in...meanwhile, let people dream. Things happen so slowly here in Keystone for a reason. | 14:43 |
| ayoung | personally I would prefer to find an authentication story that works without bearer tokens | 14:44 |
| *** roxanagh_ has joined #openstack-keystone | 14:44 | |
| amakarov | Yes, master Oogway | 14:44 |
| amakarov | ayoung, what criteria can be used to define a token as "bearer"? | 14:45 |
| ayoung | There are no accidents | 14:45 |
| ayoung | amakarov, if possesion of the token alone provides access to the resources. | 14:46 |
| ayoung | amakarov, OK...here's the full rant. | 14:46 |
| ayoung | THere are 3 means to authenticate on the web. | 14:46 |
| ayoung | Passwords, X509Client Certs, Kerberos | 14:46 |
| ayoung | Passwords provide the least management overhead, but have the most security vulnerabilities | 14:46 |
| ayoung | X509 is the most secure, and thebiggest pain to implement | 14:47 |
| ayoung | Kereros is in the middle (believe it or not) but requires centralization | 14:47 |
| ayoung | Kerberos is also very chatty | 14:47 |
| ayoung | So, of them all, I like X509 the best, but the world is conspiring against me on that | 14:47 |
| ayoung | Now, with X509, you use PKI, which means that only the holder of the private Keys can sign something and get authorized. | 14:48 |
| *** TxGVNN has quit IRC | 14:48 | |
| ayoung | This is fine if you authenticate and authorize at the edges, but OpenStack has this damn "pass the token" attitude which means that Nova calls Glance and passes on the bearer token | 14:49 |
| ayoung | you can't do that with PKI | 14:49 |
| ayoung | there are better ways to do thing IFF you have a trust set up between Nova and Glance. | 14:49 |
| ayoung | But that does not solve things for Third party apps. | 14:49 |
| amakarov | ayoung, Just thought about trusts | 14:49 |
| ayoung | and when I say "trust" there < don't Mena Keystone Trust, I mean an implicit trust relationship | 14:50 |
| amakarov | ayoung, so the problem is to change token concept for a handshake concept and we remove the threat for token to be stolen? | 14:52 |
| *** Ephur has quit IRC | 14:53 | |
| amakarov | ayoung, actually there is no need to pass tokens around since no service populates it with data to be used elsewhere | 14:54 |
| ayoung | amakarov, ok, so you have a warped view of thngs due to me | 14:54 |
| ayoung | amakarov, assume for a moment that we had unified delegation | 14:54 |
| ayoung | and so, instead of me passing a otken to nova, I authenticated as Me, and specified a delegation ID | 14:55 |
| ayoung | and when I say authenticate, I mean something crypto-secure. | 14:55 |
| dstanek | amakarov: stacktask is stuff that doesn't belong is keystone anyway | 14:55 |
| amakarov | ayoung, iirc that's the plan | 14:55 |
| ayoung | yep...so the issue then becomse, 1. how do we let people authenticate efficiently, and 2. how do we do long, multie step workflows | 14:56 |
| amakarov | ayoung, glance folks already do it with trusts | 14:56 |
| ayoung | amakarov, and remember ,one reason OpenStack is successful is that there is a stable API; many 3rp party apps out there . We can't implicitly trust them all, or really, shouldnot trust any of them | 14:56 |
| *** jaosorior has quit IRC | 14:56 | |
| breton | so why not just set up x509 between nova and glance and perform authn in a middleware? | 14:56 |
| amakarov | breton, ++ | 14:57 |
| ayoung | so If I go to Virgils VM Factory, I should not be handing them a token with full access to everything I do | 14:57 |
| ayoung | breton, that lets glance verify that the call came from nova and that is all | 14:57 |
| breton | even not in middlware -- in apache | 14:57 |
| ayoung | necessary but not sufficeint | 14:57 |
| breton | ok | 14:57 |
| ayoung | now, with Kerberos, we have the Idea of s4u2 proxy | 14:57 |
| ayoung | that means that when I go to Nova, nova would go to the KDC and get a proxy ticket as me | 14:58 |
| ayoung | but, again, this is full credentials...or at least, Nova can always ask for full credentials, not just the limited ones I requested | 14:58 |
| ayoung | this is wqhy PKI tokens were written the way they were, | 14:58 |
| *** josecastroleon has joined #openstack-keystone | 14:58 | |
| ayoung | but that ship has sailed | 14:58 |
| ayoung | and we were missing a lot of the pieces we needed to make use of them | 14:59 |
| ayoung | but we could use SAML from K2K the exact way that I planned on using PKI tokens | 14:59 |
| ayoung | however...PKI and SAML themselves fall back to Bearer tokens, and that is not really a nice thing | 14:59 |
| ayoung | so, instead, lets get it so we have fine grained roles, and let a user request a token with the appropriate subset of roles for the workflow | 15:00 |
| ayoung | then beare tokens are alittle less scary | 15:00 |
| ayoung | make it so a scoped token cannot be traded for another scoped token (merges!) | 15:00 |
| ayoung | merged! | 15:00 |
| ayoung | and enforce that | 15:00 |
| ayoung | Getting GLance ot trust Nova is fine, but still only works for "all these services have the same identity" approach | 15:01 |
| ayoung | does not handle the less trusted 3rd party app | 15:01 |
| ayoung | this is why Amazon has signed requests, which was something morgan and I have discussed on and off over the years | 15:01 |
| ayoung | so...lets say we had signed requests. | 15:02 |
| ayoung | THat means that we are basing our infrastructure on X509 , or at least PKI | 15:02 |
| bknudson | signed requests put a burdon on client users. | 15:02 |
| ayoung | bknudson, exactly | 15:02 |
| bknudson | not sure how you could do this with curl | 15:02 |
| ayoung | bknudson, and does not handle 3rd part web apps, either | 15:02 |
| ayoung | bknudson, it would be 2 stage; | 15:03 |
| ayoung | opensssl --sign <request> | 15:03 |
| ayoung | curl -d @signedrequest.cms | 15:03 |
| ayoung | and yes, that would suck | 15:03 |
| bknudson | for every request | 15:03 |
| bknudson | and I have to copy-paste expected headers | 15:03 |
| dstanek | bknudson: or write a script | 15:03 |
| ayoung | bknudson, yep, but keystoneauth could handle that for the Python case. | 15:04 |
| ayoung | It still doesn';t handle Horizon | 15:04 |
| ayoung | so, lets agree it sucks | 15:04 |
| ayoung | but a signed request is only necessary for multistage workflow | 15:04 |
| bknudson | I'd prefer client cert. | 15:04 |
| ayoung | bknudson, but that only works for auth at the surface | 15:04 |
| ayoung | bknudson, I would prefer client cert or Kerberos as the basic | 15:05 |
| ayoung | auth starting point | 15:05 |
| ayoung | OK...so lets say we go with client cert. I go to a a Trove instance set up by some other group, and it wants to make changes inside my project...how much trust goes where? | 15:06 |
| morgan | ayoung: oh hai | 15:06 |
| morgan | i heard my name | 15:06 |
| *** henrynash has joined #openstack-keystone | 15:06 | |
| *** ChanServ sets mode: +v henrynash | 15:06 | |
| ayoung | morgan, amakarov kicked over the hornets nest, and found a soapbox | 15:06 |
| ayoung | I'm on that soapbox now | 15:06 |
| morgan | ayoung: signed requests and ditching tokens? | 15:06 |
| morgan | and krb5? | 15:06 |
| ayoung | morgan, yep | 15:06 |
| * morgan is just guessing | 15:06 | |
| morgan | LOL | 15:07 |
| ayoung | and the problems with all of them | 15:07 |
| ayoung | amakarov, so....here is what it should be: | 15:07 |
| *** roxanagh_ has quit IRC | 15:07 | |
| morgan | so, like i said before if we break apart user->service and service->service this becomes a lot easier to work on :) | 15:07 |
| ayoung | morgan, service->service is exactly what I am ranting about | 15:07 |
| ayoung | morgan, assume the srevice is thrid party and not to get full trust from anyone | 15:08 |
| morgan | you know my view, service to service should NOT use the user's authz at all | 15:08 |
| morgan | they're authorized to do X at the edge | 15:08 |
| morgan | stop asking every step of the way | 15:08 |
| morgan | "Can i boot an instance, yes? boot it" | 15:08 |
| ayoung | morgan, exactly, but who gets to say what that other service cando? | 15:08 |
| morgan | services must be implicitly trusted to do things. | 15:09 |
| ayoung | See, for Trove, or a third party service, it should be trusts...explicitly set up by the user | 15:09 |
| ayoung | have templates that are easy to stamp out. | 15:09 |
| morgan | if you are talking to trove, ys | 15:09 |
| morgan | yes* | 15:09 |
| morgan | but if you're talking to trove via.. nova? (not a thing but for argument sake) | 15:09 |
| ayoung | for Nova to Glance, we just make a blanket trust... | 15:09 |
| morgan | no | 15:09 |
| *** edtubill has joined #openstack-keystone | 15:09 | |
| morgan | heat is treated like a "user" | 15:09 |
| morgan | not a trusted service | 15:09 |
| ayoung | morgan, here is the sample setup I've been thinking | 15:10 |
| ayoung | trove talks to heat. Heat talks to nova and the rest | 15:10 |
| morgan | ugh... my coffee cup's lid is defective :( | 15:10 |
| ayoung | heat is the edge of the trust boundary | 15:10 |
| morgan | newp | 15:10 |
| ayoung | heat does trusts all over the place anyway | 15:10 |
| morgan | heat is a user. | 15:10 |
| *** timcline_ has joined #openstack-keystone | 15:10 | |
| morgan | you must explicitly delegate trust to heat | 15:10 |
| ayoung | morgan, that too | 15:10 |
| morgan | consumers of heat likewise need to know what trust was delegated | 15:11 |
| ayoung | yeah...but heat is in the buisness of telling the user how to set up trusts | 15:11 |
| ayoung | and I think we shouldlet it | 15:11 |
| *** phalmos has joined #openstack-keystone | 15:11 | |
| morgan | yeah that is fine. i mean you don't implicitly trust heat | 15:11 |
| morgan | like say nova->glance | 15:11 |
| morgan | or nova->cindeer | 15:11 |
| morgan | or nova->glance->swift | 15:11 |
| ayoung | I'm almost thinking of heat ast the "set up a trusdt" service becausethey havetaken on that roll | 15:11 |
| dstanek | i've said this may times before. it would be great to have a graph of operations and a list of trusted services that can do those operations | 15:12 |
| morgan | dstanek: yes. | 15:12 |
| amakarov | ayoung, morgan let's make all trusts explicit for starters | 15:12 |
| ayoung | dstanek, | 15:12 |
| morgan | amakarov: no | 15:12 |
| ayoung | amakarov, for now they are. | 15:12 |
| morgan | amakarov: you are in no better shape than today. it's the same thing we have today | 15:12 |
| ayoung | amakarov, what I think we need is a way to make them non-explicit | 15:12 |
| morgan | amakarov: if we're moving the needle, we need to plan for the next step | 15:12 |
| ayoung | morgan, I think what he said can be translated 2 ways | 15:13 |
| amakarov | morgan, this can be settled in bootstraps/setups/install scripts | 15:13 |
| morgan | amakarov: oh god no. | 15:13 |
| ayoung | "for starters" meaning stage 1, not "for starters" as the basic rule | 15:13 |
| amakarov | morgan, then gather these and see, what should be implicit | 15:13 |
| ayoung | so, we have explicit trusts right now | 15:13 |
| morgan | dstanek: i thnk the best approach is get things split, then ratchet down with the callgraph | 15:13 |
| ayoung | we need something that sayd "nova can do X Y an Z" on glance | 15:14 |
| ayoung | and let Nova chose to do those | 15:14 |
| *** mylu has quit IRC | 15:14 | |
| ayoung | blanket trust there | 15:14 |
| dstanek | morgan: by split you mean u->s and s->s? | 15:14 |
| morgan | ayoung: the way i see it is that is not an optional configured thing. | 15:14 |
| morgan | dstanek: ++ | 15:14 |
| ayoung | morgan, right | 15:14 |
| dstanek | morgan: yeah, agreed | 15:14 |
| morgan | ayoung: cool, we're on the same page :) | 15:14 |
| ayoung | and s->s is setup type stuf...core trusted by one org | 15:14 |
| ayoung | trove is on the other side of a boundary | 15:14 |
| ayoung | and we make heat the gatekeeper to that boundery. | 15:15 |
| dstanek | ayoung: right, the 'nova can do ...' is similar to what i was thinking | 15:15 |
| *** mou has quit IRC | 15:15 | |
| dstanek | i think i'm going a step further though | 15:15 |
| ayoung | We don't want 3rd party projects setting up trusts for themselves | 15:15 |
| *** navidp has joined #openstack-keystone | 15:15 | |
| *** e0ne has quit IRC | 15:15 | |
| *** mou has joined #openstack-keystone | 15:15 | |
| morgan | ayoung: i think anything can fit into the heat area fwiw | 15:15 |
| ayoung | If it is not heat, then we need to figure that out somewhere | 15:15 |
| morgan | ayoung: but i'm content to say |service who can do trust things| | 15:15 |
| *** jaosorior has joined #openstack-keystone | 15:16 | |
| morgan | regardless of what it's named | 15:16 |
| ayoung | morgan, except that apps are not thinking that they have to talk to heat to get trusts...everything is token based right now | 15:16 |
| ayoung | "go to keystone, get token, hand token to mafia...." | 15:16 |
| morgan | ayoung: if we get it to a point where we can make tokens go away.... | 15:16 |
| amakarov | ayoung, 5-min tokens ftw | 15:16 |
| ayoung | so...someting like DSR might be the right approach | 15:16 |
| morgan | amakarov: nope, no bearer tokens ever | 15:16 |
| morgan | amakarov: kill the tokens | 15:17 |
| ayoung | morgan, so...that is where the rant started | 15:17 |
| ayoung | in order for tokens to go away, we need an authentication story | 15:17 |
| *** navid_ has joined #openstack-keystone | 15:17 | |
| ayoung | X509 and Kerberos both suck in different ways | 15:17 |
| morgan | ayoung: right. and oauth has other issues | 15:17 |
| ayoung | and, swift would have collective apoplexy if we said they needed to support SAML ECP | 15:17 |
| morgan | signed requests a different set | 15:17 |
| *** e0ne has joined #openstack-keystone | 15:17 | |
| morgan | oh dude can we say that just to watch the meltdown? :P | 15:17 |
| bknudson | I don't see how kerberos is going to work on a public cloud. | 15:17 |
| morgan | bknudson: it wont | 15:18 |
| morgan | well it *could* but... lets just pretend it wont | 15:18 |
| ayoung | bknudson, I'll wax poetic on that over beer next week if you wnat | 15:18 |
| morgan | krb5 is great for public clouds... as a way to authorize AFS volumes | 15:18 |
| bknudson | I might just not be familiar with it. | 15:18 |
| ayoung | I think that the norm is going to be Federation to an offsite provider, which means we have to deal with SAML in OpenStack. | 15:18 |
| ayoung | or OpenIDC | 15:18 |
| morgan | OIDC | 15:18 |
| morgan | most likely | 15:18 |
| bknudson | although I have used kerberos in the past so not totally new to it. | 15:19 |
| *** raildo is now known as raildo-afk | 15:19 | |
| ayoung | bknudson, so...there have been some advances there. Lets short circuit and say "it could be made to work if needs be" and leave it there for now | 15:19 |
| ayoung | the real shortcoming is the spnego overhead | 15:19 |
| bknudson | I have been surprised recently of web applications allowing enterprise logins using oidc. | 15:19 |
| ayoung | multiple round trips on each request | 15:19 |
| *** navidp has quit IRC | 15:19 | |
| ayoung | so oidc and SAMlare not Authentication Per Se | 15:20 |
| bknudson | it asks for your email and if it's ibm.com you get redirected to an ibm signon. | 15:20 |
| * morgan is mostly concerned with splitting u->s and s->s in a "smart" way so all this is doable | 15:20 | |
| ayoung | they are more a proxy to some other authentication...bearer tokens when put into practice | 15:20 |
| ayoung | but the real issue with either of them is that multiple round trips per request is painful | 15:21 |
| ayoung | and we couldn't even get away with PKI tokens, people wanted smaller inside OpenStack | 15:21 |
| bknudson | I assume auth_token is still involved so can validate the client cert to get the user info | 15:21 |
| ayoung | bknudson, something like auth token, but no | 15:21 |
| ayoung | it would be more like this | 15:21 |
| ayoung | say I use kerberos to Nova, nova would take the env vars post mod_auth_kerb and pack them up in a call to Keystone | 15:21 |
| bknudson | auth_token could build a fake "token" which contains some data that it presents to the service? | 15:22 |
| ayoung | it would have the same response as a token validation, but would be based on the Federation mapping | 15:22 |
| ayoung | bknudson, exactly | 15:22 |
| bknudson | why couldn't that be auth_token? | 15:22 |
| morgan | bknudson: it could be | 15:22 |
| ayoung | bknudson, cuz there is no token | 15:22 |
| ayoung | auth_mappins? | 15:22 |
| bknudson | oh, just the name. | 15:22 |
| bknudson | sure. | 15:22 |
| dstanek | ayoung: a quick, badly written and lacking description of what i was proposing a few summits ago https://etherpad.openstack.org/p/keystone-trusting-dstanek | 15:23 |
| dstanek | some details are missing | 15:23 |
| bknudson | right, let's remove the mechanism from the name. | 15:23 |
| ayoung | well...OK, here is the really crazy idea...you can blame termie for putting it in my head... | 15:23 |
| *** BigWillie has quit IRC | 15:23 | |
| ayoung | lets say that we skip the authtoken step | 15:23 |
| bknudson | you need to get termie out of your head already | 15:23 |
| ayoung | and go right down to the policy enforcement code | 15:23 |
| ayoung | and *there* we send it all to Keystone | 15:23 |
| ayoung | 1. federation env vars, 2. API name, and 3. resource data | 15:24 |
| amakarov | ayoung, that's how Fortress works )) | 15:24 |
| ayoung | amakarov, I know | 15:24 |
| ayoung | its called a remote pdp and its is an old, well established concept | 15:24 |
| ayoung | pdp == policy decision point | 15:24 |
| amakarov | ayoung, good concept | 15:24 |
| dstanek | i walk away for 2 mins to get coffee and i'm 3 pages behind in this chat | 15:24 |
| ayoung | it means that you fetch the resource from the backend before doing any validation, but it does mean that a user has to be authenticated, jut not mapped | 15:25 |
| *** henrynash has quit IRC | 15:25 | |
| ayoung | so the problem with *that* approach is that now keystone needs to know about everything | 15:26 |
| amakarov | ayoung, in real life AuthN is usually enough to get a room in a hotel and you don't need your voucher :) | 15:26 |
| ayoung | amakarov, that is beacsue the hotel is the PDP | 15:26 |
| ayoung | amakarov, the card key is the bearer token | 15:27 |
| ayoung | and the authorization you have is tied to the account that purchased the hotel room | 15:27 |
| amakarov | ayoung, inside the hotel | 15:27 |
| bknudson | it's hard for me to keep people out of my hotel room. | 15:27 |
| ayoung | its why I can get in to the executive loung and you cannot, but we both cango to the health club | 15:27 |
| ayoung | bknudson, you keep your personal life out of this | 15:27 |
| bknudson | cleaning people | 15:27 |
| ayoung | they have service tokens | 15:28 |
| *** BigWillie has joined #openstack-keystone | 15:28 | |
| bknudson | where does the room safe fit into this? | 15:28 |
| *** mhickey has joined #openstack-keystone | 15:28 | |
| bknudson | 2FA? | 15:29 |
| dstanek | bknudson: it's too small for anything real so who cares? | 15:29 |
| openstackgerrit | Navid Pustchi proposed openstack/keystone: Fix D400 PEP257 https://review.openstack.org/308060 | 15:29 |
| *** e0ne has quit IRC | 15:29 | |
| bknudson | I can't even fit a PKI token in there. | 15:29 |
| *** josecastroleon has quit IRC | 15:30 | |
| ayoung | ok, so room safe is probably safe from the cleaning service | 15:30 |
| dstanek | you need a smaller catalog :-) | 15:30 |
| ayoung | you put something in there, and a different service user might have access, like the manager | 15:30 |
| ayoung | in RBAC terms, different Role. The hotel is the project (or domain) | 15:31 |
| ayoung | so manager of the 4 seasons can do these same things in his hotel, but not in the Raddision | 15:31 |
| *** mylu has joined #openstack-keystone | 15:31 | |
| *** rderose has joined #openstack-keystone | 15:32 | |
| amakarov | ayoung, so back to the idea: you want clients just do AuthN and not dragging tokens around? | 15:32 |
| ayoung | amakarov, ideally | 15:33 |
| ayoung | amakarov, then the issue is performance and network traffic | 15:33 |
| ayoung | so we can optimize, back off if needs be | 15:33 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:33 | |
| ayoung | for example, we could use mod_session if things run in apache, and give users a session cookie. Its reallyaa bearer token, but the web server links it to the users identity. THat plus HTTPS is probablt about the right level of optimization | 15:34 |
| morgan | ayoung: if we push on an option for suburls again... | 15:35 |
| morgan | which we're pretty close to | 15:35 |
| morgan | ayoung: a single oauth works for the entire API | 15:35 |
| morgan | which... is nice. | 15:35 |
| *** csoukup has joined #openstack-keystone | 15:35 | |
| *** e0ne has joined #openstack-keystone | 15:36 | |
| ayoung | morgan, you mean to get things running in a single server...the whole upgrade story is going to disrupt that, I'm guessing. Wellllllll hmmmm. | 15:36 |
| morgan | no i didn't say a single server | 15:36 |
| morgan | i said sub-url | 15:36 |
| morgan | Load-balancer (l7 routing) is also an option | 15:36 |
| ayoung | right, yep | 15:36 |
| morgan | and that can be made redundant | 15:37 |
| *** Ephur has joined #openstack-keystone | 15:37 | |
| ayoung | I'm morethinking database migrations, but yep | 15:37 |
| stevemar | dolphm: i'll let you kick this one through, https://review.openstack.org/#/c/308060/3 -- folks can blame you for having to rebase things :) | 15:38 |
| patchbot | stevemar: patch 308060 - keystone - Fix D400 PEP257 | 15:38 |
| breton | so what stops us from the suburl thing? | 15:38 |
| *** dan_nguyen has joined #openstack-keystone | 15:39 | |
| morgan | stevemar: nope they get to blame me | 15:39 |
| morgan | breton: a lot of things | 15:39 |
| bknudson | tempest breaks when projects are running on a sub url | 15:39 |
| *** stingaci has joined #openstack-keystone | 15:39 | |
| morgan | breton: it's beena slow march - tempest is one of the things | 15:39 |
| morgan | also many projects get weird about it | 15:39 |
| bknudson | I think there are also issues in the projects. | 15:39 |
| breton | tempest is just code and fixable, isn't it? | 15:39 |
| morgan | we've corrected nova (mostly) | 15:39 |
| morgan | and i have had most services "work" but the links are all wrong | 15:39 |
| morgan | and sometimes things act weird | 15:40 |
| breton | projects == openstack components, right? | 15:40 |
| morgan | breton: yes openstack services | 15:40 |
| bknudson | morgan: this seems to indicate that there's an issue in nova? | 15:40 |
| morgan | bknudson: there has been. sdague and i worked a bunch on it in mitaka | 15:40 |
| morgan | there are still some issues but it will *actually* work in most cases now | 15:41 |
| morgan | mosrt of the projects assume they are on / of whatever server they are running | 15:41 |
| bknudson | also, https://review.openstack.org/#/c/301172/3/files/apache-tlsproxy.template | 15:41 |
| patchbot | bknudson: patch 301172 - openstack-dev/devstack - Use Apache/mod_proxy as TLS proxy instead of stud | 15:41 |
| morgan | this is also part of the failing of not using a proper application server. | 15:41 |
| bknudson | for some reason he added a rewriter. | 15:41 |
| bknudson | like tomcat ? | 15:42 |
| morgan | bknudson: uwsgi, mod_wsgi | 15:42 |
| morgan | bknudson: not a lot different than tomcat architecturally | 15:42 |
| bknudson | we do. | 15:43 |
| bknudson | does nova support it? I haven't checked on all the projects. | 15:43 |
| morgan | we do, but nova, cinder, etc don't | 15:43 |
| morgan | nope | 15:43 |
| bknudson | I wonder why not. | 15:43 |
| morgan | keystone, swift (sortof), zaqar... | 15:43 |
| bknudson | is there an actual issue or just not a priority? | 15:43 |
| morgan | well right now the periodic tasks *and* oslo.messaging is... broken | 15:43 |
| morgan | for them | 15:43 |
| morgan | in uwsgi etc | 15:43 |
| morgan | they pretty much rely on eventlet semantics and pseudoco-routines | 15:44 |
| bknudson | gross | 15:44 |
| morgan | yep. | 15:44 |
| breton | https://github.com/openstack/nova/commit/234294587ae3d92728e23f894c62c212ee800d73 well | 15:44 |
| morgan | most every oroject in openstack does | 15:44 |
| morgan | it isn't a high priority with them afaik | 15:44 |
| morgan | but it's also not "just not caring" | 15:44 |
| bknudson | there's a cross-project session at the summit. We'll see how it goes. | 15:45 |
| bknudson | if anybody shows up | 15:45 |
| morgan | also.. i want to pointout how badass flask_restplus is | 15:45 |
| morgan | i totally dig automatic swagger docs. | 15:45 |
| breton | i wonder if it is possible to wrap trafic from host:80 to nova:port | 15:45 |
| *** stingaci_ has joined #openstack-keystone | 15:46 | |
| morgan | ayoung: ^ we could convert keystone to flask and flask_restplus and the whole "web page" for keystone would be "free" | 15:46 |
| bknudson | yes, it's a reverse-proxy | 15:46 |
| bknudson | breton: this is what https://review.openstack.org/#/c/301172/3/files/apache-tlsproxy.template does. | 15:46 |
| patchbot | bknudson: patch 301172 - openstack-dev/devstack - Use Apache/mod_proxy as TLS proxy instead of stud | 15:46 |
| morgan | ayoung: its.. pretty amazing | 15:46 |
| morgan | ayoung: and it's almost free when the framework is used. | 15:46 |
| breton | because nova could still run on it's port, it's just all components should talk to nova on host:80 | 15:46 |
| morgan | ayoung: i'll show you an example of it at the summit | 15:46 |
| ayoung | morgan, could we? | 15:46 |
| *** dan_nguyen has quit IRC | 15:46 | |
| morgan | dstanek: ^ cc if we use flask, i am going to push for restplus too | 15:46 |
| ayoung | morgan, so, I believe the part after "if we convert" | 15:47 |
| morgan | i <3 the swagger docs automatically there. | 15:47 |
| *** roxanagh_ has joined #openstack-keystone | 15:47 | |
| morgan | ayoung: well "if" as in.. when dstanek pushes his next patch now that eventlet is dead | 15:47 |
| ayoung | its the ability to convert to flask that I need to see proven. We've tried things like that | 15:47 |
| ayoung | morgan, which patch is that? | 15:47 |
| *** cheneydc has quit IRC | 15:48 | |
| *** openstackgerrit has quit IRC | 15:48 | |
| morgan | ayoung: starts here https://review.openstack.org/#/c/202686/ | 15:48 |
| patchbot | morgan: patch 202686 - keystone - Initial view of Flask app factories | 15:48 |
| *** openstackgerrit has joined #openstack-keystone | 15:48 | |
| *** jaosorior has quit IRC | 15:48 | |
| morgan | ayoung: but once we're on flask (mostly it's ditching our custom crappy wsgi code) | 15:48 |
| morgan | ayoung: the rest becomes easier. | 15:48 |
| dstanek | ayoung: working on fixing that up before the summit so i can show it working | 15:48 |
| dstanek | better now that we no longer have eventlet to deal with! | 15:48 |
| ayoung | dstanek, you are awesome | 15:48 |
| *** stingac__ has joined #openstack-keystone | 15:49 | |
| *** stingaci has quit IRC | 15:49 | |
| dstanek | what a pile of ... badness | 15:49 |
| morgan | also... | 15:49 |
| morgan | the whole permission model in flask is *much* easier to work with | 15:49 |
| morgan | i think it's (while a lot of code shift) going to make keystone a lot more streamlined | 15:49 |
| morgan | and far far more "python"-community friendly | 15:50 |
| breton | what's bad in current permission model? | 15:50 |
| morgan | breton: overly complex | 15:50 |
| morgan | the whole @decorator + callbacks that re-implment everything | 15:51 |
| morgan | it's icky | 15:51 |
| *** stingaci_ has quit IRC | 15:51 | |
| * morgan has it on his plate [probably while on the plane to austin] | 15:51 | |
| morgan | to rewrite them as direct enforce calls | 15:51 |
| morgan | rather than hyper complex decorators. | 15:51 |
| ayoung | morgan, I have some code in flight along those lines, but more on pulling the logic out of the decorator... | 15:52 |
| ayoung | let me see... | 15:52 |
| morgan | ayoung: basically i was going to just yank the decorator apart, add a new decorator that strictly checks if .enforce was called (so we can be sure a function always enforces if it's expected to) | 15:52 |
| ayoung | morgan, I think it was Sam's patch... | 15:53 |
| *** trown is now known as trown|lunch | 15:53 | |
| morgan | and then do .enforce in the method where we want to actually enforce instead of... well trying to extract data and then use it in the decorator | 15:53 |
| ayoung | morgan, lookg at https://review.openstack.org/#/c/279263/ | 15:53 |
| patchbot | ayoung: patch 279263 - keystone - enforcement logic refactored | 15:53 |
| breton | @protected you mean? | 15:53 |
| morgan | breton: yeah | 15:53 |
| morgan | @protected is... icky | 15:53 |
| morgan | it was implemented exactly as asked... then grew and grew and is now not rreally maintainable | 15:54 |
| morgan | and exceedingly hard to debug | 15:54 |
| ayoung | morgan, agreed, and you might want to throw out my patch to deal with it, but there are some embedded lessons there | 15:54 |
| ayoung | the filter being a separate decorator is horrible | 15:54 |
| breton | what's the problem in rewriting it now, to simple .enforce calls? | 15:54 |
| ayoung | that was the big thing that was too different | 15:55 |
| morgan | breton: it's a lot of work | 15:55 |
| knikolla | finally managed to catch up reading | 15:55 |
| morgan | breton: and a lot of edgecases to make sure we don't regress - it's VERY complex | 15:55 |
| morgan | breton: thats all | 15:55 |
| morgan | ayoung: sam's patch is good because it's a simplification | 15:55 |
| ayoung | so that patch does, among other things, turns the filtersin into a single paramater that is an array | 15:55 |
| breton | more complex than switching to flask? | 15:55 |
| morgan | ayoung: i want to take it much much further | 15:55 |
| morgan | breton: yes. | 15:55 |
| ayoung | morgan, I'm with you | 15:55 |
| morgan | breton: @protected/@filterprotected is crazy complex. | 15:56 |
| morgan | breton: because you have callbacks that reimplment all the logic in subtly different ways on many classes | 15:56 |
| morgan | and it encodes a ton of logic in ways to "wedge" it into a decorator model | 15:56 |
| ayoung | morgan, If you get a single call, it should have a lot of the same logic as that patch. Maybe you want to start with that patch and keep going. | 15:56 |
| morgan | ayoung: likely | 15:56 |
| morgan | ayoung: that patch helps. | 15:57 |
| ayoung | morgan, I want to disconnect the enforcement from our controller hierarchy | 15:57 |
| morgan | ayoung: explain? | 15:57 |
| ayoung | the decoractor does a lot of this.token_api stuff | 15:57 |
| evrardjp | hello guys | 15:57 |
| evrardjp | I have a paste for you | 15:58 |
| ayoung | It means that the logic for building a token into an policy dictionary is tied to keystone | 15:58 |
| morgan | oh yeah | 15:58 |
| evrardjp | http://paste.openstack.org/show/495006/ | 15:58 |
| ayoung | I want to make it into a separateable library, something we could put into middleware | 15:58 |
| morgan | except you can't | 15:58 |
| morgan | because scope checks. | 15:58 |
| morgan | the middleware part | 15:58 |
| morgan | you need resources from the DB to know if you should allow it | 15:59 |
| *** belmoreira has joined #openstack-keystone | 16:01 | |
| evrardjp | this paste is link to my yesterday conversation | 16:02 |
| evrardjp | linked* | 16:02 |
| *** stingaci has joined #openstack-keystone | 16:02 | |
| *** rderose_ has joined #openstack-keystone | 16:04 | |
| *** stingac__ has quit IRC | 16:04 | |
| *** rderose has quit IRC | 16:08 | |
| *** mhickey has quit IRC | 16:11 | |
| *** lhcheng has joined #openstack-keystone | 16:12 | |
| *** ChanServ sets mode: +v lhcheng | 16:12 | |
| *** lhcheng has quit IRC | 16:13 | |
| *** lhcheng has joined #openstack-keystone | 16:13 | |
| *** ChanServ sets mode: +v lhcheng | 16:13 | |
| bknudson | evrardjp: do you want listing endpoints to be a public interface? The keystone public interface is really just getting a token. | 16:15 |
| bknudson | there's someplace you can pass in the interface to use ... not sure if it's on session or auth or client. | 16:15 |
| evrardjp | bknudson curl seems to make it work and lists it, while the openstack CL / libs don't seem to work | 16:17 |
| evrardjp | that's a usability concern for me | 16:17 |
| bknudson | when you use curl it uses whatever interface you give it directly, not the service catalog | 16:17 |
| bknudson | I don't know how you pass the interface to the openstack CLI. | 16:18 |
| bknudson | (or if it's even supported) | 16:18 |
| *** roxanag__ has joined #openstack-keystone | 16:19 | |
| *** jistr has quit IRC | 16:21 | |
| mylu | rodrigods: I figured it out....it was because I passed a saml flag to handle the 302 redirection and tempest took that parameter as part of kwargs and pass it as "body" on the GET request. and GET doesn't want any body | 16:22 |
| *** roxanagh_ has quit IRC | 16:22 | |
| *** arun_kant has joined #openstack-keystone | 16:22 | |
| *** navid_ has quit IRC | 16:23 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the resource abstract base class out of core https://review.openstack.org/302826 | 16:24 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the assignment abstract base class out of core https://review.openstack.org/299635 | 16:28 |
| arun_kant | dstanek: Hi, can you please check latest patch on https://review.openstack.org/#/c/279828/ as addressed your comments. | 16:30 |
| patchbot | arun_kant: patch 279828 - keystonemiddleware - Adding audit middleware specific notification driv... | 16:30 |
| *** mylu has quit IRC | 16:33 | |
| *** browne has joined #openstack-keystone | 16:35 | |
| evrardjp | bknudson yet that would mean different standards for libs and curl | 16:36 |
| *** browne1 has joined #openstack-keystone | 16:39 | |
| dstanek | evrardjp: not exactly. with curl you are picking the URL to use manually. the client is discovering it | 16:39 |
| *** Guest14509 has quit IRC | 16:40 | |
| dstanek | if you curled the same url the client is using it would fail the same way | 16:41 |
| *** browne has quit IRC | 16:41 | |
| *** darosale has joined #openstack-keystone | 16:41 | |
| *** phalmos has quit IRC | 16:45 | |
| *** stingaci has quit IRC | 16:46 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: Added X-Forwarded-For support https://review.openstack.org/309098 | 16:48 |
| *** ayoung has quit IRC | 16:48 | |
| *** belmoreira has quit IRC | 16:50 | |
| evrardjp | dstanek true, but I didn't set that as my auth url | 16:51 |
| *** jlk has joined #openstack-keystone | 16:52 | |
| jlk | Hey all. I have a question. If I'm doing a new install of Mitaka, and I want to support both keystone v2 api and v3 api, what should I put into the catalog for the identity service(s)? | 16:53 |
| *** roxanag__ has quit IRC | 16:53 | |
| jlk | should the URL be versioned or unversioned? | 16:54 |
| *** doug-fish has joined #openstack-keystone | 16:58 | |
| *** mou1 has joined #openstack-keystone | 16:59 | |
| *** pushkaru has joined #openstack-keystone | 17:00 | |
| *** real56 has joined #openstack-keystone | 17:00 | |
| *** dave-mccowan has quit IRC | 17:01 | |
| *** mou has quit IRC | 17:01 | |
| *** real56 has quit IRC | 17:01 | |
| *** real56 has joined #openstack-keystone | 17:02 | |
| *** trown|lunch is now known as trown | 17:02 | |
| *** doug-fis_ has quit IRC | 17:02 | |
| *** yarkot has quit IRC | 17:02 | |
| *** kevinbenton has quit IRC | 17:02 | |
| *** hugokuo has quit IRC | 17:03 | |
| *** fungi has quit IRC | 17:03 | |
| *** jgriffith has quit IRC | 17:03 | |
| *** serverascode has quit IRC | 17:03 | |
| *** jgriffith has joined #openstack-keystone | 17:03 | |
| *** fungi has joined #openstack-keystone | 17:04 | |
| *** sc68cal has quit IRC | 17:04 | |
| *** jgriffith is now known as Guest3894 | 17:04 | |
| *** sc68cal has joined #openstack-keystone | 17:04 | |
| *** kevinbenton has joined #openstack-keystone | 17:05 | |
| *** hugokuo has joined #openstack-keystone | 17:05 | |
| *** yarkot has joined #openstack-keystone | 17:05 | |
| *** sdake_ has joined #openstack-keystone | 17:06 | |
| *** stevemar has quit IRC | 17:06 | |
| *** sdake has quit IRC | 17:07 | |
| *** mou has joined #openstack-keystone | 17:07 | |
| *** dave-mccowan has joined #openstack-keystone | 17:07 | |
| *** stevemar has joined #openstack-keystone | 17:08 | |
| *** jasonsb has quit IRC | 17:08 | |
| *** raddaoui has quit IRC | 17:08 | |
| *** ekarlso has quit IRC | 17:08 | |
| *** martinus__ has quit IRC | 17:08 | |
| *** serverascode has joined #openstack-keystone | 17:08 | |
| *** sdake has joined #openstack-keystone | 17:09 | |
| *** rderose_ has quit IRC | 17:09 | |
| *** toddnni_ has joined #openstack-keystone | 17:10 | |
| *** ChanServ sets mode: +o stevemar | 17:10 | |
| *** raddaoui has joined #openstack-keystone | 17:10 | |
| *** martinus__ has joined #openstack-keystone | 17:10 | |
| *** sdake_ has quit IRC | 17:11 | |
| *** sheel_ has joined #openstack-keystone | 17:12 | |
| *** vnogin1 has joined #openstack-keystone | 17:12 | |
| *** spzala_ has joined #openstack-keystone | 17:13 | |
| *** mou1 has quit IRC | 17:13 | |
| *** darosale_ has joined #openstack-keystone | 17:13 | |
| *** zhiyan_ has joined #openstack-keystone | 17:14 | |
| *** tristanC_ has joined #openstack-keystone | 17:14 | |
| *** sc68cal_ has joined #openstack-keystone | 17:14 | |
| odyssey4me | bknudson evrardjp dstanek OK, let's step back a bit here. When accessing the Keystone auth endpoint which I've defined, and using the endpoint type that I've defined, I expect to be able to do various things via the API. Some of those things may require elevated priveleges. | 17:15 |
| *** pleia2_ has joined #openstack-keystone | 17:15 | |
| odyssey4me | So the first question is - if elevated privs are required, is it 'by design' behaviour to redirect the requester to the admin endpoint? | 17:15 |
| stevemar | jlk: you probably still want to put /v2.0 into the catalog for the identity service | 17:16 |
| *** stingaci has joined #openstack-keystone | 17:17 | |
| *** jlk` has joined #openstack-keystone | 17:18 | |
| *** real56 has quit IRC | 17:18 | |
| *** real56 has joined #openstack-keystone | 17:18 | |
| odyssey4me | bknudson evrardjp dstanek it's my understanding that in Keystone today, all endpoints actually have the same functionality and the authorisation is handled through the token scoping | 17:19 |
| *** sc68cal has quit IRC | 17:19 | |
| *** darosale has quit IRC | 17:19 | |
| *** spzala has quit IRC | 17:19 | |
| *** sheel has quit IRC | 17:19 | |
| *** amit213 has quit IRC | 17:19 | |
| *** pleia2 has quit IRC | 17:19 | |
| *** jlk has quit IRC | 17:19 | |
| *** jasondotstar has quit IRC | 17:19 | |
| *** tristanC has quit IRC | 17:19 | |
| *** lbragstad has quit IRC | 17:19 | |
| *** zhiyan has quit IRC | 17:19 | |
| *** toddnni has quit IRC | 17:19 | |
| *** vnogin has quit IRC | 17:19 | |
| *** toddnni_ is now known as toddnni | 17:19 | |
| *** darosale_ is now known as darosale | 17:19 | |
| odyssey4me | (this assumes a v3 API environment, of course) | 17:19 |
| *** sheel_ is now known as sheel | 17:19 | |
| *** real56 has quit IRC | 17:20 | |
| *** real56 has joined #openstack-keystone | 17:20 | |
| *** pleia2_ is now known as pleia2 | 17:20 | |
| *** ekarlso has joined #openstack-keystone | 17:21 | |
| *** lbragstad has joined #openstack-keystone | 17:22 | |
| *** real56 has quit IRC | 17:22 | |
| *** amit213 has joined #openstack-keystone | 17:22 | |
| *** daemontool has quit IRC | 17:22 | |
| *** real56 has joined #openstack-keystone | 17:22 | |
| *** zhiyan_ is now known as zhiyan | 17:23 | |
| *** sc68cal_ has quit IRC | 17:23 | |
| odyssey4me | bknudson evrardjp dstanek worth noting is that the impression of both endpoints being functionally equivalent is based on the comment from dolphm in this bug: https://bugs.launchpad.net/keystone/+bug/1381961 | 17:24 |
| openstack | Launchpad bug 1381961 in OpenStack Identity (keystone) "Keystone API GET 5000/v3 returns wrong endpoint URL in response body" [Low,Fix released] - Assigned to Steve Martinelli (stevemar) | 17:24 |
| *** jasondotstar has joined #openstack-keystone | 17:24 | |
| evrardjp | also, that would deserve a word of explanation here: http://docs.openstack.org/developer/keystoneauth/using-sessions.html | 17:25 |
| *** ayoung has joined #openstack-keystone | 17:26 | |
| *** ChanServ sets mode: +v ayoung | 17:26 | |
| *** alex_xu has quit IRC | 17:27 | |
| *** AJaeger has joined #openstack-keystone | 17:27 | |
| dstanek | odyssey4me: i believe that you are correct | 17:27 |
| *** chrisshattuck has joined #openstack-keystone | 17:27 | |
| AJaeger | keystone cores, could you import translation sync, please? https://review.openstack.org/307589 it removes all the pot (source files) for the tempest plugin since that one is untranslated. No need to keep the pots in tree for that... | 17:28 |
| stevemar | AJaeger: hmmmm? | 17:28 |
| *** fawadkhaliq has joined #openstack-keystone | 17:29 | |
| AJaeger | stevemar: we import translations and their source files - the tempest plug-in does not need translations - or at least we do not need to store the source files in tree and update them everytime as long as nobody translates them | 17:30 |
| AJaeger | stevemar: source files = .pot files. Source fiels for translators | 17:30 |
| AJaeger | stevemar: clearer now? | 17:31 |
| *** tqtran has joined #openstack-keystone | 17:31 | |
| *** alex_xu has joined #openstack-keystone | 17:31 | |
| *** jed56 has quit IRC | 17:33 | |
| *** EinstCrazy has quit IRC | 17:35 | |
| *** jlk` is now known as jlk | 17:35 | |
| *** real56 has quit IRC | 17:38 | |
| *** real56 has joined #openstack-keystone | 17:39 | |
| stevemar | AJaeger: all i see is magic | 17:40 |
| *** real56 has quit IRC | 17:41 | |
| *** real56 has joined #openstack-keystone | 17:41 | |
| *** pnavarro has quit IRC | 17:42 | |
| AJaeger | stevemar: shall I explain it differently? | 17:43 |
| AJaeger | stevemar: yeah, we try to add some magic to our scripts - to reduce the churn ;) | 17:43 |
| AJaeger | stevemar: thanks for approving. | 17:43 |
| stevemar | AJaeger: i'm not a wizard, explaining magic to me wouldn't help :) | 17:44 |
| stevemar | AJaeger: thanks for removing the keystone CLI stuff from the docs :) | 17:45 |
| stevemar | oh that reminds me, i need to release today | 17:45 |
| stevemar | bknudson: ! | 17:45 |
| AJaeger | Ok, will not hold you up on that ;) Bye for now! | 17:45 |
| *** AJaeger has left #openstack-keystone | 17:45 | |
| jlk | stevemar: I have a question. If I'm doing a new install of Mitaka, and I want to support both keystone v2 api and v3 api, what should I put into the catalog for the identity service(s)? | 17:46 |
| jlk | stevemar: should the URL be versioned or unversioned? | 17:46 |
| stevemar | 13:16 stevemar: jlk: you probably still want to put /v2.0 into the catalog for the identity service | 17:47 |
| stevemar | :) | 17:47 |
| *** ayoung has quit IRC | 17:47 | |
| jlk | huh, my proxy ate that | 17:47 |
| jlk | and I didn't see it | 17:47 |
| jlk | is there a reason for still putting /2.0 in there? | 17:47 |
| stevemar | damn proxies *shakes fist* | 17:47 |
| jlk | when we want everything to use 3? | 17:47 |
| *** ayoung has joined #openstack-keystone | 17:47 | |
| *** ChanServ sets mode: +v ayoung | 17:47 | |
| stevemar | just cautionary, in case some services are using v3 still, but most core services should be v3 friendly | 17:47 |
| morgan | oooh i see a jlk | 17:48 |
| stevemar | jlk: maybe morgan and jamielennox|away have a different opinion | 17:48 |
| jlk | stevemar: well, I control all the services too, so shouldn't I be able to tell the services to use the v3, and put the URL into the service config unversioned ? | 17:48 |
| jlk | I mean, what even makes use of the identity entry in the catalog, because you have to pre-known the identity URL in order to get the catalog.... | 17:49 |
| *** real56 has quit IRC | 17:49 | |
| * morgan reads backscroll? | 17:49 | |
| dstanek | does anything actually use the catalog to find the identity service? | 17:49 |
| morgan | ok | 17:49 |
| *** real56 has joined #openstack-keystone | 17:49 | |
| morgan | so.. | 17:49 |
| morgan | you can use V2 CRUD with V3 tokens | 17:50 |
| stevemar | jlk: right, the only bits that really use the identity entry in the catalog are the other services, and if you're controlling them, you can set things up to be v3 | 17:50 |
| morgan | and vice versa (keystone will translate) | 17:50 |
| morgan | NOW.. the issue is users in not the default domain CANNOT use v2 crud* | 17:50 |
| jlk | stevemar: how do the other services use the identity entry in the catalog? | 17:50 |
| morgan | * some special exceptions | 17:50 |
| morgan | i highly recommend pushing people to v3 | 17:50 |
| morgan | *highly* | 17:50 |
| morgan | but if you need to support both, don't put anything outside of the default domain | 17:51 |
| jlk | how does one get catalog information, without already knowing the url to the identity service? | 17:51 |
| morgan | and it should work | 17:51 |
| morgan | jlk: the auth_url is known apriori | 17:51 |
| bknudson | stevemar: did people fix the issues that you brought up on the mailing list? | 17:51 |
| jlk | morgan: and the auth_url is the entry in the catalog, so...? | 17:51 |
| morgan | jlk: you can put a (i think?) versionless entry in the catalog now | 17:51 |
| jlk | or are there cases where that's not the same? | 17:51 |
| morgan | with mitaka. | 17:51 |
| morgan | auth_url doesn't need to be the same | 17:52 |
| odyssey4me | morgan hmm, liberty was definitely a no-go on that one - I'll take a bash at trying that for Mitaka :) | 17:52 |
| bknudson | stevemar: https://review.openstack.org/#/c/247810/ isn't merged. | 17:52 |
| patchbot | bknudson: patch 247810 - barbican - Deleting duplicate code | 17:52 |
| morgan | my poc cloud used "auth.tempusfrangit.org" as the auth endpoint and "api.tempusfrangit.org/identity" for the CRUD interface | 17:52 |
| odyssey4me | (the versionless endpoint for the identity service in the catalog) | 17:52 |
| jlk | alright, so other services would read the catalog | 17:52 |
| morgan | jlk: correct. | 17:52 |
| morgan | jlk: so.. i would probably use v3 in the catalog tbh if you need versions | 17:53 |
| jlk | is there anything special about "identityv3" as an entry in the catalog? | 17:53 |
| jlk | or do services only look for "identity" or what they're explicitly told to look for? | 17:53 |
| morgan | we try to discourage "versioned" names | 17:53 |
| *** timcline_ has quit IRC | 17:53 | |
| morgan | i think "identity" is what things look for | 17:53 |
| morgan | though in most cases, nothing needs to do CRUD on keystone | 17:53 |
| morgan | so they just need the auth_url | 17:53 |
| stevemar | bknudson: i proposed https://review.openstack.org/#/c/307837/ instead, and it's not used in the CI | 17:53 |
| patchbot | stevemar: patch 307837 - barbican - migrate keystone_data to openstackclient | 17:53 |
| morgan | (heat being the exception afaik) | 17:53 |
| jlk | yeah, heat. | 17:54 |
| morgan | and heat talks v3 | 17:54 |
| jlk | but if my catalog entry ends in /v2.0... | 17:54 |
| morgan | in fact. don't ask heat to talk v2 | 17:54 |
| morgan | it doesn't like that | 17:54 |
| jlk | does heat just ignore that /v2.0 entry and use /v3 instead? | 17:54 |
| morgan | i think it will be configured with a direct path to /v3 | 17:54 |
| morgan | vs catalog lookup | 17:54 |
| bknudson | http://git.openstack.org/cgit/openstack/barbican/tree/bin/keystone_data.sh is broken | 17:55 |
| jlk | oh right, we configure heat directly so that auth_uri is /v3 | 17:55 |
| bknudson | oh, not used in the ci | 17:55 |
| bknudson | http://git.openstack.org/cgit/openstack/murano-deployment/tree/murano-ci/config/devstack/local.sh :( | 17:55 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:55 | |
| bknudson | fuel still has it | 17:55 |
| morgan | jlk: so, basically nothing really does keystone crud. | 17:55 |
| bknudson | openstack CLI does | 17:56 |
| morgan | jlk: and only ever looks at auth_url you configure it with | 17:56 |
| morgan | the cli talking to keystone is different (i mean services) | 17:56 |
| jlk | so I'm not going to worry about "stale" entries in our catalog that has /v2.0 on the URL | 17:56 |
| jlk | and any new catalogs will just get /v3 | 17:56 |
| morgan | you're probably "ok" in most cases. | 17:56 |
| morgan | but i really would try and push people to /v3 | 17:56 |
| morgan | wherever you can | 17:56 |
| bknudson | why would you want /v3 in the catalog? | 17:56 |
| jlk | we are | 17:56 |
| morgan | or well versionless | 17:56 |
| jlk | bknudson: if I have to put a version | 17:56 |
| bknudson | we're just going to come out with a v4 and then we'll have to go through this all over again | 17:56 |
| morgan | and if versionless isn't working | 17:56 |
| jlk | if I don't have to, then won't put a version. | 17:57 |
| morgan | please please please open bugs for us | 17:57 |
| morgan | esp. in mitaka and later | 17:57 |
| bknudson | if the clients are expecting a versioned endpoint then v3 isn't going to work. | 17:57 |
| morgan | we need to fix the versioned endpoint crap | 17:57 |
| jlk | odyssey4me: is testing that right now, right? :D | 17:57 |
| jlk | fwiw, your install documents still say to tag /2.0 on them | 17:57 |
| odyssey4me | jlk heh, I need an hour to setup an environment to validate whether stuff works with a versioned endpoint | 17:58 |
| bknudson | because clients expect the identity entry to be /v2.0 | 17:58 |
| jlk | http://docs.openstack.org/mitaka/install-guide-ubuntu/keystone-services.html | 17:58 |
| jlk | whoops | 17:58 |
| jlk | sorry, that does say /v3 | 17:58 |
| jlk | not versionless | 17:58 |
| bknudson | If /v3 is working then that's just because you're lucky | 17:59 |
| *** real56 has quit IRC | 17:59 | |
| morgan | jlk: our docs need love | 18:00 |
| morgan | jlk: it's def. on our radar | 18:00 |
| *** real56 has joined #openstack-keystone | 18:00 | |
| *** pushkaru has quit IRC | 18:01 | |
| *** pushkaru has joined #openstack-keystone | 18:01 | |
| jlk | bknudson: I'm confused, didn't you just advocate for putting versionless in the catalog? | 18:01 |
| jlk | and now you're saying anything but /v2.0 is only working due to luck? | 18:01 |
| *** real56 has quit IRC | 18:01 | |
| morgan | jlk: there are rough edges | 18:02 |
| morgan | we need to improve the testing and get feedbacke where it breaks | 18:02 |
| *** real56 has joined #openstack-keystone | 18:02 | |
| morgan | it *should* work | 18:02 |
| morgan | but ... as odyssey4me said, there are cases (liberty esp.) where it just didn't | 18:02 |
| *** doug-fis_ has joined #openstack-keystone | 18:02 | |
| bknudson | jlk: If you're deploying openstack you should have v2.0 as the identity endpoint. It's been that way so long that clients are going to expect it. | 18:03 |
| odyssey4me | jlk we've been using v3 endpoints in the catalogue as a default in OpenStack-Ansible since Liberty, and it works... some of the services needed to use the v2 url in their client configs (ceilometer, aodh, etc) but that was OK for those cases and many of them were fixed up for Mitaka. | 18:03 |
| bknudson | changing to versionless or v3 is not backwards compatible. | 18:03 |
| bknudson | we can't test every possible application. | 18:04 |
| *** doug-fish has quit IRC | 18:04 | |
| jlk | well, I'm going to follow the written docs and see what falls over. | 18:05 |
| morgan | bknudson: yeah. | 18:05 |
| *** stingaci has quit IRC | 18:05 | |
| bknudson | I'm guessing the reason it works is because nothing uses it except openstack CLI and that does version discovery / version replacement. | 18:07 |
| *** stingaci has joined #openstack-keystone | 18:07 | |
| bknudson | devstack now sets up versionless. | 18:07 |
| *** lhcheng has quit IRC | 18:08 | |
| jlk | versionless would be preferrable | 18:08 |
| jlk | so that I don't have to mess with URLs down the road if/when v4 happens | 18:08 |
| morgan | jlk: ++ versionless is where we SHOULD land | 18:08 |
| bknudson | if changing the endpoint to /v3 works for you then versionless will likely work too. | 18:08 |
| jlk | okay, worth a shot I suppose | 18:08 |
| *** lhcheng has joined #openstack-keystone | 18:09 | |
| *** ChanServ sets mode: +v lhcheng | 18:09 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:09 | |
| *** lhcheng has quit IRC | 18:09 | |
| *** timcline_ has joined #openstack-keystone | 18:14 | |
| *** real56 has quit IRC | 18:18 | |
| *** real56 has joined #openstack-keystone | 18:19 | |
| *** phalmos has joined #openstack-keystone | 18:19 | |
| *** real56 has quit IRC | 18:20 | |
| *** real56 has joined #openstack-keystone | 18:21 | |
| *** ayoung has quit IRC | 18:21 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Pre-cache new tokens https://review.openstack.org/309146 | 18:21 |
| *** sdake has quit IRC | 18:23 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add other-requirements.txt https://review.openstack.org/308477 | 18:24 |
| *** dan_nguyen has joined #openstack-keystone | 18:30 | |
| *** real56 has quit IRC | 18:30 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Removing bandit.yaml in favor of defaults https://review.openstack.org/294597 | 18:32 |
| *** woodster_ has joined #openstack-keystone | 18:34 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add other-requirements.txt https://review.openstack.org/308477 | 18:37 |
| *** gagehugo has quit IRC | 18:39 | |
| *** pushkaru has quit IRC | 18:50 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Zanata https://review.openstack.org/307589 | 18:51 |
| *** john5223 has joined #openstack-keystone | 18:55 | |
| *** mylu has joined #openstack-keystone | 18:59 | |
| *** mou has quit IRC | 19:00 | |
| *** henrynash has joined #openstack-keystone | 19:02 | |
| *** ChanServ sets mode: +v henrynash | 19:02 | |
| *** doug-fis_ has quit IRC | 19:06 | |
| *** lhcheng has joined #openstack-keystone | 19:07 | |
| *** ChanServ sets mode: +v lhcheng | 19:07 | |
| *** edmondsw has joined #openstack-keystone | 19:07 | |
| *** rderose_ has joined #openstack-keystone | 19:08 | |
| *** lhcheng has quit IRC | 19:08 | |
| *** doug-fish has joined #openstack-keystone | 19:08 | |
| *** lhcheng has joined #openstack-keystone | 19:08 | |
| *** ChanServ sets mode: +v lhcheng | 19:08 | |
| *** john5223 is now known as john | 19:16 | |
| *** john is now known as john5223 | 19:16 | |
| *** mhickey has joined #openstack-keystone | 19:18 | |
| *** rcernin has quit IRC | 19:19 | |
| *** john5223 has quit IRC | 19:23 | |
| *** john5223 has joined #openstack-keystone | 19:24 | |
| *** timcline_ has quit IRC | 19:27 | |
| *** mylu has quit IRC | 19:30 | |
| *** mylu has joined #openstack-keystone | 19:31 | |
| openstackgerrit | Merged openstack/keystone: Fix D400 PEP257 https://review.openstack.org/308060 | 19:37 |
| *** Guest3894 is now known as jgriffith | 19:40 | |
| *** stingaci has quit IRC | 19:40 | |
| *** tellesnobrega_af is now known as tellesnobrega | 19:43 | |
| *** mylu has quit IRC | 19:44 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes incorrect deprecation warning for IdentityDriverV8 https://review.openstack.org/305301 | 19:44 |
| *** mylu has joined #openstack-keystone | 19:47 | |
| *** mylu has quit IRC | 19:49 | |
| *** doug-fis_ has joined #openstack-keystone | 19:49 | |
| *** doug-fis_ has quit IRC | 19:50 | |
| *** doug-fis_ has joined #openstack-keystone | 19:50 | |
| *** erhudy has quit IRC | 19:51 | |
| *** mylu has joined #openstack-keystone | 19:51 | |
| *** woodburn has quit IRC | 19:52 | |
| *** doug-fish has quit IRC | 19:53 | |
| *** doug-fis_ has quit IRC | 19:54 | |
| *** ayoung has joined #openstack-keystone | 19:55 | |
| *** ChanServ sets mode: +v ayoung | 19:55 | |
| *** mylu has quit IRC | 19:56 | |
| *** tqtran is now known as tqtran-afk | 19:56 | |
| *** mylu has joined #openstack-keystone | 19:57 | |
| *** timcline_ has joined #openstack-keystone | 19:57 | |
| *** timclin__ has joined #openstack-keystone | 19:58 | |
| *** timcline_ has quit IRC | 19:58 | |
| *** dhellmann has left #openstack-keystone | 20:00 | |
| *** gyee has joined #openstack-keystone | 20:00 | |
| *** ChanServ sets mode: +v gyee | 20:00 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Concrete role assignments for federated users https://review.openstack.org/284943 | 20:02 |
| *** mylu has quit IRC | 20:03 | |
| *** timclin__ has quit IRC | 20:03 | |
| *** timcline_ has joined #openstack-keystone | 20:04 | |
| *** spzala_ has quit IRC | 20:05 | |
| *** spzala has joined #openstack-keystone | 20:06 | |
| *** mylu has joined #openstack-keystone | 20:07 | |
| *** woodburn has joined #openstack-keystone | 20:07 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 20:09 | |
| *** csoukup has quit IRC | 20:10 | |
| *** spzala has quit IRC | 20:10 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Concrete role assignments for federated users https://review.openstack.org/284943 | 20:11 |
| *** fawadkhaliq has quit IRC | 20:11 | |
| morgan | dolphm: when do you arrive in austin | 20:12 |
| morgan | ? | 20:12 |
| *** rcernin has joined #openstack-keystone | 20:12 | |
| *** fawadkhaliq has joined #openstack-keystone | 20:13 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 20:13 | |
| morgan | stevemar: ^ cc same q | 20:13 |
| dolphm | morgan: not sure exactly, but probably sunday around 3pm | 20:13 |
| *** ebalduf_ has joined #openstack-keystone | 20:15 | |
| morgan | dolphm: ok cool. | 20:15 |
| morgan | dolphm: was wondering if it was sat or sunday | 20:15 |
| morgan | dolphm: /me is trying to get teh schedule in order so things like hanging w/ the keystone folks happen :) | 20:16 |
| dstanek | morgan: are you that busy? :-P | 20:16 |
| bknudson | life of a tc member | 20:17 |
| morgan | dstanek: no | 20:17 |
| morgan | dstanek: i figure yall are that busy cause you're employed ;) | 20:17 |
| morgan | and have "things" to do | 20:18 |
| morgan | ^_^ | 20:18 |
| bknudson | we're all "buy buy buy, sell sell sell" | 20:18 |
| morgan | hehe | 20:18 |
| dolphm | morgan: i have no plans beyond setup the traditional twitter group for anyone interested and pick a rally point | 20:19 |
| *** fawadkhaliq has quit IRC | 20:19 | |
| *** fawadkhaliq has joined #openstack-keystone | 20:20 | |
| bknudson | You'll all be at the core party... it was full when I tried to sign up (or maybe I was blocked for spite). | 20:20 |
| dolphm | it was full for me too | 20:21 |
| bknudson | ok, maybe nobody will be at the core party | 20:21 |
| morgan | bknudson: hehe | 20:23 |
| morgan | i got in.. cause i asked for an extra ticket :P | 20:23 |
| *** e0ne has quit IRC | 20:24 | |
| morgan | so i has two. | 20:24 |
| * morgan shakes head | 20:24 | |
| * morgan point to the ML topic | 20:24 | |
| *** fawadkhaliq has quit IRC | 20:24 | |
| morgan | and the general sentiment makes me happy | 20:24 |
| bknudson | you can put it on eventbrite and invite everyone to try to sign up for it. | 20:24 |
| morgan | small groups, team meetups | 20:24 |
| *** e0ne has joined #openstack-keystone | 20:24 | |
| morgan | and less "core reviewer party" | 20:24 |
| morgan | :) | 20:24 |
| morgan | oh crap... | 20:25 |
| morgan | i need a hostname for my new laptop | 20:25 |
| morgan | hmmmmmm. | 20:25 |
| *** fawadkhaliq has joined #openstack-keystone | 20:25 | |
| morgan | one of the hardest things in computer science! | 20:25 |
| morgan | NAming things! | 20:25 |
| bknudson | portlandia | 20:25 |
| morgan | lol | 20:25 |
| morgan | it has to be A song of ice and fire based. | 20:25 |
| bknudson | you should put a bird on it | 20:25 |
| morgan | mac laptop is whitewalker | 20:26 |
| morgan | network is winterfell. | 20:26 |
| morgan | server is tyrell. | 20:26 |
| * morgan ponders | 20:27 | |
| morgan | HODOR! | 20:27 |
| dstanek | morgan: i'll rearrange my schedule for you sir | 20:28 |
| morgan | dstanek: hehe | 20:28 |
| *** jamielennox|away is now known as jamielennox | 20:29 | |
| morgan | hmm. | 20:30 |
| *** mhickey has quit IRC | 20:30 | |
| *** stingaci has joined #openstack-keystone | 20:31 | |
| *** doug-fish has joined #openstack-keystone | 20:32 | |
| morgan | ooh opensuse uses btrfs | 20:32 |
| morgan | neat | 20:32 |
| bknudson | here's an example using wrapt.ObjectProxy for the request ID stuff: http://paste.openstack.org/show/495040/ | 20:33 |
| bknudson | so all the _*WithMeta classes are not needed. | 20:34 |
| morgan | bknudson: please! | 20:34 |
| morgan | i dislike the _*withmeta things | 20:34 |
| *** stingaci has quit IRC | 20:34 | |
| morgan | though TBH i think we should be returning response objectds | 20:34 |
| morgan | but that ship has sailed :( | 20:34 |
| *** stingaci has joined #openstack-keystone | 20:35 | |
| bknudson | we could have had a callback function that's registered on requests (or session?) | 20:35 |
| morgan | bknudson: happy to add that to session | 20:35 |
| bknudson | that was one of my suggestions | 20:35 |
| morgan | no question | 20:35 |
| morgan | hmm. dstanek in your opinion is there a benefit to having /home isolated in a desktop linux? | 20:36 |
| morgan | dstanek: /me leans towards "not really" | 20:36 |
| bknudson | there is always a benefit to having home isolated | 20:37 |
| bknudson | lvm makes it easy to resize | 20:37 |
| morgan | bknudson: true. | 20:37 |
| morgan | it's been a while since i seriously considered a desktop linux partition layout beyond "/boot, /, swap" | 20:38 |
| *** BigWillie has quit IRC | 20:38 | |
| bknudson | I went overboard this time -- I've got home , openstack , vms , images | 20:39 |
| *** trown is now known as trown|outtypewww | 20:39 | |
| morgan | bknudson: hehe | 20:39 |
| morgan | bknudson: also.. btrfs "yay" or "OH HELL NAW" | 20:39 |
| morgan | s/naw/no | 20:39 |
| *** spzala has joined #openstack-keystone | 20:39 | |
| bknudson | haven't tried it. Not sure what difference it makes | 20:39 |
| * morgan kicks autocorrect | 20:39 | |
| morgan | HOW THE HELL did no => naw | 20:39 |
| bknudson | I say NAW. | 20:39 |
| morgan | i know.. but i'm from the west coast | 20:40 |
| morgan | we use "no" :) | 20:40 |
| john5223 | i like btrfs. if you snapshot you can rollback if you screw something up | 20:40 |
| morgan | john5223: have you had data loss issues though? | 20:40 |
| morgan | i mean i wouldn't use it on a prod server yet (until i play with it more) | 20:40 |
| john5223 | no. i've heard of issues possibly with really large drives but i haven't seen anything myself | 20:40 |
| morgan | what is "really large"? | 20:40 |
| morgan | 6TB? 20TB? | 20:41 |
| john5223 | and btrfs is now required for lxd | 20:41 |
| morgan | oooh | 20:41 |
| morgan | good to know | 20:41 |
| bknudson | does ubuntu default to btrfs? | 20:41 |
| john5223 | no. defaults to lvm install | 20:41 |
| john5223 | not sure about new release | 20:41 |
| morgan | bknudson: i'm installing openSUSE tumbleweed | 20:42 |
| morgan | bknudson: i want a rolling distro | 20:42 |
| bknudson | I just installed ubuntu 14.04 and now theres 16.04. | 20:42 |
| morgan | and .. i have an aversion to arch | 20:42 |
| morgan | if i can't get this to work, i'll go to 16.04 | 20:42 |
| * morgan needs super bleeding edge kernel :) | 20:42 | |
| john5223 | im going to be trying a dev openstack environment on 16.04 with mitaka soon. should be fun. | 20:43 |
| morgan | i also figure i give ubuntu 2wk run before i upgrade/install | 20:44 |
| morgan | because... uhm... things are wonky right at release usually | 20:44 |
| morgan | and since 16.04 released today | 20:44 |
| *** rderose_ has quit IRC | 20:46 | |
| morgan | john5223: hmmm. well good to know LXD requires btrfs | 20:46 |
| john5223 | btrfs or zfs i believe | 20:47 |
| morgan | i use ZFS on my home nas | 20:47 |
| john5223 | but yeah, i dont think its documented yet. learned it the hard way :) | 20:47 |
| morgan | but ZFS-boot worries me | 20:47 |
| morgan | esp. when i need like 4.6 kernel | 20:47 |
| morgan | or 4.5 | 20:48 |
| *** krotscheck has quit IRC | 20:48 | |
| *** krotscheck has joined #openstack-keystone | 20:48 | |
| jamielennox | when does everyone arrive into austin? | 20:50 |
| jamielennox | (i'm sure this has been asked here before) | 20:51 |
| *** fawadk has joined #openstack-keystone | 20:54 | |
| *** fawadkhaliq has quit IRC | 20:54 | |
| bknudson | late sunday | 20:54 |
| *** clenimar has quit IRC | 20:55 | |
| stevemar | sunday evening | 20:58 |
| lbragstad | sunday afternoon | 20:58 |
| knikolla | sunday afternoon | 20:58 |
| jamielennox | ah, everyone fairly late | 20:59 |
| *** fawadk has quit IRC | 20:59 | |
| jamielennox | maybe i should have said instead i've got the weekend in austin before hand, so if anyone's around early send me a twitter or something | 21:00 |
| morgan | jamielennox: saturday ~noon | 21:04 |
| jamielennox | morgan: ah, nice! | 21:05 |
| jamielennox | i'll pick up a sim card somewhere so i should be contactable | 21:05 |
| jamielennox | actually does T-mobile still do that, hmm | 21:06 |
| morgan | jamielennox: probably | 21:06 |
| *** BjoernT has quit IRC | 21:06 | |
| *** tristanC_ is now known as tristanC | 21:07 | |
| *** e0ne has quit IRC | 21:07 | |
| *** fawadkhaliq has joined #openstack-keystone | 21:07 | |
| *** fawadkhaliq has quit IRC | 21:08 | |
| *** edmondsw has quit IRC | 21:08 | |
| *** e0ne has joined #openstack-keystone | 21:08 | |
| *** fawadkhaliq has joined #openstack-keystone | 21:08 | |
| *** fawadkhaliq has quit IRC | 21:08 | |
| *** pushkaru has joined #openstack-keystone | 21:10 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add other-requirements.txt https://review.openstack.org/308477 | 21:10 |
| *** ebalduf_ has quit IRC | 21:12 | |
| stevemar | bknudson: TIL that prince hails from minnesota, i didn't realize cool people come from there | 21:16 |
| bknudson | there was one cool guy. :( | 21:16 |
| *** woodburn has quit IRC | 21:18 | |
| stevemar | bknudson: time for you to take up the cool guy position | 21:18 |
| bknudson | I'm not from minnesota | 21:18 |
| bknudson | I just live here | 21:19 |
| stevemar | bknudson: gonna play your ND card now eh | 21:23 |
| stevemar | bknudson: looks like we've got a meeting tomorrow! | 21:23 |
| bknudson | stevemar: yes, and I'll probably have meetings all the time next week too. | 21:23 |
| *** tellesnobrega is now known as tellesnobrega_af | 21:24 | |
| bknudson | stevemar: maybe we'll get some requirements to bring up during summit sessions | 21:25 |
| *** gordc has quit IRC | 21:25 | |
| bknudson | stevemar: you're not in the slack channel | 21:26 |
| *** bebech has quit IRC | 21:32 | |
| *** bebech has joined #openstack-keystone | 21:32 | |
| *** roxanaghe has quit IRC | 21:38 | |
| *** roxanaghe_ has joined #openstack-keystone | 21:39 | |
| *** roxanaghe__ has joined #openstack-keystone | 21:39 | |
| *** roxanaghe_ has quit IRC | 21:39 | |
| *** rcernin has quit IRC | 21:39 | |
| *** aimeeU has quit IRC | 21:46 | |
| *** chrisshattuck has quit IRC | 21:49 | |
| *** roxanaghe__ has quit IRC | 21:51 | |
| *** roxanaghe has joined #openstack-keystone | 21:51 | |
| *** fawadkhaliq has joined #openstack-keystone | 21:52 | |
| *** gordc has joined #openstack-keystone | 21:55 | |
| *** rderose_ has joined #openstack-keystone | 21:56 | |
| *** henrynash has quit IRC | 21:57 | |
| *** mylu has quit IRC | 21:57 | |
| *** ebalduf has joined #openstack-keystone | 21:57 | |
| *** spzala has quit IRC | 21:58 | |
| *** BjoernT has joined #openstack-keystone | 21:59 | |
| stevemar | bknudson: never got the invite | 22:01 |
| *** mylu has joined #openstack-keystone | 22:01 | |
| *** BjoernT has quit IRC | 22:03 | |
| bknudson | bob dylan is now the cool guy from minnesota | 22:07 |
| *** ebalduf has quit IRC | 22:07 | |
| bknudson | stevemar: jamielennox has been hiding slack from us. | 22:08 |
| lbragstad | mmmhm - that's right | 22:08 |
| *** darosale has quit IRC | 22:10 | |
| *** timcline_ has quit IRC | 22:13 | |
| *** tqtran-afk is now known as tqtran | 22:14 | |
| *** phalmos has quit IRC | 22:14 | |
| *** doug-fish has quit IRC | 22:14 | |
| crinkle | morgan: what does "the token can be refreshed" mean in https://bugs.launchpad.net/keystoneauth/+bug/1510825 ? wouldn't you just want a new token? | 22:15 |
| openstack | Launchpad bug 1510825 in keystoneauth "need a session constructor that takes both auth params and token" [Medium,Triaged] | 22:15 |
| morgan | hmm. | 22:15 |
| morgan | uhm | 22:15 |
| morgan | looking | 22:15 |
| morgan | ah | 22:15 |
| morgan | crinkle: so in keystoneauth, if you have username/password it can refresh the token when it's about to expire | 22:16 |
| morgan | crinkle: so the bug is saying we need a way of passing username/password in and an active token, so that the current token is used until it expires | 22:16 |
| morgan | then we get a new token | 22:16 |
| *** fawadkhaliq has quit IRC | 22:16 | |
| morgan | crinkle: the current constructor either takes token or username/password - and doesn't do the right thing with both (if it is even possible) | 22:19 |
| crinkle | morgan: it can take both it just doesn't do anything with the password one http://paste.openstack.org/show/495050/ | 22:20 |
| morgan | ahh | 22:20 |
| morgan | thats it | 22:20 |
| morgan | i think it fails to make a session that has all the sane attributes for token refresh/new-token-get when current expires | 22:21 |
| morgan | at least i remember that is what mordred was complaining about when tha tbug was opened. | 22:21 |
| *** timcline_ has joined #openstack-keystone | 22:22 | |
| *** fawadkhaliq has joined #openstack-keystone | 22:25 | |
| *** timcline_ has quit IRC | 22:27 | |
| *** fawadkhaliq has quit IRC | 22:28 | |
| *** slberger has left #openstack-keystone | 22:28 | |
| *** fawadkhaliq has joined #openstack-keystone | 22:30 | |
| *** krotscheck is now known as krotscheck_dcm | 22:32 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:35 | |
| *** ametts has quit IRC | 22:38 | |
| *** fawadkhaliq has quit IRC | 22:40 | |
| *** gordc has quit IRC | 22:41 | |
| *** stingaci has quit IRC | 22:43 | |
| *** edtubill has quit IRC | 22:45 | |
| *** dan_nguyen has quit IRC | 22:45 | |
| *** mylu has quit IRC | 22:46 | |
| *** stingaci has joined #openstack-keystone | 22:55 | |
| *** stingaci has quit IRC | 22:55 | |
| *** mylu has joined #openstack-keystone | 22:57 | |
| *** can8dnSix has joined #openstack-keystone | 23:00 | |
| *** mylu has quit IRC | 23:01 | |
| *** can8dnSix has quit IRC | 23:03 | |
| *** can8dnSix has joined #openstack-keystone | 23:03 | |
| *** furface has joined #openstack-keystone | 23:04 | |
| *** edtubill has joined #openstack-keystone | 23:05 | |
| *** rderose_ has quit IRC | 23:06 | |
| *** markvoelker has quit IRC | 23:20 | |
| *** dan_nguyen has joined #openstack-keystone | 23:29 | |
| *** timonwong has joined #openstack-keystone | 23:34 | |
| *** arun_kant has quit IRC | 23:36 | |
| *** mylu has joined #openstack-keystone | 23:46 | |
| *** e0ne has quit IRC | 23:47 | |
| jamielennox | adding the token and password like that is validating 2 auth types - not one then fallback to the other | 23:51 |
| jamielennox | the problem with using an existing token for a while is that we need more than the token, we need the service catalog and other details | 23:51 |
| jamielennox | now we could take an existing token and ask keystone for the auth_ref that goes with it | 23:52 |
| jamielennox | but at which point we could also have just issued a new token | 23:52 |
| *** mylu has quit IRC | 23:52 | |
| jamielennox | you can use the plugin caching to save and restore all this if you know you are going to want to use it later | 23:52 |
| stevemar | do i upgrade my dev env to 16.04 hmmmm | 23:55 |
| *** edtubill has quit IRC | 23:57 | |
| *** mylu has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!