| *** darrenc is now known as darren_afk | 00:09 | |
| *** fangxu has quit IRC | 00:12 | |
| *** timcline has joined #openstack-keystone | 00:15 | |
| *** timcline has quit IRC | 00:19 | |
| *** darren_afk is now known as darrenc | 00:23 | |
| *** markvoelker has quit IRC | 00:30 | |
| *** Guest460 is now known as mfisch | 00:32 | |
| *** mfisch is now known as Guest81704 | 00:32 | |
| *** itlinux has joined #openstack-keystone | 00:48 | |
| *** catintheroof has joined #openstack-keystone | 00:55 | |
| *** itlinux has quit IRC | 00:57 | |
| *** lhcheng has joined #openstack-keystone | 01:01 | |
| *** ChanServ sets mode: +v lhcheng | 01:01 | |
| *** lhcheng has quit IRC | 01:06 | |
| *** EinstCra_ has joined #openstack-keystone | 01:09 | |
| *** timcline has joined #openstack-keystone | 01:16 | |
| *** timcline has quit IRC | 01:20 | |
| *** wxy has joined #openstack-keystone | 01:32 | |
| *** spzala has joined #openstack-keystone | 01:40 | |
| *** EinstCra_ is now known as EinstCrazy | 01:44 | |
| *** julim has quit IRC | 01:51 | |
| *** navidp has joined #openstack-keystone | 01:59 | |
| *** spzala has quit IRC | 02:03 | |
| *** spzala has joined #openstack-keystone | 02:04 | |
| *** spzala has quit IRC | 02:08 | |
| *** timcline has joined #openstack-keystone | 02:16 | |
| *** timcline has quit IRC | 02:21 | |
| *** itlinux has joined #openstack-keystone | 02:33 | |
| *** amit213 has quit IRC | 02:34 | |
| *** amit213 has joined #openstack-keystone | 02:34 | |
| openstackgerrit | Merged openstack/keystoneauth: Expose allow parameters for URL discovery https://review.openstack.org/309650 | 02:56 |
|---|---|---|
| *** Guest81704 is now known as mfisch | 03:03 | |
| *** mfisch is now known as Guest30018 | 03:04 | |
| *** GB21 has quit IRC | 03:12 | |
| *** sheel has joined #openstack-keystone | 03:14 | |
| *** timcline has joined #openstack-keystone | 03:17 | |
| *** timcline has quit IRC | 03:22 | |
| *** markvoelker has joined #openstack-keystone | 03:26 | |
| *** markvoel_ has joined #openstack-keystone | 03:29 | |
| *** markvoelker has quit IRC | 03:32 | |
| *** dan_nguyen has joined #openstack-keystone | 03:35 | |
| *** navidp has quit IRC | 03:37 | |
| *** links has joined #openstack-keystone | 03:44 | |
| *** dan_nguyen has quit IRC | 03:46 | |
| *** catintheroof has quit IRC | 03:56 | |
| *** dan_nguyen has joined #openstack-keystone | 04:01 | |
| *** spzala has joined #openstack-keystone | 04:04 | |
| *** spzala has quit IRC | 04:10 | |
| *** timcline has joined #openstack-keystone | 04:18 | |
| *** browne has joined #openstack-keystone | 04:21 | |
| *** timcline has quit IRC | 04:22 | |
| *** browne has quit IRC | 04:30 | |
| *** dan_nguyen has quit IRC | 04:52 | |
| *** TxGVNN has joined #openstack-keystone | 04:57 | |
| *** roxanaghe has joined #openstack-keystone | 05:19 | |
| *** timcline has joined #openstack-keystone | 05:19 | |
| *** markvoel_ has quit IRC | 05:20 | |
| *** roxanaghe has quit IRC | 05:20 | |
| *** timcline has quit IRC | 05:23 | |
| *** TxGVNN has quit IRC | 05:23 | |
| *** itlinux has quit IRC | 05:31 | |
| *** rcernin has joined #openstack-keystone | 05:40 | |
| openstackgerrit | Ryosuke Mizuno proposed openstack/keystone: Add migration to make service type unique https://review.openstack.org/307593 | 05:48 |
| *** yolanda has joined #openstack-keystone | 05:58 | |
| *** timcline has joined #openstack-keystone | 06:03 | |
| *** timcline has quit IRC | 06:08 | |
| *** afazekas_ is now known as afazekas | 06:10 | |
| *** markvoelker has joined #openstack-keystone | 06:14 | |
| *** markvoelker has quit IRC | 06:19 | |
| *** roxanaghe has joined #openstack-keystone | 06:21 | |
| *** roxanaghe has quit IRC | 06:26 | |
| *** xek__ is now known as xek | 06:43 | |
| *** openstackgerrit has quit IRC | 06:47 | |
| *** openstackgerrit has joined #openstack-keystone | 06:48 | |
| *** tesseract has joined #openstack-keystone | 07:01 | |
| *** timcline has joined #openstack-keystone | 07:04 | |
| *** spzala has joined #openstack-keystone | 07:04 | |
| *** timcline has quit IRC | 07:09 | |
| *** spzala has quit IRC | 07:09 | |
| *** yolanda has quit IRC | 07:17 | |
| *** yolanda has joined #openstack-keystone | 07:23 | |
| *** zqfan has joined #openstack-keystone | 07:31 | |
| *** TxGVNN has joined #openstack-keystone | 07:40 | |
| *** daemontool has joined #openstack-keystone | 07:45 | |
| *** markvoelker has joined #openstack-keystone | 08:03 | |
| *** timcline has joined #openstack-keystone | 08:05 | |
| *** markvoelker has quit IRC | 08:07 | |
| *** timcline has quit IRC | 08:09 | |
| *** roxanaghe has joined #openstack-keystone | 08:10 | |
| *** roxanaghe has quit IRC | 08:14 | |
| *** openstackgerrit has quit IRC | 08:17 | |
| *** openstackgerrit has joined #openstack-keystone | 08:17 | |
| *** jaosorior has joined #openstack-keystone | 08:19 | |
| *** daemontool has quit IRC | 08:21 | |
| *** jed56 has joined #openstack-keystone | 08:24 | |
| *** jistr has joined #openstack-keystone | 08:32 | |
| *** jamielennox is now known as jamielennox|away | 08:40 | |
| *** rudolfvriend has joined #openstack-keystone | 08:42 | |
| *** belmoreira has joined #openstack-keystone | 08:49 | |
| *** mkoderer__ has joined #openstack-keystone | 09:04 | |
| *** timcline has joined #openstack-keystone | 09:06 | |
| *** timcline has quit IRC | 09:10 | |
| *** mvk has joined #openstack-keystone | 09:23 | |
| *** baffle has quit IRC | 09:24 | |
| *** baffle has joined #openstack-keystone | 09:25 | |
| openstackgerrit | yolanda.robla proposed openstack/keystoneauth: Use betamax hooks to mask fixture results https://review.openstack.org/311133 | 09:28 |
| *** daemontool has joined #openstack-keystone | 09:45 | |
| *** markvoelker has joined #openstack-keystone | 09:51 | |
| *** markvoelker has quit IRC | 09:56 | |
| *** timcline has joined #openstack-keystone | 10:06 | |
| *** timcline has quit IRC | 10:11 | |
| *** daemontool_ has joined #openstack-keystone | 10:11 | |
| *** pnavarro has joined #openstack-keystone | 10:11 | |
| *** daemontool has quit IRC | 10:14 | |
| *** EinstCrazy has quit IRC | 10:22 | |
| *** daemontool__ has joined #openstack-keystone | 10:31 | |
| *** daemontool_ has quit IRC | 10:34 | |
| *** ksavich has quit IRC | 10:35 | |
| *** daemontool has joined #openstack-keystone | 10:36 | |
| *** daemontool__ has quit IRC | 10:37 | |
| *** daemontool_ has joined #openstack-keystone | 10:41 | |
| *** daemontool__ has joined #openstack-keystone | 10:43 | |
| *** daemontool has quit IRC | 10:44 | |
| *** daemontool_ has quit IRC | 10:46 | |
| *** dmellado|off is now known as dmellado | 10:47 | |
| *** daemontool_ has joined #openstack-keystone | 10:51 | |
| *** daemontool__ has quit IRC | 10:55 | |
| samueldmq | morning keystone | 10:59 |
| *** daemontool__ has joined #openstack-keystone | 10:59 | |
| *** daemontool_ has quit IRC | 11:03 | |
| *** daemontool has joined #openstack-keystone | 11:04 | |
| *** spzala has joined #openstack-keystone | 11:05 | |
| *** daemontool_ has joined #openstack-keystone | 11:06 | |
| *** timcline has joined #openstack-keystone | 11:07 | |
| *** rodrigods has quit IRC | 11:07 | |
| *** rodrigods has joined #openstack-keystone | 11:07 | |
| *** daemontool__ has quit IRC | 11:07 | |
| *** daemontool__ has joined #openstack-keystone | 11:08 | |
| *** spzala has quit IRC | 11:09 | |
| *** daemontool has quit IRC | 11:10 | |
| *** daemontool has joined #openstack-keystone | 11:11 | |
| *** timcline has quit IRC | 11:12 | |
| *** daemontool_ has quit IRC | 11:12 | |
| *** daemontool_ has joined #openstack-keystone | 11:14 | |
| *** daemontool__ has quit IRC | 11:15 | |
| *** jaosorior has quit IRC | 11:15 | |
| *** jaosorior has joined #openstack-keystone | 11:16 | |
| *** daemontool has quit IRC | 11:18 | |
| *** mjb has quit IRC | 11:24 | |
| *** mjb has joined #openstack-keystone | 11:27 | |
| *** gordc has joined #openstack-keystone | 11:28 | |
| *** jaosorior has quit IRC | 11:33 | |
| *** jaosorior has joined #openstack-keystone | 11:33 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: DO NOT MERGE: test ldap_filters in user list https://review.openstack.org/314055 | 11:35 |
| *** frontrunner has quit IRC | 11:37 | |
| *** markvoelker has joined #openstack-keystone | 11:39 | |
| *** markvoelker has quit IRC | 11:44 | |
| *** roxanaghe has joined #openstack-keystone | 11:45 | |
| *** roxanaghe has quit IRC | 11:50 | |
| *** yolanda has quit IRC | 11:57 | |
| *** yolanda has joined #openstack-keystone | 12:02 | |
| *** raildo-afk is now known as raildo | 12:04 | |
| *** pauloewerton has joined #openstack-keystone | 12:07 | |
| *** timcline has joined #openstack-keystone | 12:08 | |
| *** rudolfvriend has quit IRC | 12:08 | |
| *** timcline has quit IRC | 12:12 | |
| *** dobson has quit IRC | 12:14 | |
| *** iurygregory has joined #openstack-keystone | 12:28 | |
| *** edmondsw has joined #openstack-keystone | 12:30 | |
| *** markvoelker has joined #openstack-keystone | 12:33 | |
| *** markvoelker has quit IRC | 12:38 | |
| *** agireud has quit IRC | 12:38 | |
| *** agireud has joined #openstack-keystone | 12:40 | |
| *** daemontool__ has joined #openstack-keystone | 12:41 | |
| *** jordanP has joined #openstack-keystone | 12:42 | |
| *** EinstCrazy has joined #openstack-keystone | 12:42 | |
| jordanP | hi guys. I am working on a a Tempest test failure. the failing test is https://github.com/openstack/tempest/blob/master/tempest/api/identity/admin/v2/test_users_negative.py#L228 | 12:42 |
| jordanP | it started to fail on May, 5 according to the log stash query message:"self.assertRaises(lib_exc.Unauthorized, self.users_client.list_users)" | 12:43 |
| jordanP | example of a test failure here: http://logs.openstack.org/88/306788/10/check/gate-tempest-dsvm-postgres-full/bb9875c/console.html#_2016-05-09_10_57_39_189 | 12:43 |
| jordanP | I hate to say, but it feels like a Fernet token/implementation issue | 12:44 |
| *** dobson has joined #openstack-keystone | 12:44 | |
| jordanP | I am saying that because it seems like fernet token was made the default recently (according to https://review.openstack.org/#/c/195780/) | 12:44 |
| patchbot | jordanP: patch 195780 - openstack-dev/devstack - Switch fernet to be the default token provider (MERGED) | 12:44 |
| jordanP | and I've never seen that test failing before | 12:45 |
| *** daemontool_ has quit IRC | 12:45 | |
| *** EinstCrazy has quit IRC | 12:46 | |
| *** EinstCrazy has joined #openstack-keystone | 12:47 | |
| samueldmq | jordanP: hi, morning | 12:48 |
| jordanP | hi samueldmq | 12:48 |
| samueldmq | jordanP: so the request is not using a token, and should fail with 401 right? | 12:48 |
| jordanP | it's using a token but that token should have been deleted (revoked) ? | 12:49 |
| samueldmq | jordanP: is the token the same for both self.client and self.users_client ? | 12:50 |
| samueldmq | jordanP: token from self.client is deleted | 12:50 |
| samueldmq | jordanP: and self.users_client is used to make the request | 12:50 |
| *** EinstCrazy has quit IRC | 12:50 | |
| jordanP | samueldmq, I am not sure. I assume so, otherwise the test would fail 100% of the time | 12:51 |
| samueldmq | jordanP: could you doublecheck? | 12:52 |
| samueldmq | jordanP: oh, and it's failing randomly? | 12:52 |
| jordanP | yes | 12:52 |
| jordanP | it failed only 30 times in the last 7 days | 12:52 |
| samueldmq | *only* 30? hehe | 12:53 |
| samueldmq | jordanP: okay; e need more info to be able to debug | 12:54 |
| samueldmq | jordanP: is there a keystone log available, | 12:54 |
| jordanP | samueldmq, here: http://logs.openstack.org/88/306788/10/check/gate-tempest-dsvm-postgres-full/bb9875c/logs/apache/keystone.txt.gz#_2016-05-09_10_43_50_474 | 12:54 |
| jordanP | so can see the DELETE token statement | 12:54 |
| jordanP | and 5 lines after the GET http://127.0.0.1:35357/v2.0/users statement | 12:55 |
| jordanP | ^^this should have returned a 401, as far as I understand | 12:55 |
| samueldmq | jordanP: where are those statements ? can you pass me something so I can ctrl+f ? | 12:56 |
| jordanP | gAAAAABXMGnluQ1tzfT1XOAIs9jn6pwTdQu8dvE6xIsxtN8aW3k8Q is the token you are interested in | 12:57 |
| jordanP | (wait for your browser to completely load the page) | 12:57 |
| *** zzzeek has joined #openstack-keystone | 12:58 | |
| samueldmq | jordanP: so the list_users request is arriving prior to the delete token request on keystone server | 12:58 |
| *** yolanda has quit IRC | 12:58 | |
| samueldmq | jordanP: ? | 12:59 |
| jordanP | no,, the list user arrived at 2016-05-09 10:43:50.535 | 12:59 |
| *** Ephur has joined #openstack-keystone | 12:59 | |
| jordanP | and the delete at 2016-05-09 10:43:50.474 | 12:59 |
| *** EinstCrazy has joined #openstack-keystone | 13:01 | |
| samueldmq | jordanP: is this running the defaults for devstack/tempest ? | 13:02 |
| *** links has quit IRC | 13:02 | |
| samueldmq | jordanP: I will need to spin up a vm and try to reproduce it locally | 13:02 |
| jordanP | yes, it's from the gate-tempest-dsvm-postgres-full job so I guess it"s the default | 13:03 |
| samueldmq | jordanP: my first guess would be that the tokens are different between self.client and self.users_client | 13:03 |
| samueldmq | jordanP: otherwise that would be a bug on the server | 13:03 |
| *** yolanda has joined #openstack-keystone | 13:04 | |
| jordanP | It's possibly a concurrency issue, not related to postgre, logstash says the mysql job also fails on this from time to time | 13:04 |
| samueldmq | jordanP: likely yes, my question is whether this is a tempest bug (when handling tokens) or a keystone issue | 13:05 |
| *** EinstCrazy has quit IRC | 13:06 | |
| jordanP | yes, that's the question indeed | 13:06 |
| jordanP | I am not sure about the answer | 13:06 |
| samueldmq | it'd be useful if the tokens were logged for devstack, in the logs it shows as 'X-Auth-Token': '<omitted>'" | 13:06 |
| jordanP | yep, I'll try to repro locally | 13:06 |
| *** timcline has joined #openstack-keystone | 13:08 | |
| jordanP | the Tempest code has changed lately in this area | 13:10 |
| jordanP | *hasn't... | 13:10 |
| jordanP | lol | 13:10 |
| *** timcline has quit IRC | 13:13 | |
| *** markvoelker has joined #openstack-keystone | 13:13 | |
| *** EinstCrazy has joined #openstack-keystone | 13:14 | |
| *** zzzeek has quit IRC | 13:16 | |
| *** zzzeek has joined #openstack-keystone | 13:18 | |
| *** edmondsw has quit IRC | 13:20 | |
| *** rudolfvriend has joined #openstack-keystone | 13:29 | |
| *** jsavak has joined #openstack-keystone | 13:30 | |
| *** belmoreira has quit IRC | 13:31 | |
| *** rderose has joined #openstack-keystone | 13:34 | |
| *** rudolfvriend has quit IRC | 13:36 | |
| *** yolanda has quit IRC | 13:36 | |
| *** tonytan4ever has joined #openstack-keystone | 13:37 | |
| jordanP | I couldn't reproduce locally.. | 13:41 |
| *** yolanda has joined #openstack-keystone | 13:43 | |
| *** david-lyle_ has joined #openstack-keystone | 13:48 | |
| openstackgerrit | Merged openstack/keystone: Tests clean up global ldap settings https://review.openstack.org/304337 | 13:49 |
| *** david-lyle has quit IRC | 13:50 | |
| *** gagehugo has joined #openstack-keystone | 13:50 | |
| *** ametts has joined #openstack-keystone | 13:53 | |
| *** richm has joined #openstack-keystone | 13:53 | |
| *** markvoelker has quit IRC | 13:55 | |
| samueldmq | jordanP: how do I run that single test in tempest ? | 13:56 |
| samueldmq | jordanP: I have a fresh devstack env running | 13:57 |
| *** edmondsw has joined #openstack-keystone | 13:57 | |
| jordanP | tox -e all -- tempest.api.identity.admin.v2.test_users_negative | 13:57 |
| jordanP | from the tempest repo | 13:57 |
| jordanP | this runs all the tests in the test_users_negative file | 13:57 |
| * samueldmq nods | 13:57 | |
| jordanP | or tox -e all -- test_get_users_request_without_token | 13:58 |
| jordanP | if you want only that single test | 13:58 |
| *** woodburn has joined #openstack-keystone | 13:58 | |
| *** thiagolib has joined #openstack-keystone | 14:00 | |
| *** catintheroof has joined #openstack-keystone | 14:03 | |
| samueldmq | jordanP: I can't reproduce it locally either | 14:04 |
| openstackgerrit | Merged openstack/keystone: Clean up test_receive_identityId https://review.openstack.org/309842 | 14:05 |
| *** spzala has joined #openstack-keystone | 14:05 | |
| *** TemporalBeing1 has left #openstack-keystone | 14:05 | |
| samueldmq | jordanP: if tempest allowed us to see the token used ... that would be helpful | 14:05 |
| samueldmq | https://github.com/openstack/tempest-lib/blob/master/tempest_lib/common/rest_client.py#L397-L414 | 14:05 |
| jordanP | ok, will submit a patch for this | 14:06 |
| jordanP | give me 10 min :) | 14:06 |
| jordanP | and then 50min to let to tests pass obviously | 14:06 |
| samueldmq | jordanP: nice | 14:06 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:06 | |
| jordanP | I am 95% sure it's not a bug in Tempest :) | 14:07 |
| jordanP | hehe, we will see | 14:07 |
| *** d0ugal has quit IRC | 14:07 | |
| samueldmq | jordanP: let's see ... we will be sure if the tests fail, otherwise we can't say anything | 14:08 |
| samueldmq | let's see | 14:08 |
| *** jaugustine has joined #openstack-keystone | 14:08 | |
| *** ramishra has quit IRC | 14:08 | |
| *** links has joined #openstack-keystone | 14:08 | |
| jordanP | it's super unlikely that the test will fail. But we can see if the same token is used | 14:08 |
| jordanP | and it should be used | 14:08 |
| samueldmq | jordanP: notice that other tests also failed when that one failed | 14:08 |
| jordanP | yeah that's because the cleanup is not properly done | 14:09 |
| jordanP | this is a tempest bug | 14:09 |
| jordanP | for sure | 14:09 |
| *** timcline has joined #openstack-keystone | 14:09 | |
| *** ramishra has joined #openstack-keystone | 14:09 | |
| *** spzala has quit IRC | 14:09 | |
| samueldmq | jordanP: kk, brb | 14:10 |
| *** spzala has joined #openstack-keystone | 14:10 | |
| samueldmq | jordanP: let me know once you have a patch up | 14:10 |
| jordanP | yes | 14:10 |
| *** csoukup has joined #openstack-keystone | 14:11 | |
| *** links has quit IRC | 14:11 | |
| bknudson | #success The keystone CLI is finally gone. Long live openstack CLI. | 14:11 |
| openstackstatus | bknudson: Added success to Success page | 14:11 |
| bknudson | I hope this sticks. | 14:12 |
| *** navidp has joined #openstack-keystone | 14:13 | |
| *** timcline has quit IRC | 14:14 | |
| *** jorge_munoz has joined #openstack-keystone | 14:15 | |
| *** navidp has quit IRC | 14:17 | |
| *** rderose has quit IRC | 14:19 | |
| *** jorge_munoz_ has joined #openstack-keystone | 14:19 | |
| *** jorge_munoz has quit IRC | 14:21 | |
| *** jorge_munoz_ is now known as jorge_munoz | 14:21 | |
| *** andrewbogott has quit IRC | 14:22 | |
| *** andrewbogott has joined #openstack-keystone | 14:22 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move identity.backends.sql model code to sql_model.py https://review.openstack.org/292611 | 14:27 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/305487 | 14:27 |
| *** slberger has joined #openstack-keystone | 14:28 | |
| morgan | ayoung, lbragstad: https://review.openstack.org/#/c/311652/6 don't use for/else | 14:30 |
| patchbot | morgan: patch 311652 - keystone - Replace revoke tree with linear search | 14:30 |
| *** navidp has joined #openstack-keystone | 14:31 | |
| lbragstad | morgan ah ha - nice | 14:32 |
| ayoung | morgan, can I do that in a follow on. This is an attempt to move the test code on over to master as-is | 14:33 |
| ayoung | the test code has been run in parallel since the trust code started using the tree | 14:33 |
| ayoung | and, while I don't love it, I want to do all changes in a step by step way. So..I can submite a follow on patch with that change | 14:34 |
| morgan | ayoung: i'll be a -1 on for/else unless you have a followup posted | 14:35 |
| morgan | i draw a hard line on for/else while/else useage | 14:35 |
| morgan | if we're fixing things, that gets fixed too. | 14:35 |
| bknudson | we need to be consistent on how we do our reviews, so if for/else / while/else is not allowed that needs to be documented | 14:35 |
| ayoung | morgan, I can work with that. Two patches, one as is,. one with the for/else cleanup, and any other cleanups we want to be linked with it | 14:35 |
| morgan | ayoung: ++ | 14:36 |
| morgan | bknudson: i think we had a hacking change by dstanek specifically to deal with that | 14:36 |
| *** sdake has joined #openstack-keystone | 14:36 | |
| morgan | bknudson: and i want to revisit it. | 14:36 |
| morgan | bknudson: it is unreasonable to ask everyone to review / know "for/else" is banned in keystone | 14:36 |
| morgan | bknudson: i think it needed a fix in our tests, but i'll check with dstanek today and get that re-worked. | 14:36 |
| bknudson | probably because the test that ayoung is copying does it. | 14:37 |
| morgan | bknudson: yep. | 14:37 |
| *** navidp has quit IRC | 14:37 | |
| morgan | it wont be hard to remove all traces of for/else and while/else from keystone and then make the hacking change a thing. | 14:38 |
| ayoung | bknudson, I think he is right that the logic of if/else is confusing. I remember learning it when the original patch was posted, as I had not seen it before. | 14:38 |
| stevemar | o/ | 14:38 |
| ayoung | I mean for/else | 14:38 |
| morgan | stevemar: oh hai. | 14:38 |
| bknudson | ayoung: I hope if/else isn't too confusing! he he | 14:38 |
| *** pgbridge has joined #openstack-keystone | 14:38 | |
| bknudson | if / return or raise / else is kind of confusing. | 14:39 |
| morgan | bknudson: dude, if you can't do it with while/break on everything | 14:39 |
| morgan | bknudson: you're not trying | 14:39 |
| morgan | no if/else | 14:39 |
| morgan | :P | 14:39 |
| bknudson | break? I goto. | 14:39 |
| morgan | bknudson: ++ | 14:39 |
| dstanek | bknudson: long live the cli! | 14:39 |
| ayoung | Does python support goto? | 14:39 |
| morgan | bknudson: i just write C and make python dynamically call out to GCC to compile the shared object before loading it in | 14:40 |
| dstanek | morgan: i did make that, but at one of the mid-cycles it was decided that we didn't need/want it | 14:40 |
| morgan | dstanek: well i think i want to bring it back up. | 14:40 |
| morgan | dstanek: because regardless i'm going to keep -1ing every instance of for/else i find. | 14:40 |
| stevemar | who is ready for when folks bring out their pitch forks? https://pypi.python.org/pypi/python-keystoneclient/3.0.0 ?! | 14:42 |
| morgan | dstanek: i really do think it is the wrong construct to use and the only place (outside of testing) we really used it was the revoke tree | 14:42 |
| morgan | stevemar: oh uh... sure? i have my fire resistant suit today | 14:42 |
| ayoung | stevemar, its OK. I have the heavy machine guns already set up in a support by fire position. Let them bring their farming implements | 14:42 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the federation abstract base class out of core https://review.openstack.org/314137 | 14:43 |
| dstanek | morgan: i find it useful for avoiding extra nesting or and extra 'if', but since it confuses everyone I'm ok with not using it | 14:44 |
| morgan | dstanek: if it wasn't such a weird construct that has to be explained over and over, i'd agree with you | 14:44 |
| morgan | dstanek: but i would rather the code not need extra explinations / comments every time for some convenience. | 14:44 |
| dstanek | morgan: unfortunate :-(, but i agree | 14:45 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the federation abstract base class out of core https://review.openstack.org/314137 | 14:46 |
| *** jsavak has quit IRC | 14:46 | |
| *** ChanServ changes topic to "Midcycle Planning Thread: http://lists.openstack.org/pipermail/openstack-dev/2016-April/092298.html" | 14:48 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the federation abstract base class out of core https://review.openstack.org/314137 | 14:49 |
| *** woodster_ has joined #openstack-keystone | 14:49 | |
| *** dancn has joined #openstack-keystone | 14:52 | |
| *** TxGVNN has quit IRC | 14:53 | |
| *** raddaoui has joined #openstack-keystone | 14:53 | |
| *** d0ugal has joined #openstack-keystone | 14:55 | |
| *** phalmos has joined #openstack-keystone | 14:55 | |
| lbragstad | dolphm bknudson talking with jordanP in #openstack-qa about https://bugs.launchpad.net/keystone/+bug/1578866 if you're interested | 14:57 |
| openstack | Launchpad bug 1578866 in OpenStack Identity (keystone) "test_user_update_own_password failing intermittently" [High,Confirmed] | 14:57 |
| zzzeek | heya morgan my CI is getting a bunch of these http://paste.openstack.org/show/496467/ all the sudden | 14:57 |
| morgan | zzzeek: looking | 14:57 |
| zzzeek | morgan: there's a lot of dogpile in the logs too, not sure if that's related, let me put a bigger segment | 14:58 |
| morgan | zzzeek: nah that looks like a pyldap issue | 14:58 |
| morgan | zzzeek: python-ldap* | 14:58 |
| morgan | and set_option being bad. | 14:58 |
| zzzeek | morgan: http://paste.openstack.org/show/496468/ | 14:58 |
| *** jsavak has joined #openstack-keystone | 14:58 | |
| zzzeek | OK so my CI env is not totally standard maybe if i wipe and rebuild ? | 14:59 |
| morgan | zzzeek: have to jump into a meeting. maybe, but unlikely i'll look in an hour or so :) | 14:59 |
| *** Guest30018 is now known as mfisch | 14:59 | |
| zzzeek | morgan: np | 14:59 |
| *** mfisch is now known as Guest56459 | 14:59 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the federation abstract base class out of core https://review.openstack.org/314137 | 15:03 |
| *** tonytan4ever has quit IRC | 15:03 | |
| *** haplo37 has joined #openstack-keystone | 15:04 | |
| *** clenimar has joined #openstack-keystone | 15:04 | |
| *** spzala has quit IRC | 15:06 | |
| *** spzala has joined #openstack-keystone | 15:07 | |
| *** jsavak has quit IRC | 15:08 | |
| *** d0ugal has quit IRC | 15:08 | |
| *** edtubill has joined #openstack-keystone | 15:09 | |
| *** yolanda has quit IRC | 15:09 | |
| *** timcline has joined #openstack-keystone | 15:10 | |
| *** timcline_ has joined #openstack-keystone | 15:13 | |
| *** spzala has quit IRC | 15:13 | |
| *** timcline has quit IRC | 15:13 | |
| *** timcline_ has quit IRC | 15:14 | |
| *** timcline has joined #openstack-keystone | 15:14 | |
| *** EinstCrazy has quit IRC | 15:18 | |
| *** yolanda has joined #openstack-keystone | 15:19 | |
| *** roxanaghe has joined #openstack-keystone | 15:22 | |
| ayoung | dstanek, looking more closely at the for/elses in https://review.openstack.org/#/c/311652/6/keystone/models/revoke_model.py sepcifically the one at line 180...can that ever be hit? | 15:22 |
| patchbot | ayoung: patch 311652 - keystone - Replace revoke tree with linear search | 15:22 |
| ayoung | for attribute_name in ['identity_domain_id', 'assignment_domain_id']: would never trigger an else, right? | 15:22 |
| *** pnavarro has quit IRC | 15:24 | |
| *** d0ugal has joined #openstack-keystone | 15:25 | |
| *** diazjf has joined #openstack-keystone | 15:26 | |
| ayoung | OK...I'm forgetting what else means in a for loop. that def needs to die | 15:26 |
| *** roxanaghe has quit IRC | 15:26 | |
| dstanek | ayoung: the 'else' will be executed if the 'break' is not executed | 15:27 |
| ayoung | dstanek, right...which makes this logic the perfect candidate for using it. | 15:28 |
| ayoung | Excpet for that fact that only a python guru would understand that | 15:28 |
| dstanek | ayoung: :-) | 15:28 |
| ayoung | I am not a python guru, so I clearly cannot chose the goblet in front of me | 15:28 |
| dstanek | ayoung: it's one of those language constructs that's really useful, but so infrequently used that it's hard to remember what it does | 15:30 |
| ayoung | dstanek, and also more obscure by the attempt to not require addtional language keywords | 15:30 |
| *** tonytan4ever has joined #openstack-keystone | 15:32 | |
| *** jistr has quit IRC | 15:33 | |
| dstanek | ayoung: yeah, i've started to replace it with 'if all(somefilter...)' when i can in some of the other projects i hack on | 15:34 |
| *** jed56 has quit IRC | 15:34 | |
| ayoung | ooh | 15:34 |
| ayoung | I think I can do that here | 15:34 |
| *** navidp has joined #openstack-keystone | 15:34 | |
| ayoung | dstanek, for example | 15:36 |
| ayoung | if all(event.user_id == token_values[attribute_name] | 15:36 |
| ayoung | for attribute_name in ['user_id', 'trustor_id', 'trustee_id']): | 15:36 |
| ayoung | return False | 15:36 |
| rodrigods | ^ really odd | 15:37 |
| rodrigods | i can't read what's going on | 15:37 |
| dstanek | ayoung: yeah, something like that should work. if your expression gets too long you can just make it a function and give it a name | 15:38 |
| dstanek | ayoung: actually i think you want any() instead of all() | 15:38 |
| morgan | dstanek: ++ | 15:39 |
| ayoung | dstanek, nope | 15:39 |
| dstanek | rodrigods: it's easier to ready that the for-else because that just confuses people | 15:39 |
| ayoung | if they all pass, it means that the event can't match, and thus short circuit | 15:39 |
| ayoung | if any one of them match, the event can still potentially match the token, and keep on checking | 15:40 |
| dstanek | ayoung: in that original code if any of them match then the loop is aborted and the 'else' is not executed | 15:40 |
| *** daemontool__ has quit IRC | 15:41 | |
| ayoung | dstanek, right. and in the original code, it is the else that does the return | 15:41 |
| rodrigods | actually, i can't read either way... have to stop and think a bit for both | 15:41 |
| rodrigods | i usually do that with an external bool | 15:42 |
| ayoung | rodrigods, False means "token is not revoked by this event" and passes through a series of checks. It is only revoked it if passes through all of the checks, so we want a quick return for the normal case | 15:44 |
| rodrigods | ayoung, right... what don't split in several methods that return True if matches? | 15:45 |
| rodrigods | if any of the methods return False, short circuit | 15:45 |
| ayoung | rodrigods, I'm not certain it makes it any clearer. | 15:45 |
| ayoung | I'll have the updated code posted for review shortly | 15:46 |
| rodrigods | ayoung, yeah... not sure either | 15:46 |
| rodrigods | just brainstorming | 15:46 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Change to use json instead of msgpack in request_local cache https://review.openstack.org/314188 | 15:46 |
| morgan | ayoung: ^ move to json from msgpack in request local | 15:47 |
| morgan | ayoung: lets see how it goes. | 15:47 |
| ayoung | dstanek, OK you are right...I had it backwards. any is the right test | 15:47 |
| ayoung | dstanek, but I need to swap == to != | 15:47 |
| ayoung | no...wait... | 15:48 |
| rodrigods | ayoung no... | 15:48 |
| ayoung | I don't need to swap here | 15:48 |
| rodrigods | keep the == | 15:48 |
| rodrigods | yeah | 15:48 |
| ayoung | um | 15:49 |
| ayoung | I think it is | 15:49 |
| ayoung | if all ( != ) | 15:49 |
| rodrigods | isn't any( == )? | 15:49 |
| ayoung | rodrigods, if any( == ) then continue | 15:49 |
| rodrigods | yes | 15:49 |
| ayoung | if all ( != ) then return False | 15:50 |
| rodrigods | if all ( != ) return False | 15:50 |
| rodrigods | exactly | 15:50 |
| ayoung | so the short circuit logic is | 15:50 |
| ayoung | if any ( == ): NOOP else return False | 15:50 |
| ayoung | I know this is premature optimization, but this is the fast path | 15:51 |
| dstanek | this looks like code by committee :-) | 15:51 |
| *** d0ugal has quit IRC | 15:51 | |
| ayoung | maybe not pre-mature | 15:51 |
| ayoung | dstanek, nah, it looks like hand tuned performance code | 15:51 |
| bknudson | pair-programming | 15:53 |
| bknudson | very agile | 15:53 |
| morgan | bknudson: s/pair/3+ people/ | 15:53 |
| ayoung | rodrigods, dstanek here is my current thinking (untested as of yet) https://paste.fedoraproject.org/364305/14628092/ | 15:54 |
| bknudson | we need a shared display where we can all type | 15:54 |
| bknudson | etherpad, I guess | 15:54 |
| *** jistr has joined #openstack-keystone | 15:54 | |
| ayoung | I guess I can reverse that...the pass is not going to be any more performant | 15:55 |
| dstanek | bknudson: etherpad needs vim bindings | 15:55 |
| morgan | bknudson: programming via google docs? | 15:55 |
| ayoung | so this https://paste.fedoraproject.org/364306/14628093/ | 15:56 |
| dstanek | morgan: when i interviewed with Google that's what they did | 15:56 |
| rodrigods | ayoung the second one by far | 15:56 |
| rodrigods | dstanek morgan yes | 15:56 |
| rodrigods | they do that | 15:56 |
| bknudson | VaaS (vim as a service) | 15:56 |
| ayoung | rodrigods, yeah. I think they have exactly the same execution path. | 15:57 |
| *** rderose has joined #openstack-keystone | 16:01 | |
| *** tesseract has quit IRC | 16:01 | |
| *** ramishra_ has joined #openstack-keystone | 16:04 | |
| *** jsavak has joined #openstack-keystone | 16:05 | |
| *** rcernin has quit IRC | 16:06 | |
| *** d0ugal has joined #openstack-keystone | 16:06 | |
| *** ramishra has quit IRC | 16:07 | |
| *** roxanaghe has joined #openstack-keystone | 16:07 | |
| *** spzala has joined #openstack-keystone | 16:08 | |
| *** dan_nguyen has joined #openstack-keystone | 16:12 | |
| *** agrebennikov has joined #openstack-keystone | 16:13 | |
| *** spzala has quit IRC | 16:15 | |
| *** dan_nguyen has quit IRC | 16:16 | |
| *** gyee has joined #openstack-keystone | 16:22 | |
| *** ChanServ sets mode: +v gyee | 16:22 | |
| *** tonytan4ever has quit IRC | 16:22 | |
| *** diazjf has quit IRC | 16:24 | |
| *** tonytan4ever has joined #openstack-keystone | 16:24 | |
| yolanda | hi morgan, sigmavirus24 , can you take a look at my new keystoneauth + betamax patch ?https://review.openstack.org/#/c/311133/ | 16:26 |
| patchbot | yolanda: patch 311133 - keystoneauth - Use betamax hooks to mask fixture results | 16:26 |
| morgan | yolanda: will do. on my list for today :) | 16:26 |
| yolanda | morgan, there was some concern from sigmavirus24 related to the way we use betamax for unit testing | 16:27 |
| * sigmavirus24 nods | 16:27 | |
| sigmavirus24 | I was looking for shade's issue tracker but the storyboard for it looks dead and outdated | 16:27 |
| *** rbridgeman has joined #openstack-keystone | 16:29 | |
| morgan | sigmavirus24: welllll | 16:32 |
| morgan | sigmavirus24: it's supposed to be in storyboard... | 16:32 |
| morgan | sigmavirus24: what is the concern? | 16:32 |
| *** fangxu has joined #openstack-keystone | 16:33 | |
| sigmavirus24 | morgan: so the way I understood it, y'all are going to record cassettes and then use those with mocks? | 16:33 |
| morgan | basically we plan to record real cloud interactions, then use the replay as part of the testing | 16:33 |
| morgan | sigmavirus24: the reason is to ensure we don't regress/break the ... large number of variations from what clouds.yaml provides. | 16:33 |
| morgan | sigmavirus24: with changes to shade/ksa/etc | 16:34 |
| morgan | sigmavirus24: if a cloud changes their responses, we need to update the cassette | 16:34 |
| sigmavirus24 | Right | 16:34 |
| morgan | but that seems to be less common than us changing code in shade | 16:34 |
| sigmavirus24 | It just sounded like y'all were going to just update your current unit testing/mocking with cassette data | 16:34 |
| morgan | afaik it's adding a ton more testing | 16:34 |
| sigmavirus24 | Cool | 16:34 |
| morgan | not replacing tests | 16:34 |
| *** jsavak has quit IRC | 16:35 | |
| morgan | yolanda: ^ correct me if i'm wrong. | 16:35 |
| morgan | sigmavirus24: we might replace *some* very synthetic mocks with cassettes | 16:35 |
| *** rbridgeman_ has joined #openstack-keystone | 16:35 | |
| sigmavirus24 | col | 16:35 |
| yolanda | yep, not replacing tests, but make the unit tests use the recorded data to mock server | 16:35 |
| sigmavirus24 | *cool | 16:35 |
| sigmavirus24 | Ignore me then :) | 16:35 |
| morgan | sigmavirus24: but i don't want to ignore you :P | 16:35 |
| *** jsavak has joined #openstack-keystone | 16:35 | |
| sigmavirus24 | either way, I'm no longer concerned | 16:36 |
| morgan | okiue | 16:36 |
| morgan | okie8 | 16:36 |
| morgan | ugh... i can't type | 16:36 |
| *** rcernin has joined #openstack-keystone | 16:37 | |
| *** tonytan4ever has quit IRC | 16:37 | |
| *** rbridgeman has quit IRC | 16:38 | |
| yolanda | morgan, so what i did following sigmavirus24 advice, is to replace with placeholders | 16:39 |
| yolanda | then on shade, we can replace these placeholders with real cloud data | 16:39 |
| yolanda | i'm thinking in adding a placeholder as well for the url, because for example, my devstack endpoints change on each run, so that's going to cause to record different fixtures per environment, that should not happen | 16:40 |
| morgan | yolanda: ++ | 16:40 |
| sigmavirus24 | Oh, can I suggest different test classes for different providers (including devstack) | 16:41 |
| sigmavirus24 | They can share common tests, but they should preferably be different test case classes to be safe :) | 16:41 |
| openstackgerrit | ZhiQiang Fan proposed openstack/keystone: replace logging with oslo.log https://review.openstack.org/309869 | 16:42 |
| morgan | sigmavirus24: sure. or something that programtically creates the test classes based upon the registered cassettes...oer whatever | 16:42 |
| sigmavirus24 | right | 16:43 |
| yolanda | yep, at the moment only using devstack, but the idea is to have fixtures per proviers | 16:44 |
| yolanda | providers | 16:44 |
| *** david-lyle_ is now known as david-lyle | 16:45 | |
| *** fangxu has quit IRC | 16:45 | |
| arunkant | dstanek: Can you review: https://review.openstack.org/#/c/279828/ | 16:49 |
| patchbot | arunkant: patch 279828 - keystonemiddleware - Adding audit middleware specific notification driv... | 16:49 |
| *** jordanP has quit IRC | 16:51 | |
| *** pnavarro has joined #openstack-keystone | 16:51 | |
| *** jsavak has quit IRC | 16:51 | |
| *** roxanagh_ has joined #openstack-keystone | 16:53 | |
| *** jaosorior has quit IRC | 16:58 | |
| *** sdake has quit IRC | 17:00 | |
| *** jsavak has joined #openstack-keystone | 17:00 | |
| *** sdake has joined #openstack-keystone | 17:01 | |
| *** fangxu has joined #openstack-keystone | 17:02 | |
| *** diazjf has joined #openstack-keystone | 17:02 | |
| *** jistr has quit IRC | 17:02 | |
| *** TxGVNN has joined #openstack-keystone | 17:03 | |
| *** fangxu has quit IRC | 17:03 | |
| *** yolanda has quit IRC | 17:06 | |
| *** daemontool__ has joined #openstack-keystone | 17:09 | |
| *** pgbridge has quit IRC | 17:10 | |
| *** spzala has joined #openstack-keystone | 17:11 | |
| *** yolanda has joined #openstack-keystone | 17:12 | |
| *** fangxu has joined #openstack-keystone | 17:14 | |
| *** spzala has quit IRC | 17:16 | |
| *** sdake_ has joined #openstack-keystone | 17:18 | |
| *** rderose has quit IRC | 17:20 | |
| *** sdake has quit IRC | 17:21 | |
| *** sdake_ has quit IRC | 17:25 | |
| *** roxanagh_ has quit IRC | 17:26 | |
| *** sdake has joined #openstack-keystone | 17:27 | |
| *** jaugustine has quit IRC | 17:30 | |
| *** gagehugo has quit IRC | 17:30 | |
| *** rderose has joined #openstack-keystone | 17:31 | |
| *** stingaci has joined #openstack-keystone | 17:36 | |
| *** pgbridge has joined #openstack-keystone | 17:36 | |
| *** diazjf has quit IRC | 17:38 | |
| *** diazjf has joined #openstack-keystone | 17:38 | |
| *** spzala has joined #openstack-keystone | 17:39 | |
| *** jsavak has quit IRC | 17:42 | |
| *** jsavak has joined #openstack-keystone | 17:43 | |
| *** navidp has quit IRC | 17:46 | |
| *** harlowja has joined #openstack-keystone | 17:48 | |
| *** TxGVNN has quit IRC | 17:58 | |
| *** sdake_ has joined #openstack-keystone | 17:58 | |
| *** sdake has quit IRC | 18:01 | |
| *** julim has joined #openstack-keystone | 18:01 | |
| *** csoukup has quit IRC | 18:02 | |
| *** jsavak has quit IRC | 18:05 | |
| *** jsavak has joined #openstack-keystone | 18:05 | |
| *** navidp has joined #openstack-keystone | 18:06 | |
| openstackgerrit | ayoung proposed openstack/keystone: Replace revoke tree with linear search https://review.openstack.org/311652 | 18:11 |
| ayoung | morgan, I decided I liked how the new code looked so much better than the original that I decided to merge it in to the main patch | 18:11 |
| *** mvk has quit IRC | 18:12 | |
| ayoung | yolanda, I love that patch number. I read it as EIIIEE! | 18:12 |
| morgan | ayoung: ++ | 18:13 |
| ayoung | yolanda, looks like the tests are comparing two lists, and the ordering is changing, even though the lists contain the same set of items. You could probably sort them and then compare | 18:15 |
| ayoung | self.assertEqual(cassette.placeholders, expected_placeholders) | 18:15 |
| *** sdake_ is now known as sdake | 18:15 | |
| bknudson | assertItemsEqual | 18:15 |
| *** timcline has quit IRC | 18:15 | |
| ayoung | bknudson, RIGHT... actually I think DictEqual now that I look | 18:16 |
| ayoung | http://logs.openstack.org/33/311133/7/check/gate-keystoneauth-python27/e078b70/console.html at 2016-05-09 09:33:09.049 | 18:16 |
| bknudson | I think I wrote a thing to compare xml... | 18:17 |
| bknudson | it's not perfect since there's no way for it to have all the info it needs | 18:18 |
| *** roxanagh_ has joined #openstack-keystone | 18:23 | |
| ayoung | bknudson, actually, looking at the test it is a list, and one that she constructs manually. Could be handled just by reordering the elements, but it looks like it should be a dict test | 18:24 |
| *** diazjf1 has joined #openstack-keystone | 18:26 | |
| *** diazjf has quit IRC | 18:26 | |
| *** sdake has quit IRC | 18:27 | |
| *** openstackgerrit has quit IRC | 18:33 | |
| *** openstackgerrit has joined #openstack-keystone | 18:33 | |
| *** timcline has joined #openstack-keystone | 18:34 | |
| *** timcline has quit IRC | 18:34 | |
| *** timcline has joined #openstack-keystone | 18:35 | |
| *** browne has joined #openstack-keystone | 18:38 | |
| *** browne has quit IRC | 18:41 | |
| *** ozialien10 has quit IRC | 18:43 | |
| *** ozialien10 has joined #openstack-keystone | 18:44 | |
| *** ozialien10 has quit IRC | 18:44 | |
| *** tqtran has joined #openstack-keystone | 18:45 | |
| *** ozialien10 has joined #openstack-keystone | 18:45 | |
| *** julim has quit IRC | 18:46 | |
| *** dmellado has quit IRC | 18:47 | |
| *** spzala has quit IRC | 18:49 | |
| *** sdake has joined #openstack-keystone | 18:49 | |
| *** neophy has joined #openstack-keystone | 18:49 | |
| *** yolanda has quit IRC | 18:51 | |
| *** cloudnul- has joined #openstack-keystone | 18:55 | |
| *** roxanagh_ has quit IRC | 18:57 | |
| *** cloudnul- has quit IRC | 18:57 | |
| *** dan_nguyen has joined #openstack-keystone | 19:00 | |
| *** sdake_ has joined #openstack-keystone | 19:06 | |
| *** sdake has quit IRC | 19:07 | |
| *** rderose has quit IRC | 19:08 | |
| *** spandhe has joined #openstack-keystone | 19:08 | |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add sample file generation script https://review.openstack.org/314244 | 19:18 |
| *** dan_nguyen has quit IRC | 19:26 | |
| bknudson | amazingly no pitchforks about removal of keystone CLI yet. | 19:26 |
| *** diazjf1 has left #openstack-keystone | 19:27 | |
| *** dan_nguyen has joined #openstack-keystone | 19:31 | |
| *** navid_ has joined #openstack-keystone | 19:33 | |
| *** navidp has quit IRC | 19:36 | |
| stevemar | bknudson: no one noticed yet | 19:45 |
| stevemar | anyone want to punt https://review.openstack.org/#/c/309869/3 through? | 19:45 |
| patchbot | stevemar: patch 309869 - keystone - replace logging with oslo.log | 19:45 |
| *** tonytan4ever has joined #openstack-keystone | 19:49 | |
| lbragstad | morgan quick token caching question | 19:49 |
| lbragstad | morgan we cache both fernet and uuid tokens | 19:50 |
| morgan | lbragstad: ack | 19:50 |
| morgan | Yes | 19:50 |
| *** tonytan_brb has joined #openstack-keystone | 19:51 | |
| lbragstad | but do we only invalidate the token cache by using _invalidate_individual_token_cache() ? | 19:51 |
| morgan | Yes. | 19:51 |
| lbragstad | that method is only used keystone/token/persistence/core.py | 19:51 |
| morgan | That invalidatws the specific ID. | 19:51 |
| lbragstad | so do we never invalidate the token cache when a fernet token is revoked? | 19:51 |
| *** spzala has joined #openstack-keystone | 19:52 | |
| morgan | stevemar: done | 19:52 |
| morgan | lbragstad: hmm. | 19:52 |
| morgan | Fernet was not initially doing revoke by id | 19:52 |
| morgan | So we need to expand its use (that invalidate function) | 19:53 |
| morgan | The Rev event should catch the token cache though | 19:53 |
| morgan | Iirx | 19:53 |
| morgan | Iirc* | 19:53 |
| lbragstad | morgan i would think so because we have fernet tests in keystone that go through the password change scenario | 19:53 |
| *** jsavak has quit IRC | 19:54 | |
| morgan | So, we don't invalidate the cache, we rely on rev events. | 19:54 |
| morgan | With fernet. | 19:54 |
| lbragstad | morgan yes - I would assume that to be true | 19:54 |
| morgan | That's fine. | 19:54 |
| *** tonytan4ever has quit IRC | 19:54 | |
| morgan | This is because uuid uses a column in the db to determine revocation (rev list) | 19:54 |
| lbragstad | morgan so this is tested by fernet | 19:55 |
| lbragstad | https://github.com/openstack/keystone/blob/b155387cdd470a038387495cdcd082728cd645f9/keystone/tests/unit/test_v3_auth.py#L253-L263 | 19:55 |
| lbragstad | which means that it would *have* to be handled by revocation events | 19:56 |
| lbragstad | morgan we seem to still have an issue in the gate | 19:57 |
| *** spzala has quit IRC | 19:57 | |
| lbragstad | where a token is created, revoked and validated | 19:57 |
| lbragstad | and the validation succeeds | 19:57 |
| morgan | Hmm. | 19:58 |
| morgan | Weird. | 19:58 |
| lbragstad | but only everyone once in a while | 19:58 |
| lbragstad | so it's not consistent | 19:58 |
| morgan | Oh. Timing issue. | 19:58 |
| morgan | Boi | 19:58 |
| morgan | Boo* | 19:58 |
| lbragstad | so let's say we cross the threshold into a new second | 19:58 |
| lbragstad | and get a fernet token at 0.2 of that second | 19:59 |
| morgan | It's when you're in the same second. | 19:59 |
| lbragstad | the issued_at of that token will be X.0 because of the int(time.time()) thing fernet does | 19:59 |
| morgan | That the issue occurs I think | 19:59 |
| morgan | Yes | 19:59 |
| lbragstad | but when we issue the recovation event | 19:59 |
| morgan | Same issue. Doh. | 19:59 |
| lbragstad | if that rev event is stored in sql within the same second | 20:00 |
| lbragstad | it's going to truncate the subsecond precision | 20:00 |
| lbragstad | which means the revocation_event['issued_before' will also be X.0 | 20:00 |
| lbragstad | which is the exact same as the token_data['issued_at'] | 20:00 |
| lbragstad | but we protect ourself against that here - https://github.com/openstack/keystone/blob/master/keystone/models/revoke_model.py#L223 | 20:01 |
| lbragstad | which is why I'm starting to get super confused because we error on the side of invalidation in the event the revocation event and token issued_at time are in the same second | 20:01 |
| lbragstad | so - given that information.. how is it that we are still validating tokens if we err on the side of invalidation? | 20:03 |
| *** d34dh0r53 is now known as th3r34ld0n4ld7ru | 20:05 | |
| *** th3r34ld0n4ld7ru is now known as therealmajorhayd | 20:05 | |
| *** spzala has joined #openstack-keystone | 20:06 | |
| *** therealmajorhayd is now known as d34dh0r53 | 20:07 | |
| *** maxabidi has joined #openstack-keystone | 20:07 | |
| *** dan_nguyen has quit IRC | 20:08 | |
| *** spandhe has quit IRC | 20:11 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move identity.backends.sql model code to sql_model.py https://review.openstack.org/292611 | 20:13 |
| *** rderose has joined #openstack-keystone | 20:13 | |
| *** roxanagh_ has joined #openstack-keystone | 20:14 | |
| *** rcernin has quit IRC | 20:15 | |
| *** tonytan4ever has joined #openstack-keystone | 20:21 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move identity.backends.sql model code to sql_model.py https://review.openstack.org/292611 | 20:22 |
| *** tonytan_brb has quit IRC | 20:25 | |
| *** spzala has quit IRC | 20:38 | |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: (WIP) Honor ldap_filter on filtered user list https://review.openstack.org/312126 | 20:40 |
| edmondsw | rodrigods, you were right that the tests weren't working properly. I fixed a couple issues, but I'm stumped on the last one | 20:41 |
| edmondsw | rodrigods, the fix itself actually does work, I've verified it in manual testing, but I just can't get the UT right | 20:41 |
| rodrigods | edmondsw, hmm how so? | 20:42 |
| edmondsw | rodrigods, I pushed up my changes to the UT... if you have a minute, take a look and see if you can figure out what's going on | 20:42 |
| edmondsw | https://review.openstack.org/#/c/312126/ | 20:42 |
| patchbot | edmondsw: patch 312126 - keystone - (WIP) Honor ldap_filter on filtered user list | 20:42 |
| rodrigods | edmondsw, sure | 20:42 |
| edmondsw | tx | 20:43 |
| rodrigods | will do today, ok? | 20:43 |
| edmondsw | great | 20:43 |
| edmondsw | at this point I've got the UT trying 2 things... that if can see the user when it matches user_filter in conf, and that it can't when it does not | 20:43 |
| edmondsw | unfortunately the first of those isn't working (second is) | 20:44 |
| *** sdake has joined #openstack-keystone | 20:44 | |
| *** jsavak has joined #openstack-keystone | 20:45 | |
| edmondsw | rodrigods, I've verified that the 2nd of those 2 things works with my change and fails without it, addressing your earlier comment | 20:45 |
| edmondsw | but I have no idea why the first isn't passing | 20:45 |
| rodrigods | edmondsw, the second works without your change, at least for the unit tests | 20:46 |
| *** ksavich has joined #openstack-keystone | 20:46 | |
| edmondsw | rodrigods? | 20:46 |
| rodrigods | edmondsw, not exposing the user if the filter doesn't match, even using the name as hint | 20:46 |
| *** sdake_ has quit IRC | 20:47 | |
| rodrigods | edmondsw, here https://review.openstack.org/#/c/314055/ | 20:47 |
| patchbot | rodrigods: patch 314055 - keystone - DO NOT MERGE: test ldap_filters in user list | 20:47 |
| morgan | stevemar: i should have the details for midcycle tomorrow. Hanging at the Cisco office in Pasadena and bugging them :) | 20:47 |
| *** roxanagh_ has quit IRC | 20:48 | |
| dstanek | morgan: yay! | 20:48 |
| edmondsw | rodrigods... huh... it was working... I must have messed it up trying to get the first test working | 20:48 |
| morgan | dstanek: :) | 20:48 |
| dstanek | morgan: do we all get routers as a door prize? | 20:48 |
| edmondsw | rodrigods, or I'm losing my mind... ;) | 20:49 |
| rodrigods | you should all get a visa to visit Brazil | 20:49 |
| rodrigods | edmondsw, it doesn't work in your env, right? | 20:49 |
| edmondsw | rodrigods, yeah, it's messed up in mine as well | 20:49 |
| rodrigods | can you confirm that listing all users (without the name query) it works fine? | 20:50 |
| rodrigods | so the bug is *only* when you pass the name query | 20:50 |
| edmondsw | without the code fix, the UT fails on line 268. With the fix it fails on 255 | 20:50 |
| *** BjoernT has joined #openstack-keystone | 20:50 | |
| rodrigods | edmondsw, the first one should pass if the filter works or not | 20:52 |
| edmondsw | rodrigods, that actually makes more sense... | 20:52 |
| *** neophy has quit IRC | 20:53 | |
| edmondsw | oh, wait... we want that second check to fail without my code fix... I am losing my mind | 20:54 |
| edmondsw | rodrigods ^ | 20:54 |
| edmondsw | the point of adding the UT is for it to fail when the code is broken, which it is without the fix in the ldap driver | 20:54 |
| edmondsw | been a long day | 20:54 |
| rodrigods | edmondsw, the second must fail without your fix, exactly | 20:54 |
| rodrigods | and the first one should pass with or without it | 20:55 |
| edmondsw | and it does, so that's good | 20:55 |
| edmondsw | right | 20:55 |
| rodrigods | but... i wouldn't rely in the first one since you may be writing the filter wrong | 20:55 |
| rodrigods | let me check something here | 20:55 |
| *** mvk has joined #openstack-keystone | 20:57 | |
| rodrigods | ayoung, ping... there? could use some ldap expertise here | 20:58 |
| ayoung | Uh oh. rodrigods I'll see if I can find some | 20:58 |
| ayoung | rodrigods, to anser the question, yes, edmondsw is losing his mind. Completely gone. | 20:58 |
| rodrigods | so... we have this bug: https://bugs.launchpad.net/keystone/+bug/1577804 | 20:58 |
| openstack | Launchpad bug 1577804 in OpenStack Identity (keystone) "/v3/users?name=<name> bypasses user_filter for LDAP" [Undecided,In progress] - Assigned to Matthew Edmonds (edmondsw) | 20:59 |
| rodrigods | lol | 20:59 |
| edmondsw | tx ayoung :) | 20:59 |
| edmondsw | nice to have confirmation | 20:59 |
| rodrigods | ayoung, and we have this fix/test: https://review.openstack.org/#/c/312126/8 | 20:59 |
| patchbot | rodrigods: patch 312126 - keystone - (WIP) Honor ldap_filter on filtered user list | 20:59 |
| ayoung | edmondsw, is that version the one you are asking about, or still in your repo? | 21:00 |
| edmondsw | ayoung, that's it | 21:01 |
| edmondsw | ayoung rodrigods line 250... is "uid" supposed to be something else? | 21:01 |
| edmondsw | tried cn, didn't do any better | 21:01 |
| edmondsw | not sure what is being mocked in these tests for user id attribute | 21:02 |
| ayoung | edmondsw, no clue. I dumped all that info long ago...let me see if I can remember | 21:03 |
| rodrigods | dn=cn=40231843b1c547359f566d9102b5771e,ou=Users,cn=example,cn=com, attrs=[('objectClass', ['person', 'inetOrgPerson']), ('cn', ['40231843b1c547359f566d9102b5771e']), ('sn', ['REQ_ADMIN']), ('enabled', ['TRUE']), ('userPassword', ['password'])] | 21:04 |
| bknudson | I assume the tests use the defaults | 21:04 |
| ayoung | edmondsw, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/config.py#n632 | 21:04 |
| ayoung | 'user_id_attribute', default='cn', | 21:04 |
| ayoung | edmondsw, but.... | 21:05 |
| ayoung | that is not the same as the cn attribute for a user | 21:05 |
| ayoung | the dn is built from that attribute and the tree | 21:05 |
| edmondsw | yeah, it's using cn | 21:05 |
| * ayoung slowly remembering all this | 21:06 | |
| edmondsw | I dumped driver.user.id_attr and it was 'cn' | 21:06 |
| ayoung | edmondsw, this is some of the ugliest code in existence | 21:06 |
| ayoung | sort of | 21:06 |
| edmondsw | no kidding | 21:06 |
| rodrigods | edmondsw, http://paste.openstack.org/show/496508/ | 21:06 |
| edmondsw | I've spent 5x the time to fix the problem trying to get a UT to work | 21:06 |
| edmondsw | at least | 21:06 |
| rodrigods | now it fails on the last check | 21:06 |
| rodrigods | why? no clue | 21:07 |
| * rodrigods going insane too | 21:07 | |
| ayoung | rodrigods, edmondsw look at the code that builds a dn | 21:07 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/ldap/core.py#n1297 | 21:08 |
| ayoung | use that, pass in the id, get back the DN, and use that for the LDAP query | 21:08 |
| edmondsw | do I care about dn? shouldn't the user filter just match the part of the dn that I specify? | 21:09 |
| ayoung | edmondsw, nope | 21:09 |
| ayoung | edmondsw, DN is kindof an attributer but not really | 21:09 |
| ayoung | think of the DN as a string match that just happens to be built out of attributes | 21:09 |
| ayoung | they look the same, but they are not the same | 21:09 |
| rodrigods | so is there a change that we don't have a bug? | 21:09 |
| ayoung | rodrigods, its called "Replace LDAP identity backend with SSSD" | 21:10 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Database changes to support PCI-DSS https://review.openstack.org/314284 | 21:10 |
| rodrigods | lol | 21:10 |
| ayoung | its not a bug, its a feature | 21:10 |
| ayoung | http://barelybad.com/images/feature_bug01.jpg | 21:11 |
| edmondsw | rodrigods, I think what you did there was an invalid filter, so who knows what will happen there | 21:11 |
| ayoung | Note that out unit tests go through the wonderful FakeLDAP code, too, which essentially returns back what it was given, so, I think it will only match the full DN...I think | 21:12 |
| edmondsw | ayoung, so should we just put the fix in without a UT? | 21:12 |
| rderose | edtubill: started on the db changes for PCI-DSS: | 21:13 |
| rderose | https://review.openstack.org/#/c/314284/ | 21:13 |
| patchbot | rderose: patch 314284 - keystone - WIP - Database changes to support PCI-DSS | 21:13 |
| rodrigods | edmondsw, there is also https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap.py#L286 | 21:13 |
| rodrigods | seems that it isn't enforcing the ldap_filter too | 21:13 |
| edmondsw | rodrigods, actually I think that's intentional there | 21:13 |
| edmondsw | see ayoung's earlier comment about this being the worst code ever | 21:14 |
| edtubill | rderose: cool, I'll look at it later. | 21:15 |
| *** Guest56459 is now known as mfisch | 21:15 | |
| rderose | edtubill: sounds good | 21:15 |
| *** sheel has quit IRC | 21:15 | |
| *** mfisch is now known as Guest87085 | 21:15 | |
| rodrigods | edmondsw, lol | 21:16 |
| *** pauloewerton has quit IRC | 21:17 | |
| *** spandhe has joined #openstack-keystone | 21:17 | |
| rodrigods | edmondsw, see https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap.py#L377 | 21:17 |
| rodrigods | edmondsw, seems like the "group" code is correct | 21:18 |
| edmondsw | rodrigods what about L377? | 21:18 |
| edmondsw | yes, the group code is fine | 21:19 |
| rodrigods | edmondsw, the query format | 21:19 |
| edmondsw | rodrigods yes, the query format there is correct (and matches what I'm doing) | 21:19 |
| *** Guest87085 is now known as mfisch | 21:19 | |
| edmondsw | rodrigods you were missing parenthesis in what you tried | 21:19 |
| *** mfisch has quit IRC | 21:20 | |
| *** mfisch has joined #openstack-keystone | 21:20 | |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: Honor ldap_filter on filtered user list https://review.openstack.org/312126 | 21:23 |
| edmondsw | rodrigods, I just removed that part of the test... still better than it used to be | 21:23 |
| edmondsw | ayoung ^ | 21:23 |
| edmondsw | it now passes with my code fix, and this UT would fail without my code fix... done | 21:24 |
| rodrigods | edmondsw, suggestion: add another patch with a test where we try to list everything but we use the filters | 21:24 |
| rodrigods | the only test we have for it tries an invalid filter, so we have no idea if it actually works | 21:25 |
| edmondsw | rodrigods, I don't know how much we want to invest in this if this ldap driver is going to be replaced in newton | 21:25 |
| edmondsw | rodrigods, and I've exhausted the time I have to spend on this | 21:25 |
| edmondsw | (and then some) | 21:26 |
| rodrigods | edmondsw, but the tests will remain :) | 21:26 |
| rodrigods | but, fair enough | 21:26 |
| *** d0ugal has quit IRC | 21:26 | |
| edmondsw | rodrigods tx for your time | 21:26 |
| rodrigods | np :) it was fun | 21:27 |
| *** edmondsw has quit IRC | 21:29 | |
| *** gyee has quit IRC | 21:33 | |
| *** navid__ has joined #openstack-keystone | 21:37 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Database changes to support PCI-DSS https://review.openstack.org/314284 | 21:37 |
| *** navid_ has quit IRC | 21:38 | |
| *** browne has joined #openstack-keystone | 21:39 | |
| bknudson | this ironic change is surprising for stable: https://review.openstack.org/#/c/287134/ | 21:39 |
| patchbot | bknudson: patch 287134 - ironic (stable/liberty) - Use wsgi from oslo.service for Ironic API | 21:39 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Database changes to support PCI-DSS https://review.openstack.org/314284 | 21:40 |
| bknudson | oops, wrong channel | 21:40 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Database changes to support PCI-DSS https://review.openstack.org/314284 | 21:43 |
| *** slberger has left #openstack-keystone | 21:45 | |
| *** rderose has quit IRC | 21:47 | |
| *** spzala_ has joined #openstack-keystone | 21:56 | |
| *** jsavak has quit IRC | 21:57 | |
| *** catintheroof has quit IRC | 22:01 | |
| *** sdake has quit IRC | 22:02 | |
| *** roxanagh_ has joined #openstack-keystone | 22:05 | |
| *** tonytan4ever has quit IRC | 22:05 | |
| *** phalmos has quit IRC | 22:06 | |
| *** browne has quit IRC | 22:10 | |
| *** navid__ has quit IRC | 22:18 | |
| *** fangxu has quit IRC | 22:18 | |
| *** haplo37 has quit IRC | 22:22 | |
| *** dave-mccowan has quit IRC | 22:22 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:24 | |
| *** gordc has quit IRC | 22:25 | |
| *** edtubill has quit IRC | 22:29 | |
| *** ksavich has quit IRC | 22:30 | |
| *** rbridgeman_ has quit IRC | 22:33 | |
| *** jamielennox|away is now known as jamielennox | 22:35 | |
| *** julim has joined #openstack-keystone | 22:38 | |
| *** roxanagh_ has quit IRC | 22:39 | |
| *** BjoernT has quit IRC | 22:40 | |
| *** tonytan4ever has joined #openstack-keystone | 22:46 | |
| *** edtubill has joined #openstack-keystone | 22:47 | |
| *** tonytan4ever has quit IRC | 22:52 | |
| *** fangxu has joined #openstack-keystone | 22:55 | |
| *** edtubill has quit IRC | 22:58 | |
| *** fangxu has quit IRC | 22:58 | |
| *** ametts has quit IRC | 22:58 | |
| *** timcline has quit IRC | 23:04 | |
| *** julim has quit IRC | 23:08 | |
| *** spzala has joined #openstack-keystone | 23:08 | |
| *** spzala_ has quit IRC | 23:12 | |
| *** BjoernT has joined #openstack-keystone | 23:24 | |
| *** fangxu has joined #openstack-keystone | 23:26 | |
| *** BjoernT is now known as Bjoern_zZzZzZzZ | 23:30 | |
| *** chlong has joined #openstack-keystone | 23:33 | |
| *** Bjoern_zZzZzZzZ is now known as BjoernT | 23:33 | |
| *** BjoernT has quit IRC | 23:38 | |
| openstackgerrit | Merged openstack/keystone: Fixes incorrect deprecation warning for IdentityDriverV8 https://review.openstack.org/305301 | 23:38 |
| *** spandhe has quit IRC | 23:39 | |
| jamielennox | question for the group, if using oauth you pass a scoping project or domain it is ignored, however just based on the way v3 auth works it's legal | 23:45 |
| *** spzala has quit IRC | 23:45 | |
| *** spzala has joined #openstack-keystone | 23:46 | |
| jamielennox | should the auth plugin try to prevent people from passing project scope etc, or just be a regular plugin and the server ignores the additional data | 23:46 |
| *** richm has quit IRC | 23:47 | |
| *** spzala has quit IRC | 23:51 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/314333 | 23:56 |
| *** roxanagh_ has joined #openstack-keystone | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
