| *** rdo has joined #openstack-keystone | 00:07 | |
| *** edtubill has joined #openstack-keystone | 00:08 | |
| *** lhcheng_ has joined #openstack-keystone | 00:17 | |
| *** lhcheng has quit IRC | 00:17 | |
| *** spandhe has quit IRC | 00:22 | |
| *** doug-fish has quit IRC | 00:23 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Fix D202: No blank lines allowed after function docstring (PEP257) https://review.openstack.org/317102 | 00:23 |
|---|---|---|
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Fix D200: One-line docstring should fit on one line with quotes (PEP257) https://review.openstack.org/317103 | 00:23 |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Fix D105: Missing docstring in magic method (PEP257) https://review.openstack.org/317110 | 00:23 |
| openstackgerrit | Steve Martinelli proposed openstack/ldappool: make ldappool py3 compatible https://review.openstack.org/315728 | 00:25 |
| *** rbridgeman has quit IRC | 00:27 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Port test_v2 unit test to Python 3 https://review.openstack.org/312060 | 00:27 |
| *** sdake_ has joined #openstack-keystone | 00:27 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Port test_v3_auth unit test to Python 3 https://review.openstack.org/312061 | 00:27 |
| notmorgan | stevemar: we'll be pyldap'd up sooooon | 00:28 |
| stevemar | notmorgan: sorry i wasn't around today, i think i caught another cold (wtf) | 00:28 |
| *** slberger has left #openstack-keystone | 00:28 | |
| notmorgan | stevemar: dude | 00:29 |
| notmorgan | stevemar: how do you... no no i don't want to know | 00:29 |
| notmorgan | stevemar: in all seriousness, the Flu going around is brutal. a friend of mine ended up in teh hospital cause of it | 00:29 |
| notmorgan | stevemar: so take care of yourself. | 00:29 |
| stevemar | notmorgan: just happened last night, randomly | 00:30 |
| stevemar | slept a bit today | 00:30 |
| notmorgan | it seems people are "feeling better" then get hit with wave2 of the ick. | 00:30 |
| * notmorgan *knock on wood* has not gotten the ick this time around. | 00:30 | |
| *** sdake has quit IRC | 00:30 | |
| stevemar | notmorgan: so, we going to go with the switch-to-pyldap and drop python-ldap route? | 00:31 |
| stevemar | and release a 2.0.0? | 00:31 |
| *** spandhe has joined #openstack-keystone | 00:31 | |
| notmorgan | stevemar: yar | 00:34 |
| notmorgan | stevemar: that is my plan | 00:34 |
| stevemar | notmorgan: i just hope we don't end up busting other folks that use ldappool | 00:35 |
| notmorgan | major version bump. | 00:35 |
| notmorgan | i also am trying co-install to see what happens | 00:35 |
| notmorgan | it may be "ok" if you already have python-ldap installed | 00:36 |
| *** jamielennox|away is now known as jamielennox | 00:37 | |
| notmorgan | stevemar: it shouldn't break anyone | 00:38 |
| notmorgan | i'm thinking if we can do some hackery in setuptools to make it even friendlier | 00:38 |
| notmorgan | basically if "ldap" is installed just let it be. | 00:38 |
| notmorgan | but tbh we just can't know which package is installed | 00:39 |
| notmorgan | shore of a pip freeze | 00:39 |
| stevemar | lbragstad: look at https://review.openstack.org/#/c/312061/4 and it's previous patch | 00:40 |
| patchbot | stevemar: patch 312061 - keystone - Port test_v3_auth unit test to Python 3 | 00:40 |
| *** lhcheng_ has quit IRC | 00:41 | |
| stevemar | notmorgan: i guess an existing non-openstack product is using ldappool with python-ldap now... they upgrade, but it doesn't matter, cause only openstack bits use requirements.txt? | 00:42 |
| notmorgan | stevemar: uhm... | 00:42 |
| notmorgan | stevemar: nope. | 00:42 |
| notmorgan | stevemar: lots of things use requirements.txt | 00:42 |
| notmorgan | it's become kindof a standard now | 00:42 |
| stevemar | hmm yeah, just cause it didn't use it before | 00:43 |
| notmorgan | 094205 | 00:43 |
| notmorgan | cccccceviitgjdfbgjnbrfuccfnvcireitfkjecnfkin | 00:43 |
| notmorgan | cccccceviitgdtkndrbicfetueelvdludkdegfujefhd | 00:43 |
| notmorgan | cccccceviitgelgjchhbhibgigrllndbkvcvhkhunlec | 00:43 |
| notmorgan | damn it. | 00:43 |
| notmorgan | trying to remove this yubikey from the USB port :P | 00:43 |
| notmorgan | good thing this one isn't used for anything yet | 00:44 |
| *** agrebennikov has quit IRC | 00:45 | |
| *** chrisshattuck has quit IRC | 00:45 | |
| *** raddaoui has quit IRC | 00:47 | |
| stevemar | notmorgan: so if folks upgrade to 2.0.0, then it'll try to install pyldap too | 00:48 |
| notmorgan | stevemar: uhmm.. yes unless we do some magic | 00:48 |
| notmorgan | stevemar: which i think we can. | 00:48 |
| notmorgan | i'll work on that part soon | 00:48 |
| notmorgan | (soon[tm]) | 00:48 |
| stevemar | notmorgan: http://paste.openstack.org/show/497284/ | 00:50 |
| *** spandhe has quit IRC | 00:51 | |
| *** gyee has quit IRC | 00:52 | |
| *** EinstCrazy has joined #openstack-keystone | 00:54 | |
| *** rderose has joined #openstack-keystone | 01:04 | |
| *** lhcheng has joined #openstack-keystone | 01:05 | |
| *** ChanServ sets mode: +v lhcheng | 01:05 | |
| rderose | stevemar: regarding password_change_limit_per_day | 01:06 |
| rderose | stevemar: so we want to limit how many times a user can change their password in a day? | 01:06 |
| *** anush has joined #openstack-keystone | 01:07 | |
| *** lhcheng_ has joined #openstack-keystone | 01:08 | |
| *** lhcheng has quit IRC | 01:11 | |
| openstackgerrit | ayoung proposed openstack/keystone: Replace revoke tree with linear search https://review.openstack.org/311652 | 01:20 |
| ayoung | still a net reduction in code, but creeping up there | 01:20 |
| *** tmcpeak has quit IRC | 01:25 | |
| stevemar | rderose: yep, that was the intention | 01:25 |
| stevemar | rderose: also, side thought, i think a -1 value will make sense for most of the config options | 01:25 |
| *** anush has quit IRC | 01:26 | |
| *** edtubill has quit IRC | 01:29 | |
| *** dan_nguyen has quit IRC | 01:40 | |
| openstackgerrit | Merged openstack/keystone: Separate protocol schema https://review.openstack.org/308088 | 01:42 |
| *** rbridgeman has joined #openstack-keystone | 01:50 | |
| *** edtubill has joined #openstack-keystone | 01:52 | |
| *** rderose has quit IRC | 01:56 | |
| *** jamielennox is now known as jamielennox|away | 01:59 | |
| *** stevemar changes topic to "Keystone Midcycle Update: http://lists.openstack.org/pipermail/openstack-dev/2016-May/094574.html | Hosted By Cicso, July 20-22, 170 W Tasman Dr, San Jose, CA 95134" | 02:01 | |
| *** stevemar changes topic to "Newton Deadlines: http://releases.openstack.org/newton/schedule.html | Keystone Midcycle Update: http://lists.openstack.org/pipermail/openstack-dev/2016-May/094574.html | Hosted By Cicso, July 20-22, 170 W Tasman Dr, San Jose, CA 95134" | 02:01 | |
| *** richm has quit IRC | 02:12 | |
| *** stingaci has quit IRC | 02:28 | |
| *** rderose has joined #openstack-keystone | 02:35 | |
| *** fangxu has quit IRC | 02:36 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Support encryption of credentials in Keystone https://review.openstack.org/317169 | 02:38 |
| *** spandhe has joined #openstack-keystone | 02:41 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:46 | |
| openstackgerrit | wangxiyuan proposed openstack/python-keystoneclient: Allow send null value in extra properties https://review.openstack.org/296246 | 02:50 |
| *** stingaci has joined #openstack-keystone | 02:51 | |
| *** spandhe has quit IRC | 02:52 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/316170 | 02:57 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/317180 | 02:57 |
| *** woodster_ has quit IRC | 02:58 | |
| *** anush has joined #openstack-keystone | 03:00 | |
| *** stingaci has quit IRC | 03:01 | |
| *** stingaci has joined #openstack-keystone | 03:02 | |
| *** anush has quit IRC | 03:09 | |
| *** fawadkhaliq has quit IRC | 03:09 | |
| *** itlinux has quit IRC | 03:09 | |
| *** EinstCra_ has joined #openstack-keystone | 03:10 | |
| *** rderose has quit IRC | 03:10 | |
| *** EinstCrazy has quit IRC | 03:14 | |
| *** TxGVNN has joined #openstack-keystone | 03:20 | |
| *** wxy has joined #openstack-keystone | 03:21 | |
| *** links has joined #openstack-keystone | 03:31 | |
| *** sdake has joined #openstack-keystone | 03:36 | |
| *** itlinux has joined #openstack-keystone | 03:38 | |
| *** sdake_ has quit IRC | 03:38 | |
| *** itlinux has quit IRC | 03:39 | |
| *** stingaci has quit IRC | 03:39 | |
| openstackgerrit | javeme proposed openstack/keystone: Move validate_non_persistent_token() method from base to fernet https://review.openstack.org/317211 | 03:45 |
| *** darren-wang has quit IRC | 03:45 | |
| stevemar | dolphm: notmorgan bknudson releasing new stable versions of all things keystone this week | 03:54 |
| notmorgan | stevemar: hm ok | 03:54 |
| stevemar | notmorgan: against it? | 03:54 |
| notmorgan | nope | 03:54 |
| *** jamielennox|away is now known as jamielennox | 03:55 | |
| *** fawadkhaliq has joined #openstack-keystone | 03:56 | |
| openstackgerrit | Elvin Tubillara proposed openstack/keystone: Config changes to support PCI-DSS https://review.openstack.org/314679 | 04:02 |
| *** sheel has joined #openstack-keystone | 04:06 | |
| *** dan_nguyen has joined #openstack-keystone | 04:06 | |
| notmorgan | stevemar: now if only we could easily add u2f to Keystone :P it would be awesom. | 04:07 |
| notmorgan | stevemar: >.> | 04:07 |
| notmorgan | stevemar: mostly cause i am totally digging having my SSH key built into this hardware token (until it breaks) | 04:08 |
| stevemar | that FIFO spec, neat stuff eh | 04:08 |
| notmorgan | stevemar: yeah | 04:09 |
| notmorgan | it's kindof damn awesome | 04:10 |
| notmorgan | waaaaay slicker than the standard 2fa stuff. | 04:10 |
| *** sdake_ has joined #openstack-keystone | 04:19 | |
| *** sdake has quit IRC | 04:20 | |
| openstackgerrit | venkatamahesh proposed openstack/python-keystoneclient: Update the home-page with developer documentation https://review.openstack.org/317237 | 04:34 |
| *** dave-mccowan has quit IRC | 04:37 | |
| *** GB21 has joined #openstack-keystone | 04:56 | |
| *** sdake_ has quit IRC | 04:56 | |
| *** dan_nguyen has quit IRC | 04:59 | |
| *** rbridgeman_ has joined #openstack-keystone | 05:02 | |
| *** GB21 has quit IRC | 05:04 | |
| *** rbridgeman has quit IRC | 05:06 | |
| *** GB21 has joined #openstack-keystone | 05:09 | |
| *** GB21 has quit IRC | 05:31 | |
| *** roxanaghe has joined #openstack-keystone | 05:34 | |
| *** rbridgeman_ has quit IRC | 05:35 | |
| *** fangxu has joined #openstack-keystone | 05:37 | |
| *** roxanaghe has quit IRC | 05:39 | |
| *** fangxu has quit IRC | 05:41 | |
| *** fangxu has joined #openstack-keystone | 05:42 | |
| *** jaosorior has joined #openstack-keystone | 05:43 | |
| *** ramishra has quit IRC | 05:49 | |
| *** ramishra has joined #openstack-keystone | 05:50 | |
| *** josecastroleon has joined #openstack-keystone | 05:55 | |
| *** rcernin has joined #openstack-keystone | 06:03 | |
| *** henrynash has joined #openstack-keystone | 06:17 | |
| *** ChanServ sets mode: +v henrynash | 06:17 | |
| *** rcernin has quit IRC | 06:18 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone-specs: Service user permissions https://review.openstack.org/317266 | 06:20 |
| *** rcernin has joined #openstack-keystone | 06:21 | |
| openstackgerrit | Upama proposed openstack/keystone: Update requirements.txt to remove duplicate entry https://review.openstack.org/317267 | 06:21 |
| openstackgerrit | wangxiyuan proposed openstack/python-keystoneclient: Allow send null value in extra properties https://review.openstack.org/296246 | 06:28 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/317180 | 06:34 |
| *** jamielennox is now known as jamielennox|away | 06:41 | |
| *** belmoreira has joined #openstack-keystone | 06:53 | |
| *** jaosorior has quit IRC | 06:56 | |
| *** jaosorior has joined #openstack-keystone | 06:57 | |
| *** josecastroleon has quit IRC | 07:01 | |
| *** josecastroleon has joined #openstack-keystone | 07:04 | |
| *** ozialien10 has quit IRC | 07:07 | |
| *** spandhe has joined #openstack-keystone | 07:11 | |
| *** fawadkhaliq has quit IRC | 07:22 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:23 | |
| *** spandhe has quit IRC | 07:27 | |
| openstackgerrit | Pallavi proposed openstack/keystone: Added missed step to configure HTTPD https://review.openstack.org/317284 | 07:27 |
| *** lhcheng_ has quit IRC | 07:33 | |
| *** henrynash has quit IRC | 07:38 | |
| *** ninag has joined #openstack-keystone | 07:40 | |
| *** ninag has quit IRC | 07:44 | |
| *** ozialien10 has joined #openstack-keystone | 07:52 | |
| *** cloudpuppy has joined #openstack-keystone | 07:54 | |
| *** ozialien10 has quit IRC | 07:57 | |
| *** ozialien10 has joined #openstack-keystone | 07:58 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| openstackgerrit | Pallavi proposed openstack/keystone: Added missed step to configure HTTPD https://review.openstack.org/317284 | 08:05 |
| *** dmk0202 has joined #openstack-keystone | 08:12 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Fix D202: No blank lines allowed after function docstring (PEP257) https://review.openstack.org/317102 | 08:16 |
| *** Naresht has joined #openstack-keystone | 08:16 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Fix D200: One-line docstring should fit on one line with quotes (PEP257) https://review.openstack.org/317103 | 08:17 |
| openstackgerrit | Jack Ning proposed openstack/keystone: Added Cache to public id mapping https://review.openstack.org/317307 | 08:18 |
| *** jistr has joined #openstack-keystone | 08:19 | |
| Naresht | Hi all | 08:23 |
| Naresht | I am trying to do Keystone Google Federation | 08:24 |
| Naresht | I am following this link https://gist.github.com/stevemart/4b41bd5437048a7fdfab | 08:24 |
| Naresht | We struck at here http://paste.openstack.org/show/497292/ | 08:25 |
| Naresht | help me If any one tried before | 08:26 |
| openstackgerrit | Merged openstack/keystonemiddleware: Fix D105: Missing docstring in magic method (PEP257) https://review.openstack.org/317110 | 08:29 |
| *** pnavarro has joined #openstack-keystone | 08:30 | |
| *** mvk has joined #openstack-keystone | 08:33 | |
| *** fawadkhaliq has quit IRC | 08:41 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:42 | |
| openstackgerrit | Jack Ning proposed openstack/keystone: Added cache to public id mapping https://review.openstack.org/317307 | 08:42 |
| *** josecastroleon has quit IRC | 09:00 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Update the home-page with developer documentation https://review.openstack.org/317237 | 09:07 |
| *** josecastroleon has joined #openstack-keystone | 09:08 | |
| *** dmk0202 has quit IRC | 09:31 | |
| *** cloudpuppy has quit IRC | 09:32 | |
| *** cloudpuppy has joined #openstack-keystone | 09:32 | |
| *** zqfan has quit IRC | 09:33 | |
| *** cloudpuppy has quit IRC | 09:33 | |
| *** cloudpuppy has joined #openstack-keystone | 09:33 | |
| *** cloudpuppy has quit IRC | 09:34 | |
| *** cloudpuppy has joined #openstack-keystone | 09:34 | |
| *** dave-mccowan has joined #openstack-keystone | 09:35 | |
| *** mvk has quit IRC | 09:35 | |
| *** mvk has joined #openstack-keystone | 09:37 | |
| *** dobson has quit IRC | 09:56 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/316170 | 10:09 |
| *** jed56 has quit IRC | 10:09 | |
| *** EinstCra_ has quit IRC | 10:25 | |
| *** dobson has joined #openstack-keystone | 10:26 | |
| samueldmq | morning keystone | 10:40 |
| *** daemontool has quit IRC | 10:41 | |
| *** dobson has quit IRC | 10:43 | |
| *** daemontool has joined #openstack-keystone | 10:45 | |
| *** josecastroleon has quit IRC | 10:48 | |
| *** jamielennox|away is now known as jamielennox | 10:53 | |
| *** dobson has joined #openstack-keystone | 10:55 | |
| jamielennox | hey all, i just added the spec https://review.openstack.org/#/c/317266/ to the meeting agenda for anyone who wants a head start | 10:56 |
| patchbot | jamielennox: patch 317266 - keystone-specs - Service user permissions | 10:56 |
| jamielennox | night | 10:57 |
| *** fawadkhaliq has quit IRC | 10:59 | |
| *** josecastroleon has joined #openstack-keystone | 11:15 | |
| *** jistr has quit IRC | 11:24 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:30 | |
| *** fawadkhaliq has quit IRC | 11:30 | |
| *** gordc has joined #openstack-keystone | 11:36 | |
| *** jed56 has joined #openstack-keystone | 11:42 | |
| *** dave-mccowan has quit IRC | 11:47 | |
| *** vnogin has quit IRC | 11:47 | |
| *** amrith has joined #openstack-keystone | 11:49 | |
| *** dmk0202 has joined #openstack-keystone | 11:52 | |
| *** jistr has joined #openstack-keystone | 12:00 | |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/oslo.policy: doc: Fix wrong import statement in usage https://review.openstack.org/317413 | 12:01 |
| *** julim has joined #openstack-keystone | 12:05 | |
| *** rodrigods has quit IRC | 12:11 | |
| *** rodrigods has joined #openstack-keystone | 12:11 | |
| *** dave-mccowan has joined #openstack-keystone | 12:13 | |
| *** raildo-afk is now known as raildo | 12:15 | |
| *** ayoung has quit IRC | 12:23 | |
| *** EinstCrazy has joined #openstack-keystone | 12:45 | |
| *** sheel has quit IRC | 12:45 | |
| *** edmondsw has joined #openstack-keystone | 12:48 | |
| *** amrith is now known as _amrith_ | 13:00 | |
| *** pauloewerton has joined #openstack-keystone | 13:04 | |
| *** richm has joined #openstack-keystone | 13:04 | |
| *** doug-fish has joined #openstack-keystone | 13:06 | |
| *** ninag has joined #openstack-keystone | 13:06 | |
| *** pwgravel has joined #openstack-keystone | 13:14 | |
| *** lightshadow has joined #openstack-keystone | 13:21 | |
| *** rderose has joined #openstack-keystone | 13:23 | |
| *** BjoernT has joined #openstack-keystone | 13:27 | |
| *** BjoernT is now known as Bjoern_zZzZzZzZ | 13:27 | |
| knikolla | o/ | 13:29 |
| *** agrebennikov has joined #openstack-keystone | 13:32 | |
| *** openstackgerrit has quit IRC | 13:32 | |
| *** openstackgerrit has joined #openstack-keystone | 13:33 | |
| *** doug-fish has quit IRC | 13:33 | |
| *** links has quit IRC | 13:36 | |
| *** martinus__ has quit IRC | 13:39 | |
| *** phalmos has joined #openstack-keystone | 13:41 | |
| *** phalmos_ has joined #openstack-keystone | 13:42 | |
| *** Bjoern_zZzZzZzZ is now known as BjoernT | 13:44 | |
| *** sdake has joined #openstack-keystone | 13:44 | |
| *** phalmos has quit IRC | 13:46 | |
| *** martinus__ has joined #openstack-keystone | 13:46 | |
| *** sdake_ has joined #openstack-keystone | 13:48 | |
| *** sdake has quit IRC | 13:49 | |
| *** jaosorior has quit IRC | 13:52 | |
| *** phalmos_ has quit IRC | 13:53 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:54 | |
| *** doug-fish has joined #openstack-keystone | 13:54 | |
| *** pnavarro has quit IRC | 13:56 | |
| *** doug-fis_ has joined #openstack-keystone | 13:56 | |
| *** pushkaru has joined #openstack-keystone | 13:57 | |
| tristanC | '/win 9 | 13:58 |
| tristanC | oups :) | 13:58 |
| *** ametts has joined #openstack-keystone | 13:58 | |
| *** doug-fish has quit IRC | 13:59 | |
| *** ninag has quit IRC | 14:00 | |
| *** doug-fis_ has quit IRC | 14:01 | |
| *** ninag_ has joined #openstack-keystone | 14:03 | |
| *** med_ has joined #openstack-keystone | 14:04 | |
| *** med_ has quit IRC | 14:04 | |
| *** med_ has joined #openstack-keystone | 14:04 | |
| *** doug-fis_ has joined #openstack-keystone | 14:04 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/317483 | 14:04 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/317484 | 14:04 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/317485 | 14:04 |
| *** ninag_ has quit IRC | 14:06 | |
| *** ninag_ has joined #openstack-keystone | 14:06 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/317495 | 14:09 |
| *** daemontool has quit IRC | 14:09 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/317501 | 14:09 |
| *** ninag_ has quit IRC | 14:10 | |
| *** Naresht has quit IRC | 14:10 | |
| *** ninag has joined #openstack-keystone | 14:11 | |
| *** lightshadow has quit IRC | 14:14 | |
| *** tonytan4ever has joined #openstack-keystone | 14:14 | |
| *** ninag has quit IRC | 14:15 | |
| *** mou has joined #openstack-keystone | 14:24 | |
| *** edtubill has joined #openstack-keystone | 14:25 | |
| amakarov | jamielennox, hi! Are you here? | 14:27 |
| stevemar | thanks for the spec jamielennox | 14:28 |
| rderose | stevemar: check out my latest comments on this and lets chat when you have time #link https://review.openstack.org/#/c/317007/1 | 14:29 |
| patchbot | rderose: patch 317007 - keystone - WIP - PCI-DSS 8.2.4: User must change their passwo... | 14:29 |
| notmorgan | tristanC: hehe | 14:30 |
| notmorgan | tristanC: almost as good as my OTP failing | 14:30 |
| *** _amrith_ is now known as amrith | 14:32 | |
| *** markvoelker has joined #openstack-keystone | 14:35 | |
| *** markvoelker has quit IRC | 14:35 | |
| *** markvoelker has joined #openstack-keystone | 14:36 | |
| *** gagehugo has joined #openstack-keystone | 14:37 | |
| edtubill | rderose: I made a small comment on your patch. | 14:38 |
| *** markvoelker has quit IRC | 14:39 | |
| *** markvoelker has joined #openstack-keystone | 14:39 | |
| rderose | edtubill: yeah, looking at it now | 14:40 |
| rderose | edtubill: btw I don't think your function belongs here: keystone.common.utils | 14:41 |
| edtubill | rderose: is it because it's for mysql backends only? | 14:42 |
| rderose | edtubill: I think you should perhaps create a new PasswordValidator class or something | 14:42 |
| rderose | edtubill: exactly | 14:42 |
| stevemar | rderose: i jotted my thoughts down here: https://etherpad.openstack.org/p/keystone-newton-pci-dss line 115 | 14:43 |
| edtubill | rderose: would this class do only password strength validation or would it do more? | 14:43 |
| *** raddaoui has joined #openstack-keystone | 14:44 | |
| edtubill | stevemar: where would you picture this interface to be located? | 14:46 |
| *** chrisshattuck has joined #openstack-keystone | 14:47 | |
| rderose | edtubill: it could validate the password strength (regex) and also validate new passwords, e.g. validate(new_password1, new_password2) | 14:49 |
| rderose | edtubill: also validate password history rules e.g. validate(old_password, new_password) | 14:49 |
| rderose | edtubill, stevemar: reading your notes now, I'm not sure bundling everything into a single interface makes sense, but let me give it some thought | 14:50 |
| *** markvoelker has quit IRC | 14:51 | |
| stevemar | edtubill: it'll be in it's own package. the sql backend + interface + manager, just like the rest of our packages | 14:51 |
| stevemar | this will also allow folks to have their own implementation | 14:52 |
| stevemar | rather than helper functions everywhere | 14:52 |
| *** markvoelker has joined #openstack-keystone | 14:53 | |
| *** timcline has joined #openstack-keystone | 14:53 | |
| *** ninag has joined #openstack-keystone | 14:54 | |
| *** tmcpeak has joined #openstack-keystone | 14:55 | |
| *** tmcpeak has left #openstack-keystone | 14:55 | |
| *** dan_nguyen has joined #openstack-keystone | 14:57 | |
| rderose | stevemar, edtubill: added my comments to the etherpad. mostly agree... | 14:57 |
| *** markvoelker has quit IRC | 14:57 | |
| *** markvoelker has joined #openstack-keystone | 14:58 | |
| *** ninag has quit IRC | 15:02 | |
| *** ninag has joined #openstack-keystone | 15:03 | |
| *** markvoelker has quit IRC | 15:04 | |
| *** ninag has quit IRC | 15:05 | |
| *** ninag has joined #openstack-keystone | 15:05 | |
| *** tonytan4ever has quit IRC | 15:05 | |
| *** BjoernT has quit IRC | 15:05 | |
| *** sdake_ is now known as sdake | 15:06 | |
| *** ninag has quit IRC | 15:06 | |
| *** ninag has joined #openstack-keystone | 15:07 | |
| *** sheel has joined #openstack-keystone | 15:09 | |
| *** ninag has quit IRC | 15:11 | |
| *** diazjf has joined #openstack-keystone | 15:14 | |
| *** diazjf has quit IRC | 15:24 | |
| *** spandhe has joined #openstack-keystone | 15:25 | |
| *** diazjf has joined #openstack-keystone | 15:27 | |
| *** ayoung has joined #openstack-keystone | 15:28 | |
| *** ChanServ sets mode: +v ayoung | 15:28 | |
| *** belmoreira has quit IRC | 15:28 | |
| *** dmk0202 has quit IRC | 15:33 | |
| *** gyee has joined #openstack-keystone | 15:36 | |
| *** ChanServ sets mode: +v gyee | 15:36 | |
| *** jistr has quit IRC | 15:38 | |
| *** mvk has quit IRC | 15:39 | |
| *** fangxu has quit IRC | 15:39 | |
| *** anush has joined #openstack-keystone | 15:39 | |
| *** phalmos has joined #openstack-keystone | 15:49 | |
| *** lhcheng has joined #openstack-keystone | 15:50 | |
| *** ChanServ sets mode: +v lhcheng | 15:50 | |
| *** diazjf has quit IRC | 15:52 | |
| *** ninag has joined #openstack-keystone | 15:53 | |
| *** ninag has quit IRC | 15:55 | |
| *** ninag has joined #openstack-keystone | 15:55 | |
| *** rbridgeman has joined #openstack-keystone | 15:56 | |
| *** gokrokve has joined #openstack-keystone | 15:59 | |
| *** spandhe has quit IRC | 16:00 | |
| *** ChanServ sets mode: +o notmorgan | 16:08 | |
| *** notmorgan changes topic to "Newton Deadlines: http://releases.openstack.org/newton/schedule.html | Keystone Midcycle RSVP: http://goo.gl/forms/NfFMpJe6MSCXSNhr2 (Hosted By Cicso, July 20-22, 170 W Tasman Dr, San Jose, CA 95134)" | 16:10 | |
| *** notmorgan sets mode: -o notmorgan | 16:10 | |
| *** diazjf has joined #openstack-keystone | 16:11 | |
| notmorgan | stevemar, dolphm: shared the spreadsheet response for the RSVP with you | 16:14 |
| notmorgan | vvtletuvnjejhrbnhbcnbcefthvnngfenbbckvciciec | 16:14 |
| notmorgan | GDI. i need to fix that. | 16:14 |
| *** henrynash has joined #openstack-keystone | 16:14 | |
| *** ChanServ sets mode: +v henrynash | 16:14 | |
| henrynash | stevemar: ping | 16:14 |
| *** spandhe has joined #openstack-keystone | 16:16 | |
| notmorgan | stevemar: added info to the wiki for midcycle | 16:27 |
| *** doug-fis_ has quit IRC | 16:28 | |
| *** ninag has quit IRC | 16:28 | |
| *** ninag has joined #openstack-keystone | 16:29 | |
| *** ninag has quit IRC | 16:32 | |
| *** ninag has joined #openstack-keystone | 16:32 | |
| *** ninag has quit IRC | 16:32 | |
| openstackgerrit | Merged openstack/oslo.policy: doc: Fix wrong import statement in usage https://review.openstack.org/317413 | 16:33 |
| *** ninag has joined #openstack-keystone | 16:33 | |
| *** jbell8 has joined #openstack-keystone | 16:36 | |
| *** ninag has quit IRC | 16:37 | |
| *** doug-fish has joined #openstack-keystone | 16:41 | |
| *** fangxu has joined #openstack-keystone | 16:41 | |
| stevemar | henrynash: pong | 16:41 |
| *** phalmos has quit IRC | 16:41 | |
| *** roxanaghe has joined #openstack-keystone | 16:41 | |
| henrynash | stevemar: hi….wanted to get your view on my comment on https://review.openstack.org/#/c/311460/ | 16:42 |
| patchbot | henrynash: patch 311460 - python-openstackclient - Add assignment list to v2 identity and deprecate a... | 16:42 |
| henrynash | stevemar: this was in respone to your comment….as to whether we auto-extract the auth user/project from an token, or whether it has to be explict | 16:42 |
| *** diazjf has quit IRC | 16:43 | |
| stevemar | henrynash: ah, i like comment #2 you make | 16:43 |
| henrynash | stevemar: ok, to have a param option to cuase the extraction (e.g. —authuser or something)…. | 16:44 |
| stevemar | henrynash: let's see what dtroyer says... it's our chance to fix things up before we 3.0.0 | 16:44 |
| henrynash | stevemar: and we should then also support this for the v3 version of the call as well | 16:44 |
| stevemar | henrynash: listing things is awful right now for non-admin users | 16:44 |
| henrynash | stevemar: abso-bloody-lutely (as Helen Miren woudl say) | 16:45 |
| *** diazjf has joined #openstack-keystone | 16:46 | |
| openstackgerrit | Merged openstack/keystone: Drop the (unused) domain table https://review.openstack.org/316119 | 16:51 |
| *** diazjf has quit IRC | 16:52 | |
| *** fangxu has quit IRC | 16:53 | |
| *** fangxu has joined #openstack-keystone | 16:54 | |
| *** BjoernT has joined #openstack-keystone | 16:54 | |
| *** stingaci has joined #openstack-keystone | 16:56 | |
| *** stingaci has quit IRC | 16:56 | |
| *** stingaci has joined #openstack-keystone | 16:57 | |
| *** stingaci_ has joined #openstack-keystone | 16:59 | |
| *** spandhe has left #openstack-keystone | 16:59 | |
| *** gyee has quit IRC | 17:00 | |
| henrynash | ayoung, stevemar, dstanek, samueldmq: There’s another “driver version increase” patch that has been waiting a while, if you get a chance somtime to send it on it’s way (or comment) that would be great…at least one fix is dependant on it... | 17:01 |
| ayoung | henrynash, link? | 17:01 |
| henrynash | ayoung, stevemar, dstanek, samueldmq: https://review.openstack.org/#/c/305315/ | 17:01 |
| patchbot | henrynash: patch 305315 - keystone - Create V9 driver for identity backend | 17:01 |
| *** stingac__ has joined #openstack-keystone | 17:01 | |
| stevemar | henrynash: do we have this automated yet? :P | 17:01 |
| ayoung | henrynash, +602 -12...each line technical debt... | 17:02 |
| henrynash | stevemar: I don’t belive so….(and this one was a little different, due to the fact that we load it from multiple places)…. | 17:02 |
| henrynash | ayoung: yep! | 17:02 |
| *** stingaci has quit IRC | 17:03 | |
| henrynash | ayoung: well most of it is actually a copy of teh sql driver purely so we can test it, it isn’t part of the funcitonal code | 17:03 |
| stevemar | notmorgan: reqeuested access from my gmail accnt | 17:03 |
| *** doug-fish has quit IRC | 17:03 | |
| henrynash | ayoung (403 lines of it is the copy of the sql driver) | 17:03 |
| *** ninag has joined #openstack-keystone | 17:03 | |
| ayoung | henrynash, I saw that, an I really would like to burn it. With kerosene | 17:04 |
| *** stingaci_ has quit IRC | 17:04 | |
| *** doug-fish has joined #openstack-keystone | 17:04 | |
| ayoung | henrynash, does that really need to be there? What is the justification again? | 17:04 |
| *** ninag has quit IRC | 17:05 | |
| notmorgan | stevemar: ok | 17:05 |
| notmorgan | sec | 17:05 |
| *** ninag has joined #openstack-keystone | 17:06 | |
| notmorgan | stevemar: hmm. | 17:06 |
| notmorgan | stevemar: done | 17:06 |
| *** doug-fis_ has joined #openstack-keystone | 17:07 | |
| *** doug-fish has quit IRC | 17:08 | |
| *** gyee has joined #openstack-keystone | 17:08 | |
| *** ChanServ sets mode: +v gyee | 17:08 | |
| *** ninag_ has joined #openstack-keystone | 17:09 | |
| *** ninag has quit IRC | 17:10 | |
| *** ninag has joined #openstack-keystone | 17:10 | |
| *** doug-fis_ has quit IRC | 17:12 | |
| *** stingac__ has quit IRC | 17:12 | |
| *** doug-fish has joined #openstack-keystone | 17:13 | |
| *** ninag_ has quit IRC | 17:14 | |
| *** lhcheng_ has joined #openstack-keystone | 17:15 | |
| *** lhcheng_ has quit IRC | 17:15 | |
| *** stingaci has joined #openstack-keystone | 17:15 | |
| *** lhcheng_ has joined #openstack-keystone | 17:16 | |
| *** stingaci has quit IRC | 17:16 | |
| *** lhcheng_ has quit IRC | 17:16 | |
| *** stingaci has joined #openstack-keystone | 17:17 | |
| *** lhcheng_ has joined #openstack-keystone | 17:17 | |
| *** lhcheng has quit IRC | 17:18 | |
| *** phalmos has joined #openstack-keystone | 17:20 | |
| *** phalmos has quit IRC | 17:21 | |
| *** stingaci has quit IRC | 17:22 | |
| *** phalmos has joined #openstack-keystone | 17:22 | |
| *** stingaci has joined #openstack-keystone | 17:25 | |
| notmorgan | stevemar, crinkle: ldappool merging py3 compat, we need to run tests again now. (pyldap is merged) | 17:26 |
| stevemar | notmorgan: nice | 17:29 |
| notmorgan | stevemar: proposing a change for keystone too now, with a reno for moving to pyldap | 17:29 |
| *** jbell8 has quit IRC | 17:30 | |
| *** agrebennikov has quit IRC | 17:31 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Use PyLDAP instead of python-ldap https://review.openstack.org/317638 | 17:32 |
| stevemar | notmorgan: you could re-use https://review.openstack.org/#/c/311827/ if you want | 17:32 |
| patchbot | stevemar: patch 311827 - keystone - WIP: review at own risk: switch to pyldap | 17:32 |
| notmorgan | too late :P | 17:32 |
| notmorgan | i can swap to the old if if you'd prefer | 17:32 |
| stevemar | no no | 17:33 |
| notmorgan | i went with a *very* simple change | 17:33 |
| notmorgan | to show it was drop in | 17:33 |
| notmorgan | we should rebase that on the one i proposed and do the py3 fixes | 17:33 |
| notmorgan | once ldappool is released | 17:33 |
| *** stingaci_ has joined #openstack-keystone | 17:34 | |
| stevemar | notmorgan: i see, you want to do the swap first, then make things py3 compat | 17:34 |
| notmorgan | or | 17:34 |
| notmorgan | yeah | 17:34 |
| stevemar | notmorgan: also, white space at https://review.openstack.org/#/c/317638/1/setup.cfg | 17:35 |
| patchbot | stevemar: patch 317638 - keystone - Use PyLDAP instead of python-ldap | 17:35 |
| notmorgan | see my comment on your patch :P | 17:35 |
| stevemar | or not... | 17:35 |
| *** naresht has joined #openstack-keystone | 17:35 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Use PyLDAP instead of python-ldap https://review.openstack.org/317638 | 17:35 |
| *** tonytan4ever has joined #openstack-keystone | 17:35 | |
| notmorgan | whitespace fixed | 17:35 |
| *** timcline has quit IRC | 17:36 | |
| notmorgan | there we go | 17:36 |
| notmorgan | this way we can show drop-in replacement works and then fix py3 things in a clear way | 17:36 |
| notmorgan | :) | 17:36 |
| *** mdurrant has quit IRC | 17:37 | |
| *** ninag has quit IRC | 17:37 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP: review at own risk: switch to pyldap https://review.openstack.org/311827 | 17:37 |
| *** ninag has joined #openstack-keystone | 17:37 | |
| *** stingaci has quit IRC | 17:38 | |
| dolphm | stevemar: you're supposed to fill out the survey, not just type into the spreadsheet | 17:40 |
| stevemar | dolphm: whoaaa there's a survey | 17:40 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: enable ldap tests for py3 https://review.openstack.org/317644 | 17:40 |
| *** roxanaghe_ has joined #openstack-keystone | 17:41 | |
| *** roxanaghe has quit IRC | 17:41 | |
| stevemar | dolphm: done :) | 17:42 |
| *** stingaci has joined #openstack-keystone | 17:43 | |
| *** stingaci_ has quit IRC | 17:44 | |
| *** stingaci_ has joined #openstack-keystone | 17:44 | |
| *** timcline has joined #openstack-keystone | 17:46 | |
| *** jbell8 has joined #openstack-keystone | 17:47 | |
| *** stingaci has quit IRC | 17:48 | |
| *** diazjf has joined #openstack-keystone | 17:48 | |
| notmorgan | stevemar, dolphm, lbragstad: https://bugs.launchpad.net/ossa/+bug/1577558 please review impact statement for me | 17:49 |
| openstack | Launchpad bug 1577558 in OpenStack Security Advisory "v2.0 fernet tokens audit ids are inconsistent" [Undecided,Confirmed] | 17:49 |
| *** Alexander has joined #openstack-keystone | 17:52 | |
| *** Alexander is now known as Guest48550 | 17:52 | |
| *** jaugustine has joined #openstack-keystone | 17:53 | |
| *** amakarov has quit IRC | 17:53 | |
| *** Guest48550 is now known as amakarov | 17:54 | |
| *** alexander__ has joined #openstack-keystone | 17:54 | |
| lbragstad | notmorgan looks good to me | 17:56 |
| *** BjoernT has quit IRC | 17:56 | |
| *** TxGVNN has quit IRC | 17:56 | |
| henrynash | ayoung: so I’d love to not have that part….but how else would we reliably test whether our legacy interface was still supported? | 17:59 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/317483 | 18:00 |
| *** BjoernT has joined #openstack-keystone | 18:01 | |
| *** stingaci_ has quit IRC | 18:04 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/317495 | 18:05 |
| *** pushkaru has quit IRC | 18:11 | |
| *** stevemar changes topic to "Newton Deadlines: http://releases.openstack.org/newton/schedule.html | Keystone Midcycle RSVP: http://goo.gl/forms/NfFMpJe6MSCXSNhr2 (Hosted By Cicso, July 20-22, 170 W Tasman Dr, San Jose, CA 95134) | Keystone Midcycle wiki https://wiki.openstack.org/wiki/Sprints/KeystoneNewtonSprint" | 18:13 | |
| *** doug-fis_ has joined #openstack-keystone | 18:15 | |
| *** doug-fish has quit IRC | 18:18 | |
| *** pushkaru has joined #openstack-keystone | 18:20 | |
| *** roxanaghe has joined #openstack-keystone | 18:26 | |
| *** jbell8 has quit IRC | 18:27 | |
| *** roxanaghe__ has joined #openstack-keystone | 18:28 | |
| *** roxanaghe_ has quit IRC | 18:30 | |
| *** rcernin has quit IRC | 18:31 | |
| *** roxanaghe has quit IRC | 18:31 | |
| *** jbell8 has joined #openstack-keystone | 18:31 | |
| *** stingaci has joined #openstack-keystone | 18:34 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move identity.backends.sql model code to sql_model.py https://review.openstack.org/292611 | 18:44 |
| *** kevinbenton has quit IRC | 18:49 | |
| *** kevinbenton has joined #openstack-keystone | 18:50 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/317485 | 18:52 |
| amakarov | ayoung: a PoC from breton's intern about enforcing policy in keystone: https://review.openstack.org/#/c/317529/ | 18:53 |
| patchbot | amakarov: patch 317529 - keystone - Added app for policy enforcement | 18:53 |
| *** roxanaghe_ has joined #openstack-keystone | 18:54 | |
| ayoung | amakarov, nice | 18:54 |
| *** roxanaghe has joined #openstack-keystone | 18:56 | |
| *** roxanaghe__ has quit IRC | 18:57 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/317484 | 18:58 |
| *** roxanaghe_ has quit IRC | 18:59 | |
| *** diazjf has quit IRC | 18:59 | |
| gyee | jamielennox, can you please expend on certs can't be enforce globally? | 19:00 |
| jamielennox | we can get to the point that certs are the recommended deployment mechanism but people just won't set up the infrastructure | 19:00 |
| jamielennox | s/enforce/required | 19:00 |
| gyee | certs are a requirement in any production deployment | 19:00 |
| samueldmq | ayoung: you on patch 311652 ? | 19:01 |
| patchbot | samueldmq: https://review.openstack.org/#/c/311652/ - keystone - Replace revoke tree with linear search | 19:01 |
| *** amakarov has quit IRC | 19:01 | |
| jamielennox | gyee: https certs are, doing client cert enforcement is not | 19:01 |
| jamielennox | and the ca management that comes with it is a high bar for some people | 19:01 |
| ayoung | samueldmq, yeah | 19:01 |
| samueldmq | let's start a Certificate as a service then | 19:02 |
| gyee | why not, same mechanism for cert management | 19:02 |
| *** spandhe_ has joined #openstack-keystone | 19:02 | |
| gyee | its no different than, say fernet key management | 19:02 |
| samueldmq | ayoung: nice, wanted to get that in today so we can seee if it fixes the issue in the gates | 19:02 |
| samueldmq | ayoung: or if we still need to keep debugging | 19:02 |
| *** diazjf has joined #openstack-keystone | 19:03 | |
| samueldmq | gyee: just a big broader because it's for every endpoint | 19:03 |
| ayoung | samueldmq, hoping to keep that one as a new loss of lines... | 19:03 |
| samueldmq | gyee: while fernet is for keystone endpoints | 19:03 |
| jamielennox | barbican tried that and oh god the vendor extensions and crap to make a cert-aas | 19:04 |
| samueldmq | gyee: but I like the idea, just don't have xp with handling certs etc to say it's bad or not | 19:04 |
| samueldmq | gyee: but shouldn't be :/ | 19:04 |
| ayoung | anyone know a one liner to convert a python path into a file... change . to / in bash? | 19:05 |
| jamielennox | i'm sure it's doable, but even i'm not sure without some testing how you set up a public facing https endpoint with a global ca, but then also do optional client cert enforcement on an internal ca | 19:05 |
| ayoung | ah forget it | 19:05 |
| ayoung | not worth it | 19:05 |
| jamielennox | particularly if the endpoint you expose it haproxy or eventlet | 19:06 |
| gyee | jamielennox, I have a demo for enforcing cert authorization | 19:07 |
| *** doug-fis_ has quit IRC | 19:08 | |
| gyee | we can differentiate between SSL cert and certs used for authn/z | 19:08 |
| jamielennox | gyee: in what - apache? | 19:08 |
| gyee | both apache and haproxy | 19:08 |
| gyee | you can terminate SSL at either haproxy or apache | 19:08 |
| gyee | it works either way | 19:09 |
| *** iurygregory_ has joined #openstack-keystone | 19:09 | |
| jamielennox | yep, well for the eventlet based apis haproxy would have to be available or it's a non-starter | 19:09 |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/317501 | 19:09 |
| gyee | eventlet!? | 19:09 |
| gyee | I thought we are not recommending eventlet | 19:10 |
| jamielennox | gyee: n-api, g-api, c-api ... | 19:10 |
| jamielennox | you would need to do client cert enforcement at all those points to make certs work from service to service | 19:10 |
| gyee | sure, in production, they are fronted by haproxy or some 3rd party LB anyway | 19:11 |
| lbragstad | ayoung question: how familiar are you with dogtag? | 19:13 |
| *** sdake has quit IRC | 19:15 | |
| *** doug-fish has joined #openstack-keystone | 19:16 | |
| ayoung | lbragstad, I have many sets. | 19:16 |
| ayoung | Name SSN Religeon Blood Type | 19:16 |
| gyee | hahahah | 19:16 |
| ayoung | lbragstad, pretty familiar, and I know who to ask | 19:17 |
| gyee | ayoung, I enjoy your comics | 19:17 |
| lbragstad | ayoung favorite/preferred ammunition? | 19:17 |
| ayoung | lbragstad, we still talking dogtag, or Firearms? | 19:17 |
| lbragstad | ayoung i was wondering it it would be possible to use it to store fernet keys? | 19:17 |
| gyee | lbragstad, you are talking to a military guy | 19:17 |
| ayoung | lbragstad, ah...probably | 19:17 |
| *** BjoernT has quit IRC | 19:18 | |
| ayoung | lbragstad, Barbican backs to dogtag, and we have provisions in it to store keys | 19:18 |
| lbragstad | i have a spec up (proposed to backlog) to add different backends for fernet keys | 19:18 |
| ayoung | lbragstad, I don;t think that we need it, though. Why would you want to put them in Dogtag? | 19:18 |
| jamielennox | :q | 19:18 |
| ayoung | Or anything off site, for that matter? | 19:18 |
| jamielennox | bah | 19:18 |
| lbragstad | jamielennox :a! | 19:19 |
| lbragstad | jamielennox :qa! | 19:19 |
| ayoung | jamielennox, that should be :wq | 19:19 |
| gyee | :q! | 19:19 |
| ayoung | how do we failfast with tox run tests again? | 19:19 |
| lbragstad | ayoung we had a guy at the summit come ask us about alternative storage methods | 19:19 |
| lbragstad | after the fernet talk | 19:19 |
| ayoung | lbragstad, the real question is how to transport them for multisite | 19:20 |
| *** woodster_ has joined #openstack-keystone | 19:20 | |
| lbragstad | this specific user was interested in securing them | 19:20 |
| *** sdake has joined #openstack-keystone | 19:20 | |
| ayoung | that seems like it should bea PKCS12 or something | 19:20 |
| ayoung | Dogtag would not be proper for that unless it was for archival | 19:21 |
| lbragstad | gotcha | 19:21 |
| gyee | lbragstad, why not let Barbican manage the keys? | 19:22 |
| ayoung | lbragstad, the funny thing is, this is the one use case where Kite made sense | 19:22 |
| ayoung | gyee, not in this case | 19:22 |
| *** sdake has quit IRC | 19:22 | |
| gyee | why not? | 19:22 |
| ayoung | gyee, archival, yes | 19:22 |
| ayoung | rotation does not call for them being stored off site | 19:22 |
| gyee | not just that, I mean active key rotation | 19:22 |
| *** sdake has joined #openstack-keystone | 19:22 | |
| ayoung | gyee, I'll defer | 19:22 |
| bknudson | sorry I missed the meeting. Traveling. | 19:23 |
| ayoung | Ithink there is a chicken/egg issue with Barbican and Keystone Fernet keys | 19:23 |
| gyee | there is, we need to figure out a bootstrap issue | 19:23 |
| *** sdake has quit IRC | 19:23 | |
| gyee | same thing with Anchor and certmonger | 19:23 |
| gyee | we need the initial seed/account | 19:23 |
| lbragstad | could anchor be used to store keys? | 19:24 |
| *** BjoernT has joined #openstack-keystone | 19:25 | |
| gyee | anchor does not store keys | 19:25 |
| gyee | it only store public certs | 19:25 |
| lbragstad | ah | 19:25 |
| gyee | not even store, it was designed to discard the certs quickly | 19:25 |
| gyee | lbragstad, I think we need to look at Barbican | 19:25 |
| *** sdake has joined #openstack-keystone | 19:26 | |
| diazjf | gyee, hit me up if you need some info on storing the keys in barbican | 19:26 |
| gyee | once the initial key is provision, its just a matter of periodically polling barbican for new keys | 19:26 |
| *** iurygregory_ has quit IRC | 19:26 | |
| gyee | diazjf, thanks, I was think of a POC | 19:26 |
| gyee | s/think/thinking/ | 19:26 |
| diazjf | gyee, I'd be happy to help out I can bring it up in the next Barbican meeting on monday | 19:27 |
| gyee | diazjf, I think integrating with Barbican is the right solution | 19:27 |
| gyee | just need to test it out | 19:27 |
| diazjf | ayoung, gyee, etherpad? gyee, I agree is this for fernet tokens? | 19:27 |
| gyee | yes, fernet signing and encryption keys | 19:28 |
| gyee | diazjf, I don't have it in writing yet, just some brain farts | 19:29 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Add spec for fernet key store backends https://review.openstack.org/311268 | 19:29 |
| diazjf | gyee, no worries. Lets setup an etherpad and well talk more about it | 19:29 |
| *** comstud has joined #openstack-keystone | 19:31 | |
| *** sdake_ has joined #openstack-keystone | 19:32 | |
| *** sdake has quit IRC | 19:32 | |
| *** gyee has quit IRC | 19:33 | |
| *** rderose has quit IRC | 19:34 | |
| *** gokrokve has quit IRC | 19:36 | |
| lbragstad | notmorgan about the soft deletes | 19:36 |
| lbragstad | I was talking to a few people at the summit about that | 19:37 |
| notmorgan | lbragstad: so, i dislike "soft delete" if you have a "hard delete" option- either we maintain the records (indefinitely[fine with me]) or we don't | 19:37 |
| notmorgan | i don't like the "oh we'll let you 'prune | 19:37 |
| notmorgan | this later" | 19:37 |
| notmorgan | thats all | 19:38 |
| lbragstad | notmorgan I tried to capture some of the information here http://lbragstad.com/improving-auditing-in-keystone/ | 19:38 |
| notmorgan | for things in keystone.. tbh we should just not elminiate the records for the most part ( on users, projects, etc) | 19:38 |
| lbragstad | at the time I guess we were talking about it from an auditing angle | 19:38 |
| notmorgan | domains. | 19:38 |
| lbragstad | notmorgan so you believe in the soft delete option? | 19:38 |
| notmorgan | so, i wouldn't call it "soft delete" | 19:39 |
| notmorgan | it's not really a soft delete | 19:39 |
| notmorgan | it's how we mark something deleted. | 19:39 |
| notmorgan | is it "deleted" or "removed from the DB" | 19:39 |
| notmorgan | doesn't matter, it's semantics. | 19:39 |
| lbragstad | notmorgan isn't that a soft delete? | 19:39 |
| notmorgan | soft delete is like what nova does... with a prune late imo | 19:39 |
| notmorgan | later* | 19:40 |
| lbragstad | we just flip a bit in the db | 19:40 |
| lbragstad | delete = true | 19:40 |
| notmorgan | nope | 19:40 |
| notmorgan | use a timestamp | 19:40 |
| notmorgan | for PK reasons | 19:40 |
| notmorgan | deleted = 0, OR deleted="timestamp" | 19:40 |
| notmorgan | (unix time?) | 19:40 |
| lbragstad | deleted = 0 means it's not deleted, right? | 19:40 |
| notmorgan | right | 19:40 |
| jamielennox | why is this primary key reasons? | 19:41 |
| notmorgan | you need to do that and unique columns need to be changed to be (deleted + unique column) | 19:41 |
| notmorgan | pk/unique-keys | 19:41 |
| notmorgan | otherwise you can only ever have 1 deleted 1 active column | 19:41 |
| notmorgan | erm record with the duplicated unique column | 19:41 |
| notmorgan | not pk. | 19:42 |
| jamielennox | even unique, i agree with the timestamp for auditing but for most checks you want to say IS NOT NULL | 19:42 |
| notmorgan | you can't unique constrain on NULL in mysql | 19:42 |
| notmorgan | (NULL, ID) can be duplicated a ton of times | 19:42 |
| jamielennox | why do you want to unique constraint the timestamp? | 19:42 |
| notmorgan | (0, ID) cannot be duplicated | 19:42 |
| notmorgan | you use the timestamp to make the unique constraints for deleted not collide with subsequented deleted records | 19:43 |
| notmorgan | example project-name | 19:43 |
| notmorgan | otherwise you can't have multiple deleted records with the same project-name. | 19:44 |
| notmorgan | if the column is "active" and True or Null | 19:44 |
| notmorgan | then the active = Null would be deleted. allowing duplicated keys - but that doesn't work in PGSQL. | 19:44 |
| notmorgan | sooooo | 19:44 |
| notmorgan | short answer | 19:44 |
| jamielennox | but why have that unique constraint, your ids are unique and everything else is a query | 19:44 |
| notmorgan | project-names are unique with domain_id | 19:44 |
| notmorgan | right now | 19:44 |
| notmorgan | so if you make it "deleted" but don't change the unique constraint | 19:45 |
| notmorgan | to be domain_id, project_name, deleted | 19:45 |
| notmorgan | you can't duplicate project-names even if deleted | 19:45 |
| notmorgan | if deleted is "NULL" you aren't constraining project_name, domain_id anymore in mysql | 19:45 |
| jamielennox | oh, hmm | 19:45 |
| notmorgan | so if deleted = 0, it's active | 19:46 |
| notmorgan | if deleted=<unix_time_not_0> | 19:46 |
| notmorgan | you can have only one active, "0", and many deleted | 19:46 |
| notmorgan | since deletion is a unixtime | 19:46 |
| jamielennox | i see, that makes sense | 19:46 |
| * notmorgan is unsure why keystone opted for "remove record from DB" for deletes | 19:48 | |
| jamielennox | probably the same reason people flip out when we say there is no way to clean up shadow users - it really doesn't matter | 19:49 |
| jamielennox | but i'd be +2 on changing things like project and domain to never actually remove from db | 19:50 |
| lbragstad | so - if we were to do that we would add some bits to the keystone api to get all entities, including deleted ones | 19:50 |
| *** sdake_ has quit IRC | 19:53 | |
| lbragstad | notmorgan jamielennox would adding that ability remove the need for something like this - https://review.openstack.org/#/c/288643/ ? | 19:56 |
| patchbot | lbragstad: patch 288643 - keystone - Send notifications with entity name in payload | 19:56 |
| notmorgan | lbragstad: i think that helps, but it doesn't solve some fundamental issues with keystone and restoring things/better lifecycle management of resources | 19:57 |
| jamielennox | lbragstad: i'd think that would still be useful | 19:57 |
| *** agrebennikov has joined #openstack-keystone | 19:58 | |
| lbragstad | jamielennox notmorgan you mean enriching the notifications sent by keystone? | 19:58 |
| *** sdake has joined #openstack-keystone | 19:58 | |
| notmorgan | lbragstad: so we can enrich notificatons, but there is still real reasons to change what "deleting" means | 19:58 |
| notmorgan | we also don't create projects like nova creates vms :P | 19:58 |
| *** rcernin has joined #openstack-keystone | 19:58 | |
| notmorgan | or if we do... | 19:58 |
| notmorgan | different issue | 19:58 |
| lbragstad | jamielennox i discussed this a bit at the summit with some folks and tried to document it here http://lbragstad.com/improving-auditing-in-keystone/ | 19:59 |
| lbragstad | notmorgan what are the other reasons to change what delete means? | 19:59 |
| notmorgan | mostly for lifecycle management/restorability | 19:59 |
| jamielennox | lbragstad: i think for auditing and readability it's fine to add that info to the notification, i think most people are only consuming those and any additional info is useful | 19:59 |
| notmorgan | i don't have a good alternative | 19:59 |
| *** doug-fis_ has joined #openstack-keystone | 20:00 | |
| *** ninag has quit IRC | 20:01 | |
| * jamielennox is going to try and sleep for another hour or two | 20:01 | |
| lbragstad | so - if we change our database model to not delete things then the current notification system works | 20:01 |
| *** ninag has joined #openstack-keystone | 20:01 | |
| lbragstad | jamielennox o/ | 20:01 |
| *** doug-fi__ has joined #openstack-keystone | 20:03 | |
| *** doug-fish has quit IRC | 20:03 | |
| *** doug-fis_ has quit IRC | 20:04 | |
| *** ninag_ has joined #openstack-keystone | 20:04 | |
| *** ninag has quit IRC | 20:06 | |
| *** diazjf has quit IRC | 20:08 | |
| *** ninag_ has quit IRC | 20:09 | |
| *** anush has quit IRC | 20:11 | |
| *** anush has joined #openstack-keystone | 20:12 | |
| *** sheel has quit IRC | 20:15 | |
| *** ninag has joined #openstack-keystone | 20:15 | |
| *** doug-fish has joined #openstack-keystone | 20:16 | |
| *** ninag has quit IRC | 20:16 | |
| *** ninag has joined #openstack-keystone | 20:17 | |
| openstackgerrit | ayoung proposed openstack/keystone: Replace revoke tree with linear search https://review.openstack.org/311652 | 20:17 |
| *** ninag has quit IRC | 20:17 | |
| *** ninag has joined #openstack-keystone | 20:17 | |
| *** ninag has quit IRC | 20:18 | |
| *** doug-fi__ has quit IRC | 20:18 | |
| *** pwgravel has quit IRC | 20:26 | |
| *** rderose has joined #openstack-keystone | 20:27 | |
| *** dmk0202 has joined #openstack-keystone | 20:29 | |
| *** gyee has joined #openstack-keystone | 20:40 | |
| *** ChanServ sets mode: +v gyee | 20:40 | |
| *** diazjf has joined #openstack-keystone | 20:40 | |
| *** rcernin has quit IRC | 20:41 | |
| *** diazjf has quit IRC | 20:45 | |
| *** tonytan_brb has joined #openstack-keystone | 20:46 | |
| *** raildo is now known as raildo-afk | 20:47 | |
| amrith | stevemar, yt? | 20:49 |
| stevemar | amrith: o/ | 20:49 |
| *** tonytan4ever has quit IRC | 20:49 | |
| amrith | I'm making a mess of the change you submitted to Trove https://review.openstack.org/#/c/290971/2 | 20:49 |
| patchbot | amrith: patch 290971 - python-troveclient - WIP: switch to keystoneauth | 20:49 |
| amrith | wanted to have your thoughts on the hack job I'm doing. | 20:49 |
| amrith | :) | 20:49 |
| amrith | I hope that's what you had in mind (someone from trove pick it up and run with it) | 20:51 |
| amrith | if not, sorry for squishing your toes ... | 20:51 |
| *** ksatrimed has joined #openstack-keystone | 20:51 | |
| *** ksatrimed has quit IRC | 20:52 | |
| *** spandhe_ has quit IRC | 20:53 | |
| *** ninag has joined #openstack-keystone | 20:54 | |
| *** spandhe has joined #openstack-keystone | 20:54 | |
| *** chrisshattuck has quit IRC | 20:56 | |
| *** gagehugo has quit IRC | 20:56 | |
| *** ninag has quit IRC | 20:57 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/305487 | 20:58 |
| *** sdake_ has joined #openstack-keystone | 20:58 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/305487 | 20:59 |
| stevemar | amrith: makes me job easier! :) i'll comment in the review | 20:59 |
| *** diazjf has joined #openstack-keystone | 21:00 | |
| *** fangxu has quit IRC | 21:00 | |
| amrith | thx stevemar | 21:00 |
| *** sdake has quit IRC | 21:00 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/305487 | 21:01 |
| *** julim has quit IRC | 21:01 | |
| *** pushkaru has quit IRC | 21:07 | |
| * notmorgan finishes meetings and sighs with relief | 21:07 | |
| *** ninag has joined #openstack-keystone | 21:09 | |
| *** ninag has quit IRC | 21:09 | |
| *** dmk0202 has quit IRC | 21:10 | |
| stevemar | notmorgan: hey you signed up for it | 21:14 |
| * notmorgan signs stevemar up for meetings. | 21:14 | |
| stevemar | i got out of all my meetings | 21:14 |
| *** pauloewerton has quit IRC | 21:17 | |
| *** mou has quit IRC | 21:19 | |
| *** daemontool has joined #openstack-keystone | 21:20 | |
| *** doug-fis_ has joined #openstack-keystone | 21:22 | |
| *** doug-fish has quit IRC | 21:23 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Concrete role assignments for federated users https://review.openstack.org/284943 | 21:25 |
| *** tonytan_brb has quit IRC | 21:26 | |
| *** jamielennox is now known as jamielennox|away | 21:30 | |
| stevemar | mfisch: poke for https://review.openstack.org/#/c/315359/ | 21:33 |
| patchbot | stevemar: patch 315359 - keystonemiddleware - generate sample config automatically | 21:33 |
| *** ayoung has quit IRC | 21:33 | |
| *** haplo37 has joined #openstack-keystone | 21:37 | |
| notmorgan | stevemar: we have an issue with the requirements in ldapool | 21:38 |
| notmorgan | recheck wont solve it | 21:38 |
| *** jamielennox|away is now known as jamielennox | 21:39 | |
| *** doug-fish has joined #openstack-keystone | 21:40 | |
| *** ametts has quit IRC | 21:41 | |
| mfisch | stevemar: yay! | 21:41 |
| mfisch | go ahead and disenfranchise me in the project ;) | 21:42 |
| *** doug-fis_ has quit IRC | 21:42 | |
| *** edtubill has quit IRC | 21:44 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Support encryption of credentials in Keystone https://review.openstack.org/317169 | 21:44 |
| *** edmondsw has quit IRC | 21:45 | |
| *** spandhe_ has joined #openstack-keystone | 21:47 | |
| *** spandhe has quit IRC | 21:49 | |
| *** spandhe_ is now known as spandhe | 21:49 | |
| *** jbell8 has quit IRC | 21:49 | |
| notmorgan | mfisch: huh? | 21:50 |
| mfisch | notmorgan: I had a commit to fix some of those by hand, commit gets me a vote | 21:51 |
| mfisch | hence my poor joke | 21:51 |
| *** tqtran has joined #openstack-keystone | 21:52 | |
| openstackgerrit | Morgan Fainberg proposed openstack/ldappool: make ldappool py3 compatible https://review.openstack.org/315728 | 21:52 |
| notmorgan | mfisch: oh | 21:52 |
| *** ametts has joined #openstack-keystone | 21:54 | |
| *** sdake_ is now known as sdake | 21:54 | |
| *** diazjf has quit IRC | 21:57 | |
| *** jaugustine has quit IRC | 22:01 | |
| notmorgan | amrith: it's a hack job, but a required hack job ;) | 22:01 |
| *** daemontool has quit IRC | 22:03 | |
| *** ozialien10 has quit IRC | 22:04 | |
| *** ozialien10 has joined #openstack-keystone | 22:04 | |
| *** doug-fish has quit IRC | 22:06 | |
| *** ametts has quit IRC | 22:07 | |
| *** phalmos has quit IRC | 22:08 | |
| *** stingaci_ has joined #openstack-keystone | 22:08 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:08 | |
| *** stingaci has quit IRC | 22:11 | |
| *** markvoelker has joined #openstack-keystone | 22:14 | |
| *** ninag has joined #openstack-keystone | 22:17 | |
| *** jbell8 has joined #openstack-keystone | 22:17 | |
| *** ninag has quit IRC | 22:17 | |
| *** henrynash has quit IRC | 22:19 | |
| *** ninag_ has joined #openstack-keystone | 22:21 | |
| *** markvoelker has quit IRC | 22:21 | |
| *** markvoelker has joined #openstack-keystone | 22:22 | |
| *** ninag_ has quit IRC | 22:25 | |
| openstackgerrit | Merged openstack/keystone: Port test_v2 unit test to Python 3 https://review.openstack.org/312060 | 22:26 |
| openstackgerrit | Merged openstack/keystone: Move the oauth1 abstract base class out of core https://review.openstack.org/317045 | 22:26 |
| *** timcline has quit IRC | 22:27 | |
| *** doug-fish has joined #openstack-keystone | 22:32 | |
| *** BjoernT has quit IRC | 22:35 | |
| *** doug-fish has quit IRC | 22:36 | |
| *** doug-fish has joined #openstack-keystone | 22:39 | |
| *** rderose has quit IRC | 22:40 | |
| *** ninag has joined #openstack-keystone | 22:42 | |
| *** ayoung has joined #openstack-keystone | 22:42 | |
| *** ChanServ sets mode: +v ayoung | 22:42 | |
| *** doug-fish has quit IRC | 22:44 | |
| *** sdake_ has joined #openstack-keystone | 22:45 | |
| *** ninag has quit IRC | 22:46 | |
| *** sdake has quit IRC | 22:48 | |
| *** haplo37 has quit IRC | 22:49 | |
| *** jbell8 has quit IRC | 22:54 | |
| *** sdake_ has quit IRC | 22:54 | |
| *** jbell8 has joined #openstack-keystone | 22:56 | |
| *** doug-fish has joined #openstack-keystone | 22:59 | |
| *** lhcheng has joined #openstack-keystone | 23:00 | |
| *** ChanServ sets mode: +v lhcheng | 23:00 | |
| *** r-daneel has joined #openstack-keystone | 23:01 | |
| *** doug-fish has quit IRC | 23:03 | |
| *** lhcheng_ has quit IRC | 23:03 | |
| *** woodster_ has quit IRC | 23:08 | |
| *** gordc has quit IRC | 23:11 | |
| *** markvoelker has quit IRC | 23:12 | |
| stevemar | notmorgan: whats up with ldappool | 23:17 |
| *** roxanaghe has quit IRC | 23:17 | |
| notmorgan | ? | 23:17 |
| *** furface has joined #openstack-keystone | 23:19 | |
| stevemar | notmorgan: oh, i thought you meant something worse... nvm | 23:20 |
| stevemar | i see it now, the comment mismatch | 23:21 |
| notmorgan | nope | 23:21 |
| notmorgan | yah | 23:21 |
| *** sdake has joined #openstack-keystone | 23:24 | |
| notmorgan | stevemar: is there anything else we need for ldappool? | 23:30 |
| notmorgan | stevemar: because i'd like to do a release soon | 23:30 |
| stevemar | notmorgan: theres still: https://review.openstack.org/#/c/315728/ | 23:30 |
| patchbot | stevemar: patch 315728 - ldappool - make ldappool py3 compatible | 23:30 |
| notmorgan | cc crinkle ^ | 23:30 |
| stevemar | gah | 23:30 |
| stevemar | i meant https://review.openstack.org/#/c/315840/ | 23:30 |
| patchbot | stevemar: patch 315840 - ldappool - Raise an explicit BackendError on TLS failures | 23:30 |
| openstackgerrit | Merged openstack/ldappool: make ldappool py3 compatible https://review.openstack.org/315728 | 23:30 |
| notmorgan | besides python3 tests. | 23:30 |
| stevemar | and wut: https://review.openstack.org/#/c/316985/ | 23:31 |
| patchbot | stevemar: patch 316985 - ldappool - Updated from global requirements | 23:31 |
| notmorgan | stevemar: welcome to G-R | 23:31 |
| notmorgan | that one will conflict | 23:31 |
| notmorgan | https://review.openstack.org/#/c/317646/ needs to land too, but that is not us | 23:31 |
| patchbot | notmorgan: patch 317646 - openstack-infra/project-config - Add python3-testing to ldappool | 23:31 |
| * crinkle shrug | 23:32 | |
| notmorgan | stevemar: do we want to add tests? or just not really doable? | 23:33 |
| notmorgan | cause... i'll let it go if it's not really doable to test. | 23:33 |
| stevemar | notmorgan: not sure if it's all that do-able | 23:34 |
| notmorgan | if we do a release of ldappool, update g-r, and land pyldap thing for keystone i think we're at the point where we are within minor fixes of being py3 compat in keystone | 23:34 |
| stevemar | gerrit just slowed down | 23:34 |
| stevemar | notmorgan: i'm still concerned about folks using python-ldap and ldappool, and then updating | 23:35 |
| notmorgan | stevemar: it seemlessly upgrades | 23:35 |
| notmorgan | i tried it | 23:35 |
| notmorgan | zero issues | 23:35 |
| openstackgerrit | Steve Martinelli proposed openstack/ldappool: Updated from global requirements https://review.openstack.org/316985 | 23:35 |
| notmorgan | also remember, major version *and* no code in 3 yrs | 23:35 |
| notmorgan | on ldappool | 23:36 |
| stevemar | notmorgan: yeah | 23:36 |
| stevemar | upgrade at own risk :P | 23:36 |
| notmorgan | stevemar: i asked lifeless, there was no way to make them both work | 23:36 |
| stevemar | notmorgan: you've convinced me | 23:36 |
| stevemar | notmorgan: ah okay | 23:36 |
| stevemar | notmorgan: i tweaked https://review.openstack.org/#/c/316985/ - it should be OK now | 23:36 |
| patchbot | stevemar: patch 316985 - ldappool - Updated from global requirements | 23:36 |
| notmorgan | ok | 23:36 |
| lifeless | in debian you can say foo|bar, but the python dependency language doesn't allow that yet | 23:37 |
| notmorgan | and i'll +2 the TLS error thing | 23:37 |
| notmorgan | lifeless: i expect most distros will package this just fine and not run into issues | 23:37 |
| notmorgan | lifeless: and pip folks, it really "just works" from everything i tested | 23:37 |
| lifeless | notmorgan: upgrades worked? | 23:37 |
| notmorgan | lifeless: it's a fork and it just worked | 23:38 |
| stevemar | notmorgan: sounds good to me (re: tls) | 23:38 |
| notmorgan | stevemar: +2 on req updates *and* tls error | 23:38 |
| notmorgan | lifeless: it upgraded fine, pyldap has extra code to make it work well. | 23:38 |
| notmorgan | lifeless: it's a bit weird. but eh. couldn't break it | 23:39 |
| lifeless | notmorgan: good enough for me | 23:39 |
| openstackgerrit | Merged openstack/oslo.policy: Updated from global requirements https://review.openstack.org/317495 | 23:39 |
| stevemar | notmorgan: i think we're all good on the ldappool front | 23:39 |
| notmorgan | ayoung: https://review.openstack.org/#/c/317638/ (cc bknudson, dolphm, dstanek, lbragstad) | 23:39 |
| patchbot | notmorgan: patch 317638 - keystone - Use PyLDAP instead of python-ldap | 23:39 |
| notmorgan | gyee: ^ cc too | 23:39 |
| notmorgan | needs another +2 | 23:39 |
| notmorgan | stevemar: ok once those land i'll do a 2.0.0 release. | 23:40 |
| notmorgan | stevemar: and we'll update g-r. | 23:40 |
| notmorgan | stevemar: please update ldappool setup.cfg to include py3 | 23:41 |
| notmorgan | stevemar: before we release | 23:41 |
| notmorgan | stevemar: and add py34 | 23:41 |
| notmorgan | ? to tox ini? | 23:42 |
| notmorgan | stevemar: or do you want me to? | 23:42 |
| *** jbell8 has quit IRC | 23:43 | |
| openstackgerrit | Merged openstack/ldappool: Raise an explicit BackendError on TLS failures https://review.openstack.org/315840 | 23:43 |
| notmorgan | stevemar: can we also make uwsgi voting? | 23:44 |
| *** dan_nguyen has quit IRC | 23:47 | |
| openstackgerrit | Morgan Fainberg proposed openstack/ldappool: Add py3 info to setup.cfg https://review.openstack.org/317774 | 23:52 |
| *** EinstCrazy has quit IRC | 23:55 | |
| *** rderose has joined #openstack-keystone | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!