| jamielennox | clenimar: where in the token did project is_domain end up? | 00:02 |
|---|---|---|
| *** dan_nguyen has joined #openstack-keystone | 00:12 | |
| *** ninag has joined #openstack-keystone | 00:14 | |
| gyee | notmorgan, so we are going with pyldap instead of python3-ldap? | 00:16 |
| gyee | nice, just a drop in replacement | 00:17 |
| notmorgan | gyee: initally | 00:18 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the revoke abstract base class out of core https://review.openstack.org/317784 | 00:18 |
| gyee | notmorgan, gotcha, I still would like to use the python3-ldap discovery features to make life easier | 00:19 |
| gyee | eventually | 00:19 |
| notmorgan | gyee: the idea is pyldap gets us to py3 asap, ldap3 will be continued | 00:19 |
| notmorgan | gyee: and likely will be easier to work with long term | 00:19 |
| gyee | ++ | 00:19 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the revoke abstract base class out of core https://review.openstack.org/317784 | 00:20 |
| *** ninag has quit IRC | 00:21 | |
| openstackgerrit | Merged openstack/ldappool: Updated from global requirements https://review.openstack.org/316985 | 00:24 |
| *** lhcheng has quit IRC | 00:32 | |
| *** diazjf has joined #openstack-keystone | 00:33 | |
| *** tqtran has quit IRC | 00:45 | |
| stevemar | notmorgan: catching up... | 00:53 |
| openstackgerrit | Merged openstack/ldappool: Add py3 info to setup.cfg https://review.openstack.org/317774 | 00:55 |
| notmorgan | pushing 2.0.0 of ldappool | 00:57 |
| notmorgan | lets hope this goes "ok" | 00:57 |
| notmorgan | stevemar: pushed | 00:58 |
| notmorgan | 2.0.0 release of LDAPPool has been pushed. | 00:58 |
| stevemar | noiiiice | 00:59 |
| *** dan_nguyen has quit IRC | 00:59 | |
| notmorgan | stevemar: fyi all three of us can push tags for ldappool for now in case something is horked. | 00:59 |
| stevemar | hehe horked | 01:00 |
| stevemar | notmorgan: what about pypi https://pypi.python.org/pypi/ldappool ? still shows 1.0 | 01:00 |
| notmorgan | waiting for publish | 01:00 |
| stevemar | ah | 01:01 |
| *** diazjf1 has joined #openstack-keystone | 01:12 | |
| *** diazjf has quit IRC | 01:15 | |
| stevemar | gyee: if you want... https://review.openstack.org/#/c/315362/ :) | 01:17 |
| patchbot | stevemar: patch 315362 - keystonemiddleware - remove old options from documentation | 01:17 |
| stevemar | notmorgan: want to take a quick look at https://review.openstack.org/#/c/315359/ :) | 01:17 |
| patchbot | stevemar: patch 315359 - keystonemiddleware - generate sample config automatically | 01:18 |
| openstackgerrit | guang-yee proposed openstack/keystone: default_project_id is a domain should result in unscoped token https://review.openstack.org/317792 | 01:21 |
| *** EinstCrazy has joined #openstack-keystone | 01:21 | |
| notmorgan | gyee: ^ ? | 01:22 |
| notmorgan | dhellmann: do you want to (as the release person) take over release for ldappool? i'm happy to continue it once we get 2.0.0 out | 01:24 |
| notmorgan | dhellmann: but asking you in case you'd prefer that. | 01:24 |
| *** anush has quit IRC | 01:25 | |
| stevemar | notmorgan: dhellmann: i think it would be an independent release | 01:28 |
| notmorgan | stevemar: thats my thought, but figured i'd ask | 01:28 |
| notmorgan | stevemar: it wont ever be looking for inclusion in big tent | 01:28 |
| notmorgan | since it's just a dependant lib | 01:28 |
| notmorgan | but we lean on it pretty heavily | 01:28 |
| *** EinstCrazy has quit IRC | 01:33 | |
| *** iurygregory_ has joined #openstack-keystone | 01:35 | |
| *** EinstCrazy has joined #openstack-keystone | 01:37 | |
| *** EinstCrazy has quit IRC | 01:37 | |
| *** EinstCrazy has joined #openstack-keystone | 01:38 | |
| *** r-daneel has quit IRC | 01:42 | |
| ayoung | notmorgan, does that need a recheck? | 01:44 |
| notmorgan | ayoung: ? | 01:44 |
| ayoung | https://review.openstack.org/#/c/317638/ notmorgan got a -2 from Jenkins | 01:44 |
| ayoung | Wow, Jenkins got promoted | 01:44 |
| patchbot | ayoung: patch 317638 | 01:44 |
| ayoung | gate-tempest-dsvm-postgres-full failed, looks spurious to me | 01:45 |
| notmorgan | yeah a recheck | 01:45 |
| -openstackstatus- NOTICE: Gerrit is about to be restarted to help with page timeouts | 01:46 | |
| *** raddaoui has quit IRC | 01:47 | |
| *** lhcheng has joined #openstack-keystone | 01:47 | |
| *** ChanServ sets mode: +v lhcheng | 01:47 | |
| *** lhcheng has quit IRC | 01:47 | |
| ayoung | And Gerrit just choked | 01:48 |
| *** lhcheng has joined #openstack-keystone | 01:48 | |
| *** ChanServ sets mode: +v lhcheng | 01:48 | |
| ayoung | 503 on 443 | 01:48 |
| notmorgan | stevemar: oops i failed at tagging ldappool correctly :( | 01:48 |
| notmorgan | stevemar: doh | 01:48 |
| notmorgan | stevemar: missed some details | 01:48 |
| notmorgan | stevemar: next time. | 01:49 |
| notmorgan | it just wont send the announcement email | 01:49 |
| *** EinstCra_ has joined #openstack-keystone | 01:50 | |
| *** EinstCrazy has quit IRC | 01:50 | |
| *** EinstCra_ has quit IRC | 01:55 | |
| *** EinstCrazy has joined #openstack-keystone | 01:55 | |
| *** rderose has quit IRC | 01:56 | |
| *** EinstCra_ has joined #openstack-keystone | 01:57 | |
| *** EinstCrazy has quit IRC | 01:57 | |
| *** EinstCra_ has quit IRC | 01:58 | |
| *** EinstCrazy has joined #openstack-keystone | 01:58 | |
| *** EinstCrazy has quit IRC | 01:59 | |
| *** EinstCrazy has joined #openstack-keystone | 02:00 | |
| *** ninag has joined #openstack-keystone | 02:00 | |
| *** EinstCrazy has quit IRC | 02:05 | |
| *** EinstCrazy has joined #openstack-keystone | 02:05 | |
| *** ninag has quit IRC | 02:05 | |
| *** sdake has quit IRC | 02:06 | |
| *** sdake has joined #openstack-keystone | 02:12 | |
| *** EinstCrazy has quit IRC | 02:14 | |
| *** stingaci_ has quit IRC | 02:20 | |
| *** dan_nguyen has joined #openstack-keystone | 02:21 | |
| *** sdake has quit IRC | 02:22 | |
| *** EinstCrazy has joined #openstack-keystone | 02:24 | |
| *** EinstCra_ has joined #openstack-keystone | 02:31 | |
| *** rderose has joined #openstack-keystone | 02:33 | |
| *** EinstCrazy has quit IRC | 02:34 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/317483 | 02:35 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/ldappool: Updated from global requirements https://review.openstack.org/317806 | 02:35 |
| *** TxGVNN has joined #openstack-keystone | 02:36 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the revoke abstract base class out of core https://review.openstack.org/317784 | 02:38 |
| *** rderose has quit IRC | 02:39 | |
| *** diazjf1 has quit IRC | 02:40 | |
| openstackgerrit | Merged openstack/keystonemiddleware: generate sample config automatically https://review.openstack.org/315359 | 02:43 |
| *** dan_nguyen has left #openstack-keystone | 02:44 | |
| gyee | notmorgan, yeah, we need to straighten out project is domain stuff, especially for default_project_id | 02:46 |
| notmorgan | gyee: we should stop storing that data on the user object in keystone | 02:46 |
| openstackgerrit | Merged openstack/ldappool: Updated from global requirements https://review.openstack.org/317806 | 02:46 |
| notmorgan | gyee: it's the wrong place for it | 02:46 |
| gyee | I completely agree | 02:46 |
| gyee | but till then, we need to fix this bug | 02:46 |
| notmorgan | eh | 02:46 |
| notmorgan | do we? | 02:47 |
| notmorgan | i'd say just prevent them from setting it | 02:47 |
| notmorgan | don't let them set it and get a unscoped token | 02:47 |
| gyee | right now, right now if you set it to a domain ID, you can't log into horizon | 02:47 |
| notmorgan | prevent the setting in validation (400) altogether | 02:48 |
| notmorgan | you can't promote a project to a domain | 02:48 |
| notmorgan | so, make it a validation thing | 02:48 |
| gyee | oh! | 02:48 |
| notmorgan | not a "handle it when someone does something stupid" | 02:48 |
| *** spandhe has quit IRC | 02:48 | |
| gyee | but we need to update the spec too right? | 02:48 |
| notmorgan | possibly? | 02:48 |
| gyee | k, I can change it to validate at user update/creation | 02:49 |
| gyee | this bug was accidentally discovered by our QA :-) | 02:49 |
| gyee | she set it to a domain_id | 02:49 |
| notmorgan | yeah validate on setting the property | 02:50 |
| notmorgan | user create/update | 02:50 |
| notmorgan | raiding a 404 randomly like that is just wierd | 02:50 |
| notmorgan | raising* | 02:50 |
| gyee | k, let me update | 02:50 |
| notmorgan | this is def. a validate input deal instead :) | 02:50 |
| gyee | yeah, right now we don't validate default_project_id at all | 02:51 |
| notmorgan | and if this issue is in released code - we need to "fix" it (backported sql migration?) | 02:51 |
| gyee | two patches, one to fix input validation and the other to fix sql migration | 02:52 |
| notmorgan | sure | 02:52 |
| notmorgan | and make sure the SQL migration is backported/idempotent | 02:52 |
| notmorgan | to mitaka (spacer) if this is like i said a bug in mitaka too | 02:52 |
| gyee | k, I'll look into it | 02:53 |
| notmorgan | gyee: it should be straight forwrd. | 02:57 |
| notmorgan | gyee: if this hasn't been released as a bug - i'll just say don't bother with the migration | 02:57 |
| gyee | k | 02:58 |
| gyee | notmorgan, my only worry is would it break backward compat as there might be a case where default_project may not exist yet | 03:01 |
| notmorgan | gyee: no, you misread what i said | 03:01 |
| notmorgan | gyee: if it's a domain, fail validation | 03:01 |
| notmorgan | don;t change anything else | 03:01 |
| notmorgan | that isn't incompat. | 03:01 |
| gyee | k, k, gotcha | 03:01 |
| notmorgan | because it's an ID that isn't valid | 03:02 |
| notmorgan | though honestly, we should add validation there... yay microversions | 03:02 |
| notmorgan | or some such | 03:02 |
| *** lhcheng has quit IRC | 03:05 | |
| *** raddaoui has joined #openstack-keystone | 03:06 | |
| *** sdake has joined #openstack-keystone | 03:09 | |
| *** lhcheng has joined #openstack-keystone | 03:10 | |
| *** ChanServ sets mode: +v lhcheng | 03:10 | |
| *** lhcheng has quit IRC | 03:10 | |
| *** stingaci has joined #openstack-keystone | 03:11 | |
| *** lhcheng has joined #openstack-keystone | 03:11 | |
| *** ChanServ sets mode: +v lhcheng | 03:11 | |
| stevemar | notmorgan: gyee another trivial patch: https://review.openstack.org/#/c/315362/ | 03:12 |
| patchbot | stevemar: patch 315362 - keystonemiddleware - remove old options from documentation | 03:12 |
| * stevemar wants to reduce the amount of open patches he has | 03:12 | |
| *** agrebennikov has quit IRC | 03:12 | |
| *** lhcheng has quit IRC | 03:14 | |
| *** stingaci has quit IRC | 03:18 | |
| openstackgerrit | guang-yee proposed openstack/keystone: make sure default_project_id is not domain on user creation and update https://review.openstack.org/317792 | 03:19 |
| gyee | miller time | 03:20 |
| gyee | ah I mean dinner time | 03:20 |
| *** gyee has quit IRC | 03:20 | |
| *** links has joined #openstack-keystone | 03:26 | |
| notmorgan | stevemar: hehe | 03:27 |
| notmorgan | stevemar: i'll do another review madness day soon | 03:27 |
| *** dave-mccowan has quit IRC | 03:32 | |
| *** sdake_ has joined #openstack-keystone | 03:37 | |
| *** sdake has quit IRC | 03:40 | |
| notmorgan | stevemar: +3 | 03:44 |
| *** richm has quit IRC | 03:47 | |
| *** lhcheng has joined #openstack-keystone | 03:47 | |
| *** ChanServ sets mode: +v lhcheng | 03:47 | |
| *** anush has joined #openstack-keystone | 03:48 | |
| stevemar | notmorgan: woo hoo | 03:55 |
| *** sdake_ has quit IRC | 03:58 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: reorganize mitaka release notes https://review.openstack.org/316342 | 03:58 |
| *** anush has quit IRC | 04:05 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: reorganize mitaka release notes https://review.openstack.org/316342 | 04:07 |
| *** sdake has joined #openstack-keystone | 04:09 | |
| notmorgan | stevemar: i read that as "randomize ..." | 04:15 |
| notmorgan | stevemar: i was like "uhhhhhhh really?!" | 04:15 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Fix config path for running wsgi in developer mode https://review.openstack.org/317825 | 04:21 |
| *** edtubill has joined #openstack-keystone | 04:27 | |
| openstackgerrit | Merged openstack/keystonemiddleware: remove old options from documentation https://review.openstack.org/315362 | 04:34 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Fix config path for running wsgi in developer mode https://review.openstack.org/317825 | 04:42 |
| *** samueldmq has quit IRC | 04:43 | |
| *** ksavich has quit IRC | 04:44 | |
| *** samueldmq has joined #openstack-keystone | 04:46 | |
| stevemar | notmorgan: hehe | 04:51 |
| *** TxGVNN has quit IRC | 04:57 | |
| *** fawadkhaliq has joined #openstack-keystone | 04:57 | |
| *** rbridgeman has quit IRC | 05:00 | |
| *** furface has quit IRC | 05:00 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/305487 | 05:01 |
| *** edtubill has quit IRC | 05:02 | |
| *** ktychkova has joined #openstack-keystone | 05:07 | |
| *** EinstCra_ has quit IRC | 05:08 | |
| *** lupine_ has joined #openstack-keystone | 05:08 | |
| *** EinstCrazy has joined #openstack-keystone | 05:11 | |
| *** EinstCra_ has joined #openstack-keystone | 05:12 | |
| *** links has quit IRC | 05:12 | |
| *** lupine has quit IRC | 05:12 | |
| *** ericksonsantos has quit IRC | 05:12 | |
| *** ktychkova_ has quit IRC | 05:12 | |
| *** ericksonsantos has joined #openstack-keystone | 05:13 | |
| *** links has joined #openstack-keystone | 05:13 | |
| *** EinstCrazy has quit IRC | 05:15 | |
| *** edtubill has joined #openstack-keystone | 05:17 | |
| *** iurygregory_ has quit IRC | 05:20 | |
| *** edtubill has quit IRC | 05:21 | |
| *** edtubill has joined #openstack-keystone | 05:22 | |
| notmorgan | stevemar: are you open to the v3/auth -> /auth spec this cycle? | 05:23 |
| *** sdake has quit IRC | 05:26 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add wrapper classes for return-request-id-to-caller https://review.openstack.org/261188 | 05:32 |
| *** amrith is now known as _amrith_ | 05:34 | |
| *** lhcheng has quit IRC | 05:40 | |
| *** rcernin has joined #openstack-keystone | 05:47 | |
| *** furface has joined #openstack-keystone | 05:56 | |
| *** henrynash has joined #openstack-keystone | 06:02 | |
| *** ChanServ sets mode: +v henrynash | 06:02 | |
| *** david-lyle has quit IRC | 06:05 | |
| *** jrist has quit IRC | 06:07 | |
| *** jbell8 has joined #openstack-keystone | 06:08 | |
| *** _amrith_ is now known as amrith | 06:09 | |
| *** jbell8 has quit IRC | 06:12 | |
| *** jbell8 has joined #openstack-keystone | 06:12 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v2_0) https://review.openstack.org/267449 | 06:17 |
| naresht | Hi a;; | 06:20 |
| naresht | all* | 06:20 |
| naresht | Did anyone tried Keystone Google Federation | 06:20 |
| naresht | I struct at here http://paste.openstack.org/show/497443/ | 06:20 |
| naresht | Any help is highly appreciated. | 06:20 |
| naresht | error is "could not retrieve metadata from url: https://accounts.google.com/.well-known/openid-configuration" | 06:20 |
| *** EinstCrazy has joined #openstack-keystone | 06:21 | |
| *** jrist has joined #openstack-keystone | 06:22 | |
| *** jrist has quit IRC | 06:22 | |
| *** jrist has joined #openstack-keystone | 06:22 | |
| *** edtubill has quit IRC | 06:22 | |
| *** edtubill has joined #openstack-keystone | 06:25 | |
| *** EinstCra_ has quit IRC | 06:25 | |
| *** edtubill has quit IRC | 06:30 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3) https://review.openstack.org/267456 | 06:30 |
| openstackgerrit | Ryosuke Mizuno proposed openstack/keystone: Add the validation rules when create token https://review.openstack.org/315894 | 06:36 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use PyLDAP instead of python-ldap https://review.openstack.org/317638 | 06:38 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: enable ldap tests for py3 https://review.openstack.org/317644 | 06:40 |
| *** rcernin has quit IRC | 06:47 | |
| *** _cjones_ has joined #openstack-keystone | 06:49 | |
| *** _cjones_ has quit IRC | 06:50 | |
| *** ozialien10 has quit IRC | 06:50 | |
| *** rcernin has joined #openstack-keystone | 06:51 | |
| *** belmoreira has joined #openstack-keystone | 07:01 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3/contrib) https://review.openstack.org/268003 | 07:26 |
| *** jbell8 has quit IRC | 07:30 | |
| *** dmk0202 has joined #openstack-keystone | 07:35 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add release notes for return-request-id-to-caller https://review.openstack.org/276644 | 07:47 |
| *** fawadkhaliq has quit IRC | 07:52 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:52 | |
| *** jistr has joined #openstack-keystone | 07:54 | |
| *** daemontool has joined #openstack-keystone | 07:55 | |
| *** david-lyle has joined #openstack-keystone | 07:57 | |
| *** fawadkhaliq has quit IRC | 07:58 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:58 | |
| *** fawadkhaliq has quit IRC | 07:58 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:59 | |
| *** fawadkhaliq has quit IRC | 07:59 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:00 | |
| *** fawadkhaliq has quit IRC | 08:00 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:01 | |
| *** zzzeek has joined #openstack-keystone | 08:01 | |
| *** fawadkhaliq has quit IRC | 08:01 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:01 | |
| *** fawadkhaliq has quit IRC | 08:02 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:02 | |
| *** fawadkhaliq has quit IRC | 08:02 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:03 | |
| *** fawadkhaliq has quit IRC | 08:03 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:04 | |
| *** fawadkhaliq has quit IRC | 08:04 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:05 | |
| *** fawadkhaliq has quit IRC | 08:05 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:06 | |
| *** fawadkhaliq has quit IRC | 08:06 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:06 | |
| *** fawadkhaliq has quit IRC | 08:07 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:08 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: Let OidcPassword accept scope parameters as kwargs https://review.openstack.org/317895 | 08:20 |
| *** henrynash_ has joined #openstack-keystone | 08:40 | |
| *** ChanServ sets mode: +v henrynash_ | 08:40 | |
| *** auggy_ has joined #openstack-keystone | 08:42 | |
| *** raddaoui_ has joined #openstack-keystone | 08:43 | |
| *** jraim_ has joined #openstack-keystone | 08:44 | |
| *** eglute_s has joined #openstack-keystone | 08:44 | |
| *** bapalm_ has joined #openstack-keystone | 08:44 | |
| *** lbragstad_ has joined #openstack-keystone | 08:44 | |
| *** hockeynut_afk has joined #openstack-keystone | 08:45 | |
| *** lupine has joined #openstack-keystone | 08:45 | |
| *** mhu1 has joined #openstack-keystone | 08:45 | |
| *** breton_ has joined #openstack-keystone | 08:45 | |
| *** furface has quit IRC | 08:45 | |
| *** auggy has quit IRC | 08:45 | |
| *** wasmum has quit IRC | 08:45 | |
| *** sigmavirus24_awa has quit IRC | 08:45 | |
| *** hockeynut has quit IRC | 08:45 | |
| *** mhu has quit IRC | 08:45 | |
| *** d34dh0r53 has quit IRC | 08:45 | |
| *** jraim has quit IRC | 08:45 | |
| *** med_ has quit IRC | 08:45 | |
| *** tpeoples has quit IRC | 08:45 | |
| *** BrAsS_mOnKeY has quit IRC | 08:45 | |
| *** bapalm has quit IRC | 08:45 | |
| *** cloudnull has quit IRC | 08:45 | |
| *** henrynash has quit IRC | 08:45 | |
| *** lupine_ has quit IRC | 08:45 | |
| *** raddaoui has quit IRC | 08:45 | |
| *** ramishra has quit IRC | 08:45 | |
| *** harbor2 has quit IRC | 08:45 | |
| *** odyssey4me has quit IRC | 08:45 | |
| *** briancurtin has quit IRC | 08:45 | |
| *** yarkot1 has quit IRC | 08:45 | |
| *** david_cu has quit IRC | 08:45 | |
| *** Kimmo_ has quit IRC | 08:45 | |
| *** eglute has quit IRC | 08:45 | |
| *** mgagne has quit IRC | 08:45 | |
| *** breton has quit IRC | 08:45 | |
| *** Nakato has quit IRC | 08:45 | |
| *** lbragstad has quit IRC | 08:45 | |
| *** evrardjp has quit IRC | 08:45 | |
| *** jamielennox has quit IRC | 08:45 | |
| *** vkmc has quit IRC | 08:45 | |
| *** Nakato has joined #openstack-keystone | 08:45 | |
| *** furface has joined #openstack-keystone | 08:45 | |
| *** med_ has joined #openstack-keystone | 08:45 | |
| *** d34dh0r53 has joined #openstack-keystone | 08:45 | |
| *** mgagne has joined #openstack-keystone | 08:45 | |
| *** vkmc has joined #openstack-keystone | 08:45 | |
| *** ramishra has joined #openstack-keystone | 08:45 | |
| *** ramishra has quit IRC | 08:45 | |
| *** mhu1 is now known as mhu | 08:45 | |
| *** med_ has quit IRC | 08:45 | |
| *** med_ has joined #openstack-keystone | 08:45 | |
| *** auggy_ is now known as auggy | 08:45 | |
| *** BrAsS_mO- has joined #openstack-keystone | 08:45 | |
| *** vkmc has quit IRC | 08:45 | |
| *** vkmc has joined #openstack-keystone | 08:45 | |
| *** yarkot1 has joined #openstack-keystone | 08:46 | |
| *** mgagne is now known as Guest92292 | 08:46 | |
| *** furface has quit IRC | 08:46 | |
| *** furface has joined #openstack-keystone | 08:46 | |
| *** BrAsS_mO- has quit IRC | 08:46 | |
| *** BrAsS_mO- has joined #openstack-keystone | 08:46 | |
| *** odyssey4me has joined #openstack-keystone | 08:46 | |
| *** henrynash_ is now known as henrynash | 08:46 | |
| *** sigmavirus24_awa has joined #openstack-keystone | 08:46 | |
| *** raddaoui_ is now known as raddaoui | 08:46 | |
| *** evrardjp has joined #openstack-keystone | 08:46 | |
| *** jraim_ is now known as jraim | 08:47 | |
| *** serverascode has quit IRC | 08:47 | |
| *** mvk has joined #openstack-keystone | 08:49 | |
| *** cloudkiller has joined #openstack-keystone | 08:49 | |
| *** wxy has quit IRC | 08:49 | |
| *** raddaoui has quit IRC | 08:51 | |
| *** jaosorior has joined #openstack-keystone | 08:51 | |
| *** tpeoples has joined #openstack-keystone | 08:52 | |
| *** rm_work has quit IRC | 08:53 | |
| *** rm_work has joined #openstack-keystone | 08:54 | |
| *** jamielennox has joined #openstack-keystone | 08:55 | |
| *** ChanServ sets mode: +v jamielennox | 08:55 | |
| *** wasmum has joined #openstack-keystone | 08:57 | |
| *** daemontool_ has joined #openstack-keystone | 09:00 | |
| *** daemontool_ has quit IRC | 09:00 | |
| *** daemontool has quit IRC | 09:03 | |
| *** serverascode has joined #openstack-keystone | 09:03 | |
| *** wxy has joined #openstack-keystone | 09:03 | |
| *** briancurtin has joined #openstack-keystone | 09:05 | |
| openstackgerrit | Jack Ning proposed openstack/keystone: Added cache for mapping of user to uuid https://review.openstack.org/317307 | 09:17 |
| *** daemontool has joined #openstack-keystone | 09:18 | |
| *** mvk_ has joined #openstack-keystone | 09:24 | |
| *** mvk has quit IRC | 09:28 | |
| *** zqfan has joined #openstack-keystone | 09:36 | |
| *** cloudkiller is now known as cloudnull | 09:46 | |
| *** fawadkhaliq has quit IRC | 09:49 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:50 | |
| naresht | hi all | 09:53 |
| naresht | we are trying to do keystone to google federation | 09:54 |
| naresht | we struck at "ERROR keystone.federation.controllers [req-bdc799d5-910a-4d80-ad0d-91df148f116b - - - - -] http://x.x.x.x/dashboard/auth/websso/ is not a trusted dashboard host" | 09:56 |
| naresht | Please help us if anyone did this earlier | 09:56 |
| *** markvoelker has joined #openstack-keystone | 09:56 | |
| *** markvoelker has quit IRC | 10:02 | |
| *** mou has joined #openstack-keystone | 10:03 | |
| *** EinstCrazy has quit IRC | 10:14 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: Remove unused parameters in OidcPassword methods https://review.openstack.org/317966 | 10:32 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: oidc: create an OidcBase class with common methods https://review.openstack.org/317967 | 10:32 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: oidc: add OpenidToken class to authenticate reusing an access token https://review.openstack.org/317968 | 10:32 |
| *** Kimmo__ has joined #openstack-keystone | 10:39 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: Let OidcPassword accept scope parameters as kwargs https://review.openstack.org/317895 | 10:51 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: oidc: create an OidcBase class with common methods https://review.openstack.org/317967 | 10:52 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: Remove unused parameters in OidcPassword methods https://review.openstack.org/317966 | 10:52 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: oidc: add OpenidToken class to authenticate reusing an access token https://review.openstack.org/317968 | 10:52 |
| *** henrynash has quit IRC | 10:59 | |
| *** GB21 has joined #openstack-keystone | 11:02 | |
| *** mancdaz has quit IRC | 11:09 | |
| *** mancdaz has joined #openstack-keystone | 11:09 | |
| *** vnogin has joined #openstack-keystone | 11:23 | |
| *** GB21 has quit IRC | 11:32 | |
| *** GB21 has joined #openstack-keystone | 11:33 | |
| *** julim has joined #openstack-keystone | 11:40 | |
| *** lupine has quit IRC | 11:40 | |
| *** lupine has joined #openstack-keystone | 11:40 | |
| *** mvk_ has quit IRC | 11:49 | |
| *** ninag has joined #openstack-keystone | 11:51 | |
| *** iurygregory_ has joined #openstack-keystone | 11:52 | |
| *** ninag has quit IRC | 11:57 | |
| *** rodrigods has quit IRC | 11:58 | |
| *** rodrigods has joined #openstack-keystone | 11:58 | |
| *** tellesnobrega is now known as tellesnobrega_af | 12:02 | |
| *** ChanServ sets mode: +v samueldmq | 12:05 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 12:12 | |
| *** iurygregory_ has quit IRC | 12:14 | |
| *** fawadkhaliq has quit IRC | 12:17 | |
| *** fawadkhaliq has joined #openstack-keystone | 12:18 | |
| *** mvk_ has joined #openstack-keystone | 12:19 | |
| *** GB21 has quit IRC | 12:19 | |
| *** gordc has joined #openstack-keystone | 12:23 | |
| *** raildo-afk is now known as raildo | 12:28 | |
| *** links has quit IRC | 12:31 | |
| *** links has joined #openstack-keystone | 12:35 | |
| *** amrith is now known as _amrith_ | 12:48 | |
| *** richm has joined #openstack-keystone | 12:52 | |
| *** daemontool has quit IRC | 12:52 | |
| *** gtop-323 has joined #openstack-keystone | 12:53 | |
| *** ninag has joined #openstack-keystone | 12:55 | |
| *** tellesnobrega_af is now known as tellesnobrega | 12:58 | |
| *** edmondsw has joined #openstack-keystone | 13:04 | |
| raildo | stevemar: ping, I'm so happy to see something like this happen https://review.openstack.org/#/c/257362/ | 13:08 |
| patchbot | raildo: patch 257362 - neutron-specs - Moving to Keystone v3 API (MERGED) | 13:08 |
| *** TxGVNN has joined #openstack-keystone | 13:12 | |
| raildo | cc jamielennox notmorgan ^ | 13:14 |
| *** pnavarro has joined #openstack-keystone | 13:14 | |
| *** links has quit IRC | 13:16 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: oidc: create an OidcBase class with common methods https://review.openstack.org/317967 | 13:19 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: oidc: add OidcToken class to authenticate reusing an access token https://review.openstack.org/317968 | 13:19 |
| *** tellesnobrega is now known as tellesnobrega_af | 13:20 | |
| *** BjoernT has joined #openstack-keystone | 13:21 | |
| *** tellesnobrega_af is now known as tellesnobrega | 13:21 | |
| *** BjoernT is now known as Bjoern_zZzZzZzZ | 13:21 | |
| *** pauloewerton has joined #openstack-keystone | 13:21 | |
| *** anush has joined #openstack-keystone | 13:25 | |
| openstackgerrit | Clenimar Filemon proposed openstack/keystoneauth: Add is_domain to keystoneauth token https://review.openstack.org/282377 | 13:30 |
| *** tonytan4ever has joined #openstack-keystone | 13:31 | |
| *** Bjoern_zZzZzZzZ is now known as BjoernT | 13:37 | |
| lbragstad_ | ayoung any word on the revocation tree patch? | 13:39 |
| ayoung | lbragstad_, lots of words. I have some really choice words,,, | 13:39 |
| *** lbragstad_ is now known as lbragstad | 13:39 | |
| lbragstad | ayoung do you think it's possible to have something mergeable today? | 13:40 |
| ayoung | lbragstad, No clue | 13:40 |
| ayoung | can you fuigure out what went wrong with the other? | 13:40 |
| ayoung | http://logs.openstack.org/52/311652/12/check/gate-tempest-dsvm-postgres-full/77bf29b/console.html | 13:40 |
| lbragstad | ayoung the other? | 13:41 |
| ayoung | lbragstad, My guess is soemthing in the marshalling code for caching | 13:41 |
| ayoung | WTF I need to implement custom marshalling code when Python has perfectly acceptable Pickle is beyond me | 13:41 |
| ayoung | notmorgan, why do we not use pickle for caching? | 13:42 |
| mnaser | i know i'm just hopping in this conversation but i'm wondering if it has to do with security => https://blog.nelhage.com/2011/03/exploiting-pickle/ | 13:43 |
| mnaser | that's a common reason why ive seen it avoided | 13:43 |
| ayoung | mnaser, nope | 13:45 |
| ayoung | this is never done from an untrusted source, and what we are doing is no safer | 13:45 |
| *** ametts has joined #openstack-keystone | 13:49 | |
| lbragstad | ayoung the failures on your latest patch look strange | 13:53 |
| lbragstad | i'm going to see if i can recreate it in devstack | 13:54 |
| *** doug-fish has joined #openstack-keystone | 13:57 | |
| *** dave-mccowan has joined #openstack-keystone | 13:59 | |
| ayoung | lbragstad, I'm guessing it has to do with the dates, probably expires_at or revoked_at | 13:59 |
| *** anush has quit IRC | 14:01 | |
| *** ninag has quit IRC | 14:02 | |
| *** raddaoui has joined #openstack-keystone | 14:02 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/305487 | 14:04 |
| *** ninag has joined #openstack-keystone | 14:04 | |
| *** rderose has joined #openstack-keystone | 14:04 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/317483 | 14:08 |
| *** ninag has quit IRC | 14:09 | |
| *** links has joined #openstack-keystone | 14:10 | |
| *** ninag has joined #openstack-keystone | 14:12 | |
| *** sdake has joined #openstack-keystone | 14:14 | |
| *** pushkaru has joined #openstack-keystone | 14:16 | |
| *** jbell8 has joined #openstack-keystone | 14:16 | |
| *** doug-fis_ has joined #openstack-keystone | 14:19 | |
| knikolla | o/ | 14:21 |
| *** doug-fish has quit IRC | 14:21 | |
| *** Guest92292 is now known as mgagne | 14:25 | |
| *** mgagne has quit IRC | 14:25 | |
| *** mgagne has joined #openstack-keystone | 14:25 | |
| *** sdake has quit IRC | 14:26 | |
| *** sdake has joined #openstack-keystone | 14:27 | |
| *** daemontool has joined #openstack-keystone | 14:28 | |
| *** edtubill has joined #openstack-keystone | 14:32 | |
| *** ninag has quit IRC | 14:32 | |
| *** ninag has joined #openstack-keystone | 14:33 | |
| *** gagehugo has joined #openstack-keystone | 14:34 | |
| *** doug-fis_ has quit IRC | 14:35 | |
| *** ninag has quit IRC | 14:37 | |
| *** links has quit IRC | 14:39 | |
| *** sdake_ has joined #openstack-keystone | 14:42 | |
| *** phalmos has joined #openstack-keystone | 14:42 | |
| *** sdake has quit IRC | 14:43 | |
| *** timcline has joined #openstack-keystone | 14:47 | |
| ayoung | lbragstad, so the pre-cached version (Revision 9) passed, and the post-cached failed. There are two possbilities I can think of | 14:48 |
| ayoung | 1. THe caching itself is at fault | 14:48 |
| ayoung | 2. the marshalling code is suspect | 14:49 |
| ayoung | I'm tempted to replace my code with pickle. | 14:49 |
| lbragstad | ayoung i'm trying to reproduce it with http://logs.openstack.org/52/311652/12/check/gate-tempest-dsvm-neutron-full/f74b906/logs/reproduce.sh | 14:51 |
| *** _amrith_ is now known as amrith | 14:53 | |
| *** raildo is now known as raildo-afk | 14:56 | |
| *** hockeynut_afk is now known as hockeynut | 14:56 | |
| ayoung | notmorgan, any reason to avoid pickle for the caching? | 14:58 |
| *** jaosorior has quit IRC | 14:59 | |
| *** jaosorior has joined #openstack-keystone | 14:59 | |
| notmorgan | Ask bknudson | 14:59 |
| notmorgan | More in depth answer than I can type here ATM. | 15:00 |
| bknudson | ayoung: if you can overwrite the pickle data, you can get the application to do whatever you want | 15:00 |
| bknudson | because it's essentially run as a python program | 15:00 |
| ayoung | bknudson, this is for the cache | 15:00 |
| ayoung | its internal to our code base completely | 15:01 |
| bknudson | if you can ensure that nobody can inject into the cache then that's totally safe. | 15:01 |
| ayoung | same is true of messagepack or Json, so not a concern here | 15:01 |
| ayoung | notmorgan, ^^ I'm going with Pickle. Reduces the LOC | 15:01 |
| bknudson | json doesn't allow running arbirary code | 15:01 |
| *** tonytan4ever has quit IRC | 15:01 | |
| ayoung | GAh | 15:02 |
| ayoung | breaks other things... | 15:02 |
| bknudson | looks like messagepack is also safe | 15:02 |
| *** jistr is now known as jistr|mtg | 15:02 | |
| *** rderose has quit IRC | 15:03 | |
| *** tellesnobrega is now known as tellesnobrega_af | 15:03 | |
| *** fawadkhaliq has quit IRC | 15:04 | |
| samueldmq | ayoung: lbragstad: what are those _RevokeEventHandler and _ResponseCacheProxy ? | 15:08 |
| ayoung | samueldmq, majik | 15:08 |
| samueldmq | ayoung: you think this is making that patch fail somehow ? ^ | 15:08 |
| ayoung | blackest majik | 15:08 |
| ayoung | samueldmq, yep | 15:08 |
| notmorgan | ayoung: basically don't use pickle. we should be using json where we can | 15:08 |
| *** jbell8 has quit IRC | 15:08 | |
| *** woodster_ has joined #openstack-keystone | 15:08 | |
| notmorgan | if we can't use json, we should fix it so we can | 15:08 |
| ayoung | notmorgan, I think pickle is the more correct tool here | 15:09 |
| ayoung | it keeps us from having to one off business logic etc | 15:09 |
| notmorgan | ayoung: if pickle is "correct" use msgpack | 15:09 |
| notmorgan | is my stance on it | 15:09 |
| ayoung | notmorgan, no, msgpack means writing our own code | 15:10 |
| ayoung | that is not correct | 15:10 |
| *** diazjf has joined #openstack-keystone | 15:10 | |
| ayoung | let python do python | 15:10 |
| *** ninag has joined #openstack-keystone | 15:10 | |
| notmorgan | i am against using pickle at any point because of how the serialization and deserialization works. | 15:11 |
| *** doug-fish has joined #openstack-keystone | 15:11 | |
| ayoung | notmorgan, explain | 15:11 |
| *** iurygregory_ has joined #openstack-keystone | 15:11 | |
| notmorgan | i am not willing to explain to people why pickle is used and that it really is not insecure | 15:12 |
| notmorgan | plain and simple, it's flagged as a security risk when code is audited | 15:12 |
| ayoung | notmorgan, oy vey | 15:12 |
| notmorgan | and i wont support adding code in that i am going to need to explain this when asked. | 15:12 |
| notmorgan | i wont block it. just don't expect a +2 (or a +1) from me on it. | 15:13 |
| ayoung | notmorgan, well, let me start by seeing if it gets through the tests. That alone will be diagnostic | 15:13 |
| notmorgan | the fix for json is about 7 lines of code. | 15:14 |
| *** ninag has quit IRC | 15:14 | |
| notmorgan | if you do it the "quick" way | 15:14 |
| notmorgan | and maybe 100 if we stop assuming datetime objects | 15:14 |
| notmorgan | 1 few hundred - which is reasonable (we re-hydrate datetime in a lot of places). We could be consistent | 15:15 |
| notmorgan | and ame sure we aren't acting on datetime objects like we do. | 15:15 |
| *** iurygregory_ has quit IRC | 15:15 | |
| *** jbell8 has joined #openstack-keystone | 15:17 | |
| *** doug-fish has quit IRC | 15:17 | |
| *** ninag has joined #openstack-keystone | 15:18 | |
| notmorgan | ayoung: though once we move to a direct SQL query - this all becomes a non-issue | 15:18 |
| ayoung | notmorgan, I notice a lot of the Royal We and a "you"" in there. | 15:19 |
| *** jistr|mtg is now known as jistr | 15:19 | |
| notmorgan | ayoung: we = keystone. | 15:19 |
| ayoung | OY VEY! | 15:20 |
| ayoung | its right in Pep 8 | 15:20 |
| ayoung | WTF people | 15:21 |
| ayoung | >> Issue: [B301:blacklist] Pickle library appears to be in use, possible security issue. | 15:21 |
| ayoung | Severity: Medium Confidence: High | 15:21 |
| ayoung | Location: keystone/common/cache/_context_cache.py:38 | 15:21 |
| notmorgan | bandit | 15:21 |
| notmorgan | not pep8 | 15:21 |
| notmorgan | pep8 is just the job | 15:21 |
| *** ninag has quit IRC | 15:21 | |
| *** ninag has joined #openstack-keystone | 15:21 | |
| ayoung | its the pep8 job that is complaining | 15:22 |
| notmorgan | yes | 15:23 |
| ayoung | as in tox -e pep8 | 15:23 |
| notmorgan | pep8 job runs bandit | 15:23 |
| rodrigods | lol | 15:23 |
| *** fawadkhaliq has joined #openstack-keystone | 15:23 | |
| notmorgan | bandit is an openstack tool | 15:23 |
| *** fawadkhaliq has quit IRC | 15:23 | |
| ayoung | and marshall triggers it too. | 15:23 |
| stevemar | the pep8 job runs both flake8 and bandit | 15:23 |
| lbragstad | https://github.com/openstack/keystone/blob/master/tox.ini#L54 | 15:23 |
| *** stingaci has joined #openstack-keystone | 15:24 | |
| ayoung | THIS IS CACHING CODE! WE CONTROL ALL SIDES! AN APP DEVELOPER SHOULD NOT BE WRITING THIS! | 15:24 |
| ayoung | FFS | 15:24 |
| *** rcernin has quit IRC | 15:24 | |
| *** doug-fis_ has joined #openstack-keystone | 15:25 | |
| ayoung | Dear Python. You have let me down. Sincerely, Adam. | 15:25 |
| samueldmq | ayoung: hehe | 15:25 |
| *** doug-fis_ has quit IRC | 15:25 | |
| samueldmq | lol | 15:25 |
| ayoung | samueldmq, you laugh at me? You fix the damn code. | 15:25 |
| *** doug-fis_ has joined #openstack-keystone | 15:25 | |
| notmorgan | ayoung: you can always "# nosec" it | 15:25 |
| samueldmq | ayoung: I just found 'Dear Python. You have let me down. Sincerely, Adam.' funny | 15:26 |
| notmorgan | the fact that python-mmemcache uses pickle implicitly is also an issue | 15:26 |
| samueldmq | ayoung: not thinking you trying to fix the code funny | 15:26 |
| notmorgan | because we don't control all sides there | 15:26 |
| ayoung | samueldmq, I never wanted to do revocations at all, and somehow I am in the critical path here writing revocation code instead of what I am supposed to do, which is again not even what I should be writing | 15:27 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: enable ldap tests for py2 https://review.openstack.org/317644 | 15:27 |
| ayoung | notmorgan, what is # nosec? | 15:27 |
| lbragstad | ayoung it's like #noqa but for security things | 15:27 |
| notmorgan | what lbragstad said | 15:27 |
| ayoung | just put at the end of the line? | 15:27 |
| lbragstad | essentially | 15:27 |
| samueldmq | ayoung: let me know how I can help, and I will do it | 15:28 |
| ayoung | samueldmq, right now, it looks like I have a path. | 15:28 |
| *** Guest88617 has joined #openstack-keystone | 15:28 | |
| ayoung | If this marshalling thing is still messed up, we'll split up the work | 15:28 |
| Guest88617 | If anyone knows about the OS_INTERFACE variable and how it works in Rally, I really can't figure it out.someone posted it in a question specifically here: https://answers.launchpad.net/rally/+question/293670 but there are no responses | 15:28 |
| openstackgerrit | ayoung proposed openstack/keystone: Replace revoke tree with linear search https://review.openstack.org/311652 | 15:30 |
| ayoung | samueldmq, lets see if ^^ passes the temptest checks. If it does, the issue was my marshalling code. IF it does not, its likely cache invalidation type issues. | 15:30 |
| samueldmq | ayoung: nice, let me know | 15:31 |
| ayoung | samueldmq, nope. You keep an eye on it. I have to go work on WebSSO integration for Tripleo | 15:31 |
| samueldmq | ayoung: what's the "marshalling" code? | 15:31 |
| notmorgan | ayoung: my guess is the issue was specific in tree building | 15:31 |
| ayoung | notmorgan, not this case. THis was a problem with my patch failing tempest | 15:31 |
| samueldmq | ayoung: (I was talking one line before) | 15:31 |
| notmorgan | ayoung: no no i mean the race | 15:31 |
| ayoung | notmorgan, I hope so | 15:31 |
| notmorgan | ayoung: the issue that the linear search should fix. | 15:32 |
| stevemar | amrith: *poke* | 15:32 |
| ayoung | notmorgan, my concern is that maybe there are multiple levels of problem | 15:32 |
| ayoung | caching being one of them, | 15:32 |
| stevemar | amrith: what deprecations warnings do you want to add to: https://review.openstack.org/#/c/290971/ | 15:32 |
| patchbot | stevemar: patch 290971 - python-troveclient - switch to keystoneauth | 15:32 |
| ayoung | Like, the tree was bad, but also an event won't get into the cache when it should. | 15:32 |
| *** belmoreira has quit IRC | 15:32 | |
| ayoung | We should not have problems with tokens being incorrectly revoked unless it is time check based, though | 15:33 |
| *** fawadkhaliq has joined #openstack-keystone | 15:34 | |
| notmorgan | ayoung: i don't think it was an event missing from the cache -- except that the tree itself was built wrong | 15:36 |
| notmorgan | ayoung: and "not caching" the tree wouldn't fix that. | 15:36 |
| *** dmk0202 has quit IRC | 15:37 | |
| *** dmk0202 has joined #openstack-keystone | 15:37 | |
| samueldmq | notmorgan: ayoung: if we think the caching is wrong, why not fix the code by removing the tree without caching it | 15:37 |
| ayoung | notmorgan, so the latest errors are "revoked when they should not be" errors, which leads me to suspect my marshalling code. If that does not fix it, I am going to guess it is due to time issues, meaning the same thing that samueldmq and lbragstad have been tracking down | 15:37 |
| samueldmq | then we work in caching in a followup pach? | 15:37 |
| notmorgan | ayoung: second level resolution with "really fast tests" | 15:38 |
| ayoung | samueldmq, it means that each token validation will hit the database to pull in the list | 15:38 |
| notmorgan | is a clear issue | 15:38 |
| notmorgan | so we get racy-issues somewhere along the way | 15:38 |
| notmorgan | and we need to handle that. | 15:39 |
| ayoung | I wonder if we can't somehow drop all revocations. | 15:40 |
| ayoung | Like...if we track last password changed time, we could drop those... | 15:40 |
| ayoung | excpet that the tokens have the damn 1 second granularity so would not fix. | 15:40 |
| notmorgan | pick a rounding direction for invalidations. | 15:41 |
| notmorgan | document it, make sure tests aren't dumb | 15:41 |
| ayoung | The whole, revoke and immediately reissue work flow is a test-only issue | 15:41 |
| notmorgan | ayoung: pretty much | 15:41 |
| amrith | stevemar, one second | 15:42 |
| amrith | have to get a release out | 15:42 |
| notmorgan | ayoung: the tests are silly and don't mirror reality at all | 15:42 |
| notmorgan | ayoung: my answer is we should be fixing the tests not keystone. | 15:42 |
| notmorgan | but ... that doesn't tend to go over well "why are you sleeping in this test" | 15:42 |
| *** ninag has quit IRC | 15:43 | |
| * notmorgan does not think this is a keystone issue in any real world scenario. | 15:43 | |
| ayoung | notmorgan, the fernet granularity of 1 second breaks our pre-existing contract. And somehow that has become my problem to solve. I feel like Lando here. | 15:43 |
| notmorgan | ayoung: fix tempest instead | 15:43 |
| ayoung | notmorgan, Fix like you would fix a dog? | 15:43 |
| notmorgan | ayoung: and no it didn't really break the contract fwiw, we just were much less likely to hit it. | 15:44 |
| notmorgan | ayoung: across multi nodes etc, microsecond was *still* absolutely prone to this | 15:44 |
| notmorgan | but testing isn't multi node. | 15:44 |
| ayoung | the contract (implicit admittedly) was that we could revoke a token, immediately issue a new one, and it would be valid | 15:44 |
| notmorgan | ayoung: that wasn't a valid assumption | 15:44 |
| notmorgan | ayoung: tests just assumed it because they could get away with it | 15:44 |
| ayoung | it was. Its just not now | 15:45 |
| notmorgan | no. | 15:45 |
| notmorgan | in multi-node environments, the datetime object was based on localtime | 15:45 |
| ayoung | the whole thing is a sculpture made out of bandaids | 15:45 |
| notmorgan | not based on $centralized_time$ | 15:45 |
| notmorgan | so you could easily within ntp limits run into this issue | 15:45 |
| notmorgan | not even considering our standard "drift" acceptance | 15:45 |
| notmorgan | the only place this assumption works is in AIO deployments | 15:46 |
| notmorgan | it's the only place it has *ever* worked | 15:46 |
| ayoung | yep | 15:46 |
| notmorgan | so that points to the test being wrong | 15:46 |
| notmorgan | not keystone | 15:46 |
| ayoung | guess what kind of deployments I work with almost exclusively? | 15:46 |
| notmorgan | so we should make the test smarter | 15:46 |
| notmorgan | not "fix" keystone | 15:46 |
| notmorgan | (getting rid of the tree is orthogonal) | 15:47 |
| ayoung | notmorgan, time granularity aside I think I want to get away from a revocation event table | 15:47 |
| notmorgan | (and still a massive improvement) | 15:47 |
| ayoung | the only kind we must persist are explicit revocation by ID | 15:47 |
| ayoung | and I bet we could do that and passwords with a single value | 15:47 |
| notmorgan | ayoung: we need to track when $item$ was disabled/deleted | 15:47 |
| notmorgan | as well | 15:47 |
| notmorgan | domains, projects, users | 15:48 |
| ayoung | notmorgan, yes, but we already have that data | 15:48 |
| notmorgan | no we don't | 15:48 |
| notmorgan | not for delete | 15:48 |
| notmorgan | not for disable in most | 15:48 |
| notmorgan | we don't store it | 15:48 |
| ayoung | we only need to track the current state | 15:48 |
| ayoung | not a time | 15:48 |
| ayoung | if A is disabled when a token referenceing A is validated, the token is invalid | 15:48 |
| ayoung | re-enable, and the token is now valid | 15:49 |
| notmorgan | oh wait i'm still thinking events consumed outside keystone | 15:49 |
| notmorgan | nvm | 15:49 |
| amrith | stevemar, hello | 15:49 |
| samueldmq | ayoung: notmorgan patch 316370 | 15:49 |
| patchbot | samueldmq: https://review.openstack.org/#/c/316370/ - keystone - DO NOT MERGE: local in-process cache per request | 15:49 |
| * notmorgan does want to point out that uuid tokens still make me sad because validation paths are wildly different and can't be merged in | 15:49 | |
| amrith | stevemar, want to add warnings about os-tenant-name and os-tenant-id | 15:50 |
| amrith | in favor of os-project-name and os-project-id | 15:50 |
| samueldmq | that single run alone doesn't mean anything, but tests passed; it *could* a mix of things, as ayoung suspect | 15:50 |
| samueldmq | s | 15:50 |
| *** dmk0202 has quit IRC | 15:51 | |
| *** tonytan4ever has joined #openstack-keystone | 15:53 | |
| *** ninag has joined #openstack-keystone | 15:54 | |
| *** henrynash has joined #openstack-keystone | 15:57 | |
| *** ChanServ sets mode: +v henrynash | 15:57 | |
| *** ninag has quit IRC | 15:58 | |
| *** ninag has joined #openstack-keystone | 15:58 | |
| *** jistr has quit IRC | 16:00 | |
| *** agrebennikov has joined #openstack-keystone | 16:00 | |
| *** phalmos has quit IRC | 16:01 | |
| *** edtubill has quit IRC | 16:02 | |
| *** phalmos has joined #openstack-keystone | 16:02 | |
| *** raildo-afk is now known as raildo | 16:03 | |
| *** ninag has quit IRC | 16:04 | |
| *** ninag has joined #openstack-keystone | 16:04 | |
| notmorgan | stevemar: https://review.openstack.org/#/c/317644/3 py2? | 16:05 |
| patchbot | notmorgan: patch 317644 - keystone - enable ldap tests for py2 | 16:05 |
| notmorgan | stevemar: also... 4 test suits that aren't py3 friendly... woot | 16:06 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Updated from global requirements https://review.openstack.org/317483 | 16:07 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: enable ldap tests for py3 https://review.openstack.org/317644 | 16:07 |
| stevemar | notmorgan: i rearranged things | 16:08 |
| stevemar | the proposal bot change was going to conflict | 16:08 |
| stevemar | and yeah, my bad with calling it py2 :P | 16:08 |
| *** ninag has quit IRC | 16:09 | |
| notmorgan | stevemar: hehe it was mostly the py2 thing ;) | 16:09 |
| *** ninag has joined #openstack-keystone | 16:10 | |
| stevemar | amrith: i wonder if keystoneauth already emits deprecations for you... | 16:11 |
| *** mou has quit IRC | 16:11 | |
| stevemar | i guess not | 16:12 |
| amrith | stevemar, it does not | 16:12 |
| stevemar | hmm okay | 16:13 |
| stevemar | you could do it in a separate patch :P | 16:13 |
| amrith | the nova sample I was following did it | 16:13 |
| amrith | I was going to check and do similar | 16:13 |
| amrith | another patch for that? | 16:13 |
| stevemar | amrith: up to you, it's your repo :) | 16:14 |
| *** edtubill has joined #openstack-keystone | 16:15 | |
| *** ninag has quit IRC | 16:15 | |
| amrith | hmm, maybe I get an ATC pass | 16:16 |
| amrith | that would be nice | 16:17 |
| lbragstad | ayoung so what's the motive behind using marshal versus messagepackutils? | 16:19 |
| ayoung | lbragstad, not writing custom code versus writing custom marshalling code. | 16:19 |
| ayoung | marshall knows how to save and restore standard python types | 16:20 |
| ayoung | lbragstad, it properly converts and object to a stream of bytes and back | 16:20 |
| lbragstad | ayoung I logged the data before and after passing it to msgpackutils and the data looked fine | 16:20 |
| ayoung | and, since that was one of the potential causes, using the marshall approach removes it from the test | 16:21 |
| *** vnogin has quit IRC | 16:22 | |
| *** afred312 has joined #openstack-keystone | 16:23 | |
| *** gyee has joined #openstack-keystone | 16:25 | |
| *** ChanServ sets mode: +v gyee | 16:25 | |
| *** Guest88617 is now known as help | 16:26 | |
| *** help is now known as Kevin | 16:26 | |
| *** ninag has joined #openstack-keystone | 16:27 | |
| *** Kevin is now known as KevinE | 16:27 | |
| edtubill | Does anyone know the status of this patch? https://review.openstack.org/#/c/159910/ Also, I was wondering if django_openstack_auth is owned by the horizon or the keystone team? | 16:27 |
| patchbot | edtubill: patch 159910 - django_openstack_auth - K2K federation | 16:27 |
| *** raildo is now known as raildo-afk | 16:30 | |
| *** raildo-afk is now known as raildo | 16:30 | |
| *** sdake_ has quit IRC | 16:31 | |
| dstanek | edtubill: it's a horizon thing | 16:31 |
| *** sdake has joined #openstack-keystone | 16:31 | |
| edtubill | dstanek: thx | 16:31 |
| *** spzala has joined #openstack-keystone | 16:33 | |
| ayoung | edtubill, if you want it, add in the unit tests he's asking for | 16:33 |
| david-lyle | edtubill: apparently I was thrown on that grenade, but I haven't had time to look yet. If you have the cycles, feel free :) | 16:33 |
| *** ninag has quit IRC | 16:34 | |
| *** ninag has joined #openstack-keystone | 16:34 | |
| edtubill | ayoung, david-lyle: thx, I just need to find out now if I have cycles... | 16:35 |
| *** ngupta_ has joined #openstack-keystone | 16:37 | |
| *** lhcheng has joined #openstack-keystone | 16:38 | |
| *** ChanServ sets mode: +v lhcheng | 16:38 | |
| *** tellesnobrega_af is now known as tellesnobrega | 16:38 | |
| lbragstad | notmorgan what's the purpose behind _RevokeEventHandler ? | 16:38 |
| notmorgan | uhm. in ayoung 's code? | 16:38 |
| lbragstad | notmorgan just in general | 16:38 |
| notmorgan | lbragstad: to serialize revoke events with msgpack | 16:38 |
| lbragstad | before and after putting and pulling them from the cache right? | 16:38 |
| notmorgan | lbragstad: yeah in the local request cache | 16:39 |
| lbragstad | notmorgan what about the _registry.frozen = True and .frozen = False stuff? | 16:39 |
| *** ninag has quit IRC | 16:40 | |
| lbragstad | so when _context_cache is imported - we unfreeze the registry and make it mutable, then we freeze it agin | 16:41 |
| edtubill | david-lyle: so is that the way that the horizon/keystone team would want to support k2k federation? LIke if I were to do it, would I get a -2 because of some other competing idea? | 16:41 |
| lbragstad | again* | 16:41 |
| *** jbell8 has quit IRC | 16:43 | |
| *** amrith is now known as _amrith_ | 16:45 | |
| *** ninag has joined #openstack-keystone | 16:47 | |
| david-lyle | edtubill: that was someone's implementation. If you have a better idea, I'm certainly open to hearing it out. Storing a ton of unscoped tokens on the session is not ideal, IMO. and combining all the regions in one list will be confusing the the end user | 16:47 |
| edtubill | david-lyle: I would have to think about if there is a better way, I know that one of the problems with that patch was that I had to be sure to use the cache session backend type instead of signed cookies because the session variables were too big to fit in a cookie on the browser. | 16:50 |
| *** fawadkhaliq has quit IRC | 16:50 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:51 | |
| *** ninag has quit IRC | 16:52 | |
| *** ninag has joined #openstack-keystone | 16:52 | |
| *** ninag has quit IRC | 16:52 | |
| *** ninag has joined #openstack-keystone | 16:53 | |
| david-lyle | edtubill: that's generally true though | 16:53 |
| edtubill | I also wanted to ask if anyone here knew if there were any future plans to make keystone support saml2 websso when it is being used as an idp? or if the majority opinion was not to implement that ever. | 16:54 |
| *** fawadkhaliq has quit IRC | 16:55 | |
| *** ninag has quit IRC | 16:55 | |
| *** ninag has joined #openstack-keystone | 16:55 | |
| *** diazjf has quit IRC | 16:58 | |
| *** ninag has quit IRC | 17:00 | |
| *** henrynash has quit IRC | 17:00 | |
| *** lhcheng_ has joined #openstack-keystone | 17:01 | |
| *** lhcheng has quit IRC | 17:01 | |
| *** roxanaghe has joined #openstack-keystone | 17:01 | |
| *** ninag has joined #openstack-keystone | 17:02 | |
| *** stingaci has quit IRC | 17:06 | |
| *** tonytan4ever has quit IRC | 17:08 | |
| openstackgerrit | Merged openstack/keystone: Move the revoke abstract base class out of core https://review.openstack.org/317784 | 17:09 |
| *** jbell8 has joined #openstack-keystone | 17:11 | |
| *** ninag has quit IRC | 17:11 | |
| *** ninag has joined #openstack-keystone | 17:15 | |
| *** daemontool has quit IRC | 17:15 | |
| *** ninag_ has joined #openstack-keystone | 17:16 | |
| *** ninag has quit IRC | 17:20 | |
| *** ninag_ has quit IRC | 17:20 | |
| *** stingaci has joined #openstack-keystone | 17:22 | |
| *** rderose has joined #openstack-keystone | 17:28 | |
| *** _amrith_ is now known as amrith | 17:32 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: reorganize mitaka release notes https://review.openstack.org/316342 | 17:33 |
| *** pnavarro has quit IRC | 17:36 | |
| *** mvk_ has quit IRC | 17:37 | |
| *** stingaci has quit IRC | 17:39 | |
| *** ninag has joined #openstack-keystone | 17:40 | |
| *** tqtran has joined #openstack-keystone | 17:43 | |
| *** spzala has quit IRC | 17:43 | |
| *** spzala has joined #openstack-keystone | 17:43 | |
| *** ninag has quit IRC | 17:45 | |
| *** ninag has joined #openstack-keystone | 17:46 | |
| dstanek | anyone know how to use osc to delete role assignments? is only listing implemented? | 17:51 |
| raildo | dstanek: openstack role remove | 17:53 |
| samueldmq | raildo: ++ | 17:53 |
| samueldmq | all the CRUD is available | 17:54 |
| raildo | and with inherited flag too :D | 17:54 |
| raildo | dstanek: http://docs.openstack.org/cli-reference/openstack.html#openstack-role-remove | 17:54 |
| dstanek | raildo: that removes a role though right? not just an assignment | 17:54 |
| dstanek | oh, wait.... | 17:55 |
| raildo | "Remove role from domain/project : user/group" | 17:55 |
| *** stingaci has joined #openstack-keystone | 17:55 | |
| dstanek | raildo: i didn't realize that there was also a delete that deleted the role | 17:56 |
| dstanek | since there is a 'role assignment list' i was looking for a 'role assignment remove' - yay for consistency! | 17:57 |
| raildo | dstanek: yep, there is a role delete to delete the role, and a role remove to delete the assignment | 17:57 |
| raildo | lol | 17:57 |
| raildo | dstanek: ++ for improve this name/docs | 17:57 |
| dstanek | raildo: thx! | 17:58 |
| raildo | dstanek: np | 17:58 |
| *** BjoernT is now known as Bjoern_zZzZzZzZ | 17:58 | |
| dstanek | i would have spent 30 minutes digging through the code just to find this info | 17:58 |
| raildo | dstanek: now you can use this time to do code review (or take a coffee) :) | 17:59 |
| dstanek | ..nap time.. | 18:00 |
| raildo | haha | 18:00 |
| *** Bjoern_zZzZzZzZ is now known as BjoernT | 18:04 | |
| *** jdennis has joined #openstack-keystone | 18:05 | |
| *** jdennis1 has quit IRC | 18:05 | |
| *** rderose has quit IRC | 18:06 | |
| *** stingaci has quit IRC | 18:07 | |
| *** TxGVNN has quit IRC | 18:07 | |
| stevemar | dstanek: we're going to do a 3.0.0 for OSC soon, if you have opinions on the naming, let dtroyer know! the topic of role assignment vs role add / remove has come up before, but no conclusion! | 18:08 |
| dstanek | stevemar: maybe a patch will help the discussion :-) | 18:09 |
| stevemar | :) | 18:10 |
| stevemar | dstanek: fwiw, henry has already stumbled onto the land mine a bit here: https://review.openstack.org/#/c/311460/ | 18:10 |
| patchbot | stevemar: patch 311460 - python-openstackclient - Add assignment list to v2 identity and deprecate a... | 18:10 |
| *** darosale has joined #openstack-keystone | 18:13 | |
| dstanek | stevemar: oh, nice. i'll dig into that once i'm done hacking up my k2k setup | 18:15 |
| *** doug-fish has joined #openstack-keystone | 18:16 | |
| *** doug-fish has quit IRC | 18:17 | |
| *** doug-fish has joined #openstack-keystone | 18:17 | |
| *** tonytan4ever has joined #openstack-keystone | 18:18 | |
| *** doug-fis_ has quit IRC | 18:20 | |
| notmorgan | stevemar: ooh can we break things in 3.0.0 of OSC ? (Just kidding!!) | 18:20 |
| redrobot | ohai keystone friends. I'm looking for docs showing the proper use of keystoneauth | 18:24 |
| redrobot | anyone have a link handy? | 18:24 |
| *** amit213 has quit IRC | 18:24 | |
| dstanek | redrobot: what are you trying to do exactly? | 18:27 |
| dstanek | redrobot: maybe this will help? http://docs.openstack.org/developer/keystoneauth/using-sessions.html | 18:27 |
| *** amit213 has joined #openstack-keystone | 18:27 | |
| redrobot | dstanek trying to migrate python-barbianclient from using python-keystoneclient sessions to using keystoneauth instead | 18:27 |
| notmorgan | redrobot: woooooot | 18:27 |
| notmorgan | redrobot: we have some of those docs! | 18:27 |
| raildo | redrobot: so, i recommend this link http://docs.openstack.org/developer/keystoneauth/migrating.html | 18:28 |
| *** diazjf has joined #openstack-keystone | 18:28 | |
| dstanek | raildo: ++ | 18:28 |
| redrobot | raildo that looks like what I'm looking for | 18:28 |
| notmorgan | raildo: ++ | 18:28 |
| redrobot | thanks folks! I'll be back if I run into any troubles | 18:28 |
| notmorgan | raildo: beat me to it. | 18:28 |
| rm_work | hey, anyone aware of keystone changes that might have merged in the last day or two that could be breaking our keystone requests in devstack (for octavia/lbaas)? | 18:28 |
| rm_work | since at least yesterday we're getting broken gate runs with a 404 | 18:29 |
| notmorgan | rm_work: uhm. that is a big question | 18:29 |
| rm_work | possibly earlier | 18:29 |
| notmorgan | rm_work: what is the error? | 18:29 |
| rm_work | http://logs.openstack.org/10/314410/5/check/gate-neutron-lbaasv2-dsvm-scenario/c008b65/logs/screen-o-cw.txt.gz | 18:29 |
| raildo | redrobot: btw, I recommend take a look on this patch https://review.openstack.org/#/c/304812/ | 18:29 |
| patchbot | raildo: patch 304812 - python-monascaclient - Adding keystoneauth sessions support | 18:29 |
| dstanek | rm_work: what's the error? | 18:29 |
| raildo | redrobot: some guys made similar work in other services | 18:29 |
| redrobot | raildo will do! thanks again | 18:29 |
| rm_work | see the wall of red in there | 18:29 |
| rm_work | it traces down to a keystone request made inside of a session in neutron client | 18:29 |
| rm_work | wherein it gets a 404 | 18:29 |
| raildo | redrobot: np :) good luck! | 18:29 |
| rm_work | there's not much that is useful (at least to me) for that requestid in the keystone logs :/ | 18:30 |
| notmorgan | rm_work: nothing i know specifically would have affected that. | 18:30 |
| notmorgan | rm_work: but... i mean.. | 18:30 |
| notmorgan | clearly there is an issue | 18:30 |
| rm_work | yeah, was just curious if something major and obviously possibly breaking might have merged | 18:30 |
| raildo | rm_work: I guess it was a desvtack change related to fernet | 18:30 |
| rm_work | if not, i'll just have to go head down and debug it | 18:30 |
| notmorgan | rm_work: nothing major and obvious afaik | 18:30 |
| raildo | it was reverted | 18:31 |
| notmorgan | raildo: ah | 18:31 |
| notmorgan | rm_work: ^ | 18:31 |
| notmorgan | that probably | 18:31 |
| rm_work | the only log line for keystone is something about certs | 18:31 |
| dstanek | rm_work: that'a a 404 talking to neutron? | 18:31 |
| raildo | https://review.openstack.org/#/c/318116/ | 18:31 |
| patchbot | raildo: patch 318116 - openstack-dev/devstack - Revert "Switch fernet to be the default token prov... (MERGED) | 18:31 |
| *** sdake_ has joined #openstack-keystone | 18:31 | |
| rm_work | dstanek: no, 404 from keystone request, inside neutron client when trying to use the session | 18:31 |
| rm_work | raildo: that looks... possibly likely | 18:31 |
| rm_work | ok and it was reverted | 18:32 |
| rm_work | as of *recently* | 18:32 |
| dstanek | oh, strange: from the keystone log 127.0.0.1 - - [18/May/2016:00:15:45 +0000] "POST /v3/v2.0/tokens HTTP/1.1" 404 93 "-" "keystoneauth1/2.6.0 python-requests/2.10.0 CPython/2.7.6" 5660(us) | 18:32 |
| dstanek | /v3/v2.0? | 18:32 |
| rm_work | hmmmmmm i didn't see that | 18:32 |
| rm_work | which log is that in? | 18:33 |
| dstanek | http://logs.openstack.org/10/314410/5/check/gate-neutron-lbaasv2-dsvm-scenario/c008b65/logs/apache/keystone_access.txt.gz | 18:33 |
| *** sdake has quit IRC | 18:33 | |
| dstanek | maybe a bad endpoint for discovery or broken logic if we are still doing the url manipulation | 18:33 |
| raildo | dstanek: well, this is really odd | 18:34 |
| rm_work | oh yeah that's very weird | 18:34 |
| rm_work | man how did you even pick that out, lol | 18:34 |
| raildo | dstanek: an your eagle's eyes | 18:34 |
| rm_work | my eyes still glaze over it and i KNOW it's there | 18:34 |
| notmorgan | rm_work: dstanek is ust that good. | 18:34 |
| dstanek | lol | 18:35 |
| notmorgan | rm_work: there is a reason we keep him around ;) | 18:35 |
| raildo | notmorgan: haha | 18:35 |
| rm_work | so yeah that'd account for the 404 | 18:35 |
| notmorgan | dstanek: I'm feeling a py3 win landing here soon. we're close. | 18:36 |
| notmorgan | dstanek: so close | 18:36 |
| rm_work | let me see where I define the keystone URL | 18:36 |
| dstanek | unless you really want version 2 or the version 3 api! | 18:36 |
| notmorgan | dstanek: then we're really just dependant libraries we don't test in unit tests away | 18:36 |
| rm_work | oh, no, this is totally a problem in OUR config | 18:36 |
| rm_work | something broke badly | 18:36 |
| rm_work | but we haven't merged anything new so i don't know HOW | 18:36 |
| rm_work | something in our devstack plugin is somehow setting that in OUR config | 18:36 |
| notmorgan | rm_work: magic. | 18:36 |
| dstanek | rm_work: did something is devstack change? | 18:36 |
| rm_work | but it didn't used to | 18:36 |
| notmorgan | rm_work: black magic | 18:36 |
| rm_work | probably dstanek | 18:37 |
| rm_work | auth_uri = http://127.0.0.1:35357/v3/v2.0 | 18:37 |
| rm_work | lol | 18:37 |
| rm_work | in octavia's config | 18:37 |
| notmorgan | rm_work: thats epic | 18:37 |
| rm_work | gotta track down how our plugin does that | 18:37 |
| raildo | rm_work: notmorgan http://www.reactiongifs.com/r/mgc.gif | 18:37 |
| rm_work | i bet a trailing slash changed | 18:37 |
| rm_work | thanks for the spot dstanek :P | 18:38 |
| dstanek | rm_work: yw | 18:38 |
| *** roxanaghe has quit IRC | 18:40 | |
| rm_work | iniset $OCTAVIA_CONF keystone_authtoken auth_uri ${KEYSTONE_AUTH_URI}/v2.0 | 18:41 |
| rm_work | looks like somehow the main var for keystone auth uri changed | 18:41 |
| rm_work | we were just dumbly appending | 18:41 |
| rm_work | assuming it was a baseURI | 18:42 |
| raildo | rm_work: hardcoded v2 :( we are trying to remove this kind of v2 ussage | 18:42 |
| rm_work | yeah :/ | 18:43 |
| rm_work | our request doesn't work right with v3 yet apparently | 18:43 |
| rm_work | i tried just changing it to v3 in config and no dice | 18:43 |
| rm_work | need to dig further to figure that out | 18:43 |
| raildo | rm_work: I saw a (amazing) spec about v3 migration on neutron | 18:43 |
| raildo | rm_work: ++ for it | 18:43 |
| rm_work | yeah this is within neutronclient so i don't think it's something octavia can worry about :/ | 18:44 |
| rm_work | but not sure | 18:44 |
| rm_work | I don't think we provide the session | 18:44 |
| rm_work | err | 18:44 |
| rm_work | rather, we do provide the session, but how it's used isn't up to us | 18:44 |
| raildo | got it | 18:44 |
| dstanek | rm_work: you change the v2.0 to v3? | 18:45 |
| rm_work | dstanek: yes | 18:45 |
| rm_work | tried that FIRST actually | 18:45 |
| dstanek | wouldn't that give you /v3/v3? | 18:45 |
| rm_work | no | 18:45 |
| rm_work | i mean | 18:45 |
| rm_work | when i change it to JUST /v2.0 | 18:45 |
| rm_work | it doesn't append v3 to it | 18:46 |
| dstanek | ah, ok. | 18:46 |
| rm_work | just wondering when devstack changed $KEYSTONE_AUTH_URI to include /v3 instead of being a true base URL | 18:48 |
| rm_work | because that is what broke us | 18:48 |
| rm_work | i mean, we don't "hardcode" v2.0 in our actual code -- just for the default config in our devstack plugin | 18:49 |
| rm_work | i guess you could call that hardcoding but I don't | 18:49 |
| dstanek | rm_work: i think that's an old thing | 18:50 |
| rm_work | it can't be, because this worked last week | 18:50 |
| rm_work | let me double-check that our devstack plugin didn't change this week <_< | 18:50 |
| dstanek | rm_work: i think this is it https://github.com/openstack-dev/devstack/blob/b74e01c34de76cb451f80d2f1ac1c4ccac1bb7e4/lib/keystone#L110 (from 2014) | 18:51 |
| rm_work | lol | 18:51 |
| rm_work | well IDKWTF :P | 18:51 |
| rm_work | our devstack plugin has done this since we started | 18:52 |
| dstanek | lol, no idea :-( | 18:52 |
| rm_work | so I am thoroughly baffled by however devstack's black magic was making this work before and not now :P | 18:52 |
| rm_work | going to put in code to strip /v3 from the URL I guess in the meantime <_< | 18:52 |
| rodrigods | dstanek, bknudson, lbragstad, stevemar: review request https://review.openstack.org/#/c/294165/ :) please take a look whenever you have some time | 18:56 |
| patchbot | rodrigods: patch 294165 - tempest - Add identity providers tests | 18:56 |
| rodrigods | oops, wrong patch: https://review.openstack.org/#/c/302299/ | 18:56 |
| patchbot | rodrigods: patch 302299 - keystone - Add identity providers integration tests | 18:56 |
| *** cheran has joined #openstack-keystone | 18:59 | |
| *** pnavarro has joined #openstack-keystone | 18:59 | |
| *** agireud has quit IRC | 19:04 | |
| rm_work | so do you guys cry when you see something like https://review.openstack.org/#/c/318290/1/devstack/plugin.sh or is that acceptable? | 19:05 |
| patchbot | rm_work: patch 318290 - octavia - Fix keystone auth url in devstack plugin | 19:05 |
| hoonetorg | hi | 19:07 |
| hoonetorg | my endpoint url's for keystone stuff are already v3 | 19:07 |
| hoonetorg | but i did not upgrade policy.json to v3 | 19:07 |
| raildo | rm_work: well... doesn't sounds right, but I don't know a better way to do this | 19:08 |
| hoonetorg | i've seen in diff that there are quite a few differences between between policy.json v2 and v3 | 19:08 |
| hoonetorg | but i could not see any problems until now | 19:09 |
| hoonetorg | I only have default domain until now. | 19:09 |
| raildo | hoonetorg: are you calling the policy.json v3, this policy? https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json | 19:09 |
| hoonetorg | raildo: yes | 19:10 |
| hoonetorg | i only forgot to update | 19:10 |
| hoonetorg | but no problems now, can that be? | 19:10 |
| raildo | hoonetorg: it's just a example on how can you use better v3 stuffs like, domains | 19:10 |
| *** doug-fish has quit IRC | 19:10 | |
| raildo | hoonetorg: but does'nt have any problem keep using the other policy | 19:11 |
| hoonetorg | raildo: thx, so keeping old policy.json is OK? | 19:11 |
| stevemar | notmorgan: want to take a quick look at https://review.openstack.org/#/c/312061/ | 19:11 |
| patchbot | stevemar: patch 312061 - keystone - Port test_v3_auth unit test to Python 3 | 19:11 |
| stevemar | dstanek: we are SO close to py3 compat :O | 19:12 |
| stevemar | the ldap stuff cleans up all these: https://review.openstack.org/#/c/317644/4/tests-py3-blacklist.txt | 19:12 |
| patchbot | stevemar: patch 317644 - keystone - enable ldap tests for py3 | 19:12 |
| raildo | hoonetorg: be ok, is relative :P it works... | 19:12 |
| stevemar | dstanek: just fernet, credential and oauth need to be fixed \o/ | 19:13 |
| hoonetorg | when i replace it, what are necessary steps to do | 19:13 |
| hoonetorg | is restarting keystone enough | 19:13 |
| hoonetorg | or db_sync required too? | 19:13 |
| *** doug-fish has joined #openstack-keystone | 19:13 | |
| raildo | hoonetorg: you don't need to change anything, every request is enforced on the policy again | 19:14 |
| hoonetorg | raildo: thx, can i still access via token and /v2 -url when using policy.json v3 (my deployment tool - saltstack - only supports v2) | 19:15 |
| *** rderose has joined #openstack-keystone | 19:15 | |
| raildo | hoonetorg: I don't see any problem on it | 19:16 |
| hoonetorg | k | 19:16 |
| hoonetorg | perfect | 19:16 |
| hoonetorg | that was a great help raildo - will try NOW | 19:16 |
| raildo | hoonetorg: good luck :) | 19:16 |
| openstackgerrit | Merged openstack/keystone: Use PyLDAP instead of python-ldap https://review.openstack.org/317638 | 19:17 |
| *** doug-fish has quit IRC | 19:18 | |
| *** sdake_ has quit IRC | 19:23 | |
| *** timcline has quit IRC | 19:26 | |
| *** timcline has joined #openstack-keystone | 19:27 | |
| *** agireud has joined #openstack-keystone | 19:30 | |
| *** pnavarro has quit IRC | 19:31 | |
| *** rk4n has joined #openstack-keystone | 19:36 | |
| *** rk4n has quit IRC | 19:37 | |
| *** doug-fish has joined #openstack-keystone | 19:40 | |
| *** ninag has quit IRC | 19:41 | |
| *** stingaci has joined #openstack-keystone | 19:41 | |
| stevemar | dstanek: gyee dolphm ayoung any takers on this patch: https://review.openstack.org/#/c/317644/ :) | 19:42 |
| patchbot | stevemar: patch 317644 - keystone - enable ldap tests for py3 | 19:42 |
| ayoung | stevemar, +2A | 19:43 |
| *** doug-fish has quit IRC | 19:44 | |
| *** ninag has joined #openstack-keystone | 19:45 | |
| ayoung | samueldmq, lbragstad looks like my last attempt failed spectacularly. I'm going to revert to the one before it that used messagepack | 19:45 |
| *** diazjf has quit IRC | 19:46 | |
| samueldmq | ayoung: looking | 19:46 |
| samueldmq | ayoung: yep, "ValueError: unmarshallable object" | 19:47 |
| *** diazjf has joined #openstack-keystone | 19:47 | |
| *** sdake has joined #openstack-keystone | 19:49 | |
| ayoung | notmorgan, what would happen if we accepted "Replace revoke tree with linear search" with no caching enabled? | 19:49 |
| samueldmq | ayoung: that's what I suggested (if it works without cache), then we keep working to re-enable it ? | 19:49 |
| samueldmq | not sure this is necessary tho, since fernet has already been reverted as default :( | 19:50 |
| ayoung | samueldmq, yeah, I'm not usually allowed to be practical | 19:50 |
| samueldmq | ayoung: hehe agree, that's more practical | 19:50 |
| ayoung | usually I have to be purist and have the spirit beaten out of me to get a patch in | 19:50 |
| samueldmq | ayoung: we solve the big issue then optimize | 19:50 |
| *** fawadkhaliq has joined #openstack-keystone | 19:54 | |
| *** jbell8 has quit IRC | 19:54 | |
| *** fawadkhaliq has quit IRC | 19:54 | |
| *** fawadkhaliq has joined #openstack-keystone | 19:55 | |
| *** woodburn has joined #openstack-keystone | 19:55 | |
| openstackgerrit | ayoung proposed openstack/keystone: Replace revoke tree with linear search https://review.openstack.org/311652 | 19:56 |
| *** doug-fish has joined #openstack-keystone | 19:59 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Support encryption of credentials in Keystone https://review.openstack.org/317169 | 20:02 |
| *** rderose has quit IRC | 20:07 | |
| *** tonytan4ever has quit IRC | 20:08 | |
| *** KevinE has quit IRC | 20:08 | |
| *** ametts has quit IRC | 20:13 | |
| *** diazjf has quit IRC | 20:13 | |
| *** fawadkhaliq has quit IRC | 20:15 | |
| hoonetorg | raildo: for things like "openstack user list" i know need someone with role "cloud_admin" ? | 20:18 |
| hoonetorg | how to create such a guy? :) | 20:18 |
| dstanek | rm_work: i cry all the time :-( | 20:18 |
| dstanek | stevemar: so close to tests passing. i'll be interested in seeing if we can actually properly deal with unicode throughout the stack | 20:20 |
| *** diazjf has joined #openstack-keystone | 20:20 | |
| hoonetorg | raildo: ^^^ i switched policy.json from v2 to v3 now | 20:20 |
| raildo | hoonetorg: we have a couple of different permissions between the policy.json and v3cloudsample | 20:20 |
| dstanek | hoonetorg: create a user and create a role assignment for them? | 20:21 |
| rm_work | dstanek / raildo lol well, yeah I guess that's what we're going with for now :P | 20:21 |
| raildo | hoonetorg: we suggest have the cloud_admin in a different domain for the other users | 20:21 |
| *** ninag has quit IRC | 20:21 | |
| raildo | so we can avoid the 'global admin' issues | 20:21 |
| dstanek | hoonetorg: are you working on a dev/test cloud or a production cloud? | 20:22 |
| hoonetorg | test cloud | 20:22 |
| hoonetorg | no trouble :) | 20:22 |
| dstanek | just checking :-) | 20:22 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/318320 | 20:23 |
| hoonetorg | but change should go into prod soon | 20:23 |
| samueldmq | test cloud, no trouble, oh wait, where's my test cloud ? | 20:23 |
| samueldmq | :) | 20:23 |
| hoonetorg | samueldmq: lol | 20:24 |
| raildo | hoonetorg: so, looking into the policy file https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json#L3 | 20:24 |
| raildo | hoonetorg: cloud admin will be the guy with admin role, and this user was created in the cloud_admin_domain | 20:25 |
| *** roxanaghe has joined #openstack-keystone | 20:26 | |
| hoonetorg | raildo: so i must create an cloud_admin_domain and this shouldn't be the default domain? | 20:26 |
| hoonetorg | like "openstack domain create cloud_admin" ? | 20:27 |
| *** ninag has joined #openstack-keystone | 20:27 | |
| raildo | yes, and you change this line, for this domain_id | 20:27 |
| raildo | hoonetorg: and grant the admin role for this user, as dstanek said before | 20:28 |
| hoonetorg | k | 20:28 |
| *** ngupta_ has quit IRC | 20:29 | |
| hoonetorg | and the default value for the domain_id:admin_domain_id is really cloud_admin ? | 20:29 |
| *** ametts has joined #openstack-keystone | 20:30 | |
| hoonetorg | or can it be any name? can it be changed? | 20:30 |
| raildo | hoonetorg: you have to change this for the cloud_domain_id... | 20:32 |
| raildo | hoonetorg: so, after create this new domain, the domain_id is 123, you must change this for domain_id:123 | 20:33 |
| hoonetorg | ah, so i must edit the policy.json file, is that right? | 20:34 |
| *** huats_ has quit IRC | 20:36 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/317483 | 20:38 |
| *** rderose has joined #openstack-keystone | 20:38 | |
| raildo | hoonetorg: yeap | 20:40 |
| hoonetorg | thx | 20:41 |
| hoonetorg | got it | 20:41 |
| *** ngupta_ has joined #openstack-keystone | 20:46 | |
| *** raildo is now known as raildo-afk | 20:49 | |
| openstackgerrit | Merged openstack/keystone: enable ldap tests for py3 https://review.openstack.org/317644 | 20:49 |
| *** ninag has quit IRC | 21:01 | |
| *** pauloewerton has quit IRC | 21:03 | |
| dstanek | woot ^ | 21:06 |
| *** ametts has quit IRC | 21:07 | |
| notmorgan | dstanek: oh just wait i'm cleaning up the last 4 test cases now | 21:10 |
| notmorgan | dstanek: for py3 unless someone else has beaten me to it over lunch | 21:10 |
| dstanek | notmorgan: nice | 21:12 |
| dstanek | is there really no way using ksc to get a project by name? | 21:12 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Enable py3 for credential tests https://review.openstack.org/318341 | 21:12 |
| notmorgan | dstanek: no we don't have a good API for it. | 21:12 |
| *** spzala has quit IRC | 21:13 | |
| dstanek | notmorgan: :-( that's not cool | 21:13 |
| *** spzala has joined #openstack-keystone | 21:13 | |
| *** ninag has joined #openstack-keystone | 21:15 | |
| dstanek | i really wish federation was more cookie cutter. we could have 100s of implemenations all using different attributes and mappings. so it's much harder for the uninitiated | 21:17 |
| *** spzala has quit IRC | 21:18 | |
| *** ayoung has quit IRC | 21:18 | |
| *** ayoung has joined #openstack-keystone | 21:18 | |
| *** ChanServ sets mode: +v ayoung | 21:18 | |
| *** spzala has joined #openstack-keystone | 21:22 | |
| notmorgan | uhm | 21:22 |
| notmorgan | ... | 21:22 |
| notmorgan | dstanek: so... i found an issue | 21:22 |
| notmorgan | dstanek: python 2: urllib.parse.parse_qs returns a dict with text-type keys | 21:23 |
| *** dave-mccowan has quit IRC | 21:23 | |
| notmorgan | dstanek: python 3: urllib.parse.parse_qs returns a dict with byte-string type keys | 21:23 |
| notmorgan | erm, sorry both are byte string | 21:23 |
| notmorgan | but in py3 dict[b'key'] != dict['key'] | 21:23 |
| *** darosale has quit IRC | 21:24 | |
| dstanek | notmorgan: really? | 21:24 |
| notmorgan | dstanek: yep | 21:24 |
| dstanek | we can just use bytes to look into the dict right? | 21:25 |
| notmorgan | we can.. but... | 21:25 |
| notmorgan | i mean.. really? | 21:25 |
| dstanek | it's a pain, but it makes sense | 21:25 |
| notmorgan | {'test': 'omg2', b'test': 'omg'} | 21:25 |
| notmorgan | that is ... silly | 21:25 |
| notmorgan | sure it makes sense but... SILLY | 21:25 |
| dstanek | notmorgan: you just have to strategically add some 'b's :-P | 21:26 |
| notmorgan | i can fix our tests... | 21:26 |
| notmorgan | it might actually be an issue with our tests | 21:26 |
| notmorgan | but... ugh. | 21:26 |
| dstanek | it's the price you pay to be awesome | 21:28 |
| *** woodburn has quit IRC | 21:28 | |
| *** rderose has quit IRC | 21:30 | |
| *** doug-fish has quit IRC | 21:30 | |
| *** gagehugo has quit IRC | 21:32 | |
| *** BjoernT is now known as Bjoern_zZzZzZzZ | 21:33 | |
| *** edtubill has quit IRC | 21:33 | |
| *** Bjoern_zZzZzZzZ is now known as BjoernT | 21:46 | |
| *** rderose has joined #openstack-keystone | 21:47 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Enable py3 testing for Fernet token provider https://review.openstack.org/318349 | 21:49 |
| notmorgan | dstanek: 2/4 | 21:50 |
| *** diazjf has quit IRC | 21:50 | |
| *** markvoelker has joined #openstack-keystone | 21:51 | |
| notmorgan | stevemar: lets make uwsgi job voting now? | 21:52 |
| *** markvoelker has quit IRC | 21:52 | |
| *** markvoelker has joined #openstack-keystone | 21:53 | |
| *** phalmos has quit IRC | 21:54 | |
| *** gtop-323 has quit IRC | 21:55 | |
| *** ozialien10 has joined #openstack-keystone | 22:03 | |
| *** julim has quit IRC | 22:04 | |
| *** henrynash has joined #openstack-keystone | 22:14 | |
| *** ChanServ sets mode: +v henrynash | 22:14 | |
| hoonetorg | raildo-afk: openstack user list always gives me You are not authorized to perform the requested action: identity:list_users | 22:20 |
| *** ngupta_ has quit IRC | 22:21 | |
| *** harlowja has quit IRC | 22:22 | |
| hoonetorg | i tried with domain_id:<id of newly created admin_domain> and user admin_domain which has role admin and is in project admin in domain admin_domain and with domain_id:default, admin user which is role admin and project admin. | 22:22 |
| *** rderose has quit IRC | 22:22 | |
| hoonetorg | no chance | 22:22 |
| hoonetorg | dstanek ^^^ | 22:23 |
| hoonetorg | how to debug??? | 22:23 |
| hoonetorg | policy.json v3 | 22:23 |
| *** gordc has quit IRC | 22:25 | |
| *** timcline has quit IRC | 22:27 | |
| *** ddieterly has joined #openstack-keystone | 22:28 | |
| *** roxanaghe has quit IRC | 22:31 | |
| *** edmondsw has quit IRC | 22:32 | |
| *** roxanaghe has joined #openstack-keystone | 22:34 | |
| *** mvk_ has joined #openstack-keystone | 22:34 | |
| *** ddieterly is now known as ddieterly[away] | 22:41 | |
| *** ninag has quit IRC | 22:45 | |
| *** ninag has joined #openstack-keystone | 22:45 | |
| *** ninag has quit IRC | 22:50 | |
| *** jaosorior has quit IRC | 22:58 | |
| *** jaosorior has joined #openstack-keystone | 22:59 | |
| *** harlowja has joined #openstack-keystone | 23:00 | |
| *** jamielennox is now known as jamielennox|away | 23:04 | |
| *** ddieterly[away] is now known as ddieterly | 23:05 | |
| *** markvoelker_ has joined #openstack-keystone | 23:05 | |
| *** markvoelker_ has quit IRC | 23:05 | |
| *** markvoelker_ has joined #openstack-keystone | 23:06 | |
| *** markvoelker has quit IRC | 23:09 | |
| *** BjoernT has quit IRC | 23:09 | |
| *** ddieterly has quit IRC | 23:12 | |
| notmorgan | dstanek: almost done with test_v3_auth. woo | 23:12 |
| notmorgan | dstanek: oauth1 is going to be the challenging one | 23:12 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Enable py3 for credential tests https://review.openstack.org/318341 | 23:13 |
| *** agrebennikov has quit IRC | 23:14 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Enable py3 testing for Fernet token provider https://review.openstack.org/318349 | 23:14 |
| *** spzala has quit IRC | 23:15 | |
| *** spzala has joined #openstack-keystone | 23:16 | |
| *** spzala has quit IRC | 23:21 | |
| notmorgan | gyee: the totp test code is awful :( | 23:41 |
| notmorgan | gyee: it's so not py3 friendly | 23:42 |
| *** stingaci has quit IRC | 23:43 | |
| gyee | notmorgan, looking | 23:44 |
| notmorgan | gyee: sec. | 23:46 |
| *** stingaci has joined #openstack-keystone | 23:46 | |
| gyee | notmorgan, I thought I've commented on that utf-8 encoding in one of the reviews | 23:47 |
| notmorgan | gyee: http://paste.openstack.org/show/497628/ | 23:47 |
| notmorgan | the code is really opaque and hard to debug. | 23:47 |
| notmorgan | even with pdb | 23:47 |
| notmorgan | gyee: blob = base64.b32encode(uuid.uuid4().hex.encode('utf-8')).decode('utf-8').rstrip('=') this gets us past string type errors | 23:47 |
| notmorgan | and the value is the same on the other end (checked) if your input uuid is the same | 23:48 |
| notmorgan | maybe i need to re-encode again? | 23:48 |
| *** pushkaru has quit IRC | 23:48 | |
| *** pushkaru has joined #openstack-keystone | 23:48 | |
| notmorgan | oh gah. nope. | 23:49 |
| notmorgan | gyee: btw, this is the only issue keeping us from having all but oauth1 tests py3 compat | 23:49 |
| notmorgan | i can publish the current state of changes if that helps | 23:50 |
| *** pushkaru has quit IRC | 23:50 | |
| *** pushkaru has joined #openstack-keystone | 23:51 | |
| *** jamielennox|away is now known as jamielennox | 23:51 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Enable py3 tests for test_v3_auth https://review.openstack.org/318381 | 23:51 |
| notmorgan | gyee: ^ current pass, we need to fix the TOTP test to not fail, and we're good on that | 23:51 |
| gyee | which totp tests failed? | 23:52 |
| notmorgan | sec, getting the list | 23:52 |
| notmorgan | keystone.tests.unit.test_v3_auth.TestAuthTOTP.test_with_username_and_domain_id | 23:52 |
| *** zqfan has quit IRC | 23:53 | |
| notmorgan | keystone.tests.unit.test_v3_auth.TestAuthTOTP.test_with_multiple_users | 23:53 |
| notmorgan | keystone.tests.unit.test_v3_auth.TestAuthTOTP.test_with_multiple_credentials | 23:53 |
| notmorgan | keystone.tests.unit.test_v3_auth.TestAuthTOTP.test_with_an_invalid_passcode_with_no_user_credentials | 23:53 |
| notmorgan | those 4 | 23:53 |
| notmorgan | they pass under py2.7 | 23:53 |
| notmorgan | as is | 23:53 |
| notmorgan | (in that patchset) | 23:53 |
| *** markvoelker has joined #openstack-keystone | 23:53 | |
| *** furface has quit IRC | 23:54 | |
| *** doug-fish has joined #openstack-keystone | 23:54 | |
| *** roxanaghe has quit IRC | 23:54 | |
| gyee | totp creds need to be base32 encoded | 23:54 |
| notmorgan | right. | 23:55 |
| notmorgan | blob = base64.b32encode(uuid.uuid4().hex.encode('utf-8')).decode('utf-8').rstrip('=') | 23:55 |
| *** stingaci has quit IRC | 23:55 | |
| notmorgan | that is b32encoded | 23:55 |
| gyee | yikes | 23:55 |
| gyee | maybe we can use random bytes instead uuid | 23:56 |
| *** pushkaru has quit IRC | 23:56 | |
| gyee | one sec | 23:56 |
| notmorgan | the only difference is the string encode/decode for py3 text vs binary_type things | 23:56 |
| *** pushkaru has joined #openstack-keystone | 23:56 | |
| notmorgan | gyee: tried, smae error | 23:56 |
| notmorgan | i tried uuid.uuid4().bytes | 23:56 |
| notmorgan | still need to decode for rstrip() | 23:56 |
| *** markvoelker_ has quit IRC | 23:56 | |
| notmorgan | but with .bytes the string is wildly different/shorter than with .hex | 23:56 |
| notmorgan | out the other end of b32encode | 23:56 |
| *** diazjf has joined #openstack-keystone | 23:58 | |
| *** doug-fish has quit IRC | 23:58 | |
| gyee | base64.b32encode(os.urandom(20)).decode('utf-8') | 23:58 |
| gyee | notmorgan, ^^^ | 23:58 |
| gyee | that's what I have in my other patch to make it pass py3 | 23:59 |
| notmorgan | ok let me try tht | 23:59 |
| gyee | https://review.openstack.org/#/c/279854/15/openstackclient/tests/identity/v3/test_credential.py | 23:59 |
| patchbot | gyee: patch 279854 - python-openstackclient - Support TOTP credential | 23:59 |
| notmorgan | no rstrip? | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
