| *** clayton has joined #openstack-keystone | 00:00 | |
| *** amakarov has quit IRC | 00:33 | |
| *** shoutm_ has joined #openstack-keystone | 00:34 | |
| *** shoutm has quit IRC | 00:35 | |
| *** amakarov has joined #openstack-keystone | 00:39 | |
| *** shoutm_ has quit IRC | 00:48 | |
| *** shoutm has joined #openstack-keystone | 00:49 | |
| *** edtubill has quit IRC | 00:58 | |
| *** edtubill has joined #openstack-keystone | 00:59 | |
| *** edtubill has quit IRC | 01:03 | |
| *** iurygregory has quit IRC | 01:20 | |
| *** EinstCrazy has joined #openstack-keystone | 01:25 | |
| *** EinstCrazy has quit IRC | 01:29 | |
| *** EinstCrazy has joined #openstack-keystone | 01:30 | |
| openstackgerrit | Alex Xu proposed openstack/oslo.policy: Add note about not all APIs support policy enforcement by user_id https://review.openstack.org/325645 | 01:39 |
|---|---|---|
| *** shoutm has quit IRC | 01:58 | |
| *** chlong has joined #openstack-keystone | 02:04 | |
| *** shoutm has joined #openstack-keystone | 02:04 | |
| *** tqtran has joined #openstack-keystone | 02:16 | |
| *** tqtran has quit IRC | 02:21 | |
| *** shoutm has quit IRC | 02:31 | |
| *** ozialien10 has quit IRC | 02:42 | |
| *** shoutm has joined #openstack-keystone | 02:53 | |
| *** sheel has joined #openstack-keystone | 03:09 | |
| *** jrist has quit IRC | 03:16 | |
| *** jrist has joined #openstack-keystone | 03:30 | |
| *** chlong has quit IRC | 03:34 | |
| *** dave-mccowan has quit IRC | 03:41 | |
| *** chlong has joined #openstack-keystone | 03:51 | |
| *** achatterjee has joined #openstack-keystone | 04:07 | |
| *** amit213 has quit IRC | 04:08 | |
| *** vint_bra has joined #openstack-keystone | 04:23 | |
| *** chlong has quit IRC | 04:26 | |
| *** chlong has joined #openstack-keystone | 04:38 | |
| *** nisha has joined #openstack-keystone | 04:41 | |
| *** jaosorior has joined #openstack-keystone | 04:41 | |
| *** vint_bra has quit IRC | 04:41 | |
| nisha | hey all! | 04:41 |
| *** vint_bra has joined #openstack-keystone | 04:45 | |
| *** vint_bra has quit IRC | 04:56 | |
| *** nisha has quit IRC | 05:03 | |
| *** nisha has joined #openstack-keystone | 05:03 | |
| *** chlong has quit IRC | 05:05 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: clean up test_resource_uuid https://review.openstack.org/281546 | 05:05 |
| notmorgan | stevemar: i expect to have oython-memcached soon | 05:06 |
| stevemar | o/ | 05:06 |
| stevemar | python-memcached soon? | 05:06 |
| notmorgan | will be coordibatibg with sean this week | 05:06 |
| notmorgan | the current maintainer to impprt into our infra | 05:07 |
| notmorgan | and then we have a chunk of options :) | 05:07 |
| *** pcaruana has quit IRC | 05:13 | |
| *** chlong has joined #openstack-keystone | 05:18 | |
| *** chlong has quit IRC | 05:37 | |
| *** GB21 has joined #openstack-keystone | 05:49 | |
| *** TxGVNN has joined #openstack-keystone | 05:55 | |
| *** josecastroleon has joined #openstack-keystone | 05:57 | |
| jamielennox | do we want to have python-memcached? | 06:02 |
| *** openstackgerrit has quit IRC | 06:02 | |
| *** openstackgerrit has joined #openstack-keystone | 06:03 | |
| notmorgan | jamielennox: easier to own it and fix it than convert to oymemcshce etc | 06:05 |
| notmorgan | jamielennox: pymemcache* as the interfaces are very different | 06:05 |
| openstackgerrit | Ryosuke Mizuno proposed openstack/keystone: Add validation rules for create token using a JSON schema https://review.openstack.org/325086 | 06:12 |
| *** tqtran has joined #openstack-keystone | 06:18 | |
| *** tqtran has quit IRC | 06:22 | |
| *** GB21 has quit IRC | 06:25 | |
| *** chlong has joined #openstack-keystone | 06:31 | |
| *** henrynash_ has joined #openstack-keystone | 06:35 | |
| *** ChanServ sets mode: +v henrynash_ | 06:35 | |
| achatterjee | Hi, I am working on liberty, and I observerd the following: in a 4CPU environment, if I set admin_workers=4 in keystone.conf, the number of processes do not increase. mutiple requests sent to keystone is thus handled sequentially, whereas for 4core setup there could be parallel processing. | 06:46 |
| achatterjee | is this a known phenemenon ? or am i missing something here? | 06:46 |
| *** tesseract has joined #openstack-keystone | 06:53 | |
| *** nisha_ has joined #openstack-keystone | 07:04 | |
| *** nisha has quit IRC | 07:05 | |
| *** frontrunner has quit IRC | 07:06 | |
| *** frontrunner has joined #openstack-keystone | 07:07 | |
| *** yolanda has quit IRC | 07:09 | |
| jamielennox | achatterjee: its likely to do with how your deploying, that option works for eventlet deploys (using bin/keystone-all) but if you're on apache or other it won't do anything | 07:11 |
| jamielennox | those servers all have their own ways of controlling the number of processes that get spawned | 07:12 |
| *** yolanda has joined #openstack-keystone | 07:13 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Pass a request to controllers instead of a context https://review.openstack.org/318658 | 07:14 |
| *** pcaruana has joined #openstack-keystone | 07:14 | |
| *** jed56 has joined #openstack-keystone | 07:22 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Use SAML2 requests plugin https://review.openstack.org/255056 | 07:27 |
| *** daemontool has joined #openstack-keystone | 07:31 | |
| *** tesseract has quit IRC | 07:32 | |
| *** tesseract has joined #openstack-keystone | 07:33 | |
| achatterjee | @jamielennox - i'm on apache. In kilo however there were multi threaded processing. I noticed this in liberty only. | 07:35 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Use oslo_cache in auth_token middleware https://review.openstack.org/268664 | 07:43 |
| *** tesseract has quit IRC | 07:46 | |
| *** tesseract has joined #openstack-keystone | 07:46 | |
| jamielennox | achatterjee: so i'm guessing that's when you changed from the keystone-all runner to apache (which might have been done by your distro if you didn't notcie) | 07:52 |
| jamielennox | achatterjee: http://modwsgi.readthedocs.io/en/develop/user-guides/processes-and-threading.html#the-mod-wsgi-daemon-processes | 07:53 |
| jamielennox | so in mod_wsgi you should be using daemon mode and then you set process=X threads=Y in your apache conf | 07:53 |
| jamielennox | similarly if it's uwsgi there's another method | 07:54 |
| jamielennox | just that those values are only read by the old eventlet process started | 07:54 |
| jamielennox | starter | 07:54 |
| *** al_loew has joined #openstack-keystone | 07:56 | |
| *** chlong has quit IRC | 07:56 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** mancdaz has quit IRC | 08:04 | |
| *** mancdaz has joined #openstack-keystone | 08:11 | |
| openstackgerrit | Ryosuke Mizuno proposed openstack/keystone: Add validation rules for create token using a JSON schema https://review.openstack.org/325086 | 08:13 |
| *** nisha__ has joined #openstack-keystone | 08:14 | |
| *** nisha_ has quit IRC | 08:17 | |
| *** dimonv has joined #openstack-keystone | 08:18 | |
| *** nisha__ has quit IRC | 08:20 | |
| *** TxGVNN has quit IRC | 08:22 | |
| *** jaosorior has quit IRC | 08:23 | |
| *** jaosorior has joined #openstack-keystone | 08:23 | |
| *** EinstCra_ has joined #openstack-keystone | 08:33 | |
| *** EinstCrazy has quit IRC | 08:33 | |
| *** shoutm has quit IRC | 08:35 | |
| *** _amrith_ is now known as amrith | 08:37 | |
| *** aloga has quit IRC | 08:40 | |
| *** jaosorior is now known as jaosorior_lunch | 08:48 | |
| *** nisha has joined #openstack-keystone | 08:52 | |
| *** aloga has joined #openstack-keystone | 08:52 | |
| *** mvk has joined #openstack-keystone | 08:54 | |
| *** permalac has joined #openstack-keystone | 09:22 | |
| *** nisha has quit IRC | 09:23 | |
| *** nisha has joined #openstack-keystone | 09:23 | |
| *** pnavarro has joined #openstack-keystone | 09:23 | |
| nisha | hey samueldmq | 09:24 |
| *** pnavarro has quit IRC | 09:34 | |
| *** amrith is now known as _amrith_ | 09:41 | |
| samueldmq | nisha: hi | 09:42 |
| nisha | samueldmq, how was the conference? :) | 09:42 |
| samueldmq | nisha: it was good, thanks | 09:50 |
| samueldmq | nisha: hope you had a nice weekend too | 09:50 |
| nisha | yeah, my summer vacations started, so I travelled and came home | 09:51 |
| nisha | samueldmq, I was going through the user functional tests you worked on, https://review.openstack.org/#/c/289306/ | 09:52 |
| patchbot | nisha: patch 289306 - python-keystoneclient - Add users functional tests | 09:52 |
| *** jaosorior_lunch is now known as jaosorior | 09:52 | |
| samueldmq | nisha: so, from there you can basically know what the tests would look like for other entities too | 09:53 |
| samueldmq | nisha: tests are simple, create and check the entity, retrieve and check, etc | 09:54 |
| nisha | samueldmq, alright | 09:55 |
| *** daemontool has quit IRC | 09:59 | |
| *** pnavarro has joined #openstack-keystone | 10:26 | |
| openstackgerrit | Merged openstack/keystone: Adding role assignment lists unit tests https://review.openstack.org/254436 | 10:32 |
| *** al_loew has quit IRC | 10:35 | |
| nisha | samueldmq, Sir I was looking at keystoneclient/tests/functional/v3/test_users.py to see the tests. You told me once that they test this https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/users.py | 10:40 |
| nisha | samueldmq, I am not able to understand the functions, written in test_user.py e.g. check_user | 10:42 |
| nisha | How are these functions used and what for, assertIsNotNone or assertIn ? | 10:43 |
| *** chlong has joined #openstack-keystone | 10:44 | |
| nisha | Can you please explain a bit or point a documentation that I can go through? | 10:44 |
| *** daemontool has joined #openstack-keystone | 10:47 | |
| samueldmq | nisha: those functions are used for testing .. see https://docs.python.org/2.7/library/unittest.html | 10:55 |
| samueldmq | nisha: assertIsNotNone asserts an object is not None type in python, otherwise it fails | 10:55 |
| samueldmq | nisha: assertIn asserts an object is included in a list, failing otherwise | 10:55 |
| *** nisha_ has joined #openstack-keystone | 11:01 | |
| *** nisha has quit IRC | 11:01 | |
| *** nisha_ has quit IRC | 11:03 | |
| *** nisha_ has joined #openstack-keystone | 11:08 | |
| *** nisha_ is now known as nisha | 11:10 | |
| nisha | samueldmq, thank you, reading the doc | 11:12 |
| *** henrynash_ has quit IRC | 11:16 | |
| samueldmq | nisha: it may useful for you to create a few tests using that library's method | 11:23 |
| samueldmq | methods/functions | 11:24 |
| samueldmq | nisha: just to get familiar with it | 11:24 |
| *** iurygregory has joined #openstack-keystone | 11:29 | |
| *** TxGVNN has joined #openstack-keystone | 11:33 | |
| *** dave-mccowan has joined #openstack-keystone | 11:46 | |
| *** pauloewerton has joined #openstack-keystone | 11:47 | |
| *** _amrith_ is now known as amrith | 12:01 | |
| *** markvoelker has joined #openstack-keystone | 12:01 | |
| *** julim has joined #openstack-keystone | 12:37 | |
| *** rodrigods has quit IRC | 12:38 | |
| *** rodrigods has joined #openstack-keystone | 12:38 | |
| *** afred312 has quit IRC | 12:41 | |
| *** afred312 has joined #openstack-keystone | 12:42 | |
| *** afred312 has quit IRC | 12:42 | |
| *** rcernin has joined #openstack-keystone | 12:58 | |
| *** rcernin has quit IRC | 12:59 | |
| *** EinstCra_ has quit IRC | 13:02 | |
| *** nisha has quit IRC | 13:04 | |
| *** nisha has joined #openstack-keystone | 13:05 | |
| *** ayoung has joined #openstack-keystone | 13:07 | |
| *** ChanServ sets mode: +v ayoung | 13:07 | |
| *** TxGVNN has quit IRC | 13:07 | |
| *** setuid has joined #openstack-keystone | 13:16 | |
| *** afred312 has joined #openstack-keystone | 13:18 | |
| *** edmondsw has joined #openstack-keystone | 13:26 | |
| *** henrynash_ has joined #openstack-keystone | 13:27 | |
| *** ChanServ sets mode: +v henrynash_ | 13:27 | |
| *** roxanaghe has joined #openstack-keystone | 13:32 | |
| *** roxanaghe has quit IRC | 13:32 | |
| *** agrebennikov has joined #openstack-keystone | 13:36 | |
| *** anteaya has joined #openstack-keystone | 13:38 | |
| *** agrebennikov has quit IRC | 13:41 | |
| *** aurelien__ has joined #openstack-keystone | 13:42 | |
| *** dmk0202 has joined #openstack-keystone | 13:44 | |
| *** aurelien__ has quit IRC | 13:49 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 13:50 |
| *** sdake has joined #openstack-keystone | 13:51 | |
| *** permalac has quit IRC | 13:54 | |
| *** julim has quit IRC | 13:55 | |
| *** sdake_ has joined #openstack-keystone | 13:56 | |
| *** julim has joined #openstack-keystone | 13:57 | |
| *** ametts has joined #openstack-keystone | 13:57 | |
| samueldmq | keystone cores, the rest of migrating from migrating api-ref to our own repo is up to review | 13:58 |
| samueldmq | https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:migrate-identity-api-ref | 13:58 |
| *** sdake has quit IRC | 13:58 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements https://review.openstack.org/320156 | 14:00 |
| *** BjoernT has joined #openstack-keystone | 14:01 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:01 | |
| *** gordc has joined #openstack-keystone | 14:01 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 14:02 |
| *** fundcor has left #openstack-keystone | 14:03 | |
| *** fawadkhaliq has joined #openstack-keystone | 14:05 | |
| *** rderose has joined #openstack-keystone | 14:07 | |
| *** yolanda has quit IRC | 14:10 | |
| *** yolanda has joined #openstack-keystone | 14:10 | |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add equality operator to policy.RuleDefault https://review.openstack.org/321242 | 14:13 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add helper scripts for generating policy info https://review.openstack.org/321243 | 14:13 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add sample file generation script and helper methods https://review.openstack.org/314244 | 14:13 |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: Honor ldap_filter on filtered group list https://review.openstack.org/325939 | 14:17 |
| *** dan_nguyen has joined #openstack-keystone | 14:18 | |
| *** richm has joined #openstack-keystone | 14:29 | |
| *** raddaoui has joined #openstack-keystone | 14:30 | |
| *** permalac has joined #openstack-keystone | 14:33 | |
| henrynash | ayoung, lbragstad: hi | 14:35 |
| *** rk4n has joined #openstack-keystone | 14:35 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements https://review.openstack.org/320156 | 14:36 |
| ayoung | henrynash, so...I think you have enough feedback from monty and notmorgan to go with, right? | 14:38 |
| henrynash_ | ayoung: yep, agreed | 14:39 |
| henrynash_ | ayoung: sperate subject | 14:39 |
| ayoung | I couldn't quite parse the final steps of the conversation, but it sounded like they were firm on one of the approaches...can you summarize which? | 14:39 |
| ayoung | Ajh..OK, go on | 14:39 |
| *** edtubill has joined #openstack-keystone | 14:40 | |
| henrynash_ | ayoung: do you think there is mileage on having an option to (effectively) have a cache on whether a fernet token has been revoked….i.e. so if a deploye was OK with fernet tokens taking, say 300s to expire afte revokation, then we could improve performacne? | 14:40 |
| ayoung | henrynash_, I suspect that we are going to have that with Galera and multisite anyway | 14:41 |
| *** GB21 has joined #openstack-keystone | 14:41 | |
| henrynash_ | ayoung: do you mean that we will need it…or that somehowwe get that for free? | 14:41 |
| ayoung | henrynash_, I mean that somehow we will get bug reports on it working that way when people don't realize that revocations are DB replicated | 14:42 |
| henrynash_ | ayoung: ah, I’m with you! | 14:42 |
| ayoung | henrynash_, revocations are dumb | 14:42 |
| ayoung | I really don't want to spend my adult years this way | 14:43 |
| henrynash_ | ayoung: trying to see how we can shave down the cost of a fernet validation | 14:43 |
| ayoung | I'd rather be | 14:43 |
| ayoung | a lumberjack | 14:43 |
| henrynash_ | ayoung: (now, we’re talking) | 14:43 |
| henrynash_ | (or singing) | 14:43 |
| *** josecastroleon has quit IRC | 14:44 | |
| ayoung | Leaping from tree to tree as they float down the mighty rivers of British Columbia | 14:44 |
| *** d0ugal has quit IRC | 14:44 | |
| ayoung | The giant redwood, the larch, the fir, the mighty scots pine. | 14:44 |
| henrynash_ | ayoung: :-) | 14:44 |
| ayoung | anyway | 14:44 |
| *** sdake_ has quit IRC | 14:45 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Add failed auth attempts logic to meet PCI-DSS https://review.openstack.org/324029 | 14:46 |
| *** dan_nguyen has quit IRC | 14:47 | |
| *** vint_bra has joined #openstack-keystone | 14:48 | |
| lbragstad | dolphm chain starts here - https://review.openstack.org/#/c/325514/ | 14:48 |
| patchbot | lbragstad: patch 325514 - keystone - Add caching config for federation | 14:48 |
| *** fawadkhaliq has quit IRC | 14:49 | |
| *** permalac has quit IRC | 14:52 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: Devstack plugin for Federation https://review.openstack.org/320623 | 14:54 |
| *** timcline has joined #openstack-keystone | 14:54 | |
| *** TxGVNN has joined #openstack-keystone | 14:54 | |
| knikolla | breton: ^^ | 14:55 |
| *** gagehugo has joined #openstack-keystone | 14:58 | |
| *** mvk has quit IRC | 14:59 | |
| *** josecastroleon has joined #openstack-keystone | 15:04 | |
| *** dmk0202 has quit IRC | 15:05 | |
| *** nisha_ has joined #openstack-keystone | 15:06 | |
| breton | knikolla: thank you | 15:06 |
| breton | knikolla: $mapping_file=$KEYSTONE_PLUGIN_FILES/mapping-k2k.json | 15:06 |
| breton | knikolla: does it work? :) i think the $ in the beginning should not be there. | 15:06 |
| knikolla | breton: oops, you are right! | 15:07 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: Devstack plugin for Federation https://review.openstack.org/320623 | 15:08 |
| knikolla | breton: fixed. i haven't tried it yet though. | 15:09 |
| knikolla | breton: will try now. | 15:09 |
| *** nisha has quit IRC | 15:09 | |
| *** KevinE has joined #openstack-keystone | 15:11 | |
| *** nisha_ is now known as nisha | 15:15 | |
| *** dgonzalez has quit IRC | 15:17 | |
| *** dgonzalez has joined #openstack-keystone | 15:19 | |
| *** diazjf has joined #openstack-keystone | 15:19 | |
| *** tonytan4ever has joined #openstack-keystone | 15:19 | |
| henrynash_ | lbragstad: hi | 15:22 |
| lbragstad | henrynash_ hey | 15:22 |
| henrynash_ | lbragstad: so I’m also looking at token validation performance... | 15:23 |
| henrynash_ | lbragstad: what’s you view on where the time is going, that makes us so much slower than UUID to validate…. | 15:23 |
| lbragstad | henrynash_ I think it's because we rebuild everything on the fly with Fernet tokens (because things aren't persisted anywhere) | 15:24 |
| lbragstad | where as with UUID tokens, it just a database read | 15:24 |
| lbragstad | and we regurgitate whatever is stored in the database back to the user | 15:24 |
| henrynash_ | lbragstad: agreed….do you have a feeling on whether it’s just reading the data (which by now I’d hope most is cached)….or the revokation check? | 15:25 |
| lbragstad | henrynash_ as of last release - we have be adding a lot of patches for caching | 15:25 |
| lbragstad | like role assignments, catalog, etc... | 15:25 |
| henrynash_ | lbragstad: yep, noticed that | 15:26 |
| lbragstad | which should be making everything faster | 15:26 |
| lbragstad | so I think the next logical thing to start investigating would be the revocation events | 15:26 |
| lbragstad | since that gets rebuilt and compared to every Fernet token that is validated | 15:26 |
| henrynash_ | lbragstad: I wonderd about the idea of just chaching the token reponse, and giving the option for a deployer to say whether it’s Ok to have invlaidted tokens only expire after the cache timesout | 15:27 |
| *** spzala has joined #openstack-keystone | 15:27 | |
| henrynash_ | lbragstad: for many cases, maybe that’s ok? | 15:27 |
| lbragstad | henrynash_ don't we already do that with token caching? | 15:27 |
| henrynash_ | lbragstad: I couldn’t see that we do that for fernet | 15:27 |
| henrynash_ | lbragstad: we do, I think, for UUID | 15:28 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L315 | 15:28 |
| henrynash_ | llbragstda: but does that actually get called for fernet? | 15:28 |
| lbragstad | henrynash_ _validate_token() does for sure - https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L290 | 15:29 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L295-L298 | 15:29 |
| *** rk4n_ has joined #openstack-keystone | 15:30 | |
| henrynash_ | …exactly, so doesn’t that mean we DON’T call validate_v3_token | 15:31 |
| lbragstad | henrynash_ only if we've already cached a fernet token, right? | 15:32 |
| henrynash_ | lbragstad: ah, right | 15:32 |
| henrynash_ | lbragstad…but isn’t teh sequence: Controller calles valide_v3_token, which calls validate_non_persistent_token? | 15:33 |
| *** rk4n has quit IRC | 15:33 | |
| *** josecastroleon has quit IRC | 15:34 | |
| henrynash_ | lbragstad: ..and we never get to _validate_tolen() | 15:35 |
| *** dan_nguyen has joined #openstack-keystone | 15:35 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Improve documentation for auth_uri https://review.openstack.org/310290 | 15:35 |
| zigo | Has keystone removed its capability to run as a standalone server? | 15:35 |
| zigo | Does it requires Apache now? | 15:35 |
| lbragstad | we call _validate_non_persistent_token with validate_v3_token, validate_v2_token and _validate_token | 15:35 |
| zigo | (ie: in Newton b1) | 15:35 |
| lbragstad | henrynash_ i think part of that problem is that we have different parts of keystone that enter into the token provider at different places | 15:36 |
| henrynash_ | lbragstad: agreed…It’s hellishly confusing! | 15:37 |
| lbragstad | yes - it is | 15:37 |
| dstanek | zigo: is doesn't technically require Apache, just a WSGI server - Apache is the recommended one | 15:37 |
| lbragstad | henrynash i think one good step forward that would help with understanding/consolidating the problem would be to make a single entry point into the token provider module | 15:37 |
| zigo | dstanek: Ok, well just wanted to know, as I'm packaging Newton b1. | 15:38 |
| henrynash_ | lbragstad: but it does appear to me that the /auth/tokens validation DOESN’T call _validate_token for non-persistance token formats…hence no caching | 15:38 |
| lbragstad | right now the token_provider_api has validate_v2_token, validate_v3_token (which are pretty straight-forward), but we also have a validate_token() method | 15:38 |
| lbragstad | henrynash auth/tokens/ ? | 15:39 |
| *** d0ugal has joined #openstack-keystone | 15:39 | |
| lbragstad | henrynash do you mean from the auth controller? | 15:39 |
| henrynash_ | lbragdstad: the auth controller calls token_provider_api.validate_v3_token to validate a v3 token | 15:40 |
| lbragstad | henrynash https://github.com/openstack/keystone/blob/master/keystone/auth/controllers.py#L560 | 15:40 |
| lbragstad | yep | 15:40 |
| lbragstad | henrynash which calls - https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L267 | 15:40 |
| bknudson | zigo: you can use uwsgi or gunicorn to run keystone standalone | 15:40 |
| zigo | bknudson: Yeah, that's what I'm about to do. | 15:40 |
| zigo | bknudson: I hate using a web server, that's IMO a very bad way to do things. | 15:41 |
| henrynash_ | yep…which for non-persistant tokns bypasses _validate_token | 15:41 |
| zigo | bknudson: Simply because then, when adding / removing / reconfigure an unrelated service, then you got to restart them all. | 15:41 |
| bknudson | zigo: for devstack we'll likely switch to apache forwarding to uwsgi | 15:41 |
| henrynash_ | line 277 | 15:41 |
| lbragstad | henrynash yes | 15:41 |
| lbragstad | henrynash i see what you mean | 15:41 |
| zigo | bknudson: The only issue is that uwsgi is *very* badly maintained in Debian. :( | 15:42 |
| bknudson | zigo: actually, we already have a devstack setup that does apache forwarding to uswsgi, just tuning it now. | 15:42 |
| lbragstad | henrynash we should change /auth/controllers.py to call - https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L204 | 15:42 |
| notmorgan | bknudson: gunicorn does not work atm | 15:42 |
| bknudson | to get rid of the port. | 15:42 |
| zigo | Cool. | 15:42 |
| bknudson | notmorgan: what's wrong with gunicorn? | 15:42 |
| bknudson | eventlet? | 15:43 |
| notmorgan | oslo config conflicts with its options | 15:43 |
| bknudson | that's weird. | 15:43 |
| notmorgan | pytjon argparse | 15:44 |
| henrynash_ | lbragstad: I don’t think so, firts list is to generate an ID ! | 15:44 |
| henrynash_ | lbragstad: actually, not sure what that does | 15:44 |
| notmorgan | we need to remove.cli options for keystone or somehow fix oslo.config | 15:44 |
| notmorgan | but gunicorn gets real cranky | 15:45 |
| *** pnavarro has quit IRC | 15:45 | |
| lbragstad | henrynash_ | 15:46 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/token/utils.py#L17 | 15:46 |
| henrynash_ | lbragstad: which seems irreleavnt for fernet! | 15:46 |
| notmorgan | it was the main reason i puahed for uwsgi instead of gunicorn | 15:46 |
| *** gyee has joined #openstack-keystone | 15:46 | |
| *** ChanServ sets mode: +v gyee | 15:46 | |
| *** TxGVNN has quit IRC | 15:47 | |
| notmorgan | since we had to maintain eventlet support and cli options | 15:47 |
| *** TxGVNN has joined #openstack-keystone | 15:47 | |
| bknudson | I don't know how you pass CLI options to uwsgi. | 15:47 |
| *** KevinE has quit IRC | 15:47 | |
| bknudson | I didn't think you could | 15:47 |
| henrynash_ | lbragstad: ok, so at least we agree there is a problem here….I’ll investigate further…. | 15:48 |
| lbragstad | henrynash_ yeah - that seems like it's PKI specific | 15:48 |
| bknudson | you can do it running keystone-admin / public scripts now. | 15:48 |
| lbragstad | henrynash_ one thing we do know is that token caching doesn't seem to be working for Fernet + v3 | 15:48 |
| lbragstad | henrynash_ right? | 15:48 |
| henrynash_ | lbragstad: yep | 15:49 |
| lbragstad | henrynash_ can we open a bug against that? | 15:49 |
| bknudson | we're not caching fernet tokens, though? | 15:49 |
| *** josecastroleon has joined #openstack-keystone | 15:49 | |
| bknudson | just the data that fernet uses (like role assignments) | 15:49 |
| henrynash_ | lbragstad, bknudson: correct | 15:49 |
| bknudson | or did you want to actually cache token_id -> data? | 15:49 |
| lbragstad | well we have @MEMOIZE wrapping a bunch of the validate token methods in the token_provider_api | 15:50 |
| bknudson | did we cache uuid tokens like this? | 15:50 |
| henrynash_ | bknudson: but it occured to me that if we did actualy cached of teh ID (like we do for other token types), then we wouldn;t do all teh revolation checking, etc. | 15:50 |
| zigo | What's the launchpad package for os-api-ref ? | 15:50 |
| henrynash_ | bknudson: I think so, yes... | 15:50 |
| zigo | Keystone needs it, but it contains a compressed/minified javascript of bootstrap 3.2.0 ... | 15:51 |
| zigo | (ie: that's non-free in debian's world...) | 15:51 |
| lbragstad | henrynash_ the revocation checking is unrelated to the actual caching of the token - right? | 15:51 |
| henrynash_ | bknudson: I walked through teh code today, and it appears we DO cache tokens that are persistent, but not those that are non-persistent !! | 15:51 |
| bknudson | we'd still need to check for revocations, although should be easy to invalidate the cache for a token that's revoked. | 15:51 |
| *** KevinE has joined #openstack-keystone | 15:52 | |
| lbragstad | bknudson yeah | 15:52 |
| bknudson | seems like you wouldn't want to cache tokens just due to the size... memcache line is only so long. | 15:52 |
| henrynash_ | lbragstad: except I was wondering if we provdied an option to allow a deployer to say that it was OK for revoked tokens to life for no more than the cache lifetime, we could (effectively) cache that answer too | 15:52 |
| lbragstad | bknudson but we cache a bunch of other things - like role assignments, catalogs, etc... and we invalidate those | 15:52 |
| henrynash_ | bknudson: and if that’s true, then even what I suggest isn’t requried | 15:53 |
| lbragstad | the revocation event problem isn't related to caching stuff I don't think . | 15:53 |
| dstanek | zigo: why does keysotne need that? | 15:54 |
| lbragstad | the reason being is because the revocation event is the only way we can tell if a token has been revoked in certain cases. | 15:54 |
| henrynash_ | llbragstad: bit we search for revokation events as part of validation, no | 15:54 |
| henrynash_ | ? | 15:54 |
| lbragstad | since we have no persistent record of the token | 15:54 |
| lbragstad | henrynash_ right | 15:54 |
| lbragstad | henrynash_ so if someone is caching fernet tokens, they wouldn't be validating against the revocation events (I'd have to double check that code path though) | 15:55 |
| henrynash_ | lbragstad: so what if we cached the (boolean) answerto that | 15:55 |
| bknudson | I think the default is 1MB for the item size -- "Override the default size of each slab page. Default is 1mb." | 15:55 |
| bknudson | so that should be big enough for a token | 15:55 |
| *** sdake has joined #openstack-keystone | 15:56 | |
| zigo | dstanek: For its sphinx doc. | 15:56 |
| henrynash_ | lbragstad: basically that’s what I’m trying to get us to….If I have a fernet token and use it 1000 times, then most of the time I don’t the to hit the DB | 15:56 |
| KevinE | boris-42: Hello! Has agrebennikov had a chance to speak to you about the Rally/keystone bug we have been trying to figure out? | 15:57 |
| bknudson | henrynash_: since all the data to rebuild the fernet token is cached then it won't hit the db | 15:57 |
| lbragstad | henrynash_ after the first validation you shouldn't hit the db | 15:57 |
| bknudson | it'll hit the cache a few times. | 15:57 |
| dstanek | zigo: to generate the docs? i'm not familiar with that as a dependency | 15:57 |
| henrynash_ | bknudson: if that were true, agreed… | 15:57 |
| zigo | dstanek: $ grep os-api-ref test-requirements.txt | 15:58 |
| zigo | os-api-ref>=0.1.0 # Apache-2.0 | 15:58 |
| zigo | dstanek: Or maybe I can just skip it? | 15:58 |
| *** dmk0202 has joined #openstack-keystone | 15:58 | |
| henrynash_ | bknudson, lbragstad: as an aside, I also notcied that we don’t pass down whether to include the catalog from the controller for validation…we also return it tehn strip it out at the controller | 15:59 |
| henrynash_ | …if it is not required | 15:59 |
| bknudson | I'm not sure if anyone is even using the option to include catalog anywhere. | 15:59 |
| lbragstad | henrynash_ i go back and forth on that | 15:59 |
| dstanek | zigo: do you need to package all the test requirements when you package keystone? | 16:00 |
| henrynash_ | bknudson: you mean the option to not include it? | 16:00 |
| bknudson | when checking x-auth-token there's no need to get the catalog since keystone doesn't care. | 16:00 |
| *** dimonv has quit IRC | 16:00 | |
| dolphm | nonameentername: is this a transient failure? http://logs.openstack.org/periodic-stable/periodic-keystone-python27-db-mitaka/a445f52/console.html#_2016-06-02_06_15_19_205 | 16:00 |
| zigo | dstanek: Everything that is used in unit tests, yes, so I can run unit tests at build time, and everything which is used to run sphinx-build, so I can package the doc. | 16:00 |
| bknudson | henrynash_: yes, I wonder if anyone is setting that option on the validate request. | 16:00 |
| zigo | dstanek: It's like that for *all* packages I do. | 16:00 |
| bknudson | you can configure it in auth_token middleware... not sure if you can set it on the session even? | 16:01 |
| zigo | I don't *have* to, but like this, we find lots and lots of issues before actually trying the software. | 16:01 |
| lbragstad | henrynash_ I think that the controller layer or core layer should be handling the "should this data look like v2 or v3?" question and the token provider should just provide that data. It's interface should be issue_token(), validate_token() and revoke_token() | 16:01 |
| bknudson | lbragstad: the tricky part is the catalog is so different from v2 to v3. | 16:01 |
| lbragstad | bknudson right | 16:02 |
| lbragstad | right now all of the logic that figures out how the catalog looks lives in the token provider | 16:02 |
| lbragstad | and it's kind of confusing because there are edge cases everywhere | 16:02 |
| bknudson | solvable but it'll take some time. | 16:03 |
| lbragstad | right - it's a huge refactor | 16:03 |
| lbragstad | one that would probably be easier with only one token providers supported | 16:03 |
| lbragstad | provider* | 16:03 |
| bknudson | should be able to change the controller to only request v3 tokens | 16:04 |
| bknudson | then do the translation | 16:04 |
| bknudson | then can remove the v2 code from the providers | 16:04 |
| bknudson | but I think that the v3 response is missing data that v2 needs so that would have to be changed, too. | 16:05 |
| lbragstad | the auth controllers should be in charge of making the token data look a certain way | 16:05 |
| henrynash_ | lbragstad: agreed | 16:05 |
| lbragstad | if the v3 auth controller gets a token ID, then i should be able to pass that to the token_provider_api, which just passes back a token object... then the auth controller should just format it's response in a way that makes sense for v3 | 16:06 |
| *** dmk0202 has quit IRC | 16:06 | |
| lbragstad | that would remove all the v3 and v2 logic and edge cases from the token provider paths | 16:06 |
| lbragstad | and keep them in the controllers, where they are explicit | 16:07 |
| *** ddieterly has joined #openstack-keystone | 16:08 | |
| lbragstad | and as an added benefit - when a particular token version goes away, all the logic for it goes with it | 16:08 |
| *** jaugustine has joined #openstack-keystone | 16:10 | |
| *** lamt_ has joined #openstack-keystone | 16:12 | |
| lbragstad | henrynash_ bknudson so - where do we want to start? ;) | 16:12 |
| henrynash_ | lbragstad: so I think the need is presssing for us to at least achieve the “validate a fernet token should have all its DB accesses cached” | 16:13 |
| henrynash_ | lbragstad: and many are now covered | 16:14 |
| henrynash_ | lbragstad: (e.g. role assignemnets) | 16:14 |
| lbragstad | henrynash_ I have two patches that need to land to help with that | 16:14 |
| lbragstad | henrynash_ https://review.openstack.org/#/c/325514/1 | 16:14 |
| patchbot | lbragstad: patch 325514 - keystone - Add caching config for federation | 16:14 |
| henrynash_ | lbragstad: if we can achieve that (which might be worth back porting to Mitaka, ideall), then we can yhink about refactoring | 16:15 |
| henrynash_ | lbragstad: you added a catalog chache already, right? | 16:16 |
| lbragstad | henrynash_ yeah - and a role assignment cache | 16:16 |
| lbragstad | we merged both of those at the last keystone midcycle | 16:16 |
| henrynash_ | lbragstad: cool | 16:16 |
| henrynash_ | lbragstad: are you able to get performance numbers on these changes…I saw you did post some with a few of these patche | 16:17 |
| henrynash_ | patches | 16:17 |
| lbragstad | henrynash_ I need to recollect numbers | 16:17 |
| lbragstad | henrynash_ i also asked for some input on the mailing list last week | 16:18 |
| lbragstad | http://lists.openstack.org/pipermail/openstack-dev/2016-June/096593.html | 16:18 |
| henrynash_ | lbragstad: I remember that UUID validations were around 5ms….I dont see why we shouldn’t be able to get to teh same thing… | 16:18 |
| lbragstad | henrynash_ i would like to try and find a way performance test patches before we merge them | 16:18 |
| henrynash_ | lbragsatd: agreed….I fully support that | 16:19 |
| lbragstad | but we need to have a performance test environment that isn't susceptible to noisy neighbors | 16:19 |
| *** TxGVNN has quit IRC | 16:19 | |
| lbragstad | and it needs to be recreateable | 16:19 |
| lbragstad | so - last friday I started working on using openstack/ansible to deploy stand-alone keystone | 16:19 |
| lbragstad | and start writing a basic set of performance tests (token create and token validate) | 16:20 |
| *** josecastroleon has quit IRC | 16:20 | |
| lbragstad | run the tests against master - then run the tests against keystone built with the patch under review | 16:20 |
| lbragstad | then publish the results to gerrit as a comment on the patch | 16:20 |
| bknudson | openstack/ansible doesn't support standalone keystone? | 16:20 |
| henrynash_ | lbragstad: cool | 16:21 |
| lbragstad | bknudson openstack/ansible has an os_keystone role that is isolated from the rest of the ansible bits for standing up the rest of the openstack services | 16:21 |
| *** tqtran has joined #openstack-keystone | 16:21 | |
| lbragstad | but you have to provide it a certain set of variable in order to get it to stand up by itself | 16:21 |
| lbragstad | https://github.com/openstack/openstack-ansible-os_keystone | 16:22 |
| *** ddieterly is now known as ddieterly[away] | 16:22 | |
| *** josecastroleon has joined #openstack-keystone | 16:23 | |
| *** jaosorior has quit IRC | 16:23 | |
| *** ddieterly[away] is now known as ddieterly | 16:23 | |
| *** ddieterly is now known as ddieterly[away] | 16:23 | |
| *** jaosorior has joined #openstack-keystone | 16:24 | |
| bknudson | openstack/ansible should switch to uwsgi. | 16:24 |
| *** ddieterly[away] is now known as ddieterly | 16:25 | |
| *** tqtran has quit IRC | 16:25 | |
| *** rk4n has joined #openstack-keystone | 16:26 | |
| bknudson | why have keystone_pip_packages config option? keystone has requirements.txt. | 16:26 |
| *** woodster_ has joined #openstack-keystone | 16:26 | |
| *** rk4n_ has quit IRC | 16:28 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 16:29 |
| *** tesseract has quit IRC | 16:33 | |
| *** pcaruana has quit IRC | 16:34 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Drop EPHEMERAL user type https://review.openstack.org/296639 | 16:37 |
| *** tonytan4ever has quit IRC | 16:49 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 16:52 |
| notmorgan | bknudson: dunno | 16:52 |
| *** josecastroleon has quit IRC | 16:52 | |
| *** diazjf has quit IRC | 16:57 | |
| *** GB21 has quit IRC | 17:03 | |
| *** nisha_ has joined #openstack-keystone | 17:05 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/323602 | 17:06 |
| *** nisha_ has quit IRC | 17:07 | |
| *** nisha has quit IRC | 17:09 | |
| *** josecastroleon has joined #openstack-keystone | 17:12 | |
| *** nisha has joined #openstack-keystone | 17:14 | |
| *** ddieterly is now known as ddieterly[away] | 17:19 | |
| *** jaosorior has quit IRC | 17:20 | |
| *** setuid has left #openstack-keystone | 17:21 | |
| *** catintheroof has joined #openstack-keystone | 17:25 | |
| *** roxanaghe has joined #openstack-keystone | 17:26 | |
| *** rderose has quit IRC | 17:28 | |
| *** josecastroleon has quit IRC | 17:42 | |
| *** tqtran has joined #openstack-keystone | 17:43 | |
| *** browne has joined #openstack-keystone | 17:43 | |
| *** daemontool has quit IRC | 17:44 | |
| KevinE | what is lxml? I see that keystone uses it. I'm trying to add scenarios in rally and I try to import lxml but it says it can't find the module | 17:46 |
| *** harlowja has joined #openstack-keystone | 17:48 | |
| *** daemontool has joined #openstack-keystone | 17:48 | |
| bknudson | KevinE: https://www.google.com/webhp?sourceid=chrome-instant&ion=1&espv=2&ie=UTF-8#q=lxml | 17:49 |
| *** sdake_ has joined #openstack-keystone | 17:49 | |
| *** sdake has quit IRC | 17:49 | |
| *** rderose has joined #openstack-keystone | 17:51 | |
| *** lhcheng has joined #openstack-keystone | 17:52 | |
| *** ChanServ sets mode: +v lhcheng | 17:52 | |
| KevinE | wow | 17:52 |
| *** tqtran has quit IRC | 17:52 | |
| *** josecastroleon has joined #openstack-keystone | 17:53 | |
| samueldmq | KevinE: hi, are you trying to add code to rally repo ? | 17:53 |
| KevinE | samueldmq: yes I am. I realized that the repo I pulled from for testing doesn't include lxml in test-requirements for some reason | 17:54 |
| *** daemontool has quit IRC | 17:54 | |
| *** daemontool has joined #openstack-keystone | 17:55 | |
| samueldmq | KevinE: so you should add it to rally test-requirements.txt | 17:55 |
| dstanek | KevinE: likely rally doesn't need to parse XML | 17:55 |
| KevinE | dstanek: The plugin I file I have here associated with the scenarios I'm to move up import it | 17:56 |
| *** nisha has quit IRC | 17:56 | |
| KevinE | samueldmq: will do! I just need to figure out how to do it locally until I make an upstream commit | 17:57 |
| samueldmq | KevinE: if you really need lxml in your plugin and you're trying to put it upstream | 17:58 |
| samueldmq | KevinE: yes you will need to add lxml to rally/test-requirements.txt | 17:58 |
| samueldmq | KevinE: https://github.com/openstack/rally/blob/master/test-requirements.txt | 17:58 |
| samueldmq | KevinE: after adding, you can recreate your env using -r option to tox command | 17:59 |
| samueldmq | dstanek: ^ makes sense ? | 17:59 |
| *** rderose_ has joined #openstack-keystone | 18:00 | |
| KevinE | samueldmq: awesome thanks, I'll see where this takes me | 18:01 |
| *** sdake_ has quit IRC | 18:01 | |
| samueldmq | KevinE: yw | 18:01 |
| *** rderose has quit IRC | 18:03 | |
| *** julim has quit IRC | 18:04 | |
| *** julim has joined #openstack-keystone | 18:07 | |
| dstanek | samueldmq: yes, you are correct | 18:07 |
| dstanek | KevinE: i assume you need lxml for saml stuff? | 18:07 |
| *** nisha_ has joined #openstack-keystone | 18:08 | |
| *** afred312 has quit IRC | 18:09 | |
| *** diazjf has joined #openstack-keystone | 18:10 | |
| KevinE | dstanek: Description of the file using it says it's a "Module for parsing statistical output from Ganglia *gmond) server. The module opens a socket connection to collect statistical data. It parses the raw data in xml format." | 18:11 |
| nisha_ | samueldmq, what's an Assertion error Exception? I read that the unit test outcome is fail if it doesn't pass it and error, if there was an exception other than this. | 18:13 |
| nisha_ | samueldmq, If I get an Assertion error then, does it mean, tests were written wrongly ? | 18:14 |
| *** ddieterly[away] is now known as ddieterly | 18:14 | |
| samueldmq | nisha_: either the test is wrong, or there's something going wrong with the code under test | 18:15 |
| samueldmq | nisha_: if you test self.assertEqual(4, multiply(2, 2)) | 18:16 |
| samueldmq | nisha_: and that raises an exception, it's likely the function multiply is wrong, someone may have added an error to it (we call that a regression) | 18:17 |
| samueldmq | nisha_: if you were testing self.assertEqual(5, multiply(2, 2)) your test is likely the one wrong there :) | 18:17 |
| nisha_ | samueldmq, so, the former will give an error as output and latter will give fail because of assertion error exception | 18:19 |
| *** daemontool has quit IRC | 18:19 | |
| *** sdake has joined #openstack-keystone | 18:20 | |
| samueldmq | nisha_: yes | 18:21 |
| samueldmq | nisha_: that's what tests are for, you try to break the program :) | 18:21 |
| nisha_ | samueldmq, that was a really nice example. Thanks | 18:21 |
| samueldmq | nisha_: and they will emit an error if someone's bronken it | 18:21 |
| samueldmq | broken | 18:21 |
| samueldmq | nisha_: yw | 18:21 |
| samueldmq | nisha_: keep asking whenever you have questions | 18:22 |
| nisha_ | samueldmq, sure :) | 18:22 |
| *** sdake_ has joined #openstack-keystone | 18:23 | |
| *** josecastroleon has quit IRC | 18:23 | |
| *** sdake has quit IRC | 18:24 | |
| *** rderose_ has quit IRC | 18:26 | |
| *** daemontool has joined #openstack-keystone | 18:27 | |
| *** pcaruana has joined #openstack-keystone | 18:29 | |
| *** josecastroleon has joined #openstack-keystone | 18:38 | |
| *** woodburn has joined #openstack-keystone | 18:42 | |
| *** krotscheck has quit IRC | 18:42 | |
| *** krotscheck_ has joined #openstack-keystone | 18:42 | |
| *** diazjf has quit IRC | 18:43 | |
| *** krotscheck_ is now known as krotscheck | 18:44 | |
| *** diazjf has joined #openstack-keystone | 18:44 | |
| *** jed56 has quit IRC | 18:45 | |
| *** rderose has joined #openstack-keystone | 18:45 | |
| *** afred312 has joined #openstack-keystone | 18:47 | |
| *** BrAsS_mO- is now known as BrAsS_mOnKeY | 18:48 | |
| *** SamYaple has quit IRC | 18:51 | |
| ayoung | rodrigods, I think the issue with federation is this | 18:53 |
| *** frontrunner has quit IRC | 18:53 | |
| ayoung | class Saml2ScopedToken(v3.Token): | 18:53 |
| ayoung | def __init__(self, auth_url, token, **kwargs): | 18:53 |
| ayoung | see the token param? | 18:53 |
| ayoung | unscoped does not have that problem, as it does not take in a token | 18:54 |
| ayoung | the kerb one ... | 18:54 |
| ayoung | v3fedkerb = keystoneclient_kerberos.v3:FederatedKerberos | 18:55 |
| ayoung | class FederatedKerberos(v3.FederatedBaseAuth): | 18:57 |
| ayoung | and pretty sure the FederatedBaseAuth handes unscoped to scoped | 18:57 |
| ayoung | all it implements is | 18:57 |
| ayoung | def get_unscoped_auth_ref(self, session, **kwargs): | 18:57 |
| openstackgerrit | Sean Perry proposed openstack/keystoneauth: Show deprecation when a user_agent is not set https://review.openstack.org/289645 | 18:58 |
| *** sdake has joined #openstack-keystone | 18:58 | |
| *** ddieterly is now known as ddieterly[away] | 18:59 | |
| lbragstad | bknudson i stood up keystone using the os_keystone openstack/ansible role and i ran an authenticate against it 1000 times | 18:59 |
| lbragstad | http://cdn.pasteraw.com/nmvcz06yjcguxsvf30ta7nqjzkd5jc8 | 19:00 |
| *** sdake_ has quit IRC | 19:00 | |
| lbragstad | using all the defaults from os_keystone | 19:00 |
| lbragstad | they use fernet by default | 19:00 |
| bknudson | gAAAAABXVcb ! | 19:00 |
| lbragstad | times are printed at the end of the paste | 19:00 |
| bknudson | 0.0842203118801117 seconds per authentication request -- that's pretty good. | 19:00 |
| bknudson | you've got a fast computer | 19:01 |
| lbragstad | just a beefed up vm i'm using to test the performance criteria | 19:01 |
| bknudson | this is master? | 19:01 |
| bknudson | P50/P90: 0.0556974411011/0.0588443040848 min/max: 0.0523588657379/0.114371061325 | 19:01 |
| bknudson | I guess my laptop is faster. | 19:01 |
| nisha_ | samueldmq, I finished up reading this doc, https://pymotw.com/2/unittest/ | 19:02 |
| lbragstad | bknudson yes - this should be master | 19:02 |
| nisha_ | samueldmq, I have one small doubt though | 19:02 |
| bknudson | lbragstad: memcache is on? Also, I assume this includes your patch since that was on master? | 19:02 |
| bknudson | or was there something wrong with the caching fix that it didn't do anything? | 19:03 |
| nisha_ | samueldmq, the doc uses failUnlessRaises()for testing Exceptions. | 19:03 |
| bknudson | lbragstad: also, try it with uuid. | 19:03 |
| notmorgan | ayoung: checking in on krb5 plugin test? | 19:04 |
| nisha_ | samueldmq, def raises_error(*args, **kwds): print args, kwds raise ValueError('Invalid value: ' + str(args) + str(kwds)) | 19:04 |
| lbragstad | bknudson uuid - http://cdn.pasteraw.com/pso3psw2w3miyirqktvfxiqiygw4wm9 | 19:04 |
| ayoung | notmorgan, not yet | 19:04 |
| bknudson | lbragstad: uuid is slower in your case. | 19:04 |
| notmorgan | ayoung: any idea on general timeline? | 19:04 |
| ayoung | notmorgan, I'm still trying to get SAML2 Federation to work with the CLI | 19:04 |
| ayoung | after | 19:04 |
| nisha_ | samueldmq, def testFailUnlessRaises(self): | 19:04 |
| nisha_ | self.failUnlessRaises(ValueError, raises_error, 'a', b='c') | 19:04 |
| lbragstad | bknudson is it, which is strange | 19:04 |
| ayoung | <miyagi>after after</miyagi> | 19:04 |
| notmorgan | ayoung: so we should look for someone else to validate it loads if they can? | 19:04 |
| ayoung | notmorgan, is there someone else? | 19:05 |
| notmorgan | ayoung: i only ask because i'd like to get general fixes like that landed sooner vs later. not trying to pre-empt your workload, just if we have someone else who can validate | 19:05 |
| bknudson | lbragstad: I wonder why I get such different results... for me it was 0.0128 for uuid and 0.0556 for fernet | 19:05 |
| notmorgan | bknudson: for what? | 19:06 |
| notmorgan | bknudson: uuid vs fernet? easy | 19:06 |
| nisha_ | samueldmq, I understood, why it's used and all. What type of argument does this (*args, **kwds) suggest ? I saw them in the v3 keystoneclient api too | 19:06 |
| notmorgan | bknudson: SQL vs SQL+SQL+SQL+SQL+SQL+SQL | 19:06 |
| lbragstad | bknudson second run http://cdn.pasteraw.com/m5xeyswe42gl0h1nqpty069vr4jmh6o | 19:06 |
| notmorgan | bknudson: we do most of the loading from the body in the db table instead of having to reconstruct, we only ensure things are "valid" still. (lower cost) | 19:06 |
| ayoung | notmorgan, I should be able to test that against an OSP8 (Liberty) install, right? | 19:06 |
| bknudson | notmorgan: lbragstad ran tests and in his case fernet is faster. | 19:07 |
| notmorgan | ayoung: i would hope you can. | 19:07 |
| notmorgan | ayoung: if you can't we did something very very wrong | 19:07 |
| notmorgan | bknudson: what was the test? | 19:07 |
| lbragstad | notmorgan bknudson let me push what i have | 19:07 |
| notmorgan | bknudson, lbragstad: because i can think of two reasons for it to be faster, depending on what the test scenario is | 19:07 |
| ayoung | notmorgan, OK...I have a setup I can test against...what is the simplest test? | 19:07 |
| lbragstad | it's mostly ansible to set things up | 19:07 |
| bknudson | notmorgan: My test just validates a single token over and over again. | 19:07 |
| notmorgan | ayoung: does the plugin load/auth | 19:07 |
| notmorgan | ayoung: thats really what we're looking for. :) | 19:07 |
| lbragstad | my test is authenticate repeatedly | 19:07 |
| notmorgan | ayoung: that is 100 times better than "can't load the plugin" | 19:08 |
| notmorgan | ayoung: or a million times ;) | 19:08 |
| bknudson | lbragstad: that's totally different. We were only asked to look at validation perf for now. | 19:08 |
| nisha_ | samueldmq, https://pymotw.com/2/unittest/#testing-for-exceptions | 19:08 |
| ayoung | notmorgan, so I have venv with keystoneauth tests run | 19:08 |
| notmorgan | ayoung: edge cases/other bugs can be addressed after but fundamentally working is the important part :) | 19:08 |
| bknudson | lbragstad: that would explain why you're printing out so many tokens. | 19:08 |
| lbragstad | bknudson right | 19:08 |
| notmorgan | lbragstad: and caching enabled? | 19:08 |
| lbragstad | bknudson let me write a new test | 19:08 |
| bknudson | lbragstad: https://github.com/brantlk/keystone_performance/blob/master/keystone_performance/test1.py | 19:09 |
| lbragstad | bknudson it's is known that token creation with fernet is faster than uuid | 19:09 |
| ayoung | GAH...something at my office messes up DNS entries for gerrit | 19:09 |
| ayoung | git fetch | 19:09 |
| ayoung | ssh_exchange_identification: Connection closed by remote host | 19:09 |
| notmorgan | lbragstad: because you're basically hitting cache a TON -- and with local_request cache. | 19:09 |
| ayoung | only inside the VPN... | 19:09 |
| notmorgan | ayoung: weird. so the auth plugin test should be "from the CLI or from a synthetic script, auth against a KRB enabled openstack" | 19:09 |
| notmorgan | ayoung: and if that loads/works we're good. :) | 19:10 |
| nisha_ | samueldmq, Also why is invalid value not printed along with the arguments, in the output? | 19:10 |
| notmorgan | ayoung: but like i said, just was getting a timeline from you. happy to poke elsewhere if you really are swamped :) | 19:10 |
| ayoung | notmorgan, I'll try to hit it today/tonight | 19:10 |
| ayoung | nah, just want to close out on this bug | 19:10 |
| notmorgan | ayoung: perfect. or just give me a "will plan to do it by X" and hit it by then :) | 19:11 |
| *** josecastroleon has quit IRC | 19:11 | |
| notmorgan | ayoung: that way i wont be asking consistently :) | 19:11 |
| ayoung | notmorgan, we need a Federated SAML plugin, that works like the Kerberos on: requests an unscoped via federation, then uses that tokne via normal means to get a scoped token. we have each of theopieces, but not the end to end. THUS ECP sodes not work | 19:11 |
| ayoung | I'd test right now, but I can't pull the patch from Geerit | 19:12 |
| ayoung | is it merged yet? | 19:12 |
| notmorgan | ayoung: no. it's waiting for your ack | 19:12 |
| ayoung | ah ,wait, I think I have it anyway | 19:12 |
| notmorgan | since you said you would test it locally. | 19:12 |
| ayoung | ommit 33133581aea946c82f629128d079d031bacc6b64 | 19:12 |
| ayoung | Author: Colleen Murphy <colleen@gazlene.net> | 19:12 |
| ayoung | Date: Thu May 26 12:01:59 2016 -0700 | 19:12 |
| ayoung | Make the kerberos plugin loadable | 19:12 |
| ayoung | that one? | 19:12 |
| notmorgan | yes let me check the sha | 19:12 |
| ayoung | does not matter...wil be close enough | 19:12 |
| notmorgan | c600c81db5bf269f0abd464869d24d3046c3add7 is the latest | 19:12 |
| notmorgan | it had a rebase and a minor test fix i think | 19:13 |
| notmorgan | ayoung: 'git fetch https://git.openstack.org/openstack/keystoneauth refs/changes/14/321814/7 && git cherry-pick FETCH_HEAD' should work | 19:13 |
| notmorgan | if ssh is broken | 19:13 |
| notmorgan | lbragstad: ok so caching or no caching? | 19:14 |
| lbragstad | notmorgan yes - keystone is setup using the defaults that osa deploys keystone with | 19:15 |
| lbragstad | the only caching they don't use by default is catalog caching | 19:15 |
| *** gyee has quit IRC | 19:15 | |
| ayoung | notmorgan, export OS_AUTH_TYPE=v3fedkerb | 19:15 |
| ayoung | ? | 19:15 |
| notmorgan | lbragstad: also i think a better benchmark to use is: "get base 'validation' token, get new_token, validate new_token with validator token" | 19:15 |
| notmorgan | ayoung: looking.. | 19:15 |
| notmorgan | ayoung: v3kerberos | 19:15 |
| notmorgan | ayoung: this is the basic krb5 auth not even federated | 19:16 |
| ayoung | ah... | 19:16 |
| ayoung | hmmm, not sure if I am set to test that...one sec | 19:16 |
| KevinE | In scenario files under context, I have "user_role" and it's not happy about that. is that depreciated or something? sorry if this doesn't make sense lol | 19:16 |
| lbragstad | notmorgan https://github.com/openstack/openstack-ansible-os_keystone/blob/master/templates/keystone.conf.j2#L101-L107 | 19:16 |
| notmorgan | lbragstad: uhm.. we fixed that didn't we? | 19:16 |
| ayoung | notmorgan, I think I need something else... | 19:16 |
| lbragstad | notmorgan there was a follow on patch you had that never landed | 19:17 |
| notmorgan | ayoung: no worries then. circle back on it later on. | 19:17 |
| notmorgan | ayoung: lets plan that i'll ask you again on wednesday if you haven't had a chance. | 19:17 |
| notmorgan | ayoung: go back to your federation on the cli stuff :) | 19:17 |
| * notmorgan tries to keep this under 15min context switch thing | 19:17 | |
| *** yolanda has quit IRC | 19:17 | |
| ayoung | too late, you forced a context shif | 19:18 |
| ayoung | t | 19:18 |
| notmorgan | 15 mins is where you can context switch back usually pretty easily | 19:18 |
| notmorgan | typically | 19:18 |
| notmorgan | :) | 19:18 |
| notmorgan | after that... | 19:18 |
| ayoung | So Keystone on this machine is running on 35357... | 19:18 |
| notmorgan | lbragstad: i think this patch is no longer needed | 19:19 |
| openstackgerrit | Sean Perry proposed openstack/keystoneauth: Show deprecation when a user_agent is not set https://review.openstack.org/289645 | 19:19 |
| notmorgan | lbragstad: we fixed the main patchset. | 19:19 |
| lbragstad | notmorgan i proposed a patch to osa to enable catalog caching again but i think we need to test it a bit more https://review.openstack.org/#/c/314854/ | 19:20 |
| patchbot | lbragstad: patch 314854 - openstack-ansible-os_keystone - Remove catalog section | 19:20 |
| notmorgan | lbragstad: ++ | 19:20 |
| samueldmq | nisha_: **kwargs accept any additional argument passed in | 19:21 |
| dolphm | nonameentername: is this a transient failure that you're aware of? http://logs.openstack.org/periodic-stable/periodic-keystone-python27-db-mitaka/a445f52/console.html#_2016-06-02_06_15_19_205 | 19:21 |
| *** frontrunner has joined #openstack-keystone | 19:22 | |
| ayoung | notmorgan, too much to do now. Needs a hacked Keystone set up to test. Will do that after this plugin | 19:22 |
| *** roxanaghe has quit IRC | 19:22 | |
| KevinE | samueldmq: Could you take a look at this? It's mad that I have user_role in there but I just don't know what consequences there will be if I remove it http://pastebin.com/fmss8GbV | 19:22 |
| notmorgan | ayoung: wfm | 19:22 |
| notmorgan | ayoung: i'll bug you again wednesday afternoon if i haven't heard. | 19:23 |
| ayoung | notmorgan, ++ | 19:23 |
| samueldmq | KevinE: I am not familiar with rally, maybe it's better to ask in #openstack-rally ? | 19:23 |
| *** tqtran has joined #openstack-keystone | 19:23 | |
| KevinE | samueldmq: I did, this channel is so much more helpful lol. I figured you may know just because the config is the same for keystone too from what I saw :) | 19:24 |
| nisha_ | samueldmq, **kwargs are optional right? | 19:25 |
| *** sheel has quit IRC | 19:25 | |
| samueldmq | nisha_: yes | 19:26 |
| lbragstad | bknudson uuid token validation - http://cdn.pasteraw.com/hfjbhc29v4ihpmnp7tgola58y8a9a77 | 19:26 |
| lbragstad | bknudson rerunning with fernet now | 19:27 |
| *** ddieterly[away] is now known as ddieterly | 19:27 | |
| bknudson | lbragstad: that's right in line with what I get. | 19:27 |
| lbragstad | bknudson cool - at least i'm on the right track with what you're seeing | 19:28 |
| lbragstad | bknudson fernet results http://cdn.pasteraw.com/tj389xab8yablnzyrhxarmbr4k3qptb | 19:28 |
| bknudson | lbragstad: that's slower than my system but in line. | 19:28 |
| bknudson | lbragstad: I'm not too worried about uuid vs fernet. I think we're going to be using fernet to support local database in datacenter. | 19:29 |
| bknudson | distributed database is too slow. | 19:30 |
| lbragstad | bknudson yeah - fernet's lack of speed seems to be the lesser of two evils when compared to backend replication | 19:30 |
| bknudson | although we're running liberty so maybe caching improvements would cover that up. | 19:30 |
| bknudson | we still have to figure out how to replicate things like users and projects. | 19:31 |
| lbragstad | bknudson what do you mean? | 19:31 |
| bknudson | to share tokens between data centers we need to have users with the same user ID | 19:31 |
| bknudson | projects with the same project ID, etc. | 19:32 |
| lbragstad | bknudson ah - right | 19:32 |
| bknudson | not sure how we're going to do that... will probably have to write a tool | 19:32 |
| bknudson | the data centers will have keystones at different code levels so even sync at db level isn't going to work. | 19:33 |
| *** nisha_ has quit IRC | 19:34 | |
| *** woodburn has quit IRC | 19:45 | |
| *** woodburn has joined #openstack-keystone | 19:46 | |
| *** openstackstatus has quit IRC | 19:55 | |
| *** openstackstatus has joined #openstack-keystone | 19:57 | |
| *** ChanServ sets mode: +v openstackstatus | 19:57 | |
| *** josecastroleon has joined #openstack-keystone | 19:57 | |
| *** browne1 has joined #openstack-keystone | 20:00 | |
| *** browne has quit IRC | 20:00 | |
| *** rderose has quit IRC | 20:02 | |
| *** amrith is now known as _amrith_ | 20:05 | |
| *** rderose has joined #openstack-keystone | 20:07 | |
| lbragstad | bknudson here are my ansible bits for setting up my performance host | 20:10 |
| lbragstad | https://github.com/lbragstad/keystone-performance | 20:10 |
| bknudson | lbragstad: that was too easy. | 20:11 |
| bknudson | lbragstad: what does this do? https://github.com/lbragstad/keystone-performance/blob/master/setup_perf_host.yml#L30 | 20:12 |
| lbragstad | bknudson those are pre_tasks pulled from osa's testing setup | 20:13 |
| lbragstad | i can't remember what the % character does in sql-land | 20:13 |
| lbragstad | but that task is for granting the keystone user privileges | 20:13 |
| bknudson | lbragstad: "You can specify wildcards in the host name. For example, user_name@'%.example.com' applies to user_name for any host in the example.com domain" | 20:14 |
| bknudson | http://dev.mysql.com/doc/refman/5.7/en/grant.html | 20:15 |
| lbragstad | ah | 20:15 |
| lbragstad | bknudson i'm going to test this out from top-to-bottom on a bare metal node | 20:15 |
| bknudson | galera_root_password: password | 20:15 |
| bknudson | Now I know your password | 20:15 |
| lbragstad | bknudson you can auth as many times as you want - and you can steal all my super secrete performance data | 20:16 |
| bknudson | https://lkml.org/lkml/2012/6/5/356 -- git bisect works backwards when the "good" thing is newer (e.g., when performance is newer in mitaka vs liberty) | 20:17 |
| *** gyee has joined #openstack-keystone | 20:20 | |
| *** ChanServ sets mode: +v gyee | 20:20 | |
| *** protoz has joined #openstack-keystone | 20:23 | |
| lbragstad | dstanek notmorgan dolphm fyi - https://github.com/lbragstad/keystone-performance | 20:26 |
| lbragstad | PR's welcome :) | 20:26 |
| protoz | Hello, I can't seem to find anything on an issue I'm having with keystone and LDAP. A user's password expired in ldap and was changed but keystone is still expecting the old password. | 20:26 |
| lbragstad | cc henrynash ^ | 20:27 |
| dstanek | protoz: are you using an ldap backend? | 20:27 |
| protoz | yes | 20:27 |
| *** josecastroleon has quit IRC | 20:27 | |
| protoz | The user did not exist in keystone until the user logged in with ldap creds | 20:27 |
| dstanek | protoz: i don't think we are caching anything. it should go back to your ldap server to authenticate | 20:27 |
| henrynash_ | protoz: you are using the LDAP Identity driver I assume | 20:28 |
| dstanek | protoz: using the ldap backend we don't store the password | 20:28 |
| protoz | Yes, driver = keystone.identity.backends.ldap.Identity | 20:28 |
| *** BjoernT has quit IRC | 20:28 | |
| protoz | I didn't think Keystone would which is probably why I couldn't find anything | 20:28 |
| zigo | When building Keystone, I get this: http://paste.openstack.org/show/508448/ | 20:28 |
| zigo | What's going on? | 20:28 |
| zigo | (FYI: that's Newton b1...) | 20:29 |
| dstanek | protoz: can you auth directly against ldap using the new creds? | 20:29 |
| bknudson | zigo: a newer version of oslo.log is required | 20:29 |
| zigo | Oh... | 20:29 |
| zigo | bknudson: This should be addressed in requirements.txt then ! | 20:29 |
| protoz | Yes I've confirmed it with my account and another users account | 20:29 |
| bknudson | zigo: you're right... we need better testing for min versions | 20:29 |
| *** ayoung has quit IRC | 20:30 | |
| dstanek | protoz: are you able to see in keystone's log that it is hitting the ldap server? | 20:30 |
| zigo | bknudson: Much much better now, thanks! :) | 20:31 |
| bknudson | zigo: no problem. | 20:31 |
| zigo | I've made a (build-)depends on oslo.log 3.8.0 ... :P | 20:31 |
| zigo | bknudson: Do you know if keystone *really* needs mock >= 2.0 ? | 20:32 |
| zigo | It's annoying that the maintainer of mock in Debian isn't responsive, and hasn't packaged it yet. | 20:32 |
| bknudson | zigo: Nope, probably something else needs it. | 20:32 |
| zigo | (I filed a bug, of course...) | 20:32 |
| *** dave-mccowan has quit IRC | 20:32 | |
| zigo | Ok, cheers. | 20:32 |
| zigo | Again, again and again, the same dependency management type of issues ... :) | 20:33 |
| *** dave-mccowan has joined #openstack-keystone | 20:33 | |
| bknudson | I don't think anybody's got time to work on fixing the issues. | 20:33 |
| zigo | Right, not even me... | 20:33 |
| bknudson | I might be able to get it on my things to do. | 20:33 |
| zigo | Doug clearly expressed the fact it's taking too much time. | 20:34 |
| knikolla | rodrigods: can you point me to where i can find information on how to run the tempest tests in keystone_tempest_plugin? we're having some trouble | 20:34 |
| dstanek | bknudson: how do you fix it if potentially every project needs different versions in g-r? | 20:34 |
| knikolla | rodrigods: i'm gonna head off now but will check back in a few hours. thanks | 20:34 |
| zigo | Though the main issue I'm seeing when packaging all of OpenStack is that some *rules* are wrong. Like bumping a requirement to everyone when only a single package needs it ... | 20:34 |
| bknudson | My goal will be to make it so that keystone doesn't need to update the min version unless keystone uses the feature. | 20:34 |
| zigo | Then we get to this type of situation: "well I don't know, maybe someone else needs it..." just like you stated. | 20:35 |
| bknudson | zigo: yes, I don't agree with that one either | 20:35 |
| zigo | Anyway, the only solution is to get us to gate with lower bounds, that's no news! :) | 20:35 |
| bknudson | dstanek: the way to do that is to not cap so that the latest version works with everything. | 20:35 |
| zigo | It's been only 2 years we're talking about it. | 20:36 |
| zigo | :) | 20:36 |
| bknudson | zigo: yes, it's too hard to expect projects to maintain their own min level correctly. Needs min testing in place. | 20:36 |
| *** itisha has joined #openstack-keystone | 20:36 | |
| bknudson | zigo: apparently swift maintains their own mins... is that working for you? | 20:37 |
| bknudson | swift does this by just not accepting the reviews from the proposal bot. | 20:37 |
| protoz | dstanek: Authorization failed. KS-58299FC The request you have made requires authentication. | 20:38 |
| *** julim has quit IRC | 20:39 | |
| notmorgan | bknudson, zigo: iirc there has been talk about min testing as well in some projects | 20:40 |
| notmorgan | but part of the issue is pip/dep-solver doesn't know how to do minimums well | 20:40 |
| notmorgan | so a separate requirements thing is/might be needed? | 20:40 |
| zigo | notmorgan: Robert Collins said we should therefore patch pip ! :) | 20:41 |
| notmorgan | zigo: yes. someone needs to do that work | 20:41 |
| zigo | (which I agree...) | 20:41 |
| notmorgan | :) | 20:41 |
| *** roxanaghe has joined #openstack-keystone | 20:42 | |
| KevinE | Python question: is this line the same with or without the single quotes around those variables? val = str(self.get_metric_value(parsed_node, host['NAME'], host['metrics'][count]['NAME'])) | 20:43 |
| dstanek | KevinE: nope. using single quotes means you want a string | 20:43 |
| notmorgan | dstanek: said better than what i was typing | 20:44 |
| KevinE | dstanek: ok, so why is pep saying to remove the single quotes? | 20:44 |
| dstanek | KevinE: you'd have to show the error message | 20:44 |
| KevinE | dstanek: it's just "N350 Remove Single quotes" and points to all of the single quotes in this file | 20:45 |
| notmorgan | uhm. | 20:45 |
| * notmorgan looks up N350 | 20:45 | |
| bknudson | http://git.openstack.org/cgit/openstack/rally/tree/tests/hacking/checks.py#n319 | 20:45 |
| dstanek | KevinE: never heard of that :-( maybe they want double quotes? | 20:45 |
| KevinE | notmorgan: I don't know where to look that up lol | 20:46 |
| notmorgan | i would explicitly disable that check personally | 20:46 |
| notmorgan | that seems exceedingly silly | 20:46 |
| bknudson | looks like rally likes " rather than ' | 20:46 |
| * notmorgan prefers single quotes. | 20:46 | |
| notmorgan | yeah | 20:46 |
| notmorgan | wow. | 20:46 |
| KevinE | dstanek: will it be exactly the same function-wise? | 20:46 |
| bknudson | (which is actually against pep8) | 20:46 |
| dstanek | KevinE: yes single == double | 20:46 |
| KevinE | bknudson: wait, double quotes are against pep8? | 20:46 |
| notmorgan | KevinE: well.. pep8 is a guideline document | 20:46 |
| notmorgan | and says "feel free to be inconsistent" | 20:47 |
| dstanek | single quotes are preferred by openstack projects | 20:47 |
| notmorgan | forcing a style of quotes is against pep8 explicitly | 20:47 |
| bknudson | oh, I was wrong, it's openstack style guide that says ' | 20:47 |
| notmorgan | we tend to prefer '' in openstack over "" | 20:47 |
| dstanek | i don't think pep8 cares about single vs. double | 20:47 |
| notmorgan | but it is 100% reasonable to be inconsistent to avoid needing to do 'can\'t' | 20:47 |
| bknudson | although we maybe got rid of that? | 20:48 |
| notmorgan | basically, "tend to use the same quotes" is the best option. | 20:48 |
| notmorgan | the fact that rally enforces "" seems silly to me. but i'm not a rally dev... | 20:48 |
| notmorgan | sooooooooooo | 20:48 |
| notmorgan | i have little to say in it | 20:48 |
| bknudson | I like a rule of " for human strings and ' for constants. | 20:48 |
| dstanek | or 'for strings less than 10 characters and " for everything else | 20:49 |
| notmorgan | bknudson: except when it requires \' :) | 20:49 |
| notmorgan | bknudson: but that is about knowing when to be inconsistent :) | 20:49 |
| bknudson | y, it's unlikely that a special value is going to have ' in it. | 20:49 |
| KevinE | sorry guys, so should I make them "" and make the pep tests happy before merging or go against pep? lol | 20:49 |
| bknudson | whereas it's a lot more likely in english | 20:50 |
| bknudson | KevinE: you should ask the rally guys about their style guidelines. | 20:50 |
| bknudson | oops, they're not all guys | 20:50 |
| dstanek | KevinE: they likely won't accept your code if it goes against their standard | 20:50 |
| KevinE | okie thanks for the help y'all | 20:50 |
| *** josecastroleon has joined #openstack-keystone | 20:51 | |
| lbragstad | fernet authentication performance on a bare metal node with 20 cores and 128 GB of RAM - http://cdn.pasteraw.com/nfxjkt9tp8w2nb09zg39axn2tz91vj3 | 20:59 |
| bknudson | lbragstad: if you're not doing 20 concurrently then more cores isn't going to help | 20:59 |
| *** gagehugo has quit IRC | 20:59 | |
| lbragstad | bknudson you're right - but I'm doing it on bare metal which is the closest thing to a "consistent" environment I can find | 21:00 |
| *** daemontool_ has joined #openstack-keystone | 21:00 | |
| lbragstad | fernet validaton on the same node - http://cdn.pasteraw.com/2plinbed539cb8r9rpekemqm2bb5xhz | 21:00 |
| *** jaugustine has quit IRC | 21:01 | |
| bknudson | lbragstad: how to make it faster? I guess the point of comparing fernet to UUID is more to show that it could be faster. | 21:02 |
| lbragstad | bknudson i guess the reason i'm comparing is that uuid performance is more of a known quantity for our uses | 21:02 |
| lbragstad | users* | 21:02 |
| *** daemontool has quit IRC | 21:03 | |
| *** daemontool_ has quit IRC | 21:03 | |
| *** mvk has joined #openstack-keystone | 21:05 | |
| bknudson | unfortunately, the story today is that fernet validation performance is worse than uuid. | 21:06 |
| lbragstad | bknudson i'm hoping we can aim to make them the same - then that argument goes away | 21:07 |
| *** ddieterly is now known as ddieterly[away] | 21:08 | |
| *** pcaruana has quit IRC | 21:08 | |
| *** pauloewerton has quit IRC | 21:09 | |
| lbragstad | uuid authentication performance - http://cdn.pasteraw.com/rjrt9nwtn7sblfs90ihahh59591ikxm . uuid validation performance - http://cdn.pasteraw.com/9yyyllwrpxglmqu0pde6ggaoxng1sle | 21:09 |
| rodrigods | knikolla, of course... "tox -e all-plugin -- keystone" in tempest | 21:11 |
| henrynash_ | lbragstad: good initial data….and I agree, I don’t see why we can’t make these perform approximately the same... | 21:14 |
| zigo | dh_install: usr/etc/keystone/keystone.conf/keystone.conf.sample exists in debian/tmp but is not installed to anywhere | 21:14 |
| zigo | dh_install: usr/etc/keystone/default_catalog.templates/default_catalog.templates exists in debian/tmp but is not installed to anywhere | 21:14 |
| zigo | dh_install: usr/etc/keystone/policy.json/policy.json exists in debian/tmp but is not installed to anywhere | 21:14 |
| zigo | dh_install: usr/etc/keystone/sso_callback_template.html/sso_callback_template.html exists in debian/tmp but is not installed to anywhere | 21:14 |
| zigo | dh_install: usr/etc/keystone/keystone-paste.ini/keystone-paste.ini exists in debian/tmp but is not installed to anywhere | 21:14 |
| henrynash_ | lbragstad:…which of your caching patches were in teh code taht ran those tests? | 21:15 |
| zigo | Guys, we're *NOT* supposed to install stuff in /etc through setup.cfg. | 21:15 |
| zigo | This is a *bug*. | 21:15 |
| zigo | Grrr... | 21:15 |
| lbragstad | henrynash_ all of them? | 21:15 |
| zigo | Julien Danjou ... | 21:15 |
| lbragstad | except the catalog caching patch | 21:15 |
| lbragstad | catalog caching isn't enabled | 21:15 |
| bknudson | lbragstad: I think we're going to want these tests to have high concurrency. It's not realistic otherwise. Nobody running a cloud is only going to be doing 1 verify at a time. | 21:16 |
| henrynash_ | lbragstad: ok, that’s what I would have thought from the results….it used to be around 80-90ms before any of your patches | 21:16 |
| bknudson | lbragstad: it would be interesting to see if you get better results with the patch to enable catalog caching. | 21:16 |
| henrynash_ | (validation of fernet, that is) | 21:17 |
| lbragstad | bknudson henrynash_ we need to track down and figure out how to fix - https://github.com/openstack/openstack-ansible-os_keystone/blob/master/templates/keystone.conf.j2#L101-L107 | 21:17 |
| lbragstad | i can enable it but upstream osa turns it off by default because they had some issues with it | 21:17 |
| bknudson | lbragstad: devstack has that same exception | 21:18 |
| lbragstad | we should sync up with both the osa group and the devstack people and see if we can get that enabled again | 21:19 |
| *** _amrith_ is now known as amrith | 21:20 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements https://review.openstack.org/320156 | 21:20 |
| *** josecastroleon has quit IRC | 21:20 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Scaffolding for keystone.conf package https://review.openstack.org/325604 | 21:22 |
| dolphm | nonameentername: ping | 21:24 |
| lbragstad | bknudson henrynash_ https://github.com/lbragstad/keystone-performance/tree/master/results | 21:26 |
| lbragstad | bknudson henrynash_ let me turn on catalog caching and re-run those | 21:27 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/325589 | 21:27 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/325589 | 21:27 |
| *** diazjf has quit IRC | 21:29 | |
| *** ddieterly[away] is now known as ddieterly | 21:31 | |
| *** josecastroleon has joined #openstack-keystone | 21:32 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Scaffolding for keystone.conf package https://review.openstack.org/325604 | 21:32 |
| lbragstad | bknudson henrynash_ I see no performance increase with fernet authentication when catalog caching is enabled - running the validation tests now | 21:33 |
| *** rk4n has quit IRC | 21:34 | |
| lbragstad | bknudson i think i see an 8% performance improvement on fernet token validation with catalog caching enabled | 21:35 |
| lbragstad | without caching: Validated token 1000 times in 56.432976961135864 seconds | 21:36 |
| lbragstad | with caching: Validated token 1000 times in 51.833451986312866 seconds | 21:36 |
| bknudson | not bad, but still not sure how we're going to get to uuid speeds | 21:37 |
| lbragstad | bknudson yeah - we're going to have to look for speeds in other areas | 21:37 |
| bknudson | other than, the idea of caching the tokens instead of caching the parts. | 21:37 |
| *** spzala has quit IRC | 21:39 | |
| *** spzala has joined #openstack-keystone | 21:40 | |
| *** frontrunner has quit IRC | 21:43 | |
| bknudson | because then we'd bypass all that logic given the same token and the performance should be the same as uuid | 21:43 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/325589 | 21:44 |
| *** spzala has quit IRC | 21:44 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 21:45 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements https://review.openstack.org/320156 | 21:45 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 21:46 |
| *** catintheroof has quit IRC | 21:46 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements https://review.openstack.org/320156 | 21:46 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 21:46 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/325589 | 21:46 |
| *** tqtran has quit IRC | 21:47 | |
| dims | bknudson : lbragstad : am i reading this right (how/why we need pykerberos) https://review.openstack.org/#/c/325658/ (please see my last 2 comments) | 21:47 |
| patchbot | dims: patch 325658 - openstack-infra/system-config - krb5 dependencies for pykerberos | 21:47 |
| bknudson | dims: keystoneauth uses requests-kerberos | 21:50 |
| bknudson | so maybe that's bringing in pykerberos... | 21:50 |
| *** rderose has quit IRC | 21:51 | |
| dims | bknudson : ack thanks | 21:51 |
| bknudson | dims: https://github.com/requests/requests-kerberos/blob/master/requirements.txt#L3 | 21:52 |
| dims | yep, that should do it | 21:52 |
| bknudson | oh, that's what you said already | 21:52 |
| *** sdake_ has joined #openstack-keystone | 21:52 | |
| *** julim has joined #openstack-keystone | 21:53 | |
| openstackgerrit | Thomas Goirand proposed openstack/keystone: Revert "Install necessary files in etc/" https://review.openstack.org/326152 | 21:54 |
| *** sdake has quit IRC | 21:54 | |
| *** jdennis1 has quit IRC | 21:58 | |
| *** edmondsw has quit IRC | 21:58 | |
| *** jdennis has joined #openstack-keystone | 21:59 | |
| *** rk4n has joined #openstack-keystone | 21:59 | |
| *** gyee has quit IRC | 22:00 | |
| *** julim has quit IRC | 22:00 | |
| *** markvoelker has quit IRC | 22:00 | |
| *** markvoelker has joined #openstack-keystone | 22:00 | |
| *** josecastroleon has quit IRC | 22:02 | |
| *** ayoung has joined #openstack-keystone | 22:04 | |
| *** ChanServ sets mode: +v ayoung | 22:04 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Return 404 instead of 401 for tokens w/o roles https://review.openstack.org/322280 | 22:05 |
| *** spzala has joined #openstack-keystone | 22:06 | |
| *** r-daneel has joined #openstack-keystone | 22:11 | |
| KevinE | I'm failing pep8 with an error that says "import only modules" when trying to import OptionParser. Anyone know what that is? | 22:12 |
| *** gyee has joined #openstack-keystone | 22:12 | |
| *** ChanServ sets mode: +v gyee | 22:12 | |
| lbragstad | KevinE OptionParser looks like a class | 22:13 |
| lbragstad | KevinE instead it probably wants you to do something like `from module import submodule` | 22:13 |
| lbragstad | then reference OptionParser like: | 22:13 |
| *** edtubill has quit IRC | 22:13 | |
| lbragstad | `op = submodule.OptionParser()` | 22:13 |
| KevinE | lbragstad: currently I have ' from optparse import OptionParser ' | 22:14 |
| lbragstad | KevinE try just using `import optparser` | 22:14 |
| lbragstad | then reference it like `optparser.OptionParser` | 22:14 |
| *** henrynash_ has quit IRC | 22:15 | |
| *** sdake has joined #openstack-keystone | 22:15 | |
| *** sdake_ has quit IRC | 22:18 | |
| KevinE | lbragstad: worked, thanks :) Any reason why that happened? Or is that just a styling thing | 22:19 |
| lbragstad | KevinE i'm pretty sure it's just a styling thing | 22:19 |
| lbragstad | most of the openstack project (from what i can tell) don't allow the import of classes | 22:20 |
| lbragstad | instead, you have to import the module and us that to reference the class | 22:20 |
| *** protoz has quit IRC | 22:24 | |
| *** ametts has quit IRC | 22:25 | |
| *** gordc has quit IRC | 22:29 | |
| *** ddieterly is now known as ddieterly[away] | 22:35 | |
| *** sdake has quit IRC | 22:36 | |
| *** vint_bra has quit IRC | 22:36 | |
| *** dan_nguyen has quit IRC | 22:39 | |
| *** spzala has quit IRC | 22:41 | |
| *** timcline has quit IRC | 22:43 | |
| *** KevinE has quit IRC | 22:55 | |
| *** roxanaghe has quit IRC | 22:56 | |
| *** ddieterly[away] is now known as ddieterly | 22:59 | |
| *** sdake has joined #openstack-keystone | 23:00 | |
| *** harlowja has quit IRC | 23:01 | |
| *** sdake_ has joined #openstack-keystone | 23:03 | |
| *** sdake has quit IRC | 23:05 | |
| *** ddieterly has quit IRC | 23:09 | |
| *** raddaoui has quit IRC | 23:17 | |
| *** markvoelker has quit IRC | 23:19 | |
| ayoung | jamielennox, I was able to get an ECP plugin that works for scoped calls, not just unscoped. THe Scoped SAML plugin in keystoneclient (this is OSP8 work) looks like it is unusable as is. It expects a token in its parameter list, but then the entry point fails | 23:36 |
| *** dan_nguyen has joined #openstack-keystone | 23:38 | |
| *** rk4n has quit IRC | 23:38 | |
| *** tqtran has joined #openstack-keystone | 23:39 | |
| jamielennox | ayoung: expects a token? | 23:47 |
| jamielennox | i was really hoping to do a setup that would let me test the saml token in ksa | 23:47 |
| jamielennox | just not sure when yet | 23:47 |
| jamielennox | ayoung: oh wtf, why is v3scopedsaml pointing to that plugin? | 23:50 |
| ayoung | jamielennox, no idea, but it is borked right? | 23:50 |
| ayoung | jamielennox, I was able to cobble together a simple one that works extending the federation one | 23:51 |
| ayoung | https://paste.fedoraproject.org/375517/44872146/ (line 13 on) | 23:51 |
| jamielennox | ayoung: in ksc? did you look at the ksa one? | 23:51 |
| openstackgerrit | Merged openstack/keystonemiddleware: Determine project name from oslo_config or local config https://review.openstack.org/320123 | 23:51 |
| ayoung | jamielennox, had not looked yet, as I needed this for OSP8 | 23:51 |
| ayoung | and that seems to be using KC still | 23:52 |
| jamielennox | ayoung: i'm sure we had this working | 23:52 |
| jamielennox | but the plugins available via entrypoing | 23:52 |
| ayoung | jamielennox, rippowam was generating an RC file with unscoped | 23:52 |
| jamielennox | you would need to do openstack --os-auth-plugin v3unscopedsaml ... token get | 23:52 |
| jamielennox | then use v3scopedsaml to scope it | 23:52 |
| jamielennox | which is ridiculous | 23:52 |
| ayoung | jamielennox, so the Federation plugin is the way to go | 23:53 |
| ayoung | Just wrapped the unscoped plugin, worked fine | 23:53 |
| ayoung | trickiest part was figuring out how to get the params listed | 23:54 |
| jamielennox | yep, there is a base federation plugin that will take another plugin and handle the socping for you | 23:54 |
| ayoung | jamielennox, ah...did I now even need to explicitly wrap it? | 23:54 |
| jamielennox | ayoung: it might be a subclass, i can't remember | 23:54 |
| ayoung | jamielennox, maybe in KSA? | 23:55 |
| jamielennox | ayoung: so i rebased https://review.openstack.org/#/c/255056/ yesterday and i'm looking for somewhere to test it | 23:55 |
| patchbot | jamielennox: patch 255056 - keystoneauth - Use SAML2 requests plugin | 23:55 |
| openstackgerrit | Merged openstack/keystonemiddleware: Make sure audit can handle API requests which does not require a token https://review.openstack.org/320725 | 23:55 |
| jamielennox | i was going to rewrite some ansible (copy most from rippowam) to set up an environment i could use | 23:55 |
| ayoung | jamielennox, rippowam should work for you using keycloak now instead of Ipsilon | 23:56 |
| ayoung | have not tested agains Centos, but the rest should be ok. | 23:56 |
| ayoung | You could probably even re-introduce Ipsilon if you wanted | 23:56 |
| jamielennox | ayoung: there were a few problems, like i don't have access to the repos it was pointed at, and i'm not setting this up on an openstack cloud so the ossipee integration won't work | 23:57 |
| jamielennox | and there are some assumptions from rippowam that you set things up that way | 23:57 |
| ayoung | jamielennox, I was starting to break things into smaller roles. | 23:57 |
| ayoung | look at the last few commits | 23:57 |
| ayoung | rhsso aside, I pulled out roles for | 23:57 |
| jamielennox | oh, i didn't really want packstack either | 23:57 |
| ayoung | jamielennox, right, you just need an ossippe compatible inventory file | 23:58 |
| ayoung | keycloak is running in an ipa client merely for HTTPS set up | 23:58 |
| jamielennox | isn't the 'identtiy-provider' opt provided by the base clsas? | 23:59 |
| ayoung | jamielennox, yeah. The missing one was protocol | 23:59 |
| jamielennox | oh? | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!