| *** ddieterly has joined #openstack-keystone | 00:02 | |
| *** adu has joined #openstack-keystone | 00:04 | |
| *** TxGVNN has joined #openstack-keystone | 00:07 | |
| *** harlowja has quit IRC | 00:10 | |
| openstackgerrit | Sam Leong proposed openstack/keystoneauth: Auth plugin for X.509 tokenless authentication https://review.openstack.org/283905 | 00:11 |
|---|---|---|
| notmorgan | jamielennox: which is fine really | 00:20 |
| notmorgan | dict and memorypool code are short lived, no? | 00:20 |
| *** bjornar_ has quit IRC | 00:20 | |
| notmorgan | and repopulated | 00:20 |
| *** spzala has quit IRC | 00:24 | |
| jamielennox | notmorgan: we've gone to lengths before to not change the format in memcache and surprise deployments | 00:26 |
| notmorgan | *blink* | 00:26 |
| notmorgan | we.. have? | 00:26 |
| jamielennox | it just means i thought i had figured out a nice way around the oslo.cache update - and i haven't :( | 00:26 |
| notmorgan | uhmm. | 00:27 |
| notmorgan | dogpile also calculates cache_keys totally differently | 00:27 |
| notmorgan | soooooo | 00:27 |
| jamielennox | notmorgan: i was replacing the keymangler | 00:27 |
| notmorgan | i mean, assuming "memcache" is long-lived is *wrong* | 00:27 |
| notmorgan | be very careful on doing that | 00:27 |
| notmorgan | like i said, assuming a cache key is long-lived... is wrong | 00:28 |
| notmorgan | the only place we've been VERY careful on this front has been in the token data stored in the backend iirc | 00:28 |
| notmorgan | otherwise, *shrug*. | 00:28 |
| notmorgan | and by token data, i mean when we had the memcahce token backend | 00:28 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Remove oslo-incubator https://review.openstack.org/337928 | 00:30 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: WIP: Use dogpile.cache for caching https://review.openstack.org/337929 | 00:30 |
| jamielennox | it'll fail tests but ^ is how | 00:30 |
| *** ddieterly has quit IRC | 00:30 | |
| *** rderose has joined #openstack-keystone | 00:33 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Remove accept_header from context https://review.openstack.org/337015 | 00:39 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Use request.environ through auth and federation https://review.openstack.org/337017 | 00:39 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Remove headers from context https://review.openstack.org/337016 | 00:42 |
| *** tonytan4ever has joined #openstack-keystone | 00:42 | |
| *** tonytan4ever has quit IRC | 00:47 | |
| *** rderose has quit IRC | 00:57 | |
| stevemar | jamielennox: thanks for the rebase on master | 01:06 |
| *** harlowja has joined #openstack-keystone | 01:09 | |
| stevemar | jamielennox: reference https://bugs.launchpad.net/keystonemiddleware/+bug/1523375 if possible | 01:09 |
| openstack | Launchpad bug 1523375 in keystonemiddleware "Keystonemiddleware should switch to oslo.cache" [Low,In progress] - Assigned to Jamie Lennox (jamielennox) | 01:09 |
| jamielennox | stevemar: yea, i already have a review open that attempts to do this another way, i should probably have used that - however i don't know if this is the right way to go yet | 01:10 |
| *** spzala has joined #openstack-keystone | 01:17 | |
| gyee | stevemar, would you be mad at me if I A+ this one? https://review.openstack.org/#/c/283905/ | 01:18 |
| patchbot | gyee: patch 283905 - keystoneauth - Auth plugin for X.509 tokenless authentication | 01:18 |
| gyee | once we get this in, next stop is devstack change to make use of it | 01:19 |
| jamielennox | gyee: i've been reviewing it, i just haven't had a chance to do a setup and do a real test of it | 01:20 |
| jamielennox | but the code looks fine | 01:20 |
| jamielennox | i'm not sure it should ever be default in devstack though | 01:20 |
| gyee | jamielennox, thanks brother! | 01:20 |
| gyee | jamielennox, I can work on a devstack patch showing how it can be utilized | 01:20 |
| gyee | jamielennox, you can use the same certs from keystone-manage gen_pki | 01:21 |
| jamielennox | gyee: i put a +2 on for the code, if you're satisfied it actually works in production then you can +A it | 01:21 |
| gyee | or I can send you a script to generate your own PKI | 01:21 |
| jamielennox | gyee: do we still have that? | 01:21 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Allow prompting for password when CLI loading https://review.openstack.org/248524 | 01:22 |
| *** tqtran has quit IRC | 01:22 | |
| jamielennox | notmorgan: i want to talk to you about your -2 on ^ | 01:23 |
| gyee | jamielennox, yes, keystone-manage pki_setup still around | 01:23 |
| gyee | though it may get removed by Ocata | 01:23 |
| jamielennox | gyee: so there is still no solution here for how you do X-Service-Token with this which glance, swift etc rely on - so i still consider this a bit of a niche usage | 01:25 |
| gyee | its a niche for now | 01:25 |
| gyee | I am working on a POC on how to map certs directly to auth headers | 01:26 |
| jamielennox | why not just do x509 federation? | 01:26 |
| gyee | yes, that's the idea | 01:26 |
| jamielennox | ok, that's different to tokenless | 01:26 |
| gyee | it can be both | 01:27 |
| jamielennox | but hey - you could actually make use of binding in that case! | 01:27 |
| gyee | x509 federation is already supported today :-) | 01:27 |
| jamielennox | there's no keystoneauth plugin for it afaik | 01:27 |
| *** thiagolib has quit IRC | 01:28 | |
| gyee | jamielennox, http://www.meetup.com/openstack/events/229450770/ | 01:29 |
| gyee | take a look at the slides | 01:29 |
| gyee | gotta run, have an appointment with the treadmill, be back in an hour | 01:32 |
| *** wangqun has joined #openstack-keystone | 01:32 | |
| *** chlong has quit IRC | 01:40 | |
| *** spzala has quit IRC | 01:48 | |
| *** chlong has joined #openstack-keystone | 01:53 | |
| *** iurygregory_ has joined #openstack-keystone | 01:55 | |
| *** code-R has joined #openstack-keystone | 01:55 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Add a py35 tox venv for Python 3.5 support https://review.openstack.org/337952 | 01:55 |
| *** tonytan4ever has joined #openstack-keystone | 02:02 | |
| *** EinstCrazy has joined #openstack-keystone | 02:04 | |
| *** tonytan4ever has quit IRC | 02:07 | |
| *** code-R_ has joined #openstack-keystone | 02:18 | |
| *** code-R_ has quit IRC | 02:19 | |
| *** code-R__ has joined #openstack-keystone | 02:19 | |
| *** code-R has quit IRC | 02:20 | |
| *** EinstCrazy has quit IRC | 02:21 | |
| *** tqtran has joined #openstack-keystone | 02:21 | |
| *** tqtran has quit IRC | 02:26 | |
| *** EinstCrazy has joined #openstack-keystone | 02:27 | |
| *** tonytan4ever has joined #openstack-keystone | 02:31 | |
| *** amoralej|pto has quit IRC | 02:33 | |
| *** amoralej has joined #openstack-keystone | 02:33 | |
| *** roxanagh_ has joined #openstack-keystone | 02:43 | |
| *** roxanagh_ has quit IRC | 02:48 | |
| *** tonytan4ever has quit IRC | 02:48 | |
| *** tonytan4ever has joined #openstack-keystone | 02:49 | |
| *** gyee has quit IRC | 02:52 | |
| *** woodster_ has quit IRC | 02:59 | |
| *** maestropandy has joined #openstack-keystone | 03:03 | |
| *** roxanagh_ has joined #openstack-keystone | 03:06 | |
| *** tonytan_brb has joined #openstack-keystone | 03:06 | |
| *** gagehugo has joined #openstack-keystone | 03:09 | |
| *** tonytan4ever has quit IRC | 03:09 | |
| *** richm has quit IRC | 03:12 | |
| openstackgerrit | Merged openstack/keystone: Use request.environ through auth and federation https://review.openstack.org/337017 | 03:15 |
| openstackgerrit | Merged openstack/keystone: Remove accept_header from context https://review.openstack.org/337015 | 03:19 |
| *** julim has quit IRC | 03:21 | |
| *** maestropandy has quit IRC | 03:23 | |
| *** spzala_ has joined #openstack-keystone | 03:25 | |
| *** spzala_ has quit IRC | 03:26 | |
| *** roxanagh_ has quit IRC | 03:28 | |
| *** ayoung has quit IRC | 03:30 | |
| *** iurygregory_ has quit IRC | 03:43 | |
| *** code-R has joined #openstack-keystone | 03:48 | |
| *** code-R__ has quit IRC | 03:51 | |
| *** itisha has joined #openstack-keystone | 03:52 | |
| openstackgerrit | Merged openstack/keystoneauth: Auth plugin for X.509 tokenless authentication https://review.openstack.org/283905 | 03:53 |
| *** GB21 has joined #openstack-keystone | 03:56 | |
| *** code-R has quit IRC | 04:01 | |
| *** roxanagh_ has joined #openstack-keystone | 04:01 | |
| *** code-R has joined #openstack-keystone | 04:01 | |
| *** chrisshattuck has joined #openstack-keystone | 04:02 | |
| *** gagehugo has quit IRC | 04:12 | |
| *** GB21 has quit IRC | 04:15 | |
| *** code-R_ has joined #openstack-keystone | 04:17 | |
| *** code-R has quit IRC | 04:20 | |
| *** tqtran has joined #openstack-keystone | 04:23 | |
| *** GB21 has joined #openstack-keystone | 04:28 | |
| *** tqtran has quit IRC | 04:28 | |
| *** kean has joined #openstack-keystone | 04:28 | |
| kean | hi anyone know this :openstack service create \ | 04:29 |
| kean | --name keystone --description "OpenStack Identity" identity | 04:29 |
| kean | -bash: openstack: command not found | 04:29 |
| kean | I Just follow this page as a guide: http://docs.openstack.org/mitaka/install-guide-rdo/keystone-services.html | 04:30 |
| *** GB21 has quit IRC | 04:34 | |
| kean | I got this : need to install python-openstackclient | 04:36 |
| kean | Anyone know this :$ export OS_URL=http://controller:35357/v3 | 04:37 |
| kean | what show I type for controller ? | 04:37 |
| kean | my server iP ? | 04:37 |
| kean | ERROR message:# openstack service create --name keystone --description │ | 04:38 |
| kean | "OpenStack Identity" identity │ | 04:38 |
| kean | Unable to establish connection to http://192.168.0.4:35357/v3/services | 04:38 |
| *** janonymous has joined #openstack-keystone | 04:40 | |
| *** links has joined #openstack-keystone | 04:48 | |
| kean | hi @all | 04:49 |
| *** roxanagh_ has quit IRC | 04:53 | |
| *** GB21 has joined #openstack-keystone | 04:59 | |
| *** sheel has joined #openstack-keystone | 05:02 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add service functional tests https://review.openstack.org/337351 | 05:03 |
| *** code-R has joined #openstack-keystone | 05:11 | |
| *** code-R_ has quit IRC | 05:11 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 policies https://review.openstack.org/337829 | 05:16 |
| *** chrisshattuck has quit IRC | 05:16 | |
| openstackgerrit | Merged openstack/keystone: Remove headers from context https://review.openstack.org/337016 | 05:21 |
| openstackgerrit | Shan Guo proposed openstack/keystone: Make Fernet the default token provider Edit https://review.openstack.org/337997 | 05:25 |
| kean | anyone know how to fix this ? | 05:59 |
| *** itisha has quit IRC | 06:00 | |
| openstackgerrit | Shan Guo proposed openstack/keystone: Make Fernet the default token provider Edit https://review.openstack.org/337997 | 06:02 |
| *** pcaruana has joined #openstack-keystone | 06:05 | |
| *** rcernin has joined #openstack-keystone | 06:09 | |
| *** tonytan_brb has quit IRC | 06:14 | |
| *** adu has quit IRC | 06:14 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add policy functional tests https://review.openstack.org/337836 | 06:24 |
| -openstackstatus- NOTICE: All python 3.5 jobs are failing today, we need to build new xenial images first. | 06:27 | |
| *** harlowja has quit IRC | 06:34 | |
| *** nisha has joined #openstack-keystone | 06:36 | |
| *** code-R has quit IRC | 07:13 | |
| *** jpena|off is now known as jpena | 07:13 | |
| *** tonytan4ever has joined #openstack-keystone | 07:14 | |
| *** tonytan4ever has quit IRC | 07:20 | |
| *** tesseract- has joined #openstack-keystone | 07:21 | |
| *** GB21 has quit IRC | 07:24 | |
| *** yolanda has joined #openstack-keystone | 07:30 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 regions https://review.openstack.org/338063 | 07:32 |
| openstackgerrit | Shan Guo proposed openstack/keystone: Make Fernet the default token provider Edit https://review.openstack.org/337997 | 07:34 |
| *** yolanda has quit IRC | 07:38 | |
| *** yolanda has joined #openstack-keystone | 07:38 | |
| *** nisha_ has joined #openstack-keystone | 07:41 | |
| *** yolanda has quit IRC | 07:43 | |
| *** nisha has quit IRC | 07:44 | |
| aloga | jamielennox: are you around to discuss about patch 330465 | 07:45 |
| patchbot | aloga: https://review.openstack.org/#/c/330465/ - keystoneauth - oidc: deprecate grant_type argument | 07:45 |
| aloga | jamielennox: ouch, not that one, I mean patch 330006 | 07:45 |
| patchbot | aloga: https://review.openstack.org/#/c/330006/ - keystoneauth - WIP - oidc: fix OpenID Connect authorization code ... | 07:45 |
| kean | hi how to understand domain of keystone ? | 07:47 |
| *** nisha_ has quit IRC | 07:48 | |
| *** yolanda has joined #openstack-keystone | 07:49 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: fix OpenID Connect authorization code grant_type https://review.openstack.org/330006 | 07:51 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: move the get_unscoped_auth_ref into the base class https://review.openstack.org/337140 | 07:51 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: add discovery document support https://review.openstack.org/330464 | 07:51 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: deprecate grant_type argument https://review.openstack.org/330465 | 07:51 |
| openstackgerrit | yuyafei proposed openstack/python-keystoneclient: Add __ne__ built-in function https://review.openstack.org/337435 | 07:59 |
| *** yolanda has quit IRC | 07:59 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** GB21 has joined #openstack-keystone | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** danpawlik has joined #openstack-keystone | 08:03 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** pnavarro has joined #openstack-keystone | 08:15 | |
| *** GB21 has quit IRC | 08:31 | |
| *** GB21 has joined #openstack-keystone | 08:47 | |
| *** code-R has joined #openstack-keystone | 09:13 | |
| *** tonytan4ever has joined #openstack-keystone | 09:16 | |
| *** code-R has quit IRC | 09:18 | |
| *** GB21 has quit IRC | 09:20 | |
| *** tonytan4ever has quit IRC | 09:21 | |
| *** SamYaple has quit IRC | 09:23 | |
| *** tqtran has joined #openstack-keystone | 09:25 | |
| *** tqtran has quit IRC | 09:29 | |
| *** kean has quit IRC | 09:35 | |
| *** GB21 has joined #openstack-keystone | 09:38 | |
| *** daemontool has joined #openstack-keystone | 09:49 | |
| *** GB21 has quit IRC | 09:51 | |
| *** tonytan4ever has joined #openstack-keystone | 09:52 | |
| *** daemontool has quit IRC | 09:58 | |
| *** daemontool has joined #openstack-keystone | 09:58 | |
| *** links has quit IRC | 10:00 | |
| jamielennox | aloga: i'm here | 10:07 |
| *** GB21 has joined #openstack-keystone | 10:08 | |
| jamielennox | henrynash: hey - you here re your comment on https://review.openstack.org/#/c/336980/ | 10:11 |
| patchbot | jamielennox: patch 336980 - keystone - Pass request to build_driver_hints | 10:11 |
| aloga | jamielennox: me too | 10:11 |
| henrynash | jamielennox: HI | 10:11 |
| jamielennox | everyone at once | 10:11 |
| henrynash | It’s a DOS attack | 10:12 |
| jamielennox | aloga: so i think for now take the oidc webbrowser patch out of line and we'll discus it seperately | 10:12 |
| jamielennox | aloga: you going to the midcycle? | 10:12 |
| jamielennox | henrynash: so re https://review.openstack.org/#/c/336980/2/keystone/assignment/controllers.py i want to make sure i'm not changing the behaviour at all | 10:13 |
| patchbot | jamielennox: patch 336980 - keystone - Pass request to build_driver_hints | 10:13 |
| aloga | jamielennox: no I'm not | 10:13 |
| aloga | jamielennox: I'll try to split it out, but it is a painful work | 10:13 |
| jamielennox | henrynash: i don't think i am, but i didn't understand the domain_id flag initially (and still not sure i see why it matters) | 10:13 |
| jamielennox | aloga: really? the others are dependant on that? | 10:14 |
| henrynash | jamielennox: let me go through it again to ensure we are not changing the functionality with your modifcations | 10:14 |
| aloga | jamielennox: nevermind, I'll try to update it | 10:15 |
| jamielennox | henrynash: so i confirmed that if i don't set domain_id=None then i do get different behaviour so i think that's right | 10:15 |
| henrynash | jamielennox: it’s a subtlety due to our desire to not suprise API callers who aren’t aeware fo domain specific roles | 10:15 |
| aloga | jamielennox: however, there is no way of implementing this grant type without interacting with the browser | 10:15 |
| jamielennox | aloga: actually i may have read it incorrectly and it's not in the patch chain - i really dislike this gerrit interface where you can't tell immediately what the parents are | 10:16 |
| jamielennox | aloga: or maybe just the version you just uploaded and i'm looking at now doesn't have it | 10:17 |
| jamielennox | henrynash: yea, but it surprises me that you would need to force set = None, i would expect that to be the default | 10:17 |
| jamielennox | like based on the code i can't see any way that domain_id is not set (if missing its forced to =None) so why not just the backend expects that default? | 10:19 |
| henrynash | jamielenox: it’s in the query string, so no current API would set domain_id=None, since domain_id didn’t used to be an attribute of the role | 10:19 |
| henrynash | jamielennox: and we want to interpret the lack of setting domain_id in the quesry sting as the same as domain_id=None, so that we can only return those roles with domain_id=None (i.e. global roles) | 10:20 |
| jamielennox | henrynash: right, so why does me just leaving domain_id unset not do that by default | 10:20 |
| jamielennox | aloga: if it can't be done without the browser i'm annoyed that we carry it at all | 10:22 |
| henrynash | jamielennox: you mean why actually update the context_dict? I think I wanted to do that so that the url we return in the collection showed the default we had applied (maybe that was the wrong thing to do…) | 10:23 |
| jamielennox | henrynash: when i removed those lines it failed | 10:23 |
| henrynash | jamielennox: i”m trying to remmebr why I did it this way! | 10:24 |
| jamielennox | like if i don't do if not request.params.get('domain_id'): hints.add_filter('domain_id', None) it fails | 10:24 |
| henrynash | jamielennox: ok, let me go try and refersh my memory on why I did it this way! | 10:25 |
| *** wangqun has quit IRC | 10:26 | |
| openstackgerrit | Merged openstack/keystone: Use request instead of context in v2 auth https://review.openstack.org/336999 | 10:27 |
| aloga | jamielennox: sorry, I was in a meetting and I had to pretend I was attending | 10:30 |
| aloga | O:-) | 10:30 |
| jamielennox | aloga: ha - yep know that feeling | 10:30 |
| aloga | jamielennox: so, the other patches depends on it, os taking it out the chain would require a bit of work, but it's doable | 10:30 |
| aloga | jamielennox: but, there is no way to do that without the browser, I am afraid | 10:31 |
| henrynash | jamielennox: ah, right! | 10:32 |
| jamielennox | aloga: :( | 10:32 |
| henrynash | jamielennox: it’s to do with policy protection of the list_roles and list_domain_roles endpoints | 10:32 |
| henrynash | jamielennox: we want to be able to write policy rules that know if you are looking at global roles or not, and this is done by (effectively) looking in the query string to see if domain_id=None | 10:33 |
| jamielennox | henrynash: yep, so that's the split from the wrapper | 10:34 |
| henrynash | the @controller.filterprotected() wrapper | 10:34 |
| *** samueldmq has joined #openstack-keystone | 10:34 | |
| *** ChanServ sets mode: +v samueldmq | 10:34 | |
| jamielennox | henrynash: so so long as they go through the right function the correct policy should be enforced | 10:34 |
| henrynash | which is around teh endpoints themselves…. | 10:34 |
| samueldmq | morning keystone | 10:35 |
| henrynash | yep | 10:35 |
| jamielennox | henrynash: but i don't think that should require setting the value on the contextdict | 10:35 |
| henrynash | well, I think, that’s what @controller.filterprotected() uses to set the attributes that get passed to oslo.policy | 10:35 |
| henrynash | jamielennox: so you can write policy rules based on ths filters…AND…with our current plicy engine you can’t test for the lack of an attribute | 10:36 |
| aloga | jamielennox: the only option that I see is using "urn:ietf:wg:oauth:2.0:oob" as the redirect URL but this requires that 1) the user goes *manually* to an URL, 2) the user gets the code from a web page, 3) the user enters the code *interactively* | 10:36 |
| aloga | jamielennox: your brain is going to die of context switching high rate :P | 10:37 |
| henrynash | jamielennox: so we need be able to explictely test for domain_id = None (or not) in our policy rule for listing roles | 10:38 |
| jamielennox | henrynash: i'm not sure, because when i did the rearange to put it on the hints directly it still worked | 10:39 |
| henrynash | jamielennox: hmm, but something still doesn’t smell rigt | 10:39 |
| jamielennox | i need to figure out which test was failing | 10:39 |
| henrynash | jamielennox: I’ll look into it as well | 10:40 |
| *** jed56 has joined #openstack-keystone | 10:41 | |
| jamielennox | henrynash: keystone.tests.unit.test_v3_assignment.DomainSpecificRoleTests.test_get_and_list_domain_specific_roles | 10:42 |
| henrynash | jamielennox: that failed when you did what…not change the context dict? | 10:43 |
| jamielennox | henrynash: on master | 10:43 |
| jamielennox | diff --git a/keystone/assignment/controllers.py b/keystone/assignment/controllers.py | 10:43 |
| jamielennox | index 32fa07a..f897c1c 100644 | 10:43 |
| jamielennox | --- a/keystone/assignment/controllers.py | 10:43 |
| jamielennox | +++ b/keystone/assignment/controllers.py | 10:43 |
| jamielennox | @@ -335,11 +335,7 @@ class RoleV3(controller.V3Controller): | 10:43 |
| jamielennox | # global roles, so we set the domain_id filter to None. | 10:43 |
| jamielennox | # NOTE(jamielennox): this is still using context_dict because it's | 10:43 |
| jamielennox | # writing to the query dict. Why is it writing to the query dict? | 10:43 |
| jamielennox | - params = request.context_dict['query_string'] | 10:43 |
| jamielennox | - if 'domain_id' not in params: | 10:43 |
| jamielennox | - request.context_dict['query_string']['domain_id'] = None | 10:43 |
| jamielennox | - | 10:43 |
| jamielennox | - if request.context_dict['query_string']['domain_id'] is not None: | 10:43 |
| jamielennox | + if request.context_dict['query_string'].get('domain_id'): | 10:43 |
| jamielennox | return self.list_domain_roles(request) | 10:43 |
| jamielennox | else: | 10:43 |
| jamielennox | return self.list_roles(request) | 10:44 |
| jamielennox | i probably shouldn't paste that but whatever | 10:44 |
| jamielennox | testtools.matchers._impl.MismatchError: 3 != 6 | 10:44 |
| samueldmq | :-) | 10:44 |
| henrynash | jamielennix: Ok, let me study that! | 10:44 |
| samueldmq | jamielennox: henrynash: are you talking about a bug ? | 10:44 |
| samueldmq | or just something to be implemented ? | 10:45 |
| jamielennox | samueldmq: just an oddity i've found when rearranging some stuff | 10:45 |
| samueldmq | I am asking because I see you're talking about roles .... and test_implied_roles in keystoneclient FAIL when another test use a role fixture | 10:45 |
| samueldmq | which is very odd | 10:45 |
| samueldmq | jamielennox: kk | 10:46 |
| samueldmq | jamielennox: would you have any idea what's going on here ? patch 332871 | 10:46 |
| patchbot | samueldmq: https://review.openstack.org/#/c/332871/ - python-keystoneclient - Add project functional tests | 10:46 |
| samueldmq | jamielennox: I have looked at it for a bit and I don't have any clue | 10:46 |
| henrynash | jamielennox: are you saying it fails when you chnage that even with your additions to build_driver_hints? | 10:48 |
| jamielennox | samueldmq: so the error on that one in console.txt is to do with infra problems | 10:48 |
| samueldmq | jamielennox: the implied roles mismatch ? | 10:49 |
| jamielennox | henrynash: no i applied that direct to master, it should be the same outcome | 10:49 |
| samueldmq | jamielennox: gaah, let me get you the right logs, sorry | 10:49 |
| samueldmq | jamielennox: see the previous build http://logs.openstack.org/71/332871/8/check/gate-keystoneclient-dsvm-functional/b799e58/console.html.gz#_2016-06-30_10_55_54_814063 | 10:50 |
| henrynash | jamielennox: so yes, I would expect that to fail if you just nuked those lines, since that causes our filtering to only return global roles if you have not specified a domain_id ID at all in the query…so that makes sense | 10:53 |
| henrynash | jamielenox: the question is whether not upating the context is safe from a policy check point of view…whcih I will now invetsigate | 10:53 |
| *** TxGVNN has quit IRC | 10:54 | |
| jamielennox | henrynash: yea i was just looking at that as well | 10:55 |
| jamielennox | henrynash: yes, that's my thing - why does not domain_id not default to None | 10:56 |
| *** TxGVNN has joined #openstack-keystone | 10:57 | |
| henrynash | jamielennox: your question oon defaults…do you mean in the policy checking or teh actual filtering in terms of returning the correct collection | 10:59 |
| jamielennox | henrynash: the filtering | 10:59 |
| jamielennox | the backends | 10:59 |
| henrynash | jamielennox: ah, but there is a difference between not specifiying domain_id and domain_id=None…teh first means get me ALL roles, the seconds means get me all global roles…so we can’t leave it to the manager layer…it’s a current API difference | 11:01 |
| henrynash | (since we are going to, in the end, plug these filters into an sql coammnd) | 11:02 |
| jamielennox | henrynash: i don't think you can actually specify both those things | 11:04 |
| *** TxGVNN has quit IRC | 11:05 | |
| jamielennox | if you were to not specify the domain_id then the code sets it to None anyway | 11:05 |
| *** EinstCrazy has quit IRC | 11:05 | |
| jamielennox | henrynash: ok, your trying to manually trigger https://github.com/openstack/keystone/blob/master/keystone/assignment/role_backends/sql.py#L19-L25 | 11:10 |
| henrynash | jamielennox: gotta drop off as off to dentist…but will look at this later | 11:13 |
| *** henrynash has quit IRC | 11:13 | |
| *** code-R has joined #openstack-keystone | 11:14 | |
| *** TxGVNN has joined #openstack-keystone | 11:14 | |
| *** code-R has quit IRC | 11:19 | |
| *** links has joined #openstack-keystone | 11:24 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Handle role filtering in the backend https://review.openstack.org/338192 | 11:30 |
| jamielennox | henrynash_: is ^ equivalent? | 11:31 |
| *** rodrigods has quit IRC | 11:41 | |
| *** rodrigods has joined #openstack-keystone | 11:41 | |
| *** amoralej is now known as amoralej|lunch | 12:01 | |
| *** permalac has joined #openstack-keystone | 12:02 | |
| *** raildo-afk is now known as raildo | 12:14 | |
| *** jpena is now known as jpena|lunch | 12:23 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Add service functional tests https://review.openstack.org/337351 | 12:25 |
| *** pnavarro has quit IRC | 12:27 | |
| *** tonytan4ever has quit IRC | 12:27 | |
| *** henrynash has joined #openstack-keystone | 12:32 | |
| *** ChanServ sets mode: +v henrynash | 12:32 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Improve docs for v3 policies https://review.openstack.org/337829 | 12:34 |
| *** GB21 has quit IRC | 12:35 | |
| *** tonytan4ever has joined #openstack-keystone | 12:38 | |
| *** henrynash has quit IRC | 12:45 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Add policy functional tests https://review.openstack.org/337836 | 12:45 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Add project functional tests https://review.openstack.org/332871 | 12:45 |
| *** nisha has joined #openstack-keystone | 12:46 | |
| *** woodster_ has joined #openstack-keystone | 13:04 | |
| *** maestropandy has joined #openstack-keystone | 13:10 | |
| stevemar | o/ | 13:13 |
| nisha | o/ | 13:14 |
| *** amoralej|lunch is now known as amoralej | 13:14 | |
| *** code-R has joined #openstack-keystone | 13:15 | |
| *** pauloewerton has joined #openstack-keystone | 13:16 | |
| rodrigods | nisha, samueldmq, hey... found the issue in test_project | 13:16 |
| rodrigods | the actual issue | 13:16 |
| nisha | rodrigods, yeah, I was reading your comments | 13:17 |
| nisha | rodrigods, thank you, can you explain a bit please | 13:17 |
| rodrigods | i mean, what causes that test to interfere in test_implied_roles | 13:17 |
| rodrigods | nisha, do you have a ready devstack setup where you can run the tests? | 13:17 |
| nisha | rodrigods, yes, I have | 13:19 |
| rodrigods | nisha, ok, so first remove your .testrepository folder inside "python-keystoneclient" (after checking out this patch: https://review.openstack.org/#/c/332871/) | 13:20 |
| patchbot | rodrigods: patch 332871 - python-keystoneclient - Add project functional tests | 13:20 |
| *** code-R has quit IRC | 13:20 | |
| nisha | rodrigods, checking out patch, meaning downloading the patch(thus, moving into req. branch)? | 13:22 |
| rodrigods | nisha, yes! :) | 13:23 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: fix OpenID Connect authorization code grant_type https://review.openstack.org/330006 | 13:23 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: move the get_unscoped_auth_ref into the base class https://review.openstack.org/337140 | 13:23 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: add discovery document support https://review.openstack.org/330464 | 13:23 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: deprecate grant_type argument https://review.openstack.org/330465 | 13:23 |
| *** sigmavirus_away is now known as sigmavirus | 13:24 | |
| nisha | rodrigods, will do it in 5 min, I am in middle of follow up patch for policies | 13:25 |
| *** pnavarro has joined #openstack-keystone | 13:25 | |
| *** tonytan4ever has quit IRC | 13:26 | |
| *** tqtran has joined #openstack-keystone | 13:26 | |
| rodrigods | nisha, https://review.openstack.org/#/c/332871/9 commented there with the details | 13:26 |
| patchbot | rodrigods: patch 332871 - python-keystoneclient - Add project functional tests | 13:26 |
| rodrigods | samueldmq, ^ | 13:26 |
| *** tonytan4ever has joined #openstack-keystone | 13:27 | |
| breton | oh wow | 13:27 |
| *** tonytan_brb has joined #openstack-keystone | 13:27 | |
| rodrigods | breton, referring to that ^? | 13:27 |
| breton | nisha: are you planning to code functional tests for assignments? | 13:27 |
| breton | rodrigods: yep | 13:27 |
| *** tonytan4ever has quit IRC | 13:28 | |
| nisha | breton, yeah role_assignments too | 13:28 |
| *** M00nr41n has quit IRC | 13:29 | |
| breton | nisha: any ETA? I was planning to do the same, but if you do it, i'll swtich to catalog tests | 13:29 |
| rodrigods | breton, note that are ksc tests, not keystone | 13:30 |
| breton | oh. | 13:30 |
| breton | ooh. | 13:30 |
| breton | rodrigods: thanks | 13:30 |
| breton | nisha: nevermind then | 13:30 |
| *** tqtran has quit IRC | 13:30 | |
| breton | nisha: thanks for working on it though | 13:30 |
| stevemar | jamielennox: rebase the saml keystoneauth one? | 13:32 |
| nisha | breton, I am working as an Outreachy intern for May-Aug with Samuel as my mentor. We are working on writing client functional tests and improving docs for the same :) | 13:32 |
| nisha | breton, your suggestions are welcome :) | 13:32 |
| *** ametts has joined #openstack-keystone | 13:33 | |
| *** jpena|lunch is now known as jpena | 13:35 | |
| *** ayoung has joined #openstack-keystone | 13:38 | |
| *** ChanServ sets mode: +v ayoung | 13:38 | |
| *** itisha has joined #openstack-keystone | 13:39 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: fix OpenID Connect authorization code grant_type https://review.openstack.org/330006 | 13:43 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: move the get_unscoped_auth_ref into the base class https://review.openstack.org/337140 | 13:43 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: add discovery document support https://review.openstack.org/330464 | 13:43 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: deprecate grant_type argument https://review.openstack.org/330465 | 13:43 |
| *** richm has joined #openstack-keystone | 13:43 | |
| *** AJaeger has joined #openstack-keystone | 13:44 | |
| AJaeger | keystone stable cores, could you approve these backports of adding other-requirements, please? https://review.openstack.org/335814 and https://review.openstack.org/335813 . Those help us to keep the list of default package installs small. Thanks, stevemar for your +2 already. | 13:45 |
| stevemar | bknudson_: dolphm notmorgan ^ | 13:46 |
| stevemar | i think we need another stable core =\ | 13:46 |
| stevemar | with notmorgan and bknudson_ a bit side tracked these days | 13:46 |
| openstackgerrit | Merged openstack/keystone: Make assert_admin work with a request https://review.openstack.org/337022 | 13:47 |
| dstanek | stevemar: what's up with bknudson_ these days? | 13:49 |
| openstackgerrit | David Stanek proposed openstack/keystone: Deprecate the AdminTokenAuthMiddleware https://review.openstack.org/305287 | 13:51 |
| jdennis | has there been a decision in which release python-keystoneclient will no longer be shipped? | 13:52 |
| AJaeger | jdennis: we still need the library, don't we? | 13:52 |
| samueldmq | dstanek: see my comment https://review.openstack.org/#/c/305287/2/etc/keystone-paste.ini | 13:53 |
| patchbot | samueldmq: patch 305287 - keystone - Deprecate the AdminTokenAuthMiddleware | 13:53 |
| jdennis | to be more specific, when will the keystone cli cease to exist? | 13:53 |
| *** GB21 has joined #openstack-keystone | 13:54 | |
| dstanek | jdennis: i don't think we plan to stop shipping that. we just don't support the CLI anymore | 13:54 |
| dstanek | samueldmq: good find. i'll change that comment. we never actually deprecated anything | 13:55 |
| dstanek | samueldmq: i'm in the process of updating that again anyway to add a release note | 13:57 |
| samueldmq | dstanek: nice | 13:57 |
| *** links has quit IRC | 13:57 | |
| jdennis | dstanek: fair enough, let me rephrase: if you were telling a customer they needed to stop using the keystone cli and they had to switch to the openstack cli in which Openstack release would say they *must* make the switch? | 14:01 |
| *** code-R has joined #openstack-keystone | 14:01 | |
| dstanek | jdennis: isn't it already gone? | 14:03 |
| *** julim has joined #openstack-keystone | 14:03 | |
| dstanek | jdennis: http://docs.openstack.org/developer/python-keystoneclient/history.html#id3 | 14:04 |
| *** diazjf has joined #openstack-keystone | 14:06 | |
| lbragstad | notmorgan bknudson_ henrynash_ dolphm with https://review.openstack.org/#/c/336268/1 , when do options get registered? | 14:08 |
| patchbot | lbragstad: patch 336268 - keystone - Do not register options on import (MERGED) | 14:08 |
| *** SamYaple has joined #openstack-keystone | 14:08 | |
| *** diazjf has quit IRC | 14:09 | |
| *** henrynash has joined #openstack-keystone | 14:11 | |
| *** roxanaghe has quit IRC | 14:11 | |
| *** ChanServ sets mode: +v henrynash | 14:11 | |
| *** roxanaghe has joined #openstack-keystone | 14:11 | |
| *** bjornar_ has joined #openstack-keystone | 14:12 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Deprecate the AdminTokenAuthMiddleware https://review.openstack.org/305287 | 14:14 |
| *** code-R_ has joined #openstack-keystone | 14:16 | |
| SamYaple | dstanek: about https://review.openstack.org/305287 , can we bootstrap ldap domains now without the admin token? | 14:17 |
| openstackgerrit | David Stanek proposed openstack/keystone: Deprecate the AdminTokenAuthMiddleware https://review.openstack.org/305287 | 14:18 |
| *** code-R has quit IRC | 14:18 | |
| dstanek | SamYaple: you can use bootstrap to create an admin that can use the API to do whatever | 14:19 |
| *** diazjf has joined #openstack-keystone | 14:19 | |
| SamYaple | so it will still require at least one mysql backed domain | 14:20 |
| lbragstad | dstanek thoughts on my comment here? https://review.openstack.org/#/c/334673/1/keystone/common/validation/parameter_types.py | 14:21 |
| patchbot | lbragstad: patch 334673 - keystone - Allow id string validation to be configurable | 14:21 |
| *** nisha is now known as Guest19610 | 14:21 | |
| *** Guest19610 has quit IRC | 14:22 | |
| *** nisha_ has joined #openstack-keystone | 14:23 | |
| henrynash_ | jamielennix: you still around? | 14:24 |
| dstanek | lbragstad: commented on the review | 14:24 |
| lbragstad | dstanek sweet - thanks | 14:26 |
| lbragstad | dstanek you mean create a decorator for get_id_string() or just a factory? | 14:26 |
| *** BjoernT has joined #openstack-keystone | 14:26 | |
| dstanek | you'll need to create a new validation decorator and a factory for schema | 14:27 |
| dstanek | lbragstad: or possibly allow the exising one to accept a callable, but i like separate better if we can | 14:27 |
| lbragstad | dstanek so the factory will live in keystone/common/parameter_types.py | 14:27 |
| dstanek | lbragstad: yeah, the challenge is that anything that uses it will need to be a factory. no more declarative, module level schemas | 14:28 |
| *** phalmos has joined #openstack-keystone | 14:29 | |
| *** gordc has joined #openstack-keystone | 14:31 | |
| *** ravelar159 has joined #openstack-keystone | 14:31 | |
| lbragstad | dstanek got it - the factory part makes sense | 14:32 |
| *** jaugustine has joined #openstack-keystone | 14:32 | |
| lbragstad | dstanek let me post what i have and mark it as wip | 14:32 |
| *** sdake has joined #openstack-keystone | 14:33 | |
| dolphm | lbragstad: options get registered when keystone.conf.configure() is explicitly called https://github.com/openstack/keystone/blob/master/keystone/conf/__init__.py#L134-L135 | 14:33 |
| lbragstad | dolphm ah - so it looks like that is called from keystone/server/common.py | 14:35 |
| dolphm | lbragstad: 95% of it yes | 14:35 |
| lbragstad | er - that's one of the three places it is called | 14:35 |
| dolphm | lbragstad: right, tests, keystone-manage, and the wsgi module all call .configure() | 14:36 |
| lbragstad | ok - cool | 14:36 |
| dolphm | lbragstad: i'd like to look at doing it a bit more like nova, but hopefully without reintroducing a race condition | 14:36 |
| lbragstad | dolphm how does nova do it? | 14:36 |
| stevemar | jdennis: dstanek yes, it's already gone | 14:37 |
| stevemar | i think we removed it in the mitaka dev cycle | 14:37 |
| dolphm | lbragstad: that's the thing - pretty much like i was doing it, so nova has the race condition too | 14:37 |
| lbragstad | dolphm ah - interesting | 14:37 |
| lbragstad | dolphm I was going to say, it looked like we were doing exactly what they were doing | 14:38 |
| stevemar | jdennis: we did a major version jump when we released the new keystoneclient | 14:38 |
| dolphm | lbragstad: notmorgan and bknudson_ said they avoid the race condition from being a problem with diligent code reviewing :( | 14:38 |
| stevemar | jdennis: http://releases.openstack.org/teams/keystone.html | 14:38 |
| stevemar | jdennis: so *very* beginning of newton we dropped it | 14:38 |
| stevemar | jdennis: we cut 3.0.0 of keystoneclient | 14:38 |
| lbragstad | dolphm so - they make sure they don't introduce a race condition by not merging anything that can cause one? | 14:39 |
| dstanek | stevemar: yep, 3.0.0 was where we dropped it | 14:39 |
| dolphm | lbragstad: correct | 14:39 |
| lbragstad | dolphm hm | 14:39 |
| dolphm | lbragstad: like, they would have caught your patch like brant did | 14:39 |
| dolphm | lbragstad: not exactly fool-proof | 14:39 |
| *** woodburn has joined #openstack-keystone | 14:39 | |
| *** henrynash has quit IRC | 14:39 | |
| *** nisha_ has quit IRC | 14:39 | |
| lbragstad | that sounds like a big foot-gun/tribal knowledge | 14:39 |
| *** nisha_ has joined #openstack-keystone | 14:40 | |
| dolphm | lbragstad: yep | 14:40 |
| *** pushkaru has joined #openstack-keystone | 14:42 | |
| stevemar | dolphm: have a quick minute for simple backports? | 14:42 |
| stevemar | dolphm: https://review.openstack.org/#/c/335814/ and https://review.openstack.org/#/c/335813/ for AJaeger | 14:42 |
| patchbot | stevemar: patch 335814 - python-keystoneclient (stable/liberty) - List system dependencies for running common tests | 14:42 |
| patchbot | stevemar: patch 335813 - python-keystoneclient (stable/mitaka) - List system dependencies for running common tests | 14:42 |
| AJaeger | thanks, stevemar for pinging on my behalf | 14:43 |
| dolphm | stevemar: yes | 14:48 |
| *** nisha__ has joined #openstack-keystone | 14:54 | |
| *** KevinE has joined #openstack-keystone | 14:55 | |
| *** nisha_ has quit IRC | 14:56 | |
| *** KevinE has quit IRC | 14:56 | |
| *** GB21 has quit IRC | 14:56 | |
| *** nisha__ is now known as nisha_ | 14:56 | |
| *** KevinE has joined #openstack-keystone | 14:56 | |
| *** thumpba has joined #openstack-keystone | 15:01 | |
| *** diazjf has quit IRC | 15:01 | |
| *** diazjf has joined #openstack-keystone | 15:01 | |
| *** ddieterly has joined #openstack-keystone | 15:05 | |
| *** pcaruana has quit IRC | 15:06 | |
| *** harlowja has joined #openstack-keystone | 15:07 | |
| *** code-R_ has quit IRC | 15:07 | |
| *** code-R has joined #openstack-keystone | 15:08 | |
| *** timcline has joined #openstack-keystone | 15:08 | |
| *** chrisshattuck has joined #openstack-keystone | 15:09 | |
| *** rcernin has quit IRC | 15:10 | |
| *** maestropandy has quit IRC | 15:12 | |
| *** aastha has joined #openstack-keystone | 15:13 | |
| *** jaugustine has quit IRC | 15:14 | |
| *** gsilvis_ is now known as gsilvis | 15:14 | |
| *** KevinE has quit IRC | 15:15 | |
| *** jaugustine has joined #openstack-keystone | 15:16 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Allow id string validation to be configurable https://review.openstack.org/334673 | 15:17 |
| *** maestropandy has joined #openstack-keystone | 15:18 | |
| *** thiagolib has joined #openstack-keystone | 15:18 | |
| *** tonytan_brb is now known as tonytan4ever | 15:18 | |
| *** pushkaru has quit IRC | 15:24 | |
| dolphm | stevemar: AJaeger: is there a bug / spec to track the platform dependencies work? i've seen it in a few other projects, but haven't read up on it | 15:25 |
| lbragstad | dstanek updated https://review.openstack.org/#/c/334673/2 and marked as wip | 15:26 |
| patchbot | lbragstad: patch 334673 - keystone - Allow id string validation to be configurable | 15:26 |
| lbragstad | dstanek I added the factory to parameter_types, but the other part would be adding another decorator here - https://github.com/openstack/keystone/blob/46b76a3d8e302f47daf04c739066f70b7438e0da/keystone/common/validation/__init__.py#L22 ? | 15:27 |
| *** code-R has quit IRC | 15:29 | |
| *** KevinE has joined #openstack-keystone | 15:35 | |
| dstanek | samueldmq meet lbragstad; lbragstad meet samueldmq; you guys may be working toward resolving the same race condition bug | 15:37 |
| samueldmq | dstanek: yes we have been working on that together :-) | 15:38 |
| samueldmq | but haven't been updating each other recently | 15:38 |
| samueldmq | (I looked at that again yesterday) | 15:38 |
| samueldmq | lbragstad: hi, nice to meet you | 15:38 |
| lbragstad | samueldmq where you able to recreate any of those issues since ayoung's patch landed | 15:38 |
| lbragstad | samueldmq o/ | 15:38 |
| samueldmq | lbragstad: yes | 15:38 |
| samueldmq | lbragstad: at a given patchset of ayoung's patch (one without that cache!), the tests passed | 15:39 |
| lbragstad | samueldmq so - we're still susceptible to it even though we have revocation events in a linear search? | 15:39 |
| samueldmq | lbragstad: with cache (it merged with cache), it's been failing | 15:39 |
| samueldmq | lbragstad: https://review.openstack.org/#/c/319497/ | 15:39 |
| patchbot | samueldmq: patch 319497 - keystone - DO NOT MERGE: Test fix for fernet race condition | 15:39 |
| samueldmq | lbragstad: yes, still the same situation | 15:39 |
| ayoung | samueldmq, where is the patch that does the caching correctly? | 15:40 |
| lbragstad | ugh - are you able to recreate any of the failures locally? | 15:40 |
| lbragstad | samueldmq or is it only in the gate? | 15:40 |
| samueldmq | lbragstad: in the gate | 15:40 |
| dstanek | can it be reproduced locally? | 15:40 |
| samueldmq | ayoung: you patch for linear search, one of the versions you had removed cache | 15:40 |
| samueldmq | ayoung: and my test passed | 15:41 |
| lbragstad | dstanek bknudson_ samueldmq and myself were unable to recreate it locally | 15:41 |
| lbragstad | via a host of different methods | 15:41 |
| ayoung | samueldmq, nah, there was a follow on, I thought you wrote, that did the caching better | 15:41 |
| *** diazjf has quit IRC | 15:41 | |
| lbragstad | it only seems to be an issue in the gate | 15:41 |
| samueldmq | ayoung: see rechecks of patchset 1 in https://review.openstack.org/#/c/319497/ | 15:41 |
| patchbot | samueldmq: patch 319497 - keystone - DO NOT MERGE: Test fix for fernet race condition | 15:41 |
| samueldmq | ayoung: ah yes, even with revoking the cache, it fails :( | 15:41 |
| dstanek | maybe the fourth try is the charm | 15:41 |
| lbragstad | dstanek that's what we said the second and third time too ;) | 15:42 |
| samueldmq | ayoung: lbragstad I thought https://review.openstack.org/#/c/316991/ would fix it | 15:42 |
| samueldmq | but not | 15:42 |
| patchbot | samueldmq: patch 316991 - keystone - Invalidate token cache after token delete | 15:42 |
| *** KevinE has quit IRC | 15:42 | |
| samueldmq | I rebased https://review.openstack.org/#/c/319497/ on this potential fix ^, but it still failed, no luck | 15:43 |
| patchbot | samueldmq: patch 319497 - keystone - DO NOT MERGE: Test fix for fernet race condition | 15:43 |
| ayoung | samueldmq, I think it needs to be invalidated at other times, too | 15:43 |
| ayoung | samueldmq, lets look at the failing test...might be due to a different side effect | 15:43 |
| ayoung | gate-keystone-python35-db-nv FAILURE in 2m 13s (non-voting) | 15:44 |
| ayoung | that was all that failed, right? | 15:44 |
| samueldmq | no | 15:44 |
| samueldmq | I am talking about the patch that testes fernet | 15:44 |
| samueldmq | gate-tempest-dsvm-full failed there, for eg | 15:44 |
| samueldmq | see this patch https://review.openstack.org/#/c/319497/ | 15:44 |
| patchbot | samueldmq: patch 319497 - keystone - DO NOT MERGE: Test fix for fernet race condition | 15:44 |
| samueldmq | ayoung: http://logs.openstack.org/97/319497/2/check/gate-tempest-dsvm-full/9a25562/console.html#_2016-07-05_17_11_41_879231 | 15:45 |
| ayoung | samueldmq, ok...but 316991 should go in, right? | 15:45 |
| samueldmq | ayoung: it goes, there is a Depends-On: I496531a30559f0cf021c4478404093a99f2fbe3d | 15:46 |
| *** maestropandy has quit IRC | 15:46 | |
| samueldmq | which is 316991 | 15:46 |
| *** rcernin has joined #openstack-keystone | 15:49 | |
| *** slberger has joined #openstack-keystone | 15:51 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Limits config fixture usage to where it's needed https://review.openstack.org/266399 | 15:54 |
| *** nisha_ has quit IRC | 15:55 | |
| samueldmq | ayoung: I could submit a patch removing the cache on validate_token | 15:55 |
| samueldmq | ayoung: and make the test patch depends on it | 15:55 |
| *** nisha_ has joined #openstack-keystone | 15:55 | |
| samueldmq | ayoung: if it passes, we're missing to invalidate that somewhere | 15:55 |
| ayoung | samueldmq, ++ | 15:56 |
| *** roxanagh_ has joined #openstack-keystone | 15:56 | |
| *** code-R has joined #openstack-keystone | 15:57 | |
| *** code-R_ has joined #openstack-keystone | 15:59 | |
| *** ddieterly is now known as ddieterly[away] | 15:59 | |
| *** ayoung has quit IRC | 16:00 | |
| *** code-R has quit IRC | 16:02 | |
| *** ddieterly[away] is now known as ddieterly | 16:05 | |
| dstanek | samueldmq: do you still have a link to that tempest test that fails? | 16:07 |
| *** jaugustine has quit IRC | 16:08 | |
| *** shaleh has joined #openstack-keystone | 16:11 | |
| *** ravelar159 has quit IRC | 16:12 | |
| *** ddieterly is now known as ddieterly[away] | 16:12 | |
| *** ravelar159 has joined #openstack-keystone | 16:12 | |
| *** jaugustine has joined #openstack-keystone | 16:12 | |
| *** alex_xu has quit IRC | 16:15 | |
| *** ayoung has joined #openstack-keystone | 16:15 | |
| *** ChanServ sets mode: +v ayoung | 16:15 | |
| *** jaugustine has quit IRC | 16:17 | |
| *** bjornar_ has quit IRC | 16:18 | |
| *** ravelar_159 has joined #openstack-keystone | 16:19 | |
| *** ravelar159 has quit IRC | 16:20 | |
| *** gyee has joined #openstack-keystone | 16:21 | |
| *** ChanServ sets mode: +v gyee | 16:21 | |
| lbragstad | henrynash_ around? | 16:23 |
| lbragstad | henrynash_ is domain specific backends designed to work with multiple domains in each "backend"? https://bugs.launchpad.net/keystone/+bug/1555629 | 16:23 |
| openstack | Launchpad bug 1555629 in OpenStack Identity (keystone) "v3/users reports all users in all domains excepts when domain_specific_drivers_enabled is set to true." [Undecided,New] | 16:23 |
| *** KevinE has joined #openstack-keystone | 16:24 | |
| *** KevinE has quit IRC | 16:25 | |
| *** KevinE has joined #openstack-keystone | 16:26 | |
| dstanek | lbragstad: i don't think so, if i understand what you are asking. i think you just make a config for a domain and specify a backend and configuration for it. | 16:29 |
| dstanek | you may use the same backend code, but you'd get different instances of the driver for different domains | 16:29 |
| lbragstad | dstanek in that bug report - they are seeing an API behavior issue when they have multiple domains in a single backend and the domain_specific_drivers_enabled options is True | 16:30 |
| *** david-lyle_ has joined #openstack-keystone | 16:30 | |
| dstanek | lbragstad: looking | 16:30 |
| lbragstad | it makes me think we need to document that use of domain specific backends | 16:31 |
| *** david-lyle_ is now known as david-lyle | 16:32 | |
| lbragstad | It would probably clear up some confusion if we answered the question "Is domain specific backends designed to work with multiple domains in each backend, or only a single domain in each backend?" | 16:32 |
| *** clenimar has joined #openstack-keystone | 16:33 | |
| *** KevinE has quit IRC | 16:33 | |
| *** nisha_ has quit IRC | 16:34 | |
| *** KevinE has joined #openstack-keystone | 16:34 | |
| dstanek | lbragstad: one of the comments pointed to the docs that describe this behavior | 16:35 |
| dstanek | https://bugs.launchpad.net/keystone/+bug/1555629/comments/4 | 16:35 |
| openstack | Launchpad bug 1555629 in OpenStack Identity (keystone) "v3/users reports all users in all domains excepts when domain_specific_drivers_enabled is set to true." [Undecided,New] | 16:35 |
| *** ddieterly[away] is now known as ddieterly | 16:35 | |
| lbragstad | dstanek so we could close that bug? | 16:38 |
| *** david-lyle has quit IRC | 16:39 | |
| lbragstad | dstanek but jesse brings up a good point in comment #9 | 16:39 |
| dstanek | if domain specific backends is enabled i don't think we can list users or groups efficiently. you'd have to iterate over all configured drivers, for which a user has authz on, and pull the lists, squash them together, etc | 16:40 |
| dstanek | i don't think real users will ever list all users in all domains. i think that would be cloud operators and they should not be surprised that the feature is enabled | 16:41 |
| lbragstad | that's a good point | 16:42 |
| dstanek | i'll add my viewpoint to the bug | 16:43 |
| *** gyee has quit IRC | 16:45 | |
| dstanek | commented | 16:48 |
| *** amoralej is now known as amoralej|off | 16:49 | |
| *** tesseract- has quit IRC | 16:49 | |
| dstanek | stevemar: take a look at https://bugs.launchpad.net/keystone/+bug/1555629 again? i think we should mark it as WONTFIX | 16:52 |
| openstack | Launchpad bug 1555629 in OpenStack Identity (keystone) "v3/users reports all users in all domains excepts when domain_specific_drivers_enabled is set to true." [Undecided,New] | 16:52 |
| *** TxGVNN has quit IRC | 16:54 | |
| *** ravelar_159 has quit IRC | 16:55 | |
| *** ravelar159 has joined #openstack-keystone | 16:59 | |
| *** gyee has joined #openstack-keystone | 17:00 | |
| *** ChanServ sets mode: +v gyee | 17:00 | |
| *** dan_nguyen has joined #openstack-keystone | 17:02 | |
| *** ayoung has quit IRC | 17:06 | |
| *** browne has joined #openstack-keystone | 17:07 | |
| *** jpena is now known as jpena|off | 17:10 | |
| *** jlk has quit IRC | 17:11 | |
| *** jlk has joined #openstack-keystone | 17:12 | |
| *** jlk has joined #openstack-keystone | 17:12 | |
| *** ddieterly is now known as ddieterly[away] | 17:13 | |
| *** dan_nguyen has quit IRC | 17:14 | |
| harlowja | where's adam :-P | 17:14 |
| harlowja | come back adam | 17:14 |
| harlowja | lol | 17:14 |
| AJaeger | dolphm: I've added the links to the review. The nova change was done in reaction to a new keyring release that needed additional dependencies installed on all images. For the change that added this to infra there was no bug ;( | 17:16 |
| dolphm | AJaeger: thanks, i recognize it's probably necessary for stable/* but i'd like to follow up for my own sake | 17:17 |
| *** ddieterly[away] is now known as ddieterly | 17:17 | |
| *** daemontool has quit IRC | 17:18 | |
| AJaeger | dolphm: sure, what can I help there? | 17:18 |
| *** ayoung has joined #openstack-keystone | 17:19 | |
| *** ChanServ sets mode: +v ayoung | 17:19 | |
| notmorgan | eeuuuwww more keyring issues :( | 17:23 |
| *** jaugustine has joined #openstack-keystone | 17:24 | |
| *** tqtran has joined #openstack-keystone | 17:27 | |
| *** bjornar_ has joined #openstack-keystone | 17:48 | |
| *** ddieterly is now known as ddieterly[away] | 17:49 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Support encryption of credentials in Keystone https://review.openstack.org/317169 | 17:53 |
| *** sdake has quit IRC | 17:55 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Fix the username value in federated tokens https://review.openstack.org/335617 | 17:55 |
| *** sdake has joined #openstack-keystone | 17:56 | |
| *** jaugustine has quit IRC | 17:57 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Support encryption of credentials in Keystone https://review.openstack.org/317169 | 17:59 |
| *** browne1 has joined #openstack-keystone | 18:00 | |
| *** browne has quit IRC | 18:00 | |
| *** sdake has quit IRC | 18:02 | |
| *** browne1 has quit IRC | 18:03 | |
| *** browne has joined #openstack-keystone | 18:05 | |
| *** diazjf has joined #openstack-keystone | 18:06 | |
| *** sdake has joined #openstack-keystone | 18:08 | |
| *** sdake has quit IRC | 18:08 | |
| *** sdake has joined #openstack-keystone | 18:08 | |
| *** permalac has quit IRC | 18:09 | |
| *** AJaeger has left #openstack-keystone | 18:17 | |
| stevemar | dstanek: looking | 18:19 |
| samueldmq | dstanek: ahve you found the link you were looking for ? | 18:20 |
| samueldmq | dstanek: https://review.openstack.org/#/c/319497/ | 18:20 |
| patchbot | samueldmq: patch 319497 - keystone - DO NOT MERGE: Test fix for fernet race condition | 18:20 |
| dstanek | stevemar: both dolphm and lbragstad have mixed opinions on the subject | 18:21 |
| stevemar | dstanek: why not just check if we have multiple backends before changing the behaviour | 18:21 |
| dstanek | stevemar: what do you mean? | 18:22 |
| dstanek | if you have multiple backends you get a different behavior | 18:22 |
| stevemar | dstanek: right, even if you don't have any | 18:22 |
| stevemar | dstanek: the behaviour changes if "domain_specific_drivers_enabled" is set to T/F | 18:23 |
| stevemar | regardless if you have any domain specific drivers | 18:23 |
| dstanek | stevemar: that doesn't address Jessie's concern with I think is more important to have an official stance on | 18:24 |
| *** jed56 has quit IRC | 18:25 | |
| stevemar | dstanek: he wants to list all the users even though he has multiple domains | 18:25 |
| lbragstad | If I'm reading Jesse's comment correctly, he wants it so that when a user lists all users from keystone, they get all users regardless of the domain they are in and regardless of multiple domain backends | 18:25 |
| dstanek | that's how i read it as well | 18:26 |
| lbragstad | in order to do that, we would have to get all the domains the user making the request has access to, list all users for those domains, then compile all the sets and return that in the response | 18:26 |
| openstackgerrit | Sean Perry proposed openstack/keystoneauth: Show deprecation when a user_agent is not set https://review.openstack.org/289645 | 18:27 |
| lbragstad | right? | 18:27 |
| stevemar | #success http://developer.openstack.org/api-ref.html now shows keystone's in-tree APIs ! | 18:27 |
| openstackstatus | stevemar: Added success to Success page | 18:27 |
| stevemar | samueldmq: ^ | 18:27 |
| lbragstad | or... we just return all users for all domains | 18:27 |
| lbragstad | all the time... | 18:27 |
| samueldmq | samueldmq: woot, that's great | 18:28 |
| samueldmq | opps | 18:28 |
| samueldmq | stevemar: ^ not myself | 18:28 |
| dstanek | lbragstad: you still have to check access to you don't give out user data to someone that is not allowed to see it | 18:28 |
| dstanek | not coke's admin can see pepsi's users? or is this just for cloud ops? | 18:28 |
| dstanek | s/not/now/ | 18:29 |
| *** dan_nguyen has joined #openstack-keystone | 18:31 | |
| lbragstad | dstanek yeah - that's a good point | 18:32 |
| lbragstad | returning all users regardless doesn't seem like the right solution | 18:32 |
| *** ddieterly[away] is now known as ddieterly | 18:34 | |
| *** ayoung has quit IRC | 18:35 | |
| *** diazjf has quit IRC | 18:36 | |
| *** jaugustine has joined #openstack-keystone | 18:38 | |
| openstackgerrit | Sean Perry proposed openstack/keystoneauth: Show deprecation when a user_agent is not set https://review.openstack.org/289645 | 18:39 |
| *** jaugustine has quit IRC | 18:42 | |
| *** diazjf has joined #openstack-keystone | 18:43 | |
| *** esumerfd has joined #openstack-keystone | 18:54 | |
| *** sheel has quit IRC | 18:55 | |
| *** ddieterly is now known as ddieterly[away] | 18:57 | |
| *** ddieterly[away] is now known as ddieterly | 19:02 | |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Fix mispelled method name in setup.cfg https://review.openstack.org/338503 | 19:10 |
| *** esumerfd has left #openstack-keystone | 19:10 | |
| *** nk2527 has joined #openstack-keystone | 19:12 | |
| *** diazjf has quit IRC | 19:17 | |
| *** samueldmq has quit IRC | 19:23 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Order revocation query to prevent deadlocks https://review.openstack.org/338507 | 19:26 |
| lbragstad | gyee mind if i mark https://bugs.launchpad.net/keystone/+bug/1553324 as a duplicate of https://bugs.launchpad.net/keystone/+bug/1471665 | 19:27 |
| openstack | Launchpad bug 1553324 in OpenStack Security Notes "potential DOS with revoke by id or audit_id" [Undecided,New] - Assigned to Luke Hinds (lhinds) | 19:27 |
| openstack | Launchpad bug 1471665 in OpenStack Identity (keystone) "Successive runs of identity tempest tests take more and more time to finish" [Low,Confirmed] | 19:27 |
| *** adu has joined #openstack-keystone | 19:34 | |
| *** adu has quit IRC | 19:37 | |
| *** gagehugo has joined #openstack-keystone | 19:39 | |
| *** diazjf has joined #openstack-keystone | 19:41 | |
| *** ddieterly is now known as ddieterly[away] | 19:44 | |
| *** ayoung has joined #openstack-keystone | 19:56 | |
| *** ChanServ sets mode: +v ayoung | 19:56 | |
| *** ravelar159 has quit IRC | 19:56 | |
| *** alex_xu has joined #openstack-keystone | 19:58 | |
| *** diazjf has quit IRC | 20:01 | |
| *** julim has quit IRC | 20:01 | |
| *** diazjf has joined #openstack-keystone | 20:02 | |
| *** julim has joined #openstack-keystone | 20:05 | |
| *** rcernin_ has joined #openstack-keystone | 20:06 | |
| *** dan_nguyen has quit IRC | 20:06 | |
| *** pnavarro has quit IRC | 20:07 | |
| *** ddieterly[away] is now known as ddieterly | 20:08 | |
| *** rcernin_ has quit IRC | 20:10 | |
| openstackgerrit | Shawn Berger proposed openstack/keystone: Added name to duplicate entry error message. https://review.openstack.org/337892 | 20:10 |
| *** sdake has quit IRC | 20:12 | |
| *** rcernin_ has joined #openstack-keystone | 20:15 | |
| *** rcernin_ has quit IRC | 20:19 | |
| *** sdake has joined #openstack-keystone | 20:19 | |
| *** rcernin_ has joined #openstack-keystone | 20:19 | |
| *** rcernin_ has quit IRC | 20:20 | |
| *** ravelar159 has joined #openstack-keystone | 20:22 | |
| *** ravelar159 has quit IRC | 20:22 | |
| *** ravelar159 has joined #openstack-keystone | 20:23 | |
| *** pnavarro has joined #openstack-keystone | 20:23 | |
| *** rcernin has quit IRC | 20:24 | |
| *** rcernin has joined #openstack-keystone | 20:25 | |
| *** rcernin has quit IRC | 20:25 | |
| *** rcernin has joined #openstack-keystone | 20:25 | |
| dstanek | 2/b 25 | 20:27 |
| *** ddieterly is now known as ddieterly[away] | 20:33 | |
| *** samueldmq has joined #openstack-keystone | 20:36 | |
| *** ChanServ sets mode: +v samueldmq | 20:36 | |
| *** ddieterly[away] is now known as ddieterly | 20:36 | |
| *** rcernin has quit IRC | 20:38 | |
| *** rcernin has joined #openstack-keystone | 20:39 | |
| *** jaugustine has joined #openstack-keystone | 20:39 | |
| gyee | lbragstad, yes, they are related, still require OSSN nevertheless | 20:42 |
| *** samueldmq has quit IRC | 20:44 | |
| *** jaugustine has quit IRC | 20:45 | |
| *** thumpba has quit IRC | 20:46 | |
| *** raildo is now known as raildo-afk | 20:51 | |
| *** sdake has quit IRC | 20:53 | |
| *** timcline has quit IRC | 20:58 | |
| *** timcline has joined #openstack-keystone | 20:58 | |
| *** dan_nguyen has joined #openstack-keystone | 20:58 | |
| *** ravelar159 has quit IRC | 21:01 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Add a py35 tox venv for Python 3.5 support https://review.openstack.org/337952 | 21:01 |
| *** sdake has joined #openstack-keystone | 21:03 | |
| *** rcernin has quit IRC | 21:03 | |
| *** rcernin has joined #openstack-keystone | 21:04 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: fix OpenID Connect authorization code grant_type https://review.openstack.org/330006 | 21:05 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: move the get_unscoped_auth_ref into the base class https://review.openstack.org/337140 | 21:05 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: add discovery document support https://review.openstack.org/330464 | 21:05 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: deprecate grant_type argument https://review.openstack.org/330465 | 21:05 |
| *** julim has quit IRC | 21:07 | |
| *** diazjf has quit IRC | 21:07 | |
| *** rcernin has quit IRC | 21:07 | |
| *** rcernin has joined #openstack-keystone | 21:07 | |
| *** pauloewerton has quit IRC | 21:19 | |
| openstackgerrit | Merged openstack/oslo.policy: Fix mispelled method name in setup.cfg https://review.openstack.org/338503 | 21:28 |
| jamielennox | bknudson_: can you have a look at https://review.openstack.org/#/c/301918/ when you have a sec | 21:31 |
| patchbot | jamielennox: patch 301918 - oslo.context - Add oslo.context name attributes matching ids | 21:31 |
| jamielennox | bknudson_: shouldn't be that difficult i just want to get some movement on context | 21:31 |
| *** rcernin has quit IRC | 21:37 | |
| *** pnavarro has quit IRC | 21:37 | |
| *** ddieterly is now known as ddieterly[away] | 21:40 | |
| *** dan_nguyen has quit IRC | 21:44 | |
| *** gordc has quit IRC | 21:44 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add test coverage for trust tokens and domains https://review.openstack.org/265455 | 21:44 |
| *** rvba has quit IRC | 21:48 | |
| *** sigmavirus is now known as sigmavirus_away | 21:52 | |
| *** gyee has quit IRC | 21:54 | |
| *** timcline has quit IRC | 21:56 | |
| *** diazjf has joined #openstack-keystone | 21:56 | |
| *** diazjf has quit IRC | 22:00 | |
| *** spzala has joined #openstack-keystone | 22:00 | |
| *** ametts has quit IRC | 22:02 | |
| *** ddieterly[away] is now known as ddieterly | 22:03 | |
| *** gagehugo has quit IRC | 22:05 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Add a py35 tox venv for Python 3.5 support https://review.openstack.org/337952 | 22:12 |
| *** bjornar_ has quit IRC | 22:18 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Add a py35 tox venv for Python 3.5 support https://review.openstack.org/337952 | 22:20 |
| *** david-lyle_ has joined #openstack-keystone | 22:21 | |
| *** KevinE has quit IRC | 22:25 | |
| *** david-lyle__ has joined #openstack-keystone | 22:26 | |
| *** timcline has joined #openstack-keystone | 22:26 | |
| *** timcline_ has joined #openstack-keystone | 22:29 | |
| *** timcline has quit IRC | 22:31 | |
| *** timcline_ has quit IRC | 22:33 | |
| *** david-lyle_ is now known as david-lyle | 22:35 | |
| *** david-lyle__ has quit IRC | 22:36 | |
| *** thiagolib has quit IRC | 22:38 | |
| *** slberger has left #openstack-keystone | 22:38 | |
| *** spzala has quit IRC | 22:38 | |
| *** spzala has joined #openstack-keystone | 22:39 | |
| *** spzala has quit IRC | 22:45 | |
| *** jgos1 has joined #openstack-keystone | 22:49 | |
| *** ddieterly is now known as ddieterly[away] | 22:52 | |
| *** ddieterly[away] is now known as ddieterly | 22:52 | |
| *** ddieterly has quit IRC | 22:52 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Fix the username value in federated tokens https://review.openstack.org/335617 | 22:57 |
| *** BjoernT has quit IRC | 22:58 | |
| *** phalmos has quit IRC | 23:00 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Fix the username value in federated tokens https://review.openstack.org/335617 | 23:03 |
| *** pushkaru has joined #openstack-keystone | 23:05 | |
| *** spzala has joined #openstack-keystone | 23:06 | |
| *** spzala has quit IRC | 23:10 | |
| jamielennox | notmorgan: herre? | 23:14 |
| *** code-R_ has quit IRC | 23:18 | |
| *** chrisshattuck has quit IRC | 23:20 | |
| *** timcline has joined #openstack-keystone | 23:23 | |
| *** timcline has quit IRC | 23:27 | |
| *** roxanagh_ has quit IRC | 23:27 | |
| *** pushkaru has quit IRC | 23:35 | |
| *** jgos1 has quit IRC | 23:36 | |
| *** ravelar159 has joined #openstack-keystone | 23:39 | |
| *** itisha has quit IRC | 23:40 | |
| *** ravelar159 has quit IRC | 23:40 | |
| *** sdake has quit IRC | 23:43 | |
| *** code-R has joined #openstack-keystone | 23:45 | |
| notmorgan | jamielennox: sortof | 23:50 |
| jamielennox | notmorgan: want to debate your -2 on https://review.openstack.org/#/c/248524/ | 23:50 |
| patchbot | jamielennox: patch 248524 - keystoneauth - Allow prompting for password when CLI loading | 23:50 |
| jamielennox | i left a comment with most of it | 23:50 |
| jamielennox | but i don't expect people to see those after a -2 | 23:50 |
| notmorgan | i would argue occ and osc should do the prompting | 23:51 |
| notmorgan | not KSA | 23:51 |
| jamielennox | notmorgan: they will, os-c-c uses the opts to do it's own loading | 23:51 |
| jamielennox | this would give the opts the prompt param so they know to prompt | 23:51 |
| jamielennox | and then in the case where ksa is handling the cli loading (rare, it'll be done via os-c-c) will let it prompt | 23:52 |
| notmorgan | it's the getpass.getpass i don't want ksa to provide prompting code | 23:52 |
| notmorgan | i would _much_ rather let OSC/OCC do that part | 23:52 |
| notmorgan | and set the values before passing to KSA | 23:52 |
| jamielennox | i consider the ksa cli loading a reference implementation at this point | 23:52 |
| jamielennox | notmorgan: os-c-c doesn't hit that path | 23:52 |
| jamielennox | they would have to handle prompting as they see fit | 23:53 |
| notmorgan | again, i just don't think prompting code that actually interrupts runtim for user-input-from-stdin belongs in ksa | 23:53 |
| notmorgan | thats where i'm having an issue. | 23:53 |
| notmorgan | i'm fine with documenting it, i don't want someone consuming this directly from ksa, if that makes sense. | 23:54 |
| jamielennox | notmorgan: so that code only gets triggered when ksa is told to load options from a parsed CLI argparse.namespace - which is not how os-c-c does it | 23:54 |
| *** roxanagh_ has joined #openstack-keystone | 23:54 | |
| jamielennox | we need the option on Opt either way | 23:54 |
| jamielennox | but it seems silly to me to have this functionality unused by the most basic implementation | 23:54 |
| jamielennox | again, anyone using OSC/os-c-c will not hit this path | 23:55 |
| notmorgan | then why do we need it? | 23:55 |
| notmorgan | why do we need keystoneauth to specifically prompt a user for input | 23:55 |
| jamielennox | because there are older scripts that do, and because most people look at that code when doing there own thing | 23:56 |
| notmorgan | document it, provide examples on "how to". but i view KSA as not-providing-direct-user-interaction | 23:56 |
| jamielennox | notmorgan: you're basically arguing that keystoneauth1/loading/cli.py shouldn't exist - and that's ok we've had that before | 23:56 |
| notmorgan | pretty much. | 23:56 |
| jamielennox | notmorgan: but it does exist and it seems dumb to hamstring it now | 23:56 |
| *** jdennis1 has joined #openstack-keystone | 23:56 | |
| notmorgan | here is the deal. get mordred and stevemar to agree with you [even "eh, sure"] and i'm willing to rescind the -2 | 23:57 |
| notmorgan | mostly because mordred and I discussed this a bit and both agreed that ksa shouldn't be getting into the prompting business | 23:58 |
| notmorgan | and stevemar being the ptl. | 23:58 |
| notmorgan | mordred also is a big consumer of KSA and sees where is has/is being used. | 23:58 |
| *** jdennis has quit IRC | 23:59 | |
| notmorgan | jamielennox: i'm willing to give in. i just think this is a bad(tm) idea to implement | 23:59 |
| jamielennox | alright, then either way i need to split that patch | 23:59 |
| jamielennox | because i thought we got the prompt= param on Opts ages ago | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!