| *** ravelar159 has joined #openstack-keystone | 00:02 | |
| *** ravelar159 has quit IRC | 00:10 | |
| *** nkinder has quit IRC | 00:11 | |
| *** woodburn1 has joined #openstack-keystone | 00:11 | |
| *** code-R has quit IRC | 00:12 | |
| *** woodburn has quit IRC | 00:13 | |
| *** roxanaghe has joined #openstack-keystone | 00:14 | |
| *** dan_nguyen has quit IRC | 00:14 | |
| *** roxanaghe has quit IRC | 00:18 | |
| *** ddieterly has joined #openstack-keystone | 00:22 | |
| henrynash | stevemar: you around? | 00:29 |
|---|---|---|
| stevemar | henrynash: you betcha | 00:29 |
| henrynash | stevemar: struggling with getting openstack client to run.....getting th e'ol Discovering versions from the identity service failed when creating the password plugin. Attempting to determine version from URL | 00:30 |
| henrynash | stevemar: which I thought had something to do with clouds.yaml | 00:30 |
| *** ravelar159 has joined #openstack-keystone | 00:30 | |
| henrynash | stevemar: but try as I might, can't seem to fix it | 00:31 |
| stevemar | henrynash: paste the output of the same command using --debug? | 00:32 |
| stevemar | henrynash: using devstack i assume? | 00:32 |
| henrynash | stevemar: devstack, yes | 00:32 |
| henrynash | stevemar: on devstack I seem to have version 2.2 of osc | 00:33 |
| henrynash | stevemar: whcih works fine | 00:33 |
| henrynash | stevemar: trying to run my dev version of osc in a another VM, attaching to the devstack VM | 00:33 |
| *** adrian_otto has quit IRC | 00:35 | |
| henrynash | stevemar: http://paste.openstack.org/show/541672/ | 00:35 |
| henrynash | stevemar: is debug ouput from osc | 00:35 |
| henrynash | stevemar: ok, sorry, fixed it! | 00:38 |
| *** ravelar159 has quit IRC | 00:38 | |
| henrynash | stevemar: it actually was a mismatch...but the problem was actually in my env variables not in cloud.yaml... | 00:38 |
| *** sdake has joined #openstack-keystone | 00:39 | |
| stevemar | henrynash: woo hoo | 00:40 |
| henrynash | stevemar: IP adress *.*.*.149 != *.*.*.249 :-) | 00:41 |
| henrynash | stevemar: shocking, that | 00:41 |
| *** ravelar159 has joined #openstack-keystone | 00:44 | |
| *** ayoung has joined #openstack-keystone | 00:45 | |
| *** ChanServ sets mode: +v ayoung | 00:45 | |
| *** code-R has joined #openstack-keystone | 00:47 | |
| *** code-R_ has joined #openstack-keystone | 00:48 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone: adding totp support to password auth plugin https://review.openstack.org/343422 | 00:49 |
| *** sdake_ has joined #openstack-keystone | 00:50 | |
| notmorgan | henrynash: i did say it is often env var vs cli/etc ;) | 00:50 |
| *** spandhe has quit IRC | 00:51 | |
| *** code-R has quit IRC | 00:51 | |
| *** sdake has quit IRC | 00:52 | |
| *** ravelar159 has quit IRC | 00:54 | |
| henrynash | notmorgan: yep!!!! I thought I had check them all....but then, whatdoyaknow..... | 00:54 |
| *** sdake has joined #openstack-keystone | 00:55 | |
| *** sdake_ has quit IRC | 00:55 | |
| *** ravelar159 has joined #openstack-keystone | 00:56 | |
| *** adrian_otto has joined #openstack-keystone | 00:57 | |
| *** ayoung has quit IRC | 01:00 | |
| *** ravelar159 has quit IRC | 01:03 | |
| *** code-R_ has quit IRC | 01:06 | |
| *** code-R has joined #openstack-keystone | 01:06 | |
| *** tqtran has quit IRC | 01:09 | |
| *** clenimar_ has joined #openstack-keystone | 01:14 | |
| *** clenimar_ has quit IRC | 01:15 | |
| *** dan_nguyen has joined #openstack-keystone | 01:21 | |
| *** adrian_otto has quit IRC | 01:27 | |
| *** ddieterly has quit IRC | 01:31 | |
| *** hoonetorg has quit IRC | 01:35 | |
| *** ddieterly has joined #openstack-keystone | 01:38 | |
| openstackgerrit | Clenimar Filemon proposed openstack/keystone: Improve os-federation docs https://review.openstack.org/347091 | 01:39 |
| *** dan_nguyen has quit IRC | 01:39 | |
| *** ravelar159 has joined #openstack-keystone | 01:41 | |
| *** dikonoor has joined #openstack-keystone | 01:48 | |
| *** ravelar159 has quit IRC | 01:48 | |
| *** hoonetorg has joined #openstack-keystone | 01:49 | |
| *** sdake has quit IRC | 01:59 | |
| *** roxanaghe has joined #openstack-keystone | 02:02 | |
| *** KevinE has quit IRC | 02:02 | |
| *** KevinE has joined #openstack-keystone | 02:02 | |
| *** KevinE has quit IRC | 02:03 | |
| *** KevinE has joined #openstack-keystone | 02:03 | |
| *** julim has joined #openstack-keystone | 02:04 | |
| *** edmondsw has quit IRC | 02:05 | |
| *** catintheroof has quit IRC | 02:06 | |
| *** roxanaghe has quit IRC | 02:06 | |
| *** KevinE has quit IRC | 02:06 | |
| *** browne has quit IRC | 02:06 | |
| *** tqtran has joined #openstack-keystone | 02:07 | |
| *** ddieterly has quit IRC | 02:08 | |
| *** ravelar159 has joined #openstack-keystone | 02:09 | |
| *** tqtran has quit IRC | 02:11 | |
| *** davechen has joined #openstack-keystone | 02:19 | |
| *** code-R has quit IRC | 02:22 | |
| *** code-R has joined #openstack-keystone | 02:22 | |
| *** ravelar159 has quit IRC | 02:29 | |
| *** jistr has quit IRC | 02:32 | |
| *** jistr has joined #openstack-keystone | 02:33 | |
| openstackgerrit | Tang Chen proposed openstack/keystone: Use assertEqual() instead of assertDictEqual() https://review.openstack.org/347097 | 02:35 |
| *** gagehugo has quit IRC | 02:52 | |
| *** richm has quit IRC | 02:56 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 03:11 |
| openstackgerrit | Merged openstack/keystone: Fix v2-ext API enabled documentation https://review.openstack.org/346965 | 03:16 |
| *** dikonoor has quit IRC | 03:29 | |
| *** dan_nguyen has joined #openstack-keystone | 03:37 | |
| *** josdotso has quit IRC | 03:39 | |
| *** dan_nguyen has quit IRC | 03:47 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password expires validation https://review.openstack.org/333360 | 03:49 |
| *** roxanaghe has joined #openstack-keystone | 03:50 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password expires validation https://review.openstack.org/333360 | 03:51 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/328339 | 03:52 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/328339 | 03:54 |
| *** roxanaghe has quit IRC | 03:54 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 03:54 |
| sorrison | Hi keystone people, we just did an upgrade to mitaka and ended up rolling back | 04:02 |
| sorrison | Raised a bug https://bugs.launchpad.net/keystone/+bug/1606426 | 04:02 |
| openstack | Launchpad bug 1606426 in OpenStack Identity (keystone) "Upgrading to Mitaka casues significant slow down on user-list " [Undecided,New] | 04:02 |
| sorrison | One of those bugs you only see in prod due to the scale of our deployment | 04:03 |
| *** links has joined #openstack-keystone | 04:03 | |
| *** roxanaghe has joined #openstack-keystone | 04:22 | |
| *** spandhe has joined #openstack-keystone | 04:31 | |
| stevemar | sorrison: are there 2 bugs? | 04:32 |
| stevemar | sorrison: i assume changing the apache didn't hurt, otherwise you would have noticed this in project list too | 04:34 |
| *** pcaruana has quit IRC | 04:34 | |
| sorrison | no just the one bug | 04:34 |
| sorrison | yeah I don't suspect apache | 04:34 |
| stevemar | sorrison: this is a weird one | 04:35 |
| sorrison | we are going through other api calls to see if anything else affected | 04:35 |
| sorrison | Just adding 10000 users to our dev instance | 04:35 |
| stevemar | maybe its the shadow user stuff we added in mitaka | 04:36 |
| sorrison | My guess is there is now some iteration happening after the initial SQL query to get all users | 04:37 |
| sorrison | Have seen similar mistakes in other projects | 04:37 |
| sorrison | (as opposed to doing a join) | 04:37 |
| *** GB21 has joined #openstack-keystone | 04:40 | |
| *** dikonoor has joined #openstack-keystone | 04:42 | |
| stevemar | sorrison: hmm, this is one of the few changes to the sql backend between kilo and mitaka https://github.com/openstack/keystone/blob/312a041862dc48b776715ccb2585d21cc479f5fb/keystone/identity/backends/sql.py#L201 | 04:43 |
| stevemar | you can use git blame to see the whole commit | 04:43 |
| stevemar | lots of things changed | 04:43 |
| sorrison | Is there an index on the join key I wonder | 04:46 |
| sorrison | foreign key is on it, I don't know enough about sql to know if that is enough | 04:46 |
| *** nk2527 has quit IRC | 04:49 | |
| *** GB21 has quit IRC | 04:51 | |
| *** kaszkiet has quit IRC | 04:54 | |
| sorrison | OK I've PDB'd it to confirm and it's in the sql backend layer somewhere | 04:55 |
| stevemar | sorrison: :sadface: | 04:56 |
| sorrison | the call in identity/core.py "ref_list = driver.list_users(hints)" is the slow point | 04:56 |
| sorrison | I'll step in there and get my hands dirty | 04:56 |
| stevemar | sorrison: that would be super appreciated | 04:56 |
| *** davechen has quit IRC | 04:57 | |
| *** ntpttr- has quit IRC | 04:59 | |
| *** ntpttr- has joined #openstack-keystone | 05:03 | |
| *** GB21 has joined #openstack-keystone | 05:09 | |
| sorrison | OK the slow bit is the for loop at https://github.com/openstack/keystone/blob/master/keystone/identity/backends/sql.py#L79 | 05:10 |
| sorrison | stevemar: taking out the filter_user call doesn't make a difference eg just calling [x.to_dict() for x in user_refs] is slow | 05:10 |
| sorrison | hints are {'limit': None, 'filters': [], 'cannot_match': False} | 05:11 |
| sorrison | stevemar: Still not sure why as that code is in Kilo too so nothing much has changed there | 05:12 |
| *** roxanaghe has quit IRC | 05:12 | |
| sorrison | except user_ref is now much bigger | 05:12 |
| *** code-R has quit IRC | 05:14 | |
| *** code-R has joined #openstack-keystone | 05:14 | |
| sorrison | yeah I'm pretty sure it's just the converting them all to dicts that is slowing things down | 05:15 |
| *** ntpttr- has quit IRC | 05:15 | |
| *** ntpttr- has joined #openstack-keystone | 05:17 | |
| sorrison | for i in user_refs: foo = i runs quick but | 05:19 |
| sorrison | for i in user_refs: foo = i.to_dict() slows down significantly | 05:19 |
| openstackgerrit | Adrian Turjak proposed openstack/keystone: adding totp support to password auth plugin https://review.openstack.org/343422 | 05:42 |
| *** GB21 has quit IRC | 05:49 | |
| openstackgerrit | Tin Lam proposed openstack/keystone: Add schema validation to v2 create tenant https://review.openstack.org/346594 | 05:52 |
| *** adriant has quit IRC | 05:57 | |
| *** GB21 has joined #openstack-keystone | 06:02 | |
| *** code-R has quit IRC | 06:09 | |
| *** code-R has joined #openstack-keystone | 06:12 | |
| *** nishaYadav has joined #openstack-keystone | 06:16 | |
| *** davechen has joined #openstack-keystone | 06:17 | |
| *** nishaYadav is now known as Guest8794 | 06:17 | |
| *** woodster_ has quit IRC | 06:19 | |
| *** ntpttr- has quit IRC | 06:24 | |
| *** ntpttr- has joined #openstack-keystone | 06:26 | |
| *** ntpttr- has quit IRC | 06:37 | |
| *** tesseract- has joined #openstack-keystone | 06:39 | |
| *** ntpttr- has joined #openstack-keystone | 06:39 | |
| *** spandhe has quit IRC | 06:39 | |
| *** Guest8794 is now known as nisha_ | 06:46 | |
| *** tangchen has quit IRC | 06:46 | |
| *** pcaruana has joined #openstack-keystone | 06:55 | |
| *** tangchen has joined #openstack-keystone | 06:57 | |
| openstackgerrit | Swapnil Kulkarni (coolsvap) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 07:00 |
| openstackgerrit | Tang Chen proposed openstack/keystone: Use assertEqual() instead of assertDictEqual() https://review.openstack.org/347097 | 07:04 |
| *** rcernin has joined #openstack-keystone | 07:06 | |
| *** tqtran has joined #openstack-keystone | 07:09 | |
| *** tqtran has quit IRC | 07:13 | |
| *** pnavarro has joined #openstack-keystone | 07:35 | |
| *** code-R_ has joined #openstack-keystone | 07:35 | |
| *** code-R has quit IRC | 07:38 | |
| *** tonytan4ever has quit IRC | 07:44 | |
| *** aastha has quit IRC | 07:49 | |
| *** code-R_ has quit IRC | 07:50 | |
| *** code-R has joined #openstack-keystone | 07:50 | |
| *** code-R has quit IRC | 07:59 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** mvk has quit IRC | 08:24 | |
| *** pblaho has quit IRC | 08:32 | |
| *** pnavarro has quit IRC | 08:43 | |
| *** tonytan4ever has joined #openstack-keystone | 08:44 | |
| *** tonytan4ever has quit IRC | 08:49 | |
| *** mvk has joined #openstack-keystone | 08:51 | |
| *** nisha_ has quit IRC | 08:51 | |
| *** TxGVNN has joined #openstack-keystone | 08:55 | |
| *** pnavarro has joined #openstack-keystone | 09:02 | |
| *** tqtran has joined #openstack-keystone | 09:10 | |
| *** tqtran has quit IRC | 09:15 | |
| openstackgerrit | Tang Chen proposed openstack/python-keystoneclient: Use assertEqual() instead of assertDictEqual() https://review.openstack.org/347208 | 09:16 |
| *** GB21 has quit IRC | 09:22 | |
| *** TxGVNN has quit IRC | 09:34 | |
| *** TxGVNN has joined #openstack-keystone | 09:35 | |
| *** GB21 has joined #openstack-keystone | 09:40 | |
| *** hwcomcn has joined #openstack-keystone | 09:49 | |
| *** hwcomcn has quit IRC | 09:52 | |
| *** hwcomcn has joined #openstack-keystone | 09:53 | |
| *** mvk has quit IRC | 09:56 | |
| *** mvk has joined #openstack-keystone | 09:57 | |
| *** GB21 has quit IRC | 10:12 | |
| *** NishaYadav has joined #openstack-keystone | 10:13 | |
| NishaYadav | o/ | 10:14 |
| *** NishaYadav is now known as nishaYadav | 10:14 | |
| *** nishaYadav is now known as nisha_ | 10:15 | |
| *** NishaYadav has joined #openstack-keystone | 10:16 | |
| *** NishaYadav is now known as nishaYadav | 10:17 | |
| *** GB21 has joined #openstack-keystone | 10:18 | |
| *** nisha_ has quit IRC | 10:19 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystonemiddleware: Fix description of option `cache` https://review.openstack.org/347234 | 10:30 |
| *** ntpttr- has quit IRC | 10:30 | |
| *** ntpttr- has joined #openstack-keystone | 10:35 | |
| *** TxGVNN has quit IRC | 10:38 | |
| *** tonytan4ever has joined #openstack-keystone | 10:46 | |
| *** davechen has left #openstack-keystone | 10:49 | |
| *** tonytan4ever has quit IRC | 10:50 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add wrapper classes for return-request-id-to-caller https://review.openstack.org/261188 | 10:51 |
| *** GB21 has quit IRC | 10:56 | |
| *** GB21 has joined #openstack-keystone | 11:00 | |
| *** rdo has quit IRC | 11:10 | |
| *** tqtran has joined #openstack-keystone | 11:12 | |
| *** tqtran has quit IRC | 11:16 | |
| *** GB21 has quit IRC | 11:21 | |
| *** GB21 has joined #openstack-keystone | 11:24 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: Retry revocation on MySQL deadlock https://review.openstack.org/344924 | 11:31 |
| *** nishaYadav has quit IRC | 11:39 | |
| *** rdo has joined #openstack-keystone | 11:49 | |
| *** dkehn has quit IRC | 11:52 | |
| *** richm has joined #openstack-keystone | 11:54 | |
| *** GB21 has quit IRC | 11:57 | |
| *** GB21 has joined #openstack-keystone | 11:58 | |
| *** nishaYadav has joined #openstack-keystone | 12:11 | |
| dstanek | good morning keystone | 12:16 |
| *** GB21 has quit IRC | 12:16 | |
| *** edmondsw has joined #openstack-keystone | 12:17 | |
| *** pauloewerton has joined #openstack-keystone | 12:23 | |
| breton | morning | 12:27 |
| *** ericksonsantos has joined #openstack-keystone | 12:27 | |
| *** julim has quit IRC | 12:35 | |
| *** rodrigods has quit IRC | 12:35 | |
| *** rodrigods has joined #openstack-keystone | 12:35 | |
| stevemar | morning dstanek | 12:35 |
| stevemar | and breton | 12:35 |
| nishaYadav | hey, morning o/ | 12:36 |
| stevemar | o/ | 12:36 |
| nishaYadav | stevemar, if you have some time, can you please look at this patch https://review.openstack.org/#/c/341612/ | 12:41 |
| patchbot | nishaYadav: patch 341612 - python-keystoneclient - Improve implied-role functional tests | 12:41 |
| *** catintheroof has joined #openstack-keystone | 12:46 | |
| *** ddieterly has joined #openstack-keystone | 12:51 | |
| *** jsavak has joined #openstack-keystone | 12:51 | |
| *** woodster_ has joined #openstack-keystone | 12:58 | |
| *** Xudong has joined #openstack-keystone | 13:00 | |
| *** Xudong has left #openstack-keystone | 13:01 | |
| *** ddieterly has quit IRC | 13:13 | |
| *** rdo has quit IRC | 13:18 | |
| *** julim has joined #openstack-keystone | 13:24 | |
| *** TxGVNN has joined #openstack-keystone | 13:32 | |
| *** ddieterly has joined #openstack-keystone | 13:43 | |
| *** links has quit IRC | 13:44 | |
| *** ayoung has joined #openstack-keystone | 13:48 | |
| *** ChanServ sets mode: +v ayoung | 13:48 | |
| *** tonytan4ever has joined #openstack-keystone | 13:52 | |
| lbragstad | morning | 13:55 |
| *** ddieterly has quit IRC | 13:55 | |
| *** ddieterly has joined #openstack-keystone | 13:56 | |
| SamYaple | morning lbragstad | 13:56 |
| *** code-R has joined #openstack-keystone | 14:02 | |
| dstanek | good morning, good afternoon, good evening and good night! | 14:03 |
| *** rdo has joined #openstack-keystone | 14:03 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Use assertEqual() instead of assertDictEqual() https://review.openstack.org/347208 | 14:04 |
| *** nk2527 has joined #openstack-keystone | 14:04 | |
| stevemar | dstanek: i see what you did there truman | 14:06 |
| dstanek | stevemar: :-) | 14:07 |
| dstanek | i think it may be review time | 14:07 |
| stevemar | dstanek: yep | 14:07 |
| stevemar | jamielennox|away: i removed your BPs from the meeting agenda | 14:07 |
| stevemar | folks need to add to the meeting agenda :O | 14:08 |
| stevemar | https://etherpad.openstack.org/p/keystone-weekly-meeting | 14:08 |
| *** ravelar159 has joined #openstack-keystone | 14:09 | |
| *** nkinder has joined #openstack-keystone | 14:10 | |
| *** ravelar159 has quit IRC | 14:13 | |
| *** tqtran has joined #openstack-keystone | 14:13 | |
| *** sdake has joined #openstack-keystone | 14:14 | |
| *** ravelar159 has joined #openstack-keystone | 14:14 | |
| *** gordc has joined #openstack-keystone | 14:16 | |
| *** sdake_ has joined #openstack-keystone | 14:18 | |
| *** ravelar159 has quit IRC | 14:18 | |
| *** tqtran has quit IRC | 14:18 | |
| *** ravelar159 has joined #openstack-keystone | 14:20 | |
| *** sdake has quit IRC | 14:20 | |
| breton | stevemar: i think i can confirm sorrison's issue | 14:20 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 14:20 |
| stevemar | breton: its a nasty one | 14:21 |
| *** gagehugo has joined #openstack-keystone | 14:21 | |
| *** ravelar159 has quit IRC | 14:22 | |
| breton | stevemar: i've just created 10k users on Liberty. It takes 2 seconds to fetch on L and 15 on M. | 14:22 |
| stevemar | breton: for i in 10000; openstack user create i | 14:22 |
| stevemar | :) | 14:22 |
| *** ravelar159 has joined #openstack-keystone | 14:22 | |
| breton | stevemar: nope, takes 2+ hours | 14:23 |
| bknudson | breton: git bisect should help find the problem commit. | 14:23 |
| stevemar | breton: oh, what did you do? | 14:23 |
| breton | stevemar: had to curl them | 14:23 |
| breton | bknudson: yep, will do now | 14:24 |
| *** raildo has joined #openstack-keystone | 14:25 | |
| breton | bknudson: bisecting is a little hard because of migrations | 14:27 |
| openstackgerrit | Merged openstack/keystone: Make it so federated tokens are validated on v2.0 https://review.openstack.org/345685 | 14:28 |
| *** rdo has quit IRC | 14:28 | |
| *** michauds has joined #openstack-keystone | 14:28 | |
| bknudson | breton: you'd have to recreate 10k users every time :( | 14:28 |
| breton | one wrong move and have to re-dump db | 14:28 |
| breton | bknudson: or just dump the db | 14:29 |
| lbragstad | dolphm awesome writeup | 14:36 |
| *** haplo37__ has joined #openstack-keystone | 14:36 | |
| *** roxanaghe has joined #openstack-keystone | 14:38 | |
| *** michauds_ has joined #openstack-keystone | 14:39 | |
| breton | > for relatively minimal cost (no $1,200 tickets required) | 14:39 |
| breton | you have not seen plane tickets' price :p | 14:39 |
| *** pnavarro has quit IRC | 14:40 | |
| *** ravelar159 has quit IRC | 14:40 | |
| *** hwcomcn has quit IRC | 14:40 | |
| *** adrian_otto has joined #openstack-keystone | 14:42 | |
| *** roxanaghe has quit IRC | 14:42 | |
| *** ravelar159 has joined #openstack-keystone | 14:44 | |
| *** slberger has joined #openstack-keystone | 14:45 | |
| *** dikonoor has quit IRC | 14:45 | |
| stevemar | breton: have you seen the cost for the summit entry o_O | 14:45 |
| stevemar | $650.00 | 14:46 |
| stevemar | pycon is $600 USD | 14:46 |
| breton | stevemar: meh, summit is free | 14:47 |
| stevemar | breton: haha, for you and I :) | 14:47 |
| stevemar | i wonder what percentage of the summit gets in for free? | 14:48 |
| SamYaple | stevemar: i have to guess alot | 14:48 |
| stevemar | speakers + ATC + other / total | 14:48 |
| SamYaple | and you know there is early bird tickets for $300, and then group tickets companies can buy that can be pretty cheap ive heard | 14:49 |
| stevemar | SamYaple: hmm, yeah, at least 2,159 have one commit in newton so far: http://stackalytics.com/?metric=commits | 14:49 |
| SamYaple | the ATC/Speaker/Alt codes dont associate with a single person and i know people share those too | 14:50 |
| stevemar | austin had 7000 people | 14:50 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 14:50 |
| stevemar | i'd ballpark it at half? | 14:50 |
| breton | summits brag to have 7k+ | 14:50 |
| SamYaple | at least half i would guess. the companies at the summit pay for most of it | 14:50 |
| SamYaple | so really its probably just venue costs anyway, not that high overhead | 14:50 |
| stevemar | yeah | 14:51 |
| stevemar | would be interesting to see the data | 14:51 |
| SamYaple | i bet tom would have access to it | 14:51 |
| *** michauds_ has quit IRC | 14:54 | |
| bknudson | midcycle in moscow! | 14:55 |
| dstanek | bknudson: pass | 14:55 |
| *** spandhe has joined #openstack-keystone | 14:56 | |
| *** spandhe has quit IRC | 14:56 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 14:56 |
| *** rdo has joined #openstack-keystone | 14:57 | |
| *** adrian_otto has quit IRC | 14:57 | |
| bknudson | dstanek: moscow, ohio? | 14:57 |
| *** dikonoor has joined #openstack-keystone | 14:58 | |
| *** ravelar159 has quit IRC | 14:59 | |
| *** ravelar159 has joined #openstack-keystone | 14:59 | |
| amakarov | bknudson, in January? | 15:00 |
| breton | Europe would be ok | 15:00 |
| amakarov | breton, ++ | 15:02 |
| amakarov | what about Prague? | 15:02 |
| *** nishaYadav has quit IRC | 15:03 | |
| *** rdo has quit IRC | 15:03 | |
| dstanek | bknudson: i'd be down for ohio | 15:03 |
| *** rcernin has quit IRC | 15:05 | |
| breton | did we have any problems with migration 89 -> 90? | 15:05 |
| breton | (1005, "Can't create table 'test_keystone.local_user' (errno: 150)") | 15:05 |
| breton | https://ask.openstack.org/en/question/91148/trouble-migrating-keystone-database-from-juno-to-mitaka/ | 15:08 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation assignment driver https://review.openstack.org/291318 | 15:08 |
| *** Trident has joined #openstack-keystone | 15:11 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 15:12 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make AuthWithTrust testable against uuid and fernet https://review.openstack.org/345686 | 15:12 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Allow V2TestCase to be tested against fernet and uuid https://review.openstack.org/345687 | 15:12 |
| *** danpawlik has quit IRC | 15:13 | |
| *** KevinE_ has joined #openstack-keystone | 15:17 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 15:21 |
| *** Guest51132 is now known as med_ | 15:23 | |
| *** med_ has quit IRC | 15:24 | |
| *** med_ has joined #openstack-keystone | 15:24 | |
| *** pgbridge has joined #openstack-keystone | 15:25 | |
| *** code-R_ has joined #openstack-keystone | 15:25 | |
| *** code-R has quit IRC | 15:28 | |
| *** nkinder has quit IRC | 15:29 | |
| *** rdo has joined #openstack-keystone | 15:30 | |
| *** samueldmq has joined #openstack-keystone | 15:34 | |
| *** ChanServ sets mode: +v samueldmq | 15:34 | |
| samueldmq | g'afternoon all | 15:34 |
| lbragstad | samueldmq | 15:37 |
| lbragstad | all recovered? | 15:37 |
| samueldmq | lbragstad: almost hehe | 15:37 |
| lbragstad | samueldmq i'm working through your revocation changes | 15:37 |
| lbragstad | samueldmq I have https://review.openstack.org/#/c/345688/6 passing locally so that might mean we can us it instead of https://review.openstack.org/#/c/319489/ | 15:38 |
| patchbot | lbragstad: patch 345688 - keystone - Switch fernet to be the default token provider. | 15:38 |
| patchbot | lbragstad: patch 319489 - openstack-dev/devstack - Switch fernet back as the default token provider | 15:38 |
| lbragstad | samueldmq I'm trying to step through your revocation changes to see if there is one that will get https://review.openstack.org/#/c/345688/6 passing by added a depends on from one of your patches | 15:39 |
| patchbot | lbragstad: patch 345688 - keystone - Switch fernet to be the default token provider. | 15:39 |
| samueldmq | lbragstad: hmm, yes ? so we making it as keystone default this cycle? | 15:39 |
| samueldmq | lbragstad: the one that disable caches, I couldn't get a solution to the issue so far, just identified it | 15:40 |
| lbragstad | samueldmq we should see the same issues regardless of it being the default in keystone or devstack - right? | 15:40 |
| lbragstad | samueldmq when you disable the cache - it passed with fernet as the default right? | 15:40 |
| samueldmq | lbragstad: add depends on in 343875 (actually pep8 failing, I will fix in a bit) | 15:40 |
| samueldmq | lbragstad: yes, and yes | 15:41 |
| lbragstad | samueldmq I can respin it | 15:41 |
| *** EinstCrazy has joined #openstack-keystone | 15:41 | |
| lbragstad | samueldmq I already have some of the changes locally | 15:41 |
| samueldmq | lbragstad: awesome, thanks | 15:42 |
| samueldmq | lbragstad: also update the commit message, I think we can make it a proposal for now (disabling cache), as it is not affecting performance terribly | 15:42 |
| samueldmq | lbragstad: specially if we want this to merge this cycle... so we can circle back and work on adding caching later (again) | 15:43 |
| lbragstad | samueldmq we also have to make sure it doesn't degrade performance a lot when there are tons of revocation events | 15:43 |
| *** tesseract- has quit IRC | 15:43 | |
| lbragstad | right now the current performances tests don't really take that into consideration | 15:43 |
| samueldmq | lbragstad: so 'check performance' is not that heavy? | 15:44 |
| samueldmq | lbragstad: I agree, we should do more tests... the ideal would be to us to fix that cache | 15:44 |
| lbragstad | samueldmq ++ | 15:44 |
| lbragstad | samueldmq check performance will do a bunch of authenticate and validates | 15:44 |
| lbragstad | but the test criteria doesn't populate keystone with a bunch of revocation events prior to running the test | 15:45 |
| lbragstad | samueldmq that's actually something we could add here - https://github.com/lbragstad/keystone-performance/issues | 15:45 |
| samueldmq | lbragstad: nice, so tests could be more meaninful | 15:47 |
| lbragstad | samueldmq right | 15:47 |
| lbragstad | samueldmq i'm trying to track cases like that in issues so that we can pick them off as we go | 15:48 |
| lbragstad | without forgetting about them | 15:48 |
| *** woodburn has joined #openstack-keystone | 15:49 | |
| lbragstad | samueldmq https://github.com/lbragstad/keystone-performance/issues/12 | 15:49 |
| *** woodburn1 has quit IRC | 15:50 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 15:53 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove cache from revoke subsystem https://review.openstack.org/343875 | 15:53 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 15:56 |
| *** BjoernT has joined #openstack-keystone | 16:01 | |
| *** jsavak has quit IRC | 16:05 | |
| *** jsavak has joined #openstack-keystone | 16:06 | |
| *** NishaYadav has joined #openstack-keystone | 16:09 | |
| dstanek | /b 23 | 16:09 |
| *** NishaYadav is now known as nishaYadav | 16:09 | |
| *** EinstCrazy has quit IRC | 16:11 | |
| *** EinstCrazy has joined #openstack-keystone | 16:11 | |
| *** EinstCrazy has quit IRC | 16:16 | |
| *** richm has quit IRC | 16:16 | |
| *** nkinder has joined #openstack-keystone | 16:16 | |
| *** richm has joined #openstack-keystone | 16:16 | |
| *** adrian_otto1 has joined #openstack-keystone | 16:18 | |
| *** adrian_otto1 is now known as adrian_otto | 16:19 | |
| *** gyee has joined #openstack-keystone | 16:21 | |
| *** ChanServ sets mode: +v gyee | 16:21 | |
| *** nishaYadav has quit IRC | 16:23 | |
| *** nishaYadav has joined #openstack-keystone | 16:23 | |
| *** code-R_ has quit IRC | 16:33 | |
| *** EinstCrazy has joined #openstack-keystone | 16:33 | |
| *** code-R has joined #openstack-keystone | 16:33 | |
| *** tqtran has joined #openstack-keystone | 16:37 | |
| *** tqtran_ has joined #openstack-keystone | 16:39 | |
| *** tqtran has quit IRC | 16:41 | |
| *** samueldmq has quit IRC | 16:44 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 16:46 |
| *** code-R has quit IRC | 16:47 | |
| *** itisha has joined #openstack-keystone | 16:48 | |
| *** dan_nguyen has joined #openstack-keystone | 16:49 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 16:50 |
| *** EinstCrazy has quit IRC | 16:51 | |
| *** samueldmq has joined #openstack-keystone | 16:52 | |
| *** ChanServ sets mode: +v samueldmq | 16:52 | |
| *** mvk has quit IRC | 16:57 | |
| *** browne has joined #openstack-keystone | 16:57 | |
| *** jsavak has quit IRC | 16:59 | |
| *** ddieterly is now known as ddieterly[away] | 17:00 | |
| *** aastha has joined #openstack-keystone | 17:01 | |
| *** roxanaghe has joined #openstack-keystone | 17:03 | |
| *** chrisshattuck has joined #openstack-keystone | 17:05 | |
| *** adrian_otto has quit IRC | 17:07 | |
| *** Gorian_ has joined #openstack-keystone | 17:09 | |
| *** josdotso has joined #openstack-keystone | 17:10 | |
| *** code-R has joined #openstack-keystone | 17:12 | |
| *** dikonoor has quit IRC | 17:13 | |
| *** code-R_ has joined #openstack-keystone | 17:14 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use quotes consistently in token controller https://review.openstack.org/347493 | 17:15 |
| *** code-R has quit IRC | 17:17 | |
| *** jsavak has joined #openstack-keystone | 17:24 | |
| henrynash | just checking....are we on for the keystone IRC meeting today? | 17:26 |
| *** Krishna has joined #openstack-keystone | 17:28 | |
| josdotso | Asked this question over at #opesntack-sdks, but thought I'd post here, too since it's auth related: Hi folks. I've installed from master branch into a fresh virtualenv clones of keystoneauth and python-openstackclient from review.openstack.org. I'm getting this auth_ref error whilst attempting v3oidcpassword. How can I squash this error? http://paste.openstack.org/show/542153/ | 17:28 |
| *** achanda has joined #openstack-keystone | 17:29 | |
| *** TxGVNN has quit IRC | 17:31 | |
| *** amakarov is now known as amakarov_away | 17:32 | |
| *** sdake_ is now known as sdake | 17:37 | |
| stevemar | clenimar: want to toss up a new patch for https://review.openstack.org/#/c/319446/ ? | 17:41 |
| patchbot | stevemar: patch 319446 - python-barbicanclient - Use keystoneauth | 17:41 |
| clenimar | stevemar, sure. i'll take a look into it | 17:43 |
| clenimar | :) | 17:43 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 17:43 |
| *** spandhe has joined #openstack-keystone | 17:44 | |
| *** spandhe has quit IRC | 17:44 | |
| *** spandhe has joined #openstack-keystone | 17:46 | |
| breton | stevemar: sorrison: 312a041 introduced the regression :( | 17:51 |
| bknudson | https://review.openstack.org/#/c/278570/ | 17:51 |
| patchbot | bknudson: patch 278570 - keystone - Shadow users - Separate user identities (MERGED) | 17:51 |
| stevemar | clenimar: its pretty inactive :( | 17:52 |
| *** mvk has joined #openstack-keystone | 17:52 | |
| *** tonytan4ever has quit IRC | 17:53 | |
| stevemar | breton: it's that damn outerjoin(LocalUser) calls | 17:54 |
| stevemar | i actually don't know, but i did suspect shadow users :( | 17:54 |
| *** jaugustine_ has joined #openstack-keystone | 17:56 | |
| *** shaleh has joined #openstack-keystone | 17:58 | |
| *** ddieterly[away] has quit IRC | 18:00 | |
| *** henrynash_ has joined #openstack-keystone | 18:02 | |
| *** ChanServ sets mode: +v henrynash_ | 18:02 | |
| *** henrynash has left #openstack-keystone | 18:03 | |
| *** henrynash_ has left #openstack-keystone | 18:03 | |
| samueldmq | stevemar: do we have meeting today? | 18:05 |
| samueldmq | stevemar: nvm, just joined | 18:05 |
| *** adrian_otto has joined #openstack-keystone | 18:16 | |
| breton | indeed, to_dict takes the most time | 18:20 |
| *** timcline has joined #openstack-keystone | 18:23 | |
| samueldmq | breton: where ? | 18:23 |
| *** timcline_ has joined #openstack-keystone | 18:24 | |
| breton | samueldmq: bug 1606426 | 18:24 |
| openstack | bug 1606426 in OpenStack Identity (keystone) "Upgrading to Mitaka casues significant slow down on user-list " [Critical,New] https://launchpad.net/bugs/1606426 - Assigned to Ron De Rose (ronald-de-rose) | 18:24 |
| *** BjoernT is now known as Bjoern_zZzZzZzZ | 18:24 | |
| samueldmq | breton: thanks | 18:25 |
| *** timcline has quit IRC | 18:27 | |
| *** adrian_otto has quit IRC | 18:30 | |
| *** sdake has quit IRC | 18:35 | |
| *** ddieterly has joined #openstack-keystone | 18:35 | |
| *** sdake has joined #openstack-keystone | 18:35 | |
| *** Bjoern_zZzZzZzZ has quit IRC | 18:38 | |
| *** tonytan4ever has joined #openstack-keystone | 18:43 | |
| *** spandhe has quit IRC | 18:46 | |
| *** adrian_otto has joined #openstack-keystone | 18:55 | |
| *** timcline_ has quit IRC | 18:56 | |
| *** itlinux has joined #openstack-keystone | 18:56 | |
| *** spandhe has joined #openstack-keystone | 18:59 | |
| *** Krishna has quit IRC | 19:00 | |
| jaugustine_ | Will do | 19:00 |
| lbragstad | jaugustine_ rderose lamt dstanek continue here? | 19:00 |
| rderose | okay, so are we including LDAP in the lockout feature or not? | 19:00 |
| lamt | sure | 19:00 |
| lbragstad | rderose I think we should hold off until we have more of a usecase? | 19:01 |
| lbragstad | for the ldap lockout | 19:01 |
| rderose | lbragstad: agree, just want to make sure others are on board | 19:01 |
| jaugustine_ | I'm on mobile but I can get the details it was asked how we would accomplish this so if it can be useful to others of course we would like to do it for the entire community | 19:01 |
| lbragstad | per dstanek's concern - it can be confusing if a user is locked out of one, or both systems | 19:01 |
| lamt | I understand that with the current ldap policy, anyone can lock the user out - but the security folks just want to make sure it is not keystone that's the cause of problem. | 19:02 |
| rderose | lbragstad: yeah, I think it's confusing | 19:02 |
| lbragstad | rderose how hard would it be add this in later? | 19:02 |
| breton | stevemar: fetching attributes `name` and `password` take the most time | 19:02 |
| lbragstad | refactoring the lockout into the Manager() layer? | 19:02 |
| dstanek | lamt: how do you prevent this in other applications? | 19:03 |
| dstanek | lamt: or why is keystone special? | 19:03 |
| topol | lbragstad, dsatnek I agree the am I locked out of keystone or ldap (or both) could get nasty | 19:03 |
| rderose | lbragstad: currently adding new columns to local_user table, moving it up a layer would cause it to be in the user table | 19:03 |
| topol | dstanek ^ | 19:03 |
| *** fifieldt has quit IRC | 19:03 | |
| rderose | lbragstad: so adding new columns; migrating the data potentially | 19:03 |
| lbragstad | rderose so it would require a data migration specifically to move it to the manager | 19:04 |
| lbragstad | rderose just curious if it was trivial or not | 19:04 |
| openstackgerrit | Eric Brown proposed openstack/keystone: Invalid tls_req_cert constant as default https://review.openstack.org/347523 | 19:04 |
| rderose | lbragstad: so yeah, not trivial if we change later | 19:04 |
| *** haplo37__ has quit IRC | 19:06 | |
| dstanek | topol: yeah, not sure this usecase has been fully thought though yet | 19:06 |
| lamt | dstanek: other applications that use LDAP has their own lock out count prevention. The solution may be change on the LDAP side. | 19:07 |
| lbragstad | lamt which applications? | 19:07 |
| topol | lamt do you have any public examples? | 19:07 |
| dstanek | lamt: so you don't use ldap lockout at all? | 19:07 |
| lamt | There is LDAP lockout. E.g. a user signing into Windows desktop login leverages the corporate Active Directory | 19:08 |
| lamt | If a user signs in a few times incorrectly, it locks | 19:08 |
| dstanek | lamt: so for example your webmail system would have a shorter lockout? | 19:09 |
| rderose | lamt: yeah exactly. I would expect the same behavior if you are logging into an app backed by AD. | 19:10 |
| rderose | dstanek: ++ | 19:10 |
| lamt | dstanek: yes | 19:11 |
| lbragstad | lamt so what happens when a user gets locked out of the webmail application but not locked out of AD? | 19:11 |
| dstanek | lamt: do you have an example of what the lockouts would be? | 19:12 |
| dstanek | AD is set to 5 and all other applications are 3 (for an example) | 19:12 |
| rderose | lamt: hmm... is that really the expected behavior, that all of these apps would implement a separate lockout feature. what's the point of having an IdP | 19:12 |
| lamt | lbragstad: the shorter lock out is time based, after a while it is unlocked. | 19:13 |
| lbragstad | lamt is there way to override that? | 19:13 |
| lbragstad | i believe rderose is providing a lockout override in addition to a time-based lockout for the sql stuff | 19:13 |
| rderose | lamt lbragstad: AD is time-based | 19:13 |
| dstanek | lamt: so you can still lockout a user from AD be using multiple apps? | 19:13 |
| rderose | lbragstad: correct, you can override by re-enabling the user | 19:14 |
| lamt | dstanek: yes, you can do that by just sending in multiple ldapsearch with wrong credentials | 19:14 |
| lbragstad | and that doesn't necessarily mean you've locked the user out of a *single* app | 19:14 |
| dstanek | lamt: then i'm confused...are you just making it a little harder to lockout? | 19:15 |
| lamt | The idea is that if a lock out is to happen, it is prefer you are locked out of the single app over getting locked out of the active directory - which requires a service call to unlock | 19:15 |
| *** sdake has quit IRC | 19:15 | |
| *** timcline has joined #openstack-keystone | 19:16 | |
| *** ddieterly is now known as ddieterly[away] | 19:16 | |
| *** timcline_ has joined #openstack-keystone | 19:17 | |
| *** fifieldt has joined #openstack-keystone | 19:18 | |
| lbragstad | there is still the possibility of a user getting locked out of AD if you have 5 applications that have a max auth count of 3 (each) and your AD lockout is 5. | 19:18 |
| rderose | lbragstad: yep | 19:19 |
| lbragstad | you could auth from each application once and lock your AD account | 19:19 |
| lbragstad | lamt do your applications display different lockout messages for each case? | 19:20 |
| *** timcline has quit IRC | 19:20 | |
| lamt | lbragstad: agreed. It is just that they do not want keystone to be the sole application that is the problem - but I understand the use case isn't bulletproofing an AD lockout. | 19:21 |
| rderose | and for internal apps, users typically don't login, but their Windows account is automatically applied. in those cases, lockout happens at Windows login | 19:22 |
| lamt | Currently, it does not, it returns an Unauthorized if the user is locked out of the AD. | 19:22 |
| dstanek | lamt: if they are locked out of keystone/openstack wouldn't them make a service call to unlock? | 19:23 |
| lbragstad | for AD - lockout is time-based... | 19:24 |
| lamt | dstanek: yes, but the procedure is less onerous | 19:24 |
| lbragstad | err... applications use AD only supply a time-based lockout | 19:24 |
| lbragstad | where as a lock out from AD requires a service call to re-enable the user | 19:24 |
| dstanek | lamt: how so? | 19:24 |
| dstanek | lamt: sorry about all the questions, but i really want to understand the usecase | 19:25 |
| lamt | it is not a problem - I understand the use case is wonky because the way the corporate security is structured | 19:25 |
| dstanek | from a user perspective since i don't know why i'm locked out i will make the same support call/ticket/whatever either way | 19:26 |
| lbragstad | that works if the same team manages access to all applications | 19:26 |
| lamt | Because the cloud team that runs the cloud is different from the corporate Active Directory team - to unlock keystone does not require the same # of hoops needed to unlock the corporate AD access. | 19:27 |
| dstanek | lamt: how does a user know what app they are locked out of? and do they have a different way to report the error based on that? | 19:27 |
| lbragstad | but - it would be up to the application to display the proper error in that case | 19:27 |
| dstanek | i don't know if they is possible, but i want to recommend setting up an ldap server they AD replicates to, but has a different lockout policy | 19:28 |
| lbragstad | if the openstack deployment is managed by a different group than corporate IT, it could get confusing as to which group to go talk to from a user perspective | 19:29 |
| lamt | that is a potential solution - the interaction with the corporate AD team can be very challenging. | 19:29 |
| *** jaugustine_ has quit IRC | 19:30 | |
| breton | how does mysql general log work? | 19:30 |
| dstanek | breton: general log? | 19:30 |
| lamt | lbragstad: agreed | 19:30 |
| dstanek | lamt: how does it work now? | 19:31 |
| lbragstad | lamt in your case - is all that managed by the same group? | 19:31 |
| breton | dstanek: [mysqld] | 19:32 |
| breton | general_log = on | 19:32 |
| lamt | Currently, keystone (and the openstack clouds) infrastructure is managed by 1 group, and a separate group (the corporate security) owns the active directory/LDAP. | 19:32 |
| dstanek | breton: i've never seen that before, so i'm no help | 19:33 |
| breton | http://paste.openstack.org/show/542167/ this is what i see with shadow users | 19:33 |
| lbragstad | lamt so do all locked account requests go to only one group (the corporate security)? | 19:33 |
| breton | are these actual db queries or just explanation how one big query works? | 19:33 |
| dstanek | lamt: so you know currently have any opps that implement lockout that are managed by other groups? | 19:33 |
| rderose | breton: is this from the performance bug? | 19:34 |
| *** gyee has quit IRC | 19:34 | |
| breton | rderose: yeah | 19:34 |
| lamt | lbragstad: yes | 19:34 |
| rderose | breton: so separate queries for each table looks like | 19:35 |
| rderose | breton: which is configurable | 19:35 |
| dstanek | lamt: so that team will essentially have to query AD and keystone to see where the user is locked and forward to the correct team? | 19:35 |
| *** sdake has joined #openstack-keystone | 19:36 | |
| lbragstad | lamt so regardlless of which application locks the user out - they all have to go to the same team to get unlocked | 19:36 |
| lamt | dstanek: I need to check. There are just too many applications in ATT. | 19:36 |
| breton | zzzeek: any ideas ^? | 19:36 |
| zzzeek | breton: ideas and an arrow....lets follow.... | 19:36 |
| *** samueldmq has quit IRC | 19:36 | |
| lamt | dstanek: Yes. | 19:38 |
| zzzeek | breton: the general log...logs all the queries. that paste is what's being sent to the DB. | 19:38 |
| lamt | lbragstad: if it is locked at the AD level, yes. It is still very possible for a user to be locked out of the AD. | 19:39 |
| zzzeek | breton: so...this paste shows like seven queries taht are keystone specific, all the "select 1"s are an oslo.db thing, and the stuff above is a handful of queries the SQLA dialect emits on first connect. | 19:39 |
| dstanek | lamt: you can actually be locked out of either or both | 19:40 |
| lbragstad | that what it sounds like - but in either case it sounds like no matter what you have to go talk to the same team to get unlocked | 19:40 |
| lamt | yes, they are asking to find a way to minimize the chance of a lockout at the AD level. | 19:41 |
| *** nisha_ has joined #openstack-keystone | 19:41 | |
| *** nishaYadav has quit IRC | 19:42 | |
| *** ddieterly[away] is now known as ddieterly | 19:42 | |
| lamt | if one is to maliciously trying to lock you out of the AD, through multiple application, that's something corporate security has to solve. They are asking for the case of someone writing a loop that repeatedly send incorrect credential to keystone would stop it at the application level , and not the corporate AD level. | 19:43 |
| dstanek | lamt: probably need to be a feature request on launchpad so that the conversation can be better captured | 19:48 |
| lbragstad | dstanek ++ | 19:48 |
| lamt | dstanek: Thanks - I will do that. | 19:49 |
| *** achanda has quit IRC | 19:49 | |
| dstanek | lamt: spend more time of why you want to do this and whey the keystone implications are than on what you want to do | 19:50 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 roles https://review.openstack.org/334546 | 19:51 |
| *** spandhe has quit IRC | 19:56 | |
| *** timcline_ has quit IRC | 19:57 | |
| *** timcline has joined #openstack-keystone | 19:58 | |
| *** slberger1 has joined #openstack-keystone | 20:03 | |
| *** spandhe has joined #openstack-keystone | 20:05 | |
| *** slberger has quit IRC | 20:05 | |
| *** chrisshattuck has quit IRC | 20:10 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Add dummy domain_id column to cached role https://review.openstack.org/347543 | 20:10 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Add dummy domain_id column to cached role https://review.openstack.org/347543 | 20:17 |
| *** nisha_ has quit IRC | 20:18 | |
| breton | zzzeek: so these are separate queries? I have 10002 'FROM password' in the log, so there were 10002 queries? | 20:18 |
| *** woodburn has quit IRC | 20:19 | |
| breton | and all are with the same id 37 | 20:19 |
| *** spandhe has left #openstack-keystone | 20:25 | |
| *** karthikb has joined #openstack-keystone | 20:28 | |
| breton | stevemar: rderose: yep, N queries are made for N users | 20:30 |
| breton | 45 Query SELECT password.id AS password_id, password.local_user_id AS password_local_user_id, password.password AS password_password FROM password WHERE 3111 = password.local_user_id | 20:31 |
| *** dkehn has joined #openstack-keystone | 20:31 | |
| *** henrynash has joined #openstack-keystone | 20:31 | |
| *** ChanServ sets mode: +v henrynash | 20:31 | |
| rderose | breton: yeah, I'm testing it out using eager loading instead | 20:31 |
| zzzeek | breton: yes | 20:32 |
| rderose | breton stevemar: that should fix it. just want to test it out any edge cases | 20:33 |
| zzzeek | breton: keystone is big on many small queries. receives lots of web requests. this is why there's interest in more caching | 20:33 |
| *** jsavak has quit IRC | 20:34 | |
| *** jsavak has joined #openstack-keystone | 20:35 | |
| breton | here a single list_users produces N requests. I think that eager loading will help. | 20:35 |
| rderose | breton: it should | 20:36 |
| *** thiagolib has joined #openstack-keystone | 20:36 | |
| breton | zzzeek: thank you! | 20:38 |
| bknudson | breton: lbragstad: the list users is a good candidate for performance testing. | 20:41 |
| lbragstad | true | 20:42 |
| *** slberger1 has quit IRC | 20:42 | |
| *** gyee has joined #openstack-keystone | 20:43 | |
| *** ChanServ sets mode: +v gyee | 20:43 | |
| *** karthikb has quit IRC | 20:43 | |
| *** josdotso has quit IRC | 20:46 | |
| *** slberger has joined #openstack-keystone | 20:47 | |
| *** itisha has quit IRC | 20:50 | |
| *** timcline has quit IRC | 20:52 | |
| *** catintheroof has quit IRC | 20:52 | |
| stevemar | breton: rderose what should fix it? | 20:56 |
| *** adrian_otto1 has joined #openstack-keystone | 20:56 | |
| *** adrian_otto has quit IRC | 20:58 | |
| rderose | stevemar: I think changing lazy='subquery' to eager loading would help: https://github.com/openstack/keystone/blob/master/keystone/identity/backends/sql_model.py#L37 | 20:58 |
| rderose | stevemar: just trying to test this out first, to see if there is any side effects | 20:58 |
| *** julim has quit IRC | 21:02 | |
| *** raildo has quit IRC | 21:03 | |
| breton | rderose: it probably won't help | 21:03 |
| breton | rderose: the issue is in passwords | 21:03 |
| *** timcline has joined #openstack-keystone | 21:03 | |
| breton | rderose: please see the query above | 21:04 |
| rderose | breton stevemar: right, I would change to eager loading for all relationships | 21:04 |
| rderose | breton stevemar: including passwords | 21:04 |
| rderose | breton: yeah, the query above should be a joined query instead, this is configurable as well | 21:05 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Eagerly load local users and passwords https://review.openstack.org/347552 | 21:08 |
| breton | rderose: like this ^? | 21:08 |
| breton | :p | 21:08 |
| stevemar | breton: hehe | 21:09 |
| breton | ah dammit, forgot the import | 21:09 |
| dstanek | breton: nice | 21:09 |
| stevemar | breton: aren't lines 78 and 79 the same? | 21:10 |
| rderose | breton: yep | 21:10 |
| stevemar | or, can we pass in query instead on line 79? | 21:10 |
| stevemar | breton: what kind of gains are you seeing? | 21:11 |
| breton | the patch is written for stable/mitaka and it seems it won't work for master, fixing it now | 21:11 |
| *** adrian_otto1 has quit IRC | 21:13 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Eagerly load local users and passwords https://review.openstack.org/347552 | 21:14 |
| breton | stevemar: 30 seconds -> 5 seconds | 21:14 |
| stevemar | breton: \o/ | 21:14 |
| breton | http://paste.openstack.org/show/542177/ and these queries in mysql log | 21:15 |
| breton | i wonder if these 4 queries can be joined into 1 | 21:16 |
| *** adrian_otto has joined #openstack-keystone | 21:17 | |
| breton | after all apache instances got their first requests, it became ~2.7-2.8 seconds | 21:18 |
| stevemar | would be nice if we could create a test that ensured none of the list operations took too long for 10K objects | 21:20 |
| breton | we could count queries like in https://review.openstack.org/#/c/344924/4/keystone/tests/unit/test_v3_os_revoke.py | 21:21 |
| patchbot | breton: patch 344924 - keystone - Retry revocation on MySQL deadlock | 21:21 |
| breton | i'll have some sleep, will be back in 9h | 21:23 |
| *** rm_work has quit IRC | 21:25 | |
| *** mjb has quit IRC | 21:25 | |
| *** jsavak has quit IRC | 21:26 | |
| *** rm_work has joined #openstack-keystone | 21:26 | |
| *** jsavak has joined #openstack-keystone | 21:27 | |
| *** mjb has joined #openstack-keystone | 21:28 | |
| rderose | breton: you're too quick, I was doing something similar. will stop and let you finish fixing this bug. | 21:34 |
| *** jsavak has quit IRC | 21:36 | |
| stevemar | breton: i'm jealous of your 9hrs | 21:38 |
| * breton wanted to go, but ran into https://eng.uber.com/mysql-migration/ | 21:42 | |
| *** ayoung has quit IRC | 21:45 | |
| *** ddieterly is now known as ddieterly[away] | 21:50 | |
| *** ddieterly[away] has quit IRC | 21:54 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: WIP: refactor views to be used by v2.0 and v3 https://review.openstack.org/347561 | 21:54 |
| *** ravelar159 has quit IRC | 21:56 | |
| *** adriant has joined #openstack-keystone | 21:57 | |
| *** pauloewerton has quit IRC | 22:00 | |
| *** darrenc is now known as darrenc_afk | 22:01 | |
| *** openstackgerrit has quit IRC | 22:03 | |
| *** openstackgerrit has joined #openstack-keystone | 22:03 | |
| *** gordc has quit IRC | 22:08 | |
| *** gagehugo has quit IRC | 22:09 | |
| *** sdake has quit IRC | 22:09 | |
| *** KevinE_ has quit IRC | 22:15 | |
| *** browne has quit IRC | 22:17 | |
| jdennis | stevemar: were you able to verify your locale settings as per my response to you in https://review.openstack.org/#/c/343035/ | 22:20 |
| patchbot | jdennis: patch 343035 - python-openstackclient - arguments are not locale decoded into Unicode | 22:20 |
| openstackgerrit | Merged openstack/keystone: Add performance tuning documentation https://review.openstack.org/345566 | 22:23 |
| *** jamielennox|away is now known as jamielennox | 22:23 | |
| *** edmondsw has quit IRC | 22:24 | |
| openstackgerrit | Tin Lam proposed openstack/keystone: Add schema validation to v2 create tenant https://review.openstack.org/346594 | 22:28 |
| *** darrenc_afk is now known as darrenc | 22:35 | |
| *** diazjf has joined #openstack-keystone | 22:36 | |
| *** diazjf has left #openstack-keystone | 22:36 | |
| *** timcline has quit IRC | 22:45 | |
| *** sdake has joined #openstack-keystone | 22:47 | |
| *** openstackgerrit has quit IRC | 22:48 | |
| *** openstackgerrit has joined #openstack-keystone | 22:48 | |
| *** sdake_ has joined #openstack-keystone | 22:49 | |
| *** sdake has quit IRC | 22:52 | |
| *** michauds has quit IRC | 22:55 | |
| *** browne has joined #openstack-keystone | 22:56 | |
| *** tqtran_ has quit IRC | 22:57 | |
| *** tqtran has joined #openstack-keystone | 22:57 | |
| *** thiagolib has quit IRC | 22:58 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Add dummy domain_id column to cached role https://review.openstack.org/347543 | 22:59 |
| *** slberger has quit IRC | 23:04 | |
| *** slberger has joined #openstack-keystone | 23:18 | |
| stevemar | jdennis: i tinkered with it but couldn't get any further with OSC | 23:19 |
| *** ddieterly has joined #openstack-keystone | 23:22 | |
| *** code-R_ has quit IRC | 23:27 | |
| Gorian_ | hey stevemar | 23:28 |
| Gorian_ | :) | 23:28 |
| Gorian_ | you ever find out why openstack doesn't use a UUID for the region? | 23:28 |
| *** ddieterly is now known as ddieterly[away] | 23:32 | |
| *** Gorian_ has quit IRC | 23:35 | |
| *** slberger has left #openstack-keystone | 23:37 | |
| *** ddieterly[away] has quit IRC | 23:42 | |
| *** tonytan4ever has quit IRC | 23:47 | |
| stevemar | Gorian: yo | 23:49 |
| stevemar | Gorian: not really, just when making the APIs someone thought it was a good idea to not use them :\ | 23:49 |
| stevemar | design by committee ftw | 23:49 |
| openstackgerrit | Merged openstack/keystone: Use quotes consistently in token controller https://review.openstack.org/347493 | 23:51 |
| stevemar | jamielennox: lemme know when you're around | 23:52 |
| jamielennox | stevemar: i'm still in san jose - so for like 10 more minutes | 23:52 |
| stevemar | jamielennox: ha | 23:53 |
| stevemar | jamielennox: i've got a nasty one for ya: https://bugs.launchpad.net/keystone/+bug/1600393 | 23:53 |
| openstack | Launchpad bug 1600393 in OpenStack Identity (keystone) "AttributeError: 'list' object has no attribute 'items'" [High,New] | 23:53 |
| stevemar | (referring to my comment #2) | 23:54 |
| jamielennox | where is that coming from | 23:55 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!