| *** shaleh has quit IRC | 00:00 | |
| *** jistr has quit IRC | 00:00 | |
| *** jistr has joined #openstack-keystone | 00:01 | |
| *** spzala has quit IRC | 00:02 | |
| *** spzala has joined #openstack-keystone | 00:02 | |
| *** spzala has quit IRC | 00:02 | |
| *** spzala has joined #openstack-keystone | 00:03 | |
| *** spzala has quit IRC | 00:03 | |
| *** tonytan4ever has quit IRC | 00:22 | |
| *** mrhillsman is now known as mrhillsman_ | 00:24 | |
| *** mrhillsman_ is now known as mrhillsman_Away | 00:24 | |
| *** iurygregory_ has joined #openstack-keystone | 00:26 | |
| *** spzala has joined #openstack-keystone | 00:33 | |
| *** guoshan has joined #openstack-keystone | 00:36 | |
| *** esp has quit IRC | 00:37 | |
| *** tonytan4ever has joined #openstack-keystone | 00:48 | |
| *** code-R has quit IRC | 00:57 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/351988 | 00:58 |
|---|---|---|
| *** sdake has joined #openstack-keystone | 00:59 | |
| *** code-R has joined #openstack-keystone | 01:01 | |
| *** guoshan has quit IRC | 01:04 | |
| *** guoshan has joined #openstack-keystone | 01:24 | |
| *** richm has quit IRC | 01:28 | |
| *** spzala has quit IRC | 01:42 | |
| *** EinstCrazy has joined #openstack-keystone | 01:45 | |
| *** davechen has joined #openstack-keystone | 01:46 | |
| *** mrhillsman_Away is now known as mrhillsman | 01:50 | |
| *** Gorian has joined #openstack-keystone | 01:50 | |
| openstackgerrit | Li Yingjun proposed openstack/keystone: Document get auth/catalog,projects,domains https://review.openstack.org/352689 | 01:59 |
| *** ravelar has joined #openstack-keystone | 02:08 | |
| *** ayoung has quit IRC | 02:11 | |
| *** ravelar has quit IRC | 02:13 | |
| *** rreimberg has joined #openstack-keystone | 02:14 | |
| *** rreimberg has quit IRC | 02:16 | |
| *** rreimberg has joined #openstack-keystone | 02:17 | |
| *** guoshan has quit IRC | 02:25 | |
| *** guoshan has joined #openstack-keystone | 02:25 | |
| *** jorge_munoz has quit IRC | 02:28 | |
| openstackgerrit | Merged openstack/keystone: api-ref: Add missing parameter tables to tenant https://review.openstack.org/352980 | 02:29 |
| *** guoshan has quit IRC | 02:29 | |
| openstackgerrit | Merged openstack/keystone: api-ref: Add "nocatalog" option to GET /v3/auth/tokens https://review.openstack.org/352718 | 02:29 |
| *** guoshan has joined #openstack-keystone | 02:33 | |
| openstackgerrit | Tin Lam proposed openstack/keystone: api-ref: Add query options to GET /projects API documentation https://review.openstack.org/352708 | 02:38 |
| *** jorge_munoz has joined #openstack-keystone | 02:54 | |
| *** gyee has quit IRC | 02:57 | |
| *** woodster_ has quit IRC | 03:09 | |
| *** tonytan4ever has quit IRC | 03:14 | |
| *** sdake has quit IRC | 03:17 | |
| *** browne has quit IRC | 03:27 | |
| openstackgerrit | Anh Tran proposed openstack/keystone: api-ref: Correcting V3 Domain config APIs https://review.openstack.org/352260 | 03:28 |
| *** iurygregory_ has quit IRC | 03:30 | |
| *** code-R has quit IRC | 03:30 | |
| *** julim has quit IRC | 03:30 | |
| *** code-R has joined #openstack-keystone | 03:31 | |
| *** spzala has joined #openstack-keystone | 03:43 | |
| *** spzala has quit IRC | 03:48 | |
| *** links has joined #openstack-keystone | 04:01 | |
| *** dikonoor has joined #openstack-keystone | 04:02 | |
| *** jlk has quit IRC | 04:04 | |
| *** jlk has joined #openstack-keystone | 04:04 | |
| *** jlk has joined #openstack-keystone | 04:04 | |
| *** guoshan has quit IRC | 04:11 | |
| *** rkrum has joined #openstack-keystone | 04:13 | |
| *** tonytan4ever has joined #openstack-keystone | 04:15 | |
| *** tsufiev has quit IRC | 04:18 | |
| *** tsufiev has joined #openstack-keystone | 04:18 | |
| *** tonytan4ever has quit IRC | 04:20 | |
| *** permalac has quit IRC | 04:25 | |
| *** permalac has joined #openstack-keystone | 04:26 | |
| *** roxanaghe has joined #openstack-keystone | 04:27 | |
| *** EinstCrazy has quit IRC | 04:33 | |
| *** EinstCrazy has joined #openstack-keystone | 04:34 | |
| *** roxanaghe has quit IRC | 04:51 | |
| *** jaosorior has joined #openstack-keystone | 04:55 | |
| *** guoshan has joined #openstack-keystone | 04:58 | |
| *** adrian_otto has joined #openstack-keystone | 04:59 | |
| *** pcaruana has quit IRC | 05:01 | |
| *** emccormickva has joined #openstack-keystone | 05:01 | |
| *** guoshan has quit IRC | 05:02 | |
| *** emccormick has quit IRC | 05:04 | |
| *** rreimberg has quit IRC | 05:06 | |
| *** jorge_munoz_ has joined #openstack-keystone | 05:09 | |
| *** ravelar has joined #openstack-keystone | 05:10 | |
| *** jorge_munoz has quit IRC | 05:10 | |
| *** jorge_munoz_ is now known as jorge_munoz | 05:10 | |
| *** ravelar has quit IRC | 05:15 | |
| *** roxanaghe has joined #openstack-keystone | 05:17 | |
| -openstackstatus- NOTICE: zuul is being restarted to reload configuration. Jobs should be re-enqueued but if you're missing anything (and it's not on http://status.openstack.org/zuul/) please issue a recheck in 30min. | 05:24 | |
| *** Trident has quit IRC | 05:25 | |
| *** roxanaghe has quit IRC | 05:35 | |
| *** code-R has quit IRC | 05:35 | |
| *** code-R has joined #openstack-keystone | 05:36 | |
| *** guoshan has joined #openstack-keystone | 05:52 | |
| *** guoshan has quit IRC | 05:57 | |
| breton | rodrigods: morning! Nope. | 06:02 |
| *** rcernin has joined #openstack-keystone | 06:04 | |
| *** code-R has quit IRC | 06:08 | |
| *** code-R has joined #openstack-keystone | 06:12 | |
| *** guoshan has joined #openstack-keystone | 06:18 | |
| *** agireud has quit IRC | 06:34 | |
| *** jorge_munoz has quit IRC | 06:34 | |
| *** pgbridge has quit IRC | 06:36 | |
| *** adriant has quit IRC | 06:39 | |
| *** agireud has joined #openstack-keystone | 06:40 | |
| *** spzala has joined #openstack-keystone | 06:43 | |
| *** agireud has quit IRC | 06:44 | |
| *** code-R_ has joined #openstack-keystone | 06:44 | |
| *** tesseract- has joined #openstack-keystone | 06:44 | |
| *** code-R has quit IRC | 06:46 | |
| *** spzala has quit IRC | 06:47 | |
| *** agireud has joined #openstack-keystone | 06:48 | |
| stevemar | breton: morning | 06:52 |
| *** adrian_otto has quit IRC | 06:54 | |
| *** adrian_otto has joined #openstack-keystone | 06:57 | |
| openstackgerrit | yuyafei proposed openstack/python-keystoneclient: Add __ne__ built-in function https://review.openstack.org/337435 | 07:01 |
| *** agireud has quit IRC | 07:06 | |
| *** rkrum has quit IRC | 07:06 | |
| *** adrian_otto has quit IRC | 07:11 | |
| *** jpena|off is now known as jpena | 07:16 | |
| *** jistr has quit IRC | 07:18 | |
| *** crinkle has quit IRC | 07:19 | |
| *** crinkle has joined #openstack-keystone | 07:21 | |
| *** code-R has joined #openstack-keystone | 07:23 | |
| *** code-R_ has quit IRC | 07:23 | |
| *** pcaruana has joined #openstack-keystone | 07:24 | |
| *** agireud has joined #openstack-keystone | 07:24 | |
| *** jistr has joined #openstack-keystone | 07:25 | |
| *** ktychkova has joined #openstack-keystone | 07:27 | |
| *** danpawlik has joined #openstack-keystone | 07:27 | |
| jaosorior | Is there support already for changing a domain's configuration via the OpenStack CLI? http://developer.openstack.org/api-ref/identity/v3/index.html#domain-configuration | 07:35 |
| jaosorior | Hey stevemar, still awake? how's it going? | 07:36 |
| openstackgerrit | Dave Chen proposed openstack/keystone: POC: This is the POC to support rolling upgrade without status https://review.openstack.org/353289 | 07:41 |
| *** jorge_munoz has joined #openstack-keystone | 07:42 | |
| *** agireud has quit IRC | 07:46 | |
| *** jorge_munoz has quit IRC | 07:50 | |
| *** agireud has joined #openstack-keystone | 07:50 | |
| *** Trident has joined #openstack-keystone | 07:52 | |
| *** Trident has quit IRC | 07:54 | |
| *** agireud has quit IRC | 07:55 | |
| *** Trident has joined #openstack-keystone | 07:55 | |
| *** agireud has joined #openstack-keystone | 07:57 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** agireud has quit IRC | 08:02 | |
| *** guoshan has quit IRC | 08:05 | |
| *** agireud has joined #openstack-keystone | 08:09 | |
| *** EinstCrazy has quit IRC | 08:09 | |
| *** guoshan has joined #openstack-keystone | 08:10 | |
| *** Trident has quit IRC | 08:11 | |
| *** EinstCrazy has joined #openstack-keystone | 08:11 | |
| *** agireud has quit IRC | 08:13 | |
| *** agireud has joined #openstack-keystone | 08:16 | |
| *** openstackgerrit has quit IRC | 08:18 | |
| *** openstackgerrit has joined #openstack-keystone | 08:18 | |
| *** agireud has quit IRC | 08:19 | |
| *** Trident has joined #openstack-keystone | 08:23 | |
| *** amoralej|off is now known as amoralej | 08:26 | |
| *** agireud has joined #openstack-keystone | 08:28 | |
| openstackgerrit | Anh Tran proposed openstack/keystone: api-ref: Correcting V3 Domain config APIs https://review.openstack.org/352260 | 08:37 |
| *** guoshan has quit IRC | 08:39 | |
| *** agireud has quit IRC | 08:39 | |
| *** permalac has quit IRC | 08:40 | |
| *** guoshan has joined #openstack-keystone | 08:42 | |
| *** davechen has left #openstack-keystone | 08:42 | |
| *** agireud has joined #openstack-keystone | 08:42 | |
| *** NishaYadav has joined #openstack-keystone | 08:48 | |
| *** NishaYadav is now known as Guest70635 | 08:48 | |
| *** ntpttr has quit IRC | 08:51 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Pre-cache new tokens https://review.openstack.org/309146 | 08:57 |
| *** ntpttr has joined #openstack-keystone | 08:58 | |
| *** agireud has quit IRC | 09:01 | |
| *** jed56 has joined #openstack-keystone | 09:03 | |
| *** agireud has joined #openstack-keystone | 09:05 | |
| * breton took eu-tz shift | 09:09 | |
| *** ravelar has joined #openstack-keystone | 09:12 | |
| *** ravelar has quit IRC | 09:16 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 09:21 |
| *** agireud has quit IRC | 09:25 | |
| openstackgerrit | Anh Tran proposed openstack/keystone: api-ref: Correcting V3 Authentication APIs https://review.openstack.org/352291 | 09:26 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Minimum password age requirements https://review.openstack.org/343314 | 09:31 |
| openstackgerrit | Anh Tran proposed openstack/keystone: api-ref: Correcting V3 Authentication APIs https://review.openstack.org/352291 | 09:32 |
| *** agireud has joined #openstack-keystone | 09:37 | |
| *** dkehn_ has quit IRC | 09:38 | |
| *** wangqun has joined #openstack-keystone | 09:42 | |
| *** agireud has quit IRC | 09:42 | |
| wangqun | Hi all, I have a question about keystone_paste.int . Can it have the parameter like the following in order to make it more flexible? | 09:44 |
| wangqun | {% if not disable_admin_token_auth%} | 09:44 |
| openstackgerrit | Anh Tran proposed openstack/keystone: api-ref: Correcting V3 Policies APIs https://review.openstack.org/351636 | 09:44 |
| wangqun | [filter:admin_token_auth] | 09:44 |
| wangqun | paste.filter_factory = keystone.middleware:AdminTokenAuthMiddleware.factory | 09:44 |
| wangqun | {% endif %} | 09:45 |
| wangqun | Can any one expain this issue? | 09:45 |
| wangqun | Is is OK? | 09:46 |
| *** Trident has quit IRC | 09:46 | |
| *** Trident has joined #openstack-keystone | 09:47 | |
| *** sdake has joined #openstack-keystone | 09:47 | |
| wangqun | ping stevemar | 09:47 |
| *** agireud has joined #openstack-keystone | 09:49 | |
| openstackgerrit | Anh Tran proposed openstack/keystone: api-ref: Correcting V3 Credentials APIs https://review.openstack.org/352683 | 09:50 |
| *** dkehn_ has joined #openstack-keystone | 09:51 | |
| openstackgerrit | Anh Tran proposed openstack/keystone: api-ref: Correcting V3 OS-INHERIT APIs https://review.openstack.org/352690 | 09:56 |
| *** guoshan has quit IRC | 10:02 | |
| *** guoshan has joined #openstack-keystone | 10:02 | |
| amakarov | dolphm, hi! Are you here? | 10:04 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 10:10 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 10:10 |
| *** mnikolaenko_ has joined #openstack-keystone | 10:12 | |
| *** guoshan has quit IRC | 10:16 | |
| *** rkrum has joined #openstack-keystone | 10:23 | |
| *** EinstCrazy has quit IRC | 10:30 | |
| *** Trident has quit IRC | 10:30 | |
| *** spzala has joined #openstack-keystone | 10:44 | |
| breton | wangqun: i think it's not possible | 10:44 |
| breton | wangqun: you need to do it in your ansible/puppet | 10:44 |
| *** spzala has quit IRC | 10:48 | |
| *** permalac has joined #openstack-keystone | 10:53 | |
| *** guoshan has joined #openstack-keystone | 11:07 | |
| *** Anticime1 is now known as Anticimex | 11:10 | |
| *** guoshan has quit IRC | 11:11 | |
| *** dkehn_ has quit IRC | 11:22 | |
| *** jaosorior has quit IRC | 11:28 | |
| *** jaosorior has joined #openstack-keystone | 11:29 | |
| *** mvk has quit IRC | 11:30 | |
| *** jaosorior has quit IRC | 11:33 | |
| *** jaosorior has joined #openstack-keystone | 11:33 | |
| *** wangqun has quit IRC | 11:34 | |
| *** dkehn_ has joined #openstack-keystone | 11:35 | |
| *** rkrum has quit IRC | 11:43 | |
| *** sdake has quit IRC | 11:51 | |
| *** sdake has joined #openstack-keystone | 11:51 | |
| *** BlackDex has quit IRC | 11:56 | |
| *** sdake_ has joined #openstack-keystone | 11:56 | |
| *** jpena is now known as jpena|lunch | 11:57 | |
| *** NishaYadav has joined #openstack-keystone | 11:57 | |
| *** NishaYadav has quit IRC | 11:57 | |
| *** sdake has quit IRC | 11:59 | |
| *** guoshan has joined #openstack-keystone | 12:00 | |
| *** links has quit IRC | 12:01 | |
| *** mvk has joined #openstack-keystone | 12:05 | |
| openstackgerrit | Merged openstack/keystone: api-ref: Correcting V3 Services APIs https://review.openstack.org/351598 | 12:20 |
| samueldmq | morning keystone | 12:20 |
| henrynash | mornin' | 12:20 |
| *** pauloewerton has joined #openstack-keystone | 12:21 | |
| jaosorior | samueldmq, henrynash: Do you guys know if there is support already for changing a domain's configuration via the OpenStack CLI? http://developer.openstack.org/api-ref/identity/v3/index.html#domain-configuration | 12:22 |
| samueldmq | jaosorior: I don't think we support it yet.. I can't find it in http://docs.openstack.org/developer/python-openstackclient/command-list.html | 12:23 |
| breton | jaosorior: looks like it's not yet supported | 12:24 |
| jaosorior | alright, thanks | 12:24 |
| henrynash | jaosorior: hi...I have some patches I am working on for this...but they aer not in yet | 12:31 |
| jaosorior | I see | 12:35 |
| *** richm has joined #openstack-keystone | 12:35 | |
| *** woodster_ has joined #openstack-keystone | 12:36 | |
| *** guoshan has quit IRC | 12:38 | |
| *** gordc has joined #openstack-keystone | 12:41 | |
| *** amoralej is now known as amoralej|lunch | 12:51 | |
| *** edmondsw has joined #openstack-keystone | 13:00 | |
| *** Ephur has joined #openstack-keystone | 13:00 | |
| *** bill_az has joined #openstack-keystone | 13:00 | |
| *** spzala_ has joined #openstack-keystone | 13:08 | |
| *** andreykurilin has joined #openstack-keystone | 13:09 | |
| andreykurilin | hi everyone! Can someone from keystone-cores look at change to global-requirements related to keystoneclient? | 13:10 |
| andreykurilin | https://review.openstack.org/353461 | 13:11 |
| samueldmq | andreykurilin: what change? | 13:11 |
| andreykurilin | samueldmq: https://review.openstack.org/353461 | 13:11 |
| samueldmq | andreykurilin: done, I've also added stevemar to that so we can get his feedback | 13:15 |
| *** jpena|lunch is now known as jpena | 13:15 | |
| andreykurilin | samueldmq: thanks | 13:15 |
| samueldmq | np | 13:16 |
| andreykurilin | samueldmq: btw, if you have a bit free time, I'll be very happy if you review patch related to novaclient+keystone session https://review.openstack.org/#/c/304035/ | 13:16 |
| patchbot | andreykurilin: patch 304035 - python-novaclient - Create keystone session instance if possible | 13:16 |
| *** sdake_ is now known as sdake | 13:18 | |
| samueldmq | andreykurilin: will do later today | 13:18 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Create unit tests for endpoint policy drivers https://review.openstack.org/212006 | 13:18 |
| openstackgerrit | Jiong Liu proposed openstack/keystone: Use international logging message https://review.openstack.org/353468 | 13:18 |
| andreykurilin | samueldmq: thanks. If I have + from keystone cores, it will be easier to get final +2 from nova folks:) | 13:20 |
| *** tonytan4ever has joined #openstack-keystone | 13:21 | |
| openstackgerrit | Jiong Liu proposed openstack/keystone: Use international logging message https://review.openstack.org/353468 | 13:22 |
| *** harlowja has quit IRC | 13:23 | |
| *** julim has joined #openstack-keystone | 13:24 | |
| *** woodburn has quit IRC | 13:26 | |
| samueldmq | andreykurilin: ok. I think stevemar and jamielennox|away are more familiar with the session code than I do | 13:26 |
| samueldmq | andreykurilin: but I can take a look | 13:26 |
| samueldmq | thanks | 13:26 |
| *** dikonoor has quit IRC | 13:33 | |
| *** ametts has joined #openstack-keystone | 13:36 | |
| *** amoralej|lunch is now known as amoralej | 13:44 | |
| *** woodburn has joined #openstack-keystone | 13:45 | |
| *** rkrum has joined #openstack-keystone | 13:47 | |
| *** ayoung has joined #openstack-keystone | 13:53 | |
| *** ChanServ sets mode: +v ayoung | 13:54 | |
| *** rodrigods has quit IRC | 13:56 | |
| *** rodrigods has joined #openstack-keystone | 13:56 | |
| *** Ephur has quit IRC | 13:57 | |
| *** asettle has joined #openstack-keystone | 14:06 | |
| *** catintheroof has joined #openstack-keystone | 14:09 | |
| *** edtubill has joined #openstack-keystone | 14:12 | |
| *** rkrum has quit IRC | 14:15 | |
| *** emccormickva has left #openstack-keystone | 14:15 | |
| *** ravelar has joined #openstack-keystone | 14:18 | |
| *** asettle has quit IRC | 14:19 | |
| *** asettle has joined #openstack-keystone | 14:20 | |
| bknudson | oslo.config added support for tagging options as "advanced" -- someone should look into use in keystone. | 14:23 |
| *** ravelar has quit IRC | 14:24 | |
| bknudson | http://docs.openstack.org/developer/oslo.config/cfg.html#advanced-option | 14:25 |
| breton | bknudson: cool | 14:32 |
| *** ravelar has joined #openstack-keystone | 14:37 | |
| *** adrian_otto has joined #openstack-keystone | 14:38 | |
| *** dkehn_ has quit IRC | 14:43 | |
| dolphm | henrynash: o/ morning | 14:49 |
| dolphm | amakarov: o/ | 14:49 |
| *** d34dh0r531234123 is now known as d34dh0r53 | 14:51 | |
| *** martinus__ has joined #openstack-keystone | 14:51 | |
| *** code-R_ has joined #openstack-keystone | 14:52 | |
| amakarov | dolphm, looks like I've run into cache invalidation problem: if token was validated, all tests with disabling/deleting users are failing. I assume, it's a trade-off people agree with, so will it be fair if I change tests so that token caching will be disabled for them? | 14:52 |
| amakarov | dolphm, https://review.openstack.org/#/c/309146/ | 14:52 |
| patchbot | amakarov: patch 309146 - keystone - Pre-cache new tokens | 14:52 |
| dolphm | dstanek: lbragstad: sounds like what you're working on? ^ | 14:52 |
| lbragstad | amakarov yeah - that sounds familiar | 14:53 |
| lbragstad | amakarov what test are you seeing that with? | 14:53 |
| amakarov | lbragstad, right now I focus on test_v3_auth | 14:53 |
| *** code-R has quit IRC | 14:54 | |
| amakarov | lbragstad, problems are with trust tests - those with deleting/disabling users | 14:54 |
| *** dkehn_ has joined #openstack-keystone | 14:55 | |
| *** adrian_otto has quit IRC | 14:57 | |
| *** ezpz has joined #openstack-keystone | 14:58 | |
| *** spedione|AWAY is now known as spedione | 14:58 | |
| *** Gorian_ has joined #openstack-keystone | 15:00 | |
| *** adrian_otto has joined #openstack-keystone | 15:00 | |
| *** thebloggu has joined #openstack-keystone | 15:00 | |
| dolphm | amakarov: we're in the middle of a meeting - but that sounds like an issue we were just talking about. let us get back to you in a bit. | 15:01 |
| *** ayoung has quit IRC | 15:01 | |
| *** d0ugal has quit IRC | 15:01 | |
| amakarov | dolphm, I'll be here | 15:01 |
| bknudson | amakarov: please don't disable token caching in the tests since this is how real deployments run. | 15:02 |
| bknudson | if the test needs the token to be uncached, then there should be a way to simulate flushing a token from the cache. | 15:02 |
| amakarov | bknudson, then we need to capture user operation and invalidate token cache region | 15:03 |
| amakarov | bknudson, it's a hack too. I'd say even more dirty then just disable caching for test :) | 15:04 |
| *** sdake_ has joined #openstack-keystone | 15:04 | |
| bknudson | it's possible the test is incorrect, or that the keystone behavior is incorrect. | 15:04 |
| *** LamT_ has joined #openstack-keystone | 15:05 | |
| *** Gorian_ has quit IRC | 15:05 | |
| *** Gorian_ has joined #openstack-keystone | 15:05 | |
| amakarov | bknudson, current tests are incorrect then. We can issue a token, validate it, disable user, validate token and it will be valid | 15:06 |
| amakarov | even with it's user disabled | 15:06 |
| bknudson | I thought disabling a user would invalidate the user tokens | 15:06 |
| bknudson | we're not even dealing with multi-process cache in the unit tests, so this isn't even the hard case. | 15:07 |
| *** sdake has quit IRC | 15:07 | |
| thebloggu | I have an openstack keystone server with the v2 and v3 API. I want to create a role that can list endpoints and I configured the policy.json accordingly but found out that the identity:list_endpoints target only maps to v3. if I make a request to the v2 API the keystone client tries to use the v2 Admin API (v2.0/endpoints). What's the policy target for those? | 15:07 |
| bknudson | disabling user should flush all user info from the cache, and validate token should always check the user. | 15:08 |
| amakarov | thebloggu, v2 api doesn't support policies | 15:08 |
| thebloggu | amakarov: so, if I'm currently using v2 what are my options to allow a specific role to list endpoints? do I have to migrate to v3? | 15:09 |
| *** Gorian_ has quit IRC | 15:09 | |
| amakarov | bknudson, yes, if token validation result wasn't memoized right before that | 15:09 |
| *** Gorian_ has joined #openstack-keystone | 15:09 | |
| bknudson | amakarov: right... was looking at this not too long ago and I think the token is checked right away... complicated. | 15:10 |
| amakarov | thebloggu, v3 is currently the recommended api version for keystone. v2.0 is passing away | 15:10 |
| amakarov | bknudson, we can do that using notifications | 15:11 |
| *** Gorian_ has quit IRC | 15:11 | |
| bknudson | amakarov: mock it up and let's see what it looks like! | 15:11 |
| *** Gorian_ has joined #openstack-keystone | 15:11 | |
| * amakarov thinks about code and spaghetti... | 15:11 | |
| *** david-lyle has quit IRC | 15:12 | |
| amakarov | bknudson, what exactly do you want me to mock up? | 15:12 |
| bknudson | amakarov: you were saying that notifications could be used ... | 15:12 |
| *** ayoung has joined #openstack-keystone | 15:12 | |
| *** ChanServ sets mode: +v ayoung | 15:12 | |
| *** david-lyle has joined #openstack-keystone | 15:12 | |
| amakarov | bknudson, ... provided we add them to identity api operations | 15:13 |
| amakarov | currently update_user is silent | 15:14 |
| *** Gorian_ has quit IRC | 15:14 | |
| bknudson | what would the update_user notification do/ | 15:14 |
| bknudson | ? | 15:14 |
| *** Gorian_ has joined #openstack-keystone | 15:14 | |
| amakarov | bknudson, it will notify user is changed. disabled, for instance | 15:15 |
| bknudson | what would listen to the update_user notification and what would it do? | 15:15 |
| thebloggu | amakarov: I know and we use v3 for the most part but we still support v2 for now and I would like to allow some type of users to list endpoints. is this possible (without policies for example)? | 15:16 |
| *** Gorian_ has quit IRC | 15:16 | |
| *** Gorian_ has joined #openstack-keystone | 15:16 | |
| *** Gorian_ has quit IRC | 15:17 | |
| *** Gorian_ has joined #openstack-keystone | 15:17 | |
| amakarov | thebloggu, v2.0 code check roles this way: "is it an admin?" And it's hard-coded | 15:18 |
| bknudson | also, this is a little strange because we really only want to check the user status if the token ID hits. If the token ID misses then no need to check the user. | 15:18 |
| amakarov | bknudson, listener in token module. The simplest action - invalidate token cache region | 15:19 |
| bknudson | should be like @MEMOIZE(on_hit=validate_user) -- where validate_user is a function that validates the user of the token. | 15:19 |
| bknudson | amakarov: so invalidate all tokens when a user is disabled? | 15:20 |
| *** pgbridge has joined #openstack-keystone | 15:20 | |
| *** Gorian_ has quit IRC | 15:21 | |
| amakarov | bknudson, no - just cache region, so that old tokens vill be actually validated and cached anew on the next validation attempt | 15:21 |
| *** Gorian_ has joined #openstack-keystone | 15:21 | |
| amakarov | so tokens are valid | 15:21 |
| amakarov | just the cache is purged | 15:21 |
| bknudson | sorry, "invalidate" has different meanings. | 15:21 |
| bknudson | amakarov: I'm fine with flushing token cache region on user update, since it's fixing a bug. | 15:22 |
| *** jrist has quit IRC | 15:22 | |
| thebloggu | amakarov: ok, thank you for your help. I guess we'll need to use v3 for those cases then | 15:22 |
| amakarov | bknudson, got it. I think it should be a separate patch... | 15:22 |
| bknudson | amakarov: yes, please. | 15:23 |
| amakarov | and a bug | 15:23 |
| *** jrist has joined #openstack-keystone | 15:23 | |
| *** Gorian_ has quit IRC | 15:25 | |
| *** haplo37__ has joined #openstack-keystone | 15:29 | |
| *** adrian_otto has quit IRC | 15:31 | |
| *** pgbridge has quit IRC | 15:31 | |
| *** itisha has joined #openstack-keystone | 15:32 | |
| amakarov | bknudson, lbragstad would you mind give this fix a push? https://review.openstack.org/#/c/352343/ | 15:34 |
| patchbot | amakarov: patch 352343 - keystoneauth - add status code 308 to _REDIRECT_STATUSES | 15:34 |
| bknudson | amakarov: lgtm. | 15:36 |
| thebloggu | amakarov: I'm developing a service that uses openstack swift and openstack keystone for auth. I would like to use the http swift endpoint for some requests and the https for others. I initially thought the service catalog from keystone would help but I couldn't get more than 1 endpoint from it for each service (at least with the python libraries). So I started using the API in keystone to list endpoints and filter those I needed. But as you tol | 15:36 |
| thebloggu | d me I can't use v2 to list endpoints (I'll have multiple users in keystone that my service will use and I can't obviously use the admin user). I now need to now what my options are: was my first choice (using the list endpoints API from keystone) the best choice? should I use v3 only? and what's the most common way of dealing with multiple endpoints for a service? | 15:36 |
| bknudson | amakarov: do you need this in a release? If so, I've already got a release request: https://review.openstack.org/#/c/353548/ . | 15:37 |
| patchbot | bknudson: patch 353548 - releases - keystoneauth 2.11.1 | 15:37 |
| bknudson | so if this merges, go ahead and update https://review.openstack.org/#/c/353548/ | 15:37 |
| patchbot | bknudson: patch 353548 - releases - keystoneauth 2.11.1 | 15:37 |
| *** code-R_ has quit IRC | 15:38 | |
| amakarov | bknudson, ok, will keep in mind | 15:38 |
| *** gyee has joined #openstack-keystone | 15:41 | |
| *** diazjf has joined #openstack-keystone | 15:41 | |
| *** sdake has joined #openstack-keystone | 15:45 | |
| *** pgbridge has joined #openstack-keystone | 15:46 | |
| *** sdake_ has quit IRC | 15:48 | |
| *** code-R has joined #openstack-keystone | 15:49 | |
| *** danpawlik has quit IRC | 15:50 | |
| *** dikonoor has joined #openstack-keystone | 15:53 | |
| *** jpena is now known as jpena|away | 15:56 | |
| *** code-R has quit IRC | 16:00 | |
| *** rcernin has quit IRC | 16:01 | |
| *** KevinE has joined #openstack-keystone | 16:04 | |
| amakarov | bknudson, hmm, on the current master my case is no longer valid - cached tokens handled correctly | 16:05 |
| bknudson | amakarov: wow. | 16:05 |
| bknudson | how's that? It checks the user after validating the token? | 16:06 |
| amakarov | bknudson, I'll rebase my patch and try it out too | 16:07 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Pre-cache new tokens https://review.openstack.org/309146 | 16:07 |
| *** roxanaghe has joined #openstack-keystone | 16:08 | |
| stevemar | jaosorior: definitely not in yet | 16:14 |
| jaosorior | stevemar: thanks, I just checked :( | 16:15 |
| jaosorior | stevemar: Wanted to add support for it in puppet | 16:15 |
| *** code-R has joined #openstack-keystone | 16:17 | |
| stevemar | jaosorior: https://review.openstack.org/#/c/168089/ | 16:17 |
| patchbot | stevemar: patch 168089 - python-keystoneclient - Support domain-specific configuration management | 16:17 |
| stevemar | needs to land in KSC before it can land in OSC | 16:17 |
| *** code-R has quit IRC | 16:17 | |
| jaosorior | that looks quite red | 16:17 |
| *** code-R has joined #openstack-keystone | 16:17 | |
| *** tonytan_brb has joined #openstack-keystone | 16:21 | |
| openstackgerrit | David Stanek proposed openstack/keystone: WIP: region namespace POC for cache invalidation https://review.openstack.org/349704 | 16:22 |
| stevemar | jaosorior: it hasn't been picked up in a while :( | 16:23 |
| dstanek | amakarov: our caching is problematic | 16:23 |
| *** tonytan4ever has quit IRC | 16:24 | |
| *** raildo has joined #openstack-keystone | 16:25 | |
| *** pcaruana has quit IRC | 16:29 | |
| *** jaosorior has quit IRC | 16:29 | |
| *** esp has joined #openstack-keystone | 16:30 | |
| dstanek | bknudson: it turns out that once i fixed region invalidation that a few of our tests failed ^ | 16:33 |
| *** Ephur has joined #openstack-keystone | 16:35 | |
| *** amoralej is now known as amoralej|off | 16:35 | |
| *** tonytan_brb is now known as tonytan4ever | 16:36 | |
| *** diazjf has quit IRC | 16:38 | |
| *** ametts has quit IRC | 16:38 | |
| *** jaugustine_ has joined #openstack-keystone | 16:39 | |
| *** jaugustine has quit IRC | 16:40 | |
| *** jaugustine_ is now known as jaugustine | 16:40 | |
| *** asettle has quit IRC | 16:43 | |
| *** asettle has joined #openstack-keystone | 16:43 | |
| *** diazjf has joined #openstack-keystone | 16:54 | |
| *** asettle has quit IRC | 17:00 | |
| *** jaugustine has quit IRC | 17:03 | |
| *** ayoung has quit IRC | 17:06 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Pre-cache new tokens https://review.openstack.org/309146 | 17:06 |
| *** code-R has quit IRC | 17:07 | |
| amakarov | bknudson, shame on me: all notifications are there :) | 17:08 |
| amakarov | bknudson, the problem that token cache is invalidated only for persistent tokens and only if revoke_by_id is set. So added region invalidation everywhere | 17:09 |
| *** diazjf1 has joined #openstack-keystone | 17:13 | |
| *** diazjf1 has quit IRC | 17:15 | |
| *** code-R has joined #openstack-keystone | 17:16 | |
| *** diazjf has quit IRC | 17:16 | |
| *** ayoung has joined #openstack-keystone | 17:20 | |
| *** ChanServ sets mode: +v ayoung | 17:20 | |
| *** nishaYadav has joined #openstack-keystone | 17:21 | |
| *** mrhillsman is now known as mrhillsman_away | 17:22 | |
| *** mvk has quit IRC | 17:23 | |
| *** jpena|away is now known as jpena|off | 17:23 | |
| nishaYadav | o/ | 17:26 |
| *** harlowja has joined #openstack-keystone | 17:27 | |
| *** ametts has joined #openstack-keystone | 17:28 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Pre-cache new tokens https://review.openstack.org/309146 | 17:31 |
| *** tonytan4ever has quit IRC | 17:35 | |
| bknudson | amakarov: ok. Wonder why we thought it was ok only for persistent tokens & revoke_by_id. | 17:36 |
| amakarov | bknudson, ^ I had to remove anonymous decorator due to v2/v3 intermix problems and fix fernet test in the process. | 17:36 |
| *** amakarov is now known as amakarov_away | 17:38 | |
| amakarov_away | bknudson, sorry, I have to go | 17:38 |
| *** woodster_ has quit IRC | 17:39 | |
| jlk | Has anybody seen a problem with client auth when both OS_PROJECT_NAME=admin OS_DOMAIN_ID=default are set? | 17:44 |
| jlk | I'm getting "Authentication cannot be scoped to multiple targets. Pick one of: project, domain, trust or unscoped" | 17:44 |
| *** Gorian_ has joined #openstack-keystone | 17:49 | |
| *** Gorian_ has quit IRC | 17:49 | |
| *** asettle has joined #openstack-keystone | 17:52 | |
| *** ravelar has quit IRC | 17:56 | |
| *** nisha_ has joined #openstack-keystone | 18:02 | |
| *** jaugustine has joined #openstack-keystone | 18:02 | |
| *** nisha__ has joined #openstack-keystone | 18:04 | |
| *** nisha__ has quit IRC | 18:04 | |
| *** nishaYadav has quit IRC | 18:04 | |
| *** nishaYadav has joined #openstack-keystone | 18:05 | |
| *** nisha_ has quit IRC | 18:07 | |
| *** jaugustine has quit IRC | 18:09 | |
| *** mvk has joined #openstack-keystone | 18:12 | |
| *** tesseract- has quit IRC | 18:13 | |
| *** Trident has joined #openstack-keystone | 18:14 | |
| *** Gorian_ has joined #openstack-keystone | 18:17 | |
| *** diazjf has joined #openstack-keystone | 18:22 | |
| *** thebloggu has quit IRC | 18:28 | |
| henrynash | lbragstad: trying to get to grips with your proposal....can you talk me through the "tiggers" bit? | 18:30 |
| *** jaugustine has joined #openstack-keystone | 18:31 | |
| *** ayoung has quit IRC | 18:31 | |
| *** catintheroof has quit IRC | 18:34 | |
| stevemar | henrynash: can you double check my changes in https://review.openstack.org/#/c/283554/ ? | 18:34 |
| patchbot | stevemar: patch 283554 - python-openstackclient - Add support for domain specific roles | 18:34 |
| stevemar | henrynash: it's the last bit before we release 3.0.0! | 18:34 |
| henrynash | stevemar: sure...thanks for those....have got bogged down with the rolling upgrade stuff! I'll look now | 18:34 |
| *** tonytan4ever has joined #openstack-keystone | 18:35 | |
| *** tonytan4ever has quit IRC | 18:40 | |
| henrynash | stevemar: what about all this stuff that adam added...I assume this for his follow on patch? | 18:41 |
| *** dikonoor has quit IRC | 18:41 | |
| *** nisha_ has joined #openstack-keystone | 18:41 | |
| *** ametts has quit IRC | 18:42 | |
| henrynash | ayoung: did you mean to add addional stuff into https://review.openstack.org/#/c/283554/? | 18:42 |
| patchbot | henrynash: patch 283554 - python-openstackclient - Add support for domain specific roles | 18:42 |
| *** ametts has joined #openstack-keystone | 18:43 | |
| *** nisha_ has quit IRC | 18:43 | |
| *** nisha_ has joined #openstack-keystone | 18:44 | |
| *** nishaYadav has quit IRC | 18:45 | |
| *** spzala_ has quit IRC | 18:49 | |
| *** spzala has joined #openstack-keystone | 18:50 | |
| *** fifieldt has quit IRC | 19:02 | |
| *** tonytan4ever has joined #openstack-keystone | 19:05 | |
| *** asettle has quit IRC | 19:12 | |
| *** woodster_ has joined #openstack-keystone | 19:13 | |
| *** Trident has quit IRC | 19:14 | |
| *** fifieldt has joined #openstack-keystone | 19:18 | |
| *** jaugustine has quit IRC | 19:22 | |
| *** ravelar has joined #openstack-keystone | 19:25 | |
| *** ravelar has quit IRC | 19:26 | |
| *** diazjf has quit IRC | 19:26 | |
| *** roxanaghe has quit IRC | 19:29 | |
| *** roxanaghe has joined #openstack-keystone | 19:34 | |
| lbragstad | henrynash sure | 19:34 |
| lbragstad | dstanek dolphm rderose_ and i were thinking about the r/w case | 19:34 |
| lbragstad | and started experimenting with the idea of using triggers in the expand and contract phases to handle the copy of data from the old schema to the new one | 19:35 |
| lbragstad | henrynash it's very similar to what you've proposed - but using triggers (performing the data copy in the data layer) | 19:35 |
| lbragstad | so the flow would be | 19:36 |
| lbragstad | 1.) Take the first keystone node out of the rotation | 19:36 |
| lbragstad | 2.) upgrade the first keystone node to the next release (to get the latest schema and migrations) | 19:36 |
| lbragstad | 3.) peform a db_sync --expand on the first node which updates the database with all the additive changes | 19:37 |
| lbragstad | the expand phase will also create database triggers using sqlalchemy to copy data written to the old schema over to the new schema | 19:37 |
| lbragstad | 4.) from the first keystone node - issue a db_sync --migrate which will copy over all data manually | 19:38 |
| lbragstad | (note that there are two database triggers in effect here - one to copy data from the old schema to the new schema and one to copy data from the new schema to the old schema) | 19:39 |
| *** diazjf has joined #openstack-keystone | 19:39 | |
| lbragstad | at this point - we also only have the old application code running - so the application only understands the old schema (which is fine because we have two-way triggers in place) | 19:40 |
| lbragstad | 5.) take each node out of rotation and upgrade it to the next release | 19:40 |
| lbragstad | and place it back into rotation | 19:40 |
| lbragstad | (this is where you'll have a mix of different application versions in your deployment (but that's fine because the triggers make it so that they don't need to understand each others schemas) | 19:41 |
| lbragstad | 6.) after you do a rolling restart on your entire cluster - all application nodes will be running the latest application code (which only understand the new schema) | 19:42 |
| lbragstad | so you can do a db_sync --contract to remove all the old schema changes | 19:42 |
| lbragstad | henrynash theoretically - that will allow you to do a r/w rolling upgrade without having to make a release aware of two separate schema | 19:43 |
| *** mrhillsman_away is now known as mrhillsman | 19:43 | |
| *** ayoung has joined #openstack-keystone | 19:43 | |
| *** ChanServ sets mode: +v ayoung | 19:43 | |
| lbragstad | henrynash the final db_sync --contract will remove the database triggers before removing the old schema | 19:44 |
| bknudson | does sqlalchemy support creating triggers? | 19:44 |
| lbragstad | bknudson yes - something like this http://stackoverflow.com/questions/7888846/trigger-in-sqlachemy | 19:45 |
| lbragstad | bknudson dolphm and dstanek dug that up | 19:46 |
| bknudson | so are we talking about actual database triggers or sqlalchemy listener interface? | 19:46 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Move fernet utils into keystone/common/ https://review.openstack.org/353707 | 19:47 |
| lbragstad | bknudson sqlalchemy can create an actual database trigger | 19:47 |
| bknudson | sure it can but you have to write the ddl for each supported DB. | 19:47 |
| lbragstad | bknudson so the data layer will handle the copying of data (not the application - which is probably a good thing?) | 19:47 |
| lbragstad | bknudson yeah - we would have to work that in if we wanted to make the data layer handle the copy | 19:48 |
| dstanek | bknudson: right, that's what we need to proof out i think. | 19:48 |
| *** diazjf has quit IRC | 19:48 | |
| *** roxanaghe has quit IRC | 19:49 | |
| *** jaugustine has joined #openstack-keystone | 19:53 | |
| *** roxanaghe has joined #openstack-keystone | 19:56 | |
| *** d0ugal has joined #openstack-keystone | 20:01 | |
| *** nisha_ has quit IRC | 20:03 | |
| *** roxanaghe has quit IRC | 20:04 | |
| *** roxanaghe has joined #openstack-keystone | 20:07 | |
| *** haplo37__ has quit IRC | 20:07 | |
| *** jlk has left #openstack-keystone | 20:07 | |
| *** asettle has joined #openstack-keystone | 20:09 | |
| *** jaugustine has quit IRC | 20:17 | |
| *** BlackDex has joined #openstack-keystone | 20:18 | |
| *** jaugustine has joined #openstack-keystone | 20:19 | |
| *** jaugustine has quit IRC | 20:24 | |
| *** diazjf has joined #openstack-keystone | 20:27 | |
| *** julim has quit IRC | 20:30 | |
| *** roxanaghe has quit IRC | 20:33 | |
| *** ametts has quit IRC | 20:34 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Updates Development Environment Docs https://review.openstack.org/246400 | 20:36 |
| *** diazjf has quit IRC | 20:37 | |
| *** roxanaghe has joined #openstack-keystone | 20:38 | |
| *** diazjf has joined #openstack-keystone | 20:39 | |
| *** michauds has joined #openstack-keystone | 20:40 | |
| *** mnikolaenko_ has quit IRC | 20:40 | |
| *** roxanaghe has quit IRC | 20:46 | |
| *** roxanaghe has joined #openstack-keystone | 20:47 | |
| *** messy has joined #openstack-keystone | 20:52 | |
| *** roxanaghe has quit IRC | 20:56 | |
| *** esp has quit IRC | 20:59 | |
| *** esp has joined #openstack-keystone | 21:02 | |
| henrynash | lbragstad: (back): ok, thanks for explanation, I understand it now...off to mull it over....interesting idea.... | 21:03 |
| *** roxanaghe has joined #openstack-keystone | 21:03 | |
| lbragstad | henrynash cool - ping us if you have any more questions | 21:06 |
| *** pauloewerton has quit IRC | 21:22 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add debug logging to revocation event checking https://review.openstack.org/353742 | 21:27 |
| openstackgerrit | Merged openstack/keystone: api-ref: Add query options to GET /projects API documentation https://review.openstack.org/352708 | 21:37 |
| *** adriant has joined #openstack-keystone | 21:39 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: add status code 308 to _REDIRECT_STATUSES https://review.openstack.org/352343 | 21:40 |
| *** Ephur has quit IRC | 21:49 | |
| *** edtubill has quit IRC | 21:49 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for rolling upgrades to keystone-manage https://review.openstack.org/349716 | 21:52 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add migration helper logic for rolling upgrades https://review.openstack.org/353753 | 21:57 |
| *** tonytan4ever has quit IRC | 21:58 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add contract migrations to keystone-manage https://review.openstack.org/349939 | 21:59 |
| *** messy has quit IRC | 21:59 | |
| *** gordc has quit IRC | 22:00 | |
| *** LamT_ has quit IRC | 22:01 | |
| henrynash | lbragstad: hi | 22:07 |
| *** bill_az has quit IRC | 22:08 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Move fernet utils into keystone/common/ https://review.openstack.org/353707 | 22:08 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make a FernetUtils class https://review.openstack.org/353761 | 22:08 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Pass key_repository and max_active_keys to FernetUtils https://review.openstack.org/353762 | 22:08 |
| lbragstad | henrynash hello | 22:08 |
| henrynash | lbragstad: so.... | 22:09 |
| * dstanek ducks | 22:09 | |
| stevemar | i'm free from conference nonsense, whats up with rolling upgrades | 22:09 |
| henrynash | lbragstad: there is no real RO mode in what you are proposing? This is just (!) a better way than have versioned objects? | 22:09 |
| dstanek | henrynash: ++ with the triggers, yes | 22:09 |
| dolphm | henrynash: no versioned objects required - each release (or commit to master) only knows about one schema | 22:10 |
| lbragstad | henrynash technically you could achieve RO with the model but... | 22:10 |
| lbragstad | with triggers we can do the copy part during R/W without having to keep that logic in the application | 22:10 |
| lbragstad | which I think would be really nice | 22:10 |
| dolphm | henrynash: i'm going to propose another spec revision and new documentation for operators to illustrate the experience, flow, etc | 22:10 |
| henrynash | lbragstad: sure, you could if we wanted....but the real interesting thing is there is NO data migration required for Newton! | 22:11 |
| lbragstad | henrynash what do you mean? | 22:11 |
| henrynash | lbragstad: so none of the migrations actual need us to copy data in Newton | 22:11 |
| lbragstad | henrynash meaning we only have additive schema changes in newton? | 22:11 |
| dolphm | henrynash: just by coincidence this release? | 22:11 |
| henrynash | lbragstad: yes (by coincidnece) | 22:11 |
| lbragstad | ah | 22:12 |
| lbragstad | right | 22:12 |
| breton | 1am | 22:12 |
| henrynash | lbragdstad, dolphm: so if we are confident we can make the trigger solution work in Ocata, then we can allow the RW pattern in Newton | 22:12 |
| breton | sleep or cide? | 22:12 |
| breton | *code | 22:12 |
| *** michauds has quit IRC | 22:13 | |
| henrynash | lbragstad: we just make sure we have the right keystone-manager cmmands, states etc. so that the operators experience remains the same | 22:13 |
| dolphm | henrynash: that is the hope - no confidence until we can demo it :P | 22:13 |
| dolphm | and test it :D | 22:13 |
| dstanek | breton: isn't beer an option? | 22:13 |
| dolphm | henrynash: ++ | 22:13 |
| dolphm | henrynash: but we'd only need the 3 new arguments | 22:14 |
| henrynash | dolphm: yep, agreed | 22:14 |
| dolphm | henrynash: --expand, --migrate, --contract, i believe (plus the original, vanilla db_sync for backwards compat | 22:14 |
| openstackgerrit | Merged openstack/keystone: api-ref: Correcting V3 Endpoints APIs https://review.openstack.org/351600 | 22:14 |
| dolphm | ) | 22:14 |
| henrynash | dolphm: yep | 22:14 |
| dstanek | my only concern is that we have to prove how it will work for mysql, postgres, etc... | 22:14 |
| dolphm | henrynash: and no new config options | 22:14 |
| dolphm | dstanek: +++ | 22:14 |
| dolphm | and db2 | 22:14 |
| dstanek | but we can't do that without some codes | 22:14 |
| dolphm | and ideally sqlite | 22:14 |
| breton | dstanek: nope, i don't drink | 22:14 |
| henrynash | dolphm: agreed | 22:14 |
| rderose_ | breton: whats wrong with you! | 22:15 |
| stevemar | dolphm: we dont support db2 | 22:15 |
| dolphm | stevemar: we? | 22:15 |
| dolphm | stevemar: keystone has code for db2 | 22:15 |
| stevemar | dolphm: and even we (IBM) don't care about it | 22:15 |
| dolphm | stevemar: one sec proposing a patch | 22:15 |
| stevemar | dolphm: i don't think so... | 22:15 |
| stevemar | k | 22:15 |
| *** diazjf has quit IRC | 22:15 | |
| stevemar | dolphm: i think those were old migrations when IBM actually cared about db2, but i firmly believe we don't care if openstack runs on it now | 22:16 |
| henrynash | dolphm: it would be trivial for me to modify my current implementation to match the Newton implementation of this, if we decide it is the way to go | 22:17 |
| lbragstad | dstanek https://review.openstack.org/#/q/topic:bp/credential-encryption | 22:18 |
| henrynash | dolphm: I just refactored it so that it is a better squence and you can see how we would change it (as well as didtch one of the patches altogther) | 22:18 |
| *** diazjf has joined #openstack-keystone | 22:19 | |
| *** diazjf1 has joined #openstack-keystone | 22:19 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Drop support for IBM DB2 https://review.openstack.org/353767 | 22:19 |
| dolphm | henrynash: bknudson: stevemar: fixed ^ | 22:20 |
| stevemar | dolphm: thanks | 22:20 |
| henrynash | dolphm: nice! | 22:20 |
| bknudson | we used to have a requirement for DB2, but that's gone away. | 22:20 |
| stevemar | dolphm: last mention of it: https://github.com/openstack/keystone/blob/3a266929cf42a63ab39c6963c72506e7425df709/keystone/common/sql/migrate_repo/versions/073_insert_assignment_inherited_pk.py#L87-L108 | 22:21 |
| stevemar | but can't remove that :( | 22:21 |
| dolphm | stevemar: yeah, i figured the migration would eventually just go away | 22:21 |
| *** diazjf1 has quit IRC | 22:21 | |
| stevemar | yeah | 22:21 |
| stevemar | it's the next one up | 22:21 |
| *** KevinE has quit IRC | 22:22 | |
| henrynash | dolphm, lbragstad, dstanek: is someone attempting a POC of the tiggers? Do you want me to? | 22:22 |
| dolphm | henrynash: we only talked about the need for one - that'd be awesome | 22:23 |
| *** diazjf has quit IRC | 22:23 | |
| stevemar | dolphm: can you review https://review.openstack.org/#/c/351749/ | 22:23 |
| patchbot | stevemar: patch 351749 - keystone - Password expires ignore user list | 22:23 |
| henrynash | dolphm: if we could show it is viable, then I think we would have confidence to push ahead with the Newton RW flow (which wouldn't actually need the triggers of course) | 22:24 |
| stevemar | close to closing out PCI | 22:24 |
| stevemar | which would be a huge load off my mind :D | 22:24 |
| dolphm | henrynash: any idea if we have anything proposed in gerrit that might need them? | 22:25 |
| henrynash | dolphm: not yet | 22:25 |
| stevemar | are all the rackers together in SA? | 22:25 |
| dstanek | stevemar: yerp | 22:25 |
| stevemar | dstanek: what about rderose_? | 22:25 |
| henrynash | dolphm: I'd create a dummy migration to tets | 22:25 |
| dstanek | yep | 22:25 |
| dolphm | stevemar: yes, including rderose_ | 22:25 |
| stevemar | nice | 22:25 |
| dolphm | stevemar: openstack-ansible midcycle | 22:25 |
| stevemar | jelly | 22:25 |
| stevemar | yeah | 22:25 |
| dstanek | me, rderose_, lbragstad and dolphm are sitting in the same room | 22:26 |
| lbragstad | we're peer programming | 22:26 |
| henrynash | dstanek: now that sounds dangerous | 22:26 |
| stevemar | rderose_: is https://review.openstack.org/#/c/343314/ an outcome of the ibm requirement for not too many password changes per day? | 22:26 |
| patchbot | stevemar: patch 343314 - keystone - PCI-DSS Minimum password age requirements | 22:26 |
| lbragstad | which consists of me watching dstanek debug revocation caching problems | 22:26 |
| stevemar | lbragstad: "I'm helping!" | 22:26 |
| dolphm | lbragstad: i'm not your peer, pal | 22:26 |
| dstanek | translation: watching dstanek huddle in the corner crying | 22:26 |
| henrynash | peer, earl, lord...whatever | 22:27 |
| rderose_ | stevemar: yes and no | 22:27 |
| lbragstad | the room is quiet for about 45 minutes.. then dstanek belts out some four letter word randomly | 22:27 |
| lbragstad | this is the process of debugging revocation events | 22:27 |
| rderose_ | stevemar: it naturally goes with password history requirements | 22:27 |
| dolphm | lbragstad: commits* some four letter words | 22:27 |
| rderose_ | stevemar: but both options are for the same purpose, right? to prevent users from reusing old passwords. | 22:28 |
| henrynash | ok, off to sleep and dream of sql triggers (I really should get out more) | 22:28 |
| rderose_ | stevemar: min password age seemed like a more common way of dealing with that | 22:28 |
| dolphm | henrynash: ++ | 22:29 |
| dolphm | henrynash: also ++ | 22:29 |
| dstanek | henrynash: good night, sir | 22:29 |
| dolphm | henrynash: spec tomorrow! | 22:29 |
| lbragstad | henrynash o/ | 22:29 |
| stevemar | rderose_: yeah, totally | 22:31 |
| stevemar | just didn't want you doing it solely for us | 22:31 |
| rderose_ | stevemar: ah, I see | 22:31 |
| rderose_ | stevemar: last of the PCI btw, thank goodness!! | 22:31 |
| stevemar | rderose_: measured in days eh | 22:32 |
| stevemar | so i can only change my password once per day? | 22:32 |
| rderose_ | stevemar: exactly | 22:32 |
| stevemar | rderose_: shouldn't that be measured in seconds or minutes? | 22:33 |
| stevemar | rderose_: IIRC the old requirement was "a user shouldn't be able to change their password more than 5 times a day" | 22:33 |
| stevemar | the minimum of 1 day would bust that | 22:33 |
| stevemar | consider the case where i ask the admin to reset my password, thats 1 change, and then i want to change it again (now i can't) | 22:34 |
| rderose_ | stevemar: typically minimum password age is set in days | 22:34 |
| rderose_ | stevemar: I ignore admin password resets | 22:34 |
| rderose_ | stevemar: colleen brought that up | 22:34 |
| stevemar | mmm yeah she did | 22:35 |
| rderose_ | stevemar: so only counting self service password changes | 22:35 |
| *** edmondsw has quit IRC | 22:36 | |
| stevemar | rderose_: i guess my argument is that having it in minutes makes it more open | 22:37 |
| rderose_ | stevemar: why not seconds? | 22:38 |
| stevemar | rderose_: even better | 22:38 |
| stevemar | rderose_: ugh https://technet.microsoft.com/en-us/library/hh994570(v=ws.11).aspx | 22:38 |
| *** sdake has quit IRC | 22:38 | |
| stevemar | i guess that's the norm | 22:39 |
| stevemar | that's silly | 22:39 |
| *** ezpz has quit IRC | 22:39 | |
| rderose_ | stevemar: yeah, days seemed to be the norm | 22:39 |
| stevemar | rderose_: ok | 22:40 |
| stevemar | rderose_: i'll concede for now :D | 22:40 |
| rderose_ | stevemar: :) | 22:40 |
| stevemar | rderose_: we should rename password_expires_days to maximum_password_age to better match up with minimum_password_age :P | 22:41 |
| rderose_ | stevemar: what, are we microsoft now? | 22:41 |
| rderose_ | stevemar: but yeah, I did think that too :) | 22:42 |
| stevemar | rderose_: i'd be down for it :P | 22:42 |
| stevemar | rderose_: was "change_password" missing from the base? :\ | 22:43 |
| rderose_ | stevemar: yeah, manager would just call update_user for all password changes | 22:43 |
| rderose_ | stevemar: implementation was cleaner creating a separate method in the backend for self service password changes | 22:47 |
| *** asettle has quit IRC | 22:47 | |
| lbragstad | nonameentername I pulled a few of your changes into their own reviews - https://review.openstack.org/#/q/topic:bp/credential-encryption | 22:49 |
| *** spedione is now known as spedione|AWAY | 22:49 | |
| stevemar | lbragstad: thanks for working on that too | 22:50 |
| * stevemar will be back in 5 minutes as he's getting kicked out | 22:50 | |
| lbragstad | stevemar no problem | 22:51 |
| *** tonytan4ever has joined #openstack-keystone | 22:59 | |
| *** code-R has quit IRC | 23:01 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Pass key_repository and max_active_keys to FernetUtils https://review.openstack.org/353762 | 23:02 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make a FernetUtils class https://review.openstack.org/353761 | 23:02 |
| *** tonytan4ever has quit IRC | 23:03 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add debug logging to revocation event checking https://review.openstack.org/353742 | 23:04 |
| *** tonytan4ever has joined #openstack-keystone | 23:07 | |
| stevemar | o/ | 23:19 |
| stevemar | dolphm: the rackers all go home? | 23:19 |
| *** Ephur has joined #openstack-keystone | 23:25 | |
| *** sdake has joined #openstack-keystone | 23:26 | |
| *** ayoung has quit IRC | 23:30 | |
| *** chlong|mtg has quit IRC | 23:31 | |
| *** Gorian_ has quit IRC | 23:41 | |
| openstackgerrit | Jiong Liu proposed openstack/keystone: Use international logging message https://review.openstack.org/353468 | 23:43 |
| *** woodster_ has quit IRC | 23:49 | |
| *** rkrum has joined #openstack-keystone | 23:50 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!