| *** jlk has quit IRC | 00:35 | |
| *** jamielennox is now known as jamielennox|away | 00:41 | |
| *** jamielennox|away is now known as jamielennox | 00:58 | |
| *** erlon has quit IRC | 01:12 | |
| *** breton has quit IRC | 01:12 | |
| *** med_ has quit IRC | 01:12 | |
| *** kukacz_ has quit IRC | 01:12 | |
| *** delaf has quit IRC | 01:12 | |
| *** comstud has quit IRC | 01:12 | |
| *** kfox1111 has quit IRC | 01:12 | |
| *** mgagne has quit IRC | 01:12 | |
| *** mordred has quit IRC | 01:12 | |
| *** DinaBelova has quit IRC | 01:12 | |
| *** jhesketh has quit IRC | 01:12 | |
| *** dims has quit IRC | 01:12 | |
| *** darrenc has quit IRC | 01:12 | |
| *** Daviey has quit IRC | 01:12 | |
| *** kfox1111 has joined #openstack-keystone | 01:12 | |
| *** kukacz has joined #openstack-keystone | 01:12 | |
| *** breton has joined #openstack-keystone | 01:12 | |
| *** Daviey has joined #openstack-keystone | 01:12 | |
| *** med_ has joined #openstack-keystone | 01:12 | |
| *** delaf has joined #openstack-keystone | 01:12 | |
| *** mordred has joined #openstack-keystone | 01:12 | |
| *** darrenc_ has joined #openstack-keystone | 01:12 | |
| *** comstud has joined #openstack-keystone | 01:12 | |
| *** DinaBelova has joined #openstack-keystone | 01:12 | |
| *** med_ is now known as Guest34220 | 01:13 | |
| *** jhesketh has joined #openstack-keystone | 01:13 | |
| *** Guest96631 has joined #openstack-keystone | 01:13 | |
| *** darrenc_ is now known as darrenc | 01:14 | |
| *** dims has joined #openstack-keystone | 01:14 | |
| *** erlon has joined #openstack-keystone | 01:16 | |
| *** liujiong has joined #openstack-keystone | 01:21 | |
| *** briancurtin has quit IRC | 01:23 | |
| *** dhellmann has quit IRC | 01:23 | |
| *** knikolla has quit IRC | 01:23 | |
| *** jistr has quit IRC | 01:23 | |
| *** kamal___ has quit IRC | 01:23 | |
| *** morgan has quit IRC | 01:23 | |
| *** lbragstad has quit IRC | 01:23 | |
| *** zigo has quit IRC | 01:23 | |
| *** antwash has quit IRC | 01:23 | |
| *** jmccrory has quit IRC | 01:23 | |
| *** dstanek has quit IRC | 01:23 | |
| *** chris_hultin|AWA has quit IRC | 01:23 | |
| *** dtroyer has quit IRC | 01:23 | |
| *** melwitt has quit IRC | 01:23 | |
| *** redrobot has quit IRC | 01:23 | |
| *** zigo has joined #openstack-keystone | 01:23 | |
| *** lbragstad_ has joined #openstack-keystone | 01:23 | |
| *** jmccrory_ has joined #openstack-keystone | 01:23 | |
| *** melwitt has joined #openstack-keystone | 01:23 | |
| *** dstanek has joined #openstack-keystone | 01:24 | |
| *** ChanServ sets mode: +v dstanek | 01:24 | |
| *** melwitt is now known as Guest86619 | 01:24 | |
| *** antwash has joined #openstack-keystone | 01:24 | |
| *** redrobot has joined #openstack-keystone | 01:24 | |
| *** redrobot is now known as Guest59792 | 01:24 | |
| *** jistr has joined #openstack-keystone | 01:24 | |
| *** jmccrory_ is now known as jmccrory | 01:25 | |
| *** dhellmann has joined #openstack-keystone | 01:25 | |
| *** jlk has joined #openstack-keystone | 01:26 | |
| *** jlk has quit IRC | 01:26 | |
| *** jlk has joined #openstack-keystone | 01:26 | |
| *** kamal___ has joined #openstack-keystone | 01:27 | |
| *** dtroyer has joined #openstack-keystone | 01:28 | |
| *** chris_hultin|AWA has joined #openstack-keystone | 01:28 | |
| *** chris_hultin|AWA is now known as chris_hultin | 01:28 | |
| *** briancurtin has joined #openstack-keystone | 01:28 | |
| *** morgan has joined #openstack-keystone | 01:36 | |
| *** thorst has joined #openstack-keystone | 01:39 | |
| *** guoshan has joined #openstack-keystone | 01:39 | |
| *** dtroyer has quit IRC | 01:43 | |
| *** dstanek has quit IRC | 01:43 | |
| *** dstanek has joined #openstack-keystone | 01:43 | |
| *** ChanServ sets mode: +v dstanek | 01:43 | |
| *** thorst has quit IRC | 01:44 | |
| *** dtroyer has joined #openstack-keystone | 01:45 | |
| *** thorst has joined #openstack-keystone | 01:56 | |
| *** nkinder has quit IRC | 02:05 | |
| *** Trident has quit IRC | 02:08 | |
| *** thorst has quit IRC | 02:09 | |
| *** lamt has quit IRC | 02:14 | |
| *** lamt has joined #openstack-keystone | 02:15 | |
| *** hyakuhei has quit IRC | 02:19 | |
| *** hyakuhei has joined #openstack-keystone | 02:22 | |
| *** dave-mccowan has joined #openstack-keystone | 02:42 | |
| *** samueldmq has quit IRC | 02:42 | |
| *** jraim has quit IRC | 02:42 | |
| *** erlon has quit IRC | 02:42 | |
| *** samueldmq has joined #openstack-keystone | 02:43 | |
| *** ChanServ sets mode: +v samueldmq | 02:43 | |
| *** zigo has quit IRC | 02:43 | |
| *** erlon has joined #openstack-keystone | 02:43 | |
| *** sudorandom has quit IRC | 02:43 | |
| *** ayoung has quit IRC | 02:44 | |
| *** ayoung has joined #openstack-keystone | 02:45 | |
| *** ChanServ sets mode: +v ayoung | 02:45 | |
| *** sudorandom has joined #openstack-keystone | 02:46 | |
| *** zigo has joined #openstack-keystone | 02:48 | |
| *** jraim has joined #openstack-keystone | 02:49 | |
| *** edmondsw has joined #openstack-keystone | 02:53 | |
| *** david-lyle has quit IRC | 02:55 | |
| *** edmondsw has quit IRC | 02:57 | |
| *** chris_hultin has quit IRC | 02:58 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Add python-memcached to requirements https://review.openstack.org/285315 | 03:03 |
|---|---|---|
| *** dtroyer has quit IRC | 03:03 | |
| *** esp has joined #openstack-keystone | 03:06 | |
| *** dtroyer has joined #openstack-keystone | 03:06 | |
| *** chris_hultin|AWA has joined #openstack-keystone | 03:06 | |
| *** chris_hultin|AWA is now known as chris_hultin | 03:07 | |
| *** nkinder has joined #openstack-keystone | 03:12 | |
| *** esp has quit IRC | 03:12 | |
| *** sudorandom has quit IRC | 03:16 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Add python-memcached to requirements https://review.openstack.org/285315 | 03:17 |
| *** sudorandom has joined #openstack-keystone | 03:19 | |
| *** Guest86619 is now known as melwitt | 03:27 | |
| *** jdennis has quit IRC | 03:29 | |
| *** nkinder has quit IRC | 03:49 | |
| *** jdennis has joined #openstack-keystone | 03:54 | |
| *** guoshan has quit IRC | 03:58 | |
| *** nkinder has joined #openstack-keystone | 04:01 | |
| *** links has joined #openstack-keystone | 04:02 | |
| *** sheel has joined #openstack-keystone | 04:11 | |
| *** dikonoor has joined #openstack-keystone | 04:20 | |
| *** dave-mccowan has quit IRC | 04:28 | |
| *** udesale has joined #openstack-keystone | 04:29 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Set connection timeout for LDAP configuration https://review.openstack.org/390948 | 05:03 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add anonymous bind to get_connection method https://review.openstack.org/407561 | 05:03 |
| stevemar | crinkle_: o/ | 05:04 |
| stevemar | crinkle_: let me know if https://review.openstack.org/#/c/390948/ is any better | 05:04 |
| *** edtubill has joined #openstack-keystone | 05:05 | |
| *** adriant has quit IRC | 05:12 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: listing revoke events should be admin only https://review.openstack.org/416841 | 05:19 |
| *** teju has joined #openstack-keystone | 05:24 | |
| stevemar | triaged a bug: https://bugs.launchpad.net/keystoneauth/+bug/1654847 pretty simple fix, but will need tests | 05:33 |
| openstack | Launchpad bug 1654847 in keystoneauth "Full service token is shown in logs" [Critical,Triaged] | 05:33 |
| *** thorst has joined #openstack-keystone | 05:38 | |
| *** phalmos has quit IRC | 05:39 | |
| *** adrian_otto has joined #openstack-keystone | 05:40 | |
| *** thorst has quit IRC | 05:43 | |
| *** adrian_otto has quit IRC | 05:53 | |
| *** itisha has quit IRC | 06:22 | |
| *** stingaci has joined #openstack-keystone | 06:27 | |
| *** stingaci has quit IRC | 06:31 | |
| *** jvarlamova has joined #openstack-keystone | 06:34 | |
| *** hoonetorg has quit IRC | 06:38 | |
| *** edtubill has quit IRC | 06:39 | |
| *** richm has quit IRC | 06:41 | |
| *** stingaci has joined #openstack-keystone | 06:42 | |
| *** stingaci has quit IRC | 06:45 | |
| *** rcernin has joined #openstack-keystone | 07:08 | |
| *** tesseract has joined #openstack-keystone | 07:12 | |
| openstackgerrit | Tin Lam proposed openstack/keystoneauth: X-Serivce-Token should be hashed in the log https://review.openstack.org/417765 | 07:16 |
| *** voelzmo has joined #openstack-keystone | 07:24 | |
| *** voelzmo has quit IRC | 07:29 | |
| *** voelzmo has joined #openstack-keystone | 07:38 | |
| *** thorst has joined #openstack-keystone | 07:39 | |
| *** pcaruana has joined #openstack-keystone | 07:41 | |
| *** thorst has quit IRC | 07:43 | |
| *** namnh has joined #openstack-keystone | 07:59 | |
| *** thorst has joined #openstack-keystone | 08:00 | |
| *** namnh has quit IRC | 08:00 | |
| *** namnh has joined #openstack-keystone | 08:00 | |
| *** pepperingranivor has joined #openstack-keystone | 08:03 | |
| *** d0ugal_ has quit IRC | 08:03 | |
| *** d0ugal has joined #openstack-keystone | 08:03 | |
| *** d0ugal has quit IRC | 08:03 | |
| *** d0ugal has joined #openstack-keystone | 08:03 | |
| *** thorst has quit IRC | 08:04 | |
| *** hoonetorg has joined #openstack-keystone | 08:07 | |
| *** pepperingranivor has quit IRC | 08:10 | |
| *** pepperingranivor has joined #openstack-keystone | 08:15 | |
| *** openstackgerrit has quit IRC | 08:18 | |
| *** hoonetorg has quit IRC | 08:25 | |
| *** openstackgerrit has joined #openstack-keystone | 08:35 | |
| openstackgerrit | Julia Varlamova proposed openstack/keystone: Change DevStack plugin to setup multi-Keystone https://review.openstack.org/399472 | 08:35 |
| *** agrebennikov has joined #openstack-keystone | 08:37 | |
| openstackgerrit | Julia Varlamova proposed openstack/keystone: Change DevStack plugin to setup multi-Keystone https://review.openstack.org/399472 | 08:40 |
| *** agrebennikov has quit IRC | 08:42 | |
| *** flaper87 has joined #openstack-keystone | 08:55 | |
| *** flaper87 has joined #openstack-keystone | 08:55 | |
| *** rha has joined #openstack-keystone | 08:59 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:00 | |
| *** jrist has quit IRC | 09:30 | |
| *** jrist has joined #openstack-keystone | 09:42 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 09:44 | |
| *** jrist has quit IRC | 09:59 | |
| *** thorst has joined #openstack-keystone | 10:00 | |
| *** thorst has quit IRC | 10:07 | |
| *** jrist has joined #openstack-keystone | 10:13 | |
| *** mvk has joined #openstack-keystone | 10:20 | |
| *** namnh has quit IRC | 10:24 | |
| *** jerrygb has joined #openstack-keystone | 10:26 | |
| *** liujiong has quit IRC | 10:39 | |
| *** asettle has joined #openstack-keystone | 10:41 | |
| *** hyakuhei has quit IRC | 10:49 | |
| *** hyakuhei has joined #openstack-keystone | 10:49 | |
| *** hyakuhei has quit IRC | 10:49 | |
| *** hyakuhei has joined #openstack-keystone | 10:49 | |
| *** udesale has quit IRC | 10:58 | |
| *** nicolasbock has joined #openstack-keystone | 11:04 | |
| *** richm has joined #openstack-keystone | 11:11 | |
| *** nicolasbock has quit IRC | 11:11 | |
| *** jerrygb_ has joined #openstack-keystone | 11:18 | |
| *** jerrygb has quit IRC | 11:21 | |
| *** nicolasbock has joined #openstack-keystone | 11:23 | |
| *** aloga has quit IRC | 11:41 | |
| *** aloga has joined #openstack-keystone | 11:41 | |
| *** jerrygb_ has quit IRC | 12:07 | |
| *** dikonoo has joined #openstack-keystone | 12:09 | |
| *** teju has quit IRC | 12:09 | |
| *** jerrygb has joined #openstack-keystone | 12:14 | |
| *** jerrygb has quit IRC | 12:20 | |
| *** thorst has joined #openstack-keystone | 12:24 | |
| *** thorst has joined #openstack-keystone | 12:25 | |
| *** nklenke has joined #openstack-keystone | 12:39 | |
| *** catintheroof has joined #openstack-keystone | 12:42 | |
| *** jerrygb has joined #openstack-keystone | 12:49 | |
| *** edtubill has joined #openstack-keystone | 12:54 | |
| *** jerrygb_ has joined #openstack-keystone | 13:07 | |
| *** jerrygb has quit IRC | 13:08 | |
| *** nklenke has quit IRC | 13:09 | |
| *** jerrygb has joined #openstack-keystone | 13:10 | |
| *** nklenke has joined #openstack-keystone | 13:11 | |
| *** jerrygb_ has quit IRC | 13:12 | |
| *** jerrygb_ has joined #openstack-keystone | 13:12 | |
| *** pepperingranivor has quit IRC | 13:13 | |
| *** jerrygb has quit IRC | 13:15 | |
| *** lamt has quit IRC | 13:19 | |
| *** jerrygb_ has quit IRC | 13:24 | |
| *** edmondsw has joined #openstack-keystone | 13:25 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Remove comment from previous migration https://review.openstack.org/417455 | 13:26 |
| *** pepperingranivor has joined #openstack-keystone | 13:30 | |
| *** asettle has quit IRC | 13:35 | |
| *** asettle has joined #openstack-keystone | 13:36 | |
| *** jamielennox is now known as jamielennox|away | 13:39 | |
| *** edtubill has quit IRC | 13:41 | |
| *** thorst has quit IRC | 13:45 | |
| *** thorst has joined #openstack-keystone | 13:46 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Cascade delete federated_user fk https://review.openstack.org/415906 | 13:46 |
| *** thorst has quit IRC | 13:50 | |
| *** knikolla has joined #openstack-keystone | 14:00 | |
| *** jerrygb has joined #openstack-keystone | 14:01 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Cascade delete federated_user fk https://review.openstack.org/415906 | 14:02 |
| *** thorst has joined #openstack-keystone | 14:05 | |
| *** aleph1 is now known as agarner | 14:18 | |
| *** lbragstad_ is now known as lbragstad | 14:19 | |
| *** jerrygb has quit IRC | 14:22 | |
| *** jerrygb has joined #openstack-keystone | 14:22 | |
| *** jerrygb has quit IRC | 14:23 | |
| *** jaosorior has joined #openstack-keystone | 14:23 | |
| *** dikonoo has quit IRC | 14:27 | |
| *** jaosorior has quit IRC | 14:31 | |
| *** dikonoor has quit IRC | 14:33 | |
| *** dave-mccowan has joined #openstack-keystone | 14:34 | |
| *** jerrygb has joined #openstack-keystone | 14:35 | |
| *** jaosorior has joined #openstack-keystone | 14:35 | |
| *** jerrygb_ has joined #openstack-keystone | 14:41 | |
| *** jerrygb has quit IRC | 14:43 | |
| knikolla | o/ | 14:47 |
| knikolla | back from vacations | 14:47 |
| *** edtubill has joined #openstack-keystone | 14:48 | |
| *** links has quit IRC | 14:50 | |
| *** lamt has joined #openstack-keystone | 14:56 | |
| *** mvk has quit IRC | 15:03 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: [api-ref] Clean up OS-EP-FILTER association docs https://review.openstack.org/417533 | 15:09 |
| lbragstad | knikolla o/ hopefully it was relaxing | 15:09 |
| lbragstad | stevemar gagehugo thanks for the doc reviews & | 15:09 |
| lbragstad | s/&/^/ | 15:09 |
| *** jerrygb has joined #openstack-keystone | 15:11 | |
| *** jerrygb_ has quit IRC | 15:13 | |
| stevemar | lbragstad: np! | 15:15 |
| *** jerrygb has quit IRC | 15:15 | |
| *** mvk has joined #openstack-keystone | 15:18 | |
| *** jerrygb has joined #openstack-keystone | 15:23 | |
| *** markvoelker has joined #openstack-keystone | 15:24 | |
| *** aloga has quit IRC | 15:24 | |
| *** aloga has joined #openstack-keystone | 15:24 | |
| *** knikolla has quit IRC | 15:29 | |
| *** asettle has quit IRC | 15:29 | |
| *** knikolla has joined #openstack-keystone | 15:30 | |
| *** asettle has joined #openstack-keystone | 15:30 | |
| *** phalmos has joined #openstack-keystone | 15:37 | |
| *** jistr is now known as jistr|biab | 15:40 | |
| *** jistr|biab is now known as jistr | 15:43 | |
| ayoung | stevemar, so, the change to add is_admin_project to Keystone falls down on Tempest testing. | 15:43 |
| ayoung | SAme kind of problem we saw with Nova, I think; | 15:44 |
| *** jaugustine has joined #openstack-keystone | 15:44 | |
| *** mvk has quit IRC | 15:44 | |
| *** d0ugal has quit IRC | 15:44 | |
| *** d0ugal has joined #openstack-keystone | 15:44 | |
| *** d0ugal has quit IRC | 15:44 | |
| *** d0ugal has joined #openstack-keystone | 15:44 | |
| *** d0ugal has quit IRC | 15:44 | |
| *** markvoelker has quit IRC | 15:44 | |
| *** d0ugal has joined #openstack-keystone | 15:45 | |
| *** d0ugal has quit IRC | 15:45 | |
| *** d0ugal has joined #openstack-keystone | 15:45 | |
| *** jerrygb has quit IRC | 15:46 | |
| openstackgerrit | Tin Lam proposed openstack/keystone: Updated docstring for test_sql_upgrade.py https://review.openstack.org/417647 | 15:47 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: listing revoke events should be admin only https://review.openstack.org/416841 | 15:47 |
| *** jaosorior has quit IRC | 15:47 | |
| *** jerrygb has joined #openstack-keystone | 15:48 | |
| *** phalmos has quit IRC | 15:49 | |
| *** jerrygb has quit IRC | 15:51 | |
| *** ChanServ sets mode: +v lbragstad | 15:53 | |
| *** ravelar has joined #openstack-keystone | 16:04 | |
| *** voelzmo has quit IRC | 16:05 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: X-Serivce-Token should be hashed in the log https://review.openstack.org/417765 | 16:08 |
| stevemar | jamielennox|away: lbragstad ayoung anyone else want to look at https://review.openstack.org/#/c/417765/2 | 16:09 |
| stevemar | lamt: thanks for the fix! | 16:09 |
| lamt | stevemar : np | 16:10 |
| ayoung | stevemar, sure | 16:10 |
| *** phalmos has joined #openstack-keystone | 16:10 | |
| stevemar | lamt: gonna do the ksc fix? hehe ;) | 16:10 |
| lamt | I got used to typing in slack - those ` vs ``. :( | 16:10 |
| ayoung | stevemar, +2...did not +A cuz it was kindof quick...do you think the testing is sufficient? | 16:11 |
| stevemar | ah thats where its from | 16:11 |
| lamt | stevemar : sure - I can make the change in ksc too | 16:11 |
| stevemar | ayoung: its a common function used by all our headers, but thats OK, i wanted mattR to look at it too | 16:11 |
| ayoung | stevemar, the test looks like it is sufficient to me: | 16:12 |
| ayoung | for k, v in security_headers.items(): | 16:12 |
| ayoung | self.assertIn('%s: {SHA1}' % k, self.logger.output) | 16:12 |
| stevemar | ayoung: it should be fine, same thing we do with x-auth-token | 16:12 |
| ayoung | stevemar, I'd be very OK with it as is | 16:12 |
| *** iurygregory has joined #openstack-keystone | 16:13 | |
| *** diazjf has joined #openstack-keystone | 16:16 | |
| *** AlexeyAbashkin has quit IRC | 16:16 | |
| stevemar | ayoung: i'll own it and push the button | 16:16 |
| ayoung | stevemar, ++ | 16:16 |
| stevemar | ayoung: expect me to bug you in 2 minutes once lamt pushes the same fix for ksc ;) | 16:17 |
| ayoung | stevemar, Sounds good | 16:17 |
| openstackgerrit | Ian Cordasco proposed openstack/keystone: Use public interfaces of pep8 for hacking https://review.openstack.org/416830 | 16:20 |
| stevemar | sigmavirus: oh i'm wondering what you cooked up | 16:21 |
| sigmavirus | stevemar: I aim to disappoint | 16:21 |
| sigmavirus | I think that'll be enough to satisfy Adam | 16:22 |
| sigmavirus | Other things will come at a later date =P | 16:22 |
| *** adrian_otto has joined #openstack-keystone | 16:22 | |
| stevemar | sigmavirus: interesting, i would have thought trying to import 'pycodestyle' would be a no-no? since it's not in globalreq? | 16:23 |
| sigmavirus | stevemar: I'm not so certain about that | 16:24 |
| sigmavirus | But having it there provides better reasoning for including it g-r | 16:24 |
| stevemar | sigmavirus: this is why i'm not reqs core! | 16:24 |
| stevemar | hehe | 16:24 |
| sigmavirus | me either | 16:24 |
| sigmavirus | =P | 16:24 |
| stevemar | o_O | 16:24 |
| stevemar | i thought you were | 16:24 |
| *** phalmos has quit IRC | 16:24 | |
| sigmavirus | I dodged that bullet | 16:24 |
| stevemar | they should really make you do that | 16:24 |
| stevemar | hehe | 16:24 |
| stevemar | ok ok | 16:24 |
| stevemar | select='K' -- will load all the keystone hacks, i assume? since they are all of the form Kxyz | 16:25 |
| sigmavirus | stevemar: correct | 16:25 |
| stevemar | neat | 16:25 |
| sigmavirus | I'm not sure there's a better way to do each one individually though | 16:25 |
| stevemar | i may just add a comment in the code that says that | 16:26 |
| sigmavirus | as usual, openstack tests with fixtures can be wonderfully indirect | 16:26 |
| sigmavirus | gopher it | 16:26 |
| stevemar | "Load all keystone hacking checks, they are of the form Kddd, where ddd can from range from 000-999" | 16:27 |
| stevemar | sigmavirus: that sound about right? | 16:27 |
| sigmavirus | yes | 16:28 |
| sigmavirus | Also pep8/flake8 allow for you to specify a prefix and anything matching that prefix is selected/ignored | 16:28 |
| sigmavirus | Adam read too much pycodestyle source code without knowing very much python and got very confused with how that's implemented | 16:29 |
| stevemar | ah | 16:29 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use public interfaces of pep8 for hacking https://review.openstack.org/416830 | 16:30 |
| stevemar | sigmavirus: just added comments | 16:30 |
| stevemar | dstanek: ^ it's all teed up for you big guy | 16:30 |
| sigmavirus | dstanek: shoot for the moon, hit the stars | 16:31 |
| *** markvoelker has joined #openstack-keystone | 16:32 | |
| openstackgerrit | Tin Lam proposed openstack/python-keystoneclient: X-Serivce-Token should be hashed in the log https://review.openstack.org/417960 | 16:32 |
| *** Guest59792 is now known as redrobot | 16:36 | |
| *** pcaruana has quit IRC | 16:38 | |
| *** rcernin has quit IRC | 16:38 | |
| *** jaosorior has joined #openstack-keystone | 16:41 | |
| *** jaosorior has quit IRC | 16:42 | |
| *** jaosorior has joined #openstack-keystone | 16:43 | |
| stevemar | yay thanks lamt! ayoung or anyone else ^ | 16:43 |
| ayoung | stevemar, +2 | 16:44 |
| ayoung | did not A | 16:44 |
| *** david-lyle has joined #openstack-keystone | 16:57 | |
| *** tesseract has quit IRC | 16:59 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Adds projects mapping to the mapping engine https://review.openstack.org/410949 | 17:03 |
| lbragstad | dstanek that should address our comments ^ | 17:03 |
| *** edmondsw has quit IRC | 17:04 | |
| *** edmondsw has joined #openstack-keystone | 17:05 | |
| *** jaugustine_ has joined #openstack-keystone | 17:13 | |
| *** asettle has quit IRC | 17:14 | |
| openstackgerrit | Tin Lam proposed openstack/keystone: Updated docstring for test_sql_upgrade.py https://review.openstack.org/417647 | 17:22 |
| dstanek | stevemar: nice | 17:26 |
| dstanek | lbragstad: cool, i'll take a look | 17:26 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Adds projects mapping to the mapping engine https://review.openstack.org/410949 | 17:28 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement shadow mapping https://review.openstack.org/415895 | 17:28 |
| *** guoshan has joined #openstack-keystone | 17:29 | |
| *** jaugustine_ has quit IRC | 17:32 | |
| *** guoshan has quit IRC | 17:33 | |
| *** diazjf has quit IRC | 17:35 | |
| *** esp has joined #openstack-keystone | 17:39 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: listing revoke events should be admin only https://review.openstack.org/416841 | 17:40 |
| *** mvk has joined #openstack-keystone | 17:42 | |
| stevemar | dstanek: zuul is happy for 416830, shall i push it through? | 17:42 |
| *** hoonetorg has joined #openstack-keystone | 17:44 | |
| *** browne has joined #openstack-keystone | 17:46 | |
| *** Guest96631 is now known as mgagne | 17:51 | |
| *** mgagne has quit IRC | 17:51 | |
| *** mgagne has joined #openstack-keystone | 17:51 | |
| *** esp has quit IRC | 17:56 | |
| *** itisha has joined #openstack-keystone | 17:58 | |
| *** esp has joined #openstack-keystone | 18:02 | |
| *** diazjf has joined #openstack-keystone | 18:05 | |
| *** woodster_ has joined #openstack-keystone | 18:06 | |
| *** spzala has joined #openstack-keystone | 18:08 | |
| knikolla | ayoung: heard that you might be mentoring a course project | 18:11 |
| ayoung | knikolla, yes I am. Submitted the description last week to Ata Turk | 18:11 |
| ayoung | knikolla, its the RBAC stuff I've been championing. | 18:11 |
| ayoung | http://specs.openstack.org/openstack/keystone-specs/specs/keystone/ongoing/role-check-from-middleware.html | 18:11 |
| *** chris_hultin is now known as chris_hultin|AWA | 18:12 | |
| knikolla | ayoung: great! | 18:13 |
| ayoung | knikolla, waiting to hear who the students are that are going to be taking part | 18:13 |
| knikolla | ayoung: you think one semester is enough to get the RBAC merged? | 18:15 |
| knikolla | will be cool to have the students get free tickets to the Boston summit also | 18:15 |
| ayoung | knikolla, I think it is enough to get an end-to-end POC written | 18:15 |
| ayoung | probably too late for Boston | 18:16 |
| openstackgerrit | Eric Brown proposed openstack/oslo.policy: Remove references to Python 3.4 https://review.openstack.org/418006 | 18:17 |
| ayoung | knikolla, I'll see what we can do to get people in, but the talk is already submitted...hard to add speakers when I don't even know who is working on it. I wonder if there are studend passes? | 18:17 |
| dstanek | stevemar: i don't see why not | 18:18 |
| *** gyee has joined #openstack-keystone | 18:24 | |
| *** jaugustine_ has joined #openstack-keystone | 18:28 | |
| *** diazjf has quit IRC | 18:29 | |
| *** guoshan has joined #openstack-keystone | 18:30 | |
| *** thorst has quit IRC | 18:30 | |
| knikolla | ayoung: i know there's an academic discount, but it doesn't reduce the price to free. | 18:30 |
| *** thorst has joined #openstack-keystone | 18:31 | |
| *** harlowja_ has joined #openstack-keystone | 18:31 | |
| *** harlowja has quit IRC | 18:31 | |
| ayoung | knikolla, Is the CFP still open? I'm willing to add people to the talk proposal if it makes sense. | 18:31 |
| ayoung | The is bnot ATC for the summit this time around, thouhg | 18:32 |
| *** jaugustine_ has quit IRC | 18:32 | |
| knikolla | ayoung: deadline for presentations is feb 6 | 18:33 |
| *** guoshan has quit IRC | 18:34 | |
| knikolla | ayoung: oh, i see. so even if students get code in they won't get a code :/ | 18:34 |
| ayoung | knikolla, ++ you going to work on the project, or just aware that it is happening? Its for Okreig's class | 18:34 |
| *** jaugustine_ has joined #openstack-keystone | 18:35 | |
| ayoung | knikolla, right, not for BOS, but they would for the next PTG | 18:35 |
| *** thorst has quit IRC | 18:35 | |
| knikolla | ayoung: i thought of mentoring a project where they implemented some spec in keystone, which is what you ended up doing. i dropped it for lack of spec ideas and time to write the proposal. | 18:35 |
| ayoung | knikolla, join me! | 18:36 |
| knikolla | ayoung: if you need some help mentoring though, i'm available. | 18:36 |
| ayoung | knikolla, I'll tell Ata Turk | 18:36 |
| knikolla | ayoung: great! | 18:36 |
| *** erlon is now known as erlon_pto | 18:39 | |
| ayoung | knikolla, done | 18:39 |
| *** chris_hultin|AWA is now known as chris_hultin | 18:46 | |
| ayoung | SamYaple, you have an idea how to do Fernet Key management in a containerd world? | 18:49 |
| *** thorst has joined #openstack-keystone | 18:49 | |
| ayoung | SamYaple, no pressure, but since you asked me about it before, thought you might know better than I how to make a docker image useful when we need secure symmetric keys for Fernet | 18:49 |
| SamYaple | production vs testing is the question. in production there needs to be a way to sync these keys around (or host the keys outside the container and sync with rsync/cronjob) | 18:50 |
| SamYaple | testing is simple, just generate them when you initial start up | 18:50 |
| ayoung | SamYaple, right...so the problem is if we pre-can keys for development, people end up using those keys in production, and hackery ensues | 18:50 |
| SamYaple | well pre-can is the wrong term | 18:50 |
| SamYaple | your entrypoint/startup script would generate them on first start | 18:50 |
| ayoung | SamYaple, Ah, so it is OK if the container writes to /etc/keystone/<subdir>? | 18:51 |
| SamYaple | inside the container itself, yes | 18:51 |
| SamYaple | but those wont exist on the host | 18:51 |
| ayoung | SamYaple, that is OK | 18:51 |
| *** tqtran has joined #openstack-keystone | 18:51 | |
| ayoung | so long as a development deployment can kick it off... | 18:51 |
| SamYaple | then a simple AIO, non-production keystone fernet deploy is easy | 18:51 |
| SamYaple | in the docker world it would get extended by other images to provide more robust config and key management using 'FROM <soruce image>' | 18:52 |
| ayoung | SamYaple, koolio. I'll let you get back to work. We can discuss when/if I get to that stage | 18:52 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Add domain_id to the user table https://review.openstack.org/409874 | 18:52 |
| SamYaple | so <source image> would be enough to do a simple AIO with reasonable default, and prod tools would need to extend that, if it makes sense | 18:52 |
| SamYaple | ayoung: while ive got you, someone just pinged me and asked me about 2FA with keystone, is there a page with most up-to-date info on that? (if its implemented which I dont know) | 18:54 |
| *** jaugustine_ has quit IRC | 19:02 | |
| *** jaugustine_ has joined #openstack-keystone | 19:03 | |
| *** jaugustine_ has quit IRC | 19:07 | |
| *** jaugustine_ has joined #openstack-keystone | 19:08 | |
| openstackgerrit | Merged openstack/python-keystoneclient: X-Serivce-Token should be hashed in the log https://review.openstack.org/417960 | 19:11 |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: Add password expiration queries for PCI-DSS https://review.openstack.org/403898 | 19:11 |
| *** jaugustine_ has quit IRC | 19:12 | |
| ayoung | SamYaple, someone else here is working on it. morgan was reviewing, and fairly critical last we talked. It is supposed to get into Ocata. stevemar ? | 19:13 |
| stevemar | SamYaple: what ayoung said; we had a design for pike from adriant, but morgan basically -2'ed it and proposed a redesign. it did not make Ocata. we still have some runway but i'm not optimistic | 19:15 |
| *** rcernin has joined #openstack-keystone | 19:15 | |
| morgan | ayoung: ? | 19:16 |
| morgan | reading up | 19:16 |
| morgan | stevemar, SamYaple: yes i am working on it, but i have a higher priority thing i must hit for shade | 19:17 |
| *** phalmos has joined #openstack-keystone | 19:17 | |
| morgan | as soon as i address this context manager I'll be back on it. | 19:17 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: listing revoke events should be admin only https://review.openstack.org/416841 | 19:19 |
| *** edmondsw_ has joined #openstack-keystone | 19:20 | |
| stevemar | morgan: you had that context manager thing for ksa cooking, you still want it in? | 19:20 |
| morgan | stevemar: yeah. need to bug mordred for the exmaple | 19:21 |
| morgan | make sure it in-face works. | 19:21 |
| *** edmondsw has quit IRC | 19:22 | |
| tqtran | hello, quick question. if i have multi-domain on, and i authenticate into one of those domain and ask for a list of projects. i get a list of projects only for that domain right? | 19:22 |
| *** phalmos has quit IRC | 19:22 | |
| SamYaple | thanks for the info ayoung stevemar and morgan | 19:25 |
| tqtran | david-lyle, stevemar ^---- | 19:27 |
| *** diazjf has joined #openstack-keystone | 19:28 | |
| stevemar | tqtran: depends on which API you call | 19:28 |
| *** david-lyle has quit IRC | 19:28 | |
| stevemar | tqtran: we have a call /auth/projects that lists which projects *you* can access | 19:28 |
| stevemar | tqtran: theres another API, /projects which lists ALL projects everywhere | 19:29 |
| lbragstad | dstanek about the shadow mapping stuff we were talking about earlier | 19:29 |
| lbragstad | dstanek when we create or update a mapping, do we expect the validation of the project object in the mapping to ensure the roles for the project exist, too? | 19:29 |
| stevemar | if you want, you can call /projects with a query parameter, /projects&domain_id=your_domain_id to filter by domain | 19:29 |
| tqtran | stevemar: https://github.com/openstack/django_openstack_auth/blob/master/openstack_auth/utils.py#L354 | 19:31 |
| tqtran | im looking specifically at that method | 19:31 |
| tqtran | seems like you only get back list of projects within that domain? wanted to verify first. | 19:31 |
| openstackgerrit | Merged openstack/keystone: Remove comment from previous migration https://review.openstack.org/417455 | 19:33 |
| stevemar | tqtran: seems like you get back ALL projects if running keystone 2; and you get the projects *you* have authorization for in the 3rd case | 19:34 |
| tqtran | ah ok, thanks for clarification | 19:35 |
| *** jaugustine_ has joined #openstack-keystone | 19:35 | |
| tqtran | stevemar: https://review.openstack.org/#/c/417221/ is the reason why im asking | 19:36 |
| stevemar | dolphm ayoung dstanek bknudson jamielennox|away samueldmq rodrigods lbragstad morgan i'm releasing libs this week and probably next week again (in case there is fall out or we want another bug fix in) | 19:37 |
| lbragstad | stevemar awesome - anything you need help with? | 19:37 |
| lbragstad | stevemar or just a friendly heads up>? | 19:37 |
| bknudson | nice. | 19:37 |
| stevemar | friendly heads up | 19:37 |
| lbragstad | omg... a bknudson | 19:37 |
| stevemar | lbragstad: oh damN!! | 19:38 |
| stevemar | bknudson: we've missed you | 19:38 |
| lbragstad | ++ | 19:38 |
| bknudson | I'll get back to it someday | 19:39 |
| rodrigods | cool | 19:40 |
| samueldmq | stevemar: kk I'll take a better look at library bugs, thanks | 19:45 |
| *** phalmos has joined #openstack-keystone | 19:47 | |
| *** diazjf has quit IRC | 19:49 | |
| *** pcaruana has joined #openstack-keystone | 19:50 | |
| knikolla | anybody has a moment to help me understand some things about federation mappings? | 19:59 |
| *** diazjf has joined #openstack-keystone | 20:02 | |
| samueldmq | stevemar: https://review.openstack.org/#/c/418074/1/keystone_tempest_plugin/tests/api/identity/base.py | 20:03 |
| dstanek | stevemar: sounds good | 20:03 |
| dstanek | knikolla: what's the question? | 20:03 |
| samueldmq | stevemar: why is it needed to add self.auth_client ? | 20:03 |
| stevemar | samueldmq: *shrug* it was in master | 20:03 |
| knikolla | dstanek: i'm trying to map a remote user, to a local user with the same name on the default domain. | 20:04 |
| knikolla | dstanek: this is my attempt at the mappings http://paste.openstack.org/show/3OsxhggEHYTsLz5Ifgg4/ | 20:04 |
| knikolla | expected output: maps to already existing user with same name and on the default domain. | 20:05 |
| *** voelzmo has joined #openstack-keystone | 20:05 | |
| samueldmq | stevemar: it was already present in master, not related to that fix | 20:05 |
| samueldmq | stevemar: not sure it is necessary | 20:05 |
| stevemar | samueldmq: *shrug* you can remove it | 20:05 |
| knikolla | actual output: gets mapped to user with same name, no domain, and for whatever reason, admin role :/ | 20:05 |
| knikolla | and the blacklist is ignored. | 20:06 |
| *** phalmos has quit IRC | 20:06 | |
| *** phalmos has joined #openstack-keystone | 20:06 | |
| dstanek | knikolla: domain doesn't work well yet with mappings. i don't actually know if it works at all without the work currently going on | 20:06 |
| samueldmq | stevemar: done ,thanks | 20:07 |
| dstanek | knikolla: can you post you mapping though? | 20:07 |
| knikolla | dstanek: i linked to it above, but here's it again http://paste.openstack.org/show/3OsxhggEHYTsLz5Ifgg4/ | 20:07 |
| dstanek | knikolla: oops missed it. my client has terrible link color and no underline. i messed up my theme over the weekend :-( | 20:08 |
| knikolla | dstanek: no worries | 20:08 |
| dstanek | knikolla: does you use have the admin role via assignments? | 20:08 |
| knikolla | dstanek: no. and actually, i've blacklisted the username admin and it still goes through when i do k2k with the admin user :/ | 20:11 |
| knikolla | this is in two newton devstacks. | 20:12 |
| knikolla | dstanek: with that mapping, it mapped me to the local nova user :/ i'm utterly confused | 20:13 |
| knikolla | but that explains the admin permissions | 20:13 |
| dstanek | knikolla: can you see that values from the environment that are being passed into the mapper? | 20:14 |
| knikolla | dstanek: how do i do that? | 20:15 |
| *** phalmos has quit IRC | 20:15 | |
| dstanek | knikolla: the environment should be logged. maybe in debug mode | 20:15 |
| *** bknudson has left #openstack-keystone | 20:16 | |
| *** phalmos has joined #openstack-keystone | 20:16 | |
| knikolla | dstanek: wait, my bad. it didn't map me to the 'nova' user. was looking at the wrong json. It mapped me to a user it created automatically, named "[]", with domain None. Checking the role assignments on its user id returned nothing. | 20:18 |
| knikolla | yet somehow its able to scope to admin and do a user list | 20:19 |
| dstanek | knikolla: that's really scarry | 20:20 |
| knikolla | dstanek: hopefully i'm doing something wrong. | 20:20 |
| dstanek | knikolla: if you turn on debugging you should be able to see into what the mapper is doing | 20:21 |
| knikolla | dstanek: here's the logs http://paste.openstack.org/show/eW6ng4S18oggNB4VkYnY/ | 20:26 |
| *** bknudson has joined #openstack-keystone | 20:26 | |
| *** ChanServ sets mode: +v bknudson | 20:26 | |
| rderose | knikolla: (ron eavesdropping), so it looks like the user was given the default domain, right? | 20:28 |
| *** iurygregory has quit IRC | 20:28 | |
| rderose | knikolla: actually, with newton, you should be given the "Federated" domain | 20:29 |
| knikolla | rderose: the user is given the None domain. | 20:29 |
| rderose | knikolla: from the token? | 20:30 |
| rderose | knikolla: mapped_properties: {'group_ids': [], 'user': {u'domain': {'id': 'Federated'}, 'type': 'ephemeral', u'name': u'[]'}, 'group_names': []} | 20:30 |
| rderose | knikolla: that's from the log | 20:30 |
| knikolla | rderose: oh ok. i saw none from openstack user list, thats why. | 20:30 |
| knikolla | ubuntu@kristi-sp1:~$ openstack user show 333ce86480284ee0b4afc4c5298c790a | 20:30 |
| knikolla | +---------------------+----------------------------------+ | 20:30 |
| knikolla | | Field | Value | | 20:30 |
| knikolla | +---------------------+----------------------------------+ | 20:30 |
| knikolla | | domain_id | None | | 20:30 |
| knikolla | | enabled | True | | 20:30 |
| knikolla | | id | 333ce86480284ee0b4afc4c5298c790a | | 20:30 |
| knikolla | | name | [] | | 20:30 |
| knikolla | | password_expires_at | None | | 20:30 |
| knikolla | +---------------------+----------------------------------+ | 20:30 |
| rderose | knikolla: yes, that is correct | 20:31 |
| rderose | knikolla: in newton, when the federated user authenticates, they're giving the 'Federated' domain | 20:31 |
| rderose | knikolla: this is changing in ocata | 20:31 |
| rderose | knikolla: the name = [] is not correct though ;) | 20:32 |
| dstanek | knikolla: that's super strange that you get an empty list | 20:32 |
| knikolla | dstanek: its strange too. when i tried in the morning i would get the same name as the remote user. but still the same role problems and the federated domain. | 20:33 |
| rderose | knikolla dstanek: the mapping is expecting the name to be passed in "name": "{0}" | 20:33 |
| rderose | knikolla: what's the role problems? | 20:33 |
| knikolla | rderose: by role problems i mean, this user is somehow getting admin role. | 20:34 |
| knikolla | it's also strange that blacklist doesn't work | 20:35 |
| rderose | knikolla: this user "[]" has the admin role? | 20:35 |
| knikolla | rderose: yes | 20:35 |
| rderose | knikolla: hmm... have you tested other users, where you are seeing them being created? | 20:36 |
| rderose | knikolla: or, are all users getting this [] user? | 20:36 |
| *** david-lyle has joined #openstack-keystone | 20:37 | |
| knikolla | rderose: if i remove the blacklist condition, i get a user with the same name. | 20:37 |
| knikolla | rderose: if i include the blacklist condition, even if the username is in the blacklist, i get this [] user. | 20:38 |
| knikolla | in both ways, i'm able to scope to the admin project and do a user list. | 20:38 |
| *** voelzmo has quit IRC | 20:39 | |
| knikolla | (by removing blacklist i mean this: [(u'id', u'rules'), (u'keystone-idp-mapping', [{u'local': [{u'user': {u'domain': {u'id': u'default'}, u'name': u'{0}'}}], u'remote': [{u'type': u'openstack_user'}]}])] | 20:39 |
| rderose | knikolla dstanek: correct, if I'm wrong, but what this mapping is saying is, if a user comes in as openstack_user type, map them to the local user with the same name, right? | 20:39 |
| rderose | the rule is user is openstack_user type and not admin or demo (blacklist) | 20:40 |
| knikolla | rderose: right. i want to map as user to a same named local user. | 20:40 |
| knikolla | this through k2k | 20:41 |
| rderose | knikolla: so the local user would have to already be created | 20:41 |
| rderose | right? | 20:41 |
| knikolla | rderose: yes. | 20:41 |
| rderose | okay | 20:41 |
| rderose | hmm... | 20:41 |
| *** nklenke has quit IRC | 20:41 | |
| dstanek | in part sounds like a blacklist bug | 20:41 |
| rderose | knikolla: and I take the users' don't already have the admin role? | 20:44 |
| rderose | the condition when you remove the blacklist | 20:45 |
| knikolla | rderose: in this case, they were automatically created. and when i do openstack role assignment list —user <id> | 20:45 |
| knikolla | nothing is returned | 20:45 |
| *** jaugustine_ has quit IRC | 20:46 | |
| rderose | knikolla: ah, yeah is through shadow users... | 20:46 |
| rderose | knikolla: but I would think you would get the roles of the local user | 20:46 |
| dstanek | knikolla: all of your data looks good in that log | 20:47 |
| *** iurygregory has joined #openstack-keystone | 20:50 | |
| rderose | knikolla: so result of your mapping really is about the roles, you should have gotten a token with the roles for the local user. We create a shadow user for all federated users when they auth and they will automatically be in the 'Federated' domain. | 20:50 |
| rderose | knikolla: just don't want you to think that when a federated user authenticates, that the local user is returned. that is not how it works. | 20:51 |
| rderose | knikolla: when we create a shadow user, there will be an entry in the federated_user table | 20:54 |
| rderose | knikolla: and of course, the user table (user -> federated_user) (1:many) | 20:54 |
| *** r1chardj0n3s has quit IRC | 20:55 | |
| knikolla | rderose: thats ok for me. if i get a user in the federated domain with the permissions i need, that works too. | 20:56 |
| knikolla | rderose: what i'm actually trying to do is a bit more complicated, so this was an exercise to get myself acquainted with the mapping rules. but the results were utterly confusing for me. | 20:56 |
| rderose | knikolla: I see | 20:57 |
| rderose | knikolla: so when you remove the blacklist (taking that out of the equation for now), you are getting a user with the admin role | 20:57 |
| knikolla | rderose: yes | 20:58 |
| rderose | knikolla: and the local user, doesn't have an admin role | 20:58 |
| rderose | ? | 20:58 |
| knikolla | rderose: the local user no. | 20:58 |
| knikolla | rderose: as seen through "openstack role assignments" | 20:58 |
| *** catinthe_ has joined #openstack-keystone | 20:59 | |
| knikolla | and it doesn't seem to be getting that through any groups either. | 20:59 |
| *** catintheroof has quit IRC | 21:00 | |
| *** jamielennox|away is now known as jamielennox | 21:00 | |
| *** jaosorior has quit IRC | 21:03 | |
| rderose | knikolla: you mean 'openstack role list --user <your local user>' | 21:03 |
| *** jaosorior has joined #openstack-keystone | 21:03 | |
| rderose | I think that would include roles from groups | 21:03 |
| knikolla | rderose: role list —user is actually deprecated in favor of role assignment list | 21:04 |
| rderose | :) | 21:04 |
| knikolla | the output is the same from both though | 21:04 |
| rderose | okay | 21:05 |
| knikolla | brb in 10 minutes | 21:05 |
| *** jlk has quit IRC | 21:06 | |
| *** voelzmo has joined #openstack-keystone | 21:08 | |
| *** diazjf has quit IRC | 21:09 | |
| *** voelzmo has quit IRC | 21:12 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: listing revoke events should be admin only https://review.openstack.org/416841 | 21:12 |
| *** diazjf has joined #openstack-keystone | 21:14 | |
| knikolla | back | 21:14 |
| stevemar | well at least keystoneclient stable gates are fine | 21:14 |
| stevemar | keystoneauth and keystonemiddleware stable gates are broken | 21:14 |
| stevemar | keystone mitaka works, keystone newton is broken (patch is up) | 21:15 |
| *** voelzmo has joined #openstack-keystone | 21:19 | |
| *** diazjf has quit IRC | 21:20 | |
| *** voelzmo has quit IRC | 21:23 | |
| lbragstad | ravelar hybrid attribute documentation in case you haven't already stumbled across it - http://docs.sqlalchemy.org/en/latest/orm/extensions/hybrid.html# | 21:26 |
| *** jaugustine_ has joined #openstack-keystone | 21:28 | |
| rderose | knikolla dstanek: I'm not seeing where a federated user would get local user roles (if mapped to a local user): | 21:30 |
| stevemar | anyone know whats going on here: http://logs.openstack.org/87/418087/1/check/gate-keystoneauth-python27-ubuntu-xenial/05a93c0/console.html#_2017-01-09_20_09_13_026636 ? | 21:30 |
| rderose | knikolla dstanek: looks like roles only come from groups (I'm probably missing something...) | 21:30 |
| knikolla | rderose: so groups are required? | 21:32 |
| *** adriant has joined #openstack-keystone | 21:43 | |
| rderose | knikolla: just a sec | 21:44 |
| *** voelzmo has joined #openstack-keystone | 21:45 | |
| rderose | knikolla: I believe so | 21:46 |
| rderose | knikolla: from looking at the code, roles are coming from groups; not a local user | 21:47 |
| rderose | knikolla: doesn't explain how you are getting the admin role though | 21:47 |
| knikolla | rderose: either bug, or my mistake. | 21:49 |
| rderose | knikolla: yeah, I'll try to reproduce | 21:49 |
| knikolla | rderose: i can live with setting permissions through groups. i'll give that a try tomorrow. | 21:50 |
| rderose | knikolla: cool | 21:50 |
| *** voelzmo has quit IRC | 21:50 | |
| knikolla | rderose: what i'm trying to accomplish is some sort of "metaproject", where a user coming from projectX, is mapped to a user/group that has access on projectY only. | 21:51 |
| knikolla | making projectY an extension of projectX, but on a separate cloud. | 21:51 |
| *** jlk has joined #openstack-keystone | 21:51 | |
| *** jlk has quit IRC | 21:51 | |
| *** jlk has joined #openstack-keystone | 21:51 | |
| rderose | knikolla: that should totally be possible | 21:52 |
| rderose | knikolla: you would just map the user to a role that has access to projectY | 21:52 |
| openstackgerrit | Merged openstack/keystoneauth: X-Serivce-Token should be hashed in the log https://review.openstack.org/417765 | 21:52 |
| rderose | *map user to a group that has that role | 21:52 |
| rderose | knikolla: ^ | 21:52 |
| knikolla | rderose: yep, and get the project name through the openstack_project attribute. | 21:52 |
| knikolla | i'll have the project name be part of the username/group of the local user. | 21:53 |
| *** jaosorior has quit IRC | 21:53 | |
| rderose | knikolla: local user? | 21:53 |
| rderose | knikolla: if your federated users are mapped to group, you don't need existing local users | 21:54 |
| rderose | or local users created in advance | 21:54 |
| knikolla | rderose: right. true. | 21:54 |
| knikolla | rderose: i need to work on my federation terminology. | 21:54 |
| rderose | knikolla: me too :) | 21:55 |
| *** richm has quit IRC | 21:55 | |
| stevemar | jamielennox: around? | 21:56 |
| jamielennox | stevemar: meeting, give me 10 minutes | 21:56 |
| stevemar | jamielennox: okay, i'll leave you info here | 21:56 |
| stevemar | jamielennox: actually, i think i figured it out, i need to backport https://review.openstack.org/#/c/388945/1 | 21:57 |
| stevemar | jamielennox: the short is, stable/mitaka|newton are broken | 21:57 |
| stevemar | for keystoneauth | 21:57 |
| stevemar | dolphm & morgan i need one of you for stable +2'ing | 22:00 |
| dolphm | stevemar: o/ | 22:00 |
| stevemar | dolphm: okay, let me get a few links together | 22:01 |
| dolphm | stevemar: i can find them -- which repo should i focus on? | 22:02 |
| stevemar | dolphm: keystone: https://review.openstack.org/#/c/418074/ | 22:02 |
| stevemar | dolphm: keystoneauth needs https://review.openstack.org/#/q/I1e09228cff7a0c8136447f07df6864045a6fb849,n,z i think | 22:03 |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: Add password expiration queries for PCI-DSS https://review.openstack.org/403898 | 22:03 |
| stevemar | dolphm: as well as all these: https://review.openstack.org/#/q/status:open+topic:bug/1654847 | 22:03 |
| stevemar | dolphm: and these... https://review.openstack.org/#/q/status:open+topic:bug/1654847 | 22:03 |
| stevemar | err | 22:04 |
| stevemar | dolphm: wrong one: https://review.openstack.org/#/q/status:open+topic:bug/1616105 | 22:04 |
| stevemar | dolphm: last one: https://review.openstack.org/#/c/418118/ | 22:04 |
| stevemar | dolphm: or check all my open patches from today: https://review.openstack.org/#/q/owner:s.martinelli%2540gmail.com+status:open :P | 22:05 |
| dolphm | stevemar: lol k | 22:05 |
| stevemar | dolphm: considering none of them were authored by me, and our lack of stable cores, i'll be +A'ing them | 22:06 |
| jamielennox | stevemar: whoa - what's happenign | 22:08 |
| stevemar | dolphm: the only catch is keystoneauth is borked but i backported the patch that should fix it | 22:09 |
| stevemar | jamielennox: whats up? | 22:09 |
| stevemar | jamielennox: just backporting fixes, getting ready to wrap up the release | 22:09 |
| jamielennox | stevemar: i remember that patch, i'm surprised it broke gate though | 22:09 |
| jamielennox | i don't think i fixed it because of an actual failure | 22:10 |
| stevemar | jamielennox: in the comment it says "fixing ci failure" | 22:10 |
| *** adrian_otto has quit IRC | 22:10 | |
| stevemar | jamielennox: i approved https://review.openstack.org/#/c/417960/ btw, it was a new patch for ksa | 22:10 |
| jamielennox | stevemar: alrighty then | 22:10 |
| jamielennox | stevemar: i saw that one and would have +Aed | 22:11 |
| stevemar | yay | 22:11 |
| stevemar | i didn't mess up | 22:11 |
| jamielennox | the only thing maybe was to look for X-*-Token and blank that | 22:11 |
| jamielennox | which is what i did for that oslo_middleware catcherrors thing | 22:11 |
| jamielennox | ... that still doesn't appear to be merged | 22:11 |
| *** rcernin has quit IRC | 22:12 | |
| stevemar | jamielennox: poke harder | 22:13 |
| stevemar | eh yeah, X-*-Token is probably smarter | 22:13 |
| morgan | jamielennox: hmm | 22:14 |
| morgan | yeah aim for x-*-token | 22:14 |
| stevemar | dolphm: morgan looks like https://review.openstack.org/#/q/I1e09228cff7a0c8136447f07df6864045a6fb849,n,z will fix ksa gates, if you'd be so kind | 22:15 |
| stevemar | or i will just approve :P | 22:15 |
| jamielennox | i can | 22:16 |
| morgan | stevemar: looking | 22:16 |
| jamielennox | oh, wait - no i can't | 22:16 |
| morgan | stevemar: want me to +A them too? | 22:16 |
| openstackgerrit | Merged openstack/oslo.policy: Remove references to Python 3.4 https://review.openstack.org/418006 | 22:17 |
| morgan | stevemar: tossed +2 on then, but might want to wait for jenkins | 22:17 |
| stevemar | morgan: zuul is happy with them | 22:17 |
| openstackgerrit | Merged openstack/keystone: Updated docstring for test_sql_upgrade.py https://review.openstack.org/417647 | 22:17 |
| stevemar | morgan: dolphm said he will look, so i'll give him a minute | 22:17 |
| morgan | stevemar: okie | 22:17 |
| * dolphm just got started | 22:17 | |
| stevemar | morgan: you can take a second pass once dolphm goes though? all stable/* patches in my queue: https://review.openstack.org/#/q/owner:s.martinelli%2540gmail.com+status:open | 22:17 |
| morgan | stevemar: sure. since i'm blocked on some devstack things for shade | 22:18 |
| morgan | stevemar: it's stupid that the "private" module isn't "_" prefixed for testtools | 22:18 |
| morgan | fwiw | 22:18 |
| *** agrebennikov has joined #openstack-keystone | 22:20 | |
| stevemar | morgan: *shrug* | 22:20 |
| jamielennox | morgan: well it's in testtools.tests, we don't do keystoneauth1._tests either | 22:23 |
| jamielennox | granted in testtools you might think .tests is public | 22:23 |
| morgan | jamielennox: fair. but yeah | 22:23 |
| *** darrenc is now known as darrenc_afk | 22:23 | |
| morgan | also i expect that anyone using keystoneauth1.tests will likely know it might be broken | 22:23 |
| morgan | we may want to explicitly mark it private though... or move tests out of the main tree | 22:24 |
| jamielennox | i would hope there's nothing in there that's useful | 22:24 |
| *** catinthe_ has quit IRC | 22:24 | |
| morgan | jamielennox: right | 22:25 |
| morgan | but we may want to be explicit | 22:25 |
| *** edtubill has quit IRC | 22:25 | |
| *** stewie925 has joined #openstack-keystone | 22:28 | |
| stewie925 | hello guys | 22:28 |
| dolphm | stevemar: why is this only related-bug? https://review.openstack.org/#/c/416260/ | 22:28 |
| dolphm | stevemar: it seems to close the issue | 22:28 |
| stewie925 | I have been setting up openstack and installed keystone service | 22:28 |
| stewie925 | I need to reset the password for the keystoneUser - what is the syntax for it? | 22:29 |
| dolphm | stewie925: keystoneUser? | 22:29 |
| stewie925 | oh wait.... | 22:30 |
| stewie925 | dolphm: think I just found out why... brb | 22:30 |
| stevemar | dolphm: looks like there was some confusion about it between logging binary data in request vs response and ksc vs ksa | 22:30 |
| dolphm | stevemar: any reason not to just revise it to Closes-Bug and +2? | 22:31 |
| dolphm | the master patch merged as Related | 22:32 |
| stewie925 | dolphm: thank you hehe - I realized I entered the wrong username :) whew! | 22:32 |
| stevemar | dolphm: i didn't open the bug against mitaka/newton yet | 22:32 |
| dolphm | stewie925: lol ++ | 22:32 |
| stevemar | dolphm: i'm not that critical about using LP to track backported fixes | 22:32 |
| dolphm | stevemar: so, just leave it as is? | 22:32 |
| stevemar | dolphm: but i don't mind it if it's bugging you, just saying it won't change anything in LP :P | 22:33 |
| dolphm | stevemar: no worries - i left a comment in gerrit for the sake of posterity if anyone ever wonders | 22:34 |
| stevemar | ++ | 22:34 |
| *** spzala has quit IRC | 22:34 | |
| *** richm has joined #openstack-keystone | 22:41 | |
| dolphm | stevemar: ?? https://review.openstack.org/#/c/418118/1 | 22:41 |
| dolphm | stevemar: see inline | 22:41 |
| *** adrian_otto has joined #openstack-keystone | 22:42 | |
| stewie925 | I did steps 1 and 2 - and when i tried to run step 3 I got a "type required" error | 22:51 |
| stewie925 | hi guys - so i am creating the keystone service for openstack-kilo - following the instructions in http://docs.openstack.org/kilo/install-guide/install/apt/content/keystone-services.html | 22:51 |
| stewie925 | this is the command : openstack service create --name keystone --description "OpenStack Identity" identity | 22:51 |
| stewie925 | and I got this error: openstack service create: error: argument --type is required | 22:52 |
| *** jperry has joined #openstack-keystone | 22:54 | |
| *** edmondsw_ has quit IRC | 22:55 | |
| dolphm | samueldmq: what is application/text, exactly? | 22:57 |
| *** david-lyle has quit IRC | 22:59 | |
| *** darrenc_afk is now known as darrenc | 23:00 | |
| *** ravelar has quit IRC | 23:00 | |
| *** jperry has quit IRC | 23:05 | |
| *** jaosorior has joined #openstack-keystone | 23:07 | |
| morgan | stevemar: all users (inc. federated) have entries in the user table, right? | 23:09 |
| morgan | oh wait... nvm. i already figured this part out | 23:10 |
| stevemar | morgan: correct, now, in N or O... can't remember which | 23:10 |
| dolphm | morgan: yes cc- rderose | 23:10 |
| stevemar | dolphm: looks like you figured it out | 23:10 |
| dolphm | stevemar: yeah - and then i ran into "application/text" | 23:10 |
| stevemar | dolphm: surprise! | 23:11 |
| morgan | stevemar: ok so if i'm adding a new table... do i need to add to both expand and migration repo? | 23:11 |
| morgan | or just expand? | 23:11 |
| dolphm | morgan: yes, you need a migration in all 3 repos, even if they are no-ops | 23:11 |
| *** asettle has joined #openstack-keystone | 23:12 | |
| morgan | dolphm: ick | 23:12 |
| morgan | wait all three? we have 4 | 23:12 |
| dolphm | oh, you don't need a migration in the "legacy" migration repo | 23:12 |
| dolphm | just expand -> migrate -> contract | 23:12 |
| morgan | right | 23:12 |
| dolphm | for new things going forward | 23:12 |
| morgan | i figured the other three | 23:12 |
| morgan | just wanted to make sure it was safe to ignore migrate_repo | 23:12 |
| dolphm | it's safe to ignore the old repo - whatever that's called (i swear it's called migrate_repo?) | 23:13 |
| rderose | morgan: yes, all users have an entry in the user table | 23:13 |
| dolphm | ah, yeah ignore migrate_repo | 23:14 |
| morgan | dolphm: yep, migrate_repo | 23:14 |
| dolphm | expand_repo -> data_migration_repo -> contract_repo | 23:14 |
| morgan | dolphm: we should make a real effort next cycle to get on alembic | 23:14 |
| dolphm | morgan: i spent a good chunk of today baffled by glance's approach to switching | 23:14 |
| morgan | rderose: i am going to add a table instead of adding a column to the user table so we can use metadata in the mfa-per-user (aka "enabled") type stuff | 23:15 |
| dolphm | morgan: i might end up tackling a switch to alembic | 23:15 |
| stevemar | dolphm: https://www.w3.org/Protocols/rfc1341/7_1_Text.html ? | 23:15 |
| morgan | rderose: adding it to the user table might require a lot of extra moving bits. | 23:15 |
| dolphm | stevemar: ? | 23:15 |
| stevemar | dolphm: application/text ? | 23:16 |
| morgan | dolphm: it should be pretty straight forward, last time i looked it seemed not too crazy | 23:16 |
| rderose | morgan: hmm... sounds interesting | 23:16 |
| rderose | morgan 1:1 relationship? | 23:16 |
| dolphm | stevemar: that describes text/* | 23:16 |
| morgan | rderose: yeah. | 23:16 |
| morgan | rderose: because we store the rules in a json column | 23:16 |
| dolphm | morgan: ++ | 23:16 |
| rderose | morgan: sounds good | 23:16 |
| dolphm | glance's patches are complicated :( | 23:17 |
| morgan | but we can add "enabled" etc in the new table rather than a ton of new columns in user | 23:17 |
| rderose | morgan: right, in that case, I think a new table makes sense | 23:18 |
| morgan | dolphm: yeah. glance has some more complex stuff we have small number of migrations since we moved to the contract/migrate/expand model | 23:18 |
| stevemar | dolphm: right? we only want to log things that have content type application/json or application/text | 23:18 |
| dolphm | stevemar: what uses application/text ?? | 23:18 |
| stevemar | dolphm: i want to say something in oauth... | 23:19 |
| dolphm | morgan: ceilometer's switch to alembic did not involve rewriting any migrations | 23:19 |
| stevemar | dolphm: maybe this? http://developer.openstack.org/api-ref/identity/v3-ext/index.html?expanded=create-access-token-detail#id31 | 23:20 |
| stevemar | dolphm: we also had xml there for a while | 23:20 |
| morgan | dolphm: and ours should not require it either | 23:20 |
| stevemar | ah, oauth uses https://github.com/openstack/keystone/blob/83bd595b22944d38eff1cdef77b4c07a75af0fdc/keystone/oauth1/controllers.py#L268 | 23:21 |
| stevemar | application/x-www-form-urlencoded | 23:21 |
| stevemar | dolphm: either way, its just an extra case that we can remove if its too chatty? | 23:21 |
| *** asettle has quit IRC | 23:22 | |
| *** phalmos has quit IRC | 23:23 | |
| *** asettle has joined #openstack-keystone | 23:23 | |
| morgan | hm | 23:25 |
| *** asettle has quit IRC | 23:27 | |
| stevemar | samueldmq davechen when you get a chance: https://review.openstack.org/#/c/416841/ | 23:28 |
| dstanek | knikolla: did you get it figured out? | 23:29 |
| openstackgerrit | Merged openstack/keystone: Use public interfaces of pep8 for hacking https://review.openstack.org/416830 | 23:30 |
| *** thorst has quit IRC | 23:32 | |
| *** thorst has joined #openstack-keystone | 23:32 | |
| *** thorst has quit IRC | 23:37 | |
| *** spzala has joined #openstack-keystone | 23:40 | |
| *** harlowja_ has quit IRC | 23:40 | |
| *** jaosorior has quit IRC | 23:40 | |
| *** harlowja has joined #openstack-keystone | 23:41 | |
| *** lamt has quit IRC | 23:48 | |
| dolphm | stevemar: there's probably a lot of useless, untested code that we could land and remove later, but that's not a good reason to land it! | 23:57 |
| *** edmondsw has joined #openstack-keystone | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!