| *** ngupta has quit IRC | 00:13 | |
| *** ngupta has joined #openstack-keystone | 00:13 | |
| *** jdennis1 has joined #openstack-keystone | 00:15 | |
| *** jdennis has quit IRC | 00:17 | |
| *** ngupta has quit IRC | 00:17 | |
| *** thorst has joined #openstack-keystone | 00:20 | |
| *** thorst has quit IRC | 00:25 | |
| *** adrian_otto has quit IRC | 00:27 | |
| *** _cjones_ has quit IRC | 00:29 | |
| *** _cjones_ has joined #openstack-keystone | 00:30 | |
| *** mkoderer__ has quit IRC | 00:31 | |
| *** edmondsw has quit IRC | 00:34 | |
| *** _cjones_ has quit IRC | 00:34 | |
| *** edmondsw has joined #openstack-keystone | 00:35 | |
| *** markvoelker has quit IRC | 00:35 | |
| *** ngupta has joined #openstack-keystone | 00:35 | |
| *** markvoelker has joined #openstack-keystone | 00:35 | |
| *** edmondsw has quit IRC | 00:36 | |
| *** DFFlanders has quit IRC | 00:40 | |
| *** markvoelker has quit IRC | 00:40 | |
| *** edmondsw has joined #openstack-keystone | 00:41 | |
| *** jamielennox|away is now known as jamielennox | 00:43 | |
| *** edmondsw has quit IRC | 00:46 | |
| *** bkudryavtsev has quit IRC | 00:46 | |
| *** tovin07 has joined #openstack-keystone | 00:50 | |
| openstackgerrit | Merged openstack/oslo.policy master: [Fix gate]Update test requirement https://review.openstack.org/440314 | 00:57 |
|---|---|---|
| *** ngupta has quit IRC | 01:06 | |
| *** ngupta has joined #openstack-keystone | 01:06 | |
| *** edmondsw has joined #openstack-keystone | 01:08 | |
| *** ngupta has quit IRC | 01:11 | |
| *** edmondsw has quit IRC | 01:12 | |
| *** agrebennikov_ has quit IRC | 01:18 | |
| *** thorst has joined #openstack-keystone | 01:21 | |
| *** liujiong has joined #openstack-keystone | 01:23 | |
| *** edmondsw has joined #openstack-keystone | 01:25 | |
| *** thorst has quit IRC | 01:25 | |
| *** dave-mccowan has joined #openstack-keystone | 01:27 | |
| *** jamielennox is now known as jamielennox|away | 01:29 | |
| *** markvoelker has joined #openstack-keystone | 01:36 | |
| *** jamielennox|away is now known as jamielennox | 01:36 | |
| *** thorst has joined #openstack-keystone | 01:37 | |
| *** markvoelker has quit IRC | 01:40 | |
| *** thorst has quit IRC | 01:41 | |
| *** markvoelker has joined #openstack-keystone | 01:43 | |
| *** dave-mccowan has quit IRC | 01:46 | |
| *** thorst has joined #openstack-keystone | 01:58 | |
| *** zsli has joined #openstack-keystone | 01:58 | |
| *** thorst has quit IRC | 01:59 | |
| openstackgerrit | Shan Guo proposed openstack/keystone master: Revise conf param in releasenotes https://review.openstack.org/440894 | 01:59 |
| adriant | rodrigods: https://blueprints.launchpad.net/keystone/+spec/name-field-consistency | 02:23 |
| *** thorst has joined #openstack-keystone | 02:23 | |
| *** dave-mccowan has joined #openstack-keystone | 02:24 | |
| *** thorst has quit IRC | 02:24 | |
| *** catintheroof has joined #openstack-keystone | 02:30 | |
| *** ravelar1 has joined #openstack-keystone | 02:41 | |
| *** ravelar1 has quit IRC | 02:46 | |
| *** thorst has joined #openstack-keystone | 02:48 | |
| *** thorst has quit IRC | 02:48 | |
| *** aasthad has quit IRC | 03:02 | |
| *** lucasxu has joined #openstack-keystone | 03:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy master: Updated from global requirements https://review.openstack.org/440139 | 03:07 |
| *** lucasxu has quit IRC | 03:10 | |
| *** bkudryavtsev has joined #openstack-keystone | 03:11 | |
| *** zhurong has joined #openstack-keystone | 03:21 | |
| *** ravelar1 has joined #openstack-keystone | 03:23 | |
| *** zhurong has quit IRC | 03:24 | |
| *** ravelar1 has quit IRC | 03:27 | |
| *** dikonoor has joined #openstack-keystone | 03:28 | |
| *** thorst has joined #openstack-keystone | 03:54 | |
| *** ngupta has joined #openstack-keystone | 03:58 | |
| *** thorst has quit IRC | 03:59 | |
| *** nicolasbock has quit IRC | 03:59 | |
| *** lucasxu has joined #openstack-keystone | 03:59 | |
| *** zsli has quit IRC | 04:02 | |
| *** adrian_otto has joined #openstack-keystone | 04:06 | |
| *** aasthad has joined #openstack-keystone | 04:09 | |
| *** prashkre has joined #openstack-keystone | 04:13 | |
| *** links has joined #openstack-keystone | 04:26 | |
| *** dave-mcc_ has joined #openstack-keystone | 04:29 | |
| *** dave-mccowan has quit IRC | 04:29 | |
| *** dave-mcc_ has quit IRC | 04:34 | |
| *** ngupta has quit IRC | 04:37 | |
| *** lucasxu has quit IRC | 04:52 | |
| *** adrian_otto has quit IRC | 04:53 | |
| *** adrian_otto has joined #openstack-keystone | 04:53 | |
| *** prashkre has quit IRC | 04:54 | |
| *** thorst has joined #openstack-keystone | 04:55 | |
| *** thorst has quit IRC | 05:00 | |
| *** catintheroof has quit IRC | 05:00 | |
| *** ravelar has quit IRC | 05:00 | |
| *** zsli has joined #openstack-keystone | 05:00 | |
| *** markvoelker has quit IRC | 05:07 | |
| *** rderose has quit IRC | 05:07 | |
| *** prashkre has joined #openstack-keystone | 05:20 | |
| *** h5t4 has joined #openstack-keystone | 05:24 | |
| *** adrian_otto has quit IRC | 05:33 | |
| *** liujiong has quit IRC | 05:35 | |
| *** liujiong has joined #openstack-keystone | 05:36 | |
| *** ravelar has joined #openstack-keystone | 05:36 | |
| *** ravelar has quit IRC | 05:36 | |
| *** adrian_otto has joined #openstack-keystone | 05:40 | |
| *** h5t4 has quit IRC | 05:56 | |
| *** thorst has joined #openstack-keystone | 05:56 | |
| *** zhurong has joined #openstack-keystone | 05:58 | |
| *** thorst has quit IRC | 06:01 | |
| *** zsli has quit IRC | 06:01 | |
| *** zsli has joined #openstack-keystone | 06:01 | |
| *** markvoelker has joined #openstack-keystone | 06:07 | |
| *** markvoelker has quit IRC | 06:12 | |
| openstackgerrit | Merged openstack/oslo.policy master: Updated from global requirements https://review.openstack.org/440139 | 06:15 |
| *** tovin07 has quit IRC | 06:23 | |
| *** tovin07 has joined #openstack-keystone | 06:24 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone master: Make name fields a consistent size of 255 https://review.openstack.org/440941 | 06:24 |
| *** tovin07 has quit IRC | 06:27 | |
| *** tovin07 has joined #openstack-keystone | 06:28 | |
| *** edmondsw_ has joined #openstack-keystone | 06:33 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone master: Make name fields a consistent size of 255 https://review.openstack.org/440941 | 06:34 |
| *** edmondsw has quit IRC | 06:35 | |
| *** adriant has quit IRC | 06:42 | |
| *** richm has quit IRC | 06:43 | |
| *** jaosorior has joined #openstack-keystone | 06:44 | |
| *** h5t4 has joined #openstack-keystone | 06:54 | |
| *** thorst has joined #openstack-keystone | 06:57 | |
| *** thorst has quit IRC | 07:01 | |
| *** edmondsw_ has quit IRC | 07:03 | |
| *** edmondsw has joined #openstack-keystone | 07:05 | |
| *** tesseract has joined #openstack-keystone | 07:12 | |
| *** adrian_otto has quit IRC | 07:12 | |
| *** david-lyle has quit IRC | 07:16 | |
| *** jrist has quit IRC | 07:16 | |
| *** david-lyle has joined #openstack-keystone | 07:16 | |
| *** jrist has joined #openstack-keystone | 07:17 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone master: Imported Translations from Zanata https://review.openstack.org/439420 | 07:25 |
| *** zhurong has quit IRC | 07:26 | |
| *** tesseract-RH has joined #openstack-keystone | 07:29 | |
| *** tesseract has quit IRC | 07:30 | |
| *** pcaruana has joined #openstack-keystone | 07:41 | |
| *** rcernin has joined #openstack-keystone | 07:44 | |
| *** namnh has joined #openstack-keystone | 07:54 | |
| *** thorst has joined #openstack-keystone | 07:58 | |
| *** thorst has quit IRC | 08:02 | |
| *** zhurong has joined #openstack-keystone | 08:04 | |
| *** markvoelker has joined #openstack-keystone | 08:08 | |
| *** zsli_ has joined #openstack-keystone | 08:09 | |
| *** zsli has quit IRC | 08:10 | |
| *** markvoelker has quit IRC | 08:14 | |
| *** zsli__ has joined #openstack-keystone | 08:18 | |
| *** zsli_ has quit IRC | 08:20 | |
| *** edmondsw has quit IRC | 08:22 | |
| *** zsli__ is now known as Shunli | 08:23 | |
| *** Shunli is now known as ShunliZhou | 08:23 | |
| *** zsli_ has joined #openstack-keystone | 08:37 | |
| *** ShunliZhou has quit IRC | 08:40 | |
| *** thorst has joined #openstack-keystone | 08:58 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:00 | |
| *** thorst has quit IRC | 09:09 | |
| *** david-lyle has quit IRC | 09:13 | |
| *** david-lyle has joined #openstack-keystone | 09:13 | |
| *** jrist has quit IRC | 09:14 | |
| *** jrist has joined #openstack-keystone | 09:14 | |
| *** david-lyle_ has joined #openstack-keystone | 09:30 | |
| *** david-lyle has quit IRC | 09:31 | |
| *** zhurong has quit IRC | 09:34 | |
| *** zsli_ has quit IRC | 09:47 | |
| *** h5t4 has quit IRC | 09:57 | |
| *** zhurong has joined #openstack-keystone | 09:58 | |
| *** thorst has joined #openstack-keystone | 10:06 | |
| *** thorst has quit IRC | 10:10 | |
| *** markvoelker has joined #openstack-keystone | 10:10 | |
| *** tovin07 has quit IRC | 10:12 | |
| *** markvoelker has quit IRC | 10:15 | |
| *** liujiong has quit IRC | 10:18 | |
| *** edmondsw has joined #openstack-keystone | 10:22 | |
| *** zhurong has quit IRC | 10:25 | |
| *** edmondsw has quit IRC | 10:27 | |
| *** prashkre_ has joined #openstack-keystone | 10:38 | |
| *** prashkre has quit IRC | 10:38 | |
| *** h5t4_ has joined #openstack-keystone | 10:48 | |
| *** jaosorior is now known as jaosorior_lunch | 11:01 | |
| *** nicolasbock has joined #openstack-keystone | 11:06 | |
| *** aasthad has quit IRC | 11:12 | |
| *** richm has joined #openstack-keystone | 11:14 | |
| *** namnh has quit IRC | 11:40 | |
| *** jaosorior_lunch is now known as jaosorior | 11:41 | |
| *** zhurong has joined #openstack-keystone | 12:04 | |
| *** dikonoor has quit IRC | 12:04 | |
| *** thorst has joined #openstack-keystone | 12:07 | |
| *** ayoung has joined #openstack-keystone | 12:08 | |
| *** markvoelker has joined #openstack-keystone | 12:11 | |
| *** thorst has quit IRC | 12:11 | |
| *** markvoelker has quit IRC | 12:16 | |
| *** ArchiFleKs has joined #openstack-keystone | 12:16 | |
| *** zhurong has quit IRC | 12:33 | |
| *** zhurong has joined #openstack-keystone | 12:39 | |
| *** prashkre_ has quit IRC | 12:42 | |
| *** prashkre_ has joined #openstack-keystone | 12:42 | |
| *** thorst has joined #openstack-keystone | 12:44 | |
| *** dikonoor has joined #openstack-keystone | 12:47 | |
| *** dikonoo has joined #openstack-keystone | 12:55 | |
| *** dikonoor has quit IRC | 12:56 | |
| *** prashkre_ has quit IRC | 12:57 | |
| *** dave-mccowan has joined #openstack-keystone | 12:57 | |
| openstackgerrit | Sean Dague proposed openstack/keystone-specs master: WIP: early rough draft of unified limits https://review.openstack.org/440815 | 13:01 |
| *** dikonoo has quit IRC | 13:03 | |
| *** links has quit IRC | 13:05 | |
| *** Mr_Smurf_ has left #openstack-keystone | 13:05 | |
| *** dikonoo has joined #openstack-keystone | 13:11 | |
| *** chlong__ has quit IRC | 13:14 | |
| *** markvoelker has joined #openstack-keystone | 13:23 | |
| *** catintheroof has joined #openstack-keystone | 13:31 | |
| *** catintheroof has quit IRC | 13:39 | |
| *** zhurong has quit IRC | 13:48 | |
| *** spilla has joined #openstack-keystone | 14:00 | |
| *** dikonoo has quit IRC | 14:03 | |
| lbragstad | o/ | 14:11 |
| *** zhurong has joined #openstack-keystone | 14:14 | |
| lbragstad | here's a stable backport review if anyone is interested - https://review.openstack.org/#/c/440918/1 | 14:19 |
| *** ngupta has joined #openstack-keystone | 14:20 | |
| *** ngupta has quit IRC | 14:20 | |
| *** ngupta has joined #openstack-keystone | 14:21 | |
| *** chlong__ has joined #openstack-keystone | 14:22 | |
| openstackgerrit | Béla Vancsics proposed openstack/keystone master: Remove unused variable https://review.openstack.org/439525 | 14:23 |
| *** edmondsw has joined #openstack-keystone | 14:24 | |
| *** Dinesh_Bhor has quit IRC | 14:24 | |
| *** pcaruana has quit IRC | 14:24 | |
| *** edmondsw has quit IRC | 14:28 | |
| *** zhurong has quit IRC | 14:33 | |
| *** arturb has quit IRC | 14:36 | |
| openstackgerrit | Béla Vancsics proposed openstack/keystone master: Remove unused variable https://review.openstack.org/439525 | 14:46 |
| *** rderose has joined #openstack-keystone | 14:51 | |
| *** masber has quit IRC | 14:58 | |
| *** masber has joined #openstack-keystone | 14:59 | |
| lbragstad | cmurphy rodrigods o/ | 15:02 |
| rodrigods | lbragstad, o/ | 15:02 |
| lbragstad | rodrigods cmurphy i did some digging on your comments here - https://review.openstack.org/#/c/438896/2/keystone/tests/unit/common/test_database_conflicts.py,unified | 15:02 |
| lbragstad | I think I figured out why we litter our unit tests with try/excepts for that specific module | 15:03 |
| rodrigods | lbragstad, hmm | 15:03 |
| rodrigods | why? (i guess to look the exception messages?) | 15:03 |
| lbragstad | rodrigods we want to be able to save the exception so that we can verify it contains a specific message, right? | 15:03 |
| lbragstad | that makes sense | 15:04 |
| lbragstad | and the original implementation of self.assertRaises should support that https://docs.python.org/2/library/unittest.html#unittest.TestCase.assertRaises | 15:04 |
| lbragstad | because you should be able to use it like a context manager | 15:04 |
| lbragstad | s/like/as/ | 15:04 |
| lbragstad | which would be perfect for us because we'd be able to do this | 15:05 |
| rodrigods | right | 15:05 |
| lbragstad | http://cdn.pasteraw.com/h38srugqxbw69dw7flw63pqfwxjl3g6 | 15:05 |
| lbragstad | but ^ that doesn't work because we use testtools, and testtools reimplemented the assertRaises implementation but didn't add the context manager support | 15:05 |
| lbragstad | https://github.com/testing-cabal/testtools/blob/master/testtools/testcase.py#L464-L487 | 15:05 |
| rodrigods | :( | 15:06 |
| lbragstad | which leads to this failure - http://cdn.pasteraw.com/97zgb4zpyeqo436hj0de7fd6lx25zyb | 15:06 |
| lbragstad | #themoreyouknow | 15:06 |
| rodrigods | nice lbragstad | 15:06 |
| *** edmondsw has joined #openstack-keystone | 15:06 | |
| rodrigods | thanks for digging this up | 15:06 |
| *** jaosorior has quit IRC | 15:06 | |
| lbragstad | rodrigods yeah - i was like "how is this *not* possible?!" | 15:06 |
| rodrigods | everything makes sense now | 15:07 |
| lbragstad | i also find it odd to have try/excepts in the tests | 15:07 |
| cmurphy | o/ | 15:07 |
| cmurphy | that is amazing | 15:08 |
| lbragstad | cmurphy o/ | 15:08 |
| lbragstad | cmurphy rodrigods and i were just discussing https://review.openstack.org/#/c/438896/2/keystone/tests/unit/common/test_database_conflicts.py,unified | 15:08 |
| lbragstad | cmurphy weird, right? | 15:08 |
| cmurphy | very | 15:08 |
| lbragstad | cmurphy i was going to do a follow on patch to yours that cleaned a bunch of that up, but I guess I'll just settle for a FIXME explaining the reasoning behind it instead :) | 15:09 |
| cmurphy | haha | 15:09 |
| *** ravelar has joined #openstack-keystone | 15:14 | |
| *** lucasxu has joined #openstack-keystone | 15:17 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add in-code comment to clarify pattern in tests https://review.openstack.org/441187 | 15:30 |
| lbragstad | cc cmurphy rodrigods dstanek ^ | 15:30 |
| dstanek | lbragstad: does a pasteraw live forever? | 15:34 |
| dolphm | dstanek: yes | 15:44 |
| dolphm | dstanek: until someone yells at me about cloud files usage, in which case, there are a lot of spam entries i can programmatically remove | 15:44 |
| dstanek | dolphm: nice | 15:46 |
| dstanek | i didn't know that it was a dolphm thing :-) | 15:46 |
| *** chris_hultin|AWA is now known as chris_hultin | 15:53 | |
| notmorgan | dstanek: ++ same | 15:54 |
| knikolla | o/ | 15:55 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Move driver loading inside of dict https://review.openstack.org/440845 | 15:59 |
| *** agrebennikov_ has joined #openstack-keystone | 15:59 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Remove password_expires_ignore_user_ids https://review.openstack.org/438208 | 16:01 |
| *** lucasxu has quit IRC | 16:01 | |
| *** adrian_otto has joined #openstack-keystone | 16:01 | |
| *** rcernin has quit IRC | 16:02 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Remove password_expires_ignore_user_ids https://review.openstack.org/438208 | 16:02 |
| *** Aurelgadjo has joined #openstack-keystone | 16:05 | |
| *** arunkant has joined #openstack-keystone | 16:07 | |
| *** lucasxu has joined #openstack-keystone | 16:11 | |
| *** tesseract-RH has quit IRC | 16:14 | |
| openstackgerrit | Sean Dague proposed openstack/keystone-specs master: WIP: block diag quota scenarios https://review.openstack.org/441203 | 16:16 |
| openstackgerrit | Merged openstack/keystone master: Stop reading local config dirs for domain-specific file config driver https://review.openstack.org/436882 | 16:19 |
| *** h5t4_ has quit IRC | 16:20 | |
| openstackgerrit | Anthony Washington proposed openstack/oslo.policy master: Add additional param to policy.RuleDefault https://review.openstack.org/439070 | 16:22 |
| ayoung | knikolla, so, something important that needs to be done is to fix the creationg of admin-users in Tempest tests. Right now, they are created in all different projects, but they need to be created in the admin project. | 16:24 |
| ayoung | that is why these patchs fail: https://review.openstack.org/#/c/384148/ and https://review.openstack.org/#/c/257636/ | 16:25 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Validate rolling upgrade is run in order https://review.openstack.org/437441 | 16:25 |
| ayoung | Get a Tempest run that can pass those and we'll be able to close out those reveiws, too | 16:26 |
| knikolla | ayoung: i see. alright, i'll look into it. | 16:27 |
| ayoung | knikolla, that would be awesome.... | 16:27 |
| *** ngupta has quit IRC | 16:32 | |
| *** ngupta has joined #openstack-keystone | 16:36 | |
| *** aasthad has joined #openstack-keystone | 16:37 | |
| *** adrian_otto has quit IRC | 16:39 | |
| *** edmondsw has quit IRC | 16:39 | |
| *** adrian_otto has joined #openstack-keystone | 16:43 | |
| knikolla | ayoung: so basically the project here should be the admin one | 16:45 |
| knikolla | https://github.com/openstack/tempest/blob/master/tempest/common/dynamic_creds.py#L170 | 16:45 |
| knikolla | hmmm… but then also the token used 'during' the test must be scoped to the admin one | 16:46 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Minor cleanup from patch 429047 https://review.openstack.org/433636 | 16:56 |
| ayoung | knikolla, maybe. The term admin is loaded | 17:02 |
| ayoung | so some cases where you want a project specific admin, or a domain admin, should not be from the admin project, but from the project specified. However, it might be sufficient to just change that point and get everything to pass. | 17:02 |
| knikolla | ayoung: i'll give it a try later today after pizza. | 17:04 |
| knikolla | wanna start an etherpad for future reference? | 17:04 |
| ayoung | knikolla, if necessary. Only if we start getting that many details to track. Otherwise, add them to the bug report for 968696 | 17:05 |
| knikolla | sounds good. | 17:06 |
| notmorgan | ayoung: 968696 -> "Wont fix", "sorry this bug is just not something we consider important naymore..." /s | 17:12 |
| ayoung | notmorgan, reassigning it to you. | 17:12 |
| notmorgan | ayoung: i couldn't resist. that bug is sooooooooooo old, man it feels like it's just part of "keystone" these days. ;) | 17:12 |
| *** _cjones_ has joined #openstack-keystone | 17:12 | |
| notmorgan | ayoung: yeah because reassigning it to me is going to get it done :P | 17:12 |
| ayoung | notmorgan, doesn't help that I was not really able to work on it for so long | 17:13 |
| * notmorgan reassigns it to lbragstad | 17:13 | |
| notmorgan | it's what the PTL is for, right? | 17:13 |
| notmorgan | ayoung: so... i think i could get us to signed requests... but endpoint filtering is the monkeywrench. | 17:13 |
| ayoung | notmorgan, how's that? | 17:13 |
| notmorgan | ayoung: endpoints can change depending on the token. | 17:14 |
| notmorgan | so catalog isn't static. | 17:14 |
| notmorgan | makes discovery near impossible. | 17:14 |
| notmorgan | if we didn't have endpoint filtering (the thing we implemenrted, not the "hey only show me nova" query string) | 17:15 |
| notmorgan | the catalog could be static. then if you needed discovery, ask for catalog | 17:15 |
| ayoung | if only we had a spec for that | 17:15 |
| ayoung | oh wait...I wrote one years ago | 17:15 |
| notmorgan | ksm could pass off the signed request to keystone and keystone could do normal validation. | 17:15 |
| notmorgan | no not for this bit. | 17:15 |
| notmorgan | this is eliminating the need for tokens for user->nova for example. | 17:16 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Move driver loading inside of dict https://review.openstack.org/440845 | 17:16 |
| notmorgan | it just eliminates the secret going on the wire. | 17:16 |
| ayoung | signed requests have nothing to do with the service catalog. Don't sign the token | 17:16 |
| notmorgan | no, sign (HMAC) the actual request to nova | 17:16 |
| notmorgan | don't send a token | 17:16 |
| ayoung | user has a key, signes the request, nova validates , not catalog | 17:16 |
| notmorgan | catalog is just discovery specific | 17:16 |
| notmorgan | if you don't know where nova is | 17:16 |
| notmorgan | you have to ask keystone | 17:17 |
| ayoung | yeah, send HMAC in a header, no token | 17:17 |
| ayoung | separate request for that | 17:17 |
| notmorgan | AND that data can change depending on your scope | 17:17 |
| notmorgan | the catalog is not static. it is scope-specific... so... ugh | 17:17 |
| ayoung | user still requests a token, just doesn't send it to nova | 17:17 |
| notmorgan | also services have scope in their urls :( | 17:17 |
| ayoung | or...requests something like a token | 17:17 |
| ayoung | just requests catalog as a signed request! | 17:18 |
| notmorgan | heh | 17:18 |
| ayoung | seriously | 17:18 |
| notmorgan | possible, just still icky and sad. | 17:18 |
| notmorgan | i am so sad the catalog isn't static | 17:18 |
| notmorgan | it should be | 17:18 |
| ayoung | user requests catalog as a signed request, scoped to project. Holds on to that data as long as they plan | 17:18 |
| ayoung | Should be a DNS lookup | 17:18 |
| notmorgan | that too | 17:18 |
| notmorgan | but again, static data | 17:19 |
| notmorgan | not "if i look up this thing i get different data back because my scope is different) | 17:19 |
| notmorgan | s/\(/" | 17:19 |
| ayoung | what's the worst that can happen? User sends request to a valid Nova server that they should not have sent it to? | 17:19 |
| notmorgan | well the issue is catalogs encode scope data in the catalog itself | 17:19 |
| ayoung | Oh. Yeah. THat. | 17:20 |
| *** edmondsw has joined #openstack-keystone | 17:20 | |
| notmorgan | https://nova/{project_id}/.... | 17:20 |
| notmorgan | and we don't actually generate a catalog w/o a token | 17:20 |
| ayoung | but if you sent it to the wrong end point, woulnd't nova just summarily reject it? | 17:20 |
| notmorgan | nope | 17:20 |
| notmorgan | it's security through obscurity | 17:20 |
| ayoung | Joy | 17:20 |
| ayoung | rapture | 17:21 |
| notmorgan | so we could work around it by doing a signed request to keystone that says gimme catalog | 17:21 |
| *** edmondsw has quit IRC | 17:21 | |
| notmorgan | but we could totally get there now. | 17:22 |
| notmorgan | we have positioned things in a way that would just-work(tm) | 17:22 |
| notmorgan | if we wanted to do it | 17:22 |
| *** edmondsw has joined #openstack-keystone | 17:22 | |
| notmorgan | though KSM would need to store a nonce to avoid replay attacks | 17:22 |
| ayoung | notmorgan, short time out, I think, instead of nonce | 17:23 |
| notmorgan | but that could just be leaned on in cache + time-window for the request to limit exposure (since HMAC(endpoint, time, nonce, request-data, secret-id), secret-id | 17:23 |
| ayoung | yeah, that | 17:23 |
| notmorgan | i'd add a nonce, wether or not we do anything with it just for future proofing and make it so ksm *can* cache it and eliminate replay attacks | 17:23 |
| ayoung | What about Horizon? | 17:24 |
| notmorgan | initially, horizon would stay with tokens | 17:24 |
| *** edmondsw_ has joined #openstack-keystone | 17:24 | |
| notmorgan | but i bet with javascript we could create the signed request in the browser and not pass that secret to the server | 17:24 |
| ayoung | Oh, I like that | 17:25 |
| notmorgan | now the downside. | 17:25 |
| notmorgan | the BIG downside | 17:25 |
| notmorgan | you can't cache the validation | 17:25 |
| ayoung | I'm totally OK with that | 17:25 |
| notmorgan | the signed request validation | 17:25 |
| notmorgan | the way we get around nova->glance on your behalf is ksm gets a token from keystone and just sticks it in x-auth-token when talking to nova | 17:26 |
| notmorgan | we've separated concerns between user->service and service->service | 17:26 |
| notmorgan | we can work on making service->service better w/o breaking the user story then. | 17:26 |
| ayoung | only validate signed requests at the edges, not between Nova and Glance | 17:26 |
| notmorgan | but we can make the user experience better/more secure | 17:26 |
| ayoung | that is done like a service token | 17:26 |
| notmorgan | ayoung: ideally i would do that | 17:26 |
| notmorgan | but just as a bootstrap so less code change/churn in projects, pass a token in | 17:27 |
| *** edmondsw has quit IRC | 17:27 | |
| notmorgan | make it a query-param to begin with and not the default behavior | 17:27 |
| ayoung | pseudotoken | 17:27 |
| notmorgan | and when (sigh) we microversion beyond it's need it is dropped | 17:27 |
| notmorgan | basically. yes | 17:27 |
| notmorgan | we could also require that token to only work w/ a service token | 17:28 |
| notmorgan | (somehow) | 17:28 |
| ayoung | unified delegation type thing | 17:28 |
| notmorgan | but in short, we split the concerns this way between user interactions and service interactions | 17:28 |
| notmorgan | and we eliminate the hell that is bearer tokens on the wire from/through an untrusted netowkr | 17:29 |
| ayoung | body of a Fernet token, not signed by symkey, just returns "this is what you would get if this were asigned token" coupled with "token from service user" | 17:29 |
| ayoung | its why I wanted tokens with a single role in them | 17:29 |
| notmorgan | you'd still need a token that glance would get the data for/from. | 17:29 |
| notmorgan | but... | 17:29 |
| notmorgan | again... iterative work | 17:29 |
| notmorgan | fix the user->service thing | 17:29 |
| ayoung | pseudotoken | 17:29 |
| notmorgan | then fix service->service | 17:30 |
| ayoung | wouldn't have to go to Keystone to get it issued, Nova could generate and pass along | 17:30 |
| notmorgan | sure. | 17:30 |
| ayoung | wouldn't be signed, | 17:30 |
| notmorgan | ksm would just need to trust nova on the other end | 17:30 |
| notmorgan | i wrote that up and people hated it because "OMG NOVA CAN DO ANYTHING THEN" | 17:30 |
| notmorgan | "KEYSTONE MUST VALIDATE" | 17:30 |
| notmorgan | heck, i even wrote up a bit of code in lua to make ksm go away in the process. | 17:31 |
| ayoung | well, we could always force Nova to pass along the original signed request, if were paranoid | 17:31 |
| notmorgan | so haproxy could do all the work at the edge | 17:31 |
| notmorgan | and nova/cinder/glance/etc could just trust eachother | 17:31 |
| ayoung | and then force a rulethat said "if user asks Nova todo X in project P, Nova can ask glance to do Y in Project P" | 17:32 |
| notmorgan | i had it all working too, was a pretty cool setup | 17:32 |
| ayoung | its things like this that make me happy to be focused on Kubevirt these days... | 17:32 |
| notmorgan | no one was interested because "keystone mostly just works" | 17:32 |
| * notmorgan shrugs | 17:33 | |
| *** david_cu has quit IRC | 17:34 | |
| *** pkoraca_ has joined #openstack-keystone | 17:36 | |
| *** darrenc_ has joined #openstack-keystone | 17:36 | |
| *** wolsen_ has joined #openstack-keystone | 17:37 | |
| *** robcresswell_ has joined #openstack-keystone | 17:37 | |
| *** r1chardj0n3s_ has joined #openstack-keystone | 17:39 | |
| *** Aurelgad1o has joined #openstack-keystone | 17:40 | |
| *** Trident has joined #openstack-keystone | 17:40 | |
| *** jhesketh_ has joined #openstack-keystone | 17:41 | |
| *** andreykurilin_ has joined #openstack-keystone | 17:42 | |
| *** spotz_ has joined #openstack-keystone | 17:42 | |
| *** jmccrory_ has joined #openstack-keystone | 17:42 | |
| *** afazekas_ has joined #openstack-keystone | 17:42 | |
| *** wasmum- has joined #openstack-keystone | 17:42 | |
| *** dtroyer_zz has joined #openstack-keystone | 17:42 | |
| *** mgagne_ has joined #openstack-keystone | 17:42 | |
| *** Alex_Oughton has joined #openstack-keystone | 17:42 | |
| *** dutsmoc has joined #openstack-keystone | 17:43 | |
| *** dtroyer has quit IRC | 17:43 | |
| *** chris_hultin has quit IRC | 17:43 | |
| *** dstanek has quit IRC | 17:43 | |
| *** darrenc has quit IRC | 17:43 | |
| *** wolsen has quit IRC | 17:43 | |
| *** comstud has quit IRC | 17:43 | |
| *** jmccrory has quit IRC | 17:43 | |
| *** spotz has quit IRC | 17:43 | |
| *** mgagne has quit IRC | 17:43 | |
| *** pkoraca has quit IRC | 17:43 | |
| *** AlexOughton has quit IRC | 17:43 | |
| *** r1chardj0n3s has quit IRC | 17:43 | |
| *** wasmum has quit IRC | 17:43 | |
| *** hyakuhei has quit IRC | 17:43 | |
| *** afazekas has quit IRC | 17:43 | |
| *** dims has quit IRC | 17:43 | |
| *** g2 has quit IRC | 17:43 | |
| *** andreykurilin has quit IRC | 17:43 | |
| *** Tridde has quit IRC | 17:43 | |
| *** robcresswell has quit IRC | 17:43 | |
| *** jhesketh has quit IRC | 17:43 | |
| *** mdavidson has quit IRC | 17:43 | |
| *** Aurelgadjo has quit IRC | 17:43 | |
| *** chris__hultin has joined #openstack-keystone | 17:43 | |
| *** hyakuhei has joined #openstack-keystone | 17:43 | |
| *** hyakuhei has quit IRC | 17:43 | |
| *** hyakuhei has joined #openstack-keystone | 17:43 | |
| *** hyakuhei has quit IRC | 17:43 | |
| *** hyakuhei has joined #openstack-keystone | 17:43 | |
| *** chris__hultin is now known as chris_hultin | 17:43 | |
| *** mdavidson has joined #openstack-keystone | 17:43 | |
| *** pkoraca_ is now known as pkoraca | 17:43 | |
| *** dstanek has joined #openstack-keystone | 17:43 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 17:43 | |
| *** jmccrory_ is now known as jmccrory | 17:44 | |
| *** wolsen_ is now known as wolsen | 17:44 | |
| *** dims has joined #openstack-keystone | 17:44 | |
| *** robcresswell_ is now known as robcresswell | 17:44 | |
| *** spotz_ is now known as spotz_zzz | 17:48 | |
| *** dtroyer_zz has left #openstack-keystone | 17:53 | |
| *** dtroyer_zz has joined #openstack-keystone | 17:53 | |
| *** adrian_otto has quit IRC | 17:55 | |
| openstackgerrit | Sean Dague proposed openstack/keystone-specs master: WIP: block diag quota scenarios https://review.openstack.org/441203 | 17:57 |
| openstackgerrit | Sean Dague proposed openstack/keystone-specs master: WIP: block diag quota scenarios https://review.openstack.org/441203 | 18:00 |
| *** chlong__ has quit IRC | 18:04 | |
| openstackgerrit | Sean Dague proposed openstack/keystone-specs master: WIP: block diag quota scenarios https://review.openstack.org/441203 | 18:09 |
| *** rcernin has joined #openstack-keystone | 18:09 | |
| *** gyee has joined #openstack-keystone | 18:11 | |
| *** lucasxu has quit IRC | 18:19 | |
| *** chlong__ has joined #openstack-keystone | 18:20 | |
| *** adrian_otto has joined #openstack-keystone | 18:24 | |
| *** lucasxu has joined #openstack-keystone | 18:25 | |
| *** AJaeger has joined #openstack-keystone | 18:32 | |
| AJaeger | jamielennox: looking at tox.ini and your note about warnerrors: You can now use "warning-is-error" in the build_sphinx section. See https://review.openstack.org/441273 for a sample change... | 18:33 |
| *** h5t4 has joined #openstack-keystone | 18:37 | |
| gagehugo | AJaeger: https://review.openstack.org/#/c/439674/ | 18:37 |
| gagehugo | AJaeger: has the upper-constraint for sphinx been changed to >= 1.5? | 18:38 |
| AJaeger | gagehugo: it has! | 18:38 |
| AJaeger | gagehugo: 12 hours ago ;) | 18:38 |
| gagehugo | AJaeger: cool! I'll update the patch set then | 18:39 |
| AJaeger | gagehugo: thanks for tackling this | 18:39 |
| *** spotz_zzz is now known as spotz | 18:39 | |
| gagehugo | :) | 18:40 |
| *** adrian_otto has quit IRC | 18:44 | |
| *** prashkre_ has joined #openstack-keystone | 18:48 | |
| *** spotz is now known as spotz_zzz | 18:49 | |
| *** adrian_otto has joined #openstack-keystone | 18:49 | |
| robcresswell | Okay, question: If you're requesting an unscoped token in a single domain model, you still have to supply a domain name as part of the request right? Keystone will error rather than fall back to a default? | 18:50 |
| robcresswell | I'm just poking the auth model with a stick to try and get some proper understanding | 18:50 |
| knikolla | robcresswell: yes. domain is required in v3 even in a single-domain model. you'll get back 400. | 18:53 |
| knikolla | robcresswell: unless you use user_id. | 18:54 |
| *** adrian_otto has quit IRC | 18:55 | |
| knikolla | http://paste.openstack.org/show/601366/ | 18:56 |
| *** AJaeger has left #openstack-keystone | 18:58 | |
| robcresswell | knikolla: Gotcha. Good to know. | 18:58 |
| robcresswell | Whats the reason for not using the default domain if none is supplied? I was just curious, since an outside service has to have knowledge of the Keystone config to log in, right? | 18:59 |
| robcresswell | Either by assuming 'Default' or having a setting like Horizon does. | 19:00 |
| knikolla | I don't know the historical reason for that. I guess the less assumptions about the user and automagic the better. v2 does default to 'Default' domain since it doesn't support domains. | 19:02 |
| robcresswell | knikolla: Well, that comes down to the implicit vs explicit argument which applies to programming everywhere | 19:03 |
| robcresswell | It's just one of those slightly strange things IMO that the user has to know the name of the domain, even if there is only one | 19:04 |
| robcresswell | But then, it means less ambiguity for the keystone folk to debug | 19:04 |
| knikolla | robcresswell: true. | 19:05 |
| openstackgerrit | Sujitha proposed openstack/oslo.policy master: Allow multiline descriptions for RuleDefaults https://review.openstack.org/441342 | 19:05 |
| openstackgerrit | David Stanek proposed openstack/keystone-specs master: WIP: block diag quota scenarios https://review.openstack.org/441203 | 19:22 |
| *** ngupta has quit IRC | 19:23 | |
| dstanek | robcresswell: explicit is better than implicit | 19:30 |
| *** ngupta has joined #openstack-keystone | 19:31 | |
| robcresswell | dstanek: Well, thats that debate solved then. I'll alert the internet :) | 19:31 |
| dstanek | robcresswell: don't worry the important people (Python programmers) already know | 19:31 |
| robcresswell | :( | 19:32 |
| dstanek | it's rule #2 | 19:32 |
| robcresswell | ah yes | 19:33 |
| dstanek | my favorite command to give out is 'python -m this' | 19:33 |
| robcresswell | :o | 19:34 |
| robcresswell | Didn't know about that | 19:35 |
| robcresswell | I wonder how many apps out there have hardcoded a fallback to "Default" as the domain | 19:36 |
| robcresswell | bleurgh, I just said "apps" | 19:37 |
| robcresswell | programs* | 19:37 |
| knikolla | ayoung: arghhh… the tempest option is for admin_project_name, so i have to mock the list_projects api call in a lot of the tempest unit tests to get the project_id and do the assignment | 19:38 |
| *** spotz_zzz is now known as spotz | 19:40 | |
| *** spotz is now known as spotz_zzz | 19:49 | |
| openstackgerrit | Gage Hugo proposed openstack/keystoneauth master: Remove pbr warnerrors in favor of sphinx check https://review.openstack.org/439797 | 19:54 |
| *** chris_hultin is now known as chris_hultin|AWA | 19:55 | |
| *** rdo has quit IRC | 19:55 | |
| *** chlong__ has quit IRC | 19:55 | |
| *** BrAsS_mOnKeY is now known as g2 | 20:03 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Remove pbr warnerrors in favor of sphinx check https://review.openstack.org/439674 | 20:07 |
| *** chlong__ has joined #openstack-keystone | 20:09 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone-specs master: Remove pbr warnerrors in favor of sphinx check https://review.openstack.org/439914 | 20:15 |
| openstackgerrit | Sujitha proposed openstack/oslo.policy master: Allow multiline descriptions for RuleDefaults https://review.openstack.org/441342 | 20:15 |
| *** ayoung has quit IRC | 20:16 | |
| openstackgerrit | Gage Hugo proposed openstack/keystonemiddleware master: Added "warning-is-error" sphinx check for docs https://review.openstack.org/439819 | 20:22 |
| *** prashkre_ has quit IRC | 20:24 | |
| *** spotz_zzz is now known as spotz | 20:37 | |
| openstackgerrit | Merged openstack/pycadf master: Updated from global requirements https://review.openstack.org/440451 | 20:39 |
| *** rdo has joined #openstack-keystone | 20:45 | |
| *** spotz is now known as spotz_zzz | 20:47 | |
| openstackgerrit | Gage Hugo proposed openstack/python-keystoneclient master: Remove pbr warnerrors in favor of sphinx check https://review.openstack.org/441468 | 20:49 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Change is_admin_project to False by default https://review.openstack.org/438035 | 20:51 |
| knikolla | rodrigods: feedback appreciated on this https://review.openstack.org/#/c/441469 | 20:53 |
| *** rdo_ has joined #openstack-keystone | 20:54 | |
| *** rdo has quit IRC | 20:56 | |
| *** chlong__ has quit IRC | 20:57 | |
| *** dave-mccowan has quit IRC | 20:58 | |
| *** chris_hultin|AWA is now known as chris_hultin | 21:15 | |
| openstackgerrit | Merged openstack/keystone master: Fix duplicate handling for user-specified IDs https://review.openstack.org/438896 | 21:27 |
| *** jamielennox is now known as jamielennox|away | 21:29 | |
| *** chris_hultin is now known as chris_hultin|AWA | 21:34 | |
| *** thorst has quit IRC | 21:48 | |
| *** thorst has joined #openstack-keystone | 21:50 | |
| *** spilla has quit IRC | 21:50 | |
| *** rcernin has quit IRC | 21:51 | |
| *** thorst has quit IRC | 21:55 | |
| *** lucasxu has quit IRC | 22:00 | |
| *** h5t4 has quit IRC | 22:10 | |
| *** adrian_otto has joined #openstack-keystone | 22:15 | |
| *** h5t4_ has joined #openstack-keystone | 22:19 | |
| *** catintheroof has joined #openstack-keystone | 22:29 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone master: Updated from global requirements https://review.openstack.org/439219 | 22:50 |
| openstackgerrit | Merged openstack/keystone master: Remove password_expires_ignore_user_ids https://review.openstack.org/438208 | 23:05 |
| *** edmondsw_ has quit IRC | 23:15 | |
| *** edmondsw has joined #openstack-keystone | 23:16 | |
| *** edmondsw has quit IRC | 23:20 | |
| *** david-lyle_ is now known as david-lyle | 23:29 | |
| *** agrebennikov_ has quit IRC | 23:35 | |
| *** david-lyle has quit IRC | 23:47 | |
| *** h5t4_ has quit IRC | 23:52 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!