| *** stradling has joined #openstack-keystone | 00:27 | |
| *** zhurong has joined #openstack-keystone | 00:33 | |
| *** thorst has quit IRC | 00:33 | |
| *** stradling has quit IRC | 01:02 | |
| *** nicolasbock has joined #openstack-keystone | 01:10 | |
| *** thorst has joined #openstack-keystone | 01:34 | |
| *** thorst has quit IRC | 01:37 | |
| *** thorst has joined #openstack-keystone | 01:37 | |
| *** zhurong has quit IRC | 01:58 | |
| *** zhurong has joined #openstack-keystone | 02:10 | |
| *** aojea has joined #openstack-keystone | 02:13 | |
| *** aojea has quit IRC | 02:18 | |
| *** xuhaigang has quit IRC | 02:21 | |
| *** thorst has joined #openstack-keystone | 02:38 | |
| *** nicolasbock has quit IRC | 02:53 | |
| *** thorst has quit IRC | 02:57 | |
| *** catintheroof has joined #openstack-keystone | 03:43 | |
| *** catintheroof has quit IRC | 03:51 | |
| *** thorst has joined #openstack-keystone | 03:55 | |
| *** shu-mutou has joined #openstack-keystone | 03:55 | |
| *** rocky has joined #openstack-keystone | 03:56 | |
| *** thorst has quit IRC | 03:59 | |
| *** markvoelker has joined #openstack-keystone | 04:05 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Add federated support for get user https://review.openstack.org/448730 | 04:08 |
|---|---|---|
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Address comments from Policy in Code 5 https://review.openstack.org/448826 | 04:09 |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:22 | |
| *** thorst has joined #openstack-keystone | 04:55 | |
| *** rocky has quit IRC | 04:59 | |
| *** thorst has quit IRC | 05:00 | |
| *** rcernin has joined #openstack-keystone | 05:25 | |
| *** richm has quit IRC | 05:43 | |
| *** thorst has joined #openstack-keystone | 05:56 | |
| *** thorst has quit IRC | 06:00 | |
| *** pcaruana has joined #openstack-keystone | 06:01 | |
| *** namnh has joined #openstack-keystone | 06:43 | |
| *** tesseract has joined #openstack-keystone | 06:48 | |
| *** jaosorior has joined #openstack-keystone | 06:49 | |
| *** voelzmo has joined #openstack-keystone | 06:54 | |
| *** thorst has joined #openstack-keystone | 06:57 | |
| *** voelzmo has quit IRC | 06:59 | |
| *** thorst has quit IRC | 07:01 | |
| *** voelzmo has joined #openstack-keystone | 07:01 | |
| *** markvoelker has quit IRC | 07:12 | |
| *** markvoelker has joined #openstack-keystone | 07:15 | |
| *** voelzmo has quit IRC | 07:15 | |
| *** adriant has quit IRC | 07:35 | |
| *** shuyingya has joined #openstack-keystone | 07:38 | |
| *** voelzmo has joined #openstack-keystone | 07:43 | |
| *** Aqsa has joined #openstack-keystone | 07:51 | |
| *** thorst has joined #openstack-keystone | 07:58 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:01 | |
| *** thorst has quit IRC | 08:17 | |
| *** aojea has joined #openstack-keystone | 08:26 | |
| *** shu-mutou is now known as shu-mutou-AWAY | 08:59 | |
| *** thorst has joined #openstack-keystone | 09:14 | |
| *** thorst has quit IRC | 09:18 | |
| *** rocky_ has joined #openstack-keystone | 09:20 | |
| *** tovin07 has left #openstack-keystone | 09:47 | |
| *** richm has joined #openstack-keystone | 10:15 | |
| *** nicolasbock has joined #openstack-keystone | 10:22 | |
| *** namnh has quit IRC | 10:37 | |
| openstackgerrit | pawnesh kumar proposed openstack/keystone master: Add .idea pattern to .gitignore https://review.openstack.org/455228 | 10:38 |
| Aqsa | rodrigods: hi | 10:52 |
| *** raildo has joined #openstack-keystone | 10:59 | |
| *** raildo has quit IRC | 11:03 | |
| *** raildo has joined #openstack-keystone | 11:05 | |
| *** thorst has joined #openstack-keystone | 11:15 | |
| *** thorst has quit IRC | 11:20 | |
| *** jamielennox|away is now known as jamielennox | 11:25 | |
| openstackgerrit | XieYingYun proposed openstack/keystone master: Add Apache License Content in index.rst https://review.openstack.org/455263 | 11:30 |
| *** belmoreira has joined #openstack-keystone | 11:36 | |
| *** thorst has joined #openstack-keystone | 11:55 | |
| *** stradling has joined #openstack-keystone | 12:09 | |
| *** markvoelker has quit IRC | 12:10 | |
| *** rocky_ has quit IRC | 12:13 | |
| *** edmondsw has joined #openstack-keystone | 12:16 | |
| *** markvoelker has joined #openstack-keystone | 12:25 | |
| *** zhurong has quit IRC | 12:26 | |
| *** shuyingya has quit IRC | 12:34 | |
| *** catintheroof has joined #openstack-keystone | 12:36 | |
| ayoung | I'ma Devstackin'. I'ma Devstackin'. | 12:48 |
| *** rmascena has joined #openstack-keystone | 12:56 | |
| *** raildo has quit IRC | 12:58 | |
| *** shuyingya has joined #openstack-keystone | 13:08 | |
| *** shuyingya has quit IRC | 13:13 | |
| *** shuyingya has joined #openstack-keystone | 13:13 | |
| *** spilla has joined #openstack-keystone | 13:13 | |
| *** chlong has joined #openstack-keystone | 13:31 | |
| *** openstackgerrit has quit IRC | 13:33 | |
| ayoung | what is the new standard on API documentation? In the Keystone docs repo now, or somewhere else? | 13:36 |
| lbragstad | ayoung we keep the documentation in keystone/api-ref | 13:38 |
| lbragstad | s/documentation/api documentation/ | 13:38 |
| dstanek | g'morning | 13:38 |
| lbragstad | o/ | 13:39 |
| ayoung | lbragstad, and nothing new is supposed to go into ext, right? | 13:39 |
| lbragstad | ayoung what do you mean? | 13:40 |
| ayoung | lbragstad, for example, the changes https://review.openstack.org/401808 go into api-ref/source/v3/ | 13:40 |
| ayoung | we are no longer doing extensions, right | 13:40 |
| ayoung | or experimental in a separate tree, whatever | 13:40 |
| lbragstad | ayoung right | 13:41 |
| ayoung | OK. Any standards on what those docs are supposed to look like, or just "make them look like the existing ones" | 13:41 |
| lbragstad | ayoung the existing docs aren't the greatest | 13:42 |
| lbragstad | ayoung but use the existing ones as a guide | 13:42 |
| ayoung | lbragstad, adding new docs can be super frustrating if there are not a set of guidelines for what they are supposed to look like | 13:42 |
| ayoung | lots of churn on the code reviews | 13:42 |
| lbragstad | ayoung we've been fixing parts of it since we moved everything from -specs | 13:43 |
| lbragstad | ayoung i'd like to propose we have another API docs sprint to clean up *all* of it | 13:43 |
| ayoung | lbragstad, it is only fixed if we have a set of guidelines or standards to meet. Otherwise, it really is just a bunch of gut feelings | 13:43 |
| lbragstad | ayoung completely agree | 13:44 |
| lbragstad | ayoung that'd be another thing to work on during an API spring | 13:44 |
| lbragstad | defining, reviewing, and publishing those guidelines | 13:45 |
| dstanek | ayoung: what do you mean by supposed to look like? | 13:46 |
| *** rajpatel has joined #openstack-keystone | 13:47 | |
| ayoung | dstanek, I mean "If I do these things, I meet the standard and thus the api change should be merged" | 13:49 |
| ayoung | versus a long painful back and forth on gerrit about what should or should not be in a code change due to the changes to the API | 13:49 |
| *** shuyingya has quit IRC | 13:52 | |
| *** shuyingya has joined #openstack-keystone | 13:53 | |
| *** openstackgerrit has joined #openstack-keystone | 13:58 | |
| openstackgerrit | Jose Castro Leon proposed openstack/keystoneauth master: Allows to modify the behavior of mutual authentication in kerberos Adds an optional parameter that will allow a deployer to tune it on their environments https://review.openstack.org/455330 | 13:58 |
| *** ravelar has joined #openstack-keystone | 14:01 | |
| *** dave-mccowan has joined #openstack-keystone | 14:04 | |
| *** shuyingya has quit IRC | 14:09 | |
| *** dave-mccowan has quit IRC | 14:09 | |
| *** shuyingya has joined #openstack-keystone | 14:09 | |
| *** rajpatel has quit IRC | 14:14 | |
| openstackgerrit | ayoung proposed openstack/keystoneauth master: Parameter to tune mutual authentication in kerberos https://review.openstack.org/455330 | 14:15 |
| *** aloga has quit IRC | 14:18 | |
| *** aloga has joined #openstack-keystone | 14:18 | |
| *** aloga has quit IRC | 14:18 | |
| *** chris_hultin|AWA is now known as chris_hultin | 14:18 | |
| *** lucasxu has joined #openstack-keystone | 14:27 | |
| *** shuyingya has quit IRC | 14:28 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Validate rolling upgrade is run in order https://review.openstack.org/437441 | 14:37 |
| *** stingaci has joined #openstack-keystone | 14:42 | |
| *** belmoreira has quit IRC | 14:46 | |
| *** rcernin has quit IRC | 15:03 | |
| ayoung | knikolla, so it appears I never hooked up the routers in https://review.openstack.org/#/c/401808/14 | 15:07 |
| knikolla | ayoung: oh, i thought i had messed up my devstack somehow. | 15:08 |
| *** aojea has quit IRC | 15:09 | |
| *** gcb has joined #openstack-keystone | 15:09 | |
| ayoung | knikolla, nah, that was actually intentional at the time, as I was trying to do the patch in reviewable stages | 15:09 |
| ayoung | but i am adding it in now | 15:09 |
| knikolla | ayoung: ok cool. our talk is on wed, may 10. 4.30pm | 15:10 |
| *** rderose has joined #openstack-keystone | 15:10 | |
| gcb | lbragstad, our periodic job for Keystone has failures in http://logs.openstack.org/periodic/periodic-keystone-py27-with-oslo-master/b7ff181/testr_results.html.gz that should be related with oslo.config commit https://review.openstack.org/328692 | 15:12 |
| *** voelzmo has quit IRC | 15:13 | |
| *** voelzmo has joined #openstack-keystone | 15:13 | |
| lbragstad | gcb looks like we need to update keystone | 15:14 |
| lbragstad | gcb thanks for the heads up! | 15:14 |
| gcb | lbragstad, yeah, that should be easy to fix, It's too late for me, I just fix Cinder one in https://review.openstack.org/455152 and hold on new release of oslo.config in https://review.openstack.org/455318 | 15:15 |
| gcb | lbragstad, please help dig the issue from keystone side, will help dig tomorrow if we haven't fixed from keystone side :-) | 15:16 |
| lbragstad | gcb will do - i'll dig into it | 15:17 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L270 looks to be the only occurrence https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L270 | 15:17 |
| *** voelzmo has quit IRC | 15:18 | |
| gcb | lbragstad, thanks | 15:18 |
| *** stingaci has quit IRC | 15:25 | |
| *** rajpatel has joined #openstack-keystone | 15:30 | |
| *** rajpatel has quit IRC | 15:34 | |
| *** thorst is now known as thorst_afk | 15:35 | |
| *** Aqsa has quit IRC | 15:48 | |
| *** rderose has quit IRC | 15:52 | |
| *** ravelar has quit IRC | 15:55 | |
| breton | big problem with pymemcache is that it is barely packaged | 15:57 |
| breton | from example, CentOS 7 doesn't have HashClient there | 15:57 |
| *** rajpatel has joined #openstack-keystone | 15:58 | |
| lbragstad | cc morgan ^ | 15:59 |
| morgan | same as anything/everything for openstack, it is in g-r and can be used and will be packaged | 15:59 |
| morgan | have you checked EPEL? | 15:59 |
| breton | I mean, Ocata RDO doesn't have HashClient. CentOS 7 hasn't pymemcache at all. | 16:00 |
| *** lucasxu has quit IRC | 16:00 | |
| morgan | this is why we do the conversions early if anything | 16:00 |
| morgan | it can/will be packaged. | 16:00 |
| morgan | if we can only ever use things that are packaged, we would never move forward. | 16:00 |
| *** rajpatel has quit IRC | 16:00 | |
| morgan | it is https://github.com/openstack/requirements/blob/master/global-requirements.txt#L188 here | 16:01 |
| morgan | it is useable | 16:01 |
| morgan | and it will get packaged | 16:01 |
| breton | epel is 1.2.5 -> no HashClient | 16:01 |
| morgan | doesn't matter still. | 16:01 |
| morgan | but if the argument is "i don't want to", thats fine as well. | 16:02 |
| breton | well, it's a show-stopper for me now | 16:02 |
| morgan | it *will* be packaged. | 16:02 |
| morgan | it is part of the requirements for the project then. | 16:02 |
| morgan | the only reason it isn't packaged now is because no one is using it here. | 16:03 |
| morgan | in this case, just use it, next release will get it packaged | 16:03 |
| morgan | RDO isn't going to be based on Master | 16:03 |
| morgan | it willbe based on <stable/*> | 16:04 |
| morgan | similar to other packages | 16:04 |
| *** morgan sets mode: -o morgan | 16:08 | |
| *** rmascena is now known as raildo | 16:09 | |
| asettle | lbragstad: could you or Richard take a look at: https://bugs.launchpad.net/openstack-manuals/+bug/1680228 | 16:12 |
| openstack | Launchpad bug 1680228 in openstack-manuals "Install Guide missing --domain name parameter when creating role" [Undecided,New] | 16:12 |
| asettle | I was unable to verify | 16:12 |
| *** gyee has joined #openstack-keystone | 16:14 | |
| *** aloga has joined #openstack-keystone | 16:15 | |
| *** rajpatel has joined #openstack-keystone | 16:22 | |
| *** lamt has joined #openstack-keystone | 16:30 | |
| lbragstad | asettle will do | 16:34 |
| asettle | Gracias, gracias | 16:35 |
| *** Aqsa has joined #openstack-keystone | 16:35 | |
| *** lamt has quit IRC | 16:42 | |
| *** rajpatel has quit IRC | 16:44 | |
| ayoung | knikolla, Ok, I think I fooled myself | 16:46 |
| ayoung | I was looking at the wrong place. I did wire up the routers | 16:46 |
| *** jaosorior is now known as jaosorior_away | 16:51 | |
| *** aojea has joined #openstack-keystone | 16:51 | |
| lbragstad | asettle updated | 16:52 |
| *** tesseract has quit IRC | 16:52 | |
| *** lucasxu has joined #openstack-keystone | 17:02 | |
| *** rocky_ has joined #openstack-keystone | 17:03 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove usage of enforce_type https://review.openstack.org/455391 | 17:07 |
| lbragstad | gcb ^ that should get us started | 17:07 |
| lbragstad | gcb that will have to wait until keystone is using oslo.config 3.24 though before it will pass tests | 17:08 |
| lbragstad | gcb https://github.com/openstack/keystone/blob/2dbd5d99bbf71ad5c4a81f54e8d4ce0de258ab00/requirements.txt#L25 | 17:09 |
| *** thorst_afk is now known as thorst | 17:16 | |
| *** MaxPC has joined #openstack-keystone | 17:20 | |
| *** stingaci has joined #openstack-keystone | 17:26 | |
| *** lamt has joined #openstack-keystone | 17:28 | |
| *** stingaci has quit IRC | 17:30 | |
| *** stradling has quit IRC | 17:47 | |
| ayoung | morgan, can you give this the once over https://review.openstack.org/#/c/290253/ so it has some keystone review? | 17:55 |
| *** lamt has quit IRC | 17:56 | |
| *** stradling has joined #openstack-keystone | 17:58 | |
| *** aojea has quit IRC | 18:16 | |
| openstackgerrit | Merged openstack/keystone master: Updated from global requirements https://review.openstack.org/453881 | 18:17 |
| knikolla | ayoung: actually IIRC, i think you hadn't hooked it up, but I did when I revised the patch. | 18:21 |
| ayoung | knikolla, ah | 18:22 |
| ayoung | knikolla, that makes sense | 18:22 |
| ayoung | I was wondering about that. Was origianlly doing it in stages. Lost track of how far I'd gotten | 18:22 |
| morgan | ayoung: i'll review it in a couple minutes | 18:23 |
| ayoung | morgan, thanks | 18:23 |
| *** stradling has quit IRC | 18:44 | |
| openstackgerrit | Kristi Nikolla proposed openstack/python-keystoneclient master: WIP - Client functions for url_patterns https://review.openstack.org/452893 | 18:59 |
| knikolla | ayoung: ^^ | 18:59 |
| ayoung | knikolla, Thanks | 19:00 |
| ayoung | let me grab that for my devstack | 19:00 |
| *** stradling has joined #openstack-keystone | 19:06 | |
| *** MaxPC has quit IRC | 19:06 | |
| *** edmondsw_ has joined #openstack-keystone | 19:15 | |
| *** edmondsw_ has quit IRC | 19:15 | |
| knikolla | ayoung: in keystone/unit/tests/assignment/test_core.py why is there test_deleting_role_removes_inference_rule and test_implied_role_crd? | 19:26 |
| ayoung | hmmm | 19:34 |
| ayoung | knikolla, cuz I wanted to tes that those things worked? | 19:35 |
| ayoung | knikolla, if I have a role X which implied member, and I assigned it to someone, and I delete the role X, the user should no longer have the member role | 19:36 |
| ayoung | all the implied role stuff is in the assignemnt backend | 19:36 |
| knikolla | ayoung: i mean why are there in the rbac patch. its functionality not introduced by it. | 19:36 |
| *** rajpatel has joined #openstack-keystone | 19:36 | |
| ayoung | probably because they were in my repo and I didn't realize they were still there? OProbably squashed them into the patch by mistake | 19:37 |
| ayoung | but they could and should be spun out to their own patch | 19:37 |
| knikolla | ayoung: ok, will remove them from the rbac patch. just wanted to confirm | 19:37 |
| ayoung | cool | 19:37 |
| ayoung | jamielennox, I know it is early, but got a Keystoneclient question for you. Trying to create a client based on the envvars set by the .rc file | 19:43 |
| ayoung | parser = argparse.ArgumentParser( | 19:44 |
| ayoung | description='Simple HTTP testing for Openstack') | 19:44 |
| ayoung | loading.register_session_argparse_arguments(parser) | 19:44 |
| ayoung | loading.register_auth_argparse_arguments(parser, sys.argv[1:]) | 19:44 |
| ayoung | opts = parser.parse_args() | 19:44 |
| ayoung | auth = loading.load_auth_from_argparse_arguments(opts) | 19:44 |
| ayoung | session = loading.load_session_from_argparse_arguments( | 19:44 |
| ayoung | opts, | 19:44 |
| ayoung | auth=auth, | 19:44 |
| ayoung | user_agent='os-http') | 19:44 |
| ayoung | keystone = keystone_v3.Client(session=session) | 19:44 |
| ayoung | or anyone else here | 19:44 |
| ayoung | sorry for the flood, | 19:44 |
| ayoung | anyway, that code should create a client, but trying to use it gets | 19:46 |
| ayoung | keystoneauth1.exceptions.auth_plugins.MissingAuthPlugin: An auth plugin is required to determine endpoint URL | 19:46 |
| ayoung | however, with the env vars set, I can use the openstack cli to listroles: | 19:47 |
| ayoung | openstack role list returns just right | 19:47 |
| ayoung | Do we have a decent example of creating a client this way? | 19:48 |
| *** rajpatel has quit IRC | 19:57 | |
| ayoung | knikolla, seems to work | 20:00 |
| knikolla | ayoung: :) | 20:02 |
| *** raildo has quit IRC | 20:04 | |
| *** lamt has joined #openstack-keystone | 20:08 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: URL pattern based RBAC Management Interface https://review.openstack.org/401808 | 20:22 |
| openstackgerrit | Merged openstack/keystone-specs master: Unified limits specification https://review.openstack.org/440815 | 20:24 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Remove LDAP delete logic and associated tests https://review.openstack.org/424344 | 20:32 |
| openstackgerrit | Sam Yaple proposed openstack/keystone master: DONOTMERGE - LOCI zuul-cloner test https://review.openstack.org/453933 | 20:34 |
| *** lamt has quit IRC | 20:43 | |
| jamielennox | ayoung: so that should work for CLI - but we are typically suggesting that people use os-c-c rather that the ksa argparse stuff | 20:46 |
| jamielennox | but it will work | 20:46 |
| jamielennox | the env vars should work with ksa, os-c-c gives you the yaml stuff | 20:46 |
| jamielennox | the thing i can think of is that osc defaults OS_AUTH_TYPE=password and ksa doesn't | 20:48 |
| jamielennox | in ksa you must give an OS_AUTH_TYPE var | 20:48 |
| openstackgerrit | Merged openstack/keystone master: Add Apache License Content in index.rst https://review.openstack.org/455263 | 20:50 |
| openstackgerrit | Merged openstack/keystone master: Remove unused revocation check in revoke_models https://review.openstack.org/451452 | 20:50 |
| *** aojea has joined #openstack-keystone | 20:51 | |
| *** Aqsa has quit IRC | 20:53 | |
| openstackgerrit | Merged openstack/keystone master: Address comments from Policy in Code 5 https://review.openstack.org/448826 | 20:56 |
| *** stradling has quit IRC | 20:57 | |
| *** thorst has quit IRC | 21:03 | |
| *** edmondsw has quit IRC | 21:08 | |
| *** spilla has quit IRC | 21:09 | |
| *** edmondsw has joined #openstack-keystone | 21:10 | |
| *** rajpatel has joined #openstack-keystone | 21:11 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: WIP - Document functional testing and devstack plugin https://review.openstack.org/448773 | 21:13 |
| *** edmondsw has quit IRC | 21:15 | |
| *** pcaruana has quit IRC | 21:15 | |
| *** catintheroof has quit IRC | 21:25 | |
| *** pramodrj07 has joined #openstack-keystone | 21:32 | |
| *** MasterOfBugs has joined #openstack-keystone | 21:32 | |
| *** lucasxu has quit IRC | 21:40 | |
| *** sjain has joined #openstack-keystone | 21:40 | |
| *** sjain has quit IRC | 21:57 | |
| *** lamt has joined #openstack-keystone | 22:02 | |
| openstackgerrit | Merged openstack/keystoneauth master: Updated from global requirements https://review.openstack.org/445086 | 22:06 |
| openstackgerrit | Merged openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/439318 | 22:07 |
| *** catintheroof has joined #openstack-keystone | 22:27 | |
| *** lamt has quit IRC | 22:31 | |
| *** hoonetorg has joined #openstack-keystone | 22:39 | |
| *** aojea has quit IRC | 22:48 | |
| *** edmondsw has joined #openstack-keystone | 22:53 | |
| *** edmondsw has quit IRC | 22:57 | |
| *** thorst has joined #openstack-keystone | 23:02 | |
| *** adriant has joined #openstack-keystone | 23:03 | |
| *** sjain has joined #openstack-keystone | 23:04 | |
| *** lamt has joined #openstack-keystone | 23:09 | |
| ayoung | jamielennox, yeah, but I am still coding | 23:25 |
| ayoung | we don't have a CLI for this new code yet, so I need to give an example using the python-keystoneclient | 23:26 |
| jamielennox | ayoung: that looks right for ksc | 23:27 |
| ayoung | jamielennox, didn't work | 23:27 |
| jamielennox | you can use ksa with ksc | 23:27 |
| ayoung | I had to do | 23:27 |
| ayoung | auth = v3.Password(auth_url='http://192.168.122.180:35357/v3', | 23:27 |
| ayoung | username='admin', | 23:27 |
| ayoung | password='FreeIPA4All', | 23:27 |
| ayoung | project_name='demo', | 23:27 |
| ayoung | user_domain_name='default', | 23:27 |
| ayoung | project_domain_name='default') | 23:27 |
| jamielennox | and you set an OS_AUTH_TYPE=password | 23:27 |
| *** jdennis has joined #openstack-keystone | 23:27 | |
| ayoung | ah, you think I just need that one more value? | 23:27 |
| ayoung | let me try that | 23:27 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Support new hashing algorithms for securely storing password hashes https://review.openstack.org/438701 | 23:27 |
| jamielennox | ayoung: os-http is the simplest example i have of this using os-c-c | 23:27 |
| ayoung | jamielennox, yep thanks | 23:28 |
| *** lamt has quit IRC | 23:29 | |
| ayoung | jamielennox, just trying to do development with changes on keystone server, keystoneclient, and keystone middleware for the RBAC in middelware proof of concept | 23:29 |
| ayoung | jamielennox, any strong feelings on RBAC from middleware? https://review.openstack.org/#/c/452198/ | 23:30 |
| ayoung | jamielennox, and, I assume it is too much to hope that you are coming to Boston, right> | 23:31 |
| ayoung | ? | 23:31 |
| jamielennox | ayoung: no boston for me ;( | 23:31 |
| jamielennox | talk rejected, and even then i'm not sure i would have been approved | 23:32 |
| ayoung | jamielennox, I knew this was going to happen when they split off the PTG | 23:32 |
| jamielennox | doesn't appear to be much developer funding for boston | 23:32 |
| jamielennox | ayoung: yep, it was fairly predictable | 23:32 |
| ayoung | My talk is accepted, but not sure it is going to matter, as all the people that should be there won't be there | 23:32 |
| jamielennox | ayoung: my main concern with RBAC from middleware is the same as always - i think the lookup is going to be really slow | 23:32 |
| jamielennox | particularly now that nova and everyone is moving towards policy in code and decorators for policy | 23:33 |
| *** lamt has joined #openstack-keystone | 23:33 | |
| ayoung | jamielennox, what aspect do you think is going to be slow? The HTTP fetch, or the pattern matching? | 23:35 |
| jamielennox | well, http fetch is always an issue - but pattern matching | 23:35 |
| ayoung | So, I think that is going to be pretty quick | 23:36 |
| ayoung | it will be basically the same cost as selecting the route is now | 23:36 |
| ayoung | and, for the vast majority, I bet they use the default rule any way | 23:36 |
| openstackgerrit | Tin Lam proposed openstack/keystonemiddleware master: Replace pycrypto with cryptography https://review.openstack.org/451941 | 23:39 |
| *** sjain has quit IRC | 23:41 | |
| openstackgerrit | Samriddhi proposed openstack/keystone master: Updated scope parameter description in v3 API-ref https://review.openstack.org/450038 | 23:42 |
| ayoung | jamielennox, so, I think that, in future iterations, the URL pattern match and the RBAC lookup could be done at the same time, as a performance tune. You could pre-match the rules against the Routers, or something, so you only end up matching once | 23:42 |
| jamielennox | ayoung: agreed - but that's not middleware | 23:42 |
| ayoung | jamielennox, its a performance tune if, and only if, it proves to be an issue | 23:42 |
| ayoung | we won't know until someone tries it | 23:42 |
| ayoung | I can't see that the pattern match would be signficantly different than any other dictionary lookup in Python, though | 23:43 |
| ayoung | and those are legion | 23:43 |
| ayoung | We can probably also pay the price per URL once and somehow pre-calculate the matches for later URLs...hand wave hand wave | 23:44 |
| *** lamt has quit IRC | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!