| *** spotz_ has joined #openstack-keystone | 00:00 | |
| *** spotz_ has quit IRC | 00:04 | |
| *** spotz_ has joined #openstack-keystone | 00:05 | |
| *** kalyan_ has joined #openstack-keystone | 00:09 | |
| kalyan_ | Hi i'm using "https://docs.openstack.org/developer/python-keystoneclient/using-sessions.html" this document for sessions, my question is does a session varibale created here have an expiry. if it does how do i get it | 00:10 |
|---|---|---|
| kalyan_ | https://docs.openstack.org/developer/python-keystoneclient/using-sessions.html | 00:14 |
| *** gyee has quit IRC | 00:30 | |
| *** thorst has joined #openstack-keystone | 00:32 | |
| *** zhugaoxiao has quit IRC | 00:47 | |
| *** zhugaoxiao has joined #openstack-keystone | 00:47 | |
| *** lamt has joined #openstack-keystone | 00:49 | |
| *** jdwidari has quit IRC | 00:58 | |
| *** hyakuhei has quit IRC | 01:00 | |
| *** MasterOfBugs has quit IRC | 01:03 | |
| *** lamt has quit IRC | 01:08 | |
| *** kalyan_ has quit IRC | 01:10 | |
| lbragstad | kalyan_ i don't believe it does but jamielennox would probably be able to give you a better answer | 01:10 |
| *** lamt has joined #openstack-keystone | 01:12 | |
| *** adrian_otto has joined #openstack-keystone | 01:13 | |
| *** lamt has quit IRC | 01:13 | |
| *** thorst has quit IRC | 01:17 | |
| *** adrian_otto1 has joined #openstack-keystone | 01:20 | |
| *** adrian_otto has quit IRC | 01:21 | |
| *** adrian_otto1 has quit IRC | 01:23 | |
| *** hyakuhei has joined #openstack-keystone | 01:35 | |
| *** dikonoor has joined #openstack-keystone | 01:38 | |
| *** zhurong has joined #openstack-keystone | 01:50 | |
| *** adrian_otto has joined #openstack-keystone | 01:56 | |
| *** stingaci has quit IRC | 01:57 | |
| *** dikonoor has quit IRC | 01:58 | |
| *** stingaci has joined #openstack-keystone | 01:58 | |
| *** stingaci has quit IRC | 02:03 | |
| *** adrian_otto has quit IRC | 02:07 | |
| *** adrian_otto has joined #openstack-keystone | 02:07 | |
| *** spotz is now known as spotz_zzz | 02:17 | |
| *** thorst has joined #openstack-keystone | 02:18 | |
| *** thorst has quit IRC | 02:22 | |
| *** spotz_zzz has quit IRC | 02:33 | |
| *** thorst has joined #openstack-keystone | 02:49 | |
| *** MasterOfBugs has joined #openstack-keystone | 02:50 | |
| *** edmondsw has quit IRC | 02:58 | |
| *** Shunli has joined #openstack-keystone | 02:59 | |
| *** lamt has joined #openstack-keystone | 03:01 | |
| *** lamt has quit IRC | 03:07 | |
| *** thorst has quit IRC | 03:08 | |
| *** lamt has joined #openstack-keystone | 03:11 | |
| *** gongysh has joined #openstack-keystone | 03:17 | |
| *** zhurong has quit IRC | 03:21 | |
| *** adrian_otto has quit IRC | 03:24 | |
| *** hyakuhei has quit IRC | 03:32 | |
| *** hyakuhei has joined #openstack-keystone | 03:35 | |
| *** tovin07 has quit IRC | 03:35 | |
| jamielennox | no kalyan - but no there's no expiry on the session | 03:39 |
| jamielennox | there is expiry on the auth plugin based on the token you get, there is a function to test that | 03:40 |
| *** adrian_otto has joined #openstack-keystone | 03:50 | |
| *** nicolasbock has quit IRC | 04:13 | |
| *** tovin07 has joined #openstack-keystone | 04:14 | |
| *** dikonoor has joined #openstack-keystone | 04:20 | |
| *** faizy has joined #openstack-keystone | 04:53 | |
| *** ducttape_ has joined #openstack-keystone | 04:59 | |
| *** thorst has joined #openstack-keystone | 05:05 | |
| *** ducttape_ has quit IRC | 05:09 | |
| *** thorst has quit IRC | 05:09 | |
| *** gongysh has quit IRC | 05:11 | |
| *** lamt has quit IRC | 05:34 | |
| *** faizy has quit IRC | 05:35 | |
| *** faizy has joined #openstack-keystone | 05:36 | |
| *** richm has quit IRC | 05:43 | |
| *** zsli_ has joined #openstack-keystone | 05:48 | |
| *** Shunli has quit IRC | 05:51 | |
| *** zhurong has joined #openstack-keystone | 05:52 | |
| *** adrian_otto has quit IRC | 05:59 | |
| *** zhurong has quit IRC | 06:01 | |
| *** adrian_otto has joined #openstack-keystone | 06:01 | |
| *** thorst has joined #openstack-keystone | 06:06 | |
| *** thorst has quit IRC | 06:06 | |
| *** thorst has joined #openstack-keystone | 06:08 | |
| *** Shunli has joined #openstack-keystone | 06:08 | |
| *** prashkre has joined #openstack-keystone | 06:08 | |
| *** zsli_ has quit IRC | 06:11 | |
| *** thorst has quit IRC | 06:12 | |
| *** Shunli has quit IRC | 06:13 | |
| *** adrian_otto has quit IRC | 06:14 | |
| *** jaosorior_away is now known as jaosorior | 06:16 | |
| *** gongysh has joined #openstack-keystone | 06:18 | |
| *** sjain has joined #openstack-keystone | 06:18 | |
| openstackgerrit | Hemanth Nakkina proposed openstack/keystone master: Add response examples to OS-OAUTH1 api documentation https://review.openstack.org/459528 | 06:37 |
| *** sjain has quit IRC | 06:39 | |
| *** Aqsa has joined #openstack-keystone | 06:39 | |
| *** voelzmo has joined #openstack-keystone | 06:54 | |
| *** stingaci has joined #openstack-keystone | 06:59 | |
| *** voelzmo has quit IRC | 07:00 | |
| *** arturb has quit IRC | 07:02 | |
| *** kornicameister has quit IRC | 07:03 | |
| *** voelzmo has joined #openstack-keystone | 07:08 | |
| *** thorst has joined #openstack-keystone | 07:12 | |
| *** stingaci has quit IRC | 07:15 | |
| *** thorst has quit IRC | 07:17 | |
| *** Administrator_ has joined #openstack-keystone | 07:18 | |
| *** zhugaoxiao has quit IRC | 07:21 | |
| *** g0d355__ has quit IRC | 07:26 | |
| *** pcaruana has joined #openstack-keystone | 07:32 | |
| *** stingaci has joined #openstack-keystone | 07:35 | |
| *** stingaci has quit IRC | 07:40 | |
| *** voelzmo has quit IRC | 07:45 | |
| *** voelzmo has joined #openstack-keystone | 07:54 | |
| *** Shunli has joined #openstack-keystone | 07:59 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:01 | |
| *** arturb has joined #openstack-keystone | 08:10 | |
| *** voelzmo has quit IRC | 08:13 | |
| *** thorst has joined #openstack-keystone | 08:13 | |
| *** voelzmo has joined #openstack-keystone | 08:21 | |
| *** voelzmo has quit IRC | 08:22 | |
| *** voelzmo has joined #openstack-keystone | 08:29 | |
| *** voelzmo has quit IRC | 08:32 | |
| *** markvoelker has quit IRC | 08:32 | |
| *** thorst has quit IRC | 08:32 | |
| *** voelzmo has joined #openstack-keystone | 08:34 | |
| *** sjain has joined #openstack-keystone | 08:37 | |
| *** edmondsw has joined #openstack-keystone | 08:45 | |
| *** edmondsw has quit IRC | 08:49 | |
| *** gongysh has quit IRC | 08:58 | |
| *** prashkre has quit IRC | 09:07 | |
| *** sjain has quit IRC | 09:12 | |
| *** gongysh has joined #openstack-keystone | 09:16 | |
| openstackgerrit | zhengliuyang proposed openstack/python-keystoneclient master: Remove unused log https://review.openstack.org/459607 | 09:18 |
| *** mvk has quit IRC | 09:22 | |
| *** MasterOfBugs has quit IRC | 09:23 | |
| *** thorst has joined #openstack-keystone | 09:29 | |
| *** Shunli has quit IRC | 09:30 | |
| *** markvoelker has joined #openstack-keystone | 09:33 | |
| *** thorst has quit IRC | 09:34 | |
| *** markvoelker has quit IRC | 09:38 | |
| *** voelzmo has quit IRC | 09:40 | |
| *** Administrator_ has quit IRC | 09:55 | |
| *** Administrator_ has joined #openstack-keystone | 09:55 | |
| *** mvk has joined #openstack-keystone | 09:58 | |
| *** gongysh has quit IRC | 10:08 | |
| *** nicolasbock has joined #openstack-keystone | 10:12 | |
| *** richm has joined #openstack-keystone | 10:15 | |
| *** lamt has joined #openstack-keystone | 10:22 | |
| *** edmondsw has joined #openstack-keystone | 10:33 | |
| *** markvoelker has joined #openstack-keystone | 10:34 | |
| openstackgerrit | Hemanth Nakkina proposed openstack/keystone master: Add response examples to OS-OAUTH1 api documentation https://review.openstack.org/459528 | 10:36 |
| *** edmondsw has quit IRC | 10:37 | |
| *** markvoelker has quit IRC | 10:38 | |
| *** voelzmo has joined #openstack-keystone | 11:02 | |
| *** raildo has joined #openstack-keystone | 11:05 | |
| *** thorst has joined #openstack-keystone | 11:10 | |
| *** dave-mccowan has joined #openstack-keystone | 11:26 | |
| *** arturb has quit IRC | 11:26 | |
| *** voelzmo has quit IRC | 11:33 | |
| *** markvoelker has joined #openstack-keystone | 11:35 | |
| *** ducttape_ has joined #openstack-keystone | 11:36 | |
| *** markvoelker has quit IRC | 11:39 | |
| *** voelzmo has joined #openstack-keystone | 11:40 | |
| *** ducttape_ has quit IRC | 11:40 | |
| *** dave-mccowan has quit IRC | 11:41 | |
| *** catintheroof has joined #openstack-keystone | 11:48 | |
| *** pcaruana has quit IRC | 11:51 | |
| *** ducttape_ has joined #openstack-keystone | 11:55 | |
| *** pcaruana has joined #openstack-keystone | 11:56 | |
| *** ducttap__ has joined #openstack-keystone | 11:57 | |
| *** ducttape_ has quit IRC | 11:57 | |
| *** Aqsam has joined #openstack-keystone | 11:58 | |
| *** Aqsa has quit IRC | 11:59 | |
| *** faizy_ has joined #openstack-keystone | 11:59 | |
| *** faizy_ has quit IRC | 12:00 | |
| *** faizy_ has joined #openstack-keystone | 12:01 | |
| *** faizy has quit IRC | 12:02 | |
| *** ducttap__ has quit IRC | 12:03 | |
| *** ducttape_ has joined #openstack-keystone | 12:04 | |
| *** ducttap__ has joined #openstack-keystone | 12:05 | |
| *** ducttape_ has quit IRC | 12:05 | |
| *** ducttap__ has quit IRC | 12:07 | |
| *** dave-mccowan has joined #openstack-keystone | 12:07 | |
| *** ducttape_ has joined #openstack-keystone | 12:08 | |
| *** catintheroof has quit IRC | 12:08 | |
| *** ducttape_ has quit IRC | 12:13 | |
| *** stingaci has joined #openstack-keystone | 12:15 | |
| *** ayoung has quit IRC | 12:17 | |
| *** chlong has quit IRC | 12:20 | |
| *** arturb has joined #openstack-keystone | 12:26 | |
| *** edmondsw has joined #openstack-keystone | 12:26 | |
| *** edmondsw has quit IRC | 12:27 | |
| *** edmondsw has joined #openstack-keystone | 12:28 | |
| *** stingaci has quit IRC | 12:30 | |
| *** ayoung has joined #openstack-keystone | 12:31 | |
| *** markvoelker has joined #openstack-keystone | 12:35 | |
| *** markvoelker has quit IRC | 12:40 | |
| *** sjain has joined #openstack-keystone | 12:41 | |
| *** sjain has quit IRC | 12:48 | |
| cmurphy | samueldmq: you are a review machine | 12:50 |
| *** pcaruana has quit IRC | 12:50 | |
| samueldmq | cmurphy: hehe trying to get things done! :D | 12:50 |
| samueldmq | cmurphy: you make it much easier when you review it in first place | 12:51 |
| cmurphy | haha | 12:52 |
| *** pcaruana has joined #openstack-keystone | 12:53 | |
| *** markvoelker has joined #openstack-keystone | 12:53 | |
| *** catintheroof has joined #openstack-keystone | 13:01 | |
| openstackgerrit | Gage Hugo proposed openstack/keystoneauth master: Uncomment warning-is-error for doc building https://review.openstack.org/459673 | 13:02 |
| openstackgerrit | Merged openstack/keystone master: Trivial Fix: fix typo in test comments https://review.openstack.org/458427 | 13:04 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone master: Readability enhancements to architecture doc https://review.openstack.org/422375 | 13:06 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone master: Readability enhancements to architecture doc https://review.openstack.org/422375 | 13:09 |
| *** sjain has joined #openstack-keystone | 13:10 | |
| *** Aqsa has joined #openstack-keystone | 13:28 | |
| *** sjain has quit IRC | 13:29 | |
| *** Aqsam has quit IRC | 13:30 | |
| openstackgerrit | Merged openstack/keystone master: Include sample policy file in documentation https://review.openstack.org/458677 | 13:31 |
| openstackgerrit | Merged openstack/keystone master: Move policy generator config to config-generator/ https://review.openstack.org/458930 | 13:31 |
| *** ducttape_ has joined #openstack-keystone | 13:32 | |
| *** chlong has joined #openstack-keystone | 13:40 | |
| *** pcaruana has quit IRC | 13:43 | |
| *** ducttape_ has quit IRC | 13:44 | |
| *** pcaruana has joined #openstack-keystone | 13:55 | |
| *** adrian_otto has joined #openstack-keystone | 14:01 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Do not fetch group assignments without groups https://review.openstack.org/459705 | 14:05 |
| *** adrian_otto has quit IRC | 14:08 | |
| *** adrian_otto has joined #openstack-keystone | 14:09 | |
| *** ducttape_ has joined #openstack-keystone | 14:11 | |
| *** adrian_otto has quit IRC | 14:14 | |
| *** arunkant_ has joined #openstack-keystone | 14:20 | |
| *** ducttape_ has quit IRC | 14:20 | |
| *** arunkant has quit IRC | 14:24 | |
| *** mvk has quit IRC | 14:46 | |
| *** dikonoor has quit IRC | 14:47 | |
| *** stingaci has joined #openstack-keystone | 15:12 | |
| *** stingaci has quit IRC | 15:14 | |
| *** stingaci has joined #openstack-keystone | 15:16 | |
| *** stingaci has quit IRC | 15:17 | |
| openstackgerrit | Merged openstack/keystone master: Add response examples to OS-OAUTH1 api documentation https://review.openstack.org/459528 | 15:22 |
| *** rderose has joined #openstack-keystone | 15:26 | |
| *** ducttape_ has joined #openstack-keystone | 15:29 | |
| *** rderose has quit IRC | 15:44 | |
| *** Aqsa has quit IRC | 15:45 | |
| *** adrian_otto has joined #openstack-keystone | 15:57 | |
| *** ducttap__ has joined #openstack-keystone | 15:59 | |
| *** ducttape_ has quit IRC | 15:59 | |
| *** rderose has joined #openstack-keystone | 16:00 | |
| *** ducttap__ has quit IRC | 16:03 | |
| *** chlong has quit IRC | 16:10 | |
| *** chlong has joined #openstack-keystone | 16:24 | |
| *** mvk has joined #openstack-keystone | 16:31 | |
| *** adrian_otto has quit IRC | 16:33 | |
| *** pcaruana has quit IRC | 16:39 | |
| openstackgerrit | Merged openstack/keystone master: Do not fetch group assignments without groups https://review.openstack.org/459705 | 16:40 |
| *** voelzmo has quit IRC | 16:46 | |
| *** gyee has joined #openstack-keystone | 16:50 | |
| *** clenimar has joined #openstack-keystone | 16:58 | |
| *** sjain_ has joined #openstack-keystone | 17:03 | |
| *** rderose has quit IRC | 17:03 | |
| sjain_ | Hi, I'm a new contributor and I made my first contribution here, https://review.openstack.org/#/c/450038/ | 17:05 |
| sjain_ | It would be great if anyone could review the changes made, thanks! | 17:05 |
| samueldmq | lbragstad: dstanek ^ should be an easy review/approval | 17:06 |
| samueldmq | sjain_: hi! | 17:07 |
| sjain_ | @samueldmq, hi! | 17:07 |
| sjain_ | anymore changes needed here? | 17:07 |
| lbragstad | sjain_ sounds good - i'll add it to my queue today | 17:08 |
| ayoung | samueldmq, sjain_ +2A. Very Nice. Well done | 17:09 |
| sjain_ | oh great, thanks! | 17:09 |
| samueldmq | ayoung: thanks. sjain_ will likely be one of our contributors in the context of Outreachy this year | 17:09 |
| *** browne has joined #openstack-keystone | 17:10 | |
| sjain_ | thank you @ayoung, @samueldmq, @ lbragstad | 17:10 |
| *** stingaci has joined #openstack-keystone | 17:13 | |
| ayoung | samueldmq, sjain_ since I was reponsible for the explict unscope request feature, I felt an obligation to review | 17:15 |
| ayoung | sjain_, do you have a set of tasks lined up? | 17:16 |
| edmondsw | isn't it meeting time? | 17:16 |
| ayoung | edmondsw, 45 I thought... | 17:16 |
| ayoung | Tuesdays at 18:00 UTC | 17:16 |
| lbragstad | edmondsw in 45 minutes | 17:16 |
| ayoung | what is that... | 17:16 |
| edmondsw | doh, I could have sworn I already accounted for DST in my calendar reminder | 17:17 |
| lbragstad | right now it's 17:17 UTC | 17:17 |
| sjain_ | @ayoung, what kind of tasks, regarding outreachy? | 17:17 |
| ayoung | sjain_, yeah, Keystone development work? | 17:17 |
| *** oomichi has joined #openstack-keystone | 17:17 | |
| sjain_ | yeah the outreachy period starts from May 30, the results are not declared yet | 17:18 |
| sjain_ | but we made a rough timeline, on different docs to be targetted | 17:18 |
| *** jaosorior is now known as jaosorior_away | 17:19 | |
| ayoung | sjain_, cool | 17:19 |
| ayoung | just docs, no coding sjain_ ? | 17:19 |
| sjain_ | I think the best step to start would be finalising those first | 17:20 |
| *** phalmos has joined #openstack-keystone | 17:20 | |
| samueldmq | ayoung: yeah the idea is docs, but she will need to deploy and try things | 17:22 |
| samueldmq | a few patches fixing things in parallel (as she finds issues in the code) doesn't hurt | 17:23 |
| *** sjain_ has quit IRC | 17:24 | |
| *** sjain has joined #openstack-keystone | 17:26 | |
| *** MasterOfBugs has joined #openstack-keystone | 17:28 | |
| samueldmq | lbragstad: edmondsw: ayoung: do any of you remind where the next PTG is going to be ? | 17:34 |
| edmondsw | samueldmq last I heard they were still debating between 2 places | 17:34 |
| edmondsw | I think one was Denver and the other somewhere in Canada | 17:35 |
| lbragstad | the announcement came out that it is going to be in Denver | 17:35 |
| samueldmq | edmondsw: didn't they announce Denver in the last day of the Atlanta PTG? | 17:35 |
| lbragstad | there way an email about it | 17:35 |
| samueldmq | lbragstad: edmondsw thanks! | 17:35 |
| lbragstad | https://openstack.nimeyo.com/110956/openstack-dev-save-the-date-queens-ptg | 17:36 |
| samueldmq | lbragstad: yeah, September 11th-15th | 17:36 |
| samueldmq | ++ | 17:36 |
| edmondsw | I must have missed that... tx lbragstad | 17:36 |
| lbragstad | yup! | 17:37 |
| *** chlong has quit IRC | 17:37 | |
| *** ayoung has quit IRC | 17:45 | |
| *** spilla has joined #openstack-keystone | 17:53 | |
| *** chlong has joined #openstack-keystone | 17:53 | |
| *** sjain has quit IRC | 17:53 | |
| *** ayoung has joined #openstack-keystone | 18:02 | |
| *** adrian_otto has joined #openstack-keystone | 18:26 | |
| openstackgerrit | Merged openstack/keystone master: Updated scope parameter description in v3 API-ref https://review.openstack.org/450038 | 18:30 |
| *** spilla has quit IRC | 18:38 | |
| *** spilla has joined #openstack-keystone | 18:39 | |
| *** thorst_ has joined #openstack-keystone | 18:40 | |
| *** thorst has quit IRC | 18:43 | |
| *** thorst_ is now known as thorst | 18:44 | |
| *** adrian_otto has quit IRC | 18:52 | |
| *** spilla_ has joined #openstack-keystone | 18:56 | |
| *** spilla has quit IRC | 18:59 | |
| ayoung | samueldmq, anyway, let me not spend another hour going through this one-on-one | 19:00 |
| samueldmq | ayoung: let's keep discussing tomorrow? | 19:00 |
| samueldmq | ayoung: in the meeting? | 19:00 |
| ayoung | I can't afford that. It was why I wanted the video conf last week, and it is why we are presenting at the summit | 19:00 |
| samueldmq | ayoung: Ok. I will try to talk to folks and create a list with main concerns | 19:01 |
| ayoung | samueldmq, do you have a gmail account? I can show you the slides | 19:01 |
| samueldmq | ayoung: yes the one in my gerrit account, will send in PM too | 19:02 |
| samueldmq | \q ayoung | 19:02 |
| samueldmq | hmm | 19:02 |
| samueldmq | ayoung: thanks | 19:03 |
| dstanek | ayoung: i've definitely warmed up to the idea of middleware based role checks | 19:10 |
| *** edmondsw has quit IRC | 19:19 | |
| *** MasterOfBugs has quit IRC | 19:19 | |
| ayoung | dstanek, so, lets talk about your revulsion to the URL based aspect. Is that just because we already have something? | 19:21 |
| ayoung | If we were tabular rasa, would you be OK with an URL base approach? | 19:21 |
| *** edmondsw has joined #openstack-keystone | 19:21 | |
| *** edmondsw has quit IRC | 19:26 | |
| *** catinthe_ has joined #openstack-keystone | 19:28 | |
| dstanek | ayoung: in my mind is breaks rest constraints. it also makes it harder for URLs that actually do multiple things | 19:30 |
| *** catintheroof has quit IRC | 19:30 | |
| ayoung | dstanek, explain that first point, please? | 19:30 |
| dstanek | ayoung: it sort of enforces the need to know URLs ahead of time. I know we're not good at HATEOAS, but I had my hopes. | 19:32 |
| dstanek | i was thinking about adding a patch on top of what you guys were doing to show how we could make it about operations. | 19:32 |
| ayoung | dstanek, no, you only need to know the URL once you want to call it, or once you want to pass it to something else | 19:32 |
| dstanek | sort of a parting gift | 19:32 |
| ayoung | ideally, just looking at the URL would say "Ah, there is the resourece, I need to make this resource accessible" | 19:33 |
| ayoung | with RBAC, we are grouping resources together into projects and roles are a way to access sets of operations, but the degenerate case would be one role per API | 19:33 |
| ayoung | read/write/execute on a file | 19:34 |
| dstanek | ayoung: yes and no. if we already had a good relationship structure i could see that maybe that was true, but since we don't things hardcode URLs all over the place and i think thins reinforces that | 19:34 |
| dstanek | also operators would have to know about URLs and probably build tools around them | 19:34 |
| ayoung | dstanek, ideally, we would use "OPTIONS" but that would be phase 2 or so | 19:35 |
| ayoung | dstanek, but the OSC could do that for us | 19:35 |
| *** MasterOfBugs has joined #openstack-keystone | 19:35 | |
| ayoung | OSC knows about the URLS already, so it could have a --test --list-roles type flag with this API | 19:35 |
| dstanek | ayoung: yeah, but even before that we'd have to find a way to expose links properly | 19:35 |
| ayoung | dstanek, what do you mean? | 19:36 |
| dstanek | so for instance i want to know if i can edit a user: Client(BASE_SEARCH_URL).get(query=username)['rels']['edit'].options() | 19:38 |
| dstanek | maybe s/edit/identity:update_user/ | 19:38 |
| dstanek | everything would understand a few entry points.. i like / for jsonhome and discovery and a search at a minimun. then you have to know relationships | 19:39 |
| ayoung | dstanek, start earlier in the process | 19:39 |
| ayoung | you want to know if you can call opestack user mod ... | 19:40 |
| ayoung | or you want to do the same thing from a Web UI | 19:40 |
| ayoung | or some automated process that calls the python-keystoneclient api | 19:40 |
| dstanek | so basically i have an application that needs to edit a user. it knows what user, the requested changes and the hypertext structure | 19:40 |
| dstanek | first it uses the entrypoint to search: representation = Client(BASE_SEARCH_URL).get(query=username) | 19:41 |
| dstanek | then it knows to look for the edit relationship in the JSON doc. | 19:41 |
| ayoung | Client(BASE_SEARCH_URL).get(query=username)['rels']['edit'].options() CAN BE Mapped, by the client to PUT BASE_SEARCH_URL/v3/users/<id> right? | 19:41 |
| *** dave-mccowan has quit IRC | 19:41 | |
| *** ducttape_ has joined #openstack-keystone | 19:41 | |
| *** dave-mccowan has joined #openstack-keystone | 19:42 | |
| dstanek | that's something like: usable_url = representation['rels']['identity:update_user'] | 19:42 |
| dstanek | usable_url is a client-like object that keeps the session data around and has HTTP methods that can be called. .head(), .get(), etc. | 19:43 |
| dstanek | ayoung: it could be, but i don't want that baked in ahead of time | 19:43 |
| ayoung | dstanek, no, I mean at the time you call it, it has to calculate an URL anyway | 19:43 |
| ayoung | dstanek, you cannot call OpenStack without know the URL you are going to call, at least at some point, on the near side of the wire | 19:45 |
| ayoung | it is the only thing you can be sure of | 19:45 |
| dstanek | ayoung: right, that's what i was saying before. if we already had a good link structure i would buy that argument, but i think we are solidifying our current URL-in-client with this | 19:46 |
| *** chlong has quit IRC | 19:46 | |
| ayoung | dstanek, I'm missing something. Or you are missing something. Probably both. | 19:46 |
| ayoung | dstanek, think of a URL as a keyhole | 19:46 |
| ayoung | the role you need is the key that will fit in that keyhold and turn the lock | 19:47 |
| ayoung | at some point, you need to know what key to present | 19:47 |
| dstanek | then is roles were based on identity:operation it would align with policy and how users think | 19:47 |
| ayoung | dstanek, there is no reason that we could not have roles namded that way. But what we have is Building 202, room 400. | 19:47 |
| ayoung | there is no mappong from identity:create_user to POST /v3/users/ | 19:48 |
| *** dave-mccowan has quit IRC | 19:48 | |
| ayoung | but if you want a system where those are mapped, we can move toward that. I don't want to maintain i manually. | 19:48 |
| dstanek | ayoung: so right now the client pretty much has to know the URLs (all clients and not just OSC) - so i just think this makes moving away from that harder | 19:48 |
| dstanek | ayoung: actually there is. that's the patch i was going to put on top of yours | 19:49 |
| ayoung | dstanek, that is a different issue, and one I tried to address years ago as you may recall | 19:49 |
| ayoung | the Keystone-does-html effort was to get to proper discovery | 19:49 |
| ayoung | and that got shot down too | 19:49 |
| dstanek | the mapping of routes (method and url) maps back to a callable that is decorated with 'identity:operation' | 19:50 |
| dstanek | the data exists, but we don't use it yet | 19:50 |
| dstanek | ayoung: yeah i don't agree with that. i like the HTML view of the data | 19:50 |
| ayoung | dstanek, then you should have pushed it through. Suspect people would have listened if the idea came from you | 19:51 |
| dstanek | ayoung: i don't think so. i think there were just some overly misguided opinions on the subject | 19:52 |
| ayoung | dstanek, and so we did nothing. | 19:52 |
| ayoung | dstanek, regardless, the RBAC based on a URL is, I think, the most RESTful approach to discovery we could do. We just need discovery, too. But that is beyond this effort | 19:53 |
| ayoung | K8S does it a little cleaner | 19:53 |
| ayoung | instead of a service catalog, you get a list of object types | 19:54 |
| ayoung | and an URL from which to manage them | 19:54 |
| ayoung | namespace (project_id) is part of the URL templating, but it is standardized | 19:54 |
| ayoung | But RBAC is done on operation+resource basis, with those things defined by URLs | 19:54 |
| *** chlong has joined #openstack-keystone | 19:57 | |
| *** raildo has quit IRC | 19:59 | |
| dstanek | ayoung: so the other fear i have is that the URL based approach isn't as flexible in cases where there may be multiple check involved | 19:59 |
| dstanek | for example, if something in the payload triggers something else that needed a role check where there was not API call. not sure if this exists yet though | 20:01 |
| dstanek | a case like [GET /snapshot] contains data in the body to say what type, where or something else that needs a role check. maybe you can only perform 'service:full_data_raw' if you have the admin role, but 'service:incremental_data' for members | 20:03 |
| dstanek | those things may also have their own URLs as they may be standalone API calls too | 20:03 |
| *** Aqsa has joined #openstack-keystone | 20:06 | |
| ayoung | dstanek, so, not in the first rev, but we do have a spec for that, too | 20:09 |
| ayoung | just hard to get right, and so iterations | 20:09 |
| ayoung | its not going to be perfect. But remember *nothing* is using roles right now beyond admin and some services stuff | 20:10 |
| ayoung | we are not going to be reducing what can be done to start | 20:10 |
| ayoung | just making it sane | 20:10 |
| ayoung | sane-a-tizing it | 20:11 |
| *** catinthe_ has quit IRC | 20:42 | |
| *** spilla has joined #openstack-keystone | 20:42 | |
| *** spilla_ has quit IRC | 20:44 | |
| openstackgerrit | Kristi Nikolla proposed openstack/python-keystoneclient master: Client functions for Routes https://review.openstack.org/452893 | 21:01 |
| *** spilla_ has joined #openstack-keystone | 21:04 | |
| *** spilla has quit IRC | 21:08 | |
| *** thorst has quit IRC | 21:10 | |
| *** Aqsa has quit IRC | 21:25 | |
| *** chlong has quit IRC | 21:28 | |
| *** spilla has joined #openstack-keystone | 21:34 | |
| *** spilla_ has quit IRC | 21:36 | |
| *** edmondsw has joined #openstack-keystone | 21:38 | |
| *** thorst has joined #openstack-keystone | 21:39 | |
| *** edmondsw has quit IRC | 21:43 | |
| *** gyee has quit IRC | 21:55 | |
| *** thorst is now known as thorst_afk | 22:00 | |
| *** ducttape_ has quit IRC | 22:32 | |
| *** harlowja has quit IRC | 22:34 | |
| *** dave-mccowan has joined #openstack-keystone | 22:34 | |
| *** thorst_afk has quit IRC | 22:40 | |
| *** adriant has joined #openstack-keystone | 22:42 | |
| *** cloudnull has joined #openstack-keystone | 23:06 | |
| *** masber has joined #openstack-keystone | 23:18 | |
| *** nicolasbock has quit IRC | 23:19 | |
| *** ducttape_ has joined #openstack-keystone | 23:21 | |
| *** spilla_ has joined #openstack-keystone | 23:25 | |
| *** openstack has joined #openstack-keystone | 23:27 | |
| *** spilla has quit IRC | 23:28 | |
| *** harlowja has joined #openstack-keystone | 23:29 | |
| *** spilla has joined #openstack-keystone | 23:30 | |
| *** spilla_ has quit IRC | 23:32 | |
| *** dave-mccowan has quit IRC | 23:33 | |
| *** spilla_ has joined #openstack-keystone | 23:33 | |
| *** phalmos has quit IRC | 23:34 | |
| *** spilla has quit IRC | 23:37 | |
| *** thorst_afk has joined #openstack-keystone | 23:41 | |
| *** thorst_afk has quit IRC | 23:46 | |
| *** spilla has joined #openstack-keystone | 23:51 | |
| *** spilla_ has quit IRC | 23:51 | |
| *** spilla_ has joined #openstack-keystone | 23:51 | |
| *** spilla has quit IRC | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!