| *** ductta___ has quit IRC | 00:08 | |
| *** thorst has joined #openstack-keystone | 00:23 | |
| *** thorst has quit IRC | 00:26 | |
| *** zhurong has joined #openstack-keystone | 00:44 | |
| *** Shunli has joined #openstack-keystone | 00:52 | |
| *** lbragstad has quit IRC | 00:56 | |
| *** tobberydberg has joined #openstack-keystone | 01:01 | |
| *** tobberydberg has quit IRC | 01:06 | |
| *** thorst has joined #openstack-keystone | 01:06 | |
| *** lbragstad has joined #openstack-keystone | 01:10 | |
| *** ChanServ sets mode: +o lbragstad | 01:10 | |
| *** liujiong has joined #openstack-keystone | 01:34 | |
| *** CowboyPride has quit IRC | 01:43 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Gear documentation towards a wider audience https://review.openstack.org/476676 | 02:01 |
|---|---|---|
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move caching docs into admin-guide https://review.openstack.org/477678 | 02:10 |
| lbragstad | stevemar: morgan fixed and rebased ^ | 02:11 |
| *** aselius has quit IRC | 02:12 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move upgrade documentation to admin-guide https://review.openstack.org/481381 | 02:19 |
| *** gyee has quit IRC | 02:23 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move upgrade documentation to admin-guide https://review.openstack.org/481381 | 02:28 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: More performance documentation to admin-guide https://review.openstack.org/481383 | 02:37 |
| *** xuhaigang has quit IRC | 02:50 | |
| *** lucasxu has joined #openstack-keystone | 02:53 | |
| openstackgerrit | Merged openstack/keystone master: Removed apache-httpd guide from docs https://review.openstack.org/477632 | 02:57 |
| openstackgerrit | zhengliuyang proposed openstack/keystone master: Confusing log messages in project hierarchy checking https://review.openstack.org/480967 | 02:58 |
| *** lucasxu has quit IRC | 02:59 | |
| *** gagehugo has quit IRC | 03:00 | |
| *** gagehugo has joined #openstack-keystone | 03:03 | |
| *** thorst has joined #openstack-keystone | 03:07 | |
| *** chlong_ has quit IRC | 03:08 | |
| *** chlong_ has joined #openstack-keystone | 03:09 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: More performance documentation to admin-guide https://review.openstack.org/481383 | 03:11 |
| *** thorst has quit IRC | 03:13 | |
| *** chlong_ has quit IRC | 03:17 | |
| *** chlong_ has joined #openstack-keystone | 03:18 | |
| *** gagehugo has quit IRC | 03:25 | |
| *** Shunli has quit IRC | 03:25 | |
| *** Shunli has joined #openstack-keystone | 03:26 | |
| *** gagehugo has joined #openstack-keystone | 03:27 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove policy mapping documentation https://review.openstack.org/481395 | 03:30 |
| *** Shunli has quit IRC | 03:54 | |
| *** Shunli has joined #openstack-keystone | 03:55 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move development environment setup to contributor docs https://review.openstack.org/481405 | 04:00 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Consolidate LDAP documentation into admin-guide https://review.openstack.org/478206 | 04:02 |
| *** gagehugo has quit IRC | 04:02 | |
| *** gagehugo has joined #openstack-keystone | 04:03 | |
| *** thorst has joined #openstack-keystone | 04:09 | |
| *** thorst has quit IRC | 04:14 | |
| *** lbragstad has quit IRC | 04:14 | |
| *** links has joined #openstack-keystone | 04:29 | |
| *** faizy has joined #openstack-keystone | 04:42 | |
| openstackgerrit | Merged openstack/keystone master: Gear documentation towards a wider audience https://review.openstack.org/476676 | 04:47 |
| *** liujiong is now known as liujiong|away | 04:52 | |
| *** zzzeek has joined #openstack-keystone | 04:55 | |
| *** zzzeek has quit IRC | 04:56 | |
| *** aojea has joined #openstack-keystone | 05:01 | |
| *** zzzeek has joined #openstack-keystone | 05:02 | |
| *** zzzeek has quit IRC | 05:02 | |
| *** zzzeek has joined #openstack-keystone | 05:04 | |
| *** zzzeek has quit IRC | 05:04 | |
| *** aojea has quit IRC | 05:06 | |
| *** zzzeek has joined #openstack-keystone | 05:08 | |
| *** tobberydberg has joined #openstack-keystone | 05:08 | |
| *** zzzeek has quit IRC | 05:09 | |
| *** zzzeek has joined #openstack-keystone | 05:10 | |
| *** zzzeek has quit IRC | 05:16 | |
| *** thorst has joined #openstack-keystone | 05:21 | |
| *** zzzeek has joined #openstack-keystone | 05:22 | |
| *** zzzeek has quit IRC | 05:23 | |
| *** thorst has quit IRC | 05:25 | |
| openstackgerrit | Merged openstack/keystone master: Update security compliance documentation https://review.openstack.org/479357 | 05:29 |
| *** blake has joined #openstack-keystone | 05:38 | |
| *** zzzeek has joined #openstack-keystone | 05:40 | |
| *** zzzeek has quit IRC | 05:40 | |
| *** rcernin has joined #openstack-keystone | 05:46 | |
| *** markvoelker has quit IRC | 05:50 | |
| *** markvoelker has joined #openstack-keystone | 05:51 | |
| *** ianw is now known as ianw_pto | 05:55 | |
| *** markvoelker has quit IRC | 05:55 | |
| *** aojea has joined #openstack-keystone | 05:57 | |
| *** aojea has quit IRC | 05:59 | |
| *** aojea has joined #openstack-keystone | 05:59 | |
| *** junbo has quit IRC | 06:01 | |
| *** zzzeek has joined #openstack-keystone | 06:02 | |
| *** blake has quit IRC | 06:02 | |
| *** aojea has quit IRC | 06:13 | |
| *** zzzeek has quit IRC | 06:17 | |
| *** blake has joined #openstack-keystone | 06:21 | |
| *** blake has quit IRC | 06:24 | |
| *** liujiong|away is now known as liujiong | 06:26 | |
| *** timburke has quit IRC | 06:37 | |
| *** htruta has quit IRC | 06:38 | |
| *** charz has quit IRC | 06:38 | |
| *** Adobeman has quit IRC | 06:38 | |
| *** timburke has joined #openstack-keystone | 06:38 | |
| *** charz has joined #openstack-keystone | 06:39 | |
| *** Adobeman has joined #openstack-keystone | 06:39 | |
| *** rha has quit IRC | 06:41 | |
| *** htruta has joined #openstack-keystone | 06:42 | |
| *** rha has joined #openstack-keystone | 06:45 | |
| *** rha has quit IRC | 06:45 | |
| *** rha has joined #openstack-keystone | 06:45 | |
| *** liujiong has quit IRC | 07:01 | |
| *** tesseract has joined #openstack-keystone | 07:17 | |
| *** aojea has joined #openstack-keystone | 07:21 | |
| *** thorst has joined #openstack-keystone | 07:21 | |
| *** thorst has quit IRC | 07:27 | |
| *** markvoelker has joined #openstack-keystone | 07:51 | |
| *** zzzeek_ has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** david-lyle has quit IRC | 08:19 | |
| *** david-lyle has joined #openstack-keystone | 08:19 | |
| *** markvoelker has quit IRC | 08:26 | |
| *** faizy has quit IRC | 09:04 | |
| *** faizy has joined #openstack-keystone | 09:05 | |
| *** tobberyd_ has joined #openstack-keystone | 09:06 | |
| *** tobberydberg has quit IRC | 09:10 | |
| *** tobberyd_ has quit IRC | 09:11 | |
| *** markvoelker has joined #openstack-keystone | 09:23 | |
| *** thorst has joined #openstack-keystone | 09:23 | |
| *** thorst has quit IRC | 09:28 | |
| *** Shunli has quit IRC | 09:29 | |
| *** aloga has quit IRC | 09:38 | |
| *** aloga has joined #openstack-keystone | 09:38 | |
| *** openstackgerrit has quit IRC | 09:48 | |
| *** markvoelker has quit IRC | 09:56 | |
| *** jmlowe_ has joined #openstack-keystone | 10:10 | |
| *** jmlowe has quit IRC | 10:11 | |
| *** raies has joined #openstack-keystone | 10:25 | |
| raies | Anybody around, is keystone policy API implementation is an alternate to download policy.json (or policy in code) using API ? | 10:25 |
| *** zhurong has quit IRC | 10:46 | |
| *** markvoelker has joined #openstack-keystone | 10:53 | |
| *** thorst has joined #openstack-keystone | 11:00 | |
| *** thorst has quit IRC | 11:05 | |
| *** markvoelker has quit IRC | 11:26 | |
| *** openstackgerrit has joined #openstack-keystone | 11:31 | |
| openstackgerrit | bhavani proposed openstack/keystone master: Stop using deprecated 'message' attribute in Exception https://review.openstack.org/481588 | 11:31 |
| *** markvoelker has joined #openstack-keystone | 11:44 | |
| *** pcaruana has joined #openstack-keystone | 11:49 | |
| *** jsavak has joined #openstack-keystone | 11:55 | |
| *** thorst has joined #openstack-keystone | 11:56 | |
| *** aojea has quit IRC | 11:57 | |
| *** jsavak has quit IRC | 12:03 | |
| *** raildo has joined #openstack-keystone | 12:03 | |
| *** jsavak has joined #openstack-keystone | 12:03 | |
| *** aojea has joined #openstack-keystone | 12:15 | |
| *** aojea has quit IRC | 12:19 | |
| *** edmondsw has joined #openstack-keystone | 12:21 | |
| *** aojea has joined #openstack-keystone | 12:24 | |
| *** aojea has quit IRC | 12:28 | |
| *** faizy has quit IRC | 12:28 | |
| *** catintheroof has joined #openstack-keystone | 12:40 | |
| *** chlong_ has quit IRC | 12:43 | |
| *** ducttape_ has joined #openstack-keystone | 12:59 | |
| *** lucasxu has joined #openstack-keystone | 12:59 | |
| *** ducttape_ has quit IRC | 13:01 | |
| *** links has quit IRC | 13:06 | |
| cmurphy | what's the difference between the admin guide and the operator guide? i'm wondering why https://review.openstack.org/#/c/477678 goes to the admin guide and not the operator guide | 13:07 |
| samueldmq | cmurphy: I asked myself the same question yesterday while hitting the sack | 13:09 |
| samueldmq | admin == operator returned true for me | 13:09 |
| cmurphy | well - in my mind they're not 100% the same | 13:09 |
| cmurphy | operator is the person deploying the thing | 13:09 |
| samueldmq | and admin is the person maintaining the thing? | 13:09 |
| cmurphy | administrator is an API user doing administrator tasks | 13:09 |
| samueldmq | hmm | 13:10 |
| samueldmq | like adding hypervisors? | 13:10 |
| cmurphy | ya maybe | 13:10 |
| cmurphy | or adding users | 13:10 |
| samueldmq | cmurphy: makes sense | 13:10 |
| cmurphy | but idk if that's just in my brain or if that has basis in reality | 13:10 |
| samueldmq | those different docs existed already in the openstack-manual repos, correct? | 13:10 |
| samueldmq | ++ we can probably ask asettle | 13:11 |
| cmurphy | or sjain | 13:11 |
| *** zhurong has joined #openstack-keystone | 13:24 | |
| *** aojea has joined #openstack-keystone | 13:27 | |
| *** bknudson has joined #openstack-keystone | 13:30 | |
| *** aojea has quit IRC | 13:31 | |
| *** aojea has joined #openstack-keystone | 13:31 | |
| *** Dinesh_Bhor has quit IRC | 13:32 | |
| raies | is there any way in keystone, where I can download keystone rbac policies (policy.json items) using API ? | 13:42 |
| raies | I can see some policy APIs are implemented in keystone but not sure how they work. | 13:43 |
| raies | can someone guide me if these policy APIs are used to download rbac policy ? | 13:44 |
| *** jsavak has quit IRC | 13:47 | |
| *** jsavak has joined #openstack-keystone | 13:54 | |
| *** dansmith is now known as superdan | 13:55 | |
| *** sjain has joined #openstack-keystone | 14:08 | |
| *** chlong_ has joined #openstack-keystone | 14:08 | |
| *** jsavak has quit IRC | 14:11 | |
| samueldmq | raies: hi, no those APIs are not used for downloading the policies in openstack deployments | 14:26 |
| samueldmq | they were created as a way to allow for that, but the implementation hasnt gone too far than that | 14:26 |
| *** zhurong has quit IRC | 14:26 | |
| samueldmq | for several reasons, but there are cross-project changes happening to the way policies are managed within openstack | 14:27 |
| samueldmq | there are policy weekly meetings on Wed 16h00 UTC | 14:28 |
| samueldmq | #link http://eavesdrop.openstack.org/#Keystone_Policy_Meeting | 14:28 |
| raies | yes i was supposed to join this but couldn't get time to join it. | 14:29 |
| *** aselius has joined #openstack-keystone | 14:30 | |
| raies | samueldmq: Few weeks back I had submitted one blueprint specs and implementation - https://review.openstack.org/#/c/463547/ | 14:32 |
| raies | this was to download/GET keystone rbac policy info. | 14:33 |
| raies | there was comment over this patch about this is already done | 14:34 |
| raies | but as u said it is not functional so far. | 14:34 |
| raies | ayoung: samueldmq: Just to give some background, OpenStack Patrole is tempest plugin | 14:35 |
| raies | there is a limitation of patrole that it can't be run from remote machine | 14:36 |
| raies | because it needs API rbac action to be parsed from controller node (or where /etc/policy.json file exists) | 14:37 |
| raies | So to make it functional, I had proposed bp here so that we can get policy information on a remote machine | 14:38 |
| raies | if these is any way to get rbac policy information on a remote machine please suggest ? otherwise we will require a API implementation to GET policy information on remote machine. | 14:39 |
| *** ducttape_ has joined #openstack-keystone | 14:39 | |
| raies | samueldmq: ayoung: please sugest ^^ | 14:39 |
| raies | **suggest | 14:39 |
| samueldmq | raies: sorry I need to go afk for a bit, will be back in a bit | 14:44 |
| *** lbragstad has joined #openstack-keystone | 14:45 | |
| *** ChanServ sets mode: +o lbragstad | 14:45 | |
| raies | samueldmq: okay np | 14:49 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Move upgrade documentation to admin-guide https://review.openstack.org/481381 | 14:50 |
| ayoung | raies, I've given up. I provided a whole solution. But cannot get the support I need to implement in a timely manner. | 14:50 |
| ayoung | raies, but Patrole has the potential to do far more harm than good if it locks us into poor security decisions. Keep that in mind as you move forward. | 14:51 |
| *** catintheroof has quit IRC | 14:52 | |
| *** catintheroof has joined #openstack-keystone | 14:53 | |
| *** ppiela has quit IRC | 14:56 | |
| raies | ayoung: ok | 14:56 |
| *** catinthe_ has joined #openstack-keystone | 14:56 | |
| raies | ayoung: any alternate suggestion for this ? | 14:59 |
| *** catintheroof has quit IRC | 14:59 | |
| bknudson | should openstack have a centralized authorization service? | 15:00 |
| *** lucasxu has quit IRC | 15:04 | |
| *** rcernin has quit IRC | 15:06 | |
| *** catintheroof has joined #openstack-keystone | 15:06 | |
| *** catinthe_ has quit IRC | 15:09 | |
| *** zzzeek_ has joined #openstack-keystone | 15:17 | |
| *** zzzeek_ has quit IRC | 15:17 | |
| morgan | bknudson: unknown | 15:23 |
| *** aojea has quit IRC | 15:24 | |
| *** sjain has quit IRC | 15:29 | |
| *** raies has quit IRC | 15:32 | |
| openstackgerrit | Merged openstack/keystonemiddleware master: Change locations of docs for intersphinx https://review.openstack.org/480474 | 15:32 |
| *** catinthe_ has joined #openstack-keystone | 15:35 | |
| *** catintheroof has quit IRC | 15:36 | |
| openstackgerrit | Merged openstack/ldappool master: Switch from oslosphinx to openstackdocstheme https://review.openstack.org/479208 | 15:46 |
| *** gyee has joined #openstack-keystone | 15:58 | |
| morgan | bknudson: i don't know if it makes sense to continue having a central authz/authn service | 15:58 |
| morgan | bknudson: it really would be easier to oauth/oidc natively for the APIs | 15:59 |
| morgan | and lean on the IDP to do the work | 15:59 |
| bknudson | idp for authorization? | 15:59 |
| morgan | idp can hand off group data etc | 15:59 |
| morgan | the app can be configured to map authz for it | 16:00 |
| bknudson | sure, but then need to determine if the user can perform the op on the other service | 16:00 |
| morgan | move towards more normalized IDP/SP model | 16:00 |
| morgan | but i think that is a convo we can't really have in all seriousness | 16:00 |
| morgan | because how far we are down the path we are =/ | 16:00 |
| morgan | but *eh* | 16:00 |
| * morgan shrugs. | 16:00 | |
| *** aojea has joined #openstack-keystone | 16:00 | |
| bknudson | openstack has special case of tenancy, so not sure where that should live | 16:00 |
| bknudson | should be doing consul or something for service discovery | 16:01 |
| *** aojea has quit IRC | 16:02 | |
| *** jmlowe_ has quit IRC | 16:05 | |
| *** sjain has joined #openstack-keystone | 16:13 | |
| *** aojea has joined #openstack-keystone | 16:13 | |
| *** thorst has quit IRC | 16:15 | |
| *** catinthe_ has quit IRC | 16:19 | |
| *** catintheroof has joined #openstack-keystone | 16:19 | |
| morgan | i like something like consul | 16:20 |
| morgan | but thats just me | 16:20 |
| morgan | again... a bit far down this path | 16:20 |
| bknudson | maybe there's a migration path where keystone queries consul... | 16:21 |
| bknudson | (a consul backend for catalog) | 16:22 |
| *** aojea has quit IRC | 16:23 | |
| morgan | bknudson: i wanted to do that for the catalog | 16:25 |
| morgan | any service can register with consul | 16:25 |
| morgan | and keystone just represents that for compat reasons | 16:25 |
| *** otleimat has joined #openstack-keystone | 16:35 | |
| lbragstad | bknudson: morgan that's an interesting idea | 16:38 |
| openstackgerrit | Eric Fried proposed openstack/keystoneauth master: normalize_version_number([1]) => (1, 0) and docs https://review.openstack.org/481309 | 16:38 |
| lbragstad | so keystone would only be around to serve as the authority for project information and the catalog? | 16:38 |
| morgan | lbragstad: yep | 16:46 |
| morgan | lbragstad: that was something i wanted to do ages ago | 16:46 |
| morgan | ZK would also work, consul is a little better at it though | 16:46 |
| lbragstad | it would be an interesting exercise to map out the migratin | 16:47 |
| lbragstad | migration* | 16:47 |
| morgan | the migration was pretty straightforward | 16:48 |
| morgan | driver for keystone | 16:48 |
| morgan | KSM does the register | 16:48 |
| morgan | for the services | 16:49 |
| morgan | and we expect a certain data type/set to know the registry | 16:49 |
| morgan | erm know the registration | 16:50 |
| morgan | we could also use the is the connection active to enable/disable things in the catalog...an yway | 16:51 |
| morgan | also i think consul has a DNS front end on it | 16:51 |
| morgan | *shrug* | 16:51 |
| *** jmlowe has joined #openstack-keystone | 16:52 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Consolidate LDAP documentation into admin-guide https://review.openstack.org/478206 | 16:53 |
| openstackgerrit | Merged openstack/keystonemiddleware master: Switch from oslosphinx to openstackdocstheme https://review.openstack.org/479206 | 16:56 |
| openstackgerrit | Merged openstack/keystoneauth master: Switch from oslosphinx to openstackdocstheme https://review.openstack.org/479191 | 16:59 |
| asettle | cmurphy and samueldmq - the ops guide and admin guide do contain a lot of practical similarities as you have noticed | 17:03 |
| asettle | But the guides themselves differ between the theoretical and practical application of administration and operations | 17:04 |
| asettle | We are very aware of the similarities | 17:04 |
| *** jmlowe has quit IRC | 17:10 | |
| samueldmq | asettle: kk. is there a description anywhere about those different audiences ? what an operator is VS what an admin is ? | 17:18 |
| asettle | samueldmq: I wouldn't go as far as calling them different audiences. They are different guides for differing requirements. | 17:19 |
| asettle | Administration is aimed at practical applications of operations | 17:19 |
| asettle | And the operations guide was aimed at theoretical side of operations | 17:19 |
| asettle | YOu can read the description on docs.openstack.org (each guide has a description underneath the link( | 17:19 |
| samueldmq | asettle: cool, I will take a better look there | 17:21 |
| samueldmq | we need a clear understanding of that before we decide what goes where | 17:21 |
| samueldmq | thanks for sharing | 17:22 |
| *** dave-mccowan has joined #openstack-keystone | 17:24 | |
| *** links has joined #openstack-keystone | 17:25 | |
| *** jmlowe has joined #openstack-keystone | 17:25 | |
| *** links has quit IRC | 17:29 | |
| *** links has joined #openstack-keystone | 17:30 | |
| *** ducttape_ has quit IRC | 17:31 | |
| cmurphy | thanks asettle | 17:34 |
| *** links has quit IRC | 17:36 | |
| *** aojea has joined #openstack-keystone | 17:37 | |
| *** aojea has quit IRC | 17:41 | |
| *** sjain has quit IRC | 17:44 | |
| openstackgerrit | Kelly Hall proposed openstack/keystone master: Trims whitespace from request headers https://review.openstack.org/470425 | 17:44 |
| openstackgerrit | Merged openstack/keystone master: Switch from oslosphinx to openstackdocstheme https://review.openstack.org/479188 | 17:46 |
| *** sjain_ has joined #openstack-keystone | 17:49 | |
| *** thorst has joined #openstack-keystone | 17:49 | |
| *** thorst has quit IRC | 17:52 | |
| *** thorst has joined #openstack-keystone | 17:52 | |
| *** bit_lySLH2uSZHed has joined #openstack-keystone | 18:00 | |
| *** bit_lySLH2uSZHed has left #openstack-keystone | 18:02 | |
| *** ducttape_ has joined #openstack-keystone | 18:03 | |
| *** sjain_ has quit IRC | 18:20 | |
| *** tesseract has quit IRC | 18:21 | |
| *** amyge_ has joined #openstack-keystone | 18:22 | |
| openstackgerrit | Jaewoo Park proposed openstack/keystone master: WIP: Add project tags https://review.openstack.org/470317 | 18:26 |
| amyge_ | hi, I have a question about how to cache the token for keystone. I code in python. I generate the token plugin from the token I import then generate the session with that plugin,and cache the session and plugin. But when I try plugin.get_access(session).auth_token, I see that the auth_token is different from the one I import | 18:29 |
| amyge_ | just wondering what's the right way to cache the token in keystone? | 18:30 |
| *** chlong_ has quit IRC | 18:40 | |
| morgan | amyge_: so .get_access will get a new token if the plugin doesn't have a token | 18:41 |
| morgan | that is likely what is happening | 18:41 |
| morgan | you would need to pass the token in (not sure how that is working atm) if you want to use the token itself. | 18:41 |
| morgan | that you have previously used. | 18:41 |
| morgan | erm, generated | 18:42 |
| amyge_ | I pass the token in as one of the arguments to create the plugin | 18:50 |
| morgan | hm. well either the token is expiring (they have a short window of life relatively speaking), we have a bug, or the construction of the plugin isn't being done like you expect | 18:50 |
| amyge_ | but I test as soon as I create a new token...which I think should last for at least an hour right? | 18:51 |
| morgan | should. | 18:52 |
| amyge_ | so basically {"token": mytoken} is passed in to keystoneauth1.identity.Token() | 18:52 |
| amyge_ | and I generate session with keystoneauth1.session.Session(auth=plugin, ...) | 18:53 |
| amyge_ | and I just cache the plugin and session | 18:53 |
| morgan | right | 18:53 |
| amyge_ | but when I try plugin.get_access(session).auth_token | 18:54 |
| morgan | oh | 18:54 |
| morgan | hm. | 18:54 |
| morgan | let me see what .get_access does | 18:54 |
| morgan | that might always get a new token | 18:55 |
| amyge_ | yeah sure. I'm not sure if I do it wrong | 18:55 |
| morgan | hm. | 18:56 |
| morgan | i think something is creating a new auth_ref | 18:56 |
| morgan | somehow | 18:56 |
| morgan | .get_access would get a new auth_ref (and new token) if needed | 18:56 |
| amyge_ | is that because my token is not valid? | 18:57 |
| morgan | so, i think what is happening is you are in a state that the token has been deemed invalid...somehow | 18:57 |
| morgan | or it's using your current token to get a new token | 18:57 |
| morgan | which is what the token plugin is typically used for. | 18:57 |
| morgan | but passing the token in should do what you expect afaict at first glance | 18:57 |
| openstackgerrit | Kelly Hall proposed openstack/keystone master: Trims whitespace from request headers https://review.openstack.org/470425 | 18:58 |
| amyge_ | oh okay. | 18:58 |
| amyge_ | does this relate to some default setting? | 18:58 |
| amyge_ | to not use the token passed in but instead, generate a new one? | 18:59 |
| morgan | not sure | 19:02 |
| morgan | honestly, i'm trying to context switch to think about what is happening | 19:02 |
| amyge_ | kk~ | 19:04 |
| morgan | when you create the plugin with everything | 19:07 |
| morgan | check what plugin.auth_ref is | 19:08 |
| morgan | if that is not populated, it will get a new token | 19:08 |
| *** bit_lySLH2uSZHed has joined #openstack-keystone | 19:08 | |
| *** bit_lySLH2uSZHed has left #openstack-keystone | 19:08 | |
| amyge_ | let me check | 19:09 |
| morgan | the Token plugin is specifically for authenticating with a known token, so it is almost assured that it is doing the right thing | 19:10 |
| morgan | it is taking the toke you supplied and getting a new one | 19:10 |
| morgan | and populating auth_ref | 19:10 |
| amyge_ | yeah it returns 'None' | 19:10 |
| amyge_ | do you mean that it will still generate a new token even if I pass in one? | 19:11 |
| morgan | in this case. | 19:12 |
| amyge_ | but am I able to cache that new token? or every time it will take the token and generate a new one from it? | 19:12 |
| morgan | no it will not generate a new token unless it's expired *or* you don't have an auth_ref | 19:13 |
| morgan | see https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/identity/base.py#L91-L111 | 19:13 |
| *** aojea has joined #openstack-keystone | 19:13 | |
| morgan | now. that being said, using Token auth, once your original token expires it cannot re-auth | 19:13 |
| morgan | like Password could | 19:14 |
| morgan | the session already caches a generated token | 19:14 |
| morgan | s/session/plugin | 19:14 |
| amyge_ | I see. so if I create another client object, it will still get the cached token as long as it's not expired right? | 19:15 |
| morgan | as long as you use the same session/plugin | 19:16 |
| morgan | in theory you can use the same plugin across multiple sessions, just like you can use the same session in multiple clients | 19:16 |
| amyge_ | okay I see.~ I will try and ask questions again if I have any | 19:17 |
| amyge_ | thanks for the help! | 19:18 |
| morgan | sure! | 19:18 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Add history behind why keystone has two ports https://review.openstack.org/476703 | 19:19 |
| morgan | rebased that | 19:19 |
| morgan | it was being wonky | 19:19 |
| *** ayoung has quit IRC | 19:19 | |
| morgan | needed help | 19:19 |
| *** ducttap__ has joined #openstack-keystone | 19:23 | |
| *** ducttape_ has quit IRC | 19:27 | |
| *** ducttape_ has joined #openstack-keystone | 19:30 | |
| *** ducttap__ has quit IRC | 19:32 | |
| *** amyge_ has quit IRC | 19:43 | |
| *** ayoung has joined #openstack-keystone | 19:55 | |
| *** catinthe_ has joined #openstack-keystone | 19:56 | |
| *** ppiela has joined #openstack-keystone | 19:58 | |
| *** catintheroof has quit IRC | 19:59 | |
| *** jmlowe has quit IRC | 20:00 | |
| *** amyge has joined #openstack-keystone | 20:04 | |
| amyge | @morgan my original idea was to use only one token per user, so that it won't generate new token everytime when I run a new scenario and have a new osclient | 20:04 |
| amyge | but now, although the sess | 20:05 |
| amyge | but now, although the session cache the token and use it for other clients, when I run a new scenario, it will create a new session and will have to generate a new token | 20:06 |
| morgan | you could create a single plugin per scenario, which should only auth once unless it gets invalidated | 20:06 |
| morgan | yeah | 20:06 |
| morgan | that is the case. | 20:06 |
| morgan | it is safest, per scenario, to use a new token | 20:06 |
| morgan | it means that if an invalidation of that token is being tested, it can succeed - it also means you're isolating a token to a single use | 20:07 |
| *** ducttape_ has quit IRC | 20:07 | |
| morgan | that is the safest testing scenario... that said, i get whyu somone would want to re-use a token | 20:07 |
| morgan | you could (possibly) deep_copy the auth_ref and just attach it to a new pluin | 20:07 |
| morgan | plugin* | 20:07 |
| morgan | auth_ref *is* a public interface on the plugin | 20:08 |
| amyge | I see | 20:09 |
| amyge | so if I want to try shell script, is it also possible to use one token per scenario? | 20:10 |
| morgan | ah you'd need to do it in python in this case | 20:11 |
| ayoung | amyge, you can save the token to a file and reuse it for the next call | 20:11 |
| ayoung | or put it in an env var really the better option | 20:12 |
| morgan | ayoung: oh right we can populate with the ENV | 20:13 |
| amyge | @ayoung you mean the "openstack --os-token" command? | 20:13 |
| morgan | i was thinking strictly from within python itself | 20:13 |
| ayoung | amyge, yeah, or the comparable envvar | 20:14 |
| morgan | amyge: yep | 20:14 |
| amyge | what do you mean by "comparable envvar"? | 20:14 |
| ayoung | --os-token <auth-token> | 20:14 |
| ayoung | With token_endpoint: The token that will always be | 20:14 |
| ayoung | used With token_endpoint: Authentication token to use | 20:14 |
| ayoung | With v2token: Token With admin_token: The token that | 20:14 |
| ayoung | will always be used With v3scopedsaml: Token to | 20:14 |
| ayoung | authenticate with With token: Token to authenticate | 20:14 |
| ayoung | with With v3token: Token to authenticate with (Env: | 20:14 |
| ayoung | OS_TOKEN) | 20:14 |
| morgan | amyge: openstackclient has OS_TOKEN env-var option as well | 20:14 |
| ayoung | so you need --os-endpoint <auth-endpoint> | 20:14 |
| ayoung | With token_endpoint: The endpoint that will always be | 20:14 |
| ayoung | used With admin_token: The endpoint that will always | 20:14 |
| ayoung | be used (Env: OS_ENDPOINT) | 20:14 |
| morgan | if you don't want it on the command-line | 20:15 |
| *** ducttape_ has joined #openstack-keystone | 20:15 | |
| ayoung | set it once per scenario...or run each scenario in their own bash session | 20:15 |
| ayoung | os token issue --<all the vars> | 20:15 |
| morgan | if you pass a os-token you don't have a catalog | 20:15 |
| morgan | so the --os-endpoint is required | 20:15 |
| ayoung | und so wieder | 20:15 |
| amyge | sorry I think I'm not following | 20:16 |
| amyge | if I store the token OS_TOKEN and passed it in, how can I set it once per scenario? | 20:17 |
| amyge | and I will also have to specify --os-endpoint? | 20:17 |
| amyge | pass* | 20:18 |
| openstackgerrit | Eric Fried proposed openstack/keystoneauth master: normalize_version_number([1]) => (1, 0) and docs https://review.openstack.org/481309 | 20:23 |
| *** markvoelker has quit IRC | 20:27 | |
| *** markvoelker has joined #openstack-keystone | 20:27 | |
| *** catinthe_ has quit IRC | 20:39 | |
| openstackgerrit | Eric Fried proposed openstack/keystoneauth master: Fix _run_discovery caching; misc cleanup https://review.openstack.org/481754 | 20:39 |
| ayoung | amyge, nah, you want one or the other | 20:40 |
| ayoung | amyge, unset everything OS_* | 20:41 |
| ayoung | then use openstack token issue with only command line flags to actually get the token: | 20:41 |
| ayoung | export OS_TOKEN=`openstack token issue --os-auth-url X --os-user-doamain-name X ..." | 20:42 |
| ayoung | then export OS_ENDPOINT=<OS_AUTH_URL> | 20:42 |
| ayoung | and from there on out, openstack commands should be scoped to the token you go. | 20:42 |
| ayoung | if you do all of that in one bash script per scenario, when the script exits, none of your info will bleed over into other scenarios | 20:43 |
| ayoung | Kapishe? | 20:43 |
| amyge | I see, will try now | 20:53 |
| amyge | thanks adam and also morgan ^^ | 20:54 |
| *** ducttape_ has quit IRC | 21:09 | |
| *** ducttape_ has joined #openstack-keystone | 21:09 | |
| amyge | @ayoung if I have 10 commands in my script, will it create 10 new scoped token from the token I pass in? or is it gonna use the same original one? | 21:14 |
| *** thorst has quit IRC | 21:16 | |
| *** ducttape_ has quit IRC | 21:24 | |
| *** raildo has quit IRC | 21:25 | |
| *** catintheroof has joined #openstack-keystone | 21:33 | |
| *** edmondsw has quit IRC | 21:34 | |
| *** thorst has joined #openstack-keystone | 21:38 | |
| *** thorst has quit IRC | 21:38 | |
| *** dave-mccowan has quit IRC | 21:41 | |
| *** iurygregory has quit IRC | 21:41 | |
| *** iurygregory has joined #openstack-keystone | 21:44 | |
| *** openstackgerrit has quit IRC | 21:47 | |
| *** openstackgerrit has joined #openstack-keystone | 21:49 | |
| openstackgerrit | Jaewoo Park proposed openstack/keystone master: WIP: Add project tags https://review.openstack.org/470317 | 21:49 |
| *** thorst has joined #openstack-keystone | 21:50 | |
| *** openstackstatus has quit IRC | 21:56 | |
| *** openstack has joined #openstack-keystone | 21:57 | |
| *** thorst has quit IRC | 21:57 | |
| *** ducttape_ has joined #openstack-keystone | 21:57 | |
| *** openstackstatus has joined #openstack-keystone | 21:58 | |
| *** ChanServ sets mode: +v openstackstatus | 21:58 | |
| *** aojea has quit IRC | 22:00 | |
| *** zzzeek_ has joined #openstack-keystone | 22:08 | |
| *** zzzeek_ has quit IRC | 22:09 | |
| *** zzzeek_ has joined #openstack-keystone | 22:14 | |
| *** zzzeek_ has quit IRC | 22:14 | |
| *** zzzeek_ has joined #openstack-keystone | 22:14 | |
| *** zzzeek_ has quit IRC | 22:15 | |
| *** bknudson has quit IRC | 22:15 | |
| *** zzzeek_ has joined #openstack-keystone | 22:19 | |
| *** zzzeek_ has quit IRC | 22:24 | |
| *** zzzeek_ has joined #openstack-keystone | 22:29 | |
| *** zzzeek_ has quit IRC | 22:30 | |
| *** zzzeek_ has joined #openstack-keystone | 22:31 | |
| *** zzzeek- has joined #openstack-keystone | 22:33 | |
| *** zzzeek_ has quit IRC | 22:35 | |
| *** zzzeek- has quit IRC | 22:41 | |
| *** catintheroof has quit IRC | 22:42 | |
| *** jmlowe has joined #openstack-keystone | 23:07 | |
| openstackgerrit | Omar Tleimat proposed openstack/keystone master: WIP: Add project tags https://review.openstack.org/470317 | 23:11 |
| *** zzzeek_ has joined #openstack-keystone | 23:17 | |
| *** zzzeek_ has quit IRC | 23:21 | |
| *** zzzeek_ has joined #openstack-keystone | 23:21 | |
| openstackgerrit | Jaewoo Park proposed openstack/keystone master: WIP: Add project tags https://review.openstack.org/470317 | 23:22 |
| *** ducttape_ has quit IRC | 23:38 | |
| *** ducttape_ has joined #openstack-keystone | 23:47 | |
| *** jmlowe has quit IRC | 23:48 | |
| *** jmlowe has joined #openstack-keystone | 23:50 | |
| *** thorst has joined #openstack-keystone | 23:57 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!