| *** itlinux has joined #openstack-keystone | 00:24 | |
| *** itlinux has quit IRC | 00:50 | |
| *** Chealion has quit IRC | 00:57 | |
| *** Chealion has joined #openstack-keystone | 00:58 | |
| *** daidv has joined #openstack-keystone | 01:15 | |
| *** lxnch has quit IRC | 01:17 | |
| *** lxnch has joined #openstack-keystone | 01:18 | |
| *** rcernin has quit IRC | 01:29 | |
| *** rcernin has joined #openstack-keystone | 01:30 | |
| *** links has joined #openstack-keystone | 01:44 | |
| *** itlinux has joined #openstack-keystone | 01:45 | |
| *** itlinux has quit IRC | 01:53 | |
| *** zhouyaguo has joined #openstack-keystone | 01:53 | |
| *** kukacz has quit IRC | 02:00 | |
| *** kukacz_ has joined #openstack-keystone | 02:01 | |
| *** zhurong has joined #openstack-keystone | 02:16 | |
| *** annp has joined #openstack-keystone | 02:27 | |
| *** korean101 has joined #openstack-keystone | 02:39 | |
| korean101 | HI guys | 02:42 |
|---|---|---|
| korean101 | how can i downgrade? | 02:42 |
| korean101 | i finished to deploy ocata release | 02:43 |
| korean101 | and i finished to deploy pike release | 02:43 |
| korean101 | and upgrade ocata to pike release | 02:43 |
| korean101 | now i try to downgrade pike --> ocata release | 02:43 |
| korean101 | how can I? | 02:43 |
| korean101 | or some manuals for me? | 02:43 |
| *** itlinux has joined #openstack-keystone | 02:47 | |
| *** ayoung has joined #openstack-keystone | 03:14 | |
| *** itlinux has quit IRC | 03:27 | |
| *** ayoung has quit IRC | 03:40 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add schema check for OS-TRUST:trust authentication https://review.openstack.org/522107 | 03:57 |
| *** korean101 has left #openstack-keystone | 04:01 | |
| *** itlinux has joined #openstack-keystone | 04:01 | |
| *** zhurong has quit IRC | 04:48 | |
| *** BenderRodriguez has quit IRC | 04:50 | |
| *** aselius has quit IRC | 04:51 | |
| *** zhurong has joined #openstack-keystone | 05:13 | |
| *** BenderRodriguez has joined #openstack-keystone | 05:31 | |
| *** markvoelker has quit IRC | 05:53 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add schema check for OS-TRUST:trust authentication https://review.openstack.org/522107 | 06:04 |
| *** openstackgerrit has quit IRC | 06:33 | |
| *** _ix has quit IRC | 06:49 | |
| *** openstackgerrit has joined #openstack-keystone | 06:53 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Update the help message for unique_last_password_count https://review.openstack.org/522136 | 06:53 |
| *** markvoelker has joined #openstack-keystone | 06:54 | |
| *** namnh has joined #openstack-keystone | 06:54 | |
| *** itlinux has quit IRC | 07:07 | |
| *** josecastroleon has joined #openstack-keystone | 07:09 | |
| *** rcernin has quit IRC | 07:17 | |
| *** d0ugal has quit IRC | 07:21 | |
| *** josecastroleon has quit IRC | 07:41 | |
| *** d0ugal has joined #openstack-keystone | 07:42 | |
| *** enriquetaso has quit IRC | 07:43 | |
| *** enriquetaso has joined #openstack-keystone | 07:43 | |
| *** threestrands has quit IRC | 07:47 | |
| *** pcaruana has joined #openstack-keystone | 07:49 | |
| *** hoonetorg has quit IRC | 07:58 | |
| *** josecastroleon has joined #openstack-keystone | 08:08 | |
| *** hoonetorg has joined #openstack-keystone | 08:12 | |
| *** tesseract has joined #openstack-keystone | 08:14 | |
| *** KwozyMan has joined #openstack-keystone | 08:31 | |
| *** magicboiz has joined #openstack-keystone | 08:40 | |
| *** zhouyaguo has quit IRC | 09:09 | |
| *** zhurong has quit IRC | 09:09 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 09:38 | |
| *** gmann is now known as gmann_afk | 10:24 | |
| *** annp has quit IRC | 10:24 | |
| *** namnh has quit IRC | 10:42 | |
| *** magicboiz has quit IRC | 10:45 | |
| *** josecastroleon has quit IRC | 10:46 | |
| *** josecastroleon1 has joined #openstack-keystone | 10:46 | |
| *** tsufiev has quit IRC | 10:49 | |
| *** tsufiev has joined #openstack-keystone | 10:55 | |
| *** josecastroleon1 has quit IRC | 11:09 | |
| *** magicboiz has joined #openstack-keystone | 11:12 | |
| *** AlexeyAbashkin has quit IRC | 11:31 | |
| *** tsufiev has quit IRC | 11:31 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 11:34 | |
| *** tsufiev has joined #openstack-keystone | 11:41 | |
| *** raildo has joined #openstack-keystone | 12:06 | |
| *** kukacz_ is now known as kukacz | 12:20 | |
| *** hoonetorg has quit IRC | 12:23 | |
| *** AlexeyAbashkin has quit IRC | 12:29 | |
| *** KwozyMan has quit IRC | 12:30 | |
| *** tsufiev has quit IRC | 12:30 | |
| *** sticker has joined #openstack-keystone | 12:32 | |
| *** KwozyMan has joined #openstack-keystone | 12:32 | |
| *** tsufiev has joined #openstack-keystone | 12:39 | |
| *** josecastroleon has joined #openstack-keystone | 12:41 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 12:44 | |
| *** gmann_afk is now known as gmann | 12:51 | |
| *** spectr has joined #openstack-keystone | 12:53 | |
| *** spectr has quit IRC | 13:04 | |
| *** gmann is now known as gmann_afk | 13:11 | |
| *** zhouyaguo has joined #openstack-keystone | 13:18 | |
| *** arxcruz has quit IRC | 13:35 | |
| *** josecastroleon1 has joined #openstack-keystone | 13:39 | |
| *** josecastroleon has quit IRC | 13:39 | |
| *** magicboiz has quit IRC | 13:40 | |
| *** dave-mccowan has joined #openstack-keystone | 13:40 | |
| *** AlexeyAbashkin has quit IRC | 13:43 | |
| *** links has quit IRC | 13:44 | |
| *** dave-mcc_ has joined #openstack-keystone | 13:44 | |
| *** dave-mccowan has quit IRC | 13:45 | |
| *** josecastroleon1 has quit IRC | 13:49 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 13:50 | |
| *** josecastroleon has joined #openstack-keystone | 14:10 | |
| *** spectr has joined #openstack-keystone | 14:27 | |
| *** KwozyMan has quit IRC | 14:29 | |
| lbragstad | o/ | 14:40 |
| cmurphy | \o | 14:40 |
| *** jose-phillips has quit IRC | 14:46 | |
| *** jose-phillips has joined #openstack-keystone | 14:48 | |
| *** akrzos has quit IRC | 14:49 | |
| *** jose-phillips has quit IRC | 14:49 | |
| *** rcernin has joined #openstack-keystone | 14:51 | |
| *** sticker_ has joined #openstack-keystone | 14:53 | |
| *** sticker__ has joined #openstack-keystone | 14:54 | |
| *** d0ugal has quit IRC | 14:56 | |
| *** sticker has quit IRC | 14:57 | |
| *** sticker has joined #openstack-keystone | 14:57 | |
| *** sticker_ has quit IRC | 14:58 | |
| *** sticker_ has joined #openstack-keystone | 14:59 | |
| *** d0ugal has joined #openstack-keystone | 14:59 | |
| *** d0ugal has quit IRC | 14:59 | |
| *** d0ugal has joined #openstack-keystone | 14:59 | |
| *** sticker__ has quit IRC | 15:00 | |
| *** sticker__ has joined #openstack-keystone | 15:00 | |
| *** sticker has quit IRC | 15:02 | |
| *** spectr has quit IRC | 15:03 | |
| *** sticker_ has quit IRC | 15:04 | |
| *** akrzos has joined #openstack-keystone | 15:04 | |
| *** sticker__ has quit IRC | 15:05 | |
| *** _ix has joined #openstack-keystone | 15:07 | |
| *** rmascena has joined #openstack-keystone | 15:09 | |
| *** raildo has quit IRC | 15:09 | |
| *** josecastroleon has quit IRC | 15:15 | |
| *** sticker has joined #openstack-keystone | 15:16 | |
| *** rcernin has quit IRC | 15:18 | |
| *** rmascena has quit IRC | 15:19 | |
| *** rmascena__ has joined #openstack-keystone | 15:19 | |
| *** rmascena__ is now known as raildo | 15:25 | |
| *** AlexeyAbashkin has quit IRC | 15:49 | |
| *** magicboiz has joined #openstack-keystone | 15:58 | |
| *** magicboiz has quit IRC | 16:08 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone-specs master: Repropose application credentials to queens https://review.openstack.org/512505 | 16:20 |
| cmurphy | mordred: lbragstad kmalloc ^ | 16:20 |
| *** magicboiz has joined #openstack-keystone | 16:21 | |
| lbragstad | cmurphy: sweet - i'll review today for sure | 16:22 |
| *** magicboiz has quit IRC | 16:26 | |
| *** itlinux has joined #openstack-keystone | 16:26 | |
| *** magicboiz has joined #openstack-keystone | 16:26 | |
| *** sticker has quit IRC | 16:27 | |
| lbragstad | cmurphy: so - we're blacklisting the ability to get a token with an application credential? | 16:32 |
| lbragstad | (POST /v3/auth/tokens) | 16:33 |
| cmurphy | lbragstad: that's my idea, what do you think? | 16:34 |
| cmurphy | lbragstad: otherwise how do we prevent it from creating a new token that can circumvent the method check? | 16:35 |
| cmurphy | or can we implement this somehow in policy and not by looking at the token? | 16:35 |
| lbragstad | this is to make sure we have a token that we can use to blacklist operations, right? | 16:36 |
| lbragstad | as the server, we need to know if this is an application credential token so that we can safeguard against bad things? | 16:36 |
| cmurphy | lbragstad: right - so in my mind (maybe i'm on the wrong track) an application credential can of course get a token but it shouldn't be able to use that token just for getting a new token | 16:38 |
| lbragstad | the first token's methods should be ['application-credential'] | 16:38 |
| lbragstad | and the concern is that the second token's would be ['token'] | 16:38 |
| lbragstad | right? | 16:39 |
| cmurphy | right | 16:39 |
| lbragstad | ok - we're on the same page then | 16:39 |
| cmurphy | okay | 16:39 |
| lbragstad | when you get a token with a password the original methods are ['password'] | 16:39 |
| lbragstad | then if you rescope that token to get a new one, the methods should be ['password', 'token'] | 16:39 |
| lbragstad | at least that's how i recall it working | 16:40 |
| cmurphy | oh i see, so this would be unnecessary | 16:40 |
| lbragstad | well - if it works that way for other combinations of authentication and token scoping | 16:40 |
| lbragstad | we might be able to build off of that behavior for this | 16:40 |
| lbragstad | but still be able to blacklist based on 'application-credential' being in methods | 16:41 |
| cmurphy | there was a concern at the PTG about being able to circumvent this check, was it because of this or was it because of something else? | 16:41 |
| lbragstad | is there an example of the concern? | 16:42 |
| lbragstad | i can't remember it exactly | 16:42 |
| cmurphy | i don't have a specific one, i remember it came up when we were talking about heat | 16:42 |
| lbragstad | ok - thinking about this from step 1 | 16:44 |
| lbragstad | we have an application that monitors resources in our project | 16:44 |
| lbragstad | but token expiration is defaulted to an hour | 16:44 |
| lbragstad | and the application checks ~30 minutes to see if things change or whatnot | 16:45 |
| lbragstad | an hour and a half in, wouldn't the application need to get a new token to continue monitoring resources? | 16:45 |
| *** itlinux has quit IRC | 16:47 | |
| cmurphy | lbragstad: but couldn't it do that by using the id/secret instead of the token? | 16:47 |
| cmurphy | lbragstad: but in any case i think you're right, this shouldn't be necessary | 16:47 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone-specs master: Repropose application credentials to queens https://review.openstack.org/512505 | 16:48 |
| lbragstad | cmurphy: oh - yeah i guess we could limit application credentials to only reauthenticating... | 16:49 |
| lbragstad | but... if an application-credential token is used to do something in another service, won't the service be validating that token? | 16:52 |
| lbragstad | so keystone should be able to validate those | 16:52 |
| cmurphy | lbragstad: yeah i think i was missing some pieces, i removed that bit | 16:53 |
| lbragstad | (thinking if an application creates and instance and nova passes an application credential scoped token to glance to pull an image) | 16:53 |
| *** tesseract has quit IRC | 16:57 | |
| *** itlinux has joined #openstack-keystone | 17:02 | |
| *** aojea has joined #openstack-keystone | 17:10 | |
| *** _ix has quit IRC | 17:12 | |
| *** itlinux has quit IRC | 17:15 | |
| *** pcaruana has quit IRC | 17:18 | |
| *** zhouyaguo has quit IRC | 17:24 | |
| *** josecastroleon has joined #openstack-keystone | 17:28 | |
| kmalloc | lbragstad, cmurphy: I glossed over app creds being under /project | 17:32 |
| kmalloc | i *very* much dislike that | 17:32 |
| kmalloc | i would have come out much more strongly against the proposal had I been paying a bit closer attention to that | 17:32 |
| kmalloc | credentials are not a project thing. they are always a user thing. they may have limited scope | 17:33 |
| *** AlexeyAbashkin has joined #openstack-keystone | 17:33 | |
| kmalloc | I also do not agree with anyone-in-a-project-with-write-access-can-delete-creds | 17:33 |
| lbragstad | kmalloc: being under /project in the path? | 17:35 |
| kmalloc | yeah | 17:35 |
| kmalloc | as part of the project api | 17:35 |
| lbragstad | i don't think that was ever proposed | 17:35 |
| lbragstad | if it was, i missed it | 17:35 |
| kmalloc | lbragstad: based on cmurphy's comment: If we don't support general credential management by the whole project team, then it really stops making sense for this API to live under /projects and should be moved to /users. | 17:36 |
| kmalloc | lbragstad: i'm very strongly -1 on it being under /project unless someone can sway me with a really strong case, possibly even -2. | 17:37 |
| kmalloc | this was in regards to the anyone with write access deleting a cred | 17:37 |
| kmalloc | (to the project) | 17:37 |
| *** AlexeyAbashkin has quit IRC | 17:38 | |
| lbragstad | i'm missing how application credentials are under /project... if by under /project you mean being able to delete creds based on writeable roles, then i get it | 17:38 |
| lbragstad | but i don't think that has anything to do with the path | 17:38 |
| kmalloc | right. i'm very confused now | 17:38 |
| *** josecastroleon has quit IRC | 17:38 | |
| kmalloc | so, i think i need clarification on what is actually being proposed now =/ | 17:39 |
| lbragstad | so - that was the requirement where an application credential needs to be managed when someone leaves the team | 17:40 |
| kmalloc | because that comment is making me worried where this is planned on living | 17:40 |
| lbragstad | application credentials are still going to be tied to the user | 17:40 |
| lbragstad | that hasn't changed | 17:40 |
| kmalloc | and if someone leaves the team - the user is either losing the RBAC *or* deleted | 17:40 |
| lbragstad | yes | 17:40 |
| kmalloc | in either case the cred should be auto-deleted | 17:40 |
| lbragstad | yes | 17:40 |
| kmalloc | so -1 (possibly -2) on allowing direct deletion of app creds by *anyone* who has write access on the project | 17:40 |
| *** edmondsw has joined #openstack-keystone | 17:41 | |
| kmalloc | it's a user's resource | 17:41 |
| kmalloc | keystone should be handling the app-cred deletion internally. | 17:41 |
| lbragstad | or handling it in the revoke case | 17:41 |
| kmalloc | yeah. | 17:41 |
| kmalloc | it's not a "user who has write on project X, deletes another user's app cred" | 17:41 |
| lbragstad | that was part of the management bit, before a user leaves a team, another team member could rotate things out | 17:42 |
| lbragstad | and assume ownership of the application by updating the application credential | 17:42 |
| lbragstad | essentially the workaround to having application credentials tied to the lifecycle of the project instead of the user | 17:43 |
| kmalloc | lbragstad: still a hard -1 from me on that | 17:44 |
| kmalloc | there is zero reason to need that for a work-around. before user leaves team, create new cred, update places that use it, remove old user. | 17:45 |
| kmalloc | done | 17:45 |
| kmalloc | it's needless allowance of cross-ownership resource manipulation | 17:46 |
| *** itlinux has joined #openstack-keystone | 17:49 | |
| lbragstad | kmalloc: have you left a comment on the spec yet? | 17:49 |
| kmalloc | yep | 17:49 |
| *** aojea has quit IRC | 17:58 | |
| *** aojea has joined #openstack-keystone | 17:58 | |
| *** aojea has quit IRC | 17:58 | |
| *** aojea has joined #openstack-keystone | 17:58 | |
| mordred | lbragstad, cmurphy: we discussed making the prevention of using an app-cred to create an app-cred tied to a role or policy thing- so that in some cases a user could be granted the role that would let them use an app-cred to create an app-cred (the driving use-case for that is heat needing to be able to make per-vm app-creds) | 18:00 |
| * mordred hasn't read the whole scrollback yet | 18:00 | |
| kmalloc | mordred: that is fine, it's an API so we can gate on RBAC for it | 18:05 |
| kmalloc | and prevent sub-app-creds | 18:05 |
| kmalloc | that's the easy part (so to speak) | 18:05 |
| kmalloc | the part i'm not happy about is the concept that anyone with write access to the project can delete any app-cred associated with the project | 18:06 |
| kmalloc | (or a specific app-cred-delete role) | 18:06 |
| mordred | kmalloc: yah - I don't think that's important any more with app-creds no longer being owned by a project | 18:07 |
| mordred | that would be important if they had a project lifecycle rather than a user lifecycle, otherwise FAIL | 18:08 |
| kmalloc | yes | 18:08 |
| mordred | but since they don't, I agree | 18:08 |
| kmalloc | and since we're user-lifecycle i'm a hard -1 on that project-lifecycle supprot bit | 18:08 |
| kmalloc | mordred: ++ cool, we're on the same page | 18:08 |
| kmalloc | otherwise i think the spec is solid | 18:09 |
| lbragstad | ok - we can work that in | 18:10 |
| *** aojea has quit IRC | 18:17 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Expose a bug when authenticating for a trust-scoped token https://review.openstack.org/522356 | 18:50 |
| lbragstad | wxy_: ^ that should expose the behavior you're fixing, you should be able to rebase on that and update the test in your patch (removing the wip decorator) | 18:50 |
| *** edmondsw has quit IRC | 19:16 | |
| *** edmondsw has joined #openstack-keystone | 19:28 | |
| *** edmondsw has quit IRC | 19:32 | |
| *** aojea has joined #openstack-keystone | 19:52 | |
| *** edmondsw has joined #openstack-keystone | 20:02 | |
| *** edmondsw has quit IRC | 20:06 | |
| *** itlinux has quit IRC | 20:25 | |
| *** aselius has joined #openstack-keystone | 20:29 | |
| *** nkinder has quit IRC | 20:58 | |
| *** nkinder has joined #openstack-keystone | 21:01 | |
| mgagne | is there a technical reason to not allow a cloud_admin to list a user's projects? https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json#L41 | 21:13 |
| *** linkmark has joined #openstack-keystone | 21:13 | |
| *** jmlowe has joined #openstack-keystone | 21:32 | |
| lbragstad | mgagne: if i understand that policy correctly, it's making sure the target user is within the domain the cloud admin is in | 21:39 |
| *** dave-mcc_ has quit IRC | 21:39 | |
| mgagne | ok, I'm having problem making it work. my cloud admin is in the default domain and it's being denied although the target user is in the default domain too. | 21:40 |
| mgagne | it looks like the "domain_id:%(domain_id)s" part is not evaluating to True. I thought you needed a domain scoped token to get domain_id defined properly but no luck here. | 21:41 |
| mgagne | but also, I'm not sure why a cloudadmin which is a super mega admin couldn't make this call and why rule:cloud_admin isn't used | 21:42 |
| mgagne | lbragstad: ^ | 21:42 |
| lbragstad | mgagne: this sounds familiar to another bug that was just reported... | 21:43 |
| lbragstad | mgagne: let me grab the link | 21:44 |
| *** threestrands has joined #openstack-keystone | 21:45 | |
| *** threestrands has quit IRC | 21:45 | |
| *** threestrands has joined #openstack-keystone | 21:45 | |
| *** jmlowe has quit IRC | 21:45 | |
| lbragstad | mgagne: https://bugs.launchpad.net/keystone/+bug/1732502 | 21:47 |
| openstack | Launchpad bug 1732502 in OpenStack Identity (keystone) "project-list command does not work for a user with admin role on domain" [Undecided,New] | 21:47 |
| lbragstad | sounds like the same thing you're hitting | 21:47 |
| lbragstad | i think that was recreated using Newton | 21:47 |
| mgagne | I'm running Pike 12.0.0 | 21:48 |
| *** raildo has quit IRC | 21:48 | |
| mgagne | I'll read the bug and see if there is anything I can learn from it. otherwise yes, the domain_id part is problematic in my case | 21:49 |
| lbragstad | mgagne: it sounds really familiar to what you described | 21:50 |
| lbragstad | wxy_: FYI - cmurphy proposed this a while ago and you might be able to leverage some of it https://review.openstack.org/#/c/468223/ | 21:50 |
| mgagne | there is debug log I can read where I see domain_id defined with a domain scoped token (unlike a project scoped token). but still no success with the policy. | 21:51 |
| mgagne | I'm not hitting his problem because the user I'm testing with is a cloud_admin and the policy for identity:list_projects allows cloud_admin. (unlike identity:list_user_projects) | 21:54 |
| mgagne | I'll try with a domain admin instead... | 21:54 |
| mgagne | lbragstad: ok, I'm able to reproduce the bug linked above with a domain admin (not cloud admin) | 21:58 |
| lbragstad | ok - you were able to recreate it with pike? | 21:59 |
| mgagne | yes | 21:59 |
| lbragstad | ok | 21:59 |
| lbragstad | i wonder if it is recreateable in master then, too? | 21:59 |
| mgagne | so I think it's the same root cause where domain_id is not properly evaluated | 21:59 |
| lbragstad | we don't have that great of test coverage with that specific policy file | 21:59 |
| mgagne | I could try but my setup doesn't allow me to easily test master | 21:59 |
| mgagne | well, it's for keystone v3... and v2 is gone | 22:00 |
| mgagne | so I'm not sure what this is suppose to mean | 22:00 |
| lbragstad | right - but most of our unit tests in test_protection.py test the default policies | 22:00 |
| mgagne | which are v3 ? or "old" v2 default? | 22:00 |
| lbragstad | the current default are very much geared towards v2.0 | 22:01 |
| lbragstad | unfortunately.. | 22:01 |
| mgagne | ok.... | 22:01 |
| lbragstad | but we are working on a way to start deprecating them and moving towards something more sane | 22:01 |
| mgagne | IMO, it should be v3 because... come on =) | 22:01 |
| lbragstad | https://review.openstack.org/#/c/509909/ | 22:01 |
| lbragstad | right - i know, i completely agree | 22:01 |
| lbragstad | ;) | 22:01 |
| lbragstad | the problem is that we never really had a way to signal that those defaults are changing to operators | 22:02 |
| mgagne | I think it's unrelated because policies are not deprecated, they are getting their default value replaced? | 22:02 |
| mgagne | unless I'm mistaking the purpose/scope of the change | 22:02 |
| lbragstad | yeah - but that can still break a deployment | 22:02 |
| mgagne | ok so review supports change in default rule? | 22:03 |
| lbragstad | that change should allow us to change the default | 22:03 |
| lbragstad | yes | 22:03 |
| mgagne | good stuff then =) | 22:03 |
| mgagne | so if v3 sample is not tested, this could mean 2 things: domain_id is bugged and/or default rule is wrong (missing cloud_admin IMO) | 22:04 |
| lbragstad | example and documentation if you care to see how it's used - https://docs.openstack.org/oslo.policy/latest/reference/api/oslo_policy.policy.html#oslo_policy.policy.DeprecatedRule | 22:04 |
| lbragstad | mgagne: yeah - that could be | 22:04 |
| mgagne | I'll work from there then and add my finding to the bug. thanks! | 22:06 |
| lbragstad | mgagne: cool - thank you | 22:06 |
| *** AlexeyAbashkin has joined #openstack-keystone | 22:09 | |
| *** Dinesh_Bhor has quit IRC | 22:11 | |
| *** gagehugo has quit IRC | 22:13 | |
| *** AlexeyAbashkin has quit IRC | 22:13 | |
| *** rcernin has joined #openstack-keystone | 22:20 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Have project get domain_id from parent https://review.openstack.org/489655 | 22:23 |
| *** jmlowe has joined #openstack-keystone | 22:32 | |
| *** aojea has quit IRC | 22:44 | |
| *** aojea has joined #openstack-keystone | 22:44 | |
| *** aojea has quit IRC | 22:48 | |
| lbragstad | for those traveling and taking time off, have a safe thanksgiving! | 22:51 |
| lbragstad | i'll be here friday if anyone needs anything | 22:52 |
| *** aojea has joined #openstack-keystone | 22:53 | |
| *** aojea has quit IRC | 22:59 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 23:08 | |
| *** AlexeyAbashkin has quit IRC | 23:12 | |
| *** lbragstad has quit IRC | 23:23 | |
| *** edmondsw has joined #openstack-keystone | 23:54 | |
| *** edmondsw has quit IRC | 23:59 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!