| *** odyssey4me has quit IRC | 00:11 | |
| *** odyssey4me has joined #openstack-keystone | 00:11 | |
| *** d0ugal has quit IRC | 00:13 | |
| *** d0ugal has joined #openstack-keystone | 00:17 | |
| *** r-daneel has quit IRC | 00:26 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 00:44 | |
| *** harlowja has quit IRC | 01:21 | |
| *** oikiki has joined #openstack-keystone | 01:22 | |
| *** annp has joined #openstack-keystone | 02:04 | |
| *** germs has quit IRC | 02:23 | |
| *** germs has joined #openstack-keystone | 02:24 | |
| *** david-lyle has quit IRC | 02:42 | |
| *** david-lyle has joined #openstack-keystone | 02:42 | |
| *** lbragstad has joined #openstack-keystone | 03:11 | |
| *** ChanServ sets mode: +o lbragstad | 03:11 | |
| *** abhi89 has joined #openstack-keystone | 03:25 | |
| *** nicolasbock has quit IRC | 03:39 | |
| *** annp has quit IRC | 03:39 | |
| *** bhagyashri_s has left #openstack-keystone | 03:40 | |
| *** links has joined #openstack-keystone | 03:48 | |
| *** annp has joined #openstack-keystone | 03:49 | |
| *** harlowja has joined #openstack-keystone | 03:53 | |
| *** voelzmo has quit IRC | 04:04 | |
| *** rcernin has quit IRC | 04:04 | |
| *** germs has quit IRC | 04:07 | |
| *** lbragstad has quit IRC | 04:18 | |
| *** rcernin has joined #openstack-keystone | 04:19 | |
| *** Dinesh_Bhor has quit IRC | 05:01 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 05:04 | |
| *** harlowja has quit IRC | 05:13 | |
| *** bigjools has quit IRC | 05:21 | |
| *** bigjools has joined #openstack-keystone | 05:21 | |
| *** bigjools has quit IRC | 05:21 | |
| *** bigjools has joined #openstack-keystone | 05:21 | |
| *** fiddletwix has quit IRC | 05:24 | |
| *** fiddletwix has joined #openstack-keystone | 05:29 | |
| *** zeus has quit IRC | 05:33 | |
| *** zeus has joined #openstack-keystone | 05:38 | |
| *** zeus is now known as Guest42736 | 05:38 | |
| *** oikiki has quit IRC | 05:46 | |
| *** oikiki has joined #openstack-keystone | 06:01 | |
| *** Dinesh__Bhor has joined #openstack-keystone | 06:04 | |
| *** Dinesh_Bhor has quit IRC | 06:04 | |
| *** jaosorior has joined #openstack-keystone | 06:05 | |
| openstackgerrit | Nguyen Hai proposed openstack/keystone master: Follow the new PTI for document build https://review.openstack.org/555196 | 06:07 |
|---|---|---|
| *** sonuk has joined #openstack-keystone | 06:10 | |
| *** martinus__ has joined #openstack-keystone | 06:24 | |
| *** jistr has quit IRC | 06:30 | |
| *** jistr has joined #openstack-keystone | 06:32 | |
| *** markvoelker has quit IRC | 06:43 | |
| *** markvoelker has joined #openstack-keystone | 06:44 | |
| *** pcaruana has joined #openstack-keystone | 06:47 | |
| *** markvoelker has quit IRC | 06:48 | |
| *** belmoreira has joined #openstack-keystone | 06:53 | |
| *** tesseract has joined #openstack-keystone | 07:20 | |
| *** threestrands has quit IRC | 07:36 | |
| *** rcernin has quit IRC | 07:37 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:41 | |
| *** oikiki has quit IRC | 07:58 | |
| *** oikiki has joined #openstack-keystone | 08:01 | |
| *** voelzmo has joined #openstack-keystone | 08:02 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystoneauth master: add lower-constraints job https://review.openstack.org/555625 | 08:05 |
| *** oikiki has quit IRC | 08:16 | |
| *** pcichy has joined #openstack-keystone | 08:32 | |
| *** abhi89 has quit IRC | 08:34 | |
| *** abhi89 has joined #openstack-keystone | 08:36 | |
| *** voelzmo has quit IRC | 08:37 | |
| *** oikiki has joined #openstack-keystone | 08:37 | |
| *** markvoelker has joined #openstack-keystone | 08:44 | |
| *** oikiki has quit IRC | 08:48 | |
| *** voelzmo has joined #openstack-keystone | 08:56 | |
| *** voelzmo has quit IRC | 09:01 | |
| *** markvoelker has quit IRC | 09:18 | |
| *** Sandy619 has joined #openstack-keystone | 09:20 | |
| *** sonuk_ has joined #openstack-keystone | 09:37 | |
| *** sonuk has quit IRC | 09:37 | |
| *** Guest42736 has quit IRC | 09:39 | |
| *** bigjools has quit IRC | 09:40 | |
| *** bigjools has joined #openstack-keystone | 09:40 | |
| *** bigjools has quit IRC | 09:40 | |
| *** bigjools has joined #openstack-keystone | 09:40 | |
| *** zeus has joined #openstack-keystone | 09:42 | |
| *** zeus is now known as Guest2385 | 09:42 | |
| *** markvoelker has joined #openstack-keystone | 10:15 | |
| *** Dinesh__Bhor has quit IRC | 10:16 | |
| *** nicolasbock has joined #openstack-keystone | 10:27 | |
| *** jistr has quit IRC | 10:27 | |
| *** annp has quit IRC | 10:28 | |
| *** jistr has joined #openstack-keystone | 10:36 | |
| *** tesseract has quit IRC | 10:37 | |
| *** tesseract has joined #openstack-keystone | 10:38 | |
| *** markvoelker has quit IRC | 10:49 | |
| *** tesseract-RH has joined #openstack-keystone | 10:59 | |
| *** tesseract has quit IRC | 10:59 | |
| *** sonuk_ has quit IRC | 11:21 | |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Add methods to get all of the version data https://review.openstack.org/559154 | 11:24 |
| mordred | cmurphy: ^^ that should be ready for review now - and I even added tests | 11:25 |
| cmurphy | mordred: fantastic | 11:25 |
| *** Sandy619 has quit IRC | 11:26 | |
| openstackgerrit | Doug Hellmann proposed openstack/keystoneauth master: add lower-constraints job https://review.openstack.org/555625 | 11:35 |
| *** sonuk has joined #openstack-keystone | 11:35 | |
| *** markvoelker has joined #openstack-keystone | 11:46 | |
| *** jistr is now known as jistr|mtg | 12:02 | |
| *** raildo has joined #openstack-keystone | 12:08 | |
| *** abhi89 has quit IRC | 12:11 | |
| *** abhi89 has joined #openstack-keystone | 12:12 | |
| *** sonuk has quit IRC | 12:13 | |
| *** markvoelker has quit IRC | 12:19 | |
| *** fried_rice has joined #openstack-keystone | 12:20 | |
| fried_rice | ö/ | 12:21 |
| *** markvoelker has joined #openstack-keystone | 12:24 | |
| *** jistr|mtg is now known as jistr | 12:31 | |
| *** pooja_jadhav has joined #openstack-keystone | 12:37 | |
| pooja_jadhav | fried_rice: Hi | 12:37 |
| fried_rice | Hello | 12:37 |
| pooja_jadhav | i want dicuss with you regarding keystoneauth session | 12:38 |
| fried_rice | pooja_jadhav: Is this in reference to https://review.openstack.org/#/c/505764/ ? | 12:39 |
| pooja_jadhav | correct | 12:40 |
| fried_rice | Okay. I remember seeing that go by, but I didn't actually review it. | 12:40 |
| fried_rice | Let's just heads-up the folks who did, cause they're more likely to be able to help... | 12:40 |
| fried_rice | kmalloc, cmurphy, mordred, cdent | 12:40 |
| fried_rice | pooja_jadhav: Okay, proceed with your question please :) | 12:40 |
| pooja_jadhav | fried_rice: Actually, i want use that split logger parameter in nova while call is going to cinder client.[1]https://github.com/openstack/nova/blob/master/nova/volume/cinder.py#L77 | 12:41 |
| pooja_jadhav | but how to use not getting still | 12:42 |
| pooja_jadhav | :( | 12:42 |
| fried_rice | pooja_jadhav: Okay, I'm reading over that patch, stand by... | 12:44 |
| pooja_jadhav | fried_rice: Sure | 12:44 |
| *** odyssey4me has quit IRC | 12:47 | |
| *** odyssey4me has joined #openstack-keystone | 12:47 | |
| fried_rice | pooja_jadhav: Okay, it looks to me like there's no way to do this via ksa loading. | 12:48 |
| *** jmlowe has quit IRC | 12:48 | |
| pooja_jadhav | fried_rice: Yeah, but if we want to do.. then how can we do then? | 12:49 |
| fried_rice | pooja_jadhav: If you want to try it out just to see if it will work the way you want it to, you can add: | 12:50 |
| fried_rice | _SESSION._split_loggers = True | 12:50 |
| fried_rice | after https://github.com/openstack/nova/blob/master/nova/volume/cinder.py#L82 | 12:50 |
| pooja_jadhav | ohk.. i will try and let u know | 12:51 |
| fried_rice | pooja_jadhav: That's not going to be a real solution. But if it does what you want, you could probably submit a patch to openstack/keystone to expose that via a conf option. | 12:52 |
| fried_rice | pooja_jadhav: Then you wouldn't need to do anything to the nova code - you could just add the option in your conf file and restart the service. | 12:52 |
| pooja_jadhav | ok | 12:56 |
| openstackgerrit | Doug Hellmann proposed openstack/ldappool master: add lower-constraints job https://review.openstack.org/555757 | 13:02 |
| *** edmondsw has joined #openstack-keystone | 13:07 | |
| *** david-lyle has quit IRC | 13:10 | |
| *** jmlowe has joined #openstack-keystone | 13:18 | |
| *** felipemonteiro_ has joined #openstack-keystone | 13:19 | |
| openstackgerrit | Merged openstack/ldappool master: add lower-constraints job https://review.openstack.org/555757 | 13:20 |
| *** felipemonteiro__ has joined #openstack-keystone | 13:23 | |
| *** david-lyle has joined #openstack-keystone | 13:24 | |
| *** felipemonteiro_ has quit IRC | 13:26 | |
| *** lbragstad has joined #openstack-keystone | 13:28 | |
| *** ChanServ sets mode: +o lbragstad | 13:28 | |
| *** links has quit IRC | 13:28 | |
| *** lbragstad has quit IRC | 13:35 | |
| openstackgerrit | Merged openstack/keystone master: Removal of deprecated direct driver loading https://review.openstack.org/350815 | 13:36 |
| openstackgerrit | Nguyen Hai proposed openstack/keystone master: Fix incompatible requirement in lower-constraints https://review.openstack.org/559334 | 13:36 |
| openstackgerrit | Nguyen Hai proposed openstack/keystone master: Fix incompatible requirement in lower-constraints https://review.openstack.org/559334 | 13:38 |
| *** lbragstad has joined #openstack-keystone | 13:39 | |
| *** ChanServ sets mode: +o lbragstad | 13:39 | |
| *** dansmith is now known as superdan | 13:40 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystoneauth master: add lower-constraints job https://review.openstack.org/555625 | 13:43 |
| *** david-lyle has quit IRC | 13:44 | |
| openstackgerrit | Merged openstack/keystonemiddleware master: Update links in README https://review.openstack.org/557189 | 13:49 |
| *** pcichy has quit IRC | 13:49 | |
| *** melwitt is now known as jgwentworth | 14:02 | |
| *** germs has joined #openstack-keystone | 14:10 | |
| *** germs has quit IRC | 14:11 | |
| *** germs has joined #openstack-keystone | 14:11 | |
| *** germs has quit IRC | 14:15 | |
| lbragstad | cmurphy: an application credential token can't be used to change a user's password can it? | 14:23 |
| cmurphy | lbragstad: it could if it has the user's original password https://developer.openstack.org/api-ref/identity/v3/index.html#change-password-for-user | 14:25 |
| lbragstad | ahh | 14:26 |
| lbragstad | ok - nevermind | 14:26 |
| cmurphy | :) | 14:26 |
| lbragstad | i thought i remember a restriction in there somewhere that might help with https://bugs.launchpad.net/keystone/+bug/1755874/ | 14:27 |
| openstack | Launchpad bug 1755874 in OpenStack Identity (keystone) "Ability to block users from changing passwords is missing in Kesystone v3" [Undecided,In progress] - Assigned to Pavlo Shchelokovskyy (pshchelo) | 14:27 |
| *** r-daneel has joined #openstack-keystone | 14:27 | |
| lbragstad | i just read the use case they described... | 14:27 |
| cmurphy | yeah we didn't any restrictions on that for app creds | 14:29 |
| cmurphy | having a policy that users can't change their own passwords seems really weird and anti-security to me but i guess it's a real world use case we should allow | 14:29 |
| lbragstad | mhmm | 14:30 |
| lbragstad | unless there is a different workflow we can support somehow that doesn't require us to open that back up | 14:31 |
| cmurphy | we can enforce password strength | 14:32 |
| lbragstad | yeah | 14:32 |
| cmurphy | that seems like the main thing they want | 14:33 |
| lbragstad | sounds like the layer that sits on top of keystone does that too | 14:33 |
| lbragstad | but i assume that's been around for a while if they implemented that for v2.0 | 14:33 |
| lbragstad | so - sure... some system creates a new user for some set of operations and a user *could* change the password directly using keystone | 14:34 |
| lbragstad | but it won't buy them much because keystone can be configured to match the same password strength requirements that the layer on top of keystone requires? | 14:34 |
| openstackgerrit | Nguyen Hai proposed openstack/keystone master: Follow the new PTI for document build https://review.openstack.org/555196 | 14:35 |
| cmurphy | auditability i guess, if they're tracking password changes through this other layer and don't want to track them through keystone | 14:36 |
| lbragstad | that could be true | 14:37 |
| cmurphy | sounds like they have a system in place and we broke them, so we could either enable the change that unbreaks their system or we could encourage them to use our system | 14:38 |
| cmurphy | ¯\_(ツ)_/¯ | 14:38 |
| *** jdennis has quit IRC | 14:39 | |
| lbragstad | sure - i'll leave a comment | 14:39 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Add methods to get all of the version data https://review.openstack.org/559154 | 14:40 |
| cmurphy | lbragstad: fyi i'll be on vacation all next week and hopefully not looking at my computer | 14:41 |
| lbragstad | cmurphy: ack - thanks for the heads up | 14:41 |
| lbragstad | cmurphy: i'm jealous ;) | 14:41 |
| lbragstad | doing anything fun? | 14:42 |
| *** jdennis has joined #openstack-keystone | 14:42 | |
| *** abhi89 has quit IRC | 14:43 | |
| cmurphy | meeting up with some friends to go camping in Iceland :D | 14:43 |
| *** abhi89 has joined #openstack-keystone | 14:44 | |
| lbragstad | oh... wow | 14:44 |
| * lbragstad gives cmurphy his camera | 14:44 | |
| lbragstad | please take some pictures | 14:44 |
| cmurphy | i plan to | 14:44 |
| lbragstad | s/some/lots of/ | 14:44 |
| cmurphy | :) | 14:44 |
| lbragstad | that's going to be amazing | 14:44 |
| lbragstad | also - pretty hard to get onto irc while camping | 14:45 |
| *** david-lyle has joined #openstack-keystone | 14:45 | |
| *** Guest2385 is now known as zeus | 14:50 | |
| *** zeus has quit IRC | 14:51 | |
| *** zeus has joined #openstack-keystone | 14:51 | |
| *** felipemonteiro__ has quit IRC | 14:55 | |
| *** felipemonteiro__ has joined #openstack-keystone | 14:56 | |
| *** spilla has joined #openstack-keystone | 14:58 | |
| *** dangtrinhnt has joined #openstack-keystone | 15:02 | |
| knikolla | cmurphy: have fun! | 15:03 |
| *** dangtrinhnt has quit IRC | 15:08 | |
| openstackgerrit | Matthew Thode proposed openstack/keystone master: Fix incompatible requirement in lower-constraints https://review.openstack.org/559334 | 15:09 |
| openstackgerrit | Matthew Thode proposed openstack/keystone master: Use the new pysaml2 constraints https://review.openstack.org/558217 | 15:09 |
| *** felipemonteiro_ has joined #openstack-keystone | 15:10 | |
| *** felipemonteiro__ has quit IRC | 15:14 | |
| openstackgerrit | Nguyen Hai proposed openstack/keystone master: Follow the new PTI for document build https://review.openstack.org/555196 | 15:23 |
| *** jmlowe_ has joined #openstack-keystone | 15:23 | |
| *** jmlowe has quit IRC | 15:23 | |
| *** abhi89 has quit IRC | 15:28 | |
| *** belmoreira has quit IRC | 15:30 | |
| *** openstackgerrit has quit IRC | 15:33 | |
| *** pcaruana has quit IRC | 15:49 | |
| gagehugo | o/ | 15:55 |
| *** r-daneel has quit IRC | 16:03 | |
| *** germs has joined #openstack-keystone | 16:11 | |
| *** germs has quit IRC | 16:11 | |
| *** germs has joined #openstack-keystone | 16:11 | |
| *** AlexeyAbashkin has quit IRC | 16:12 | |
| *** germs has quit IRC | 16:16 | |
| kmalloc | lbragstad, cmurphy: so... there is a minor issue to fix the password-change API blocking bit | 16:24 |
| kmalloc | and it is because @protected is wonky | 16:24 |
| * lbragstad dreads that refactor too | 16:25 | |
| kmalloc | the most immediate mechanism to block in that bug is use ninx/apache and put a block rule into http[s]://identity/v3/users/*/password | 16:26 |
| *** germs has joined #openstack-keystone | 16:30 | |
| *** germs has quit IRC | 16:30 | |
| *** germs has joined #openstack-keystone | 16:30 | |
| *** germs has quit IRC | 16:30 | |
| *** germs has joined #openstack-keystone | 16:31 | |
| *** germs has quit IRC | 16:31 | |
| *** germs has joined #openstack-keystone | 16:31 | |
| kmalloc | lbragstad: oh man, i know how to fix the bug w/o code on our end | 16:37 |
| kmalloc | we have minimum password change times. | 16:38 |
| lbragstad | oh! | 16:38 |
| kmalloc | right?! | 16:38 |
| * lbragstad checks the implementation | 16:39 | |
| kmalloc | yeah i am looking at that now | 16:39 |
| kmalloc | oh. | 16:39 |
| kmalloc | maybe we don't have that | 16:39 |
| kmalloc | we might need to add that. | 16:39 |
| lbragstad | yeah... | 16:40 |
| lbragstad | we have unique last pass count | 16:41 |
| *** r-daneel has joined #openstack-keystone | 16:41 | |
| kmalloc | lets just add minimum password change time | 16:41 |
| kmalloc | rather than implement policy due to issues with @protected | 16:42 |
| kmalloc | until that refactor lands | 16:42 |
| lbragstad | what's the status of that refactor? | 16:42 |
| lbragstad | i haven't had a chance to dig into it yet | 16:42 |
| kmalloc | ... i don't know what the status is | 16:43 |
| lbragstad | oh - no worries, i was just curious | 16:43 |
| lbragstad | i've buried myself in the token provider refactor, but i think i need a break from that for a while | 16:43 |
| *** spilla has quit IRC | 16:44 | |
| kmalloc | i don't think much yeah | 16:44 |
| kmalloc | s/don't think much | 16:44 |
| kmalloc | annnnyway | 16:44 |
| kmalloc | i don't think much has been done on the refactor | 16:45 |
| kmalloc | i can try and dig in some, but, it's a beast of a refactor | 16:45 |
| kmalloc | the issue is that it touches soooooo very much | 16:45 |
| *** spilla has joined #openstack-keystone | 16:45 | |
| lbragstad | yeah :( | 16:45 |
| kmalloc | let me start my NAS [old] -> NAS [new] | 16:45 |
| kmalloc | transfer | 16:46 |
| kmalloc | need to move ~4TB today | 16:46 |
| kmalloc | and i'll start poking at the refactor | 16:46 |
| lbragstad | sweet | 16:47 |
| lbragstad | the refactors we have on our plate this release are _massive_ | 16:47 |
| kmalloc | yeah | 16:48 |
| lbragstad | i started breaking the "rewrite keystone" patch into a series | 16:48 |
| kmalloc | but it's all VERY good stuff that makes keystnoe better | 16:48 |
| lbragstad | i failed, like 4 times | 16:48 |
| kmalloc | honestly, i want to re-write a ton of keystone. | 16:48 |
| kmalloc | once we break @protected, the flask re-write will be easy | 16:48 |
| lbragstad | yesterday i pulled the entire new model into a separate change, which is cool.. but then i attempted to remove the KeystoneToken model | 16:49 |
| lbragstad | so s/KeystoneToken/TokenModel/ everywhere in keystone | 16:49 |
| lbragstad | and then went over like a kicking a hornets nest | 16:50 |
| lbragstad | the problem is that we need to validate the token, then we pass it to the KeystoneTOken model to get an object | 16:50 |
| lbragstad | but with the new model, we use composition | 16:50 |
| kmalloc | right | 16:50 |
| lbragstad | so - we validate the token and then handpick values to build a token model using TokenModel? | 16:51 |
| lbragstad | which just defeats the purpose | 16:51 |
| kmalloc | well, we know what the values from the fernet payload mean | 16:51 |
| kmalloc | and we should be able to do composition with a "hey this is issued" | 16:51 |
| kmalloc | vs "this is new" | 16:51 |
| kmalloc | composition should work the same | 16:52 |
| lbragstad | oh - yeah.. that'd mean building the model generation into the validation path right? | 16:52 |
| kmalloc | it's a big change to the internals | 16:52 |
| kmalloc | yeah | 16:52 |
| lbragstad | right.. i didn't do that | 16:52 |
| kmalloc | but that is the way to do it and how we discussed it | 16:52 |
| lbragstad | all i did was introduce the new model and attempt to replace all usage of the old model with the new one | 16:52 |
| lbragstad | which kinda backfired | 16:52 |
| kmalloc | yeah | 16:52 |
| lbragstad | and it got really messy | 16:52 |
| lbragstad | i think we need to wait until validate_token returns an instance of TokenModel | 16:52 |
| kmalloc | if anything do it inverse, compose validation 1st | 16:53 |
| kmalloc | THEN everything else | 16:53 |
| lbragstad | instead of making all the different places in keystone do composition on blank token models | 16:53 |
| lbragstad | ++ | 16:53 |
| lbragstad | yeah | 16:53 |
| lbragstad | i think that's what i learned yesterday | 16:53 |
| kmalloc | and maybe just make a wrapper interface for the tokenmodel (new) | 16:53 |
| kmalloc | so we can interface the token the same way elsewhere | 16:53 |
| kmalloc | then drop the interface | 16:53 |
| *** fried_rice is now known as fried_rolls | 16:53 | |
| kmalloc | it's transitional code, but it would make it easy | 16:54 |
| lbragstad | ok - so what if i do this | 16:54 |
| kmalloc | and we can just drop the magic methods to see what all still references the old style | 16:54 |
| lbragstad | 1.) propose the new token model | 16:54 |
| lbragstad | 2.) rework the authentication API to construct token models and whatnot | 16:54 |
| lbragstad | 3.) rework the validation path to construct token models | 16:55 |
| kmalloc | 1a. implement interface for tokenmodel to work like current dict-model. | 16:55 |
| lbragstad | how do you do that? | 16:55 |
| kmalloc | basically some magic __getitem__ __setitem__ | 16:55 |
| lbragstad | one model accepts a dictionary and the other doesn't accept anything? | 16:55 |
| lbragstad | s/?// | 16:55 |
| kmalloc | just implement __getitem__ __setitem__ that knows the token dict format | 16:56 |
| lbragstad | kt = token_model.KeystoneToken(token_data=token_data) | 16:56 |
| kmalloc | and sets the values | 16:56 |
| lbragstad | mmm | 16:56 |
| kmalloc | then you can just use the KeystoneToken directly | 16:56 |
| kmalloc | everywhere | 16:56 |
| kmalloc | simple search/replace | 16:56 |
| kmalloc | then rework bits to compose | 16:56 |
| kmalloc | and direct access | 16:56 |
| lbragstad | so - under the hood KeystoneToken proxies to TokenModel? | 16:56 |
| kmalloc | no | 16:56 |
| kmalloc | implement on KeystoneToken __getitem__ that knows what the format should be | 16:57 |
| kmalloc | its the dict magic get method | 16:57 |
| *** links has joined #openstack-keystone | 16:57 | |
| kmalloc | so KeystoneToken()['user'] etc returns dicts of the keystonetoken values | 16:57 |
| kmalloc | and KeystoneToken()['user']['id' | 16:58 |
| kmalloc | and KeystoneToken()['user']['id'] = XXXXX | 16:58 |
| kmalloc | would set the ritght thin | 16:58 |
| kmalloc | now that i think about it | 16:58 |
| kmalloc | might be a massive amount of work | 16:58 |
| lbragstad | yeah | 16:58 |
| lbragstad | that's how i have things now | 16:58 |
| kmalloc | maybe just a .to_dict() | 16:58 |
| lbragstad | with the new model | 16:58 |
| kmalloc | or _to_dict() | 16:58 |
| lbragstad | it all @property methods | 16:58 |
| kmalloc | and just render a token from the @propertys | 16:59 |
| kmalloc | so keystonetoken.to_dict()[<normal_otken_lookup] | 16:59 |
| kmalloc | since we already need the code to render the dicts | 16:59 |
| kmalloc | for controller bits | 16:59 |
| lbragstad | for exmple - https://review.openstack.org/#/c/555931/1/keystone/models/token_model.py@869 | 17:00 |
| kmalloc | eh, i think your proposed steps work fine | 17:00 |
| lbragstad | so | 17:00 |
| lbragstad | 1.) introduce new model | 17:00 |
| lbragstad | 2.) make authentication path use new model | 17:00 |
| lbragstad | 3.) make validation path use new model | 17:01 |
| kmalloc | yep | 17:01 |
| lbragstad | 4.) convert instances of KeystoneToken to use TokenModel (which is returned from PROVIDERS.token_provider_api.validate_token(token_id)) | 17:01 |
| lbragstad | 5.) remove duplicate model | 17:01 |
| kmalloc | yep | 17:02 |
| lbragstad | 6.) profit | 17:02 |
| lbragstad | because everyone loves a good refactor, amiright? | 17:02 |
| *** links has quit IRC | 17:06 | |
| *** links has joined #openstack-keystone | 17:08 | |
| *** david-lyle has quit IRC | 17:09 | |
| lbragstad | ok - i'm going to step away for lunch quick | 17:12 |
| *** openstackgerrit has joined #openstack-keystone | 17:18 | |
| openstackgerrit | Matthew Thode proposed openstack/keystone master: Fix incompatible requirement in lower-constraints https://review.openstack.org/559334 | 17:18 |
| openstackgerrit | Matthew Thode proposed openstack/keystone master: Use the new pysaml2 constraints https://review.openstack.org/558217 | 17:18 |
| kmalloc | lbragstad: i'll propose the "minimum password change time" thing shortly | 17:22 |
| kmalloc | lbragstad: and make it so -1 is a "never allowed", | 17:23 |
| *** tesseract-RH has quit IRC | 17:35 | |
| *** voelzmo has joined #openstack-keystone | 17:45 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 17:46 | |
| *** AlexeyAbashkin has quit IRC | 17:50 | |
| *** voelzmo has quit IRC | 17:59 | |
| *** brad[] has quit IRC | 18:03 | |
| *** brad[] has joined #openstack-keystone | 18:04 | |
| *** voelzmo has joined #openstack-keystone | 18:09 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Introduce new TokenModel object https://review.openstack.org/559129 | 18:10 |
| *** voelzmo has quit IRC | 18:14 | |
| *** abhi89 has joined #openstack-keystone | 18:15 | |
| *** jessegler has joined #openstack-keystone | 18:20 | |
| jessegler | #openstack-security | 18:21 |
| *** r-daneel has quit IRC | 18:23 | |
| *** r-daneel has joined #openstack-keystone | 18:25 | |
| *** felipemonteiro_ has quit IRC | 18:31 | |
| *** felipemonteiro_ has joined #openstack-keystone | 18:32 | |
| *** david-lyle has joined #openstack-keystone | 18:40 | |
| *** fried_rolls is now known as fried_rice | 18:59 | |
| *** felipemonteiro__ has joined #openstack-keystone | 19:00 | |
| *** felipemonteiro_ has quit IRC | 19:03 | |
| *** cz2 has quit IRC | 19:03 | |
| kmalloc | lbragstad: almost have the password opt override added for min_password_age | 19:20 |
| kmalloc | lbragstad: i am also implementing the case where if min_password_age is -1 in config, it makes password changes impossible. | 19:21 |
| lbragstad | cool | 19:21 |
| kmalloc | so, you will now have a useropt "min_password_age" which overrides the global conf only if it is greater than the global conf | 19:22 |
| kmalloc | (basically, we only take the highest of the two values) | 19:22 |
| kmalloc | EXCEPT if the value is -1 for either | 19:22 |
| kmalloc | which means passwords may not be changed via the change_password API | 19:22 |
| lbragstad | that makes se | 19:24 |
| lbragstad | sense* | 19:24 |
| lbragstad | knikolla: did you have the patch to replace non-existant users with @ while listing role assignments? | 19:25 |
| * lbragstad thinks something in our ldap implementation regressed | 19:25 | |
| lbragstad | i'm noticing something pretty strange | 19:26 |
| lbragstad | if i have a user in ldap, i can create a role assignment for them, and everything is fine and dandy | 19:26 |
| lbragstad | if i remove the user from ldap directly, i still see the role assignment | 19:27 |
| lbragstad | if i attempt to remove the role assignment, i get an error saying the user can't be found, which makes sense | 19:27 |
| lbragstad | but the role assignment doesn't go away | 19:27 |
| lbragstad | and then after some period of time... the user name in the assignment list switches to @? | 19:28 |
| *** abhi89 has quit IRC | 19:28 | |
| knikolla | lbragstad: that was a long time ago, yeah i think i did a patch for smth like that. | 19:28 |
| knikolla | Changed names with empty string though | 19:29 |
| knikolla | Not sure about the @ | 19:29 |
| lbragstad | http://paste.openstack.org/show/718621/ | 19:29 |
| lbragstad | i had a developers@Users group | 19:30 |
| knikolla | Oh, because @ divides the username and domain | 19:30 |
| lbragstad | and an lbragstad@Users user | 19:30 |
| knikolla | Which both are empty strings | 19:30 |
| lbragstad | yeah | 19:30 |
| *** cz2 has joined #openstack-keystone | 19:30 | |
| lbragstad | if i do `openstack role assignment list` i see the stale records | 19:31 |
| lbragstad | with the IDs | 19:31 |
| knikolla | I think my patch was only for listing, not deleting. | 19:31 |
| * knikolla is on the subway. Will be home in 10 mins or so. | 19:32 | |
| lbragstad | ok - no worries | 19:32 |
| *** gagehugo has quit IRC | 19:47 | |
| kmalloc | lbragstad: just finishing tests and then docs | 19:50 |
| kmalloc | lbragstad: and we should really implement domain-specific overrides for all the DSS stuff. | 19:53 |
| lbragstad | for PCI? | 19:53 |
| kmalloc | https://www.irccloud.com/pastebin/c8D2uU2Y/ | 19:55 |
| kmalloc | lbragstad: yeah. | 19:55 |
| kmalloc | pci-dss* | 19:55 |
| kmalloc | lbragstad: once tests pass locally i'll toss in docs | 19:55 |
| kmalloc | and a reno | 19:55 |
| kmalloc | and we can tag that bug as closed | 19:55 |
| kmalloc | the user resource options stuff is nice to work with. | 19:56 |
| kmalloc | lbragstad: i'm pleased with the code just because adding a resource is straightforward | 19:57 |
| kmalloc | s/resource/option | 19:57 |
| lbragstad | right | 19:57 |
| lbragstad | yeah - that is nice | 19:57 |
| kmalloc | lbragstad: next challene, i need to standup keycloak or freeipa locally on my network so i can get my NAS to have consistent uids | 19:58 |
| kmalloc | ayoung: i am frightened, i am actually thinking of standing up keycloak locally for my home network... just had to share (krb5 and all that) | 19:59 |
| kmalloc | lbragstad: and i need to stand up some ansible for all my stuff *eek* this is like I am actually an engineer or something. | 20:00 |
| kmalloc | lbragstad: annnd, i'm actually developing python on windows (gonna see if subsystem for linux will work for unit tests) | 20:00 |
| *** gagehugo has joined #openstack-keystone | 20:03 | |
| lbragstad | 0.o | 20:06 |
| lbragstad | python on windows? | 20:06 |
| kmalloc | yep | 20:07 |
| lbragstad | i know it's possible, but i always found it to be a pain sharing source between the development environment and the environment the project actually runs in | 20:07 |
| kmalloc | oh, i just symlink: <WSL ROOT>/home/notmorgan/userprofile -> /mnt/c/User/<windowsuser>/Documents/ and have stuff under there | 20:07 |
| kmalloc | i even have proper ssh-agent and all that running | 20:08 |
| kmalloc | in bash | 20:08 |
| kmalloc | i expect this will explode in my face | 20:08 |
| lbragstad | lol | 20:08 |
| *** mchlumsky has quit IRC | 20:10 | |
| *** mchlumsky has joined #openstack-keystone | 20:12 | |
| knikolla | why is it still snowing in april... | 20:18 |
| lbragstad | i just did something with ldap + keystone that technically shouldn't be possible | 20:25 |
| lbragstad | ldap blows my mind some days | 20:25 |
| *** links has quit IRC | 20:28 | |
| gagehugo | knikolla right?! | 20:30 |
| kmalloc | lbragstad: what did you do? | 20:39 |
| lbragstad | this - https://bugs.launchpad.net/keystone/+bug/1751045 | 20:40 |
| openstack | Launchpad bug 1751045 in OpenStack Identity (keystone) "The removal of a role on a non existing group throws an error" [Undecided,In progress] - Assigned to Jose Castro Leon (jose-castro-leon) | 20:40 |
| lbragstad | ^ i couldn't recreate it | 20:40 |
| lbragstad | but i have no idea how not | 20:40 |
| kmalloc | hmm | 20:40 |
| kmalloc | what version of keystone is he using | 20:41 |
| kmalloc | because shadow stuff might have 100% mitigated that | 20:41 |
| lbragstad | we used to have a fix for getting that to work with users... | 20:42 |
| *** spilla has quit IRC | 20:42 | |
| lbragstad | well - we still have that fix | 20:42 |
| kmalloc | right | 20:42 |
| lbragstad | technically - it should blow up here https://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L403-L413 | 20:43 |
| lbragstad | but it doesnt? | 20:44 |
| kmalloc | check to see if it's hitting shadow user stuff | 20:44 |
| kmalloc | because the api.get would work if the group is shadowed | 20:44 |
| kmalloc | right? | 20:44 |
| kmalloc | lbragstad: also, it's funny, but unit tests are running. | 20:45 |
| kmalloc | but man it's slow | 20:45 |
| kmalloc | lbragstad: what was the invocation to run unit tests with the pretty output? | 20:46 |
| lbragstad | added so logging to figure out what in the world is going on | 20:46 |
| lbragstad | that's a good question, i'm not quite sure? | 20:47 |
| *** edmondsw has quit IRC | 20:47 | |
| ayoung | kmalloc, there is a reason all this technology exists, you know. | 20:49 |
| kmalloc | ayoung: do you rtememebr the magic subunit-trace invocation w/ tox | 20:50 |
| kmalloc | ayoung: this is driving me batty, i want to see the tests running | 20:50 |
| ayoung | kmalloc, so I remeber enable the venv and run the command tox runs | 20:50 |
| kmalloc | there was something needed piping to like subunit-trace | 20:51 |
| ayoung | oslo_debug_helper {posargs} | 20:52 |
| ayoung | What is that? | 20:52 |
| kmalloc | no idea | 20:52 |
| ayoung | https://docs.openstack.org/os-testr/latest/user/subunit_trace.html | 20:52 |
| ayoung | stestr run | 20:53 |
| *** AlexeyAbashkin has joined #openstack-keystone | 20:53 | |
| ayoung | something like that? | 20:53 |
| kmalloc | ayoung: yeah, but i can't seem to get it to work. | 20:56 |
| lbragstad | bah! caching bites me again | 20:57 |
| *** AlexeyAbashkin has quit IRC | 20:57 | |
| lbragstad | once i disabled caching i was able to recreate it | 21:00 |
| kmalloc | ayoung: it's working now | 21:00 |
| kmalloc | lbragstad: AHA | 21:01 |
| kmalloc | lbragstad: yeaaaah | 21:01 |
| *** panbalag has joined #openstack-keystone | 21:01 | |
| *** panbalag has left #openstack-keystone | 21:01 | |
| lbragstad | that group was being cached... | 21:01 |
| kmalloc | lbragstad: rememebr, only 2 hard things in computer science | 21:01 |
| kmalloc | lbragstad: naming things, caching, off-by-one-errors | 21:01 |
| lbragstad | lol | 21:01 |
| lbragstad | exactly | 21:01 |
| kmalloc | i also like the async data version of that too | 21:02 |
| kmalloc | holy crap. i'm... running 32 python test runners under windows subsystem for linux | 21:02 |
| kmalloc | it's... working | 21:02 |
| kmalloc | heh, load: 0.52 | 21:02 |
| *** itlinux has joined #openstack-keystone | 21:03 | |
| kmalloc | lbragstad: i... i want another threadripper now. | 21:03 |
| kmalloc | ... obligatory: COULD YOU IMAGINE A BEOWULF CLUSTER OF THOSE!?! *sigh* I'm ... making it clear how long i've lurked on the intertubes now | 21:04 |
| kmalloc | ayoung: yeah, well i guess I'm back to having a far more complex home lab than expected ;) | 21:06 |
| *** martinus__ has quit IRC | 21:06 | |
| kmalloc | lbragstad: our tests are stupid chatty about debug things like scope-check failures | 21:07 |
| kmalloc | lbragstad: we should make sure we aren't emitting that cruft unlessw e care | 21:07 |
| lbragstad | yeah - i need to fix that | 21:10 |
| lbragstad | not the chattyness | 21:10 |
| lbragstad | the actual tests | 21:10 |
| lbragstad | to do things properly with scope | 21:10 |
| ayoung | I actually built Beowulf clusters for a living. I cannot imagine a Beowulf cluster of those. | 21:12 |
| *** itlinux has quit IRC | 21:18 | |
| kmalloc | ayoung: lol | 21:19 |
| kmalloc | ayoung: i really do want to setup a few compute nodes that are all 1950x processors | 21:19 |
| kmalloc | ayoung: it would be fantastic. | 21:19 |
| kmalloc | but i don't have that kind of money | 21:19 |
| ayoung | Running Windows? | 21:20 |
| kmalloc | i run it locally for reasons of lazyness | 21:20 |
| kmalloc | but i would run those nodes under linux | 21:20 |
| ayoung | https://adam.younglogic.com/2012/03/shared-nothing-diskless-boot/ | 21:20 |
| kmalloc | yeah i've done that before | 21:21 |
| kmalloc | it's fantastic. | 21:21 |
| ayoung | Kinda want to do that for an OpenStack cluster | 21:21 |
| kmalloc | that is how we managed all of our nodes at myspace [largely my design] | 21:21 |
| kmalloc | and how we did it at blizzard | 21:21 |
| kmalloc | ayoung: it wouldn't be too hard to do that for some of openstack, but parts need stateful storage [but i guess that could be outside of the root] | 21:24 |
| kmalloc | notably libvirt is a culprit. | 21:24 |
| kmalloc | and some cinder things | 21:24 |
| ayoung | iSCSI for that | 21:24 |
| kmalloc | sure. | 21:25 |
| kmalloc | you'd have some wonky | 21:25 |
| kmalloc | for some things | 21:25 |
| *** felipemonteiro__ has quit IRC | 21:25 | |
| kmalloc | but generally it would be doable for the API nodes themselves. | 21:26 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Allow to remove a group deleted out-of-band from LDAP https://review.openstack.org/546969 | 21:39 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add a test for cleaning up stale group assignments https://review.openstack.org/559435 | 21:39 |
| *** raildo has quit IRC | 21:41 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add a test for cleaning up stale group assignments https://review.openstack.org/559435 | 21:43 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add a test for cleaning up stale group assignments https://review.openstack.org/559435 | 21:43 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Allow blockin users from self-service password change https://review.openstack.org/559438 | 22:13 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Allow blocking users from self-service password change https://review.openstack.org/559438 | 22:15 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Allow blocking users from self-service password change https://review.openstack.org/559438 | 22:15 |
| kmalloc | lbragstad: ^ there ya go | 22:16 |
| gagehugo | nice | 22:19 |
| lbragstad | kmalloc: awesome - thanks for picking that up | 22:19 |
| *** fried_rice is now known as efried | 22:23 | |
| *** superdan is now known as dansmith | 22:25 | |
| openstackgerrit | Merged openstack/keystone master: Fix incompatible requirement in lower-constraints https://review.openstack.org/559334 | 22:35 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Allow blocking users from self-service password change https://review.openstack.org/559438 | 22:57 |
| *** r-daneel has quit IRC | 23:20 | |
| *** lbragstad has quit IRC | 23:34 | |
| *** itlinux has joined #openstack-keystone | 23:39 | |
| *** jessegler has quit IRC | 23:41 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 23:53 | |
| *** AlexeyAbashkin has quit IRC | 23:58 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!