| *** r-daneel has quit IRC | 00:00 | |
| *** panbalag has joined #openstack-keystone | 00:51 | |
| *** namnh has joined #openstack-keystone | 00:51 | |
| *** kmalloc has quit IRC | 01:10 | |
| *** panbalag has left #openstack-keystone | 01:11 | |
| *** sapd has joined #openstack-keystone | 01:35 | |
| *** viks_ has joined #openstack-keystone | 02:08 | |
| *** gmann_ has joined #openstack-keystone | 02:08 | |
| *** wlmbasson_ has joined #openstack-keystone | 02:08 | |
| *** jamespage_ has joined #openstack-keystone | 02:09 | |
| *** breton has joined #openstack-keystone | 02:11 | |
| *** chrome0_ has joined #openstack-keystone | 02:12 | |
| *** chrome0 has quit IRC | 02:12 | |
| *** breton__ has quit IRC | 02:12 | |
| *** viks has quit IRC | 02:12 | |
| *** jamespage has quit IRC | 02:12 | |
| *** wlmbasson has quit IRC | 02:12 | |
| *** mordred has quit IRC | 02:12 | |
| *** d0ugal has quit IRC | 02:12 | |
| *** gmann has quit IRC | 02:12 | |
| *** ianw_pto has quit IRC | 02:12 | |
| *** viks_ is now known as viks | 02:12 | |
| *** wlmbasson_ is now known as wlmbasson | 02:12 | |
| *** jamespage_ is now known as jamespage | 02:13 | |
| *** ianw has joined #openstack-keystone | 02:13 | |
| *** mordred has joined #openstack-keystone | 02:13 | |
| *** d0ugal has joined #openstack-keystone | 02:13 | |
| *** cburgess has quit IRC | 02:15 | |
| *** cburgess has joined #openstack-keystone | 02:18 | |
| *** gongysh has joined #openstack-keystone | 02:19 | |
| *** edmondsw has joined #openstack-keystone | 02:20 | |
| *** daidv has joined #openstack-keystone | 02:46 | |
| *** daidv has quit IRC | 02:49 | |
| *** namnh_ has joined #openstack-keystone | 03:06 | |
| *** namnh has quit IRC | 03:08 | |
| *** jenglisch has quit IRC | 03:27 | |
| *** jenglisch has joined #openstack-keystone | 03:29 | |
| *** nicolasbock has quit IRC | 03:33 | |
| *** rvba has joined #openstack-keystone | 03:33 | |
| *** rvba has quit IRC | 03:33 | |
| *** rvba has joined #openstack-keystone | 03:33 | |
| *** annp has joined #openstack-keystone | 03:39 | |
| *** prashkre has joined #openstack-keystone | 03:47 | |
| *** edmondsw has quit IRC | 03:50 | |
| *** dklyle has joined #openstack-keystone | 04:02 | |
| *** ayoung has quit IRC | 04:08 | |
| *** prashkre has quit IRC | 04:14 | |
| *** edmondsw has joined #openstack-keystone | 04:18 | |
| *** edmondsw has quit IRC | 04:21 | |
| *** edmondsw has joined #openstack-keystone | 04:21 | |
| *** edmondsw has quit IRC | 04:21 | |
| *** edmondsw has joined #openstack-keystone | 04:22 | |
| *** namnh has joined #openstack-keystone | 04:23 | |
| *** namnh_ has quit IRC | 04:23 | |
| *** dklyle has quit IRC | 04:26 | |
| *** edmondsw has quit IRC | 04:26 | |
| *** dklyle has joined #openstack-keystone | 04:30 | |
| *** dklyle has quit IRC | 04:35 | |
| *** links has joined #openstack-keystone | 04:53 | |
| *** prashkre has joined #openstack-keystone | 05:16 | |
| *** belmoreira has joined #openstack-keystone | 05:19 | |
| *** prashkre has quit IRC | 05:20 | |
| *** prashkre has joined #openstack-keystone | 05:20 | |
| *** d0ugal has quit IRC | 05:46 | |
| *** d0ugal has joined #openstack-keystone | 06:13 | |
| *** tesseract has joined #openstack-keystone | 06:58 | |
| *** tesseract has quit IRC | 07:00 | |
| *** tesseract has joined #openstack-keystone | 07:02 | |
| *** pcaruana has joined #openstack-keystone | 07:31 | |
| *** rcernin has quit IRC | 07:32 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:45 | |
| *** threestrands_ has quit IRC | 07:52 | |
| *** jaosorior has joined #openstack-keystone | 08:24 | |
| *** dtruong_ has joined #openstack-keystone | 08:27 | |
| *** dtruong has quit IRC | 08:28 | |
| *** prashkre has quit IRC | 08:36 | |
| *** prashkre has joined #openstack-keystone | 08:38 | |
| eEbx | Hello, I'm thinking about keystone cluster in two data centers. Can you recommend me some best practices or do you have some architectural plan? | 08:40 |
|---|---|---|
| *** jmccarthy has joined #openstack-keystone | 08:42 | |
| jmccarthy | Does keystone support this currently ? assert:supports-zero-downtime-upgrade | 08:43 |
| *** rpittau has joined #openstack-keystone | 08:52 | |
| *** Alexey_Abashkin has joined #openstack-keystone | 08:57 | |
| *** hoonetorg has quit IRC | 08:58 | |
| *** AlexeyAbashkin has quit IRC | 09:01 | |
| *** Alexey_Abashkin is now known as AlexeyAbashkin | 09:01 | |
| *** hoonetorg has joined #openstack-keystone | 09:15 | |
| cmurphy | eEbx: we don't really have a good document on that yet :/ you might try the #openstack-operators room or the openstack-operators mailing list for some best practice advice | 09:32 |
| eEbx | cmurphy: ok thanks a lot | 09:33 |
| cmurphy | jmccarthy: we don't currently assert that tag, but we do support rolling upgrades (we're just short of asserting the tag by some CI requirements) and zero downtime should be achievable that way | 09:33 |
| jmccarthy | cmurphy: Ok - this is the best docs for this at the moment is it ? https://docs.openstack.org/keystone/pike/admin/identity-upgrading.html | 09:35 |
| cmurphy | jmccarthy: yes or the queens version https://docs.openstack.org/keystone/queens/admin/identity-upgrading.html | 09:37 |
| cmurphy | though i don't think it's changed | 09:37 |
| jmccarthy | cmurphy: Oh yes, great - thanks ! :) | 09:37 |
| cmurphy | np | 09:37 |
| *** pcichy has quit IRC | 09:40 | |
| *** pcichy has joined #openstack-keystone | 09:40 | |
| *** mtreinish has quit IRC | 09:41 | |
| *** Horrorcat has quit IRC | 09:47 | |
| *** mtreinish has joined #openstack-keystone | 09:47 | |
| *** Horrorcat has joined #openstack-keystone | 09:48 | |
| *** Horrorcat has joined #openstack-keystone | 09:48 | |
| *** jaosorior has quit IRC | 09:49 | |
| *** prashkre has quit IRC | 09:49 | |
| *** prashkre has joined #openstack-keystone | 09:49 | |
| *** gongysh has quit IRC | 10:01 | |
| *** namnh has quit IRC | 10:14 | |
| *** nicolasbock has joined #openstack-keystone | 10:33 | |
| *** threestrands_ has joined #openstack-keystone | 11:01 | |
| *** d3mon has joined #openstack-keystone | 11:16 | |
| *** d3mon has left #openstack-keystone | 11:16 | |
| *** openstackgerrit has joined #openstack-keystone | 11:22 | |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Turn normalize_status into a class https://review.openstack.org/564110 | 11:22 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Infer version from old versioned service type aliases https://review.openstack.org/564299 | 11:22 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Make VersionData class https://review.openstack.org/564469 | 11:22 |
| mordred | cmurphy: ^^ that last patch should take care of your original review on the version data patches | 11:23 |
| cmurphy | mordred: sweet | 11:23 |
| *** pcichy has quit IRC | 11:24 | |
| mordred | cmurphy: if we don't watch out, we're going to have a workable service type story | 11:24 |
| cmurphy | whoa | 11:25 |
| *** prashkre_ has joined #openstack-keystone | 11:35 | |
| *** prashkre has quit IRC | 11:36 | |
| *** rm_work has quit IRC | 11:39 | |
| *** rm_work has joined #openstack-keystone | 11:39 | |
| *** raildo has joined #openstack-keystone | 11:48 | |
| *** alex_xu has quit IRC | 11:49 | |
| *** alex_xu has joined #openstack-keystone | 11:49 | |
| *** edmondsw has joined #openstack-keystone | 11:57 | |
| *** edmondsw_ has joined #openstack-keystone | 11:58 | |
| *** edmondsw has quit IRC | 12:02 | |
| *** edmondsw_ is now known as edmondsw | 12:08 | |
| gagehugo | o/ | 12:22 |
| *** alee__ has quit IRC | 12:28 | |
| *** dave-mccowan has joined #openstack-keystone | 12:31 | |
| *** panbalag has joined #openstack-keystone | 12:40 | |
| *** dave-mcc_ has joined #openstack-keystone | 12:40 | |
| *** panbalag has left #openstack-keystone | 12:41 | |
| *** dave-mccowan has quit IRC | 12:43 | |
| *** threestrands_ has quit IRC | 12:58 | |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Infer version from old versioned service type aliases https://review.openstack.org/564299 | 13:04 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Allow tuples and sets in interface list https://review.openstack.org/564495 | 13:04 |
| *** bhagyashris has quit IRC | 13:09 | |
| *** edmondsw has quit IRC | 13:12 | |
| *** edmondsw has joined #openstack-keystone | 13:12 | |
| *** alee__ has joined #openstack-keystone | 13:13 | |
| *** edmondsw has quit IRC | 13:16 | |
| *** jdennis has quit IRC | 13:19 | |
| *** mvk has quit IRC | 13:29 | |
| *** jaosorior has joined #openstack-keystone | 13:35 | |
| *** ediardo has quit IRC | 13:44 | |
| lbragstad | jamielennox: the system scope one? | 13:57 |
| lbragstad | it's a dictionary | 13:57 |
| *** mvk has joined #openstack-keystone | 13:58 | |
| *** pcichy has joined #openstack-keystone | 14:01 | |
| *** spilla has joined #openstack-keystone | 14:11 | |
| *** jaosorior has quit IRC | 14:12 | |
| *** jaosorior has joined #openstack-keystone | 14:13 | |
| *** edmondsw has joined #openstack-keystone | 14:19 | |
| *** raildo has quit IRC | 14:29 | |
| *** raildo has joined #openstack-keystone | 14:41 | |
| *** pcaruana has quit IRC | 14:42 | |
| *** r-daneel has joined #openstack-keystone | 14:45 | |
| *** dklyle has joined #openstack-keystone | 14:47 | |
| *** edmondsw has quit IRC | 14:54 | |
| *** edmondsw has joined #openstack-keystone | 14:54 | |
| *** jaosorior has quit IRC | 14:55 | |
| *** felipemonteiro_ has joined #openstack-keystone | 14:58 | |
| *** felipemonteiro__ has joined #openstack-keystone | 14:59 | |
| *** r-daneel has quit IRC | 15:01 | |
| *** felipemonteiro_ has quit IRC | 15:03 | |
| *** jdennis has joined #openstack-keystone | 15:04 | |
| *** jistr|mtgs is now known as jistr | 15:04 | |
| -openstackstatus- NOTICE: We've successfully troubleshooted the issue that prevented paste.openstack.org from loading and it's now back online, thank you for your patience. | 15:05 | |
| *** links has quit IRC | 15:06 | |
| *** chudly has joined #openstack-keystone | 15:15 | |
| openstackgerrit | Merged openstack/keystone master: Remove policy service from architecture.rst https://review.openstack.org/564239 | 15:16 |
| *** jdennis has quit IRC | 15:33 | |
| *** gyee has joined #openstack-keystone | 15:40 | |
| *** jmlowe has quit IRC | 15:44 | |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.policy master: Update documentation to include usage for new projects https://review.openstack.org/564340 | 15:44 |
| *** Guest62064 is now known as lamt | 15:48 | |
| *** jdennis has joined #openstack-keystone | 15:48 | |
| *** AlexeyAbashkin has quit IRC | 15:56 | |
| cmurphy | if we propose moving the default roles session from Thursday to Monday at 11:35 how do people feel about that? | 15:56 |
| lbragstad | +1 from me | 15:57 |
| gagehugo | yes please | 15:57 |
| lbragstad | knikolla: have you heard of any updates about the mutable configs goal? | 15:59 |
| lbragstad | i was just reading the weekly release email and it reminded me of that | 16:00 |
| *** d0ugal has quit IRC | 16:03 | |
| *** d0ugal has joined #openstack-keystone | 16:04 | |
| *** jmlowe has joined #openstack-keystone | 16:04 | |
| *** jmlowe has quit IRC | 16:05 | |
| *** empty_cup has joined #openstack-keystone | 16:12 | |
| empty_cup | I'm trying to associate a user with a project using Keystone's REST APIs. Initially I set the default_project_id field but that seems more like a suggestion. | 16:14 |
| lbragstad | empty_cup: correct | 16:14 |
| lbragstad | empty_cup: you need to explicitly give that user authorization | 16:14 |
| empty_cup | I'm also assigning the role to user on project and both return successfully but when I list the projects that a user belongs to, it is empty. | 16:15 |
| lbragstad | empty_cup: we have a note about default_project_id here - https://developer.openstack.org/api-ref/identity/v3/index.html#users | 16:16 |
| lbragstad | empty_cup: which APIs are you calling? do you have a trace? | 16:16 |
| empty_cup | Ok, the confirmation helps that I need to create a role and assign it to a user on a project | 16:17 |
| empty_cup | lbragstad: I'm working on a trace. Basically I create a user, then a role, assign the user to the role on an existing project. | 16:21 |
| lbragstad | ok | 16:21 |
| lbragstad | that sounds about right | 16:21 |
| lbragstad | what api are you asking for a user's projects? | 16:21 |
| empty_cup | Although when I list projects for the user there is nothing in the array. I'm using v3. I can see each in Horizon except for the role | 16:22 |
| empty_cup | I am creating all of the objects in a separate domain although I can view them while logging in as the default admin account on the default domain. | 16:23 |
| empty_cup | Except for the role, the role doesn't show up. | 16:23 |
| lbragstad | hmm | 16:25 |
| lbragstad | are you using /v3/role_assignments | 16:25 |
| lbragstad | or GET /v3/auth/projects ? | 16:25 |
| lbragstad | are you using openstackclient? | 16:26 |
| empty_cup | yep, v3 for everything, that's my reference | 16:27 |
| empty_cup | sorry, i'm using post requests for everything -- i have a python script or using curl | 16:27 |
| lbragstad | ok - if you have a token for the user you're trying to list projects for, you should be able to use GET /v3/auth/projects | 16:29 |
| lbragstad | and get a list of all projects you have authorization on | 16:29 |
| lbragstad | otherwise, as an administrator, you should be able to call the /v3/role_assignments API and list all role assignments present in the deployment | 16:29 |
| empty_cup | i'm working on it, thanks for the help | 16:31 |
| *** edmondsw has quit IRC | 16:31 | |
| *** jmccarthy has left #openstack-keystone | 16:31 | |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Infer version from old versioned service type aliases https://review.openstack.org/564299 | 16:41 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Allow tuples and sets in interface list https://review.openstack.org/564495 | 16:42 |
| mordred | lbragstad: I got the class extraction done in that stack ^^ like you wanted | 16:44 |
| mordred | lbragstad: https://review.openstack.org/#/c/564469/1 | 16:44 |
| *** felipemonteiro__ has quit IRC | 16:45 | |
| lbragstad | oh -cool | 16:45 |
| *** felipemonteiro has joined #openstack-keystone | 16:45 | |
| *** lbragstad[m] has joined #openstack-keystone | 16:46 | |
| *** eschwartz has quit IRC | 16:48 | |
| *** germs has joined #openstack-keystone | 16:50 | |
| *** germs has quit IRC | 16:50 | |
| *** germs has joined #openstack-keystone | 16:50 | |
| *** anyone has joined #openstack-keystone | 16:51 | |
| *** ediardo has joined #openstack-keystone | 16:55 | |
| *** lbragstad has quit IRC | 17:07 | |
| *** dklyle has quit IRC | 17:12 | |
| *** germs has quit IRC | 17:13 | |
| *** germs has joined #openstack-keystone | 17:13 | |
| *** germs has quit IRC | 17:13 | |
| *** germs has joined #openstack-keystone | 17:13 | |
| empty_cup | lbragstad[m]: I confirmed by using the roles?domain_id that I see the role created. And I have a trace of activity. Is there a pastebin of choice the channel uses? | 17:19 |
| empty_cup | I feel like I'm really close to understanding how keystone works | 17:19 |
| mordred | empty_cup: http://paste.openstack.org is a good one | 17:21 |
| mordred | empty_cup: and yay for understanding! | 17:21 |
| *** germs has quit IRC | 17:24 | |
| *** germs has joined #openstack-keystone | 17:25 | |
| *** germs has quit IRC | 17:25 | |
| *** germs has joined #openstack-keystone | 17:25 | |
| *** germs has quit IRC | 17:26 | |
| *** germs has joined #openstack-keystone | 17:26 | |
| *** germs has quit IRC | 17:26 | |
| *** germs has joined #openstack-keystone | 17:26 | |
| empty_cup | Pasted here: http://paste.openstack.org/show/719965/ | 17:26 |
| *** belmoreira has quit IRC | 17:32 | |
| *** anyone is now known as eschwartz | 17:32 | |
| *** prashkre__ has joined #openstack-keystone | 17:38 | |
| *** prashkre_ has quit IRC | 17:38 | |
| empty_cup | i'm starting to think it may be influenced by the scope of the admin token | 17:41 |
| lbragstad[m] | empty_cup: which API are you calling? | 17:43 |
| *** germs has quit IRC | 17:46 | |
| *** germs has joined #openstack-keystone | 17:47 | |
| *** germs has quit IRC | 17:47 | |
| *** germs has joined #openstack-keystone | 17:47 | |
| knikolla | lbragstad[m]: i haven't checked with regards to mutable config. will do. | 17:47 |
| *** alee__ has left #openstack-keystone | 17:47 | |
| empty_cup | libragstad: http://localhost/identity/v3 | 17:47 |
| lbragstad[m] | that's the root path of the v3 api | 17:49 |
| *** felipemonteiro has quit IRC | 17:51 | |
| *** felipemonteiro has joined #openstack-keystone | 17:51 | |
| empty_cup | oh sorry, i misunderstood the question, which api call? the pastebin contains the resulting text for each API call. i can include the URL data as well | 17:51 |
| lbragstad[m] | lines 15 and 16 in your paste seem to be missing the call you made? | 17:54 |
| *** mvk has quit IRC | 17:55 | |
| empty_cup | lbragstad[m]: /roles?domain_id= using the same domain_id fed into the creation commands | 17:59 |
| lbragstad[m] | oh - gotcha | 18:00 |
| lbragstad[m] | so - that's only going to give you a list of role filtered by the domain, were you looking for it to give you a list of people with authorization on that domain? | 18:00 |
| empty_cup | that's a good point, i'll find the other command that will list authorized users | 18:10 |
| lbragstad[m] | empty_cup: https://developer.openstack.org/api-ref/identity/v3/index.html#id594 might help | 18:16 |
| *** felipemonteiro_ has joined #openstack-keystone | 18:17 | |
| *** felipemonteiro has quit IRC | 18:21 | |
| *** lbragstad has joined #openstack-keystone | 18:22 | |
| *** ChanServ sets mode: +o lbragstad | 18:22 | |
| *** dklyle has joined #openstack-keystone | 18:22 | |
| *** tesseract has quit IRC | 18:24 | |
| *** mvk has joined #openstack-keystone | 18:31 | |
| *** harlowja has joined #openstack-keystone | 18:46 | |
| empty_cup | ok i was applying the role to the domain and not on the project. that's fixed | 18:55 |
| empty_cup | now through the use of policy.json i can craft a policy that says this role has the ability to create users only within this project | 18:56 |
| lbragstad[m] | technically - yes... | 18:56 |
| empty_cup | is there a better way? | 18:57 |
| lbragstad[m] | but we do have some stuff in the works to make it so that you don't have to roll a custom policy for that kind of thing https://bugs.launchpad.net/keystone/+bug/1748027 | 18:57 |
| openstack | Launchpad bug 1748027 in OpenStack Identity (keystone) "The v3 users API should account for different scopes" [High,Triaged] - Assigned to sonu (sonu-bhumca11) | 18:57 |
| empty_cup | neat | 19:06 |
| empty_cup | now that i have the trifecta of role, project, and user. when i list projects for user the array is still empty. should it be empty or populated with the project? | 19:07 |
| lbragstad | how are you listing the projects for a user? | 19:08 |
| lbragstad | GET /v3/auth/projects ? | 19:08 |
| empty_cup | /v3/users/{user_id}/projects | 19:09 |
| empty_cup | as an admin from default | 19:09 |
| lbragstad | empty_cup: and the user is in a different domain with a role assignment on a project in a different domain? | 19:10 |
| lbragstad | empty_cup: i was able to do this locally - http://paste.openstack.org/raw/719967/ | 19:17 |
| lbragstad | i was operating as the 'admin' user from devstack which has the administrator role and is within the default domain | 19:18 |
| empty_cup | cool, i'm looking at it. i've been using the 'admin' user from devstack as well | 19:23 |
| *** ediardo has quit IRC | 19:23 | |
| *** felipemonteiro__ has joined #openstack-keystone | 19:46 | |
| *** felipemonteiro_ has quit IRC | 19:46 | |
| mordred | lbragstad: did morgan change his nick again or is he just not in channel? | 19:47 |
| lbragstad | i think kmalloc just dropped | 19:48 |
| lbragstad | i'm unaware of a nick change | 19:48 |
| lbragstad | but - would totally believe it if he did change nicks again :) | 19:48 |
| mordred | right? tough to keep up with him on that :) | 19:48 |
| lbragstad | it took me about 2 days to catch on to kmalloc | 19:49 |
| mordred | lbragstad: in any case, the plan of "make an sdk patch consuming the alias patches to make sure we didn't miss anything" TOTALLY bore fruit and caught a bug | 19:49 |
| lbragstad | nice! | 19:49 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Infer version from old versioned service type aliases https://review.openstack.org/564299 | 20:10 |
| mordred | lbragstad: ^^ this time with winning included | 20:13 |
| openstackgerrit | Merged openstack/oslo.policy master: Trivial: Update pypi url to new url https://review.openstack.org/563368 | 20:29 |
| *** jmlowe has joined #openstack-keystone | 20:33 | |
| *** raildo has quit IRC | 20:34 | |
| *** belmoreira has joined #openstack-keystone | 20:57 | |
| *** pcichy has quit IRC | 20:59 | |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy master: make the sphinxpolicygen extension handle multiple input/output files https://review.openstack.org/564627 | 21:00 |
| empty_cup | lbragstad: is there the ability for a project "admin" to create users scoped to a specific project within a specific domain? | 21:00 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Infer version from old versioned service type aliases https://review.openstack.org/564299 | 21:01 |
| lbragstad | empty_cup: an admin can give users roles on specific projects, which essentially acts as scope | 21:02 |
| lbragstad | empty_cup: are you trying to find a way to make it so that a user can only work within one project? | 21:02 |
| lbragstad | other wise users at technically scoped to domains | 21:02 |
| lbragstad | which act as containers for users, groups, and projects | 21:03 |
| lbragstad | and sometimes roles | 21:03 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy master: make the sphinxpolicygen extension handle multiple input/output files https://review.openstack.org/564627 | 21:03 |
| *** prashkre__ has quit IRC | 21:04 | |
| empty_cup | lbragstad: oh, i'm starting to see that's not how it is designed. the user is created in the domain and then based on roles is allowed into projects | 21:07 |
| *** dklyle has quit IRC | 21:08 | |
| *** david-lyle has joined #openstack-keystone | 21:08 | |
| lbragstad | correct | 21:11 |
| lbragstad | keystone tries to be explicit with authorization | 21:12 |
| lbragstad | so even if a user's domain is set, they don't automatically get authorization on projects within that domain | 21:12 |
| lbragstad | an administrator of some kind must grant them authorization explicitly | 21:12 |
| empty_cup | got it | 21:26 |
| *** spilla has quit IRC | 21:31 | |
| *** belmoreira has quit IRC | 21:46 | |
| *** dave-mcc_ has quit IRC | 22:02 | |
| *** rcernin has joined #openstack-keystone | 22:23 | |
| *** felipemonteiro__ has quit IRC | 22:28 | |
| *** david-lyle is now known as dklyle | 22:33 | |
| jamielennox | lbragstad: ok, it's kind of weird (or just not something we'd done before) passing a dict through the environment headers | 22:55 |
| jamielennox | is it a known dict or something that will change frequently? | 22:56 |
| *** annp has quit IRC | 23:13 | |
| *** annp has joined #openstack-keystone | 23:14 | |
| *** empty_cup has quit IRC | 23:17 | |
| *** jmccrory has quit IRC | 23:17 | |
| *** jmccrory has joined #openstack-keystone | 23:18 | |
| *** gyee has quit IRC | 23:54 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!