| *** liuzz has joined #openstack-keystone | 01:03 | |
| *** openstack has joined #openstack-keystone | 01:17 | |
| *** ChanServ sets mode: +o openstack | 01:17 | |
| *** zhongjun__ has joined #openstack-keystone | 01:44 | |
| *** gongysh has joined #openstack-keystone | 01:50 | |
| *** annp has joined #openstack-keystone | 02:31 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add auto increase primary key for unified limit https://review.openstack.org/576025 | 02:39 |
|---|---|---|
| *** germs has quit IRC | 03:04 | |
| *** germs has joined #openstack-keystone | 03:04 | |
| *** germs has quit IRC | 03:04 | |
| *** germs has joined #openstack-keystone | 03:04 | |
| openstackgerrit | zhongshengping proposed openstack/keystone master: Fix syntax errors https://review.openstack.org/577715 | 03:05 |
| *** germs has quit IRC | 03:06 | |
| *** liuzz_ has joined #openstack-keystone | 03:06 | |
| *** germs has joined #openstack-keystone | 03:08 | |
| *** germs has quit IRC | 03:08 | |
| *** germs has joined #openstack-keystone | 03:08 | |
| *** liuzz has quit IRC | 03:10 | |
| *** liuzz has joined #openstack-keystone | 03:13 | |
| *** liuzz_ has quit IRC | 03:16 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add auto increase primary key for unified limit https://review.openstack.org/576025 | 03:39 |
| *** pooja_jadhav has joined #openstack-keystone | 03:44 | |
| *** d0ugal_ has joined #openstack-keystone | 04:15 | |
| *** germs has quit IRC | 04:15 | |
| *** d0ugal has quit IRC | 04:15 | |
| *** germs has joined #openstack-keystone | 04:40 | |
| *** mvk has quit IRC | 04:52 | |
| *** gongysh has quit IRC | 05:15 | |
| *** nicolasbock has joined #openstack-keystone | 05:21 | |
| *** gongysh has joined #openstack-keystone | 05:41 | |
| *** germs_ has joined #openstack-keystone | 05:51 | |
| *** germs has quit IRC | 05:54 | |
| *** pcichy has quit IRC | 06:02 | |
| *** josecastroleon has joined #openstack-keystone | 06:17 | |
| *** hoonetorg has quit IRC | 06:20 | |
| *** hoonetorg has joined #openstack-keystone | 06:32 | |
| *** ispp has joined #openstack-keystone | 06:45 | |
| *** belmoreira has joined #openstack-keystone | 06:45 | |
| *** belmoreira has quit IRC | 06:46 | |
| *** ispp has quit IRC | 06:47 | |
| *** lifeless has quit IRC | 06:49 | |
| *** martinus__ has joined #openstack-keystone | 06:52 | |
| *** ispp has joined #openstack-keystone | 07:05 | |
| *** pcaruana has joined #openstack-keystone | 07:07 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add auto increase primary key for unified limit https://review.openstack.org/576025 | 07:14 |
| *** tesseract has joined #openstack-keystone | 07:20 | |
| *** rogeryu_ has joined #openstack-keystone | 07:24 | |
| rogeryu_ | https://review.openstack.org/#/c/577612/ | 07:24 |
| rogeryu_ | Has anyone helped me to review this commit? thank you very much! :) | 07:24 |
| *** amoralej|off is now known as amoralej | 07:42 | |
| *** pcichy has joined #openstack-keystone | 08:06 | |
| *** jistr|off is now known as jistr | 08:14 | |
| *** d0ugal_ has quit IRC | 08:16 | |
| *** d0ugal has joined #openstack-keystone | 08:17 | |
| *** d0ugal has quit IRC | 08:17 | |
| *** d0ugal has joined #openstack-keystone | 08:17 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add registered_limit_id column for limit https://review.openstack.org/577751 | 08:39 |
| *** jaosorior has joined #openstack-keystone | 08:43 | |
| *** namnh has joined #openstack-keystone | 08:43 | |
| *** sapd has quit IRC | 08:59 | |
| *** brad[] has joined #openstack-keystone | 09:15 | |
| *** sapd has joined #openstack-keystone | 09:23 | |
| *** namnh has quit IRC | 09:36 | |
| *** mvk has joined #openstack-keystone | 09:39 | |
| *** namnh has joined #openstack-keystone | 09:41 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: [WIP]Add registered_limit_id column for limit https://review.openstack.org/577751 | 09:55 |
| *** peereb has joined #openstack-keystone | 09:59 | |
| *** peereb has quit IRC | 10:01 | |
| *** peereb has joined #openstack-keystone | 10:01 | |
| *** peereb has quit IRC | 10:02 | |
| *** peereb has joined #openstack-keystone | 10:03 | |
| *** ispp has quit IRC | 10:03 | |
| *** peereb has quit IRC | 10:04 | |
| *** peereb has joined #openstack-keystone | 10:04 | |
| *** peereb has quit IRC | 10:05 | |
| *** namnh_ has joined #openstack-keystone | 10:21 | |
| *** namnh_ has quit IRC | 10:21 | |
| *** namnh has quit IRC | 10:24 | |
| *** edmondsw has joined #openstack-keystone | 10:45 | |
| *** edmondsw_ has joined #openstack-keystone | 10:48 | |
| *** edmondsw has quit IRC | 10:49 | |
| *** gongysh has quit IRC | 11:08 | |
| *** pooja_jadhav has quit IRC | 11:17 | |
| *** josecastroleon has quit IRC | 11:25 | |
| *** ispp has joined #openstack-keystone | 11:25 | |
| *** tosky has joined #openstack-keystone | 11:28 | |
| *** josecastroleon has joined #openstack-keystone | 11:28 | |
| *** bhagyashris has quit IRC | 11:30 | |
| *** amoralej is now known as amoralej|lunch | 11:32 | |
| *** ispp has quit IRC | 11:34 | |
| *** josecastroleon has quit IRC | 11:38 | |
| *** ispp has joined #openstack-keystone | 11:40 | |
| *** rogeryu_ has quit IRC | 11:41 | |
| *** josecastroleon has joined #openstack-keystone | 11:42 | |
| *** annp has quit IRC | 11:44 | |
| *** ispp has quit IRC | 11:46 | |
| *** ispp has joined #openstack-keystone | 11:46 | |
| *** josecastroleon has quit IRC | 11:49 | |
| *** josecastroleon has joined #openstack-keystone | 11:52 | |
| *** edmondsw_ has quit IRC | 11:53 | |
| *** pooja_jadhav has joined #openstack-keystone | 11:54 | |
| *** raildo has joined #openstack-keystone | 12:03 | |
| *** ispp has quit IRC | 12:05 | |
| *** edmondsw has joined #openstack-keystone | 12:30 | |
| *** amoralej|lunch is now known as amoralej | 12:31 | |
| *** germs_ has quit IRC | 12:35 | |
| *** evrardjp_ has joined #openstack-keystone | 12:47 | |
| *** evrardjp has quit IRC | 12:50 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/oslo.policy master: Implement base for pluggable policy drivers https://review.openstack.org/577807 | 12:53 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/oslo.policy master: Create _plugins directory for enforcer drivers https://review.openstack.org/577808 | 12:53 |
| *** evrardjp_ has quit IRC | 12:53 | |
| *** efried_pto is now known as efried | 12:56 | |
| *** efried has left #openstack-keystone | 12:57 | |
| *** evrardjp_ has joined #openstack-keystone | 13:07 | |
| *** evrardjp_ has quit IRC | 13:16 | |
| *** evrardjp_ has joined #openstack-keystone | 13:17 | |
| *** itlinux has quit IRC | 13:22 | |
| *** ispp has joined #openstack-keystone | 13:30 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/oslo.policy master: Implement base for pluggable policy drivers https://review.openstack.org/577807 | 13:40 |
| *** germs has joined #openstack-keystone | 13:45 | |
| *** germs has quit IRC | 13:45 | |
| *** germs has joined #openstack-keystone | 13:45 | |
| *** felipemonteiro__ has joined #openstack-keystone | 14:07 | |
| *** felipemonteiro_ has joined #openstack-keystone | 14:10 | |
| *** blake has joined #openstack-keystone | 14:11 | |
| *** felipemonteiro__ has quit IRC | 14:14 | |
| *** germs has quit IRC | 14:22 | |
| *** felipemonteiro_ has quit IRC | 14:39 | |
| *** felipemonteiro__ has joined #openstack-keystone | 14:39 | |
| *** itlinux has joined #openstack-keystone | 14:39 | |
| hrybacki | o/ | 14:44 |
| knikolla | o/ | 14:49 |
| *** felipemonteiro__ has quit IRC | 14:59 | |
| *** kukacz_ has quit IRC | 15:09 | |
| *** kukacz_ has joined #openstack-keystone | 15:10 | |
| *** pcaruana has quit IRC | 15:13 | |
| *** blake has quit IRC | 15:35 | |
| *** fiddletwix has joined #openstack-keystone | 15:36 | |
| *** spilla has joined #openstack-keystone | 15:48 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/oslo.policy master: Implement base for pluggable policy drivers https://review.openstack.org/577807 | 15:55 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/oslo.policy master: Implement base for pluggable policy drivers https://review.openstack.org/577807 | 15:55 |
| *** ispp has quit IRC | 16:01 | |
| *** tesseract has quit IRC | 16:18 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 16:28 | |
| *** gyee has joined #openstack-keystone | 16:55 | |
| *** amoralej is now known as amoralej|off | 16:56 | |
| *** pcichy has quit IRC | 16:59 | |
| *** jmlowe has quit IRC | 16:59 | |
| kmalloc | o/o/ | 17:04 |
| kmalloc | knikolla, hrybacki: https://review.openstack.org/#/c/577627/ thoughts on that and https://review.openstack.org/#/c/577655/ ? | 17:04 |
| *** Alexey_Abashkin has joined #openstack-keystone | 17:04 | |
| kmalloc | knikolla: also https://review.openstack.org/#/c/576639/ could use some eyes [tests are still WIP, but just make sure it is all making sense now that everything is being fleshed out] | 17:06 |
| *** AlexeyAbashkin has quit IRC | 17:07 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 17:07 | |
| *** Alexey_Abashkin has quit IRC | 17:09 | |
| *** ChanServ changes topic to "Rocky release schedule: https://releases.openstack.org/rocky/schedule.html | Meeting agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | Bugs that need triaging: http://bit.ly/2iJuN1h | Trello: https://trello.com/b/wmyzbFq5/keystone-rocky-roadmap !!NOTE!!: This Channel is Logged (logs at https://tinyurl.com/OpenStackKeystone )" | 17:14 | |
| *** ChanServ changes topic to "Rocky release schedule: https://releases.openstack.org/rocky/schedule.html | Meeting agenda: https://etherpad.openstack.org/p/keystone-weekly-meeting | Bugs that need triaging: http://bit.ly/2iJuN1h | Trello: https://trello.com/b/wmyzbFq5/keystone-rocky-roadmap !!NOTE!! This Channel is Logged ( https://tinyurl.com/OpenStackKeystone )" | 17:15 | |
| elbragstad | kmalloc: i figured out the issue with context+policy+authorization enforcement checks | 17:16 |
| *** elbragstad is now known as lbragstad | 17:16 | |
| lbragstad | there's a recursive method in oslo policy that ends us spinning on the KeystoneToken object we pass in | 17:17 |
| lbragstad | s/us/up/ | 17:17 |
| kmalloc | lbragstad: yep | 17:21 |
| kmalloc | it's fun | 17:21 |
| kmalloc | =/ | 17:21 |
| lbragstad | i assume we don't want oslo.policy to be parsing keystone object only meant to be used internally | 17:24 |
| lbragstad | because it just happens to inherit from `dict` type | 17:24 |
| lbragstad | so - when we're in middleware | 17:27 |
| lbragstad | we build this auth_context dictionary and we store a KeystoneToken in 'token' | 17:28 |
| lbragstad | in that dictionary | 17:28 |
| lbragstad | which makes its way into oslo.policy's enforce() check | 17:28 |
| lbragstad | because auth_context is where we pull the credentials from | 17:28 |
| lbragstad | and since KeystoneToken inherit from dict, it actually get's processed by oslo.policy | 17:29 |
| lbragstad | though i'm not sure if that was what we intended to do | 17:29 |
| lbragstad | i broke that when i created TokenModel, which doesn't inherit from dict and inherits from object instead | 17:29 |
| lbragstad | so - maybe what we do instead is translate the TokenModel to a dictionary form - e.g. the v3 API contract representation and populate that in credentials['token'] instead of the internal object we're using within keystone | 17:30 |
| kmalloc | lbragstad: hold on. | 17:30 |
| kmalloc | reading | 17:30 |
| kmalloc | unless oslo-policy exposes the object interface | 17:30 |
| kmalloc | we should not be leaning on an internal "object" generated by keystone | 17:31 |
| lbragstad | right - i'm saying we should not do that | 17:31 |
| lbragstad | instead we should pass something else, more along the lines of something that follows an API contract instead of an internal object | 17:31 |
| kmalloc | right, so we need to do a .render_to_dict in the pre-enforcer logic in keystone | 17:31 |
| kmalloc | ideally we should not be dumping the whole token in | 17:32 |
| kmalloc | if we can avoid that. | 17:32 |
| lbragstad | http://paste.openstack.org/show/724243/ | 17:32 |
| kmalloc | i'd rather make a strong contract on waht is expected | 17:32 |
| lbragstad | i agree | 17:32 |
| kmalloc | oslo.policy side. | 17:32 |
| lbragstad | because otherwise we just opened up the entire keystone token reference for people to key off of in their policy files 0.0 | 17:33 |
| kmalloc | that is an ugly hack | 17:33 |
| kmalloc | but that is fine. | 17:33 |
| kmalloc | for now | 17:33 |
| *** brandor5 has joined #openstack-keystone | 17:33 | |
| kmalloc | well.. we've been doing that for *ages* | 17:33 |
| kmalloc | :P | 17:33 |
| brandor5 | hello everyone: I'm getting the following error when trying to view what assignments I have for a particular project... "Could not find group: 6 (HTTP 404) (Request-ID: req-e50b064b-6e23-4fb3-860a-a8ff791fbe58)" | 17:33 |
| brandor5 | I'm pretty sure that it's because that group can't be seen in LDAP by keystone anymore... but how can I find out what group it is? | 17:33 |
| kmalloc | brandor5: there should be debug info on the LDAP query if debugging is enabled | 17:34 |
| kmalloc | (in the logs) | 17:34 |
| brandor5 | kmalloc: ah, yeah I need to enable debug then | 17:35 |
| brandor5 | thanks | 17:35 |
| kmalloc | brandor5: np! | 17:36 |
| *** pcichy has joined #openstack-keystone | 17:36 | |
| lbragstad | kmalloc: for now - are you ok with that hack and reworking that logic to be explicit in a different patch? | 17:37 |
| kmalloc | yeah | 17:38 |
| kmalloc | because it's the same(ish) thing we do today | 17:38 |
| lbragstad | agreed | 17:38 |
| lbragstad | the KeystoneToken instance is essetially the v3 API contract represented as a more pythonic object | 17:39 |
| kmalloc | yep | 17:39 |
| kmalloc | totally unrelated [but related to all those 404 fixes I did earlier in the flask stack] https://review.openstack.org/#/c/577627/, make the flask app [in test] issue a 418 instead of a 404 for un-routed paths. meaning we should never mis-interpret a 404 "e.g. XxxNotFound" for a "this path is unrouted" | 17:40 |
| knikolla | kmalloc: 418 I'm a teapot? haha | 17:40 |
| kmalloc | knikolla: yep. | 17:40 |
| kmalloc | knikolla: it's only for test cases. | 17:40 |
| kmalloc | but it is something we can be sure we should never use in prod ;) | 17:40 |
| knikolla | kmalloc: we need at least proper support for the BREW method. lol | 17:41 |
| kmalloc | knikolla: oh don't get me started. I want to implement HTCPCP in keystone | 17:42 |
| kmalloc | and i do mean full HTCPCP. | 17:42 |
| knikolla | kmalloc: I was just going through the RFC now | 17:42 |
| knikolla | seems genius | 17:42 |
| kmalloc | it's a great RFC :) | 17:42 |
| kmalloc | yah. | 17:42 |
| kmalloc | it is one of my favorites. better than IPoAC | 17:43 |
| kmalloc | lbragstad: do you know of anyone running audit middleware in the keystone pipeline? | 17:46 |
| lbragstad | not to my knowledge | 17:46 |
| lbragstad | we could ping the op ML though? | 17:47 |
| kmalloc | lbragstad: i want to chat with them to make sure i'm getting things right if we're supporting loading it with the flask-model of things | 17:47 |
| kmalloc | maybe. i was hoping to just get a quick convo. | 17:47 |
| * kmalloc shrugs. | 17:47 | |
| kmalloc | we can poke at it in a week or so | 17:47 |
| kmalloc | no rush. | 17:47 |
| *** AlexeyAbashkin has quit IRC | 17:49 | |
| brandor5 | kmalloc: thanks for the pointer... that gave me the info I needed :) | 17:51 |
| kmalloc | brandor5: fantastic, happy to help! | 17:52 |
| * knikolla struggling with being productive versus reading all the april fools RFCs | 17:52 | |
| kmalloc | knikolla: i knew that was a risk using 418 ;) | 17:53 |
| kmalloc | knikolla: i almost used "HTTP 420 [Enhance your calm] | 17:54 |
| kmalloc | but figured 420 was more fringe than 418. | 17:54 |
| kmalloc | ;) | 17:54 |
| knikolla | kmalloc: it's funny cause the other day i was having a discussion with a cowerker about TCP over carrier pigeons | 17:54 |
| *** felipemonteiro has joined #openstack-keystone | 17:54 | |
| knikolla | and lo and behold, there's an RFC | 17:54 |
| knikolla | haha | 17:55 |
| *** harlowja has joined #openstack-keystone | 17:55 | |
| *** felipemonteiro_ has joined #openstack-keystone | 17:56 | |
| kmalloc | lbragstad: ^ note I added a "this channel is logged" to the topic | 17:56 |
| lbragstad | thanks | 17:57 |
| *** felipemonteiro has quit IRC | 18:00 | |
| *** jmlowe has joined #openstack-keystone | 18:01 | |
| *** felipemonteiro_ has quit IRC | 18:06 | |
| *** felipemonteiro_ has joined #openstack-keystone | 18:06 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: WIP: Remove KeystoneToken object https://review.openstack.org/577567 | 18:09 |
| lbragstad | i should be able to just start cleaning up that chain now ^ | 18:09 |
| kmalloc | hehe | 18:09 |
| lbragstad | some changes aren't grouped logically imo | 18:10 |
| kmalloc | lbragstad: i hope i can get the rest of the new enforcer tests done today | 18:10 |
| lbragstad | before i make you go refactor it all :) | 18:10 |
| kmalloc | it's going to be a followup patch because i want to implement a test-only API. | 18:10 |
| kmalloc | rather than leaning on "/" or something else. | 18:11 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: WIP: Remove KeystoneToken object https://review.openstack.org/577567 | 18:11 |
| kmalloc | going to need a followup, not be a followup | 18:11 |
| lbragstad | knikolla: did you attend the edge computing wg meeting on the 13th? | 18:21 |
| knikolla | lbragstad: i did not | 18:21 |
| lbragstad | i'm reading the note from cmurphy and it sounds like she mentioned that we could use resource to help implementing the testing | 18:21 |
| lbragstad | ah | 18:21 |
| lbragstad | i was curious if anyone on the call said anything about working on that, or helping with it | 18:22 |
| lbragstad | versus just donating resources | 18:22 |
| lbragstad | cc ildikov might know? | 18:22 |
| ildikov | lbragstad: hi | 18:22 |
| ildikov | lbragstad: I'm recruiting people for testing right now: https://etherpad.openstack.org/p/ECG_Keystone_Testing | 18:23 |
| lbragstad | http://lists.openstack.org/pipermail/openstack-dev/2018-June/131550.html i was just reading this | 18:23 |
| lbragstad | and noticed cmurphy mentioned the need for additional resources | 18:24 |
| ildikov | lbragstad: the story for that is hat the OPNFV team would like to help, but they don't have resources to write up tempest tests | 18:24 |
| ildikov | lbragstad: however they can help with environment and setup automation | 18:24 |
| lbragstad | so the involvement would be strictly hardware donations? | 18:24 |
| ildikov | lbragstad: and setting up the environment in an automated way, etc | 18:24 |
| lbragstad | ahh | 18:25 |
| lbragstad | ok | 18:25 |
| ildikov | lbragstad: I talked to knikolla about this last week and we got to the conclusion that the basic testing can be done in our gate already | 18:25 |
| ildikov | lbragstad: it's partially there and we can add some tests to that and finish up the gate jobs | 18:25 |
| lbragstad | cool | 18:25 |
| kmalloc | yeah it should totally work (mostly) in our current gate | 18:26 |
| kmalloc | extensive testing will require hardware. | 18:26 |
| ildikov | lbragstad: and he will join the Edge Cloud call this week to see how we could setup the basic env in OPNFV and get to the next steps from there to test some more advanced configurations | 18:26 |
| kmalloc | but that is outside of scope of "does this function" | 18:26 |
| ildikov | kmalloc: +1 | 18:26 |
| lbragstad | i was mostly curious if anyone from the opnfv community bit on helping write tests (since that's probably the most needed thing) | 18:26 |
| ildikov | kmalloc: in my view the "does this function" part should be finished on our side and I would like us to collaborate with the OPNFV team on more advanced testing | 18:26 |
| kmalloc | ++ | 18:27 |
| ildikov | the tiny issue is that neither them nor me is a Keystone expert, so we will come with questions :) | 18:27 |
| ildikov | knikolla will join on Wednesday to start brainstorming on what would be useful to do | 18:27 |
| lbragstad | yeah - that's fair.. i assume several members of this team would spend cycles helping people get up to speed if it means we can distribute the knowledge a bit more | 18:28 |
| ildikov | lbragstad: kmalloc: knikolla: BTW as we're chatting about this already, there's a thread on the Edge ML about Keystone architecture options for Edge, like federation or not, etc. | 18:28 |
| lbragstad | yeah - someone pinged be about it, hence my digging into the meetings notes from the 13th :) | 18:28 |
| lbragstad | i'm subscribing to the ml now | 18:29 |
| ildikov | lbragstad: kmalloc: knikolla: would you be available tomorrow to revisit and continue the Forum discussion on this? as not everyone could attend and it's a longer chat to get to the same page | 18:29 |
| ildikov | lbragstad: kmalloc: knikolla:tomorrow's call is the Edge Computing Group call | 18:29 |
| lbragstad | what time is the call? same time as before? | 18:29 |
| lbragstad | is it a video call? | 18:29 |
| lbragstad | s/a/the/ | 18:29 |
| ildikov | lbragstad: it's 9am US Central time on Zoom | 18:30 |
| lbragstad | ack | 18:30 |
| ildikov | lbragstad: https://wiki.openstack.org/wiki/Edge_Computing_Group#Meetings | 18:30 |
| lbragstad | i can most likely attend - but i should be able to give you a better answer by EOD | 18:30 |
| knikolla | i'll attend | 18:30 |
| ildikov | lbragstad: we are taking notes on IRC, but not everyone is able to join IRC from the call, so that's really more notes | 18:30 |
| ildikov | lbragstad: knikolla: great, thank you, I will forward you the meeting invite I have | 18:31 |
| kmalloc | ildikov: i still have issues with zoom.us working | 18:33 |
| ildikov | lbragstad: knikolla: I will see what's the best way to keep this discussion going without causing too much extra pain, but have everyone involved | 18:33 |
| kmalloc | ildikov: it's why i've missed the meetings | 18:33 |
| ildikov | kmalloc: what is the issue? | 18:33 |
| ildikov | kmalloc: I'm not a huge expert, but happy to help if I can | 18:33 |
| ildikov | kmalloc: I see Zoom being used in several communities, so it got very popular lately, not just on our end | 18:34 |
| knikolla | lbragstad: kmalloc: added an item to tomorrow's keystone meeting on federation testing | 18:34 |
| ildikov | kmalloc: I understand the feeling of installing yet another tool, my phone is full of meeting apps and I hate it, but didn't really have a choice... :/ | 18:34 |
| kmalloc | ildikov: it doesn't really work on my laptop. | 18:35 |
| kmalloc | failure to run client installed or not | 18:35 |
| kmalloc | Ubuntu 18.04 | 18:35 |
| *** jmlowe has quit IRC | 18:36 | |
| ildikov | kmalloc: hmm, let me ask around if anyone got that | 18:39 |
| lbragstad | ildikov: dumb question: does mailman support getting an old message from the list right after you've subscribed? | 18:39 |
| ildikov | kmalloc: my colleagues told me they either had issues with Ubuntu 18.04 or they didn't even try just used the dial-in number | 18:44 |
| lbragstad | i suppose i could just use the In-Reply-To header? | 18:44 |
| brandor5 | OK, so here's a tricky one (I think) a group in LDAP has had it's UID changed... how do I remove the mapping to the old uid from keystone? | 18:44 |
| brandor5 | I have a feeling I'm going to need to hand edit the DB? | 18:45 |
| kmalloc | brandor5: there is a keystone-manage command that lets you purge the mapping | 18:45 |
| lbragstad | ``keystone-manage mapping_purge --help`` | 18:45 |
| brandor5 | kmalloc: do you have any documentation for that? | 18:45 |
| kmalloc | that said, if you want to purge just one mapping, yeah direct sql is the most surgical | 18:45 |
| kmalloc | brandor5: ^ see lbragstad's comment | 18:45 |
| ildikov | lbragstad: hmm, I don't know, I wouldn't think so, but I'm not an expert of it | 18:45 |
| brandor5 | ha there we go... thanks lbragstad | 18:45 |
| lbragstad | no problem | 18:45 |
| kmalloc | brandor5: that being said.. Keystone does not handle changes in LDAP very well like that | 18:46 |
| brandor5 | kmalloc: I've noticed :) | 18:46 |
| lbragstad | you can purge based on a few different combinations | 18:46 |
| kmalloc | brandor5: and it's because we are limited in how much we can deal with "well the backing store changed data on us" | 18:46 |
| lbragstad | e.g. you can pass in a specific user (--user) or group (--group) along with a domain | 18:46 |
| ildikov | kmalloc: there should be a no-toll number you can use, painful, but at least a solution, or you can try to install the Zoom app on your phone | 18:47 |
| kmalloc | brandor5: fwiw, I had a very similar request [recently] get passed up along from a customer. | 18:47 |
| ildikov | kmalloc: I actually like the phone version, at least on iPhone it works well | 18:47 |
| brandor5 | so to make sure I understand... I can run `keystone-manage mapping_purge --group updatedGroup --domain MyDomain` and taht should clear it? | 18:47 |
| lbragstad | yes - it should | 18:48 |
| lbragstad | otherwise - if you just use ``keystone-manage mapping_purge`` it will purge everything | 18:49 |
| lbragstad | which just means the ids will get regenerated on next auth | 18:49 |
| kmalloc | ildikov: i might give the android one a whack, but honestly, i just default to not using zoom video bits because extra clients / not webbrowser based/noplugins | 18:49 |
| brandor5 | define purge for me :) | 18:49 |
| brandor5 | so not destructive | 18:49 |
| lbragstad | well.. yes and no | 18:49 |
| kmalloc | brandor5: purge deletes the data in the mapping tables, but it is re-created | 18:49 |
| kmalloc | as needed | 18:49 |
| lbragstad | yes in that purge will remove the entry from the id_mapping table | 18:49 |
| kmalloc | if you specify no args, it purges the entire table | 18:49 |
| lbragstad | no in that it is regenerated to the same value via a hash | 18:50 |
| ildikov | kmalloc: I don't like video calls, so I don't use the camera most often, I only use the app and not just dial-in as if there's screen sharing I can see that | 18:50 |
| kmalloc | keystone uses data from the backend and the domain_id to hash | 18:50 |
| brandor5 | ok, much thanks to both of you, I'll give the specific group a try and let you know how it goes | 18:50 |
| kmalloc | so the hash should be recreated unless something in the backend or the domain_id changes | 18:50 |
| *** felipemonteiro_ has quit IRC | 18:52 | |
| *** felipemonteiro_ has joined #openstack-keystone | 18:53 | |
| *** pcaruana has joined #openstack-keystone | 19:27 | |
| brandor5 | so I'm getting this error now when trying to do role assignment list... https://pastebin.com/2zzxRcGv | 19:28 |
| brandor5 | The error returned on the command line is : Could not find group: 0e8e5f63b7ae647f7fdd7e7904c8c0dbf27bd8f5ce074c98b2eacd4089d47f56 (HTTP 404) (Request-ID: req-4babd5a8-b767-4054-9cd0-283ed1d02a9d) | 19:29 |
| kmalloc | brandor5: so, i think the user or a user with that group needs to login again to recreate the hash | 19:38 |
| kmalloc | without a login keystone can't know how that hash -> backend maps | 19:39 |
| kmalloc | keystone just doens't have insight into it | 19:39 |
| kmalloc | we have talked about a keystone-manage command to force a hash generation | 19:42 |
| kmalloc | but... i don't think we;ve gotten there yet | 19:42 |
| *** blake has joined #openstack-keystone | 19:45 | |
| brandor5 | i dont even recognize that group | 19:46 |
| brandor5 | and would mapping_populate on my domain work to fix that? or should | 19:55 |
| brandor5 | ? | 19:55 |
| kmalloc | well it sounds like the group_id [mapping] has changed because something in LDAP changed. | 19:58 |
| kmalloc | based upon that error | 19:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Implement base for new RBAC Enforcer https://review.openstack.org/576639 | 19:59 |
| kmalloc | lbragstad: so.. on to the last tests... should i just mock out the enforcer to do an assert on what the values should look like? | 19:59 |
| kmalloc | lbragstad: ooooor... | 19:59 |
| kmalloc | lbragstad: i kindof want to drop all the way to the oslo_policy enforcer, but i need to create a policy enforcment i can muck with to validate the data is passed through | 20:00 |
| kmalloc | [god, we don't even have this level of testing on our current policy code[ | 20:00 |
| kmalloc | brandor5: or somehow you're getting a hashed group id that doesn't make sense... | 20:01 |
| kmalloc | brandor5: i apologize, i'm having a hard time context switching to LDAP-isms when I'm thinking about keystone RBAC policy stuff | 20:02 |
| brandor5 | kmalloc: no problem :) i'm doing a lot of switching myself | 20:03 |
| lbragstad | brandor5: try listing all the groups in that domain after you purge the mappings | 20:03 |
| lbragstad | that should repopulate the list | 20:03 |
| brandor5 | lbragstad: k | 20:03 |
| brandor5 | 15000+ groups will take a little bit heh | 20:05 |
| brandor5 | need to get memcached setup | 20:05 |
| lbragstad | brandor5: you're backing everything to ldap, yeah? | 20:05 |
| lbragstad | s/everything/users and groups/ | 20:05 |
| brandor5 | lbragstad: yep, with the exception of a handful of 'service accounts' that live in sql | 20:06 |
| lbragstad | in can you haven't seen it yet - this might be something that is useful for you https://youtu.be/DKOJ-UToCKM | 20:06 |
| brandor5 | yep, i have, i'm sad I missed it... was in a different pres | 20:07 |
| lbragstad | oh - good deal | 20:07 |
| brandor5 | hmm still missing a group :( | 20:09 |
| brandor5 | hmm | 20:09 |
| brandor5 | actually 1 secodn | 20:09 |
| brandor5 | nevermind :| | 20:11 |
| brandor5 | still missing a group | 20:11 |
| *** felipemonteiro_ has quit IRC | 20:15 | |
| *** felipemonteiro_ has joined #openstack-keystone | 20:15 | |
| lbragstad | brandor5: did that group change? | 20:17 |
| lbragstad | kmalloc: when i look at that code, it seems like we have a couple different layers in indirection | 20:17 |
| lbragstad | authorization.py calls keystone.policy.backends.rules which calls keystone.common.policy | 20:17 |
| lbragstad | if that's the code you're talking about? | 20:18 |
| kmalloc | lbragstad: no, just to test the .enforce_call functionality directly | 20:18 |
| kmalloc | i am debating if I should mock the oslo_policy enforcer object | 20:18 |
| kmalloc | and introspect the passed in args... *or* if I should create a dummy policy for testing and let the entire enforcement chain fire | 20:19 |
| brandor5 | lbragstad: we've had several groups change | 20:19 |
| brandor5 | for some reason many years ago when this directory was first spun up they used UIDs and GIDs that were very low (<1000) | 20:20 |
| lbragstad | kmalloc: oh - i see what you mean... | 20:20 |
| brandor5 | when you're trying to connect a linux system to the directory for authentication that gets in the way and we asked them to re-ID them... so that's what has happened | 20:20 |
| brandor5 | I'm wondering if there is someway for me to delete the mapping manually? | 20:21 |
| brandor5 | mapping probably isnt the right word there | 20:21 |
| brandor5 | the old group was added as a _member_ to the project... that's what I need to remove | 20:21 |
| brandor5 | i think | 20:21 |
| lbragstad | kmalloc: i think we currently execute oslo.policy as opposed to using mocks | 20:29 |
| lbragstad | brandor5: that'd need to be done through the assignment API i think | 20:31 |
| lbragstad | if i'm understanding your question | 20:31 |
| lbragstad | you should be able to get that list using the /role_assignment API | 20:31 |
| lbragstad | or `openstack role assignment list --names` | 20:31 |
| brandor5 | lbragstad: that's the command the is returning the errors | 20:32 |
| lbragstad | brandor5: do you have a trace? | 20:35 |
| lbragstad | kmalloc: https://review.openstack.org/#/c/577567/3 increased our overall test coverage by 2% lol | 20:35 |
| *** raildo has quit IRC | 20:37 | |
| *** pcaruana has quit IRC | 20:43 | |
| *** felipemonteiro__ has joined #openstack-keystone | 20:45 | |
| *** felipemonteiro_ has quit IRC | 20:48 | |
| brandor5 | lbragstad: just sent you a link with the trace | 20:48 |
| lbragstad | hmm | 20:50 |
| lbragstad | are you using master? | 20:50 |
| brandor5 | RHOSP10 | 20:50 |
| lbragstad | is that ocata? | 20:51 |
| brandor5 | newton | 20:51 |
| lbragstad | ah | 20:51 |
| lbragstad | so - the issue is that the public id isn't being cleared? | 20:52 |
| lbragstad | after you use keystone-manage mapping_purge? | 20:52 |
| brandor5 | yeah, i think so | 20:52 |
| brandor5 | that public id isn't in the id_mappings table | 20:59 |
| brandor5 | (i'm not sure that it's supposed to be though) | 20:59 |
| brandor5 | so I think i just need to drop them from the assignment table... | 21:02 |
| *** martinus__ has quit IRC | 21:02 | |
| *** kukacz_ has quit IRC | 21:03 | |
| *** EmilienM has joined #openstack-keystone | 21:03 | |
| brandor5 | I've found that public_id in the assignment table for the expected projects | 21:03 |
| *** felipemonteiro__ has quit IRC | 21:03 | |
| *** felipemonteiro__ has joined #openstack-keystone | 21:03 | |
| *** EmilienM_PTO has quit IRC | 21:04 | |
| *** harlowja has quit IRC | 21:04 | |
| *** EmilienM has quit IRC | 21:04 | |
| *** EmilienM has joined #openstack-keystone | 21:04 | |
| *** felipemonteiro_ has joined #openstack-keystone | 21:05 | |
| *** kukacz_ has joined #openstack-keystone | 21:05 | |
| lbragstad | i thought we fixed https://bugs.launchpad.net/keystone/+bug/1757022 but the patch for it is still in review | 21:06 |
| openstack | Launchpad bug 1757022 in OpenStack Identity (keystone) ""keystone-manage mapping_purge" ignores --type option" [Undecided,In progress] - Assigned to Dai Hanada (dai-hanada) | 21:06 |
| lbragstad | https://review.openstack.org/#/c/554397/5 | 21:06 |
| lbragstad | i should pick that up or propose a follow on for my comments so that we can approve that fix | 21:06 |
| brandor5 | did you see my previous messages? | 21:07 |
| lbragstad | it sounded somewhat related to what you were hitting brandor5 | 21:07 |
| kmalloc | lbragstad: i might use mocks just to specify the policy DSL rule | 21:07 |
| kmalloc | lbragstad: i'll +2 that once you address the comments | 21:07 |
| brandor5 | lbragstad: I'm thinking I can just drop the entries from assignment table that reference that group_id | 21:07 |
| brandor5 | would there be any adverse side-effects of doing that? | 21:08 |
| lbragstad | brandor5: we have a bug open for that i think | 21:08 |
| lbragstad | which might be a different issue | 21:08 |
| *** felipemonteiro__ has quit IRC | 21:08 | |
| brandor5 | so does that mean it's okay to remove it? :D | 21:09 |
| lbragstad | the mapping purge should be taking care of that for you, i would think | 21:10 |
| lbragstad | but i also know that we have a few bugs open in that area that might be related to it | 21:10 |
| brandor5 | i don't have that public_id listed anywhere in id_mapping | 21:10 |
| lbragstad | but it is listed in the assignment table | 21:11 |
| brandor5 | yes | 21:11 |
| lbragstad | knikolla: were we working on that together ^ | 21:11 |
| lbragstad | knikolla: it sounds *super* familiar and i thought we either fixed it or had a patch in review for it | 21:11 |
| brandor5 | (It's an 'actor_id' in the assignment table) | 21:11 |
| lbragstad | brandor5: that makes sense | 21:13 |
| brandor5 | removing the entries or that it's an actor_id | 21:13 |
| brandor5 | I understand being hesitant to telling some random person to drop entries :D | 21:14 |
| lbragstad | ;) | 21:14 |
| lbragstad | i try not advocating the usage of mysql as an implementation of keystoneclient | 21:15 |
| brandor5 | hehe yep | 21:15 |
| kmalloc | lbragstad: hehe | 21:20 |
| lbragstad | ha - i think i found it | 21:21 |
| lbragstad | https://bugs.launchpad.net/keystone/+bug/1658641 | 21:21 |
| openstack | Launchpad bug 1658641 in OpenStack Identity (keystone) "Moving/disabling LDAP users break Keystone queries depending on role ID" [Medium,In progress] - Assigned to Kristi Nikolla (knikolla) | 21:21 |
| brandor5 | what table does keystone store the name of the remote groups? | 21:21 |
| lbragstad | and knikolla does have a patch for it in review :) https://review.openstack.org/#/c/487579/ | 21:21 |
| lbragstad | i should add ^ to my list to review too, because that one is close and we could probably merge it tomorrow | 21:22 |
| knikolla | lbragstad: oh, i had totally forgotten about that | 21:22 |
| lbragstad | i thought i was going crazy | 21:22 |
| lbragstad | i swear we merged that | 21:22 |
| knikolla | lbragstad: i thought something similar | 21:23 |
| knikolla | i know we had some discussions and there was some conclusion | 21:23 |
| lbragstad | i bet we could tag team that tomorrow | 21:23 |
| knikolla | ++ i have time after the meeting | 21:23 |
| lbragstad | adding the office-hours tag | 21:24 |
| lbragstad | same with https://bugs.launchpad.net/keystone/+bug/1757022 | 21:24 |
| openstack | Launchpad bug 1757022 in OpenStack Identity (keystone) ""keystone-manage mapping_purge" ignores --type option" [Undecided,In progress] - Assigned to Dai Hanada (dai-hanada) | 21:24 |
| lbragstad | i bet we could get that one done, too | 21:25 |
| lbragstad | both of which will help you brandor5 ^ (at least using master) | 21:25 |
| knikolla | i like the idea of more structured office hours | 21:25 |
| brandor5 | yep, appreciate it... going through akaris stuff now... :) | 21:25 |
| knikolla | we played around with the idea but never came out of it | 21:25 |
| brandor5 | thanks again for the help lbragstad and kmalloc :) | 21:26 |
| knikolla | nothing* | 21:26 |
| lbragstad | brandor5: hopefully it helps | 21:26 |
| lbragstad | knikolla: those seems like good candidates to cleanup | 21:26 |
| lbragstad | we have several things in review that just need touch ups | 21:26 |
| lbragstad | and they close bugs | 21:26 |
| lbragstad | we could also do something about https://bugs.launchpad.net/keystone/+bug/1775207 while we're in the mapping code | 21:28 |
| openstack | Launchpad bug 1775207 in OpenStack Identity (keystone) "Fetching all mappings may become too slow" [Undecided,In progress] - Assigned to Pavlo Shchelokovskyy (pshchelo) | 21:28 |
| lbragstad | tomorrow | 21:28 |
| lbragstad | since https://review.openstack.org/#/c/572446/ is in review | 21:28 |
| knikolla | cool | 21:30 |
| *** spilla has quit IRC | 21:30 | |
| brandor5 | just as an FYI, I made a backup of my databases and dropped those 2 entries from assignment and things seem to be working as expected now | 21:35 |
| brandor5 | beforehand I also grepped the databases for those public_ids and only found them in the assignment table | 21:35 |
| lbragstad | nice | 21:35 |
| brandor5 | I'll be sure to get irate and come back and yell at you lbragstad when things go south overnight ;) | 21:36 |
| lbragstad | of course! | 21:36 |
| * lbragstad hands brandor5 his personal favorite pitchfork | 21:37 | |
| *** nicolasbock has quit IRC | 21:37 | |
| brandor5 | haha | 21:38 |
| lbragstad | unfortunately i don't think we'll be able to backport those specific fixes to newton | 21:38 |
| lbragstad | according to https://releases.openstack.org/ | 21:39 |
| brandor5 | as soon as they release RHOSP13 I'll be moving to that :) | 21:39 |
| brandor5 | which is Queens | 21:39 |
| *** felipemonteiro_ has quit IRC | 21:42 | |
| *** jmlowe has joined #openstack-keystone | 21:44 | |
| *** rcernin has joined #openstack-keystone | 21:45 | |
| *** itlinux has quit IRC | 21:45 | |
| *** brandor5 has quit IRC | 21:55 | |
| *** jmlowe has quit IRC | 21:56 | |
| *** edmondsw has quit IRC | 21:58 | |
| lbragstad | is anyone else hitting this when they run `tox -e docs`? http://paste.openstack.org/show/724264/ | 22:03 |
| *** harlowja has joined #openstack-keystone | 22:14 | |
| *** jmlowe has joined #openstack-keystone | 22:15 | |
| lbragstad | https://bugs.launchpad.net/keystone/+bug/1778603 | 22:19 |
| openstack | Launchpad bug 1778603 in OpenStack Identity (keystone) "Documentation builds failing with Sphinx 1.7.5" [High,Triaged] | 22:19 |
| lbragstad | not sure if anyone else can verify - but apparently other teams are hitting it too | 22:20 |
| *** blake has quit IRC | 22:50 | |
| *** edmondsw has joined #openstack-keystone | 22:57 | |
| *** jmlowe has quit IRC | 23:19 | |
| kmalloc | sec | 23:30 |
| kmalloc | lbragstad: so uh.. | 23:30 |
| kmalloc | lbragstad: got a sec? | 23:31 |
| kmalloc | lbragstad: i need some help debugging where i went wrong on something | 23:31 |
| kmalloc | lbragstad: yes, can confirm doc builds on 1.7.5 are failing | 23:32 |
| *** tosky has quit IRC | 23:34 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Implement base for new RBAC Enforcer https://review.openstack.org/576639 | 23:37 |
| kmalloc | lbragstad: afaict, this test should be passing: v | 23:40 |
| kmalloc | https://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/common/test_rbac_enforcer.py?h=refs/changes/39/576639/16#n412 | 23:40 |
| kmalloc | any thoughts on what i've implemented incorrectly here? | 23:41 |
| *** jmlowe has joined #openstack-keystone | 23:41 | |
| *** gyee has quit IRC | 23:51 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!