Friday, 2018-09-07

*** gyee has quit IRC00:21
*** threestrands has joined #openstack-keystone00:32
*** threestrands has quit IRC00:32
*** threestrands has joined #openstack-keystone00:32
*** spsurya has quit IRC00:35
itlinuxhello guys, I am getting a strange issue.. LDAP which used to work now I get this.. ` There is either no auth token in the request or the certificate issuer is not trusted. No auth context will be set. fill_context /usr/lib/python2.7/site-packages/keystone/middleware/auth.py:20300:45
itlinux`00:45
*** spartakos has quit IRC00:45
itlinuxcan someone give me a tip on this..00:45
itlinuxthanks00:45
*** dave-mccowan has joined #openstack-keystone00:50
*** bhagyashris_ has joined #openstack-keystone01:04
*** bhagyashris has joined #openstack-keystone01:04
*** Emine has quit IRC01:11
*** Emine has joined #openstack-keystone01:11
*** markvoelker has joined #openstack-keystone01:20
*** markvoelker has quit IRC01:24
*** markvoelker has joined #openstack-keystone01:41
*** bhagyashris_ has quit IRC02:10
*** bhagyashris has quit IRC02:10
*** bhagyashris_ has joined #openstack-keystone02:14
*** bhagyashris has joined #openstack-keystone02:14
*** r-daneel has quit IRC02:23
openstackgerritwangxiyuan proposed openstack/keystonemiddleware master: No need to compare CONF content  https://review.openstack.org/59993602:38
*** ykarel|away has joined #openstack-keystone02:54
*** bhagyashris_ has quit IRC03:02
*** bhagyashris has quit IRC03:02
*** ykarel|away is now known as ykarel03:11
*** r-daneel has joined #openstack-keystone03:13
*** dave-mccowan has quit IRC03:25
openstackgerritTony Breeds proposed openstack/keystonemiddleware master: Remove tox_install.sh  https://review.openstack.org/59900303:27
*** annp has joined #openstack-keystone03:32
*** nicolasbock has quit IRC03:36
*** r-daneel has quit IRC03:47
*** r-daneel has joined #openstack-keystone03:47
*** spsurya has joined #openstack-keystone04:11
*** ykarel has quit IRC04:24
*** spartakos has joined #openstack-keystone04:29
*** bhagyashris_ has joined #openstack-keystone04:32
*** bhagyashris has joined #openstack-keystone04:32
*** bhagyashris has quit IRC04:37
*** bhagyashris_ has quit IRC04:38
*** ykarel has joined #openstack-keystone04:44
*** bhagyashris has joined #openstack-keystone04:46
*** bhagyashris_ has joined #openstack-keystone04:46
cmurphyitlinux: that message is benign, it just means it's receiving an incoming token request, look for a WARN or ERROR message instead of that debug message04:50
itlinuxok..04:52
itlinuxtrying to figure if the LDAP is broken or it's something else..04:52
itlinuxcmurphy: thanks04:52
*** rcernin has quit IRC04:57
*** spartakos has quit IRC04:57
*** spartakos has joined #openstack-keystone05:12
*** shyamb has joined #openstack-keystone05:13
*** shyamb has quit IRC05:17
*** rcernin has joined #openstack-keystone05:30
*** shyamb has joined #openstack-keystone05:34
*** bhagyashris_ has quit IRC05:39
*** bhagyashris has quit IRC05:39
*** r-daneel has quit IRC05:44
*** bhagyashris has joined #openstack-keystone05:49
*** bhagyashris_ has joined #openstack-keystone05:49
*** pcaruana has joined #openstack-keystone06:13
openstackgerritVishakha Agarwal proposed openstack/python-keystoneclient master: create() call in v3.regions.py is wrong  https://review.openstack.org/59492106:14
openstackgerritMerged openstack/keystonemiddleware master: No need to compare CONF content  https://review.openstack.org/59993606:22
*** n16738 has joined #openstack-keystone06:23
n16738hi all06:24
*** n16738 has left #openstack-keystone06:24
*** shyamb has quit IRC06:24
*** shyamb has joined #openstack-keystone06:24
openstackgerritVishakha Agarwal proposed openstack/keystone master: Implement Trust Flush via keystone-manage.  https://review.openstack.org/58937806:38
*** bhagyashris_ has quit IRC06:50
*** bhagyashris has quit IRC06:50
*** bhagyashris has joined #openstack-keystone06:54
*** bhagyashris_ has joined #openstack-keystone06:54
*** shyamb has quit IRC07:00
*** shyamb has joined #openstack-keystone07:10
zioprotoHello, I am implementing in gophercloud the possibility to issue tokens using keystone application credentials. https://github.com/gophercloud/gophercloud/pull/122407:24
zioprotoI could not find in the docs official examples of json requests07:24
zioprotoso far I captured requests from the official openstack client07:25
zioprotodoing openstack token issue07:25
zioprotocan anyone point me to the full list of possible requests that I should implement ?07:25
*** ayushin78 has joined #openstack-keystone07:25
wxy-xiyuanzioproto: https://developer.openstack.org/api-ref/identity/v3/index.html#authenticating-with-an-application-credential This is maybe want you want.07:27
*** tesseract has joined #openstack-keystone07:27
zioprotowxy-xiyuan: thanks ! so basically it is just two types of request. If I use the UUID I dont need to pass also the username. If I use the app credential name, then I need to give also the username. The project is never needed.07:28
zioprotoI think there is an error in the docs here07:29
zioprotohttps://specs.openstack.org/openstack/keystone-specs/specs/keystone/backlog/application-credentials.html07:29
*** ayushin78 has quit IRC07:29
zioprotothere is an example for POST /v3/auth/tokens07:29
zioprotowhere the project ID is give in the json07:29
zioprotois that a documentation error ?07:29
*** ayushin78 has joined #openstack-keystone07:29
*** AlexeyAbashkin has joined #openstack-keystone07:30
*** AlexeyAbashkin has quit IRC07:30
*** ayushin78 has quit IRC07:30
zioprotoshould I open a documentation bug ?07:30
*** ayushin78 has joined #openstack-keystone07:30
*** ayushin78 has left #openstack-keystone07:32
wxy-xiyuanzioproto: Let me double check. You know, there is usually a little difference between design and implementation :)07:32
zioprotothanks07:32
zioprotoI started to implement using that wrong example with the projectID, and it never worked07:33
zioprotothen I captured the requests from openstack client and I saw it never uses the project07:33
*** shyamb has quit IRC07:34
zioprotowxy-xiyuan: according to my tests the 'openstack token issue' if you dont pass the username never works, probably because with the username also the domain is passed in the json request07:38
zioprotowxy-xiyuan: I mean this works:07:39
zioprotohttps://www.irccloud.com/pastebin/qJc8j2GI/07:40
*** AlexeyAbashkin has joined #openstack-keystone07:40
*** AlexeyAbashkin has quit IRC07:40
wxy-xiyuancc cmurphy for double check07:40
zioprotoI actually done use the "user"->"id" but the user name07:40
zioprotos/done/dont07:41
zioprotoit is not clear to me if I should always implement all the options for everything. Is any object always callable by ID or name ?07:41
zioprotocmurphy: you can also leave your comment in the github issue for gophercloud07:42
zioprotocmurphy: if you dont catch me on IRC07:42
wxy-xiyuanwell, the backlog in keystone-spec should be refreshed. project_id does not work here.07:49
wxy-xiyuanfor app_cred auth, there are three kinds of format in request json. 1. app_cred id. 2 app_cred name + user_id 3. app_cred name + user_name + user_domain_id/user_domain_name07:52
wxy-xiyuanzioproto:07:52
zioprotoOK, so it is three kind of requests to implement08:01
wxy-xiyuanzioproto: yes, if you treat user_domain_id/user_domain_name is the same kind.08:07
*** aloga has quit IRC08:07
*** aloga has joined #openstack-keystone08:07
*** AlexeyAbashkin has joined #openstack-keystone08:08
*** ykarel is now known as ykarel|lunch08:13
cmurphyzioproto: i don't think there should be a projrct id, probably an error in the doc08:17
* cmurphy -> plane08:17
zioprotothanks08:17
openstackgerritVishakha Agarwal proposed openstack/python-keystoneclient master: create() call in v3.regions.py is wrong  https://review.openstack.org/59492108:18
*** spartakos has quit IRC08:18
*** threestrands has quit IRC08:33
*** shyamb has joined #openstack-keystone08:45
*** ykarel|lunch is now known as ykarel08:49
*** bhagyashris_ has quit IRC08:54
*** bhagyashris has quit IRC08:54
*** bhagyashris has joined #openstack-keystone08:58
*** bhagyashris_ has joined #openstack-keystone08:58
*** bhagyashris has left #openstack-keystone09:02
*** bhagyashris_ has quit IRC09:03
*** bhagyashris_ has joined #openstack-keystone09:03
*** rcernin has quit IRC09:16
*** nicolasbock has joined #openstack-keystone09:39
*** nicolasbock has quit IRC09:40
*** bhagyashris_ has quit IRC09:44
*** shyamb has quit IRC09:54
openstackgerritAndreas Jaeger proposed openstack/keystone master: Use templates for cover and lower-constraints  https://review.openstack.org/60069009:56
openstackgerritAndreas Jaeger proposed openstack/keystonemiddleware master: Use templates for cover and lower-constraints  https://review.openstack.org/60069109:57
openstackgerritAndreas Jaeger proposed openstack/python-keystoneclient master: Use templates for cover and lower-constraints  https://review.openstack.org/60069209:57
*** shyamb has joined #openstack-keystone09:59
*** shyamb has quit IRC10:04
zioprotocmurphy: no error in the doc, that was the backlog10:28
zioprotothe right page to look is https://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/application-credentials.html10:28
zioprotobut google index alwats proposes the old outdated page10:28
*** shyamb has joined #openstack-keystone10:29
*** ykarel is now known as ykarel|session10:31
*** shyamb has quit IRC10:36
*** dave-mccowan has joined #openstack-keystone10:52
*** ykarel|session is now known as ykarel11:12
*** shyamb has joined #openstack-keystone11:12
*** annp has quit IRC11:13
*** shyamb has quit IRC11:24
*** shyamb has joined #openstack-keystone11:24
*** takamatsu has joined #openstack-keystone11:27
*** nicolasbock has joined #openstack-keystone11:29
*** r-daneel has joined #openstack-keystone11:39
evrardjplbragstad: I think for 'You must give at least one requirement to install (see "pip help install")' this has started to appear with pip 10 was released, do you freeze or provide constraints about pip? If not stable branches will always be moving targets (not that it is a big problem, but just saying...)11:44
*** csatari has joined #openstack-keystone12:00
lbragstadevrardjp right - if we don't now maybe we should12:45
lbragstad(provide constraints for pip)12:45
evrardjplbragstad: that's what OSA is doing: we have an extra constraint, just for the project, freezing setuptools, pip, and wheels.12:47
evrardjpI am not sure it would be the best practice though for a service project, so...12:48
evrardjpI think it's better to refer to the broader community in that case, and decide what we should all do : )12:48
lbragstadevrardjp dhellmann just suggested in -oslo that we should talk about this sometime next week12:49
*** shyamb has quit IRC12:49
evrardjpI am also not saying your issue has to do with that too or needs to be fixed that way. I am just giving you info that can help you take a decision :)12:49
evrardjpthat sounds a nice conversation to have next week inded12:50
evrardjpI'd be happy to see what would be the outcome,as deployment projects would probably consume what you'll decide.12:50
lbragstadright12:51
evrardjphttps://pipenv.readthedocs.io/en/latest/ generates Pipfile.lock files, just saying! ;)12:51
lbragstadnice12:52
knikollao/12:55
evrardjphey knikolla :)12:57
* knikolla waves12:58
evrardjplbragstad: ok you can completely ignore that pipenv thing: it doesn't lock pip, setuptools, virtalenv, or wheels :p13:06
evrardjpbut it does the rest! :)13:06
lbragstadlol13:06
*** jistr is now known as jistr|call13:32
*** TheJulia is now known as needssleep14:00
*** lbragstad is now known as elbragstad14:18
*** nick_kar has quit IRC14:20
elbragstadkmalloc let me know when you get in - we might need to go through a bunch of stable stuff today to get things fixed up14:27
elbragstadhttps://review.openstack.org/#/c/600554/114:27
*** pcaruana has quit IRC14:33
knikollaelbragstad: very interesting to see federated enhancements come out on top14:49
elbragstadyeah - i'm pretty sure it was on top last time, too14:49
elbragstadfederated identity enhancements were 78 last time, followed by multi-region support with 60, and enhancing policy 58 (those being the top 3)14:51
*** spartakos has joined #openstack-keystone14:52
elbragstadthe ops meetup is happening on monday and tuesday in Aspen14:52
elbragstadhttps://www.openstack.org/ptg/#tab_schedule14:52
elbragstadi wonder if we can get more information there, or if it will be brought up14:53
elbragstadgagehugo was https://review.openstack.org/#/c/600561/ abandoned because we're going to keep sha256 on master, right?15:01
*** jistr|call is now known as jistr15:03
elbragstadi think we should be able to get all the ksa python3 patches done once https://review.openstack.org/#/c/598346/9 is merged and we fix up the pep8 issues with nosec that gagehugo proposed15:03
gagehugoelbragstad yeah15:04
*** d0ugal has quit IRC15:04
*** gyee has joined #openstack-keystone15:06
*** ykarel is now known as ykarel|away15:15
openstackgerritayoung proposed openstack/keystone-specs master: Service Catalog Subsets by ID  https://review.openstack.org/16090915:25
*** d0ugal has joined #openstack-keystone15:25
*** shyamb has joined #openstack-keystone15:26
*** fiddletwix has joined #openstack-keystone15:33
elbragstadgagehugo any reason why isn't failing https://review.openstack.org/#/c/597681/ because https://review.openstack.org/#/c/600567/1 hasn't merged yet?15:39
*** josecastroleon has joined #openstack-keystone15:39
gagehugoelbragstad that passes because I had backported the SHA256 change, which kmalloc is reverting here: https://review.openstack.org/#/c/599461/15:42
gagehugoI added the nosec to kmalloc's fix15:42
*** josecastroleon has quit IRC15:44
*** ykarel|away has quit IRC15:46
*** shyamb has quit IRC15:47
elbragstadooooh15:47
elbragstadgagehugo so15:48
elbragstadwe need to merge https://review.openstack.org/#/c/599461/ then https://review.openstack.org/#/c/600567/1 and finally https://review.openstack.org/#/c/597681/ ?15:48
elbragstadright?15:48
gagehugooh bandit is capped at 1.4 for pike15:50
gagehugoelbragstad https://review.openstack.org/#/c/600567/1 might not be needed15:51
openstackgerritayoung proposed openstack/keystone-specs master: Tokens with subsets of roles  https://review.openstack.org/18697915:51
gagehugoif bandit on stable/pike is capped at 1.415:51
gagehugootherwise yeah15:51
elbragstadok15:51
elbragstadlet's abandon then?15:51
gagehugowill do15:51
elbragstadcool - updating my email15:52
elbragstadi'm summarizing all of this in the stable thread15:52
gagehugohttp://logs.openstack.org/81/597681/1/check/openstack-tox-pep8/150e60e/job-output.txt.gz#_2018-09-06_23_51_15_43179415:52
* gagehugo is curious why that failed the first time15:52
elbragstadbandit==1.4.015:52
gagehugoso pike/ocata are fine, no backport needed15:53
elbragstadgagehugo you didn't have a #nosec patch proposed to ocata, did you?15:54
gagehugono, it passed fine first time iirc15:54
elbragstadok15:54
gagehugoI thought pike failed though, not sure if something else changed or I was seeing things15:55
elbragstadi saw the sha256 one, but that one is already abandon, which is fine i think15:55
elbragstadgagehugo was the failure on doug's patch?15:56
elbragstadhttp://logs.openstack.org/81/597681/1/check/openstack-tox-py27/88c9e88/job-output.txt.gz15:56
elbragstadhttp://logs.openstack.org/81/597681/1/check/openstack-tox-py27/88c9e88/job-output.txt.gz#_2018-08-29_20_25_00_78593915:56
gagehugothought so15:57
gagehugobut perhaps not15:57
elbragstadthat should be fixed with https://review.openstack.org/#/c/598990/15:57
gagehugoah ok15:57
elbragstadok - so https://review.openstack.org/#/c/597681/ is the only thing needed for stable/pike ksa15:58
elbragstademail sent16:06
*** bhagyashris has joined #openstack-keystone16:26
*** spartakos has quit IRC16:27
*** AlexeyAbashkin has quit IRC16:36
*** ykarel has joined #openstack-keystone16:40
openstackgerritayoung proposed openstack/keystone-specs master: Allow a remote service to Validate Federation Mapping  https://review.openstack.org/24558816:50
ayoungelbragstad, we can work some of the user survey stuff into the talk that knikolla kmalloc and I are doing at the summit16:53
ayoungsounds like the 3 points are:  policy enhancements, Federated enhancements, and multi-site...which needs both the others16:54
ayoungper domain config, too16:54
ayounghmmmm16:54
*** bhagyashris has quit IRC16:55
*** imacdonn has quit IRC17:05
*** imacdonn has joined #openstack-keystone17:06
*** mvenesio has joined #openstack-keystone17:12
*** tesseract has quit IRC17:20
*** mvenesio has quit IRC17:28
*** ykarel is now known as ykarel|away17:33
*** mvenesio has joined #openstack-keystone17:35
*** spartakos has joined #openstack-keystone17:39
*** ykarel|away has quit IRC17:46
elbragstadayoung i wonder if we need to adjust our survey questions18:02
elbragstadwe've had the same ones for a while18:03
elbragstadi also wonder if we can have more than 5 options18:03
ayoungelbragstad, good thoughts for the next go roung18:04
ayounground18:04
ayoungI'm going to go take the dog for a walk and ponder federation.18:05
ayoungI just got asked to cover for an internal talk on it, and this is making me think harder...18:05
elbragstadayoung enjoy18:26
knikollaayoung: can i add you to an email thread with some RGW red hatters who wanted some feedback with a keystone question?18:39
ayoungknikolla, never!18:51
ayoungI mean...yeah, sure.18:51
ayoungelbragstad, ok, so Federation.  I see 2 big problems that we should tackle.  First is making it easier to add a new Federated Protocol, and second is making it easier to work with the mappings18:52
ayoungFor adding a protocol, it really is a painful Apache config setup18:52
ayoungI know that dstanek was working on in-keystone support for SAML, I suspect for just that reason:18:52
ayoungSo, If SAML really is the #1 Federated protocol, it might be worth resurrecting that effort.18:53
ayoungAnd, if OpenIDC is up there, that can also be done in pure Python18:53
ayoungso the idea would be for the Federated configuration to be completely driven off the database, not config files18:54
ayoungthat might be worth trying to validate with the operator community18:54
ayoungthe other part, the mapping, should be easier to address18:54
*** ykarel|away has joined #openstack-keystone18:55
ayoungif we know what we get from the Apache layer (mod_auth*) we can work with the mapping engine off line18:55
ayoungthat, of course, implies that we yank the mapping engine out of Keystone and make it work stand-alone18:56
ayoungpython-keystonemapping as a stand alone library with corresponding CLI?18:56
ayoungsomething like18:56
ayoungkeystone-map <mapping file>  <assertion>18:57
ayoungand generate the corresponding unscoped token type output18:57
*** r-daneel has quit IRC18:58
ayoungthat would allow an operator to iterate on a mapping file outside of the deployment, and get it right18:58
*** ykarel|away has quit IRC19:00
knikollaayoung: thanks!19:02
ayoungRDG == Rados Gateway, right?  The Ceph/Storage protocol?19:02
knikollaayoung: yep.19:02
*** r-daneel has joined #openstack-keystone19:30
*** r-daneel_ has joined #openstack-keystone19:35
*** r-daneel has quit IRC19:37
*** r-daneel_ is now known as r-daneel19:37
*** spartakos has quit IRC19:49
openstackgerritGage Hugo proposed openstack/keystone master: [WIP] Add functional testing gate  https://review.openstack.org/53101419:52
openstackgerritMerged openstack/oslo.limit master: Add opts file  https://review.openstack.org/58676020:24
elbragstadinteresting ksa bug if anyone is able to reproduce with devstack https://bugs.launchpad.net/keystoneauth/+bug/178016420:34
*** r-daneel has quit IRC20:34
openstackLaunchpad bug 1780164 in keystoneauth "httpd leaks open files" [Undecided,Confirmed]20:34
openstackgerritTim Burke proposed openstack/keystonemiddleware master: Respect delay_auth_decision when Keystone is unavailable  https://review.openstack.org/60086220:37
openstackgerritTim Burke proposed openstack/keystonemiddleware master: Respect delay_auth_decision when Keystone is unavailable  https://review.openstack.org/60086220:39
timburke*sigh* that's what i get for "temporarily" backing out my changes to make sure new tests really fail without them...20:40
*** r-daneel has joined #openstack-keystone20:47
*** spartakos has joined #openstack-keystone21:01
*** spartakos has quit IRC21:02
openstackgerritLance Bragstad proposed openstack/oslo.limit master: Render API reference documentation  https://review.openstack.org/60026421:13
openstackgerritLance Bragstad proposed openstack/oslo.limit master: Add a conceptual overview to docs  https://review.openstack.org/60026521:13
openstackgerritLance Bragstad proposed openstack/oslo.limit master: Allow ProjectClaims to support multiple resources  https://review.openstack.org/60026621:13
openstackgerritLance Bragstad proposed openstack/oslo.limit master: Use openstackdocstheme for documentation  https://review.openstack.org/60086621:17
*** mvenesio has quit IRC21:22
*** mvenesio has joined #openstack-keystone21:56
*** spartakos has joined #openstack-keystone21:56
openstackgerritTim Burke proposed openstack/keystonemiddleware master: Catch more keystoneauth exceptions  https://review.openstack.org/60087421:58
*** sapd1 has quit IRC21:59
*** mvenesio has quit IRC22:00
*** kukacz_ has quit IRC22:02
*** kukacz_ has joined #openstack-keystone22:04
*** mchlumsky has quit IRC22:05
*** r-daneel has quit IRC22:12
*** spartakos has quit IRC22:14
*** spartakos has joined #openstack-keystone22:15
*** spartakos has quit IRC22:23
*** spartakos has joined #openstack-keystone22:27
*** dave-mccowan has quit IRC22:38
openstackgerritMerged openstack/keystone master: Remove member_role_id/name  https://review.openstack.org/59846722:48
*** mvenesio has joined #openstack-keystone23:01
*** mvenesio has quit IRC23:06
*** spartakos has quit IRC23:17

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!