Wednesday, 2018-10-17

*** gyee has quit IRC00:17
openstackgerritayoung proposed openstack/keystone-specs master: Explicit Domain Ids  https://review.openstack.org/61120100:24
*** felipemonteiro has joined #openstack-keystone00:29
*** lbragstad-503 is now known as lbragstad00:58
*** imacdonn has quit IRC01:09
*** felipemonteiro has quit IRC01:10
adriantkmalloc: I'm trying to redo the auth receipts stuff and I'm getting a little lost with the flask refactor.01:11
adriantpreviously I used to get the receipt_id directly from the request object in authenticate_for_token01:12
adriant(with a change to the webob request object to expose the correct header as a property)01:12
adrianthow do I now get the receipt_id into that function? or can i just grab it directly from the global flask request object?01:14
adriantfor now i'm just going to try:01:17
adriantreceipt_id = flask.request.headers.get(authorization.AUTH_RECEIPT_HEADER, None)01:17
*** dave-mccowan has joined #openstack-keystone01:19
adriantoh but it gets worse... that function now returns a token rather than a response01:20
adriantwhich means I probably do need to raise an InsufficientAuthMethods exception and handle the creation of a receipt in the next layer up :/01:21
*** imacdonn has joined #openstack-keystone01:22
adriantwhich looks just as ugly in a way :(01:23
openstackgerritwangxiyuan proposed openstack/keystone master: Allow registered limit's region_id to be None  https://review.openstack.org/61088701:35
*** felipemonteiro has joined #openstack-keystone01:42
*** Dinesh_Bhor has joined #openstack-keystone01:48
wxy-xiyuanlbragstad: this is the limit CRUD patch for sdk: https://review.openstack.org/#/q/topic:unified_limit+(status:open+OR+status:merged), I'll update my oslo.limit patch once sdk release a new version.01:57
lbragstadwxy-xiyuan awesome - i was going to review that yesterday and ran out of time01:57
lbragstadi'll be sure to review it tomorrow though01:57
wxy-xiyuancc kmalloc, mordred, vishakha if you are interested.01:58
wxy-xiyuanlbragstad: cool.01:58
wxy-xiyuanlbragstad: BTW, the guidelines for naming policies is approved, what's the next step, start coding  in each project?01:59
lbragstadwxy-xiyuan yep - i think so01:59
lbragstadnow that we have something concrete to reference01:59
wxy-xiyuanlbragstad: using policy deprecation mechanism, right?02:00
lbragstadcorrect02:00
wxy-xiyuanlbragstad: nice.02:00
lbragstadsome examples here https://docs.openstack.org/oslo.policy/latest/reference/api/oslo_policy.policy.html#oslo_policy.policy.DeprecatedRule02:01
wxy-xiyuanlbragstad: clear guidelines. Thanks.02:02
lbragstadwxy-xiyuan no problem - let me know if you have questions, chances are we can probably continue improving the guidelines02:03
adriantlbragstad: Adjutant doesn't yet have a dedicated meeting time. Mostly not enough devs yet, or from external companies. But should organise one so that people have a chance to pop in and ask questions if needed.02:11
adriantalso, lbragstad, since kmalloc is probably asleep, are you able to help with a couple of question regarding the flask auth rework?02:12
lbragstadyou might be able to do it with the global request object02:13
lbragstadthe auth stuff was a mess in the first place02:13
lbragstadthe auth receipt comes from the header, right?02:14
adriantyeah02:14
adriantthat part I'm fine with, but now I'm stuck on how to handle returning the receipt02:15
lbragstadok - so it will have to come from the global request object or flask02:15
lbragstadoh?02:15
adriantin my old code i replaced this with a return response that made the receipt: https://github.com/openstack/keystone/blob/master/keystone/api/_shared/authentication.py#L20902:15
adriantbut since this function no longer returns a request02:15
adriantthe only option I can see that isn't awful is to catch this error, and then make/return the receipt elsewhere02:16
adriantbut I'm not sure a try except here is that nice: https://github.com/openstack/keystone/blob/master/keystone/api/auth.py#L31502:16
adriantbut that's what I'm doing right now02:16
lbragstadhmm02:16
lbragstadwell - let's start with that and see if we can flush out better alternatives in the process?02:16
lbragstadthis has happened a couple times with the flask refactor02:17
adriantI was curious where the actual error handling for unauthorised is handled right now, but I can't find a flask "handle_exception" function defined anywhere in so02:17
adriantso I'm a little confused02:17
lbragstadwhere we need to massage flask to handle specific things we did a long time ago02:17
adriantbecause in that same exception handling layer is another possible option for making/returning the receipt02:17
lbragstadhandle_exception is in flaks02:18
lbragstadflask02:18
lbragstadlike flask/app.py02:19
lbragstadso we don't really have access to that02:19
adriantoh wait, sorry thought you could define an exception handler to replace the default one02:19
* adriant hasn't used flask in ages02:19
lbragstadhttp://flask.pocoo.org/snippets/127/02:21
lbragstadjust an example of subclassing handle_exception02:21
adriantjust reading through http://flask.pocoo.org/docs/1.0/patterns/apierrors/?highlight=exception#implementing-api-exceptions now02:21
lbragstadok - i'm going to have to run, but feel free to leave messages if you find something02:22
lbragstadand i'll follow up02:22
adriantI think I'm just lost and confused and asking really pointless questions02:22
adriantso don't mind me too much about that :P02:23
adriantwill throw up some code and we can start from there02:23
lbragstad+1 kmalloc and i can take a poke at it tomorrow02:23
lbragstadthanks for continuing to work on this, adriant02:23
adriantlbragstad: np! I'm just sorry it's taken me this long to get back to it02:24
*** Dinesh_Bhor has quit IRC02:44
*** Dinesh_Bhor has joined #openstack-keystone02:49
*** felipemonteiro has quit IRC03:00
vishakhawxy-xiyuan: Looking in it03:23
*** dklyle has quit IRC03:25
*** dave-mccowan has quit IRC03:33
openstackgerritMerged openstack/keystone master: Convert S3 and EC2 auth to flask native dispatching  https://review.openstack.org/60950003:56
openstackgerritVishakha Agarwal proposed openstack/keystone master: Fixing update unified limit api-ref  https://review.openstack.org/61000003:59
openstackgerritAdrian Turjak proposed openstack/keystone master: Implement auth receipts spec  https://review.openstack.org/61123004:00
*** Dinesh_Bhor has quit IRC04:07
openstackgerritVishakha Agarwal proposed openstack/keystone master: Fixing update unified limit api-ref  https://review.openstack.org/61000004:07
*** Dinesh_Bhor has joined #openstack-keystone04:39
*** pcaruana has quit IRC04:46
*** shyamb has joined #openstack-keystone04:58
*** annp has quit IRC05:23
*** obre has quit IRC05:40
*** obre has joined #openstack-keystone05:41
*** Dinesh_Bhor has quit IRC05:49
*** Dinesh_Bhor has joined #openstack-keystone06:01
*** Dinesh_Bhor has quit IRC06:15
*** obre has quit IRC06:16
*** obre has joined #openstack-keystone06:17
*** Dinesh_Bhor has joined #openstack-keystone06:23
*** pcaruana has joined #openstack-keystone06:34
*** shyamb has quit IRC06:52
*** rdopiera has joined #openstack-keystone07:00
openstackgerritMerged openstack/keystone master: Update API version to 3.11  https://review.openstack.org/60821607:05
openstackgerritMerged openstack/keystone master: Added test case update registered limit with region  https://review.openstack.org/61000507:05
*** rcernin has quit IRC07:09
*** shyamb has joined #openstack-keystone07:46
*** Dinesh_Bhor has quit IRC08:25
*** adriant has quit IRC08:29
*** adriant has joined #openstack-keystone08:29
openstackgerritVishakha Agarwal proposed openstack/keystone master: Set Default and resource limit as defined schema  https://review.openstack.org/61047908:36
openstackgerritVishakha Agarwal proposed openstack/keystone master: Fixing update unified limit api-ref  https://review.openstack.org/61000008:44
*** Dinesh_Bhor has joined #openstack-keystone09:06
wxy-xiyuanlbragstad: look forward to get your thought: https://review.openstack.org/#/c/611216  I'm not quite sure the way is correct.09:06
openstackgerritMerged openstack/oslo.policy master: Add minor nits in testing documentation  https://review.openstack.org/61111109:09
openstackgerritVishakha Agarwal proposed openstack/keystone master: Remove deprecated token_flush  https://review.openstack.org/60927709:10
openstackgerritVishakha Agarwal proposed openstack/keystone master: Remove deprecated token_flush  https://review.openstack.org/60927709:12
*** shyamb has quit IRC09:14
openstackgerritVishakha Agarwal proposed openstack/keystone master: Remove deprecated token_flush  https://review.openstack.org/60927709:15
vishakhacmurphy:  waiting four comment on https://review.openstack.org/#/c/606912/09:25
vishakhas/four/for09:25
*** shyamb has joined #openstack-keystone09:38
*** Emine has joined #openstack-keystone09:40
*** Dinesh_Bhor has quit IRC09:42
*** shyamb has quit IRC09:48
*** shyamb has joined #openstack-keystone09:48
openstackgerritVishakha Agarwal proposed openstack/keystone master: Adding 'date' for trust_flush  https://review.openstack.org/60789710:05
*** shyam89 has joined #openstack-keystone10:09
*** Emine has quit IRC10:10
*** shyamb has quit IRC10:13
*** Emine has joined #openstack-keystone10:13
openstackgerritVishakha Agarwal proposed openstack/keystone master: Fixing update unified limit api-ref  https://review.openstack.org/61000010:18
*** Emine has quit IRC10:30
*** Dinesh_Bhor has joined #openstack-keystone10:30
*** pooja_jadhav has quit IRC10:41
*** xek has joined #openstack-keystone10:41
*** Dinesh_Bhor has quit IRC10:50
*** Emine has joined #openstack-keystone10:50
cmurphyvishakha: sorry i'm sort of afk this week, will try to check asap11:13
*** shyam89 has quit IRC11:16
*** pcaruana has quit IRC11:28
*** shyam89 has joined #openstack-keystone11:28
*** pooja_jadhav has joined #openstack-keystone11:35
*** mvkr has quit IRC11:46
*** raildo has joined #openstack-keystone11:56
*** shyam89 has quit IRC12:11
*** shyam89 has joined #openstack-keystone12:11
*** shyam89 has quit IRC12:13
*** shyam89 has joined #openstack-keystone12:13
*** dave-mccowan has joined #openstack-keystone12:14
*** shyamb has joined #openstack-keystone12:15
*** shyam89 has quit IRC12:18
*** pcaruana has joined #openstack-keystone12:24
*** mvkr has joined #openstack-keystone12:53
*** mchlumsky has joined #openstack-keystone13:15
*** dklyle has joined #openstack-keystone13:16
*** shyamb has quit IRC13:22
*** dklyle has quit IRC13:31
*** e0ne has joined #openstack-keystone13:39
e0necmurphy: thanks a lot for you reviews and commend for Horizon bugs13:39
*** dims has quit IRC13:40
*** jmlowe has quit IRC13:49
lbragstadwxy-xiyuan nice work on the zaqar patch, just a few comments inline but that's on the right track for sure13:56
*** jmlowe has joined #openstack-keystone13:58
*** munimeha1 has joined #openstack-keystone13:59
*** dims has joined #openstack-keystone14:03
ayounghttps://review.openstack.org/#/c/611201/  lbragstad cmurphy please defile it with all your comments!14:05
ayoungdeface?14:05
* lbragstad puts a post-it on his monitor14:05
ayoungvishakha, add keystone-core to a review that is important.  We'll all see it14:05
ayoungvishakha, reviewed14:12
*** sapd1_ has quit IRC14:13
cmurphye0ne: you're welcome, if you want to thank me you could bump https://bugs.launchpad.net/horizon/+bug/1794710 to someone's priority, it's really broken and i don't know how to fix it ;)14:16
openstackLaunchpad bug 1794710 in OpenStack Dashboard (Horizon) "WebSSO initial redirect 404s" [High,Confirmed]14:16
*** sapd1_ has joined #openstack-keystone14:16
cmurphyayoung: will look tonight14:16
*** dims has quit IRC14:16
e0necmurphy: TBH, I tested this feature last time in Pike. I'll try to find few hours next week to dig into it early next week14:17
*** dims has joined #openstack-keystone14:19
*** openstackgerrit has quit IRC14:36
*** munimeha1 has quit IRC14:49
*** knikolla has quit IRC14:49
*** openstackgerrit has joined #openstack-keystone14:58
openstackgerritayoung proposed openstack/keystone-specs master: Explicit Domain Ids  https://review.openstack.org/61120114:58
ayoungcmurphy, e0ne I'll take a look.  I think I wrote the original impl14:59
e0neayoung: thanks. feel free to ping me if you need any help15:00
ayounge0ne,  https://review.openstack.org/61134915:05
ayoungit will probably start a small storm15:05
e0ne:)15:06
ayounge0ne, what is your launchpad id?  Or add yourself as a reviewer, please15:06
e0neayoung: done. my launchpad id is the same as IRC nickname15:07
ayoungGOt it15:07
ayounge0ne, and, since you approved the change that broken things, you are on the hook to fix it anyway!15:08
e0neayoung: sure, let's wait for CI15:08
ayounge0ne, I leave it to you.15:08
e0neI'm pretty sure that CI will pass on your patch15:09
ayounge0ne,  what do you think should be done WRT to the bug that lead to the breaking patch?15:09
e0neayoung: I'll re-open it15:10
*** xek has quit IRC15:13
openstackgerritLance Bragstad proposed openstack/keystone master: Implement scope_type checking for credentials  https://review.openstack.org/59454715:16
openstackgerritLance Bragstad proposed openstack/keystone master: Remove obsolete credential policies  https://review.openstack.org/59718715:16
openstackgerritLance Bragstad proposed openstack/keystone master: Pass context objects to policy enforcement  https://review.openstack.org/60553915:25
*** xek has joined #openstack-keystone15:43
*** itlinux has joined #openstack-keystone15:50
*** xek has quit IRC15:51
*** xek has joined #openstack-keystone15:57
*** munimeha1 has joined #openstack-keystone16:24
*** knikolla has joined #openstack-keystone16:24
openstackgerritLance Bragstad proposed openstack/keystone master: Implement system reader role in users API  https://review.openstack.org/61117916:42
lbragstadkmalloc ^16:42
lbragstadfor whenever you get back16:42
*** e0ne has quit IRC16:46
*** mvkr has quit IRC17:01
kmalloclbragstad: why are we worried about 404 vs 403?17:17
lbragstadso - the 404 could be returned without a user being authenticated to perform that action17:19
lbragstadwhen they should get a 40317:19
lbragstadright?17:19
kmallocif someone is not authenticated, it would be a 40317:20
lbragstadif some is authenticated, it should be a 404, yeah?17:20
kmallocyeah17:20
lbragstadok17:20
kmallocthe test looks correct now.17:20
kmallocfwiw17:20
lbragstadi noticed this isn't tested in the credentials patch either17:20
lbragstadi'll update that one, too17:20
kmallocah17:20
kmallocok so we're missing the "if not authenticated, 403"17:20
kmallocfwiw, the RBACEnforcer has that logic built in17:21
kmallocin *all* cases, not-authenticated bounces with a 40317:21
kmallocand we do test that17:21
kmallocif .enforce_call is used17:21
lbragstadyeah - that's the default behavior17:21
kmallocso this case probably doesn't need explicit 403 check17:21
lbragstadif ! authenticated; raise 40317:21
lbragstadbut what about with 404?17:21
kmallocand that behavior isn't configurable in policy.json17:22
kmallocit is hard-coded17:22
openstackgerritMorgan Fainberg proposed openstack/keystone master: Support KWARGS in the cache key generating function(s).  https://review.openstack.org/61112017:24
kmallocayoung: commented on explicit domain_id spec17:36
kmallocmostly just a couple questions for discussion purposes17:36
kmallocnothing that would block it from landing as is17:36
kmallocayoung: +1 for now, +2 as we capture discussion17:36
kmalloclbragstad: https://review.openstack.org/#/c/611121/ security (minor) issue with caching17:37
kmalloclbragstad: needs quick eyes.,17:37
kmalloclbragstad: might need backporting.17:37
openstackgerritCorey Bryant proposed openstack/ldappool master: py3 ldap does not allow bytes for DN/RDN/field names  https://review.openstack.org/61140117:44
*** rdopiera has quit IRC17:49
*** dklyle has joined #openstack-keystone17:52
openstackgerritCorey Bryant proposed openstack/keystone master: py3 ldap does not allow bytes for DN/RDN/field names  https://review.openstack.org/61119017:52
openstackgerritCorey Bryant proposed openstack/keystone master: py3 ldap does not allow bytes for DN/RDN/field names  https://review.openstack.org/61119017:53
openstackgerritayoung proposed openstack/keystone-specs master: Explicit Domain Ids  https://review.openstack.org/61120117:57
*** ayoung has quit IRC18:08
openstackgerritLance Bragstad proposed openstack/keystone master: Implement scope_type checking for credentials  https://review.openstack.org/59454718:09
lbragstadkmalloc ok ^ that should clearly test the 404 vs 403 differences across the various personas18:10
openstackgerritLance Bragstad proposed openstack/keystone master: Remove obsolete credential policies  https://review.openstack.org/59718718:11
openstackgerritLance Bragstad proposed openstack/keystone master: Pass context objects to policy enforcement  https://review.openstack.org/60553918:11
*** david-lyle has joined #openstack-keystone18:29
*** dklyle has quit IRC18:29
kmalloclbragstad: my brain is a little fried post flask18:34
lbragstadyeah...18:36
lbragstadthat one was a doozy18:47
openstackgerritMerged openstack/keystone master: Remove incorrect copyright notice.  https://review.openstack.org/61087919:29
*** dklyle has joined #openstack-keystone19:31
*** david-lyle has quit IRC19:33
*** dklyle has quit IRC19:37
*** dklyle has joined #openstack-keystone19:38
kmallocand something is now failing with py36 in gate becasue it couldn't find keystone.sample.conjf19:45
kmallocit was just workingt19:45
kmalloc....19:45
kmallocoh transient19:46
kmalloci don't know how THAT transient happened19:46
kmallocbut...19:46
lbragstadyeah - i've seen that one a couple times too19:47
*** dklyle has quit IRC19:52
*** dklyle has joined #openstack-keystone19:55
*** dklyle has quit IRC20:15
*** xek has quit IRC20:22
*** mchlumsky has quit IRC20:22
*** dklyle has joined #openstack-keystone20:46
*** raildo has quit IRC20:52
openstackgerritMatt Riedemann proposed openstack/keystone master: Implement scaffolding for upgrade checks  https://review.openstack.org/60878520:55
lbragstadthanks mr20:56
*** dklyle has quit IRC20:59
*** dklyle has joined #openstack-keystone20:59
*** dklyle has quit IRC21:10
*** dklyle has joined #openstack-keystone21:10
openstackgerritLance Bragstad proposed openstack/oslo.policy master: WIP: Add domain scope support for scope types  https://review.openstack.org/61144321:12
*** felipemonteiro has joined #openstack-keystone21:14
*** dklyle has quit IRC21:17
*** rcernin has joined #openstack-keystone21:18
*** dklyle has joined #openstack-keystone21:18
*** felipemonteiro has quit IRC21:24
*** dklyle has quit IRC21:40
*** dklyle has joined #openstack-keystone21:44
openstackgerritLance Bragstad proposed openstack/keystone master: Implement system reader role in users API  https://review.openstack.org/61117921:44
openstackgerritLance Bragstad proposed openstack/keystone master: Implement reader role in users API  https://review.openstack.org/61117921:44
*** dklyle has quit IRC21:52
*** dklyle has joined #openstack-keystone21:57
*** bnemec has quit IRC22:01
*** mvkr has joined #openstack-keystone22:04
*** munimeha1 has quit IRC22:20
*** itlinux has quit IRC22:22
*** felipemonteiro has joined #openstack-keystone22:26
openstackgerritAdrian Turjak proposed openstack/keystone master: Implement auth receipts spec  https://review.openstack.org/61123022:31
*** dklyle has quit IRC22:36
*** itlinux has joined #openstack-keystone23:22
openstackgerritLance Bragstad proposed openstack/keystone master: WIP: Implement domain and system default roles  https://review.openstack.org/61146523:25
*** lbragstad is now known as lbragstad_50323:26

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!