| openstackgerrit | Zhongcheng Lao proposed openstack/keystone master: Fixes missing name on filtered queries https://review.openstack.org/623928 | 01:13 |
|---|---|---|
| *** Dinesh_Bhor has joined #openstack-keystone | 01:52 | |
| *** dave-mccowan has joined #openstack-keystone | 02:07 | |
| *** Dinesh_Bhor has quit IRC | 02:10 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 02:21 | |
| *** mhen has quit IRC | 02:24 | |
| *** mhen has joined #openstack-keystone | 02:25 | |
| *** dave-mccowan has quit IRC | 02:47 | |
| *** dklyle has joined #openstack-keystone | 03:20 | |
| *** lbragstad has joined #openstack-keystone | 03:26 | |
| *** ChanServ sets mode: +o lbragstad | 03:26 | |
| *** Dinesh_Bhor has quit IRC | 03:51 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 03:52 | |
| *** itlinux has quit IRC | 03:59 | |
| *** itlinux has joined #openstack-keystone | 04:29 | |
| *** itlinux has quit IRC | 04:30 | |
| *** dklyle has quit IRC | 05:16 | |
| *** itlinux has joined #openstack-keystone | 05:32 | |
| *** rcernin has joined #openstack-keystone | 05:46 | |
| *** markvoelker has joined #openstack-keystone | 05:47 | |
| *** rcernin has quit IRC | 05:47 | |
| *** markvoelker has quit IRC | 05:51 | |
| *** Dinesh_Bhor has quit IRC | 06:06 | |
| *** rcernin has joined #openstack-keystone | 06:09 | |
| *** rcernin has quit IRC | 06:09 | |
| *** rcernin has joined #openstack-keystone | 06:09 | |
| *** rcernin has quit IRC | 06:09 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 06:41 | |
| *** itlinux has quit IRC | 07:09 | |
| *** itlinux has joined #openstack-keystone | 07:23 | |
| *** Dinesh_Bhor has quit IRC | 07:29 | |
| *** Emine has joined #openstack-keystone | 07:33 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 07:35 | |
| *** markvoelker has joined #openstack-keystone | 07:48 | |
| *** Dinesh_Bhor has quit IRC | 07:57 | |
| *** pcaruana has joined #openstack-keystone | 08:18 | |
| *** amoralej|off is now known as amoralej | 08:31 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Ensure change is addressed for unified limit table https://review.openstack.org/621497 | 08:37 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain_id column for limit https://review.openstack.org/620202 | 08:37 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain level limit support - Manager https://review.openstack.org/621468 | 08:37 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain level limit support - API https://review.openstack.org/622773 | 08:37 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain level support for strict-two-level-model https://review.openstack.org/623153 | 08:37 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Update project depth check https://review.openstack.org/623984 | 08:37 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Release note for domain level limit https://review.openstack.org/624019 | 08:37 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: [api-ref] add domain level limit support https://review.openstack.org/624562 | 08:37 |
| *** yan0s has joined #openstack-keystone | 08:45 | |
| *** alexchadin has joined #openstack-keystone | 08:47 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 09:17 | |
| *** Dinesh_Bhor has quit IRC | 09:56 | |
| *** lbragstad has quit IRC | 10:10 | |
| *** xek has joined #openstack-keystone | 10:16 | |
| *** yan0s has quit IRC | 10:30 | |
| *** yan0s has joined #openstack-keystone | 10:50 | |
| *** raildo has joined #openstack-keystone | 12:47 | |
| *** markvoelker has quit IRC | 13:05 | |
| *** amoralej is now known as amoralej|lunch | 13:12 | |
| openstackgerrit | Moisés Guimarães de Medeiros proposed openstack/oslo.policy master: Add ability for policy-checker to read configuration https://review.openstack.org/616659 | 13:13 |
| *** sapd1__ has joined #openstack-keystone | 13:18 | |
| *** alexchadin has quit IRC | 13:24 | |
| *** dave-mccowan has joined #openstack-keystone | 13:26 | |
| *** erus has joined #openstack-keystone | 13:39 | |
| *** dave-mccowan has quit IRC | 13:42 | |
| *** gagehugo has joined #openstack-keystone | 13:42 | |
| *** mvkr has quit IRC | 13:46 | |
| *** pcaruana has quit IRC | 13:50 | |
| *** lbragstad has joined #openstack-keystone | 13:58 | |
| *** ChanServ sets mode: +o lbragstad | 13:58 | |
| *** lbragstad has quit IRC | 13:59 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: DNM: test lower constraints change https://review.openstack.org/625601 | 13:59 |
| *** lbragstad has joined #openstack-keystone | 14:04 | |
| *** ChanServ sets mode: +o lbragstad | 14:04 | |
| *** pcaruana has joined #openstack-keystone | 14:05 | |
| *** amoralej|lunch is now known as amoralej | 14:06 | |
| *** dave-mccowan has joined #openstack-keystone | 14:07 | |
| *** dave-mccowan has quit IRC | 14:11 | |
| *** mchlumsky has joined #openstack-keystone | 14:11 | |
| *** aojea_ has joined #openstack-keystone | 14:16 | |
| *** mvkr has joined #openstack-keystone | 14:22 | |
| *** beekneemech is now known as bnemec | 15:00 | |
| *** pcaruana has quit IRC | 15:29 | |
| lbragstad | o/ | 15:38 |
| *** itlinux has quit IRC | 15:40 | |
| gagehugo | o/ | 15:41 |
| *** pcaruana has joined #openstack-keystone | 15:51 | |
| *** dklyle has joined #openstack-keystone | 15:59 | |
| *** gyee has joined #openstack-keystone | 16:10 | |
| *** yan0s has quit IRC | 16:17 | |
| *** Emine has quit IRC | 16:24 | |
| *** pcaruana has quit IRC | 16:28 | |
| *** itlinux has joined #openstack-keystone | 16:40 | |
| *** Emine has joined #openstack-keystone | 16:48 | |
| kmalloc | lbragstad: reminder, as of tomorrow i'm on vacation until ~jan 14 | 17:11 |
| kmalloc | i'll be turning my bouncer off | 17:11 |
| lbragstad | cool | 17:11 |
| lbragstad | see you next year then ;) | 17:11 |
| kmalloc | if there is an emergency, just drop me a line/text/ghangout | 17:11 |
| kmalloc | not that i expect it | 17:11 |
| kmalloc | but, hey i'm available if something really does come up | 17:11 |
| * lbragstad has a feeling it is going to be pretty quiet | 17:11 | |
| *** erus has quit IRC | 17:18 | |
| *** erus has joined #openstack-keystone | 17:18 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove protocol policies from v3cloudsample.json https://review.openstack.org/625357 | 17:18 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove protocol policies from v3cloudsample.json https://review.openstack.org/625357 | 17:19 |
| kmalloc | thats the hope | 17:25 |
| kmalloc | but you know, sometimes... sometimes it isn't quiet | 17:26 |
| *** sapd1__ has quit IRC | 17:29 | |
| *** Emine has quit IRC | 17:54 | |
| *** Emine has joined #openstack-keystone | 17:54 | |
| *** Emine has quit IRC | 17:58 | |
| lbragstad | stepping away to grab lunch | 18:07 |
| *** ayoung has joined #openstack-keystone | 18:11 | |
| *** imacdonn has quit IRC | 18:24 | |
| *** imacdonn has joined #openstack-keystone | 18:24 | |
| *** amoralej is now known as amoralej|off | 18:33 | |
| *** mvkr has quit IRC | 18:44 | |
| *** mchlumsky has quit IRC | 19:09 | |
| *** Emine has joined #openstack-keystone | 19:10 | |
| *** erus has quit IRC | 19:15 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement system reader role for users https://review.openstack.org/605485 | 19:17 |
| *** erus has joined #openstack-keystone | 19:17 | |
| *** mvkr has joined #openstack-keystone | 19:20 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement system member role user test coverage https://review.openstack.org/623317 | 19:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement system admin role in users API https://review.openstack.org/623318 | 19:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement domain reader functionality for user API https://review.openstack.org/623319 | 19:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement domain member functionality for user API https://review.openstack.org/623320 | 19:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement domain admin functionality for user API https://review.openstack.org/623321 | 19:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add explicit testing for project users and the user API https://review.openstack.org/623322 | 19:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove user policies from policy.v3cloudsample.json https://review.openstack.org/623323 | 19:25 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Ignore user/domain not found on initial validate https://review.openstack.org/625699 | 19:53 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add random pause when user/domain not found https://review.openstack.org/625700 | 19:54 |
| kmalloc | gagehugo: FYI that domain not found bit... that will severely impact test runtime | 20:03 |
| gagehugo | kmalloc: yup | 20:03 |
| gagehugo | unfortunately | 20:04 |
| kmalloc | gagehugo: potentially at least... i am generally against that. | 20:04 |
| gagehugo | I posted both of those to see what hurts worse | 20:04 |
| kmalloc | this is in-fact a case where i'd like to see an option to enable or disable it. | 20:04 |
| gagehugo | sure | 20:04 |
| kmalloc | right. | 20:04 |
| kmalloc | we can hold on options for the moment | 20:04 |
| kmalloc | This one is one of those things i would like to see disabled for test cases / tempest outside of explicit testing | 20:05 |
| kmalloc | and it can be enabled by default... but i don't want to have a case where we blow out our test runtimes | 20:05 |
| *** aojea has joined #openstack-keystone | 20:05 | |
| kmalloc | if that makes sense. | 20:05 |
| gagehugo | yeah, I agree | 20:06 |
| *** aojea_ has quit IRC | 20:06 | |
| kmalloc | i'm mostly telling you cause i am on vacation soon(tm) for a while | 20:06 |
| kmalloc | :) | 20:06 |
| kmalloc | i also don't feel like my request for options should block work. | 20:06 |
| kmalloc | we can always add an option down the road if it's too slow. | 20:06 |
| kmalloc | so.. wait ignore user/domain not found... one | 20:07 |
| gagehugo | it shouldn't hurt normal operation, but all the integrated testing may suffer | 20:07 |
| kmalloc | what are we doing? | 20:07 |
| kmalloc | oh | 20:07 |
| kmalloc | just deferring the logic | 20:07 |
| kmalloc | don't do it that way. do not use uuid. | 20:07 |
| gagehugo | ok | 20:08 |
| kmalloc | while i would eat my hat if a uuid colided there is a chance | 20:08 |
| kmalloc | and if those collide you'd authorize someone | 20:08 |
| gagehugo | true | 20:08 |
| kmalloc | i'd use something that could never be an ID | 20:08 |
| kmalloc | but wont break the backend storage | 20:08 |
| kmalloc | i don't know what that is, but definitely not a uuid or a sha256/512 | 20:09 |
| gagehugo | hmm | 20:12 |
| kmalloc | yeah this one is hard. | 20:15 |
| kmalloc | it might need to be a fixed non-printable string | 20:15 |
| kmalloc | we control | 20:15 |
| kmalloc | or something liek that | 20:15 |
| lbragstad | i just left a comment on both patches | 20:17 |
| lbragstad | so - what if we leveraged the pre/post hooks like we do with the RBAC enforcer? | 20:18 |
| lbragstad | we could set a flask specific variable for the request and handle that case for authentication, then write a post hook to raise exception.Unauthorized() if it's true | 20:19 |
| gagehugo | hmm | 20:21 |
| gagehugo | so we'd still go through the motions regardless, and then throw back unauthorized at the end | 20:23 |
| lbragstad | yeah | 20:23 |
| lbragstad | and if we have access to the flask context, we have access to the global variable | 20:24 |
| lbragstad | so if there are things that happen in the authentication flow that we need to special-case, we might be able to detect it easier | 20:24 |
| lbragstad | kinda keeping inline with cmurphy's suggestion of just processing as much as we can normally and then just throwing the error at the end | 20:25 |
| kmalloc | oh totally doable | 20:26 |
| kmalloc | the pre/post hooks are awesome for that | 20:26 |
| kmalloc | keep in mind that "g" is mutable by any code | 20:26 |
| lbragstad | right | 20:26 |
| kmalloc | so something loading in externally could change it. | 20:26 |
| kmalloc | we could create a dynamic key for each request on G for this | 20:26 |
| kmalloc | (probably should have done that for RBACEnforcer) | 20:27 |
| kmalloc | but it's still ultimately something we need to be aware of when leaning on it | 20:27 |
| kmalloc | but someone could break flask massively | 20:27 |
| kmalloc | if they sideload things that change "g" on us | 20:27 |
| * kmalloc thinks | 20:27 | |
| kmalloc | yeah just simple pre/post hooks might be the best bet | 20:27 |
| kmalloc | in known key/locations | 20:27 |
| lbragstad | the only thing that should be setting that flask variable should be authentication code | 20:28 |
| lbragstad | then it's really just a read-only thing | 20:29 |
| lbragstad | does that make sense gagehugo ? | 20:33 |
| gagehugo | yeah, I'll play around with it | 20:33 |
| kmalloc | just register it like the RBAC enforcer bits. | 20:33 |
| kmalloc | the pre/post hooks | 20:34 |
| gagehugo | ok | 20:34 |
| * gagehugo is a flask padawan | 20:34 | |
| kmalloc | also, if you do this, do it where setting a value prevents an exception | 20:35 |
| kmalloc | instead of the inverse. | 20:35 |
| kmalloc | e.g. don't set a "we need to throw an exception" set a "don't throw an exception" marker | 20:35 |
| gagehugo | ok | 20:35 |
| gagehugo | yeah | 20:35 |
| kmalloc | and you'll see a couple places where RBACEnforcer has explicit overrides (e.g. in middleware/normalizing/etc) | 20:35 |
| kmalloc | you'll need to add similar exceptions in the same places | 20:35 |
| kmalloc | and probably also hook into @unauthenticated_api | 20:36 |
| lbragstad | yeah - sounds like we do something really similar with the rbac enforcer anyway, so it might make for a good template | 20:40 |
| *** aojea has quit IRC | 20:42 | |
| gagehugo | ok | 20:45 |
| * gagehugo goes to get a late lunch | 20:47 | |
| *** dmellado has quit IRC | 21:05 | |
| *** erus has quit IRC | 21:17 | |
| *** erus has joined #openstack-keystone | 21:18 | |
| *** Emine has quit IRC | 21:23 | |
| *** raildo has quit IRC | 21:25 | |
| *** rcernin has joined #openstack-keystone | 21:28 | |
| *** xek has quit IRC | 21:44 | |
| *** itlinux has quit IRC | 22:42 | |
| *** Emine has joined #openstack-keystone | 23:04 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement system reader role for groups https://review.openstack.org/625732 | 23:08 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement system member test coverage for groups https://review.openstack.org/625733 | 23:08 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement system admin role in groups API https://review.openstack.org/625734 | 23:08 |
| *** Emine has quit IRC | 23:08 | |
| *** itlinux has joined #openstack-keystone | 23:33 | |
| *** Emine has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!