Wednesday, 2019-02-13

*** markvoelker has quit IRC00:06
*** jamesmcarthur has joined #openstack-keystone00:10
*** jamesmcarthur has quit IRC00:16
*** david-lyle has joined #openstack-keystone00:18
*** dklyle has quit IRC00:21
*** openstackgerrit has quit IRC00:52
*** jamesmcarthur has joined #openstack-keystone00:53
*** jamesmcarthur has quit IRC00:54
adriantlbragstad: having project names bigger than 64 would be nice for some of my use cases... but changing that is too much of a breaking change it seems, so https://blueprints.launchpad.net/keystone/+spec/name-field-consistency is probably dead01:00
lbragstadadriant ack - i appreciate the follow up01:00
adriantI'll will patiently wait for v401:01
adriant....01:01
lbragstadhah01:01
adriantbah was rewritting that and hit enter.01:01
adriantbut yes, v4, the solution to all the problems!01:01
lbragstad:)01:02
adriantmostly, I need 64+ project names to essentially turn the project name into a sub-tree name path, so subprojects can be 'unique'01:02
lbragstadyeah - i remember you were doing something like that01:02
adriantbut I guess I'll mostly tell people to name things shorts, and use project descriptions01:02
lbragstadoh - sure01:02
lbragstadi suppose that works01:02
lbragstadyou don't use traditional project hierarchies?01:03
lbragstadlike - the actual implementation in keystone?01:03
*** markvoelker has joined #openstack-keystone01:03
adriantnames aren't unique for sub projects01:04
adriantas in, this includes trees01:04
adriantbut I enforce a naming convention down the tree01:04
adriantso root_project_1/test and root_project_2/test can both exist01:04
*** jamesmcarthur has joined #openstack-keystone01:04
adriantwhen otherwise they will both make "test" and the second attempt will fail01:04
lbragstadbut that's because they will both be in the same domain, right?01:05
adriantyes01:05
adriantsingle domain issues01:05
lbragstadand has less to do with project hierarchy01:05
adriantyep01:05
lbragstadgot it01:05
adriantproject hierarchy is used for role inheritance and subproject ownership, but we aren't handing a domain to each customer :/01:06
adriantmostly because that has it's own set of messes01:06
*** gyee has quit IRC01:07
lbragstadlike proper domain support for RBAC?01:08
*** yankcrime has quit IRC01:08
*** gyee has joined #openstack-keystone01:10
adriantlbragstad: sort of, but also the ability to migrate existing customers into their own domain, and other stuff like billing per domain01:18
lbragstadmmm01:18
adriantsingle domain is easier in a weird way01:19
adriantand sub-projects and hierarchy mostly make it fine01:19
adriantthe only issue is names no being unique per sub-project level, which can't be solved without some path_name value to maintain unique namespacing01:20
adriantthere was specs and such a while back about solving exactly that, but it would break too much01:20
adriantso my solution (through Adjutant) was just enforce that path_name in the actual name01:21
adriantlbragstad: https://blueprints.launchpad.net/keystone/+spec/hierarchical-project-naming < before my time01:22
adriantbut essentially I'm trying to mimic that01:23
lbragstadinteresting01:23
adriantadding that to keystone breaks the API, but doing it as a 'naming convention' doesn't :)01:24
adriantah yes, the rabbit hole of rejected specs that is this: https://review.openstack.org/#/c/318605/01:27
adriantlbragstad: looks like you even commented on those :)01:28
lbragstadit's been a while01:30
*** jamesmcarthur has quit IRC01:30
adriantthat's a little before I started playing around a lot more with Keystone, so I missed those discussions until afterwards.01:31
adriantand by that point the first spec (which solved my particular use case) was abandoned01:31
*** Dinesh_Bhor has joined #openstack-keystone01:32
*** jamesmcarthur has joined #openstack-keystone01:33
*** markvoelker has quit IRC01:35
lbragstadcmurphy vishakha - i started an etherpad in case either of you find it useful to see what i'm doing with blueprint https://etherpad.openstack.org/p/keystone-blueprint-cleanup01:46
*** openstackgerrit has joined #openstack-keystone01:46
openstackgerritMerged openstack/keystonemiddleware master: Add auth invalidation in auth_token for identity endpoint update  https://review.openstack.org/63369501:46
lbragstadalso - i'm open to feedback if you have an alternative way of doing things01:46
*** gyee has quit IRC01:47
* lbragstad signs off for a bit01:48
*** jamesmcarthur has quit IRC01:53
*** jamesmcarthur has joined #openstack-keystone01:54
*** yankcrime has joined #openstack-keystone02:01
*** jamesmcarthur has quit IRC02:05
*** jamesmcarthur has joined #openstack-keystone02:16
*** jamesmcarthur has quit IRC02:28
*** penguinepimple has left #openstack-keystone02:41
*** Dinesh_Bhor has quit IRC02:44
*** Dinesh_Bhor has joined #openstack-keystone02:48
*** vishakha has joined #openstack-keystone02:58
*** jamesmcarthur has joined #openstack-keystone02:59
*** jamesmcarthur has quit IRC03:06
*** jamesmcarthur has joined #openstack-keystone03:26
*** jamesmcarthur has quit IRC03:30
*** opetrenko_ has quit IRC03:49
*** spsurya has joined #openstack-keystone03:55
*** lbragstad has quit IRC04:32
*** shyamb has joined #openstack-keystone05:03
*** shyamb has quit IRC05:53
*** shyamb has joined #openstack-keystone05:55
*** markvoelker has joined #openstack-keystone06:00
*** markvoelker has quit IRC06:04
*** imacdonn has quit IRC06:13
*** Dinesh_Bhor has quit IRC06:30
openstackgerritweizj proposed openstack/oslo.policy master: Update hacking version  https://review.openstack.org/62765106:33
*** Dinesh_Bhor has joined #openstack-keystone06:39
*** markvoelker has joined #openstack-keystone07:00
*** ileixe has joined #openstack-keystone07:07
*** adriant has quit IRC07:11
*** adriant has joined #openstack-keystone07:11
*** josecastroleon has joined #openstack-keystone07:15
openstackgerritweizj proposed openstack/oslo.limit master: Update hacking version  https://review.openstack.org/62765607:15
*** jamesmcarthur has joined #openstack-keystone07:26
*** jamesmcarthur has quit IRC07:31
*** markvoelker has quit IRC07:34
*** shyamb has quit IRC07:41
*** yan0s has joined #openstack-keystone08:07
vishakhalbragstad, cmurphy :  I am updating the same etherpad https://etherpad.openstack.org/p/keystone-blueprint-cleanup  with blueprints on which I commented.08:12
*** markvoelker has joined #openstack-keystone08:31
*** liumk_ has joined #openstack-keystone08:36
*** tkajinam has quit IRC08:36
*** liumk_ has quit IRC08:50
*** shyamb has joined #openstack-keystone08:53
*** xek has joined #openstack-keystone08:54
*** markvoelker has quit IRC09:04
*** liumk2233 has joined #openstack-keystone09:08
*** liumk2233 has quit IRC09:14
*** liumk_ has joined #openstack-keystone09:15
openstackgerritVishakha Agarwal proposed openstack/keystone master: Correcting tests with project_id  https://review.openstack.org/63439409:32
*** liumk_ has quit IRC09:35
*** markvoelker has joined #openstack-keystone10:02
*** markvoelker has quit IRC10:34
*** shyamb has quit IRC10:58
*** ileixe has quit IRC11:20
*** Dinesh_Bhor has quit IRC11:21
*** markvoelker has joined #openstack-keystone11:30
*** shyamb has joined #openstack-keystone11:32
*** raildo has joined #openstack-keystone11:42
*** raildo_ has joined #openstack-keystone11:58
*** raildo has quit IRC12:01
*** markvoelker has quit IRC12:04
*** rmascena__ has joined #openstack-keystone12:27
*** raildo_ has quit IRC12:30
*** erus has joined #openstack-keystone12:58
*** markvoelker has joined #openstack-keystone13:01
*** shyamb has quit IRC13:13
*** jamesmcarthur has joined #openstack-keystone13:14
*** jamesmcarthur has quit IRC13:29
*** Dinesh_Bhor has joined #openstack-keystone13:34
*** markvoelker has quit IRC13:34
*** vishakha has quit IRC13:35
*** lbragstad has joined #openstack-keystone13:41
*** ChanServ sets mode: +o lbragstad13:41
*** Dinesh_Bhor has quit IRC13:44
*** jamesmcarthur has joined #openstack-keystone13:50
*** jmlowe has quit IRC13:54
*** Dinesh_Bhor has joined #openstack-keystone14:22
*** jamesmcarthur has quit IRC14:26
lbragstadcmurphy do you see a use case for https://blueprints.launchpad.net/keystone/+spec/domain-specific-mapping ?14:31
*** markvoelker has joined #openstack-keystone14:31
lbragstadthat blueprint does seem to fall in line with the self-service aspect of the keystone vision and openstack vision14:37
lbragstadby allowing domain users access to mappings14:37
cmurphylbragstad: did that get covered by http://specs.openstack.org/openstack/keystone-specs/specs/keystone/ocata/shadow-mapping.html ? i can't quite tell at a quick skim14:38
lbragstadcmurphy i double checked14:38
lbragstadcmurphy shadow mappings need to be created by system administrators, right?14:38
cmurphylbragstad: yeah14:38
cmurphyi definitely see a use for domain specific mappings, it goes along with native saml and self service domain admins14:39
lbragstadi think what henry was trying to get at with that blueprint, is the ability for domain administrators to modify mappings for the domain+idp they are using with federation14:39
cmurphymakes sense to me, i think native saml is a prereq for that though14:40
lbragstadiiuc - the mapping logic in keystone is all api driven, do we need native saml for it?14:40
lbragstadwe need native saml for full domain admin federation support for sure14:41
lbragstadbut if i'm a domain admin and you're a system admin, you setup the shib mappings and trust my identity provider, then i get the keys and i can update mappings based on assertions issued by my idp?14:42
lbragstade.g., i don't have to ask you to setup a mapping specific to my assertions14:44
* cmurphy thinks...the mapping would take input from the saml assertion which means it's useful to have direct control over the identity provider and the service provider configuration settings, i guess not required if you're able to get that information from your admin14:44
lbragstadi should clarify - i'm thinking about the keystone mapping, not the shib mapping14:45
cmurphyyeah but it's still looking into the saml assertion to get the values in the "remote" section of the mapping14:46
lbragstadyeah - because those come from the shib mapping output14:46
lbragstadhmm14:46
cmurphyso you're right not 100% required, just more useful if paired with domain admin control of the idp14:46
lbragstadyeah - absolutely14:46
cmurphyin any case i would unmark that as invalid and we should revisit the spec14:47
lbragstadi think so, too14:47
lbragstadfor blueprints like this, I'll just mark them as "discussion"14:48
cmurphyi marked a couple others in the etherpad that i think should be revisited14:48
cmurphyi didn't make it through the whole list14:48
lbragstadwell - it's a long list14:48
cmurphyya14:48
cmurphywho knew14:48
lbragstadit hasn't been cleaned up in years...14:49
lbragstadbecause i've never done it - and i can't remember if steve ever did? i just see updates from 2016-02-02 to the whiteboard14:49
cmurphynot sure if we can block the blueprints feature in lp but maybe after this cleanup is done we should add a note to use bugs and specs instead14:50
lbragstadyeah - we need something that describes the process14:51
lbragstadi came up dry trying to find any documentation on "how to write specs"14:51
lbragstadi think the best we have is the template14:51
*** jamesmcarthur has joined #openstack-keystone14:55
openstackgerritJose Castro Leon proposed openstack/keystone master: Adds caching of credentials  https://review.openstack.org/63664514:58
*** jmlowe has joined #openstack-keystone14:59
*** markvoelker has quit IRC15:04
kmalloclbragstad: I have a fix proposed to the template to indicate use of bugs over BPs15:15
lbragstadsounds good15:15
kmallocI'd just close all blueprints after period x with prejudice.15:15
lbragstadlaunchpad does have a toggle for blueprints, so i would guess that we don't have to use them15:16
kmallochttps://review.openstack.org/#/c/625282/15:16
*** Dinesh_Bhor has quit IRC15:16
lbragstadwhat i mean by that is if we are going to move to RFE bugs, then i'd like to completely shutoff the ability for people to open blueprints at all15:17
kmallocYes15:17
lbragstadbut i do want the archive15:17
lbragstadi want the cake and i want to eat it, too!15:17
kmallocTurning off in LP I think turns off the archive15:18
*** jmlowe has quit IRC15:18
lbragstadof course it would15:18
kmallocNot delete though iirc15:18
cmurphywe can copy the ones we want to keep into bugs15:18
kmallocI think it is fine to lose the archive at this point. Copy to bug.. what cmurphy said15:18
lbragstadlike - pending blueprints cmurphy? or all blueprints?15:18
kmallocAll pending15:19
lbragstadoh - right15:19
cmurphylbragstad: whatever we dont' want to get rid of15:19
kmallocOld bps are going away with the move to sb anyway.15:19
kmallocSo *shrug*15:19
kmallocIt's really ok, BPs provide not a ton of info these days that isn't in reno15:19
lbragstadwhat i don't want to lose it stuff like this - http://specs.openstack.org/openstack/keystone-specs/specs/keystone/juno/non-persistent-tokens.html15:20
lbragstadwhich points to all the patches in https://blueprints.launchpad.net/keystone/+spec/non-persistent-tokens15:20
kmallocHonestly, we could write a bit that just closes BPs if you want.15:21
kmallocPersonally I am ok with losing that, perhaps we just do a mass update of those specs and copy the content into them.and drop the links.15:21
kmallocThey are archive only, not active.15:22
kmallocAs part of the shut down BPs bit.15:22
*** jmlowe has joined #openstack-keystone15:23
lbragstadwell - let's see if that's even necessary15:25
kmallocYou know, I think copy/paste the BP content into a <pre> block in the archived specs and drop the link is the best bet the more I think about it if we lose the archive access.15:25
lbragstadlet's go through all the existing ones, mark invalid ones as obsolete, move interesting ones to formal specs or bugs, and then at that point i'll try disabling them in launchpad for keystone15:26
lbragstadthen we can test if the links still work15:26
kmallocWfm15:26
*** shyamb has joined #openstack-keystone15:28
*** jmlowe has quit IRC15:54
*** jmlowe has joined #openstack-keystone15:58
*** markvoelker has joined #openstack-keystone16:01
*** shyam89 has joined #openstack-keystone16:14
*** shyamb has quit IRC16:16
*** shyamb has joined #openstack-keystone16:17
*** rafaelweingartne has joined #openstack-keystone16:18
rafaelweingartneHello guys, what is the status of the endpoint filtering feature in Keystone?16:18
rafaelweingartneI mean, I am having some odd issues16:18
*** ayoung has quit IRC16:19
rafaelweingartneWhen I read, endpoing groups, I was expecting to be able to create rules such as : {     "service_id": "<service1>",     "service_id": "<service2>"}16:20
rafaelweingartnehowever, that does not seem to work16:20
rafaelweingartneI tried to read some docs and blueprints, but they did not give me much on what is implemented there16:20
rafaelweingartneIs it fully implemented?16:20
rafaelweingartnefor instance, I tried: {     "interface": "public" }16:21
*** shyam89 has quit IRC16:21
rafaelweingartneand this rules works, it lists only public enpoints16:21
rafaelweingartneon the other hand, this rule : {     "service_id": "serviceID"}16:21
rafaelweingartnedoes not work16:21
rafaelweingartneit continues listing all services endpoints16:21
*** markvoelker has quit IRC16:34
*** jmlowe has quit IRC16:38
*** jmlowe has joined #openstack-keystone16:44
lbragstadrafaelweingartne i haven't looked at that feature in a while, but you might need to build an association between a group of endpoints and a project16:49
lbragstadusers with a token scoped to that project should get a filtered catalog in the response16:50
rafaelweingartnethat is what I am doing16:50
rafaelweingartnebut, it gets even more strange16:51
*** jamesmcarthur has quit IRC16:51
rafaelweingartneI have these two configurations rafael-EP-filtering-group-restrict-public.json and rafael-EP-filtering-group-restrict-internal.json16:51
rafaelweingartnethese a basic filters, the first one filters interfaces by public, and the second by internal16:51
*** shyamb has quit IRC16:51
rafaelweingartnethe content of each one of them is the following: {     "interface": "public" }  and {     "interface": "internal" }16:52
rafaelweingartneThen,16:52
rafaelweingartneI issue the commands:16:52
rafaelweingartneopenstack endpoint group create rafael-test1-ep-filter rafael-EP-filtering-group-restrict-public.json16:52
rafaelweingartneopenstack endpoint group create rafael-test3-ep-filter rafael-EP-filtering-group-restrict-internal.json16:52
rafaelweingartneafterwards, if I issue: openstack endpoint group list16:53
rafaelweingartneI can see both of them16:53
rafaelweingartnehowever, if I issue: openstack endpoint group show rafael-test1-ep-filter More than one endpointgroup exists with the name 'rafael-test1-ep-filter'.16:53
rafaelweingartneI get an error saying that there are more than one with the same name16:54
rafaelweingartneI then, proceeed and use the show command with a uuid16:54
rafaelweingartneopenstack endpoint group show 0dcfa90ff2c84510a04d1c32fdad7e0716:54
rafaelweingartneand I get this: +-------------+----------------------------------+ | Field       | Value                            | +-------------+----------------------------------+ | description | None                             | | filters     | {u'interface': u'internal'}      | | id          | 0dcfa90ff2c84510a04d1c32fdad7e07 | | name        | rafael-test3-ep-filter           | +-------------+----------------------------16:54
*** gyee has joined #openstack-keystone16:55
lbragstadfor pastes - you can use paste.openstack.org if that helps16:55
*** jamesmcarthur has joined #openstack-keystone17:00
*** rmascena__ has quit IRC17:04
*** rmascena__ has joined #openstack-keystone17:05
*** itlinux has joined #openstack-keystone17:05
lbragstadhttps://blueprints.launchpad.net/keystone/+spec/keystone-lib is an interesting idea17:07
*** itlinux has quit IRC17:09
*** itlinux_ has joined #openstack-keystone17:09
*** itlinux_ has quit IRC17:14
*** itlinux has joined #openstack-keystone17:15
*** jamesmcarthur has quit IRC17:22
*** jmlowe has quit IRC17:23
lbragstadhttps://blueprints.launchpad.net/keystone should be relatively clean now17:27
lbragstadthese are the changes we made17:27
lbragstadhttps://etherpad.openstack.org/p/keystone-blueprint-cleanup17:27
lbragstadi think our next steps are to figure out the migration away from blueprints so i can disable them in launchpad17:28
lbragstadand formally documenting out RFE bug process in the template ( kmalloc has a patch up already) and in the contributor guide (still needs to be done)17:28
lbragstads/out/our/17:28
lbragstadthen - we need to migrate applicable blueprints to RFE bugs and copy the context17:29
lbragstadunless anyone has objections, we'll plan on stein being the last release we use blueprints for17:29
*** itlinux has quit IRC17:30
*** markvoelker has joined #openstack-keystone17:32
lbragstaddocumented the next steps on line 79 here - https://etherpad.openstack.org/p/keystone-blueprint-cleanup17:33
*** jamesmcarthur has joined #openstack-keystone17:34
*** itlinux has joined #openstack-keystone17:36
*** itlinux_ has joined #openstack-keystone17:39
*** itlinux has quit IRC17:41
*** erus has quit IRC17:42
*** erus has joined #openstack-keystone17:42
*** erus has quit IRC17:49
*** awalende has joined #openstack-keystone17:58
*** erus has joined #openstack-keystone17:59
*** markvoelker has quit IRC18:04
*** jmlowe has joined #openstack-keystone18:08
*** itlinux_ has quit IRC18:08
*** awalende has quit IRC18:19
*** awalende has joined #openstack-keystone18:21
*** erus has quit IRC18:25
*** erus has joined #openstack-keystone18:27
*** awalende has quit IRC18:35
*** awalende has joined #openstack-keystone18:38
*** erus has quit IRC18:43
*** erus has joined #openstack-keystone18:45
*** markvoelker has joined #openstack-keystone19:01
*** raildo has joined #openstack-keystone19:12
*** rmascena__ has quit IRC19:13
*** rafaelweingartne has quit IRC19:19
*** markvoelker has quit IRC19:34
openstackgerritMerged openstack/keystone master: Fix wrong example for direct_maps  https://review.openstack.org/63544419:37
openstackgerritMerged openstack/keystone master: Seperated CADF notifications tests for request_id  https://review.openstack.org/63510119:37
*** awalende has quit IRC19:39
*** irclogbot_1 has quit IRC19:47
*** jamesmcarthur has quit IRC19:55
*** irclogbot_1 has joined #openstack-keystone20:00
*** jamesmcarthur has joined #openstack-keystone20:07
*** jamesmcarthur has quit IRC20:12
*** jamesmcarthur has joined #openstack-keystone20:16
*** jmlowe has quit IRC20:28
*** markvoelker has joined #openstack-keystone20:31
*** jamesmcarthur has quit IRC20:35
*** itlinux has joined #openstack-keystone21:04
*** markvoelker has quit IRC21:05
*** raildo has quit IRC21:06
*** xek has quit IRC21:07
*** jmlowe has joined #openstack-keystone21:15
gagehugoour unit tests sure do create a lot of deprecated policy spam :(21:21
lbragstadyep - sorry about that21:23
*** erus has quit IRC21:25
*** jamesmcarthur has joined #openstack-keystone21:25
*** erus has joined #openstack-keystone21:25
*** jamesmcarthur has quit IRC21:30
*** whoami-rajat has quit IRC21:32
lbragstadwxy-xiyuan http://lists.openstack.org/pipermail/openstack-discuss/2019-February/002674.html21:35
*** itlinux has quit IRC21:58
*** markvoelker has joined #openstack-keystone22:02
*** erus has quit IRC22:20
*** erus has joined #openstack-keystone22:20
*** openstackgerrit has quit IRC22:22
*** erus has quit IRC22:26
*** eandersson has quit IRC22:33
*** erus has joined #openstack-keystone22:33
*** markvoelker has quit IRC22:34
*** cburgess has quit IRC22:36
*** cburgess has joined #openstack-keystone22:38
*** erus has quit IRC22:40
*** jamesmcarthur has joined #openstack-keystone22:43
*** jamesmcarthur has quit IRC22:48
*** erus has joined #openstack-keystone22:50
*** erus has quit IRC22:50
*** jamesmcarthur has joined #openstack-keystone22:51
*** eandersson has joined #openstack-keystone22:59
*** david-lyle has quit IRC23:02
*** dklyle has joined #openstack-keystone23:02
*** tkajinam has joined #openstack-keystone23:05
*** jamesmcarthur has quit IRC23:07
*** jamesmcarthur has joined #openstack-keystone23:27
*** markvoelker has joined #openstack-keystone23:31
*** jamesmcarthur has quit IRC23:33
*** jamesmcarthur has joined #openstack-keystone23:49
*** lbragstad has quit IRC23:52
*** jamesmcarthur has quit IRC23:53
*** jamesmcarthur has joined #openstack-keystone23:56

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!