| *** gyee has quit IRC | 00:08 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:15 | |
| *** aning_ has joined #openstack-keystone | 00:30 | |
| *** jamesmcarthur has quit IRC | 00:31 | |
| *** jamesmcarthur has joined #openstack-keystone | 00:31 | |
| *** aning has quit IRC | 00:32 | |
| *** jamesmcarthur has quit IRC | 00:35 | |
| *** nicolasbock has quit IRC | 00:39 | |
| *** aning has joined #openstack-keystone | 00:45 | |
| *** aning_ has quit IRC | 00:47 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Replace support matrix ext with common library https://review.openstack.org/527808 | 01:09 |
|---|---|---|
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Uncap jsonschema https://review.openstack.org/653180 | 01:09 |
| *** threestrands has joined #openstack-keystone | 01:24 | |
| *** whoami-rajat has joined #openstack-keystone | 01:31 | |
| *** ileixe has quit IRC | 01:55 | |
| *** ileixe has joined #openstack-keystone | 01:58 | |
| *** itlinux has joined #openstack-keystone | 02:09 | |
| *** lbragstad has quit IRC | 02:30 | |
| *** itlinux has quit IRC | 02:52 | |
| *** itlinux has joined #openstack-keystone | 02:54 | |
| *** erus has quit IRC | 02:54 | |
| *** erus has joined #openstack-keystone | 02:55 | |
| *** ileixe has quit IRC | 03:25 | |
| *** ileixe has joined #openstack-keystone | 03:31 | |
| eandersson | https://review.openstack.org/#/c/653233/2/ironicclient/common/http.py | 03:33 |
| eandersson | Can someone confirm that this is correct? | 03:33 |
| cmurphy | eandersson: hmm i don't think so, endpoint_override is its own parameter of the Session request() https://docs.openstack.org/keystoneauth/latest/api/keystoneauth1.html#module-keystoneauth1.session | 03:40 |
| eandersson | cmurphy, the odd thing is that the override works with that patch | 03:42 |
| cmurphy | hmm | 03:43 |
| eandersson | e.g. | 03:43 |
| eandersson | > base_url = self.get_endpoint(auth, allow=allow, **endpoint_filter) | 03:43 |
| *** itlinux has quit IRC | 03:43 | |
| eandersson | > if 'endpoint_override' in kwargs: return kwargs['endpoint_override'] | 03:43 |
| eandersson | You see ^ | 03:44 |
| eandersson | https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/session.py#L1134 | 03:44 |
| eandersson | https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/session.py#L726 | 03:44 |
| eandersson | While you are right, I don't understand why it does not work in this case. | 03:45 |
| eandersson | > base_url = endpoint_override % _StringFormatter(self, auth) | 03:46 |
| eandersson | https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/session.py#L722 | 03:46 |
| eandersson | Not sure if I understand that logic at all | 03:46 |
| eandersson | because both should work | 03:50 |
| cmurphy | hmm it might be something wonky with how the adapter is instantiated | 03:59 |
| eandersson | Yea - something is off | 04:03 |
| cmurphy | because i think it's here https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/adapter.py#L191-L192 where endpoint_override should be working | 04:05 |
| *** imacdonn has quit IRC | 04:07 | |
| *** erus has quit IRC | 04:07 | |
| *** imacdonn has joined #openstack-keystone | 04:07 | |
| *** erus has joined #openstack-keystone | 04:08 | |
| *** david-lyle has joined #openstack-keystone | 04:13 | |
| *** dklyle has quit IRC | 04:16 | |
| eandersson | cmurphy, you are right https://github.com/openstack/python-ironicclient/commit/8071d5de57c728ce09d25d04c8c9fe48cd7db42e | 04:16 |
| cmurphy | eandersson: oh so you were testing this with not-master? | 04:21 |
| eandersson | Yea - I honestly didn't realize. | 04:21 |
| cmurphy | cool, the best bugs are the ones that are already fixed | 04:22 |
| eandersson | The Ironic team is gonna take a look to make sure that path is solid, but at the very least I have a path forward. | 04:22 |
| *** ileixe has quit IRC | 04:31 | |
| *** sapd1 has quit IRC | 04:50 | |
| *** ileixe has joined #openstack-keystone | 05:02 | |
| *** vishakha has joined #openstack-keystone | 05:09 | |
| *** ileixe has quit IRC | 05:55 | |
| *** ileixe has joined #openstack-keystone | 05:58 | |
| *** erus has quit IRC | 05:58 | |
| *** erus has joined #openstack-keystone | 05:59 | |
| *** pcaruana has joined #openstack-keystone | 06:11 | |
| *** erus has quit IRC | 06:11 | |
| *** erus has joined #openstack-keystone | 06:11 | |
| *** starborn has joined #openstack-keystone | 06:47 | |
| *** erus has quit IRC | 06:47 | |
| *** erus has joined #openstack-keystone | 06:48 | |
| *** ileixe has quit IRC | 06:57 | |
| *** ileixe has joined #openstack-keystone | 07:02 | |
| *** shyamb has joined #openstack-keystone | 07:37 | |
| openstackgerrit | zhufl proposed openstack/keystone master: Pass kwargs to exception to get better format of error message https://review.openstack.org/653342 | 07:44 |
| *** awalende has joined #openstack-keystone | 07:52 | |
| awalende | Hi there, we upgraded our openstack from queens to rocky and have problems with openid, which worked flawless with the old deprecated auth plugin from stevedore. After using the new method "openid", we get an unauthorized error in horizon. The Keystone log shows the following error: | 07:57 |
| awalende | ERROR keystone.federation.controllers [req-6502caa6-769a-468c-b070-c030ac098124 - - - - -] Missing entity ID from environment | 07:58 |
| awalende | What is meant with the entity ID? | 07:58 |
| *** Emine has joined #openstack-keystone | 07:59 | |
| *** rcernin has quit IRC | 08:13 | |
| *** tkajinam has quit IRC | 08:17 | |
| *** rcernin has joined #openstack-keystone | 08:27 | |
| *** shyamb has quit IRC | 08:30 | |
| *** shyamb has joined #openstack-keystone | 08:31 | |
| *** vishakha has quit IRC | 08:33 | |
| *** threestrands has quit IRC | 09:36 | |
| *** erus has quit IRC | 09:36 | |
| *** erus has joined #openstack-keystone | 09:36 | |
| *** shyamb has quit IRC | 09:46 | |
| *** awalende has quit IRC | 10:32 | |
| *** awalende has joined #openstack-keystone | 10:32 | |
| *** awalende has quit IRC | 10:36 | |
| *** nicolasbock has joined #openstack-keystone | 10:38 | |
| *** awalende has joined #openstack-keystone | 10:42 | |
| *** erus has quit IRC | 10:42 | |
| *** erus has joined #openstack-keystone | 10:43 | |
| *** awalende has quit IRC | 10:56 | |
| *** awalende has joined #openstack-keystone | 10:57 | |
| *** raildo has joined #openstack-keystone | 11:48 | |
| *** shyamb has joined #openstack-keystone | 11:48 | |
| frickler | cmurphy: kmalloc: for some reason I'd need a requirements bump in order for my patch to remove the identity admin endpoint from keystonemiddleware. could you review the patch please before I proceed and submit a matching reqs change? https://review.openstack.org/651790 | 11:49 |
| frickler | "... in order for my patch to pass the lower-constraints job ..." | 11:51 |
| *** awalende has quit IRC | 11:52 | |
| *** awalende has joined #openstack-keystone | 11:53 | |
| *** awalende has quit IRC | 11:53 | |
| *** awalende has joined #openstack-keystone | 11:54 | |
| *** awalende has quit IRC | 11:54 | |
| *** awalende has joined #openstack-keystone | 11:54 | |
| *** awalende has quit IRC | 11:55 | |
| *** awalende has joined #openstack-keystone | 11:56 | |
| *** awalende has quit IRC | 11:56 | |
| *** awalende has joined #openstack-keystone | 11:57 | |
| *** awalende has quit IRC | 11:58 | |
| *** awalende has joined #openstack-keystone | 12:08 | |
| *** pcaruana has quit IRC | 12:30 | |
| *** erus has quit IRC | 12:30 | |
| *** erus has joined #openstack-keystone | 12:30 | |
| *** shyamb has quit IRC | 12:37 | |
| *** pcaruana has joined #openstack-keystone | 12:53 | |
| *** lbragstad has joined #openstack-keystone | 12:56 | |
| *** ChanServ sets mode: +o lbragstad | 12:56 | |
| *** erus has quit IRC | 12:56 | |
| *** erus has joined #openstack-keystone | 12:57 | |
| *** vishakha has joined #openstack-keystone | 12:57 | |
| *** shyamb has joined #openstack-keystone | 12:58 | |
| *** mchlumsky has joined #openstack-keystone | 13:26 | |
| *** erus has quit IRC | 13:26 | |
| *** erus has joined #openstack-keystone | 13:26 | |
| cmurphy | frickler: will look today, why does it need a requirements bump though? | 13:33 |
| cmurphy | awalende: the entity ID is the identifier for the IdP that gets passed in the apache service provider headers, keystone uses a key defined by remote_id_attribute in keystone.conf to look up the entity ID | 13:35 |
| cmurphy | awalende: if remote_id_attribute isn't defined or is defined in the wrong place then keystone can't find the entity ID | 13:36 |
| awalende | ye, we managed to fix that a few hours ago. We now get a different error but I think it has something to do with our recycled mapping... | 13:37 |
| awalende | WARNING keystone.federation.utils [req-07437bb9-b8af-42b6-96da-0307e69adb75 - - - - -] Could not map any federated user properties to identity values. Check debug logs or the mapping used for additional details.: Unauthorized: The request you have made requires authentication. | 13:37 |
| awalende | When I enable debug, I see that identity values are empty: | 13:37 |
| awalende | identity_values: [] process /usr/lib/python2.7/dist-packages/keystone/federation/utils.py:541 | 13:38 |
| awalende | however it seems to pick up my rules: rules: [{u'remote': [{u'type': u'HTTP_OIDC_SUB'}], u'local': [{u'user': {u'domain': {u'name': u'elixir'}, u'type': u'local', u'name': u'{0}'}}]}] process /usr/lib/python2.7/dist-packages/keystone/federation/utils.py:521 | 13:38 |
| cmurphy | awalende: looks okay to me, but you're using type:local, does a user with a username matching the HTTP_OIDC_SUB value already exist in the keystone db? | 13:42 |
| awalende | yes, we have a designated service for this which syncs the user list | 13:43 |
| cmurphy | hmm not sure then | 13:44 |
| cmurphy | is HTTP_OIDC_SUB appearing in the assertion in the debug logs? | 13:46 |
| awalende | let me check... | 13:47 |
| awalende | assertion data: {'HTTP_OIDC_ISS': u'https://login.elixir-czech.org/oidc/'} process /usr/lib/python2.7/dist-packages/keystone/federation/utils.py:515 | 13:49 |
| awalende | assertion: {'HTTP_OIDC_ISS': [u'https://login.elixir-czech.org/oidc/']} process /usr/lib/python2.7/dist-packages/keystone/federation/utils.py:518 | 13:49 |
| awalende | aha! | 13:49 |
| awalende | weird that it only shows HTTP_OIDC_ISS in the data....when I intercept the oidc token... I find much more fields, like my wanted HTTP_OIDC_SUB | 13:52 |
| frickler | cmurphy: something in keystoneauth1 changed, see the errors on the previous PS. I tested locally to identify 3.6.0 as the first working version, current lower bound is 3.4.0. http://logs.openstack.org/90/651790/6/check/openstack-tox-lower-constraints/6e8204d/testr_results.html.gz | 13:54 |
| frickler | cmurphy: if you can see a solution that fixes the tests without needing the bump, I'd be fine with that, too ;) | 13:57 |
| *** awalende has quit IRC | 14:06 | |
| *** awalende has joined #openstack-keystone | 14:06 | |
| cmurphy | frickler: eh probably worthwhile to bump it, we won't backport this anyway | 14:06 |
| *** awalende_ has joined #openstack-keystone | 14:11 | |
| *** awalende has quit IRC | 14:11 | |
| *** awalende_ has quit IRC | 14:16 | |
| *** itlinux has joined #openstack-keystone | 14:19 | |
| *** itlinux has quit IRC | 14:22 | |
| *** markvoelker has joined #openstack-keystone | 14:35 | |
| *** david-lyle is now known as dklyle | 14:35 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Move list projects from ids to manager and cache https://review.openstack.org/478293 | 14:41 |
| gagehugo | o/ | 14:47 |
| cmurphy | o/ | 14:47 |
| lbragstad | \o | 14:49 |
| *** dustinc has quit IRC | 14:56 | |
| *** dustinc has joined #openstack-keystone | 14:56 | |
| *** dustinc is now known as dustinc_away | 14:56 | |
| kmalloc | \o/ | 15:34 |
| kmalloc | /o\ | 15:34 |
| *** itlinux has joined #openstack-keystone | 15:35 | |
| *** adriant has quit IRC | 15:51 | |
| *** adriant has joined #openstack-keystone | 15:53 | |
| *** erus has quit IRC | 15:53 | |
| *** erus has joined #openstack-keystone | 15:53 | |
| *** gyee has joined #openstack-keystone | 15:58 | |
| *** shyamb has quit IRC | 16:06 | |
| *** dims has quit IRC | 16:07 | |
| knikolla | o/ | 16:23 |
| *** david-lyle has joined #openstack-keystone | 16:24 | |
| *** erus has quit IRC | 16:24 | |
| *** erus has joined #openstack-keystone | 16:25 | |
| *** ileixe has quit IRC | 16:25 | |
| *** dklyle has quit IRC | 16:27 | |
| *** idlemind has joined #openstack-keystone | 16:51 | |
| *** dims has joined #openstack-keystone | 16:54 | |
| *** dims has quit IRC | 16:59 | |
| *** dims has joined #openstack-keystone | 17:01 | |
| *** erus has quit IRC | 17:01 | |
| *** erus has joined #openstack-keystone | 17:02 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone-specs master: Repropose federated attributes in the user API for Train https://review.openstack.org/653492 | 17:05 |
| knikolla | ayoung: ^^ this should fit right in with your predictable ids direction | 17:05 |
| *** markvoelker has quit IRC | 17:31 | |
| *** markvoelker has joined #openstack-keystone | 17:31 | |
| *** markvoelker has quit IRC | 17:35 | |
| *** david-lyle is now known as dklyle | 17:55 | |
| *** vishakha has quit IRC | 18:56 | |
| *** raildo has quit IRC | 19:05 | |
| *** raildo has joined #openstack-keystone | 19:20 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystonemiddleware master: Bump memcached minimum version https://review.openstack.org/653542 | 19:46 |
| *** starborn has quit IRC | 19:51 | |
| cmurphy | cycle schedule proposal https://review.openstack.org/653544 | 19:54 |
| *** raildo has quit IRC | 20:02 | |
| gagehugo | lgtm | 20:08 |
| kmalloc | wfm | 20:36 |
| *** raildo has joined #openstack-keystone | 20:40 | |
| *** erus has quit IRC | 20:40 | |
| *** erus has joined #openstack-keystone | 20:41 | |
| *** pcaruana has quit IRC | 20:43 | |
| *** whoami-rajat has quit IRC | 21:01 | |
| *** mchlumsky has quit IRC | 21:29 | |
| *** logan- has quit IRC | 21:34 | |
| *** logan- has joined #openstack-keystone | 21:37 | |
| *** Emine has quit IRC | 21:51 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystonemiddleware master: Bump memcached minimum version https://review.openstack.org/653542 | 21:57 |
| openstackgerrit | Merged openstack/keystone master: Fix unscoped federated token formatter https://review.openstack.org/652520 | 22:19 |
| openstackgerrit | Merged openstack/keystone master: Uncap jsonschema https://review.openstack.org/653180 | 22:19 |
| *** erus has quit IRC | 22:30 | |
| *** lbragstad has quit IRC | 22:33 | |
| *** lbragstad has joined #openstack-keystone | 22:35 | |
| *** ChanServ sets mode: +o lbragstad | 22:35 | |
| *** erus has joined #openstack-keystone | 22:46 | |
| *** tkajinam has joined #openstack-keystone | 22:54 | |
| *** zigo has quit IRC | 22:58 | |
| *** efried has joined #openstack-keystone | 23:03 | |
| efried | Hey 'stoners, can I propose a ksa release to pick up https://review.openstack.org/#/c/644251/ please? | 23:04 |
| efried | cmurphy, lbragstad: ^ | 23:04 |
| cmurphy | efried: sure, if you propose I'll +1 | 23:06 |
| efried | cmurphy: Thanks :) | 23:06 |
| *** raildo has quit IRC | 23:07 | |
| *** jamesmcarthur has joined #openstack-keystone | 23:07 | |
| efried | cmurphy: https://review.openstack.org/653626 | 23:12 |
| *** jamesmcarthur has quit IRC | 23:23 | |
| *** itlinux has quit IRC | 23:26 | |
| *** itlinux has joined #openstack-keystone | 23:44 | |
| *** itlinux has quit IRC | 23:44 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!