| *** joshualyle has quit IRC | 00:00 | |
| *** joshualyle has joined #openstack-keystone | 00:01 | |
| *** joshualyle has quit IRC | 00:06 | |
| *** joshualyle has joined #openstack-keystone | 00:18 | |
| *** joshualyle has quit IRC | 00:20 | |
| *** joshualyle has joined #openstack-keystone | 00:20 | |
| *** ivve has quit IRC | 00:21 | |
| *** markvoelker has joined #openstack-keystone | 00:23 | |
| openstackgerrit | Merged openstack/keystone master: Allows to use application credentials through group membership https://review.opendev.org/655166 | 00:32 |
|---|---|---|
| *** jamesmcarthur_ has quit IRC | 00:47 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:01 | |
| *** jamesmcarthur has quit IRC | 01:04 | |
| *** pcaruana has quit IRC | 01:26 | |
| *** gyee has quit IRC | 01:33 | |
| *** markvoelker has quit IRC | 01:39 | |
| adriant | kmalloc: ok... I think a see a way to do both methods=[] upfront for a new multimethod auth constructor, and way to augment exisitng auth objects with additional methods | 01:39 |
| adriant | will start hacking some code and testing against my devstack | 01:39 |
| adriant | but I think we have some viable patterns | 01:40 |
| *** markvoelker has joined #openstack-keystone | 01:40 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:56 | |
| *** jamesmcarthur has quit IRC | 01:58 | |
| *** jamesmcarthur has joined #openstack-keystone | 01:59 | |
| *** jamesmcarthur has quit IRC | 02:22 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:22 | |
| *** jamesmcarthur has quit IRC | 02:25 | |
| *** jamesmcarthur has joined #openstack-keystone | 02:26 | |
| *** jamesmcarthur has quit IRC | 02:56 | |
| *** jamesmcarthur has joined #openstack-keystone | 03:12 | |
| *** markvoelker has quit IRC | 03:14 | |
| *** whoami-rajat has joined #openstack-keystone | 03:19 | |
| *** markvoelker has joined #openstack-keystone | 03:38 | |
| *** markvoelker has quit IRC | 03:43 | |
| *** pcaruana has joined #openstack-keystone | 03:44 | |
| *** jamesmcarthur has quit IRC | 04:00 | |
| *** joshualyle has quit IRC | 04:18 | |
| *** jaosorior has quit IRC | 04:22 | |
| *** markvoelker has joined #openstack-keystone | 04:24 | |
| *** jamesmcarthur has joined #openstack-keystone | 04:30 | |
| *** markvoelker has quit IRC | 04:38 | |
| adriant | hmmm, making keystoneauth raise a specific error for auth receipts isn't particularly pretty because I have to hack all the nice duplication reducing code for handling HTTP responses to specifically check for a 401, and if that 401 has a receipt header set. | 04:40 |
| adriant | and the exceptions/http.py module is where that is, but that module doesn't feel like the right place for the auth receipt error.... because we have exceptions/auth.py | 04:41 |
| * adriant is just going to hack this in for now and make pretty later | 04:41 | |
| adriant | I may need to move where the 'from_response' function is defined to make this less ugly in future and better split up | 04:43 |
| *** jamesmcarthur has quit IRC | 04:55 | |
| *** shyamb has joined #openstack-keystone | 04:55 | |
| *** jamesmcarthur has joined #openstack-keystone | 05:01 | |
| *** jamesmcarthur has quit IRC | 05:35 | |
| *** shyamb has quit IRC | 05:44 | |
| *** shyamb has joined #openstack-keystone | 05:53 | |
| *** jamesmcarthur has joined #openstack-keystone | 06:03 | |
| *** shyamb has quit IRC | 06:05 | |
| *** shyam89 has joined #openstack-keystone | 06:05 | |
| *** markvoelker has joined #openstack-keystone | 06:18 | |
| *** markvoelker has quit IRC | 06:22 | |
| *** jaosorior has joined #openstack-keystone | 06:28 | |
| *** jamesmcarthur has quit IRC | 06:37 | |
| *** dancn has joined #openstack-keystone | 06:52 | |
| *** rcernin has quit IRC | 07:03 | |
| *** shyam89 has quit IRC | 07:14 | |
| *** tesseract has joined #openstack-keystone | 07:26 | |
| *** shyam89 has joined #openstack-keystone | 07:33 | |
| *** ivve has joined #openstack-keystone | 07:34 | |
| *** xek has joined #openstack-keystone | 07:34 | |
| *** jamesmcarthur has joined #openstack-keystone | 07:35 | |
| *** jistr is now known as jistr|afk | 07:42 | |
| *** spsurya has joined #openstack-keystone | 07:50 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystoneauth master: add support for auth_receipts and multi-method auth https://review.opendev.org/675049 | 07:52 |
| adriant | mordred, kmalloc, cmurphy: ^ rough hack that seems to work | 07:53 |
| *** shyam89 has quit IRC | 07:54 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystoneauth master: add support for auth_receipts and multi-method auth https://review.opendev.org/675049 | 07:59 |
| adriant | and used this to test against a devstack setup that has a keystone with totp enabled, and a user that has password and totp setup (with a totp credential): | 08:00 |
| adriant | http://paste.openstack.org/show/755602/ | 08:00 |
| adriant | kmalloc: I give you both patterns :P | 08:00 |
| adriant | we can supply all methods up front, or add them as a chain | 08:01 |
| adriant | seeing how simple this code actually turned out, I may have time to work on the SDK and horizon this cycle... | 08:02 |
| adriant | and mordred: if you can help me with the SDK or even do it yourself and get me to review, we can probably churn this out fast | 08:02 |
| adriant | kmalloc, mordred: I will add unit tests tomorrow, and start digging through the loader logic, but any feedback right now would be good to ensure I am going in the right direction | 08:05 |
| adriant | also, where/how I should better handle the catching of the receipt error. | 08:05 |
| *** jamesmcarthur has quit IRC | 08:08 | |
| *** mauro|call has quit IRC | 08:13 | |
| *** mauro|call has joined #openstack-keystone | 08:14 | |
| *** shyam89 has joined #openstack-keystone | 08:22 | |
| *** shyamb has joined #openstack-keystone | 08:32 | |
| *** shyam89 has quit IRC | 08:34 | |
| *** jamesmcarthur has joined #openstack-keystone | 08:42 | |
| *** markvoelker has joined #openstack-keystone | 08:50 | |
| *** markvoelker has quit IRC | 08:55 | |
| *** mauro|call has quit IRC | 08:58 | |
| *** mauro|call has joined #openstack-keystone | 09:00 | |
| *** tkajinam has quit IRC | 09:02 | |
| *** shyamb has quit IRC | 09:10 | |
| *** mauro|call is now known as takamatsu | 09:14 | |
| *** shyamb has joined #openstack-keystone | 09:24 | |
| *** joshualyle has joined #openstack-keystone | 09:39 | |
| *** joshualyle has quit IRC | 09:41 | |
| *** dancn has quit IRC | 09:49 | |
| *** joshualyle has joined #openstack-keystone | 09:49 | |
| *** jistr|afk is now known as jistr | 09:54 | |
| *** dancn has joined #openstack-keystone | 09:55 | |
| *** shyamb has quit IRC | 09:57 | |
| *** jamesmcarthur has quit IRC | 09:57 | |
| *** mvkr has joined #openstack-keystone | 10:36 | |
| *** shyamb has joined #openstack-keystone | 10:50 | |
| adriant | I realise I actually have no idea how to test this, and the Keystoneauth tests are... weird. | 11:17 |
| *** kplant has joined #openstack-keystone | 11:19 | |
| *** raildo has joined #openstack-keystone | 11:38 | |
| *** jamesmcarthur has joined #openstack-keystone | 11:38 | |
| *** shyamb has quit IRC | 11:40 | |
| *** shyamb has joined #openstack-keystone | 11:41 | |
| *** markvoelker has joined #openstack-keystone | 11:49 | |
| *** shyam89 has joined #openstack-keystone | 11:56 | |
| *** shyamb has quit IRC | 12:01 | |
| *** markvoelker has quit IRC | 12:11 | |
| *** wxy-xiyuan has quit IRC | 12:15 | |
| *** jamesmcarthur has quit IRC | 12:16 | |
| *** markvoelker has joined #openstack-keystone | 12:16 | |
| *** jistr is now known as jistr|call | 12:37 | |
| *** shyam89 has quit IRC | 12:39 | |
| *** jamesmcarthur has joined #openstack-keystone | 12:49 | |
| *** shyamb has joined #openstack-keystone | 12:55 | |
| *** jamesmcarthur has quit IRC | 13:13 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:14 | |
| *** shyamb has quit IRC | 13:23 | |
| mordred | adriant: they take some getting used to | 13:42 |
| *** jamesmcarthur has quit IRC | 13:44 | |
| *** jaosorior has quit IRC | 13:44 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:46 | |
| *** jamesmcarthur has quit IRC | 13:51 | |
| *** jamesmcarthur has joined #openstack-keystone | 13:53 | |
| *** tesseract has quit IRC | 13:56 | |
| *** tesseract has joined #openstack-keystone | 13:57 | |
| *** whoami-rajat has quit IRC | 13:57 | |
| *** tesseract has quit IRC | 14:00 | |
| *** tesseract has joined #openstack-keystone | 14:01 | |
| *** mvkr has quit IRC | 14:12 | |
| *** joshualyle has joined #openstack-keystone | 14:15 | |
| *** joshualyle has quit IRC | 14:19 | |
| *** jdwidari has joined #openstack-keystone | 14:28 | |
| *** joshualyle has joined #openstack-keystone | 14:30 | |
| *** joshualyle has quit IRC | 14:34 | |
| *** jistr|call is now known as jistr | 14:36 | |
| *** altlogbot_0 has quit IRC | 14:46 | |
| *** altlogbot_1 has joined #openstack-keystone | 14:47 | |
| *** jamesmcarthur has quit IRC | 14:51 | |
| * cmurphy hasn't gotten used to them yet | 14:54 | |
| *** jaosorior has joined #openstack-keystone | 15:14 | |
| *** jamesmcarthur has joined #openstack-keystone | 15:18 | |
| *** jamesmcarthur has quit IRC | 15:52 | |
| *** whoami-rajat has joined #openstack-keystone | 15:55 | |
| *** tesseract has quit IRC | 15:58 | |
| *** tesseract has joined #openstack-keystone | 16:02 | |
| *** gyee has joined #openstack-keystone | 16:05 | |
| kmalloc | adriant: what mordred said | 16:09 |
| *** Ben78 has joined #openstack-keystone | 16:11 | |
| ildikov | cmurphy: hi | 16:14 |
| ildikov | cmurphy: wanted to point you to the edge hacking days we're trying to organize: https://etherpad.openstack.org/p/osf-edge-hacking-days | 16:15 |
| ildikov | cmurphy: if you're available on either days we could follow up on some Keystone items like testing or bug fixing | 16:15 |
| ildikov | or if anyone else from the Keystone team is available this Friday or next to pop by on Zoom to talk about edge and Keystone please join :) | 16:16 |
| ildikov | plz sign up on the etherpad with time slots of availability so we can keep things in sync | 16:16 |
| mordred | kmalloc, cmurphy, adriant: that said - I'm about to do some refactoring of the base fixtures in openstacksdk to use the published catalog/discovery fixtures from ksa - to then make a published/exportable fixture in sdk that people can use in downstream projects | 16:17 |
| *** jamesmcarthur has joined #openstack-keystone | 16:22 | |
| *** ivve has quit IRC | 16:23 | |
| cmurphy | ildikov: i can try to be around (west coast time) but i'm worried there's kind of a lack of a framework for the keystone work, some of those items are already done, some are imo irrelevant to edge and some are too hard for a new contributor to jump into or already committed to by someone on the team | 16:27 |
| cmurphy | knikolla: re ^ is https://review.opendev.org/580041 something someone else could take over? | 16:28 |
| cmurphy | mordred: does that mean the ksa tests are going to be pretty? | 16:28 |
| ildikov | cmurphy: is there anything to do on the testing side? | 16:28 |
| *** markvoelker has quit IRC | 16:28 | |
| ildikov | cmurphy: like negative tests, etc | 16:28 |
| cmurphy | ildikov: the patch i linked for knikolla is the last work i know about for testing | 16:29 |
| cmurphy | knikolla: ildikov maybe it would be good to have a chat about where we'd like to go with testing and what new contributors can do to help further that | 16:30 |
| cmurphy | cc kmalloc ^ | 16:30 |
| *** dancn has quit IRC | 16:31 | |
| ildikov | cmurphy: knikolla: kmalloc: +1, would love to hear from you what would make sense | 16:32 |
| kmalloc | Almost done at the doctor will be home soon. Can catch up then (early ultrasound today for Brie) | 16:36 |
| *** markvoelker has joined #openstack-keystone | 16:38 | |
| *** tesseract has quit IRC | 16:39 | |
| *** markvoelker has quit IRC | 16:42 | |
| mordred | cmurphy: no! | 16:43 |
| *** markvoelker has joined #openstack-keystone | 16:44 | |
| *** jamesmcarthur has quit IRC | 17:12 | |
| *** altlogbot_1 has quit IRC | 17:17 | |
| *** altlogbot_0 has joined #openstack-keystone | 17:23 | |
| *** jamesmcarthur has joined #openstack-keystone | 17:28 | |
| *** altlogbot_0 has quit IRC | 17:31 | |
| *** jamesmcarthur has quit IRC | 17:32 | |
| *** jamesmcarthur has joined #openstack-keystone | 17:34 | |
| *** altlogbot_3 has joined #openstack-keystone | 17:35 | |
| *** jamesmcarthur has quit IRC | 17:39 | |
| *** jamesmcarthur has joined #openstack-keystone | 17:49 | |
| *** jamesmcarthur has quit IRC | 18:00 | |
| *** jamesmcarthur has joined #openstack-keystone | 18:01 | |
| *** spsurya has quit IRC | 18:22 | |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Add remove_service to token fixtures https://review.opendev.org/675174 | 18:34 |
| mordred | kmalloc: ^^ that seem like an ok addition to you? | 18:34 |
| kmalloc | Will check in a moment | 18:37 |
| kmalloc | But probably is just fine | 18:37 |
| kmalloc | mordred: ^^ | 18:37 |
| mordred | kmalloc: coolio | 18:38 |
| mordred | I even added testing :) | 18:38 |
| *** mvkr has joined #openstack-keystone | 18:47 | |
| kmalloc | mordred: +2 | 18:54 |
| mordred | kmalloc: woot | 18:54 |
| kmalloc | cmurphy: ping re the ieee meeting now (the join.me) | 19:00 |
| mordred | kmalloc: you're an ieee meeting | 19:01 |
| kmalloc | mordred: yes, yes i am | 19:02 |
| *** jamesmcarthur has quit IRC | 19:03 | |
| *** jamesmcarthur has joined #openstack-keystone | 19:16 | |
| *** dave-mccowan has joined #openstack-keystone | 19:33 | |
| *** jamesmcarthur has quit IRC | 19:35 | |
| *** jamesmcarthur has joined #openstack-keystone | 19:36 | |
| *** vesper11 has quit IRC | 19:37 | |
| cmurphy | kmalloc: https://www.nist.gov/sites/default/files/documents/2019/07/09/nist_cfra_20190709_draft_v1.0.pdf | 19:38 |
| kmalloc | cmurphy: got it, thanks! | 19:39 |
| kmalloc | :) | 19:39 |
| kmalloc | and now, i need to go get... maybe more coffee my day started at 7am with a rush out the door to the doctor | 19:40 |
| kmalloc | so... a little food/coffee light for the day so far | 19:40 |
| *** kplant has quit IRC | 19:43 | |
| *** markvoelker has quit IRC | 20:01 | |
| *** markvoelker has joined #openstack-keystone | 20:03 | |
| kmalloc | mordred: ++ | 20:08 |
| *** ivve has joined #openstack-keystone | 20:15 | |
| *** whoami-rajat has quit IRC | 20:17 | |
| knikolla | kmalloc: cmurphy: how'd the ieee thing go? | 21:15 |
| kmalloc | as expected, confirmed the general direction, marked down good other technologies and proposals to consider, and finally figure out what general direction to take for spectroscope (if it is to be a thing) | 21:18 |
| kmalloc | it was good | 21:18 |
| knikolla | cool | 21:20 |
| cmurphy | they were interested in the token translation and identity linking ideas from spectroscope, it sounds like there might be some existing overlapping ideas or implementations out there that are worth exploring | 21:21 |
| cmurphy | worth reading https://www.nist.gov/sites/default/files/documents/2019/07/09/nist_cfra_20190709_draft_v1.0.pdf to get a broad overview of how they want to define federation | 21:22 |
| *** xek has quit IRC | 21:22 | |
| cmurphy | one thing mentioned in that is the idea of a federation broker or discovery service, i don't think we've talked about that wrt spectroscope, their thinking was that it was something that might be covered by keystone's service catalog | 21:23 |
| *** markvoelker has quit IRC | 21:23 | |
| * kmalloc nods. | 21:23 | |
| *** raildo has quit IRC | 21:23 | |
| *** vesper11 has joined #openstack-keystone | 21:25 | |
| knikolla | hmmm, that is something i'm also gravitating towards using keystone's service catalog for | 21:25 |
| cmurphy | right now i more imagine spectroscope itself filling that role, that or using consul or the like at the same logical level as spectroscope, with keystone remaining just an identity provider behind the discovery and proxy idp services | 21:28 |
| *** jamesmcarthur has quit IRC | 21:29 | |
| kmalloc | i like consul for that, but for other reasons | 21:29 |
| kmalloc | because then i have consul to also lean on | 21:29 |
| *** jamesmcarthur has joined #openstack-keystone | 21:29 | |
| kmalloc | but honestly, spectroscope could also house the discovery of non-openstack endpoints (IdP/SP) | 21:29 |
| knikolla | mostly because i know keystone and since we're resource strapped, that's one less service to keep up, but MOC is mostly the extreme case. | 21:30 |
| kmalloc | and keystone is still catalog authoritative for openstack | 21:30 |
| *** jamesmcarthur has quit IRC | 21:34 | |
| *** markvoelker has joined #openstack-keystone | 21:38 | |
| *** jamesmcarthur has joined #openstack-keystone | 21:40 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystoneauth master: Add remove_service to token fixtures https://review.opendev.org/675174 | 21:43 |
| *** mchlumsky has quit IRC | 21:44 | |
| cmurphy | knikolla: did you see my conversation with ildikov from earlier? wondering what next steps are with https://review.opendev.org/580041 and whether someone could take it over, and additionally whether there are other federation testing related tasks we could give to a newbie | 21:46 |
| *** markvoelker has quit IRC | 21:50 | |
| knikolla | cmurphy: honestly, it has just fallen from my plate multiple times and i haven't prioritized it. | 21:51 |
| mordred | kmalloc: thanks for the update | 21:51 |
| knikolla | maybe i'll do it tonight to feel like i accomplished something | 21:51 |
| mordred | knikolla: you got app-creds enabled in moc! | 21:52 |
| kmalloc | mordred: yup. Def want to get that landed. | 21:52 |
| knikolla | that was larsks :) | 21:52 |
| mordred | oh. well then | 21:52 |
| mordred | cmurphy: if you're bored, 675174 is easy :) | 21:52 |
| cmurphy | i'm never bored | 21:53 |
| mordred | cmurphy: fair | 21:53 |
| cmurphy | knikolla: you could also come to the hacking days and help someone else through it | 21:56 |
| cmurphy | knikolla: but the larger conversation is what comes next? | 21:57 |
| knikolla | people using it? | 21:59 |
| knikolla | where by it i mean federation and being able to drive its direction | 21:59 |
| cmurphy | well i meant more like on the ci front | 22:02 |
| cmurphy | removing the dependence on samltest.id for instance | 22:02 |
| knikolla | ah | 22:02 |
| knikolla | yeah | 22:02 |
| cmurphy | testing with an x509 idp | 22:02 |
| cmurphy | those kinds of things | 22:03 |
| *** rcernin has joined #openstack-keystone | 22:15 | |
| *** markvoelker has joined #openstack-keystone | 22:19 | |
| *** Ben78 has quit IRC | 22:31 | |
| *** markvoelker has quit IRC | 22:38 | |
| *** jamesmcarthur has quit IRC | 22:41 | |
| *** jamesmcarthur has joined #openstack-keystone | 22:42 | |
| *** ivve has quit IRC | 22:45 | |
| *** jamesmcarthur has quit IRC | 22:47 | |
| *** jamesmcarthur has joined #openstack-keystone | 22:50 | |
| *** markvoelker has joined #openstack-keystone | 22:53 | |
| *** jamesmcarthur has quit IRC | 22:57 | |
| *** markvoelker has quit IRC | 23:08 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: [WIP] Add immutable resource option for roles https://review.opendev.org/666739 | 23:23 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Add --immutable-roles flag to bootstrap command https://review.opendev.org/675228 | 23:23 |
| *** prometheanfire has joined #openstack-keystone | 23:25 | |
| prometheanfire | so.... new oauthlib looks like it'll need some action | 23:25 |
| prometheanfire | https://logs.opendev.org/37/673737/6/check/cross-keystone-py27/a992851/testr_results.html.gz | 23:25 |
| prometheanfire | https://review.opendev.org/673737 | 23:26 |
| cmurphy | fun | 23:26 |
| *** hoonetorg has quit IRC | 23:26 | |
| prometheanfire | yep | 23:27 |
| *** jamesmcarthur has joined #openstack-keystone | 23:28 | |
| prometheanfire | I'm gonna remove it from the review, but thought you | 23:29 |
| prometheanfire | I'm gonna remove it from the review, but thought you'd like to know | 23:29 |
| prometheanfire | you want me to make a review for just that for you to test against? | 23:31 |
| cmurphy | prometheanfire: sure, could you file a bug as well? that will make it more likely that someone-not-me will pick it up | 23:33 |
| *** jamesmcarthur has quit IRC | 23:33 | |
| prometheanfire | yep | 23:34 |
| prometheanfire | ok, depend on https://review.opendev.org/675229 for testing | 23:35 |
| prometheanfire | https://bugs.launchpad.net/keystone/+bug/1839393 | 23:38 |
| openstack | Launchpad bug 1839393 in OpenStack Identity (keystone) "oauthlib===3.1.0 fails tests (requirements update)" [Undecided,New] | 23:38 |
| *** markvoelker has joined #openstack-keystone | 23:38 | |
| cmurphy | ty | 23:39 |
| *** hoonetorg has joined #openstack-keystone | 23:40 | |
| prometheanfire | yarp | 23:42 |
| *** markvoelker has quit IRC | 23:43 | |
| *** jamesmcarthur has joined #openstack-keystone | 23:43 | |
| *** jamesmcarthur has quit IRC | 23:46 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!