18:00:35 <stevemar_> #startmeeting keystone
18:00:35 <openstack> Meeting started Tue Oct  6 18:00:35 2015 UTC and is due to finish in 60 minutes.  The chair is stevemar_. Information about MeetBot at http://wiki.debian.org/MeetBot.
18:00:36 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
18:00:39 <ayoung> Robot Rollcall!
18:00:39 <stevemar_> #link https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting
18:00:39 <openstack> The meeting name has been set to 'keystone'
18:00:45 <stevemar_> oops
18:00:55 <stevemar_> courtesy ping
18:00:56 <stevemar_> ajayaa, amakarov, ayoung, breton, browne, davechen, david8hu, dolphm, dstanek, ericksonsantos, geoffarnold, gyee, henrynash, hogepodge, htruta, jamielennox, joesavak, lbragstad, lhcheng, marekd, morganfainberg, nkinder, raildo, rharwood, rodrigods, roxanaghe, samueldmq, stevemar, tsymanczyk, topol, vivekd, wanghong, claudiub
18:01:03 <amakarov> o/
18:01:10 <browne> o/
18:01:16 <stevemar_> o\
18:01:18 * bknudson does something
18:01:19 <david8hu> \o
18:01:24 <topol> o/
18:01:28 <dstanek> o/
18:01:28 * stevemar_ high five's bknudson
18:01:30 <htruta> o/
18:01:35 * ayoung now has the MST3K themesong playing through his head
18:01:42 <raildo> \o
18:01:47 <henrynash> :-)
18:01:49 <lhcheng_> o/
18:01:50 <ayoung> henrynash, !
18:01:51 <stevemar_> i'd say we have enough folks
18:01:57 <stevemar_> henrynash: ayoung has been looking for you
18:02:07 <ayoung> henrynash, I threw an item on the end of the agenda...
18:02:07 <henrynash> (runs, hides)
18:02:14 <ayoung> Virtual Roles
18:02:20 <stevemar_> alright, good new to start
18:02:21 <henrynash> ah-ah!
18:02:26 <topol> run Forest run
18:02:28 <stevemar_> #topic RC status
18:02:35 <stevemar_> we've cut rc2!
18:02:40 <stevemar_> yayyyyy
18:02:41 <henrynash> hay!
18:02:46 <topol> CONGRATS
18:02:46 <marekd> nice
18:02:48 <lbragstad> o/
18:02:49 <ayoung> Any significant changes from RC1?
18:03:00 <stevemar_> unless there is an install / upgrade / crazy issue, this will be the last release for liberty
18:03:22 <stevemar_> ayoung: 3 bugs, and translation: https://launchpad.net/keystone/+milestone/liberty-rc2
18:03:25 <bknudson> #link http://git.openstack.org/cgit/openstack/keystone/log/?h=stable%2Fliberty
18:03:50 <ayoung> all good stuff
18:04:06 <stevemar_> around the same topic, we have also release ksc 1.7.2 and ksm 2.3.1 for liberty
18:04:13 <bknudson> I only see 2 bug fixes in the git log
18:04:56 <lbragstad> this is everything that merged in stable/liberty so far - https://review.openstack.org/#/q/status:merged+project:openstack/keystone+branch:stable/liberty,n,z
18:04:57 <ayoung> 1) Skip rows with empty remote_ids 2) Show v3 endpoints in v2 endpoint list  3) 	Ensure token validation works irrespective of padding
18:05:06 <stevemar_> bknudson: 1) skip rows, 2) padding, 3) v3 endpoints
18:05:08 <ayoung> are those not all bugs?
18:05:09 <bknudson> oh, the top one is in there
18:05:21 * stevemar_ shakes fist at bknudson
18:05:22 <bknudson> so they're all there
18:05:25 <stevemar_> thanks ayoung :)
18:05:44 <ayoung> stevemar_, that scares me.  It is the first time i ever saw bknudson overlook a detail
18:05:57 <stevemar_> regarding libs: so when we eventually release new stuff for mitaka, they'll be at 1.8.0 and 2.4.0 respectively
18:06:01 <topol> he's slippin'
18:06:08 <stevemar_> he's human after all
18:06:15 <marekd> stevemar_: who?
18:06:17 <marekd> !
18:06:18 <ayoung> Not sure about that
18:06:26 <stevemar_> marekd: bknudsonbot
18:06:31 <marekd> stevemar_: no way!
18:06:49 <stevemar_> gonna skip the 2nd topic for now (summit planning)
18:06:55 <ayoung> what is the version number for ksa?
18:07:00 <ayoung> nevermind
18:07:05 <stevemar_> ayoung: 1.0ish
18:07:09 <ayoung> ++
18:07:23 <stevemar_> ayoung: it was cut, but not too many things are using it
18:07:43 <ayoung> I saw the summit room breakdown email.  Let me see if I can link it
18:07:50 <dolphm> is that why releases haven't appeared on pypi?
18:08:03 <stevemar_> dolphm: of keystoneauth?
18:08:08 <dolphm> stevemar_: yes
18:08:20 <bknudson> #link https://pypi.python.org/pypi/keystoneauth
18:08:22 <bknudson> says 0.2.0
18:08:29 <stevemar_> that seems wrong
18:08:32 <bknudson> https://pypi.python.org/pypi/keystoneauth1
18:08:36 <bknudson> that's got 1.1.0
18:08:50 <stevemar_> ah right, it's keystoneauth1
18:09:02 <bknudson> I thought we'd want keystoneauth on pypi
18:09:03 <ayoung> http://lists.openstack.org/pipermail/openstack-dev/2015-October/076000.html
18:09:06 <dolphm> oh, f
18:09:19 <dolphm> can we delete the old package? or update the README to point to the new one?
18:09:27 <stevemar_> dolphm: i can look into that
18:09:35 <lbragstad> delete keystoneauth and point everyone to keystoneauth1
18:09:39 <lbragstad> right?
18:09:42 <stevemar_> yes
18:09:46 <topol> +++
18:09:54 <dolphm> if deleting things on pypi is acceptable, not sure it is
18:09:55 <breton> or raise an exception in keystoneauth
18:10:23 <breton> saying "keystoneauth1"
18:10:24 <stevemar_> there's a few things we can do, i'm sure there is a right answer though
18:10:38 <ayoung> #link https://docs.google.com/spreadsheets/d/1tpLN5emWhcMmSmkn8z_HuclcjnEPevP77BhdnFN9KCs/pubhtml?gid=5&single=true  Here is our room breakdown
18:10:58 <ayoung> https://mitakadesignsummit.sched.org/overview/type/Keystone#.VhQOp7P-TMU  and its on sched .org already
18:11:13 <stevemar_> ayoung: hehe, hold up.
18:11:26 <stevemar_> any other q's on liberty or the surrounding libraries?
18:11:43 <ayoung> Give me liberty or give me RC3
18:12:02 <stevemar_> #topic ops feedback for summit
18:12:22 <bknudson> hopefully the ops will show up this time.
18:12:25 <ayoung> Did we skip Design session planning?
18:12:33 <stevemar_> ayoung: just for a minute
18:12:37 <ayoung> k
18:12:48 <stevemar_> ayoung: that is gonna be a long discussion, get the easy stuff in first
18:12:53 <stevemar_> #link https://etherpad.openstack.org/p/TYO-ops-feedback-into-PWG
18:12:59 <stevemar_> add questions to that etherpad ^
18:13:03 <ayoung> #link https://mitakadesignsummit.sched.org/overview/type/Ops#.VhQPKLP-TMU
18:13:27 <stevemar_> and if you're interested in going to the session: http://mitakadesignsummit.sched.org/event/1cdd373e1128b6c5f9536c00f461947a#.VhCyIhNVhBc
18:13:36 <stevemar_> bknudson: i think it'll be more organized this time
18:13:48 <breton> yeah, last time it was 15 developers vs 2 ops
18:14:21 <stevemar_> breton: yeah, i think they are doing a general session for all the ops to generate data on projects
18:14:29 <dolphm> and for the record, the devs won
18:14:30 <stevemar_> so it's important to put questions on the etherpad
18:14:37 <stevemar_> dolphm: we always win
18:14:46 <bknudson> we really put those operators in their place.
18:14:48 <dolphm> i'd like to see ops win for a change
18:14:51 <lbragstad> so, if you know people in ops that don't necessarily hangout on irc, poke them!
18:14:57 <stevemar_> lbragstad: ++
18:15:10 <lbragstad> or at least pass them the info
18:15:33 <stevemar_> also for those interested, there is also this link going around:
18:15:35 <stevemar_> #link https://etherpad.openstack.org/p/operator-local-patches
18:15:44 <stevemar_> a set of local patches that ops carry per project
18:15:58 <stevemar_> we're actually pretty good :)
18:16:36 <stevemar_> anyway, try to be engaged in these sessions, they are crazy important
18:16:51 <bknudson> "Strip catalog from PKI token"
18:17:12 <stevemar_> bknudson: comment on the etherpad if you want
18:17:14 <dolphm> ?nocatalog#implemented
18:17:22 <stevemar_> yep
18:17:24 <lbragstad> it's the fernet?
18:17:28 <lbragstad> isn't*
18:17:36 <dolphm> it's always the fernet
18:17:45 <stevemar_> teh fehrnet
18:17:51 <morgan> Delete PKI token format *shiftyeyes*
18:18:04 <dolphm> interface="furnet"
18:18:05 * lbragstad wanders off to learn to keyboard...
18:18:18 <gyee> y'all using PKI wrong
18:18:20 <morgan> dolphm: i am scared what a furnet is
18:18:37 <stevemar_> alright alright :)
18:18:55 <stevemar_> #topic release notes
18:19:04 <stevemar_> edit the wiki directly
18:19:16 <stevemar_> #link https://wiki.openstack.org/wiki/ReleaseNotes/Liberty#OpenStack_Identity_.28Keystone.29
18:19:22 <stevemar_> review and edit please
18:19:36 <stevemar_> dolphm i know you did a lot for this already
18:19:38 <stevemar_> and thanks :D
18:19:55 <stevemar_> samueldmq: you too!
18:20:08 <dolphm> ++
18:20:12 <stevemar_> apparently this is a buzz kill of a topic
18:20:20 <ayoung> lets not make any changes to PKI tokens;  lets just work on deprecating them
18:20:25 <ayoung> there are too many problems to fix
18:20:26 <dolphm> \o/ yay release notes
18:20:34 <stevemar_> ayoung: ++
18:20:41 <dstanek> ayoung: ++
18:20:41 <stevemar_> dolphm: thanks for trying :)
18:20:54 <stevemar_> alright, on to the fun stuff!
18:20:59 <ayoung> and the primary reason PKI tokens were even written is replaced by K2K and SAML.
18:20:59 <stevemar_> ayoung: it's time
18:21:09 <ayoung> Summit planning time?
18:21:11 <stevemar_> #topic design sessions
18:21:21 <ayoung> where is our etherpad?
18:21:36 <bknudson> #link https://etherpad.openstack.org/p/keystone-mitaka-summit-brainstorm
18:21:37 <lbragstad> we had one here #Link https://etherpad.openstack.org/p/keystone-mitaka-summit-brainstorm
18:21:49 <ayoung> thanks
18:21:50 <stevemar_> ayoung: so far i have the brain dump ... fineeee bknudson and lbragstad
18:22:18 <ayoung> Can we make one session that is KSA, KSM and KSC?
18:22:40 <ayoung> lets start thinking in buckets for these things.  we have 14 top level topics
18:22:41 <stevemar_> so before we start penciling in stuff
18:22:43 <lbragstad> so a session dedicated to non-server related keystone libraries
18:22:50 <marekd> who added bullet 14.3 ?
18:22:59 <stevemar_> we have 7 fishbowl sessions
18:23:03 <ayoung> marekd, I did
18:23:06 <stevemar_> these are the ones that are group discussion
18:23:19 <samueldmq> stevemar_: hello, sorry I am late
18:23:22 <samueldmq> stevemar_: no problem :)
18:23:29 <stevemar_> 4 workroom sessions
18:23:30 <marekd> ayoung: ack
18:23:37 <stevemar_> and 2 meetup sessions (same as last)
18:23:47 <stevemar_> workrooms are the boardroom style ones
18:23:57 <lbragstad> I feel like tokens and tokenless auth could be grouped
18:24:00 <stevemar_> and fishbowls are the ones we've done for a while
18:24:10 <ayoung> marekd, probably we can mix that in with something else.  Consumption of notifications needs to be addressed in a few places...its really cross project type stuff
18:24:13 <morgan> And fishbowl rooms are much larger
18:24:14 <stevemar_> samueldmq: np, and hello
18:24:17 <lbragstad> both goals for those two sessions are getting it to be the default in devstack
18:24:19 <ayoung> lbragstad, ++
18:24:20 <marekd> ayoung: yes
18:24:26 <stevemar_> lbragstad: true
18:24:27 <morgan> Fyi in tokyo expect the work rooms to be small
18:24:32 <morgan> Very small
18:24:40 <topol> how small?
18:25:01 <bknudson> also, you have to take your shoes off and sit on the floor.
18:25:07 <morgan> I think the target was ~8-10 people
18:25:08 <gyee> really?
18:25:19 <stevemar_> topol: prison sized
18:25:21 <ayoung_> gyee, really.  but just you
18:25:24 <gyee> bknudson, you ain't kidding
18:25:25 <marekd> bknudson: and put on another shoes when going to toilet (yes, really)
18:25:25 <bknudson> we're probably going to have to wander off to another area to work
18:25:39 <ayoung_> http://i.dailymail.co.uk/i/pix/2013/07/02/article-2353514-1A9F4E55000005DC-736_634x436.jpg
18:25:59 <gyee> wow
18:26:01 <morgan> The only reason any work rooms were requested was to have some general purpose time
18:26:02 <dolphm> ayoung_: are we staying at the same hotel??
18:26:21 <marekd> bknudson: 12.1 - what's incorrect right now?
18:26:22 <morgan> Otherwise I would have requested only fishbowls
18:26:41 <morgan> (Since I was the one who had to make the requests for room allocation)
18:26:43 <lbragstad> could we address topic 5 in 8 (keystone server)?
18:27:09 <ayoung_> lbragstad, ++
18:27:38 <bknudson> marekd: according to mtreinish the keystone functional tests should require checking something in the backend database.
18:27:51 <gyee> lbragstad, yeah, if we are talking about server deprecations
18:27:51 <bknudson> not just be a test that uses devstack.
18:28:02 * breton doesn't see 5 in 8, sees only 3
18:28:06 <stevemar_> so, the workrooms, anyone have a suggestion about one of the things from the etherpad that can be dumped there?
18:28:19 <lbragstad> gyee: ++ yeah, we'll have to cover deprecations for the ksm, ksc, ksa bits, too
18:28:29 <dstanek> bknudson: what sort of checking?
18:28:30 <dolphm> bknudson: that's super odd
18:28:41 <marekd> bknudson: so affter adding entity i should write a code that queries backend and checks if that's there?
18:28:59 <stevemar_> i was thinking that testing could be a workroom session
18:29:00 <bknudson> dstanek: in the case of nova, it's like checking something in libvirt I would guess. In keystone it might be something like checking that the entry was created in ldap
18:29:03 <dolphm> i care about how the interface behaves, not what the interface does on the backend.
18:29:37 <gyee> then why do we need func tests?
18:29:40 <bknudson> dolphm: that's how I interpreted functional tests at first, too, but mtreinish said that was incorrect.
18:29:42 <ayoung_> dolphm, yeah...this sounds like a lead in to fragile tests
18:29:56 <dstanek> bknudson: if the test is to creates something then we'll probably check for it. other than that i don't see what we'd be doing.
18:29:58 <dolphm> if tests are dependent on true implementation details, then they need to be rewritten in order to do refactors, which means the tests are fragile and completely useless.
18:30:00 <dolphm> ayoung_: ++
18:30:02 <ayoung_> functional tests  exercise the backend, but do not check for implementation details
18:30:07 <dstanek> definitely not hitting the DB directly
18:30:18 <dolphm> dstanek: ++
18:30:35 <dstanek> dolphm: ayoung_: ++
18:30:56 <stevemar_> dolphm: dstanek ayoung_ i think we're all in agreement on that
18:30:57 <dstanek> i want the same tests to run against any backend (with the exceptions i noted in my documentation)
18:31:10 <ayoung_> Now,  having two distinct servers running that talk to the same backend is a viable test setup, but it would be expensive.
18:31:10 <bknudson> I suggest you bring this up with the -qa team and figure out what the alternative is.
18:31:11 <dolphm> ++
18:31:31 <morgan> Etherpad on mobile has gotten bad :(
18:31:35 <stevemar_> morgan: :(
18:31:41 <dolphm> the alternative is not writing "unit" tests against the database and calling it "functional"
18:31:56 <ayoung_> So stevemar_ what are we looking for here:  big buckets for big rooms and small buckets for small rooms?
18:31:56 <stevemar_> this has gone way off topic :\
18:32:00 <dstanek> bknudson: where was this discussed?
18:32:22 <bknudson> dstanek: they have had summit sessions on it that I wasn't able to attend, so I got learned on irc.
18:32:24 <stevemar_> ayoung_: yes, big topic for fishbowl rooms and smaller topics for workrooms
18:32:39 <lbragstad> stevemar_: do you want to have things consolidated yet?
18:32:52 <bknudson> maybe for the workrooms we find some things that a few of us want to work on.
18:33:05 <bknudson> for example, I'd be interested in test refactoring
18:33:17 <bknudson> maybe documentation for the libs
18:33:19 <stevemar_> lbragstad: i can easily consolidate and pick things, i wanted to give the core team a chance to say "I want this topic to be a fishbowl"
18:33:30 <stevemar_> or "I want this topic to be a workroom"
18:33:35 <breton> oh, I'd love to see test refactoring.
18:34:10 <stevemar_> I think anything that touches another project should not be a workroom, since that's hard to schedule
18:34:10 <ayoung_> 5 fishbowl room sessions 5 Work room sessions ?
18:34:15 <ayoung_> Do I have that right
18:34:25 <morgan> 7 fishbowl for us, 4 workroom
18:34:29 <stevemar_> ayoung_: no, 7 fish, 4 work
18:34:31 <henrynash> the whole policy/roles direction would be another
18:34:31 <lbragstad> catalog standardization has been a theme in the last couple summits
18:34:43 <lbragstad> that'd probably benefit from being a fishbowl
18:34:48 <stevemar_> lbragstad: thats gonna be a X-project one
18:34:57 <stevemar_> so don't even count it on here
18:35:02 <lbragstad> cool
18:35:29 <ayoung_> Roles and Policy need to be cross project attended
18:35:48 <gyee> ayoung_, ++
18:35:53 <ayoung_> We need buy in, especially from Nova, if we are going to make any progress
18:35:59 <stevemar_> yep
18:36:13 <stevemar_> i think "things to deprecate and remove" and "testing" can be working rooms?
18:36:16 <samueldmq> ayoung_: ++
18:36:18 <lbragstad> federation as it's own fishbowl i assume
18:36:20 <stevemar_> anyone disagree?
18:36:21 <ayoung_> ++
18:36:36 <lbragstad> there is a *lot* of stuff under those
18:36:43 <stevemar_> actually... deprecation... we might need input from others
18:36:50 <bknudson> The times were 40 mins right?
18:36:54 <ayoung_> is federation even that much a hot topic anymore?  Its kindof implemented.  There are details like making them apping easier to work with...openid connect.
18:37:00 <ayoung_> OK..yeah, that is fishbowl
18:37:02 <bknudson> We didn't get much done in the 40 min sessions last time.
18:37:17 <dstanek> stevemar_: i would agree since i think those are more likely topics that we'll work on and not just discuss
18:37:20 <stevemar_> basically the contentious ones, I want to make fishbowls
18:37:22 <dolphm> ayoung_: it should be more of a cross-project topic this time around. horizon + keystone + openstackclient + etc
18:37:32 <stevemar_> dolphm: yep
18:37:37 <ayoung_> dolphm, ah,  good.
18:37:38 <lbragstad> I'd agree with that
18:37:54 <dolphm> stevemar_: is there room for that in the cross-project schedule at this point?
18:37:58 <dolphm> (federation)
18:38:29 <stevemar_> dolphm: i dont think it's finalized yet
18:38:47 <stevemar_> I could ask for it
18:38:50 <dolphm> stevemar_: ++
18:39:11 <anteaya> I think cross project schedule is on today's tc meeting agenda
18:39:12 <dstanek> i'll throw this out as a general OpenStack criticism - the x-project initiatives need an x-project team otherwise they'll either never get done or take forever
18:39:20 <dolphm> anteaya: awesome, thanks
18:39:39 <gyee> dstanek, so true :)
18:39:42 <dolphm> dstanek: that's (unfortunately?) true
18:39:52 <anteaya> dolphm: confirmed
18:40:03 <dolphm> our first round of cross project sessions was a lot of tossing responsibilities over the fence
18:40:16 <anteaya> I think growing folks to do cross project work is part of what ttx is trying to get the tc to do
18:40:21 <dolphm> some number of summits ago
18:40:34 <dstanek> anteaya: nice
18:40:40 <stevemar_> that would be cool to see
18:40:45 <anteaya> but the electorate has to elect folks who aren't currently booked with ptl duties to do so
18:40:53 <anteaya> so far, that hasn't happened a lot
18:40:58 <anteaya> here's hoping
18:41:02 <bknudson> hey, we made v3 available it's their own fault if they don't use it.
18:41:08 <dstanek> we really need OpenStack initiatives and construct a team of the right people - not a project saying we are doing this x-project thing so listen up
18:41:26 * anteaya agrees, having come into the middle of the conversation
18:42:52 <stevemar_> ayoung_: dolphm dstanek -- everyone>> my current picks: http://paste.openstack.org/show/475509/
18:42:57 <lbragstad> so, almost everything either has 'fishbowl' or 'workroom' next to it
18:43:03 <stevemar_> lbragstad: ^
18:43:22 <lbragstad> is paste.o.o slow for anyone else today?
18:43:27 <samueldmq> dstanek: ++ that looks to have happened to dynamic policies too, when ayoung_ had setions, and it seemed that people form other projects just didn't appear
18:43:28 <ayoung_> yep
18:43:33 <marekd> lbragstad: yes
18:43:49 <stevemar_> i think we got everything on the paste
18:43:54 <lbragstad> stevemar_: you want federation to be a x-project fishbowl if we have the time, right?
18:44:11 <stevemar_> lbragstad: i'd prefer that
18:44:18 <stevemar_> but in case, i can use one of ours
18:44:20 <dstanek> lbragstad: yes, takes a long time to load
18:44:33 <lbragstad> stevemar_: ok, marked it as such in the etherpad
18:45:06 <gyee> stevemar_, and audit?
18:45:16 <gyee> its a small A of the AAA after all
18:45:21 <stevemar_> lbragstad: if anything i would like to have another random cross-project fishbowl session
18:45:23 <ayoung_> stevemar_, so  Policy can be policy and roles...and with that, I'd like to ask for the last 10 minutes of this meeting to be aboutt roles stuff
18:45:52 <morgan> gyee: we are more IAM + audit than AAA now
18:45:54 <lbragstad> stevemar_: so, should we put an action item under Federation to check on the status of getting a x-project slot for that?
18:45:56 <stevemar_> ayoung_: that's fine with me, still 5 minutes left
18:46:00 <stevemar_> err 15
18:46:04 <ayoung_> ++
18:46:08 <stevemar_> lbragstad: yep
18:46:27 <dstanek> stevemar_: i'm happy with that list so far
18:46:36 <stevemar_> i'll be doing that as i look to make sure the service catalog is coming out of x-project fishbowl and not ours
18:46:46 <ayoung_> ++
18:46:47 <stevemar_> gyee: audit might be a working room
18:46:59 <ayoung_> would love to move the service catalog to DNS
18:47:04 <stevemar_> i'd prefer to have the last fishbowl for general crossproject stuff
18:47:22 <stevemar_> so no red flags here right?
18:47:24 <dstanek> ayoung_: i started a little project to test that out
18:47:30 <stevemar_> no one is feeling short changed?
18:47:41 <stevemar_> everything is groovy
18:47:51 <ayoung_> Performing
18:48:03 <stevemar_> and with that, let the battle begin, ayoung_ and henrynash lace up
18:48:12 <ayoung_> Heh
18:48:13 <stevemar_> #topic roles
18:48:17 * dstanek grabs some popcorn and a beer
18:48:20 <henrynash> (I think not much of a battle, actually!)
18:48:25 <ayoung_> henrynash, so...aside from naming, I think we are on the same page
18:48:41 * lbragstad grabs a seat next to dstanek
18:48:48 <stevemar_> http://cdn.meme.am/instances/400x/59486625.jpg
18:48:50 <ayoung_> gyee, role groups  ayoung_ implied roles henrynash virtual roles
18:48:59 <ayoung_> but I think we all want  roughly the same thing:
18:49:03 <ayoung_> assing one role, get many...
18:49:14 <ayoung_> that is the subset of henrynash 's blueprint
18:49:20 <gyee> is assing a word?
18:49:26 <lbragstad> it is now
18:49:27 <dolphm> gyee: it's the subset
18:49:35 <ayoung_> yes,  but only halfway
18:49:37 <gyee> hahahah
18:49:45 <ayoung_> I guess I half-assigned that
18:49:56 * gyee learn something new today
18:50:01 <ayoung_> anyway
18:50:14 <ayoung_> henrynash, you also have the domain specific roles part, which is, I think 2 parts:
18:50:18 <ayoung_> 1  namespacing of roles
18:50:22 <henrynash> yes
18:50:30 <ayoung_> 2. certain roles don't go in tokens
18:50:48 <ayoung_> so..if we do implied roles first (expanded in the tokens) can we build the other things on top of it?
18:50:52 <henrynash> correct (maybe “management roles” woudl be a better name for those)
18:51:22 <ayoung_> henrynash, I was thinking virtual roles would be "roles that imply other roles but that never end up in tokens themselves:
18:51:23 <ayoung_> "
18:51:41 <gyee> all I am asking is usability
18:51:45 <dstanek> dumb question...does this concept already exist in some other product?
18:51:52 <ayoung_> dstanek, all over the place
18:51:58 <henrynash> ayoung_: sure, that’s what I meant by them too….but most people don;t like virtual roles (and I’m not sure I do either)
18:52:06 <ayoung_> dstanek, the reason gyee keeps using the term role groups is that is what MS calls it (at least)
18:52:25 <henrynash> and the very first bp I wrote called them role-groups!
18:52:31 <ayoung_> henrynash, fair enough.  I'll defer on the naming.
18:52:35 <henrynash> and I’m Ok with taht name too
18:52:44 <morgan> Role-groups is pretty descriptive
18:52:49 <morgan> And not overloaded
18:52:51 <morgan> Fwiw
18:53:06 <morgan> Descriptive and not overloaded = good option
18:53:21 <henrynash> so implied roles…..just means expand this role-group and put all the roles in the token?
18:54:14 <morgan> I would err to the side of something that people are familiar with. If MS uses "role groups" that is a pretty good option imo
18:54:26 <morgan> henrynash: i think thst is an inplementation detail
18:54:28 <ayoung_> henrynash, well, I was thinking that a role is either in the token or not.  an implied role means "If I get this role I get this other one too"
18:54:28 <henrynash> morgan: and I’m fine with that
18:54:35 <ayoung_> so I had them as two dimentions on the role object
18:54:37 <morgan> Either way it could work regardless of the name
18:54:49 <morgan> So either you expand or you dont. I dont think it matters
18:54:49 <ayoung_> arole group could be "a role that does not go into a token"
18:55:03 <henrynash> ayoung_: agreed
18:55:03 <lbragstad> 5 minutes remaining
18:55:04 <samueldmq> openstackbot info: 5 mins left
18:55:08 <samueldmq> lbragstad: o/
18:55:09 <ayoung_> so if we give someone "admin" they get "member" and both go into the token
18:55:16 <dolphm> how are roles groups inherited in hierarchical multitenancy?
18:55:19 <gyee> we just need something that is "easy" to explain to average users, "easy" for doc people, "easy" to use
18:55:20 * dolphm sorry.
18:55:20 <morgan> ayoung_: yeah. I think your spot on lets defer impl details like expansion for not in this meetinf
18:55:25 <ayoung_> but if we give someon "IBM-DISTINGUISHED_ENGINEER" that is a roel group and it does not go in the token
18:55:35 <henrynash> gyee: absolutely +++++
18:55:35 <ayoung_> morgan, I think we are good
18:55:44 <morgan> ayoung_: yah agreed :)
18:56:13 <henrynash> ayoung_: ok, so namespacing
18:56:22 <ayoung_> OK...we can battle out the rest of the details at the summit, but I want a goal of having the spec approved before we leave Japan
18:56:32 <henrynash> ayoung_: agreed
18:56:38 <ayoung_> namespacing...yeah, that is tricky.
18:57:02 <ayoung_> can we do it in this order:
18:57:06 <bknudson> collect everyone's passport until spec is approved
18:57:06 <henrynash> ayoung_: I think that’s the hardest bit, I agree….if you namespec a role that goes ina token…what does that mean?
18:57:21 <ayoung_> henrynash, right, one of two things
18:57:29 <morgan> bknudson: i think that is mordred's plan for some other sessions :P
18:57:35 <ayoung_> 1.  namespace to a domain, don;'t put it in the token.   2. Namespace to a service...
18:57:40 <stevemar_> bknudson: haha
18:57:48 <mordred> what did I do?
18:57:52 <ayoung_> so nova:admin is different from swift:admin
18:57:58 <ayoung_> and that shoudl be expanded later?
18:58:02 <henrynash> ayoung_: namespacing a role_group to a domain (say) makes a lot of sense (to me)…..and doesn’t affect that types of role that end up in the token
18:58:29 <ayoung_> so the related spec (we don't have time for ) is this one
18:58:45 <samueldmq> henrynash: yes because role-groups never go in the token
18:58:46 <ayoung_> https://review.openstack.org/#/c/228477/
18:58:53 <ayoung_> I see you -1 ed it. have not looked yet
18:59:16 <ayoung_> henrynash, so get a sketch of your approach up
18:59:17 <henrynash> ayoung_: I only -1’d since I am going to post an alternative so we can comapre
18:59:27 <henrynash> will do
18:59:30 <ayoung_> and with that, I cede the floor
18:59:31 <stevemar_> and we're up
18:59:37 <stevemar_> excellent timing
18:59:40 <stevemar_> #endmeeting