19:01:10 <lbragstad> #startmeeting keystone-office-hours 19:01:11 <openstack> Meeting started Tue Oct 24 19:01:10 2017 UTC and is due to finish in 60 minutes. The chair is lbragstad. Information about MeetBot at http://wiki.debian.org/MeetBot. 19:01:12 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 19:01:15 <openstack> The meeting name has been set to 'keystone_office_hours' 19:01:18 <lbragstad> o/ 19:03:30 <cmurphy> o/ 19:04:38 <knikolla> o/ 19:05:40 <lbragstad> alright - what are folks itching to work on? 19:05:54 <lbragstad> bug reviews are pretty low 19:06:09 <lbragstad> so we could dedicate time towards picking up fixes or proposing new ones. 19:06:17 <cmurphy> keystone is bug free 19:06:19 <cmurphy> good job team 19:06:29 <lbragstad> lol 19:06:48 * lbragstad slowly starts to cry because he knows it isn't true 19:07:12 <cmurphy> :'( 19:07:25 <lbragstad> we could also clean up/merge specs 19:08:10 <lbragstad> cmurphy: fyi - thanks for reviews on https://review.openstack.org/#/c/511822/4 19:08:33 <lbragstad> we also got some feedback on https://review.openstack.org/#/c/460344/ 19:17:35 <cmurphy> I reported a bug this morning if anyone is interested in taking a look https://bugs.launchpad.net/keystone/+bug/1726736 19:17:35 <openstack> Launchpad bug 1726736 in OpenStack Identity (keystone) ""no auth token" debug logs are confusing" [Wishlist,New] 19:17:51 <cmurphy> people ask me about this all the time and i don't know what to tell them except "don't worry about it" 19:20:41 <lbragstad> cmurphy: oh - yes! 19:20:52 <lbragstad> cmurphy: that one is confusing 19:25:13 <lbragstad> seems like it existed when keystone/middleware/auth.py was created 19:25:15 <lbragstad> cf81d1ec356beca65d40a78a1dca915f4b5448fb 19:28:57 <cmurphy> hmm originally added here i think https://review.openstack.org/#/c/156870/ 19:33:39 <lbragstad> cmurphy: yeah - that seems like the current version 19:34:00 <lbragstad> but it looks like there was a previous version of that same vague message @ line 199 19:34:03 <lbragstad> https://review.openstack.org/#/c/156870/62/keystone/middleware/core.py 19:34:22 <gagehugo> o/ 19:34:39 <cmurphy> oh hmm 19:34:49 <cmurphy> the plot thickens 19:34:53 <lbragstad> yes... 19:35:10 <lbragstad> which appears to be around since 2015 versioning?! 19:35:12 <lbragstad> http://git.openstack.org/cgit/openstack/keystone/tree/keystone/middleware/core.py?h=2015.1.0 19:36:31 <cmurphy> okay i guess the original version just meant X-Auth-Token wasn't in the request headers which just means it's a regular token request 19:36:32 <lbragstad> and 2014.2 http://git.openstack.org/cgit/openstack/keystone/tree/keystone/middleware/core.py?h=2014.2#n270 19:37:18 <lbragstad> cmurphy: that should just mean it's not a "validate this token" call, yeah? 19:37:42 <lbragstad> wait - nevermind 19:37:51 <cmurphy> lbragstad: you're thinking X-Subject-Token 19:37:54 <lbragstad> yeah 19:39:01 <lbragstad> so - there isn't a whole lot you can do if X-Auth-Token isn't in the headers (except APIs that are "unprotected" like authenticate) 19:44:55 <cmurphy> that's true, but I'm not sure there's that much value in logging that for every POST /auth/tokens 19:46:31 <lbragstad> yeah.. me either 19:46:38 <lbragstad> does it generate more value than confusion? 19:48:13 <lbragstad> also - that message never actually makes it back to the user who it hitting POST /auth/tokens unless they are an operator and tailing the logs at the same time 19:48:44 <cmurphy> right 19:48:57 <lbragstad> it also contains no information about the user making the request - so the usability from an operator perspective is slim 19:49:10 <cmurphy> but if you do try to hit /projects with no X-Auth-Token the logs have a warning with "Authorization failed. auth_context did not decode anything useful" 19:49:31 <cmurphy> so i'm not sure there's ever a case where x-auth-token is unset and that message is useful 19:50:16 <lbragstad> cmurphy: right - in those cases the API requires a token and if it doesn't get it, it should provide some useful info to the user 19:50:55 <cmurphy> well it just provides a 401 but that's about as useful as you're going to get without giving too much away 19:51:18 <lbragstad> unless we're going to start including entity information in the message, i'm in favor of removing it or replacing it with an inline comment 19:52:08 <lbragstad> s/message/log message/ 19:57:39 <openstackgerrit> Colleen Murphy proposed openstack/keystone master: Remove "no auth token" debug log https://review.openstack.org/514810 19:57:49 <cmurphy> lbragstad: done ^ 19:57:57 <lbragstad> reviewing 19:59:49 <lbragstad> when authenticating with x509 and the certificate is invalid, you'd expect to get a 401 back just like you would for an invalid password, right? 20:01:31 <cmurphy> I think so, I've never played with it though 20:02:04 <lbragstad> either way, the usefulness is in the response and not vague logs 20:02:28 <knikolla> cmurphy: quick-approved :) nice to see that message go away 20:03:17 <cmurphy> \o/ 20:11:08 <lbragstad> #link https://review.openstack.org/#/c/460344/ and https://review.openstack.org/#/c/462733/12 are ready to go 20:19:23 <openstackgerrit> Gage Hugo proposed openstack/keystone master: Consolidate V2Controller functionality https://review.openstack.org/514814 20:28:34 <openstackgerrit> Lance Bragstad proposed openstack/keystone-specs master: Specification for system roles https://review.openstack.org/464763 20:30:51 <lbragstad> has anyone been able to recreate the functional v2.0 test failures in ksc 20:30:55 <lbragstad> ? 20:34:32 * cmurphy hadn't tried 20:34:46 <cmurphy> is it something more than just devstack not having v2 anymore? 20:38:10 <lbragstad> looking at a failed test run 20:38:19 <lbragstad> and the python-keystoneclient functional suite 20:38:27 <lbragstad> https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/tests/functional/test_base.py#L24-L28 is the only thing that failed 20:44:15 <lbragstad> https://github.com/openstack/python-keystoneclient/tree/master/keystoneclient/tests/functional/v2_0 doesn't have much in it either 20:46:05 <openstackgerrit> Lance Bragstad proposed openstack/python-keystoneclient master: Remove v2.0 functional tests https://review.openstack.org/514823 20:46:17 <lbragstad> we'll see if ^ passes 21:39:40 <lbragstad> whew - the assignment api is complex 22:00:12 <lbragstad> #endmeeting