*** Marga_ has quit IRC | 00:03 | |
*** mattgriffin has quit IRC | 00:11 | |
*** ddaskal has joined #openstack-community | 00:23 | |
*** electroc_ has joined #openstack-community | 00:39 | |
*** electrocucaracha has quit IRC | 00:40 | |
*** electroc_ has quit IRC | 00:44 | |
*** jtomasek has quit IRC | 00:48 | |
*** mattgriffin has joined #openstack-community | 00:51 | |
*** tiswanso has joined #openstack-community | 01:17 | |
*** tiswanso has quit IRC | 01:20 | |
*** mattgriffin has quit IRC | 01:20 | |
*** tiswanso has joined #openstack-community | 01:20 | |
*** tiswanso has quit IRC | 01:26 | |
*** tiswanso has joined #openstack-community | 01:26 | |
*** annegentle has joined #openstack-community | 02:15 | |
*** annegentle has quit IRC | 02:20 | |
*** tiswanso has quit IRC | 02:28 | |
*** tiswanso has joined #openstack-community | 02:29 | |
*** annegentle has joined #openstack-community | 02:40 | |
*** smallbig has joined #openstack-community | 02:59 | |
*** tiswanso has quit IRC | 03:05 | |
*** ozialien has quit IRC | 03:06 | |
*** annegentle has quit IRC | 03:43 | |
*** annegentle has joined #openstack-community | 03:44 | |
*** ddaskal has quit IRC | 03:55 | |
*** Marga_ has joined #openstack-community | 03:58 | |
*** Marga_ has quit IRC | 04:00 | |
*** Marga_ has joined #openstack-community | 04:00 | |
*** annegentle has quit IRC | 04:02 | |
*** mattgriffin has joined #openstack-community | 04:15 | |
*** mattgriffin has quit IRC | 04:17 | |
*** mattgriffin has joined #openstack-community | 04:20 | |
*** julim has quit IRC | 04:49 | |
*** julim has joined #openstack-community | 04:56 | |
*** annegentle has joined #openstack-community | 05:03 | |
*** mrmartin has joined #openstack-community | 05:07 | |
*** annegentle has quit IRC | 05:09 | |
*** mattgriffin has quit IRC | 05:11 | |
*** mrmartin has quit IRC | 05:19 | |
*** annegentle has joined #openstack-community | 06:04 | |
*** annegentle has quit IRC | 06:10 | |
*** neeti has joined #openstack-community | 06:23 | |
*** Marga_ has quit IRC | 06:44 | |
*** annegentle has joined #openstack-community | 07:05 | |
*** annegentle has quit IRC | 07:10 | |
*** tobe has joined #openstack-community | 08:05 | |
*** annegent_ has joined #openstack-community | 08:06 | |
*** annegent_ has quit IRC | 08:11 | |
*** dizquierdo has joined #openstack-community | 08:26 | |
*** mrmartin has joined #openstack-community | 08:29 | |
*** dizquierdo has quit IRC | 08:31 | |
*** tobe has quit IRC | 08:31 | |
*** cdent has joined #openstack-community | 08:56 | |
*** annegentle has joined #openstack-community | 09:07 | |
*** annegentle has quit IRC | 09:12 | |
*** mrmartin has quit IRC | 09:40 | |
*** coolsvap|afk is now known as coolsvap | 10:03 | |
*** annegent_ has joined #openstack-community | 10:08 | |
*** annegent_ has quit IRC | 10:13 | |
*** mrmartin has joined #openstack-community | 10:43 | |
*** mwagner_lap has joined #openstack-community | 11:06 | |
*** annegent_ has joined #openstack-community | 11:08 | |
*** annegent_ has quit IRC | 11:13 | |
*** annegentle has joined #openstack-community | 12:00 | |
*** annegentle has quit IRC | 13:00 | |
*** annegentle has joined #openstack-community | 13:02 | |
*** cdent has quit IRC | 13:12 | |
*** tiswanso has joined #openstack-community | 13:14 | |
*** EmilienM|afk is now known as EmilienM | 13:15 | |
*** coolsvap is now known as coolsvap|afk | 13:37 | |
*** neeti has quit IRC | 13:39 | |
*** neeti has joined #openstack-community | 13:44 | |
*** annegentle has quit IRC | 13:44 | |
*** annegentle has joined #openstack-community | 13:45 | |
*** cdent has joined #openstack-community | 13:46 | |
*** coolsvap has joined #openstack-community | 13:47 | |
*** dizquierdo has joined #openstack-community | 14:09 | |
*** annegentle has quit IRC | 14:16 | |
*** ddaskal has joined #openstack-community | 14:22 | |
*** Piet has joined #openstack-community | 14:23 | |
*** neeti has quit IRC | 14:25 | |
*** shakamunyi has joined #openstack-community | 14:25 | |
*** mattgriffin has joined #openstack-community | 14:28 | |
*** ddaskal has quit IRC | 14:32 | |
*** Marga_ has joined #openstack-community | 14:38 | |
*** Marga_ has quit IRC | 14:39 | |
*** Marga_ has joined #openstack-community | 14:39 | |
*** Guest58709 has joined #openstack-community | 14:41 | |
*** electrocucaracha has joined #openstack-community | 14:42 | |
*** packet has joined #openstack-community | 14:45 | |
*** electrocucaracha has quit IRC | 14:45 | |
*** rbowen has quit IRC | 14:47 | |
*** electrocucaracha has joined #openstack-community | 14:48 | |
*** rbowen has joined #openstack-community | 14:52 | |
*** Marga_ has quit IRC | 15:13 | |
*** electrocucaracha has quit IRC | 15:17 | |
*** shakamunyi has quit IRC | 15:25 | |
*** Marga_ has joined #openstack-community | 15:28 | |
*** mwagner_lap has quit IRC | 15:35 | |
*** Marga_ has quit IRC | 15:37 | |
*** Guest58709 is now known as annegentle | 15:40 | |
reed | hi mrmartin | 15:46 |
---|---|---|
reed | I am checking my morning email now | 15:46 |
mrmartin | hi | 15:48 |
reed | mrmartin, I saw the good news! so grateful | 15:51 |
reed | i'm going to test it now | 15:51 |
mrmartin | yeah, I definietly suggest to do testing, we have 520 new commits in this 0.7.53 upgrade | 15:52 |
mrmartin | and as we don't have a detailed changelog anything can happen | 15:52 |
*** openstackstatus has quit IRC | 15:56 | |
reed | the site looks good | 15:56 |
*** openstackstatus has joined #openstack-community | 15:56 | |
*** ChanServ sets mode: +v openstackstatus | 15:56 | |
reed | now Evgeny needs to fix the G+ code https://bugs.launchpad.net/openstack-community/+bug/1418361 | 15:57 |
openstack | Launchpad bug 1418361 in OpenStack Community Project "OpenID 2.0 for Google Accounts is going away" [High,In progress] - Assigned to Evgeny Fadeev (evgeny-fadeev) | 15:57 |
reed | because there seem still to be an issue | 15:57 |
reed | mrmartin, did you talk to Evgeny today | 15:57 |
reed | ? | 15:57 |
mrmartin | not yet | 15:58 |
reed | ok, I'll look for him | 15:58 |
mrmartin | I bet this setting going away thing happens when you save the settings | 15:58 |
mrmartin | on the UI | 15:58 |
reed | which setting? | 15:59 |
mrmartin | the google account auth icon | 15:59 |
mrmartin | it was disappeared at least two times before | 16:00 |
*** annegentle has quit IRC | 16:02 | |
reed | ah, that's another one | 16:03 |
reed | oh, I know the cause of that | 16:04 |
reed | the icon disappeared when an oauth Key was misteriosly disabled in the UI | 16:04 |
reed | I think that once we put those key in settings.py we won't have the problem | 16:04 |
*** Marga_ has joined #openstack-community | 16:07 | |
mrmartin | We need to move this setting to hiera | 16:11 |
mrmartin | anyway we can go forward with infra patches, and Evgeny can work on fixes meanwhile, because we have an approval window, so it needs some time to roll out | 16:12 |
*** shakamunyi has joined #openstack-community | 16:16 | |
reed | cool | 16:17 |
reed | fungi is available to help starting on monday | 16:17 |
reed | please coordinate with him after gerrit upgrade this weekend | 16:17 |
*** Marga_ has quit IRC | 16:21 | |
*** Marga_ has joined #openstack-community | 16:22 | |
*** Marga_ has quit IRC | 16:30 | |
*** dizquierdo has quit IRC | 16:30 | |
*** shakamunyi has quit IRC | 16:33 | |
*** Marga_ has joined #openstack-community | 16:39 | |
*** Marga_ has quit IRC | 16:43 | |
*** packet has quit IRC | 16:46 | |
*** shakamunyi has joined #openstack-community | 16:48 | |
*** mwagner_lap has joined #openstack-community | 16:56 | |
*** annegentle has joined #openstack-community | 16:59 | |
*** Marga_ has joined #openstack-community | 17:03 | |
*** Marga_ has quit IRC | 17:03 | |
*** Marga_ has joined #openstack-community | 17:03 | |
*** shakamunyi has quit IRC | 17:07 | |
*** Evgeny has joined #openstack-community | 17:08 | |
Evgeny | mrmartin, reed, hello. I've read Stef's email and the ticket, I'me aware of this possibility of google still not linking to old OpenID. This will require debugging on live site by logging. | 17:11 |
Evgeny | mrmartin, reed: Although I should recheck this last statement above on my dev laptop first for the case of possible regression. | 17:13 |
Evgeny | mrmartin, reed, I have a meeting in 15 minutes, after that I can work on this issue. | 17:13 |
reed | Evgeny, ok | 17:13 |
mrmartin | ok | 17:17 |
*** shakamunyi has joined #openstack-community | 17:18 | |
*** annegentle has quit IRC | 17:21 | |
*** shakamunyi has quit IRC | 17:23 | |
*** Evgeny has quit IRC | 17:26 | |
*** shakamunyi has joined #openstack-community | 17:34 | |
*** annegentle has joined #openstack-community | 17:43 | |
*** sarob has joined #openstack-community | 17:46 | |
*** coolsvap has quit IRC | 18:15 | |
*** ozstacker has quit IRC | 18:15 | |
*** ozstacker has joined #openstack-community | 18:16 | |
*** Marga_ has quit IRC | 18:30 | |
*** Marga_ has joined #openstack-community | 18:30 | |
*** annegentle has quit IRC | 18:31 | |
*** Marga_ has quit IRC | 18:35 | |
*** Marga_ has joined #openstack-community | 18:35 | |
*** Piet has quit IRC | 18:37 | |
*** Marga_ has quit IRC | 18:37 | |
*** Evgeny has joined #openstack-community | 18:56 | |
reed | mrmartin, Evgeny do you still need to VM instance on Rackspace? | 19:02 |
mrmartin | i don't need | 19:02 |
Evgeny | reed, no | 19:02 |
reed | if not, I'll switch it down and save some $ :) | 19:02 |
reed | cool, thanks, i'm switching it off | 19:03 |
mrmartin | ok, I can keep the hp instance until we don't have a proper ask-dev.o.o in openstack infra | 19:03 |
reed | Evgeny, what do you need exactly to test the G+ issue? | 19:08 |
Evgeny | reed, I'm on the case now. First testing the migration, if I can. | 19:09 |
Evgeny | next thing - add logging statements and deploy on live site. | 19:09 |
Evgeny | what can be done to mitigate: | 19:09 |
Evgeny | if user logs in via google+ | 19:09 |
*** Marga_ has joined #openstack-community | 19:09 | |
Evgeny | we display a message on the registration page (where user name and email are added) | 19:10 |
*** jehb has quit IRC | 19:10 | |
Evgeny | "Google+ authentication may not recover your existing Google Openid account, if you had a Google account on this site, click below to recover it via email" | 19:10 |
Evgeny | I've added the recovery by email form on the same page | 19:11 |
Evgeny | Right now what is missing is a message. | 19:11 |
Evgeny | the issue is that migration worked on some sites and did not work on others | 19:11 |
Evgeny | reed, ^ my answer is above | 19:12 |
reed | Evgeny, let me understand better | 19:12 |
reed | if Boris uses his email on https://askbot-dev.openstack.org/en/account/recover/ should he be able to reconcile the G+ account? | 19:13 |
Evgeny | no | 19:13 |
Evgeny | askbot-dev is a different site | 19:14 |
reed | in what sense? | 19:14 |
Evgeny | well, here is the thing: | 19:14 |
*** jehb has joined #openstack-community | 19:14 | |
Evgeny | one of requests to g+ includes parameter "openid-realm" | 19:15 |
Evgeny | which currently is identical to the base url of the current site | 19:15 |
Evgeny | in this case it is https://askbot-dev.openstack.org/ | 19:15 |
Evgeny | your live site has domain ask.openstack.org | 19:15 |
reed | oh, I see | 19:15 |
reed | so we need to upgrade first and then we can really test if the upgrade is broken? | 19:16 |
Evgeny | that said - on one production site I've tested on my own account | 19:16 |
Evgeny | and I had the same issue - when logging in with g+ - it promts to create a new account | 19:16 |
Evgeny | so the migration code although it is there is not 100% effective | 19:17 |
reed | what if we change the /etc/hosts to ask.openstack.org: will that work? | 19:17 |
reed | for testing, I mean | 19:18 |
Evgeny | it could be tested. | 19:18 |
mrmartin | reed, yes, we need to update the settings in puppet | 19:18 |
Evgeny | however some things may need to be changed on the askbot-dev | 19:18 |
mrmartin | and be careful to not forget about /etc/hosts entry | 19:18 |
Evgeny | mrmartin: in settings.py there is "ALLOWED_HOSTS" | 19:18 |
Evgeny | also maybe change the domain name in Apache | 19:18 |
Evgeny | if it permits such change | 19:19 |
reed | what do you think? shall we try this path? | 19:19 |
reed | what are the alternatives? | 19:19 |
Evgeny | Let's try. This still is not guaranteed to work as google can compare the IP addresses of the real and dev site. | 19:19 |
mrmartin | we don't have too much option here, as openid have a callback url mechanism | 19:19 |
Evgeny | i.e. may or may not work | 19:19 |
mrmartin | I think it will work | 19:19 |
mrmartin | give me a sec, I'll rewrite the site parameters and rerun puppet | 19:20 |
reed | ok, let's give it a shot | 19:20 |
Evgeny | also in site live settings APP_URL will need to be adjusted | 19:20 |
mrmartin | yeah | 19:22 |
Evgeny | Also - to test the dev site needs to be seeded with the openid data | 19:23 |
Evgeny | if openid account is not there already (in the ask site itself) there is nothing to migrate | 19:24 |
Evgeny | and in such case prompt to create new account is expected | 19:24 |
Evgeny | I.e. on a blank dev site it is impossible to test the migration | 19:24 |
Evgeny | unless at least user accounts with the login data associated is copied from the live site. | 19:25 |
mrmartin | done | 19:25 |
mrmartin | to /etc/hosts file: 15.125.72.80askbot-dev.openstack.org ask.openstack.org | 19:25 |
mrmartin | Evgeny, we are working from a backup here | 19:26 |
mrmartin | if it is out of date, we can ask fungi to create a new one for us | 19:26 |
*** mwagner_lap has quit IRC | 19:26 | |
reed | guys, I have a bit of an emergency here, I have to be afk for a while, 30min or so | 19:27 |
reed | please proceed without me | 19:27 |
mrmartin | ok. | 19:28 |
reed | ah, you can't until I change the Google auth stuff | 19:28 |
reed | argh | 19:28 |
mrmartin | ok, google auth changed | 19:34 |
mrmartin | I can reach to askbot account page, but I didn't have an openid account there previously | 19:34 |
mrmartin | Evgeny: can you test this somehow? | 19:35 |
Evgeny | mrmartin, reed: it's asking to register and there is error message "internal error occured" | 19:37 |
Evgeny | with some numeric code | 19:37 |
mrmartin | yeah, it comes from the captcha service | 19:37 |
Evgeny | ^ that after clicking the G+ login button | 19:38 |
Evgeny | Maybe try to disable captcha for now? | 19:38 |
mrmartin | where can I disable? in settings.py? | 19:39 |
mrmartin | I found this setting there: RECAPTCHA_USE_SSL = True | 19:40 |
Evgeny | can be "ASKBOT_USE_RECAPTCHA = False" | 19:40 |
Evgeny | also in live settings | 19:40 |
Evgeny | it must be True | 19:40 |
Evgeny | (the use ssl) | 19:40 |
mrmartin | ok, it is disabled now | 19:41 |
Evgeny | The same, asking me to create an account | 19:44 |
Evgeny | I don't remember if I have an openid record there | 19:44 |
mrmartin | can we check it somehow in the db? | 19:49 |
Evgeny | Yes, find user with email evgeny.fadeev@gmail.com | 19:51 |
Evgeny | then records | 19:52 |
Evgeny | UserAssociation where user=<user as found above> | 19:52 |
mrmartin | yep, you had a google openid | 19:59 |
Evgeny | mrmartin: most efficient is to debug with pdb and run site with runserver | 20:01 |
mrmartin | what I need to debug? | 20:01 |
Evgeny | instead of apache | 20:01 |
Evgeny | askbot/deps/django_authopenid/views.py around line 338 | 20:03 |
*** packet has joined #openstack-community | 20:06 | |
*** DrBacchus has joined #openstack-community | 20:10 | |
mrmartin | and what we need to test? whether the google+ sends back to email address or what? | 20:13 |
*** rbowen has quit IRC | 20:14 | |
*** shakamunyi has quit IRC | 20:17 | |
mrmartin | Evgeny, it is entering to the "if openid_url:" case | 20:19 |
Evgeny | that's good | 20:19 |
Evgeny | what is openid_url? | 20:20 |
Evgeny | is it a real url? | 20:20 |
mrmartin | http://paste.openstack.org/show/217363/ | 20:21 |
*** tiswanso has quit IRC | 20:21 | |
mrmartin | yeah, it is a nice google url | 20:21 |
Evgeny | step through there, it should be seen why it fails to find the matching user | 20:22 |
Evgeny | possibly that openid url has changed | 20:22 |
Evgeny | if that's so - we have no option but to recover account via email | 20:23 |
mrmartin | but | 20:23 |
mrmartin | it was with my google account | 20:23 |
mrmartin | and I didn't have a previous openid | 20:23 |
mrmartin | so you need to try this out with your account | 20:24 |
Evgeny | if openid_url returned by g+ is different from what you have in the user association | 20:24 |
Evgeny | then there will be no matching user | 20:24 |
Evgeny | (barring some other silly reason due to some bug in the askbot code) | 20:25 |
*** annegentle has joined #openstack-community | 20:25 | |
*** annegentle has quit IRC | 20:26 | |
mrmartin | how can you debug this? | 20:26 |
*** annegentle has joined #openstack-community | 20:26 | |
mrmartin | I've restarted the server meanwhile | 20:26 |
mrmartin | plz try to login with your google account | 20:26 |
mrmartin | and I can check what happens there with pdb | 20:27 |
Evgeny | server not available to me | 20:27 |
Evgeny | I get connection refused error | 20:28 |
mrmartin | strange works for me | 20:28 |
mrmartin | what is the ip of the server you're checking? | 20:28 |
Evgeny | i have this in my hosts | 20:29 |
Evgeny | 15.125.72.80 askbot-dev.openstack.org ask.openstack.org | 20:29 |
Evgeny | so it returns the user instance? | 20:29 |
Evgeny | If value of 'user' around that point from the paste above is not None | 20:30 |
mrmartin | ok, and you still receive connection refused? | 20:30 |
Evgeny | you should be logged in | 20:31 |
mrmartin | ok, I get this part | 20:31 |
Evgeny | yes | 20:31 |
Evgeny | "this webpage is not available" ERR_CONNECTION_REFUSED | 20:31 |
Evgeny | so were you able to log in? | 20:31 |
mrmartin | yeah | 20:31 |
Evgeny | and recovered openid? | 20:32 |
mrmartin | strange, because I can reach the site | 20:32 |
Evgeny | "this is chile"TM | 20:32 |
Evgeny | I get strange network issues from here at times | 20:33 |
mrmartin | for me it is going through the G+ auth, the only thing that happens here, that I need to provide my askbot account | 20:33 |
mrmartin | oh ok | 20:33 |
Evgeny | ? | 20:33 |
Evgeny | this part I don't understand | 20:34 |
Evgeny | what do you mean by "need to provide my askbot account" | 20:34 |
mrmartin | so the openid auth works well, but I didn't have an account in askbount | 20:34 |
mrmartin | askbot | 20:34 |
Evgeny | as far as I understand - you log in, g+ gives openid_url, but you previously did not have that url | 20:36 |
mrmartin | yes | 20:36 |
mrmartin | so after g+ auth | 20:36 |
Evgeny | on the ask site, therefore you are prompted to create a new account - is this correct? | 20:36 |
mrmartin | askbot is asking my screen name and email address | 20:36 |
mrmartin | this two | 20:36 |
Evgeny | ok | 20:37 |
mrmartin | anyway | 20:37 |
mrmartin | if you setup a local deployment | 20:37 |
Evgeny | is your test server running on https? | 20:37 |
mrmartin | and set the local domain of your askbot to ask.openstack.org in hosts file | 20:37 |
mrmartin | you can test the g+ auth | 20:37 |
*** julim has quit IRC | 20:37 | |
Evgeny | that's good | 20:37 |
mrmartin | and I've post your stored openid url from user assoc table in priv | 20:38 |
Evgeny | Well as far as we can see - openid_url is returned | 20:38 |
mrmartin | so you can compare the too values | 20:38 |
mrmartin | the only thing, that g+ url is set to https | 20:38 |
mrmartin | but if you like I can change it back to http | 20:38 |
Evgeny | The thing is that - if the value returned by g+ is different, there is nothing I can do | 20:39 |
mrmartin | doesn't this auth code returns the email address? | 20:40 |
Evgeny | google did change my openid url at times | 20:40 |
mrmartin | we would pair the accounts based on email | 20:40 |
Evgeny | this code does not yet utilize email address | 20:40 |
Evgeny | this needs to be fixed | 20:40 |
Evgeny | on the askbot side | 20:40 |
Evgeny | therefore user is prompted to enter email even though g+ can give it | 20:40 |
Evgeny | this applies to other login methods as well | 20:41 |
mrmartin | ok, but theoretically the old account can be joined through email address - until the user not changing that to something new | 20:41 |
Evgeny | IMO there is no sense in testing this further. | 20:41 |
Evgeny | good idea - I did not think of that | 20:42 |
Evgeny | it is also possible that openid url points to one account and email address - to another account :) | 20:43 |
Evgeny | not very likely, but possible | 20:43 |
mrmartin | usually people who used google openid for auth had a gmail address, I guess | 20:43 |
mrmartin | it is about the "ownership" of an email address, | 20:44 |
mrmartin | so I suggest to think about this as an alternative solution, I need to go, because getting a bit late here | 20:44 |
mrmartin | I write a memo for Stefano | 20:45 |
Evgeny | right | 20:45 |
Evgeny | Anyway - I think we are good to deploy | 20:45 |
Evgeny | perhaps what can be changed - is wording on the "registration" page (with email and screen name) | 20:45 |
Evgeny | as not all Google accounts may be recoverable | 20:46 |
Evgeny | - using email as a link is an option | 20:46 |
Evgeny | let me see. | 20:46 |
Evgeny | mrmartin: I can make this part correctly by Monday | 20:47 |
mrmartin | ok, great | 20:48 |
*** shakamunyi has joined #openstack-community | 20:48 | |
mrmartin | great, email sent | 20:52 |
mrmartin | have a nice weekend there | 20:52 |
Evgeny | thank you, you too. | 20:53 |
*** mrmartin has quit IRC | 21:01 | |
*** shakamunyi has quit IRC | 21:03 | |
*** shakamunyi has joined #openstack-community | 21:22 | |
*** Evgeny has quit IRC | 21:29 | |
*** DrBacchus has quit IRC | 21:35 | |
*** Piet has joined #openstack-community | 21:46 | |
*** shakamunyi has quit IRC | 22:04 | |
*** barra204 has joined #openstack-community | 22:05 | |
*** EmilienM is now known as EmilienM|afk | 22:08 | |
*** cdent has quit IRC | 22:23 | |
*** annegentle has quit IRC | 22:23 | |
*** annegentle has joined #openstack-community | 22:36 | |
*** julim has joined #openstack-community | 22:44 | |
*** annegentle has quit IRC | 23:09 | |
*** packet has quit IRC | 23:15 | |
*** barra204 has quit IRC | 23:22 | |
*** electrocucaracha has joined #openstack-community | 23:22 | |
*** electrocucaracha has quit IRC | 23:28 | |
*** mattgriffin has quit IRC | 23:28 | |
*** electrocucaracha has joined #openstack-community | 23:29 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!