| *** galstrom_zzz is now known as galstrom | 00:01 | |
| *** jduhamel has quit IRC | 00:05 | |
| *** anniec has quit IRC | 00:07 | |
| *** anniec has joined #openstack-dev | 00:07 | |
| *** Ryan_Lane has quit IRC | 00:11 | |
| *** Ryan_Lane has joined #openstack-dev | 00:11 | |
| *** anniec has quit IRC | 00:12 | |
| *** galstrom is now known as galstrom_zzz | 00:13 | |
| *** faramir has joined #openstack-dev | 00:14 | |
| *** anniec has joined #openstack-dev | 00:14 | |
| *** hemna has quit IRC | 00:16 | |
| *** shanewang_away is now known as shanewang | 00:24 | |
| *** otherwiseguy has joined #openstack-dev | 00:29 | |
| *** galstrom_zzz is now known as galstrom | 00:31 | |
| *** Ryan_Lane has quit IRC | 00:32 | |
| *** xarses has quit IRC | 00:41 | |
| *** SumitNaiksatam has quit IRC | 00:42 | |
| *** reed_ is now known as reed | 00:46 | |
| *** reed has joined #openstack-dev | 00:46 | |
| *** sballe_ has quit IRC | 00:49 | |
| *** sballe_ has joined #openstack-dev | 00:49 | |
| *** nosnos has joined #openstack-dev | 00:53 | |
| *** dina_belova has joined #openstack-dev | 00:54 | |
| *** gyee has quit IRC | 00:54 | |
| *** matiu has quit IRC | 00:55 | |
| *** galstrom is now known as galstrom_zzz | 00:57 | |
| *** rfolco has joined #openstack-dev | 00:57 | |
| *** dina_belova has quit IRC | 00:58 | |
| *** michchap has joined #openstack-dev | 00:59 | |
| *** sthaha has joined #openstack-dev | 00:59 | |
| *** gongysh has quit IRC | 01:02 | |
| *** martyntaylor has quit IRC | 01:04 | |
| *** angdraug has quit IRC | 01:05 | |
| *** Mandell has quit IRC | 01:05 | |
| *** changbl has joined #openstack-dev | 01:09 | |
| morganfainberg | jamielennox, sorry back now | 01:09 |
|---|---|---|
| morganfainberg | jamielennox, if you're here | 01:09 |
| jamielennox | morganfainberg: yep | 01:09 |
| *** galstrom_zzz is now known as galstrom | 01:09 | |
| morganfainberg | jamielennox, so atiwari brought up an interesting point | 01:09 |
| morganfainberg | jamielennox, looks like check and validate tokens in keystone are returning 401s instead of 404s if the check/validate fails | 01:10 |
| morganfainberg | jamielennox, am i wrong in understanding the auth_token middleware then re-requests it's "admin" token on a 401? | 01:10 |
| *** xarses has joined #openstack-dev | 01:11 | |
| jamielennox | morganfainberg: off the top of my head i think that is correct | 01:12 |
| *** erkules_ has joined #openstack-dev | 01:12 | |
| jamielennox | a 401 says that the token you are using to validate is not good | 01:12 |
| morganfainberg | jamielennox, yeah, so it's a bug. | 01:12 |
| jamielennox | so you should re-fetch an admin token and try again | 01:12 |
| jamielennox | a 404 says that you are valid but the token you are authing is not there | 01:12 |
| morganfainberg | jamielennox, yep. thats what my understanding has been | 01:12 |
| *** freedomhui has joined #openstack-dev | 01:13 | |
| jamielennox | why is that a bug? | 01:13 |
| morganfainberg | jamielennox, the current behavior, not the way you describe | 01:13 |
| morganfainberg | as in, we should raise tokennotfound not unauthorized | 01:13 |
| *** rfolco has quit IRC | 01:14 | |
| morganfainberg | jamielennox, thanks. just making sure my understanding was sane. | 01:14 |
| *** erkules has quit IRC | 01:14 | |
| jamielennox | token not found should be 404 right? | 01:15 |
| morganfainberg | yep | 01:15 |
| jamielennox | so you need to distinguish between the event that the admin token failed and the token you are checking failed | 01:15 |
| jamielennox | because validation is a priviledged operation | 01:15 |
| morganfainberg | that is handled by @protected decorator | 01:15 |
| morganfainberg | the issue is that the provider's validate_token methods cause 401s on TokenNotfound | 01:16 |
| jamielennox | if your admin token is expired and all of a sudden it just starts showing 404s instead of 401s then it will assume that the token you are validating is bad | 01:16 |
| morganfainberg | this appears to have been introduced (in v3 auth) at the v3 auth inception. | 01:16 |
| *** anniec has quit IRC | 01:16 | |
| morganfainberg | right. @protected decorator should cause 401s | 01:17 |
| morganfainberg | on invalid token. | 01:17 |
| *** trey_h has joined #openstack-dev | 01:17 | |
| jamielennox | on invalid admin token | 01:17 |
| morganfainberg | yes | 01:17 |
| morganfainberg | @protected doesn't care about X-Subject-Token | 01:17 |
| morganfainberg | it cares about the auth token | 01:17 |
| morganfainberg | validate_token et al, should care about x-subject-token (v3 terminology) | 01:18 |
| morganfainberg | in v2, token we care about is from the URI, not the x-auth-token header | 01:18 |
| morganfainberg | in valiate_token/check_token that is | 01:18 |
| morganfainberg | validate* | 01:18 |
| *** yongli_going_hom is now known as yongli | 01:19 | |
| *** anniec has joined #openstack-dev | 01:19 | |
| *** gongysh has joined #openstack-dev | 01:19 | |
| jamielennox | ok, so you're saying that an invalid x-subject-token is returning a 401? | 01:20 |
| morganfainberg | yep | 01:21 |
| jamielennox | hmmm | 01:21 |
| jamielennox | that's tough | 01:21 |
| morganfainberg | that appears to have always been the case in v3 | 01:21 |
| jamielennox | because you can't really return a 404 from /v3/auth/tokens | 01:21 |
| jamielennox | the caching would go nuts | 01:21 |
| morganfainberg | how so? | 01:21 |
| jamielennox | sorry, not our caching | 01:22 |
| morganfainberg | oh | 01:22 |
| morganfainberg | right | 01:22 |
| morganfainberg | well, we should be tossing pragma-cache headers in | 01:22 |
| jamielennox | but in theory you should be able to run this via squid or something and it would work | 01:22 |
| morganfainberg | except.. that would be broken | 01:22 |
| morganfainberg | always | 01:22 |
| *** armax has left #openstack-dev | 01:22 | |
| morganfainberg | unless squid cared about the headers | 01:23 |
| morganfainberg | that would be a bad idea to cache that in either case. | 01:23 |
| jamielennox | it's a POST operation, it shouldn't touch it | 01:23 |
| *** waa has quit IRC | 01:23 | |
| *** SumitNaiksatam has joined #openstack-dev | 01:23 | |
| jamielennox | anyway whaterver | 01:23 |
| morganfainberg | right, but a get or head? | 01:23 |
| morganfainberg | x-subject-token is the important part of that request | 01:23 |
| jamielennox | it doesn't make sense to return 404 from /v3/auth/tokens IMO | 01:23 |
| morganfainberg | then how do you differentiate between a bad auth token and x-subject-token? | 01:24 |
| morganfainberg | same concern as with V2 | 01:24 |
| jamielennox | right | 01:24 |
| jamielennox | no idea :) | 01:24 |
| morganfainberg | and caching v3/auth/token on get/head unless you also looked at x-subject-token header would be tragic. | 01:25 |
| jamielennox | what happens now? a new admin token is being called for every time a token is missed? | 01:25 |
| morganfainberg | in v2, yes | 01:25 |
| jamielennox | in v3 | 01:25 |
| morganfainberg | middleware doesn't do v3 iirc | 01:25 |
| jamielennox | i think i've always set up PKI when using v3 | 01:25 |
| morganfainberg | most people do. | 01:25 |
| jamielennox | umm, it can i think | 01:25 |
| morganfainberg | well then it would have the same behavior | 01:26 |
| morganfainberg | new admin token on each invalid token | 01:26 |
| jamielennox | actually, no it can deal with v2 tokens but it always sends them over the v2 api | 01:26 |
| jamielennox | v3 tokens | 01:26 |
| morganfainberg | right. | 01:26 |
| morganfainberg | which results in some odd data mismatching. | 01:26 |
| morganfainberg | but, nothing serious | 01:26 |
| morganfainberg | or even relevant in this case. | 01:27 |
| *** krtaylor has quit IRC | 01:28 | |
| morganfainberg | jamielennox, also: https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#404-not-found | 01:28 |
| jamielennox | sorry, i confused that - it can talk to the v3 api it's just it can only have a v2 admin token | 01:28 |
| *** sld has quit IRC | 01:28 | |
| morganfainberg | jamielennox, ah. in either case. 401 = new admin token (as i understand) | 01:28 |
| jamielennox | yes | 01:29 |
| jamielennox | it's the verify_uuid_token function | 01:29 |
| morganfainberg | yep | 01:29 |
| morganfainberg | our spec (also) says the current behavior of keystone is wrong. | 01:29 |
| morganfainberg | i think. | 01:29 |
| jamielennox | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/middleware/auth_token.py#L1057 | 01:29 |
| morganfainberg | ah ys | 01:29 |
| morganfainberg | got it | 01:29 |
| *** dkehn has quit IRC | 01:30 | |
| morganfainberg | i'm going to open a bug since atiwari didn't and see what can be done about it. this seems like a sub-optimal behavior and could cause excess token churn/failures | 01:31 |
| morganfainberg | erm. just token churn | 01:31 |
| jamielennox | so the v3 api says that | 01:32 |
| *** jasondotstar has joined #openstack-dev | 01:32 | |
| morganfainberg | and v2 until recently, didn't do this. | 01:32 |
| jamielennox | The Identity service will return the exact same response as when the subject token was issued by POST /auth/tokens. | 01:32 |
| jamielennox | that's for get /auth/tokens | 01:32 |
| morganfainberg | hrm. | 01:32 |
| jamielennox | and POST /auth/tokens only mentions a 401 | 01:32 |
| morganfainberg | hrm. | 01:33 |
| morganfainberg | right. | 01:33 |
| morganfainberg | i'm thinking this is an unclear spec :P | 01:33 |
| *** marun has quit IRC | 01:33 | |
| morganfainberg | is the "same response" meant to be if the token validates? | 01:33 |
| morganfainberg | or in _all_ cases. | 01:33 |
| jamielennox | well i would suggest it was interpretted as all cases | 01:33 |
| jamielennox | because you get a 401 in the event of failure | 01:34 |
| jamielennox | which is the same as specified by POST /auth/tokesn | 01:34 |
| jamielennox | IMO i think we modify the spec to say that in the event of x-subject-token failure we return a 403 | 01:34 |
| jamielennox | This status code is returned when the request is successfully authenticated but not authorized to perform the requested action. | 01:34 |
| morganfainberg | that is a good option | 01:34 |
| jamielennox | not authorized is not quite correct | 01:35 |
| *** dkehn has joined #openstack-dev | 01:35 | |
| jamielennox | but it says yes, you passed the correct auth-token just the x-subject-token is wrong | 01:35 |
| morganfainberg | except this is more of a 404 instance | 01:35 |
| jamielennox | i'm not a fan of returning a 404 from a valid url | 01:36 |
| *** danwent has quit IRC | 01:36 | |
| morganfainberg | jamielennox, we should use 402, payment required :P | 01:37 |
| jamielennox | especially one that is so publicly available | 01:37 |
| jamielennox | i really want a situation where i can use that | 01:37 |
| morganfainberg | i also legitimately want to use "I'm a teapot" 318 | 01:38 |
| morganfainberg | erm 418 | 01:38 |
| jamielennox | i would be interested in getting into the smart appliances sector, purely to build a kettle that could use it | 01:38 |
| morganfainberg | heheh | 01:38 |
| morganfainberg | sorry, i can't handle that request reason: I'm a teapot, | 01:39 |
| jamielennox | simply replace all 404 errors with 418s | 01:40 |
| morganfainberg | LOL | 01:40 |
| jamielennox | GET /bacon, sorry i'm a teapot | 01:40 |
| *** galstrom is now known as galstrom_zzz | 01:42 | |
| *** ericw has joined #openstack-dev | 01:44 | |
| *** dims has quit IRC | 01:45 | |
| *** ayoung has joined #openstack-dev | 01:51 | |
| *** dina_belova has joined #openstack-dev | 01:54 | |
| *** lnxnut has joined #openstack-dev | 01:55 | |
| ayoung | jamielennox, I'm not really here, just checking in before bed. Anything burning? | 01:55 |
| jamielennox | ayoung: no, i think it's all good | 01:55 |
| morganfainberg | ayoung, all quiet (for the moment) | 01:56 |
| *** sdake_ has quit IRC | 01:56 | |
| *** dina_belova has quit IRC | 01:58 | |
| *** sarob_ has joined #openstack-dev | 01:59 | |
| *** sarob has quit IRC | 01:59 | |
| *** d34dh0r53 has joined #openstack-dev | 01:59 | |
| *** comay has quit IRC | 02:00 | |
| *** d34dh0r53 has quit IRC | 02:01 | |
| *** freedomhui has quit IRC | 02:04 | |
| *** clayb has quit IRC | 02:04 | |
| *** ericw has quit IRC | 02:05 | |
| *** nati_ueno has quit IRC | 02:05 | |
| *** freedomhui has joined #openstack-dev | 02:08 | |
| *** jimjiang has joined #openstack-dev | 02:11 | |
| *** gongysh has quit IRC | 02:13 | |
| *** yaguang has joined #openstack-dev | 02:13 | |
| *** rcleere has joined #openstack-dev | 02:15 | |
| *** alop has joined #openstack-dev | 02:18 | |
| *** reed has quit IRC | 02:18 | |
| *** sarob_ has quit IRC | 02:20 | |
| *** sarob has joined #openstack-dev | 02:20 | |
| *** anniec has quit IRC | 02:25 | |
| *** galstrom_zzz is now known as galstrom | 02:29 | |
| *** markwash has joined #openstack-dev | 02:29 | |
| *** radsy has quit IRC | 02:31 | |
| ayoung | jamielennox, on https://etherpad.openstack.org/devstack-freeipa yeah, we would honor env vars in localrc of course | 02:31 |
| jamielennox | ayoung: i wasn't thinking so much honour them as just make ipa one means of providing that information into a generic system | 02:32 |
| ayoung | interesting... | 02:33 |
| jamielennox | so example when you want to put in certs you make IPA fill in a bunch of env variables containing cert data, but the deployment of certs is generic | 02:33 |
| ayoung | jamielennox, I was just talking devstack, but how would ipa provide anything, short of a DNS lookup | 02:33 |
| jamielennox | otherwise we're going to have a massive IPA section to devstack to maintain | 02:33 |
| ayoung | jamielennox, when you say IPA, you mean the ipa plugin to devstack? | 02:34 |
| jamielennox | plugin? i mean whatever the path would be through devstack for ipa | 02:34 |
| ayoung | deployment of certs is really not generic. | 02:34 |
| jamielennox | ayoung: why? | 02:34 |
| ayoung | jamielennox, certonger! | 02:34 |
| ayoung | ipa manages certs. It just needs to know about them | 02:34 |
| jamielennox | i don't think it makes sense for devstack | 02:34 |
| *** shang has joined #openstack-dev | 02:35 | |
| *** xchu has joined #openstack-dev | 02:35 | |
| ayoung | jamielennox, yes it does...if you think of devstack as the place where people learn how to set up and confiugre openstack | 02:35 |
| ayoung | plus it has to be in devstack for gating jobs to use it | 02:35 |
| jamielennox | so for example we set up a lot of env variables like IDENTITY_CERTFILE and IDENTITY_KEYFILE for {service}_{key} | 02:36 |
| jamielennox | putting the files into the correct place is then a generic operation | 02:36 |
| jamielennox | populating the variables is an IPA operation | 02:36 |
| jamielennox | same for kerberos | 02:36 |
| ayoung | jamielennox, in this case, it would take that info and pass it to Certmonger | 02:36 |
| *** shang has quit IRC | 02:37 | |
| *** shang has joined #openstack-dev | 02:37 | |
| jamielennox | does it have to be? | 02:37 |
| ayoung | jamielennox, wouldn't be much for the ipa part of devstack to do except to say "don't try to do this yourself" | 02:37 |
| ayoung | jamielennox, I am not saying that FreeIPA wopuld be required for devstack | 02:38 |
| *** galstrom is now known as galstrom_zzz | 02:38 | |
| ayoung | it would be optional, but, if triggerd, would use IPA to the utmost | 02:38 |
| jamielennox | i mean in an ideal situation it would but you can deploy certs from ipa without certmonger and you can use certmonger without ipa | 02:38 |
| *** schwicht has quit IRC | 02:40 | |
| *** yaguang has quit IRC | 02:40 | |
| ayoung | jamielennox, "same for Kerberos" I think that is the real issue. Without FreeIPA, Kerberos is a non-starter in a devstack environment | 02:40 |
| ayoung | I'm less concerned about the X509 side | 02:41 |
| jamielennox | why? | 02:41 |
| ayoung | devstack setting up Kerberos is ... | 02:41 |
| ayoung | insanity? | 02:41 |
| ayoung | wicked hard? | 02:41 |
| ayoung | ein bissel meshugie? | 02:41 |
| jamielennox | you need keytabs and krb5.conf stuff | 02:41 |
| jamielennox | are you talking about doing that one per service? | 02:42 |
| *** ericw has joined #openstack-dev | 02:42 | |
| ayoung | ipa-client-install handles that to start with. ipa-getkeytab simplifies it for additional services, too | 02:42 |
| ayoung | yes, one per service | 02:42 |
| jamielennox | i'm not saying we don't use that | 02:43 |
| jamielennox | i'm asking what would be required to provide that information manually, that we could then have IPA auto configure | 02:43 |
| *** edmund has joined #openstack-dev | 02:43 | |
| ayoung | jamielennox, so you are saying that you think the provisioning for the ipa case should be the same as the provisioning for the non-ipa case. I suspect that is actually harder than letting ipa-client and certmonger do their jobs | 02:44 |
| *** jbresnah has quit IRC | 02:44 | |
| *** unkown has joined #openstack-dev | 02:45 | |
| ayoung | We'd still need a mechanism to, say, fetch a cert from ipa and put it in place | 02:45 |
| *** ericw has quit IRC | 02:45 | |
| jamielennox | ayoung: right, but we'll need that anyway | 02:45 |
| ayoung | whic hexsts, but we would need a separate call out to it in the ipa case than in the non-ipa case...which probably does self signed | 02:45 |
| jamielennox | we don't' have to provide the non-ipa case, someone might wish to | 02:45 |
| ayoung | no, I mean the current way *is* the non ipa case...when the cert doesn't come from IPA, it has to be openssl generated | 02:46 |
| jamielennox | ok | 02:46 |
| jamielennox | i didn't realize devstack was generating that many certs, but good | 02:46 |
| *** markwash has quit IRC | 02:46 | |
| ayoung | yeah...or it is not setting up SSL at all. | 02:47 |
| ayoung | I am not sure which | 02:47 |
| jamielennox | so let's rephrase the question, what does it take to make the SSL cert stuff a 'plugin' | 02:47 |
| jamielennox | i'm not that familiar with devstack's internals but as i see it there are two ways to accomplish it | 02:48 |
| *** novas0x2a|laptop has quit IRC | 02:48 | |
| jamielennox | 1. have an actual plugin that gets called with 'generate a new cert for X' | 02:48 |
| ayoung | good question. I'd have to scan the code, but I suspect the answer is " a lot of shell scripting" and, for the IPA case, if that does not currently exist, we don't need to do it, either | 02:48 |
| jamielennox | 2. pregenerate a bunch of certificates and put them into ENV variables, and then use them iff they are set | 02:48 |
| ayoung | I have to admit I have learned and forgotten and relearned and reforgotten much of devstack | 02:49 |
| *** Shaan7 has quit IRC | 02:49 | |
| ayoung | not a bad idea, but lets keep that as a stretch goal. We can move that way if it looks easier to do. | 02:49 |
| jamielennox | if we can make it number 2 then to my mind it's easy | 02:49 |
| *** Shaan7 has joined #openstack-dev | 02:49 | |
| jamielennox | because you take either the openssl path, the ipa path, or neither | 02:50 |
| *** jasdeepH has quit IRC | 02:50 | |
| jamielennox | the handling/installing of certs is generic, the generation is done up front | 02:50 |
| ayoung | jamielennox, he look https://github.com/openstack-dev/devstack/commit/d98a5d0a58c1fae2ce8adcd8098cefaa9f558381 | 02:51 |
| jamielennox | bet they're regretting writing devstack in bash these days | 02:52 |
| ayoung | jamielennox, devstack sets up certificates for keystone pki, but I don't think it does ssl elsewhere | 02:52 |
| ayoung | jamielennox, beats Perl | 02:53 |
| ayoung | maybe | 02:53 |
| jamielennox | i've never done perl, but i'd suggest it doesn't | 02:53 |
| jamielennox | i mean i've read enough and know the arguments | 02:54 |
| jamielennox | there are throwbacks who really love perl but | 02:54 |
| *** dina_belova has joined #openstack-dev | 02:55 | |
| ayoung | personally, I hate all languages. Each for a different reason, of course | 02:55 |
| morganfainberg | ayoung, i'll take python over perl (at the very least) | 02:56 |
| jamielennox | do you know what the tls proxy in devstack is for? | 02:57 |
| ayoung | anyway, cert generation aside, jamielennox heh, I just found that too Only other place that seems to be doing openssl | 02:57 |
| ayoung | let see if git can tell us | 02:57 |
| *** alexxu has joined #openstack-dev | 02:57 | |
| ayoung | jamespage, commit c83a7e12 | 02:58 |
| jamielennox | i can see a good argument for saying i want to setup keystone/other service with this certificate | 02:58 |
| ayoung | specifically for Keystone | 02:58 |
| jamielennox | so you put IDENTITY_CERT in localrc | 02:58 |
| jamielennox | probably IDENTITY_CA and IDENTITY_KEY as well | 02:58 |
| jamielennox | same for all services | 02:58 |
| jamielennox | that is first challenge | 02:59 |
| *** yaguang has joined #openstack-dev | 02:59 | |
| *** dina_belova has quit IRC | 02:59 | |
| jamielennox | then you say, you asked to be setup with a freeipa server, let me just prefill all those {SERVICE}_{CERT|CA|KEY} variables for you | 02:59 |
| ayoung | jamielennox, so, It might end up being the same...if they are all running in an apache instance, just on different ports, I think they can share a cert. | 02:59 |
| jamielennox | ayoung: can, depends on what makes sense i guess | 03:00 |
| *** mjfork has quit IRC | 03:01 | |
| ayoung | jamielennox, ok, lets table this detail for now. I suspect that we will just skip it for the IPA case, as I think that lib/tls is not even used if Keystone is running in HTTPD, and you want the HTTPD server to provide SSL support | 03:01 |
| ayoung | So it would more likely be that lib/apache makes use of certmonger for ssl, otherwise, no ssl. | 03:02 |
| jamielennox | yea, i think lib/tls is going to be irrelevant with httpd | 03:02 |
| jamielennox | ayoung: allways uses certmonger? that seems extreme | 03:03 |
| ayoung | jamielennox, I mean that the IPA work is going to be the first to do this, so we will set it up with cermonger via ipa-cleint. If someone else wants to do more, they are welcome to | 03:04 |
| jamielennox | surely the first situation is going to be deploying with apache though, certmonger being the extension | 03:04 |
| *** stevemar has joined #openstack-dev | 03:05 | |
| ayoung | apache work is already done for keystone. We will leverage that. We will just have, as part of lib/ipa (or whatever) code that registers the httpds service, allocates the certificatre, and tells certmaonger to manage it. | 03:06 |
| ayoung | jamielennox, I think that when you run ipa-getcert, certmonger knows about it if the machine is an ipa-client | 03:07 |
| jamielennox | i don't know enough about how that works | 03:08 |
| jamielennox | if certmonger knows about it does that imply httpd knows somehow | 03:09 |
| *** pmathews has joined #openstack-dev | 03:09 | |
| ayoung | jamielennox, I have the advantage that I sit back to back with Nalin. He's basically certmonger maestro | 03:09 |
| jamielennox | i've seen it in use with IPA but not otherwise, and i don't remember how i set it up | 03:10 |
| *** ljjjustin has joined #openstack-dev | 03:10 | |
| jamielennox | i'm still not convinced that certmonger should be the default route for certs though | 03:10 |
| ayoung | actually , I need to figure out how to reissue the ipa servers HTTPS cert, as I am getting that "reissued certificate serial number" error now that I rebuilt or dev IPA server | 03:10 |
| ayoung | BTW, I rebuilt our dev ipa server | 03:11 |
| jamielennox | it seems like giving devstack even the option of using certs is first | 03:11 |
| ayoung | jamielennox, one of the reasons to use IPA is to make all of this easy | 03:11 |
| ayoung | certs, kerberos, ldap, dns | 03:11 |
| ayoung | centralized sudo and HBAC are add ons on top of that. | 03:12 |
| jamielennox | ayoung: i get that, the thing that i like most about ipa though is it more or less management of well known services, and there should be the option of using those without ipa | 03:12 |
| ayoung | jamielennox, there is no standardized way of getting certificates from a CA | 03:12 |
| *** KurtMartin has joined #openstack-dev | 03:13 | |
| ayoung | but, every way that is close to standardized is supported by cermonger | 03:13 |
| jamielennox | true | 03:13 |
| ayoung | I would say, use certmonger, even in the absence of IPA | 03:13 |
| *** xmltok has quit IRC | 03:14 | |
| ayoung | ok...I'm off to bed. Have to work tomorrow. | 03:14 |
| jamielennox | and i think that building certmonger into devstack is a good idea - it should be able to be independant of the freeipa stuff | 03:14 |
| jamielennox | ayoung: ok, good night | 03:14 |
| *** coolsvap has joined #openstack-dev | 03:16 | |
| *** alop has quit IRC | 03:17 | |
| *** jhesketh has joined #openstack-dev | 03:18 | |
| *** colinmcnamara has quit IRC | 03:19 | |
| *** unkown has quit IRC | 03:22 | |
| *** dims has joined #openstack-dev | 03:22 | |
| *** unkown has joined #openstack-dev | 03:22 | |
| *** prekarat has joined #openstack-dev | 03:22 | |
| *** markwash has joined #openstack-dev | 03:23 | |
| *** colinmcnamara has joined #openstack-dev | 03:23 | |
| *** jbresnah has joined #openstack-dev | 03:25 | |
| *** prekarat has quit IRC | 03:25 | |
| *** jasdeepH has joined #openstack-dev | 03:27 | |
| *** prekarat has joined #openstack-dev | 03:27 | |
| *** garyk1 has quit IRC | 03:30 | |
| *** prekarat has quit IRC | 03:31 | |
| *** prekarat has joined #openstack-dev | 03:31 | |
| *** shinylasers has quit IRC | 03:33 | |
| *** unkown has quit IRC | 03:37 | |
| *** sballe_ has quit IRC | 03:45 | |
| *** sballe_ has joined #openstack-dev | 03:46 | |
| *** xchu has quit IRC | 03:47 | |
| *** stevemar has quit IRC | 03:49 | |
| *** aditirav has joined #openstack-dev | 03:52 | |
| *** aditirav has quit IRC | 03:53 | |
| *** aditirav has joined #openstack-dev | 03:53 | |
| *** sridevi has joined #openstack-dev | 03:53 | |
| *** rcleere has quit IRC | 03:54 | |
| *** Mandell has joined #openstack-dev | 03:54 | |
| *** dina_belova has joined #openstack-dev | 03:55 | |
| *** sandywalsh has quit IRC | 03:56 | |
| *** KurtMartin has quit IRC | 03:59 | |
| *** dina_belova has quit IRC | 04:00 | |
| *** basha has joined #openstack-dev | 04:00 | |
| *** nati_ueno has joined #openstack-dev | 04:01 | |
| *** pmathews has quit IRC | 04:03 | |
| *** sumanthns has joined #openstack-dev | 04:04 | |
| *** danwent has joined #openstack-dev | 04:06 | |
| *** tsmithgc has quit IRC | 04:06 | |
| *** edmund1 has joined #openstack-dev | 04:12 | |
| *** edmund has quit IRC | 04:12 | |
| *** sridevi has quit IRC | 04:12 | |
| *** sthaha has quit IRC | 04:14 | |
| *** ljjjustin has quit IRC | 04:14 | |
| *** sushils has quit IRC | 04:15 | |
| *** torgomatic has quit IRC | 04:15 | |
| *** lnxnut has quit IRC | 04:15 | |
| *** yaguang has quit IRC | 04:17 | |
| *** torgomatic has joined #openstack-dev | 04:17 | |
| *** xchu has joined #openstack-dev | 04:18 | |
| *** yongli has quit IRC | 04:20 | |
| *** stevemar has joined #openstack-dev | 04:24 | |
| *** jhesketh_ has quit IRC | 04:24 | |
| *** xchu has quit IRC | 04:25 | |
| *** jhesketh_ has joined #openstack-dev | 04:25 | |
| *** yaguang has joined #openstack-dev | 04:34 | |
| *** freedomhui has quit IRC | 04:36 | |
| *** sandywalsh has joined #openstack-dev | 04:39 | |
| *** Mandell has quit IRC | 04:41 | |
| *** xchu has joined #openstack-dev | 04:42 | |
| *** hemna has joined #openstack-dev | 04:43 | |
| *** amotoki has joined #openstack-dev | 04:45 | |
| *** bashok has joined #openstack-dev | 04:46 | |
| *** Ruetobas has quit IRC | 04:48 | |
| *** jergerber has joined #openstack-dev | 04:49 | |
| *** sridevi has joined #openstack-dev | 04:54 | |
| *** colinmcnamara has quit IRC | 04:54 | |
| *** dina_belova has joined #openstack-dev | 04:56 | |
| *** nati_uen_ has joined #openstack-dev | 04:57 | |
| *** sarob has quit IRC | 04:57 | |
| *** sarob has joined #openstack-dev | 04:57 | |
| *** dina_belova has quit IRC | 04:58 | |
| *** dina_bel_ has joined #openstack-dev | 04:58 | |
| *** dina_bel_ has quit IRC | 04:58 | |
| *** yongli has joined #openstack-dev | 04:59 | |
| *** sarob has quit IRC | 05:02 | |
| *** trey_h has quit IRC | 05:07 | |
| *** trey_h has joined #openstack-dev | 05:07 | |
| *** jimfehlig has quit IRC | 05:09 | |
| *** sarob has joined #openstack-dev | 05:11 | |
| *** neoXsys has quit IRC | 05:12 | |
| *** trey_h has quit IRC | 05:12 | |
| *** terriyu has quit IRC | 05:15 | |
| *** freedomhui has joined #openstack-dev | 05:16 | |
| *** sarob has quit IRC | 05:16 | |
| *** sushils has joined #openstack-dev | 05:16 | |
| *** Ryan_Lane has joined #openstack-dev | 05:20 | |
| *** freedomhui has quit IRC | 05:25 | |
| *** kushal has joined #openstack-dev | 05:26 | |
| *** neoXsys has joined #openstack-dev | 05:27 | |
| *** aditirav has quit IRC | 05:27 | |
| *** aditirav has joined #openstack-dev | 05:28 | |
| *** hemna has quit IRC | 05:31 | |
| *** xchu has quit IRC | 05:31 | |
| *** jasdeepH has quit IRC | 05:31 | |
| *** jcoufal has joined #openstack-dev | 05:32 | |
| *** nati_ueno has quit IRC | 05:33 | |
| *** kaushikc has joined #openstack-dev | 05:33 | |
| *** nati_ueno has joined #openstack-dev | 05:34 | |
| *** kushal has quit IRC | 05:35 | |
| *** AnilV4 has joined #openstack-dev | 05:36 | |
| *** xchu has joined #openstack-dev | 05:43 | |
| *** bashok has quit IRC | 05:44 | |
| *** bashok has joined #openstack-dev | 05:44 | |
| *** kushal has joined #openstack-dev | 05:46 | |
| *** garyk has joined #openstack-dev | 05:49 | |
| *** Mandell has joined #openstack-dev | 05:54 | |
| *** zaitcev has quit IRC | 05:55 | |
| *** erkules_ is now known as erkules | 05:55 | |
| *** Brainspa1kle is now known as Brainspackle | 05:56 | |
| *** kaushikc has quit IRC | 05:58 | |
| *** kaushikc has joined #openstack-dev | 05:59 | |
| *** dina_belova has joined #openstack-dev | 05:59 | |
| *** marios has joined #openstack-dev | 05:59 | |
| *** edmund1 has quit IRC | 06:02 | |
| *** dina_belova has quit IRC | 06:03 | |
| *** o_petit has joined #openstack-dev | 06:08 | |
| *** dina_belova has joined #openstack-dev | 06:09 | |
| *** o_petit has quit IRC | 06:09 | |
| *** stevemar has quit IRC | 06:10 | |
| *** danwent has quit IRC | 06:12 | |
| *** dina_belova has quit IRC | 06:13 | |
| *** o_petit has joined #openstack-dev | 06:13 | |
| *** jtomasek has joined #openstack-dev | 06:14 | |
| *** odyssey4me has joined #openstack-dev | 06:16 | |
| *** sushils has quit IRC | 06:16 | |
| *** sushils has joined #openstack-dev | 06:18 | |
| *** vartom9 has joined #openstack-dev | 06:19 | |
| *** MaxV has joined #openstack-dev | 06:19 | |
| *** xchu has quit IRC | 06:20 | |
| *** gareth_kun has joined #openstack-dev | 06:20 | |
| *** mrunge has joined #openstack-dev | 06:21 | |
| *** nati_ueno_2 has joined #openstack-dev | 06:21 | |
| *** alexpilotti has quit IRC | 06:22 | |
| *** sarob has joined #openstack-dev | 06:22 | |
| *** bashok has quit IRC | 06:22 | |
| *** nati_ueno has quit IRC | 06:25 | |
| *** otherwiseguy has quit IRC | 06:27 | |
| *** sarob has quit IRC | 06:28 | |
| *** aditirav has quit IRC | 06:30 | |
| *** sushils has quit IRC | 06:31 | |
| *** xchu has joined #openstack-dev | 06:33 | |
| *** MaxV has quit IRC | 06:34 | |
| *** sushils has joined #openstack-dev | 06:37 | |
| *** asavu has joined #openstack-dev | 06:37 | |
| *** yolanda has joined #openstack-dev | 06:38 | |
| *** danwent has joined #openstack-dev | 06:39 | |
| *** jayg is now known as jayg|g0n3 | 06:42 | |
| *** jamielennox is now known as jamielennox|away | 06:48 | |
| *** jprovazn has joined #openstack-dev | 06:54 | |
| *** corXi has joined #openstack-dev | 06:57 | |
| *** o_petit has quit IRC | 06:57 | |
| *** o_petit has joined #openstack-dev | 06:58 | |
| *** safchain has joined #openstack-dev | 07:02 | |
| *** dina_belova has joined #openstack-dev | 07:04 | |
| *** dina_belova has quit IRC | 07:09 | |
| *** o_petit has quit IRC | 07:10 | |
| *** ifarkas has joined #openstack-dev | 07:11 | |
| *** alexpilotti has joined #openstack-dev | 07:13 | |
| *** sushils has quit IRC | 07:15 | |
| *** xga has joined #openstack-dev | 07:15 | |
| *** wfoster_away is now known as wfoster | 07:16 | |
| *** jaimegil has joined #openstack-dev | 07:24 | |
| *** ndipanov_gone is now known as ndipanov | 07:25 | |
| *** wfoster is now known as wfoster_away | 07:25 | |
| *** corXi has quit IRC | 07:25 | |
| *** MaxV has joined #openstack-dev | 07:28 | |
| *** jistr has joined #openstack-dev | 07:30 | |
| *** dina_belova has joined #openstack-dev | 07:31 | |
| *** danwent has quit IRC | 07:31 | |
| *** xga_ has joined #openstack-dev | 07:31 | |
| *** egallen has joined #openstack-dev | 07:32 | |
| *** bauzas has quit IRC | 07:32 | |
| *** bauzas has joined #openstack-dev | 07:32 | |
| *** wfoster_away is now known as wfoster | 07:32 | |
| *** xga has quit IRC | 07:33 | |
| *** o_petit has joined #openstack-dev | 07:34 | |
| *** jergerber has quit IRC | 07:35 | |
| *** JordanP has joined #openstack-dev | 07:37 | |
| *** flaper87|afk is now known as flaper87 | 07:38 | |
| *** mkerrin has quit IRC | 07:39 | |
| *** nati_uen_ has quit IRC | 07:39 | |
| *** asavu has quit IRC | 07:40 | |
| *** dina_belova has quit IRC | 07:40 | |
| *** dina_belova has joined #openstack-dev | 07:42 | |
| *** pixelbeat has joined #openstack-dev | 07:42 | |
| *** basha has quit IRC | 07:46 | |
| *** corXi has joined #openstack-dev | 07:46 | |
| *** xqueralt-afk is now known as xqueralt | 07:47 | |
| *** yassine has joined #openstack-dev | 07:47 | |
| *** mkerrin has joined #openstack-dev | 07:47 | |
| *** sridevi has quit IRC | 07:48 | |
| *** corXi_ has joined #openstack-dev | 07:48 | |
| *** corXi has quit IRC | 07:48 | |
| *** jpich has joined #openstack-dev | 07:49 | |
| *** boris-42 has joined #openstack-dev | 07:49 | |
| *** hoodow has quit IRC | 07:54 | |
| *** basha has joined #openstack-dev | 07:57 | |
| *** kaushikc has quit IRC | 07:58 | |
| *** vartom9 has quit IRC | 07:58 | |
| *** sld has joined #openstack-dev | 07:58 | |
| *** basha has quit IRC | 08:00 | |
| *** xga has joined #openstack-dev | 08:01 | |
| *** xchu has quit IRC | 08:03 | |
| *** xga_ has quit IRC | 08:04 | |
| *** asavu has joined #openstack-dev | 08:06 | |
| *** lucasagomes has joined #openstack-dev | 08:12 | |
| *** henrynash has joined #openstack-dev | 08:15 | |
| *** xchu has joined #openstack-dev | 08:16 | |
| *** alexpilotti has quit IRC | 08:17 | |
| *** bauzas is now known as sbauza | 08:21 | |
| *** sbauza is now known as bauzas | 08:23 | |
| *** dina_belova has quit IRC | 08:24 | |
| *** alexpilotti has joined #openstack-dev | 08:26 | |
| *** derekh has joined #openstack-dev | 08:32 | |
| *** eglynn has joined #openstack-dev | 08:34 | |
| *** mmagr has joined #openstack-dev | 08:37 | |
| *** asavu has quit IRC | 08:39 | |
| *** sushils has joined #openstack-dev | 08:44 | |
| *** ruhe has joined #openstack-dev | 08:44 | |
| *** Ryan_Lane has quit IRC | 08:47 | |
| *** ruhe has quit IRC | 08:48 | |
| *** Mandell has quit IRC | 08:50 | |
| *** shang has quit IRC | 08:51 | |
| *** doron_afk has joined #openstack-dev | 08:53 | |
| *** dkehn has quit IRC | 08:53 | |
| *** dkehn has joined #openstack-dev | 08:54 | |
| *** Ruetobas has joined #openstack-dev | 08:54 | |
| *** donaldh has joined #openstack-dev | 08:55 | |
| *** o_petit has quit IRC | 08:57 | |
| *** ruhe has joined #openstack-dev | 08:59 | |
| *** danpb has joined #openstack-dev | 08:59 | |
| *** wolfdreamer has quit IRC | 09:00 | |
| *** o_petit has joined #openstack-dev | 09:00 | |
| *** yolanda has quit IRC | 09:02 | |
| *** gareth_kun has left #openstack-dev | 09:09 | |
| *** egallen has quit IRC | 09:11 | |
| *** saschpe has quit IRC | 09:11 | |
| *** basha has joined #openstack-dev | 09:11 | |
| *** gmoro has quit IRC | 09:12 | |
| *** xchu has quit IRC | 09:12 | |
| *** ljjjustin has joined #openstack-dev | 09:13 | |
| *** kaushikc has joined #openstack-dev | 09:14 | |
| *** sridevi has joined #openstack-dev | 09:14 | |
| *** kaushikc has quit IRC | 09:14 | |
| *** egallen has joined #openstack-dev | 09:15 | |
| *** dina_belova has joined #openstack-dev | 09:22 | |
| *** Shaan7 has quit IRC | 09:24 | |
| *** gmoro has joined #openstack-dev | 09:24 | |
| *** sandywalsh has quit IRC | 09:26 | |
| *** xga_ has joined #openstack-dev | 09:29 | |
| *** alexpilotti has quit IRC | 09:30 | |
| *** gmoro has quit IRC | 09:30 | |
| *** xga has quit IRC | 09:32 | |
| *** faramir has quit IRC | 09:34 | |
| *** dina_belova has quit IRC | 09:35 | |
| *** CaptTofu has quit IRC | 09:38 | |
| *** CaptTofu has joined #openstack-dev | 09:39 | |
| *** alexpilotti has joined #openstack-dev | 09:42 | |
| *** CaptTofu has quit IRC | 09:44 | |
| *** yaguang has quit IRC | 09:44 | |
| *** gmoro has joined #openstack-dev | 09:46 | |
| *** prekarat has quit IRC | 09:52 | |
| *** prekarat has joined #openstack-dev | 09:55 | |
| *** martyntaylor has joined #openstack-dev | 09:57 | |
| *** alexpilotti_ has joined #openstack-dev | 09:57 | |
| *** dkehn_ has joined #openstack-dev | 09:57 | |
| *** prekarat1 has joined #openstack-dev | 09:57 | |
| *** prekarat1 has joined #openstack-dev | 09:58 | |
| *** prekarat has quit IRC | 09:59 | |
| *** alexpilotti has quit IRC | 10:00 | |
| *** alexpilotti_ is now known as alexpilotti | 10:00 | |
| *** pcm_ has joined #openstack-dev | 10:00 | |
| *** ljjjustin has quit IRC | 10:00 | |
| *** dkehn has quit IRC | 10:00 | |
| *** arezmerita_ has joined #openstack-dev | 10:01 | |
| *** dina_belova has joined #openstack-dev | 10:03 | |
| *** Ruetobas has quit IRC | 10:03 | |
| *** sballe has joined #openstack-dev | 10:04 | |
| *** sballe_ has quit IRC | 10:06 | |
| *** sballe_ has joined #openstack-dev | 10:07 | |
| *** mjfork has joined #openstack-dev | 10:08 | |
| *** o_petit has quit IRC | 10:09 | |
| *** sballe has quit IRC | 10:11 | |
| *** toabctl has quit IRC | 10:15 | |
| *** ruhe has quit IRC | 10:17 | |
| *** kushal has quit IRC | 10:17 | |
| basha | Hey can someone please review https://review.openstack.org/#/c/44843/ | 10:17 |
| *** toabctl has joined #openstack-dev | 10:17 | |
| *** wfoster is now known as wfoster_away | 10:20 | |
| *** ruhe has joined #openstack-dev | 10:20 | |
| *** kaushikc has joined #openstack-dev | 10:22 | |
| *** kushal has joined #openstack-dev | 10:23 | |
| *** kaushikc has quit IRC | 10:25 | |
| *** kaushikc has joined #openstack-dev | 10:25 | |
| sshturm | jd__: Could you please review a patch that fixed wrong downgrade in migrations? https://review.openstack.org/#/c/45410/ | 10:29 |
| *** romcheg has joined #openstack-dev | 10:31 | |
| *** ruhe has quit IRC | 10:32 | |
| *** xga_ has quit IRC | 10:32 | |
| *** pcm_ has quit IRC | 10:32 | |
| *** pcm_ has joined #openstack-dev | 10:33 | |
| *** dkehn__ has joined #openstack-dev | 10:35 | |
| *** dkehn_ has quit IRC | 10:39 | |
| *** jaimegil has quit IRC | 10:39 | |
| *** xga has joined #openstack-dev | 10:39 | |
| *** jruzicka has joined #openstack-dev | 10:41 | |
| *** sergmelikyan has joined #openstack-dev | 10:41 | |
| sergmelikyan | join #openstack-infra | 10:41 |
| *** romcheg has quit IRC | 10:42 | |
| *** romcheg has joined #openstack-dev | 10:43 | |
| *** anniec has joined #openstack-dev | 10:43 | |
| *** anniec_ has joined #openstack-dev | 10:46 | |
| *** vkmc has joined #openstack-dev | 10:47 | |
| *** anniec has quit IRC | 10:48 | |
| *** anniec_ is now known as anniec | 10:48 | |
| *** kushal has quit IRC | 10:50 | |
| *** sergmelikyan has quit IRC | 10:53 | |
| *** markvoelker has quit IRC | 10:54 | |
| *** vartom7 has joined #openstack-dev | 10:56 | |
| *** kaushikc has quit IRC | 11:01 | |
| *** dkehn__ has quit IRC | 11:03 | |
| *** dkehn__ has joined #openstack-dev | 11:04 | |
| *** vartom7 has quit IRC | 11:04 | |
| *** markvoelker has joined #openstack-dev | 11:07 | |
| *** saschpe_ has joined #openstack-dev | 11:08 | |
| *** o_petit has joined #openstack-dev | 11:10 | |
| *** mrunge has quit IRC | 11:11 | |
| *** kbringard has joined #openstack-dev | 11:13 | |
| *** o_petit has quit IRC | 11:14 | |
| *** gmoro has quit IRC | 11:14 | |
| *** ruhe has joined #openstack-dev | 11:17 | |
| *** mrunge has joined #openstack-dev | 11:19 | |
| *** CaptTofu has joined #openstack-dev | 11:20 | |
| *** kaushikc has joined #openstack-dev | 11:20 | |
| *** sridevi has quit IRC | 11:20 | |
| *** o_petit has joined #openstack-dev | 11:23 | |
| *** kaushikc has quit IRC | 11:25 | |
| *** kaushikc has joined #openstack-dev | 11:25 | |
| *** gmoro has joined #openstack-dev | 11:26 | |
| *** nosnos has quit IRC | 11:29 | |
| *** kaushikc has quit IRC | 11:29 | |
| *** kaushikc has joined #openstack-dev | 11:30 | |
| *** martyntaylor1 has joined #openstack-dev | 11:30 | |
| *** martyntaylor has quit IRC | 11:31 | |
| *** AnilV4 has quit IRC | 11:32 | |
| *** rcrit has quit IRC | 11:36 | |
| *** jayg|g0n3 is now known as jayg | 11:38 | |
| *** zbitter has joined #openstack-dev | 11:41 | |
| *** kaushikc has quit IRC | 11:43 | |
| *** zaneb has quit IRC | 11:43 | |
| *** wfoster_away is now known as wfoster | 11:43 | |
| *** FunnyLookinHat has joined #openstack-dev | 11:46 | |
| *** FunnyLookinHat has joined #openstack-dev | 11:46 | |
| *** rcrit has joined #openstack-dev | 11:49 | |
| *** lucasagomes is now known as lucas-hungry | 11:50 | |
| *** kaushikc has joined #openstack-dev | 11:50 | |
| *** dkranz has quit IRC | 11:51 | |
| *** zbitter is now known as zaneb | 11:51 | |
| *** asalkeld has quit IRC | 11:55 | |
| *** mkollaro has joined #openstack-dev | 11:59 | |
| *** mrunge has quit IRC | 12:00 | |
| *** adalbas has quit IRC | 12:01 | |
| *** coolsvap has quit IRC | 12:02 | |
| *** sridevi has joined #openstack-dev | 12:02 | |
| *** dolphm has joined #openstack-dev | 12:03 | |
| *** anteaya has joined #openstack-dev | 12:04 | |
| *** bashok has joined #openstack-dev | 12:05 | |
| *** wfoster is now known as wfoster_brb | 12:06 | |
| *** ruhe has quit IRC | 12:07 | |
| *** safchain_ has joined #openstack-dev | 12:08 | |
| *** terryh has joined #openstack-dev | 12:09 | |
| *** safchain has quit IRC | 12:11 | |
| *** rfolco has joined #openstack-dev | 12:12 | |
| *** rfolco has quit IRC | 12:13 | |
| *** ruhe has joined #openstack-dev | 12:15 | |
| *** ruhe has quit IRC | 12:16 | |
| *** terryh has quit IRC | 12:16 | |
| *** adalbas has joined #openstack-dev | 12:18 | |
| *** waa has joined #openstack-dev | 12:18 | |
| *** gordc has joined #openstack-dev | 12:19 | |
| *** dkehn has joined #openstack-dev | 12:21 | |
| *** dkehn__ has quit IRC | 12:22 | |
| *** ruhe has joined #openstack-dev | 12:25 | |
| *** mmagr has quit IRC | 12:25 | |
| *** drewlander has joined #openstack-dev | 12:26 | |
| *** drewlander has quit IRC | 12:26 | |
| *** drewlander has joined #openstack-dev | 12:27 | |
| *** annegentle has quit IRC | 12:27 | |
| *** terryh has joined #openstack-dev | 12:28 | |
| *** schwicht has joined #openstack-dev | 12:28 | |
| *** mmagr has joined #openstack-dev | 12:29 | |
| *** terryh has quit IRC | 12:29 | |
| *** para__ has joined #openstack-dev | 12:30 | |
| *** terryh has joined #openstack-dev | 12:30 | |
| *** tmclaugh[work] has joined #openstack-dev | 12:30 | |
| *** dvarga has joined #openstack-dev | 12:31 | |
| *** terryh has quit IRC | 12:31 | |
| *** terryh has joined #openstack-dev | 12:33 | |
| *** terryh has quit IRC | 12:33 | |
| *** morazi has joined #openstack-dev | 12:35 | |
| *** sridevi has quit IRC | 12:39 | |
| *** imsurit has joined #openstack-dev | 12:39 | |
| *** bknudson has joined #openstack-dev | 12:40 | |
| *** ruhe_ has joined #openstack-dev | 12:42 | |
| *** ruhe has quit IRC | 12:43 | |
| *** sballe_ has quit IRC | 12:43 | |
| *** enikanorov-w has joined #openstack-dev | 12:44 | |
| *** sballe_ has joined #openstack-dev | 12:44 | |
| *** odyssey4me has quit IRC | 12:47 | |
| *** markmcclain has quit IRC | 12:47 | |
| *** roz has joined #openstack-dev | 12:49 | |
| *** roz is now known as AndreaRosa | 12:49 | |
| *** kaushikc has quit IRC | 12:49 | |
| *** kaushikc has joined #openstack-dev | 12:50 | |
| *** sballe_ has quit IRC | 12:52 | |
| *** lbragstad has joined #openstack-dev | 12:53 | |
| AndreaRosa | I am putting an import pdb; pdb.set_trace() in a test, I'd like to run it (using tox or run_test) and enter in the pbr, is that possible? | 12:54 |
| *** jistr has quit IRC | 12:55 | |
| AndreaRosa | I mean pdb | 12:55 |
| *** networkstatic has quit IRC | 12:56 | |
| *** kaushikc has quit IRC | 12:56 | |
| *** jistr has joined #openstack-dev | 12:56 | |
| *** spzala has joined #openstack-dev | 12:56 | |
| *** sumanthns has quit IRC | 12:57 | |
| *** dprince has joined #openstack-dev | 12:58 | |
| dolphm | ayoung: this isn't an LDAP vs AD issue, is it? https://bugs.launchpad.net/keystone/+bug/1210141 | 13:00 |
| uvirtbot | Launchpad bug 1210141 in keystone "LDAP identity provider fails when using samAccountName" [Medium,Triaged] | 13:00 |
| *** annegentle has joined #openstack-dev | 13:01 | |
| *** lucas-hungry is now known as lucasagomes | 13:01 | |
| *** pcm__ has joined #openstack-dev | 13:03 | |
| *** pcm__ has quit IRC | 13:04 | |
| *** blentz has joined #openstack-dev | 13:04 | |
| *** pcm__ has joined #openstack-dev | 13:05 | |
| *** stevemar has joined #openstack-dev | 13:05 | |
| *** pcm_ has quit IRC | 13:06 | |
| dolphm | chmouel: mind if i assign you bug 1210515? | 13:09 |
| uvirtbot | Launchpad bug 1210515 in keystone "keystone chokes on empty "description" field in active directory" [Medium,Triaged] https://launchpad.net/bugs/1210515 | 13:09 |
| AndreaRosa | run_tests -d it works, my problem is on a specific test...debugging it. thanks | 13:10 |
| chmouel | dolphm: i think i am assigned already :) | 13:10 |
| dolphm | chmouel: so you are. ;) | 13:10 |
| *** ctlaugh_ has joined #openstack-dev | 13:10 | |
| *** ctlaugh has quit IRC | 13:11 | |
| *** dina_belova has quit IRC | 13:11 | |
| *** markmcclain has joined #openstack-dev | 13:13 | |
| *** dstanek has joined #openstack-dev | 13:14 | |
| henrynash | dolphm: quick question….in the V2 identity controller there are some Diablo CRUD "extensions" for getting and creating role_refs…..I assume we still need to support these (I noticed we don't test them anywhere!) | 13:14 |
| dolphm | henrynash: test_keystoneclient doesn't hit that stuff? | 13:15 |
| henrynash | dolphm:let me check | 13:15 |
| dolphm | henrynash: line 1030 ish | 13:16 |
| dolphm | henrynash: first few tests in KcEssex3TestCase | 13:16 |
| henrynash | dolphm: oops, sorry my search filter was wrong…. | 13:17 |
| henrynash | dolphm: …and I assume support is still required… | 13:17 |
| *** bashok has quit IRC | 13:17 | |
| henrynash | dolphm: just rationalising where I need to make changes for the bug in list/get user projects | 13:17 |
| dolphm | henrynash: yeah, i'd like to consider it deprecated though, if possible | 13:18 |
| *** imsurit has quit IRC | 13:18 | |
| *** yaguang has joined #openstack-dev | 13:19 | |
| henrynash | dolphm: ok | 13:19 |
| *** maheshp has joined #openstack-dev | 13:19 | |
| *** maheshp1 has joined #openstack-dev | 13:19 | |
| dolphm | henrynash: maybe in icehouse-1 we can add deprecation warnings to all of the v2 controller methods? | 13:20 |
| *** stevemar has quit IRC | 13:20 | |
| henrynash | dolphm: yes, I was thinking something like that…we haven't really made any statements on v2 yet | 13:20 |
| *** garyk has quit IRC | 13:22 | |
| dolphm | henrynash: if we do it in icehouse, then we can drop support as soon as K-1 | 13:22 |
| *** basha has quit IRC | 13:22 | |
| henrynash | dolphmL yep | 13:22 |
| *** egallen has quit IRC | 13:22 | |
| *** garyk has joined #openstack-dev | 13:22 | |
| henrynash | dolphm: feels about the right sort of time | 13:22 |
| dolphm | henrynash: i imagine we'll have to support /v2.0/tokens much longer though | 13:23 |
| dolphm | henrynash: but all the admin stuff can go ASAP | 13:23 |
| henrynash | dolphm: agreed | 13:23 |
| *** derekh has quit IRC | 13:23 | |
| dolphm | henrynash: i guess that's a blueprint worthy endeavor... i'll go file one | 13:24 |
| henrynash | dolphm: good plan | 13:24 |
| *** basha has joined #openstack-dev | 13:24 | |
| *** ctlaugh_ has quit IRC | 13:24 | |
| *** dims has quit IRC | 13:24 | |
| *** ctlaugh has joined #openstack-dev | 13:25 | |
| *** arezmerita has quit IRC | 13:25 | |
| *** arezmerita_ has quit IRC | 13:25 | |
| *** rushiagr has joined #openstack-dev | 13:27 | |
| *** eharney has joined #openstack-dev | 13:28 | |
| *** krtaylor has joined #openstack-dev | 13:29 | |
| *** derekh has joined #openstack-dev | 13:30 | |
| *** johnthetubaguy has joined #openstack-dev | 13:31 | |
| *** alunduil has quit IRC | 13:31 | |
| *** wfoster_brb is now known as wfoster | 13:31 | |
| dolphm | henrynash: https://blueprints.launchpad.net/keystone/+spec/deprecate-v2-api | 13:32 |
| *** o_petit has quit IRC | 13:33 | |
| *** sandywalsh_ has joined #openstack-dev | 13:34 | |
| *** sandywalsh has joined #openstack-dev | 13:34 | |
| *** sandywalsh_ has quit IRC | 13:36 | |
| *** sandywalsh has quit IRC | 13:37 | |
| *** dims has joined #openstack-dev | 13:38 | |
| *** prad has joined #openstack-dev | 13:40 | |
| *** hellome has quit IRC | 13:40 | |
| *** otherwiseguy has joined #openstack-dev | 13:40 | |
| *** hellome has joined #openstack-dev | 13:41 | |
| *** dina_belova has joined #openstack-dev | 13:43 | |
| *** jhesketh has quit IRC | 13:44 | |
| sdague | dtroyer: so I'm actually thinking that we could use a pep8 equiv for devstack, at least something to check basic indentation and whitespace things. Am I crazy for thinking about banging that out? | 13:46 |
| lxsli | Hi, please could I have eyes on https://review.openstack.org/#/c/45432/ ? Very small change | 13:47 |
| *** terryh has joined #openstack-dev | 13:48 | |
| dtroyer | sdague: not at all. I've thought that before too... | 13:48 |
| *** hartsocks has joined #openstack-dev | 13:48 | |
| *** hartsocks has left #openstack-dev | 13:48 | |
| *** tstevenson has joined #openstack-dev | 13:48 | |
| sdague | ok, well I'm putting it on my list :) | 13:48 |
| *** ruhe_ has quit IRC | 13:49 | |
| *** sballe has joined #openstack-dev | 13:49 | |
| sdague | maybe a good thing to hack on in new orleans at linux con when other things aren't going on | 13:49 |
| *** FunnyLookinHat has quit IRC | 13:49 | |
| *** radez_g0n3 is now known as radez | 13:51 | |
| *** athomas has quit IRC | 13:52 | |
| *** burt has joined #openstack-dev | 13:56 | |
| *** stevemar has joined #openstack-dev | 13:56 | |
| *** jhesketh has joined #openstack-dev | 13:57 | |
| *** trey_h has joined #openstack-dev | 13:58 | |
| *** athomas has joined #openstack-dev | 13:58 | |
| *** crazed has joined #openstack-dev | 13:59 | |
| *** xga_ has joined #openstack-dev | 14:01 | |
| *** dvarga_ has joined #openstack-dev | 14:01 | |
| *** tong|2 has joined #openstack-dev | 14:01 | |
| *** pcm_ has joined #openstack-dev | 14:01 | |
| *** dvarga has quit IRC | 14:03 | |
| *** prekarat1 has quit IRC | 14:03 | |
| *** doron_afk has quit IRC | 14:03 | |
| *** prekarat has joined #openstack-dev | 14:03 | |
| *** doron_afk has joined #openstack-dev | 14:03 | |
| *** pcm__ has quit IRC | 14:04 | |
| *** xga has quit IRC | 14:04 | |
| *** litong has quit IRC | 14:04 | |
| *** rcrit has quit IRC | 14:06 | |
| *** otherwiseguy has quit IRC | 14:10 | |
| *** dina_belova has quit IRC | 14:10 | |
| *** o_petit has joined #openstack-dev | 14:10 | |
| *** dkranz has joined #openstack-dev | 14:11 | |
| *** alunduil has joined #openstack-dev | 14:12 | |
| stevemar | dolphm: ping | 14:14 |
| *** dina_belova has joined #openstack-dev | 14:15 | |
| dolphm | stevemar: pong | 14:16 |
| dolphm | henrynash: this is now invalid, right? https://bugs.launchpad.net/keystone/+bug/1195019 | 14:16 |
| uvirtbot | Launchpad bug 1195019 in keystone "GET /role_assignments not supported on LDAP backend" [Wishlist,Triaged] | 14:16 |
| stevemar | dolphm: so, trying to recreate your bug (https://bugs.launchpad.net/keystone/+bug/1221418), can't at all =\ | 14:17 |
| uvirtbot | Launchpad bug 1221418 in keystone "creating duplicate users is allowed, MultipleResultsFound exception on auth" [Medium,Won't fix] | 14:17 |
| dolphm | stevemar: see my comment this morning | 14:17 |
| stevemar | ack | 14:17 |
| stevemar | dolphm: i didn't refresh the page this morning | 14:18 |
| dolphm | stevemar: i need to update the role one as well | 14:18 |
| *** trey_h has quit IRC | 14:18 | |
| dolphm | stevemar: i tried to repro against mysql and it doesn't seem possible, but i can repro against sqlite easily | 14:18 |
| dolphm | stevemar: and somehow sqlite has gotten worse | 14:18 |
| stevemar | dolphm: and I don't get launchpad emails right away for some reason, there is at least a 30 minute delay | 14:18 |
| stevemar | dolphm: alright, btw I wanted to show you an error i was getting this time around | 14:19 |
| *** rcrit has joined #openstack-dev | 14:19 | |
| *** jvrbanac has joined #openstack-dev | 14:19 | |
| *** sgordon has joined #openstack-dev | 14:20 | |
| stevemar | dolphm: http://paste.openstack.org/show/45910/ | 14:20 |
| dolphm | stevemar: well that's new | 14:21 |
| *** o_petit_ has joined #openstack-dev | 14:22 | |
| stevemar | dolphm: and not so good | 14:22 |
| *** mlavalle has joined #openstack-dev | 14:22 | |
| bknudson | why is that a 400? the request was fine. | 14:22 |
| dolphm | stevemar: that's not reproducible on master for me | 14:22 |
| *** hartsocks has joined #openstack-dev | 14:23 | |
| *** hartsocks has left #openstack-dev | 14:23 | |
| stevemar | dolphm: i did this last night at 1am, token format is UUID, that's the only change to devstack i made | 14:23 |
| *** clayb has joined #openstack-dev | 14:23 | |
| dolphm | stevemar: i have the same config against mysql | 14:24 |
| dolphm | stevemar: changed the username to something unique http://pasteraw.com/gom6szp72hdphwiuacvp0rvyvecns6a | 14:24 |
| *** o_petit has quit IRC | 14:24 | |
| dolphm | stevemar: http://pasteraw.com/c4pgfb02lmv610jjw7l3cclk9r4095q | 14:25 |
| stevemar | hmm | 14:26 |
| *** hemna has joined #openstack-dev | 14:26 | |
| *** basha has quit IRC | 14:26 | |
| *** dina_belova has quit IRC | 14:26 | |
| *** jcoufal_ has joined #openstack-dev | 14:28 | |
| *** thedodd has joined #openstack-dev | 14:28 | |
| *** markwash has quit IRC | 14:29 | |
| *** jcoufal has quit IRC | 14:30 | |
| *** souvik has joined #openstack-dev | 14:31 | |
| *** markmcclain has quit IRC | 14:31 | |
| *** prekarat has quit IRC | 14:32 | |
| *** o_petit_ has quit IRC | 14:34 | |
| *** dstanek has quit IRC | 14:35 | |
| med_ | have the 2013.2.b3 tags gone out yet? I'm not seeing them. | 14:37 |
| med_ | or is that close-of-biz today? | 14:37 |
| med_ | ttx, ^ | 14:38 |
| *** otherwiseguy has joined #openstack-dev | 14:38 | |
| *** rcrit has quit IRC | 14:38 | |
| *** wolfdreamer has joined #openstack-dev | 14:38 | |
| *** edmund has joined #openstack-dev | 14:38 | |
| ttx | med_: it's today. Looks like I'll push them out in 30min | 14:38 |
| *** alexpilotti has quit IRC | 14:38 | |
| med_ | thanks ttx | 14:38 |
| *** FunnyLookinHat has joined #openstack-dev | 14:41 | |
| *** ruhe has joined #openstack-dev | 14:41 | |
| *** jcoufal_ has quit IRC | 14:44 | |
| *** FunnyLookinHat has quit IRC | 14:45 | |
| *** jmontemayor has joined #openstack-dev | 14:46 | |
| *** FunnyLookinHat has joined #openstack-dev | 14:47 | |
| *** arezmerita has joined #openstack-dev | 14:48 | |
| *** markmcclain has joined #openstack-dev | 14:48 | |
| *** _TheDodd_ has joined #openstack-dev | 14:49 | |
| *** thedodd has quit IRC | 14:49 | |
| *** dina_belova has joined #openstack-dev | 14:49 | |
| *** sarob has joined #openstack-dev | 14:50 | |
| *** thedodd has joined #openstack-dev | 14:50 | |
| *** mmagr has quit IRC | 14:50 | |
| *** thedodd has quit IRC | 14:50 | |
| *** rcrit has joined #openstack-dev | 14:50 | |
| *** bashok has joined #openstack-dev | 14:51 | |
| *** Shaan7 has joined #openstack-dev | 14:51 | |
| *** rushiagr has quit IRC | 14:52 | |
| *** diogogmt has joined #openstack-dev | 14:52 | |
| *** _TheDodd_ has quit IRC | 14:53 | |
| *** thedodd has joined #openstack-dev | 14:53 | |
| *** matiu has joined #openstack-dev | 14:54 | |
| *** thedodd has quit IRC | 14:56 | |
| *** corXi_ has quit IRC | 14:57 | |
| *** pabelanger has quit IRC | 14:57 | |
| *** eglynn_ has joined #openstack-dev | 14:58 | |
| *** eglynn has quit IRC | 14:58 | |
| *** thedodd has joined #openstack-dev | 14:59 | |
| *** sarob has quit IRC | 14:59 | |
| *** jprovazn has quit IRC | 14:59 | |
| *** sarob has joined #openstack-dev | 14:59 | |
| *** sarob has quit IRC | 15:00 | |
| *** jasdeepH has joined #openstack-dev | 15:00 | |
| *** sarob has joined #openstack-dev | 15:00 | |
| *** sarob has quit IRC | 15:00 | |
| *** sarob has joined #openstack-dev | 15:01 | |
| *** colinmcnamara has joined #openstack-dev | 15:02 | |
| *** dstanek has joined #openstack-dev | 15:03 | |
| *** sarob has quit IRC | 15:05 | |
| *** maheshp1 has quit IRC | 15:06 | |
| *** jimfehlig has joined #openstack-dev | 15:06 | |
| *** armax has joined #openstack-dev | 15:08 | |
| *** sarob has joined #openstack-dev | 15:09 | |
| *** sarob has quit IRC | 15:09 | |
| *** sarob has joined #openstack-dev | 15:09 | |
| *** troytoman-away is now known as troytoman | 15:09 | |
| *** galstrom_zzz is now known as galstrom | 15:11 | |
| *** wfoster is now known as wfoster_away | 15:13 | |
| *** arezmerita has quit IRC | 15:15 | |
| *** bdpayne has quit IRC | 15:16 | |
| *** dina_bel_ has joined #openstack-dev | 15:18 | |
| *** ndipanov has quit IRC | 15:18 | |
| *** coolsvap has joined #openstack-dev | 15:20 | |
| *** ericw has joined #openstack-dev | 15:21 | |
| *** dina_belova has quit IRC | 15:22 | |
| *** rnirmal has joined #openstack-dev | 15:22 | |
| *** pmathews has joined #openstack-dev | 15:23 | |
| *** imsurit has joined #openstack-dev | 15:25 | |
| *** imsurit is now known as Guest27738 | 15:25 | |
| *** Guest27738 is now known as imsurit1 | 15:26 | |
| *** shinylasers has joined #openstack-dev | 15:29 | |
| *** hemna has quit IRC | 15:29 | |
| *** arezmerita has joined #openstack-dev | 15:30 | |
| *** shinylasers has quit IRC | 15:32 | |
| henrynash | dolphm: on https://bugs.launchpad.net/keystone/+bug/1195019 it is technically still an issue, although likely no longer such an issue….since with split-identity, you can have users/groups in ldap, but roles in sql…so the issue raised is only relevant if you want the assignment backend also in ldap….for which I think we are deficient in most v3 role APis (e.g. grants) | 15:32 |
| uvirtbot | Launchpad bug 1195019 in keystone "GET /role_assignments not supported on LDAP backend" [Wishlist,Invalid] | 15:32 |
| dolphm | henrynash: want to keep it open then? | 15:33 |
| *** svapneel has joined #openstack-dev | 15:33 | |
| *** sandeepr_ltp has joined #openstack-dev | 15:33 | |
| dolphm | henrynash: or supersede it with a broader wishlist item? | 15:33 |
| *** odyssey4me has joined #openstack-dev | 15:33 | |
| *** o_petit has joined #openstack-dev | 15:34 | |
| *** coolsvap has quit IRC | 15:34 | |
| henrynash | dolphm: let's go for a broader wish list - which is to decide what we do about ldap assigmnet backend….do we freeze it as is, bring it up to full capability, depreceite it etc. | 15:34 |
| dolphm | henrynash: ++ | 15:34 |
| henrynash | dolphm: want me to put that in? | 15:34 |
| dolphm | henrynash: sounds good | 15:35 |
| henrynash | dolphm: maybe that's a blueprint? | 15:35 |
| *** radez is now known as radez_g0n3 | 15:35 | |
| dolphm | henrynash: well, the decision should be a bp, not the fact that it's incomplete | 15:36 |
| *** bashok has quit IRC | 15:36 | |
| henrynash | dolphm: ok | 15:36 |
| dolphm | henrynash: .. if that makes any sense | 15:36 |
| *** pasquier-s has quit IRC | 15:36 | |
| *** xarses has quit IRC | 15:37 | |
| *** alop has joined #openstack-dev | 15:37 | |
| chmouel | dolphm: about https://bugs.launchpad.net/keystone/+bug/1221579 | 15:37 |
| uvirtbot | Launchpad bug 1221579 in keystone "Disabling a tenat with ldap does not seem to do much" [Undecided,Incomplete] | 15:37 |
| chmouel | i think we should just come back with an error right? | 15:38 |
| *** imsurit1 has quit IRC | 15:39 | |
| *** odyssey4me2 has joined #openstack-dev | 15:39 | |
| *** odyssey4me has quit IRC | 15:40 | |
| *** svapneel has quit IRC | 15:40 | |
| *** chenxu has joined #openstack-dev | 15:40 | |
| *** tstevenson has quit IRC | 15:40 | |
| chenxu | question: on dhcp-agent of neutron, RemoteError: Remote error: AgentNotFoundByTypeHost Agent with agent_type=DHCP agent and host=openstack-n1 could not be found | 15:41 |
| chenxu | where to look first? | 15:41 |
| chenxu | running trunk btw | 15:41 |
| *** thedodd has quit IRC | 15:41 | |
| *** thedodd has joined #openstack-dev | 15:42 | |
| crazed | so quantum was renamed to neutron in havana? | 15:42 |
| *** tstevenson has joined #openstack-dev | 15:42 | |
| *** hellome has quit IRC | 15:43 | |
| crazed | er wrong channel | 15:43 |
| *** bdpayne has joined #openstack-dev | 15:44 | |
| *** hellome has joined #openstack-dev | 15:44 | |
| *** cococafe has joined #openstack-dev | 15:44 | |
| *** insanidade has joined #openstack-dev | 15:45 | |
| *** o_petit_ has joined #openstack-dev | 15:45 | |
| *** dina_belova has joined #openstack-dev | 15:46 | |
| *** dina_bel_ has quit IRC | 15:47 | |
| *** yassine has quit IRC | 15:47 | |
| *** mrodden has joined #openstack-dev | 15:47 | |
| *** o_petit has quit IRC | 15:48 | |
| *** markmcclain has quit IRC | 15:48 | |
| henrynash | ayoung: ping | 15:49 |
| *** odyssey4me has joined #openstack-dev | 15:49 | |
| *** pabelanger has joined #openstack-dev | 15:49 | |
| *** dina_belova has quit IRC | 15:49 | |
| bknudson | henrynash: deprecate ldap assignment backend. | 15:49 |
| *** dina_belova has joined #openstack-dev | 15:49 | |
| insanidade | hi all. question: I'm trying to use a routar openstack still doesn't support. I have to write code so that that router's api can be invoked and responses are translated back into openstack. I understand that's an agent's responsability. As I don't understand the complete flow yet, I ask: do I have to create a new driver for that router and make the agent use that driver ? | 15:50 |
| henrynash | bknudson: is that proposal or a question ? | 15:50 |
| henrynash | bknudson: :-) | 15:50 |
| bknudson | henrynash: my opinion is it should be deprecated | 15:50 |
| henrynash | bknudson: I agree… | 15:50 |
| ayoung | henrynash, yeah | 15:51 |
| *** sarob has quit IRC | 15:51 | |
| ayoung | bknudson, I agree | 15:51 |
| *** odyssey4me2 has quit IRC | 15:51 | |
| henrynash | ayoung: question for you default project and membership role (which i kind of saw you in conversation about a while back) | 15:51 |
| ayoung | it is there to provide a migration path for people currently using LDAP for Identity. We can't cut them off, but it should not be a long term approach | 15:51 |
| *** ruhe has quit IRC | 15:52 | |
| henrynash | ayoung: I though a default project meant you would have (at least) the membership role on the project, no? | 15:52 |
| ayoung | henrynash, so the discussion was whether changing default shoud unenroll you. I say, no way Jose | 15:52 |
| ayoung | and it should enroll you, I think, as a streamline | 15:52 |
| ayoung | but removing it as your default project should not unenroll you | 15:52 |
| *** michchap has quit IRC | 15:53 | |
| *** terriyu has joined #openstack-dev | 15:53 | |
| ayoung | alternatively, we could force the user to explicitly enroll before changing default. | 15:53 |
| *** hellome has quit IRC | 15:53 | |
| ayoung | that would be consistent, but obnoxious. Hobgoblin. | 15:53 |
| *** odyssey4me has quit IRC | 15:53 | |
| henrynash | ayoung: I'm actually looking at a separate issue…which is, can you safely assume that if you want to respond to "list projects for suer" that we can just return any project that has a role for that user... | 15:54 |
| *** dina_belova has quit IRC | 15:54 | |
| *** egallen has joined #openstack-dev | 15:54 | |
| henrynash | ayoung: today the code (sometimes) also adds in the default project from the user record explicitly…that seems redundant to me | 15:54 |
| *** hellome has joined #openstack-dev | 15:54 | |
| *** matrohon has quit IRC | 15:55 | |
| *** aeperezt has joined #openstack-dev | 15:55 | |
| ayoung | henrynash, hmmm. does setting default role currently enroll the user? | 15:55 |
| henrynash | ayoung: yes | 15:55 |
| henrynash | ayoung: on create user, yes | 15:56 |
| ayoung | henrynash, how about update? | 15:56 |
| *** hellome has quit IRC | 15:56 | |
| ayoung | henrynash, so, to contradict myself, I would say that we should not enroll a user upon setting default. But we should allow a user to set their own default. | 15:57 |
| henrynash | ayoung: that was the bug that was in question to which you responded…what happens if you update the default project…and the fix was to indeed enrol you | 15:57 |
| henrynash | sorry gotta nip offline…will be back on line later to continue... | 15:57 |
| ayoung | henrynash, so, do you thin a user should be able to set their own default? | 15:57 |
| *** hellome has joined #openstack-dev | 15:58 | |
| *** o_petit_ has quit IRC | 15:58 | |
| *** danwent has joined #openstack-dev | 15:59 | |
| *** Ryan_Lane has joined #openstack-dev | 16:00 | |
| dtroyer | ayoung: fwiw, as a user I would like to choose the default…if I already am a member of the project. | 16:00 |
| ayoung | dtroyer, yep | 16:00 |
| ayoung | me too | 16:00 |
| ayoung | dtroyer, as a user of an OS cluster, I was messed up by that very issue on Wednesday | 16:00 |
| ayoung | All our accounts were created with a user specific project, but as a team we started using a team project, and I wanted to change my default/ | 16:01 |
| dtroyer | stevemar: (or anyone else interested in OAuth in DevStack) could you have a look at https://review.openstack.org/#/c/44401 when you get a sec? | 16:01 |
| ayoung | dtroyer, I'll look | 16:01 |
| dtroyer | ayoung: thanks | 16:02 |
| *** xga__ has joined #openstack-dev | 16:02 | |
| ayoung | dtroyer, shouldn't we have something like KEYSTONE_EXTENSIONS=oauth, kds,vargarble,snurp | 16:02 |
| bknudson | ayoung: is that a copy of the config in the pipeline? | 16:03 |
| dtroyer | ayoung: possibly... | 16:03 |
| bknudson | ayoung: or do we change the pipeline to have an extension handler | 16:03 |
| ayoung | bknudson, this would be additional extensions | 16:03 |
| ttx | havana-3 is out | 16:03 |
| ayoung | ttx, rock on! | 16:04 |
| ttx | Now let's test and fix :) | 16:04 |
| dtroyer | this is the first extension to be enabled in DevStack, right? (I don't know what is and what isn't an extension offhand) | 16:04 |
| ttx | med_: ^ | 16:04 |
| bknudson | should be like enable_keystone_oauth | 16:04 |
| *** MaxV has quit IRC | 16:04 | |
| *** xga_ has quit IRC | 16:04 | |
| dtroyer | bknudson: I'd prefer to do it like we do services now, just have a list to enable and do the right thing in the code. but yeah | 16:05 |
| ayoung | dtroyer, he'll need to run the migration script for it, too | 16:06 |
| dtroyer | ayoung: good to know…please leave a comment | 16:06 |
| ayoung | dtroyer, working on it | 16:07 |
| *** alop_ has joined #openstack-dev | 16:07 | |
| *** gyee has joined #openstack-dev | 16:07 | |
| dtroyer | coolness…thanks | 16:07 |
| *** markwash has joined #openstack-dev | 16:07 | |
| med_ | ttx, ,many thanks | 16:07 |
| ayoung | dtroyer, how' | 16:08 |
| ayoung | s that? | 16:08 |
| *** angdraug has joined #openstack-dev | 16:08 | |
| *** ayoung is now known as ayoung-afk | 16:08 | |
| *** odyssey4me has joined #openstack-dev | 16:08 | |
| dtroyer | ayoung-afk: looks good, thanks again | 16:09 |
| *** xarses has joined #openstack-dev | 16:09 | |
| *** alop has quit IRC | 16:10 | |
| *** alop_ is now known as alop | 16:10 | |
| *** gmoro has quit IRC | 16:10 | |
| *** drewlander has quit IRC | 16:14 | |
| *** jistr has quit IRC | 16:16 | |
| *** johnthetubaguy has quit IRC | 16:23 | |
| *** jpich has quit IRC | 16:24 | |
| *** jdennis1 has quit IRC | 16:26 | |
| *** drewlander has joined #openstack-dev | 16:27 | |
| *** xga__ has quit IRC | 16:29 | |
| *** insanida1e has joined #openstack-dev | 16:29 | |
| wolfdreamer | so question, I have an issue that I've completed, but the changes break a test in tempest, what is the procedure for being able to make modifications to tempest and original issue | 16:29 |
| *** zz_Guest35249 is now known as leif | 16:31 | |
| *** leif is now known as Guest40704 | 16:31 | |
| *** souvik1 has joined #openstack-dev | 16:31 | |
| *** xga has joined #openstack-dev | 16:31 | |
| *** comay has joined #openstack-dev | 16:32 | |
| *** insanidade has quit IRC | 16:32 | |
| *** drewlander has quit IRC | 16:33 | |
| *** souvik has quit IRC | 16:33 | |
| *** Mandell has joined #openstack-dev | 16:34 | |
| *** kbrierly has joined #openstack-dev | 16:34 | |
| *** markmcclain has joined #openstack-dev | 16:35 | |
| *** souvik1 has quit IRC | 16:36 | |
| *** changbl has quit IRC | 16:37 | |
| *** gmoro has joined #openstack-dev | 16:38 | |
| *** chenxu has quit IRC | 16:39 | |
| *** anniec has quit IRC | 16:39 | |
| *** xga_ has joined #openstack-dev | 16:39 | |
| *** paragan has joined #openstack-dev | 16:40 | |
| *** paragan has joined #openstack-dev | 16:40 | |
| *** aeperezt has quit IRC | 16:41 | |
| *** CaptTofu has quit IRC | 16:42 | |
| *** CaptTofu has joined #openstack-dev | 16:42 | |
| *** xga has quit IRC | 16:43 | |
| *** Mandell has quit IRC | 16:46 | |
| *** CaptTofu has quit IRC | 16:47 | |
| *** aeperezt has joined #openstack-dev | 16:47 | |
| *** JordanP has quit IRC | 16:50 | |
| *** arezmerita has quit IRC | 16:52 | |
| *** dkehn has quit IRC | 16:53 | |
| *** dkehn has joined #openstack-dev | 16:54 | |
| *** gyee has quit IRC | 16:55 | |
| *** xmltok has joined #openstack-dev | 16:59 | |
| *** xga_ has quit IRC | 16:59 | |
| *** dina_belova has joined #openstack-dev | 17:00 | |
| *** troytoman is now known as troytoman-away | 17:01 | |
| *** CaptTofu has joined #openstack-dev | 17:02 | |
| *** dina_belova has quit IRC | 17:05 | |
| *** rushiagr has joined #openstack-dev | 17:06 | |
| *** nati_ueno has joined #openstack-dev | 17:08 | |
| *** alop has quit IRC | 17:09 | |
| *** ruhe has joined #openstack-dev | 17:09 | |
| *** radez_g0n3 is now known as radez | 17:09 | |
| *** alop has joined #openstack-dev | 17:12 | |
| *** gyee has joined #openstack-dev | 17:15 | |
| *** MaxV has joined #openstack-dev | 17:15 | |
| *** chenxu has joined #openstack-dev | 17:18 | |
| *** kaushikc has joined #openstack-dev | 17:19 | |
| *** MaxV has quit IRC | 17:19 | |
| *** derekh has quit IRC | 17:22 | |
| *** reed has joined #openstack-dev | 17:22 | |
| *** kaushikc has quit IRC | 17:23 | |
| *** mlavalle has quit IRC | 17:23 | |
| *** basha has joined #openstack-dev | 17:24 | |
| *** dvarga_ has quit IRC | 17:25 | |
| *** ayoung-afk is now known as ayoung | 17:25 | |
| *** paragan has quit IRC | 17:25 | |
| *** athomas has quit IRC | 17:25 | |
| *** martyntaylor1 has quit IRC | 17:25 | |
| *** vuil has joined #openstack-dev | 17:26 | |
| ayoung | wolfdreamer, submit a change to tempest first that removes the old test, with an link to the change that breaks it. Ater you have the new change in, submit an additional test to tempest | 17:26 |
| *** dvarga has joined #openstack-dev | 17:26 | |
| *** dina_belova has joined #openstack-dev | 17:26 | |
| wolfdreamer | ayoung, thanks for the info. Test to tempest didn't need to be removed first but will keep in mind for future | 17:29 |
| *** hartsocks has joined #openstack-dev | 17:29 | |
| *** hartsocks has left #openstack-dev | 17:30 | |
| *** souvik has joined #openstack-dev | 17:31 | |
| *** jdennis1 has joined #openstack-dev | 17:31 | |
| *** athomas has joined #openstack-dev | 17:31 | |
| *** ruhe has quit IRC | 17:32 | |
| *** mkerrin has quit IRC | 17:32 | |
| *** lucasagomes has quit IRC | 17:32 | |
| *** dkehn has quit IRC | 17:36 | |
| *** dkehn has joined #openstack-dev | 17:36 | |
| *** rushiagr has quit IRC | 17:39 | |
| *** hemnafk is now known as hemna | 17:40 | |
| *** eglynn_ has quit IRC | 17:41 | |
| *** xqueralt is now known as xqueralt-afk | 17:41 | |
| *** dkehn has quit IRC | 17:41 | |
| *** ruhe has joined #openstack-dev | 17:44 | |
| *** nati_ueno_2 has quit IRC | 17:45 | |
| *** nati_ueno_2 has joined #openstack-dev | 17:45 | |
| bknudson | I'm not able to start up devstack with LDAP keystone ... | 17:46 |
| bknudson | UNDEFINED_TYPE: {'info': 'enabled: attribute type undefined', 'desc': 'Undefined attribute type'} | 17:46 |
| stevemar | bknudson, i saw that last night, i think it's independent of ldap | 17:47 |
| *** dkehn has joined #openstack-dev | 17:47 | |
| bknudson | stevemar: I'll try without. | 17:47 |
| bknudson | I think I had seen this a few times yesterday but then it would mysteriously go away | 17:47 |
| chmouel | i have tried ldap/devstack keystone just this morning and had no troubles so far | 17:48 |
| chmouel | bknudson: ^ | 17:48 |
| *** alop has quit IRC | 17:49 | |
| *** alop has joined #openstack-dev | 17:49 | |
| *** nati_ueno_2 has quit IRC | 17:50 | |
| *** danpb has quit IRC | 17:50 | |
| *** mkollaro has quit IRC | 17:50 | |
| stevemar | dtroyer, i'm taking a look at https://review.openstack.org/#/c/44401 | 17:50 |
| *** RajeshMohan has quit IRC | 17:51 | |
| *** RajeshMohan has joined #openstack-dev | 17:51 | |
| *** rushiagr has joined #openstack-dev | 17:52 | |
| ayoung | wolfdreamer, also watch out for the Foresaken. One of them has been hiding out in Tempest. I think it is Samael. | 17:52 |
| *** gordc has quit IRC | 17:53 | |
| *** souvik has quit IRC | 17:54 | |
| *** mlavalle has joined #openstack-dev | 17:55 | |
| *** athomas has quit IRC | 17:56 | |
| *** yaguang has quit IRC | 17:58 | |
| *** maheshp has joined #openstack-dev | 17:58 | |
| *** sushils has quit IRC | 18:00 | |
| *** feleouet has quit IRC | 18:01 | |
| *** comay has quit IRC | 18:02 | |
| *** souvik has joined #openstack-dev | 18:03 | |
| *** vuil1 has joined #openstack-dev | 18:03 | |
| *** vuil has quit IRC | 18:05 | |
| *** ifarkas has quit IRC | 18:05 | |
| *** jbresnah_ has joined #openstack-dev | 18:06 | |
| *** mkollaro has joined #openstack-dev | 18:06 | |
| *** maheshp1 has joined #openstack-dev | 18:06 | |
| *** maheshp has quit IRC | 18:06 | |
| *** cococafe has quit IRC | 18:06 | |
| *** dina_belova has quit IRC | 18:07 | |
| *** cococafe has joined #openstack-dev | 18:07 | |
| *** gerritTestMan has joined #openstack-dev | 18:08 | |
| wolfdreamer | ayoung, just trying to avoid Ishamael | 18:08 |
| *** gerritTestMan has left #openstack-dev | 18:08 | |
| *** chenxu has quit IRC | 18:08 | |
| *** jbresnah has quit IRC | 18:09 | |
| *** dosaboy has quit IRC | 18:09 | |
| *** dosaboy has joined #openstack-dev | 18:11 | |
| bknudson | my ldap problem was my own mistake... had changed lib/keystone to not set user_attribute_ignore enabled to work on a diff fix. | 18:13 |
| *** changbl has joined #openstack-dev | 18:13 | |
| morganfainberg | dolphm, digging into https://bugs.launchpad.net/keystone/+bug/1218094, I'm finding a lot of gaps in multi-domain support. I can probably get a bug fix in before RC1, but it's likely going to have a good deal of delta. | 18:15 |
| uvirtbot | Launchpad bug 1218094 in keystone "Multi domain code not searching domains for LDAP read only users" [Medium,Triaged] | 18:15 |
| *** sushils has joined #openstack-dev | 18:15 | |
| dolphm | morganfainberg: https://bugs.launchpad.net/keystone/+bug/1218094 | 18:15 |
| *** egallen has quit IRC | 18:15 | |
| dolphm | morganfainberg: i was starting to suspect there was a significant gap :( | 18:16 |
| morganfainberg | yep. a lot of calls wont handle domain_scop. i think i'm about 50% there with 11 files changed, 58 insertions(+), 54 deletions(-) | 18:16 |
| morganfainberg | and that doesn't include touching a single test | 18:16 |
| morganfainberg | plus. user_id's don't look very unique based upon how we do str2dn | 18:17 |
| dolphm | morganfainberg: ouch | 18:17 |
| *** networkstatic has joined #openstack-dev | 18:17 | |
| morganfainberg | dolphm, we should likely be storing user_id as something like user_id@domain | 18:18 |
| morganfainberg | but that seems like it will be a pretty massive change. | 18:18 |
| *** mkollaro has quit IRC | 18:18 | |
| dolphm | morganfainberg: it is - and you either need to encode at least one half, or ensure that '@' can't appear in at least one half | 18:19 |
| morganfainberg | i'd use the same logic as the external user, use an rsplit('@', 1) if anything | 18:19 |
| morganfainberg | dolphm, that has edge cases as well, now that i think about it | 18:20 |
| *** adalbas has quit IRC | 18:20 | |
| dolphm | morganfainberg: edge cases like user@ex@mple.com ? or something else | 18:21 |
| *** vishy is now known as vishious | 18:22 | |
| *** maheshp has joined #openstack-dev | 18:22 | |
| morganfainberg | dolphm, i was thinking upgrade issues. user@something (username), now we do an rsplit, "something" isn't a domain | 18:22 |
| morganfainberg | it should be user@somthing@domain | 18:22 |
| *** jog0 is now known as flashgordon | 18:23 | |
| *** maheshp1 has quit IRC | 18:23 | |
| *** adalbas has joined #openstack-dev | 18:23 | |
| morganfainberg | so we'd need to write a migration script for that. that likely would be an ugly migration script. or we have to do some wierd compat code. | 18:24 |
| *** cococafe has quit IRC | 18:24 | |
| dolphm | morganfainberg: also doesn't solve the upgrade issue of a user who is already authenticating with a pre-upgrade user_id and no domain | 18:24 |
| *** zaitcev has joined #openstack-dev | 18:24 | |
| morganfainberg | dolphm, there is one other issue. https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L352 is used to extract domain information, in some cases this would limit keystone so there cannot be a "super admin" that could lookup/edit/etc things outside of the current token's domain scope. | 18:24 |
| *** feleouet has joined #openstack-dev | 18:24 | |
| morganfainberg | super admin/cloud admin/etc | 18:24 |
| *** cococafe has joined #openstack-dev | 18:25 | |
| *** Mandell has joined #openstack-dev | 18:25 | |
| dolphm | morganfainberg: wow, that code is also incredibly broken | 18:26 |
| morganfainberg | dolphm, yep. | 18:26 |
| morganfainberg | dolphm, i am pretty sure i could put together a 75% ish fix. but, there would be strange edge cases / lack of functionality | 18:27 |
| *** rushiagr has quit IRC | 18:28 | |
| morganfainberg | dolphm, so, not sure if we want to mothball this up some until icehouse or push for a fix. it's kind of 11th hour for this type of rabbit hole. | 18:29 |
| dolphm | morganfainberg: +++ | 18:30 |
| dolphm | morganfainberg: i'm now worried that not-split-identity use case could be very broken as well | 18:31 |
| morganfainberg | dolphm, my digging in shows (for the most part) it looks sane as long as you never have multiple identity drivers (no split domain drivers). | 18:32 |
| dolphm | morganfainberg: comforting words ^^ :P | 18:32 |
| morganfainberg | dolphm, yeah i know. :P | 18:32 |
| *** christopherevans has joined #openstack-dev | 18:33 | |
| *** pmathews has quit IRC | 18:35 | |
| *** pmathews has joined #openstack-dev | 18:35 | |
| *** stevemar has quit IRC | 18:36 | |
| morganfainberg | dolphm, i'm going to get some lunch, once i'm back (and i've stewed on thsi some more) we can figure out what we want to do | 18:38 |
| morganfainberg | dolphm, s/once i'm back/once back i'll hit you up/ | 18:38 |
| dolphm | morganfainberg: henrynash: https://etherpad.openstack.org/keystone-identity-driver-per-domain-icehouse | 18:38 |
| *** dvarga has quit IRC | 18:39 | |
| dolphm | morganfainberg: starting to map that out ^ | 18:39 |
| morganfainberg | dolphm, cool. looking now (have a few mins before lunch train takes off) | 18:39 |
| *** souvik has quit IRC | 18:40 | |
| *** russellb is now known as rustlebee | 18:43 | |
| morganfainberg | dolphm, ok i'll be back in a few. hit you up then. | 18:44 |
| *** garyk1 has joined #openstack-dev | 18:44 | |
| dolphm | morganfainberg: o/ | 18:44 |
| *** ruhe has quit IRC | 18:44 | |
| *** garyk has quit IRC | 18:45 | |
| *** colinmcnamara has quit IRC | 18:45 | |
| *** eglynn_ has joined #openstack-dev | 18:45 | |
| *** insanida1e is now known as insanidade | 18:47 | |
| *** pixelbeat has quit IRC | 18:47 | |
| *** novas0x2a|laptop has joined #openstack-dev | 18:48 | |
| *** christopherevans has quit IRC | 18:48 | |
| *** jruzicka has quit IRC | 18:50 | |
| *** cp16net has left #openstack-dev | 18:52 | |
| *** sdake_ has joined #openstack-dev | 18:53 | |
| *** bdpayne has quit IRC | 18:59 | |
| *** pmathews has quit IRC | 19:00 | |
| *** vkmc has quit IRC | 19:00 | |
| *** sushils has quit IRC | 19:02 | |
| *** sgordon has quit IRC | 19:03 | |
| *** bdpayne has joined #openstack-dev | 19:03 | |
| *** alop has quit IRC | 19:03 | |
| *** waa has quit IRC | 19:04 | |
| *** vipul is now known as vipul-away | 19:05 | |
| *** atiwari has joined #openstack-dev | 19:05 | |
| *** cococafe_ has joined #openstack-dev | 19:07 | |
| *** dstanek has quit IRC | 19:07 | |
| dolphm | ttx: will bugs / blueprints targeting 'next' automatically map to icehouse somehow? | 19:08 |
| *** cococafe has quit IRC | 19:08 | |
| *** cococafe_ is now known as cococafe | 19:08 | |
| *** asavu has joined #openstack-dev | 19:08 | |
| atiwari | All I am waiting for review on https://review.openstack.org/#/c/37141/10/openstack-identity-api/v3/src/markdown/identity-api-v3-os-roles-ext.md | 19:11 |
| atiwari | also, can some one validate https://bugs.launchpad.net/keystone/+bug/1221889? | 19:12 |
| uvirtbot | Launchpad bug 1221889 in keystone "Wrong unit tests for v3 token head calls" [Undecided,New] | 19:12 |
| *** tstevenson is now known as codenamekt | 19:13 | |
| *** stevemar has joined #openstack-dev | 19:13 | |
| *** sarob has joined #openstack-dev | 19:14 | |
| *** cococafe has quit IRC | 19:15 | |
| *** codenamekt is now known as tstevenson | 19:16 | |
| *** cburgess has quit IRC | 19:16 | |
| *** cococafe has joined #openstack-dev | 19:16 | |
| *** sarob has quit IRC | 19:17 | |
| *** sarob has joined #openstack-dev | 19:17 | |
| *** troytoman-away is now known as troytoman | 19:17 | |
| *** rmk has quit IRC | 19:18 | |
| *** CaptTofu has quit IRC | 19:18 | |
| *** Vivek has quit IRC | 19:19 | |
| *** hartsocks1 has joined #openstack-dev | 19:19 | |
| *** dstanek has joined #openstack-dev | 19:20 | |
| *** cburgess has joined #openstack-dev | 19:21 | |
| *** rmk has joined #openstack-dev | 19:23 | |
| *** hartsocks1 has quit IRC | 19:23 | |
| *** sgordon has joined #openstack-dev | 19:23 | |
| *** hartsocks has joined #openstack-dev | 19:23 | |
| *** hartsocks has left #openstack-dev | 19:23 | |
| *** cococafe has quit IRC | 19:25 | |
| *** cococafe has joined #openstack-dev | 19:26 | |
| *** Vivek has joined #openstack-dev | 19:26 | |
| *** reed has quit IRC | 19:27 | |
| *** Vivek is now known as Guest63959 | 19:27 | |
| *** basha has quit IRC | 19:27 | |
| *** dvarga has joined #openstack-dev | 19:31 | |
| *** stevemar has quit IRC | 19:32 | |
| *** cococafe has quit IRC | 19:35 | |
| *** jdennis1 has quit IRC | 19:35 | |
| *** cococafe has joined #openstack-dev | 19:36 | |
| *** maheshp has quit IRC | 19:38 | |
| *** pmathews has joined #openstack-dev | 19:40 | |
| *** vartom7 has joined #openstack-dev | 19:41 | |
| *** reed has joined #openstack-dev | 19:41 | |
| *** cococafe has left #openstack-dev | 19:41 | |
| *** sushils has joined #openstack-dev | 19:42 | |
| *** kenperkins has quit IRC | 19:43 | |
| *** jhesketh has quit IRC | 19:43 | |
| crazed | where's the best docs on the latest way to do metadata api? specifically i'm not running the l3_agent | 19:43 |
| *** kenperkins has joined #openstack-dev | 19:43 | |
| *** yassine has joined #openstack-dev | 19:44 | |
| *** jhesketh has joined #openstack-dev | 19:45 | |
| morganfainberg | dolphm, the etherpad looks good | 19:47 |
| atiwari | morganfainberg, I filed the bug https://bugs.launchpad.net/keystone/+bug/1221889, please take a look | 19:49 |
| uvirtbot | Launchpad bug 1221889 in keystone "Wrong unit tests for v3 token head calls" [Medium,New] | 19:49 |
| morganfainberg | atiwari, i saw that. Commented on it. | 19:50 |
| atiwari | just saw | 19:51 |
| *** mmoya has quit IRC | 19:52 | |
| *** danwent has quit IRC | 19:53 | |
| *** mmoya has joined #openstack-dev | 19:59 | |
| *** bdpayne has quit IRC | 19:59 | |
| *** romcheg has joined #openstack-dev | 20:00 | |
| dolphm | morganfainberg: /salute | 20:00 |
| morganfainberg | dolphm, i'll snag the tenant_id vs tenantId bug for rc1 so we can get that out the door. I'll also work on the new BP for icehouse and the multi-domain stuff this weekend (so we have a starting place) unless you already grabbed that | 20:01 |
| *** danwent has joined #openstack-dev | 20:02 | |
| dolphm | morganfainberg: i have not | 20:02 |
| *** alunduil has quit IRC | 20:02 | |
| morganfainberg | dolphm, sounds good. | 20:03 |
| *** otherwiseguy has quit IRC | 20:03 | |
| *** vartom7 has quit IRC | 20:04 | |
| *** feleouet has quit IRC | 20:04 | |
| *** feleouet has joined #openstack-dev | 20:05 | |
| *** pmathews has quit IRC | 20:07 | |
| *** chenxu has joined #openstack-dev | 20:07 | |
| *** markwash has quit IRC | 20:08 | |
| *** markwash has joined #openstack-dev | 20:09 | |
| *** dstanek has quit IRC | 20:09 | |
| dolphm | morganfainberg: i amended the docs to identify the feature as experimental in havana... does the scope of work you're looking at to complete the overall feature fit under one of the currently filed bugs? or should we create a new one? | 20:10 |
| dolphm | morganfainberg: i'm just trying to figure out what bug to cite in the commit message for docs as a Related-Bug | 20:11 |
| *** sarob_ has joined #openstack-dev | 20:11 | |
| dolphm | morganfainberg: bug or bugs... probably plural | 20:11 |
| morganfainberg | dolphm, i think it covers the read-only bug and then some | 20:13 |
| morganfainberg | so i'll need to probably file a couple more bugs along the way. | 20:13 |
| morganfainberg | but for now i think the 2 bugs you identified are the crux of why it can't be used in havana | 20:13 |
| *** bdpayne has joined #openstack-dev | 20:13 | |
| *** sarob has quit IRC | 20:15 | |
| dolphm | morganfainberg: fair enough | 20:15 |
| dolphm | morganfainberg: https://review.openstack.org/#/c/45486/ | 20:15 |
| morganfainberg | dolphm, looking now. | 20:16 |
| *** radez is now known as radez_g0n3 | 20:16 | |
| dolphm | morganfainberg: just realized the WARN should maybe be WARNING | 20:16 |
| morganfainberg | dolphm, yeah WARNING, also you're missing a capitalization on Keystone in line 108. | 20:17 |
| morganfainberg | otherwise, looks good to me | 20:17 |
| dolphm | morganfainberg: fixed | 20:18 |
| morganfainberg | dolphm, Looks good, +2. | 20:19 |
| morganfainberg | any issue with me pressing "go" on the LLC -> Foundation patch? | 20:19 |
| *** mars has quit IRC | 20:19 | |
| *** dvarga has quit IRC | 20:21 | |
| dolphm | morganfainberg: not that i'm aware of | 20:23 |
| *** pmathews has joined #openstack-dev | 20:24 | |
| *** stevemar has joined #openstack-dev | 20:24 | |
| *** pabelanger has quit IRC | 20:25 | |
| *** yassine has quit IRC | 20:25 | |
| bknudson | is multi-domain experimental or it doesn't work? | 20:26 |
| *** eharney has quit IRC | 20:29 | |
| *** ftcjeff has joined #openstack-dev | 20:30 | |
| *** ftcjeff has quit IRC | 20:30 | |
| *** hartsocks has joined #openstack-dev | 20:31 | |
| *** hartsocks has left #openstack-dev | 20:31 | |
| *** danwent has quit IRC | 20:34 | |
| dolphm | bknudson: it makes several assumptions and appears to be incompletely implemented; a proper fix appears to be out of scope for havana | 20:35 |
| morganfainberg | bknudson, it would be a significant amount of delta to get it into havana | 20:36 |
| morganfainberg | bknudson, and there would be some odd edgecases where things would behave in non-intuitive ways | 20:36 |
| bknudson | I assume it would be a significant delta to revert it? | 20:36 |
| morganfainberg | bknudson, i think that would be worse because of when it went in. alot of things were built with it's changes already there | 20:37 |
| bknudson | could a small change disable it (reading the configs?) | 20:38 |
| dolphm | bknudson: prevent people from using it? | 20:38 |
| *** dprince has quit IRC | 20:38 | |
| bknudson | dolphm: right, not make it experimental make it so that it's not usable at all | 20:38 |
| morganfainberg | dolphm, bknudson, i think it's only tested (config option) in a couple places, could just move from if conf.<whatever> to if false | 20:38 |
| bknudson | experimental to me indicates that I can try it out. | 20:39 |
| morganfainberg | bknudson, it will sort of work… kind of… and produce very odd behavior. | 20:39 |
| bknudson | but if there's a bunch of stuff we know doesn't work? | 20:39 |
| david-lyle | bknudson: which part of multi-domain? the ability to create multiple domains? | 20:39 |
| morganfainberg | bknudson, a lot of things will just flat fail because user lookups don't provide domain_scope | 20:40 |
| morganfainberg | not even including the same issues for grants, etc | 20:40 |
| bknudson | are we going to get security issues? | 20:40 |
| dolphm | bknudson: we "generated" some useful bug reports by having it "usable" ... but you're right, we probably won't get much more useful feedback from havana | 20:40 |
| *** dvarga has joined #openstack-dev | 20:40 | |
| morganfainberg | dolphm, bknudson has a point. this opens the door for some nasty problems. disabling whole-sale might be a better course | 20:41 |
| bknudson | david-lyle: it appears that you can create multiple domains (there are unit tests for this), but then you couldn't find the correct users when looking up by id. | 20:42 |
| bknudson | I could be wrong in the assessment. | 20:42 |
| dolphm | bknudson: that sounds correct | 20:42 |
| morganfainberg | thats the base of it | 20:42 |
| bknudson | keystone looks up stuff by id all the time... roles, groups, etc. | 20:42 |
| *** mmoya has quit IRC | 20:43 | |
| morganfainberg | basically, anything controlled by the identity driver wasn't guaranteed to be able to be looked up by ID in all cases | 20:43 |
| *** sgordon has quit IRC | 20:43 | |
| dolphm | david-lyle: we have the ability to create multiple domains, and to specify discrete backend configuration per domain, but we're not entirely handling the consequences of that properly | 20:43 |
| morganfainberg | with multiple domain backends. | 20:43 |
| david-lyle | so it's just the multiple backends in question? | 20:43 |
| dolphm | david-lyle: yes | 20:44 |
| morganfainberg | david-lyle, yes. | 20:44 |
| dolphm | david-lyle: multiple domains in SQL is fine, AFAIK | 20:44 |
| david-lyle | ok, just wanted to check, Horizon added multi-domain support in Havana for at least SQL backends | 20:44 |
| *** mmoya has joined #openstack-dev | 20:44 | |
| bknudson | oh, this isn't exactly multiple domains... | 20:44 |
| bknudson | it's "split domains" | 20:45 |
| morganfainberg | bknudson - yes. | 20:45 |
| dolphm | we have a lot of "split-X" blueprints lol | 20:45 |
| morganfainberg | hehe | 20:45 |
| bknudson | you have a domain in LDAP1 and a domain in LDAP2 and a domain in SQL1 | 20:45 |
| david-lyle | ok, just got worried when I read disable multi-domain :) | 20:45 |
| dolphm | and then most of your users suddenly can't be found :) | 20:45 |
| morganfainberg | bknudson, yep that is the problem scenario, the per-domain-backend | 20:46 |
| david-lyle | thanks for the clarification | 20:47 |
| *** danwent has joined #openstack-dev | 20:48 | |
| *** tmclaugh[work] has quit IRC | 20:49 | |
| dolphm | morganfainberg: if people didn't try and run "production" installs with debug enabled, i'd suggest just checking that debug = True to 'disable' it | 20:49 |
| *** dvarga has quit IRC | 20:49 | |
| morganfainberg | dolphm, fair point. | 20:50 |
| bknudson | you do have to work pretty hard to use it, it's not like someone's going to accidentally use it. | 20:50 |
| dolphm | morganfainberg: bknudson: how about adding an --i-am-an-idiot that defaults to False | 20:52 |
| *** asavu has quit IRC | 20:52 | |
| *** comay has joined #openstack-dev | 20:52 | |
| bknudson | dolphm: I'm not sure about the default... | 20:53 |
| *** feleouet has quit IRC | 20:53 | |
| dolphm | bknudson: oh, but we should always provide it | 20:53 |
| *** garyk1 has quit IRC | 20:54 | |
| *** spzala has quit IRC | 20:54 | |
| *** kenperkins has quit IRC | 20:55 | |
| *** devoid has joined #openstack-dev | 20:58 | |
| *** otherwiseguy has joined #openstack-dev | 20:59 | |
| *** slagle has quit IRC | 20:59 | |
| *** pabelanger has joined #openstack-dev | 21:00 | |
| *** otherwiseguy has quit IRC | 21:00 | |
| *** otherwiseguy has joined #openstack-dev | 21:00 | |
| *** marios has quit IRC | 21:01 | |
| *** Guest40704 is now known as zz_Guest40704 | 21:04 | |
| *** boris-42 has quit IRC | 21:05 | |
| *** dstanek has joined #openstack-dev | 21:06 | |
| *** rnirmal has quit IRC | 21:06 | |
| *** mars has joined #openstack-dev | 21:07 | |
| *** mars has joined #openstack-dev | 21:07 | |
| *** ruhe has joined #openstack-dev | 21:07 | |
| *** donaldh has quit IRC | 21:07 | |
| *** donaldh has joined #openstack-dev | 21:08 | |
| *** donaldh has quit IRC | 21:09 | |
| morganfainberg | bknudson / dolphm, make it also log "no seriously this feature is still being baked, you probably don't want to use it" | 21:12 |
| stevemar | hehe | 21:13 |
| morganfainberg | stevemar. you going to take: https://bugs.launchpad.net/keystone/+bug/1219739 or should I start working on it? | 21:13 |
| uvirtbot | Launchpad bug 1219739 in keystone "LDAP use 'tenant_id' instead of 'tenantId' in user_ref" [Medium,New] | 21:13 |
| stevemar | dolphm (and others if interested), i'm still getting that error i showed you earlier, where create user expects 3 args instead of 2 | 21:13 |
| stevemar | morganfainberg: go ahead sir | 21:14 |
| morganfainberg | stevemar, cool. | 21:14 |
| *** vipul-away is now known as vipul | 21:14 | |
| stevemar | morganfainberg: I "worked" on the duplicate name on, it's no longer on the list :P | 21:14 |
| *** sarob_ has quit IRC | 21:14 | |
| bknudson | maybe we need to push back on large patches ... https://www.ibm.com/developerworks/rational/library/11-proven-practices-for-peer-review/ | 21:14 |
| stevemar | morganfainberg: that's not to say I wrote a patch | 21:14 |
| bknudson | "Review fewer than 200–400 lines of code at a time" | 21:14 |
| *** sarob has joined #openstack-dev | 21:15 | |
| morganfainberg | bknudson, that is the exact reason why i split the caching into each subsystem i was enablin caching for | 21:15 |
| morganfainberg | bknudson, it would be good to also split things into "basic support" and "enable support of new feature for <blah>" type patches | 21:16 |
| morganfainberg | bknudson, at least that way we could have a series of small changes to look at even if it amounts to a big change needed for a feature. and we are more likely to catch issues like this. | 21:17 |
| morganfainberg | before they are a problem | 21:17 |
| bknudson | morganfainberg: I think everyone appreciated splitting up by subsystem... could concentrate on each one. | 21:17 |
| morganfainberg | bknudson, i think it is a good practice to encourage across the board (unless it _really_ isn't possible) | 21:17 |
| *** prad has left #openstack-dev | 21:19 | |
| bknudson | I remember on that one I spent a lot of energy looking at the config changes | 21:19 |
| bknudson | by "that one" I mean the split domains | 21:19 |
| morganfainberg | yeah, i spent like 4 hours last night chasing down all the edge cases | 21:20 |
| morganfainberg | and a lot of that was wrapping my head around the config system to make sure that wasn't going to bite me along the way | 21:20 |
| *** stevemar has quit IRC | 21:21 | |
| *** mars has quit IRC | 21:21 | |
| *** colinmcnamara has joined #openstack-dev | 21:22 | |
| morganfainberg | bknudson, i bet it was time consuming on initial review, there is some nuance to the approach - and a lot of things are touched by it | 21:22 |
| ayoung | annegentle, for many of the doc bugs, I can go through and provide the info inside the bug report. Is that suffcient, or is it need to be the patch and submit process? | 21:23 |
| bknudson | morganfainberg: 24 changed files with 1,050 additions and 412 deletions https://github.com/openstack/keystone/commit/1ed2046eaa91fa36926d66a5fe1e88ccd65373bb | 21:24 |
| *** yjiang5 is now known as bmqq123 | 21:24 | |
| morganfainberg | bknudson, that is a sizable delta. | 21:25 |
| *** ruhe has quit IRC | 21:25 | |
| bknudson | morganfainberg: although not sizable enough | 21:25 |
| *** donaldh has joined #openstack-dev | 21:26 | |
| morganfainberg | bknudson, true | 21:26 |
| *** alunduil has joined #openstack-dev | 21:26 | |
| ayoung | dolphm, for a bug like this: https://bugs.launchpad.net/openstack-manuals/+bug/1090655 where do we document it? Is it in the keystone project, or in the openstack-manual project? | 21:28 |
| uvirtbot | Launchpad bug 1090655 in openstack-manuals "grizzly: keystone user groups" [Medium,Confirmed] | 21:28 |
| *** esheffield has quit IRC | 21:29 | |
| *** kbringard has quit IRC | 21:29 | |
| *** tong|2 has quit IRC | 21:29 | |
| *** romcheg has quit IRC | 21:29 | |
| *** chenxu has quit IRC | 21:29 | |
| *** NobodyCam_ has joined #openstack-dev | 21:30 | |
| *** odyssey4me has quit IRC | 21:30 | |
| *** NobodyCam_ has quit IRC | 21:30 | |
| *** dolphm has quit IRC | 21:31 | |
| dstanek | is the format for a templated catalog in Keystone documented anywhere? | 21:32 |
| ayoung | bknudson, morganfainberg still, domain specific ID backends might be the single most requested feature for Keystone | 21:33 |
| dstanek | ah cool, i found an example in devstack | 21:33 |
| ayoung | expect people to use it, and to break it | 21:34 |
| morganfainberg | ayoung, and i really want it in (personally, i am stoked about being able to do this split). I am just concerned about havana timelines and how broken it is. | 21:34 |
| *** bmqq123 has quit IRC | 21:35 | |
| ayoung | morganfainberg, let's crank up the priority on bugs on that, then | 21:35 |
| bknudson | can we backport the fixes if they get through more testing in IceHouse? | 21:35 |
| ayoung | bknudson, we can still do bug fixes up until release, with major thinkgs backprotable from ICe house to Havana stable | 21:36 |
| *** yjiang5 has joined #openstack-dev | 21:37 | |
| *** adalbas has quit IRC | 21:37 | |
| ayoung | morganfainberg, are there bug reports specific to multi-domain? | 21:37 |
| morganfainberg | ayoung, per-domain backends, there are 2 | 21:38 |
| *** galstrom is now known as galstrom_zzz | 21:38 | |
| henrynash | we're talking about the issues of user_id access with mulit-domain, I assume? | 21:38 |
| morganfainberg | henrynash, yes. | 21:38 |
| ayoung | link? | 21:38 |
| morganfainberg | henrynash and all other identity-controlled items (groups, etc all have the same issue) | 21:38 |
| morganfainberg | ayoung, sec. | 21:38 |
| morganfainberg | https://bugs.launchpad.net/keystone/+bug/1218094 and https://bugs.launchpad.net/keystone/+bug/1217017 | 21:39 |
| uvirtbot | Launchpad bug 1218094 in keystone "Multi domain code not searching domains for LDAP read only users" [Medium,Triaged] | 21:39 |
| *** jimfehlig has quit IRC | 21:39 | |
| *** sarob has quit IRC | 21:39 | |
| henrynash | morganfainberg: I think they'll all work Ok as log as you have a domain scoped token (or at least they should), with the exception of the bug in auth that we need to pass domain into get_user when setting project scope | 21:39 |
| henrynash | (as long as) | 21:40 |
| morganfainberg | henrynash, there are a lot of cases that never see domain scope passed when they do get_user | 21:41 |
| morganfainberg | e.g. grants | 21:41 |
| morganfainberg | so it'll get a usernotfound error | 21:41 |
| *** yjiang5 is now known as bmqq123 | 21:41 | |
| morganfainberg | henrynash and a scoped domain token will not allow a user (e.g. cloud admin) to access / update data from a domain they are not part of (in some cases) | 21:42 |
| henrynash | morganfainberg: ahh, so management of "pure" identity assets are OK, but mixed assignment/idenity calls are an issue | 21:43 |
| morganfainberg | henrynash, there is a chunk of work to do to get this shored up. I have a partial delta together, but it's going to be a lot. I wasn't sure if we wanted to try and wedge this in under RC. | 21:43 |
| morganfainberg | henrynash, yep. | 21:43 |
| ayoung | morganfainberg, did you split the caching info off into a separate bug? If not, that should be tracked separately | 21:44 |
| morganfainberg | henrynash and some cases it's very hard to derive domain since domain is derived from the ref returned by get_user (not commone, but i think i've found 2 or three) | 21:44 |
| henrynash | morganfainberg: I understand your concern - but actually I thikn we do "get_user" all over the place when we really shouldn't…..it would be great to get that cleanup up…I really don;t think we ever want an assignment backend calling the identity backend…should all be done higher up (when scope can be checked) | 21:44 |
| bknudson | morganfainberg: henrynash: how to you get it to work other than query every backend for the id? | 21:44 |
| morganfainberg | ayoung, ah, i should open that bug. | 21:44 |
| morganfainberg | ayoung will do todya. | 21:44 |
| bknudson | oh, move the lookup to someplace earlier. | 21:45 |
| henrynash | bknudson: so every query shouldn't be doing that, clearly….and if we can't see our way out of that hole, then I agree we have a problem | 21:45 |
| morganfainberg | bknudson, and if you don't already know the domain, how do you know which result to use (e.g. 2 users with the username "joe") | 21:45 |
| *** dkranz has quit IRC | 21:45 | |
| morganfainberg | in different domains. | 21:46 |
| bknudson | morganfainberg: I assume we're doing lookup by ID and not name. | 21:46 |
| henrynash | morgainfainberg: to usernames with joe is fine... | 21:46 |
| henrynash | morganfainberg: two users with the same users_id is not | 21:46 |
| *** novas0x2a|laptop has quit IRC | 21:46 | |
| morganfainberg | bknudson, in ldap, id is a str2dn[0][0][1], so cn=User,dc=example,dc=com becomes 'User' | 21:46 |
| ayoung | morganfainberg, please make sure I am added as a reviewer on all LDAP related bugs. | 21:46 |
| *** novas0x2a|laptop has joined #openstack-dev | 21:46 | |
| morganfainberg | ayoung, will do. | 21:47 |
| ayoung | ah. dolph submitted the fix on behalf of...sorry, morganfainberg misread that | 21:47 |
| bknudson | I think we always had the assumption that user IDs were unique | 21:47 |
| bknudson | the assumption before domains was that user names were also unique | 21:47 |
| morganfainberg | ayoung, no worries. i know you're an ldap expert, anything i touch with LDAP i'll make sure you're part of. | 21:47 |
| bknudson | so if they're violating unique user IDs then I think that's not our problem. | 21:48 |
| morganfainberg | bknudson, how do you enforce that with per-domain identity? | 21:48 |
| ayoung | morganfainberg, Expert, in this case, means I've written more broken LDAP code than anyone else... | 21:48 |
| ayoung | we should test a user ID and figure out what domain it is in | 21:48 |
| ayoung | UUID-> got to SQL | 21:48 |
| morganfainberg | ayoung, hehe. | 21:49 |
| bknudson | morganfainberg: documentation | 21:49 |
| ayoung | DN--> calculate the domain based on the subtree | 21:49 |
| ayoung | henrynash, is ^^ a workable solution? | 21:49 |
| morganfainberg | bknudson / ayoung, i think the right answer is to have the domain stored with the user. | 21:49 |
| henrynash | ayoung: so caching on identity would really help…so after one call to find a user_id (that searched domains) subsequent calls would dome out of cache | 21:49 |
| *** neoXsys has quit IRC | 21:49 | |
| ayoung | henrynash, except that caching on Users from LDAP breaks the ability to have revocation events come from LDAP | 21:50 |
| ayoung | If I remove a user from a group in LDAP, there is no notification | 21:50 |
| ayoung | and group assignments typically come off the user object in a memberof | 21:50 |
| ayoung | so we have to be careful | 21:51 |
| morganfainberg | this is one of the reasons i punted on any Identity caching for havana | 21:51 |
| morganfainberg | wanted a bit more time to work out sensible caching / etc | 21:51 |
| ayoung | morganfainberg, caching is always at odds with responsiveness by definition. YOu were right in favoring correctness over performance to start | 21:51 |
| henrynash | I'm going to mull on this issue this weekend… | 21:51 |
| *** jayg is now known as jayg|g0n3 | 21:52 | |
| ayoung | henrynash, is that in conjunction with the original meaning o "Mull"? | 21:52 |
| *** mancdaz has left #openstack-dev | 21:52 | |
| *** mancdaz has joined #openstack-dev | 21:52 | |
| *** jmontemayor has quit IRC | 21:53 | |
| morganfainberg | henrynash, i have a partial delta already on shoring up things, and i think i could have a semi-working solution (with some edgecases and limitations) by RC1, but it would have very odd edgecases w/o some serious restructuring of how things work (at odds for being this late in the cycle) | 21:53 |
| henrynash | ayoung: no wine invloved... | 21:53 |
| ayoung | En vino veritas | 21:53 |
| henrynash | morganfainberg: so here's one thought…let's not check whether user_id or group_id is valid on grants….just assign it... | 21:53 |
| ayoung | morganfainberg, what kind of edge cases | 21:53 |
| ayoung | henrynash, agreed | 21:53 |
| ayoung | henrynash, I thought I submitted a patch for just that? | 21:54 |
| morganfainberg | ayoung, unless you are part of the domain, you can't get information about users, etc for the domain | 21:54 |
| henrynash | we shouldn't bother doing get_user() etc. all over the place | 21:54 |
| *** dstanek has quit IRC | 21:54 | |
| morganfainberg | since we rely on the scoped token to determine the domain in some cases | 21:54 |
| morganfainberg | so no super-admin/cloud admin being able to see into some data | 21:54 |
| ayoung | 3be931165c6e218aaa5355a1f435ae58eb4484eb | 21:54 |
| morganfainberg | ayoung, i can dig up the specifics on that over the weekend if it makes a difference. | 21:55 |
| *** jasondotstar has quit IRC | 21:55 | |
| ayoung | https://github.com/openstack/keystone/commit/3be931165c6e218aaa5355a1f435ae58eb4484eb | 21:56 |
| ayoung | henrynash, ^^ is that not sufficient? Where else are we doing that check? | 21:56 |
| ayoung | oh, I moved it into the controllers... | 21:57 |
| *** mars has joined #openstack-dev | 21:57 | |
| morganfainberg | ayoung, yes. | 21:57 |
| morganfainberg | ayoung, it just needs some modification to include domain scope. | 21:58 |
| morganfainberg | ayoung, thats part of the change set i've been working on (those calls to identity included) | 21:58 |
| ayoung | morganfainberg, I want to drop that. It is going to make Federation really, rally hard | 21:59 |
| morganfainberg | ayoung, that makes sense. and i'm not opposed to providing some fixes for RC1, i just see this as being a massive bug fix (all things considered) very late in the cycle | 22:00 |
| morganfainberg | to get things cleaned up. it's not a bad approach, it's just incomplete. | 22:00 |
| morganfainberg | (I wish I had looked at this more closely before H3) | 22:01 |
| ayoung | assume you are an admin and you want to create entries for a user that is going to authenticated from some remote domain, and verified via SAML. You won't be able to query the system about that user... | 22:02 |
| ayoung | assignments will become impossible. What do we give up if we stop checking user validity? | 22:02 |
| ayoung | morganfainberg, so all of the V2 calls will assume default domain. All of the v3 calls should be providing domain id with them. We stop making the domain fields optional, we should be on the right track, no? | 22:02 |
| *** jbresnah_ is now known as jbresnah | 22:02 | |
| morganfainberg | ayoung that is the essence of my patchset. | 22:02 |
| ayoung | morganfainberg, H3 is not rc1 | 22:02 |
| morganfainberg | one exception. v2 tokens need to know how to do lookups for domains in a sane way (easy enough) | 22:03 |
| *** morazi has quit IRC | 22:03 | |
| *** insanidade has quit IRC | 22:03 | |
| ayoung | for all domains or just default? | 22:03 |
| *** pcm_ has quit IRC | 22:03 | |
| morganfainberg | if you ask about validity of a token by uuid/hashed id, it should respond correctly regardless of v2.0 or v3, no? | 22:04 |
| morganfainberg | which case it would fail on defaultdomain if the user was in a domain-specific backend | 22:04 |
| morganfainberg | but that data is already there (scoped token that is) | 22:04 |
| *** burt has quit IRC | 22:04 | |
| *** ericw has quit IRC | 22:05 | |
| morganfainberg | ayoung, i can have a workable patchset ready for some drive time next week if we want to do cleanup. i've already chased a chunk of this down. | 22:06 |
| morganfainberg | ayoung, but, in this case i'm defering to dolph and you guys about the scope we're willing to take on post H3 (feature freeze) | 22:07 |
| morganfainberg | my opinion is there is a bunch to do. | 22:07 |
| ayoung | morganfainberg, will it change either API or configuration? | 22:07 |
| morganfainberg | ayoung, api will change some. domain becomes manditory in a number of cases. | 22:07 |
| morganfainberg | s/number/some | 22:07 |
| bknudson | Grant role to user on project: PUT /projects/{project_id}/users/{user_id}/roles/{role_id} | 22:07 |
| bknudson | doesn't have a domain | 22:08 |
| ayoung | right | 22:08 |
| bknudson | so should not check if the user exists or not? | 22:08 |
| morganfainberg | bknudson, iirc that assumes the scoped token is where the domain is derived from | 22:08 |
| bknudson | (wouldn't return 404 if user doesn't exist) | 22:08 |
| ayoung | bknudson, ouch | 22:08 |
| morganfainberg | bknudson, project id is unique, you can lookup domain from project_id | 22:08 |
| ayoung | yeah, proejct and domain stayed in the same backend for just that reason | 22:09 |
| *** jtomasek has quit IRC | 22:09 | |
| *** kenperkins has joined #openstack-dev | 22:09 | |
| bknudson | I can't use the admin token to grant role to user on project ? | 22:09 |
| morganfainberg | bknudson, in that case you could. since project can be used to get domain | 22:10 |
| morganfainberg | but deleting a user. you couldn't do that | 22:10 |
| bknudson | List user's roles on project: GET /projects/{project_id}/users/{user_id}/roles | 22:10 |
| morganfainberg | you have to be part of the domain to delete a user, regardless of admin-token | 22:10 |
| bknudson | how can I get the domain from the project? | 22:10 |
| morganfainberg | bknudson, assignment_api.get_project()['domain_id'] | 22:11 |
| bknudson | If it's LDAP, I'd be deleting the user from the LDAP directory directly, not going through keystone. | 22:11 |
| morganfainberg | bknudson, if it's read-only ldap. but if you have a domain w/ a sql backend, and one with an ldap backend | 22:11 |
| morganfainberg | or 2 with sql backend | 22:11 |
| ayoung | henrynash, do we trust LDAP? | 22:11 |
| morganfainberg | or read-write ldap | 22:11 |
| ayoung | For example, say I have two LDAP based domains registerd | 22:11 |
| ayoung | and I know that they will be searcheed A and then B | 22:12 |
| ayoung | if a user is in domain B, and I hack LDAP A to have a subtree that looks like it, will I be able to steal users from domain B? | 22:12 |
| ayoung | I think...we want to do a pattern match on the User IDs from LDAP. they should contain the subtree | 22:13 |
| bknudson | morganfainberg: ok, I see that the project is owned by a domain... so we could say that you essentially can't go willy-nilly granting roles across domains. | 22:13 |
| morganfainberg | bknudson, yes. | 22:13 |
| ayoung | bknudson, A user in one domain can be granted access to a project in a different domain, though. | 22:14 |
| bknudson | ayoung: I was wondering if we could drop that (A user in one domain can be granted access to a project in a different domain) | 22:14 |
| ayoung | hmmm, also, I am making the assumption that a userID will be their DN... | 22:14 |
| ayoung | bknudson, I don't think we want to drop that. It is too powerful an abstraction | 22:15 |
| bknudson | or maybe only drop it if using split domains. | 22:15 |
| ayoung | I'm more concerned with... | 22:15 |
| *** dolphm has joined #openstack-dev | 22:15 | |
| morganfainberg | bknudson, except a | 22:15 |
| morganfainberg | "cloud admin" might want to be able to do grants | 22:15 |
| morganfainberg | on behalf of a customer? | 22:15 |
| ayoung | lets say an LDAP deployment uses the posix numeric ID as the users ID. We are definitely going to have overlap | 22:15 |
| bknudson | cloud admin can get a token scoped to domain | 22:16 |
| morganfainberg | bknudson, without an account specifically in that split-id backend? | 22:16 |
| ayoung | we should not allow that....userId needs to be globally uniqeu | 22:16 |
| ayoung | unique | 22:16 |
| morganfainberg | ayoung, agreed | 22:16 |
| bknudson | ayoung: that's what I was going to say ... user ID unique. | 22:16 |
| morganfainberg | ayoung, i think it needs to be enforced unique | 22:16 |
| bknudson | but we can only enforce it by documenatation | 22:16 |
| morganfainberg | bknudson, we could make domain required across the board (v2 only uses DEFAULT_DOMAIN) | 22:17 |
| bknudson | we can't stop someone updating their LDAP with a non-unique name | 22:17 |
| bknudson | this goes back to trusting LDAP | 22:17 |
| morganfainberg | bknudson, there is a difference between single ldap server with someone doing something dumb and multiple ldap servers | 22:17 |
| ayoung | ugh, we should get the defaults out of the User Object in ldap.py | 22:18 |
| morganfainberg | if we force lookups to always include domain, we don't need to worry. | 22:18 |
| *** dstanek has joined #openstack-dev | 22:18 | |
| *** eglynn_ has quit IRC | 22:18 | |
| bknudson | morganfainberg: ... because then user IDs don't have to be unique | 22:18 |
| morganfainberg | bknudson, actually i'd encourace encoding the domain in the "user_id" | 22:19 |
| morganfainberg | encourage* | 22:19 |
| *** otherwiseguy has quit IRC | 22:19 | |
| morganfainberg | somehow. or make it a composite of some sort we can rely on. | 22:19 |
| bknudson | If you were using LDAP and had unique email addresses, then could derive domain from email | 22:19 |
| morganfainberg | then the "user_id" isn't the complete user_id as far as keystone is concerned. | 22:20 |
| morganfainberg | similar to how external auth could be user@domain | 22:20 |
| ayoung | ugh, and we default ID to cn...what was I thinking? | 22:20 |
| morganfainberg | ayoung, >.< | 22:20 |
| morganfainberg | ayoung, you were thinking 1 identity back end? | 22:21 |
| morganfainberg | also, isn't that configurable? | 22:21 |
| *** tstevenson has quit IRC | 22:21 | |
| ayoung | morganfainberg, yeah, but so many people have been following the documentation.... | 22:21 |
| morganfainberg | ayoung, fair poiint | 22:21 |
| ayoung | ugh.... | 22:21 |
| * ayoung goes to bang head against wall | 22:21 | |
| morganfainberg | and if we change that… upgrades are going to be ugly | 22:22 |
| morganfainberg | (change the default) | 22:22 |
| henrynash | sorry, hopping in and out of this conversation... | 22:22 |
| ayoung | OK, we knowthat no one is yet using multiple domains in a live deployment, so the damage is fairly limited | 22:22 |
| bknudson | anybody with an existing LDAP would have to pick an attr that's unique . | 22:22 |
| *** thedodd has quit IRC | 22:22 | |
| bknudson | maybe it's cn or maybe it's posixAccountNumber | 22:23 |
| ayoung | morganfainberg, yeah | 22:23 |
| bknudson | probably should pick one that's single-valued. | 22:23 |
| morganfainberg | bknudson, or samaccount or... | 22:23 |
| ayoung | still we can fix the documentation on that | 22:23 |
| ayoung | dn | 22:23 |
| ayoung | nothing else really makes sense | 22:23 |
| henrynash | surely for all the grants, list projects for user etc…..none of that needs to know the domain….since this is all manipulation of id mappings in assignemnt | 22:23 |
| bknudson | dn would be unique, but might be longer than the db allows | 22:24 |
| morganfainberg | bknudson, dn->hash? | 22:24 |
| morganfainberg | sha1 should be _safe_ | 22:24 |
| bknudson | morganfainberg: that would be ok | 22:24 |
| bknudson | oh, right, a nefarious user could pick their name to match another hash. | 22:25 |
| morganfainberg | bknudson, unless we hash it across the board, and store the hash'd for reversability…or use a reversable hashing | 22:26 |
| morganfainberg | erm non-hashed | 22:26 |
| *** anniec has joined #openstack-dev | 22:26 | |
| *** sushils has quit IRC | 22:26 | |
| morganfainberg | henrynash, i think that that argument can be made. we'd need to ensure we're not assuming validity in a way that would break otherwise | 22:27 |
| dolphm | (if we're going to hash, i'd suggest something strong than sha1) | 22:27 |
| morganfainberg | henrynash, but as long as we decouple that cleanly, yes. | 22:27 |
| dolphm | stronger* | 22:27 |
| morganfainberg | dolphm, sha256? | 22:27 |
| *** lbragstad has quit IRC | 22:27 | |
| dolphm | morganfainberg: that's as high as we can go for convenience, probably | 22:27 |
| *** lbragstad has joined #openstack-dev | 22:28 | |
| bknudson | could be keyed off some secret known about each domain. | 22:29 |
| morganfainberg | dolphm / bknudson, do we need anything to reverse the hashing? | 22:29 |
| morganfainberg | or would it always be a forward lookup? | 22:30 |
| morganfainberg | henrynash, actually list_projects for user (if you need to lookup the user from id) would need domain i think? | 22:31 |
| morganfainberg | unless the id was the full dn (or hash thereof) | 22:32 |
| henrynash | morganfainberg: why would you need to look up the user? | 22:32 |
| bknudson | how about this API: List effective role assignments: GET /role_assignments | 22:32 |
| dolphm | morganfainberg: you want to be able to rip apart a user ID to figure out the domain driver to call? | 22:32 |
| bknudson | I guess that only deals with IDs. | 22:33 |
| morganfainberg | dolphm, i don't know if we need that. | 22:33 |
| morganfainberg | dolphm, just something to consider if we do hashing. | 22:33 |
| henrynash | bknudson: purely should reflect the id mappings in assignment…no need to look up users | 22:33 |
| *** mlavalle has left #openstack-dev | 22:33 | |
| *** sarob has joined #openstack-dev | 22:33 | |
| morganfainberg | dolphm is there ever a case we will have the hash and need to be able to get the user_ref. | 22:34 |
| dolphm | morganfainberg: wait, is that not the point? | 22:34 |
| henrynash | morganfainberg: list_project_for_user does uses get_user() today, but I'm looking at that for another bug…since it thinks it needs to get the default project for the user…but I think that is superflous | 22:34 |
| bknudson | henrynash: what about ops like HEAD /projects/{project_id}/users/{user_id}/roles/{role_id} | 22:35 |
| dolphm | morganfainberg: when you say hash, you mean "user_id = hash(dn)", right? so GET /users/{hashed_dn} has to return a user_ref | 22:35 |
| morganfainberg | bknudson, again, project_id can derive domain if needed. | 22:35 |
| bknudson | only touches the assignment backend so doesn't need to look up at all? | 22:35 |
| henrynash | bknudson: nope, just a mapping look up | 22:35 |
| morganfainberg | dolphm, yes. | 22:35 |
| bknudson | just wouldn't return a 404 if user didn't exist. | 22:35 |
| bknudson | although maybe it doesn't do that anywyas | 22:36 |
| henrynash | bknduson: yes the mapping is found or not | 22:36 |
| morganfainberg | dolphm, that is my thought, i might be wrong though. | 22:36 |
| dolphm | how long can dn's really be? | 22:36 |
| bknudson | do we want PUT /projects/{project_id}/users/{user_id}/roles/{role_id} to be successful if user doesn't exist or user isn't in project domain? | 22:36 |
| morganfainberg | dolphm, in AD as of 2012 looks like 255characters | 22:37 |
| morganfainberg | bknudson, i would say it should fail. | 22:38 |
| henrynash | bknudson: I guess it is debatable….but I would argue that we just allow the assignment and don't check the validity of UUIDs….as was point out earlier, future federation will be close to impossible otherwise | 22:38 |
| dolphm | bknudson: current behavior is that it would fail with a 404 | 22:38 |
| morganfainberg | if it didn't it would be a vector for a seciurity problem. create the grant, oops didn't exist, later a user is created that matches | 22:38 |
| henrynash | dolphm: I think that's true | 22:38 |
| morganfainberg | now that user has an unintended grant | 22:38 |
| bknudson | now it will fail if the user doesn't exist | 22:39 |
| henrynash | morganfainberg: a user is created with a random ID that just happens to match? | 22:39 |
| bknudson | but it will succeed if the user exists but is in a domain other than the project | 22:39 |
| bknudson | right? | 22:39 |
| *** ericw has joined #openstack-dev | 22:39 | |
| henrynash | morganfainberg: isn't that just as likely as two users getting the same UUID on creation? | 22:40 |
| dolphm | hashing was suggested because "dn would be unique, but might be longer than the db allows" ... if dn's can only be 255 chars, hashing isn't really a gain | 22:40 |
| dolphm | 255 is fine | 22:40 |
| dolphm | so, how about just user_id = urlencode(dn) | 22:41 |
| dolphm | persist in sql as plain text, urlencode on the wire | 22:41 |
| dolphm | we could start url encoding / decoding everything without consequence (every *other* ID is url safe by design..) | 22:42 |
| bknudson | it's the ID col that would be a problem... https://github.com/openstack/keystone/blob/master/keystone/assignment/backends/sql.py#L644 | 22:43 |
| bknudson | it's 64 | 22:43 |
| dolphm | bknudson: make it 255? | 22:43 |
| bknudson | works for me | 22:43 |
| *** atiwari has quit IRC | 22:43 | |
| morganfainberg | that seems sane | 22:45 |
| bknudson | but also doesn't seem like something to put in H | 22:45 |
| morganfainberg | dolphm, with url-encode we should probably add some buffer in there. | 22:46 |
| *** nati_ueno_2 has joined #openstack-dev | 22:46 | |
| dolphm | morganfainberg: store the plaintext dn in sql, no? | 22:46 |
| morganfainberg | dolphm, yes. | 22:47 |
| morganfainberg | dolphm, oh oh | 22:47 |
| morganfainberg | derp. | 22:47 |
| dolphm | morganfainberg: encode/decode in the controllers | 22:47 |
| bknudson | seems like we could configure some # of pieces of the DN rather than the whole thing. | 22:47 |
| morganfainberg | yes | 22:47 |
| bknudson | if necessary | 22:47 |
| morganfainberg | dolphm, was thinking of storing encoded in the DB… :P | 22:48 |
| morganfainberg | which doesn't make sense | 22:48 |
| morganfainberg | plaintext is the right way for sure. | 22:48 |
| dolphm | morganfainberg: if you do that then you should zlib it too :P | 22:48 |
| morganfainberg | dolphm, can we layer lzma and rot13 on it while we're at it? | 22:48 |
| * dolphm win | 22:49 | |
| *** dolphm has quit IRC | 22:49 | |
| *** FunnyLookinHat has quit IRC | 22:49 | |
| *** wolfdreamer has quit IRC | 22:49 | |
| *** jvrbanac has quit IRC | 22:50 | |
| *** stevebaker_ has joined #openstack-dev | 22:51 | |
| *** ericw has quit IRC | 22:51 | |
| *** sarob has quit IRC | 22:52 | |
| *** jdennis1 has joined #openstack-dev | 22:52 | |
| *** bknudson has quit IRC | 22:52 | |
| *** donaldh has quit IRC | 22:54 | |
| *** zz_Guest40704 is now known as leif | 22:54 | |
| *** leif is now known as Guest80380 | 22:54 | |
| *** nati_ueno_2 has quit IRC | 22:55 | |
| *** nati_ueno_2 has joined #openstack-dev | 22:55 | |
| *** vkmc has joined #openstack-dev | 22:56 | |
| *** vkmc has quit IRC | 22:56 | |
| *** vkmc has joined #openstack-dev | 22:56 | |
| *** kbrierly has quit IRC | 22:57 | |
| morganfainberg | henrynash, fair enough, but if we have deterministic uids (partial DNs) it could be a problem | 22:58 |
| henrynash | morganfainberg: that's a fair point | 22:58 |
| *** nati_uen_ has joined #openstack-dev | 22:58 | |
| *** Mandell has quit IRC | 23:00 | |
| *** nati_ueno_2 has quit IRC | 23:00 | |
| *** dstanek has quit IRC | 23:01 | |
| *** Mandell has joined #openstack-dev | 23:01 | |
| *** devoid has quit IRC | 23:02 | |
| *** Ryan_Lane has quit IRC | 23:07 | |
| *** anniec has quit IRC | 23:07 | |
| *** Ryan_Lane has joined #openstack-dev | 23:07 | |
| *** dstanek has joined #openstack-dev | 23:08 | |
| *** clayb has quit IRC | 23:09 | |
| *** bnemec_away is now known as bnemec | 23:09 | |
| *** vipul is now known as vipul-away | 23:09 | |
| *** nati_uen_ has quit IRC | 23:09 | |
| *** nati_ueno_2 has joined #openstack-dev | 23:10 | |
| *** galstrom_zzz is now known as galstrom | 23:11 | |
| *** nati_uen_ has joined #openstack-dev | 23:11 | |
| *** galstrom is now known as galstrom_zzz | 23:12 | |
| *** nati_ueno_2 has quit IRC | 23:14 | |
| *** nati_uen_ has quit IRC | 23:16 | |
| *** nati_ueno_2 has joined #openstack-dev | 23:17 | |
| *** stevebaker_ has quit IRC | 23:17 | |
| *** xmltok has quit IRC | 23:18 | |
| *** stevebaker_ has joined #openstack-dev | 23:18 | |
| *** vipul-away is now known as vipul | 23:20 | |
| *** xmltok has joined #openstack-dev | 23:21 | |
| *** nati_ueno_2 has quit IRC | 23:21 | |
| *** xmltok has quit IRC | 23:23 | |
| *** terryh has quit IRC | 23:24 | |
| *** aeperezt has quit IRC | 23:25 | |
| *** malini1 has joined #openstack-dev | 23:27 | |
| *** sarob has joined #openstack-dev | 23:29 | |
| *** markwash has quit IRC | 23:29 | |
| *** stevebaker_ has quit IRC | 23:29 | |
| *** kenperkins has quit IRC | 23:30 | |
| morganfainberg | henrynash, There is a lot to digest in this conversation today. I think I'll see if I can come up with some cleanup / completion of the feature this weekend. | 23:32 |
| *** armax has quit IRC | 23:32 | |
| *** stevebaker_ has joined #openstack-dev | 23:32 | |
| morganfainberg | henrynash, it wont hurt us to be closer, but I'd still recommend keeping it marked as "experimental" since I think the final fixes will be Icehouse. | 23:33 |
| henrynash | morganfainberg: I agree | 23:33 |
| *** MaxV has joined #openstack-dev | 23:34 | |
| *** colinmcnamara has quit IRC | 23:35 | |
| *** bswartz has joined #openstack-dev | 23:38 | |
| *** henrynash has quit IRC | 23:40 | |
| *** chenxu has joined #openstack-dev | 23:41 | |
| *** pmathews has quit IRC | 23:41 | |
| *** colinmcnamara has joined #openstack-dev | 23:42 | |
| *** vishious is now known as vishy | 23:42 | |
| *** otherwiseguy has joined #openstack-dev | 23:44 | |
| *** hemna is now known as hemnafk | 23:44 | |
| *** CaptTofu has joined #openstack-dev | 23:45 | |
| *** malini1 has quit IRC | 23:47 | |
| *** otherwiseguy has quit IRC | 23:50 | |
| *** stevebaker_ has quit IRC | 23:50 | |
| *** MaxV has quit IRC | 23:51 | |
| *** stevebaker_ has joined #openstack-dev | 23:53 | |
| ayoung | don't hash...just put a rule that the user id has to be globally unique and document that it should be the DN | 23:55 |
| *** lcheng has quit IRC | 23:55 | |
| *** diogogmt has quit IRC | 23:55 | |
| *** noslzzp has quit IRC | 23:55 | |
| *** jdennis1 has quit IRC | 23:56 | |
| *** comay has quit IRC | 23:57 | |
| *** danwent has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!