| jamielennox | stevemar: ping | 00:00 |
|---|---|---|
| stevemar | jamielennox pong | 00:00 |
| jamielennox | i'm having a look through your oauth review | 00:01 |
| *** pixelb has joined #openstack-dev | 00:01 | |
| *** FatDarrel has quit IRC | 00:01 | |
| jamielennox | actually give me a sec, i'll post the reviews i have | 00:01 |
| jamielennox | stevemar: ok, reviewed | 00:02 |
| *** salv-orlando has quit IRC | 00:02 | |
| jamielennox | so looking and token manager - if access_token and request_token are fairly different things does it make sense to split them into different managers? | 00:03 |
| stevemar | jamielennox thanks for the review - dolphm mentioned the same thing, but wasn't insistent on it | 00:04 |
| stevemar | jamielennox, i think that might be over-doing it | 00:04 |
| jamielennox | i think with everything _access_token it's different to the standard way we use managers | 00:05 |
| jamielennox | so we typically have just list() or get() | 00:05 |
| jamielennox | i think what i would do is split TokenManager into two parts AccessTokenManager and RequestTokenManager | 00:05 |
| jamielennox | then you have client.oauth1.access_token and client.oauth1.request_token | 00:06 |
| jamielennox | then when you want to do a list it's client.oauth1.access_token.list() | 00:06 |
| jamielennox | still explicit and obvious and fits in much better with the other client managers | 00:06 |
| *** sarob has joined #openstack-dev | 00:06 | |
| jamielennox | and you can have client.oauth1.access_token.authenticate and client.oauth1.request_token.authenticate without clashing | 00:07 |
| jamielennox | (btw, even if it's not _strictly_ correct i would pick either authenticate or authorize and use it for both managers) | 00:07 |
| jamielennox | (authenticate would be my preference i think) | 00:09 |
| jamielennox | (but whatever) | 00:09 |
| *** adjohn has quit IRC | 00:11 | |
| *** sarob has quit IRC | 00:11 | |
| *** cjellick1 has quit IRC | 00:14 | |
| *** sthaha has joined #openstack-dev | 00:16 | |
| *** faramir1 has joined #openstack-dev | 00:17 | |
| *** mangelajo has joined #openstack-dev | 00:18 | |
| *** vuil has quit IRC | 00:20 | |
| *** cjellick has joined #openstack-dev | 00:21 | |
| *** rnirmal has quit IRC | 00:22 | |
| *** matsuhashi has joined #openstack-dev | 00:22 | |
| *** mangelajo has quit IRC | 00:23 | |
| *** jfcastro has joined #openstack-dev | 00:24 | |
| jfcastro | anybody has deployed glance-scrubber in Unbuntu and Grizzly? | 00:24 |
| *** bdpayne has quit IRC | 00:28 | |
| stevemar | jamielennox, ping | 00:31 |
| jamielennox | stevemar: i'm here | 00:31 |
| stevemar | jamielennox, your comment here: https://review.openstack.org/#/c/30043/39/keystoneclient/v3/contrib/oauth1/core.py | 00:31 |
| jamielennox | yep | 00:31 |
| stevemar | what should I be inheriting from then? | 00:31 |
| jamielennox | object | 00:31 |
| stevemar | or just object | 00:31 |
| stevemar | rgr | 00:32 |
| *** morazi has quit IRC | 00:32 | |
| *** nermina has left #openstack-dev | 00:32 | |
| gyee | stevemar! | 00:34 |
| stevemar | gyee: ahoy | 00:34 |
| gyee | is HEAT using OAUTH yet? | 00:35 |
| jamielennox | it might be worth thinking about putting in some raise exceptions.HTTPNotImplemented("Update not supported for trusts") style statements for things that don't make sense as well | 00:35 |
| stevemar | gyee: don't think so :( | 00:35 |
| gyee | stevemar, you know any OpenStack service integrated with OAUTH yet? | 00:35 |
| stevemar | gyee: nope | 00:35 |
| stevemar | gyee: some folks have poked around it | 00:35 |
| gyee | stevemar, we are looking at it too | 00:36 |
| stevemar | gyee: is this mark miller and such? | 00:36 |
| gyee | I want to to gather some fire power so I can walk into the meeting with my guns blazing :) | 00:36 |
| gyee | like there are 15 services lining up to integrate with it! | 00:37 |
| gyee | something like that :) | 00:37 |
| stevemar | gyee: lol, by services you mean OS or HP ones? | 00:38 |
| gyee | OS | 00:38 |
| stevemar | gyee: cool, can you be more specific, mainly heat ones? | 00:38 |
| gyee | I just want to be able to argue on use cases | 00:38 |
| gyee | stevemar, my understanding is that heat need to perform operations in the user context | 00:39 |
| gyee | that's why they need delegation | 00:39 |
| gyee | I wonder what other use cases out there | 00:39 |
| gyee | maybe nova launching a vm in the user context? | 00:40 |
| stevemar | gyee: yup, that was one we had in mind | 00:40 |
| gyee | or backup an image to glance? | 00:40 |
| stevemar | gyee: any service that you want delegated really, our internal use case was more for users who weren't known to OS | 00:41 |
| *** adjohn has joined #openstack-dev | 00:41 | |
| *** dtyarnell has joined #openstack-dev | 00:42 | |
| gyee | stevemar, ah federation and oauth | 00:42 |
| *** wenjianhn has joined #openstack-dev | 00:43 | |
| stevemar | gyee: actually federation wasn't even in mind yet - but it did work out nicely that way | 00:43 |
| stevemar | gyee: but let me know if you have any hiccups with it, i'll certainly help as much as i can | 00:43 |
| stevemar | gyee: you are working on heat nowadays? | 00:43 |
| gyee | stevemar, I am just looking at it from operation standpoint, haven't dig into the details yet | 00:44 |
| stevemar | ah okay | 00:44 |
| stevemar | gyee: yeah, lots of poking around oauth :) | 00:44 |
| *** ctracey has quit IRC | 01:00 | |
| *** ctracey has joined #openstack-dev | 01:01 | |
| *** blamar has quit IRC | 01:02 | |
| *** blamar has joined #openstack-dev | 01:02 | |
| *** utlemming has quit IRC | 01:02 | |
| *** ctracey has quit IRC | 01:02 | |
| *** ctracey has joined #openstack-dev | 01:03 | |
| *** utlemming has joined #openstack-dev | 01:03 | |
| *** ron-slc has quit IRC | 01:04 | |
| *** BLZbubba has quit IRC | 01:04 | |
| *** thingee has quit IRC | 01:04 | |
| *** thingee has joined #openstack-dev | 01:04 | |
| *** anteaya has quit IRC | 01:04 | |
| *** BLZbubba has joined #openstack-dev | 01:05 | |
| *** ron-slc has joined #openstack-dev | 01:05 | |
| *** Mandell has joined #openstack-dev | 01:07 | |
| *** nermina has joined #openstack-dev | 01:07 | |
| *** mfer has joined #openstack-dev | 01:09 | |
| *** nermina has left #openstack-dev | 01:09 | |
| jog0 | any neutron folks around | 01:09 |
| jfcastro | where I must deploy cinder-scheduler: at controller or with cinder-volume? | 01:10 |
| *** jbresnah has joined #openstack-dev | 01:12 | |
| *** freedomhui has joined #openstack-dev | 01:12 | |
| *** sandywalsh_ has quit IRC | 01:14 | |
| *** READ10 has quit IRC | 01:16 | |
| *** ctracey has quit IRC | 01:16 | |
| *** comay has quit IRC | 01:18 | |
| *** tvb|afk has joined #openstack-dev | 01:18 | |
| *** tvb|afk has quit IRC | 01:18 | |
| *** tvb|afk has joined #openstack-dev | 01:18 | |
| *** mangelajo has joined #openstack-dev | 01:19 | |
| *** venkatesh has joined #openstack-dev | 01:20 | |
| morganfainberg | jog0, pinfg | 01:20 |
| morganfainberg | wow. ping even | 01:20 |
| morganfainberg | jog0, ran into an interesting side-effect of the cache code you were requesting. | 01:20 |
| *** topol has joined #openstack-dev | 01:21 | |
| morganfainberg | jog0, when using os_cache, there is no guarantee or need to be explicitly passing a password in. I can simply invalidate the cache, but, that is about all I can do. re-authing is not guaranteed to be in the cards. | 01:21 |
| *** tvb|afk has quit IRC | 01:23 | |
| *** adjohn has quit IRC | 01:23 | |
| jog0 | morganfainberg: are you saying that if the token expired all you can do is flush the cache. but can't guarantee a re-auth wiil work? | 01:23 |
| jog0 | if so thats what I expected | 01:24 |
| *** mangelajo has quit IRC | 01:24 | |
| morganfainberg | jog0, ok i can also add in the logic to try and re-auth if there is self.username/self.password (90% there actually) | 01:24 |
| morganfainberg | jog0, but not really required. | 01:24 |
| *** jasdeepH has quit IRC | 01:24 | |
| morganfainberg | jog0, ok so i just need to tell the keyring saver to nuke it's save. cool that is way less work when it comes to tests. | 01:25 |
| morganfainberg | :P | 01:25 |
| *** mfer has quit IRC | 01:27 | |
| *** fifieldt has joined #openstack-dev | 01:27 | |
| jog0 | so the use case I imagine is: user auths, keyring saves token. a few hours later user is using the same token, turns out it expired. | 01:27 |
| jog0 | morganfainberg: so keyring flushes token, and user needs a new token now. If the user has to rerun a command to fetch a new token that seems reasonable but if its done behind the scenes if self.username is present even better | 01:28 |
| *** ctracey has joined #openstack-dev | 01:29 | |
| jog0 | in all this the user ideally doesn't notice | 01:29 |
| morganfainberg | jog0, sounds good i have most of that test work done. | 01:29 |
| jog0 | \o/ | 01:29 |
| *** changbl has joined #openstack-dev | 01:30 | |
| morganfainberg | jog0, just need to convince keyring saver to flush it. | 01:30 |
| morganfainberg | jog0, in either case that is | 01:30 |
| jog0 | what are the two cases? | 01:30 |
| *** gordc has joined #openstack-dev | 01:30 | |
| morganfainberg | 1: username and password are available, attempt reauth | 01:31 |
| morganfainberg | 2: username and password aren't both available, simply flush the cache | 01:31 |
| jog0 | right | 01:31 |
| morganfainberg | actually case 1, flush cache, THEN re-auth | 01:31 |
| jog0 | morganfainberg: in my mind i decoupled those two actions because if no token in cache then attempt auth | 01:32 |
| *** mangelajo has joined #openstack-dev | 01:32 | |
| jog0 | but the code may not be layed out that way | 01:32 |
| morganfainberg | jog0, this is only in the exceptional case of token validate fails | 01:32 |
| morganfainberg | jog0, but yes, you are correct, it is logically like this | 01:32 |
| morganfainberg | jog0, that* | 01:32 |
| morganfainberg | jog0, i'm working from the assumption that we already failed to validate a cached token (it was cached and loaded) | 01:33 |
| jog0 | morganfainberg: ahh | 01:33 |
| morganfainberg | jog0, if that isn't the case, we wouldn't even hit this new code path. | 01:33 |
| *** angdraug has quit IRC | 01:34 | |
| jog0 | *nod* | 01:35 |
| *** dstanek has quit IRC | 01:35 | |
| *** mangelajo has quit IRC | 01:36 | |
| *** erkules has quit IRC | 01:36 | |
| stevemar | jamielennox, new patch boss | 01:38 |
| morganfainberg | jog0, ah. we don't support flushing the cache out in the secret helper. | 01:41 |
| *** danwent has quit IRC | 01:41 | |
| morganfainberg | jog0, i think it is assumed you'd get a 404/401 in either case. | 01:41 |
| morganfainberg | jog0, so no reason to purge out the cache. | 01:42 |
| morganfainberg | jog0, not sure if i like that behavior. | 01:42 |
| jamielennox | stevemar: shall do | 01:44 |
| stevemar | jamielennox, give it 30 more seconds, just noticed that i'm using assertEquals instead of assertEqual | 01:44 |
| stevemar | we're fixing it in keystone, so may as well be consistent here | 01:44 |
| *** matiu has quit IRC | 01:46 | |
| *** venkatesh has quit IRC | 01:48 | |
| *** sandywalsh has joined #openstack-dev | 01:48 | |
| *** mfer has joined #openstack-dev | 01:48 | |
| *** spzala has joined #openstack-dev | 01:50 | |
| *** erkules has joined #openstack-dev | 01:53 | |
| *** tserong_ has joined #openstack-dev | 01:56 | |
| *** ljjjustin has joined #openstack-dev | 01:57 | |
| *** tserong has quit IRC | 01:59 | |
| *** tserong_ is now known as tserong | 01:59 | |
| *** rcrit has quit IRC | 02:01 | |
| *** xchu has joined #openstack-dev | 02:04 | |
| *** jfcastro has left #openstack-dev | 02:06 | |
| *** amohn9 has joined #openstack-dev | 02:07 | |
| *** mfer has joined #openstack-dev | 02:09 | |
| *** zhikunliu has joined #openstack-dev | 02:11 | |
| *** boris-42 has quit IRC | 02:13 | |
| *** dubsquared has joined #openstack-dev | 02:13 | |
| *** rcrit has joined #openstack-dev | 02:14 | |
| *** dubsquar_ has joined #openstack-dev | 02:15 | |
| *** Mandell has quit IRC | 02:17 | |
| *** dubsquared has quit IRC | 02:17 | |
| *** cjellick has quit IRC | 02:19 | |
| *** mangelajo has joined #openstack-dev | 02:19 | |
| *** mfer has quit IRC | 02:20 | |
| *** grizzled has quit IRC | 02:20 | |
| ayoung | jamielennox, did you see my message about certmonger/certmaster yesterday? | 02:24 |
| jamielennox | ayoung: yea, i did - i haven't had a chance to look at certmaster since though | 02:24 |
| ayoung | jamielennox, talked with nalin about it. It sounds like a good "development" tool. | 02:25 |
| *** mangelajo has quit IRC | 02:25 | |
| ayoung | Doesn't to OCSP or CRLs | 02:25 |
| ayoung | to->do | 02:25 |
| jamielennox | that's ok - it act's as a certmonger backend | 02:25 |
| jamielennox | ? | 02:25 |
| ayoung | yes | 02:26 |
| ayoung | certmaster would be the story for multinode | 02:26 |
| *** sld has quit IRC | 02:26 | |
| ayoung | you'd probably have to decide up front whether to use it, so maybe once we have certmaster in, we always use it, even for single node deployments | 02:27 |
| *** sld has joined #openstack-dev | 02:27 | |
| ayoung | jamielennox, I think I want to use it for the pki_setup in Keystone | 02:27 |
| ayoung | cermonger, that is | 02:27 |
| jamielennox | that's a run time dependency... | 02:28 |
| ayoung | Yep | 02:28 |
| ayoung | but a good one | 02:28 |
| ayoung | it provides a way to keep the certs active and updated | 02:28 |
| *** dubsquar_ has quit IRC | 02:28 | |
| ayoung | something that is missing now | 02:28 |
| ayoung | also, it will give us a way to tie in with barbican or whatever the cloudkeep folks end up calling their CA once they have it out. | 02:29 |
| jamielennox | stevemar: done | 02:29 |
| jamielennox | interesting cloudkeep as a backend to certmonger | 02:29 |
| ayoung | jamielennox, yeah...or whatever other CAs come up. We make certmonger a bridge component to keep the configuration simple | 02:32 |
| *** gyee has quit IRC | 02:32 | |
| *** dims has quit IRC | 02:33 | |
| ayoung | Then it becomes the common point for people to define how to talk to their particular CAs. We can even, potentially, tie it in with AMQP for notifications if we want to. | 02:33 |
| stevemar | jamielennox, alright, probably gonna fix it up tmrw, gettin sleepy | 02:33 |
| jamielennox | if we back barbican to dogtag, then certmonger to barbican - way to complicate life | 02:34 |
| jamielennox | stevemar: no worries | 02:35 |
| jamielennox | it's the right approach though | 02:35 |
| ayoung | stevemar, which patch? | 02:35 |
| jog0 | morganfainberg: I think we need to change that behavior then? we need to be able to flush the cache right? | 02:35 |
| jamielennox | though i'm not sure that SSL certs is barbicans area | 02:35 |
| jamielennox | sorry the right approach thing was intended at you ayoung | 02:36 |
| jamielennox | ayoung: https://review.openstack.org/#/c/30043/ | 02:36 |
| jamielennox | tell you what though the way stevemar is going your old trust reviews record may not keep you in the top couple | 02:37 |
| ayoung | jamielennox, the Dogtag folks are working on making the key escrow stuff work with an external CA. Barbican would work with that. So, yeah, not the SSL cert stuff. But somethihng in CLoudkeep is going to end up as a CA | 02:37 |
| *** amcrn has quit IRC | 02:37 | |
| jamielennox | ayoung: are the dogtags folks looking at integrating with barbican or just the principal | 02:37 |
| *** twoputt_ has joined #openstack-dev | 02:38 | |
| *** vipul has quit IRC | 02:38 | |
| *** stevemar has quit IRC | 02:38 | |
| jamielennox | (i had kind of thought it might be me that ends up looking at that integration) | 02:38 |
| ayoung | jamielennox, I don't know what is going on there. I think that talks have broken down. I suspect that the Coudkeepers sopped listening at Java | 02:38 |
| ayoung | stopped | 02:38 |
| jamielennox | i thought the talks were regarding API design | 02:39 |
| *** vipul has joined #openstack-dev | 02:39 | |
| jamielennox | they just had troubles getting the thing up and running, so long as the backend is pluggable i don't think it matters that much in the long run | 02:40 |
| ayoung | they were...but I suspect Ade got involved with day to day dogtag work (lots of it) and the CLoudkeep folk went on doing Python dev as they see it. I hope at least they took a good read of the API doc. | 02:40 |
| ayoung | THe install process for Dogtag is a farce. That is the one thing that really, really is in need of a do-over | 02:41 |
| *** mangelajo has joined #openstack-dev | 02:42 | |
| ayoung | I mean, yeah, for FIPS etc you need to lock down the server...but...its a tomcat app.... | 02:42 |
| jamielennox | i eventually got a standalone dogtag working for rhel6 - was a PITA though | 02:42 |
| ayoung | do it like every other tomcat app out there. | 02:42 |
| *** sdague has quit IRC | 02:42 | |
| *** sdague has joined #openstack-dev | 02:42 | |
| *** neelashah has joined #openstack-dev | 02:42 | |
| jamielennox | i've no experience deploying java | 02:43 |
| ayoung | I had it all down back 2 years ago. Then bstein came by with "Hey, I have something you might be interested in working on." | 02:43 |
| *** giulivo has quit IRC | 02:43 | |
| ayoung | DId Java from 99 through 2004, and then again for my first year at RH | 02:44 |
| *** freedomhui has quit IRC | 02:44 | |
| *** dtyarnell has quit IRC | 02:45 | |
| jamielennox | ayoung: i don't mind it, the bit i've done - i've just never found the extra memory of the JVM worth it | 02:45 |
| ayoung | anyway...I think you are on the right track with the "here are where the files go" env vars. Instead ostraight openssl calls, we do certmonger with the self signed options for the first irteration, and do certmaster for the second. We might even decide to move the certmaster stuff into the core projects | 02:45 |
| jamielennox | i understand it from a mainframe and enterprise view but otherwise just no | 02:46 |
| ayoung | jamielennox, talk to me when we are not working on a project in a language with a GIL | 02:46 |
| *** mangelajo has quit IRC | 02:46 | |
| jamielennox | i've done plenty of C and multithreaded C | 02:46 |
| jamielennox | that gets fun | 02:46 |
| ayoung | yeah...I miss that, too | 02:46 |
| ayoung | I liked the Kernel work I was doing at Penguin. | 02:47 |
| jamielennox | anyway again, i'm not specifying where the cert files go - the user is telling me | 02:47 |
| ayoung | Process migration, file caching, remote forks, signal forwarding...and maintaining Posix semantics. Everything since then has felt like kids stuff | 02:47 |
| ayoung | right, right...it is the cert genreation game that I want us out of. Where it goes is up to the user. | 02:48 |
| *** jbresnah has quit IRC | 02:48 | |
| ayoung | I thin I am going to open a blueprint for Certmonger integration for Keystone. | 02:48 |
| jamielennox | mmm, not really - where it goes is up to whoever made the certs - i don't want to be creating files into a specific location | 02:49 |
| jamielennox | if i'm creating certs then i'll put them wherever I want because apparently the user doesn't care | 02:49 |
| jamielennox | so long as they work | 02:49 |
| jamielennox | anyway i need to look into fixing grenade before i can make that work | 02:50 |
| ayoung | Keystone knows. It is in the config file | 02:50 |
| *** sandywalsh has quit IRC | 02:50 | |
| ayoung | to keystone_manage pki_setup and ssl_setup can just be calls to certmonger | 02:50 |
| ayoung | we could even, potentially do the same thing for the signing certs from auth_token | 02:51 |
| ayoung | but that is not really the right thing... | 02:51 |
| *** dtyarnell has joined #openstack-dev | 02:52 | |
| *** nati_ueno has joined #openstack-dev | 02:53 | |
| *** anniec has quit IRC | 02:53 | |
| *** johnpur has quit IRC | 02:54 | |
| *** briancurtin has quit IRC | 02:54 | |
| *** dkranz has joined #openstack-dev | 02:55 | |
| jamielennox | this sounds like something that should be driven from packstack or something rather that part of keystone-manage | 02:59 |
| jamielennox | but i'm happy with the idea that we should say use certmonger instead of doing ssl_setup | 02:59 |
| *** amohn9 has left #openstack-dev | 03:01 | |
| ayoung | jamielennox, maybe. But I like the idea of making the SSL work be as simple as possible. THis way, only Keystone needs to get it right. | 03:01 |
| *** freedomhui has joined #openstack-dev | 03:01 | |
| *** paragan has joined #openstack-dev | 03:05 | |
| *** martine has joined #openstack-dev | 03:07 | |
| *** martine is now known as Guest60418 | 03:07 | |
| *** edmund has quit IRC | 03:08 | |
| *** galstrom_zzz is now known as galstrom | 03:09 | |
| jamielennox | ayoung: going to get lunch, cya tomorrow | 03:11 |
| ayoung | jamielennox, g'night | 03:11 |
| *** edmund has joined #openstack-dev | 03:13 | |
| *** anniec has joined #openstack-dev | 03:15 | |
| *** stevemar has joined #openstack-dev | 03:17 | |
| *** jecarey has joined #openstack-dev | 03:18 | |
| *** freedomhui has quit IRC | 03:18 | |
| *** anniec_ has joined #openstack-dev | 03:18 | |
| *** anniec has quit IRC | 03:19 | |
| *** anniec_ is now known as anniec | 03:19 | |
| *** freedomhui has joined #openstack-dev | 03:19 | |
| *** mangelajo has joined #openstack-dev | 03:20 | |
| *** alexxu has joined #openstack-dev | 03:21 | |
| *** novas0x2a|laptop has quit IRC | 03:22 | |
| *** mangelajo has quit IRC | 03:25 | |
| *** galstrom is now known as galstrom_zzz | 03:29 | |
| *** jecarey has quit IRC | 03:30 | |
| *** schwicht has quit IRC | 03:31 | |
| *** pixelb has quit IRC | 03:33 | |
| *** amotoki has quit IRC | 03:36 | |
| *** spzala has quit IRC | 03:39 | |
| *** zhiyan has joined #openstack-dev | 03:40 | |
| *** ayoung has quit IRC | 03:41 | |
| *** sushils has joined #openstack-dev | 03:45 | |
| *** galstrom_zzz is now known as galstrom | 03:46 | |
| *** twoputt has quit IRC | 03:48 | |
| *** twoputt_ is now known as twoputt | 03:48 | |
| *** adjohn has joined #openstack-dev | 03:49 | |
| *** sushils has quit IRC | 03:49 | |
| *** adjohn has quit IRC | 03:50 | |
| *** sushils has joined #openstack-dev | 03:52 | |
| *** terriyu has quit IRC | 03:52 | |
| *** neelashah has quit IRC | 03:55 | |
| *** Mandell has joined #openstack-dev | 03:58 | |
| *** matsuhashi has quit IRC | 03:59 | |
| *** matsuhashi has joined #openstack-dev | 04:02 | |
| *** stevemar has quit IRC | 04:03 | |
| *** galstrom is now known as galstrom_zzz | 04:11 | |
| *** gongysh has joined #openstack-dev | 04:13 | |
| *** vipul is now known as vipul-away | 04:14 | |
| *** ecarlin has joined #openstack-dev | 04:16 | |
| *** ecarlin has quit IRC | 04:16 | |
| *** anniec has quit IRC | 04:17 | |
| *** mangelajo has joined #openstack-dev | 04:20 | |
| *** pmathews has joined #openstack-dev | 04:22 | |
| *** aditirav has joined #openstack-dev | 04:23 | |
| *** kaushikc has joined #openstack-dev | 04:24 | |
| *** mangelajo has quit IRC | 04:25 | |
| *** aditirav has quit IRC | 04:26 | |
| *** kaushikc1 has joined #openstack-dev | 04:27 | |
| *** aditirav has joined #openstack-dev | 04:27 | |
| *** sridevi has joined #openstack-dev | 04:28 | |
| *** kaushikc has quit IRC | 04:29 | |
| *** bnemec_ has joined #openstack-dev | 04:30 | |
| *** bnemec has quit IRC | 04:30 | |
| *** kaushikc has joined #openstack-dev | 04:31 | |
| *** kaushikc has quit IRC | 04:31 | |
| *** kaushikc has joined #openstack-dev | 04:31 | |
| *** adjohn has joined #openstack-dev | 04:33 | |
| *** kaushikc has quit IRC | 04:34 | |
| *** kaushikc has joined #openstack-dev | 04:34 | |
| *** kaushikc1 has quit IRC | 04:34 | |
| *** kaushikc1 has joined #openstack-dev | 04:35 | |
| *** Guest60418 has quit IRC | 04:35 | |
| *** freedomhui has quit IRC | 04:37 | |
| *** jhesketh has quit IRC | 04:38 | |
| *** jhesketh__ has quit IRC | 04:38 | |
| *** kaushikc has quit IRC | 04:38 | |
| *** edmund has quit IRC | 04:39 | |
| *** kaushikc1 has quit IRC | 04:48 | |
| *** sumanthns has joined #openstack-dev | 04:48 | |
| *** melwitt has quit IRC | 04:51 | |
| *** jhesketh has joined #openstack-dev | 04:51 | |
| *** jhesketh__ has joined #openstack-dev | 04:51 | |
| *** reed has quit IRC | 04:54 | |
| *** mangelajo has joined #openstack-dev | 04:57 | |
| *** mangelajo has quit IRC | 05:01 | |
| *** alexxu has quit IRC | 05:02 | |
| *** claxton has joined #openstack-dev | 05:02 | |
| *** otherwiseguy has quit IRC | 05:05 | |
| *** gordc has quit IRC | 05:07 | |
| *** jbresnah has joined #openstack-dev | 05:09 | |
| *** zaitcev has quit IRC | 05:11 | |
| *** nshaikh has joined #openstack-dev | 05:17 | |
| *** bashok has joined #openstack-dev | 05:17 | |
| *** prekarat1 has joined #openstack-dev | 05:17 | |
| *** aditirav_ has joined #openstack-dev | 05:18 | |
| *** aditirav_ has joined #openstack-dev | 05:19 | |
| *** fifieldt has quit IRC | 05:21 | |
| *** aditirav has quit IRC | 05:22 | |
| *** aditirav_ is now known as aditirav | 05:22 | |
| *** tvb|afk has joined #openstack-dev | 05:22 | |
| *** nati_ueno has quit IRC | 05:26 | |
| *** mangelajo has joined #openstack-dev | 05:27 | |
| *** freedomhui has joined #openstack-dev | 05:27 | |
| *** tvb|afk has quit IRC | 05:27 | |
| *** alexxu has joined #openstack-dev | 05:28 | |
| *** mangelajo has quit IRC | 05:32 | |
| *** rwsu has quit IRC | 05:34 | |
| *** jbresnah has quit IRC | 05:36 | |
| *** jbresnah has joined #openstack-dev | 05:36 | |
| *** SkyRocknRoll_ has joined #openstack-dev | 05:38 | |
| *** SkyRocknRoll_ is now known as SkyRocknRol | 05:38 | |
| *** SkyRocknRol has quit IRC | 05:38 | |
| *** raies has joined #openstack-dev | 05:40 | |
| *** twoputt has quit IRC | 05:41 | |
| *** twoputt has joined #openstack-dev | 05:42 | |
| *** nati_ueno has joined #openstack-dev | 05:45 | |
| *** rwsu has joined #openstack-dev | 05:45 | |
| *** zhikunliu has quit IRC | 05:47 | |
| *** afazekas_zz is now known as afazekas | 05:47 | |
| *** eglynn has joined #openstack-dev | 05:49 | |
| *** pmathews has quit IRC | 05:51 | |
| *** zhikunliu has joined #openstack-dev | 05:52 | |
| *** bashok has quit IRC | 05:55 | |
| *** yaguang has joined #openstack-dev | 05:59 | |
| *** claxton has quit IRC | 06:00 | |
| *** adjohn has quit IRC | 06:00 | |
| *** yaguang has quit IRC | 06:00 | |
| *** yaguang_ has joined #openstack-dev | 06:00 | |
| *** xchu has quit IRC | 06:09 | |
| *** yolanda has joined #openstack-dev | 06:10 | |
| *** yaguang_ has quit IRC | 06:10 | |
| *** yaguang has joined #openstack-dev | 06:12 | |
| *** rahmu has quit IRC | 06:12 | |
| *** _anant has joined #openstack-dev | 06:13 | |
| *** gaelL has quit IRC | 06:13 | |
| *** rahmu has joined #openstack-dev | 06:13 | |
| *** gaelL has joined #openstack-dev | 06:14 | |
| *** afazekas is now known as __afazekas | 06:14 | |
| *** yaguang has quit IRC | 06:17 | |
| *** yaguang has joined #openstack-dev | 06:17 | |
| *** SergeyLukjanov has joined #openstack-dev | 06:21 | |
| *** belmoreira has joined #openstack-dev | 06:22 | |
| *** MaxV has joined #openstack-dev | 06:23 | |
| *** tvb|afk has joined #openstack-dev | 06:23 | |
| *** xchu has joined #openstack-dev | 06:25 | |
| *** yaguang has quit IRC | 06:26 | |
| *** mangelajo has joined #openstack-dev | 06:27 | |
| *** yaguang has joined #openstack-dev | 06:27 | |
| *** zhiyan has quit IRC | 06:31 | |
| *** jcoufal has joined #openstack-dev | 06:32 | |
| *** xqueralt-afk is now known as xqueralt | 06:33 | |
| *** yaguang has quit IRC | 06:34 | |
| *** MaxV has quit IRC | 06:36 | |
| *** prekarat1 has quit IRC | 06:38 | |
| *** afazekas has joined #openstack-dev | 06:43 | |
| *** vartom10 has joined #openstack-dev | 06:45 | |
| *** tvb|afk has quit IRC | 06:47 | |
| *** matsuhashi has quit IRC | 06:47 | |
| *** corXi has joined #openstack-dev | 06:55 | |
| *** reidrac has joined #openstack-dev | 06:56 | |
| *** zhiyan has joined #openstack-dev | 06:56 | |
| *** topol has quit IRC | 06:58 | |
| *** ndipanov has joined #openstack-dev | 06:59 | |
| *** mrunge has joined #openstack-dev | 07:00 | |
| *** adjohn has joined #openstack-dev | 07:02 | |
| *** nil1511 has joined #openstack-dev | 07:02 | |
| *** prekarat has joined #openstack-dev | 07:04 | |
| *** odyssey4me has joined #openstack-dev | 07:06 | |
| *** matsuhashi has joined #openstack-dev | 07:06 | |
| *** xga has joined #openstack-dev | 07:06 | |
| *** nil1511 has quit IRC | 07:08 | |
| *** rdopieralski has joined #openstack-dev | 07:09 | |
| *** rdopiera1ski has joined #openstack-dev | 07:09 | |
| *** DeeJay1 has joined #openstack-dev | 07:10 | |
| *** adjohn has quit IRC | 07:10 | |
| *** ema has joined #openstack-dev | 07:10 | |
| *** ema has joined #openstack-dev | 07:10 | |
| *** gongysh has quit IRC | 07:14 | |
| *** jprovazn has joined #openstack-dev | 07:14 | |
| *** corXi has quit IRC | 07:15 | |
| *** fbo_away is now known as fbo | 07:15 | |
| *** gongysh has joined #openstack-dev | 07:16 | |
| *** martyntaylor has joined #openstack-dev | 07:17 | |
| *** corXi has joined #openstack-dev | 07:17 | |
| *** jbresnah has quit IRC | 07:17 | |
| *** vartom11 has joined #openstack-dev | 07:21 | |
| *** vartom10 has quit IRC | 07:22 | |
| *** o_petit has joined #openstack-dev | 07:22 | |
| *** SergeyLukjanov has quit IRC | 07:24 | |
| *** eglynn has quit IRC | 07:24 | |
| *** rdopiera1ski is now known as rdopieralski | 07:26 | |
| *** gongysh has quit IRC | 07:26 | |
| *** feleouet has joined #openstack-dev | 07:27 | |
| *** SergeyLukjanov has joined #openstack-dev | 07:30 | |
| *** henrynash has joined #openstack-dev | 07:30 | |
| *** safchain has joined #openstack-dev | 07:30 | |
| *** gongysh has joined #openstack-dev | 07:35 | |
| *** xga_ has joined #openstack-dev | 07:36 | |
| *** romcheg1 has joined #openstack-dev | 07:36 | |
| *** xga has quit IRC | 07:39 | |
| *** salv-orlando has joined #openstack-dev | 07:39 | |
| *** gongysh has quit IRC | 07:39 | |
| *** johnthetubaguy has joined #openstack-dev | 07:41 | |
| *** gongysh has joined #openstack-dev | 07:42 | |
| *** tvb|afk has joined #openstack-dev | 07:43 | |
| *** bashok has joined #openstack-dev | 07:45 | |
| *** johnthetubaguy has quit IRC | 07:45 | |
| *** kspear has quit IRC | 07:45 | |
| *** SergeyLukjanov has quit IRC | 07:45 | |
| *** ljjjustin has quit IRC | 07:46 | |
| *** SergeyLukjanov has joined #openstack-dev | 07:46 | |
| *** claxton has joined #openstack-dev | 07:47 | |
| *** rossella_s has joined #openstack-dev | 07:48 | |
| *** pabelanger has quit IRC | 07:50 | |
| *** kspear has joined #openstack-dev | 07:52 | |
| *** romcheg1 has left #openstack-dev | 07:53 | |
| *** Oneiroi has quit IRC | 07:55 | |
| *** shang has quit IRC | 07:56 | |
| *** _anant has quit IRC | 07:56 | |
| *** danpb has joined #openstack-dev | 07:56 | |
| *** _anant has joined #openstack-dev | 07:56 | |
| *** MaxV has joined #openstack-dev | 07:58 | |
| *** bogdando has quit IRC | 07:59 | |
| *** bashok_ has joined #openstack-dev | 08:00 | |
| *** ifarkas has joined #openstack-dev | 08:00 | |
| *** _anant has quit IRC | 08:00 | |
| *** _anant has joined #openstack-dev | 08:01 | |
| *** bogdando has joined #openstack-dev | 08:02 | |
| *** SergeyLu_ has joined #openstack-dev | 08:02 | |
| *** pabelanger has joined #openstack-dev | 08:03 | |
| *** kspear has quit IRC | 08:03 | |
| *** bashok has quit IRC | 08:03 | |
| *** networkstatic has quit IRC | 08:03 | |
| *** SergeyLukjanov has quit IRC | 08:04 | |
| *** boden has joined #openstack-dev | 08:04 | |
| *** _anant has quit IRC | 08:04 | |
| *** _anant has joined #openstack-dev | 08:06 | |
| *** o_petit has quit IRC | 08:09 | |
| *** o_petit has joined #openstack-dev | 08:09 | |
| *** _anant has quit IRC | 08:09 | |
| *** _anant has joined #openstack-dev | 08:10 | |
| *** zhikunliu has quit IRC | 08:10 | |
| *** briancline has quit IRC | 08:10 | |
| *** kspear has joined #openstack-dev | 08:10 | |
| *** eglynn has joined #openstack-dev | 08:10 | |
| *** derekh has joined #openstack-dev | 08:12 | |
| *** _anant has quit IRC | 08:14 | |
| *** _anant has joined #openstack-dev | 08:14 | |
| *** athomas has joined #openstack-dev | 08:14 | |
| *** briancline has joined #openstack-dev | 08:17 | |
| *** zhikunliu has joined #openstack-dev | 08:17 | |
| *** yongli is now known as yongli_away | 08:18 | |
| *** _anant has quit IRC | 08:19 | |
| *** _anant has joined #openstack-dev | 08:20 | |
| *** DeeJay1 has quit IRC | 08:20 | |
| *** claxton has quit IRC | 08:21 | |
| *** claxton has joined #openstack-dev | 08:22 | |
| *** DeeJay1 has joined #openstack-dev | 08:22 | |
| *** kspear has quit IRC | 08:23 | |
| *** _anant has quit IRC | 08:24 | |
| *** twoputt_ has joined #openstack-dev | 08:25 | |
| *** _anant has joined #openstack-dev | 08:25 | |
| *** _anant has quit IRC | 08:29 | |
| *** _anant has joined #openstack-dev | 08:29 | |
| *** nati_ueno has quit IRC | 08:29 | |
| *** fifieldt has joined #openstack-dev | 08:31 | |
| *** xchu has quit IRC | 08:31 | |
| *** o_petit has quit IRC | 08:32 | |
| *** fifieldt has quit IRC | 08:33 | |
| *** xga__ has joined #openstack-dev | 08:33 | |
| *** o_petit has joined #openstack-dev | 08:34 | |
| *** _anant has quit IRC | 08:34 | |
| *** _anant has joined #openstack-dev | 08:34 | |
| *** lucasagomes has joined #openstack-dev | 08:35 | |
| *** prekarat has quit IRC | 08:35 | |
| *** xga_ has quit IRC | 08:36 | |
| *** shang has joined #openstack-dev | 08:37 | |
| *** bashok__ has joined #openstack-dev | 08:38 | |
| *** mmagr has joined #openstack-dev | 08:38 | |
| *** bashok_ has quit IRC | 08:41 | |
| *** twoputt_ has quit IRC | 08:44 | |
| *** o_petit has quit IRC | 08:44 | |
| *** twoputt has quit IRC | 08:45 | |
| *** jtomasek has joined #openstack-dev | 08:45 | |
| *** athomas_ has joined #openstack-dev | 08:46 | |
| *** _anant has quit IRC | 08:46 | |
| *** bashok has joined #openstack-dev | 08:46 | |
| *** _anant has joined #openstack-dev | 08:46 | |
| *** mestery has quit IRC | 08:47 | |
| *** jistr has joined #openstack-dev | 08:47 | |
| *** yaguang has joined #openstack-dev | 08:47 | |
| *** Alexei_987 has joined #openstack-dev | 08:49 | |
| *** bashok__ has quit IRC | 08:49 | |
| *** _anant has quit IRC | 08:51 | |
| *** xchu has joined #openstack-dev | 08:51 | |
| *** _anant has joined #openstack-dev | 08:51 | |
| *** iartarisi has joined #openstack-dev | 08:53 | |
| *** romcheg1 has joined #openstack-dev | 08:55 | |
| *** giulivo has joined #openstack-dev | 08:55 | |
| *** dripton has quit IRC | 08:56 | |
| *** yassine has joined #openstack-dev | 08:57 | |
| *** AnilV4 has joined #openstack-dev | 08:58 | |
| *** henrynash has quit IRC | 08:58 | |
| *** dripton has joined #openstack-dev | 08:59 | |
| *** bashok_ has joined #openstack-dev | 09:00 | |
| *** bashok__ has joined #openstack-dev | 09:01 | |
| *** bashok has quit IRC | 09:03 | |
| *** _anant has quit IRC | 09:04 | |
| *** xga__ has quit IRC | 09:04 | |
| *** _anant has joined #openstack-dev | 09:04 | |
| *** xga__ has joined #openstack-dev | 09:05 | |
| *** bashok_ has quit IRC | 09:05 | |
| *** AnilV4 has quit IRC | 09:05 | |
| *** flaper87|afk is now known as flaper87 | 09:07 | |
| *** mrda has quit IRC | 09:08 | |
| *** _neoXsys_ has joined #openstack-dev | 09:08 | |
| *** AnilV4 has joined #openstack-dev | 09:11 | |
| *** sushils has quit IRC | 09:11 | |
| *** neoXsys has quit IRC | 09:12 | |
| *** mkollaro has joined #openstack-dev | 09:12 | |
| *** gmurphy has quit IRC | 09:12 | |
| *** romcheg has quit IRC | 09:12 | |
| *** DeeJay1 has quit IRC | 09:13 | |
| *** martyntaylor has quit IRC | 09:13 | |
| *** DeeJay1 has joined #openstack-dev | 09:13 | |
| *** _anant has quit IRC | 09:16 | |
| *** _anant has joined #openstack-dev | 09:17 | |
| *** belmoreira1 has joined #openstack-dev | 09:17 | |
| *** alexxu has quit IRC | 09:17 | |
| *** alexxu has joined #openstack-dev | 09:18 | |
| *** jcoufal has quit IRC | 09:18 | |
| *** martyntaylor has joined #openstack-dev | 09:19 | |
| *** belmoreira has quit IRC | 09:19 | |
| *** vartom11 has quit IRC | 09:20 | |
| *** _anant has quit IRC | 09:21 | |
| *** _anant has joined #openstack-dev | 09:21 | |
| *** tstevenson has quit IRC | 09:21 | |
| *** alexpilotti has joined #openstack-dev | 09:26 | |
| *** mrunge has quit IRC | 09:31 | |
| *** ndipanov has quit IRC | 09:32 | |
| *** o_petit has joined #openstack-dev | 09:33 | |
| *** _anant has quit IRC | 09:34 | |
| *** _anant has joined #openstack-dev | 09:35 | |
| *** mrunge has joined #openstack-dev | 09:35 | |
| *** xga__ has quit IRC | 09:38 | |
| *** SergeyLu_ has quit IRC | 09:39 | |
| *** xga has joined #openstack-dev | 09:40 | |
| *** eglynn is now known as eglynn-fuse-summ | 09:40 | |
| *** eglynn-fuse-summ is now known as eglynn-fuse-f2f | 09:40 | |
| *** _anant has quit IRC | 09:40 | |
| *** mestery has joined #openstack-dev | 09:40 | |
| *** _anant has joined #openstack-dev | 09:41 | |
| *** ndipanov has joined #openstack-dev | 09:41 | |
| *** xga_ has joined #openstack-dev | 09:42 | |
| *** vartom11 has joined #openstack-dev | 09:43 | |
| *** o_petit has quit IRC | 09:44 | |
| *** xga has quit IRC | 09:45 | |
| *** _anant has quit IRC | 09:46 | |
| *** _anant has joined #openstack-dev | 09:46 | |
| *** o_petit has joined #openstack-dev | 09:48 | |
| *** _anant has quit IRC | 09:50 | |
| *** _anant has joined #openstack-dev | 09:51 | |
| *** sergmelikyan has quit IRC | 09:54 | |
| *** tvb|afk has quit IRC | 09:54 | |
| *** alexxu has quit IRC | 09:55 | |
| *** ifarkas has quit IRC | 09:58 | |
| *** _anant has quit IRC | 09:59 | |
| *** _anant has joined #openstack-dev | 09:59 | |
| *** donaldh has joined #openstack-dev | 09:59 | |
| *** tvb|afk has joined #openstack-dev | 10:00 | |
| *** ifarkas has joined #openstack-dev | 10:00 | |
| *** donaldh has quit IRC | 10:01 | |
| *** tsufiev has quit IRC | 10:01 | |
| *** tsufiev has joined #openstack-dev | 10:02 | |
| *** qba73 has joined #openstack-dev | 10:02 | |
| *** boris-42 has joined #openstack-dev | 10:04 | |
| *** _anant has quit IRC | 10:04 | |
| *** _anant has joined #openstack-dev | 10:05 | |
| *** danpb has quit IRC | 10:10 | |
| *** faramir1 has quit IRC | 10:11 | |
| *** danpb has joined #openstack-dev | 10:12 | |
| *** tvb|afk has quit IRC | 10:13 | |
| *** gongysh has quit IRC | 10:13 | |
| *** ygbo has joined #openstack-dev | 10:13 | |
| *** o_petit has quit IRC | 10:14 | |
| *** wenjianhn has quit IRC | 10:16 | |
| *** xchu has quit IRC | 10:20 | |
| *** MaxV has quit IRC | 10:26 | |
| *** athomas_ has quit IRC | 10:26 | |
| *** claxton has quit IRC | 10:27 | |
| *** athomas has quit IRC | 10:29 | |
| *** tvb|afk has joined #openstack-dev | 10:29 | |
| *** markmc has joined #openstack-dev | 10:33 | |
| *** AnilV4 has quit IRC | 10:37 | |
| *** schwicht has joined #openstack-dev | 10:39 | |
| *** paragan has quit IRC | 10:39 | |
| *** freedomhui has quit IRC | 10:43 | |
| *** o_petit has joined #openstack-dev | 10:45 | |
| *** bvandenh has joined #openstack-dev | 10:47 | |
| *** yaguang has quit IRC | 10:50 | |
| *** o_petit has quit IRC | 10:53 | |
| *** athomas has joined #openstack-dev | 10:54 | |
| *** bashok_ has joined #openstack-dev | 10:56 | |
| *** athomas has quit IRC | 10:57 | |
| *** bashok__ has quit IRC | 10:59 | |
| *** lucasagomes is now known as lucas-afk | 11:00 | |
| *** jtomasek_ has joined #openstack-dev | 11:00 | |
| *** athomas has joined #openstack-dev | 11:00 | |
| *** claxton has joined #openstack-dev | 11:01 | |
| *** romcheg1 is now known as romcheg | 11:01 | |
| *** jtomasek has quit IRC | 11:04 | |
| *** pixelb has joined #openstack-dev | 11:10 | |
| *** o_petit has joined #openstack-dev | 11:10 | |
| *** freedomhui has joined #openstack-dev | 11:11 | |
| *** vartom11 has quit IRC | 11:12 | |
| *** zhiyan has quit IRC | 11:19 | |
| *** dims has joined #openstack-dev | 11:20 | |
| *** nshaikh has quit IRC | 11:21 | |
| *** AlexF has joined #openstack-dev | 11:24 | |
| *** o_petit has quit IRC | 11:26 | |
| *** imsurit has joined #openstack-dev | 11:27 | |
| *** dstanek has joined #openstack-dev | 11:28 | |
| *** imsurit is now known as Guest7965 | 11:28 | |
| *** o_petit has joined #openstack-dev | 11:30 | |
| *** prekarat has joined #openstack-dev | 11:31 | |
| *** claxton has quit IRC | 11:33 | |
| *** claxton has joined #openstack-dev | 11:33 | |
| *** nshaikh has joined #openstack-dev | 11:44 | |
| *** eglynn-fuse-f2f has quit IRC | 11:45 | |
| *** egallen has joined #openstack-dev | 11:49 | |
| *** kiall_ is now known as Kiall | 11:52 | |
| *** SergeyLukjanov has joined #openstack-dev | 11:55 | |
| *** AlexF has quit IRC | 11:56 | |
| *** venkatesh has joined #openstack-dev | 11:57 | |
| *** claxton has quit IRC | 11:57 | |
| *** belmoreira1 has quit IRC | 12:01 | |
| *** eglynn-fuse-f2f has joined #openstack-dev | 12:01 | |
| *** sdake_ has quit IRC | 12:02 | |
| *** sdake has quit IRC | 12:02 | |
| *** MaxV has joined #openstack-dev | 12:02 | |
| *** bcrochet is now known as bcrochet|ex210 | 12:03 | |
| *** bcrochet|ex210 is now known as bcrochet | 12:03 | |
| *** bauzas has joined #openstack-dev | 12:03 | |
| *** mohits has joined #openstack-dev | 12:03 | |
| *** bauzas has quit IRC | 12:03 | |
| *** sdake has joined #openstack-dev | 12:03 | |
| *** sdake_ has joined #openstack-dev | 12:04 | |
| *** sdake_ has quit IRC | 12:04 | |
| *** sdake_ has joined #openstack-dev | 12:04 | |
| *** belmoreira has joined #openstack-dev | 12:04 | |
| *** bauzas has joined #openstack-dev | 12:05 | |
| *** vartom11 has joined #openstack-dev | 12:05 | |
| *** bcrochet has quit IRC | 12:06 | |
| *** dims has quit IRC | 12:07 | |
| *** bashok_ has quit IRC | 12:07 | |
| *** bcrochet has joined #openstack-dev | 12:08 | |
| *** claxton has joined #openstack-dev | 12:09 | |
| *** nil1511 has joined #openstack-dev | 12:09 | |
| *** sridevi has quit IRC | 12:09 | |
| *** _anant has quit IRC | 12:12 | |
| *** dstanek has quit IRC | 12:14 | |
| *** FunnyLookinHat has joined #openstack-dev | 12:15 | |
| *** nil1511 has quit IRC | 12:15 | |
| *** nil1511 has joined #openstack-dev | 12:17 | |
| *** Guest7965 has quit IRC | 12:19 | |
| *** dims has joined #openstack-dev | 12:20 | |
| *** ekarlso has quit IRC | 12:20 | |
| *** dstanek has joined #openstack-dev | 12:21 | |
| *** ifarkas has quit IRC | 12:23 | |
| *** romcheg1 has joined #openstack-dev | 12:23 | |
| *** ifarkas has joined #openstack-dev | 12:26 | |
| *** lucas-afk is now known as lucasagomes | 12:26 | |
| *** dtyarnell has quit IRC | 12:27 | |
| *** romcheg has quit IRC | 12:28 | |
| *** dolphm has joined #openstack-dev | 12:31 | |
| *** jruzicka has quit IRC | 12:33 | |
| *** jruzicka has joined #openstack-dev | 12:33 | |
| *** matsuhashi has quit IRC | 12:34 | |
| *** lucasagomes has quit IRC | 12:36 | |
| *** nil1511 has quit IRC | 12:36 | |
| *** lucasagomes has joined #openstack-dev | 12:36 | |
| *** zhikunliu has quit IRC | 12:42 | |
| *** statik has left #openstack-dev | 12:42 | |
| *** maheshp has joined #openstack-dev | 12:45 | |
| *** karlsone has joined #openstack-dev | 12:47 | |
| chmouel | dolphm: ping | 12:48 |
| dolphm | chmouel: pong | 12:48 |
| chmouel | so not sure what's the status of https://review.openstack.org/#/c/45447/ | 12:48 |
| chmouel | saw my name falshing in my scrollback | 12:48 |
| chmouel | should I update the tests | 12:49 |
| dolphm | chmouel: lol dstanek's revision merged with your name on it | 12:49 |
| chmouel | ah k cool | 12:49 |
| chmouel | so i can abandon that one? | 12:49 |
| dolphm | chmouel: yep! | 12:49 |
| chmouel | nice :) | 12:49 |
| dolphm | chmouel: i wrote some additional tests here https://review.openstack.org/#/c/48340/ | 12:49 |
| chmouel | cool, revieweing | 12:50 |
| chmouel | so moving it to test_backend.py ? | 12:50 |
| chmouel | (or adding it even) | 12:50 |
| *** sgordon has joined #openstack-dev | 12:52 | |
| *** jay-lau-513 has joined #openstack-dev | 12:52 | |
| *** donaldh has joined #openstack-dev | 12:54 | |
| *** o_petit has quit IRC | 12:54 | |
| *** giulivo has quit IRC | 12:56 | |
| *** belmoreira has quit IRC | 12:56 | |
| *** romcheg has joined #openstack-dev | 12:56 | |
| *** corrigac has joined #openstack-dev | 12:57 | |
| *** belmoreira has joined #openstack-dev | 12:58 | |
| *** ccorrigan has quit IRC | 12:59 | |
| *** thomasm has joined #openstack-dev | 12:59 | |
| *** Ruetobas has quit IRC | 12:59 | |
| *** eglynn-fuse-f2f has quit IRC | 13:00 | |
| *** romcheg1 has quit IRC | 13:00 | |
| *** venkatesh has quit IRC | 13:02 | |
| *** morazi has joined #openstack-dev | 13:03 | |
| *** statik has joined #openstack-dev | 13:04 | |
| *** dolphm has quit IRC | 13:04 | |
| *** martine has joined #openstack-dev | 13:06 | |
| *** yaguang has joined #openstack-dev | 13:07 | |
| *** martine is now known as Guest49371 | 13:07 | |
| *** wenjianhn has joined #openstack-dev | 13:08 | |
| *** aditirav has quit IRC | 13:08 | |
| *** xchu has joined #openstack-dev | 13:09 | |
| *** dolphm has joined #openstack-dev | 13:10 | |
| *** nermina has joined #openstack-dev | 13:10 | |
| *** o_petit has joined #openstack-dev | 13:11 | |
| *** bashok has joined #openstack-dev | 13:13 | |
| *** rfolco has joined #openstack-dev | 13:14 | |
| *** eglynn-fuse-f2f has joined #openstack-dev | 13:14 | |
| *** maheshp has quit IRC | 13:15 | |
| *** maheshp has joined #openstack-dev | 13:15 | |
| *** gordc has joined #openstack-dev | 13:17 | |
| *** portante|afk is now known as portante | 13:18 | |
| *** jayg|g0n3 is now known as jayg | 13:18 | |
| *** dvarga has joined #openstack-dev | 13:19 | |
| *** Ruetobas has joined #openstack-dev | 13:20 | |
| *** cthulhup has joined #openstack-dev | 13:20 | |
| *** martine_ has joined #openstack-dev | 13:21 | |
| *** dprince has joined #openstack-dev | 13:22 | |
| *** alunduil has quit IRC | 13:24 | |
| *** Guest49371 has quit IRC | 13:24 | |
| *** dkranz has quit IRC | 13:25 | |
| *** jaypipes has joined #openstack-dev | 13:25 | |
| *** gordc has quit IRC | 13:26 | |
| *** shang has quit IRC | 13:27 | |
| *** jab416171 has quit IRC | 13:27 | |
| *** akscram has quit IRC | 13:28 | |
| *** jasondotstar has joined #openstack-dev | 13:29 | |
| *** xjiujiu has joined #openstack-dev | 13:29 | |
| *** zhiyan has joined #openstack-dev | 13:29 | |
| *** markmc has quit IRC | 13:30 | |
| *** ayoung has joined #openstack-dev | 13:30 | |
| *** markmc has joined #openstack-dev | 13:31 | |
| *** edmund has joined #openstack-dev | 13:31 | |
| *** bashok has quit IRC | 13:32 | |
| *** shang has joined #openstack-dev | 13:32 | |
| *** akscram has joined #openstack-dev | 13:32 | |
| *** dtyarnell has joined #openstack-dev | 13:32 | |
| *** DinaBelova has joined #openstack-dev | 13:32 | |
| *** karlsone has quit IRC | 13:33 | |
| *** mjfs has joined #openstack-dev | 13:34 | |
| *** maheshp has quit IRC | 13:34 | |
| *** martine_ has quit IRC | 13:35 | |
| *** jswarren has quit IRC | 13:35 | |
| *** jswarren has joined #openstack-dev | 13:36 | |
| *** MaxV has quit IRC | 13:36 | |
| *** jswarren has quit IRC | 13:37 | |
| *** lbragstad has joined #openstack-dev | 13:38 | |
| *** neelashah has joined #openstack-dev | 13:38 | |
| *** ron-slc has quit IRC | 13:38 | |
| *** jswarren has joined #openstack-dev | 13:38 | |
| *** dkranz has joined #openstack-dev | 13:38 | |
| *** gordc has joined #openstack-dev | 13:38 | |
| *** jecarey has joined #openstack-dev | 13:38 | |
| *** jswarren has quit IRC | 13:39 | |
| *** jhesketh has quit IRC | 13:39 | |
| *** jswarren has joined #openstack-dev | 13:39 | |
| *** enikanorov has joined #openstack-dev | 13:40 | |
| *** enikanorov_ has quit IRC | 13:43 | |
| *** matsuhashi has joined #openstack-dev | 13:43 | |
| *** ron-slc has joined #openstack-dev | 13:44 | |
| *** kbringard has joined #openstack-dev | 13:46 | |
| *** prad_ has joined #openstack-dev | 13:46 | |
| *** cthulhup has quit IRC | 13:46 | |
| *** AnilV4 has joined #openstack-dev | 13:47 | |
| *** litong has joined #openstack-dev | 13:48 | |
| *** cjellick has joined #openstack-dev | 13:48 | |
| *** paragan has joined #openstack-dev | 13:48 | |
| *** burt has joined #openstack-dev | 13:49 | |
| *** Max_ has joined #openstack-dev | 13:49 | |
| *** mrunge has quit IRC | 13:52 | |
| *** davidhadas_ has quit IRC | 13:52 | |
| *** mjfs has quit IRC | 13:53 | |
| *** FunnyLookinHat has quit IRC | 13:53 | |
| *** tvb|afk has quit IRC | 13:53 | |
| *** martine_ has joined #openstack-dev | 13:54 | |
| *** yaguang has quit IRC | 13:54 | |
| *** eharney has joined #openstack-dev | 13:54 | |
| *** cjellick has quit IRC | 13:54 | |
| *** cjellick has joined #openstack-dev | 13:54 | |
| *** venkatesh has joined #openstack-dev | 13:54 | |
| *** dkranz has quit IRC | 13:59 | |
| *** topol has joined #openstack-dev | 13:59 | |
| *** jmontemayor has joined #openstack-dev | 13:59 | |
| *** markwash has joined #openstack-dev | 13:59 | |
| *** o_petit has quit IRC | 14:00 | |
| *** stevemar has joined #openstack-dev | 14:02 | |
| *** johnthetubaguy has joined #openstack-dev | 14:03 | |
| *** beraldo has joined #openstack-dev | 14:03 | |
| *** belmoreira has left #openstack-dev | 14:03 | |
| *** alunduil has joined #openstack-dev | 14:04 | |
| *** stevemar has quit IRC | 14:04 | |
| beraldo | hi, I'm having problems to configure keystone + ldap, keystone user-list show everthing ok, uid, name, enabled and email. But when I do keystone user-get "uid" dont show user, my config file user_id_attribute = uid, but keystone insist in use cn to get user, if I do keystone user-get "Complete CN" works. | 14:05 |
| *** jtomasek_ is now known as jtomasek | 14:06 | |
| *** nshaikh has left #openstack-dev | 14:08 | |
| *** vartom11 has quit IRC | 14:08 | |
| *** pberis has quit IRC | 14:09 | |
| *** changbl has quit IRC | 14:09 | |
| *** pberis has joined #openstack-dev | 14:09 | |
| *** aloga has quit IRC | 14:10 | |
| beraldo | I can see the bug #997700 | 14:11 |
| uvirtbot | Launchpad bug 997700 in keystone/essex "LDAP should not check username on "sn" field" [Medium,Fix released] https://launchpad.net/bugs/997700 | 14:11 |
| *** pberis has quit IRC | 14:11 | |
| *** jasondotstar has quit IRC | 14:11 | |
| beraldo | but i think that the fix proposed is only on user_name_attribute, may be is missing a user_id_attribute ? | 14:12 |
| *** pberis has joined #openstack-dev | 14:12 | |
| *** o_petit has joined #openstack-dev | 14:12 | |
| *** giulivo has joined #openstack-dev | 14:12 | |
| *** jmontemayor has quit IRC | 14:12 | |
| *** hemanth has joined #openstack-dev | 14:13 | |
| *** matsuhashi has quit IRC | 14:13 | |
| *** eglynn-fuse-f2f has quit IRC | 14:14 | |
| *** wenjianhn has quit IRC | 14:16 | |
| *** briancurtin has joined #openstack-dev | 14:16 | |
| *** xchu has quit IRC | 14:18 | |
| *** jasondotstar has joined #openstack-dev | 14:18 | |
| *** tmclaugh[work] has joined #openstack-dev | 14:20 | |
| *** xga__ has joined #openstack-dev | 14:20 | |
| *** xga_ has quit IRC | 14:21 | |
| *** DeeJay1 has quit IRC | 14:21 | |
| *** johnpur has joined #openstack-dev | 14:24 | |
| *** tvb|afk has joined #openstack-dev | 14:24 | |
| *** karlsone has joined #openstack-dev | 14:24 | |
| *** ericw has joined #openstack-dev | 14:24 | |
| *** prekarat1 has joined #openstack-dev | 14:25 | |
| *** prekarat has quit IRC | 14:26 | |
| *** eglynn-fuse-f2f has joined #openstack-dev | 14:26 | |
| *** dolphm has quit IRC | 14:26 | |
| *** romcheg has quit IRC | 14:27 | |
| *** romcheg has joined #openstack-dev | 14:27 | |
| *** richardwoo has joined #openstack-dev | 14:27 | |
| *** martine_ has quit IRC | 14:27 | |
| *** Guest19249 is now known as esheffield | 14:27 | |
| *** eglynn-fuse-f2f has quit IRC | 14:28 | |
| *** eglynn has joined #openstack-dev | 14:28 | |
| *** wenjianhn has joined #openstack-dev | 14:29 | |
| *** martine has joined #openstack-dev | 14:30 | |
| *** martine is now known as Guest29506 | 14:30 | |
| *** xjiujiu has quit IRC | 14:31 | |
| *** cjellick1 has joined #openstack-dev | 14:32 | |
| *** rnirmal has joined #openstack-dev | 14:33 | |
| *** cjellick has quit IRC | 14:34 | |
| *** dolphm has joined #openstack-dev | 14:35 | |
| *** pberis has quit IRC | 14:35 | |
| *** cjellick1 has quit IRC | 14:36 | |
| *** devoid has joined #openstack-dev | 14:36 | |
| *** cjellick has joined #openstack-dev | 14:36 | |
| *** devoid has quit IRC | 14:36 | |
| *** sthaha has quit IRC | 14:38 | |
| *** corXi has quit IRC | 14:38 | |
| *** otherwiseguy has joined #openstack-dev | 14:38 | |
| *** anteaya has joined #openstack-dev | 14:38 | |
| *** richardwoo has quit IRC | 14:39 | |
| *** bvandenh has quit IRC | 14:39 | |
| *** johnpur has quit IRC | 14:39 | |
| *** markmc has quit IRC | 14:39 | |
| iccha | annegentle: do u know thomas leaman's irc nick? | 14:40 |
| *** rcleere has joined #openstack-dev | 14:41 | |
| *** datsun180b has joined #openstack-dev | 14:41 | |
| *** FunnyLookinHat has joined #openstack-dev | 14:41 | |
| *** mangelajo has quit IRC | 14:42 | |
| *** mjfork has joined #openstack-dev | 14:42 | |
| *** mjfork has quit IRC | 14:42 | |
| *** wenjianhn has quit IRC | 14:42 | |
| *** mangelajo has joined #openstack-dev | 14:42 | |
| *** johnpur has joined #openstack-dev | 14:44 | |
| bugsduggan | iccha: I am he | 14:46 |
| iccha | hey bugsduggan | 14:46 |
| bugsduggan | howdy | 14:46 |
| iccha | bugsduggan: so we were talking about ur patch in glance | 14:46 |
| iccha | and I was wondering if u could remove the dependency? | 14:47 |
| iccha | and remove references to @ and ! | 14:47 |
| iccha | so we can include it in rc1? | 14:47 |
| iccha | thanks for ur work on it :) | 14:47 |
| *** venkatesh has quit IRC | 14:47 | |
| *** mangelajo has quit IRC | 14:47 | |
| *** sumanthns has quit IRC | 14:48 | |
| bugsduggan | iccha: I can remove the dependancy, that's fine. Can I ask why the decision to remove the '@' and '!'? | 14:48 |
| iccha | bugsduggan: its going to be in ice house, thats all :) | 14:48 |
| *** Guangya has joined #openstack-dev | 14:49 | |
| *** Guangya has quit IRC | 14:50 | |
| bugsduggan | iccha: would it be easier to create a separate change to remove the dep? and you can -2 my other change for now? | 14:50 |
| iccha | bugsduggan: sure will do | 14:51 |
| iccha | can we have the patch today? | 14:51 |
| *** galstrom_zzz is now known as galstrom | 14:51 | |
| bugsduggan | iccha: excellent, I'll get that patch to you today | 14:52 |
| iccha | thanks bugsduggan :) | 14:52 |
| *** jay-lau-513 has quit IRC | 14:52 | |
| bugsduggan | iccha: my pleasure ;) | 14:52 |
| *** markwash has quit IRC | 14:53 | |
| *** radix has quit IRC | 14:53 | |
| *** radix has joined #openstack-dev | 14:54 | |
| *** radez_g0n3 is now known as radez | 14:54 | |
| *** wenjianhn has joined #openstack-dev | 14:55 | |
| *** twoputt has joined #openstack-dev | 14:55 | |
| *** markmc has joined #openstack-dev | 14:57 | |
| *** gargya has joined #openstack-dev | 14:57 | |
| *** atiwari has joined #openstack-dev | 14:57 | |
| *** venkatesh has joined #openstack-dev | 14:57 | |
| dolphm | atiwari: o/ | 14:58 |
| *** adjohn has joined #openstack-dev | 14:59 | |
| dolphm | atiwari: your change is dependent on the oslo sync, so they'll be tested together -- it won't be an issue | 14:59 |
| dolphm | (or was, in patchset 12) | 14:59 |
| atiwari | ok, in that case I ma good? | 15:00 |
| dolphm | atiwari: it looks like you squashed an old copy of gyee's fix into your patchset 13, which IS causing issues | 15:00 |
| dolphm | atiwari: so, i'm trying to work out what else you changed between patchset 12 and 13? | 15:00 |
| *** adjohn_ has joined #openstack-dev | 15:00 | |
| *** cthulhup has joined #openstack-dev | 15:00 | |
| dolphm | atiwari: i found this- http://pasteraw.com/hihepsgbe3et83qcqpnics3e9m5fskv | 15:00 |
| dolphm | atiwari: that change looks good | 15:00 |
| atiwari | that is one change | 15:01 |
| dolphm | atiwari: i also ran into a test failure on test_admin_on_project_filter | 15:01 |
| dolphm | atiwari: what did you do to resolve that? | 15:01 |
| dolphm | atiwari: it was in one of your new tests in TestTokenRevokeSelfAndAdmin | 15:02 |
| atiwari | let me see, I think the assertRaise had unauth | 15:03 |
| atiwari | I made it to notfound | 15:03 |
| *** kenperkins has quit IRC | 15:03 | |
| *** zhikunliu has joined #openstack-dev | 15:03 | |
| dolphm | atiwari: also, *please* don't do a git-review on your patch for the moment :) | 15:03 |
| *** adjohn has quit IRC | 15:03 | |
| dolphm | atiwari: i want to make sure the oslo policy sync gets in as fast as possible, so i want to avoid rebasing & restarting the gate on it | 15:03 |
| atiwari | ok | 15:04 |
| dolphm | atiwari: we can still push changes to your patch, we just need to be careful about it | 15:04 |
| *** xga__ has quit IRC | 15:04 | |
| atiwari | I am not going to touch, until you ask me :) | 15:04 |
| *** xga has joined #openstack-dev | 15:04 | |
| dolphm | atiwari: thanks! this is the failure i'm seeing that it looks like you resolved in patchset 13: http://pasteraw.com/ijpdmywy2kyjet8wicqug2podatd5hl | 15:05 |
| *** jvrbanac has joined #openstack-dev | 15:05 | |
| dolphm | note the "keystone.openstack.common.policy: ERROR: Failed to understand rule admin_on_project_filter" | 15:05 |
| *** wenjianhn has quit IRC | 15:06 | |
| *** jecarey has quit IRC | 15:06 | |
| *** mrodden has joined #openstack-dev | 15:06 | |
| *** kbrierly has joined #openstack-dev | 15:06 | |
| atiwari | dolphm, I did not see that test fail | 15:07 |
| *** reidrac has quit IRC | 15:07 | |
| dolphm | atiwari: hmm | 15:07 |
| *** zhikunliu has quit IRC | 15:07 | |
| *** twoputt has quit IRC | 15:07 | |
| atiwari | dolphm, http://logs.openstack.org/23/46123/12/check/gate-keystone-python27/fa781f6/nose_results.html are the only tests I fixed | 15:08 |
| *** prekarat1 has quit IRC | 15:08 | |
| *** prekarat has joined #openstack-dev | 15:08 | |
| dolphm | atiwari: you also rewrote your keystone.common.controller changes? | 15:08 |
| *** mjfork has joined #openstack-dev | 15:08 | |
| atiwari | yes, as per Gyee comment I made the toke_ref lighter | 15:09 |
| atiwari | dolphm, http://paste.openstack.org/show/47544/ | 15:09 |
| *** karlsone has quit IRC | 15:09 | |
| atiwari | and small change in https://review.openstack.org/#/c/46123/13/keystone/token/providers/uuid.py | 15:11 |
| dolphm | atiwari: ooh, that looks significant | 15:11 |
| dolphm | atiwari: i missed that | 15:11 |
| *** dubsquared has joined #openstack-dev | 15:11 | |
| atiwari | both to resolve gyee comments in patch 11 | 15:11 |
| *** dkranz has joined #openstack-dev | 15:12 | |
| *** jecarey has joined #openstack-dev | 15:12 | |
| *** masumotok has joined #openstack-dev | 15:12 | |
| *** mangelajo has joined #openstack-dev | 15:12 | |
| dolphm | atiwari: how are those changes tested? | 15:13 |
| dolphm | atiwari: i think i'm down to two errors across the entire test suite | 15:14 |
| atiwari | I ran entire test before pushing | 15:14 |
| *** prekarat has quit IRC | 15:15 | |
| atiwari | let me run it again | 15:15 |
| masumotok | Hi, does anyone know when ZBF mode in swift object auditor can be used? In manual, this feature can be used " only zero byte files are audited", but I would like to know when swift experts use this feature *for example*. | 15:15 |
| *** changbl has joined #openstack-dev | 15:16 | |
| *** karlsone has joined #openstack-dev | 15:16 | |
| dolphm | masumotok: might want to try asking in #openstack-swift | 15:16 |
| atiwari | dolphm, what are those two? | 15:17 |
| masumotok | dolphm: Uh.. there might be better place to ask, thank you! | 15:17 |
| dolphm | masumotok: anytime | 15:17 |
| dolphm | atiwari: two of your new tests | 15:17 |
| *** masumotok has quit IRC | 15:17 | |
| atiwari | hmm | 15:17 |
| dolphm | atiwari: same failure in my paste from above | 15:17 |
| atiwari | I am running it here | 15:17 |
| dolphm | atiwari: i'd like to ask henrynash about them... as her wrote the rules it's stumbling on | 15:17 |
| *** karlsone has quit IRC | 15:18 | |
| *** o_petit has quit IRC | 15:18 | |
| *** karlsone has joined #openstack-dev | 15:18 | |
| *** wolfdreamer has joined #openstack-dev | 15:19 | |
| *** nati_ueno has joined #openstack-dev | 15:19 | |
| dolphm | atiwari: failures from a full run: http://pasteraw.com/ftxrq3urvklrk9wva12wl7u8vh4obzs | 15:20 |
| *** mangelajo has quit IRC | 15:23 | |
| *** freedomhui has quit IRC | 15:23 | |
| *** freedomhui has joined #openstack-dev | 15:23 | |
| *** sandeepr_ltp has joined #openstack-dev | 15:26 | |
| atiwari | dolphm, let me see. I am running complete tests locally on my local branch which exactly same as patch #13. | 15:26 |
| atiwari | Did you rebase with master? | 15:26 |
| dolphm | atiwari: no | 15:27 |
| dolphm | atiwari: what's in master that would affect this? | 15:27 |
| *** jab416171 has joined #openstack-dev | 15:27 | |
| dolphm | atiwari: these are the changes i've made to patchset 12 so far http://pasteraw.com/2e491vbrg44dalep82e0nyihltd2rai | 15:28 |
| atiwari | dolphm, I don't know, thought any change coming from master which is making this test unhappy. | 15:28 |
| dolphm | atiwari: just tried rebasing on master, still seeing these failures | 15:29 |
| dolphm | atiwari: ooh, i think i figured this out | 15:32 |
| atiwari | dolphm, what was that | 15:33 |
| atiwari | ? | 15:33 |
| atiwari | I am blocked with nasty proxy issue here | 15:33 |
| *** gyee has joined #openstack-dev | 15:34 | |
| *** DinaBelova has quit IRC | 15:34 | |
| dolphm | atiwari: no worries; i think there's a subtle difference between 12 and 13 about how the policy dict is constructed (it appears to be broken in 12 and fixed in 13) | 15:34 |
| *** shinylasers has joined #openstack-dev | 15:34 | |
| atiwari | dolphm, so you are good now? | 15:36 |
| dolphm | atiwari: working on it :) | 15:36 |
| *** mfer_ has joined #openstack-dev | 15:36 | |
| *** gargya_ has joined #openstack-dev | 15:37 | |
| *** hemanth is now known as Guest68622 | 15:37 | |
| *** comay has joined #openstack-dev | 15:37 | |
| dolphm | atiwari: i can change the nature of the failure by cherry picking your keystone.common.controller changes back to patchset 12 | 15:37 |
| *** boris-42 has quit IRC | 15:38 | |
| *** gargya has quit IRC | 15:38 | |
| iccha | bugsduggan: hey i am not sure if i was clear but i meant the documentation as a sepaarte patch | 15:39 |
| *** aditirav has joined #openstack-dev | 15:39 | |
| *** pmathews has joined #openstack-dev | 15:40 | |
| *** fbo is now known as fbo_away | 15:40 | |
| cjellick | hi all. should i be able to get all of the keystone tests to pass locally? i get roughly 500 failures. many of these are in the v3 api tests, but not all of them | 15:42 |
| dolphm | atiwari: passing! | 15:42 |
| atiwari | great | 15:42 |
| *** gargya_ has quit IRC | 15:42 | |
| *** dkranz has quit IRC | 15:44 | |
| *** nati_ueno has quit IRC | 15:45 | |
| bugsduggan | iccha: I'm about to push a (entirely separate) patch for the docs | 15:45 |
| *** alop has joined #openstack-dev | 15:45 | |
| iccha | bugsduggan: awesome :) | 15:45 |
| *** SergeyLukjanov has quit IRC | 15:45 | |
| *** SergeyLukjanov has joined #openstack-dev | 15:46 | |
| zhiyan | afazekas: ping | 15:46 |
| dolphm | atiwari: uploaded patchset 14 https://review.openstack.org/#/c/46123/ | 15:47 |
| *** jtomasek has quit IRC | 15:47 | |
| *** fbo_away is now known as fbo | 15:47 | |
| dolphm | atiwari: note it a lot like patchset 12, but should include all of your changes from patchset 13 with an exception | 15:47 |
| atiwari | dolphm, thanks | 15:47 |
| *** nplanel_ has joined #openstack-dev | 15:47 | |
| dolphm | atiwari: i simplified your keystone.common.controller changes in patchset 13 back to something very similar to patchset 12 | 15:47 |
| *** nplanel has quit IRC | 15:47 | |
| atiwari | ok | 15:48 |
| dolphm | atiwari: so... my ONE question on this review now... :) | 15:48 |
| *** mangelajo has joined #openstack-dev | 15:48 | |
| dolphm | atiwari: why do you have a try/except in that file to suppress the TokenNotFound? | 15:48 |
| bugsduggan | iccha: https://review.openstack.org/#/c/48475/ https://review.openstack.org/#/c/48482/ | 15:48 |
| *** bdpayne has joined #openstack-dev | 15:49 | |
| dolphm | atiwari: my intuition is that the goal of hte patch is to raise a 404 on an invalid X-Subject-Token, so why not let that bubble up immediately? | 15:49 |
| bugsduggan | iccha: I hope that's what you were expecting, let me know if I'm way off the mark | 15:49 |
| atiwari | let me see | 15:49 |
| iccha | thanks bugsduggan ! yes was looking for https://review.openstack.org/#/c/48482/ :) appreciate ur effort to work with us on this | 15:49 |
| *** alop has quit IRC | 15:49 | |
| atiwari | have you added comment in 14? | 15:49 |
| *** angdraug has joined #openstack-dev | 15:49 | |
| bugsduggan | iccha: no problem at all, happy to help | 15:50 |
| dolphm | atiwari: no, that was already there | 15:50 |
| iccha | minor q bugsduggan on patch | 15:50 |
| atiwari | dolphm, I dot that let me explain | 15:51 |
| atiwari | by that line auth did not take place and if you return 404 an unauth user can guess about a token and may open a token harvesting issues | 15:52 |
| *** vkmc has joined #openstack-dev | 15:52 | |
| *** vkmc has joined #openstack-dev | 15:52 | |
| atiwari | I am eating it up so that auth will kate place | 15:52 |
| bugsduggan | iccha: good catch, I'll fix that now ;) | 15:52 |
| *** alop has joined #openstack-dev | 15:52 | |
| *** zhiyan has quit IRC | 15:52 | |
| *** zhiyan has joined #openstack-dev | 15:53 | |
| atiwari | dolphm, am I making sense ? | 15:53 |
| *** mangelajo has quit IRC | 15:53 | |
| afazekas | zhiyan: if the open throws an exception the connection will be None | 15:53 |
| *** xga has quit IRC | 15:54 | |
| *** xga_ has joined #openstack-dev | 15:54 | |
| dolphm | atiwari: hmm, making sure auth takes place based on what? | 15:54 |
| dolphm | atiwari: if you know it's going to fail, why not fail earlier? | 15:54 |
| *** dubsquar_ has joined #openstack-dev | 15:56 | |
| *** adjohn_ has quit IRC | 15:56 | |
| atiwari | OK, I think for unauth user it should be 401 and 404 only for auth user | 15:56 |
| *** SergeyLukjanov has quit IRC | 15:56 | |
| atiwari | if you do not pass on that will not happen | 15:56 |
| dolphm | atiwari: ooh, so you want to ensure that X-Auth-Token is processed before X-Subject-Token? | 15:57 |
| *** dkranz has joined #openstack-dev | 15:57 | |
| atiwari | correct | 15:57 |
| dolphm | atiwari: but in reality, you're processing X-Subject-Token, X-Auth-Token, and then raising 404 for an invalid X-Subject-Token based on the fact that there's no user_id in the policy dict? | 15:57 |
| *** dubsquared has quit IRC | 15:59 | |
| *** shardy is now known as shardy_afk | 15:59 | |
| *** donaldh has quit IRC | 15:59 | |
| atiwari | dolphm, I am adding x-subject-token in the target, so that my policy does the auth. | 16:00 |
| atiwari | that way if x-auth-token is of admin he will get 404 | 16:00 |
| *** tserong has quit IRC | 16:00 | |
| atiwari | in case f the token is not found | 16:00 |
| dolphm | atiwari: "is of admin" ? | 16:00 |
| *** o_petit has joined #openstack-dev | 16:00 | |
| *** zaitcev has joined #openstack-dev | 16:01 | |
| *** markmc has quit IRC | 16:01 | |
| *** danwent has joined #openstack-dev | 16:01 | |
| *** Ruetobas has quit IRC | 16:01 | |
| *** tserong has joined #openstack-dev | 16:01 | |
| *** xBytez has quit IRC | 16:01 | |
| atiwari | dolphm, id not get your last question | 16:01 |
| *** xBytez has joined #openstack-dev | 16:01 | |
| *** rdopieralski has quit IRC | 16:02 | |
| dolphm | atiwari: i'm trying to work out what you meant by "that way if x-auth-token is of admin he will get 404" | 16:02 |
| dolphm | atiwari: if the x-auth-token represents a user with the admin role? | 16:02 |
| atiwari | yes | 16:02 |
| *** Ruetobas has joined #openstack-dev | 16:03 | |
| *** mangelajo has joined #openstack-dev | 16:03 | |
| atiwari | an x-auth-token with admin role is trying to revoke user token. if user (x-subject-token) is already deleted admin admin should get 404 | 16:04 |
| *** xga__ has joined #openstack-dev | 16:04 | |
| *** Mandell has quit IRC | 16:05 | |
| dolphm | atiwari: if i remove that try/except, all the tests still pass | 16:05 |
| *** xga_ has quit IRC | 16:06 | |
| *** topol has quit IRC | 16:06 | |
| atiwari | dolphm, something is wrong | 16:06 |
| atiwari | let me see | 16:06 |
| dolphm | atiwari: there's a patchset 15 now, btw -- it's just a trivial rebase | 16:07 |
| atiwari | ok | 16:07 |
| dolphm | atiwari: and this is a diff to remove the try/except, which results in passing tests http://pasteraw.com/fwzyh9wb1vza7a5d1fnh230a2hcauew | 16:07 |
| *** patelna has joined #openstack-dev | 16:08 | |
| *** Ruetobas has quit IRC | 16:08 | |
| atiwari | I think I should have added one test where a revoked x-auth-token is trying to revoke x-subject-token | 16:08 |
| atiwari | in that case test will fail | 16:08 |
| atiwari | lket me see | 16:08 |
| *** ifarkas has quit IRC | 16:09 | |
| *** ravikumar_hp has joined #openstack-dev | 16:09 | |
| dolphm | atiwari: if you want to contribute a new test, make sure you checkout patchset 15 and then either push directly to gerrit with `git push gerrit HEAD:refs/for/master` or use `git-review --no-rebase` | 16:11 |
| dolphm | atiwari: that will avoid rebasing the policy sync while it's gating :) | 16:11 |
| atiwari | which try/catch you removed? | 16:12 |
| atiwari | it is still there | 16:12 |
| atiwari | https://review.openstack.org/#/c/46123/15/keystone/common/controller.py | 16:12 |
| dolphm | atiwari: it's removed in this diff: http://pasteraw.com/fwzyh9wb1vza7a5d1fnh230a2hcauew | 16:12 |
| dolphm | atiwari: i haven't uploaded that change | 16:12 |
| *** danwent has quit IRC | 16:12 | |
| *** rackerjoe has joined #openstack-dev | 16:12 | |
| *** twoputt has joined #openstack-dev | 16:13 | |
| *** danwent has joined #openstack-dev | 16:13 | |
| *** o_petit has quit IRC | 16:13 | |
| *** afazekas has quit IRC | 16:14 | |
| atiwari | dolphm, working on #15. I will follow your instructions | 16:14 |
| atiwari | for push | 16:14 |
| *** Shaan7 has quit IRC | 16:15 | |
| *** Ruetobas has joined #openstack-dev | 16:15 | |
| *** freedomhui has quit IRC | 16:16 | |
| *** romcheg has quit IRC | 16:16 | |
| *** hemna_ is now known as hemna | 16:16 | |
| *** tvb|afk has quit IRC | 16:16 | |
| *** flaper87 is now known as flaper87|afk | 16:16 | |
| *** jtomasek has joined #openstack-dev | 16:16 | |
| *** safchain has quit IRC | 16:19 | |
| *** ericw has quit IRC | 16:19 | |
| *** feleouet has quit IRC | 16:23 | |
| *** davidhadas_ has joined #openstack-dev | 16:25 | |
| *** yassine has quit IRC | 16:25 | |
| *** odyssey4me has quit IRC | 16:25 | |
| dolphm | atiwari: thanks! | 16:25 |
| *** nermina has quit IRC | 16:25 | |
| *** Max_ has quit IRC | 16:26 | |
| *** jmontemayor has joined #openstack-dev | 16:26 | |
| garyk | arosen: ping | 16:26 |
| *** bswartz has quit IRC | 16:27 | |
| *** romcheg has joined #openstack-dev | 16:27 | |
| arosen | garyk: pong | 16:27 |
| *** dubsquar_ has quit IRC | 16:27 | |
| *** jmontemayor has quit IRC | 16:28 | |
| *** jasondotstar has quit IRC | 16:29 | |
| *** jtomasek has quit IRC | 16:31 | |
| *** jtomasek has joined #openstack-dev | 16:32 | |
| *** Shaan7 has joined #openstack-dev | 16:32 | |
| *** mfer_ is now known as mattfarina | 16:32 | |
| *** ravikumar_hp has quit IRC | 16:33 | |
| *** openfly has quit IRC | 16:34 | |
| *** aditirav has quit IRC | 16:34 | |
| *** Birk_ has joined #openstack-dev | 16:35 | |
| *** iartarisi has quit IRC | 16:36 | |
| *** ygbo has quit IRC | 16:36 | |
| *** dkehn_ has joined #openstack-dev | 16:39 | |
| *** __afazekas is now known as afazekas | 16:41 | |
| *** dkehn has quit IRC | 16:42 | |
| *** zigo_ has quit IRC | 16:42 | |
| *** zigo has joined #openstack-dev | 16:42 | |
| *** jtomasek has quit IRC | 16:43 | |
| *** briancurtin has quit IRC | 16:43 | |
| *** eglynn has quit IRC | 16:44 | |
| *** venkatesh has quit IRC | 16:45 | |
| *** Alexei_987 has quit IRC | 16:47 | |
| *** prekarat has joined #openstack-dev | 16:47 | |
| *** prekarat has quit IRC | 16:48 | |
| *** jistr has quit IRC | 16:48 | |
| *** SergeyLukjanov has joined #openstack-dev | 16:49 | |
| *** prekarat has joined #openstack-dev | 16:50 | |
| *** bswartz has joined #openstack-dev | 16:50 | |
| *** xga has joined #openstack-dev | 16:50 | |
| *** reed has joined #openstack-dev | 16:51 | |
| *** xga__ has quit IRC | 16:52 | |
| *** jtomasek has joined #openstack-dev | 16:53 | |
| *** jdurgin1 has joined #openstack-dev | 16:54 | |
| *** briancurtin has joined #openstack-dev | 16:54 | |
| *** READ10 has joined #openstack-dev | 16:55 | |
| *** martyntaylor has quit IRC | 16:55 | |
| *** mmagr has quit IRC | 16:55 | |
| *** DinaBelova has joined #openstack-dev | 16:56 | |
| *** paragan has quit IRC | 16:58 | |
| *** jbresnah has joined #openstack-dev | 16:59 | |
| *** mlavalle has joined #openstack-dev | 17:00 | |
| *** derekh has quit IRC | 17:00 | |
| atiwari | dolphm, I think you are correct. no need to add any test. we can remove the try/catch | 17:01 |
| *** jtomasek has quit IRC | 17:01 | |
| atiwari | do you want me to do that or you are planning to push? | 17:01 |
| *** reed has quit IRC | 17:02 | |
| *** vipul-away is now known as vipul | 17:03 | |
| *** nplanel_ has quit IRC | 17:03 | |
| ayoung | dolphm, what should I be looking at for RC1? Anything? THe only Bug we have open has a Keystone commit. Are we just waiting on Tempest, or is it something else? | 17:03 |
| ayoung | https://review.openstack.org/#/c/46123/15 | 17:04 |
| ayoung | atiwari, I take it this is the effort ^^ | 17:04 |
| atiwari | ayoung, thanks | 17:05 |
| atiwari | yes, we need to remove try/catch as mentioned in dolphm comment in #15 | 17:06 |
| *** qba73 has quit IRC | 17:06 | |
| ayoung | atiwari, I suspect that the logic you are putting in there should be up in _build_policy_check+_credentials. | 17:08 |
| *** reed has joined #openstack-dev | 17:08 | |
| zhiyan | afazekas: ping | 17:09 |
| afazekas | zhiyan: pong | 17:09 |
| ayoung | or, probably more correct, the logic from that function should apply to tokens | 17:09 |
| ayoung | to subject tokens | 17:09 |
| atiwari | ayoung, I think no because _build_policy_check+_credentials creates creds and my change is adding target | 17:10 |
| *** prekarat has quit IRC | 17:10 | |
| ayoung | atiwari, I am aware, that is not what I am trying to say | 17:10 |
| *** bknudson has quit IRC | 17:10 | |
| ayoung | I'm saying that we should refereto the credentials consistantly | 17:10 |
| zhiyan | afazekas: still around, tbh i'm still not sure your ut change in #47786 is enough, so can you pls give some explaining to me? since we need cut rc1 this wee (2 days left) and i asked markwash to mark your fix as rc1 but, so a little push, sorry. | 17:10 |
| ayoung | the logic indies _build_policy_check_credentials is for normalizing between v2 and v3 tokens | 17:10 |
| zhiyan | afazekas: pm? | 17:10 |
| morganfainberg | o/ | 17:11 |
| *** epim has joined #openstack-dev | 17:11 | |
| ayoung | atiwari, it won't make a difference for the rule you are addeding to cloud init | 17:11 |
| ayoung | cloudsample.policy | 17:11 |
| atiwari | ayoung, I placed similar logic to build target but sees dolphm did not liked that | 17:11 |
| atiwari | look at patch #13 | 17:12 |
| ayoung | atiwari, earlier patch? | 17:12 |
| ayoung | looking | 17:12 |
| atiwari | yes | 17:12 |
| *** prekarat has joined #openstack-dev | 17:12 | |
| morganfainberg | dolphm, ping | 17:12 |
| ayoung | atiwari, well, that was cut and pasted...you should probably refactor. | 17:12 |
| ayoung | But..if it is not needed for this feature, we can address in icehouse | 17:12 |
| *** terriyu has joined #openstack-dev | 17:12 | |
| *** dhellmann_ is now known as dhellmann | 17:13 | |
| *** johnthetubaguy has quit IRC | 17:13 | |
| *** jtomasek has joined #openstack-dev | 17:13 | |
| atiwari | ayoung, let address it in icehouse | 17:13 |
| atiwari | is that OK? | 17:13 |
| ayoung | atiwari, yes | 17:14 |
| atiwari | great | 17:14 |
| ayoung | atiwari, so, why the try catch? If policy throws an exception here, it gets converted to a 404, right? | 17:14 |
| ayoung | A generic exception | 17:14 |
| atiwari | ayoung, we can remove try/catch | 17:15 |
| ayoung | atiwari, I'm trying to understand where that exception would be handled | 17:16 |
| atiwari | in wsgi | 17:16 |
| ayoung | I don't like "spooky actions at a distance" in my code bases... | 17:16 |
| *** ema has quit IRC | 17:17 | |
| atiwari | I added try/catch to make it cleaner | 17:17 |
| ayoung | Ah...a Token Not found maps to a 404 | 17:17 |
| atiwari | yes | 17:17 |
| *** jcoufal has joined #openstack-dev | 17:17 | |
| ayoung | that is a little misleading. I suspect the error message would say "Token was not found" as opposed to "Resource is not found" | 17:18 |
| ayoung | But in your case that is OK | 17:18 |
| ayoung | atiwari, yeah, remove the try block, but a comment explaining that the token not found generates a 404 is probably appropriate there | 17:19 |
| *** jtomasek has quit IRC | 17:19 | |
| *** AlexF has joined #openstack-dev | 17:19 | |
| atiwari | ayoung, I am good | 17:19 |
| *** nati_ueno has joined #openstack-dev | 17:20 | |
| *** Guest29506 has quit IRC | 17:21 | |
| *** eglynn has joined #openstack-dev | 17:21 | |
| ayoung | atiwari, ok, ping me when the new patch passes gate. I'm assuming just that change will be in there. Rest of the patch looks good, although I'm going through the tests a little bit now | 17:24 |
| atiwari | ayoung, did you push the change? | 17:25 |
| *** martyntaylor has joined #openstack-dev | 17:26 | |
| *** tvb|afk has joined #openstack-dev | 17:27 | |
| *** tvb|afk has quit IRC | 17:27 | |
| *** tvb|afk has joined #openstack-dev | 17:27 | |
| *** carl_baldwin has joined #openstack-dev | 17:27 | |
| *** cthulhup has quit IRC | 17:27 | |
| *** negronjl has quit IRC | 17:27 | |
| salv-orlando | 67 | 17:27 |
| *** networkstatic has joined #openstack-dev | 17:28 | |
| *** henrynash has joined #openstack-dev | 17:28 | |
| *** lucasagomes has quit IRC | 17:28 | |
| *** vipul is now known as vipul-away | 17:29 | |
| *** vladikr has joined #openstack-dev | 17:29 | |
| *** martine has joined #openstack-dev | 17:29 | |
| *** martine has quit IRC | 17:29 | |
| *** vipul-away is now known as vipul | 17:29 | |
| *** jasdeepH has joined #openstack-dev | 17:30 | |
| *** alop has quit IRC | 17:30 | |
| *** dstanek has quit IRC | 17:30 | |
| *** bknudson has joined #openstack-dev | 17:31 | |
| *** alop has joined #openstack-dev | 17:31 | |
| *** tvb|afk has quit IRC | 17:31 | |
| *** jasondotstar has joined #openstack-dev | 17:31 | |
| *** jtomasek has joined #openstack-dev | 17:32 | |
| *** negronjl has joined #openstack-dev | 17:33 | |
| *** athomas has quit IRC | 17:33 | |
| *** mlavalle has quit IRC | 17:33 | |
| *** litong has quit IRC | 17:37 | |
| *** anniec has joined #openstack-dev | 17:37 | |
| *** gyee has quit IRC | 17:40 | |
| *** venkatesh has joined #openstack-dev | 17:41 | |
| *** jruzicka has quit IRC | 17:43 | |
| *** ericw has joined #openstack-dev | 17:44 | |
| *** spzala has joined #openstack-dev | 17:45 | |
| *** belmoreira has joined #openstack-dev | 17:46 | |
| atiwari | ayoung, I made changes on #15 as we discussed and doing "git review --no-rebase" as suggested by dolphm and getting http://paste.openstack.org/raw/47564/ | 17:48 |
| *** sushils has joined #openstack-dev | 17:48 | |
| atiwari | it seems "af68f75 sync oslo policy" in there | 17:49 |
| *** martyntaylor has left #openstack-dev | 17:50 | |
| *** adjohn has joined #openstack-dev | 17:52 | |
| annegentle | dolphm: around? | 17:52 |
| *** karlsone is now known as ekarlso | 17:54 | |
| *** henrynash has quit IRC | 17:54 | |
| *** oubiwann is now known as bloodninja | 17:54 | |
| *** bloodninja is now known as oubiwann | 17:55 | |
| *** jtomasek has quit IRC | 17:55 | |
| *** changbl has quit IRC | 17:55 | |
| *** krtaylor has quit IRC | 17:55 | |
| *** colinmcnamara has joined #openstack-dev | 17:55 | |
| *** Mandell has joined #openstack-dev | 17:58 | |
| *** openfly has joined #openstack-dev | 17:58 | |
| adam_g | does anyone know if the version requirements of os client libraries set by individual projects requirements.txt are frozen at this point for H? | 17:59 |
| *** belmoreira has quit IRC | 18:00 | |
| ayoung | atiwari, I'm just reviewing. I am not making changes. | 18:01 |
| *** ruhe has joined #openstack-dev | 18:01 | |
| *** dstanek has joined #openstack-dev | 18:02 | |
| ayoung | atiwari, you should be able to type "yes" on that review and be good to go. I assume that no changes to the oslo review have gone in. | 18:02 |
| dolphm | annegentle: o/ | 18:02 |
| dolphm | morganfainberg: thanks for the reverify, what's up? | 18:03 |
| dolphm | ayoung: i think atiwari's patch is the last for rc1 | 18:03 |
| morganfainberg | dolphm, did we want to pull docs about the per-domain-identity backend out, since i don't think we're going to get cleanup patches (and other dependant changes) in before RC1 is cut w/o some added buffer time. | 18:03 |
| dolphm | atiwari: also, we either need to remove the try/except or test it | 18:04 |
| dolphm | atiwari: if you don't think we need it, we can remove it | 18:04 |
| *** nplanel has joined #openstack-dev | 18:04 | |
| *** anniec has quit IRC | 18:04 | |
| dolphm | morganfainberg: can you link me to the latest patch for that? | 18:04 |
| dolphm | morganfainberg: (to clean it up) | 18:04 |
| morganfainberg | dolphm, it's the same one as before, haven't had time to roll a new one | 18:05 |
| *** romcheg has quit IRC | 18:05 | |
| morganfainberg | looking for it | 18:05 |
| *** romcheg has joined #openstack-dev | 18:05 | |
| morganfainberg | dolphm, https://review.openstack.org/#/c/45649/ | 18:05 |
| dolphm | atiwari: i'll push a patchset 16 without the try/except -- i've already got it ready to go... | 18:05 |
| dolphm | atiwari: done- https://review.openstack.org/#/c/46123/16/keystone/common/controller.py | 18:06 |
| dolphm | morganfainberg: thanks | 18:06 |
| *** xmltok_ has quit IRC | 18:06 | |
| dolphm | morganfainberg: ah, it was abandoned-- that's why i lost it :P | 18:06 |
| atiwari | dolphm, thanks | 18:06 |
| morganfainberg | dolphm, i can work on the comments and splitting it up starting today, just not sure how far it'll get. | 18:06 |
| dolphm | morganfainberg: understood | 18:07 |
| *** melwitt has joined #openstack-dev | 18:07 | |
| morganfainberg | dolphm, yeah, i didn't resurrect it since i've been stuck with some work internally here at my company + helping with some other RC1 stuff :) | 18:07 |
| dolphm | morganfainberg: i'd like to get this gating (in some form) first https://review.openstack.org/#/c/46123/ | 18:07 |
| morganfainberg | dolphm, absolutely. | 18:07 |
| dolphm | morganfainberg: and then we'll have until tomorrow morning to get a fix in for identity-per-domain if we want to? i'm happy to pursue that for the rest of the day | 18:07 |
| *** changbl has joined #openstack-dev | 18:09 | |
| *** xmltok has joined #openstack-dev | 18:09 | |
| *** xmltok has joined #openstack-dev | 18:09 | |
| morganfainberg | dolphm, if we don't hit it tomorrow, lets just pull the docs. i'll start carving that one up into the peices it needs to be in. also, we need to accept that we might have ID collisions if it's used. probably should add a document line about "this isn't enforced…expirimental people" | 18:09 |
| *** jtomasek has joined #openstack-dev | 18:09 | |
| morganfainberg | (i'll base the new patch on atiwari's so that one goes in first for sure) | 18:09 |
| *** shinylasers has quit IRC | 18:10 | |
| dolphm | morganfainberg: maybe add a link in docs to the primary bug? | 18:10 |
| morganfainberg | dolphm, sounds good. | 18:11 |
| dolphm | morganfainberg: that way there's something traceable | 18:11 |
| dolphm | atiwari: i added a comment on https://review.openstack.org/#/c/46123/16/keystone/common/controller.py | 18:11 |
| *** amcrn has joined #openstack-dev | 18:11 | |
| *** salv-orlando has quit IRC | 18:12 | |
| *** colinmcnamara has quit IRC | 18:13 | |
| *** colinmcnamara has joined #openstack-dev | 18:13 | |
| *** afazekas is now known as afazekas_zz | 18:14 | |
| *** jmontemayor has joined #openstack-dev | 18:15 | |
| ayoung | dolphm, atiwari +2 from me | 18:16 |
| dolphm | ayoung: thanks! | 18:17 |
| ayoung | dolphm, what is the plan for morganfainberg 's patch? https://review.openstack.org/#/c/45649/ Is that in the category of "if there is an RC 2 we might accept it?" | 18:17 |
| *** jtomasek has quit IRC | 18:17 | |
| *** alop has quit IRC | 18:18 | |
| ayoung | Or are we still waiting on the rest of OS for RC1, so we might add a fix for that if we feel it is justified? | 18:18 |
| dolphm | ayoung: whoa, the elif might present a security vulnerability | 18:18 |
| morganfainberg | dolphm, ayoung, atiwari, https://review.openstack.org/#/c/46123/16/keystone/token/providers/uuid.py line 562, do we really want to catch/smash unauthorized? | 18:18 |
| ayoung | dolphm, the elif is based on the policy rule. | 18:19 |
| dolphm | ayoung: not completely true | 18:19 |
| ayoung | oh..yeah...that would be bad... | 18:19 |
| ayoung | I misread that. | 18:19 |
| dolphm | ayoung: if a CLIENT specifies an X-Subject-Token, then the member policy stuff gets bypassed | 18:20 |
| morganfainberg | oh i guess, so, but shouldn't that raise up a 404 instead of just logging? | 18:20 |
| dolphm | ayoung: i'm not sure if policy would fail with a 401 or 500 or it would allow it? | 18:20 |
| *** dprince has quit IRC | 18:20 | |
| dolphm | morganfainberg: the try/except is gone, if that's what you're referring to | 18:20 |
| ayoung | dolphm, that logic should be based on the policy rule, not what the user sends in....it couldn't be hacked, as they can't arbitrarily put data into the token, but still...that one needs to be changed | 18:20 |
| *** nermina has joined #openstack-dev | 18:21 | |
| morganfainberg | dolphm, oh it is? | 18:21 |
| morganfainberg | in validate_v3_token( | 18:21 |
| dolphm | morganfainberg: latest patch https://review.openstack.org/#/c/46123/16/keystone/common/controller.py | 18:21 |
| morganfainberg | no no, providers/uuid.py | 18:21 |
| dolphm | morganfainberg: oh, where's that? | 18:21 |
| morganfainberg | https://review.openstack.org/#/c/46123/16/keystone/token/providers/uuid.py | 18:21 |
| ayoung | dolphm, my thinking is that we should proably be merging the two dictionaries | 18:21 |
| morganfainberg | line 562 | 18:21 |
| dolphm | morganfainberg: ah, hrm | 18:21 |
| dolphm | morganfainberg: this might be a bad cherry pick on my part | 18:22 |
| morganfainberg | that likely needs to re-raise a 404 of some sort | 18:22 |
| morganfainberg | dolphm, i think that was there in earlier patches | 18:22 |
| dolphm | morganfainberg: yeah, it was - nvm | 18:22 |
| *** jtomasek has joined #openstack-dev | 18:22 | |
| atiwari | morganfainberg, I had removed that exception.Unauthorized from the list | 18:22 |
| dolphm | morganfainberg: gyee had the same concern here https://review.openstack.org/#/c/46123/11/keystone/token/providers/uuid.py | 18:22 |
| *** belmoreira has joined #openstack-dev | 18:23 | |
| atiwari | we do not want exception.Unauthorized in the catch list | 18:23 |
| morganfainberg | i think the correct answer is reraise TokenNotFound | 18:23 |
| *** belmoreira has quit IRC | 18:23 | |
| morganfainberg | since we've already passed x-auth-token is valid by that point | 18:23 |
| atiwari | https://review.openstack.org/#/c/46123/13/keystone/token/providers/uuid.py | 18:23 |
| atiwari | does not have it | 18:23 |
| morganfainberg | atiwari, that doesn't change the net-effect, it probably needs to raise a 404, since validation failed | 18:24 |
| *** sushils has quit IRC | 18:24 | |
| *** danpb has quit IRC | 18:25 | |
| dolphm | ayoung: testing this now http://pasteraw.com/jxjhg3uxcm3xflkvzhr7j0aj19rd40k | 18:26 |
| *** jasondotstar has quit IRC | 18:27 | |
| *** jang has quit IRC | 18:27 | |
| *** corrigac has quit IRC | 18:27 | |
| *** mkerrin has quit IRC | 18:27 | |
| *** rossella_s has quit IRC | 18:28 | |
| dolphm | morganfainberg: what's the point of catching any of these exceptions? why not raise them all? | 18:28 |
| *** epim has quit IRC | 18:28 | |
| *** roz has quit IRC | 18:28 | |
| morganfainberg | dolphm, if we have a legitimate unauthorized, we should turn that into a 404 (or any other error) | 18:28 |
| morganfainberg | dolphm, any current 404s should be fine. | 18:28 |
| morganfainberg | dolphm, hrm. maybe just unauthorized. this is to keep from claiming x-auth-token is invalid (which is what a 401 would indicate) | 18:29 |
| dolphm | morganfainberg: on token validation | 18:29 |
| morganfainberg | yes. | 18:29 |
| dolphm | morganfainberg: if i pass in an invalid X-Auth-Token, i should get a 401 | 18:29 |
| morganfainberg | dolphm, that is checked controller level? not provider level | 18:30 |
| morganfainberg | by the time we hit the provider x-auth-token should be valid. if it isn't, we're doing something very wrong higher up | 18:30 |
| morganfainberg | dolphm, the whole crux of this patchset is that invalid x-subject-token should be 404, not 401. | 18:31 |
| dolphm | morganfainberg: right | 18:31 |
| atiwari | not totally correct | 18:31 |
| *** giulivo has quit IRC | 18:31 | |
| morganfainberg | atiwari, ? | 18:31 |
| atiwari | if x-auth-token has auth then 404 if not 401 | 18:32 |
| ayoung | dolphm, I don't think there is a security issue. No reason that passing -X-Subject-Token is any different than passing -X-Auth_Token. A user that knows the token could always call the API either way. This is really just simplifying things. I think your logic is partially correct. | 18:32 |
| dolphm | ayoung: it's VERY different | 18:32 |
| morganfainberg | atiwari, not sure what you mean. | 18:32 |
| ayoung | But whether to use the subject token or the auth token as the target should be based on the rule, not the presense of the value in the request | 18:32 |
| dolphm | ayoung: one expresses the API user's authorization and one expresses the resource they're trying to access | 18:32 |
| ayoung | dolphm, understood. and I think we should change it | 18:32 |
| *** zhiyan has quit IRC | 18:33 | |
| dolphm | ayoung: based on what? | 18:33 |
| ayoung | dolphm, I think we should make both part of the policy dictionary | 18:33 |
| *** reed_ has joined #openstack-dev | 18:33 | |
| *** amohn9 has joined #openstack-dev | 18:33 | |
| ayoung | but with the ability to differentiate | 18:33 |
| ayoung | something like | 18:33 |
| atiwari | ok, the is user who is making validate/revoke token has auth then only he should see 404 for invalid x-subject-token | 18:33 |
| *** reed_ has quit IRC | 18:33 | |
| *** networkstatic has quit IRC | 18:33 | |
| atiwari | otherwise it should be 401 | 18:34 |
| ayoung | {"target + : auth-token-data, "subject":subject-token-data} | 18:34 |
| *** reed has quit IRC | 18:34 | |
| dolphm | ayoung: that's what this patch is introducing | 18:34 |
| dolphm | ayoung: did you even review it? | 18:34 |
| ayoung | dolphm, I mean the elif | 18:34 |
| morganfainberg | atiwari, correct, and the question was regarding the check in the provider's validate_v3_token method. | 18:34 |
| ayoung | I have the values wrong...but what I amsaying is that the subject should be added to the dictionary | 18:35 |
| dolphm | ayoung: 'target' and 'subject' are synonyms here | 18:35 |
| ayoung | so instead of an elif | 18:35 |
| ayoung | dolphm, that is confusing | 18:35 |
| *** radix has quit IRC | 18:35 | |
| morganfainberg | atiwari, let me check, i think that should always cause a 404 on invalid token. | 18:35 |
| *** radix has joined #openstack-dev | 18:35 | |
| atiwari | I do not understand the need to elif | 18:35 |
| dolphm | ayoung: something more like this? http://pasteraw.com/jxjhg3uxcm3xflkvzhr7j0aj19rd40k | 18:36 |
| *** gyee has joined #openstack-dev | 18:36 | |
| *** reed has joined #openstack-dev | 18:36 | |
| *** krtaylor has joined #openstack-dev | 18:37 | |
| *** sdake has quit IRC | 18:37 | |
| ayoung | dolphm, yeah, although I think you need to initialize policy_dict to {} for the second block | 18:37 |
| *** tmclaugh[work] has quit IRC | 18:37 | |
| *** sdake has joined #openstack-dev | 18:37 | |
| atiwari | morganfainberg, some how the upper layer is converting to 401. | 18:37 |
| *** mlavalle has joined #openstack-dev | 18:37 | |
| atiwari | and that is why I added try/catch in controller | 18:38 |
| ayoung | dolphm, It might be better, though, instead o saying "target" we wrote rules designed to use the subject token as "subject" or something | 18:39 |
| dolphm | ayoung: how is that different from 'target'? | 18:39 |
| *** angdraug has quit IRC | 18:39 | |
| ayoung | ["user_id:%(subject.entity.user_id)s"] | 18:40 |
| ayoung | dolphm, it is more explicit: it says that you must have a subject token, and that the value checked will be the subject's data | 18:40 |
| ayoung | it will allow writing rules that say things like target = one user and subject = another | 18:40 |
| annegentle | dolphm: hi, I know I should know this, but are people considering v3 'complete" for havana? | 18:40 |
| dolphm | ayoung: i see your confusion then, from the perspective of writing policy.json | 18:41 |
| dolphm | annegentle: i'd say is was 'complete' for grizzly | 18:41 |
| dolphm | annegentle: most of the bugs we've seen since are a result of using both API's in the same deployment | 18:42 |
| *** mkerrin has joined #openstack-dev | 18:42 | |
| annegentle | dolphm: yeah I thought you said that at grizzly time | 18:42 |
| dolphm | annegentle: not from v3 being insufficient | 18:42 |
| annegentle | (that it was ready) | 18:42 |
| dolphm | ayoung: ["subject_user_id:%(target.entity.user_id)s"]] ? i don't know | 18:43 |
| ayoung | dolphm, yeah, target versus subject is also confusing. Although I suspect the subject part is the less confusing of the two | 18:44 |
| dolphm | ayoung: you're only confused because you're aware that it's called X-Subject-Token in the API | 18:44 |
| dolphm | ayoung: if you don't know that, then this implementation is consistent with the rest of our policy.json target stuff | 18:44 |
| *** novas0x2a|laptop has joined #openstack-dev | 18:44 | |
| atiwari | dolphm, +1 | 18:45 |
| dolphm | ayoung: if we renamed X-Target-Token in the API, you'd be satisfied as well? | 18:45 |
| dolphm | (not that we can do that) | 18:45 |
| morganfainberg | atiwari | 18:45 |
| atiwari | yes | 18:45 |
| ayoung | dolphm, let me phrase it this way. Would we ever want to write policy that need to distinguish between data from the Auth token and the Subject token? | 18:45 |
| dolphm | ayoung: i uploaded a new patch that merges the two datasets together, btw: https://review.openstack.org/#/c/46123/16/keystone/common/controller.py | 18:46 |
| *** AlexF has quit IRC | 18:46 | |
| ayoung | would you expect them both to be passed in, to be different, and for the policy to have to decide on whether an operation was acceptable. | 18:46 |
| dolphm | morganfainberg: this patchset ^ does NOT address your concerns here https://review.openstack.org/#/c/46123/16/keystone/token/providers/uuid.py | 18:46 |
| morganfainberg | dolphm, atiwari, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/provider.py#n194 might be a culprit | 18:47 |
| dolphm | ayoung: so, the latest patchset makes that exact use case possible | 18:47 |
| morganfainberg | for improper transformation to Unauthorized | 18:47 |
| dolphm | ayoung: you could even write policy that uses both | 18:47 |
| *** networkstatic has joined #openstack-dev | 18:47 | |
| dolphm | morganfainberg: the ", we have a malformed token, or something went wrong." makes me nervous there | 18:48 |
| dolphm | the try/except there should go away | 18:48 |
| morganfainberg | dolphm, that was lifted from the drivers | 18:49 |
| morganfainberg | oh | 18:49 |
| morganfainberg | oh | 18:49 |
| morganfainberg | that | 18:50 |
| morganfainberg | maybe just catch keyerror? | 18:50 |
| morganfainberg | and type/value error? | 18:50 |
| *** ruhe has quit IRC | 18:50 | |
| morganfainberg | or do we want to raise up exceptions for bad timeutils conversions etc | 18:50 |
| dolphm | morganfainberg: i have no idea :( | 18:50 |
| dolphm | morganfainberg: i would think any of that should cause a 500 because we have no idea what went wrong | 18:50 |
| morganfainberg | dolphm, fair enough. try/except should be removed. | 18:51 |
| morganfainberg | dolphm, no complaints on ISE on that. | 18:51 |
| dolphm | morganfainberg: ISE? | 18:51 |
| morganfainberg | internal server error | 18:51 |
| dolphm | ah | 18:51 |
| morganfainberg | dolphm, want me to toss a separate review up to clean that up? | 18:52 |
| ayoung | dolphm, yes...but we are still overloading the term target. It origianlly mean the value in the URL. Now we are saying that it is the value in the subject token. Now, maybe this is stretching things, but what if we had an operation where we were checking if a delegation operation were valid. We would need to be able to confirm A) the XAuth-Token was valid, B) the User from the Subject-token could perform the operation on the user | 18:52 |
| ayoung | signified as the target? We'd want to keep the user ids from the subject token separate from the target user id. | 18:52 |
| *** vipul is now known as vipul-away | 18:52 | |
| *** epim has joined #openstack-dev | 18:52 | |
| atiwari | ayoung, IMO it is the way you view the target | 18:53 |
| dolphm | morganfainberg: sure | 18:53 |
| dolphm | ayoung: it's the same thing though | 18:53 |
| ayoung | atiwari, right, so the question is will we need to maintain a clear way to tell which item we are talking about | 18:53 |
| atiwari | in all the token operations there is no target but the x-subject-token is the target of the token api | 18:54 |
| dolphm | ayoung: we just moved GET /v2.0/tokens/{token_id} to GET /v3/auth/tokens X-Subject-Token: {token_id} | 18:54 |
| dolphm | doesn't matter if you call it subject or target, it's the resource being validated | 18:54 |
| atiwari | IMO, no target is OK in case of token API | 18:54 |
| *** dubsquared has joined #openstack-dev | 18:55 | |
| dolphm | atiwari: can you be more specific? i don't follow | 18:55 |
| *** martine_ has joined #openstack-dev | 18:55 | |
| atiwari | dolphm, as you mentioned in V3 we came up with X-Subject-Token, that is actually the target of all the token APIs | 18:56 |
| *** jcoufal has quit IRC | 18:56 | |
| dolphm | atiwari: correct | 18:56 |
| dolphm | atiwari: (that was actually an api extension in v2) | 18:56 |
| *** epim has quit IRC | 18:56 | |
| dolphm | in essex | 18:56 |
| atiwari | correct | 18:56 |
| *** tmclaugh[work] has joined #openstack-dev | 18:56 | |
| ayoung | dolphm, so what you are saying is that we just have the token in the header to hide it from the url. So continuing to call it target is more correct. | 18:57 |
| *** epim has joined #openstack-dev | 18:57 | |
| ayoung | And we will not write APIs that mix the two concepts. | 18:57 |
| dolphm | ayoung: yes, but i don't think it's "more correct", i just see it as the same thing, so i'd rather not use two different termonologies | 18:57 |
| dolphm | terminologies* | 18:57 |
| *** venkatesh has quit IRC | 18:57 | |
| dolphm | ayoung: we could, i suppose, write API's that mix the two concepts... but we haven't, yet | 18:58 |
| *** sarob has joined #openstack-dev | 18:58 | |
| ayoung | In that case, then the elif is probably correct conceptually. But choseing where to get it should probably be based on the API, not based on the user input. I can't think how it would be a security issue, as the user needs access to the tokenId in the first place to do anything, and the token is fetched from the backend, so there is no arbitraty data. | 18:59 |
| dolphm | ayoung: theoretical- get me the common subset of my catalog and this user's catalog? GET /catalog X-Auth-Token: {admin's token} X-Subject-Token: {some client's token} | 18:59 |
| dolphm | i dunno | 18:59 |
| ayoung | your latest patch is OK, too | 18:59 |
| ayoung | dolphm, I was thinking, "A user just gave me token X to perform an operation on user Y" | 19:00 |
| ayoung | can they do it | 19:00 |
| dolphm | ayoung: right, i don't think it's a security vulnerability against the current codebase, but i could see someone writing a policy that used this feature, and then it gets bypassed because an api client passes a valid X-Subject-Token into an API that doesn't expect it | 19:00 |
| *** krtaylor has quit IRC | 19:01 | |
| ayoung | dolphm, yeah...get_member_from_driver is not implemented on the token or auth controllers, so we won't accidentally trip that logic in the current code base. | 19:03 |
| ayoung | but it feels like there is a better way to do this. Something like ask the controller to give you the subject | 19:04 |
| *** sarob has quit IRC | 19:04 | |
| *** ndipanov has quit IRC | 19:04 | |
| *** sarob has joined #openstack-dev | 19:04 | |
| ayoung | we could pass the subject token to the auth driver and let it make the decision instead of doing it in the common controller | 19:05 |
| dolphm | ayoung: that's why get_member is configurable | 19:05 |
| dolphm | ayoung: it's a callable specified by the controller to return the target | 19:05 |
| dolphm | ayoung: ++ for passing the subject token to the controller | 19:05 |
| ayoung | dolphm, right. But it doesn't have access to the headers | 19:05 |
| dolphm | (but that's kind of what we're doing anyway, since @protected is wrapping controller methods) | 19:06 |
| *** dubsquared has quit IRC | 19:06 | |
| dolphm | ayoung: headers are in context | 19:06 |
| ayoung | get_member_from_driver just gets the %_id, though | 19:06 |
| *** neelashah has quit IRC | 19:07 | |
| ayoung | dolphm, what if it were a separate @attribute, | 19:07 |
| ayoung | @subject_token_protected | 19:07 |
| * ayoung has gone of the deep end | 19:07 | |
| *** rch has quit IRC | 19:08 | |
| ayoung | dolphm, would it be more correct for the policy to know to get the value out of the header, or for the controller to know that, in this case, the target should come from the subject header? | 19:09 |
| *** dubsquared has joined #openstack-dev | 19:09 | |
| ayoung | if it is the controller's decision, then let it be a parameter passed to the attribute function. @protected(subject_token=True) | 19:10 |
| *** prekarat has quit IRC | 19:10 | |
| *** adjohn has quit IRC | 19:10 | |
| *** rch has joined #openstack-dev | 19:10 | |
| *** neelashah has joined #openstack-dev | 19:10 | |
| *** colinmcnamara has quit IRC | 19:11 | |
| *** adjohn has joined #openstack-dev | 19:12 | |
| *** dubsquar_ has joined #openstack-dev | 19:13 | |
| *** dubsquared has quit IRC | 19:13 | |
| *** thingee is now known as thingee_zzz | 19:15 | |
| *** hugokuo has quit IRC | 19:15 | |
| *** yolanda has quit IRC | 19:15 | |
| *** gimps_ has joined #openstack-dev | 19:15 | |
| *** adjohn has quit IRC | 19:16 | |
| *** networkstatic has quit IRC | 19:17 | |
| *** joearnold has quit IRC | 19:18 | |
| *** jasdeepH has quit IRC | 19:18 | |
| *** adepti37 has quit IRC | 19:19 | |
| *** garyk has quit IRC | 19:20 | |
| *** joearnold has joined #openstack-dev | 19:20 | |
| *** beraldo has quit IRC | 19:21 | |
| *** mkollaro has quit IRC | 19:21 | |
| *** jprovazn has quit IRC | 19:21 | |
| *** hugokuo has joined #openstack-dev | 19:21 | |
| *** dstanek has quit IRC | 19:22 | |
| *** antonym has quit IRC | 19:22 | |
| *** venkatesh has joined #openstack-dev | 19:22 | |
| *** romcheg has quit IRC | 19:23 | |
| *** venkatesh has quit IRC | 19:23 | |
| *** venkatesh has joined #openstack-dev | 19:24 | |
| *** venkatesh has quit IRC | 19:25 | |
| *** antonym has joined #openstack-dev | 19:25 | |
| *** stevemar has joined #openstack-dev | 19:26 | |
| stevemar | dolphm, ping | 19:27 |
| *** garyk has joined #openstack-dev | 19:29 | |
| dolphm | stevemar: pong | 19:29 |
| *** anderstj has quit IRC | 19:30 | |
| *** amohn9 has quit IRC | 19:30 | |
| *** adepti37 has joined #openstack-dev | 19:30 | |
| *** gatuus has joined #openstack-dev | 19:30 | |
| *** anderstj has joined #openstack-dev | 19:30 | |
| stevemar | dolphm, just wondering if there was something wrong with my comment: https://review.openstack.org/#/c/46975/ | 19:30 |
| stevemar | dolphm, doesn't look like jenkins got kicked off again | 19:31 |
| dolphm | stevemar: yep! | 19:31 |
| dolphm | stevemar: use recheck to restart checks, use reverify to restart gating | 19:31 |
| stevemar | ahhhh | 19:31 |
| dolphm | stevemar: you *may* have to be core to use reverify? i'd be curious to know for sure | 19:31 |
| stevemar | dolphm, no time like the present to give a whirl | 19:32 |
| morganfainberg | dolphm, don't think so | 19:32 |
| stevemar | worked! | 19:32 |
| dolphm | stevemar: awesome | 19:32 |
| morganfainberg | ugh. changing that validate call to raise TokenNotFound is ugly. | 19:32 |
| dolphm | morganfainberg: _verify_token() ? | 19:33 |
| morganfainberg | dolphm, _is_valid_token() | 19:33 |
| morganfainberg | dolphm, the one you said we should remove try/exepct from | 19:33 |
| morganfainberg | in provider manager | 19:33 |
| *** tmclaugh[work] has quit IRC | 19:33 | |
| *** amohn9 has joined #openstack-dev | 19:33 | |
| dolphm | morganfainberg: =( what's the impact? | 19:33 |
| morganfainberg | dolphm, i'm chasing a ton of tests. | 19:34 |
| *** vipul-away is now known as vipul | 19:34 | |
| morganfainberg | dolphm, but a lot of things assume that call will raise unauthorized | 19:34 |
| dolphm | morganfainberg: wait are you changing Unauthorized -> TokenNotFound? | 19:34 |
| *** tmclaugh[work] has joined #openstack-dev | 19:35 | |
| morganfainberg | dolphm, was looking into that. it should, when validate/check comes through the controller raise a 404 instead of 401 on expired x-subject-token | 19:35 |
| morganfainberg | dolphm, though we could probably just leave this one be. | 19:36 |
| morganfainberg | and cleanup in icehouse. | 19:36 |
| dolphm | morganfainberg: ah | 19:36 |
| morganfainberg | dolphm, if it's easy to fix most of these it might be a simple patch to apply after atiwari's (move to 404 vs. 401 there) | 19:38 |
| morganfainberg | actually.. that paert might need to gert into his patch. so we aren't passing inconsistent stuff back and forth. | 19:38 |
| morganfainberg | hmmm. | 19:38 |
| morganfainberg | ayoung, ping | 19:40 |
| *** dhellmann has quit IRC | 19:42 | |
| *** dhellmann has joined #openstack-dev | 19:43 | |
| bknudson | File ".../keystone/token/backends/memcache.py", line 54, in _get_memcache_client | 19:43 |
| *** ayoung has quit IRC | 19:43 | |
| bknudson | TypeError: __init__() got an unexpected keyword argument 'cache_cas' | 19:44 |
| bknudson | ever seen that? | 19:44 |
| bknudson | with older versions of memcache | 19:44 |
| bknudson | what does cache_cas do? | 19:44 |
| *** Vek has quit IRC | 19:44 | |
| bknudson | morganfainberg: ^ | 19:45 |
| morganfainberg | bknudson, yeah, the older version of memcache clients leak memory like a seieve | 19:45 |
| morganfainberg | bknudson, basically they always store the cas_ids even if it isn't explicitly told to, they still have some cas semantics, just not the init to enable caching the ids | 19:46 |
| bknudson | should we require whatever version added cache_cas? | 19:46 |
| morganfainberg | bknudson, hrm, yes, i thought we did | 19:46 |
| morganfainberg | bknudson, it's a fairly old version that added that option. | 19:46 |
| bknudson | we might, but old OSes like RHEL 6.4 don't provide it. | 19:46 |
| morganfainberg | bknudson, ahhh. we def. should then | 19:47 |
| morganfainberg | not only because its required for us, but because without it, those libs really do just endlessly leak memory | 19:47 |
| morganfainberg | let me see what version fedora … 18? uses, I think that distro had one of the earliest working versions | 19:48 |
| morganfainberg | bknudson, let me chase that down after lunch. | 19:49 |
| *** neelashah has quit IRC | 19:53 | |
| bknudson | morganfainberg: thanks! | 19:53 |
| *** garyk has quit IRC | 19:56 | |
| *** Birk_ has quit IRC | 19:57 | |
| *** gimps_ has quit IRC | 19:57 | |
| *** jasdeepH has joined #openstack-dev | 19:58 | |
| *** angdraug has joined #openstack-dev | 19:58 | |
| *** dubsquar_ has quit IRC | 19:59 | |
| *** egallen has quit IRC | 19:59 | |
| *** AlexF has joined #openstack-dev | 20:00 | |
| *** colinmcnamara has joined #openstack-dev | 20:00 | |
| *** litong has joined #openstack-dev | 20:00 | |
| *** eharney has quit IRC | 20:02 | |
| *** cjwilson has joined #openstack-dev | 20:02 | |
| *** neelashah has joined #openstack-dev | 20:04 | |
| *** dubsquar_ has joined #openstack-dev | 20:04 | |
| *** neelashah has quit IRC | 20:05 | |
| *** radez is now known as radez_g0n3 | 20:05 | |
| *** alunduil has quit IRC | 20:06 | |
| *** dmakogon_ has joined #openstack-dev | 20:06 | |
| *** dstanek has joined #openstack-dev | 20:07 | |
| *** dmakogon_ has left #openstack-dev | 20:09 | |
| *** venkatesh has joined #openstack-dev | 20:09 | |
| *** iccha has quit IRC | 20:10 | |
| *** rossella_s has joined #openstack-dev | 20:13 | |
| *** ekarlso has quit IRC | 20:13 | |
| *** ekarlso has joined #openstack-dev | 20:13 | |
| *** DinaBelova has quit IRC | 20:13 | |
| *** rickerc has joined #openstack-dev | 20:14 | |
| *** iccha has joined #openstack-dev | 20:15 | |
| dolphm | atiwari: gyee: morganfainberg: bknudson: i pushed another patch here to address this comment https://review.openstack.org/#/c/46123/17/keystone/token/providers/uuid.py | 20:16 |
| dolphm | the new diff makes it much more clear that only TokenNotFounds are being unsuppressed https://review.openstack.org/#/c/46123/18/keystone/token/providers/uuid.py | 20:16 |
| *** adjohn has joined #openstack-dev | 20:16 | |
| *** changbl_ has joined #openstack-dev | 20:17 | |
| *** changbl has quit IRC | 20:18 | |
| *** jasdeepH has quit IRC | 20:20 | |
| *** adjohn has quit IRC | 20:21 | |
| *** jmontemayor has quit IRC | 20:21 | |
| *** sgordon has quit IRC | 20:24 | |
| *** eglynn has quit IRC | 20:24 | |
| *** adjohn has joined #openstack-dev | 20:25 | |
| *** tserong has quit IRC | 20:25 | |
| *** changbl_ has quit IRC | 20:26 | |
| *** changbl has joined #openstack-dev | 20:26 | |
| *** tserong has joined #openstack-dev | 20:26 | |
| *** AlexF has quit IRC | 20:27 | |
| *** ayoung has joined #openstack-dev | 20:31 | |
| *** boden has quit IRC | 20:31 | |
| *** fbo is now known as fbo_away | 20:32 | |
| ayoung | morganfainberg, sorry, moved offices...you rang? | 20:33 |
| *** jasdeepH has joined #openstack-dev | 20:34 | |
| *** epim has quit IRC | 20:34 | |
| *** adjohn has quit IRC | 20:37 | |
| *** AlexF has joined #openstack-dev | 20:38 | |
| *** amohn9 has quit IRC | 20:39 | |
| *** dkehn_ is now known as dkehn | 20:40 | |
| dolphm | atiwari: gyee: morganfainberg: bknudson: ayoung: see my comments on patchsets 17 and 18 -- they're both small and don't seem to affect tests so i submitted patchset 19 to clean those bits up and +2'd | 20:40 |
| dolphm | https://review.openstack.org/#/c/46123/ | 20:40 |
| *** boris-42 has joined #openstack-dev | 20:41 | |
| *** epim has joined #openstack-dev | 20:41 | |
| *** rossella_s has quit IRC | 20:41 | |
| *** MaxV has joined #openstack-dev | 20:43 | |
| *** AlexF has quit IRC | 20:43 | |
| *** adjohn has joined #openstack-dev | 20:43 | |
| gyee | dolphm, looking | 20:46 |
| *** dolphm has quit IRC | 20:46 | |
| *** adjohn has quit IRC | 20:46 | |
| *** ondergetekende_ has joined #openstack-dev | 20:47 | |
| *** eglynn has joined #openstack-dev | 20:48 | |
| *** romcheg has joined #openstack-dev | 20:48 | |
| ayoung | gyee, I just +2ed. Feel free to merge if you think it is good | 20:49 |
| *** krtaylor has joined #openstack-dev | 20:50 | |
| *** thingee_zzz is now known as thingee | 20:50 | |
| gyee | ayoung, I think we need the rest of the token attributes | 20:50 |
| gyee | like scope and roles | 20:50 |
| ayoung | gyee, in icehouse | 20:50 |
| ayoung | gyee, so long as the semantics are OK as is, we can do that in a followon | 20:51 |
| *** xqueralt is now known as xqueralt-afk | 20:51 | |
| gyee | ayoung, k, that sounds reasonable | 20:51 |
| gyee | lemme change me vote | 20:51 |
| *** jtomasek has quit IRC | 20:51 | |
| ayoung | gyee, please file a ticket for that, too. | 20:51 |
| morganfainberg | gyee, you talking about token patch? | 20:51 |
| ayoung | morganfainberg, yeah. we only get the userid out of the subject token, | 20:51 |
| gyee | morganfainberg, https://review.openstack.org/#/c/46123/ | 20:51 |
| gyee | I am fine with the framework changes | 20:52 |
| morganfainberg | nod. | 20:52 |
| ayoung | line 150ish | 20:52 |
| morganfainberg | i'm trying to see if this patchset is actually solving the 404 vs 401 issue | 20:52 |
| morganfainberg | on x-subject-token | 20:52 |
| ayoung | morganfainberg, doesn't the unit test confirm that? | 20:53 |
| morganfainberg | ayoung, well | 20:53 |
| morganfainberg | https://review.openstack.org/#/c/46123/19/keystone/token/providers/uuid.py line 556 | 20:53 |
| gyee | morganfainberg, you want to go over it before hitting the approve button? | 20:53 |
| *** boris-42 has quit IRC | 20:53 | |
| *** litong has quit IRC | 20:53 | |
| morganfainberg | looks like we've added back in Unauthorized exception for validate | 20:53 |
| morganfainberg | crud. let me once over this | 20:54 |
| *** yaguang has joined #openstack-dev | 20:54 | |
| morganfainberg | ayoung, as far as i can tell, the provider shouldn't ever raise up an unauthorized | 20:55 |
| morganfainberg | that was the root of this whole bug | 20:55 |
| *** epim has quit IRC | 20:55 | |
| morganfainberg | please feel free to tell me i'm crazy | 20:55 |
| ayoung | morganfainberg, https://review.openstack.org/#/c/46123/19/keystone/tests/test_v3_auth.py line 455 and beyond | 20:56 |
| ayoung | invalid X-Auth-TOken raises a 401 | 20:56 |
| morganfainberg | ayoung, ah i think i see the core of the issue | 20:56 |
| morganfainberg | ayoung, no unit tests for v2 | 20:56 |
| morganfainberg | well no changes. | 20:56 |
| *** boris-42 has joined #openstack-dev | 20:57 | |
| *** epim has joined #openstack-dev | 20:57 | |
| morganfainberg | only v3 restful test case changes | 20:57 |
| ayoung | https://review.openstack.org/#/c/46123/19/keystone/tests/test_auth.py | 20:57 |
| ayoung | but that is not a content specific one... | 20:57 |
| *** spzala has quit IRC | 20:57 | |
| morganfainberg | and that likely will return a 404 | 20:57 |
| ayoung | morganfainberg, so...we could probably put one in test_contenttypes.py | 20:58 |
| morganfainberg | ayoung, i think we need to. I think we've resolved… in a partial way, the issues with unauthorized, though not completely for v3 | 20:58 |
| morganfainberg | but we're still going to run up against it for v2 | 20:59 |
| ayoung | morganfainberg, -1 it | 20:59 |
| *** adjohn has joined #openstack-dev | 20:59 | |
| morganfainberg | yep will od. | 20:59 |
| *** cjellick has quit IRC | 20:59 | |
| gyee | morganfainberg, this is v3 changes | 20:59 |
| gyee | v2 is already doing the right thing | 20:59 |
| morganfainberg | gyee, actually, it wasn't | 21:00 |
| *** lbragstad has quit IRC | 21:00 | |
| morganfainberg | gyee, it still returns Unauthorized in some cases it looks like, for invalid x-subject-tokens | 21:00 |
| gyee | looking | 21:00 |
| *** adjohn has quit IRC | 21:00 | |
| *** venkatesh has quit IRC | 21:01 | |
| morganfainberg | the issue between 404 and 401 was introduced into v2 by my cache changes and ayoung's validate changes | 21:01 |
| ayoung | morganfainberg, I don't think v2 accepts x-subject-tokens according to the API spec. | 21:01 |
| morganfainberg | ayoung, it doens't but the URI token id is the same thing | 21:01 |
| morganfainberg | ayoung, sorry i should have been more clear about x-subject vs token_id in uri | 21:01 |
| ayoung | morganfainberg, OK...lets see if we have a test we can extend in content types | 21:02 |
| *** zbitter has joined #openstack-dev | 21:02 | |
| *** tmclaugh[work] has quit IRC | 21:02 | |
| *** ericw has quit IRC | 21:02 | |
| morganfainberg | if i'm totally crazy here, i'm fine with that. I just think i'm seeing issues with v2 still returning unauthorized in some cases (i would rather be crazy tbh, this change could go in then) | 21:02 |
| *** jmontemayor has joined #openstack-dev | 21:03 | |
| ayoung | morganfainberg, test_validate_token | 21:03 |
| ayoung | line 396...lets add to that test | 21:03 |
| gyee | morganfainberg, it going through the same provider | 21:03 |
| gyee | so the changes will take care of both | 21:03 |
| morganfainberg | hm. | 21:04 |
| morganfainberg | ayoung, sec | 21:04 |
| ayoung | morganfainberg, whenever I try to run just that test, though, I get an error: | 21:05 |
| *** zaneb has quit IRC | 21:05 | |
| *** reed_ has joined #openstack-dev | 21:05 | |
| ayoung | NoSuchOptError: no such option: policy_file | 21:06 |
| gyee | :) | 21:06 |
| morganfainberg | gyee, _validate_v2_token, what in there can raise ValidationError? | 21:07 |
| *** donaldh has joined #openstack-dev | 21:07 | |
| *** reed has quit IRC | 21:07 | |
| morganfainberg | i'm not seeing anything | 21:07 |
| morganfainberg | gyee, if there is nothing that can raise ValidationError, my concerns are moot | 21:07 |
| morganfainberg | and we can move on. | 21:07 |
| gyee | ValidationError is fine | 21:07 |
| gyee | we just don't want to catch TokenNotFound error4 | 21:08 |
| morganfainberg | gyee, but on validation error we raise unauthorized | 21:08 |
| morganfainberg | re-raise | 21:08 |
| *** dtyarnell has quit IRC | 21:08 | |
| morganfainberg | which would net a 401 not a 500 ISE | 21:08 |
| gyee | morganfainberg, that's expected | 21:08 |
| morganfainberg | except that is incorrect then? | 21:08 |
| gyee | for token validation, you either get 404 or 401 | 21:08 |
| gyee | token not found is 404, everything else 401 | 21:08 |
| morganfainberg | if x-auth-token is invalid (checked at controller level) 401 | 21:08 |
| morganfainberg | right? | 21:08 |
| *** rnirmal has quit IRC | 21:09 | |
| morganfainberg | invalid token should be 404 | 21:09 |
| morganfainberg | or ISE for some massive error | 21:09 |
| gyee | correct, we basically want to distinguish between 404 and 401 | 21:09 |
| ayoung | morganfainberg, OK confirmed | 21:09 |
| morganfainberg | provider validate is a x-subject-token | 21:09 |
| gyee | invalid token should be 401 | 21:09 |
| gyee | token not found should be 404 | 21:09 |
| morganfainberg | i would say no. | 21:10 |
| *** markmcclain has quit IRC | 21:10 | |
| morganfainberg | how do you distinguish between the auth-token vs the subject-token being invalid/incorrect then? | 21:10 |
| morganfainberg | we aren't checking if you have access here. | 21:10 |
| gyee | auth-token invalid will result in 401 | 21:11 |
| morganfainberg | x-auth-token | 21:11 |
| morganfainberg | gyee, ok, so assume valid auth-token | 21:11 |
| gyee | we are talking about x-subject-token | 21:11 |
| morganfainberg | subject-token is invalid | 21:11 |
| morganfainberg | that should be a 401? | 21:11 |
| *** cjellick has joined #openstack-dev | 21:11 | |
| morganfainberg | how do you know which one is invalid at the consumer (outside) keystone based upon that? | 21:11 |
| gyee | understood | 21:12 |
| *** cjellick has quit IRC | 21:12 | |
| morganfainberg | i get a 401 back, i don't know if it's my subject token or auth token | 21:12 |
| gyee | I see your point | 21:12 |
| *** johnthetubaguy has joined #openstack-dev | 21:12 | |
| gyee | yeah, seem like it should be 403 if auth-token is invalid | 21:12 |
| morganfainberg | that would make sense | 21:12 |
| gyee | morganfainberg, good catch! | 21:12 |
| ayoung | morganfainberg, http://paste.fedoraproject.org/42539/29962138 | 21:12 |
| *** adjohn has joined #openstack-dev | 21:13 | |
| morganfainberg | ayoung, that looks good. | 21:13 |
| ayoung | morganfainberg, OK, so you think the change should be to validate? | 21:13 |
| morganfainberg | gyee, that also means http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/provider.py#n194 is incorrect | 21:14 |
| *** ericw has joined #openstack-dev | 21:14 | |
| *** ericw has quit IRC | 21:14 | |
| gyee | morganfainberg, that one is valid | 21:14 |
| morganfainberg | ayoung, that should catch the majority of the cases (most of the time we wont have validation errors, etc) | 21:14 |
| morganfainberg | gyee, is it? | 21:15 |
| gyee | yes, because token exist but not valid | 21:15 |
| morganfainberg | gyee, again, maybe 403? | 21:15 |
| morganfainberg | vs 401 | 21:15 |
| gyee | 403 is for policy check only | 21:15 |
| ayoung | 404 is fine | 21:15 |
| ayoung | could not find a valid token...many reasons for that | 21:16 |
| *** mrodden has quit IRC | 21:16 | |
| stevemar | ayoung: ping, (when you're done) | 21:16 |
| gyee | ayoung, you mean 404 for any subject token validation errors? | 21:16 |
| *** epim has quit IRC | 21:16 | |
| morganfainberg | gyee, i think that is an accurate approach | 21:16 |
| ayoung | gyee, yep | 21:16 |
| gyee | but that's just as confusing | 21:17 |
| morganfainberg | gyee, this is done as a rest call, externally saying "hey give me the data for this token" | 21:17 |
| ayoung | gyee, morganfainberg using the return code is probably a violation here. THe call itself is successful, just the content is telling us that the tokne is invalid. 404 is as correct as anything else | 21:17 |
| *** vladikr has quit IRC | 21:17 | |
| ayoung | should be 200 with a body that says "invalid" | 21:18 |
| morganfainberg | ayoung, ++ if that wouldn't break a lot of stuff… i'd say that would be the best approach | 21:18 |
| *** mrda has joined #openstack-dev | 21:18 | |
| ayoung | this is not a client error. This is a valid request. So, 404 is actually a violation of the HTTP spec in V3, but is appropraite for v2 where we put the token in the URL | 21:19 |
| *** venkatesh has joined #openstack-dev | 21:19 | |
| dstanek | is there any reason why creating a user returns a 200 and not a 201? | 21:19 |
| *** venkatesh has quit IRC | 21:19 | |
| ayoung | dstanek, becasue we don't pay that much attention to the spec | 21:19 |
| gyee | heh | 21:19 |
| morganfainberg | ayoung, well i guess we could leave that 401. really we shouldn't be getting that far most of the time | 21:19 |
| *** dubsquar_ has quit IRC | 21:19 | |
| ayoung | dstanek, and, lets face it, who really cares. Oh, wait, we do. | 21:20 |
| dstanek | ayoung: on purpose? | 21:20 |
| *** adjohn has quit IRC | 21:20 | |
| ayoung | morganfainberg, I'm OK with not breaking the auth_token middleware. I'd say that 404 is more correct, but I don't really think it matters | 21:20 |
| dstanek | ayoung: by spec are you talking about the identity spec or HTTP? | 21:20 |
| ayoung | dstanek, HTTP | 21:20 |
| morganfainberg | ayoung, if you want to add that test as a subsequent patch i'll say we can let this go as is. | 21:20 |
| ayoung | dstanek, I'm being flip. You are, of course, correct | 21:21 |
| gyee | k, I am fine with 404 | 21:21 |
| morganfainberg | i have a minor cleanup on a try/except to come in after, but i'm not worried about that. | 21:21 |
| ayoung | gyee, I am not | 21:21 |
| ayoung | gyee, I don't want to change v2 | 21:21 |
| ayoung | unless there is an overwhelming need to | 21:21 |
| gyee | anything more would be diminishing return :) | 21:21 |
| *** bswartz has quit IRC | 21:21 | |
| morganfainberg | ayoung, a 401 on v2 will cause auth_token to re-request admin token | 21:21 |
| ayoung | morganfainberg, OK, that is bad. | 21:22 |
| ayoung | A 404 works for me | 21:22 |
| dstanek | ayoung: i figured :) | 21:22 |
| *** mattfarina has quit IRC | 21:22 | |
| ayoung | morganfainberg, ...let me now get that est to pass | 21:22 |
| *** tmclaugh[work] has joined #openstack-dev | 21:22 | |
| morganfainberg | ayoung, ok, you want to switch the unauthorized to 404 as well? or you want me to to do so separately? | 21:23 |
| *** dubsquared has joined #openstack-dev | 21:23 | |
| atiwari | "unauthorized to 404" in which scenario ? | 21:23 |
| morganfainberg | atiwari, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/provider.py#n194 | 21:23 |
| morganfainberg | if a cached token validate has an expired token in it | 21:24 |
| morganfainberg | atiwari, make that a 404 instead of a 401 | 21:24 |
| atiwari | that does not make sense | 21:24 |
| *** dkranz has quit IRC | 21:24 | |
| atiwari | it should be 401 | 21:25 |
| morganfainberg | atiwari, this would be x-subject-token | 21:25 |
| morganfainberg | not x-auth-token | 21:25 |
| *** adalbas has quit IRC | 21:25 | |
| atiwari | 1 sec | 21:25 |
| morganfainberg | the scenario is as follows: validate call for token X is cached (it succeeds), when you call validate again for token X, the token has expired, but the cache hasn't expired, so it still succeeds | 21:26 |
| atiwari | as long as x-auth-token has auth 404 is ok | 21:26 |
| atiwari | if x-auth-token does not has auth it should be 401 | 21:26 |
| morganfainberg | atiwari, that shouldn't change | 21:26 |
| atiwari | even if x-subject-toekn is whatever | 21:27 |
| atiwari | ok | 21:27 |
| gyee | atiwari, how do we distinguished 401 for x-subject-token or x-auth-token? | 21:27 |
| morganfainberg | gyee, actually change http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/provider.py#n194 to 404 would be consistent. if the token was invalid the validate call would return 404. that just handles cached validate call. | 21:27 |
| morganfainberg | gyee, eliminate cache, and you'd already have a 404 coming into that method. | 21:27 |
| morganfainberg | erm before it. | 21:27 |
| *** adjohn has joined #openstack-dev | 21:28 | |
| morganfainberg | gyee, sorry for the headache on this one =/ | 21:28 |
| atiwari | x-auth-token is the one you are doing auth on and x-subject-token is target, then what is the problem | 21:29 |
| *** bnemec_ has quit IRC | 21:30 | |
| ayoung | morganfainberg, actually that test was bogus. I was using an invalid token to auth as well as the target | 21:30 |
| ayoung | http://paste.fedoraproject.org/42545/23100413/ | 21:30 |
| morganfainberg | ahhh | 21:31 |
| ayoung | atiwari, take a look at my fpaste link above and tell me if it is sane | 21:31 |
| ayoung | If so, I'll merge it into the review request.... | 21:31 |
| atiwari | looking | 21:32 |
| morganfainberg | ayoung, that looks sane to me. | 21:32 |
| *** johnthetubaguy1 has joined #openstack-dev | 21:32 | |
| *** bnemec has joined #openstack-dev | 21:32 | |
| ayoung | morganfainberg, running the full battery of unit tests against that | 21:32 |
| morganfainberg | ayoung, ok. I am fairly certain the one on the provider manager will pass w/o issue | 21:33 |
| morganfainberg | i ran tests locally with that change just a few minutes ago | 21:33 |
| *** cjwilson has quit IRC | 21:33 | |
| morganfainberg | ayoung, cool. i think that'll at least prevent needless admin_token churning in auth_token middleware | 21:33 |
| ayoung | morganfainberg, so...if someone removed the route to /v2.0/tokens/... it will also give a 404 | 21:34 |
| morganfainberg | ayoung, right =/ | 21:34 |
| ayoung | Which means that auth_token middleware will just list all tokens as invalid. Which will then get cached into the memcache and those tokens will never be valid again | 21:34 |
| *** johnthetubaguy has quit IRC | 21:35 | |
| ayoung | We've seen a bug like that in thepast | 21:35 |
| atiwari | ayoung, test looks good | 21:35 |
| *** martine_ has quit IRC | 21:35 | |
| ayoung | atiwari, but the logic is broken. See my previous comment | 21:35 |
| *** johnthetubaguy1 has quit IRC | 21:35 | |
| morganfainberg | ayoung, but this change, i don't think would mitigate that. | 21:35 |
| *** sarob has quit IRC | 21:35 | |
| morganfainberg | ayoung, or not doing this change that is | 21:35 |
| *** sarob has joined #openstack-dev | 21:36 | |
| ayoung | morganfainberg, except that we need to adjust auth_token middleware to whatever we do here...I suggest returning 420 for an invalid token "Enhance your Calm" | 21:36 |
| morganfainberg | ayoung, not that i think changing v2 is a good idea | 21:36 |
| morganfainberg | or 410 | 21:36 |
| *** mlavalle has quit IRC | 21:36 | |
| morganfainberg | hehe, 402 enhan…damn it you made me laugh there | 21:37 |
| ayoung | Yeah, that makes more sense | 21:37 |
| *** bnemec_ has joined #openstack-dev | 21:37 | |
| morganfainberg | 420* | 21:37 |
| ayoung | 451 | 21:37 |
| *** openfly has quit IRC | 21:37 | |
| ayoung | Some one has a real sense of humor there | 21:37 |
| morganfainberg | LOL | 21:37 |
| ayoung | 451 Unavailable For Legal Reasons (Internet draft) | 21:37 |
| ayoung | "I'm Ray Bradbury and I approve this message." | 21:37 |
| *** bnemec has quit IRC | 21:37 | |
| morganfainberg | perhaps making these all 410 would be the best choice? | 21:38 |
| morganfainberg | then there is no confusion about routes. | 21:38 |
| morganfainberg | but keystoneclient also needs an update for that. iirc | 21:38 |
| morganfainberg | ayoung, and what impact to the spec is that. can we .. even do that sanely? | 21:38 |
| ayoung | morganfainberg, leave it as is, and then the right answer is to not use the HTTP return code for this | 21:39 |
| ayoung | it is not a client error | 21:39 |
| morganfainberg | ayoung, ISE! | 21:39 |
| morganfainberg | :P | 21:39 |
| morganfainberg | ok, leave it as is then. | 21:39 |
| morganfainberg | i am convinced. | 21:39 |
| ayoung | morganfainberg, let me see what auth_token middleware does... | 21:40 |
| *** jasdeepH has quit IRC | 21:40 | |
| ayoung | morganfainberg, of course, no one should be using this, as they should be doing PKI tokens anyway | 21:40 |
| morganfainberg | ayoung, ++ | 21:40 |
| morganfainberg | back to the whole, can we deprecate v2 soon? :) | 21:41 |
| morganfainberg | (please) | 21:41 |
| *** adalbas has joined #openstack-dev | 21:41 | |
| *** gordc has quit IRC | 21:41 | |
| morganfainberg | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/middleware/auth_token.py#L1085 | 21:41 |
| ayoung | morganfainberg, OK, lets make it 404 | 21:42 |
| *** nachi has joined #openstack-dev | 21:42 | |
| ayoung | its the least bad of all the options/ | 21:42 |
| ayoung | I'll post my change for review | 21:42 |
| morganfainberg | ayoung, sorry :(. I hate picking least bad | 21:42 |
| ayoung | morganfainberg, nah, its ok...this is a learning process | 21:43 |
| *** adjohn has quit IRC | 21:43 | |
| gyee | reminds me of Wreck It Ralph | 21:43 |
| ayoung | morganfainberg, I need to fix some other tests | 21:43 |
| gyee | we are bad, but thats good | 21:43 |
| morganfainberg | ayoung, ok. | 21:43 |
| morganfainberg | gyee, maybe we should pick breaking bad instead? | 21:43 |
| *** adjohn has joined #openstack-dev | 21:43 | |
| *** portante is now known as portante|afk | 21:44 | |
| morganfainberg | ayoung, yeah hopefully we will have less of these issues in the future (learn from our past) | 21:44 |
| *** dvarga has quit IRC | 21:46 | |
| *** adjohn has quit IRC | 21:47 | |
| *** yaguang has quit IRC | 21:48 | |
| *** adjohn has joined #openstack-dev | 21:48 | |
| *** adjohn has quit IRC | 21:48 | |
| *** markwash has joined #openstack-dev | 21:49 | |
| ayoung | gyee, soo, with the recent change to policy, the config option is in openstack.common...which means it gets bypassed from the tests. If I import it, I get a pep8 error. I think the right answer is to import it in tests/core.py with a #noqa | 21:50 |
| *** neelashah has joined #openstack-dev | 21:50 | |
| gyee | ayoung, yes | 21:50 |
| ayoung | atiwari, tests are looking good. I will post a new version of the patch as soon as my run completes | 21:50 |
| *** thomasm has quit IRC | 21:51 | |
| *** carl_baldwin has left #openstack-dev | 21:51 | |
| *** maheshp has joined #openstack-dev | 21:51 | |
| *** jecarey has quit IRC | 21:52 | |
| morganfainberg | bknudson, i'm chasing that version down now. | 21:52 |
| *** rnirmal has joined #openstack-dev | 21:54 | |
| ayoung | gyee, morazi atiwari https://review.openstack.org/#/c/46123/19 | 21:55 |
| *** alunduil has joined #openstack-dev | 21:56 | |
| ayoung | ok, I'm in family mode...I'll check back in before bed | 21:57 |
| morganfainberg | ayoung, see ya. | 21:57 |
| *** sarob has quit IRC | 21:58 | |
| *** sarob has joined #openstack-dev | 21:58 | |
| *** dolphm has joined #openstack-dev | 21:59 | |
| *** eglynn has quit IRC | 22:00 | |
| atiwari | ayoung, sure | 22:00 |
| *** jbresnah has quit IRC | 22:01 | |
| *** egallen has joined #openstack-dev | 22:01 | |
| *** donaldh has quit IRC | 22:01 | |
| *** dubsquared has quit IRC | 22:01 | |
| *** egallen has quit IRC | 22:02 | |
| gyee | dolphm, https://review.openstack.org/#/c/46123/ | 22:04 |
| dolphm | gyee: already looking | 22:04 |
| gyee | not sure if you catch the discussion, its now returning 404 on token validation error | 22:04 |
| *** jbresnah has joined #openstack-dev | 22:05 | |
| *** burt has quit IRC | 22:05 | |
| *** briancurtin has quit IRC | 22:05 | |
| *** kbringard has quit IRC | 22:05 | |
| *** egallen has joined #openstack-dev | 22:05 | |
| morganfainberg | dolphm, i'll pull out the try/except in the provider manager in a subsequent patch (posting shortly) dependant on this token one | 22:05 |
| morganfainberg | as you requested | 22:06 |
| dolphm | morganfainberg: is it complicated? | 22:06 |
| morganfainberg | dolphm, nope, it's just removing the try/except | 22:06 |
| morganfainberg | 4 lines of change. | 22:06 |
| morganfainberg | maybe | 22:06 |
| morganfainberg | no test changes. | 22:06 |
| *** rnirmal has quit IRC | 22:06 | |
| morganfainberg | erm, take that back, eliminating a useless test then | 22:06 |
| *** rnirmal has joined #openstack-dev | 22:07 | |
| dolphm | ayoung: undo the string freeze violation :-/ | 22:07 |
| morganfainberg | it could wait for icehouse if you want. wont really change anything significant | 22:07 |
| morganfainberg | dolphm, i'll fix that in a sec. | 22:08 |
| morganfainberg | if thats the only issue, i'll have a new patch up in a couple minutes. | 22:08 |
| *** mfer has joined #openstack-dev | 22:08 | |
| dolphm | morganfainberg: thanks | 22:09 |
| dolphm | morganfainberg: make sure you don't rebase the underlying patch! | 22:10 |
| morganfainberg | dolphm, git review --no-rebase? | 22:10 |
| morganfainberg | *checks* | 22:10 |
| *** romcheg has quit IRC | 22:10 | |
| dolphm | morganfainberg: ++ | 22:10 |
| dolphm | morganfainberg: i do git push gerrit HEAD:refs/for/master when i'm super paranoid | 22:11 |
| *** jmontemayor has quit IRC | 22:11 | |
| morganfainberg | dolphm, sold. | 22:11 |
| *** changbl has quit IRC | 22:11 | |
| atiwari | dolphm, ayoung , morganfainberg I am proposing one BP https://blueprints.launchpad.net/keystone/+spec/attribute-access-privilege-based-on-role, please take a look whenever time permits. wondering if it is a right candidate for oslo | 22:12 |
| *** neelashah has quit IRC | 22:12 | |
| morganfainberg | dolphm, posted | 22:13 |
| morganfainberg | dolphm, https://bugs.launchpad.net/keystone/+bug/1231709 this should prob. be RC1 | 22:14 |
| uvirtbot | Launchpad bug 1231709 in keystone "oauth controller calls are not protected" [Undecided,In progress] | 22:14 |
| *** egallen has quit IRC | 22:15 | |
| *** stevemar has quit IRC | 22:15 | |
| *** vipul is now known as vipul-away | 22:16 | |
| *** dvarga has joined #openstack-dev | 22:17 | |
| dolphm | morganfainberg: eek | 22:17 |
| morganfainberg | dolphm, yeah. | 22:17 |
| gyee | wow | 22:18 |
| *** epim has joined #openstack-dev | 22:18 | |
| dolphm | morganfainberg: done and done | 22:18 |
| *** jbresnah has quit IRC | 22:18 | |
| morganfainberg | dolphm, thankfulle we already have a review for it | 22:18 |
| dolphm | morganfainberg: lol ++ | 22:19 |
| dolphm | thank you steve, wherever you are | 22:19 |
| morganfainberg | dolphm, hehe | 22:19 |
| ayoung | dolphm, +2, but lets get at least one more set of eyes on it...this close to deadline | 22:20 |
| ayoung | dolphm, why the change in routers? | 22:20 |
| atiwari | wondering if https://review.openstack.org/#/c/46123/21/keystone/token/provider.py has indention issue | 22:20 |
| ayoung | was it just busted before? | 22:20 |
| *** vipul-away is now known as vipul | 22:21 | |
| morganfainberg | ayoung, looks like it | 22:21 |
| morganfainberg | oh | 22:21 |
| morganfainberg | no | 22:21 |
| *** maheshp has quit IRC | 22:21 | |
| morganfainberg | he changed the name of the method. from "authorize" to "authorize_request_token" probably to make the policy.json less confusing | 22:22 |
| dolphm | ayoung: i appreciated that just because it was less ambiguous in policy.json ^ what morgan said | 22:22 |
| ayoung | conflicted with a different policy rule, but I wonder if this breaks unit test s...it should | 22:22 |
| *** shel3over has left #openstack-dev | 22:22 | |
| morganfainberg | ayoung, if it's resftule test case, no. | 22:22 |
| morganfainberg | ayoung, since that is gated through the controller. right? | 22:22 |
| *** mfer has quit IRC | 22:23 | |
| ayoung | ah...right, didn't change the url...OK. looks good, and I understand it... | 22:23 |
| morganfainberg | atiwari, indentation issue? | 22:23 |
| ayoung | dolphm, In icehouse, we force every call to go through policy, and put in a specific policy rule to let things through unauthenticated | 22:24 |
| morganfainberg | ayoung, ooh, i think i like that | 22:24 |
| dolphm | ayoung: just an trivially true rule? | 22:25 |
| boris-42 | ttx hi | 22:25 |
| *** dvarga has quit IRC | 22:25 | |
| atiwari | morganfainberg, added comment in https://review.openstack.org/#/c/46123/ | 22:26 |
| *** sarob has quit IRC | 22:26 | |
| *** maheshp has joined #openstack-dev | 22:27 | |
| *** READ10 has quit IRC | 22:27 | |
| morganfainberg | atiwari, responded. but i'll say as much here too, that is the catch-all | 22:27 |
| *** danwent has quit IRC | 22:28 | |
| morganfainberg | a few lines up if the token is valid, we return None | 22:28 |
| *** twoputt has quit IRC | 22:28 | |
| morganfainberg | the method likely should be renamed _assert_token_valid | 22:28 |
| morganfainberg | atiwari, but the indent is correct in that case. | 22:28 |
| *** MaxV has quit IRC | 22:28 | |
| *** gmurphy has joined #openstack-dev | 22:29 | |
| atiwari | ok | 22:30 |
| *** jbresnah has joined #openstack-dev | 22:30 | |
| morganfainberg | atiwari, i can totally see why that looks wrong though. | 22:30 |
| morganfainberg | ayoung, hmm. i forgot to add the icehouse cleanup BP. Now i need to remember what was supposed to go into it. darn it. | 22:30 |
| atiwari | morganfainberg, raising an exception in normal flow does not looks cool in _is_valid_token :) | 22:33 |
| ayoung | dolphm, yeah, there is a a rule for that already. | 22:33 |
| *** jbresnah has quit IRC | 22:34 | |
| ayoung | TruCheck | 22:34 |
| ayoung | https://github.com/openstack/oslo-incubator/blob/master/openstack/common/policy.py#L318 | 22:34 |
| *** sarob has joined #openstack-dev | 22:34 | |
| *** bswartz has joined #openstack-dev | 22:35 | |
| *** colinmcnamara has quit IRC | 22:35 | |
| *** dolphm has quit IRC | 22:36 | |
| ayoung | atiwari, I'll pull the trigger if you say it is OK | 22:36 |
| atiwari | ayoung, I am ok | 22:37 |
| ayoung | going once | 22:38 |
| morganfainberg | ayoung, wait for jenkins? | 22:38 |
| *** SergeyLukjanov has quit IRC | 22:38 | |
| *** FunnyLookinHat has quit IRC | 22:38 | |
| ayoung | morganfainberg, sure. | 22:38 |
| morganfainberg | ayoung, i don't mind if we jump it, but check queue is pretty backed up | 22:39 |
| *** rcleere has quit IRC | 22:39 | |
| *** sarob has quit IRC | 22:39 | |
| ayoung | yeah...I hav to head out. I'll check back in a few hours | 22:39 |
| morganfainberg | ayoung, but i thought we were supposed to wait (why a question) | 22:39 |
| *** bknudson has left #openstack-dev | 22:39 | |
| morganfainberg | ayoung, sounds good. if it clears check, i'll push go (if you don't get to it first) | 22:40 |
| morganfainberg | or it doesn't take until i need to go home . | 22:40 |
| *** jhesketh has joined #openstack-dev | 22:41 | |
| *** maheshp has quit IRC | 22:42 | |
| *** jhesketh has quit IRC | 22:42 | |
| *** jhesketh has joined #openstack-dev | 22:43 | |
| *** sarob has joined #openstack-dev | 22:43 | |
| *** prad_ has quit IRC | 22:43 | |
| *** jhesketh has quit IRC | 22:44 | |
| *** cjwilson has joined #openstack-dev | 22:45 | |
| *** egallen has joined #openstack-dev | 22:45 | |
| *** dolphm has joined #openstack-dev | 22:45 | |
| *** egallen has quit IRC | 22:47 | |
| *** sarob has quit IRC | 22:47 | |
| *** sarob has joined #openstack-dev | 22:48 | |
| *** galstrom is now known as galstrom_zzz | 22:49 | |
| *** ericw has joined #openstack-dev | 22:50 | |
| dolphm | boris-42: he's probably asleep | 22:50 |
| boris-42 | dolphm sure=) | 22:50 |
| boris-42 | dolphm but sometimes he doesn't sleep=) | 22:50 |
| dolphm | boris-42: he's just a bot | 22:51 |
| *** egallen has joined #openstack-dev | 22:51 | |
| boris-42 | hehe=) | 22:52 |
| *** sarob has quit IRC | 22:54 | |
| *** kbrierly has quit IRC | 22:54 | |
| *** dolphm has quit IRC | 22:56 | |
| *** atiwari has quit IRC | 22:57 | |
| *** epim has quit IRC | 22:59 | |
| *** boris-42 has quit IRC | 23:00 | |
| *** danwent has joined #openstack-dev | 23:00 | |
| *** egallen has quit IRC | 23:03 | |
| *** datsun180b has quit IRC | 23:04 | |
| *** sarob has joined #openstack-dev | 23:04 | |
| *** terriyu has quit IRC | 23:05 | |
| *** sarob has quit IRC | 23:05 | |
| *** sarob_ has joined #openstack-dev | 23:05 | |
| *** tmclaugh[work] has quit IRC | 23:06 | |
| *** jbresnah has joined #openstack-dev | 23:06 | |
| *** dtyarnell has joined #openstack-dev | 23:06 | |
| *** sarob has joined #openstack-dev | 23:07 | |
| *** sarob_ has quit IRC | 23:10 | |
| *** nermina has quit IRC | 23:12 | |
| *** jbresnah has quit IRC | 23:13 | |
| *** jbresnah has joined #openstack-dev | 23:15 | |
| *** twoputt has joined #openstack-dev | 23:16 | |
| *** dvarga has joined #openstack-dev | 23:21 | |
| *** sarob has quit IRC | 23:23 | |
| *** nati_ueno has quit IRC | 23:23 | |
| *** epim has joined #openstack-dev | 23:25 | |
| *** dvarga has quit IRC | 23:26 | |
| *** jayg is now known as jayg|g0n3 | 23:30 | |
| *** fifieldt has joined #openstack-dev | 23:31 | |
| *** utlemming has quit IRC | 23:31 | |
| *** changbl has joined #openstack-dev | 23:31 | |
| *** utlemming has joined #openstack-dev | 23:33 | |
| *** jbresnah has quit IRC | 23:35 | |
| *** openfly has joined #openstack-dev | 23:36 | |
| *** networkstatic has joined #openstack-dev | 23:38 | |
| *** nachi has left #openstack-dev | 23:40 | |
| *** epim has quit IRC | 23:43 | |
| *** sarob has joined #openstack-dev | 23:43 | |
| *** thomasm has joined #openstack-dev | 23:47 | |
| *** guest3 has joined #openstack-dev | 23:52 | |
| *** otherwiseguy has quit IRC | 23:52 | |
| *** dims has quit IRC | 23:53 | |
| *** rnirmal_ has joined #openstack-dev | 23:54 | |
| *** erivera has joined #openstack-dev | 23:55 | |
| *** rnirmal has quit IRC | 23:55 | |
| *** rnirmal_ is now known as rnirmal | 23:55 | |
| *** sarob_ has joined #openstack-dev | 23:58 | |
| *** guest3 has left #openstack-dev | 23:58 | |
| *** guest3 has joined #openstack-dev | 23:58 | |
| *** nati_ueno has joined #openstack-dev | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!