| jamielennox | morganfainberg: ah, there's no way i'm cool enough for something like that | 00:00 |
|---|---|---|
| morganfainberg | jamielennox, neither am I, thats why I'm not in that channel | 00:01 |
| nkinder | openstack-keystone-badcrowd? :) | 00:12 |
| *** david_lyle has quit IRC | 00:20 | |
| bknudson | how do I generate sample config | 00:28 |
| bknudson | ? | 00:28 |
| *** browne has joined #openstack-keystone | 00:35 | |
| bknudson | never mind, figured it out | 00:35 |
| morganfainberg | bknudson, yeah. maybe we need some docs for that before that merges | 00:38 |
| morganfainberg | bknudson, do you want me to remove the () around all the help strings? i seem ot have added it a lot of places | 00:39 |
| bknudson | morganfainberg: it's not consistently done | 00:39 |
| morganfainberg | bknudson, it should be consistent, any string that was spanning mulitple lines should have it | 00:40 |
| bknudson | morganfainberg: if you'd done it on every multi-line help text I'd say don't change it since it's consistent but it's not. | 00:40 |
| morganfainberg | bknudson, but i'm fine pulling it out of config.py | 00:40 |
| morganfainberg | bknudson, the warnings are expected until we get helpstrings for everything | 00:40 |
| bknudson | seems like we should have help strings for everything. | 00:41 |
| morganfainberg | bknudson, ++ we should | 00:41 |
| morganfainberg | bknudson, some of them, I'm not sure what to write :) | 00:41 |
| bknudson | morganfainberg: just put a ? or a ;) | 00:42 |
| morganfainberg | bknudson, "Good luck figuring out what this does" | 00:42 |
| morganfainberg | interestingly, looks like we lost some helpstrings in the sample config =/ | 00:43 |
| morganfainberg | actually... lost all of them in the last patchset | 00:43 |
| morganfainberg | somehow. | 00:43 |
| bknudson | morganfainberg: I didn't look closely, just ran the generator and the files were different | 00:44 |
| morganfainberg | bknudson, yeah something wonky is going on | 00:44 |
| bknudson | might depend on whatever oslo.config you have installed locally | 00:44 |
| morganfainberg | maybe. | 00:44 |
| morganfainberg | but a previous version worked as expected | 00:44 |
| morganfainberg | *grumble* | 00:44 |
| bknudson | this is where we need instructions | 00:44 |
| morganfainberg | bknudson, yeah, sounds good | 00:45 |
| morganfainberg | well... there is the README:P | 00:45 |
| bknudson | don't I just run "./tools/config/generate_sample.sh" ? | 00:46 |
| *** browne has quit IRC | 00:54 | |
| *** gokrokve has quit IRC | 01:00 | |
| *** stevemar has quit IRC | 01:00 | |
| *** gokrokve has joined #openstack-keystone | 01:00 | |
| *** stevemar has joined #openstack-keystone | 01:00 | |
| *** ChanServ sets mode: +v stevemar | 01:00 | |
| *** gokrokve has quit IRC | 01:03 | |
| morganfainberg | bknudson, that should be it | 01:05 |
| morganfainberg | bknudson, but i think there must be a bug somehow | 01:05 |
| morganfainberg | bknudson, let me chase this down | 01:05 |
| *** gokrokve has joined #openstack-keystone | 01:05 | |
| bknudson | morganfainberg: the README doesn't say "just run ./tools/config/generate_sample.sh" | 01:08 |
| morganfainberg | bknudson, but when the pep8 fails, it tells you to run it just like that | 01:10 |
| morganfainberg | bknudson, there is something else going on, because before it "just worked" when i ran " ./tools/config/generate_sample.sh" | 01:10 |
| bknudson | morganfainberg: that doesn't work for you? | 01:10 |
| bknudson | I think it worked for me. | 01:11 |
| morganfainberg | bknudson, are the keystone options in there or just the oslo options | 01:11 |
| morganfainberg | bknudson, look for [cache] | 01:11 |
| morganfainberg | bknudson, and see if the helpstrings are in the sample | 01:11 |
| morganfainberg | i just had an issue where that didn't work | 01:11 |
| bknudson | morganfainberg: doesn't find it... also, not much help text. | 01:12 |
| morganfainberg | bknudson, yep, something is going on | 01:12 |
| bknudson | oh, I'm on master. | 01:12 |
| morganfainberg | bknudson, oh vs. on the changeset? | 01:12 |
| bknudson | morganfainberg: now it looks good. | 01:13 |
| bknudson | when I've got 72808 checked out | 01:13 |
| morganfainberg | hmmm | 01:13 |
| bknudson | [cache] is there. | 01:14 |
| morganfainberg | mine keeps running w/o cache being there | 01:14 |
| morganfainberg | bknudson, ... hmm. do you install keystone in your environment? (develop or whatever)? | 01:17 |
| *** dstanek has quit IRC | 01:17 | |
| bknudson | morganfainberg: I ran devstack a year ago and keep running it... who knows what it does. | 01:17 |
| morganfainberg | bknudson, hmm... | 01:17 |
| morganfainberg | bknudson, i think my issue is that keystone isn't installed so it's not doing the right thing trying to find the options | 01:18 |
| bknudson | morganfainberg: does devstack run on your system? | 01:18 |
| morganfainberg | bknudson, i don't run devstack in most VMs i run unit tests in | 01:18 |
| morganfainberg | bknudson, i usually have specific devstack VMs | 01:18 |
| *** gokrokve has quit IRC | 01:18 | |
| *** gokrokve has joined #openstack-keystone | 01:19 | |
| *** hxgqh1987 has joined #openstack-keystone | 01:21 | |
| *** gokrokve has quit IRC | 01:23 | |
| *** marcoemorais has quit IRC | 01:43 | |
| *** dstanek has joined #openstack-keystone | 01:44 | |
| *** ChanServ sets mode: +v dstanek | 01:44 | |
| *** richm has quit IRC | 01:45 | |
| *** dolphm_503 is now known as dolphm | 01:45 | |
| dolphm | bknudson: you've been on a single devstack install for a year? | 01:46 |
| morganfainberg | bknudson, ok it def. looks like it is because "./" isn't in sys.path | 01:46 |
| morganfainberg | in my environment | 01:46 |
| morganfainberg | when running the generate thing | 01:46 |
| morganfainberg | stevemar, look! dolphm service is available again | 01:47 |
| * dolphm runs | 01:47 | |
| bknudson | dolphm: essentially since I started working on this. | 01:47 |
| stevemar | get him! | 01:47 |
| dolphm | i guess my away nick worked | 01:47 |
| morganfainberg | dolphm, naH, stevemar tried to reboot you | 01:47 |
| *** dstanek has quit IRC | 01:48 | |
| stevemar | henrynashs stuff got merged | 01:48 |
| stevemar | weee | 01:48 |
| dolphm | morganfainberg: going to check the eavesdrop logs | 01:49 |
| dolphm | stevemar: YAY | 01:49 |
| morganfainberg | dolphm, hehe | 01:49 |
| dolphm | morganfainberg: aww, eavesdrop started too late | 01:50 |
| morganfainberg | dolphm, yeah | 01:50 |
| *** dstanek has joined #openstack-keystone | 02:01 | |
| *** ChanServ sets mode: +v dstanek | 02:01 | |
| stevemar | dolphm, | 02:07 |
| stevemar | oops | 02:07 |
| dolphm | stevemar, | 02:07 |
| stevemar | for normal token rescoping, you use the unscoped token in the X-Auth-Token header right? | 02:08 |
| stevemar | it should be the same in our case | 02:08 |
| morganfainberg | bknudson, oh the way this is being done it _HAS_ to have keystone installed | 02:10 |
| morganfainberg | bknudson, how stevedore works | 02:10 |
| dolphm | stevemar: yes | 02:10 |
| morganfainberg | ugh | 02:10 |
| bknudson | morganfainberg: what does it mean to be installed? | 02:10 |
| morganfainberg | bknudson, pip, setup, whatever | 02:10 |
| bknudson | devstack probably does it | 02:11 |
| morganfainberg | bknudson, it relies on information that comes from the setup.py process | 02:11 |
| morganfainberg | bknudson, if we're ok with that limitation, i can doc it up | 02:11 |
| bknudson | morganfainberg: everybody else seems to be | 02:11 |
| morganfainberg | bknudson, if we want it to "just work".. it'll take a bit more | 02:11 |
| morganfainberg | bknudson, nah, we do things differently because we don't register configs on import | 02:11 |
| stevemar | dolphm, marek is doing something funny with it at the moment, look at line 1087 of: https://review.openstack.org/#/c/71353/28/keystone/tests/test_v3_federation.py | 02:12 |
| stevemar | he's putting the unscoped token in a random "id" field | 02:12 |
| dolphm | wasn't that supposed to be IdP or something? | 02:13 |
| stevemar | dolphm, yes | 02:14 |
| stevemar | he does that for the unscoped token | 02:14 |
| dolphm | does any of this new approach work with mod_shib / mod_mellon? | 02:14 |
| bknudson | stevemar: if you upload a new patch set -- please set "basing" to "based" in the commit message | 02:14 |
| stevemar | bknudson, will do | 02:15 |
| bknudson | I'm tired of seeing that bad grammar in my inbox | 02:15 |
| dstanek | bknudson: :-) | 02:15 |
| stevemar | bknudson, took me a second to realize what you were talking about... I usually just look for 'generate' | 02:15 |
| stevemar | bknudson, but yes, i will fix it | 02:15 |
| ayoung | nkinder, I'm about to resubmit remember-the-dn with pep8 fixed | 02:15 |
| dolphm | and what's with the obsessively building kwargs dictionaries before immediately passing them into a function call as **kwargs? did i miss a mailing list thread or something? that makes no sense to me | 02:16 |
| morganfainberg | bknudson, yep, requires entry points, which wont be populated w/o setup process *grumble* and the generator is... sub-optimal to be used like we do outside of entry points | 02:17 |
| dolphm | stevemar: did the group change get squashed again? | 02:17 |
| dolphm | or something? | 02:18 |
| stevemar | dolphm, I don't know what you mean? | 02:18 |
| dolphm | do they not need to merge in order..? | 02:18 |
| stevemar | no, they dont | 02:18 |
| dolphm | oh ok | 02:18 |
| stevemar | dolphm, in the tests we know the group ids, right | 02:18 |
| stevemar | so it could be broken off, cleanly | 02:19 |
| morganfainberg | dolphm, https://review.openstack.org/#/c/74598/2/cinderclient/service_catalog.py this seems like copy/paste of keystoneclient... am i missing something as to why they aren't doing from keystoneclient import service_catalog? | 02:19 |
| jamielennox | morganfainberg: yea, we know | 02:20 |
| jamielennox | morganfainberg: although apparently it was subtly tweaked that you just can't import it now | 02:20 |
| morganfainberg | jamielennox, ... | 02:20 |
| nkinder | ayoung: sigh... I should have caught that. | 02:20 |
| morganfainberg | jamielennox, so instead of fixing that issue, copy/paste is the answer? | 02:20 |
| nkinder | ayoung: I'll fix it and resubmit | 02:20 |
| ayoung | nkinder, nope | 02:20 |
| ayoung | I got it | 02:20 |
| ayoung | just running the tests now | 02:20 |
| jamielennox | morganfainberg: i have no answer for you here... | 02:21 |
| morganfainberg | jamielennox, i feel like ... i don't get it | 02:21 |
| ayoung | nkinder, what did you do differently? I had trouble doing a side by side diff with my earlier patch | 02:21 |
| nkinder | ayoung: I fixed up groups | 02:21 |
| nkinder | ayoung: you only focused on users | 02:21 |
| ayoung | cool | 02:21 |
| *** gokrokve has joined #openstack-keystone | 02:22 | |
| ayoung | good extension, and we can deal with assignments after we hear back from Cern...which we might have already, but I have 800+ messages still to plough through | 02:22 |
| morganfainberg | jamielennox, -1'd it with that question | 02:22 |
| morganfainberg | jamielennox, i guess we'll see what the answer is | 02:22 |
| jamielennox | there was a review? | 02:22 |
| morganfainberg | https://review.openstack.org/#/c/74598/ | 02:22 |
| stevemar | dolphm, lol'ed at your kwargs remark | 02:23 |
| nkinder | ayoung: I also cleaned up a few things with where you had the filter_user() method | 02:23 |
| ayoung | like what? | 02:23 |
| jamielennox | morganfainberg: jeez | 02:23 |
| dolphm | stevemar: i feel like i'm picking on him, but i've seen it several times recently -- the scale there was intense though | 02:23 |
| morganfainberg | jamielennox, yeah.. this is like round 2 of "WTF?" | 02:23 |
| jamielennox | morganfainberg: i put a -1 on something very like this not long ago | 02:23 |
| *** gokrokve_ has joined #openstack-keystone | 02:23 | |
| morganfainberg | jamielennox, yeah | 02:23 |
| stevemar | dolphm, s'all good | 02:24 |
| nkinder | ayoung: well, you defined it outside of any class | 02:24 |
| morganfainberg | jamielennox, just pingd' john and mike perez about that and the -1 i added | 02:25 |
| jamielennox | morganfainberg: cool | 02:25 |
| morganfainberg | jamielennox, wouldn't hurt if you -1'd as well ;) if you are so inclined | 02:25 |
| jamielennox | morganfainberg: was it cinder we recently stopped this on as well | 02:25 |
| ayoung | morganfainberg, jamielennox I dogpiled on that rabbit | 02:25 |
| morganfainberg | jamielennox, yeah where they implemented their own and we told them to use keystoneclient impl | 02:25 |
| nkinder | ayoung: I instead added methods to the UserApi class (get_filtered and filter_attributes) | 02:26 |
| morganfainberg | well i guess they are using keystoneclient's impl now.. *boggle* | 02:26 |
| nkinder | ayoung: I did the same for groups in a consistent way. | 02:26 |
| *** gokrokv__ has joined #openstack-keystone | 02:27 | |
| jamielennox | morganfainberg: lol - but not | 02:27 |
| morganfainberg | jamielennox, right | 02:27 |
| jamielennox | morganfainberg: can we coin col for crying? | 02:27 |
| ayoung | OK. looking. I reposted the reivew. I convertedold_obj to old tin order to shorten the line for pep8. I flipping hate Python line wrap rules | 02:27 |
| morganfainberg | jamielennox, HAH | 02:27 |
| *** gokrokve has quit IRC | 02:27 | |
| *** gokrokve_ has quit IRC | 02:28 | |
| ayoung | nkinder, was filter_user LDAP specific? I thought it made sense to be in identity and usable by the other backends | 02:29 |
| ayoung | nkinder, that might have been because I was using it for assignments as well | 02:30 |
| * ayoung wrote this so long ago slash me forgot | 02:30 | |
| ayoung | so we still have filter_user, but we also have filter_attributes? nkinder does that make sense? I guess so, since we need to filter the DN out of all of the objects, and filter_user originally had a different purpose | 02:32 |
| *** lbragstad has joined #openstack-keystone | 02:33 | |
| *** david-lyle has joined #openstack-keystone | 02:35 | |
| stevemar | dolphm if a protocol is deleted, then we delete any tokens with OS-FEDERATION... but not for protocol or mapping right.. ? | 02:35 |
| stevemar | dolphm, also, what's to stop chaining tokens? would the user have to start with an unscoped token every time? | 02:36 |
| nkinder | ayoung: yes, I left the old filter_user alone since it had another purpose | 02:40 |
| stevemar | dolphm, also, you suggested to rename `list_xxxx_for_groups` to `list_accessible_groups` in the controller side, what about at the SQL backend level? same convention? | 02:40 |
| nkinder | ayoung: ok, I ran pep8 and it all passed, but then I converted old back to old_obj, as I didn't see why you changed it | 02:41 |
| nkinder | ayoung: now I know it was due to pep8 :P | 02:41 |
| *** morganfainberg is now known as morganfainberg_Z | 02:42 | |
| nkinder | ayoung: filter_user was outside of the class to be used by assignment, but I found it wasn't really needed for that (when I had changed assignment as well) | 02:43 |
| ayoung | nkinder, can you submit a follow on patch for assignments? | 02:43 |
| ayoung | lets keep it in the system | 02:44 |
| ayoung | submit it as a WIP or Draft, so long as it is recorded. | 02:47 |
| nkinder | ayoung: ok, but it's completely broken unless I add back in the identity_api stuff that bknudson removed. | 02:53 |
| nkinder | ayoung: I can add that back in for the LDAP assignments driver only, but some of the unit tests will fail (the test_*_no_user ones that bknudson added when he made his changes) | 02:53 |
| nkinder | I'm not sure if there is an easy way to skip those tests only if LDAP assignments are being used. | 02:53 |
| ayoung | nkinder, please add it back in. | 02:53 |
| ayoung | I suspect that it will be necessary for assignments to work in LDAP in general. Just a suspicion | 02:54 |
| nkinder | the tests are defined in test_backend.py | 02:54 |
| ayoung | overload them in the unit tests for LDAP assignments | 02:54 |
| bknudson | nkinder: they only fail on live ldap? | 02:54 |
| nkinder | ayoung: ok, will do. | 02:54 |
| ayoung | nkinder, thanks | 02:55 |
| nkinder | bknudson: any LDAP, but this is only if I add back searching for the users | 02:55 |
| bknudson | nkinder: well, they don't fail with fake ldap ? | 02:55 |
| nkinder | bknudson: your tests pass with fake and live LDAP right now. It's only with my changes to the LDAP assignment backend that cause it to fail (fake or live) | 02:55 |
| bknudson | nkinder: what changes are you making? | 02:56 |
| nkinder | bknudson: my code relies on looking up the users, but your tests want role assignment to work when users don't exist | 02:56 |
| nkinder | bknudson: https://bugs.launchpad.net/keystone/+bug/1230260 | 02:56 |
| uvirtbot | Launchpad bug 1230260 in keystone "Multiple round trips for DNs" [Medium,In progress] | 02:56 |
| ayoung | nkinder, skip tests for that are acceptable...I'll show you where | 02:57 |
| bknudson | nkinder: I thought we wanted it to work that way but I've since been told that users should exist for assignments | 02:57 |
| nkinder | bknudson: the current patch is for identity LDAP only, but I was trying to avoid additional LDAP search ops for users and groups in the LDAP assignment code too. | 02:57 |
| nkinder | ok, for LDAP only? | 02:57 |
| bknudson | nkinder: all the backends should work the same. | 02:57 |
| bknudson | would be pretty confusing for users if it worked differently depending on the backend. | 02:58 |
| nkinder | bknudson: so does your patch need to be reverted in entirety? | 02:58 |
| bknudson | since they don't know what backend is configured | 02:58 |
| bknudson | nkinder: what patch? I've got a lot of patches. | 02:59 |
| ayoung | Did we not split the assignment tests out of identity? | 02:59 |
| * ayoung way too lazy | 02:59 | |
| nkinder | bknudson: https://github.com/openstack/keystone/commit/ab1b0c283bd37b2f547aa087bd722aaa3f973df2 | 02:59 |
| *** hxgqh1987 has quit IRC | 03:00 | |
| ayoung | nkinder, looks like they would just go in LDAPIdentity in test_backend_ldap.py I really need to split assignment tests from Identity tests. THen again, we need to split the tests along functional lines and not along backend lines.... | 03:01 |
| bknudson | nkinder: I guess if we want it to work the way that it did before then the easiest would be to revert that one. | 03:01 |
| ayoung | nah, just skip for the LDAP assign tests | 03:01 |
| *** devlaps has quit IRC | 03:01 | |
| *** morganfainberg_Z is now known as morganfainberg | 03:02 | |
| nkinder | ayoung: It seems to be like we need to determine what the plan is for LDAP assignments in general. | 03:02 |
| nkinder | Is it being deprecated or not? | 03:03 |
| nkinder | If not, should require LDAP identity (I believe the answer is yes for this currently). | 03:04 |
| nkinder | sorry, let me retry that... | 03:04 |
| nkinder | Should LDAP assigments require LDAP identity? | 03:04 |
| nkinder | If so, how does that work for federation? | 03:04 |
| bknudson | nkinder: why does LDAP assignments require LDAP identity? | 03:05 |
| nkinder | I think those answers are needed before we rush into changing LDAP assignments to be different that SQL assignments here (especially since the patch at hand is only an optimization) | 03:06 |
| nkinder | bknudson: I believe ayoung said that it requires LDAP identity | 03:06 |
| dolphm | ayoung: nkinder: from cern, it sounds like ldap assignments can be deprecated for icehouse | 03:06 |
| dolphm | as long as we still support it and allow time to migrate away | 03:06 |
| nkinder | dolphm: if that's the case, I'd rather not bother with optimizing it now | 03:06 |
| dolphm | nkinder: it's never been an optimal solution... as long as it's not worse than havana, i don't think much effort should be put into it | 03:07 |
| nkinder | dolphm: +1, that's my feeling too | 03:07 |
| bknudson | I'm sure there's some optimizations that could be done for ldap if you want to improve it. | 03:08 |
| dolphm | clean separation from identity is most important so that it can be dumped when we're ready | 03:08 |
| bknudson | connection pooling | 03:08 |
| nkinder | keep it working, but don't expend any extra effort | 03:08 |
| dolphm | bknudson: those would apply equally to identity though | 03:08 |
| dolphm | bknudson: so, ++ | 03:08 |
| nkinder | bknudson: I have other LDAP nitpicks first... | 03:08 |
| nkinder | For one, the DN comparison code is fragile | 03:08 |
| bknudson | properly handling attribute names | 03:08 |
| dolphm | i'd still like to see first class support for AD next to LDAP | 03:08 |
| nkinder | We're just comparing DNs as strings, but we need to be syntax aware | 03:09 |
| bknudson | we'll just query the ldap server to get the schema. | 03:09 |
| nkinder | no, it's not a schema issue | 03:09 |
| nkinder | the DN syntax is quite complex | 03:09 |
| nkinder | When you compare DN's, you can't just do a string comparison to see if they are equal | 03:10 |
| bknudson | how do you know if the attribute is compared case-sensitive without the schema? | 03:10 |
| dolphm | we also had an interesting suggestion to have a templated ldap driver, that loaded templated queries from disk (deployer configurable), and just used those as-is | 03:10 |
| nkinder | this isn't case sensitivity | 03:10 |
| nkinder | characters can be supplied as hex escapes for example | 03:10 |
| nkinder | See RFC 4517 if you're curious. DNs are quite complex and have many different forms that represent the same exact DN | 03:11 |
| nkinder | There is some good DN comparison code in FreeIPA that a co-worker is going to try to get into python-ldap. | 03:11 |
| nkinder | If we can get it there, we can then leverage it in Keystone. | 03:11 |
| lbragstad | dolphm: fix for the olso messaging stuff is here: https://review.openstack.org/#/c/74804/ | 03:12 |
| lbragstad | FYI | 03:12 |
| ayoung | dolphm, why is it that you don't want endpoints to know about their IDs, and instead to user URLs? | 03:12 |
| dolphm | ayoung: i put the reasoning i have in the blueprint -- i'm not suggesting one solution in particular, i just wanted to enumerate the options | 03:13 |
| bknudson | we also need to know the oids for the attribute names in case someone uses that instead. | 03:13 |
| dolphm | lbragstad: looking | 03:14 |
| ayoung | dolphm, right..I guess waht I was really asking was do you have a strong preference on it | 03:14 |
| ayoung | I can see the restart issue | 03:14 |
| nkinder | bknudson: yep, that's another quick (though not common) | 03:14 |
| nkinder | bknudson: it's usually the escape codes and case, but there are other corner cases like attribute names vs. OID and the RDN order of a DN with multiple RDNs | 03:15 |
| lbragstad | dolphm: so that *should* take care of the log_handler stuff.. added an extra test case from bnemec too so that's a plus | 03:15 |
| ayoung | but...I've been talking with the #moc folks, and they have an interesting architecture. THey are proposing that multiple endpoints for a given service be deployed, each from a different...Provider? Company? THe idea is that each would offer some quality of service, and then when you were buying into a cloud, you would select the service endpoints that met your need. THe thing is, if you do that, you have the endpoints r | 03:17 |
| ayoung | egistering themselves, and I was wondering if using the URL provided a possbility for a security issue, either intentionally or through misconfiguration | 03:17 |
| bknudson | I think clients usually have a mini-schema that has the standard attributes that commonly occur in DNs. | 03:17 |
| bknudson | better off not trying to do DN comparisons... leave that to the server | 03:17 |
| lbragstad | checking latest o-i and I'm not seeing any import log_handler statements. | 03:17 |
| lbragstad | so, once that is in o-m we should be able to just rip out the notifier/rpc/log_handler modules from o-i, I think? and then do the Keystone sync... I guess thats another part I have a question on. If we are removing things from openstack.common code in keystone, does it have to be a sync from o-i? I've never handled that case. | 03:19 |
| jamielennox | morganfainberg: do we approve of openstack.common.cache/ | 03:37 |
| ayoung | do we have a tox cheat-sheet somewhere? | 03:42 |
| morganfainberg | jamielennox, the current incarnation that is merged? no | 03:57 |
| morganfainberg | jamielennox, working with dhellmann, dims, and flapper87 to get a dogpile one setup | 03:58 |
| jamielennox | morganfainberg: yea, i looked through it a bit and realized how limited it was | 03:58 |
| morganfainberg | jamielennox, https://review.openstack.org/#/c/72291/ | 03:58 |
| morganfainberg | i need to fire a ML thread up about it. | 03:58 |
| jamielennox | morganfainberg: i was hoping i could use it to cleanup memcache access in auth_token | 03:59 |
| jamielennox | i remember you were working on something | 04:00 |
| jamielennox | that's alright | 04:00 |
| morganfainberg | jamielennox, i am working on it... just slow... yanno | 04:00 |
| jamielennox | morganfainberg: i get it | 04:00 |
| *** chandan_kumar has joined #openstack-keystone | 04:20 | |
| *** Kanagaraj has joined #openstack-keystone | 04:30 | |
| *** chandan_kumar has quit IRC | 04:37 | |
| ayoung | is there a spreadsheet equivalent to Etherpad? | 04:47 |
| ayoung | assignment tables have been rationalized. Henrynash has earned his beer | 04:52 |
| ayoung | morganfainberg, non-expiring keys merged w00t | 04:54 |
| morganfainberg | ayoung, yep | 04:54 |
| morganfainberg | ayoung, and iirc memache was on it's way | 04:54 |
| ayoung | schweeet! | 04:54 |
| morganfainberg | ayoung, yep, kvs tokens are fully converted to dogpile | 04:55 |
| morganfainberg | *phew* | 04:55 |
| ayoung | morganfainberg, will we have cassandra as an option this release, or just mongo and memcache? | 04:55 |
| * ayoung greedy bastid | 04:55 | |
| morganfainberg | ayoung, likely mongo, memcached, redis, and in-memory | 04:55 |
| ayoung | morganfainberg, that is Single-Malt-Scotch worthy | 04:56 |
| morganfainberg | ayoung, no one has worked on cassandra and it missed the FPF | 04:56 |
| morganfainberg | ayoung, but i am confident mongo will merge. | 04:56 |
| ayoung | cassandra should be easy enough now | 04:56 |
| ayoung | low hanging fruit for Juno | 04:57 |
| morganfainberg | ayoung, yep! | 05:00 |
| ayoung | morganfainberg, doc failure...how do I test that? tox -edocs? | 05:00 |
| morganfainberg | ayoung, wasn't sphinx something? | 05:00 |
| ayoung | morganfainberg, I installed that by hand | 05:00 |
| ayoung | enable venv and pip install | 05:01 |
| morganfainberg | tox -edocs maybe? | 05:01 |
| morganfainberg | yeah -edocs looks right based on tox.ini | 05:01 |
| morganfainberg | ayoung, so my evening went from good to extremely good | 05:01 |
| morganfainberg | ayoung, code merging, things coming together for icehouse, and.. feeling like life is getting in order. | 05:02 |
| ayoung | You keep your personal life out of this channel, thank you very much | 05:02 |
| ayoung | oh...boring.... | 05:02 |
| morganfainberg | ayoung, haha | 05:02 |
| ayoung | sphinx.errors.SphinxWarning: /opt/stack/keystone/keystone/contrib/revoke/core.py:docstring of keystone.contrib.revoke.core.Manager.check_token:5: ERROR: Unexpected indentation. | 05:02 |
| ayoung | acha! | 05:02 |
| morganfainberg | ayoung, beat you to the keeping personal life out of the channel! | 05:02 |
| morganfainberg | ayoung, ha! | 05:02 |
| morganfainberg | ah that error looks... pretty descriptive | 05:02 |
| morganfainberg | i think i have 1 or two small cleanup kvs patches (more testing) to add | 05:03 |
| morganfainberg | ayoung, but thats super easy | 05:03 |
| ayoung | I might need some KVS smarts on the events | 05:03 |
| morganfainberg | ayoung, sure thing. actually i want to layer in caching too | 05:03 |
| ayoung | can you tag the patch with how to implement? All events will be going into one page for now.... | 05:04 |
| ayoung | caching can come in Juno | 05:04 |
| morganfainberg | sure, i'll toss a patch for KVS stuff up... prob tomorrow | 05:04 |
| ayoung | but backend should take advantage of what you've done, and I really couldn't do that yet until your other patches merged without rebase hell | 05:04 |
| morganfainberg | ayoung, ++ totally | 05:04 |
| ayoung | thanks. I'm going to punt on the multi page thing for this patch, but might sneak it in as a bug fix | 05:05 |
| morganfainberg | ayoung, sure, seriously if you have _THAT_ many events, god | 05:05 |
| ayoung | you know "revocation events fill up a page..." | 05:05 |
| ayoung | I* don't think we will | 05:05 |
| ayoung | events should be pretty efficient | 05:05 |
| morganfainberg | ayoung, and it's only memcache we need to really worry about, redis is better about it | 05:05 |
| morganfainberg | as is mongo etc | 05:06 |
| ayoung | for example, our QE had a test that had thousands of tokens active for a given use, and when they delete him, get thousands of revoked tokens. Now that will be one event | 05:06 |
| *** chandan_kumar has joined #openstack-keystone | 05:06 | |
| morganfainberg | and if anyone tells me they are using in-mem in production... i think they need to have thier fingers broken | 05:06 |
| morganfainberg | ayoung, yeah same issue we have in production | 05:06 |
| ayoung | I really want the default to be persisted | 05:06 |
| morganfainberg | ayoung, it's why i was so so very excited to have your event stuff landing in icehouse | 05:07 |
| ayoung | glad to hear it...maybe I'll bump the testing priority for out QA for it | 05:07 |
| ayoung | our | 05:07 |
| morganfainberg | ayoung, next upgrade of Keystone (afaik) for us is going to be I, which means i'm going to push hard for events | 05:07 |
| morganfainberg | even if i have to get on a soapbox about using i keystone w/ G everything else | 05:07 |
| morganfainberg | (though... that isn't as good a plan as other alternatives) | 05:08 |
| *** dstanek_afk has joined #openstack-keystone | 05:08 | |
| *** ChanServ sets mode: +v dstanek_afk | 05:08 | |
| ayoung | I've got a meeting with them tomorrow, and I am trying, desperately, for them to engage in the upstream, instead of using the developers as their proxy. Wish me luck | 05:08 |
| morganfainberg | ayoung, best of luck! seriously! | 05:08 |
| morganfainberg | ayoung, also, for next release i might have a SEG type person who might be interested in being involved in OpenStack (he's RH employee already) | 05:09 |
| ayoung | yeah, we have some kick ass QA folks, they just have to realize the amount of community support we can get if they engage upstrean | 05:09 |
| ayoung | SEG? | 05:09 |
| morganfainberg | ayoung, he's doing uh,... Gnome fixes and the like | 05:09 |
| morganfainberg | support engineering? | 05:09 |
| ayoung | Ah | 05:09 |
| morganfainberg | ayoung, he said they were looking for folks to help w/ OpenStack as well | 05:10 |
| morganfainberg | trying to convince him he should (I got him to setup his dev/test env on openstack already and he loves it) | 05:10 |
| ayoung | of course...and if he wants an internal transfer, that seems to be well supported | 05:10 |
| *** dstanek has quit IRC | 05:10 | |
| morganfainberg | ayoung, exactly. but it would be for Juno likely, he has some family stuff he's dealing with right now | 05:10 |
| morganfainberg | but it should be all cleared up in a month or two | 05:11 |
| * morganfainberg hopes | 05:11 | |
| *** gokrokv__ has quit IRC | 05:11 | |
| morganfainberg | but more damn good people on OpenStack would be fantastic | 05:11 |
| *** gokrokve has joined #openstack-keystone | 05:11 | |
| ayoung | I spend more time messing with format than I do writing code | 05:13 |
| ayoung | sphinx.errors.SphinxWarning: /opt/stack/keystone/keystone/contrib/revoke/core.py:docstring of keystone.contrib.revoke.core.Manager.check_token:6: WARNING: Definition list ends without a blank line; unexpected unindent. | 05:13 |
| *** gokrokve_ has joined #openstack-keystone | 05:16 | |
| *** gokrokve has quit IRC | 05:16 | |
| morganfainberg | ayoung, wait.. isn't that the opposite of the last round? | 05:16 |
| ayoung | I added a blank line and it stopped complaining | 05:17 |
| morganfainberg | ah | 05:18 |
| morganfainberg | ok | 05:18 |
| * morganfainberg shrugs | 05:18 | |
| morganfainberg | we have a bunch of work to do to get other KVS backends off the legacy stuff in J | 05:19 |
| morganfainberg | might be interesting to use mongo as an assignment backend. with henry's changes, the stuff seems less relational now | 05:19 |
| morganfainberg | that grant table cleanup is another big win for Icehouse | 05:19 |
| *** gokrokve_ has quit IRC | 05:20 | |
| *** gokrokve has joined #openstack-keystone | 05:20 | |
| jamielennox | ayoung: did you generate the PKI tokens in testing by hand/ | 05:21 |
| ayoung | nope | 05:22 |
| ayoung | jamielennox, client or server? | 05:22 |
| jamielennox | ayoung: client | 05:22 |
| ayoung | there is a script in examples that generates them | 05:23 |
| ayoung | you don't want to run the whole script, as it regens the certs etc | 05:23 |
| jamielennox | http://paste.openstack.org/show/67490/ | 05:23 |
| ayoung | /opt/stack/python-keystoneclient/examples/pki/gen_pki.sh | 05:23 |
| jamielennox | oh wait, that's v2 | 05:24 |
| ayoung | jamielennox, you mean did I mock up the JSON by hand? I can't remember | 05:24 |
| jamielennox | what the hell is going on... | 05:24 |
| *** gokrokve has quit IRC | 05:25 | |
| ayoung | jamielennox, what is going on is that it is past midnight and I am going to bed | 05:28 |
| jamielennox | ayoung: ok | 05:28 |
| jamielennox | ayoung: all the example tokens are missing a 'methods' entry | 05:28 |
| ayoung | probably predate it | 05:28 |
| jamielennox | it should be a core v3 thing right? | 05:29 |
| jamielennox | at least for tokens with a service catalog | 05:29 |
| ayoung | or...yeah, I probably took them from the docs...hmmm | 05:29 |
| ayoung | no idea. But easy to fix | 05:29 |
| jamielennox | ayoung: ok, that's a pain | 05:29 |
| jamielennox | night | 05:29 |
| ayoung | jamielennox, here's the deal, the bottom of gen_pki.sh has the calls to the top level functions, so change that file to something that should be sourced, and drop off the function calls | 05:30 |
| ayoung | then call them from the command line or another script. I have an example of that in one of the compressed token patches | 05:31 |
| jamielennox | ayoung: i think i just need to patch the .json files | 05:31 |
| jamielennox | then rerun the generator | 05:31 |
| ayoung | jamielennox, yesm but don;t do it blindly. | 05:31 |
| jamielennox | hmm? | 05:31 |
| ayoung | https://review.openstack.org/#/c/71181/13/examples/pki/gen_pki.sh | 05:32 |
| ayoung | and then just run the last function | 05:32 |
| ayoung | gen_sample_cms | 05:32 |
| ayoung | you can leave off the changes that are specific to the compressed token patch | 05:32 |
| ayoung | you don;'t want to regen the certs etc, as it will make the patch redict huge with no benefit | 05:32 |
| ayoung | and scare off reviewers | 05:33 |
| jamielennox | i'll see - i think i have to regen the tokens | 05:33 |
| ayoung | if you want, I can split the patch out so that you don't regen all the keys and certs | 05:33 |
| ayoung | then you can just rerun it | 05:33 |
| *** topol has joined #openstack-keystone | 05:34 | |
| jamielennox | ayoung: it's not to do with that patch | 05:35 |
| ayoung | jamielennox, let me submit a cleanup patch, and you can rebase onto it | 05:35 |
| ayoung | you'll see... | 05:35 |
| ayoung | jamielennox, https://review.openstack.org/#/c/74930/ | 05:39 |
| ayoung | instead of running run_all.sh just source gen_pki.sh and run | 05:40 |
| ayoung | gen_sample_cms | 05:40 |
| ayoung | ugh, that patch still needs cleanup, but not tongiht | 05:40 |
| jamielennox | ayoung: i don't think it'll work | 05:40 |
| jamielennox | becuase the signing keys etc are shared | 05:40 |
| jamielennox | if i only regenerate some of the certs they aren't going to verify | 05:40 |
| ayoung | you need to edit the JSON and then regenerate the signed tokens | 05:41 |
| ayoung | gen_sample_cms does just the tokens | 05:41 |
| ayoung | it will leave the certs and keys alone | 05:41 |
| jamielennox | oh, right | 05:41 |
| ayoung | lemm fix that patch | 05:42 |
| ayoung | anyway, use that as the basis, jamielennox and your patch should be smaller an more reviewable | 05:43 |
| ayoung | now bed for me | 05:43 |
| jamielennox | ayoung: shall do | 05:43 |
| jamielennox | night | 05:43 |
| *** ayoung is now known as ayoung-ZzZzZzZ | 05:43 | |
| morganfainberg | jamielennox, most of our "example" tokens look nothing like real tokens | 05:45 |
| jamielennox | morganfainberg: yea - how does that happen/ | 05:45 |
| morganfainberg | jamielennox, because we sucked at making good fixtures (sorry, it's true) | 05:45 |
| *** marcoemorais has joined #openstack-keystone | 05:46 | |
| morganfainberg | jamielennox, i have a patch or three to help with some of it. but it's a lot of test restructuring. | 05:46 |
| morganfainberg | jamielennox, i have some internal-company work that must get done first before i can work on those | 05:46 |
| morganfainberg | plus some I3 target bugs | 05:46 |
| jamielennox | morganfainberg: yea, we would also need to fix a whole lot of test code to look like the new fixtures | 05:46 |
| morganfainberg | jamielennox, but i plan on making a token fixture probably next week or so | 05:46 |
| morganfainberg | and convert tests over to using it | 05:47 |
| morganfainberg | no more loveingly hand-crafted token examples | 05:47 |
| jamielennox | morganfainberg: the problem is doing it in a way that we don't just generate things internally that are wrong and then verify they are wrong | 05:48 |
| morganfainberg | jamielennox, the correct way is to generate it once "correctly" and use that as the basis (template) | 05:48 |
| morganfainberg | but make sure it really looks like a token | 05:48 |
| jamielennox | morganfainberg: anyway i agree - mostly client side i'm still looking at the moment though | 05:49 |
| morganfainberg | i almost have a working fixed-format token that could be used inter-changably V2/V3 | 05:49 |
| morganfainberg | as in, easy to transform | 05:49 |
| morganfainberg | basically a to_version and from_version mechanism that i'll be landing in J so token versions can be independant of API versions | 05:50 |
| morganfainberg | and we can then place a schema on the tokens, and validate they are correct | 05:51 |
| jamielennox | i like | 05:51 |
| morganfainberg | rather than "fixed" values. | 05:51 |
| jamielennox | but i almost prefer the idea of a fixed token data with different 'views' | 05:52 |
| morganfainberg | so validating a test token is correct is knowing the expected fixed form values, and then doing a schema validation (json or whatever) | 05:52 |
| morganfainberg | jamielennox, thats the idea, the to-from stuff will be at the controller layer | 05:52 |
| morganfainberg | not internally used | 05:52 |
| jamielennox | ok | 05:52 |
| jamielennox | yea, i have a few ideas along that front as well | 05:52 |
| morganfainberg | what i really want is tokens to be forward compatible | 05:53 |
| morganfainberg | V3 token may not have all the same data as v4, but v4, 5, 6 X should be able to read V3 and provided data is there, it's workable | 05:53 |
| morganfainberg | or, we do major/minor versioning | 05:53 |
| morganfainberg | or token versions are compatible over 2 token version revs, etc | 05:54 |
| morganfainberg | you know, something that makes sense | 05:54 |
| morganfainberg | obviously V4 will be the first "real" token version of the new system. | 05:54 |
| morganfainberg | anyways... thats not I3 :) | 05:55 |
| *** bvandenh has quit IRC | 05:57 | |
| jamielennox | morganfainberg: and we scope the whole thing to /auth/vX/ | 05:57 |
| *** bvandenh has joined #openstack-keystone | 05:58 | |
| jamielennox | not /v3/auth/vX - straight up /auth/VX | 05:58 |
| jamielennox | completely outside of the keystone standard apis | 05:58 |
| jamielennox | morganfainberg: ughh, i found another incorrect token example in the tests | 05:59 |
| jamielennox | one that we test to :( | 05:59 |
| *** gokrokve has joined #openstack-keystone | 06:16 | |
| *** gokrokve has quit IRC | 06:21 | |
| *** gokrokve has joined #openstack-keystone | 06:22 | |
| *** gokrokve has quit IRC | 06:27 | |
| *** topol has quit IRC | 06:28 | |
| *** amerine_ has joined #openstack-keystone | 06:36 | |
| *** chandan_kumar has quit IRC | 06:38 | |
| *** amerine has quit IRC | 06:40 | |
| *** chandan_kumar has joined #openstack-keystone | 07:03 | |
| *** Kanagaraj has quit IRC | 07:05 | |
| *** saju_m has joined #openstack-keystone | 07:15 | |
| morganfainberg | jamielennox, :( | 07:20 |
| morganfainberg | annnyways... i am going to sleep now i think | 07:20 |
| morganfainberg | like actually | 07:20 |
| morganfainberg | sleep | 07:20 |
| jamielennox | morganfainberg: night | 07:20 |
| *** saju_m has quit IRC | 07:20 | |
| *** saju_m has joined #openstack-keystone | 07:21 | |
| *** gokrokve has joined #openstack-keystone | 07:22 | |
| *** amerine_ has quit IRC | 07:26 | |
| *** saju_m has quit IRC | 07:26 | |
| *** saju_m has joined #openstack-keystone | 07:27 | |
| *** gokrokve has quit IRC | 07:27 | |
| *** morganfainberg is now known as morganfainberg_Z | 07:32 | |
| *** david_lyle_ has joined #openstack-keystone | 07:44 | |
| *** david-lyle has quit IRC | 07:47 | |
| *** saju_m has quit IRC | 07:49 | |
| *** Kanagaraj has joined #openstack-keystone | 07:55 | |
| *** marekd|away is now known as marekd | 08:08 | |
| *** amerine has joined #openstack-keystone | 08:10 | |
| marekd | stevemar: still here? | 08:18 |
| stevemar | marekd, maybe... | 08:19 |
| marekd | stevemar: maybe not. So in your last patch you basically refactored auth plugin and helper-token-methods, right? I did skim the code and this TODO list you mentioned in one of the comments is not yet done. | 08:20 |
| marekd | right? | 08:20 |
| *** gokrokve has joined #openstack-keystone | 08:22 | |
| stevemar | marekd, sort of, there are were three todos | 08:22 |
| marekd | yep. | 08:23 |
| stevemar | 1 is a no-op, the one about putting token in header... forget that one, i was confused/mixed up | 08:23 |
| marekd | stevemar: TBH i was not sure what you meant while writing that :-) | 08:23 |
| stevemar | it's sort of unconventional to put a token id in the saml2 section, that's why i was confused | 08:24 |
| stevemar | the third one, just a small change in tokens/provider/common, to add OS-FEDERATION ... | 08:24 |
| marekd | ok, i will look into 1st and 3rd | 08:24 |
| stevemar | third one is done, i submitted a patch a few minutes ago :O | 08:24 |
| marekd | stevemar: ah, ok. | 08:25 |
| marekd | stevemar: always 2 steps ahead. ;-) | 08:25 |
| stevemar | 1st one is easy, just follow what oauth did in tokens/provider, ctrl+f "consumer_id" | 08:25 |
| stevemar | wherever it says delete_token/list_token | 08:25 |
| stevemar | but i think we should hold off on that one... | 08:25 |
| marekd | why? | 08:25 |
| *** leseb has joined #openstack-keystone | 08:26 | |
| stevemar | in case dolph has a better idea | 08:26 |
| stevemar | the way of deleting tokens is so ... rigid | 08:27 |
| marekd | ok, i will talk to him when he is online. | 08:27 |
| marekd | you'd better go to bed. | 08:27 |
| *** gokrokve has quit IRC | 08:27 | |
| stevemar | theres a lot we can do for tests | 08:27 |
| stevemar | like, try and process an assertion that comes up with no user name, it should raise 401. | 08:28 |
| stevemar | we also don't scope to domains at all | 08:28 |
| marekd | uhm. | 08:28 |
| marekd | ok, i will look into it today. | 08:28 |
| marekd | anything else? | 08:28 |
| stevemar | and we should probably see if we can *use* the scoped token that we end getting back, try and create a user or something | 08:28 |
| marekd | hmmm, this should be then kind of admin_token i guess... | 08:29 |
| stevemar | Annnnnd, we should make sure it works in a real apache configured environment ... | 08:29 |
| stevemar | and hope ayoungs thinking about the protected url is right | 08:29 |
| *** chandan_kumar has quit IRC | 08:29 | |
| stevemar | it's just more and more testing tbh | 08:30 |
| stevemar | which is good, cause there are no more to-dos :) | 08:30 |
| marekd | yes........... | 08:30 |
| *** jamielennox is now known as jamielennox|away | 08:31 | |
| stevemar | marekd, that said, good morning! | 08:32 |
| marekd | heh, good morning, for both of us! | 08:32 |
| marekd | sleep well! | 08:33 |
| *** chandan_kumar has joined #openstack-keystone | 08:37 | |
| stevemar | marekd, emailing you and dolphm | 08:41 |
| *** saju_m has joined #openstack-keystone | 08:45 | |
| stevemar | marekd, alright, i'm out! | 08:48 |
| *** stevemar has quit IRC | 08:53 | |
| *** pheadron has joined #openstack-keystone | 09:00 | |
| *** david_lyle_ has quit IRC | 09:04 | |
| *** Kanagaraj has quit IRC | 09:08 | |
| *** KanagarajM_ has joined #openstack-keystone | 09:08 | |
| *** marcoemorais has quit IRC | 09:12 | |
| *** marcoemorais has joined #openstack-keystone | 09:14 | |
| *** marcoemorais has quit IRC | 09:18 | |
| *** gokrokve has joined #openstack-keystone | 09:22 | |
| *** gokrokve has quit IRC | 09:26 | |
| *** david-lyle has joined #openstack-keystone | 09:27 | |
| *** marcoemorais has joined #openstack-keystone | 09:43 | |
| *** marcoemorais has quit IRC | 09:48 | |
| *** gokrokve has joined #openstack-keystone | 10:22 | |
| *** gokrokve has quit IRC | 10:27 | |
| *** marcoemorais has joined #openstack-keystone | 10:44 | |
| *** marcoemorais has quit IRC | 10:48 | |
| *** gokrokve has joined #openstack-keystone | 11:22 | |
| *** gokrokve has quit IRC | 11:27 | |
| *** KanagarajM_ has quit IRC | 11:28 | |
| *** marcoemorais has joined #openstack-keystone | 11:44 | |
| leseb | hy all, can I create an "admin" user that could not modify quotas (nova)? and also create users within a specific tenant using V2 API? thanks! | 11:48 |
| *** marcoemorais has quit IRC | 11:49 | |
| *** dstanek_afk has quit IRC | 11:50 | |
| *** pheadron has quit IRC | 11:54 | |
| *** d0ugal has joined #openstack-keystone | 11:56 | |
| *** dstanek_afk has joined #openstack-keystone | 11:58 | |
| *** ChanServ sets mode: +v dstanek_afk | 11:58 | |
| *** gokrokve has joined #openstack-keystone | 12:07 | |
| *** gokrokve has quit IRC | 12:19 | |
| *** gokrokve has joined #openstack-keystone | 12:19 | |
| *** leseb has quit IRC | 12:20 | |
| *** gokrokve has quit IRC | 12:23 | |
| *** dstanek_afk is now known as dstanek | 12:25 | |
| dstanek | bknudson: i have a question about https://review.openstack.org/#/c/72106 when you are awake | 12:26 |
| marekd | dolphm: hey. | 12:40 |
| *** marcoemorais has joined #openstack-keystone | 12:45 | |
| *** leseb has joined #openstack-keystone | 12:47 | |
| *** marcoemorais has quit IRC | 12:50 | |
| *** gokrokve has joined #openstack-keystone | 12:50 | |
| *** gokrokve_ has joined #openstack-keystone | 12:52 | |
| *** gokrokve has quit IRC | 12:55 | |
| *** gokrokve_ has quit IRC | 12:56 | |
| *** marcoemorais has joined #openstack-keystone | 13:09 | |
| *** marcoemorais has quit IRC | 13:13 | |
| *** david-lyle has quit IRC | 13:17 | |
| *** henrynash has joined #openstack-keystone | 13:21 | |
| *** gokrokve has joined #openstack-keystone | 13:22 | |
| *** gokrokve has quit IRC | 13:27 | |
| bknudson | dstanek: what's the question? | 13:28 |
| *** dstanek has quit IRC | 13:34 | |
| *** dstanek has joined #openstack-keystone | 13:43 | |
| *** ChanServ sets mode: +v dstanek | 13:43 | |
| marekd | dolphm: ping | 13:53 |
| *** gokrokve has joined #openstack-keystone | 13:54 | |
| *** ayoung-ZzZzZzZ has quit IRC | 13:59 | |
| *** YorikSar has quit IRC | 13:59 | |
| *** saju_m has quit IRC | 14:11 | |
| *** henrynash has quit IRC | 14:11 | |
| *** topol has joined #openstack-keystone | 14:11 | |
| *** henrynash_ has joined #openstack-keystone | 14:15 | |
| *** dstanek has quit IRC | 14:15 | |
| *** ayoung-ZzZzZzZ has joined #openstack-keystone | 14:15 | |
| *** YorikSar has joined #openstack-keystone | 14:16 | |
| *** marcoemorais has joined #openstack-keystone | 14:16 | |
| *** henrynash_ is now known as henrynash | 14:16 | |
| *** saju_m has joined #openstack-keystone | 14:16 | |
| *** marcoemorais has quit IRC | 14:16 | |
| *** topol has quit IRC | 14:16 | |
| *** topol has joined #openstack-keystone | 14:16 | |
| *** YorikSar has quit IRC | 14:20 | |
| *** saju_m has quit IRC | 14:27 | |
| *** topol_ has joined #openstack-keystone | 14:29 | |
| *** chandan_kumar has quit IRC | 14:29 | |
| *** d0ugal_ has joined #openstack-keystone | 14:31 | |
| *** d0ugal_ has quit IRC | 14:31 | |
| *** d0ugal_ has joined #openstack-keystone | 14:31 | |
| *** YorikSar has joined #openstack-keystone | 14:33 | |
| *** uvirtbot has quit IRC | 14:38 | |
| *** d0ugal has quit IRC | 14:38 | |
| *** topol has quit IRC | 14:38 | |
| *** dstanek has joined #openstack-keystone | 14:39 | |
| *** ChanServ sets mode: +v dstanek | 14:39 | |
| dstanek | bknudson: i was just wondering if it mean that get project users will not work once we implement federation | 14:41 |
| *** d0ugal_ has quit IRC | 14:41 | |
| bknudson | dstanek: federated users don't exist in keystone, so there's no way to get all the users that have an assignment on a project. | 14:41 |
| *** browne has joined #openstack-keystone | 14:42 | |
| *** d0ugal_ has joined #openstack-keystone | 14:42 | |
| bknudson | dstanek: I'm sure a customer will report a bug saying that keystone should return all those users too. | 14:42 |
| dstanek | can a installation have federation enable and still use sql identity in addition to that? | 14:43 |
| *** d0ugal_ is now known as d0ugal | 14:43 | |
| *** uvirtbot has joined #openstack-keystone | 14:43 | |
| dstanek | bknudson: i'm not aware of all of the federation implications | 14:43 |
| dolphm | dstanek: yes | 14:43 |
| bknudson | dstanek: you're going to need an identity backend | 14:43 |
| dolphm | marekd: pong - alhtough i just responded to your email | 14:43 |
| bknudson | dstanek: for the groups | 14:43 |
| dolphm | bknudson: ++ | 14:43 |
| dolphm | bknudson: and for service users | 14:44 |
| marekd | dolphm: is it actually the desired configuration (empty policy req) ? | 14:44 |
| dolphm | marekd: you want it to be accessible with an unscoped token | 14:44 |
| dolphm | which has no authorization, beyond implied service-level authz on keystone | 14:44 |
| marekd | dolphm: ok, understood. | 14:45 |
| dstanek | bknudson: so this is just saying then that you can't fix federated uses and users from other backends in the same project? | 14:46 |
| bknudson | dstanek: which change is this? | 14:46 |
| dstanek | bknudson: https://review.openstack.org/#/c/72106/3/keystone/assignment/controllers.py | 14:46 |
| dstanek | bknudson: even without your patch it still wouldn't have worked in that situation | 14:47 |
| bknudson | dstanek: if you're using LDAP for identity and SQL for assignment, someone could remove the user from LDAP directly. Then you could have assignments that don't correspond to users in identity. | 14:50 |
| bknudson | dstanek: which previously that would result in a 404 result when you get project users. | 14:51 |
| bknudson | Now it returns a 500 | 14:51 |
| bknudson | so I think this is making the error more accurate -- should returns a 404 Not Found when the requested resource actually exists. | 14:52 |
| bknudson | "should returns" to "shouldn't return" | 14:52 |
| dstanek | bknudson: i don't disagree with that | 14:52 |
| bknudson | this isn't changing support for anything, just changing the response code | 14:53 |
| dstanek | bknudson: i'm just wondering if these kinds of call will stop working once federation is implemented | 14:53 |
| bknudson | dstanek: ok, so I was under the impression that federated users wouldn't exist in identity and you could assign roles to them | 14:53 |
| dstanek | bknudson: oh no, i'm not saying there is anything wrong with your change; i just using it to learn a little more :-) | 14:54 |
| bknudson | but it turns out I was wrong -- you can't assign roles to federated users. | 14:54 |
| bknudson | federated role assignments come through the groups that the mapping comes up with | 14:54 |
| bknudson | and the groups have to be known to identity | 14:54 |
| bknudson | so there actually is no reason to allow assigning roles to users and groups that don't exist | 14:55 |
| bknudson | for federation... | 14:55 |
| bknudson | now there's the other case where you're using LDAP identity in read-only -- | 14:55 |
| bknudson | so that administrators are mucking with LDAP users outside of keystone's knowledge | 14:55 |
| bknudson | so maybe there's still a requirement to allow having assignments to users and groups that don't exist. | 14:56 |
| bknudson | but it's not federation | 14:56 |
| dstanek | bknudson: thx for the info; i think i need to look a little more at the federation changes | 14:58 |
| bknudson | dstanek: what do you think about the controller test? | 14:59 |
| bknudson | I decided not to add a new test to the keystoneclient tests | 15:00 |
| dstanek | bknudson: i think the controller test on that patchset looked good | 15:02 |
| dolphm | bknudson: what is the requirement for having assignments to non-existing users & groups, if it's not in support of federation? | 15:06 |
| bknudson | dolphm: so someone's using LDAP for identity and they delete the user. Now they've got assignments to users that don't exist. | 15:07 |
| dolphm | bknudson: oh, sure -- but there's no reason to support actively creating assignments to users that can't be verified | 15:07 |
| bknudson | dolphm: I agree with that... unless there was someone wanted to create the assignment in keystone and they have to wait a while for the LDAP admins to get their act together and create the user. | 15:08 |
| bknudson | seems like they could wait | 15:08 |
| bknudson | dolphm: just making sure about this -- we now want to 404 when you try to create an assignment to a user or group that doesn't exist? | 15:09 |
| dolphm | bknudson: with the number of bug report we've gotten over the years for "i made a typo and keystone didn't complain" ... i'd rather do any verification we can | 15:09 |
| *** YorikSar has quit IRC | 15:09 | |
| *** YorikSar has joined #openstack-keystone | 15:09 | |
| dolphm | bknudson: that's what we do today, right? i don't see a reason for it to change (yet, anyway) | 15:09 |
| bknudson | dolphm: the changes in https://review.openstack.org/#/c/72142/2/keystone/assignment/controllers.py for example ... | 15:10 |
| bknudson | it's 404 because the user doesn't exist. | 15:10 |
| bknudson | but it's not because the code is actually checking that the user exists. | 15:10 |
| *** marcoemorais has joined #openstack-keystone | 15:10 | |
| bknudson | the code is checking if the user has authority to do the operation. | 15:10 |
| bknudson | it used to be that we did "self.identity_api.get_user(user_id)" all over the place to ensure that the user exists. | 15:11 |
| dolphm | bknudson: yeah, that was a mess. in the case of policy, we should never check the actual user id | 15:12 |
| bknudson | also, the _check_grant_protection only happens for v3 APIs | 15:12 |
| bknudson | so the v2 APIs are not failing (don't check policy) and the v3 APIs are failing only because they do this policy check. | 15:12 |
| dolphm | bknudson: why should this policy check care about user_id? | 15:13 |
| dolphm | maybe i need to see how this is used... not sure if the user_id is the API user, or the destination of the assignment? | 15:14 |
| bknudson | dolphm: it's the destination | 15:14 |
| dolphm | then it makes sense to check that it exists | 15:14 |
| dolphm | but i wouldn't put that under the umbrella of "policy" | 15:15 |
| dolphm | i think that's what confused me | 15:15 |
| *** marcoemorais has quit IRC | 15:15 | |
| *** Kanagaraj has joined #openstack-keystone | 15:15 | |
| bknudson | dolphm: it gets the user which checks for existence... so there's now no reason to check for existence again in create_grant anymore. | 15:15 |
| bknudson | dolphm: should it be the controller checking existence or the manager? | 15:16 |
| bknudson | seems like it should be the manager. | 15:16 |
| dolphm | bknudson: manager, ideally | 15:18 |
| *** amcrn has joined #openstack-keystone | 15:18 | |
| bknudson | dolphm: ok, when I add the checks back in I'll try to put it in the manager. | 15:19 |
| dolphm | bknudson: sounds good | 15:19 |
| *** arborism has joined #openstack-keystone | 15:20 | |
| *** amcrn has quit IRC | 15:24 | |
| dstanek | dolphm: once the change for generating the sample config are merged will these get wiped out? https://review.openstack.org/#/c/71674 | 15:30 |
| *** dolphm is now known as dolphm_503 | 15:33 | |
| *** Kanagaraj has quit IRC | 15:40 | |
| *** Kanagaraj has joined #openstack-keystone | 15:40 | |
| *** stevemar has joined #openstack-keystone | 15:43 | |
| *** ChanServ sets mode: +v stevemar | 15:43 | |
| *** david-lyle has joined #openstack-keystone | 15:44 | |
| *** dolphm_503 is now known as dolphm | 16:03 | |
| *** dolphm is now known as dolphm_503 | 16:13 | |
| *** dolphm_503 is now known as dolphm | 16:26 | |
| *** ayoung-ZzZzZzZ has quit IRC | 16:26 | |
| *** gokrokve has quit IRC | 16:28 | |
| *** gokrokve has joined #openstack-keystone | 16:28 | |
| *** devlaps has joined #openstack-keystone | 16:30 | |
| *** gokrokve has quit IRC | 16:33 | |
| topol_ | morganfainberg you there? | 16:35 |
| *** dolphm is now known as dolphm_503 | 16:35 | |
| *** browne has quit IRC | 16:42 | |
| *** warpig has joined #openstack-keystone | 16:45 | |
| *** gokrokve has joined #openstack-keystone | 16:48 | |
| *** dolphm_503 is now known as dolphm | 16:57 | |
| stevemar | marekd, ping | 16:58 |
| marekd | stevemar: hey. | 16:58 |
| stevemar | marekd, how goes it | 16:58 |
| marekd | stevemar: extended patch for listing project/domains from groups/ | 17:00 |
| *** dolphm is now known as dolphm_503 | 17:00 | |
| *** dolphm_503 is now known as dolphm | 17:02 | |
| *** gokrokve has quit IRC | 17:04 | |
| *** gokrokve has joined #openstack-keystone | 17:04 | |
| marekd | stevemar: feel free to take a look at https://review.openstack.org/#/c/74534 | 17:05 |
| *** marcoemorais has joined #openstack-keystone | 17:05 | |
| marekd | stevemar: i have basically recreated groups/projects/roles from SAML2-auth patch, so it should be easy to rebase later the test_list_projects/test_list_domains tests... | 17:06 |
| *** browne has joined #openstack-keystone | 17:06 | |
| *** browne has quit IRC | 17:06 | |
| *** browne has joined #openstack-keystone | 17:07 | |
| *** Kanagaraj has quit IRC | 17:07 | |
| *** gokrokve has quit IRC | 17:09 | |
| stevemar | marekd, commented | 17:13 |
| marekd | stevemar: looking, fixing | 17:15 |
| marekd | https://review.openstack.org/#/c/74534/9/keystone/middleware/core.py - you are talking about empty lines, right? | 17:17 |
| marekd | stevemar: ^^^^ | 17:18 |
| stevemar | yep | 17:18 |
| marekd | stevemar: ok | 17:19 |
| *** gokrokve has joined #openstack-keystone | 17:25 | |
| *** saju_m has joined #openstack-keystone | 17:33 | |
| marekd | stevemar: added | 17:36 |
| *** saju_m has quit IRC | 17:46 | |
| stevemar | marekd, i'm confused | 17:46 |
| stevemar | marekd, i'm overlaying the sql work on top of the saml auth work ... and trying to use the tokens we save in load_federation_data | 17:47 |
| marekd | stevemar: hm. | 17:50 |
| stevemar | nvm | 17:51 |
| stevemar | the authorization bit is a little wron | 17:51 |
| stevemar | g | 17:51 |
| marekd | stevemar: which authorization ;/ | 17:52 |
| stevemar | in common/authorization: g['id'] for g in token_data.get('OS-FEDERATION:groups', [])] | 17:52 |
| marekd | stevemar: i would rename token_customer => tokens['CUSTOMER_ASSERTION']. Something like that. | 17:53 |
| stevemar | it should be OS-FEDERATION['groups'] | 17:53 |
| stevemar | yeah, thats what i'm doing now | 17:53 |
| marekd | stevemar: why would you say it should be OS-FEDERATION['groups'] ? | 17:53 |
| stevemar | marekd, because that's the way it's being stored right now in tokens/provider/common _handle_saml2_tokens | 17:54 |
| stevemar | marekd, doesn't matter, we just need to finalize how to store it | 17:57 |
| marekd | stevemar: https://gist.github.com/stevemart/43be0bbc4508b8c47e44 i think i was basing on this...if we get response with that structure... | 17:57 |
| marekd | stevemar: yep, it's just more like convention i think...? | 17:57 |
| stevemar | yeah, lets go with that | 17:57 |
| stevemar | marekd, i might just merge these two together? | 17:58 |
| stevemar | if we're going to test it out, lets do it properly | 17:58 |
| marekd | go ahead. | 17:58 |
| marekd | i thought you wanted to keep those patches splited, that's why i added tests to listing projs/domains | 17:59 |
| stevemar | i did | 18:02 |
| stevemar | marekd, but to test them properly, i want to use the tokens we get back, not play around with token_api.create_token blah | 18:02 |
| *** dstanek has quit IRC | 18:03 | |
| marekd | understood. | 18:03 |
| *** saju_m has joined #openstack-keystone | 18:09 | |
| stevemar | marekd, i don't think your domain listing tests will pass? | 18:10 |
| marekd | stevemar: it was locally... | 18:10 |
| stevemar | projects will | 18:10 |
| marekd | stevemar: why domains not ? | 18:10 |
| stevemar | domains will come back empty list every time | 18:10 |
| stevemar | you never created grants for domains :) | 18:10 |
| stevemar | creating a grant on a project on domainA, doesn't mean the group has access to domainA | 18:11 |
| stevemar | just to the project | 18:11 |
| stevemar | user XOR group AND project XOR domain | 18:11 |
| marekd | stevemar: that | 18:11 |
| marekd | stevemar: https://review.openstack.org/#/c/74534/9/keystone/tests/test_v3_federation.py - starting from line 825 | 18:12 |
| marekd | but yes, in the saml2-auth i removed grants for domains because i was not testing them THERE, so somebody would eventually complain ;-) | 18:13 |
| stevemar | marekd, i'm going to squash the two together | 18:14 |
| stevemar | submitting a patch now | 18:14 |
| marekd | ok | 18:15 |
| marekd | after you submit it i will add new test. | 18:15 |
| marekd | (raise 401 when 'user' obj is not produced) | 18:16 |
| *** dstanek has joined #openstack-keystone | 18:16 | |
| *** ChanServ sets mode: +v dstanek | 18:16 | |
| marekd | are you running tests now or submitting right away ? | 18:16 |
| *** saju_m has quit IRC | 18:17 | |
| *** gyee has joined #openstack-keystone | 18:18 | |
| *** saju_m has joined #openstack-keystone | 18:21 | |
| *** leseb has quit IRC | 18:22 | |
| marekd | stevemar:after you submit your patch i wanted to also add this: http://pasteraw.com/tnln5ejyvsbzibb4445vlu8q4yojauo | 18:26 |
| *** saju_m has quit IRC | 18:28 | |
| stevemar | 1 sec, just running tests one last time | 18:29 |
| dstanek | stevemar: one sec? what kind of machine do you have? | 18:30 |
| dstanek | i'd have to say "1 hour" | 18:30 |
| marekd | dstanek: lol | 18:30 |
| stevemar | dstanek, just from the federation suite :P | 18:30 |
| stevemar | the whole test suite would be about 20 minutes :P | 18:30 |
| marekd | stevemar: exactly | 18:31 |
| dstanek | so many codes to review; so little time | 18:32 |
| *** saju_m has joined #openstack-keystone | 18:33 | |
| *** browne has quit IRC | 18:35 | |
| marekd | stevemar: ok, need to do some business now, i should get back later. | 18:35 |
| *** marekd is now known as marekd|away | 18:35 | |
| *** morganfainberg_Z is now known as morganfainberg | 18:44 | |
| morganfainberg | topol_, hi | 18:48 |
| morganfainberg | topol_, i'm here now | 18:48 |
| morganfainberg | topol_, west coast time >.< | 18:48 |
| morganfainberg | topol_, you know | 18:48 |
| morganfainberg | dolphm, so with the deal on holding for Kite via TC meeting, we're also holding on splitting the repos? | 18:49 |
| morganfainberg | dolphm, i don't want to chase infra about creating the repo if we're holding on both fronts | 18:49 |
| dolphm | morganfainberg: the TC had an informal conversation this week; ttx wasn't around to say for sure, but it sounds like the TC doesn't think they need to vote on integrating a new project in an already integrated program | 18:50 |
| dolphm | morganfainberg: the proposal to openstack/governance was more so book keeping that ttx can rubberstamp; let's poke him in #openstack-relmgr-office and find out | 18:51 |
| morganfainberg | dolphm, k | 18:51 |
| dolphm | morganfainberg: (waiting for you to join) | 18:52 |
| morganfainberg | sec. | 18:52 |
| *** browne has joined #openstack-keystone | 18:53 | |
| morganfainberg | dolphm, i thought i had joined had an issue with copy paste:P ended up in relmgr-offic | 18:54 |
| morganfainberg | no e | 18:54 |
| dstanek | dolphm: jenkins passed on https://review.openstack.org/#/c/72102/ so i'm going to approve it | 18:57 |
| dolphm | morganfainberg: lol - must be dinner time | 18:57 |
| dolphm | dstanek: ++ | 18:57 |
| morganfainberg | dstanek, ++ nice | 18:58 |
| morganfainberg | so, i think we're going to need to subclass the generator config stuff | 18:58 |
| morganfainberg | and then submit changes to oslo, going to hit up dhellmann about it first, but i do want to land that stuff in Icehouse. | 18:59 |
| dstanek | dolphm, morganfainberg: you guys are here at the same time. convenient! | 19:00 |
| dstanek | dolphm, morganfainberg: are we trying to land the auto config stuff soon? i noticed that dolphm has a few reviews for changes to the sample config | 19:01 |
| dolphm | dstanek: ignore mine | 19:01 |
| dolphm | dstanek: land morgans! | 19:02 |
| morganfainberg | dstanek, yes, i'm talking to dhellmann right now about fixing the stuff needed to make it work | 19:02 |
| morganfainberg | dstanek, whether we subclass and fix it in I for keystone, or i fasttrack a change for oslo | 19:02 |
| morganfainberg | and then sync it | 19:02 |
| *** henrynash has quit IRC | 19:03 | |
| topol_ | morganfainberg, dolphm, stevemar, I just want to give a shout out to my dear friend morganfainberg for sending hired goons to sabotage my keystone meetup presentation :-) | 19:03 |
| topol_ | morganfainberg I am happy to say your efforts failed :-) | 19:04 |
| stevemar | goons? hired goons? | 19:04 |
| dstanek | morganfainberg: hmmm... so it needs entry points to create the docs? | 19:04 |
| morganfainberg | dstanek, right now. | 19:05 |
| morganfainberg | dstanek, there is some magic "discover groups" logic | 19:05 |
| topol_ | stevemar, they were nice goons. It was fungi and he was not the heckler morganfainberg told him to be :-) | 19:05 |
| dstanek | morganfainberg: what about 'setup.py develop'? | 19:05 |
| morganfainberg | dstanek, that is suboptimal because that is required to generate a sample, i'd prefer to just be able to run tools/config/generate_sample.sh vs. a more complex (and potentially error prone, i've had it generat bogus samples) process | 19:06 |
| morganfainberg | it doesn't errror when you try and generate and keystone isn't installed, it just produces a bogus sample file | 19:06 |
| morganfainberg | jamielennox|away, dolphm , ayoung, https://review.openstack.org/#/c/74598/ round two of -2 for trying to just copy/paste reimplement/whatever service_catalog | 19:16 |
| morganfainberg | jgriffith may come bug us for eyes / help if there are issues with using ksclient directly | 19:16 |
| dolphm | morganfainberg: ++ | 19:19 |
| *** leseb has joined #openstack-keystone | 19:23 | |
| *** leseb has quit IRC | 19:28 | |
| *** gordc has joined #openstack-keystone | 19:29 | |
| *** dolphm is now known as dolphm_503 | 19:30 | |
| marekd|away | stevemar: i see you also added that: http://pasteraw.com/tnln5ejyvsbzibb4445vlu8q4yojauo | 19:42 |
| marekd|away | stevemar: thanks | 19:42 |
| stevemar | marekd|away, np, didn't need to extend rules btw | 19:42 |
| stevemar | marekd|away, the tests badly need a refactoring | 19:43 |
| stevemar | :P | 19:43 |
| morganfainberg | topol_, so... what you're saying is i need to send more goons next time? | 19:44 |
| marekd|away | stevemar: i can clean them, i think :P providing you sometimes sleep, eat, and breather instead of OpenStacking 25h/day and you don't do that now. | 19:45 |
| stevemar | marekd|away, actually.. since you have the infrastructure already set up, can you test it live? with mod_mellon? | 19:46 |
| stevemar | you've used it before, so i assume you have the infrastructure :S | 19:46 |
| topol_ | morganfainberg, when you actually look at the presentation I sent you and see how good it is you will feel guilty for all your scheming | 19:48 |
| morganfainberg | topol_, i looked at it | 19:48 |
| *** topol_ is now known as topol | 19:48 | |
| morganfainberg | topol_, i still don't feel guilty | 19:48 |
| morganfainberg | topol, :) | 19:48 |
| topol | morganfainberg... BRUTAL | 19:48 |
| morganfainberg | topol, it is damn good though | 19:48 |
| topol | send it back. dont use a single chart!!! | 19:49 |
| topol | oh ok, you can use it | 19:49 |
| morganfainberg | topol, http://www.meetup.com/OpenStack-LA/events/165980892/ | 19:49 |
| morganfainberg | topol, i need to build slides for that | 19:49 |
| topol | morganfainberg, good luck. They serve pizza at ours and its from a place that is really really good. I love going to our meetups! | 19:50 |
| morganfainberg | we have passable pizza here | 19:50 |
| morganfainberg | but i want something not pizza | 19:50 |
| topol | fungi is a nice guy. It was good to match a name to the irc nickname | 19:51 |
| morganfainberg | the last..... uhm.... 3 events have all been pizza | 19:51 |
| topol | err face to the nickname | 19:51 |
| morganfainberg | topol, yeah i plan on chasing fungi down to get a face to the irc nick in ATL | 19:51 |
| morganfainberg | among a few other infra folks | 19:51 |
| topol | excellent | 19:52 |
| morganfainberg | topol, you submit any talks for ATL? | 19:52 |
| morganfainberg | topol, i am a bit disappointed in the voting system, it's hard to give good feedback | 19:52 |
| topol | Yep, one on cloud audit and one on federated identity that is joint with rackspace | 19:53 |
| marekd|away | stevemar: not really, this is kinda problematic, because we need now work on the something that speaks ECP and doesn;t rely on webSSO. | 19:55 |
| *** leseb has joined #openstack-keystone | 19:55 | |
| marekd|away | stevemar: IMHO this test suite basically suffices, as mod_mellon will just squeeze assertion into the environ, something we do now. | 19:55 |
| marekd|away | but yes, the next imo non trivial and high priority step is to work on the client side. | 19:56 |
| *** haneef_ has joined #openstack-keystone | 19:56 | |
| marekd|away | stevemar: i already started doing some preparations for that. | 19:56 |
| stevemar | marekd|away, cool cool | 19:57 |
| topol | morganfainberg hopefully in ATL I can avoid my other duties and can go out at night with the keystone crowd. Had a lot of fun in San Antonio | 19:57 |
| *** arunk has joined #openstack-keystone | 19:58 | |
| dstanek | morganfainberg: i love that you -1ed your own review | 19:58 |
| topol | dstanek, a new term is coined. The self hating core contributor!!! :-) | 19:59 |
| haneef_ | morganfainberg: ping | 19:59 |
| dstanek | topol: :-) | 20:00 |
| haneef_ | morganfainberg: quick question. Why don't we have any cache for catalog?. Any reason? If we call get token multiple times, cache in catalog will really help. | 20:00 |
| morganfainberg | haneef_, because it hasn't been implemented yet :) | 20:00 |
| haneef_ | Thanks. | 20:00 |
| morganfainberg | haneef_, it's not a real answer, but yes just simply not done yet. | 20:01 |
| bknudson | sweet, no more sql.Base class | 20:06 |
| *** harlowja has joined #openstack-keystone | 20:06 | |
| lbragstad | bknudson: ++ nice | 20:06 |
| harlowja | got moved to a new channel, interesting | 20:06 |
| stevemar | marekd|away, i'm just worried about protecting the /auth/tokens url | 20:07 |
| morganfainberg | bknudson, ++ | 20:09 |
| morganfainberg | dstanek, ok have the stuff needed to resolve auto-sample generation in keystone, new tox target to build it | 20:10 |
| morganfainberg | tox -esample_config | 20:10 |
| morganfainberg | should do it | 20:10 |
| morganfainberg | :) | 20:10 |
| morganfainberg | will add it into my next patchset in the chain | 20:10 |
| morganfainberg | and adding some documentation | 20:10 |
| morganfainberg | bknudson, ^ | 20:10 |
| dstanek | nice...looking forward to it | 20:10 |
| bknudson | morganfainberg: a tox venv for this seems like overkill. | 20:10 |
| dstanek | does that include a fix from dhellmann? | 20:11 |
| morganfainberg | dstanek, wont be needed | 20:11 |
| morganfainberg | bknudson, you can do it in any venv, but you need all the requirements/test requirements | 20:11 |
| morganfainberg | bknudson, you can use: tox -e venv '{toxinidir}/tools/config/generate_sample.sh' | 20:11 |
| morganfainberg | but it really does guarantee that you have everything you need and you aren't getting some wacky/off the wall values | 20:12 |
| dstanek | morganfainberg: can you specify an environment in tox.ini that already exists? | 20:12 |
| bknudson | morganfainberg: that sounds safer. | 20:12 |
| morganfainberg | bknudson, the only reason i was doing it's own target is it is the easiest to document | 20:12 |
| morganfainberg | dstanek, bknudson, and makes developing less painful "just run tox -esample_config" and you get the new sample | 20:13 |
| morganfainberg | trying to minimize the chances for bad stuff | 20:13 |
| bknudson | morganfainberg: people will start complaining about running out of disk space. | 20:14 |
| bknudson | can you have 2 tox targets share a venv? | 20:14 |
| morganfainberg | bknudson, i.. don't think it owrks like that | 20:14 |
| morganfainberg | bknudson, short of overloading the commands | 20:14 |
| morganfainberg | bknudson, but.. i uhm, am not sure | 20:15 |
| morganfainberg | bknudson, looking at the docs now | 20:15 |
| bknudson | morganfainberg: don't worry too much about it. I've got plenty of disk space. | 20:16 |
| morganfainberg | bknudson, hehe | 20:16 |
| morganfainberg | bknudson, envdir we could make it double up with that option | 20:16 |
| bknudson | morganfainberg: the docs might want to say run "tox -r -e sample_config" since then would make sure they have a clean env | 20:16 |
| morganfainberg | bknudson, sure that amkes perfect sense | 20:16 |
| bknudson | morganfainberg: that sounds good! share with -e venv | 20:17 |
| bknudson | we should do the same for docs | 20:17 |
| morganfainberg | bknudson, i think that is doable. | 20:17 |
| morganfainberg | bknudson, i'll try it out | 20:17 |
| dstanek | morganfainberg: cool, that's what i meant about specifying the environment in tox.ini :P | 20:18 |
| *** henrynash has joined #openstack-keystone | 20:19 | |
| morganfainberg | dstanek, yeah | 20:19 |
| dstanek | i saw that somewhere recently, but i dont' remember where | 20:20 |
| *** ayoung has joined #openstack-keystone | 20:20 | |
| *** leseb has quit IRC | 20:21 | |
| morganfainberg | dstanek, yeah. | 20:21 |
| *** gyee has quit IRC | 20:37 | |
| dstanek | morganfainberg: is there a way to have comments on a section with auto generated configs? | 20:38 |
| morganfainberg | dstanek, on a whole section? | 20:38 |
| morganfainberg | dstanek, let me see. perhpas | 20:38 |
| * morganfainberg dives into oslo.config stuff | 20:38 | |
| dstanek | morganfainberg: like this: https://review.openstack.org/#/c/71674/1/etc/keystone.conf.sample | 20:38 |
| morganfainberg | dstanek, i don't think so though | 20:38 |
| morganfainberg | dstanek, i think the answer is no. | 20:39 |
| morganfainberg | but let me look sec | 20:39 |
| *** leseb has joined #openstack-keystone | 20:40 | |
| morganfainberg | dstanek, no the generator cannot do comments on a "section" | 20:43 |
| morganfainberg | only comments on individual options | 20:43 |
| morganfainberg | dstanek, https://github.com/openstack/oslo-incubator/blob/master/openstack/common/config/generator.py#L192 | 20:43 |
| dstanek | that's unfortunate | 20:44 |
| *** leseb has quit IRC | 20:52 | |
| *** arunk has quit IRC | 21:05 | |
| *** haneef_ has quit IRC | 21:05 | |
| *** harlowja has quit IRC | 21:05 | |
| *** dstanek has quit IRC | 21:05 | |
| *** david-lyle has quit IRC | 21:05 | |
| *** uvirtbot has quit IRC | 21:05 | |
| *** marcoemorais has quit IRC | 21:05 | |
| *** tellesnobrega has quit IRC | 21:05 | |
| *** mhu has quit IRC | 21:05 | |
| *** bknudson has quit IRC | 21:05 | |
| *** ayoung has quit IRC | 21:05 | |
| *** d0ugal has quit IRC | 21:05 | |
| *** henrynash has quit IRC | 21:05 | |
| *** browne has quit IRC | 21:05 | |
| *** topol has quit IRC | 21:05 | |
| *** bvandenh has quit IRC | 21:05 | |
| *** koolhead17 has quit IRC | 21:05 | |
| *** saju_m has quit IRC | 21:05 | |
| *** nkinder has quit IRC | 21:05 | |
| *** chmouel has quit IRC | 21:05 | |
| *** gokrokve has quit IRC | 21:05 | |
| *** warpig has quit IRC | 21:05 | |
| *** stevemar has quit IRC | 21:05 | |
| *** YorikSar has quit IRC | 21:05 | |
| *** huats has quit IRC | 21:05 | |
| *** simo has quit IRC | 21:05 | |
| *** gordc has quit IRC | 21:05 | |
| *** lari_ has quit IRC | 21:05 | |
| *** ChanServ has quit IRC | 21:05 | |
| *** morganfainberg has quit IRC | 21:05 | |
| *** dolphm_503 has quit IRC | 21:05 | |
| *** devlaps has quit IRC | 21:05 | |
| *** amerine has quit IRC | 21:05 | |
| *** lbragstad has quit IRC | 21:05 | |
| *** dtroyer has quit IRC | 21:05 | |
| *** Daviey has quit IRC | 21:05 | |
| *** rwsu has quit IRC | 21:05 | |
| *** marekd|away has quit IRC | 21:05 | |
| *** jamielennox|away has quit IRC | 21:05 | |
| *** Daviey has joined #openstack-keystone | 21:08 | |
| *** ChanServ has joined #openstack-keystone | 21:08 | |
| *** lari_ has joined #openstack-keystone | 21:08 | |
| *** huats has joined #openstack-keystone | 21:08 | |
| *** rwsu has joined #openstack-keystone | 21:08 | |
| *** jamielennox|away has joined #openstack-keystone | 21:08 | |
| *** morganfainberg has joined #openstack-keystone | 21:08 | |
| *** dickson.freenode.net sets mode: +ovov ChanServ jamielennox|away morganfainberg morganfainberg | 21:08 | |
| *** nkinder has joined #openstack-keystone | 21:08 | |
| *** marekd|away has joined #openstack-keystone | 21:08 | |
| *** koolhead17 has joined #openstack-keystone | 21:08 | |
| *** dolphm has joined #openstack-keystone | 21:08 | |
| *** dtroyer has joined #openstack-keystone | 21:08 | |
| *** simo has joined #openstack-keystone | 21:08 | |
| *** chmouel has joined #openstack-keystone | 21:08 | |
| *** lbragstad has joined #openstack-keystone | 21:08 | |
| *** bvandenh has joined #openstack-keystone | 21:08 | |
| *** amerine has joined #openstack-keystone | 21:08 | |
| *** topol has joined #openstack-keystone | 21:08 | |
| *** d0ugal has joined #openstack-keystone | 21:08 | |
| *** YorikSar has joined #openstack-keystone | 21:08 | |
| *** stevemar has joined #openstack-keystone | 21:08 | |
| *** devlaps has joined #openstack-keystone | 21:08 | |
| *** warpig has joined #openstack-keystone | 21:08 | |
| *** gokrokve has joined #openstack-keystone | 21:08 | |
| *** saju_m has joined #openstack-keystone | 21:08 | |
| *** browne has joined #openstack-keystone | 21:08 | |
| *** gordc has joined #openstack-keystone | 21:08 | |
| *** henrynash has joined #openstack-keystone | 21:08 | |
| *** ayoung has joined #openstack-keystone | 21:08 | |
| *** haneef__ has joined #openstack-keystone | 21:08 | |
| *** arun__ has joined #openstack-keystone | 21:08 | |
| *** bknudson has joined #openstack-keystone | 21:08 | |
| *** marcoemorais has joined #openstack-keystone | 21:08 | |
| *** mhu has joined #openstack-keystone | 21:08 | |
| *** tellesnobrega has joined #openstack-keystone | 21:08 | |
| *** dstanek has joined #openstack-keystone | 21:08 | |
| *** david-lyle has joined #openstack-keystone | 21:08 | |
| *** uvirtbot has joined #openstack-keystone | 21:08 | |
| *** dickson.freenode.net sets mode: +ovv dolphm stevemar dstanek | 21:08 | |
| morganfainberg | ayoung, heh | 21:08 |
| ayoung | Deprecated group/name - [DEFAULT]/bind_host | 21:09 |
| ayoung | is that how you forced that stuff to the top? | 21:09 |
| dstanek | morganfainberg: thx | 21:09 |
| morganfainberg | ayoung, i think so. | 21:09 |
| morganfainberg | well to indicate deprecated options | 21:10 |
| ayoung | programmming by Voo doo? | 21:10 |
| morganfainberg | ayoung, or.. no | 21:10 |
| morganfainberg | ayoung, i thinkit's just alphabatized? | 21:10 |
| morganfainberg | or the order the options were registered | 21:10 |
| ayoung | that would make more sense | 21:11 |
| ayoung | but within the group.... | 21:11 |
| morganfainberg | ayoung, aye | 21:11 |
| ayoung | Too much messaging creap in there | 21:11 |
| ayoung | crepes | 21:11 |
| morganfainberg | ayoung, it's the order we defined the options | 21:12 |
| ayoung | something smells wrong | 21:12 |
| morganfainberg | ayoung, if the options are registered on import they are there | 21:12 |
| ayoung | not your code...the amount of crap we are putting in the default config file | 21:12 |
| morganfainberg | if we're not actually using the oslo-incubator stuff, we should remove it | 21:12 |
| ayoung | its a 1400 line empty config file.... | 21:12 |
| morganfainberg | ayoung, it covers every option available | 21:13 |
| morganfainberg | with helpstrings and option types | 21:13 |
| morganfainberg | and deprecated alternatives | 21:13 |
| ayoung | our current is 500 lines | 21:13 |
| morganfainberg | ayoung, and our current one is effectively unmaintainable w/ oslo incubator sync | 21:13 |
| morganfainberg | etc | 21:14 |
| ayoung | we are putting too much into one config file | 21:14 |
| ayoung | /etc/keystone/config.d | 21:14 |
| morganfainberg | ayoung, not for icehouse | 21:15 |
| morganfainberg | ayoung, lets do that for J | 21:15 |
| morganfainberg | esp. when we get talking about oslo-incubator namespacing of options (properly) | 21:15 |
| ayoung | keystone probably should not be configuring messaging. We should inherit that from elsewhere....I think this is the cinderblock that breaks the camels back | 21:15 |
| ayoung | I'm OK with that, but I don't want to do this to our poor config file | 21:15 |
| *** dstanek has quit IRC | 21:26 | |
| *** david-lyle has quit IRC | 21:26 | |
| *** uvirtbot has quit IRC | 21:26 | |
| *** marcoemorais has quit IRC | 21:26 | |
| *** tellesnobrega has quit IRC | 21:26 | |
| *** mhu has quit IRC | 21:26 | |
| *** bknudson has quit IRC | 21:26 | |
| *** ayoung has quit IRC | 21:26 | |
| *** d0ugal has quit IRC | 21:26 | |
| *** henrynash has quit IRC | 21:26 | |
| *** browne has quit IRC | 21:26 | |
| *** topol has quit IRC | 21:26 | |
| *** bvandenh has quit IRC | 21:26 | |
| *** koolhead17 has quit IRC | 21:26 | |
| *** haneef__ has quit IRC | 21:26 | |
| *** saju_m has quit IRC | 21:26 | |
| *** nkinder has quit IRC | 21:26 | |
| *** arun__ has quit IRC | 21:26 | |
| *** chmouel has quit IRC | 21:26 | |
| *** gokrokve has quit IRC | 21:26 | |
| *** warpig has quit IRC | 21:26 | |
| *** stevemar has quit IRC | 21:26 | |
| *** YorikSar has quit IRC | 21:26 | |
| *** huats has quit IRC | 21:26 | |
| *** simo has quit IRC | 21:26 | |
| *** gordc has quit IRC | 21:26 | |
| *** lari_ has quit IRC | 21:26 | |
| *** ChanServ has quit IRC | 21:26 | |
| *** morganfainberg has quit IRC | 21:26 | |
| *** dolphm has quit IRC | 21:26 | |
| *** devlaps has quit IRC | 21:26 | |
| *** amerine has quit IRC | 21:26 | |
| *** lbragstad has quit IRC | 21:26 | |
| *** dtroyer has quit IRC | 21:26 | |
| *** Daviey has quit IRC | 21:26 | |
| *** rwsu has quit IRC | 21:26 | |
| *** marekd|away has quit IRC | 21:26 | |
| *** jamielennox|away has quit IRC | 21:26 | |
| *** marcoemorais has joined #openstack-keystone | 21:49 | |
| *** mhu has joined #openstack-keystone | 21:49 | |
| *** dolphm has joined #openstack-keystone | 22:06 | |
| *** leseb has joined #openstack-keystone | 22:06 | |
| *** richm has joined #openstack-keystone | 22:06 | |
| *** gyee has joined #openstack-keystone | 22:06 | |
| *** harlowja has joined #openstack-keystone | 22:06 | |
| *** jamielennox|away has joined #openstack-keystone | 22:06 | |
| *** tellesnobrega1 has joined #openstack-keystone | 22:06 | |
| *** david_lyle has joined #openstack-keystone | 22:06 | |
| *** arunkant has joined #openstack-keystone | 22:06 | |
| *** dstanek has joined #openstack-keystone | 22:06 | |
| *** Daviey has joined #openstack-keystone | 22:06 | |
| *** ChanServ has joined #openstack-keystone | 22:06 | |
| *** lari_ has joined #openstack-keystone | 22:06 | |
| *** huats has joined #openstack-keystone | 22:06 | |
| *** rwsu has joined #openstack-keystone | 22:06 | |
| *** morganfainberg has joined #openstack-keystone | 22:06 | |
| *** dickson.freenode.net sets mode: +ovoo dolphm dstanek ChanServ morganfainberg | 22:06 | |
| *** nkinder has joined #openstack-keystone | 22:06 | |
| *** marekd|away has joined #openstack-keystone | 22:06 | |
| *** koolhead17 has joined #openstack-keystone | 22:06 | |
| *** dtroyer has joined #openstack-keystone | 22:06 | |
| *** simo has joined #openstack-keystone | 22:06 | |
| *** chmouel has joined #openstack-keystone | 22:06 | |
| *** lbragstad has joined #openstack-keystone | 22:06 | |
| *** bvandenh has joined #openstack-keystone | 22:06 | |
| *** amerine has joined #openstack-keystone | 22:06 | |
| *** d0ugal has joined #openstack-keystone | 22:06 | |
| *** YorikSar has joined #openstack-keystone | 22:06 | |
| *** stevemar has joined #openstack-keystone | 22:06 | |
| *** devlaps has joined #openstack-keystone | 22:06 | |
| *** warpig has joined #openstack-keystone | 22:06 | |
| *** browne has joined #openstack-keystone | 22:06 | |
| *** henrynash has joined #openstack-keystone | 22:06 | |
| *** ayoung has joined #openstack-keystone | 22:06 | |
| *** haneef__ has joined #openstack-keystone | 22:06 | |
| *** dickson.freenode.net sets mode: +vv morganfainberg stevemar | 22:06 | |
| richm | so that means all of the test_backend_ldap tests that do CRUD should be skipped? | 22:08 |
| *** david_lyle has quit IRC | 22:08 | |
| nkinder | ayoung: what's your take on the above about keystone writing to LDAP? ^^^ | 22:10 |
| *** bknudson has joined #openstack-keystone | 22:10 | |
| nkinder | ah, bknudson is back | 22:10 |
| richm | CUD, rather | 22:10 |
| nkinder | bknudson: I was just reading your comments about LDAP and writes. | 22:10 |
| nkinder | The fact is, Keystone can write to LDAP (even if most deployments might not allow that) | 22:11 |
| bknudson | so we need to fetch the schema and validate all the input matches the schema and massage it somehow? | 22:11 |
| nkinder | I don't see why we wouldn't want to avoid an attempt to store an empty value | 22:12 |
| nkinder | bknudson: what use case is there for ever storing an empty string as an attribute value? | 22:12 |
| nkinder | what *keystone* use case that is | 22:12 |
| bknudson | I assume we store the empty string in sql? | 22:12 |
| nkinder | not sure, but what's the use case there too? | 22:12 |
| bknudson | I don't think anyone has ever asked or would require that an empty string be treated differently than no value. | 22:15 |
| ayoung | nkinder, I was discussing that with richm before. My view ir pretty much aligned with bknudson on this. LDAP in read/write is in use, but it is minimal. If we can find a way to support hte Flasy vlaues that is clean, we should, but if we can't it is OK to say "Sorry Dave, I can;t do that." | 22:15 |
| richm | That is, what does it _mean_ to have an empty field? | 22:15 |
| ayoung | richm, I assume the most common case is to remove a description that is erroneous | 22:16 |
| richm | For example, what does it mean to have a description with the value of ''? | 22:16 |
| ayoung | names can't be blank, email is questionable whether it should be | 22:16 |
| nkinder | ayoung: so anyone using the keystone API needs to know what we allow and don't (depending on the backend driver that is used)? | 22:16 |
| richm | ayoung: ok, that case is fine | 22:16 |
| richm | In that case, ldap would simply remove the description | 22:17 |
| richm | from the entry | 22:17 |
| nkinder | In this case, Horizon is setting an empty description. Does horizon know if it's LDAP or SQL that's being used? | 22:17 |
| bknudson | horizon shouldn't be sending the empty string unless that's what they want stored. | 22:17 |
| bknudson | if they don't want an empty string stored then don't send an empty string | 22:17 |
| richm | But why would they want to store that and be able to retrieve that value? | 22:17 |
| nkinder | but sql very likely allows it | 22:17 |
| richm | the problem comes from when they retrieve the value | 22:18 |
| ayoung | richm, so if it is a create, just don't add the field. If it is an update, and it comes in blank, we would need to remove the attribute. I thought that logic was there already, but maybe it was just something we discussed in the past | 22:18 |
| richm | and expect the value to be the empty string '' | 22:18 |
| *** dolphm is now known as dolphm_503 | 22:18 | |
| richm | ayoung: there is some CU logic there already | 22:18 |
| richm | it is incomplete | 22:18 |
| ayoung | Colorado University? | 22:18 |
| nkinder | I would expect out LDAP drivers to know what is/is-not OK from an LDAP standpoint and deal with the details. | 22:18 |
| richm | my proposed fix completes (Create Update) | 22:18 |
| nkinder | create update | 22:18 |
| ayoung | ah | 22:18 |
| nkinder | ayoung: you added that I believe | 22:19 |
| richm | but the problem is reading | 22:19 |
| ayoung | CUte | 22:19 |
| richm | if a client expects to be able to read that attribute, and expects the value to be '' | 22:19 |
| nkinder | ayoung: create user and project methods check for an empty description and pop it before sending to LDAP | 22:19 |
| nkinder | update does not perform this check | 22:19 |
| ayoung | the set of attributes of an object are pretty much fixed. There is the "extra' thing which is kindof a blight | 22:19 |
| bknudson | update should be consistent with create | 22:20 |
| nkinder | bknudson: yes, agreed | 22:20 |
| ayoung | nkinder, and if there is a value there, we need to del_attr it as well | 22:20 |
| richm | If the set of attributes is very fixed, then we could simply add that attribute with a value of '' if it is not present in the entry upon a read operation | 22:20 |
| nkinder | ayoung: yes, that's what richm added | 22:20 |
| ayoung | nkinder, yep...I saw it in the review, just making it poart of the discussion | 22:21 |
| bknudson | the set of attributes isn't fixes... in sql you can add extra attributes | 22:21 |
| richm | another alternative - that attribute is always present in LDAP - deleting it or setting it to '' or None would write a "dummy" value | 22:22 |
| nkinder | seems better to not have it there at all | 22:22 |
| richm | so project['description'] = '' would be translated into LDAP as description: EMPTY | 22:22 |
| *** dolphm_503 has quit IRC | 22:32 | |
| *** bknudson has quit IRC | 22:32 | |
| *** harlowja has quit IRC | 22:32 | |
| *** tellesnobrega1 has quit IRC | 22:33 | |
| *** ayoung has quit IRC | 22:33 | |
| *** richm has quit IRC | 22:33 | |
| *** d0ugal has quit IRC | 22:33 | |
| *** henrynash has quit IRC | 22:33 | |
| *** browne has quit IRC | 22:33 | |
| *** bvandenh has quit IRC | 22:33 | |
| *** koolhead17 has quit IRC | 22:33 | |
| *** gyee has quit IRC | 22:33 | |
| *** arunkant has quit IRC | 22:33 | |
| *** haneef__ has quit IRC | 22:33 | |
| *** nkinder has quit IRC | 22:33 | |
| *** chmouel has quit IRC | 22:33 | |
| *** leseb has quit IRC | 22:33 | |
| *** jamielennox|away has quit IRC | 22:33 | |
| *** warpig has quit IRC | 22:33 | |
| *** stevemar has quit IRC | 22:33 | |
| *** YorikSar has quit IRC | 22:33 | |
| *** huats has quit IRC | 22:33 | |
| *** simo has quit IRC | 22:33 | |
| *** lari_ has quit IRC | 22:33 | |
| *** ChanServ has quit IRC | 22:33 | |
| *** morganfainberg has quit IRC | 22:33 | |
| *** dstanek has quit IRC | 22:33 | |
| *** devlaps has quit IRC | 22:33 | |
| *** amerine has quit IRC | 22:33 | |
| *** lbragstad has quit IRC | 22:33 | |
| *** dtroyer has quit IRC | 22:33 | |
| *** Daviey has quit IRC | 22:33 | |
| *** rwsu has quit IRC | 22:33 | |
| *** marekd|away has quit IRC | 22:33 | |
| *** bknudson has joined #openstack-keystone | 22:37 | |
| *** dolphm_503 has joined #openstack-keystone | 22:37 | |
| *** leseb has joined #openstack-keystone | 22:37 | |
| *** richm has joined #openstack-keystone | 22:37 | |
| *** gyee has joined #openstack-keystone | 22:37 | |
| *** harlowja has joined #openstack-keystone | 22:37 | |
| *** jamielennox|away has joined #openstack-keystone | 22:37 | |
| *** tellesnobrega1 has joined #openstack-keystone | 22:37 | |
| *** arunkant has joined #openstack-keystone | 22:37 | |
| *** dstanek has joined #openstack-keystone | 22:37 | |
| *** Daviey has joined #openstack-keystone | 22:37 | |
| *** ChanServ has joined #openstack-keystone | 22:37 | |
| *** lari_ has joined #openstack-keystone | 22:37 | |
| *** huats has joined #openstack-keystone | 22:37 | |
| *** rwsu has joined #openstack-keystone | 22:37 | |
| *** morganfainberg has joined #openstack-keystone | 22:37 | |
| *** dickson.freenode.net sets mode: +ovoo dolphm_503 dstanek ChanServ morganfainberg | 22:37 | |
| *** nkinder has joined #openstack-keystone | 22:37 | |
| *** marekd|away has joined #openstack-keystone | 22:37 | |
| *** koolhead17 has joined #openstack-keystone | 22:37 | |
| *** dtroyer has joined #openstack-keystone | 22:37 | |
| *** simo has joined #openstack-keystone | 22:37 | |
| *** chmouel has joined #openstack-keystone | 22:37 | |
| *** lbragstad has joined #openstack-keystone | 22:37 | |
| *** bvandenh has joined #openstack-keystone | 22:37 | |
| *** amerine has joined #openstack-keystone | 22:37 | |
| *** d0ugal has joined #openstack-keystone | 22:37 | |
| *** YorikSar has joined #openstack-keystone | 22:37 | |
| *** stevemar has joined #openstack-keystone | 22:37 | |
| *** devlaps has joined #openstack-keystone | 22:37 | |
| *** warpig has joined #openstack-keystone | 22:37 | |
| *** browne has joined #openstack-keystone | 22:37 | |
| *** henrynash has joined #openstack-keystone | 22:37 | |
| *** ayoung has joined #openstack-keystone | 22:37 | |
| *** haneef__ has joined #openstack-keystone | 22:37 | |
| *** dickson.freenode.net sets mode: +vv morganfainberg stevemar | 22:37 | |
| morganfainberg | ayoung, hm. i think that is not 100% consistent, but is true in a number of cases | 22:37 |
| ayoung | user object is set in the body of the post message from the client | 22:37 |
| morganfainberg | yeah. | 22:37 |
| ayoung | I'm guessing that we could get a None if we did it direct from Curl... | 22:37 |
| richm | ok | 22:37 |
| morganfainberg | ayoung, likely. | 22:37 |
| richm | take a look at test_backend.py - test_attribute_update | 22:37 |
| richm | this tests expects to be able to set description = None, then update, then search, then compare description == None | 22:37 |
| richm | also to set description = '', then update, then search, then compare description == '' | 22:38 |
| richm | I don't know how this can be supported with an LDAP backend | 22:39 |
| bknudson | you could put a special value into ldap to indicate it's an empty string | 22:39 |
| richm | egads | 22:39 |
| bknudson | I know! | 22:39 |
| richm | I would rather pull my eyeballs out | 22:39 |
| bknudson | it's kind of like the dummy group member | 22:40 |
| richm | yeah - broken groupOfNames | 22:40 |
| stevemar | bknudson, think you can give the saml stuff another review when you're free? im down to just refactoring tests and writing more tests.. | 22:40 |
| bknudson | stevemar: which one? | 22:40 |
| stevemar | bknudson, https://review.openstack.org/#/c/71353/ | 22:40 |
| stevemar | bknudson, theres two more api spec related one: https://review.openstack.org/#/c/74531/ and https://review.openstack.org/#/c/74571/ just stuff we forgot to add in before, no new functions | 22:41 |
| bknudson | stevemar: I haven't looked at it before. | 22:41 |
| bknudson | other than to complain about the title. | 22:41 |
| stevemar | bknudson, yes, once, patch 16, to complain about the title | 22:42 |
| stevemar | we need the bknudson seal of approval | 22:43 |
| stevemar | ayoung and dolph have already chimed in a bunch | 22:43 |
| ayoung | bknudson, blank or non-existant value becomes '' | 22:44 |
| richm | I think the only way to make test_attribute_update pass with LDAP backend is to write "special" values in LDAP - description = '' is description: EMPTY and description = None is description: None | 22:44 |
| ayoung | richm, nah, | 22:44 |
| ayoung | we chose one of those rules and say that it applies to LDAP | 22:45 |
| ayoung | either None or '' but not both | 22:45 |
| ayoung | I'm ok with the UI friendly approach of '' | 22:45 |
| *** mhu has quit IRC | 22:46 | |
| *** marcoemorais has quit IRC | 22:46 | |
| *** bknudson has quit IRC | 22:46 | |
| *** harlowja has quit IRC | 22:46 | |
| *** dolphm_503 has quit IRC | 22:46 | |
| *** tellesnobrega1 has quit IRC | 22:46 | |
| *** ayoung has quit IRC | 22:46 | |
| *** richm has quit IRC | 22:46 | |
| *** d0ugal has quit IRC | 22:46 | |
| *** henrynash has quit IRC | 22:46 | |
| *** browne has quit IRC | 22:46 | |
| *** bvandenh has quit IRC | 22:46 | |
| *** koolhead17 has quit IRC | 22:46 | |
| *** gyee has quit IRC | 22:46 | |
| *** arunkant has quit IRC | 22:46 | |
| *** haneef__ has quit IRC | 22:46 | |
| *** nkinder has quit IRC | 22:46 | |
| *** chmouel has quit IRC | 22:46 | |
| *** leseb has quit IRC | 22:46 | |
| *** jamielennox|away has quit IRC | 22:46 | |
| *** warpig has quit IRC | 22:46 | |
| *** stevemar has quit IRC | 22:46 | |
| *** YorikSar has quit IRC | 22:46 | |
| *** huats has quit IRC | 22:46 | |
| *** simo has quit IRC | 22:46 | |
| *** lari_ has quit IRC | 22:46 | |
| *** ChanServ has quit IRC | 22:46 | |
| *** morganfainberg has quit IRC | 22:46 | |
| *** dstanek has quit IRC | 22:46 | |
| *** devlaps has quit IRC | 22:46 | |
| *** amerine has quit IRC | 22:46 | |
| *** lbragstad has quit IRC | 22:46 | |
| *** dtroyer has quit IRC | 22:46 | |
| *** Daviey has quit IRC | 22:46 | |
| *** rwsu has quit IRC | 22:46 | |
| *** marekd|away has quit IRC | 22:46 | |
| *** marcoemorais has joined #openstack-keystone | 22:48 | |
| *** mhu has joined #openstack-keystone | 22:48 | |
| *** bknudson has joined #openstack-keystone | 22:48 | |
| *** dolphm_503 has joined #openstack-keystone | 22:48 | |
| *** leseb has joined #openstack-keystone | 22:48 | |
| *** richm has joined #openstack-keystone | 22:48 | |
| *** gyee has joined #openstack-keystone | 22:48 | |
| *** harlowja has joined #openstack-keystone | 22:48 | |
| *** jamielennox|away has joined #openstack-keystone | 22:48 | |
| *** tellesnobrega1 has joined #openstack-keystone | 22:48 | |
| *** arunkant has joined #openstack-keystone | 22:48 | |
| *** dstanek has joined #openstack-keystone | 22:48 | |
| *** haneef__ has joined #openstack-keystone | 22:48 | |
| *** ayoung has joined #openstack-keystone | 22:48 | |
| *** henrynash has joined #openstack-keystone | 22:48 | |
| *** browne has joined #openstack-keystone | 22:48 | |
| *** warpig has joined #openstack-keystone | 22:48 | |
| *** devlaps has joined #openstack-keystone | 22:48 | |
| *** stevemar has joined #openstack-keystone | 22:48 | |
| *** YorikSar has joined #openstack-keystone | 22:48 | |
| *** d0ugal has joined #openstack-keystone | 22:48 | |
| *** amerine has joined #openstack-keystone | 22:48 | |
| *** bvandenh has joined #openstack-keystone | 22:48 | |
| *** lbragstad has joined #openstack-keystone | 22:48 | |
| *** chmouel has joined #openstack-keystone | 22:48 | |
| *** simo has joined #openstack-keystone | 22:48 | |
| *** dtroyer has joined #openstack-keystone | 22:48 | |
| *** koolhead17 has joined #openstack-keystone | 22:48 | |
| *** marekd|away has joined #openstack-keystone | 22:48 | |
| *** nkinder has joined #openstack-keystone | 22:48 | |
| *** morganfainberg has joined #openstack-keystone | 22:48 | |
| *** dickson.freenode.net sets mode: +ovvo dolphm_503 dstanek stevemar morganfainberg | 22:48 | |
| *** rwsu has joined #openstack-keystone | 22:48 | |
| *** huats has joined #openstack-keystone | 22:48 | |
| *** lari_ has joined #openstack-keystone | 22:48 | |
| *** ChanServ has joined #openstack-keystone | 22:48 | |
| *** Daviey has joined #openstack-keystone | 22:48 | |
| *** dickson.freenode.net sets mode: +vo morganfainberg ChanServ | 22:48 | |
| ayoung | richm, which do you think is less surprising? None or ''? | 22:48 |
| richm | I guess it doesn't matter to me - it's really what is "least astonishing" for clients | 22:48 |
| richm | Apply the principle of least astonishment | 22:48 |
| nkinder | ayoung, richm: The CLI currently won't show description if one isn't set. I expect that is because it finds None | 22:51 |
| nkinder | If we add '', then the description field may always show up when you run "keystone user-find" | 22:52 |
| nkinder | I don't really care either way, but just a point to keep in mind | 22:52 |
| richm | so, None then | 22:52 |
| *** stevemar has quit IRC | 22:52 | |
| ayoung | sure. all decisions are whimsical. arbitrary. and final | 22:52 |
| *** arborism has quit IRC | 22:57 | |
| *** jamielennox|away is now known as jamielennox | 23:04 | |
| *** ChanServ sets mode: +v jamielennox | 23:04 | |
| morganfainberg | ayoung, motion to deprecate whimsical decisions in K. | 23:05 |
| ayoung | Denied | 23:05 |
| morganfainberg | ayoung, damn | 23:05 |
| ayoung | All decisions are whimsical, arbitrary, and final. Including this one. | 23:06 |
| morganfainberg | ayoung, suuuuure | 23:06 |
| richm | btw, when running the liveldap tests - I have to set the ldap password in backend_liveldap.conf - is there some way to pass in the password to use without having to touch some file known to git? | 23:09 |
| richm | e.g. KEYSTONE_LDAP_PASSWORD=password nosetests . . . | 23:10 |
| nkinder | richm: that, or point it to an alternate config file since you might want to use different suffixes, etc. | 23:14 |
| richm | the config files seem to be hard coded in _ldap_livetest | 23:14 |
| richm | _set_config() | 23:14 |
| ayoung | richm, what we really need is SASL config so we can use Kerberos when talking to LDAP | 23:15 |
| ayoung | :) | 23:15 |
| ayoung | richm, yes, the assumption is that the LDAP server was setup using devstack | 23:15 |
| ayoung | and that the user took the defaults | 23:15 |
| ayoung | richm, the goal is to get it so that the Live tests are run as part of the Gate, and that means accpeting default passwords etc | 23:16 |
| *** dolphm_503 is now known as dolphm | 23:17 | |
| richm | ok | 23:17 |
| nkinder | richm: it's not a bad change to propose the ability to point it at a different config file though IMHO | 23:19 |
| *** ayoung is now known as ayoung-dinner | 23:20 | |
| richm | it's no big deal, it's just that you have to set the password in a file known to git, which makes commit/rebase/etc. a hassle | 23:20 |
| bknudson | richm: git update-index --assume-unchanged path/to/file.txt | 23:34 |
| richm | bknudson: thanks! | 23:35 |
| morganfainberg | dolphm, dstanek, auto_gen_config updated w/ bug references. | 23:40 |
| dolphm | morganfainberg: thanks! | 23:41 |
| *** devlaps has quit IRC | 23:41 | |
| dstanek | morganfainberg: nice, i'll take a look after dinner | 23:41 |
| morganfainberg | dolphm, i have a few more test cases for KVS to get in, but i'm going to aim to land those later on, since they should have 0 effect on any runtime code. | 23:42 |
| morganfainberg | dolphm, going to go glare at SQL stuff. | 23:42 |
| morganfainberg | see if i can chase down that ipv6 thing and the with_lockmode races | 23:42 |
| dolphm | morganfainberg: sounds good | 23:42 |
| morganfainberg | dolphm, i can almost see the light at the end of I3... almost | 23:42 |
| dolphm | we're actually starting to have a digestible number of open reviews in support of blueprints | 23:46 |
| morganfainberg | dolphm, ++ yep | 23:47 |
| dolphm | i think it was like 24 on monday; pretty sure we're under 10 now, if you don't count the ones gating | 23:48 |
| *** devlaps has joined #openstack-keystone | 23:48 | |
| dolphm | although the 3 saml-id ones are also a single patch now | 23:48 |
| *** dolphm is now known as dolphm_503 | 23:51 | |
| *** mfisch has joined #openstack-keystone | 23:52 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!