| *** bknudson has quit IRC | 00:00 | |
| *** dstanek has quit IRC | 00:00 | |
| *** bknudson has joined #openstack-keystone | 00:01 | |
| *** dstanek has joined #openstack-keystone | 00:12 | |
| *** ChanServ sets mode: +v dstanek | 00:12 | |
| *** arunkant has quit IRC | 00:15 | |
| *** browne has quit IRC | 00:23 | |
| *** leseb has quit IRC | 00:36 | |
| *** lbragstad1 has joined #openstack-keystone | 00:47 | |
| *** amerine_ has joined #openstack-keystone | 00:50 | |
| *** amerine has quit IRC | 00:55 | |
| *** lbragstad has quit IRC | 00:55 | |
| *** dtroyer has quit IRC | 00:55 | |
| *** Daviey has quit IRC | 00:55 | |
| *** amerine_ is now known as amerine | 00:56 | |
| *** Daviey has joined #openstack-keystone | 00:57 | |
| *** dtroyer has joined #openstack-keystone | 00:57 | |
| *** dtroyer has quit IRC | 01:02 | |
| *** dtroyer has joined #openstack-keystone | 01:02 | |
| *** ayoung-dinner is now known as ayoung | 01:42 | |
| *** leseb has joined #openstack-keystone | 01:47 | |
| *** leseb has quit IRC | 01:52 | |
| ayoung | Sphinx: "because PEP8 wasn't anal-retentive enough" | 01:54 |
|---|---|---|
| *** marcoemorais has quit IRC | 02:05 | |
| *** marcoemorais has joined #openstack-keystone | 02:05 | |
| *** marcoemorais has quit IRC | 02:05 | |
| jamielennox | can we stick to 6 monthly client releases as well - backwards compat is a PITA | 02:14 |
| ayoung | Sure | 02:21 |
| mfisch | ayoung: I'm working on the bug to limit the LDAP search results and had a question if you're around | 02:23 |
| ayoung | mfisch, just make sure that it works with all LDAP servers | 02:23 |
| ayoung | heh | 02:23 |
| ayoung | mfisch, its just "limit X offset Y" no? | 02:23 |
| mfisch | ayoung: that will be a challenge, but I can try AD and FreeIPA | 02:23 |
| ayoung | Heh | 02:23 |
| mfisch | ayoung: there's a parameter you can pass to search_ext, I have it working, but my issue is the unit test I wrote | 02:24 |
| ayoung | OpenLDAP and you have the trifecta | 02:24 |
| mfisch | the unit test doesn't function | 02:24 |
| ayoung | mfisch, Oy, I am well aware | 02:24 |
| mfisch | and I'm at a loss on how one debugs it, pdb isn't working | 02:24 |
| ayoung | ah...there I can help | 02:24 |
| mfisch | this is a new unit test I wrote | 02:24 |
| ayoung | pdb is not working because of eventlet | 02:24 |
| ayoung | run with an env var that tells eventlet not to monkeypatch thread: | 02:25 |
| ayoung | STANDARD_THREADS=True | 02:25 |
| ayoung | export that before you run pdb and breakpoints should start working | 02:25 |
| dstanek | morganfainberg: any reason why https://review.openstack.org/75284 is a bad idea? | 02:27 |
| morganfainberg | hmm | 02:27 |
| morganfainberg | not really sure. | 02:27 |
| morganfainberg | likely it isn't a bad idea | 02:27 |
| morganfainberg | dstanek, nothing sticks out unless pep8 suddenly requires like py33 and something else using venv doesn't | 02:28 |
| morganfainberg | ;) | 02:28 |
| dstanek | we can worry about that in 5-10 years :P | 02:28 |
| morganfainberg | LOL | 02:29 |
| mfisch | is there a trick to get pdb working? pdb.set_trace() throws a BdbQuit exception | 02:29 |
| dstanek | mfisch: how are you running the tests? | 02:29 |
| dstanek | mfisch: i'm pretty sure that testr still doesn't support running pdb - try using nosetests (you'll have to pip install it into your virtualenv) | 02:33 |
| dstanek | i swear i added something to make this easier | 02:33 |
| dstanek | mfisch: ah yes, 'tox -e debug' | 02:34 |
| dstanek | morganfainberg: you around? | 02:37 |
| morganfainberg | dstanek, no :P | 02:37 |
| dstanek | what happens when you go here https://review.openstack.org/#/c/72808/13/etc/keystone.conf.sample? | 02:37 |
| morganfainberg | yrah | 02:37 |
| morganfainberg | it's known | 02:37 |
| morganfainberg | massive review | 02:37 |
| dstanek | :-) | 02:38 |
| morganfainberg | dstanek, infra says gerrit just can't do the in-line comparisons because it's too big a changeset | 02:38 |
| morganfainberg | dstanek, jeblair looked at it | 02:38 |
| ayoung | https://www.openstack.org/vote-atlanta/Presentation/openstack-security-crunchy-on-the-outside-with-a-chewy-center | 02:40 |
| ayoung | VOTE FOR NATE AND ROB! | 02:40 |
| ayoung | and yes, they stole that quote from me. Who stole it from The Far Side | 02:41 |
| morganfainberg | dolphm_503. https://bugs.launchpad.net/keystone/+bug/1275615 - incomplte | 02:43 |
| morganfainberg | incomplete* | 02:43 |
| *** gokrokve has joined #openstack-keystone | 02:43 | |
| morganfainberg | can't repro bug 1275615 , it seems to work every time... but i can't get the alpha ubuntu lts to install in a VM to test that exact scenario | 02:44 |
| * morganfainberg is sad uvirtbot is not here | 02:44 | |
| dstanek | morganfainberg: it would be nice if the reporter could setup a temp VM that's in a bad state | 02:47 |
| mfisch | dstanek: thanks for the hints, my client died but my logger caught them, will give that a try | 02:47 |
| morganfainberg | dstanek, yeah | 02:47 |
| dstanek | mfisch: np | 02:47 |
| morganfainberg | dstanek, i'm inclined to say nogo because well alpha ubuntu? | 02:47 |
| mfisch | morganfainberg: 14.04 won't install for you? | 02:50 |
| morganfainberg | mfisch, nope no in vmware fusion | 02:50 |
| morganfainberg | mfisch, well it installs | 02:50 |
| morganfainberg | it wont ever boot | 02:51 |
| *** topol has joined #openstack-keystone | 02:51 | |
| morganfainberg | hangs forever somewhere around the time the gnome logo boots up (or whatever window manager the iso is trying to install) and the VM is locked up, can't escape / go to a console /etc | 02:51 |
| mfisch | ah, desktop 14.04 | 02:51 |
| morganfainberg | mfisch, and server 14.04 isn't exactly easy to get an iso for. | 02:52 |
| morganfainberg | mfisch, at least not that i found. lots of source, no server iso | 02:52 |
| morganfainberg | mfisch, or not one that would download | 02:52 |
| mfisch | looks like it's moved | 02:53 |
| morganfainberg | mfisch, yeah, *shrug* | 02:53 |
| morganfainberg | mfisch, but pip installed versions of the required "things" and it works. all things being equal, this should repro even on the older version (13.10) | 02:53 |
| morganfainberg | if it was actually a ipv6 / sqla / etc problem | 02:54 |
| mfisch | morganfainberg: so you can pull a daily although sounds like you've tried enough: http://cdimage.ubuntu.com/ubuntu-server/daily/current/ | 02:54 |
| morganfainberg | mfisch ah. | 02:54 |
| morganfainberg | mfisch, yeah i really don't think this is a keystone manage / sqla issue | 02:54 |
| morganfainberg | sqla-migrate | 02:54 |
| mfisch | the missing a2 is odd, will ask a colleague in the morning because now I'm curious | 02:55 |
| morganfainberg | yeah | 02:56 |
| morganfainberg | *shrug* i'm not super worried | 02:56 |
| morganfainberg | this is an edge-case of an edge-case i think | 02:57 |
| morganfainberg | mfisch, somehow i think if this was a serious problem we'd have more than just a report for Keystone | 02:58 |
| morganfainberg | mfisch, ;) | 02:58 |
| morganfainberg | we're not doing "magic" | 02:58 |
| mfisch | I beg to differ, I had to wave a wand to get ldap functional | 02:59 |
| mfisch | although those were ldap issues I exorcised and not keystone | 03:00 |
| ayoung | LDAP is magicx | 03:01 |
| ayoung | blackes of majix | 03:02 |
| morganfainberg | ayoung, uhm... | 03:02 |
| ayoung | necoramncy is clean compared to LDAP | 03:02 |
| morganfainberg | ayoung, i wont argue | 03:02 |
| ayoung | necromancy | 03:02 |
| mfisch | absolutely | 03:02 |
| mfisch | speaking of that, ayoung any chance this lands for I? https://bugs.launchpad.net/keystone/+bug/1231488 | 03:02 |
| ayoung | http://adam.younglogic.com/2008/08/openldap-api-is-somewhat-hostile/ was one of my earliest blog posts...and I stand by it | 03:03 |
| morganfainberg | dstanek, https://review.openstack.org/#/c/72026/18/keystone/common/cache/backends/mongo.py am i crazy or line 395 comment, how is meth_kwargs being set on that object. it seems like it's only ever set on line 261 which is a totally different object class that doesn't propagate | 03:03 |
| ayoung | mfisch, first I need to vent | 03:03 |
| ayoung | AAAAAAAAAAAA | 03:03 |
| morganfainberg | dstanek, i feel.. like i might be going insane | 03:03 |
| ayoung | Nothing quite like having a patch not merge because someone submitted a refactoring cleanup that just/......AAAAAAA! | 03:03 |
| mfisch | ayoung: I spent an hour last night trying ldap.OPT_SIZELIMIT only to discover it's epically useless | 03:03 |
| morganfainberg | dstanek, i hope he collapses that down into something a bit more straightforward, though, i don't think it's that maintainable | 03:03 |
| morganfainberg | dstanek as is | 03:03 |
| morganfainberg | dstanek, hard to understand the code because of the extra object abstraction | 03:04 |
| ayoung | mfisch, talk with nkinder and richm as they are LDAP Experts. | 03:04 |
| ayoung | They've been on 389 since it was called something else | 03:04 |
| morganfainberg | ayoung, so i just heard you say you're an LDAP expert >.> | 03:04 |
| morganfainberg | ayoung, :P | 03:04 |
| ayoung | morganfainberg, if by expert you mean "someone that knows more than you...." | 03:04 |
| dstanek | morganfainberg: look on line 295 | 03:04 |
| mfisch | ayoung's blog posts are what comes up when you google for freeIPA/Keystone | 03:04 |
| morganfainberg | dstanek, oh god | 03:04 |
| * ayoung is a kosher ham | 03:04 | |
| morganfainberg | dstanek, i see it now. but GAH | 03:05 |
| nkinder | what's up with sizelimits? | 03:05 |
| dstanek | morganfainberg: he is trying so hard not to listen to me :-) | 03:05 |
| mfisch | nkinder: I'm finishing up some work on them, just discovering some annoyances in the process | 03:05 |
| ayoung | -2 and move on dstanek | 03:05 |
| nkinder | if you're talking about LDAP client side sizelimits, it won't override any server limits | 03:05 |
| mfisch | nkinder: yes, thats right | 03:05 |
| morganfainberg | dstanek, yeah i think he's going to collapse it down, it just is .. a bit all over now. it looks like it does a decent implementation just will be hard to maintain | 03:06 |
| ayoung | nkinder, did you vote for your own talk yet? | 03:06 |
| morganfainberg | ayoung, -2 thats a feature | 03:06 |
| ayoung | https://www.openstack.org/vote-atlanta/Presentation/openstack-security-crunchy-on-the-outside-with-a-chewy-center | 03:06 |
| dstanek | morganfainberg: yeah, generally speaking it look quite goot | 03:06 |
| dstanek | or good | 03:06 |
| ayoung | -2 "Not on my watch" | 03:06 |
| dstanek | ayoung: i'm saving the nuke for later | 03:06 |
| nkinder | ayoung: I think so... | 03:06 |
| nkinder | voted for a bunch of stuff this morning | 03:07 |
| ayoung | Mongo only pawn in game of Keystone | 03:07 |
| nkinder | ayoung: writing up a preso on KDS right now actually | 03:07 |
| morganfainberg | nkinder, i would tell you if i voted ot not, but the voting system is the same (personal opinion) trainwreck it was last summit | 03:07 |
| dstanek | morganfainberg: the test suite worries me a little bit because it's reimplementation of Mongo | 03:07 |
| nkinder | morganfainberg: 3 stars for everything! | 03:07 |
| mfisch | the votes are just opinion right? not binding | 03:07 |
| morganfainberg | dstanek, i think that is because we don't have the mockmongo package in global reqs | 03:07 |
| dstanek | when i started reading throught it in my ming i head, "NOT IT!" | 03:07 |
| morganfainberg | nkinder, pretty much. | 03:07 |
| mfisch | I thought | 03:07 |
| *** lbragstad1 has quit IRC | 03:08 | |
| dstanek | wow i can't type | 03:08 |
| morganfainberg | nkinder, basically they need an index by company, by topic, and overall index that shows which ones i voted on... cause search is a poor substitute to an at-a-glance overview | 03:08 |
| mfisch | search by presenter didnt seem to work | 03:08 |
| dstanek | morganfainberg: when i started reading through it in my mind i heard, "NOT IT" | 03:08 |
| ayoung | Copyright 2014 Hewlett-Packard Development Company, L.P.? WHat is an LP? I thought it was kind of record. Is the Howling Patchderm really an LLP? | 03:09 |
| nkinder | morganfainberg: but it brings up random talks after every vote! Surely that makes up for a poor search interface. | 03:09 |
| ayoung | nkinder, intentional | 03:09 |
| morganfainberg | nkinder, but apparently that feedback wasn't loud enough (or often enough) from HK | 03:09 |
| ayoung | they are trying to annoy everyone equally | 03:09 |
| mfisch | ayoung: that entity is what holds all of HP's patents/IP | 03:09 |
| morganfainberg | ayoung, basically it is likely to make me not vote except for talks someone explicitly hands links to me for | 03:09 |
| ayoung | morganfainberg, that is what I am doing anyway | 03:09 |
| ayoung | don't want to dilute my votes...maybe I'll go through and One star a few though | 03:10 |
| nkinder | mfisch: so are you stuck on anything with LDAP at the moment, or you were just beating your head against the wall yesterday (and have since knocked the wall down)? | 03:10 |
| morganfainberg | ayoung, if there was an overview i'd spend time on it, but eh, i'kll be in dev sessions | 03:10 |
| mfisch | nkinder: I'm good for now, just need to get my unit test working | 03:10 |
| dstanek | morganfainberg: really small comment on https://review.openstack.org/#/c/72808/ | 03:10 |
| morganfainberg | ayoung, maybe i'll 1 start vote everything | 03:10 |
| ayoung | Yeah. and maybe a few that I have a personal stake in like ^^ and the Moc | 03:10 |
| mfisch | nkinder: you can get your red pen ready for my review | 03:10 |
| nkinder | heh | 03:11 |
| morganfainberg | dstanek, shouldn't be comma separated it's ENV variable | 03:11 |
| morganfainberg | space separated | 03:11 |
| morganfainberg | did i comma separate it? | 03:11 |
| ayoung | https://review.openstack.org/#/c/69593/ was a mistake | 03:12 |
| dstanek | morganfainberg: no, there is only one entry in there with instructions to add more | 03:12 |
| morganfainberg | dstanek, there are two entries | 03:12 |
| ayoung | OK, done venting... | 03:12 |
| morganfainberg | in the LIB line | 03:12 |
| morganfainberg | sure i'll specify what to change | 03:12 |
| *** devlaps has quit IRC | 03:12 | |
| dstanek | LIB line? | 03:13 |
| morganfainberg | dstanek, https://github.com/openstack/keystone/blob/master/tools/config/oslo.config.generator.rc#L1 | 03:13 |
| morganfainberg | dstanek, there are two entries in the ENV variable | 03:13 |
| morganfainberg | keystone and oslo.messaging | 03:13 |
| morganfainberg | dstanek, it's loaded from .sh files :P | 03:14 |
| dstanek | morganfainberg: ah, i read that as keystone. | 03:14 |
| morganfainberg | ah nope :) | 03:14 |
| dstanek | i may just be too tired for reviews tonight... | 03:14 |
| dstanek | morganfainberg: maybe a comment in the .rc file would be enough | 03:15 |
| morganfainberg | dstanek, hm.. sure | 03:15 |
| dstanek | '# a space separated list of package that use oslo.config' or something | 03:15 |
| *** marcoemorais has joined #openstack-keystone | 03:17 | |
| morganfainberg | dstanek, http://paste.openstack.org/show/67845/ | 03:17 |
| morganfainberg | dstanek, ? | 03:18 |
| dstanek | morganfainberg: love it! thanks | 03:19 |
| morganfainberg | dstanek, https://review.openstack.org/#/c/75284/ rebase clicky | 03:20 |
| *** marcoemorais has quit IRC | 03:21 | |
| *** sudorandom has joined #openstack-keystone | 03:23 | |
| mfisch | dstanek: when I tried tox -e debug, I get an error about a missing debug_helper.sh, any idea what that is? | 03:24 |
| mfisch | hmm I think I might know what it is, let me try | 03:24 |
| *** dolphm_503 is now known as dolphm | 03:25 | |
| morganfainberg | dstanek, https://review.openstack.org/#/c/73895/ | 03:25 |
| morganfainberg | dstanek, if that goes in, a lot of misc options disappear from the sample config | 03:25 |
| morganfainberg | dstanek, which would be good™ | 03:26 |
| dstanek | morganfainberg: nice, i'll take a look | 03:26 |
| dstanek | mfisch: hmmm...it exists in your tools directory? | 03:27 |
| *** david-lyle has joined #openstack-keystone | 03:31 | |
| dstanek | mfisch: i just tried and it seemed to work ok | 03:34 |
| *** dolphm is now known as dolphm_503 | 03:34 | |
| *** gyee has quit IRC | 03:40 | |
| *** richm has quit IRC | 03:43 | |
| *** harlowja is now known as harlowja_away | 03:45 | |
| mfisch | dstanek: its working, was my issue | 03:47 |
| *** dstanek has quit IRC | 03:50 | |
| *** KanagarajM_ has joined #openstack-keystone | 03:54 | |
| *** dstanek has joined #openstack-keystone | 03:54 | |
| *** ChanServ sets mode: +v dstanek | 03:54 | |
| *** dolphm_503 is now known as dolphm | 04:03 | |
| *** dolphm is now known as dolphm_503 | 04:13 | |
| *** dstanek has quit IRC | 04:25 | |
| *** dolphm_503 is now known as dolphm | 04:25 | |
| mfisch | my test is failing because its hitting the cache and not ldap | 04:33 |
| *** dolphm is now known as dolphm_503 | 04:35 | |
| ayoung | mfisch, direct cache frustrations at morganfainberg | 04:53 |
| mfisch | well it was deeper than that, my test needs to live in the _live_ldap test | 04:53 |
| mfisch | looks like that can be run against a real server | 04:53 |
| *** dstanek has joined #openstack-keystone | 04:54 | |
| *** ChanServ sets mode: +v dstanek | 04:54 | |
| jamielennox | anybody here that vaguely understands what i am trying to do with auth plugins? | 05:04 |
| jamielennox | ayoung, bknudson, dstanek, dtroyer, morganfainberg: ^ | 05:05 |
| *** dstanek has quit IRC | 05:07 | |
| jamielennox | if the problem is the 'vaguely understanding' i can walk you through enough to be a sounding board - it's a fairly conceptual problem | 05:09 |
| ayoung | I understand | 05:16 |
| ayoung | the question I thought that was still unresolved was "how do we trigger them" jamielennox | 05:16 |
| jamielennox | ayoung: trigger? | 05:16 |
| jamielennox | ayoung: the problem i have at the moment is that i want the session to be responsible for the service catalog | 05:17 |
| jamielennox | so no more does each client parse it and figure out its base_url and then start making requests | 05:17 |
| jamielennox | you just say i want path='/users', service_type="identity", version=(3,0) | 05:17 |
| ayoung | yay! | 05:18 |
| jamielennox | i also want to keep the auth plugins REALLY basic | 05:18 |
| ayoung | jamielennox, by trigger I meant "try x509" or "kerberos" instead of Password | 05:18 |
| jamielennox | so if you were to write a plugin that was not for keystone it would work | 05:19 |
| jamielennox | i want no real required knowledge of a plugin | 05:19 |
| jamielennox | the problem i have is when the path contains information that is relative to something in the token | 05:20 |
| jamielennox | e.g. /users/%(user_id)/roles | 05:20 |
| ayoung | AHHHHHH EVERYTHING HAS CHANGED WITH SQL! | 05:20 |
| jamielennox | (i'm pretty sure that's not a real path) | 05:21 |
| ayoung | the ones I saw had tenant in there | 05:21 |
| jamielennox | everything with SQL? i'm sure i would have heard about that | 05:21 |
| morganfainberg | ayoung, ugh, i think i am almost done solving the issues with moving oslo.messaging options to uhm... [oslo_messaging] config group | 05:21 |
| jamielennox | ayoung: it's not a problem coming from the service_catalog because it will do the replace | 05:21 |
| ayoung | jamielennox, trying toi rebase the sql provide for revoke and a load has changed and it is makeing me cranky | 05:21 |
| morganfainberg | ayoung, this is an ugly changeset :( | 05:21 |
| ayoung | morganfainberg, Keystone is ugly to me tongiht | 05:22 |
| morganfainberg | ayoung, 21 files changed, 198 insertions(+), 137 deletions(-) | 05:22 |
| ayoung | sounds OK | 05:22 |
| morganfainberg | ayoung, i think i have 1 more issue w/ tests to fix. | 05:22 |
| morganfainberg | ayoung, but it's been unfun unravling stevedore errors | 05:22 |
| ayoung | joy | 05:22 |
| morganfainberg | yeah | 05:22 |
| jamielennox | ayoung: keystone is the ugly sister - not pretty but you love her anyway | 05:23 |
| jamielennox | (i'm not sure if that's just wrong) | 05:23 |
| jamielennox | anyway | 05:23 |
| ayoung | jamielennox, wouldn't know about that. My sister has her issues, but she ain't ugly | 05:23 |
| jamielennox | ayoung: ... | 05:24 |
| jamielennox | morganfainberg: i'm sure ayoung just dropped into conversation that he has a hot sister | 05:24 |
| ayoung | mid forties, two kids... | 05:24 |
| morganfainberg | jamielennox, you know... i think tonight is just a night to let that one sit dude. | 05:25 |
| jamielennox | anyway what i came up with is to keep the client needing to know anything about it's auth information is that we could just submit a path with replacements in it | 05:25 |
| morganfainberg | jamielennox, it has been an odd day :P | 05:25 |
| jamielennox | morganfainberg: completely agree | 05:26 |
| ayoung | jamielennox, my kneejerk reaction is we are trying too hard there | 05:26 |
| jamielennox | so you can make a request for /users/%(user_id)/roles and the session will handle it for you | 05:26 |
| *** dolphm_503 is now known as dolphm | 05:26 | |
| jamielennox | ayoung: me too | 05:26 |
| jamielennox | ayoung: at some point here something crosses the line from this is a useful feature, to this is trying to do too much | 05:27 |
| jamielennox | (note that it's not a feature - we need access to this somewhere) | 05:27 |
| ayoung | dolphm_503.... that man Thinks in HTTP | 05:27 |
| jamielennox | because then the problem becomes that i need auth plugins to provide a dictionary so that i can do path % auth_plugin.get_format_kwargs() | 05:28 |
| ayoung | I'll be scare when he changes his nick to dolphm_410 | 05:28 |
| ayoung | too much, I think...why did you end up there? | 05:29 |
| jamielennox | the keys to that dict are essentially part of the stable api, so at which point they might as well be properties on the auth_plugin | 05:30 |
| jamielennox | so some set of user_id, project_id, and some others are required of every plugin | 05:30 |
| jamielennox | that's not unreasonable (i think), but it was part of what i was trying to avoid until i'd fleshed it out a little more | 05:31 |
| jamielennox | and i don't know, the whole thing just seems to have detoured somewhere into something complex | 05:32 |
| ayoung | so...discovery gets us the top level of the url...hostname:port/v3 for the current keystone. From there the auth plugin needs to know how to get the token for the url that you are handing it? | 05:33 |
| *** dstanek has joined #openstack-keystone | 05:34 | |
| *** ChanServ sets mode: +v dstanek | 05:34 | |
| jamielennox | ayoung: i ended up there because a large part of this is supposed to be that a client shouldn't care about it's own auth information - other than that it has some | 05:34 |
| jamielennox | ayoung: yes the plugin has done authentication | 05:34 |
| ayoung | right. and in order to seamlessly authenticate you need to be able to craft the approprate auth request | 05:34 |
| jamielennox | the plugin will also handle getting the endpoint because service_catalog is a part of the token | 05:34 |
| jamielennox | ayoung: no authenticate is fine | 05:35 |
| jamielennox | it's after that in use | 05:35 |
| ayoung | right, so parse the service catalog out of the response and then. select the approprate endpoint based on the service | 05:35 |
| ayoung | why do you need the URL part past there? | 05:35 |
| jamielennox | there are some commands (like change my own password) that require knowledge of the user_id of the current authentication context | 05:35 |
| ayoung | /users/%(user_id)/roles and such? | 05:35 |
| ayoung | ah... | 05:35 |
| ayoung | that is wrong, I think | 05:36 |
| jamielennox | there aren't a lot | 05:36 |
| jamielennox | ++ | 05:36 |
| *** dolphm is now known as dolphm_503 | 05:36 | |
| ayoung | that is beyond the scope of the auth plugin | 05:36 |
| jamielennox | completely agree, anything that requires information from the context should be taken from the token and NOT from the URL | 05:36 |
| ayoung | whatever calls the auth plugin needs to make that call | 05:36 |
| ayoung | client should know the User id | 05:36 |
| jamielennox | i'm not sure of other examples of this yet | 05:37 |
| jamielennox | ayoung: why? | 05:37 |
| ayoung | um...I guess not. Now that I think about it, they probably only know username, and userid comes in the token/response from auth | 05:37 |
| ayoung | which wouldn't be returned in a call into the auth plugin? | 05:38 |
| jamielennox | ayoung: so seperating the client from the authentication | 05:38 |
| ayoung | hmmm | 05:38 |
| jamielennox | why does the client need to know the username? | 05:38 |
| jamielennox | that's purely authentication information | 05:38 |
| ayoung | userid, this case, but any data necessary to craft the urls | 05:38 |
| ayoung | I meant that username was passed in, say from the environment...disregard for now | 05:39 |
| ayoung | jamielennox, will the auth plugin make the token info queryable to the client? | 05:39 |
| jamielennox | ayoung: right, so what i'm coming to is that certain information like user_id has to leak out from the auth plugins to make our situation work | 05:39 |
| jamielennox | ayoung: yes and no | 05:39 |
| jamielennox | i don't want to provide defaults for this stuff | 05:40 |
| jamielennox | there is a subclass of BaseAuthPlugin called IdentityAuthPlugin | 05:40 |
| ayoung | why not cache the body of the token response and make it availalble after authenitaction | 05:40 |
| jamielennox | IdentityAuthPlugin essentially means that you have authenticated against keystone and then you can query from there | 05:41 |
| jamielennox | i think it's relatively fair to say if isinstance(plugin, IdentityAuthPlugin): do stuff | 05:41 |
| jamielennox | i want to allow the case where the token provider is not keystone and may not have all that same information | 05:42 |
| jamielennox | though i think as we are discussing there must be certain fields that each plugin must provide - eg user_id | 05:42 |
| ayoung | jamielennox, I think that is wrong | 05:44 |
| ayoung | token response is part of our domain model | 05:44 |
| ayoung | don't try to abstract it away | 05:44 |
| jamielennox | ayoung: no, i think the information that we provide is part of our domain model | 05:45 |
| jamielennox | ayoung: eg user_id, project_id, domain_id etc | 05:45 |
| ayoung | right...all of that is in the token response | 05:45 |
| jamielennox | everything that auth_token middleware presents to a service | 05:45 |
| jamielennox | so long as auth_token middleware and the auth plugin are in sync then i don't think there is any requirement on our token format | 05:46 |
| ayoung | the body of the response to POST auth/tokens...the data signed inside the token as well ... | 05:46 |
| jamielennox | for example we changed from a v2 token to a v3 token | 05:46 |
| ayoung | except that we have data from it we need to expose to the end user.... | 05:46 |
| ayoung | ugh | 05:46 |
| ayoung | double ugh | 05:46 |
| ayoung | DIE V2 DIE | 05:46 |
| jamielennox | lol, ok but there are already rumours of a v4 token | 05:47 |
| *** dstanek has quit IRC | 05:47 | |
| jamielennox | and we will manage to switch again | 05:47 |
| ayoung | so we would need a client side analogue to the TokenProvider conversion code | 05:47 |
| ayoung | Jumping right to v6 | 05:47 |
| jamielennox | pretty much yea | 05:47 |
| jamielennox | we have a requirement of certain information that will be transmitted in a token | 05:48 |
| ayoung | <whingey_luke>You ask the Impossible.</whingey_luke> | 05:48 |
| jamielennox | we have published formats how that happens | 05:48 |
| jamielennox | there is nothing i can see that prevents someone coming up with another | 05:48 |
| jamielennox | (gyee got really excited at the idea) | 05:48 |
| ayoung | token version....will match the version requested of the session, though, no? | 05:48 |
| ayoung | he would | 05:48 |
| jamielennox | ayoung: not necessarily | 05:49 |
| jamielennox | we already allow using v2 tokens on v3 services and vice versa | 05:49 |
| *** dstanek has joined #openstack-keystone | 05:49 | |
| *** ChanServ sets mode: +v dstanek | 05:49 | |
| ayoung | yeah, but if you ask for a v2 session, it is going to get you a v2 token. You would only get a v3 token on a v3 session. You could pass in a token from the outside, and then you would need to convert, or use the v2 token to get a v3 token | 05:52 |
| jamielennox | you wouldn't need to convert, we support passing an auth_ref to a new client which would work | 05:53 |
| jamielennox | but it will be a lot easier with a plugin model | 05:53 |
| jamielennox | session = Session(v2.Password(user, pass, tenant)) | 05:53 |
| jamielennox | client = v3.client.Client(session) | 05:54 |
| *** dstanek has quit IRC | 05:54 | |
| ayoung | if the auth_ref was created with a v2 token, and you passed it to a new client requesting a v3 session, you would need to convert if the rule were: token should match the version on the session | 05:55 |
| jamielennox | ayoung: we very specifically do not have that rule | 05:56 |
| ayoung | token data format, that is... | 05:56 |
| ayoung | yeah, and thus we don't have access to some of the most basic data we need, as you pointed out | 05:56 |
| jamielennox | from what i can see the only thing in client that is needed is user_id | 05:56 |
| jamielennox | which IMO we should have had a /user route that handled operations for the current user | 05:57 |
| ayoung | yeah... | 05:58 |
| jamielennox | it would almost be a pure redirect from /user -> /users/%(my_id)s | 05:58 |
| ayoung | but we also don't know the project info if they had default set | 05:58 |
| jamielennox | hmmm, that would actually be fairly easy | 05:58 |
| ayoung | yeah, that would be | 05:58 |
| jamielennox | ayoung: from what i can see in client there is nothing that requires the project_id you are scoped to to be used as part of the path | 05:59 |
| jamielennox | i wonder if other services do though | 05:59 |
| ayoung | pretty sure that nova does | 06:01 |
| jamielennox | this was how i got to allowing POST /projects/%(project_id)s/images or whatever replacements | 06:02 |
| ayoung | yep | 06:02 |
| ayoung | nova could doa redirect, too | 06:02 |
| jamielennox | ayoung: it's more correct IMO even for rest | 06:03 |
| jamielennox | anyway - i guess for now i mandate user_id, leave everything else for as required | 06:03 |
| ayoung | jamielennox, how a bout the plugin gives you the token and you pass the token to a helper utility to get user_id...and project id? | 06:05 |
| *** gokrokve has quit IRC | 06:05 | |
| jamielennox | this was essentially where i started plugin.get_format_kwargs() | 06:06 |
| ayoung | or it always gives if back to you in v3 format, regardless of the form you got it in. A V3 helper a-la the provider code? | 06:06 |
| ayoung | ok...I need to crash. | 06:06 |
| jamielennox | ayoung: yea, it's nearly beers time here - it must be late | 06:07 |
| *** gokrokve has joined #openstack-keystone | 06:12 | |
| *** marcoemorais has joined #openstack-keystone | 06:19 | |
| *** topol has quit IRC | 06:22 | |
| *** dolphm_503 is now known as dolphm | 06:27 | |
| *** gokrokve has quit IRC | 06:30 | |
| *** gokrokve has joined #openstack-keystone | 06:31 | |
| *** gokrokve has quit IRC | 06:35 | |
| *** morganfainberg is now known as morganfainberg_Z | 06:36 | |
| *** saju_m has joined #openstack-keystone | 06:36 | |
| *** dolphm is now known as dolphm_503 | 06:36 | |
| *** dolphm_503 is now known as dolphm | 07:27 | |
| *** gokrokve has joined #openstack-keystone | 07:29 | |
| *** gokrokve_ has joined #openstack-keystone | 07:30 | |
| *** gokrokve has quit IRC | 07:33 | |
| *** gokrokve_ has quit IRC | 07:35 | |
| *** dolphm is now known as dolphm_503 | 07:37 | |
| *** jamielennox is now known as jamielennox|away | 07:44 | |
| *** dstanek has joined #openstack-keystone | 07:51 | |
| *** ChanServ sets mode: +v dstanek | 07:51 | |
| *** dstanek has quit IRC | 07:55 | |
| *** leseb has joined #openstack-keystone | 08:04 | |
| *** marekd|away is now known as marekd | 08:04 | |
| *** dolphm_503 is now known as dolphm | 08:28 | |
| *** saju_m has quit IRC | 08:31 | |
| *** gokrokve has joined #openstack-keystone | 08:31 | |
| *** KanagarajM_ has quit IRC | 08:32 | |
| *** gokrokve has quit IRC | 08:36 | |
| *** dolphm is now known as dolphm_503 | 08:38 | |
| *** saju_m has joined #openstack-keystone | 09:00 | |
| *** saju_m has quit IRC | 09:02 | |
| *** bvandenh has quit IRC | 09:19 | |
| *** saju_m has joined #openstack-keystone | 09:21 | |
| *** dolphm_503 is now known as dolphm | 09:23 | |
| *** chandan_kumar has joined #openstack-keystone | 09:25 | |
| *** bvandenh has joined #openstack-keystone | 09:27 | |
| *** gokrokve has joined #openstack-keystone | 09:29 | |
| *** gokrokve has quit IRC | 09:34 | |
| *** marcoemorais has quit IRC | 09:40 | |
| *** marcoemorais has joined #openstack-keystone | 09:42 | |
| *** marcoemorais has quit IRC | 09:47 | |
| *** warpig has left #openstack-keystone | 09:51 | |
| *** chandan_kumar has quit IRC | 09:51 | |
| *** Kanagaraj has joined #openstack-keystone | 10:00 | |
| *** chandan_kumar has joined #openstack-keystone | 10:05 | |
| *** marcoemorais has joined #openstack-keystone | 10:11 | |
| *** KanagarajM_ has joined #openstack-keystone | 10:13 | |
| *** Kanagaraj has quit IRC | 10:16 | |
| *** marcoemorais has quit IRC | 10:16 | |
| *** chandan_kumar has quit IRC | 10:28 | |
| *** gokrokve has joined #openstack-keystone | 10:29 | |
| *** gokrokve_ has joined #openstack-keystone | 10:31 | |
| *** gokrokve has quit IRC | 10:34 | |
| *** gokrokve_ has quit IRC | 10:36 | |
| *** leseb has quit IRC | 11:00 | |
| *** dolphm is now known as dolphm_503 | 11:03 | |
| *** dolphm_503 is now known as dolphm | 11:03 | |
| *** leseb has joined #openstack-keystone | 11:04 | |
| *** marcoemorais has joined #openstack-keystone | 11:12 | |
| *** KanagarajM_ has quit IRC | 11:15 | |
| *** KanagarajM_ has joined #openstack-keystone | 11:15 | |
| *** marcoemorais has quit IRC | 11:17 | |
| *** leseb has quit IRC | 11:23 | |
| *** dolphm is now known as dolphm_503 | 11:27 | |
| *** gokrokve has joined #openstack-keystone | 11:29 | |
| *** gokrokve has quit IRC | 11:33 | |
| *** KanagarajM_ has quit IRC | 11:45 | |
| *** KanagarajM_ has joined #openstack-keystone | 11:47 | |
| *** dstanek has joined #openstack-keystone | 11:54 | |
| *** ChanServ sets mode: +v dstanek | 11:54 | |
| *** KanagarajM__ has joined #openstack-keystone | 11:58 | |
| *** dstanek has quit IRC | 11:59 | |
| *** leseb has joined #openstack-keystone | 12:00 | |
| *** KanagarajM_ has quit IRC | 12:00 | |
| *** KanagarajM__ has quit IRC | 12:07 | |
| *** marcoemorais has joined #openstack-keystone | 12:13 | |
| *** marcoemorais has quit IRC | 12:17 | |
| *** gokrokve has joined #openstack-keystone | 12:29 | |
| *** gokrokve has quit IRC | 12:34 | |
| *** dolphm_503 is now known as dolphm | 12:49 | |
| *** marcoemorais has joined #openstack-keystone | 13:14 | |
| *** david-lyle has quit IRC | 13:15 | |
| *** marcoemorais has quit IRC | 13:18 | |
| *** leseb has quit IRC | 13:25 | |
| *** gokrokve has joined #openstack-keystone | 13:29 | |
| *** dstanek has joined #openstack-keystone | 13:36 | |
| *** ChanServ sets mode: +v dstanek | 13:36 | |
| *** leseb has joined #openstack-keystone | 13:41 | |
| *** browne has joined #openstack-keystone | 13:53 | |
| *** saju_m has quit IRC | 14:10 | |
| *** leseb has quit IRC | 14:13 | |
| *** nkinder has quit IRC | 14:13 | |
| *** marcoemorais has joined #openstack-keystone | 14:14 | |
| *** marcoemorais has quit IRC | 14:19 | |
| *** leseb has joined #openstack-keystone | 14:22 | |
| *** gokrokve has quit IRC | 14:37 | |
| *** gokrokve has joined #openstack-keystone | 14:39 | |
| *** jagee has joined #openstack-keystone | 14:46 | |
| *** lbragstad has joined #openstack-keystone | 14:57 | |
| *** richm has joined #openstack-keystone | 15:06 | |
| *** nkinder has joined #openstack-keystone | 15:06 | |
| richm | looking at Bug #1282676 Error 500 when trying to set empty description with LDAP | 15:07 |
| richm | I'm having trouble understanding how the mapping of ldap attributes to object properties is supposed to work | 15:07 |
| richm | for example, in class ProjectApi | 15:07 |
| richm | There is the attribute_options_names dict | 15:07 |
| richm | afaict, this is is supposed to map the key (the object property name) to the value (the ldap attribute name) | 15:08 |
| richm | well, not exactly - map the key (the property name) to the value (config file key) that maps to the attribute name. | 15:10 |
| richm | but some of these are just wrong | 15:11 |
| richm | in the sample config file, anyway | 15:12 |
| richm | # tenant_desc_attribute = desc | 15:12 |
| richm | should be = description | 15:12 |
| richm | and there is no "enabled" attribute | 15:13 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n1076 | 15:13 |
| bknudson | it's #tenant_desc_attribute=description now | 15:13 |
| richm | ah, ok | 15:13 |
| richm | I guess I need to do a git pull | 15:13 |
| dolphm | richm: every hour! ;) | 15:13 |
| richm | never mind then - I'll shut up now | 15:14 |
| bknudson | there's also ignored attributes | 15:14 |
| dolphm | bknudson: have you seen https://bugs.launchpad.net/keystone/+bug/1233365 ? | 15:14 |
| bknudson | tenant_attribute_ignore= -- which allows attributes in the tenant to not be mapped or put in ldap. | 15:14 |
| bknudson | dolphm: have I seen it happen? I think someone mentioned it to me once related to an IBM product. | 15:15 |
| *** marcoemorais has joined #openstack-keystone | 15:15 | |
| bknudson | but they weren't using keystone ldap... had their own ldap client impl. | 15:15 |
| dolphm | bknudson: i just meant the bug report, but that works too | 15:15 |
| dolphm | bknudson: based on python-ldap? | 15:15 |
| bknudson | dolphm: yes, and the workaround was essentially to disable referrals | 15:16 |
| dolphm | bknudson: it sounds like there's a patch floating around the ether for that bug, i'm trying to get ahold of it | 15:16 |
| bknudson | dolphm: the proposed fix here of skipping references seems like a good idea. | 15:16 |
| dolphm | bknudson: you mean disable referrals on the AD side? | 15:16 |
| bknudson | it's assigned to ayoung so was kind of ignoring it. | 15:16 |
| dolphm | bknudson: or on the client side? | 15:16 |
| dolphm | bknudson: ayoung just sits on bugs | 15:16 |
| bknudson | dolphm: on the client side. | 15:16 |
| dolphm | bknudson: that's why i have a "Unassigning due to inactivity." script | 15:17 |
| *** marcoemorais has quit IRC | 15:20 | |
| ayoung | assign it to richm | 15:21 |
| ayoung | dolphm, I hatebugs | 15:21 |
| richm | do you use a python IDE? If so, which one? I've been using pydev with eclipse 4.3.0 and it leaves something to be desired | 15:21 |
| ayoung | richm, pycharm is better by far | 15:22 |
| ayoung | I just hadn't gotten used to it before learning eclipse, so I always end up back with eclipse | 15:22 |
| ayoung | but there is a ... special offer? for a pycharm license for openstack developers. | 15:22 |
| ayoung | It is built on Intellij Idea | 15:23 |
| bknudson | pydev works for me... annoying when it adds space after = in arguments. | 15:23 |
| ayoung | the one thing I find frustrating about pycharm is that it doesn't keep multiple projects open at the same time, so if I am switching between python-keystoneclient and keystone I have to dump one for the other | 15:24 |
| ayoung | but pycharms' refactoring and code navigation support outstrips pydev | 15:24 |
| marekd | richm: some of my friends use sublime, you can give it a try. | 15:24 |
| *** lbragstad has quit IRC | 15:25 | |
| ayoung | pycharm has a 30 day trial and then you can search the openstack mailing list for the guy that will hand out the developers licenses | 15:26 |
| richm | pydev is missing a lot of features that I use when using eclipse for C and Java development | 15:26 |
| richm | e.g. can't click on a symbol and have it give me the references to that symbol - can't do a call graph - etc. | 15:27 |
| bknudson | that's because python doesn't know | 15:28 |
| bknudson | too dynamic | 15:28 |
| marekd | ayoung: seriously?! wow. | 15:28 |
| bknudson | this is why you never write complicated applications in python | 15:28 |
| *** lbragstad has joined #openstack-keystone | 15:29 | |
| *** david-lyle has joined #openstack-keystone | 15:29 | |
| * richm thinks keystone is complicated, or at least complex | 15:29 | |
| *** bknudson has quit IRC | 15:29 | |
| ayoung | bknudson, are you actually a Javaphile? | 15:30 |
| ayoung | but even python can do better than pydev does. Pycharm is better, its just that i have a huge body of tests in the memory of pydev...and I periodically wipe out my .settings file | 15:30 |
| ayoung | with a git clean -xdf | 15:30 |
| ayoung | marekd, yeah...they want to get people using it, and have hitched themselves to the Openstack wagon | 15:31 |
| marekd | ayoung: hm, i think i might want to try it, then :-) | 15:32 |
| ayoung | it takes some figuring out, especially with the autogenerated venvs | 15:32 |
| ayoung | marekd, twas morganfainberg that got me to try it. He uses it pretty much exclusively, I think | 15:32 |
| marekd | ayoung: i see. | 15:33 |
| *** bknudson has joined #openstack-keystone | 15:33 | |
| ayoung | marekd, when ever someone says "I see" on IRC I read that as: "Wow, that is the stupidest thing I have heard in a long time." I know you don't mean it that way. | 15:34 |
| richm | ayoung: no, that would be "Wow - cool story bro" | 15:34 |
| marekd | richm: ++ | 15:35 |
| ayoung | richm, that, too. "I see implies" a technical dumbassery and an attempt to keep from cursing in a public forum | 15:35 |
| *** lbragstad has quit IRC | 15:36 | |
| marekd | ayoung: i see :-) No, i didn't mean it. Is it just your impression or everybodys (so i better stop using it, at least on IRC)? | 15:36 |
| ayoung | Just mine | 15:36 |
| * richm likes the term "technical dumbassery" | 15:38 | |
| *** lnxnut has joined #openstack-keystone | 15:43 | |
| *** amcrn has joined #openstack-keystone | 15:53 | |
| *** stevemar has joined #openstack-keystone | 16:01 | |
| *** ChanServ sets mode: +v stevemar | 16:01 | |
| stevemar | marekd, nice refactoring of tests :) | 16:01 |
| marekd | stevemar: thanks :-) | 16:03 |
| stevemar | bknudson, ayoung dolphm morganfainberg_Z https://review.openstack.org/#/c/71353/ is ready for review | 16:09 |
| ayoung | stevemar, we all have PBKRS now | 16:11 |
| ayoung | post-Brant-Knudson-Review-Syndrome | 16:11 |
| ayoung | its where we don't bother to review something that is close to committing before he has gone through and nickled and dimed it to death | 16:11 |
| marekd | LOL | 16:12 |
| stevemar | ayoung, i find that you get used it after a while, and kinda enjoy it | 16:12 |
| ayoung | its flipping AWESOME! | 16:12 |
| bknudson | I'll make time to review https://review.openstack.org/#/c/71353/ . | 16:12 |
| ayoung | edewata was the same way when we were working together on FreeIPA. He was like a human compiler | 16:12 |
| bknudson | stevemar: have you run tox -e cover on it? | 16:12 |
| stevemar | bknudson, not yet, more tests are the only thing on my todo list | 16:13 |
| ayoung | stevemar, do you have some sample SAML assertions to use? | 16:15 |
| ayoung | I realize that we are not actually going to parse them | 16:15 |
| ayoung | feel free to use: http://adam.younglogic.com/resources/adam_example.saml | 16:16 |
| stevemar | ayoung, we inject assertions into the context | 16:16 |
| ayoung | attributes....the assertion is the signed file | 16:16 |
| stevemar | ayoung, sorry, we inject attributes (as they would look like after being parsed by apache modules) into the context | 16:17 |
| marekd | ayoung: this is work for apache. | 16:17 |
| stevemar | marekd, i noticed you got rid of the prefix | 16:18 |
| marekd | stevemar: not me, somebody removed it from the keystone.conf.sample | 16:19 |
| marekd | stevemar: it was in the master, and everybody here wanted to remove that prefix. | 16:19 |
| ayoung | stevemar, I guess what I am asking is are you using the attributes from "real" SAML files? | 16:20 |
| bknudson | stevemar: you're asking me to review untested code? | 16:20 |
| dolphm | marekd: keystone.conf.sample is now dynamically generated | 16:20 |
| bknudson | why should I waste my time on that? | 16:20 |
| *** browne1 has joined #openstack-keystone | 16:21 | |
| stevemar | bknudson, there are tests for it, just didn't run coverage report yet | 16:22 |
| stevemar | bknudson, unless i misunderstood something.. | 16:22 |
| bknudson | stevemar: you said "more tests are the only thing on my todo list" | 16:23 |
| stevemar | more than half the code is in test | 16:23 |
| stevemar | yes "more" | 16:23 |
| *** browne has quit IRC | 16:23 | |
| marekd | ayoung: this is how my environment looked like when I was authenticating to a saml protected simple website. So you can assume, ADFS_* parameters are real there. https://gist.github.com/zaccone/914822d37ac2eea420ce | 16:23 |
| stevemar | not "start tests" | 16:23 |
| ayoung | awesome | 16:24 |
| bknudson | I tried to get us a "check experimental" that would run the coverage tests... https://review.openstack.org/#/c/72151/ | 16:24 |
| bknudson | -1 by the infra team. | 16:24 |
| *** lbragstad has joined #openstack-keystone | 16:26 | |
| *** browne has joined #openstack-keystone | 16:35 | |
| *** browne1 has quit IRC | 16:37 | |
| ayoung | bknudson, I want an external test repo | 16:38 |
| ayoung | and three flavors of tests: | 16:38 |
| ayoung | 1. unit tests. run all the time | 16:38 |
| ayoung | 2. failing tests; new test that are known not to pass | 16:38 |
| ayoung | 3. functional tests: ldap against a live server, or SAML, or Apache HTTPD type stuff | 16:39 |
| ayoung | gate would run against 1 and 3 | 16:39 |
| ayoung | we also keep a scorecard on the failing tests to record when they start passing | 16:39 |
| bknudson | ayoung: what do you mean by repo? a new git project? | 16:40 |
| ayoung | yeah | 16:40 |
| ayoung | I want to be able to commit tests even when keystone is in code freeze | 16:40 |
| ayoung | also, it should test both server and client | 16:40 |
| dolphm | ayoung: you can contribute tests anytime | 16:40 |
| dolphm | ayoung: we don't have a "code" freeze - we have a "feature" freeze | 16:41 |
| ayoung | dolphm hmmm....OK, fair enough. | 16:41 |
| ayoung | there is still a bit of an issue with adding features to the client that need a live server to test | 16:42 |
| ayoung | and the ability to run tests known to fail | 16:42 |
| ayoung | the "known to fail" thing I guess could also be handled inthe current repo | 16:42 |
| ayoung | its really the client I guess that needs a live keystone server... | 16:43 |
| bknudson | write a test that shows how it fails | 16:43 |
| ayoung | bknudson, a test that "passes"? | 16:43 |
| ayoung | then when you fix it, it fails? | 16:43 |
| ayoung | bassackwards | 16:43 |
| bknudson | right, then you know when you fix it. | 16:43 |
| dolphm | ayoung: when you fix it, you illustrate by revising the test | 16:43 |
| ayoung | dolphm, that loses one of the primary motivators: we need to be able to run the set of known-failing tests | 16:44 |
| bknudson | and also we know what's going to happen if the change is reverted | 16:44 |
| *** gokrokve has quit IRC | 16:44 | |
| ayoung | maybe instead of "skip" we have a "skip if skipping failures" | 16:44 |
| *** gokrokve has joined #openstack-keystone | 16:45 | |
| ayoung | ohh I like ^^ | 16:45 |
| ayoung | that can be done in the current context. OK | 16:45 |
| ayoung | SO all we needthat we don;t have beyond that is the ability to run a keystone server for client tests. | 16:45 |
| ayoung | no need for a separate repo. I'm going to write a couple BPs for those things | 16:45 |
| *** marekd is now known as marekd|away | 16:46 | |
| bknudson | it would be nice to have a fake keystone for keystoneclient that could be unfaked. | 16:46 |
| ayoung | ah..actually, we also want the live-tests thing. But that can be done in the current repo as well... | 16:46 |
| bknudson | then all the tests run against real keystone instead | 16:46 |
| ayoung | bknudson, just spin up a keystone the way that we do for thecurrent keystoneclient tests, just from that repo | 16:46 |
| ayoung | means you need to have the keystone git repo checked out, or the code available on the python_path | 16:46 |
| dstanek | ayoung: we used to use a @needs_work decorator to annotate tests known to be failing | 16:48 |
| ayoung | dstanek, ++ | 16:48 |
| dstanek | ayoung: maybe i'll replicate the idea here and see what everyone things | 16:48 |
| ayoung | dstanek, so long as we have a switch that can pass through that and actually run the test to see if it now passes | 16:48 |
| ayoung | dstanek, cool | 16:49 |
| ayoung | dstanek, ideally we would run Only the tests decorated that way when checking known failures | 16:49 |
| *** gokrokve has quit IRC | 16:49 | |
| ayoung | and generate a report that shows "these tests were expected to fail but now pass" | 16:49 |
| *** gokrokve has joined #openstack-keystone | 16:51 | |
| ayoung | dstanek, https://blueprints.launchpad.net/keystone/+spec/failing-tests | 16:53 |
| *** henrynash has quit IRC | 16:53 | |
| ayoung | want me to assign to you? | 16:54 |
| dstanek | ayoung: sure | 16:54 |
| *** gokrokve has quit IRC | 16:56 | |
| *** marcoemorais has joined #openstack-keystone | 16:58 | |
| stevemar | bknudson, cover is mostly 90-100% for auth/plugins/saml2 and contrib/federation/* | 17:00 |
| stevemar | bknudson, except for core.. probably because of the abstract driver class | 17:01 |
| bknudson | stevemar: check if there's any new code added in the review that's important and not covered. | 17:02 |
| bknudson | the % isn't what's important. | 17:02 |
| *** nkinder has quit IRC | 17:04 | |
| *** gokrokve has joined #openstack-keystone | 17:04 | |
| dstanek | stevemar: is that branch or line coverage? | 17:05 |
| *** leseb has quit IRC | 17:09 | |
| *** leseb has joined #openstack-keystone | 17:09 | |
| *** browne has quit IRC | 17:12 | |
| *** henrynash has joined #openstack-keystone | 17:14 | |
| *** leseb has quit IRC | 17:14 | |
| *** henrynash has quit IRC | 17:15 | |
| *** gokrokve has quit IRC | 17:15 | |
| *** gokrokve has joined #openstack-keystone | 17:15 | |
| *** nkinder has joined #openstack-keystone | 17:20 | |
| *** gokrokve has quit IRC | 17:20 | |
| stevemar | dstanek, not sure? whatever the default is? | 17:20 |
| dstanek | stevemar: line probably | 17:21 |
| *** achampion has joined #openstack-keystone | 17:21 | |
| achampion | Is it possible to use SAML for authentication only, but keep all the authorisation information in keystone, e.g. projects, roles, etc. | 17:22 |
| bknudson | here's the latest coverage report: http://logs.openstack.org/a6/a6c3d6d07d217b86e9d2f26e4c216a3011e37c55/post/keystone-coverage/2d5c04f/cover/ | 17:23 |
| ayoung | need to take that report and run a regression on it from commit to commit.... | 17:26 |
| bknudson | ayoung: that's what the infra guys suggested. | 17:26 |
| ayoung | is coverage run on gate, or just on check? | 17:27 |
| bknudson | ayoung: it's run in post | 17:27 |
| bknudson | so we don't get a report until after the change is merged | 17:27 |
| ayoung | ah...perfect | 17:27 |
| ayoung | yeah, but we can always grab the latest post to check against... | 17:27 |
| bknudson | yes, you can get the report from the last merge. | 17:28 |
| *** gyee has joined #openstack-keystone | 17:38 | |
| dstanek | dolphm: this needed a rebase https://review.openstack.org/#/c/75284/ | 17:39 |
| *** gokrokve has joined #openstack-keystone | 17:40 | |
| ayoung | bknudson, for example, I just ran cover on the sql backend for revoke. I did a wget of the link you posted above, and can do a side-by-side comparison | 17:46 |
| bknudson | ayoung: what comparison do you think we should make? just compare % ? | 17:47 |
| ayoung | nah..... | 17:47 |
| ayoung | that is too corse | 17:47 |
| ayoung | coarse | 17:47 |
| ayoung | some where I didn't cover had the same percentage | 17:48 |
| ayoung | let me run it with a few more lines of contet and I'll post | 17:48 |
| bknudson | could compare "missing" count | 17:48 |
| ayoung | http://paste.openstack.org/show/68085/ | 17:49 |
| ayoung | it puts total at the top, which is nice | 17:50 |
| *** henrynash has joined #openstack-keystone | 17:53 | |
| ayoung | bknudson, http://paste.openstack.org/show/68086/ little easier to read | 17:53 |
| ayoung | total missing went from 1805 to 1833 | 17:54 |
| ayoung | but total coverage stayed at 85% | 17:54 |
| *** harlowja_away is now known as harlowja | 17:56 | |
| *** YorikSar has quit IRC | 18:00 | |
| *** leseb has joined #openstack-keystone | 18:10 | |
| *** browne has joined #openstack-keystone | 18:10 | |
| *** topol has joined #openstack-keystone | 18:11 | |
| *** henrynash has quit IRC | 18:14 | |
| ayoung | bknudson, stevemar do you guys have the ability to test Keystone changes against DB2? | 18:18 |
| *** henrynash has joined #openstack-keystone | 18:19 | |
| stevemar | ayoung, i don't. I think bknudson was doing something db2 related at some point in the past, i think enabling support for the community edition (free)? | 18:20 |
| ayoung | stevemar, thanks. topol do you have the ability to test something against DB2? | 18:21 |
| ayoung | guessing henrynash hasn't been dealing with it | 18:21 |
| topol | ayoung, bknudson should be able to do this | 18:21 |
| henrynash | ayoung: not me, personally, no | 18:21 |
| ayoung | OK. I copied some of the token cleanup logic that is DB2 specific for the Revocation events. Would love to have a means to actually run it | 18:22 |
| ayoung | https://review.openstack.org/#/c/67372/13/keystone/contrib/revoke/backends/sql.py line 67 bknudson | 18:23 |
| *** dolphm is now known as dolphm_503 | 18:23 | |
| topol | ayoung, K Let's see what bknudson says. I can try some other folkss but I think he can | 18:23 |
| ayoung | topol, thanks | 18:23 |
| *** morganfainberg_Z is now known as morganfainberg | 18:24 | |
| bknudson | ayoung: we're working on providing an integrated CI infrastructure for DB2 | 18:29 |
| morganfainberg | ayoung, you can add projects to a pycharm window in preferecnes structure | 18:29 |
| ayoung | bknudson, yeah, I had heard that | 18:29 |
| morganfainberg | ayoung, preferences->project structure. | 18:29 |
| bknudson | we've got a BVT infrastructure internally that we run already | 18:29 |
| bknudson | it runs tempest | 18:29 |
| ayoung | morganfainberg, ohh. lemme test | 18:29 |
| bknudson | which is actually failing right now | 18:29 |
| ayoung | bknudson, need to come up with something like _live_tests for the revoke code that can be run against DB2. | 18:30 |
| *** devlaps has joined #openstack-keystone | 18:30 | |
| ayoung | wouldn't be tempest, as it is inside Keystone | 18:30 |
| ayoung | but the idea is the same | 18:30 |
| bknudson | I've run the live tests against db2 | 18:30 |
| bknudson | and we could eventually hook up our CI to keystone... | 18:30 |
| bknudson | the DB2 CI work is progressing but seems to be going slowly... need to get it for sqlalchemy project first. | 18:31 |
| ayoung | morganfainberg, "preferences" is well hidden | 18:31 |
| *** henrynash has quit IRC | 18:31 | |
| *** henrynash has joined #openstack-keystone | 18:32 | |
| ayoung | morganfainberg, so I would add /opt/stack/python-keystoneclient as an additional content root? | 18:33 |
| morganfainberg | ayoung, yep | 18:34 |
| ayoung | morganfainberg, that looks wrong | 18:34 |
| morganfainberg | ayoung, i acutally have an "OpenStack" directory and i checkout all the projects I want to include, and then open OpenStack and add the project roots as sources | 18:34 |
| ayoung | I think that is going to apply the project setting for both, to include the venv setup | 18:34 |
| morganfainberg | ayoung, hm. oh oh yeah =/ | 18:34 |
| ayoung | then again, we should be able to have an integrated venv for both | 18:35 |
| morganfainberg | ayoung, let me see if i can tell you how to use different venv (might not be doable) | 18:35 |
| ayoung | interesting.... | 18:35 |
| ayoung | morganfainberg, its low priority | 18:35 |
| ayoung | I think the keystone venv includes everything needed for p-kc | 18:35 |
| ayoung | if not...I can pip install it. | 18:35 |
| morganfainberg | ayoung, i'm opening pycharm now :P but i'm just 2x checking (takes 10 seconds) | 18:35 |
| ayoung | ah...but the kc is installed in the keystone venv. | 18:36 |
| morganfainberg | ayoung, yeah only 1 venv, hep there is the limitation | 18:36 |
| morganfainberg | ayoung, :( doh | 18:36 |
| morganfainberg | ayoung, oh well. | 18:37 |
| ayoung | morganfainberg, something to think about. I suspec that we will want to put keystone into the venv for p-kc in order to do the live testing I was ranting about before | 18:37 |
| *** henrynash has quit IRC | 18:37 | |
| morganfainberg | ayoung, i saw | 18:37 |
| morganfainberg | ayoung, i'm not opposed to that. | 18:37 |
| ayoung | nah, just needs to happen | 18:38 |
| *** YorikSar has joined #openstack-keystone | 18:38 | |
| morganfainberg | ayoung, yeah, likely worthwhile to test against a real server vs mocking it all up | 18:38 |
| morganfainberg | ayoung, s/likely// | 18:38 |
| ayoung | ++ | 18:38 |
| ayoung | morganfainberg, there was talk about trying to run all of devstack inside a single venv. I wonder if we could start hacking there | 18:39 |
| morganfainberg | ayoung, i'd love that | 18:40 |
| morganfainberg | ayoung, only issue is libvirt | 18:40 |
| morganfainberg | ayoung, you need system-packages because libvirt can't be pip installed (python bindings) last i heard | 18:40 |
| ayoung | I'm sure it isn't the "only" but it might be the "first biggest" | 18:40 |
| morganfainberg | ayoung, everything else 100% could run in the venv | 18:41 |
| morganfainberg | ayoung, it's an unfortunate hurdle | 18:41 |
| ayoung | 'salright. We just need one venv for all the python code. Wouldn't change due the libvirt side of things. | 18:41 |
| ayoung | We have other deps on native code, too | 18:41 |
| morganfainberg | ayoung, i want a precedent to run a venv in production (tbh) and isolate from system python libs | 18:41 |
| ayoung | nah, LDAP required ldap-devel | 18:41 |
| *** henrynash has joined #openstack-keystone | 18:41 | |
| morganfainberg | ayoung, if devstack does it i can make the case on a broader scope | 18:41 |
| ayoung | morganfainberg, its called PLan 9 from Bell labw | 18:41 |
| ayoung | labs | 18:41 |
| morganfainberg | ayoung, hehe | 18:42 |
| ayoung | really you want a container | 18:42 |
| ayoung | not just venv | 18:42 |
| morganfainberg | ayoung, native code != python bindings built as a side effect of the system lib | 18:42 |
| morganfainberg | ayoung, python-ldap while requiring ldap-dev, doesn't require python code outside of the venv | 18:42 |
| morganfainberg | ayoung, afaik libvirt python is built (swig?) as a side effect of building libvirt itself | 18:43 |
| ayoung | morganfainberg, why can't the libvirt bindings be built inside the venv based on the native code | 18:43 |
| morganfainberg | ayoung, which is why nova allows system packages in the venv | 18:43 |
| ayoung | just a build system problem? | 18:43 |
| morganfainberg | ayoung, not sure, i think so / swig or something very very build specific | 18:43 |
| ayoung | we have people on Open Stack that are pretty integral with libvirt. If it is a real problem I can ambush them next time Im in the office. | 18:43 |
| morganfainberg | ayoung, i thought i heard rumblings it would be fixed in the future ™ | 18:43 |
| simo | I hope we are not growing an unhealthy "native code" religion in openstack, like ti happend in the java world ? | 18:44 |
| morganfainberg | simo, nah, | 18:45 |
| simo | pheeew | 18:45 |
| morganfainberg | simo, i want to be able to isloate from system python libs, don't care if it's native | 18:45 |
| simo | for testing ? | 18:46 |
| morganfainberg | simo, nope, prod. | 18:46 |
| simo | as an option or by default ? | 18:46 |
| morganfainberg | simo, as an option | 18:46 |
| simo | I see, have fun :) | 18:46 |
| morganfainberg | simo, the choice is always deployer, i never want to take that away from the deployers | 18:46 |
| morganfainberg | simo, i just know i run up against conflicts often because <distro> relies on <X> and openstack likes version <z> which is now incompatible | 18:47 |
| morganfainberg | simo, e.g., don't want to break yum to install openstack ;) (not that it's likely, but similar concerns) | 18:47 |
| morganfainberg | it also means it is easier to test / deploy controlled versions of the python libs, roll a VENV (packaged) and use a control file to determien which venv to activate | 18:47 |
| * morganfainberg dreams of options that makes his ops teams lives better. | 18:48 | |
| *** henrynash has quit IRC | 18:48 | |
| richm | this is sounding a lot like docker | 18:49 |
| morganfainberg | richm, ++ | 18:49 |
| morganfainberg | absolutely | 18:49 |
| morganfainberg | but docker has other impllications in some cases | 18:49 |
| morganfainberg | it's a bit heavier handed than i want to be for dev/qa/etc | 18:49 |
| morganfainberg | richm, but the way i see it is you can have 4 or 5 solid ways to deploy | 18:50 |
| morganfainberg | richm, and you pick the "right" one for your use case. | 18:50 |
| richm | sure - what's right for dev is not necessarily what's right for qe or prod | 18:50 |
| morganfainberg | richm, docker being the most containerized, and the other end is system installed libs | 18:50 |
| morganfainberg | richm, absolutely. | 18:50 |
| morganfainberg | richm, and this is why i like keystone folks so much. :) I can talk about this stuff and only every now and again ayoung calls me crazy. | 18:51 |
| morganfainberg | ok ok, he probably thinks i'm crazy on a regular basis | 18:51 |
| *** dolphm_503 is now known as dolphm | 18:51 | |
| morganfainberg | damn it. now i have a song stuck in my head. | 18:52 |
| morganfainberg | ayoung, https://review.openstack.org/#/c/75316/ got part of the way there. still chasing bugs down. | 18:53 |
| ayoung | dawka as we call it here in Mass | 18:53 |
| morganfainberg | ayoung, but i think that (if we can get it in) will help with the config stuff. | 18:53 |
| ayoung | dawka dawka dawka dawka dawka dawka dawka dawka dawka | 18:53 |
| ayoung | simo, its like Software collections all over again | 18:54 |
| *** ayoung is now known as ayoung-lunch | 18:55 | |
| *** henrynash has joined #openstack-keystone | 19:01 | |
| *** marekd|away has quit IRC | 19:15 | |
| *** henrynash has quit IRC | 19:21 | |
| *** marekd|away has joined #openstack-keystone | 19:23 | |
| *** amerine has quit IRC | 19:27 | |
| *** amerine has joined #openstack-keystone | 19:30 | |
| *** henrynash has joined #openstack-keystone | 19:31 | |
| *** henrynash has quit IRC | 19:36 | |
| *** henrynash has joined #openstack-keystone | 19:55 | |
| *** lnxnut has quit IRC | 19:56 | |
| *** lnxnut has joined #openstack-keystone | 19:57 | |
| *** harlowja is now known as harlowja_away | 19:59 | |
| *** lnxnut has quit IRC | 20:01 | |
| *** harlowja_away is now known as harlowja | 20:08 | |
| *** lnxnut has joined #openstack-keystone | 20:21 | |
| *** henrynash has quit IRC | 20:22 | |
| *** YorikSar has quit IRC | 20:27 | |
| *** henrynash has joined #openstack-keystone | 20:36 | |
| achampion | can anyone direct me to any good references of getting keystone working with federated identity with a SAML IdP | 20:40 |
| dolphm | achampion: that's still a work in progress! https://blueprints.launchpad.net/keystone/+spec/saml-id | 20:41 |
| dolphm | achampion: https://review.openstack.org/#/c/71353/ | 20:41 |
| achampion | And a follow up question, is it possible to use federadeted identity just for authentication but keep authorizattion in keystone (projects, roles, etc) | 20:41 |
| dolphm | achampion: and yes, that's the goal for icehouse | 20:41 |
| achampion | dolphm: thanks I'll take a look at that | 20:41 |
| achampion | dolphm: good to hear, that would meet our requirements | 20:42 |
| achampion | dophm: is there anything I can do to help test this | 20:43 |
| achampion | +l | 20:43 |
| dolphm | marekd|away: stevemar: ^ | 20:44 |
| dolphm | achampion: those two are the ones doing all the heavy lifting ^ | 20:44 |
| dolphm | achampion: the biggest help at this point would be reviewing the code, and testing it if you're able | 20:44 |
| stevemar | achampion, yes, authentication would be through the idp, and authnz is kept in keystone | 20:45 |
| *** YorikSar has joined #openstack-keystone | 20:48 | |
| achampion | stevemar: the blueprint mentioned above seems to expect SAML assertions for the authorization with mappings - or I am missing understanding it | 20:48 |
| stevemar | achampion, mappings will translate the saml attributes to keystone entities, but which user/group gets authorization on a specific project/role is still going to be done in keystone | 20:51 |
| bknudson | keystone's common.db.sqlalchemy code has gotten way out of date. | 20:52 |
| morganfainberg | bknudson, yeah :( | 20:52 |
| morganfainberg | bknudson, i just tried to do a sync | 20:53 |
| morganfainberg | wow | 20:53 |
| bknudson | morganfainberg: I'll work on trying to get keystone working with it again. | 20:53 |
| morganfainberg | bknudson, ok. | 20:53 |
| morganfainberg | bknudson, this is kindof why i don't like the way oslo-incubator works. | 20:54 |
| morganfainberg | bknudson, i'd rather have known targets and releases to work with. | 20:54 |
| bknudson | morganfainberg: making backwards incompatible changes doesn't work. | 20:54 |
| morganfainberg | rather than "oh sorry" | 20:54 |
| bknudson | I think that they're moving the part out to its own library | 20:54 |
| morganfainberg | bknudson, ++ i hope so! | 20:54 |
| morganfainberg | ok back to stable fixes I go. | 20:55 |
| *** marcoemorais has quit IRC | 20:56 | |
| *** marcoemorais has joined #openstack-keystone | 20:58 | |
| achampion | stevemar: looking through the BP and etherpad for federation-flows, I'm not sure that it covers what I was asking. Effectively looking for a "local user" (group, project, roles, etc) defined in keystone, but authentication done via SAML with assertions to map to the local user. | 20:59 |
| morganfainberg | achampion, the user/group would come from SAML | 21:00 |
| morganfainberg | achampion, the project/roles etc woiuld be internal to keystone (standard assignment CRUD/work) | 21:00 |
| morganfainberg | achampion, at least that was my understanding of the target and general direction things are moving | 21:00 |
| morganfainberg | s/was/is | 21:00 |
| achampion | morganfai: that's what I thought... we have a corporate identity service but the idea of getting them to provide the project/role assertions is probably a no go. | 21:01 |
| morganfainberg | achampion, you shouldn't need to | 21:01 |
| morganfainberg | achampion, just the user informaiton and the SAML assertion should map to the user information needed to provide assignment (project etc) | 21:02 |
| morganfainberg | achampion, so you'd create an assignment (Role Y on project Z) for a user that would match the SAML assertion data. | 21:02 |
| morganfainberg | achampion, though stevemar and marekd|away can provide more specifics | 21:02 |
| morganfainberg | achampion, and stevemar is likely going to show up and say i'm totally wrong | 21:03 |
| morganfainberg | stevemar, *poke* | 21:03 |
| morganfainberg | :P | 21:03 |
| achampion | morganfai: ok, that would work | 21:04 |
| bknudson | the group isn't in saml. you define the group in keystone | 21:04 |
| morganfainberg | bknudson, ah | 21:04 |
| achampion | morganfai: it was just both use-case 1 and use-case 3 state: 'Keystone creates a user with an expiration of the saml-assertion "NotOnOrAfter" time and provisions the requested domain, roles, etc to that user as passed in the saml assertion.' | 21:04 |
| bknudson | the group ids come from the mapping | 21:04 |
| morganfainberg | bknudson, ok, that was it | 21:04 |
| morganfainberg | achampion, ^ | 21:04 |
| morganfainberg | bknudson, thanks :) | 21:05 |
| *** leseb has quit IRC | 21:05 | |
| stevemar | achampion, the use-cases are rather out of date | 21:06 |
| achampion | stevemar: ahh, ok. | 21:06 |
| stevemar | achampion, but bknudson and morganfainberg are feeding you correct info | 21:06 |
| stevemar | achampion, we don't expect any role/project stuff in the assertion | 21:06 |
| morganfainberg | stevemar, yay! i understand the mapping stuff (mostly) | 21:06 |
| morganfainberg | >.> | 21:07 |
| achampion | stevemar: great, it sounds like what is being discussed would work... I'll dig some more | 21:07 |
| achampion | so the use isn't ephermal in that case - right? | 21:07 |
| morganfainberg | bknudson, i'm going to resurrect the patchset to move to the config fixture now that it's all in oslo. | 21:07 |
| achampion | use=user | 21:07 |
| morganfainberg | bknudson, i think i'll aim for that to land after I3 though. | 21:08 |
| bknudson | morganfainberg: great. I think dstanek was interested in it too. | 21:08 |
| morganfainberg | bknudson, so we don't make life any worse for BPs and features | 21:08 |
| stevemar | achampion, the user would be, but the group that he's a part of is not. | 21:08 |
| dstanek | bknudson: ? | 21:08 |
| morganfainberg | dstanek, config fixture | 21:08 |
| dstanek | morganfainberg: yeah, i was excited to see that review | 21:09 |
| morganfainberg | dstanek, it's sync'd into openstack.common.fixture for us now. | 21:09 |
| morganfainberg | dstanek, i'm going to bring back the conf fixture patch once I3 sails | 21:09 |
| morganfainberg | dstanek, so we don't make features more painful | 21:09 |
| stevemar | achampion, if we see an incoming assertion, we grab the mapping rules and try to find a group that the user would be a part of. then issue a token based on the roles that the group has | 21:09 |
| *** marcoemorais has quit IRC | 21:10 | |
| *** marcoemorais has joined #openstack-keystone | 21:10 | |
| stevemar | achampion, the token will have a user field with id and name, but it's just there for auditing/information, the user won't exist in the keystone backend | 21:10 |
| achampion | stevemar: so the groups and roles a user has would have to be part of the assertions - which I think maybe challenged with. I was hoping we can define a local user with their roles, groups, etc. and just use the assertions to identify the local user. | 21:11 |
| stevemar | achampion, nope, i think i just made things worse | 21:11 |
| achampion | stevemar: maybe :) | 21:12 |
| stevemar | achampion, a have to head out now, can you PM me your email, and I promise a long explanation? | 21:12 |
| *** amcrn has quit IRC | 21:13 | |
| dstanek | i'm not sure i case about the order of the args to assertEqual | 21:14 |
| dstanek | s/case/care/ | 21:14 |
| *** stevemar has quit IRC | 21:21 | |
| morganfainberg | dstanek, the argument is that there is expected and observed | 21:38 |
| *** dolphm is now known as dolphm_503 | 21:38 | |
| morganfainberg | dstanek, and some of the derived methods from assertEqual say "saw this but expected that" and it's unclear from the error | 21:39 |
| morganfainberg | dstanek, functionaly, it doesn't matter | 21:39 |
| morganfainberg | dstanek, but it is more correct with the patches proposed. | 21:39 |
| dstanek | morganfainberg: the end result is meaningless to me | 21:39 |
| morganfainberg | dstanek, it's shuffling things towards more correct, and i'm ok with that. | 21:39 |
| dstanek | morganfainberg: what derived methods? | 21:39 |
| morganfainberg | dstanek, we have a couple that fall back on assertEqual i think | 21:39 |
| bknudson | morganfainberg: after sync, I get a weird error when tox -e sample_config -- Error importing module keystone.contrib.kds.cli.manage: no such group: database | 21:40 |
| bknudson | that part doesn't even use database. | 21:40 |
| morganfainberg | but in either case, for a new developer, when it says "expected" and "got" inverted it is more confusing | 21:40 |
| bknudson | maybe once I get further in the port it will make sense. | 21:40 |
| morganfainberg | bknudson, maybe. it might be that .cli imports something that uses .database? | 21:40 |
| bknudson | I just wanted to make sure pep8 works | 21:40 |
| morganfainberg | bknudson, ah, yeah just ignore that error then ;) | 21:41 |
| dstanek | morganfainberg: i'm not sayin i'm against it, but what your saying applies to the derived methods and not assertEqual | 21:41 |
| morganfainberg | dstanek, sure, but if upstream makes the errors clearer (unittest) it's worth being "correct" | 21:41 |
| *** topol has quit IRC | 21:42 | |
| morganfainberg | dstanek, basically, i think this is a noop, i don't care, but if someone wants to correct it, sure | 21:42 |
| morganfainberg | go for it | 21:42 |
| dstanek | morganfainberg: thier signature is something like assertEqual(first, second) - so i don't think they will change the output | 21:42 |
| morganfainberg | dstanek, def assertEqual(self, expected, observed, message=''): | 21:43 |
| morganfainberg | dstanek. """Assert that 'expected' is equal to 'observed'. | 21:43 |
| morganfainberg | at least that is py27 | 21:43 |
| morganfainberg | dstanek, https://review.openstack.org/#/c/75521/ OSSA for this | 21:44 |
| morganfainberg | bknudson, ^ | 21:44 |
| dstanek | morganfainberg: i don't see that in case.py | 21:44 |
| morganfainberg | it's public | 21:44 |
| morganfainberg | dstanek, i see it in testcase.py | 21:44 |
| morganfainberg | dstanek, sorry it's testcase not unittest | 21:45 |
| morganfainberg | testtools.testcase | 21:45 |
| dstanek | morganfainberg: ah | 21:45 |
| dstanek | yeah so far i have been mostly disappointed by testtool, testr, etc. | 21:45 |
| morganfainberg | testr is great for seeing the differences in test runs | 21:46 |
| morganfainberg | +XXX / -XXX | 21:46 |
| morganfainberg | but i can see why it's less friendly | 21:46 |
| dstanek | morganfainberg: i find i mostly don't care - i'd rather it tell when what i did wrong so i don't have to use nose several times a day | 21:46 |
| morganfainberg | dstanek, *shrug* i think i find both about as useful. | 21:47 |
| dstanek | morganfainberg: also it would be trivial to write a nose plugin that tells you differences in test runs | 21:47 |
| morganfainberg | dstanek, meaning to say, less useful than i want, but provides me half-way-decent info for debugging | 21:47 |
| morganfainberg | dstanek, now the real challenge... can i backport that fix to grizzly... | 21:48 |
| * morganfainberg is glad grizzly is going to EOL sooner vs later | 21:49 | |
| morganfainberg | it's getting hard to port needed fixes around :P | 21:50 |
| dstanek | morganfainberg: whoa, looks like there are multiple patches for assertEqual. | 21:50 |
| morganfainberg | dstanek, yeah the guy did one patch per system? | 21:50 |
| morganfainberg | dstanek, rather than a massive one, token, trust, etc | 21:51 |
| morganfainberg | i think that was it | 21:51 |
| morganfainberg | or was it dolph that did it. honesty didn't pay attention to the committer, just the content | 21:51 |
| *** henrynash has quit IRC | 21:56 | |
| richm | Can someone tell me why assignments/backends/ldap.py RoleApi.update rejects the update if a role by the given name already exists? | 21:57 |
| dstanek | morganfainberg: what does ttx mean by his comment about your commit being hard to backport? | 22:01 |
| morganfainberg | hm? | 22:01 |
| morganfainberg | oh because dogpile.kvs is not backportable | 22:02 |
| morganfainberg | totally changed structures of the code | 22:02 |
| ayoung-lunch | heh | 22:02 |
| morganfainberg | and until the other fix for CAS update happened, the token backend wasn't fun | 22:02 |
| ayoung-lunch | please backport a major rewrite from Icehouse to Havana | 22:02 |
| morganfainberg | it's better now | 22:02 |
| morganfainberg | ayoung-lunch, sure sure, can we get that for grizzly too? | 22:02 |
| *** ayoung-lunch is now known as ayoung | 22:02 | |
| ayoung | All the way back to Austin! | 22:03 |
| morganfainberg | ayoung, now you're just being unreasonable | 22:03 |
| ayoung | Cactus? | 22:03 |
| morganfainberg | ayoung, there ya go | 22:06 |
| morganfainberg | ayoung, that was keystone v1 right? | 22:06 |
| ayoung | Actually, Diablo was where it was incubated and Essex release IIRC | 22:06 |
| morganfainberg | ayoung, ok | 22:06 |
| morganfainberg | still | 22:06 |
| morganfainberg | :P | 22:06 |
| *** jagee has quit IRC | 22:08 | |
| *** henrynash has joined #openstack-keystone | 22:10 | |
| richm | anyone? This is causing the sole remaining test failure in _ldap_livetest.py | 22:12 |
| richm | would love to get this passing at 100% | 22:13 |
| morganfainberg | dstanek, https://review.openstack.org/#/c/75526/ | 22:16 |
| morganfainberg | grizzly version | 22:16 |
| dstanek | morganfainberg: strictly speaking i think the code is fine...what other considerations are there for evaluating backports | 22:19 |
| morganfainberg | dolphm_503, ^ bug 1260080 | 22:19 |
| morganfainberg | dstanek, hm. well if it fixes the issue :P | 22:19 |
| morganfainberg | dstanek, most of the time i wouldn't even be interested in backporting but it was needed | 22:20 |
| morganfainberg | awww uvirbot isn't here :( | 22:20 |
| * morganfainberg sniffles | 22:20 | |
| dstanek | morganfainberg: the change to pep8 for the sample config caught a sync issue - https://review.openstack.org/#/c/73895/ | 22:20 |
| morganfainberg | dstanek, yep. | 22:21 |
| dstanek | i like it | 22:21 |
| morganfainberg | dstanek, yes! So do I :) | 22:21 |
| *** gokrokve has quit IRC | 22:22 | |
| morganfainberg | dstanek, i really do like it that it's forced via pep8. | 22:22 |
| *** gokrokve has joined #openstack-keystone | 22:22 | |
| morganfainberg | dstanek, i also like that it's pretty easy to regenerate the sample | 22:22 |
| dstanek | morganfainberg: what do you think is easier to read: | 22:24 |
| dstanek | _, a, b = fun() | 22:24 |
| dstanek | or | 22:24 |
| dstanek | a, b = func()[1:] | 22:24 |
| morganfainberg | the former | 22:24 |
| *** dolphm_503 is now known as dolphm | 22:24 | |
| dstanek | hmmm...really? | 22:25 |
| morganfainberg | the slices feel ... cooler, but not as quick to proceess at a glance | 22:25 |
| morganfainberg | when scanning code, slices always take me longer to go "aha!" than scatter assignment | 22:25 |
| morganfainberg | but i did most of my early development in perl and C. | 22:25 |
| morganfainberg | the perl stuff still lingers around | 22:25 |
| morganfainberg | s/scatter assignment/pure scatter assignment | 22:26 |
| dstanek | i have to rename _ to something else - the original author used i | 22:27 |
| morganfainberg | hehe yeah | 22:27 |
| *** gokrokve has quit IRC | 22:27 | |
| dstanek | also pylint doesn't like the unused variable | 22:27 |
| morganfainberg | but the _, a, b one is ore perl like, the slice is more pythonic | 22:27 |
| morganfainberg | dstanek | 22:27 |
| dstanek | morganfainberg: all of your warnings down our my pep8 errors :-) | 22:31 |
| morganfainberg | dstanek, LOL just add help strings! | 22:31 |
| *** achampion has quit IRC | 22:32 | |
| dstanek | morganfainberg: yeah, "TODO: help goes here" | 22:32 |
| morganfainberg | LOL | 22:32 |
| morganfainberg | i'm actually getting some of those filled in now. | 22:33 |
| dstanek | morganfainberg: is there a changeset on master to reference for those two backports? | 22:36 |
| morganfainberg | dstanek, hmm | 22:36 |
| morganfainberg | dstanek, https://review.openstack.org/#/c/60743/ | 22:36 |
| dstanek | morganfainberg: cool thx | 22:37 |
| *** leseb has joined #openstack-keystone | 22:37 | |
| dstanek | i couldn't find it because the commit message is different | 22:37 |
| ayoung | morganfainberg, I just rebased all of my changes for Revocation | 22:39 |
| ayoung | Annnnd a poep 8 error on sql | 22:40 |
| ayoung | WTF | 22:40 |
| ayoung | 'tox -esample_config -r | 22:41 |
| ayoung | ah.... | 22:41 |
| *** leseb has quit IRC | 22:41 | |
| dstanek | ayoung: the -r is a trick | 22:42 |
| ayoung | dstanek, knowing that the patch merged that required it is the trick | 22:42 |
| dstanek | i ran the command without thinking and it recreated by venv | 22:43 |
| dstanek | not a big deal except i used command history to run it again :-( | 22:43 |
| ayoung | the amount of churn this config file stuff is trigging is a trifle annoying | 22:44 |
| *** devlaps1 has joined #openstack-keystone | 22:44 | |
| *** devlaps has quit IRC | 22:45 | |
| *** gokrokve has joined #openstack-keystone | 22:46 | |
| *** henrynash has quit IRC | 22:48 | |
| *** leseb has joined #openstack-keystone | 22:55 | |
| dolphm | this should be a fun bit of code for anyone that wants to learn about / play with auth_token https://review.openstack.org/#/c/75529/ | 22:56 |
| dolphm | basically lets you experiment with auth_token without having to stand up a real service to poke at, like nova | 22:57 |
| *** leseb has quit IRC | 23:00 | |
| lbragstad | dolphm: nice | 23:02 |
| ayoung | if our sample config file is going to be autogenerated, it probably should not be checked in to git | 23:04 |
| ayoung | dolphm, that is the coolest thing I have seen today | 23:05 |
| dolphm | ayoung: i hear your blog article already | 23:05 |
| ayoung | dolphm, I'll let you write that onw | 23:06 |
| ayoung | one | 23:06 |
| dolphm | ayoung: http://dolphmathews.com/ | 23:06 |
| dolphm | (not gonna happen) | 23:06 |
| ayoung | I'm working on one explaining why we need to use CMS for Oslo Messaging | 23:06 |
| *** gokrokve has quit IRC | 23:08 | |
| *** gokrokve has joined #openstack-keystone | 23:08 | |
| *** lbragstad is now known as lbragstad_away | 23:12 | |
| *** gokrokve has quit IRC | 23:13 | |
| bknudson | guess what -- oslo-incubator db is broken. | 23:22 |
| bknudson | :( | 23:22 |
| *** richm has quit IRC | 23:25 | |
| *** gokrokve has joined #openstack-keystone | 23:28 | |
| dstanek | oh, noes - what's wrong with it? | 23:28 |
| morganfainberg | dstanek, https://review.openstack.org/75537 | 23:33 |
| morganfainberg | dolphm, ^ dstanek, more help strings | 23:33 |
| morganfainberg | that should reduce the warnings a lot | 23:35 |
| dstanek | morganfainberg: ah, yes; that'll help | 23:38 |
| *** nkinder has quit IRC | 23:38 | |
| morganfainberg | dstanek, that one takes it down to ~12 warnings. | 23:39 |
| *** richm has joined #openstack-keystone | 23:39 | |
| morganfainberg | dstanek, i'm not comfortable writing the help strings for some of those | 23:39 |
| morganfainberg | dstanek, or i just don't know what to say "uh.. user id... and things" | 23:39 |
| *** gokrokve has quit IRC | 23:40 | |
| bknudson | dstanek: db_version_control(abs_path, init_version) | 23:40 |
| bknudson | def db_version_control(engine, abs_path, version=None): | 23:40 |
| bknudson | apparently it's not tested. | 23:40 |
| *** gokrokve has joined #openstack-keystone | 23:40 | |
| morganfainberg | ayoung, you're trying to secure the "most patches in a given review" aren't you? :P | 23:40 |
| *** gokrokve_ has joined #openstack-keystone | 23:41 | |
| *** leseb has joined #openstack-keystone | 23:41 | |
| *** gokrokve has quit IRC | 23:44 | |
| *** gokrokve_ has quit IRC | 23:46 | |
| *** gokrokve has joined #openstack-keystone | 23:47 | |
| *** dstanek is now known as dstanek_dinner | 23:48 | |
| *** gokrokve has quit IRC | 23:51 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!