| jamielennox | and i don't think it's something that i can isolate the new behaviour to just the new auth plugins as the old code will depend on them | 00:00 |
|---|---|---|
| jamielennox | well - it's python i could with some funky kwarg flags... | 00:00 |
| jamielennox | but i'm not sure it's worth it | 00:00 |
| dolphm | jamielennox: that whole method needs some better error feedback to protect against bad input | 00:01 |
| jamielennox | hmm, maybe it is worth it | 00:01 |
| jamielennox | i copied that method with a few formatting fixes | 00:01 |
| dolphm | jamielennox: it wouldn't be just as unreasonable to pass in domain_id + project_id, and the resulting behavior is equally arbitrary based on the order of the implementation | 00:02 |
| dolphm | jamielennox: it would* be | 00:02 |
| jamielennox | dolphm: that is caught | 00:03 |
| *** Fin1te has joined #openstack-keystone | 00:04 | |
| jamielennox | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/identity/v3.py#L76 | 00:04 |
| jamielennox | again that's a copy and paste | 00:04 |
| jamielennox | i guess that check should contain a trust check as well | 00:05 |
| dolphm | jamielennox: ++ | 00:06 |
| jamielennox | dolphm: it's not realaly something that can be extended now though is it? | 00:08 |
| dolphm | jamielennox: i think it can, as long as it's in the form of a friendly error message and a 0.x.0 bump | 00:09 |
| *** dims has joined #openstack-keystone | 00:11 | |
| morganfainberg | dolphm, if dstanek's comment is correct, if the truncation stuff changes, it affects all passwords now. | 00:19 |
| morganfainberg | dolphm, i think we have an issue with that being configurable. | 00:19 |
| dolphm | morganfainberg: ? | 00:20 |
| *** andreaf has quit IRC | 00:20 | |
| morganfainberg | dolphm, truncate a password, you have password of 1024 max, and someone uses it | 00:20 |
| morganfainberg | dolphm, then deployer changes the truncate to 64 | 00:20 |
| dolphm | morganfainberg: 4096 by default i think, but yeah-- they 400 | 00:20 |
| morganfainberg | anyone with a password > 64 can't auth | 00:20 |
| dstanek | morganfainberg: you do, but if we tel the operators about it they can enable the setting when they are ready vs. upgrading and getting it pushed to them | 00:20 |
| *** nkinder has quit IRC | 00:20 | |
| *** nkinder has joined #openstack-keystone | 00:21 | |
| morganfainberg | we may want to add some documentation to that | 00:21 |
| morganfainberg | extra documentation | 00:21 |
| morganfainberg | somehow i don't think anyone is going to be changing that value once deployed | 00:21 |
| dolphm | morganfainberg: we need to keep the warning that truncation is being applied, and probably include the user_id? | 00:21 |
| morganfainberg | at least i hope not | 00:21 |
| dolphm | morganfainberg: you mean reducing it from 4096? | 00:22 |
| morganfainberg | dolphm, we could keep the truncate value (when passwd is set) in the password field | 00:22 |
| morganfainberg | dolphm, not be default | 00:22 |
| morganfainberg | dolphm, secenario, deployer has 4096, and someone uses it (wow silly) | 00:23 |
| morganfainberg | then deployer decides no one's password should be > 64 | 00:23 |
| morganfainberg | that person who had a 4096 password would be unable to auth | 00:23 |
| dolphm | morganfainberg: presents a slight leak about passwords (which are shorter than the truncation limit) | 00:23 |
| morganfainberg | maybe we should make the password field something like pwlen, hash ? | 00:23 |
| morganfainberg | or truncation_limit_when_passwd_was_set, hash | 00:24 |
| morganfainberg | and we only consult the conf when/if the password is being changed | 00:24 |
| morganfainberg | not a big deal, i think it's an edge case of an edgecase | 00:24 |
| morganfainberg | most people will never change that value | 00:24 |
| dolphm | morganfainberg: yeah, especially more than once | 00:25 |
| dstanek | morganfainberg: is it that common that it's worth the trouble? seems like documentation saying the dangers of lowering the value would be enough | 00:25 |
| morganfainberg | dstanek, either documentation or code | 00:25 |
| morganfainberg | dstanek, i think this is a low prio thing to even worry about | 00:25 |
| morganfainberg | dstanek, so .. meh? just something we should be aware of | 00:25 |
| morganfainberg | not sure if it's easier to document this issue or just guard against it | 00:25 |
| dstanek | but that patch does force that on people | 00:26 |
| *** packet has quit IRC | 00:26 | |
| morganfainberg | dstanek, that patch changes a password change to a 400 vs. 200 on long password | 00:26 |
| morganfainberg | dstanek, the patch doesn't change that mucking with that value could prevent people from logging in today | 00:27 |
| ayoung | the patch seems correct: you should only scope to the trust, not domain or project | 00:27 |
| *** gordc has joined #openstack-keystone | 00:27 | |
| *** Fin1te has quit IRC | 00:27 | |
| dstanek | morganfainberg: that's what i mean it's effectively lowering the limit to the configured value | 00:27 |
| ayoung | but that is in requesting a token... | 00:27 |
| morganfainberg | dstanek, oh oh yes. | 00:27 |
| morganfainberg | dstanek, it forces what would work previously silently (and probably incorrectly) | 00:28 |
| dolphm | ayoung: yeah, but the test is asserting a broken use case and illustrating what's really going on | 00:28 |
| morganfainberg | dstanek, vs. just changes causing that issue | 00:28 |
| ayoung | dolphm, it looks correct. When you say "use a trust" nothing else in the scope is relevant. You can't change what you get back: you only get back exactly what the trust delegates to you | 00:29 |
| dolphm | ayoung: you're missing the point -- it's a broken user expectation; the client code that's being changed is completely inconsequential if the input had been validated correctly | 00:31 |
| ayoung | dolphm, I actually agreed with you in the review and -1ed. It should be a client side exception | 00:32 |
| ayoung | your first suggestion was correct. Checking that the project matched would not be correct, as that would be purely chance: | 00:33 |
| ayoung | if we overright the scope, if the scope matches the token, it would be due to luck | 00:33 |
| morganfainberg | https://review.openstack.org/#/c/78449 good change so we can get testing with latest released clients | 00:36 |
| morganfainberg | vs. trunk | 00:36 |
| jamielennox | have a fix to enforce the trust_id, project_id check, do i post it or let him fix the patch... | 00:37 |
| *** Fin1te has joined #openstack-keystone | 00:40 | |
| *** amcrn has quit IRC | 00:46 | |
| *** Fin1te has quit IRC | 00:48 | |
| *** wchrisj has quit IRC | 00:49 | |
| *** wchrisj has joined #openstack-keystone | 00:50 | |
| bknudson | jamielennox: if you just want to get the code out there you could post it as a dependent and mark it a work in progress and point him to it. | 00:50 |
| *** henrynash has joined #openstack-keystone | 00:52 | |
| *** prad has joined #openstack-keystone | 01:01 | |
| *** devlaps has quit IRC | 01:02 | |
| prad | Hi All, can i get some help configuring keystone with ssl? I followed the doc and set the [ssl] section in the keystone.conf with enable_ssl to true and passed in the relevant cert paths, also set the public/admin endpoint url to https .. but when i try to run keystone cli, i get Authorization failed http unable to establish connection to https://192.168.255.207:5000/v2.0/tokens | 01:08 |
| prad | am i missing any other steps here? | 01:08 |
| ayoung | jamielennox, go ahead an post it | 01:08 |
| ayoung | prad, anything in your log? | 01:09 |
| prad | ayoung: not much in the logs.. perhaps i need to enable debug? | 01:10 |
| ayoung | prad, well, can't hurt | 01:10 |
| bknudson | prad: are you using --insecure? | 01:12 |
| prad | bknudson: no | 01:13 |
| bknudson | prad: is keystoneclient able to connect when you use --insecure? | 01:13 |
| bknudson | prad: If I had to guess it would be that the server certificate isn't configured for a host of 192.168.255.207 so the client is rejecting it. | 01:14 |
| prad | hmm | 01:15 |
| prad | https://gist.github.com/pkilambi/9380301 | 01:15 |
| prad | bknudson: so thats the msg i get.. | 01:15 |
| prad | let me post you my keystone.conf settings, just to get another pair of eyes | 01:15 |
| bknudson | prad: ok, well it's probably not that the client is rejecting the server cert then... | 01:16 |
| bknudson | prad: how about using openssl s_client to connect to the server? | 01:17 |
| prad | bknudson: https://gist.github.com/pkilambi/9380327 | 01:17 |
| bknudson | that can give you some feedback. | 01:17 |
| ayoung | prad, or just point a web browser at it | 01:17 |
| ayoung | https://192.168.255.207:5000/ | 01:17 |
| prad | so to configure keystone with ssl endpoints is that all i need to do in keystone.conf or am i missing something? | 01:18 |
| bknudson | prad: looks like you've got "cert_required = True" -- but your keystoneclient command isn't presenting a client cert? | 01:18 |
| prad | bknudson: even if i comment that out, i get the same result | 01:18 |
| *** richm has quit IRC | 01:24 | |
| prad | bknudson: ayoung : do i need to setup the [signing] portion of the conf as well? or just the ssl portion is sufficient? | 01:25 |
| ayoung | prad, well, signing will be necessary | 01:25 |
| bknudson | prad: signing is for pki tokens and not for ssl | 01:25 |
| ayoung | but you should be able to talk to Keystone via ssl first | 01:26 |
| prad | ok | 01:26 |
| prad | https://gist.github.com/pkilambi/9380378 are the certs that i currently have.. some files such as serial have root perms but readable by all.. assume thats ok | 01:28 |
| prad | i generated the certs with keystone-manage ssl_setup command | 01:28 |
| prad | thats all i did.. so unless I'm missing some steps, not sure why its not able to talk over ssl | 01:30 |
| prad | note that i did not add any ssl config to apache virtualhost , i dint see that in the docs as part of the setup | 01:30 |
| bknudson | prad: if you're running keystone in apache then the ssl options don't apply. | 01:34 |
| bknudson | those are only used by keystone-all (running keystone in eventlet) | 01:35 |
| prad | bknudson: yea i'm just running keystone standalone outside of httpd | 01:36 |
| *** henrynash has quit IRC | 01:37 | |
| *** browne has quit IRC | 01:46 | |
| *** stevemar has joined #openstack-keystone | 01:53 | |
| *** gokrokve has joined #openstack-keystone | 01:53 | |
| *** rwsu has quit IRC | 01:54 | |
| *** harlowja has quit IRC | 01:58 | |
| lbragstad | dolphm: this is interesting.. paste.openstack.org/show/72738/ regarding your comment on descriptions being required for creating regions using the v3 api. | 02:03 |
| *** harlowja has joined #openstack-keystone | 02:04 | |
| *** thedodd has joined #openstack-keystone | 02:06 | |
| lbragstad | must be a result of the migration: https://github.com/openstack/keystone/blob/master/keystone/common/sql/migrate_repo/versions/037_add_region_table.py#L27 | 02:07 |
| *** marcoemorais has quit IRC | 02:11 | |
| *** marcoemorais has joined #openstack-keystone | 02:13 | |
| *** marcoemorais has quit IRC | 02:13 | |
| *** morganfainberg is now known as morganfainberg_Z | 02:16 | |
| *** david-lyle has joined #openstack-keystone | 02:20 | |
| *** chandan_kumar has joined #openstack-keystone | 02:21 | |
| bknudson | lbragstad: why is description unique? | 02:25 |
| *** d0ugal has quit IRC | 02:25 | |
| *** dstanek has quit IRC | 02:26 | |
| *** dstanek has joined #openstack-keystone | 02:26 | |
| *** zhiyan_ is now known as zhiyan | 02:31 | |
| *** gordc has quit IRC | 02:45 | |
| dstanek | dolphm: why did you mark this one as a wishlist item? https://bugs.launchpad.net/keystone/+bug/1277463 | 02:52 |
| dstanek | is there more work to be done? | 02:53 |
| dolphm | dstanek: no - it's done | 02:54 |
| dolphm | dstanek: looking at it again, i didn't put much thought into it... i saw a NotImplemented being replaced with an implementation and moved on | 02:55 |
| dstanek | dolphm: i'm trying to catch up on the large amounts of email from today | 02:56 |
| dolphm | dstanek: ha, good luck :P | 02:57 |
| *** d0ugal has joined #openstack-keystone | 02:57 | |
| *** d0ugal has quit IRC | 02:57 | |
| *** d0ugal has joined #openstack-keystone | 02:57 | |
| *** chandan_kumar has quit IRC | 02:59 | |
| *** prad has quit IRC | 03:04 | |
| *** gokrokve_ has joined #openstack-keystone | 03:04 | |
| *** gokrokve has quit IRC | 03:08 | |
| dolphm | lbragstad: should definitely be nullable :-/ | 03:10 |
| dolphm | lbragstad: or if it's not nullable, the service should default it to "" | 03:10 |
| dolphm | lbragstad: the second would be an easier one line fix in the manager, and avoid creating unnecessary migrations during feature freeze | 03:11 |
| bknudson | dolphm: lbragstad: default wouldn't work well since it's unique. | 03:20 |
| bknudson | you'd only be able to make one with '' and then the next would conflict | 03:20 |
| *** wchrisj has quit IRC | 03:21 | |
| *** wchrisj has joined #openstack-keystone | 03:35 | |
| ayoung | bknudson, Python question: I was messing with the CMS code and if I do the PEM form, it seems to work fine, but DER fails (can't validate what I just signed) PEM is text, DER is binary. Is there something I need to do to handle binary marshalled via stdin/stdout ? | 03:49 |
| stevemar | dstanek, select all unread -> delete | 03:52 |
| stevemar | problem solved | 03:52 |
| lbragstad | bknudson: dolphm not sure why description is unique | 03:55 |
| lbragstad | dolphm: bknudson I could push a change setting description to "" if not provided. Like dolphm said, that can be done in the manager, and then add a FIXME to fix properly with a migration in J after feature freeze | 03:56 |
| lbragstad | ? | 03:57 |
| lbragstad | that might work | 03:57 |
| stevemar | jamielennox, ping? | 03:58 |
| jamielennox | stevemar: hey | 04:00 |
| stevemar | jamielennox, hey, so question about changes to httpclient | 04:01 |
| stevemar | jamielennox, when I was adding trying to add new args (consumer and access stuff) to client (in the test), i thought i had to update httpclient too? or just auth/v3? | 04:02 |
| stevemar | if i didn't need to change httpclient, then all the changes in accessInfo can go too :) | 04:02 |
| jamielennox | stevemar: my hope is that the client shouldn't have anything to do with auth anymore | 04:04 |
| jamielennox | base client | 04:04 |
| jamielennox | it will mean that you are limited to using the new method when you want to use oauth | 04:05 |
| jamielennox | so like create a session, give it a plugin and give it to client | 04:05 |
| jamielennox | but this is a pattern i want people to get used to anyway | 04:05 |
| *** ayoung has quit IRC | 04:05 | |
| jamielennox | once you have the auth plugin on the session it will work for the client | 04:06 |
| stevemar | jamielennox, i'm all for doing whatever you need me to do, so i don't go against what you designed | 04:06 |
| stevemar | jamielennox, but i guess i'm not seeing the pattern that you want? | 04:07 |
| jamielennox | umm, alright so blog post | 04:07 |
| jamielennox | http://www.jamielennox.net/blog/2014/02/24/client-session-objects/ | 04:07 |
| jamielennox | hopefully that one explains the desing | 04:07 |
| jamielennox | there is an older one: http://www.jamielennox.net/blog/2013/09/27/apiclient-communications/ | 04:07 |
| jamielennox | for design | 04:07 |
| jamielennox | basically the client will know nothing about auth | 04:08 |
| jamielennox | whats left on client is all there for compatability | 04:08 |
| jamielennox | if you have a session object with a plugin then whatever requests passes through that plugin will get given a token | 04:08 |
| jamielennox | if you have a session object with a plugin then whatever requests passes through that session will get given a token | 04:09 |
| jamielennox | so all the client does is send it to the session | 04:09 |
| stevemar | jamielennox, so, i agree that i can probably do the signing part in get_auth_data and update the headers there. thats cool | 04:15 |
| *** wchrisj has quit IRC | 04:15 | |
| stevemar | jamielennox, so I guess I'm instantiating the client incorrectly? how can i add a plugin to a session? is there a test that already does this? | 04:17 |
| jamielennox | stevemar: so keystoneclient/tests/auth/ | 04:18 |
| jamielennox | have v2 and v3 examples | 04:18 |
| jamielennox | i don't know if any of those are actually passing session to client | 04:19 |
| jamielennox | but thats just v3.Client(session=session) | 04:19 |
| stevemar | jamielennox, ah okay, i was using tests/v3/test_auth.py as a basis | 04:19 |
| *** derek_c has joined #openstack-keystone | 04:20 | |
| jamielennox | ah, yea that's the original stuff | 04:20 |
| stevemar | jamielennox, ah okay, i think I see where the magic happens: a = v3.Password(self.TEST_URL, ... ) | 04:22 |
| stevemar | jamielennox, i hope the patch that adds request / access token support raises your blood pressure less :) | 04:23 |
| jamielennox | stevemar: oh i started that review and never got to the end | 04:24 |
| jamielennox | no blood pressure raised | 04:24 |
| jamielennox | you are the first person (non-me) to attempt a plugin afaik so i want to make sure i've got the plugin calls right | 04:25 |
| *** bvandenh has joined #openstack-keystone | 04:41 | |
| *** harlowja is now known as harlowja_away | 04:49 | |
| *** devlaps has joined #openstack-keystone | 04:55 | |
| *** harlowja_away is now known as harlowja | 05:02 | |
| stevemar | jamielennox, ping | 05:07 |
| jamielennox | yea | 05:07 |
| stevemar | jamielennox, so it works awesomely | 05:07 |
| jamielennox | sweet | 05:07 |
| stevemar | just one catch, i remember why i put the signing in the auth ref | 05:07 |
| *** wchrisj has joined #openstack-keystone | 05:07 | |
| stevemar | it was because i needed the entire url, including the self.auth_url part | 05:07 |
| stevemar | do you think it's possible to add url to get_auth_ref, along with headers? | 05:08 |
| jamielennox | crap | 05:08 |
| jamielennox | umm | 05:08 |
| stevemar | or maybe kwargs | 05:09 |
| jamielennox | there's always an edge case | 05:09 |
| jamielennox | let me find the revie | 05:09 |
| jamielennox | w | 05:09 |
| stevemar | https://review.openstack.org/#/c/77977/4/keystoneclient/auth/identity/v3.py | 05:09 |
| jamielennox | stevemar: do you need to communicate with the URL or just use it? | 05:10 |
| stevemar | just use it | 05:10 |
| stevemar | line 108 of the link i sent you | 05:10 |
| jamielennox | yep | 05:11 |
| jamielennox | i'm just trying to think if there is a more common case we could do | 05:12 |
| jamielennox | like maybe i provide the original auth plugin to the auth_method and let you get it yourself | 05:12 |
| jamielennox | it makes sense to make that take kwargs anyway | 05:13 |
| stevemar | i was leaning toward kwargs tbh | 05:13 |
| stevemar | cause different plugins will do funky things | 05:13 |
| jamielennox | yea, i was somewhat trying to restrict funky things | 05:13 |
| jamielennox | but i guess it makes sense that they might need the session object as well | 05:13 |
| jamielennox | to communicate with other places | 05:14 |
| stevemar | unless i can surface the oauthlib object, and sign it later, but that seems messy | 05:14 |
| jamielennox | yea, it means that the parent has to be aware of the plugin type | 05:14 |
| stevemar | bleh | 05:14 |
| stevemar | which is a no-no | 05:14 |
| jamielennox | ok, i think it makes sense to pass session and kwargs through to get_auth_data | 05:15 |
| jamielennox | kwargs should probably be passed from the get_auth_ref call through to get_auth_data | 05:16 |
| jamielennox | but they will mostly be empty | 05:16 |
| stevemar | jamielennox, i made the change to add session in my latest patch, but decided against kwargs, since i don't need them right now. | 05:31 |
| stevemar | jamielennox, new patch up, *much* less code now, thanks for steering me in the right direction! | 05:32 |
| jamielennox | stevemar: https://review.openstack.org/#/c/78523/ | 05:33 |
| jamielennox | we kind of need kwargs | 05:33 |
| jamielennox | because if we release the interface without it then plugins written to support it won't accept additional args | 05:34 |
| jamielennox | and if we ever want to add something in later it can't | 05:34 |
| jamielennox | so if we do an open ended kwargs not then we don't trap ourselves | 05:34 |
| stevemar | jamielennox, makes sense | 05:35 |
| jamielennox | stevemar: if you rebase on that one i provided you should just be able to do auth.token_url | 05:35 |
| stevemar | jamielennox, yep | 05:36 |
| stevemar | jamielennox, btw - are you okay with the test living with the other oauth tests? or did you want it in the auth tests? | 05:36 |
| jamielennox | stevemar: i don't mind | 05:36 |
| stevemar | cool | 05:36 |
| *** wchrisj has quit IRC | 05:44 | |
| *** stevemar has quit IRC | 05:59 | |
| *** gyee has quit IRC | 06:00 | |
| *** chandan_kumar has joined #openstack-keystone | 06:04 | |
| *** gokrokve_ has quit IRC | 06:04 | |
| *** gokrokve has joined #openstack-keystone | 06:04 | |
| *** gokrokve has quit IRC | 06:08 | |
| *** topol has joined #openstack-keystone | 06:10 | |
| *** gokrokve has joined #openstack-keystone | 06:15 | |
| *** topol has quit IRC | 06:27 | |
| *** thedodd has quit IRC | 06:34 | |
| *** amcrn has joined #openstack-keystone | 06:40 | |
| *** jamielennox is now known as jamielennox|away | 06:57 | |
| *** harlowja is now known as harlowja_away | 06:59 | |
| *** marcoemorais has joined #openstack-keystone | 07:14 | |
| *** marcoemorais1 has joined #openstack-keystone | 07:16 | |
| *** marcoemorais has quit IRC | 07:18 | |
| *** harlowja_away has quit IRC | 07:21 | |
| *** saju_m has joined #openstack-keystone | 07:22 | |
| *** henrynash has joined #openstack-keystone | 07:40 | |
| *** henrynash has quit IRC | 07:42 | |
| *** jaosorior has joined #openstack-keystone | 07:51 | |
| jaosorior | Hello, I just downloaded the source code and ran the unit test suit, and it appears that the majority of tests in "keystone.tests.test_keystoneclient.KcMasterTestCase" are failing, is this normal? | 07:52 |
| *** gokrokve has quit IRC | 08:00 | |
| *** gokrokve has joined #openstack-keystone | 08:00 | |
| *** gokrokve has quit IRC | 08:04 | |
| *** saju_m has quit IRC | 08:06 | |
| *** saju_m has joined #openstack-keystone | 08:19 | |
| *** dstanek has quit IRC | 08:20 | |
| *** saju_m has quit IRC | 08:24 | |
| *** derek_c has quit IRC | 08:24 | |
| *** YorikSar has quit IRC | 08:33 | |
| *** saju_m has joined #openstack-keystone | 08:37 | |
| *** gokrokve has joined #openstack-keystone | 08:43 | |
| *** gokrokve_ has joined #openstack-keystone | 08:45 | |
| *** gokrokve has quit IRC | 08:47 | |
| *** gokrokve_ has quit IRC | 08:49 | |
| *** achudnovets1 has joined #openstack-keystone | 09:04 | |
| *** marcoemorais1 has quit IRC | 09:08 | |
| *** saju_m has quit IRC | 09:12 | |
| achudnovets1 | hi. I need some help :) Will domain support affect urls of other OpenStack services (nova, etc)? Will domain be added to url (v1/{project_id}/{domain_id}/...) or it will be used only for obtaining token? | 09:23 |
| *** leseb has joined #openstack-keystone | 09:25 | |
| *** henrynash has joined #openstack-keystone | 09:30 | |
| *** henrynash has quit IRC | 09:36 | |
| *** marekd|away is now known as marekd | 09:44 | |
| *** gokrokve has joined #openstack-keystone | 09:45 | |
| *** gokrokve has quit IRC | 09:50 | |
| *** saju_m has joined #openstack-keystone | 09:59 | |
| *** achudnovets1 has quit IRC | 10:02 | |
| *** marcoemorais has joined #openstack-keystone | 10:06 | |
| *** morganfainberg_Z is now known as morganfainberg | 10:06 | |
| *** marcoemorais has quit IRC | 10:10 | |
| *** YorikSar has joined #openstack-keystone | 10:10 | |
| *** henrynash has joined #openstack-keystone | 10:31 | |
| *** bvandenh has quit IRC | 10:36 | |
| *** gokrokve has joined #openstack-keystone | 10:45 | |
| *** saju_m has quit IRC | 10:46 | |
| *** gokrokve has quit IRC | 10:50 | |
| *** bvandenh has joined #openstack-keystone | 11:03 | |
| *** saju_m has joined #openstack-keystone | 11:03 | |
| *** marcoemorais has joined #openstack-keystone | 11:07 | |
| *** marcoemorais has quit IRC | 11:11 | |
| *** marcoemorais has joined #openstack-keystone | 11:39 | |
| *** marcoemorais has quit IRC | 11:43 | |
| *** gokrokve has joined #openstack-keystone | 11:45 | |
| *** gokrokve has quit IRC | 11:49 | |
| *** devlaps has quit IRC | 12:11 | |
| *** bvandenh has quit IRC | 12:18 | |
| *** morganfainberg is now known as morganfainberg_Z | 12:27 | |
| *** zoresvit has joined #openstack-keystone | 12:37 | |
| *** marcoemorais has joined #openstack-keystone | 12:39 | |
| *** dstanek has joined #openstack-keystone | 12:41 | |
| *** marcoemorais has quit IRC | 12:43 | |
| *** gokrokve has joined #openstack-keystone | 12:45 | |
| *** gokrokve has quit IRC | 12:49 | |
| *** david-lyle has quit IRC | 13:10 | |
| *** marekd has quit IRC | 13:13 | |
| *** dims has quit IRC | 13:18 | |
| *** dims has joined #openstack-keystone | 13:19 | |
| *** marekd has joined #openstack-keystone | 13:19 | |
| *** saju_m has quit IRC | 13:27 | |
| *** bknudson has left #openstack-keystone | 13:35 | |
| *** marcoemorais has joined #openstack-keystone | 13:40 | |
| *** marcoemorais has quit IRC | 13:45 | |
| *** gokrokve has joined #openstack-keystone | 13:45 | |
| *** gokrokve has quit IRC | 13:49 | |
| dolphm | jamielennox|away: forced into releasing a keystoneclient today due to bug 1287301 | 13:50 |
| *** gordc has joined #openstack-keystone | 13:58 | |
| *** bknudson has joined #openstack-keystone | 14:12 | |
| *** lazzari has joined #openstack-keystone | 14:12 | |
| lazzari | Hi, I'm always getting "no handlers" when running keystone discover. Is that the expected behavior? | 14:14 |
| lazzari | keystone discover Keystone found at http://127.0.0.1:5000/v2.0 - supports version v2.0 (stable) here http://localhost:5000/v2.0/ No handlers could be found for logger "keystoneclient.generic.client" | 14:14 |
| *** ayoung has joined #openstack-keystone | 14:29 | |
| dolphm | lazzari: https://bugs.launchpad.net/python-keystoneclient/+bug/936404 | 14:34 |
| lazzari | great! tnx | 14:35 |
| *** wchrisj has joined #openstack-keystone | 14:35 | |
| *** browne has joined #openstack-keystone | 14:39 | |
| *** marcoemorais has joined #openstack-keystone | 14:41 | |
| *** stevemar has joined #openstack-keystone | 14:42 | |
| *** gokrokve has joined #openstack-keystone | 14:45 | |
| *** marcoemorais has quit IRC | 14:45 | |
| *** zoresvit has quit IRC | 14:47 | |
| *** gokrokve has quit IRC | 14:49 | |
| *** zoresvit has joined #openstack-keystone | 14:59 | |
| *** nkinder has quit IRC | 15:00 | |
| *** topol has joined #openstack-keystone | 15:01 | |
| *** gokrokve has joined #openstack-keystone | 15:02 | |
| *** zoresvit has quit IRC | 15:23 | |
| *** david-lyle has joined #openstack-keystone | 15:35 | |
| *** thedodd has joined #openstack-keystone | 15:39 | |
| *** marcoemorais has joined #openstack-keystone | 15:42 | |
| *** marcoemorais has quit IRC | 15:46 | |
| ayoung | dstanek, Python question. I am doing a popen, and want to pass binary data via stdin and stdout. communicate() indicates that it needs strings. What is the right mechanism? | 15:48 |
| dstanek | ayoung: i've never had to do that, but i suspect if you have your binary data in a str you'd be fine | 15:51 |
| ayoung | dstanek, well, I did not seem to be fine | 15:51 |
| ayoung | dstanek, there are two formats I can pass to openssl cms | 15:51 |
| dstanek | str is bytes and unicode is text - that's why in Py3 str -> byte and unicode -> str | 15:51 |
| ayoung | one is PEM wyhich is base64 | 15:51 |
| ayoung | one is DER, which is binary | 15:51 |
| dstanek | ayoung: do you have a snippet i can look at? | 15:51 |
| ayoung | dstanek, ...um, I did...let me reproduce | 15:52 |
| ayoung | here | 15:52 |
| ayoung | dstanek, https://review.openstack.org/#/c/71181/14/examples/pki/gen_cmsz.py | 15:52 |
| ayoung | grab that whole review | 15:52 |
| ayoung | and ... | 15:52 |
| ayoung | actually, let me set it up for you. | 15:53 |
| ayoung | eh...should be good enough , see how I do #verify before writing | 15:54 |
| ayoung | if you go into the dependent file: | 15:54 |
| ayoung | https://review.openstack.org/#/c/71181/14/keystoneclient/common/cms.py | 15:54 |
| ayoung | I hard coded it...one sec, let me repost | 15:54 |
| *** nkinder has joined #openstack-keystone | 15:55 | |
| *** marekd is now known as marekd|away | 15:58 | |
| ayoung | dstanek, https://review.openstack.org/#/c/71181/ latest shows the problem in commented out code in | 16:00 |
| ayoung | https://review.openstack.org/#/c/71181/15/examples/pki/gen_cmsz.py | 16:00 |
| ayoung | and..I have a phone call for an internal meeting | 16:00 |
| *** mlemay has joined #openstack-keystone | 16:02 | |
| dstanek | ayoung: ping me when you are back | 16:10 |
| dolphm | bknudson: gating https://review.openstack.org/#/c/75549/ | 16:12 |
| bknudson | dolphm: I tried picking up the fix for the mysql warning but that ran into a snag... spammed the logs. | 16:13 |
| *** chandan_kumar has quit IRC | 16:13 | |
| bknudson | hopefully I can get that figured out later today... | 16:13 |
| dolphm | bknudson: i was just looking at that fix | 16:14 |
| bknudson | dolphm: does it make sense to cache tokens for 5 minutes? | 16:29 |
| bknudson | (by defualt) | 16:29 |
| dolphm | bknudson: sure, why not? | 16:29 |
| bknudson | that means that a token will work for 5 minutes after you revoke it. | 16:29 |
| dolphm | bknudson: correct | 16:30 |
| bknudson | UUID tokens | 16:30 |
| bknudson | PKI tokens will be invalidated every 1 sec | 16:30 |
| dolphm | bknudson: obviously tunable if you need different performance characteristics | 16:30 |
| bknudson | I wonder what it's typically set to. | 16:30 |
| dolphm | bknudson: the cache time applies to both UUID and PKI right now | 16:30 |
| dolphm | bknudson: i imagine the default ;) | 16:31 |
| bknudson | well, PKI is going to hit the revocation list | 16:31 |
| bknudson | and revocation_cache_time is 1 second, so they'll be invalid right away | 16:31 |
| dolphm | bknudson: reasonable expectation, but that's not true | 16:32 |
| dolphm | bknudson: https://bugs.launchpad.net/python-keystoneclient/+bug/1287301/comments/4 | 16:33 |
| bknudson | nova-api does an odd thing where there are actually multiple caches... one for each worker or something. | 16:34 |
| bknudson | so a token might work depending on which worker it hits has it cached or not. | 16:34 |
| bknudson | so the processing doesn't go 1. get-token (from cache) , 2. validate against revocation list? | 16:36 |
| lbragstad | dolphm: bknudson possible region v3 fix for description, per discussion last night: https://review.openstack.org/#/c/78658/ | 16:37 |
| bknudson | lbragstad: add a test where you add 2 with no description. | 16:38 |
| lbragstad | bknudson: I added a test with no description | 16:38 |
| lbragstad | https://review.openstack.org/#/c/78658/1/keystone/tests/test_v3_catalog.py | 16:39 |
| *** richm has joined #openstack-keystone | 16:39 | |
| bknudson | lbragstad: also add a test where you add another one with no descripton. | 16:39 |
| lbragstad | oh, two regions. OK | 16:40 |
| *** jaosorior has quit IRC | 16:40 | |
| bknudson | Looks like auth_token gets the token from cache: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/middleware/auth_token.py#L827 | 16:40 |
| bknudson | then verified = self.verify_signed_token(user_token) | 16:40 |
| bknudson | which will check the revocation list | 16:41 |
| *** dims has quit IRC | 16:45 | |
| *** dstanek has quit IRC | 16:47 | |
| *** dstanek_afk has joined #openstack-keystone | 16:47 | |
| *** dstanek_afk is now known as dstanek | 16:48 | |
| *** lazzari has quit IRC | 16:50 | |
| *** amcrn has quit IRC | 16:53 | |
| *** packet has joined #openstack-keystone | 16:53 | |
| *** gokrokve has quit IRC | 16:55 | |
| dolphm | bknudson: if you back auth_token to a memcached instance, you can share that cache across workers | 16:58 |
| dolphm | bknudson: also, https://review.openstack.org/#/c/78650/ | 16:58 |
| lbragstad | bknudson: good call, thanks for the heads up. | 17:00 |
| *** dims has joined #openstack-keystone | 17:01 | |
| *** harlowja has joined #openstack-keystone | 17:02 | |
| dolphm | lbragstad: i don't really think you need to make description nullable | 17:02 |
| dolphm | bknudson: lbragstad: but i didn't see where description was made unique? | 17:02 |
| lbragstad | dolphm: description was never checked if it was unique until it was in the sql backend | 17:03 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/common/sql/migrate_repo/versions/037_add_region_table.py#L26 | 17:05 |
| lbragstad | according to the migration, description has to be unique | 17:06 |
| lbragstad | looks like regions is the only keystone resource that enforces its description to be unique. | 17:07 |
| *** rwsu has joined #openstack-keystone | 17:08 | |
| *** gyee has joined #openstack-keystone | 17:10 | |
| wchrisj | Could someone tell me if this bug might still be in play in (devstack) KS? https://bugs.launchpad.net/keystone/+bug/997231 | 17:21 |
| *** marcoemorais has joined #openstack-keystone | 17:21 | |
| stevemar | wchrisj, whoa that is old | 17:22 |
| wchrisj | Am trying to hit this URL, and the docs for v2 say it should work: http://devstack.local:5000/v2.0/users/{userid}/roles | 17:22 |
| wchrisj | but I'm seeing the behavior in that bug | 17:22 |
| wchrisj | stevemar: my thoughts exactly | 17:22 |
| stevemar | wchrisj, what version are you using? | 17:23 |
| wchrisj | version of what? | 17:23 |
| stevemar | of openstack | 17:23 |
| wchrisj | devstack | 17:24 |
| wchrisj | few days old | 17:24 |
| wchrisj | master branch, I assume | 17:24 |
| stevemar | wchrisj, /v2.0/users/{user_id}/roles should work | 17:25 |
| stevemar | what the error you're seeing? | 17:25 |
| wchrisj | ok, then it's something with my code - that's what I was trying to confirm | 17:25 |
| wchrisj | an error 501 - User roles not supported: tenant ID required | 17:26 |
| wchrisj | I think I'm hitting the wrong port | 17:26 |
| wchrisj | my specs use port 5000 - suspect it should be 35357 | 17:26 |
| wchrisj | I think it's a port issue | 17:26 |
| *** gokrokve has joined #openstack-keystone | 17:26 | |
| wchrisj | when I manually hit the url, I get a 404 - would I get that if there are no roles associated with the user in question? stevemar: | 17:28 |
| stevemar | wchrisj, if there were not rules it shoulnd't be 404, it would be an empty list | 17:31 |
| wchrisj | makes sense | 17:31 |
| stevemar | empty list is still valid | 17:31 |
| dolphm | stevemar: wchrisj: i don't think it's a supported call, as the error message indicates | 17:31 |
| wchrisj | yeah, I'm getting a 404 trying to hit this url | 17:32 |
| wchrisj | http://devstack.local:5000/v2.0/users/2f649419c1ed4801bea38ead0e1ed6ad/roles | 17:32 |
| wchrisj | manually | 17:32 |
| dolphm | wchrisj: that sounds right; if you tried port 35357 you'd get a http 501 instead | 17:32 |
| wchrisj | What am I missing Steve? | 17:32 |
| dolphm | wchrisj: it's an ambiguously specified API call that we chose to never implement so as to avoid flip-flopping between the two perceivable interpretations of the spec; instead we have GET /v3/role_assignments | 17:33 |
| dolphm | wchrisj: which is much more powerful and avoids any confusing semantics around the call | 17:33 |
| wchrisj | so why do the docs say it exists? | 17:33 |
| wchrisj | v2 docs | 17:33 |
| ayoung | dstanek, I think I figured it: universal_newlines was set to True...testing now with them False for PEM | 17:34 |
| ayoung | er DER | 17:34 |
| wchrisj | ... just trying to understand... | 17:34 |
| dolphm | wchrisj: because it *may* be implemented by an alternative implementation of the API, but keystone chooses not to | 17:34 |
| *** amcrn has joined #openstack-keystone | 17:34 | |
| wchrisj | aha | 17:34 |
| wchrisj | I think of Keystone as the canonical implementation - good to know | 17:35 |
| dolphm | wchrisj: ++ | 17:35 |
| dolphm | wchrisj: if you have authz on the rackspace public cloud, i think you'll get something back -- but you'd likely file a bug report because it's not the results you'd expect :) | 17:35 |
| wchrisj | I'm a fairly new OS dev, so that's good to know | 17:35 |
| ayoung | dstanek, yep, that was it | 17:36 |
| dolphm | wchrisj: the identity service is one of the few APIs with more than one complete implementation in production floating around | 17:36 |
| wchrisj | wild | 17:36 |
| dstanek | ayoung: nice | 17:36 |
| dolphm | wchrisj: keystone just happens to be the one supported by openstack directly | 17:37 |
| wchrisj | dolphm: gotcha | 17:37 |
| dolphm | wchrisj: and if you look at the diablo release of keystone vs the essex release of keystone -- those were actually two completely different implementations from the ground up | 17:37 |
| wchrisj | wow | 17:37 |
| wchrisj | ok | 17:37 |
| ayoung | wchrisj, we've stabilized somewhat from that point | 17:38 |
| wchrisj | dolphm: and v3 is a whole different animal altogether! | 17:38 |
| wchrisj | ;-) | 17:38 |
| wchrisj | OK, so I'm gonna document this call as one to "stay away" from | 17:40 |
| wchrisj | and handle in v3 | 17:40 |
| *** gokrokve_ has joined #openstack-keystone | 17:40 | |
| *** gokrokve has quit IRC | 17:43 | |
| wchrisj | Many thanks stevemar: dolphm: | 17:44 |
| dolphm | wchrisj: ++ i'd like it to be removed from openstack's api site since we don't support it directly | 17:45 |
| dolphm | wchrisj: you're not the only one to be confused by it :( | 17:46 |
| dolphm | bknudson: https://review.openstack.org/#/c/75549/ | 17:46 |
| wchrisj | ++ | 17:46 |
| *** zhiyan is now known as zhiyan_ | 17:49 | |
| dolphm | bknudson: pushing a merge conflict fix for that | 17:51 |
| *** browne has quit IRC | 17:53 | |
| dolphm | lbragstad: yikes... maybe we really do need a migration to fix that | 18:00 |
| dolphm | lbragstad: it's not that we need to avoid migrations right now, i just want to make sure they're necessary | 18:01 |
| *** browne has joined #openstack-keystone | 18:01 | |
| dolphm | lbragstad: i.e. refactoring the assignments table would be a no-go right now, etc | 18:01 |
| lbragstad | dolphm: yeah, that's understandable. Either way works | 18:02 |
| dolphm | lbragstad: keep nullable=True, and just drop unique=True? | 18:04 |
| dolphm | lbragstad: then in the manager, region.setdefault('description', '') ? | 18:04 |
| lbragstad | dolphm: ok, so we are going carry that in the manager | 18:05 |
| dolphm | lbragstad: err, keep nullable=False i meant | 18:05 |
| lbragstad | right | 18:05 |
| lbragstad | yep | 18:05 |
| dolphm | lbragstad: could ask jaypipes, but i'm guessing that unique=True was either a bad copy/paste that we didn't catch, or it was a sort of workaround before user-defined region IDs was implemented | 18:06 |
| *** cmart_ has joined #openstack-keystone | 18:07 | |
| lbragstad | dolphm: gotcha, makes sense | 18:07 |
| *** chandan_kumar has joined #openstack-keystone | 18:07 | |
| dolphm | lbragstad: set the patch to WIP for now-- ping me when you have another patchset | 18:08 |
| cmart_ | Hello | 18:08 |
| dolphm | cmart_: o/ | 18:08 |
| cmart_ | sorry for interrupt.. | 18:08 |
| lbragstad | dolphm: ok, I'll get a migration in the works. Thanks | 18:09 |
| cmart_ | I'm new with keystone and I got an error that I could not understand.. I'm using devstack and I pulled the latest changes from Keystone master.. But when I try to run the stack, I got the following error: http://paste.openstack.org/show/72804/ | 18:10 |
| cmart_ | Where can I find more info related to this (like logs, or smth like that)? | 18:11 |
| cmart_ | Is this room the right place to ask these kind of things? | 18:12 |
| dolphm | cmart_: looks like you need the latest version of oslo.config (pip install -U oslo.config) | 18:12 |
| dolphm | cmart_: there wouldn't be additional logs related to that backtrace | 18:13 |
| dolphm | cmart_: you probably need to update all of keystone's dependencies though, so pip install --upgrade -r /opt/stack/keystone/requirements.txt -r /opt/stack/keystone/test-requirements.txt | 18:14 |
| cmart_ | dolphm: oh.. I see.. Well, I have the oslo.config updated.. I'll try with the keystone's dependencies then.. Thanks! | 18:14 |
| cmart_ | dolphm: Could this be also the reason why running tox gave me a lot of errors? ERROR: could not install deps [-r/opt/stack/keystone/requirements.txt, -r/opt/stack/keystone/test-requirements.txt] ? | 18:18 |
| dolphm | cmart_: looks like you're just missing a space after the -r | 18:19 |
| cmart_ | dolphm: I didn´t modify the tox.ini file and that log came from executing tox at /opt/stack/keystone.. This is the final part of the log http://paste.openstack.org/show/72779/ | 18:23 |
| cmart_ | dolphm: The dependecies upgrade just finished.. I'll give it a try and let you know.. Thanks | 18:23 |
| *** thedodd has quit IRC | 18:26 | |
| stevemar | dolphm, ayoung can https://review.openstack.org/#/c/78523/ get a review? ksclient related adding more info the authmethod plugins | 18:26 |
| ayoung | stevemar, you really should add reviewers to the review list on the page | 18:27 |
| ayoung | stevemar, looks pretty straight forward. I take it you need that for oauth? | 18:28 |
| stevemar | ayoung, yep | 18:28 |
| stevemar | ayoung, jamie posted it last night | 18:28 |
| ayoung | stevemar, commit message should really read : add auth_url to session...but I am surprised it is not there already | 18:29 |
| ayoung | interesting... | 18:30 |
| stevemar | ? | 18:30 |
| ayoung | stevemar, that has some interesting ramificatrions... | 18:30 |
| stevemar | such as? | 18:30 |
| ayoung | return '%s/auth/tokens' % self.auth_url.rstrip('/') | 18:30 |
| ayoung | implies that it is always going to one URL. | 18:30 |
| *** gyee has quit IRC | 18:30 | |
| ayoung | I'm thinking like the SAML and Kerberos stuff | 18:30 |
| ayoung | say you want to use a different suburl due to Apache mapping | 18:31 |
| ayoung | you could, in theory do | 18:31 |
| ayoung | for kerberos /v3/kerberos/auth/tokens | 18:31 |
| bknudson | dolphm: that's for taking care of the conflict | 18:31 |
| ayoung | for x509 kerberos /v3/x509/auth/tokens | 18:31 |
| stevemar | ayoung, we're not ready for that anyway, that bit of code was just pulling out something and making it a property | 18:32 |
| *** mlemay has quit IRC | 18:32 | |
| ayoung | yes, but the world is ready for it, and we need to think in those terms | 18:32 |
| ayoung | these issues are coming up time and again | 18:32 |
| stevemar | ayoung, yeah, but this patch isn't going to address that | 18:32 |
| ayoung | stevemar, I realize...you just got me thinkng. Always a dangerous thing to do | 18:33 |
| ayoung | stevemar, https://review.openstack.org/#/c/71181/ that is going to be needed for compressed tokens and running Keystone in Apache, which means needed for SAML. Take a look whn you get the chance | 18:38 |
| *** jnanin has joined #openstack-keystone | 18:41 | |
| *** jnanin has quit IRC | 18:46 | |
| dstanek | stevemar: you're fast | 18:46 |
| stevemar | dstanek, yay? | 18:46 |
| *** mlemay has joined #openstack-keystone | 18:47 | |
| stevemar | dstanek, i don't like lettings things linger when they are easy to fix | 18:47 |
| dstanek | stevemar: definitely a yay | 18:49 |
| *** dims has quit IRC | 19:00 | |
| *** dims has joined #openstack-keystone | 19:02 | |
| dstanek | i was looking at https://review.openstack.org/#/c/75741 and i noticed an inconsistency | 19:08 |
| dstanek | we typically use our own exception hierarchy for dealing with errors, but there are a few cases where we don't and we use WebOb's implementation | 19:09 |
| dstanek | doing this (i believe) leads to HTML error pages instead of JSON error pages | 19:09 |
| dstanek | has anyone come across that before? | 19:09 |
| dstanek | trying to unwind the insanity that is webob now | 19:10 |
| *** thedodd has joined #openstack-keystone | 19:20 | |
| richm | is anyone else having problems signing into gerrit? | 19:26 |
| *** gyee has joined #openstack-keystone | 19:29 | |
| dstanek | richm: i was able to login in an incognito window - are you getting an error? | 19:42 |
| richm | dstanek: it just hangs for a while trying to get to login.launchpad.net, then times out | 19:43 |
| dstanek | can you get to launchpad.net at all? | 19:43 |
| richm | I can go directly to login.launchpad.net just fine | 19:43 |
| richm | but somehow through the "sign in" link it fails | 19:43 |
| dstanek | hmmm...maybe launchpad is having issues? | 19:44 |
| dstanek | if you continue to have issues infra would probably be the best place to ask | 19:44 |
| richm | well, if no one else is having issues, then I probably need to logout and delete cookies | 19:45 |
| *** zhiyan_ is now known as zhiyan | 19:46 | |
| dolphm | bknudson: https://review.openstack.org/#/c/78521/ | 19:48 |
| dstanek | is ec2_token middleware still used? | 19:51 |
| dolphm | dstanek: by heat | 19:51 |
| dolphm | richm: just signed out of and back into gerrit without issue | 19:51 |
| dstanek | dolphm: did you see my webob question above? i think that middleware will return HTML in some cases - i wanted to augment the tests, but I can't find them | 19:52 |
| richm | yeah - I had to sign out of everything launchpad and openstack related, then delete all corresponding cookies | 19:52 |
| dolphm | dstanek: ec2 returns html? | 19:52 |
| dstanek | dolphm: i thought maybe they were in test_v3_credential.py, but i don't think so | 19:52 |
| dolphm | dstanek: i've definitely seen html produced in error conditions; we used to use webob in more places so it was more common | 19:53 |
| dolphm | dstanek: auth_token still returns plain text on failure, which is weird too | 19:53 |
| dstanek | dolphm: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/middleware/ec2_token.py#n53 | 19:53 |
| dolphm | dstanek: the change you linked is changing a docstr btw | 19:54 |
| dstanek | something would have to catch those and turn them into something else - if it runs in heat's stack they may already be doing that | 19:54 |
| ayoung | richm, should this be considered a bug fix? https://review.openstack.org/#/c/76002/ | 19:55 |
| richm | ayoung: yes, and a behavior change | 19:55 |
| dolphm | dstanek: the v3 version does it correctly, i believe | 19:56 |
| dolphm | dstanek: but i don't think there's any reason we couldn't rewrite those as proper exception.ValidationError's | 19:56 |
| dolphm | dstanek: that module predates our own exception hierarchy, and just hasn't been given much love | 19:56 |
| dstanek | dolphm: yeah, i know - i was trying to figure out which is more correct detail or explanation and it led me to this | 19:57 |
| dstanek | dolphm: technically speakeing the original way we had it would most likely be what we want *if* we used the HTML responses https://github.com/Pylons/webob/blob/master/webob/exc.py#L234 | 19:57 |
| *** wchrisj_ has joined #openstack-keystone | 19:57 | |
| dolphm | dstanek: in https://review.openstack.org/#/c/75741 ? | 19:57 |
| bknudson | dstanek: you can check the coverage report to see how well tested it is | 19:58 |
| bknudson | http://logs.openstack.org/5d/5d65f0f0401e5a9f6b142c01659c3bb3434fdf44/post/keystone-coverage/87a4606/cover/keystone_middleware_ec2_token.html | 19:58 |
| *** dstanek_afk has joined #openstack-keystone | 19:59 | |
| dstanek_afk | dolphm: if you use detail (as we currently have it) then the HTML looks something like 'Forbidden Message From WebOb<br><br>Nice Try' | 19:59 |
| dstanek_afk | hmmm...looks like i got bounced | 19:59 |
| *** dstanek has quit IRC | 20:00 | |
| *** dstanek_afk is now known as dstanek | 20:00 | |
| dstanek | i think think it matters though because we don't used either property and we don't want HTML | 20:00 |
| *** topol_ has joined #openstack-keystone | 20:02 | |
| *** wchrisj__ has joined #openstack-keystone | 20:02 | |
| *** wchrisj_ has quit IRC | 20:03 | |
| dolphm | dstanek: ++ | 20:03 |
| dolphm | bknudson: so, it's not even imported :P | 20:03 |
| *** wchrisj has quit IRC | 20:03 | |
| *** harlowja has quit IRC | 20:03 | |
| bknudson | dolphm: there's no coverage for the ec2 middleware in our unit tests. | 20:03 |
| bknudson | importing it would be a good first step. | 20:03 |
| *** harlowja has joined #openstack-keystone | 20:04 | |
| *** topol has quit IRC | 20:05 | |
| *** topol_ is now known as topol | 20:05 | |
| dstanek | bknudson: that'll get you to 15% without even writing tests! | 20:06 |
| ayoung | richm, file it as a bug first, then, and we can consider it for Icehouse. That change doesn't look horrible enough that we should rule it out on size | 20:08 |
| richm | well, it was a bug in rh bugzilla | 20:08 |
| *** cmart_ has quit IRC | 20:08 | |
| richm | the rh bz has since been closed | 20:08 |
| *** dstanek is now known as dstanek_afk | 20:09 | |
| richm | ayoung: I'm not sure what you mean by "file it as a bug first" | 20:11 |
| *** marcoemorais has quit IRC | 20:13 | |
| *** marcoemorais has joined #openstack-keystone | 20:15 | |
| *** marcoemorais has quit IRC | 20:16 | |
| *** marcoemorais has joined #openstack-keystone | 20:16 | |
| *** marcoemorais has quit IRC | 20:16 | |
| *** marcoemorais has joined #openstack-keystone | 20:17 | |
| *** achudnovets has joined #openstack-keystone | 20:28 | |
| *** devlaps has joined #openstack-keystone | 20:36 | |
| dolphm | richm: he's referring to https://bugs.launchpad.net/keystone | 20:39 |
| richm | dolphm: yes | 20:39 |
| *** achudnovets has quit IRC | 20:40 | |
| *** achudnovets has joined #openstack-keystone | 20:40 | |
| *** achudnovets has quit IRC | 20:42 | |
| *** achudnovets1 has joined #openstack-keystone | 20:42 | |
| dolphm | dstanek_afk: there's tons of violations in keystone against the hacking's master... make sure you're not re-implementing any of those! | 20:42 |
| dolphm | dstanek_afk: it's finally checking import grouping :D (H305, H307) | 20:43 |
| dolphm | and backslash line continuations H904 | 20:43 |
| *** mlemay has quit IRC | 20:46 | |
| *** achudnovets1 has left #openstack-keystone | 20:54 | |
| *** andreaf has joined #openstack-keystone | 21:06 | |
| *** topol has quit IRC | 21:07 | |
| *** andreaf has quit IRC | 21:09 | |
| *** andreaf has joined #openstack-keystone | 21:09 | |
| *** marcoemorais has quit IRC | 21:10 | |
| *** gordc has left #openstack-keystone | 21:12 | |
| *** gordc has quit IRC | 21:12 | |
| wchrisj__ | dolphm: given the issue with that call into the keystone API (method not implemented), is there another resource I should consult in terms of discovering valid api method calls, preferably with params, etc. | 21:49 |
| wchrisj__ | ie: what is the reference for that? | 21:50 |
| *** zhiyan is now known as zhiyan_ | 22:00 | |
| *** marcoemorais has joined #openstack-keystone | 22:00 | |
| *** mlemay has joined #openstack-keystone | 22:09 | |
| *** packet has quit IRC | 22:12 | |
| *** nkinder has quit IRC | 22:12 | |
| ayoung | richm, or find an existing bug to link it to. | 22:22 |
| richm | ok | 22:23 |
| *** leseb has quit IRC | 22:25 | |
| *** leseb has joined #openstack-keystone | 22:25 | |
| *** dims has quit IRC | 22:28 | |
| *** leseb has quit IRC | 22:29 | |
| *** ayoung has quit IRC | 22:37 | |
| *** leseb has joined #openstack-keystone | 22:39 | |
| *** morganfainberg_Z is now known as morganfainberg | 22:41 | |
| morganfainberg | afternoon | 22:42 |
| *** dims has joined #openstack-keystone | 22:42 | |
| *** stevemar has quit IRC | 22:51 | |
| morganfainberg | dolphm, ping, re password truncation change review. I'm going to -2 it until Juno at this point String Freeze, Possible extra options, etc | 22:52 |
| morganfainberg | dolphm, unless you want to keep it as a possible Icehouse target (just don't see it being worth the FFE) | 22:52 |
| *** jamielennox|away is now known as jamielennox | 22:57 | |
| *** dstanek_afk has quit IRC | 22:58 | |
| *** dstanek_afk has joined #openstack-keystone | 23:00 | |
| *** nkinder has joined #openstack-keystone | 23:01 | |
| *** mlemay has quit IRC | 23:02 | |
| *** mlemay has joined #openstack-keystone | 23:04 | |
| *** dstanek_afk is now known as dstanek | 23:08 | |
| *** leseb has quit IRC | 23:20 | |
| *** thedodd has quit IRC | 23:23 | |
| *** mlemay has quit IRC | 23:25 | |
| *** mlemay has joined #openstack-keystone | 23:27 | |
| bknudson | wondering if you do "tox -e docs" do you get the man pages? | 23:32 |
| bknudson | the output ends with "creating doc/build/man" -- but it's empty | 23:33 |
| morganfainberg | bknudson, probably should generate them | 23:35 |
| bknudson | morganfainberg: I think it used to. | 23:35 |
| morganfainberg | might be when we switch some sphinx stuff up | 23:36 |
| morganfainberg | that may have borken | 23:36 |
| bknudson | "Sphinx documentation setups are altered to generate man pages by default." | 23:36 |
| bknudson | http://docs.openstack.org/developer/pbr/#sphinx-autodoc | 23:36 |
| morganfainberg | hmmmm | 23:37 |
| morganfainberg | geee, wouldn't that be swell if it worked | 23:37 |
| *** andreaf2 has joined #openstack-keystone | 23:37 | |
| bknudson | I'm going to try a newer sphinx | 23:39 |
| *** andreaf has quit IRC | 23:39 | |
| bknudson | Running Sphinx v1.2.2 | 23:41 |
| bknudson | FTW | 23:41 |
| bknudson | writing... keystone-manage.1 { } keystone-all.1 { } | 23:41 |
| jamielennox | morganfainberg: do you have the links to your kite in stackforge reviews? i can't find them | 23:42 |
| morganfainberg | jamielennox, brb will find them when i'm back | 23:42 |
| *** browne has quit IRC | 23:52 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!