| *** thedodd has joined #openstack-keystone | 00:12 | |
| bknudson | http://testtools.readthedocs.org/en/latest/for-test-authors.html#delayed-assertions | 00:59 |
|---|---|---|
| *** arosen1 has quit IRC | 01:00 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Handle URLs via the session and auth_plugins https://review.openstack.org/60752 | 01:06 |
| *** arosen1 has joined #openstack-keystone | 01:18 | |
| *** thedodd has quit IRC | 01:20 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: remove redundant code in catalog/core.py https://review.openstack.org/81181 | 01:28 |
| *** arosen1 has quit IRC | 01:59 | |
| *** thedodd has joined #openstack-keystone | 02:08 | |
| *** arosen1 has joined #openstack-keystone | 02:10 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Sync config fixture object from oslo.incubator https://review.openstack.org/82412 | 02:10 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Plugin loading from config objects https://review.openstack.org/79542 | 02:10 |
| *** david-lyle has joined #openstack-keystone | 02:14 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Fix passing get_token kwargs to get_access https://review.openstack.org/76733 | 02:28 |
| *** bknudson has quit IRC | 02:45 | |
| *** thedodd has quit IRC | 02:48 | |
| *** mberlin1 has quit IRC | 02:53 | |
| *** mberlin has joined #openstack-keystone | 03:08 | |
| *** arosen1 has quit IRC | 03:22 | |
| *** arosen1 has joined #openstack-keystone | 03:25 | |
| *** arosen1 has quit IRC | 03:28 | |
| *** arosen1 has joined #openstack-keystone | 03:29 | |
| *** arosen2 has joined #openstack-keystone | 03:30 | |
| *** arosen1 has quit IRC | 03:33 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone: Change the default version discovery URLs https://review.openstack.org/78068 | 03:54 |
| *** topol has joined #openstack-keystone | 04:42 | |
| *** lbragstad has joined #openstack-keystone | 04:46 | |
| *** lbragstad1 has quit IRC | 04:47 | |
| *** chandankumar has quit IRC | 05:14 | |
| *** zhiyan_ is now known as zhiyan | 05:24 | |
| *** chandan_kumar has joined #openstack-keystone | 05:25 | |
| *** topol has quit IRC | 05:48 | |
| openstackgerrit | Jenkins proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/78525 | 06:00 |
| *** topol has joined #openstack-keystone | 06:06 | |
| *** derek_c has joined #openstack-keystone | 06:16 | |
| *** arosen2 has quit IRC | 06:31 | |
| *** topol has quit IRC | 06:32 | |
| *** saju_m has joined #openstack-keystone | 06:35 | |
| *** jamielennox is now known as jamielennox|away | 06:51 | |
| *** marekd|away is now known as marekd | 06:56 | |
| *** saju_m has quit IRC | 06:59 | |
| *** saju_m has joined #openstack-keystone | 07:12 | |
| *** saju_m has quit IRC | 07:17 | |
| *** saju_m has joined #openstack-keystone | 07:18 | |
| *** saju_m has quit IRC | 07:22 | |
| *** saju_m has joined #openstack-keystone | 07:24 | |
| *** saju_m has quit IRC | 07:30 | |
| *** saju_m has joined #openstack-keystone | 07:32 | |
| *** flaper87|afk is now known as flaper87 | 07:40 | |
| *** derek_c has quit IRC | 08:20 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add dedicated URL for issuing unscoped federation tokens. https://review.openstack.org/82375 | 08:25 |
| *** leseb has joined #openstack-keystone | 08:55 | |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Unimplemented get roles by group for project list https://review.openstack.org/76470 | 09:02 |
| *** topol has joined #openstack-keystone | 10:28 | |
| *** jaosorior has joined #openstack-keystone | 10:33 | |
| *** david-lyle has quit IRC | 10:41 | |
| *** leseb has quit IRC | 11:16 | |
| *** leseb has joined #openstack-keystone | 11:16 | |
| *** leseb has quit IRC | 11:21 | |
| dolphm | marekd: on https://review.openstack.org/#/c/82375/1/keystone/contrib/federation/routers.py ... | 11:22 |
| dolphm | marekd: should it be a GET or a POST? | 11:22 |
| dolphm | marekd: you tell me what works | 11:22 |
| dolphm | marekd: the latest patchset has a GET in the docstr, and then it's routed as a POST https://review.openstack.org/#/c/82375/2/keystone/contrib/federation/routers.py - so one of them needs to be corrected | 11:23 |
| marekd | dolphm: if you use browser - it'd be GET, but this is not something that's gonna be eventually used. Accroding to some vague infor I have in those reference clients it's POST.... | 11:23 |
| dolphm | marekd: what do you mean that it's not going to be used? | 11:24 |
| marekd | dolphm: you will not use your browser to get a token via Identity API, right? | 11:24 |
| dolphm | marekd: in the case of federation - maybe? i don't know | 11:25 |
| dolphm | marekd: should we specify and route *both* GET and POST? | 11:25 |
| marekd | dolphm: but then you will only see the XML response...is it something that people do? | 11:25 |
| dolphm | marekd: it's something people have expressed interest in, but i do not know if it's the best solution or not (i'm also wondering if it's the *only* solution for some identity providers?) | 11:26 |
| marekd | dolphm: in fact, this might be on only solution - yet *very* ugly. Because what you need to do is to use your browser, authn via webSSO (so no ECP), and later get an XML token response, copy token id and try to scope the token, possibly with you cli... | 11:28 |
| marekd | (if the step 2 is available). | 11:28 |
| *** chandankumar_ has joined #openstack-keystone | 11:29 | |
| dolphm | marekd: i suspect the answer to that is to do a lot of the work with javascript in the browser? | 11:29 |
| marekd | dolphm: when websso is used? | 11:29 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/python-keystoneclient: add functional test for cache pool https://review.openstack.org/82172 | 11:29 |
| dolphm | marekd: yes | 11:29 |
| marekd | dolphm: in web sso a client is redirected to a webpage server by an IdP - you don't know what you get there...it can be a simple html form, but also js and maybe even flash..? | 11:30 |
| marekd | dolphm: websso assumes a human is sitting at the other side and he is using a browser. | 11:31 |
| dolphm | marekd: right | 11:31 |
| marekd | IdP is something we don't control. | 11:31 |
| dolphm | ++ | 11:31 |
| marekd | dolphm: ECP is something now widely spread, but we cannot do anything about thaat.. | 11:31 |
| marekd | what's even worse, it's vaguely documented. | 11:32 |
| dolphm | marekd: you mean *not* widely spread? | 11:32 |
| marekd | dolphm: you can assume that every SAML2 IdP can speak webSSO and not every speaks ECP. | 11:33 |
| marekd | dolphm: yes, i meant *not* | 11:34 |
| marekd | dolphm: I think GET and POST methods should be fine, just to fire this particular function | 11:36 |
| marekd | dolphm: but still get info about idp and protocol from the uri. | 11:36 |
| dolphm | marekd: sounds good | 11:37 |
| dolphm | marekd: put both in the docstr, and then ['GET', 'POST'] in the router? | 11:37 |
| marekd | dolphm: changing. | 11:37 |
| marekd | in the docstring: double the line with two different methods, or you usually pack it together? | 11:38 |
| marekd | dolphm: nvm, doubled. | 11:40 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add dedicated URL for issuing unscoped federation tokens. https://review.openstack.org/82375 | 11:41 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add dedicated URL for issuing unscoped federation tokens. https://review.openstack.org/82375 | 11:45 |
| openstackgerrit | Jenkins proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/82231 | 11:49 |
| openstackgerrit | Jenkins proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/79695 | 11:55 |
| *** leseb has joined #openstack-keystone | 11:55 | |
| *** leseb has quit IRC | 11:59 | |
| *** jamielenz has joined #openstack-keystone | 12:01 | |
| *** jamielennox|away has quit IRC | 12:03 | |
| *** lbragstad has quit IRC | 12:10 | |
| *** chandankumar_ has quit IRC | 12:13 | |
| *** leseb has joined #openstack-keystone | 12:19 | |
| *** lbragstad has joined #openstack-keystone | 12:36 | |
| *** bknudson has joined #openstack-keystone | 13:06 | |
| *** browne has joined #openstack-keystone | 13:06 | |
| dstanek | i wish i had the power to bring https://review.openstack.org/#/c/68897 back to life | 13:09 |
| dstanek | dolphm: i fixed a minor test thing yesterday on https://review.openstack.org/#/c/82205/. are you still working on it? | 13:10 |
| *** andreaf has joined #openstack-keystone | 13:36 | |
| dolphm | dstanek: THANKS! i was about to address brant's comment, unless you have a revision working already | 13:38 |
| dolphm | dstanek: you can manually bring it back with a new change-id, but i really wish we had Restore :( | 13:38 |
| *** devlaps has joined #openstack-keystone | 13:40 | |
| *** nkinder has quit IRC | 13:40 | |
| dstanek | dolphm: no, i haven't looked at it - him comment is actually about the change i made yesterday | 13:44 |
| dstanek | i left a comment on that review for the original author to restore - i'll give him a few days before i do anything | 13:44 |
| *** henrynash has joined #openstack-keystone | 13:47 | |
| *** daneyon has joined #openstack-keystone | 13:51 | |
| *** daneyon has quit IRC | 13:52 | |
| dolphm | dstanek: testing a patch for the service enabled thing now | 13:52 |
| *** daneyon has joined #openstack-keystone | 13:52 | |
| *** joesavak has joined #openstack-keystone | 13:54 | |
| *** wchrisj has joined #openstack-keystone | 13:54 | |
| *** daneyon_ has joined #openstack-keystone | 13:58 | |
| *** daneyon has quit IRC | 13:58 | |
| *** daneyon_ has quit IRC | 13:59 | |
| dstanek | dolphm: i'm available to review when you push | 14:04 |
| dstanek | i'll just looking over more client reviews right now | 14:04 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Always include 'enabled' field in service response https://review.openstack.org/82205 | 14:13 |
| dolphm | dstanek: ^ | 14:14 |
| dstanek | dolphm: thx | 14:15 |
| *** thiagop has joined #openstack-keystone | 14:16 | |
| *** rwsu has joined #openstack-keystone | 14:17 | |
| dstanek | dolphm: these last few reviews are the first time i've seen server_default used; looks like sqlalchemy has everything :-) | 14:21 |
| dolphm | dstanek: me too | 14:22 |
| dolphm | dstanek: did your patch to testrepository to fix the miscount ever get accepted? | 14:24 |
| dstanek | they fixed it themselves, but i still think they have an off-by-1 | 14:24 |
| dstanek | dolphm: but yes they did fix it so that it no longer double counts errors | 14:25 |
| openstackgerrit | Andrey Kurilin proposed a change to openstack/python-keystoneclient: Reuse module `exceptions` from Oslo https://review.openstack.org/68897 | 14:26 |
| *** nkinder has joined #openstack-keystone | 14:26 | |
| dstanek | dolphm: do we need to worry about people counting on using enabled in the extra field? | 14:28 |
| dolphm | dstanek: 'extra' should just be an implementation detail, so no | 14:29 |
| dstanek | what if they create a new service with extra={'enabled': False}? | 14:30 |
| dolphm | dstanek: through what? | 14:31 |
| dolphm | what interface* | 14:31 |
| *** topol has quit IRC | 14:31 | |
| dstanek | dolphm: can't they post that directly? | 14:31 |
| dstanek | dolphm: i guess they can't because extra would be put into the extra :-) nm | 14:33 |
| dolphm | dstanek: ++ | 14:34 |
| openstackgerrit | Andrey Kurilin proposed a change to openstack/python-keystoneclient: Use `HttpNotImplemented` in `tests.v3.test_trusts` https://review.openstack.org/73993 | 14:35 |
| dolphm | is eventlet monkey patching undoable? | 14:38 |
| *** saju_m has quit IRC | 14:39 | |
| dstanek | dolphm: at runtime? | 14:43 |
| dolphm | dstanek: yeah... | 14:43 |
| *** david-lyle has joined #openstack-keystone | 14:43 | |
| dolphm | like eventlet.patcher.monkey_patch(os=False, select=False, socket=False, thread=False, time=False, psycopg=False, MySQLdb=False) resets stdlib | 14:43 |
| dstanek | dolphm: probably not entirely | 14:44 |
| dstanek | i'm sure you can find where it put the originals and put them back, but by then it's likely too late because of imports | 14:44 |
| dstanek | they'll have references to the eventlet versions - that's one of the reasons why you have to patch eventlet as one of the first things you do | 14:45 |
| *** lucasagomes has joined #openstack-keystone | 14:47 | |
| *** dims has quit IRC | 14:47 | |
| lucasagomes | hi, I'm trying to use the keystone v3 /credentials but I'm getting this error: http://paste.openstack.org/show/74141/ | 14:47 |
| lucasagomes | is it working? | 14:47 |
| *** thedodd has joined #openstack-keystone | 14:48 | |
| lucasagomes | if I access it via curl in the API I can list the credentials | 14:48 |
| *** wchrisj has quit IRC | 14:54 | |
| *** dims has joined #openstack-keystone | 15:00 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: test tcp_keepidle only if it's available on the current platform https://review.openstack.org/82520 | 15:01 |
| dolphm | anyone else dev on OS X? ^ | 15:01 |
| dolphm | dstanek: it turns out eventlet on OS X != eventlet on everything else | 15:02 |
| dolphm | dstanek: i thought my problem was that eventlet was leaving things unexpectedly patched or something, but it was just that eventlet does not patch socket in the same way it does on other platforms | 15:03 |
| *** topol has joined #openstack-keystone | 15:04 | |
| dolphm | lucasagomes: definitely pass a project_name instead of a tenant_name to the Client() | 15:04 |
| dstanek | dolphm: what is it doing differently? | 15:04 |
| dolphm | dstanek: actually maybe it's not eventlet - the socket module is missing socket.TCP_KEEPIDLE regardless of whether it's monkey patched or not | 15:06 |
| dolphm | dstanek: http://pasteraw.com/tjxf62e6rcxqf99i7u0xv51ralv5jl6 | 15:06 |
| *** mberlin has quit IRC | 15:09 | |
| dolphm | dstanek: that's on python 2.7.6 installed via homebrew | 15:09 |
| *** mberlin has joined #openstack-keystone | 15:11 | |
| dstanek | dolphm: very odd - i've never been able to run the entire test suite on my Mac | 15:13 |
| *** zhiyan is now known as zhiyan_ | 15:13 | |
| lucasagomes | dolphm, will try | 15:13 |
| dolphm | dstanek: i've been ignoring this failure for a couple months :-/ but it's the only one | 15:14 |
| dstanek | dolphm: i think the biggest things for me was the file descriptor leaks that i fixed - i just haven't gone back to the Mac since | 15:14 |
| lucasagomes | same :/ | 15:16 |
| *** leseb has quit IRC | 15:18 | |
| *** leseb_ has joined #openstack-keystone | 15:19 | |
| *** topol has quit IRC | 15:21 | |
| dolphm | lucasagomes: what does your service catalog look like? | 15:24 |
| lucasagomes | dolphm, lemme check, any command in specific u want me to run? (I'm a ks noob) | 15:28 |
| dstanek | dolphm: https://review.openstack.org/#/c/82205/ - is service_id there something that should be used? or just something pulled from the original review? | 15:28 |
| *** packet has joined #openstack-keystone | 15:29 | |
| *** richm has joined #openstack-keystone | 15:34 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: add functional test for cache pool https://review.openstack.org/82172 | 15:37 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/python-keystoneclient: sanity check memcached availability before running tests against it https://review.openstack.org/82527 | 15:38 |
| *** wchrisj has joined #openstack-keystone | 15:38 | |
| *** gyee has joined #openstack-keystone | 15:39 | |
| dolphm | dstanek: took the chance to fix another annoying test failure that bites me when i dev outside of devstack ^ (who runs memcached otherwise?) | 15:40 |
| dolphm | dstanek: bknudson is correct there -- that line should be removed | 15:41 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Regions Management https://review.openstack.org/79096 | 15:41 |
| *** andreaf2 has joined #openstack-keystone | 15:44 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Always include 'enabled' field in service response https://review.openstack.org/82205 | 15:45 |
| *** andreaf has quit IRC | 15:45 | |
| openstackgerrit | A change was merged to openstack/identity-api: Update to clouddocs-maven-plugin 1.15 https://review.openstack.org/82196 | 15:52 |
| dstanek | dolphm: just saw bknudson's comment now | 15:52 |
| dstanek | dolphm: the only other thing that i see is the ep/eps naming here: https://review.openstack.org/#/c/82205/8/keystone/common/sql/migrate_repo/versions/044_service_enabled.py | 15:53 |
| dstanek | dolphm: i noticed it because you renamed new_eps to new_service | 15:53 |
| *** marcoemorais has joined #openstack-keystone | 16:05 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Always include 'enabled' field in service response https://review.openstack.org/82205 | 16:10 |
| dolphm | dstanek: fixed ^ | 16:11 |
| *** lucasagomes has left #openstack-keystone | 16:11 | |
| openstackgerrit | Marek Denis proposed a change to openstack/identity-api: Add dedicated URL for federated authentication. https://review.openstack.org/82532 | 16:15 |
| dstanek | bknudson: you had a comment about validating the request path here: https://review.openstack.org/#/c/59914/13/keystoneclient/tests/v3/test_users.py | 16:35 |
| bknudson | dstanek: the client tests should validate that the correct request is made -- the path and body | 16:36 |
| bknudson | and method | 16:36 |
| bknudson | and headers | 16:36 |
| bknudson | and also that the client handles the expected responses | 16:37 |
| dstanek | bknudson: i can add an assertEqual to a hard coded string, but i don't think it's necessary because i believe the test will fail if it requestion a path other than the one passed into stub_url | 16:37 |
| bknudson | ok, maybe it's tested already | 16:37 |
| dstanek | bknudson: i do want to delete the assert on the body | 16:38 |
| bknudson | how about a test for the case where the server responds with an error? | 16:38 |
| bknudson | what does the assert on the body do? | 16:38 |
| dstanek | bknudson: it just tests the stubbing library right now | 16:39 |
| dstanek | bknudson: yeah, i don't think he has anything to test handling server errors | 16:39 |
| dstanek | hmmm...i don't think we do that at all in test_users.py | 16:40 |
| bknudson | so this is the return value of the manager... I guess if we always expect the method to return None then could validate it. | 16:41 |
| bknudson | But if the method returns None then I wouldn't expect an application to really care. | 16:41 |
| *** browne has quit IRC | 16:45 | |
| *** packet has quit IRC | 16:46 | |
| dstanek | bknudson: i'm just going to go with http://paste.openstack.org/show/74163/ because it's more explicit even if not needed | 16:47 |
| openstackgerrit | David Stanek proposed a change to openstack/python-keystoneclient: Add a method for changing a user's password in V3 https://review.openstack.org/59914 | 16:48 |
| *** harlowja has joined #openstack-keystone | 16:49 | |
| bknudson | dstanek: the proposal in the pasted diff looks good to me. | 16:49 |
| *** browne has joined #openstack-keystone | 16:56 | |
| *** amcrn has joined #openstack-keystone | 16:57 | |
| dstanek | dolphm: i think your changes look fine | 17:06 |
| *** jaosorior has quit IRC | 17:20 | |
| *** leseb_ has quit IRC | 17:22 | |
| *** bada has joined #openstack-keystone | 17:30 | |
| *** flashgordon is now known as jogo | 17:34 | |
| openstackgerrit | Dirk Mueller proposed a change to openstack/keystone: Create TMPDIR for tests recursively https://review.openstack.org/82565 | 17:47 |
| openstackgerrit | A change was merged to openstack/identity-api: Clean up naming to match new conventions https://review.openstack.org/81076 | 17:57 |
| marekd | Is my understanding correct that the method put() https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/base.py#L342 will issue a request with empty body? | 18:19 |
| *** andreaf2 has quit IRC | 18:23 | |
| *** morganfainberg_Z is now known as morganfainberg | 18:24 | |
| morganfainberg | dolphm, i keep trying to develop on OS X | 18:26 |
| morganfainberg | dolphm, it's a challenge sometimes. | 18:26 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Compressed Signature and Validation https://review.openstack.org/71181 | 18:27 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: remove universal_newlines https://review.openstack.org/79411 | 18:27 |
| ayoung | morganfainberg, so... I got the compressed token code working in both py27 and py33 | 18:27 |
| morganfainberg | ayoung, nice | 18:28 |
| ayoung | morganfainberg, look at this: https://review.openstack.org/#/c/71181/22/keystoneclient/common/cms.py line 294 | 18:28 |
| ayoung | makes me nostalgic for type safe languages | 18:29 |
| ayoung | but need to differentiate between python27 "everything is a string" as well as "sometimes the data is really a string: | 18:29 |
| ayoung | " | 18:29 |
| morganfainberg | ayoung, just be carefule, bytearray is muteable | 18:29 |
| ayoung | morganfainberg, 'slaright | 18:29 |
| morganfainberg | ayoung, unlike strings in python. | 18:29 |
| ayoung | morganfainberg, needs to be in binary form for the follow on operations, though | 18:30 |
| ayoung | namely uncompress | 18:30 |
| morganfainberg | ayoung, sure. | 18:30 |
| morganfainberg | ayoung, i'd probably put a comment in because bytearray isn't used commonly (but, eh, w/e) | 18:31 |
| ayoung | morganfainberg, comment on that in the code review, and see if it stirs some other reviewer feedback | 18:31 |
| ayoung | morganfainberg, it will be in py33 | 18:31 |
| ayoung | py27 "everything is a string" is going away | 18:31 |
| ayoung | buh bye | 18:31 |
| morganfainberg | ayoung, you don't need to use it in py33. bytes != bytearray | 18:32 |
| morganfainberg | bytearray is mutable, bytes is not | 18:32 |
| ayoung | morganfainberg, true...so until we get there.... | 18:32 |
| morganfainberg | most people will use bytes. | 18:32 |
| morganfainberg | just py2.7 bytes = str | 18:32 |
| morganfainberg | which is lame :P | 18:32 |
| *** thedodd has quit IRC | 18:33 | |
| ayoung | morganfainberg, agreed. I was conspiring w/ other devs: for Juno 1, we do a full court press to get Python33 working for Keystone. Then make that the primary dev platform, with 27 considered legacy | 18:33 |
| ayoung | IE: Code in 33 and run tox -epy33 first | 18:34 |
| morganfainberg | ayoung, when does RHEL7 launch? | 18:34 |
| morganfainberg | and waht is the python version in it? | 18:34 |
| ayoung | morganfainberg, In RHEL we can use software collections now, so we can do 33 | 18:34 |
| morganfainberg | ayoung, look at what i tacked onto the IRC meeting for this week | 18:34 |
| morganfainberg | ayoung, I'm looking forward to rhel7 tbh | 18:34 |
| ayoung | http://developerblog.redhat.com/tag/software-collections/ | 18:34 |
| morganfainberg | ayoung, ++ yay! | 18:35 |
| ayoung | http://developerblog.redhat.com/2013/09/12/rhscl1-ga/ | 18:35 |
| morganfainberg | our biggest blocker is eventlet moving to py33 | 18:35 |
| morganfainberg | talked w/ -infra this weekend | 18:35 |
| morganfainberg | lets just say, we should plan to kill eventlet | 18:35 |
| morganfainberg | lead the charge so to speak | 18:35 |
| ayoung | Yep...I plan on smashing that one in a coordinate attack including synchronized ground an dair strikes | 18:35 |
| morganfainberg | i was told, eventlet is dead | 18:36 |
| morganfainberg | we should be using trollius if we want eventlet like code | 18:36 |
| morganfainberg | we can move to wsgiref for basic wsgi stuff | 18:36 |
| ayoung | We have been trolled long enough | 18:36 |
| ayoung | And Cressida was wanton | 18:36 |
| morganfainberg | so step 1 move to wsgiref, step 2 celebrate, step 3 determine if we can/want to use coroutine-like-things | 18:37 |
| morganfainberg | and both wsgiref and trollius are in global reqs | 18:37 |
| ayoung | step 1 move to Apache and mod_wsgi with prefork mode | 18:37 |
| ayoung | use paste for testing and be done with it | 18:38 |
| morganfainberg | ayoung, actually, that is an easy fix for devstack gate. i'll propose that today (wont change ports, but it'll make keystone run under apache by default) | 18:38 |
| morganfainberg | ayoung, well we need to still support (legacy) stand-alone keystone | 18:38 |
| morganfainberg | ayoung, wsgiref is the answer there. | 18:38 |
| ayoung | \m/ >_< \m/ | 18:38 |
| ayoung | \m/ (>_<) \m/ | 18:38 |
| *** marekd is now known as marekd|away | 18:48 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Regions Management https://review.openstack.org/79096 | 18:48 |
| openstackgerrit | ayoung proposed a change to openstack/identity-api: Make expires_at optional https://review.openstack.org/72126 | 18:53 |
| morganfainberg | ayoung, running my devstack now to make sure i don't have anything else to "fix" before proposing this change to make keystone default to running under apache | 18:55 |
| ayoung | nice | 18:55 |
| ayoung | morganfainberg, you do realize that without compressed tokens it is a non-starter | 18:55 |
| ayoung | ? | 18:55 |
| ayoung | and it looks like I got a false sense of security on those | 18:56 |
| morganfainberg | ayoung, the default service catalog is too large? | 18:56 |
| ayoung | yep | 18:56 |
| morganfainberg | ayoung, last time i checked it was small enough under devstack | 18:56 |
| ayoung | hmmm....maybe | 18:56 |
| ayoung | lets see | 18:56 |
| *** browne has quit IRC | 18:59 | |
| *** lbragstad has quit IRC | 18:59 | |
| *** harlowja has quit IRC | 19:01 | |
| *** lbragstad has joined #openstack-keystone | 19:01 | |
| *** harlowja has joined #openstack-keystone | 19:03 | |
| morganfainberg | ayoung, so compressed tokens might not be a solution or did i read that wrong? | 19:05 |
| *** marcoemorais has quit IRC | 19:06 | |
| *** marcoemorais has joined #openstack-keystone | 19:06 | |
| ayoung | morganfainberg, no, compressed tokens are a solution, I'm jsut having trouble figuring out how to deal with the strings in python | 19:06 |
| morganfainberg | ayoung, ah | 19:07 |
| *** derek_c has joined #openstack-keystone | 19:08 | |
| dolphm | bknudson: strange failure on https://review.openstack.org/#/c/82370/ | 19:22 |
| bknudson | dolphm: that is a strange failure... guessing it's not something caused by my change. | 19:23 |
| dolphm | bknudson: agree | 19:23 |
| bknudson | dolphm: I'll ask in openstack-oslo | 19:24 |
| *** thedodd has joined #openstack-keystone | 19:25 | |
| *** browne has joined #openstack-keystone | 19:25 | |
| *** lbragstad has quit IRC | 19:36 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/identity-api: Provide alternative to overloading /v3/auth/tokens https://review.openstack.org/82585 | 19:42 |
| *** marcoemorais has quit IRC | 19:43 | |
| *** marcoemorais has joined #openstack-keystone | 19:44 | |
| dolphm | marekd|away: ^ | 19:44 |
| dolphm | morganfainberg: ayoung: you can configure devstack to allow larger tokens than 8190 with LimitRequestFieldSize | 19:45 |
| morganfainberg | dolphm, this is the header issue | 19:45 |
| morganfainberg | dolphm, not the request size. iirc mod_wsgi had a hard-set compiletime value as well? | 19:46 |
| dolphm | morganfainberg: "The LimitRequestFieldSize directive allows the server administrator to set the limit on the allowed size of an HTTP request header field." | 19:46 |
| dolphm | morganfainberg: ah | 19:46 |
| morganfainberg | dolphm, hm. i'll try it out :) | 19:46 |
| bknudson | keystone also has a setting for max token size. | 19:46 |
| ayoung | dolphm, problem is that Apache HTTPD limit is hard coded. The work around you posted only handles the Eventlet side | 19:47 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n62 | 19:47 |
| ayoung | I need #ifdef PYTHON_33 | 19:48 |
| dstanek | ayoung: i want that in requirements.txtr! | 19:48 |
| bknudson | if six.PY3 | 19:48 |
| morganfainberg | bknudson, ++ | 19:51 |
| bknudson | dstanek: http://git.openstack.org/cgit/openstack/oslo-incubator/tree/requirements-py3.txt | 19:52 |
| dstanek | bknudson: that's interesting. does requirement.txt only get used in py2 then? | 19:55 |
| dstanek | bknudson: i'll have to play with that a little. i'd like to make our py33 builder start being at least somewhat useful | 19:56 |
| bknudson | dstanek: good question... I just noticed it when I did a git pull. | 19:56 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Compressed Signature and Validation https://review.openstack.org/71181 | 19:56 |
| ayoung | bknudson, dstanek bknudson if you want to see some true py27 py33 ugliness ^^ | 19:56 |
| ayoung | although probably should wait to see if jenkins hates it again | 19:57 |
| ayoung | and if I messed up pep8 | 19:57 |
| *** jsavak has joined #openstack-keystone | 19:59 | |
| *** joesavak has quit IRC | 20:02 | |
| *** joesavak has joined #openstack-keystone | 20:02 | |
| *** derek_c has quit IRC | 20:03 | |
| *** stevemar has joined #openstack-keystone | 20:04 | |
| *** jsavak has quit IRC | 20:04 | |
| dstanek | ayoung: why do you have to use memoryview/buffer in there? | 20:12 |
| ayoung | dstanek, because if I don't it complains | 20:12 |
| ayoung | dstanek, specifically, can't be a string going in on py27 | 20:12 |
| dstanek | ayoung: interesting; i have only seen those used when a big chunk of data is loaded and you want to process parts of it without copying | 20:13 |
| ayoung | argh...context switch...! | 20:13 |
| ayoung | dstanek, I have to admit I am writing this via trial and error | 20:14 |
| ayoung | dstanek, I could probably do something different from py33 | 20:15 |
| ayoung | dstanek, so there are a couple cases to take into account: 1. the data might be string based for signing (PEM format) and it might be binary (DER) | 20:16 |
| ayoung | dstanek, also there is py27 vs 33 treatment of strings | 20:17 |
| ayoung | and the fact that something signed by one may need to be validated by the other | 20:17 |
| marekd|away | dolphm: I have already commited a patchset: https://review.openstack.org/#/c/82532/ - you probably missed that, but fine. I will abandon it. | 20:17 |
| ayoung | now we don't compress PEM, so that should simplify things in this vase | 20:17 |
| marekd|away | dolphm: anyways, thanks! | 20:17 |
| dolphm | marekd|away: oh, hrm... neither have shown up on the bug report :( | 20:18 |
| dolphm | the bot must be asleep | 20:18 |
| *** derek_c has joined #openstack-keystone | 20:19 | |
| dstanek | ayoung: i just tried running the tests and i get 25 failures that look unrelated; do they all run OK for you? | 20:19 |
| dolphm | marekd|away: did you mean to eliminate /v3/auth/tokens completely? it has no utility? | 20:19 |
| ayoung | dstanek, they run for me, yes | 20:19 |
| ayoung | what failures do you see? | 20:20 |
| openstackgerrit | A change was merged to openstack/keystone: test tcp_keepidle only if it's available on the current platform https://review.openstack.org/82520 | 20:21 |
| openstackgerrit | A change was merged to openstack/keystone: Create TMPDIR for tests recursively https://review.openstack.org/82565 | 20:21 |
| dstanek | ayoung: it's not you, it's me; this just isn't working out | 20:22 |
| ayoung | Heh | 20:22 |
| dstanek | ayoung: i have local errors import gdbm - rebuilding with tox now | 20:22 |
| marekd|away | dolphm: i didn't erase /auth/tokens completely....line 783 | 20:23 |
| *** marekd|away is now known as marekd | 20:23 | |
| *** lbragstad has joined #openstack-keystone | 20:24 | |
| marekd | dolphm: but if you are asking about issuing unscoped token - yes IMHO it does not have any utility at the moment...unless you want to make every /auth/tokens SAML2 protected. | 20:24 |
| marekd | *every /auth/tokens call to be SAML2 protected... | 20:25 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Sync oslo-incubator db.sqlalchemy b9e2499 https://review.openstack.org/82594 | 20:25 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix doc build errors with SQLAlchemy 0.9 https://review.openstack.org/82367 | 20:25 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/82372 | 20:25 |
| dolphm | marekd: let me combine our patches then | 20:27 |
| *** harlowja_ has joined #openstack-keystone | 20:27 | |
| marekd | dolphm: sure, you are the native here :D | 20:27 |
| marekd | dolphm: also, feel free to abandom mine if you want to. | 20:28 |
| *** harlowja has quit IRC | 20:31 | |
| dolphm | marekd: "WebSSO and ECP mechanisms have different authentication workflows" does one rely on GET and the other on POST? if so, which? | 20:33 |
| *** jsavak has joined #openstack-keystone | 20:33 | |
| marekd | from what i've seen it's: websso -> GET and ECP ( GET, later POST, because it sends XML SOAP body with authn Response from IdP) | 20:34 |
| marekd | but maybe we can skip this part? | 20:35 |
| *** joesavak has quit IRC | 20:37 | |
| dolphm | marekd: skip what, POST for now? | 20:37 |
| *** stevemar has quit IRC | 20:38 | |
| *** tellesnobrega_ has joined #openstack-keystone | 20:38 | |
| marekd | dolphm: the part in the docs you quoted. | 20:38 |
| *** tellesnobrega_ is now known as tellesnobrega | 20:38 | |
| dolphm | marekd: abandoned my patch, since it looks like yours is better | 20:42 |
| marekd | dolphm: ok, feel free to lynch me for poor grammar/non proper english | 20:44 |
| dolphm | marekd: you missed a comma ;) | 20:44 |
| dolphm | marekd: https://review.openstack.org/#/c/82532/1/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md | 20:44 |
| marekd | and articles i guess... | 20:45 |
| marekd | they are so unnatural for me :-) | 20:45 |
| dstanek | what are the load_tests functions in keystoneclient for? | 20:47 |
| *** jsavak has quit IRC | 20:47 | |
| *** tellesnobrega has left #openstack-keystone | 20:49 | |
| ayoung | dstanek, when we use Eventlet, is it "selects" or "epolls" | 20:49 |
| *** joesavak has joined #openstack-keystone | 20:51 | |
| dolphm | dstanek: https://review.openstack.org/#/c/56787/ | 20:51 |
| *** derek_c has quit IRC | 20:54 | |
| *** jsavak has joined #openstack-keystone | 20:55 | |
| *** stevemar has joined #openstack-keystone | 20:56 | |
| dstanek | dolphm: interesting. load_tests isn't implemented in 2.6 :-( | 20:57 |
| dstanek | it also makes nose unhappy | 20:57 |
| *** joesavak has quit IRC | 20:58 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Remember the DN https://review.openstack.org/47441 | 21:01 |
| *** browne has left #openstack-keystone | 21:01 | |
| dstanek | ayoung: just removing the use of bytearray got the tests working. is there another case not in the tests that fails? http://paste.openstack.org/show/74194/ | 21:15 |
| *** andreaf has joined #openstack-keystone | 21:15 | |
| openstackgerrit | Marek Denis proposed a change to openstack/identity-api: Add dedicated URL for federated authentication. https://review.openstack.org/82532 | 21:16 |
| marekd | dolphm: ^^ | 21:16 |
| ayoung | dstanek, was that both py33 and py27? | 21:16 |
| *** derek_c has joined #openstack-keystone | 21:17 | |
| dstanek | ayoung: yeah, i was using nose though, which shouldn't matter, but who knows | 21:18 |
| ayoung | dstanek, does the code in examples/pki/gen_cmsz.py run, too? | 21:19 |
| dstanek | ayoung: good question, jas | 21:19 |
| dstanek | ayoung: i didn't get any output at all, so i assume it worked | 21:21 |
| ayoung | should have | 21:21 |
| ayoung | dstanek, the files in pki/cms should have be regenerated | 21:21 |
| dstanek | it seems that the pem files where not recreated | 21:22 |
| ayoung | dstanek, submit it, and see if jenkins likes it better than mine. Something is messing up devstack | 21:23 |
| ayoung | yeah, only the cms files get redone | 21:23 |
| ayoung | pkiz that is | 21:23 |
| dstanek | ah, ok | 21:23 |
| dstanek | ayoung: i had a few comments in the review i was working on for it - i'll fix this too | 21:23 |
| *** jsavak has quit IRC | 21:26 | |
| *** Gippa has joined #openstack-keystone | 21:27 | |
| *** Gippa has quit IRC | 21:28 | |
| dstanek | ayoung: dinner time so i'll do it in about an hour :-) gotta be the family man for a bit | 21:30 |
| jamielenz | dstanek: load_tests is generally something that you need to use for testscenarios - i can't remember if we use it in client | 21:30 |
| ayoung | dstanek, thanks for looking at this | 21:30 |
| jamielenz | dstanek: nose doesn't implement the protocol at all so certain tests won't run with nose | 21:31 |
| dstanek | jamielenz: all the tests seem to run in nose (at least they don't fail), but nose thinks load_tests is a test to run and that fails | 21:31 |
| dstanek | jamielenz: it was added in the commit dolphm mentioned | 21:32 |
| jamielenz | dstanek: yea at this point i would assume that nose doesn't work for ksclient | 21:32 |
| dstanek | jamielenz: https://review.openstack.org/#/c/56787/ | 21:32 |
| jamielenz | yep, that makes sense | 21:32 |
| ayoung | jamielenz, casual nick er...tuesday? Something require a shorter nick? | 21:32 |
| jamielenz | wtf | 21:32 |
| *** jamielenz is now known as jamielennox | 21:33 | |
| jamielennox | i hadn't looked that closely - no idea why that happened | 21:33 |
| ayoung | I was worried that someone else with a nick really like yours was getting involved. nick completion would have been a real PITA | 21:33 |
| jamielennox | probably the bouncer getting connections mixed up | 21:34 |
| jamielennox | dstanek: load_tests is a well known python testing protocol - just nose doesn't obey it | 21:34 |
| ayoung | jamielennox, https://review.openstack.org/#/c/79096/1/keystoneclient/v3/regions.py your comment and my response | 21:34 |
| dstanek | ayoung: np | 21:34 |
| ayoung | jamielennox, parent_region_id=None vs parent_region=None | 21:34 |
| ayoung | what should that look like? | 21:35 |
| jamielennox | dolphm: can you weigh in on the backwards compatibility here: https://review.openstack.org/#/c/77748/ af far as i'm concerned auth_token doesn't have a public stable interface | 21:35 |
| dstanek | jamielennox: i don't think i've ever had the need to override the test suite during discovery - at least not with nose or py.test | 21:35 |
| dstanek | jamielennox: my though there was that there is nothing from stopping my from subclassing your middleware to extend it | 21:36 |
| jamielennox | dstanek: i'm not sure, i was doing some stuff with testscenarios in keystoneclient tests previously and i know it didn't work with nose | 21:36 |
| *** amcrn has quit IRC | 21:36 | |
| jamielennox | dstanek: yes, it's definetly possible - i've just never operated on that constraint before | 21:37 |
| dstanek | jamielennox: that doesn't surprise me - testr and friends seemed to have gone a different direction | 21:37 |
| jamielennox | *most* usages should just use it as middleware, that's not to say that someone is trying to do something funny | 21:37 |
| jamielennox | but if you need to customize middleware what you really should be doing is putting new middleware in | 21:37 |
| dstanek | jamielennox: in that case i would subclass your middleware to extend (or change) it and then put that in the pipeline | 21:38 |
| dstanek | i don't know what our guarantees are, which is why i raised the question | 21:38 |
| dstanek | i'd be fine either way - i just don't know the policy | 21:39 |
| jamielennox | ayoung: base.getid(None) should return None - i don't like anything about that system but it's used elsewhere in manages | 21:39 |
| jamielennox | dstanek: yep, will wait for dolphm to respond otherwise i'll bring it up at the meeting tomorrow | 21:40 |
| ayoung | jamielennox, so return super(RegionManager, self).create(description=description, enabled=enabled, base.getid( parent_region), **kwargs) | 21:41 |
| jamielennox | parent_region_id=base.getid(parent_region) | 21:41 |
| jamielennox | i really want to fix all that i'm just not sure which way to go | 21:41 |
| *** marekd is now known as marekd|away | 21:42 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Regions Management https://review.openstack.org/79096 | 21:50 |
| *** dims has quit IRC | 21:56 | |
| jamielennox | ayoung: i'd love to know what our plans are about region management with regards to the service catalog and client side | 22:03 |
| andreaf | Hi I'm working on a couple of blueprints to enable gate testing based on keystone v3 (and higher) - see https://blueprints.launchpad.net/tempest/+spec/multi-keystone-api-version-tests and https://blueprints.launchpad.net/tempest/+spec/keystone-v3-jobs | 22:08 |
| andreaf | I'd welcome reviews by keystone developers - see https://review.openstack.org/#/q/status:open+project:openstack/tempest+branch:master+topic:bp/multi-keystone-api-version-tests,n,z for the current open patches | 22:09 |
| andreaf | thanks! | 22:09 |
| harlowja_ | hey guys, does anyone remember what happened to https://wiki.openstack.org/wiki/KeystoneStoreQuotaData | 22:13 |
| harlowja_ | did that get sucked into another project? | 22:13 |
| * harlowja_ can't seem to remember | 22:13 | |
| *** derek_c has quit IRC | 22:13 | |
| *** dims_ has joined #openstack-keystone | 22:13 | |
| jamielennox | harlowja_: its never been implemented and i dont think anyone is working on it | 22:14 |
| harlowja_ | durn | 22:14 |
| jamielennox | harlowja_: from memory we were saying that this should be managed by the service itself or some other new service | 22:15 |
| harlowja_ | ya, it seems like some other service is really needed, central quota stuff would be a really nice thing | 22:15 |
| jamielennox | dstanek: i had some replies in: https://review.openstack.org/#/c/77055/ | 22:15 |
| jamielennox | harlowja_: yep, but it seems keystone was chosen because everyone already talks to it - rather than that i has anything to do with identity | 22:16 |
| harlowja_ | agreed | 22:16 |
| harlowja_ | put the kitchen sink into keyston | 22:16 |
| harlowja_ | and don't forget the toaster | 22:16 |
| jamielennox | heh, i like the analogy that it is electrocuting keystone | 22:17 |
| jamielennox | there is a new project that is trying to do something with resource pre-allocation | 22:17 |
| jamielennox | i can't remember what it is called or whether it is trying to support this or is just worried about things like pre-reserving compute instances | 22:18 |
| jamielennox | ayoung: no +A? https://review.openstack.org/#/c/78489/ | 22:21 |
| harlowja_ | jamielennox agreed, altough u aren't supposed to throw the toaster into the kitchen sink | 22:24 |
| harlowja_ | lol | 22:24 |
| harlowja_ | with water, lol | 22:24 |
| harlowja_ | pre-reserving though is different from quota centralization | 22:25 |
| harlowja_ | but anyways, thxs | 22:25 |
| jamielennox | https://launchpad.net/climate but yea i'm not sure if it's expected to do simpe quotas | 22:26 |
| jamielennox | i'm guessing not as climate would talk to everyone and the model for this would be everyone talked to climate | 22:26 |
| harlowja_ | i think the new project should be called kitchensink | 22:29 |
| harlowja_ | lol | 22:29 |
| *** leseb has joined #openstack-keystone | 22:33 | |
| *** andreaf has quit IRC | 22:33 | |
| *** thedodd has quit IRC | 22:34 | |
| *** nkinder has quit IRC | 22:35 | |
| bknudson | these changes are to get sqlalchemy 0.9.x requirement update -- https://review.openstack.org/#/c/82594/ | 22:40 |
| *** gyee has quit IRC | 22:40 | |
| *** leseb has quit IRC | 22:44 | |
| *** nkinder has joined #openstack-keystone | 22:49 | |
| *** henrynash has quit IRC | 22:50 | |
| *** david-lyle has quit IRC | 22:52 | |
| *** gokrokve has joined #openstack-keystone | 23:02 | |
| *** zoresvit has joined #openstack-keystone | 23:24 | |
| *** amcrn has joined #openstack-keystone | 23:27 | |
| *** zoresvit has quit IRC | 23:27 | |
| *** bknudson has quit IRC | 23:28 | |
| dstanek | ayoung: should there be a default outform for cms_sign_data? that's what the test failure is about | 23:36 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove extra cache layer debugging https://review.openstack.org/82674 | 23:47 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove extraenous instantiations of managers https://review.openstack.org/81720 | 23:47 |
| *** gokrokve has quit IRC | 23:48 | |
| dolphm | morganfainberg: just unblocked RC1 from the memcache / TZ bug - let me know if you disagree | 23:53 |
| morganfainberg | dolphm, checking now | 23:53 |
| dolphm | also, this might be the last RC-blocking change that needs a review? https://review.openstack.org/#/c/82205/ | 23:53 |
| morganfainberg | dolphm, yeah unblocking is fine. if it's a legitimate issue we can backport but i can't duplicate it and it just doesn't make sense. | 23:54 |
| morganfainberg | dolphm, reviewing now. | 23:54 |
| morganfainberg | dolphm, i was about ½ way through earlier when i got yanked into a meeting | 23:55 |
| morganfainberg | dolphm, is the table shell game for SQLite compat? | 23:56 |
| morganfainberg | oh comment says as much | 23:56 |
| morganfainberg | derp | 23:56 |
| * morganfainberg learns to read | 23:56 | |
| dolphm | yeah.. | 23:56 |
| openstackgerrit | A change was merged to openstack/identity-api: Add dedicated URL for federated authentication. https://review.openstack.org/82532 | 23:58 |
| morganfainberg | dolphm, +2/+A | 23:59 |
| dolphm | morganfainberg: YAY | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!