| *** marcoemorais has quit IRC | 00:00 | |
| *** RockKuo has joined #openstack-keystone | 00:02 | |
| *** andreaf2 has quit IRC | 00:06 | |
| *** patelna has quit IRC | 00:09 | |
| bknudson | dstanek: did you open a bug for parallel test failure? I'll open one otherwise | 00:14 |
|---|---|---|
| dstanek | bknudson: no, was distracted by dinner | 00:15 |
| bknudson | dstanek: ok, I think I've got a fix so will open and post it | 00:15 |
| dstanek | nice | 00:15 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix parallel unit tests keystoneclient partial checkout https://review.openstack.org/84907 | 00:22 |
| bknudson | morganfainberg: dstanek: https://review.openstack.org/#/c/84907/1/.testr.conf | 00:22 |
| bknudson | 2 characters | 00:22 |
| *** gokrokve has quit IRC | 00:22 | |
| morganfainberg | bknudson, +2 | 00:23 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Create a test token generator and use it https://review.openstack.org/78877 | 00:23 |
| bknudson | it's not using the cpu a whole lot with this change. | 00:25 |
| morganfainberg | bknudson, ? | 00:28 |
| morganfainberg | did you clear out your .testrepository | 00:28 |
| morganfainberg | it gets in a wonky state sometimes. | 00:28 |
| morganfainberg | and does very bad trained binning of tests | 00:28 |
| bknudson | morganfainberg: ahh, I was wondering wtf all this testr code was doing. | 00:29 |
| morganfainberg | bknudson, yeah when you make changes to grouping et al (concurrency) you should prob. clear it out | 00:29 |
| morganfainberg | first run after clearing is alphabetical binning vs. time-to-run-test based | 00:30 |
| dstanek | bknudson: why does taking off the .+ work? | 00:45 |
| bknudson | dstanek: the regex used to match the whole string | 00:46 |
| bknudson | so they were all in their own bucket | 00:46 |
| bknudson | group_callback for keystone.tests.test_keystoneclient.KcMasterTestCase.test_admin_requires_adminness is keystone.tests.test_keystoneclient | 00:46 |
| dstanek | ah i see | 00:46 |
| bknudson | that's the output of a print statement I added to testr | 00:46 |
| bknudson | so now they get put into a keystone.tests.test_keystoneclient bucket | 00:47 |
| bknudson | group for keystone.tests.test_keystoneclient_sql.KcMasterSqlTestCase.test_tenant_list_limit is keystone.tests.test_keystoneclient | 00:47 |
| bknudson | group_callback for keystone.tests.test_cert_setup.CertSetupTestCase.test_can_handle_missing_certs is keystone.tests.test_cert_setup | 00:48 |
| bknudson | those ones go in a different group | 00:48 |
| bknudson | group for keystone.tests.test_config.ConfigTestCase.test_config_default is None | 00:48 |
| bknudson | and the rest are in no group | 00:49 |
| openstackgerrit | A change was merged to openstack/identity-api: Fixed name attribute description of Projects https://review.openstack.org/84014 | 00:58 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Use efficient check for non-empty list in controller https://review.openstack.org/84912 | 01:00 |
| *** harlowja is now known as harlowja_away | 01:01 | |
| morganfainberg | jamielennox, ping re 78877 | 01:03 |
| jamielennox | morganfainberg: hmm | 01:03 |
| jamielennox | oh ok | 01:03 |
| jamielennox | morganfainberg: i'm a little questioning about it myself - but what specifically? | 01:04 |
| morganfainberg | jamielennox, i'm really not sure the context manager method of adding services is ... friendly | 01:05 |
| morganfainberg | jamielennox, it feels like the wrong use of a context manager, yanno? | 01:05 |
| jamielennox | morganfainberg: i would agree - i just don't know of a better way | 01:06 |
| jamielennox | i can always return the service object (and i think i do) | 01:06 |
| morganfainberg | yeah that's what i'd do rather than the "with" statement | 01:06 |
| morganfainberg | jamielennox, it's that the __enter__ and __exit__ logic doesn't really add much benefit here. | 01:07 |
| jamielennox | morganfainberg: so it does return the service object | 01:07 |
| morganfainberg | righrt | 01:07 |
| morganfainberg | so if you just return the service object when you're adding no need to do the "with" part and it would be easier to read | 01:07 |
| morganfainberg | this is just the first thing i noticed. | 01:08 |
| jamielennox | so all of those can be written as s = token.add_service() s.add_endpoint() | 01:08 |
| jamielennox | i think it was more reflective of what the service is | 01:08 |
| morganfainberg | yeah. and probably would be easier to read/work with. | 01:08 |
| morganfainberg | you're not really doing anything when the context exits | 01:08 |
| jamielennox | by that i mean that you don't hang on to that object and there is no defined way to retrieve a service from those defined | 01:09 |
| jamielennox | like a token.service_find(type='') | 01:09 |
| morganfainberg | you might want a way to retrieve the service via a method | 01:09 |
| morganfainberg | yeah | 01:09 |
| jamielennox | morganfainberg: yep - i'm going for baby steps here - i'm still not certain it's a great idea | 01:09 |
| morganfainberg | i think having a canonical source of v2 tokens would be good | 01:10 |
| jamielennox | the point is though that if we can get novaclient et al to define there test tokens this way we won't have to fix them all | 01:10 |
| morganfainberg | but honestly, i am almost thinking this should go into oslo. | 01:10 |
| jamielennox | maybe - i'm not sure if i like oslo for clients | 01:10 |
| jamielennox | though it's test code so whatever | 01:10 |
| morganfainberg | or separate from keystoneclient | 01:10 |
| morganfainberg | yeah i don't know, but i think oslotest (for the token generator, it doesn't rely on keystoneclient itself) would be good as a fixture | 01:11 |
| morganfainberg | if it requires keystoneclient code, then oslotest would be bad | 01:11 |
| jamielennox | the advantage but also i guess the disadvantage is that if we find an issue in token generation we can fix it in one place - but that can break people | 01:11 |
| jamielennox | no it purposefully doesn't require keystone code | 01:12 |
| morganfainberg | that is why i think it shouldn't go in keystoneclient itself. | 01:12 |
| morganfainberg | and keystoneclient should be using the same token fixtures for validation. | 01:12 |
| morganfainberg | you can't "fix" keystoneclient and the "tokens" in the same commit | 01:12 |
| jamielennox | morganfainberg: so where? i'm of the impression it's too specific for oslo.test | 01:12 |
| morganfainberg | is it? | 01:12 |
| morganfainberg | this might be something we need to poke at dhellman about | 01:12 |
| jamielennox | can switch to -dev but i assume it's late | 01:13 |
| morganfainberg | example tokens seem to be used arount a lot of places | 01:13 |
| jamielennox | morganfainberg: right - and they are incorrect in places | 01:13 |
| morganfainberg | yeah this is a tomorrow discussion i think | 01:13 |
| morganfainberg | so lets put them in a "easy to consume" place, but i this is a case where it probably is correct to not put the token generator in ksc. | 01:14 |
| jamielennox | this was the point that if i provided a token builder api then we wouldn't get incorrect tokens that clients rely on | 01:14 |
| morganfainberg | right. | 01:14 |
| morganfainberg | i'm concerned the sample tokens will be "changed" as a side-effect of something else. | 01:14 |
| jamielennox | so my thought was that ksc was the easy to consume place | 01:14 |
| jamielennox | everything should have that dep | 01:14 |
| morganfainberg | even if oslotest is the wrong place, we should def. still do something like this | 01:14 |
| jamielennox | and the keystoneclient is most likely place to know the correct way to generate keystone tokens | 01:15 |
| morganfainberg | anyway my first reaction was the context manager just looked wrong | 01:15 |
| bknudson | btw - I didn't like the context manager either. | 01:15 |
| bknudson | but I guess it worked and was used. | 01:15 |
| jamielennox | ok - it's not hard to remove, i just thought the grouping looked better and i was providing both | 01:16 |
| morganfainberg | jamielennox, i don't think it adds clarity fwiw | 01:16 |
| jamielennox | it's a shame that the v2 and v3 catalogs are so different that i can't make the APIs the same | 01:16 |
| morganfainberg | jamielennox, especially since i had to go look to see what the __exit__ was meant to do | 01:16 |
| jamielennox | so scrap it altogether or default to not using | 01:17 |
| bknudson | if there was a handy function in contextlib... | 01:17 |
| jamielennox | may as well scrap | 01:17 |
| morganfainberg | jamielennox, scrap the whoile thing? or the context manager? | 01:18 |
| morganfainberg | jamielennox, i don't think scrapping the fixture is a good idea. and if the context manager is what is needed to get it going, sure i wont block on this | 01:20 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Create a test token generator and use it https://review.openstack.org/78877 | 01:20 |
| jamielennox | morganfainberg: no just the context manager | 01:21 |
| morganfainberg | jamielennox, ok | 01:21 |
| jamielennox | you're right it's just syntax sugar - it doesn't buy anything | 01:21 |
| jamielennox | new version without the context manager | 01:21 |
| jamielennox | ^ | 01:21 |
| morganfainberg | i actually this this is easier to read | 01:21 |
| jamielennox | it removes some of the mystery | 01:21 |
| morganfainberg | looking at it now | 01:21 |
| morganfainberg | exactly | 01:21 |
| jamielennox | hmm, what i know i don't do as part of that is to test the validate() method | 01:23 |
| jamielennox | so my intention with this and other clients was to actually make it part of a fixtures.Fixture | 01:23 |
| morganfainberg | is anyone besides keystone client meant to import "keystonecleint.fixture" or just client_fixtures | 01:23 |
| morganfainberg | jamielennox, that would be good if possible | 01:24 |
| jamielennox | morganfainberg: client_fixtures? | 01:24 |
| morganfainberg | v2_0.client_fixtures | 01:24 |
| jamielennox | you would create the token as part of __init__ then setup would run validate() to make sure you were using a sane token in your tests | 01:24 |
| jamielennox | oh, no just keystoneclient.fixture | 01:24 |
| jamielennox | anything in keystoneclient.tests is off limits | 01:24 |
| morganfainberg | hm. you may want to call it something other than "fixture" | 01:25 |
| morganfainberg | colliding namespaces and all | 01:25 |
| jamielennox | i don't mind providing some samples later in the fixture folder | 01:25 |
| morganfainberg | not sure if there is a good alternative though | 01:25 |
| jamielennox | that's why it's called fixture and not fixtures | 01:25 |
| morganfainberg | oh derp my brain was adding the s | 01:25 |
| morganfainberg | strike that, it's fine. | 01:25 |
| jamielennox | in reality i should probably call it fixtures and expect people to import it correctly | 01:26 |
| morganfainberg | or do it like we do in keystone proper | 01:26 |
| morganfainberg | ksfixtures | 01:26 |
| morganfainberg | or ksc_fixtures | 01:26 |
| jamielennox | yea, but we should be looking at this from an external to ksc point of view | 01:27 |
| morganfainberg | some testtools get horribly confused even with __absolute imports | 01:27 |
| jamielennox | from keystoneclient import fixtures as ks_fixtures | 01:27 |
| morganfainberg | testtools/debuggers | 01:27 |
| morganfainberg | i should say | 01:27 |
| jamielennox | but yea, i noticed initially i had trouble when calling it fixtures | 01:27 |
| jamielennox | but i don't particularly like having the module with a singular name | 01:28 |
| jamielennox | it's only internal to keystoneclient where this is going to be a namespace issue and i guess i can manage that | 01:28 |
| morganfainberg | i don't mind it in either case | 01:29 |
| morganfainberg | just some general comments | 01:29 |
| morganfainberg | nayway | 01:29 |
| morganfainberg | jamielennox, otherwise i think this looks reasonable | 01:30 |
| morganfainberg | jamielennox, just doing a bit more review before i +2 | 01:31 |
| morganfainberg | make sure nothing else jumps out as "what is this" | 01:31 |
| jamielennox | no worries - i expected that review to sit for a bit longer - it's not urgent | 01:31 |
| jamielennox | morganfainberg: but thanks :) | 01:32 |
| morganfainberg | jamielennox, it just happened to stand out as interesting | 01:32 |
| *** richm has quit IRC | 01:32 | |
| morganfainberg | jamielennox, was looking at your backlog of ksc reviews | 01:32 |
| jamielennox | heh - it's down a bit, i got ayoung to push a few through | 01:32 |
| jamielennox | most of the 'easy' ones are in i think | 01:32 |
| morganfainberg | jamielennox, +2, one comment | 01:36 |
| morganfainberg | but nothing that should be acted on in this review | 01:36 |
| morganfainberg | ids and datetimes should be non-static. | 01:36 |
| morganfainberg | but that requires more change than needs to go in here. | 01:36 |
| morganfainberg | esp. since datetimes are expired in all the example tokens | 01:37 |
| jamielennox | replied with pretty much that | 01:38 |
| morganfainberg | yep. | 01:39 |
| jamielennox | a change like this shouldn't actually change functionality | 01:39 |
| jamielennox | it will be really simply to replace with utcnow() + timedelta(minutes=10) | 01:39 |
| jamielennox | because the generator should accept a datetime or a string | 01:39 |
| morganfainberg | should be done in a future patch before this is used widespread | 01:39 |
| morganfainberg | well, you know waht i mean. | 01:40 |
| jamielennox | morganfainberg: doesn't matter though - that's in our tests not the generator | 01:40 |
| morganfainberg | right | 01:40 |
| morganfainberg | can't brain. | 01:40 |
| morganfainberg | i should stop looking at code :P | 01:40 |
| jamielennox | hmm, but yea - i don't have a default expiry | 01:40 |
| jamielennox | which is wrong | 01:40 |
| jamielennox | if not expiry: | 01:41 |
| *** ilives has joined #openstack-keystone | 01:41 | |
| jamielennox | yea whatever you know what i mean | 01:41 |
| jamielennox | these are all things that should be fleshed out into the validate() as we come across it | 01:42 |
| jamielennox | morganfainberg: oh! i do have a default expiry! sweet | 01:43 |
| morganfainberg | jamielennox, cool | 01:43 |
| jamielennox | love it when you look back at code from a few months ago and it's actually correct | 01:43 |
| *** Chicago has quit IRC | 01:45 | |
| *** ilives has quit IRC | 01:48 | |
| *** ilives has joined #openstack-keystone | 01:49 | |
| morganfainberg | jamielennox, ++ | 01:49 |
| *** mberlin1 has joined #openstack-keystone | 01:55 | |
| *** mberlin has quit IRC | 01:56 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Remove _factory methods from auth plugins https://review.openstack.org/81985 | 01:59 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Sync with oslo-incubator 2fd457b https://review.openstack.org/83966 | 02:02 |
| openstackgerrit | xu-haiwei proposed a change to openstack/keystone: Fix assertEqual arguments order(catalog, cert_setup, etc) https://review.openstack.org/76100 | 02:13 |
| jamielennox | bknudson: do you have an example of how to link to another class definition in RST? | 02:14 |
| jamielennox | :class:`...` seems to fail | 02:14 |
| jamielennox | it drops it from the param list | 02:15 |
| jamielennox | just doing the `...` i get bold but no link | 02:15 |
| jamielennox | bknudson: got it - sphinx / ReST is kind of cool but it's a pain to start | 02:26 |
| *** nkinder has quit IRC | 02:29 | |
| *** topol has joined #openstack-keystone | 02:32 | |
| *** david-lyle has joined #openstack-keystone | 02:34 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow passing auth plugin as a parameter https://review.openstack.org/83673 | 02:38 |
| *** nkinder has joined #openstack-keystone | 02:42 | |
| *** Chicago has joined #openstack-keystone | 02:56 | |
| openstackgerrit | A change was merged to openstack/keystone: Keystone doesn't use pam https://review.openstack.org/84012 | 03:08 |
| ayoung_AFK | dstanek, I'm still debugging. I've put print statements in a bunch of locations. THe token gets correctly allocated and returned, and all of the middleware in out pipelines return (up through normalizing_filter) | 03:24 |
| ayoung_AFK | and then it dies | 03:24 |
| ayoung_AFK | only in v3, though, not v2 | 03:24 |
| ayoung_AFK | can't help but think it is something about how apache is calling the wsgi api | 03:24 |
| ayoung_AFK | and then...a size limit? | 03:25 |
| ayoung_AFK | must be the size limit bug | 03:25 |
| ayoung_AFK | yep....?nocatalog and it worked... | 03:29 |
| ayoung_AFK | wonder if we could add a switch to make that the default | 03:29 |
| ayoung_AFK | oh, well. Gnight | 03:30 |
| *** gokrokve has joined #openstack-keystone | 03:36 | |
| *** gokrokve has quit IRC | 03:36 | |
| *** gokrokve has joined #openstack-keystone | 03:37 | |
| *** sld has joined #openstack-keystone | 03:46 | |
| sld | I'm not sure if anyone is around but I have a quick question - I like the token_flush option for keystone-manage but am wondering.. are there any plans to have a simple configuration file option that can effectively tell the DB to automatically delete tokens, thus obsoleting the need for the token_flush option? (...if that makes any sense?) | 03:47 |
| *** harlowja_away is now known as harlowja | 04:00 | |
| *** stevemar has joined #openstack-keystone | 05:05 | |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Make sure all the auth plugins agree on the shared identity attributes. https://review.openstack.org/84945 | 05:22 |
| *** harlowja is now known as harlowja_away | 05:32 | |
| *** bvandenh has joined #openstack-keystone | 05:33 | |
| *** marekd|away is now known as marekd | 05:46 | |
| *** andreaf2 has joined #openstack-keystone | 05:57 | |
| openstackgerrit | Jenkins proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/83955 | 06:00 |
| *** gokrokve has quit IRC | 06:02 | |
| *** andreaf_ has joined #openstack-keystone | 06:05 | |
| *** andreaf_ has quit IRC | 06:07 | |
| *** andreaf_ has joined #openstack-keystone | 06:07 | |
| *** andreaf has quit IRC | 06:08 | |
| *** andreaf_ has quit IRC | 06:09 | |
| *** andreaf has joined #openstack-keystone | 06:09 | |
| *** andreaf has quit IRC | 06:10 | |
| *** andreaf has joined #openstack-keystone | 06:10 | |
| *** andreaf2 has quit IRC | 06:12 | |
| *** stevemar has quit IRC | 06:23 | |
| *** gokrokve has joined #openstack-keystone | 06:33 | |
| *** gokrokve has quit IRC | 06:43 | |
| marekd | jamielennox: hey, still here! | 06:45 |
| marekd | ? | 06:45 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: List all missing/forbidden attributes in the request body. https://review.openstack.org/84389 | 06:56 |
| *** zigo has quit IRC | 07:04 | |
| *** d0ugal has joined #openstack-keystone | 07:04 | |
| *** d0ugal has quit IRC | 07:04 | |
| *** d0ugal has joined #openstack-keystone | 07:04 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: List all missing/forbidden attributes in the request body. https://review.openstack.org/84389 | 07:05 |
| *** zigo has joined #openstack-keystone | 07:08 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Remove common.V3Controller.check_required_params() method. https://review.openstack.org/84952 | 07:11 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Add CRUD operations for Identity Providers. https://review.openstack.org/83337 | 07:31 |
| *** d0ugal has quit IRC | 07:34 | |
| *** gokrokve has joined #openstack-keystone | 07:40 | |
| *** Chicago has quit IRC | 07:40 | |
| *** gokrokve has quit IRC | 07:45 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: List all forbidden attributes in the request body. https://review.openstack.org/84389 | 08:03 |
| *** leseb has joined #openstack-keystone | 08:04 | |
| *** d0ugal has joined #openstack-keystone | 08:13 | |
| *** d0ugal has quit IRC | 08:13 | |
| *** d0ugal has joined #openstack-keystone | 08:13 | |
| *** Chicago has joined #openstack-keystone | 08:33 | |
| *** gokrokve has joined #openstack-keystone | 08:40 | |
| *** gokrokve has quit IRC | 08:44 | |
| jamielennox | sld: there are no plans for that - the only way to trigger something like that would be on a user's request which would slow things down significantly | 09:05 |
| jamielennox | at the very least you would have to call a url to trigger that - and in which case you are safer to have it run by an admin | 09:06 |
| jamielennox | is there a reason not to just run it as a cron job every 10 minutes or so? | 09:06 |
| jamielennox | marekd: not really, just checked in? anyting quick? | 09:06 |
| marekd | jamielennox: left my comments here https://review.openstack.org/#/c/83337/6/keystoneclient/v3/contrib/federation/identity_providers.py, so we can try talking later | 09:08 |
| marekd | jamielennox: when are you going to be more 'pingable' ? | 09:08 |
| jamielennox | marekd: the time earlier would normally be good | 09:09 |
| jamielennox | marekd: so does anything use _put() already? | 09:09 |
| jamielennox | marekd: but more - can't we just fix _put() | 09:09 |
| marekd | jamielennox: sure, i am on watch now, so I can propose something ~now, but in a separated patch. | 09:10 |
| marekd | jamielennox: however I was not sure what's the reason for keeping CrudManager._put and CrudManager._update | 09:10 |
| marekd | jamielennox: and this is something puzzled me TBH. | 09:10 |
| jamielennox | the managers are rubbish | 09:11 |
| jamielennox | i don't have a particular preference it's just that by doing _put in your class it wouuld imply that you are somehow override the underlying one | 09:12 |
| jamielennox | you can either just use update from your class - but the fix for _put should be only a couple of lines | 09:13 |
| marekd | jamielennox: sure. one quick question: is it fine to keep CrudManager._put() just for backwards compatibility and it's fine to keep _update() ? | 09:13 |
| marekd | if so, I will fix it now. | 09:13 |
| jamielennox | you can keep both | 09:14 |
| jamielennox | you can also fix the _put without worrying about compatibility | 09:14 |
| jamielennox | because it starts with an _ it's considered private | 09:14 |
| *** morganfainberg is now known as morganfainberg_Z | 09:15 | |
| marekd | i think calling _update() from _put will be mmuch better - it clearly indicated there is no different usecase for calling _put and _update(). Otherwise people may wonder: shall I use _update or _put()? like i did... ok, let me make a patch for that. | 09:16 |
| marekd | jamielennox: ok, thanks for this quick chat. | 09:17 |
| marekd | jamielennox: and the review. | 09:17 |
| jamielennox | marekd: oh - i see what i did wrong there | 09:17 |
| *** ilives has quit IRC | 09:18 | |
| marekd | jamielennox: ? | 09:18 |
| jamielennox | marekd: see put() at line 342 | 09:18 |
| marekd | jamielennox: aaaahhh, that's the different story :-) | 09:18 |
| marekd | asked about that 2-3 times but never got any response :-) | 09:18 |
| *** ilives has joined #openstack-keystone | 09:18 | |
| jamielennox | so put should look almost exactly the same as update on line 348 | 09:18 |
| jamielennox | so fix that to call _put() and that will tie it up | 09:19 |
| jamielennox | that work? | 09:20 |
| marekd | i think so. | 09:20 |
| jamielennox | cool | 09:20 |
| marekd | abstractmethods are the other topic, harder to make it work as it'd have an impact on the whole keystoneclient, so that not for now. | 09:22 |
| marekd | jamielennox: anyway, thanks! | 09:22 |
| jamielennox | yea, we can't necessarily do all abstract because they don't all have every method - eg you can list some things | 09:22 |
| jamielennox | np | 09:22 |
| marekd | i was thinking the same. Same with the tests you want to run. | 09:24 |
| *** gokrokve has joined #openstack-keystone | 09:41 | |
| *** gokrokve has quit IRC | 09:45 | |
| *** leseb has quit IRC | 09:51 | |
| *** leseb has joined #openstack-keystone | 09:51 | |
| *** leseb has quit IRC | 09:55 | |
| *** leseb has joined #openstack-keystone | 10:00 | |
| *** d0ugal has quit IRC | 10:00 | |
| *** d0ugal has joined #openstack-keystone | 10:17 | |
| *** chandankumar_ has joined #openstack-keystone | 10:22 | |
| *** leseb has quit IRC | 10:29 | |
| *** leseb has joined #openstack-keystone | 10:29 | |
| *** leseb has quit IRC | 10:33 | |
| *** gokrokve has joined #openstack-keystone | 10:42 | |
| *** gokrokve has quit IRC | 10:46 | |
| *** leseb has joined #openstack-keystone | 11:04 | |
| *** leseb has quit IRC | 11:09 | |
| *** lbragstad has quit IRC | 11:13 | |
| *** leseb has joined #openstack-keystone | 11:18 | |
| *** zhiyan_ is now known as zhiyan | 11:22 | |
| *** d0ugal has quit IRC | 11:30 | |
| *** gokrokve has joined #openstack-keystone | 11:43 | |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Sync test_migrations https://review.openstack.org/80618 | 11:44 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Redundant unique constraint https://review.openstack.org/84447 | 11:44 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Corresponding `nullable` value. https://review.openstack.org/84446 | 11:44 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Compatible server default value in the models. https://review.openstack.org/84445 | 11:44 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Explicit foreign key indexes. https://review.openstack.org/84444 | 11:44 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Make it possible to use multiprocess file locks https://review.openstack.org/84448 | 11:44 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 11:44 |
| *** gokrokve has quit IRC | 11:48 | |
| *** henrynash has joined #openstack-keystone | 12:01 | |
| *** kun_huang has joined #openstack-keystone | 12:08 | |
| *** gokrokve has joined #openstack-keystone | 12:09 | |
| *** gokrokve has quit IRC | 12:13 | |
| *** ayoung_AFK has quit IRC | 12:14 | |
| *** david-lyle has quit IRC | 12:23 | |
| *** jagee has joined #openstack-keystone | 12:27 | |
| *** lbragstad has joined #openstack-keystone | 12:35 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Fix base.CrudManager.put() method. https://review.openstack.org/85020 | 12:41 |
| marekd | jamielennox: https://review.openstack.org/85020 | 12:42 |
| *** RockKuo has quit IRC | 12:43 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Make base.CrudManager._put() use _update() method. https://review.openstack.org/85023 | 12:54 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Identity authentication now uses rotated passwords https://review.openstack.org/74447 | 12:55 |
| marekd | jamielennox: ^^ this will fail on test_put test and I have no clue why. | 12:55 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds table and model for storing rotated passwords https://review.openstack.org/73368 | 12:55 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: password rotation extension WIP https://review.openstack.org/74623 | 12:55 |
| *** bashok has joined #openstack-keystone | 12:59 | |
| *** dims_ has quit IRC | 13:07 | |
| *** lbragstad has quit IRC | 13:07 | |
| *** lbragstad has joined #openstack-keystone | 13:08 | |
| *** gokrokve has joined #openstack-keystone | 13:10 | |
| *** lbragstad has quit IRC | 13:12 | |
| *** gokrokve has quit IRC | 13:14 | |
| *** chandankumar_ has quit IRC | 13:19 | |
| *** dims_ has joined #openstack-keystone | 13:20 | |
| openstackgerrit | A change was merged to openstack/keystone: Sync from oslo db.sqlalchemy.migration https://review.openstack.org/84869 | 13:23 |
| *** d0ugal has joined #openstack-keystone | 13:23 | |
| *** d0ugal has quit IRC | 13:23 | |
| *** d0ugal has joined #openstack-keystone | 13:23 | |
| *** d0ugal has quit IRC | 13:24 | |
| *** d0ugal has joined #openstack-keystone | 13:25 | |
| *** d0ugal has quit IRC | 13:25 | |
| *** d0ugal has joined #openstack-keystone | 13:25 | |
| *** joesavak has joined #openstack-keystone | 13:28 | |
| *** bashok has left #openstack-keystone | 13:31 | |
| *** lbragstad has joined #openstack-keystone | 13:32 | |
| openstackgerrit | A change was merged to openstack/keystone: Fix parallel unit tests keystoneclient partial checkout https://review.openstack.org/84907 | 13:32 |
| *** nkinder has quit IRC | 13:45 | |
| *** ayoung has joined #openstack-keystone | 13:45 | |
| *** ilives has quit IRC | 13:48 | |
| *** ilives has joined #openstack-keystone | 13:52 | |
| *** gokrokve has joined #openstack-keystone | 14:11 | |
| *** gokrokve has quit IRC | 14:15 | |
| *** thedodd has joined #openstack-keystone | 14:18 | |
| ayoung | dolphm, so I just tripped over the 500 error due to the size of the Catalog in V3...I can't quite figure out why the V3 catalog would be bigger than the V2. However, we do have "legacy_endpoint_id" in the catalog...would it be safe to provide an option to drop that field? Trying to find ways to shrink the service catalog for apache. | 14:18 |
| *** jdob has joined #openstack-keystone | 14:26 | |
| *** chandan_kumar has quit IRC | 14:27 | |
| jdob | is there anyone around that can give me a hand with getting the tuskar API to authenticate against keystone? | 14:27 |
| baffle | I'm trying to get Nova to work with Keystone with domains. eystoneclient.middleware.auth_token seems to be able to verify user tokens in the Default domain, but for some reason when it recieves a token scoped to a different domain it barfs? And somehow ends up inside verify_uuid_token() ? But I use pki tokens...? :) | 14:27 |
| *** chandan_kumar has joined #openstack-keystone | 14:27 | |
| *** gokrokve has joined #openstack-keystone | 14:27 | |
| *** stevemar has joined #openstack-keystone | 14:27 | |
| *** chandan_kumar has quit IRC | 14:30 | |
| dstanek | ayoung: can you print out the catalog for both calls (or save to files) to see why the size difference? | 14:35 |
| baffle | If I print out the user_token before it checks if it is a PKI token, it looks like this: 0b6d252be95bdbb00e3f5e16e23848c3 <- clearly not a PKI token. | 14:38 |
| *** nkinder has joined #openstack-keystone | 14:38 | |
| ayoung | dstanek, I'm doing that now.... | 14:45 |
| ayoung | baffle, nope, just a uuid | 14:45 |
| ayoung | jdob, you are fourth in the queue | 14:45 |
| jdob | :) thanks ayoung | 14:45 |
| ayoung | jdob, is this making tuskar accept tokens for the user? | 14:48 |
| jdob | yes | 14:48 |
| ayoung | are you using auth_token middleware? | 14:48 |
| ayoung | is tuskar in Python? | 14:48 |
| jdob | yes, but realize I inherited the code which I think was copied from ironic and never actually understood, so there's no assertions we're using it correctly | 14:49 |
| ayoung | http://adam.younglogic.com/2013/07/troubleshooting-pki-middleware/ | 14:49 |
| jdob | i'm going through your middlewarearchitecture.html page now | 14:49 |
| ayoung | jdob, ^^ | 14:49 |
| jdob | ayoung: looking | 14:50 |
| baffle | ayoung: Thanks, looking at it now. | 14:51 |
| ayoung | baffle, what version of what are you using? | 14:51 |
| dolphm | ayoung: yes, there's an open bug to remove legacy_endpoint_id from the v3 catalog, along with 'enabled' (which should always be true) | 14:55 |
| ayoung | dolphm, cool. A base devstack setup means that the v3 token is too big, but a v2 is ok...I'm guessing we are right at a limit | 14:56 |
| ayoung | let me see if I can shrink it down | 14:57 |
| jdob | ayoung: what I keep getting tripped up on is that I keep seeing this in keystone's logs: keystone.middleware.core [-] Auth token not in the request header. | 14:58 |
| jdob | that's when I pass in the token as a header under X-Auth-Token or have it as admin_token in my conf file | 14:58 |
| jdob | that ring any bells? | 14:58 |
| ayoung | jdob, you've created a Tuskar admin_user? | 14:59 |
| jdob | no, been using the default admin | 14:59 |
| ayoung | jdob, the admin needs a token to feth the certs and the revocation list. I'm guessing your breakdown is there. | 14:59 |
| jdob | ok, I see users for the other services, lemme add a tuskar | 15:00 |
| baffle | ayoung: I'm using keystoneclient 0.3.2 -> keystone git master. I'm trying to dig down into it.. :-) I get "Non-default domain is not supported" in keystones log when doing requests from the 0.3.2 client (I think). I'm quite confused right now, think I might have to draw up some thing... | 15:00 |
| *** david-lyle has joined #openstack-keystone | 15:14 | |
| *** d0ugal_ has joined #openstack-keystone | 15:20 | |
| *** d0ugal has quit IRC | 15:20 | |
| *** arun_kant has joined #openstack-keystone | 15:25 | |
| *** zhiyan is now known as zhiyan_ | 15:25 | |
| *** henrynash has quit IRC | 15:28 | |
| *** leseb has quit IRC | 15:30 | |
| *** leseb has joined #openstack-keystone | 15:30 | |
| *** leseb has quit IRC | 15:34 | |
| dolphm | baffle: are you trying to do multi-domain v3 stuff? | 15:37 |
| baffle | dolphm: Yeah. | 15:37 |
| baffle | dolphm: Not separate auth backends, but just multidomain. | 15:38 |
| baffle | dolphm: For now I'm failing miserably. | 15:38 |
| baffle | dolphm: It's supposed to work. Right? :) | 15:39 |
| *** henrynash has joined #openstack-keystone | 15:39 | |
| *** andreaf has quit IRC | 15:41 | |
| dolphm | baffle: i'd definitely upgrade to the latest client (0.3.2 is super old), but you need to use the v3 client against the v3 endpoint | 15:42 |
| baffle | dolphm: "The v3 client"? | 15:42 |
| dolphm | baffle: and not use LDAP (which i just realized you might be?) which doesn't support multidomain | 15:42 |
| dolphm | baffle: keystoneclient.v3 rather than v2_0 | 15:43 |
| baffle | dolphm: No, not using LDAP. I looked into it, and saw that it didnt' support multidomain. :) | 15:43 |
| *** henrynash has quit IRC | 15:43 | |
| baffle | dolphm: I'm starting to think it is a horizon -> novaclient problem now.. I see in horizons log that X-Auth-Token: is what looks like a UUID.. Very confused. :) | 15:45 |
| *** leseb has joined #openstack-keystone | 15:47 | |
| *** d0ugal_ has quit IRC | 15:50 | |
| *** d0ugal_ has joined #openstack-keystone | 15:51 | |
| david-lyle | baffle: you can't make nova api calls outside of the default domain when using keystone v3 as there is no support in the nova apis for v3 auth | 15:53 |
| david-lyle | Horizon is just representing the state of openstack to you :( | 15:54 |
| baffle | So when in Havana it says "\o/ domains \o/" it really means "\o/ keystone has domains you can't use for anything \o/" ? :-) | 15:55 |
| *** henrynash has joined #openstack-keystone | 15:55 | |
| *** d0ugal_ has quit IRC | 15:55 | |
| *** d0ugal_ has joined #openstack-keystone | 15:55 | |
| david-lyle | unfortunately yes, there used to be a bug in the keystoneclient that briefly allowed it to work, that bug was closed as it should have been | 15:55 |
| *** d0ugal_ is now known as d0ugal | 15:56 | |
| baffle | What is HP doing? They seem to have working domains? Confused. | 15:56 |
| david-lyle | HP uses a different identity backend | 15:56 |
| david-lyle | API compatible, at least for the public cloud | 15:57 |
| david-lyle | API compatible with keystone that is | 15:58 |
| david-lyle | baffle: that said, HP is trying to migrate to keystone, but impediments like this incompatibility prevent much progress | 15:59 |
| dolphm | david-lyle: what's the incompatibility, exactly? | 16:00 |
| baffle | david-lyle: Oh, I was under the impression that they used Keystone, but had a properitary storage backend. Must have misunderstood. | 16:00 |
| david-lyle | dolphm, let grab the specific details | 16:00 |
| david-lyle | dolphm, so for a v3 token we run into https://github.com/openstack/keystone/blob/ee27d6eef62d201c99694d0f788ea2a96c6669a4/keystone/token/providers/uuid.py#L446 | 16:02 |
| *** andreaf has joined #openstack-keystone | 16:03 | |
| *** henrynash has quit IRC | 16:03 | |
| david-lyle | line 454 is the exception | 16:03 |
| dolphm | david-lyle: that looks right -- you just need to validate the token against the v3 API, otherwise keystone can't correctly represent the token (as requested on v2 without breaking compatibility with v2) | 16:05 |
| david-lyle | right but nova is not validating against the v3 API | 16:06 |
| dolphm | david-lyle: in other words, we need to get auth_token 100% onto the v3 API. right now it's still hardcoded to do some work against v2 :( | 16:06 |
| *** henrynash has joined #openstack-keystone | 16:06 | |
| dolphm | david-lyle: (it's not nova's fault, it's ours!) | 16:06 |
| david-lyle | oh, ok, that's easier to fix then | 16:07 |
| david-lyle | from a scale perspective | 16:07 |
| ayoung | dstanek, note thes sizes -rw-rw-r--. 1 ayoung ayoung 4631 Apr 3 12:10 /tmp/token-v2.raw | 16:10 |
| ayoung | -rw-rw-r--. 1 ayoung ayoung 9022 Apr 3 11:39 /tmp/token-v3.raw | 16:10 |
| dstanek | ayoung: wow | 16:10 |
| ayoung | yea...going to unpack them to see what I can see | 16:10 |
| *** d0ugal has quit IRC | 16:11 | |
| dolphm | ayoung: v3 catalog has a ton of cruft! | 16:11 |
| dstanek | ayoung: maybe the catalog is in there twice :-) | 16:11 |
| dolphm | ?nocatalog :P | 16:11 |
| baffle | I'm having some problems with the huge tokens via haproxy, even if I set tune.bufsize and friends.. They sure are massive. | 16:12 |
| baffle | I'm a bit confused with Horizon.. I get (huge) x-subject-token from Keystone when I log into Horizon. But then horizons novaclient tries to connect using an (apparently) UUID-token? | 16:15 |
| baffle | Is it confusing the hash of the PKI token with an MD5 hash or something? :-P | 16:15 |
| baffle | Shouldn't it use the X-Auth-Token I recieved from Keystone to talk with Nova? | 16:15 |
| dolphm | baffle: it might just be logging a hash of the actual token | 16:17 |
| baffle | dolphm: Well, it displays the complete curl command line as well.. | 16:17 |
| dolphm | baffle: keystone's API supports MD5-hashed tokens for validation purposes | 16:18 |
| baffle | novaclient connection created using token "beb99d9efc94d82d605100ee3b83ece7" and url "https://servers.api.zetta.io:8774/v1.1/7a113261536a4d15a20d8d6e98834e43" | 16:18 |
| baffle | REQ: curl -i 'https://servers.api.zetta.io:8774/v1.1/7a113261536a4d15a20d8d6e98834e43/extensions' -X GET -H "X-Auth-Project-Id: 7a113261536a4d15a20d8d6e98834e43" -H "User-Agent: python-novaclient" -H "Accept: application/json" -H "X-Auth-Token: beb99d9efc94d82d605100ee3b83ece7" | 16:18 |
| dolphm | baffle: GET /v3/auth/tokens + X-Subject-Token: <md5 hashed PKI token> or GET /v2/tokens/{md5_hashed_pki_token} | 16:18 |
| dolphm | baffle: could be either -- md5 hex digests are the same length as uuid hex digests | 16:20 |
| baffle | dolphm: So, if it sends Nova the md5 hash of the PKI token, Nova would have to connect to Keystone to check if the token is expired then I guess.. | 16:21 |
| baffle | dolphm: But nova seems to think it is an UUID token..? | 16:23 |
| dolphm | baffle: correct, but it *shouldn't* be doing that... | 16:23 |
| baffle | dolphm: Well, it sure looks like one. :) | 16:24 |
| dolphm | baffle: i'm not disagreeing! you could do a GET http://KEYSTONE:35357/v3/auth/tokens + X-Auth-Token: ADMIN + X-Subject-Token: beb99d9efc94d82d605100ee3b83ece7 to debug | 16:30 |
| dolphm | substitute for more appropriate values :) | 16:30 |
| *** henrynash has quit IRC | 16:31 | |
| *** leseb has quit IRC | 16:40 | |
| *** leseb has joined #openstack-keystone | 16:40 | |
| *** leseb has quit IRC | 16:42 | |
| *** leseb has joined #openstack-keystone | 16:42 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Make the py33 Jenkins job happy https://review.openstack.org/83565 | 16:48 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Replace all use of mox with mock https://review.openstack.org/84050 | 16:48 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: setUp must be called on a fixture's parent first https://review.openstack.org/84051 | 16:48 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fix cache configuration checks https://review.openstack.org/84052 | 16:48 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixed the size limit tests in Python 3 https://review.openstack.org/84053 | 16:49 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: wip: this needs to be made in oslo https://review.openstack.org/83833 | 16:49 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixed the policy tests in Python 3 https://review.openstack.org/84054 | 16:49 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: First real Python 3 tests https://review.openstack.org/83834 | 16:49 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds several more tests to the Python 3 test run https://review.openstack.org/84055 | 16:49 |
| dolphm | dstanek: nice ^ :P | 16:50 |
| *** leseb has quit IRC | 16:51 | |
| dstanek | dolphm: i'm trying to fill up the chat with noise | 16:51 |
| *** leseb has joined #openstack-keystone | 16:51 | |
| baffle | So it's like instantly https://pbs.twimg.com/media/Bd-dmftCYAA-SGS.jpg then. | 16:52 |
| dolphm | dstanek: productive* noise | 16:52 |
| ayoung | dstanek, http://paste.openstack.org/show/74989/ | 16:52 |
| dolphm | baffle: that pic looks familiar | 16:52 |
| baffle | dolphm: It's from your twitter feed. | 16:52 |
| ayoung | dstanek, the v2 token is 1/2 the size of the v3 | 16:53 |
| dolphm | dstanek: your first change will conflict with this one https://review.openstack.org/#/c/83968/ | 16:54 |
| dstanek | dolphm: i'll rabase on top of that after it merges | 16:55 |
| dstanek | dolphm: is it unapproved now? | 16:56 |
| dolphm | dstanek: i'd rather get yours in first | 16:56 |
| dstanek | we can do that too | 16:57 |
| *** leseb has quit IRC | 16:57 | |
| dstanek | the general discussions on the ML and irc have been to stop using mox and it was an easy change to make | 16:57 |
| *** andreaf has quit IRC | 16:59 | |
| dolphm | dstanek: is there any argument against using it in py2? | 16:59 |
| dolphm | (mox) | 17:00 |
| dstanek | the biggest reasons are social - mock is the standard and why use 2 mocking frameworks | 17:01 |
| *** wchrisj_ has joined #openstack-keystone | 17:03 | |
| dstanek | ayoung: your v3 token seems to have a much bigger catalog - lots more entries | 17:05 |
| ayoung | dstanek, this is base devstack | 17:05 |
| ayoung | but each endpoint is more than twcie the size in v3 than in v2 | 17:05 |
| ayoung | v2 cat 305 | 17:05 |
| ayoung | v3 cat 715 | 17:05 |
| dstanek | ayoung: ah, the endpoints in v3 are separate for admin, public and internal | 17:06 |
| ayoung | dstanek, yeah...too chatty | 17:06 |
| ayoung | dstanek, http://paste.openstack.org/show/74991/ | 17:07 |
| ayoung | dstanek, lets see the effect of just removeing legacy_endpoint_id | 17:08 |
| dolphm | dstanek: maybe we should leave mox commented out in our test-requirements with a note to reviewers not to allow it to be re-enabled, with a link to why | 17:08 |
| *** kun_huang has quit IRC | 17:09 | |
| dolphm | ayoung: i'd kill to simplify the v3 catalog format :( ?nocatalog + GET /v3/catalog might be the only answer without /v3/ | 17:09 |
| dolphm | without /v4/ * | 17:09 |
| dstanek | dolphm: i can do that - i was planning on adding a new pep8 checker to watch for modules we don't want to use | 17:09 |
| dolphm | dstanek: how many of those are there? | 17:10 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Create a test token generator and use it https://review.openstack.org/78877 | 17:11 |
| ayoung | v2 cat 305 | 17:12 |
| ayoung | v3 cat 490 | 17:12 |
| ayoung | yeah...that looks like the ticket. dolphm can we make "remove enabled and legacy_endpoint_id from token service catalog" an rtc2 blocker, please | 17:12 |
| dstanek | dolphm: mox (and maybe some of the deprecated oslo stuff) for sure - i remember seeing past reviews were we changed what should be imported - i'd want to check for those too | 17:12 |
| dstanek | dolphm: things like this we can easily automate so that we can focus on the clarity and indent of the code | 17:13 |
| *** harlowja_away is now known as harlowja | 17:14 | |
| *** marekd is now known as marekd|away | 17:14 | |
| dolphm | ayoung: regression! https://bugs.launchpad.net/keystone/+bug/1152635 | 17:14 |
| uvirtbot | Launchpad bug 1152635 in keystone "legacy_endpoint_id returned on v3" [Medium,Fix released] | 17:14 |
| dstanek | dolphm: do you want me to add that comment? if you do i can do it before i wonder off to lunch | 17:14 |
| ayoung | dolphm, I'm taking and actively working on it. Cool? | 17:14 |
| dolphm | ayoung: file a new bug, but cite it as a regression of that one | 17:15 |
| dolphm | dstanek: i really don't want to focus on the indent ;) | 17:15 |
| ayoung | dolphm, wilco | 17:15 |
| dolphm | dstanek: if you're removing mox from test-requirements somewhere (i didn't actually see that?), then yes | 17:16 |
| dstanek | dolphm: i didn't remove it, but i should have | 17:17 |
| *** ilives has quit IRC | 17:17 | |
| *** ilives has joined #openstack-keystone | 17:18 | |
| dstanek | dolphm: thoughts? http://paste.openstack.org/show/74993/ | 17:21 |
| dolphm | dstanek: cite the mailing list, maybe this one http://lists.openstack.org/pipermail/openstack-dev/2013-November/018507.html | 17:24 |
| *** mutex has left #openstack-keystone | 17:24 | |
| dolphm | dstanek: or straight to russell's email http://lists.openstack.org/pipermail/openstack-dev/2013-July/012484.html | 17:25 |
| *** morganfainberg_Z is now known as morganfainberg | 17:34 | |
| morganfainberg | mornin. | 17:34 |
| dolphm | morganfainberg: ish, as usual | 17:35 |
| morganfainberg | dolphm, yeah | 17:35 |
| morganfainberg | dolphm, rebasing the cleanup patch (removal of the identity proxy) now | 17:35 |
| *** packet has joined #openstack-keystone | 17:36 | |
| *** packet has quit IRC | 17:36 | |
| dolphm | we're ready to release icehouse-rc2 if necessary, but i'd like to hold as long as possible to get more fixes in :) | 17:36 |
| morganfainberg | dolphm, any thing else slated that needs to get in? | 17:36 |
| morganfainberg | dolphm, i can go look at it now (but the list seemed small earlier) | 17:37 |
| dolphm | morganfainberg: needs, no | 17:37 |
| *** gokrokve has quit IRC | 17:37 | |
| dolphm | morganfainberg: just a nice to have or two | 17:37 |
| morganfainberg | dolphm, any specifics I can help get into RC2? | 17:39 |
| morganfainberg | dolphm, or just waiting for master patches to land / check / etc before we get to it | 17:39 |
| dolphm | gyee got this up, but i'm not sure how i feel about putting *more* proprietary responsibility into auth plugins :-/ | 17:40 |
| dolphm | https://review.openstack.org/#/c/84945/ | 17:40 |
| *** thedodd has quit IRC | 17:45 | |
| openstackgerrit | Pablo Fernando Cargnelutti proposed a change to openstack/keystone: Moving delete_user and delete_group calls to IdentityManager https://review.openstack.org/80368 | 17:53 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Make the py33 Jenkins job happy https://review.openstack.org/83565 | 17:57 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Replace all use of mox with mock https://review.openstack.org/84050 | 17:57 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: setUp must be called on a fixture's parent first https://review.openstack.org/84051 | 17:57 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fix cache configuration checks https://review.openstack.org/84052 | 17:57 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixed the size limit tests in Python 3 https://review.openstack.org/84053 | 17:57 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: wip: this needs to be made in oslo https://review.openstack.org/83833 | 17:57 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixed the policy tests in Python 3 https://review.openstack.org/84054 | 17:57 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: First real Python 3 tests https://review.openstack.org/83834 | 17:57 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds several more tests to the Python 3 test run https://review.openstack.org/84055 | 17:57 |
| *** rwsu has quit IRC | 18:03 | |
| *** topol has quit IRC | 18:07 | |
| ayoung | "CalledProcessError: Command 'openssl' returned non-zero exit status 3" WHO BROKE MY UNIT TESTS? | 18:09 |
| *** thedodd has joined #openstack-keystone | 18:11 | |
| *** gokrokve has joined #openstack-keystone | 18:12 | |
| openstackgerrit | A change was merged to openstack/keystone: Removes unused db_sync methods https://review.openstack.org/84851 | 18:12 |
| *** raildo has joined #openstack-keystone | 18:13 | |
| ayoung | Ah...ok, false alarm. | 18:13 |
| ayoung | thought some regressed me | 18:13 |
| morganfainberg | dolphm, i'm looking at the patch from gyee | 18:14 |
| morganfainberg | dolphm, hmm this is an interesting choice. | 18:15 |
| * morganfainberg keeps reviewing | 18:15 | |
| * morganfainberg sneaks in if os.environ['user'] == 'ayoung': sys.exit('<evil laugh>') | 18:16 | |
| ayoung | +2 FILGTM | 18:16 |
| openstackgerrit | Andreas Jaeger proposed a change to openstack/keystone: Check that all po/pot files are valid https://review.openstack.org/84211 | 18:20 |
| dolphm | ayoung: lol | 18:21 |
| *** marekd|away is now known as marekd | 18:25 | |
| morganfainberg | dolphm, i feel like keystone should prevent the auth_plugins from doing bad things not the plugin's themselves. | 18:27 |
| morganfainberg | dolphm, as in overriding that method in the plugin could cause the check to pass and get mis-aligned identity info | 18:27 |
| morganfainberg | dolphm, this looks more brittle than i would like (though it might be the solution we need for the moment) | 18:28 |
| ayoung | dolphm, in removing endpoint attributes['enabled'[ from the token do I need to remove any endpoints that are enabled=False, or should those have been filtered out already? | 18:45 |
| bknudson | ayoung: https://review.openstack.org/#/c/77441/8/keystone/catalog/backends/sql.py | 18:51 |
| bknudson | ayoung: only enabled endpoints are in the catalog | 18:51 |
| ayoung | bknudson, cool | 18:51 |
| ayoung | bknudson, so should make_v3_endpoint delete the enabled and legacy_id fields, too? | 18:52 |
| bknudson | ayoung: that would make the most sense | 18:53 |
| bknudson | it's already deleting service_id | 18:53 |
| ayoung | jdob, please feel free to ask dumb devstack questions in here | 18:54 |
| jdob | ok :) | 18:54 |
| jdob | so if i'm reading this right, devstack will configure nova to use keystone. i'm trying a curl command against the nova apis, passing in X-Auth-Token in the headers, but its failing | 18:55 |
| jdob | i feel like I'm missing something really dumb, I'm using the token for the admin user | 18:55 |
| bknudson | jdob: does the token have any roles? | 18:55 |
| bknudson | is it scoped to the tenant? | 18:55 |
| jdob | it has a role and tenant, both named admin | 18:56 |
| ayoung | jdob, how did you create the token? | 18:56 |
| jdob | keystone token-get, with the admin credentials | 18:57 |
| ayoung | jdob, and you went through that troubleshooting guide I sent you? | 18:57 |
| ayoung | jdob, BTW...devstack on Fedora etc means SELinux setenforce=Permissive | 18:58 |
| jdob | ya, its permissive | 18:58 |
| jdob | also dumb question, i keep seeing port 35357, but devstack puts keystone on 5000 | 18:58 |
| ayoung | jdob, both | 18:59 |
| ayoung | 5000 is the main one that end users use for getting tokens | 18:59 |
| ayoung | 35357 is the admin interface | 18:59 |
| ayoung | jdob, and that decision predates all of the people that currently work on Keystone, so don't blame us....we are supporting other people's bad ideas | 19:00 |
| jdob | hrm, I dont have anything on 35357, but I can get the signing cert from 5000, and it's still valid | 19:00 |
| jdob | (from your blog post) | 19:00 |
| jdob | token-get is the right way to get the token, right? | 19:00 |
| jdob | and I care about the id in the returned result? | 19:00 |
| ayoung | jdob, " I dont have anything on 35357" is your problem | 19:01 |
| ayoung | nova is trying to get the certs from 35357 | 19:02 |
| ayoung | it might be the "35357 is an ephemeral port" issue | 19:02 |
| ayoung | we were assigned a port by IANAL that, while technically legal, is smack dab in the middle of the range that Linux considers ephemeral | 19:02 |
| ayoung | try killing and restarting keystone: | 19:02 |
| ayoung | screen -x | 19:02 |
| ayoung | ctrl a 1 | 19:02 |
| ayoung | (keystone is ususally screen 1) | 19:03 |
| ayoung | ctrl C and then it should be the first item in your bash history | 19:03 |
| jdob | I took a slightly different approach, I changed nova.conf to point to 5000 and it seemed to get further | 19:03 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove assignment proxy methods/controllers https://review.openstack.org/83219 | 19:04 |
| ayoung | jdob, hmmmm....that probably is not going to work | 19:04 |
| ayoung | the token revocation list should not be exposed on that port | 19:04 |
| jdob | ok cool, that worked \o/. odd, since when tuskar was trying 35357 I saw timeouts but nova didn't really reflect that | 19:04 |
| jdob | really? I actually got a response | 19:04 |
| ayoung | jdob, It may be. You are capable of magic, as I have seen. Of Both black and white variety. | 19:05 |
| jdob | i appreciate the optimisim that how I got this working was intentional and not pure luck :) | 19:05 |
| *** thedodd has quit IRC | 19:06 | |
| jdob | ok, so back to tuskar, that one still doesn't work. i see in keystone: 2014-04-03 15:05:49.116 WARNING keystone.common.wsgi [-] You are not authorized to perform the requested action, identity:revocation_list. | 19:06 |
| jdob | ayoung: is that what you were expecting on port 5000? | 19:06 |
| ayoung | jdob, maybe | 19:06 |
| ayoung | jdob, actually, I would not | 19:06 |
| ayoung | I would expect a 404 from 5000 | 19:06 |
| ayoung | but...maybe that mnakes sense, acutally | 19:07 |
| jdob | maybe I missed a step. i made a tuskar user, though I didn't assign it to any roles | 19:07 |
| ayoung | jdob, it looks like it is a valid request, but with a user that is not authorized | 19:07 |
| jdob | since it didn't look like the other service users weren't | 19:07 |
| ayoung | ah, yeah that is it | 19:07 |
| ayoung | it needs an "admin" role | 19:07 |
| ayoung | add them as admins to the "service" project | 19:07 |
| bknudson | if you're getting an RBAC error then it's using v3 api | 19:07 |
| ayoung | bknudson, is_admin for V2 | 19:08 |
| ayoung | user needs the admin role on the token that is request the Revocation list | 19:08 |
| ayoung | not RBAC | 19:08 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Remove legacy_endpoint_id and enabled from service catalog https://review.openstack.org/85147 | 19:10 |
| jdob | another dumb question: when i add tuskar to the admin role, it should show up in user-role-list, right? | 19:10 |
| ayoung | jdob, yes | 19:10 |
| jdob | hrm | 19:11 |
| jdob | https://gist.github.com/jdob/9960858 | 19:11 |
| jdob | says i added it, but i'm not seeing it | 19:11 |
| ayoung | jdob, --user b8d9c33a2f3a42489bec039b8080a0a6 vs 4b70f754d39a482eae75101eac8e07d9 for userid in that query | 19:12 |
| ayoung | you are looking at two different users | 19:12 |
| ayoung | keystone user-role-list I think is giving the answer for admin | 19:12 |
| jdob | ahhhhh | 19:12 |
| jdob | ok | 19:12 |
| jdob | sweet, ok, with the tuskar credentials I see it | 19:13 |
| ayoung | jdob, I need to head home: I 'l be back online around 4is (though in a meeting on the phone) | 19:14 |
| jdob | ok, I'm at a different error now, so this is progress and something for me to look at | 19:14 |
| jdob | thanks! | 19:14 |
| *** ayoung has quit IRC | 19:19 | |
| *** thedodd has joined #openstack-keystone | 19:21 | |
| *** david-lyle has quit IRC | 19:24 | |
| openstackgerrit | A change was merged to openstack/keystone: For ldap, API wrongly reports user is in group https://review.openstack.org/80934 | 19:26 |
| openstackgerrit | A change was merged to openstack/keystone: remove the unused variable in test_sql_upgrade https://review.openstack.org/79297 | 19:26 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Split sample PKI token generation https://review.openstack.org/74930 | 19:32 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Allow hash tokens with sha256 https://review.openstack.org/80398 | 19:33 |
| *** vhoward- has left #openstack-keystone | 19:36 | |
| *** leseb has joined #openstack-keystone | 19:41 | |
| raildo | I'm with a doubt and think that someone could help me. I'm trying to reproduce the error that happened in https://bugs.launchpad.net/keystone/+bug/1081221 | 19:41 |
| uvirtbot | Launchpad bug 1081221 in keystone "Keystone POST /tokens response does not contain all endpoints" [Medium,Triaged] | 19:42 |
| raildo | When he speaks in /POST token, this refers to usually get a token? | 19:42 |
| raildo | I could not view the list of endpoints, anyone know any way to do this? | 19:43 |
| *** zhiyan_ is now known as zhiyan | 19:50 | |
| *** ilives has quit IRC | 19:55 | |
| *** ilives has joined #openstack-keystone | 19:56 | |
| *** rwsu has joined #openstack-keystone | 19:56 | |
| *** harlowja has quit IRC | 20:02 | |
| *** harlowja has joined #openstack-keystone | 20:03 | |
| *** ilives has quit IRC | 20:03 | |
| *** ilives has joined #openstack-keystone | 20:05 | |
| *** rwsu has quit IRC | 20:07 | |
| *** rwsu has joined #openstack-keystone | 20:09 | |
| *** rwsu has quit IRC | 20:11 | |
| *** rwsu has joined #openstack-keystone | 20:11 | |
| *** ayoung has joined #openstack-keystone | 20:18 | |
| *** topol has joined #openstack-keystone | 20:18 | |
| *** leseb has quit IRC | 20:20 | |
| *** leseb has joined #openstack-keystone | 20:21 | |
| *** leseb has quit IRC | 20:26 | |
| baffle | dolphm: So, having looked at things a bit; Am I correct in understanding that domains just doesn't work with Nova (and possibly other core parts of openstack)? | 20:27 |
| *** rwsu has quit IRC | 20:27 | |
| bknudson | baffle: what do domains have to do with nova? you get a token with roles and nova uses the roles. | 20:28 |
| bknudson | what does nova have to do with the domain of the user? | 20:28 |
| *** rwsu has joined #openstack-keystone | 20:31 | |
| *** jogo has joined #openstack-keystone | 20:37 | |
| *** jogo has left #openstack-keystone | 20:37 | |
| *** henrynash has joined #openstack-keystone | 20:38 | |
| *** david-lyle has joined #openstack-keystone | 20:40 | |
| *** marekd has quit IRC | 20:43 | |
| *** marekd has joined #openstack-keystone | 20:47 | |
| *** amcrn has joined #openstack-keystone | 20:55 | |
| *** gokrokve_ has joined #openstack-keystone | 20:59 | |
| marekd | hi, I am having lots of failures not related to my change, nor to the failing tests. Anybody aware of the bug number I should put in the comment, or just keep trying with recheck no bug? https://review.openstack.org/#/c/85020/ and one of the logs: http://logs.openstack.org/20/85020/1/check/check-tempest-dsvm-neutron/f0c369c/console.html | grep exit . | 21:01 |
| *** gokrokve has quit IRC | 21:02 | |
| *** leseb has joined #openstack-keystone | 21:07 | |
| bknudson | marekd: please look into the issue and open a bug if it's a new problem. | 21:09 |
| bknudson | marekd: this will help out the entire openstack project | 21:09 |
| *** henrynash has quit IRC | 21:09 | |
| *** jdob has quit IRC | 21:10 | |
| marekd | bknudson: ok | 21:11 |
| *** stevemar has quit IRC | 21:12 | |
| jamielennox | marekd: i don't *think* that one was your fault | 21:14 |
| jamielennox | 2014-04-03 16:17:55.144 | + openstack --os-token 111222333444 --os-url=http://127.0.0.1:5000/v3 --os-identity-api-version=3 role add --user heat_domain_admin --domain 675d578ed1eb42adbea279b17b2dd6aa admin | 21:14 |
| jamielennox | 2014-04-03 16:17:55.607 | ERROR: cliff.app create_grant() got an unexpected keyword argument 'role' (HTTP 400) | 21:14 |
| marekd | jamielennox: yeah, i am looking at the same lines. | 21:16 |
| jamielennox | it's a pity that openstackclient doesn't run with debug | 21:17 |
| baffle | bknudson: I'm very confused; If I auth with a user that's not in the default domain I can't auth with nova. | 21:18 |
| baffle | bknudson: From Horizon. | 21:18 |
| bknudson | baffle: anything in the nova log? | 21:18 |
| jamielennox | dtroyer: do you know where the above create_grant() is coming from? | 21:18 |
| baffle | bknudson: Keystone says "Authorization failed. Non-default domain is not supported" and Nova says "Invalid user token - rejecting request". | 21:20 |
| dtroyer | jamielennox: I do not. it isn't in the master branch of OSC | 21:21 |
| jamielennox | dtroyer: yea, it didn't show up with a grep - but it's being used in devstack and it's not coming from keystoneclient | 21:22 |
| *** rwsu has quit IRC | 21:22 | |
| jamielennox | coming from the end of http://logs.openstack.org/20/85020/1/check/check-devstack-dsvm-cells/587a1c3/logs/devstacklog.txt.gz | 21:22 |
| baffle | bknudson: I guess it is related to this: https://review.openstack.org/#/c/24869/ | 21:22 |
| baffle | bknudson: But I don't know *why* it's like that. :) | 21:22 |
| bknudson | baffle: are you authenticating with V2? | 21:24 |
| bknudson | if so, you wouldn't be able to get a token for a user in the non-default domain. | 21:24 |
| baffle | bknudson: I think horizon uses novaclient wich uses V2? | 21:26 |
| baffle | bknudson: I auth to Horizon with V3, but I think Horizon uses novaclient wich uses V2? If I'm not mistaken. | 21:27 |
| marekd | jamielennox: probably re-running it with "recheck no bug" is not the smartest idea and filing a bug is a better one. | 21:28 |
| jamielennox | marekd: i know what it is | 21:28 |
| marekd | jamielennox: yes..? | 21:28 |
| jamielennox | marekd: see how on line 349 you move the line url = self.build_url(dict_args_in_out=kwargs) inline | 21:29 |
| jamielennox | that build_url modifies the kwargs dict | 21:29 |
| jamielennox | which is why you have to run it first and then use the kwargs again later | 21:29 |
| jamielennox | so the roles= value is still in the body when you construct body={self.key: kwargs} because it is being executed before build_url | 21:30 |
| jamielennox | create_grant is the coming from keystone server | 21:30 |
| marekd | jamielennox: ok, got it. | 21:32 |
| baffle | bknudson: Yeah.. I auth to Horizon with V3. Then it uses my token (wich is a scoped domain token) to connect to Nova: 'novaclient connection created using token "8060d8d6bf021b7cec8f4fa059fb19de" and url "https://servers.api.zetta.io:8774/v1.1/7a113261536a4d15a20d8d6e98834e43"' 'REQ: curl -i 'https://servers.api.zetta.io:8774/v1.1/7a113261536a4d15a20d8d6e98834e43/extensions' -X GET -H "X-Auth-Project-Id: 7a113261536a4d15a20d8d6e98834e43 " -H " | 21:33 |
| marekd | jamielennox: so I think the put() should behave the same way? | 21:33 |
| jamielennox | marekd: yep | 21:34 |
| baffle | bknudson: And then Nova tries to use that and keystone rejects it. | 21:34 |
| marekd | jamielennox: patching. | 21:36 |
| *** marcoemorais has joined #openstack-keystone | 21:36 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Allow hash tokens with sha256 https://review.openstack.org/80398 | 21:38 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Fix base.CrudManager.put() method. https://review.openstack.org/85020 | 21:38 |
| bknudson | baffle: UUID tokens? | 21:38 |
| baffle | bknudson: No, MD5 of the PKI token. Wich incidentially looks just like a UUID token. | 21:39 |
| bknudson | horizon does the md5? | 21:39 |
| baffle | bknudson: If you look at the user.Token code in openstack_auth you see that it converts the x-auth-token to a md5 hash... | 21:40 |
| bknudson | baffle: openstack_auth? | 21:41 |
| baffle | Yeah, openstack_auth.user .. ? | 21:41 |
| bknudson | baffle: never heard of it ... is it part of keystone? | 21:42 |
| baffle | bknudson: Hmm, maybe not.. Come to think of it, it's an addon to Django that Horizon uses. So maybe that is the culprit. | 21:43 |
| bknudson | baffle: ok, so keystone gets a v2 request to validate a token, but the user's not in the default domain... I would expect that to fail. | 21:44 |
| bknudson | since a user in a non-default domain would require a v3 token response. | 21:44 |
| dstanek | there was talk about always syncing all of olso - is that the direction? | 21:45 |
| bknudson | dstanek: https://review.openstack.org/#/c/83966/ | 21:45 |
| baffle | bknudson: Thanks, I'll dig into it some more.. Maybe with a big flowchart so I can try to keep the whole chain in my head.. :-) | 21:45 |
| bknudson | baffle: I assume it's auth_token middleware doing the token validation... seems like it should be using v3 to validate tokens. | 21:46 |
| dstanek | bknudson: nice thanks | 21:46 |
| *** nkinder has quit IRC | 21:48 | |
| *** stmi has joined #openstack-keystone | 21:49 | |
| bknudson | baffle: try setting auth_token's auth_version to v3.0 | 21:49 |
| *** leseb has quit IRC | 21:55 | |
| *** marcoemorais1 has joined #openstack-keystone | 21:56 | |
| *** marcoemorais has quit IRC | 21:58 | |
| *** lbragstad has quit IRC | 22:05 | |
| *** zhiyan is now known as zhiyan_ | 22:08 | |
| *** marcoemorais1 has quit IRC | 22:14 | |
| jamielennox | marekd: you will probably need a simple test for that put() review | 22:23 |
| *** rwsu has joined #openstack-keystone | 22:26 | |
| *** dstanek has quit IRC | 22:26 | |
| marekd | jamielennox: something like this https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/tests/test_base.py#L119 but with _put() ? | 22:27 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Configurable token hash algorithm https://review.openstack.org/80401 | 22:28 |
| jamielennox | marekd: what the hell is that | 22:28 |
| jamielennox | lol | 22:28 |
| jamielennox | whoever wrote that test mocked it to the point where it doesn't actually test anything | 22:28 |
| jamielennox | so it appears that put() was always supposed to take a body - the test just doesn't do anything | 22:29 |
| marekd | jamielennox: not me! not me! | 22:29 |
| marekd | jamielennox: hah, so it appears that python-keystoneclient has some suprises hidden...even for you :-) | 22:30 |
| jamielennox | oh, they are mocking client.put | 22:31 |
| jamielennox | marekd: i don't claim that it's all that good | 22:31 |
| marekd | jamielennox: i know | 22:31 |
| jamielennox | marekd: ok, _put() calls client.put() and that's where the mock is | 22:32 |
| jamielennox | but nothing is testing manager.put() | 22:32 |
| jamielennox | in which case why do we even have manager.put() | 22:32 |
| jamielennox | marekd: honestly it's good if you fix put() but i'd almost just use _put() for your patch | 22:34 |
| *** joesavak has quit IRC | 22:34 | |
| marekd | jamielennox: those are separated things - I would even go for _update() as it looks this should be the only method left one day... | 22:35 |
| jamielennox | depends, i think most people will understand and want to explicity specify PUT or PATCH | 22:36 |
| jamielennox | but honestly the managers suck - my approach has been whatever works | 22:36 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Configurable token hash algorithm https://review.openstack.org/80401 | 22:37 |
| marekd | jamielennox: i am talking about deprecating _put() and refactoring patch(), put(), update() to call _update() with method argument hardcoded. | 22:38 |
| *** marcoemorais has joined #openstack-keystone | 22:38 | |
| jamielennox | marekd: there has been some work recently to standardize the managers across all the projects | 22:39 |
| jamielennox | marekd: honestly i don't mind either way | 22:39 |
| marekd | jamielennox: got it. | 22:39 |
| jamielennox | but there may be some conflict there | 22:39 |
| marekd | jamielennox: why? | 22:39 |
| jamielennox | not conflict - just that it may come back later with a sync across all the projects | 22:40 |
| marekd | jamielennox: ah, ok. | 22:40 |
| *** gokrokve_ has quit IRC | 22:42 | |
| *** jagee has quit IRC | 22:53 | |
| *** dstanek has joined #openstack-keystone | 22:54 | |
| *** dstanek has quit IRC | 22:59 | |
| *** bvandenh has quit IRC | 23:00 | |
| *** david-lyle has quit IRC | 23:01 | |
| *** thedodd has quit IRC | 23:12 | |
| *** nkinder has joined #openstack-keystone | 23:15 | |
| *** dstanek has joined #openstack-keystone | 23:21 | |
| openstackgerrit | Priti Desai proposed a change to openstack/keystone: Adding one more check on project_id https://review.openstack.org/85199 | 23:22 |
| marekd | dstanek: Hi. Regarding your comments on https://review.openstack.org/#/c/84389/5/keystone/common/controller.py I think I will just try to add tests just for V3Controller (something like in test_v2_controller.py). | 23:27 |
| marekd | dstanek: and test exactly the method, so also the message output it stores in the Exception object. | 23:28 |
| marekd | It's late here, time to bed. Good night! | 23:32 |
| *** marekd is now known as marekd|away | 23:32 | |
| baffle | bknudson: Actually, I think that might be it.. It was set to "v3" wich is clearly wrong, as I can see from the sources.. | 23:49 |
| bknudson | baffle: seems like v3 should work, since that's the url | 23:50 |
| bknudson | but the code says differently | 23:50 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
