| *** praneshp_ has joined #openstack-keystone | 00:02 | |
| *** praneshp has quit IRC | 00:04 | |
| *** praneshp_ is now known as praneshp | 00:04 | |
| *** ilives has joined #openstack-keystone | 00:13 | |
| morganfainberg | ayoung-afk, yes we can drop the need for sevice users to validate a token | 00:16 |
|---|---|---|
| morganfainberg | ayoung-afk, but i bet we will have other cases to keep service users | 00:16 |
| morganfainberg | ayoung-afk, sorry was in meetings just getting back to things. | 00:17 |
| *** ilives has quit IRC | 00:17 | |
| *** ilives has joined #openstack-keystone | 00:17 | |
| *** praneshp has quit IRC | 00:17 | |
| *** praneshp has joined #openstack-keystone | 00:19 | |
| *** gokrokve has joined #openstack-keystone | 00:21 | |
| *** stevemar has joined #openstack-keystone | 00:34 | |
| *** dstanek has quit IRC | 00:43 | |
| *** dstanek has joined #openstack-keystone | 00:44 | |
| *** ayoung-afk is now known as ayoung | 00:51 | |
| *** stevemar has quit IRC | 00:51 | |
| ayoung | morganfainberg, No prob, was in Family mode. Ok, lets plan this out | 00:51 |
| ayoung | 1. we need to be able to do certain operations without a user: | 00:52 |
| ayoung | that means fetching certificates and the revocation evetns | 00:52 |
| ayoung | is there any other reason that we need a service user besides those calls? | 00:52 |
| *** gokrokve_ has joined #openstack-keystone | 00:53 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: delete association when delete proj or endpoint https://review.openstack.org/87551 | 00:56 |
| *** gokrokve has quit IRC | 00:56 | |
| ayoung | endpoint? | 00:58 |
| *** marcoemorais has quit IRC | 01:00 | |
| *** stevemar has joined #openstack-keystone | 01:03 | |
| morganfainberg | ayoung, hmm | 01:03 |
| morganfainberg | ayoung, catalog | 01:04 |
| ayoung | morganfainberg, right now that is in the token | 01:04 |
| ayoung | you are thinking of your optimization, right? | 01:04 |
| morganfainberg | ayoung, but we should also support getting the catalog w/o a token | 01:04 |
| ayoung | IDs only tokens | 01:04 |
| ayoung | and role list | 01:04 |
| morganfainberg | ayoung, yeah roles too | 01:04 |
| morganfainberg | ayoung, and yes for the optimisation, but also because it doesn't hurt to provide the catalog in general | 01:05 |
| morganfainberg | ayoung, i think that is most of it. it's a relatively small surface area | 01:06 |
| *** dims has quit IRC | 01:08 | |
| morganfainberg | ayoung, hopefully i can wade out of these meetings and get back to writing code, about to start working on unifying the token data (json -> something consistent) while internal to keystone (prior to emitting) | 01:10 |
| morganfainberg | should make working with the token better inside keystone and make it version agnostic internally | 01:10 |
| *** wchrisj has joined #openstack-keystone | 01:15 | |
| *** browne has quit IRC | 01:20 | |
| *** dims has joined #openstack-keystone | 01:20 | |
| *** wchrisj has quit IRC | 01:21 | |
| ayoung | morganfainberg, part of the token pipeline refactor? | 01:28 |
| morganfainberg | ayoung, yeah it'll be used for that | 01:29 |
| ayoung | morganfainberg, https://review.openstack.org/#/c/71181/ oh happy day! Compressed tokens work, pep8, p27 p33 and Tempest | 01:29 |
| *** dstanek has quit IRC | 01:34 | |
| *** topol has joined #openstack-keystone | 01:38 | |
| ayoung | morganfainberg, so, we need a rule in policy that says "you can call this function without a token" and we don't have that yet | 01:42 |
| morganfainberg | ayoung, hm isn't that just not decorating with the @protected method? | 01:43 |
| morganfainberg | ayoung, or you mean it should support needing a token if a deployer wants? | 01:43 |
| *** dstanek has joined #openstack-keystone | 01:43 | |
| ayoung | morganfainberg, policy should control whether or not. It should not require a code change | 01:44 |
| ayoung | making that happen would mean processing the policy before unpacking the token, | 01:44 |
| ayoung | which is not what is done now | 01:44 |
| morganfainberg | ayoung, hmm. | 01:45 |
| ayoung | morganfainberg, I want to move the policy parsing and enforcement all into keystone client, too, so we can share the goodness. | 01:45 |
| ayoung | and..I want an API where we can fetch policy by the endpoint id. | 01:45 |
| ayoung | all of those should probably be tokenless. | 01:46 |
| morganfainberg | ayoung, i'm not sure we want policy involved with these "no token needed" methods | 01:46 |
| ayoung | they go hand in glove | 01:46 |
| morganfainberg | ayoung, rather give people too much rope to hang themselves vs. prevent the hanging from misconfiguration? | 01:47 |
| morganfainberg | ayoung, my thought was if these are expected to be public, why is policy involved at all? | 01:48 |
| ayoung | morganfainberg, I say, lets make it possible to run without service users, not a hard and fast requirment | 01:48 |
| ayoung | no, I mean policy fetch needs to be public, too | 01:48 |
| morganfainberg | oh oh | 01:48 |
| morganfainberg | yeah | 01:48 |
| morganfainberg | so if you want to require authentication you can enforce it? | 01:49 |
| morganfainberg | i'd argue somethings need to be unauthenticated, but maybe not all? | 01:49 |
| morganfainberg | and always no-auth | 01:49 |
| ayoung | we need an "unauthenticated" policy call, and then things get interested | 01:49 |
| ayoung | interesting | 01:49 |
| morganfainberg | i'll need to stew on that on. | 01:51 |
| morganfainberg | not saying i disagree | 01:51 |
| morganfainberg | just need to let that one rattle around a bit | 01:51 |
| ayoung | yeah.... | 01:52 |
| ayoung | what would it take to make a call unauthenticated....let's see | 01:56 |
| topol | pretty quiet night on the keystone channel | 02:02 |
| ayoung | morganfainberg, I'm guessing it would need to be a hardcoded check here: https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L164 | 02:04 |
| ayoung | something like | 02:05 |
| openstackgerrit | A change was merged to openstack/keystone: Don't re-raise instance https://review.openstack.org/87149 | 02:05 |
| morganfainberg | ayoung, possibly | 02:05 |
| morganfainberg | ayoung, that looks about right | 02:05 |
| ayoung | if action.bypass_authorization(): | 02:05 |
| ayoung | return | 02:05 |
| morganfainberg | ayoung, yeah | 02:08 |
| *** richm has quit IRC | 02:09 | |
| morganfainberg | ayoung, i'll play around with that as well. | 02:11 |
| morganfainberg | ayoung, hopefully have time soon for it | 02:11 |
| morganfainberg | ayoung, topol, catch you guys later. | 02:14 |
| ayoung | later | 02:14 |
| *** rwsu has quit IRC | 02:22 | |
| *** jsidhu has quit IRC | 02:24 | |
| *** amcrn has quit IRC | 02:32 | |
| *** harlowja is now known as harlowja_away | 02:49 | |
| *** ayoung is now known as ayoung_afk | 02:52 | |
| *** mberlin1 has joined #openstack-keystone | 02:54 | |
| *** mberlin has quit IRC | 02:56 | |
| *** gokrokve_ has quit IRC | 02:58 | |
| *** gyee has quit IRC | 02:59 | |
| *** gokrokve has joined #openstack-keystone | 03:05 | |
| *** gokrokve has quit IRC | 03:09 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: delete association when delete proj or endpoint https://review.openstack.org/87551 | 03:16 |
| *** chandan_kumar has joined #openstack-keystone | 03:20 | |
| *** dstanek has quit IRC | 03:26 | |
| *** stevemar has quit IRC | 03:26 | |
| *** stevemar has joined #openstack-keystone | 03:28 | |
| *** gokrokve has joined #openstack-keystone | 03:29 | |
| *** gokrokve_ has joined #openstack-keystone | 03:31 | |
| *** gokrokv__ has joined #openstack-keystone | 03:33 | |
| *** gokrokve has quit IRC | 03:34 | |
| *** gokrokve_ has quit IRC | 03:35 | |
| *** lnxnut has quit IRC | 03:37 | |
| *** gokrokv__ has quit IRC | 03:37 | |
| *** lnxnut has joined #openstack-keystone | 03:39 | |
| *** wchrisj has joined #openstack-keystone | 03:41 | |
| *** stevemar has quit IRC | 03:51 | |
| *** browne has joined #openstack-keystone | 03:55 | |
| *** browne has quit IRC | 03:55 | |
| *** lbragstad has joined #openstack-keystone | 03:58 | |
| *** zhiyan_ is now known as zhiyan | 04:04 | |
| *** praneshp has quit IRC | 04:05 | |
| *** wchrisj has quit IRC | 04:08 | |
| *** david-lyle has joined #openstack-keystone | 04:08 | |
| *** praneshp has joined #openstack-keystone | 04:08 | |
| *** topol has quit IRC | 04:18 | |
| *** lnxnut has quit IRC | 04:22 | |
| *** dstanek has joined #openstack-keystone | 04:28 | |
| *** gokrokve has joined #openstack-keystone | 04:32 | |
| *** dstanek has quit IRC | 04:33 | |
| *** gokrokve has quit IRC | 04:37 | |
| *** david-lyle has quit IRC | 04:37 | |
| *** zhiyan is now known as zhiyan_ | 04:41 | |
| *** praneshp has quit IRC | 04:54 | |
| *** gokrokve has joined #openstack-keystone | 05:32 | |
| *** gokrokve has quit IRC | 05:37 | |
| *** zhiyan_ is now known as zhiyan | 05:42 | |
| *** derek_c has quit IRC | 05:48 | |
| *** derek_c has joined #openstack-keystone | 05:51 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/88503 | 06:01 |
| *** tomoiaga has joined #openstack-keystone | 06:12 | |
| *** gokrokve has joined #openstack-keystone | 06:32 | |
| *** gokrokve has quit IRC | 06:36 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Cleanup of ldap backends https://review.openstack.org/88517 | 06:43 |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Cleanup of ldap backends https://review.openstack.org/88517 | 06:46 |
| *** chandan_kumar has quit IRC | 06:57 | |
| *** chandan_kumar has joined #openstack-keystone | 07:05 | |
| *** praneshp has joined #openstack-keystone | 07:18 | |
| *** dstanek has joined #openstack-keystone | 07:31 | |
| *** gokrokve has joined #openstack-keystone | 07:32 | |
| *** morganfainberg is now known as morganfainberg_Z | 07:32 | |
| *** dstanek has quit IRC | 07:35 | |
| *** gokrokve has quit IRC | 07:37 | |
| *** leseb has joined #openstack-keystone | 08:03 | |
| *** dstanek has joined #openstack-keystone | 08:31 | |
| *** gokrokve has joined #openstack-keystone | 08:32 | |
| *** dstanek has quit IRC | 08:36 | |
| *** gokrokve has quit IRC | 08:36 | |
| *** derek_c has quit IRC | 08:37 | |
| *** gokrokve has joined #openstack-keystone | 09:32 | |
| *** gokrokve has quit IRC | 09:37 | |
| *** praneshp has quit IRC | 10:03 | |
| *** henrynash has joined #openstack-keystone | 10:20 | |
| *** gokrokve has joined #openstack-keystone | 10:32 | |
| *** gokrokve has quit IRC | 10:37 | |
| *** gokrokve has joined #openstack-keystone | 11:32 | |
| *** gokrokve has quit IRC | 11:37 | |
| *** lnxnut has joined #openstack-keystone | 12:08 | |
| *** dstanek has joined #openstack-keystone | 12:11 | |
| *** dstanek has quit IRC | 12:24 | |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Sync test_migrations https://review.openstack.org/80618 | 12:26 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Redundant unique constraint https://review.openstack.org/84447 | 12:26 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Corresponding `nullable` value. https://review.openstack.org/84446 | 12:26 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Migration DB_INIT_VERSION in common place https://review.openstack.org/88016 | 12:26 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Compatible server default value in the models. https://review.openstack.org/84445 | 12:26 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Explicit foreign key indexes. https://review.openstack.org/84444 | 12:26 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Sync on-demand database schemas https://review.openstack.org/84448 | 12:26 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 12:27 |
| *** gokrokve has joined #openstack-keystone | 12:32 | |
| *** gokrokve has quit IRC | 12:37 | |
| *** Anju_ has joined #openstack-keystone | 12:38 | |
| *** dstanek has joined #openstack-keystone | 12:39 | |
| *** bvandenh has joined #openstack-keystone | 12:42 | |
| *** rediskin has joined #openstack-keystone | 12:48 | |
| rediskin | hi all | 12:52 |
| rediskin | dolphm: please take a look at my comment: https://bugs.launchpad.net/python-keystoneclient/+bug/1309180 | 12:52 |
| uvirtbot | Launchpad bug 1309180 in python-keystoneclient "nothing works when only externalURL available" [Undecided,Invalid] | 12:52 |
| rediskin | dolphm: all works when i set `endpoint'. even with port 35357 | 12:52 |
| *** bach has joined #openstack-keystone | 12:56 | |
| *** dims has quit IRC | 13:09 | |
| *** bach has quit IRC | 13:13 | |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Sync test_migrations https://review.openstack.org/80618 | 13:15 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Sync on-demand database schemas https://review.openstack.org/84448 | 13:15 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 13:15 |
| *** dims has joined #openstack-keystone | 13:22 | |
| *** topol has joined #openstack-keystone | 13:22 | |
| *** gokrokve has joined #openstack-keystone | 13:32 | |
| *** bach has joined #openstack-keystone | 13:32 | |
| *** gokrokve has quit IRC | 13:37 | |
| *** bknudson has joined #openstack-keystone | 13:38 | |
| *** chandan_kumar has quit IRC | 13:42 | |
| *** wchrisj has joined #openstack-keystone | 13:47 | |
| *** bvandenh has quit IRC | 14:01 | |
| *** vhoward has joined #openstack-keystone | 14:02 | |
| *** daneyon has joined #openstack-keystone | 14:03 | |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 14:05 |
| *** gokrokve has joined #openstack-keystone | 14:32 | |
| *** lbragstad has quit IRC | 14:34 | |
| *** gokrokve has quit IRC | 14:37 | |
| *** lbragstad has joined #openstack-keystone | 14:37 | |
| *** ilives has quit IRC | 14:40 | |
| *** thedodd has joined #openstack-keystone | 14:46 | |
| *** RockKuo_TW has joined #openstack-keystone | 14:46 | |
| *** gokrokve has joined #openstack-keystone | 14:54 | |
| *** Anju_ has quit IRC | 15:01 | |
| *** tomoiaga has quit IRC | 15:14 | |
| *** daneyon has quit IRC | 15:18 | |
| *** daneyon has joined #openstack-keystone | 15:19 | |
| *** stevemar has joined #openstack-keystone | 15:24 | |
| *** browne has joined #openstack-keystone | 15:34 | |
| *** david-lyle has joined #openstack-keystone | 15:35 | |
| *** RockKuo_TW has quit IRC | 15:46 | |
| *** zhiyan is now known as zhiyan_ | 15:50 | |
| *** chandan_kumar has joined #openstack-keystone | 15:51 | |
| *** stevemar has quit IRC | 16:03 | |
| *** gokrokve has quit IRC | 16:13 | |
| *** shakamunyi has joined #openstack-keystone | 16:18 | |
| openstackgerrit | Florent Flament proposed a change to openstack/python-keystoneclient: Allow keystone_authtoken middleware to use v3 API https://review.openstack.org/88620 | 16:22 |
| openstackgerrit | Christina Darretta proposed a change to openstack/keystone: Removed duplication with list_user_ids_for_project https://review.openstack.org/88621 | 16:23 |
| *** tomoiaga has joined #openstack-keystone | 16:25 | |
| openstackgerrit | Florent Flament proposed a change to openstack/python-keystoneclient: Allow keystone_authtoken middleware to use v3 API https://review.openstack.org/88620 | 16:25 |
| *** tomoiaga has quit IRC | 16:29 | |
| *** bknudson has quit IRC | 16:32 | |
| *** gyee has joined #openstack-keystone | 16:33 | |
| *** bach has quit IRC | 16:38 | |
| *** branen has joined #openstack-keystone | 16:56 | |
| *** harlowja_away is now known as harlowja | 16:58 | |
| *** gokrokve has joined #openstack-keystone | 16:58 | |
| *** gokrokve has quit IRC | 17:03 | |
| *** leseb has quit IRC | 17:17 | |
| *** gokrokve has joined #openstack-keystone | 17:17 | |
| *** leseb has joined #openstack-keystone | 17:18 | |
| *** leseb has quit IRC | 17:22 | |
| *** bknudson has joined #openstack-keystone | 17:28 | |
| *** Anju_ has joined #openstack-keystone | 17:31 | |
| *** dstanek has quit IRC | 17:33 | |
| *** amcrn has joined #openstack-keystone | 17:42 | |
| *** topol has quit IRC | 17:43 | |
| *** EmilienM has quit IRC | 17:50 | |
| *** EmilienM has joined #openstack-keystone | 17:50 | |
| openstackgerrit | Christina Darretta proposed a change to openstack/keystone: Removed duplication with list_user_ids_for_project https://review.openstack.org/88621 | 17:54 |
| *** leseb has joined #openstack-keystone | 17:58 | |
| *** wchrisj_ has joined #openstack-keystone | 17:58 | |
| *** wchrisj has quit IRC | 18:02 | |
| *** daneyon has quit IRC | 18:07 | |
| *** leseb has quit IRC | 18:10 | |
| *** bach has joined #openstack-keystone | 18:15 | |
| *** dstanek has joined #openstack-keystone | 18:25 | |
| *** topol has joined #openstack-keystone | 18:42 | |
| *** dims is now known as dims-openstack | 18:58 | |
| openstackgerrit | A change was merged to openstack/keystone: Enhance tests for user extra attribute mapping https://review.openstack.org/81046 | 19:09 |
| *** derek_c has joined #openstack-keystone | 19:10 | |
| *** dims-openstack is now known as dims | 19:24 | |
| *** shakamunyi has quit IRC | 19:27 | |
| *** derek_c has quit IRC | 19:27 | |
| *** shakayumi has joined #openstack-keystone | 19:27 | |
| *** derek_c has joined #openstack-keystone | 19:27 | |
| *** amcrn has quit IRC | 19:44 | |
| *** dstanek has quit IRC | 19:46 | |
| *** nekron99_ has joined #openstack-keystone | 19:50 | |
| *** amcrn has joined #openstack-keystone | 20:02 | |
| *** chandan_kumar has quit IRC | 20:21 | |
| *** Anju_ has quit IRC | 20:21 | |
| *** henrynash has quit IRC | 20:34 | |
| *** david_lyle_ has joined #openstack-keystone | 20:40 | |
| *** dklyle has joined #openstack-keystone | 20:41 | |
| *** david-lyle has quit IRC | 20:43 | |
| *** david_lyle_ has quit IRC | 20:45 | |
| *** daneyon has joined #openstack-keystone | 20:47 | |
| *** daneyon has quit IRC | 20:48 | |
| *** daneyon has joined #openstack-keystone | 20:50 | |
| *** harlowja is now known as harlowja_away | 20:50 | |
| *** dklyle has quit IRC | 20:57 | |
| *** wchrisj_ has quit IRC | 20:58 | |
| *** david-lyle has joined #openstack-keystone | 21:04 | |
| *** harlowja_away is now known as harlowja | 21:41 | |
| *** gokrokve has quit IRC | 21:58 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Sync with oslo-incubator 74ae271 https://review.openstack.org/87980 | 22:08 |
| *** derek_c has quit IRC | 22:08 | |
| *** thedodd has quit IRC | 22:11 | |
| *** nekron99_ has quit IRC | 22:13 | |
| *** rediskin has left #openstack-keystone | 22:13 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Stronger assertion for test_user_extra_attribute_mapping https://review.openstack.org/87145 | 22:22 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: WIP: Remove fixtures from oslo config https://review.openstack.org/88706 | 22:26 |
| *** daneyon has quit IRC | 22:28 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: More efficient DN list for LDAP role delete https://review.openstack.org/87151 | 22:35 |
| *** bach has quit IRC | 22:41 | |
| *** david-lyle has quit IRC | 22:55 | |
| *** topol has quit IRC | 23:05 | |
| *** Chicago has quit IRC | 23:08 | |
| *** wchrisj has joined #openstack-keystone | 23:13 | |
| *** dims has quit IRC | 23:15 | |
| *** bach has joined #openstack-keystone | 23:24 | |
| *** dims has joined #openstack-keystone | 23:42 | |
| *** derek_c has joined #openstack-keystone | 23:54 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!