| *** gokrokve has quit IRC | 00:03 | |
| *** browne has quit IRC | 00:12 | |
| *** marcoemorais has quit IRC | 00:13 | |
| *** browne has joined #openstack-keystone | 00:13 | |
| *** marcoemorais has joined #openstack-keystone | 00:15 | |
| *** browne has quit IRC | 00:17 | |
| boris-42 | morganfainberg ping | 00:18 |
|---|---|---|
| boris-42 | Guys | 00:23 |
| boris-42 | Seems like something wired is happening with keystone | 00:23 |
| boris-42 | when it is under load for a long period of time | 00:23 |
| boris-42 | http://pavlovic.me/rally/keystone-users.html | 00:23 |
| boris-42 | ^ take a look at these graphs ^ | 00:24 |
| bknudson | boris-42: that's why we need rally | 00:24 |
| boris-42 | bknudson take a look at graph | 00:24 |
| boris-42 | bknudson first 3k iterations everything was fine | 00:24 |
| boris-42 | bknudson and then BOOM | 00:24 |
| boris-42 | bknudson btw rally gates are almost ready | 00:25 |
| bknudson | it crashed by browser | 00:25 |
| boris-42 | bknudson hehe | 00:25 |
| boris-42 | bknudson we should improve this stuff | 00:25 |
| boris-42 | bknudson when we have 6k iterations.. | 00:25 |
| boris-42 | let me just share image | 00:26 |
| *** praneshp has quit IRC | 00:26 | |
| boris-42 | bknudson https://docs.google.com/a/mirantis.com/file/d/0B7XIUFtx6EISTUxOU1Zndy05cUk/edit | 00:27 |
| boris-42 | most of errors are timeouts | 00:28 |
| boris-42 | to /tokens | 00:28 |
| bknudson | boris-42: mysql? | 00:28 |
| boris-42 | bknudson it was devstack installation with apache in localsc | 00:29 |
| boris-42 | so I think yes mysql | 00:29 |
| bknudson | boris-42: there's plans for juno to have ephemeral tokens so we won't have to store those in the db | 00:29 |
| *** joesavak has joined #openstack-keystone | 00:30 | |
| bknudson | 20 seconds to get a token? | 00:30 |
| bknudson | even that seems like a long time! | 00:30 |
| *** gokrokve has joined #openstack-keystone | 00:30 | |
| boris-42 | timeout was set to 30 | 00:30 |
| boris-42 | so nope benchmark is a bit another | 00:30 |
| boris-42 | 1) create user 2) delete user | 00:30 |
| boris-42 | ^ 2 steps | 00:31 |
| bknudson | boris-42: does it get a token every time? | 00:31 |
| boris-42 | yep | 00:31 |
| boris-42 | 1) get token | 00:31 |
| boris-42 | 2) create user | 00:31 |
| boris-42 | 3) delete user | 00:31 |
| bknudson | so the token table will continue to grow | 00:31 |
| boris-42 | 6k times under load of 50 concurrency scenarious | 00:31 |
| boris-42 | yep | 00:31 |
| bknudson | if you want to test user creation time, don't create a token every time | 00:32 |
| boris-42 | but it should have only 6k records | 00:32 |
| boris-42 | bknudson we have some kind of rules inside rally about benchmarking | 00:32 |
| boris-42 | we are simulating real situations | 00:32 |
| boris-42 | so no caching between to iterations | 00:32 |
| bknudson | I'm not sure how realistic it would be for a cloud to have 50 concurrent users creating 6k users. | 00:33 |
| bknudson | and then deleting them right away | 00:33 |
| bknudson | boris-42: doesn't a test with just getting a token show the same thing? | 00:33 |
| boris-42 | bknudson I didn't run it | 00:33 |
| boris-42 | bknudson with such amount of iterations | 00:34 |
| *** jsavak has joined #openstack-keystone | 00:34 | |
| bknudson | boris-42: it's more realistic that a cloud would have 50 concurrent users getting 6k tokens. | 00:34 |
| *** amcrn has joined #openstack-keystone | 00:34 | |
| boris-42 | bknudson that is possible to do | 00:34 |
| *** gokrokve has quit IRC | 00:34 | |
| boris-42 | bknudson and benchmark as well | 00:34 |
| boris-42 | bknudson and it is possible to make next benchmark create 1 tenant + N users (where N you may specify) | 00:35 |
| boris-42 | bknudson but in any case | 00:36 |
| boris-42 | bknudson why this thing is so sharp? | 00:36 |
| boris-42 | bknudson why it didn't raise smooth | 00:37 |
| bknudson | boris-42: maybe a case of a database lock changing mode from row to table? | 00:37 |
| *** zhiyan_ is now known as zhiyan | 00:37 | |
| bknudson | or switching from something fitting in memory to moving to disk? | 00:37 |
| bknudson | (e.g., the token table) | 00:38 |
| boris-42 | bknudson but it's not so huge | 00:38 |
| *** joesavak has quit IRC | 00:38 | |
| boris-42 | bknudson I will try to repeat this experiment | 00:38 |
| boris-42 | bknudson with new deployment | 00:38 |
| bknudson | boris-42: you said this is running keystone in apache? | 00:39 |
| boris-42 | bknudson yep | 00:40 |
| bknudson | boris-42: how many keystone processes do you wind up with? | 00:40 |
| boris-42 | bknudson btw started one more time benhmark | 00:40 |
| bknudson | apache log usually shows startup of the servers | 00:40 |
| boris-42 | bknudson everything works fine! | 00:40 |
| boris-42 | bknudson lol | 00:41 |
| boris-42 | I mean I run just 100 iterations | 00:41 |
| boris-42 | all passed | 00:41 |
| boris-42 | running one more time 200 | 00:41 |
| bknudson | I thought it was 3000 was the problem? | 00:42 |
| boris-42 | bknudson yep | 00:42 |
| boris-42 | bknudson after 3k | 00:42 |
| boris-42 | bknudson something happened | 00:42 |
| boris-42 | bknudson but I just wait for some period of time | 00:42 |
| bknudson | if requestcount > 3000: sleep(40) | 00:43 |
| boris-42 | bknudson and re run just 100 iterations to check does it make sense that the load was continious | 00:43 |
| boris-42 | yep something like that=) | 00:43 |
| boris-42 | actually no | 00:44 |
| boris-42 | if avg_load_for_last_is(50) and requestcount > 3000: sleep(40) | 00:44 |
| bknudson | oh, it wakes back up again? | 00:44 |
| boris-42 | yep | 00:44 |
| boris-42 | it works fine | 00:44 |
| boris-42 | now | 00:44 |
| boris-42 | I run 200 iterations with load of 50 concurrency scnearios | 00:45 |
| bknudson | so maybe it gets backed up and can't recover? | 00:45 |
| boris-42 | and it works fine | 00:45 |
| boris-42 | Idk=) | 00:45 |
| boris-42 | but something strange is happaning | 00:45 |
| bknudson | for example, if it doesn't notice that clients disconnect and cancel the operation | 00:45 |
| boris-42 | bknudson hm probably | 00:46 |
| boris-42 | bknudson seems like there is some data and GC | 00:47 |
| boris-42 | bknudson and if load is bigger then XXX after some time GC is not able to cleanup everything | 00:47 |
| boris-42 | bknudson not super big expert of keystone code | 00:47 |
| boris-42 | bknudson seems like I should deep dive into it | 00:48 |
| bknudson | could be. keystone doesn't do anything special with gc as far as I know | 00:48 |
| boris-42 | bknudson I will try to run just authenticate benchmark | 00:48 |
| boris-42 | bknudson so we will be able to localize issue | 00:49 |
| bknudson | boris-42: I think that one's more important than speed of creating users. | 00:49 |
| boris-42 | yep cause probably the same can happen even on smaller load | 00:49 |
| boris-42 | bknudson so sorry but I have to sleep a bit=) | 00:50 |
| boris-42 | 5 a.m. lol | 00:50 |
| boris-42 | bknudson see you later | 00:50 |
| bknudson | boris-42: ok, thanks for working on this | 00:50 |
| bknudson | will be really valuable if we can have some numbers to work with | 00:51 |
| bknudson | we'll be able to see if token compression helps | 00:53 |
| bknudson | and ephemeral tokens | 00:53 |
| bknudson | and revocation events | 00:53 |
| bknudson | these are all being done to supposedly improve performance. | 00:53 |
| *** jsavak has quit IRC | 00:54 | |
| *** huats_ has joined #openstack-keystone | 00:58 | |
| *** huats_ has quit IRC | 00:58 | |
| *** huats_ has joined #openstack-keystone | 00:58 | |
| *** zhiyan has quit IRC | 00:58 | |
| *** huats has quit IRC | 00:58 | |
| *** gokrokve has joined #openstack-keystone | 00:59 | |
| *** zhiyan has joined #openstack-keystone | 01:00 | |
| morganfainberg | boris-42, looking at the graphs now | 01:00 |
| morganfainberg | bknudson, oh wow | 01:00 |
| *** derek_c has joined #openstack-keystone | 01:00 | |
| *** harlowja has joined #openstack-keystone | 01:00 | |
| *** theocean_ has joined #openstack-keystone | 01:02 | |
| *** marcoemorais has quit IRC | 01:02 | |
| *** theocean_ is now known as theocean154 | 01:02 | |
| *** dstanek_zzz has quit IRC | 01:02 | |
| *** marcoemorais has joined #openstack-keystone | 01:03 | |
| *** gokrokve has quit IRC | 01:04 | |
| morganfainberg | bknudson, that's an interesting graph | 01:05 |
| *** browne has joined #openstack-keystone | 01:05 | |
| *** theocean154 is now known as theocean154_zzz | 01:24 | |
| *** marcoemorais has quit IRC | 01:25 | |
| *** wchrisj has quit IRC | 01:33 | |
| *** bach has joined #openstack-keystone | 01:39 | |
| *** theocean154_zzz has quit IRC | 01:54 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Add new error for invalid response https://review.openstack.org/85213 | 01:57 |
| openstackgerrit | A change was merged to openstack/keystone: Fix typo on cache backend module https://review.openstack.org/89509 | 01:59 |
| *** gokrokve has joined #openstack-keystone | 01:59 | |
| *** gokrokve has quit IRC | 02:00 | |
| *** gokrokve has joined #openstack-keystone | 02:01 | |
| *** gokrokve has quit IRC | 02:05 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Fix the catalog format of a sample token https://review.openstack.org/89453 | 02:13 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Compressed Signature and Validation https://review.openstack.org/71181 | 02:17 |
| *** derek_c has quit IRC | 02:26 | |
| *** mberlin1 has quit IRC | 02:28 | |
| *** bach has quit IRC | 02:36 | |
| *** bach has joined #openstack-keystone | 02:37 | |
| *** amcrn has quit IRC | 02:41 | |
| *** mberlin has joined #openstack-keystone | 02:42 | |
| *** morganfainberg is now known as morganfainberg_Z | 02:47 | |
| *** gokrokve has joined #openstack-keystone | 02:59 | |
| *** praneshp has joined #openstack-keystone | 03:01 | |
| *** harlowja is now known as harlowja_away | 03:09 | |
| *** lbragstad has joined #openstack-keystone | 03:11 | |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Reduce excess LDAP searches https://review.openstack.org/47441 | 03:49 |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Reduce excess LDAP searches https://review.openstack.org/47441 | 03:54 |
| *** amcrn has joined #openstack-keystone | 04:06 | |
| *** gokrokve has quit IRC | 04:08 | |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Reduce excess LDAP searches https://review.openstack.org/47441 | 04:17 |
| *** harlowja_away is now known as harlowja | 04:18 | |
| *** marcoemorais has joined #openstack-keystone | 04:20 | |
| *** stevemar has joined #openstack-keystone | 04:27 | |
| *** chandan_kumar has joined #openstack-keystone | 05:00 | |
| *** gokrokve has joined #openstack-keystone | 05:07 | |
| *** rwsu has quit IRC | 05:07 | |
| *** gokrokve has quit IRC | 05:11 | |
| *** lbragstad has quit IRC | 05:16 | |
| *** marcoemorais has quit IRC | 05:16 | |
| *** daneyon has quit IRC | 05:23 | |
| *** rwsu has joined #openstack-keystone | 05:23 | |
| *** bach has quit IRC | 05:25 | |
| *** bach has joined #openstack-keystone | 05:27 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/88503 | 06:01 |
| *** tomoiaga has joined #openstack-keystone | 06:02 | |
| *** gyee has quit IRC | 06:05 | |
| *** tomoiaga has quit IRC | 06:06 | |
| *** gokrokve has joined #openstack-keystone | 06:07 | |
| *** gokrokve has quit IRC | 06:12 | |
| *** harlowja is now known as harlowja_away | 06:30 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Limited use trusts https://review.openstack.org/57492 | 06:48 |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Added statement for ... if ... else https://review.openstack.org/90013 | 06:49 |
| *** stevemar has quit IRC | 06:54 | |
| *** jaosorior has joined #openstack-keystone | 06:57 | |
| *** bach has quit IRC | 06:58 | |
| *** amcrn has quit IRC | 07:04 | |
| *** gokrokve has joined #openstack-keystone | 07:08 | |
| *** marekd|afk is now known as marekd | 07:08 | |
| *** marcoemorais has joined #openstack-keystone | 07:12 | |
| *** gokrokve has quit IRC | 07:12 | |
| *** praneshp has quit IRC | 07:20 | |
| *** d0ugal has quit IRC | 07:27 | |
| *** d0ugal has joined #openstack-keystone | 07:29 | |
| *** d0ugal has joined #openstack-keystone | 07:29 | |
| *** andreaf has joined #openstack-keystone | 07:50 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Ensure that cached token is not revoked https://review.openstack.org/78241 | 07:53 |
| *** bvandenh has joined #openstack-keystone | 08:03 | |
| *** andreaf has quit IRC | 08:06 | |
| *** gokrokve has joined #openstack-keystone | 08:09 | |
| *** jamielennox is now known as jamielennox|away | 08:12 | |
| *** gokrokve has quit IRC | 08:13 | |
| *** andreaf has joined #openstack-keystone | 08:40 | |
| *** huats_ is now known as huats | 08:57 | |
| *** derek_c has joined #openstack-keystone | 09:03 | |
| *** marcoemorais has quit IRC | 09:06 | |
| *** gokrokve has joined #openstack-keystone | 09:10 | |
| *** gokrokve has quit IRC | 09:14 | |
| *** derek_c has quit IRC | 09:15 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add detailed federation configuration docs https://review.openstack.org/89220 | 09:29 |
| *** zhiyan is now known as zhiyan_ | 09:32 | |
| *** marcoemorais has joined #openstack-keystone | 09:33 | |
| *** marcoemorais1 has joined #openstack-keystone | 09:35 | |
| boris-42 | morganfainberg_Z oh sorry was sleeping | 09:38 |
| *** marcoemorais has quit IRC | 09:38 | |
| *** marcoemorais1 has quit IRC | 09:39 | |
| *** tomoiaga has joined #openstack-keystone | 09:42 | |
| *** deani has joined #openstack-keystone | 09:42 | |
| tomoiaga | I'm trying to find out if I can limit an admin user using a token scope. If I login as admin (cloud_admin), can I limit the operations that admin can perform using the token scope ? (Or I missunderstood what the scope is) | 09:43 |
| deani | I am trying to setup only glance and keystone | 09:43 |
| deani | but while cofiguring the identity service according to http://docs.openstack.org/icehouse/install-guide/install/yum/openstack-install-guide-yum-trunk.pdf | 09:44 |
| deani | i am always getting Unable to communicate with identity service: (503, 'Service Unavailable'). (HTTP 400) | 09:44 |
| tomoiaga | deani: did you check the error log for keystone ? (usually /var/log/keystone.log) | 09:45 |
| deani | while doing a keystone user-create --name=admin --pass=ADMIN_PASS --email=blabla | 09:45 |
| *** bvandenh has quit IRC | 09:45 | |
| deani | @tomoiaga: i am checking the same | 09:45 |
| *** bvandenh has joined #openstack-keystone | 09:45 | |
| deani | is empty | 09:46 |
| deani | do i have to enable some thing | 09:46 |
| deani | while restarting opestack-keystone service | 09:46 |
| tomoiaga | if keystone is running it should write something on the log | 09:47 |
| openstackgerrit | Matthieu Huin proposed a change to openstack/keystone: More random values for oAuth1 verifier https://review.openstack.org/89612 | 09:47 |
| deani | well this is the problem | 09:48 |
| deani | keystone is dying | 09:48 |
| deani | [root@mccvm162 ~]# service openstack-keystone status keystone dead but pid file exists | 09:48 |
| deani | i can restart the same but it again dies when ever i try to add | 09:49 |
| tomoiaga | does it die after you run the command or just after the restart ? | 09:49 |
| tomoiaga | ok, try to enable debug logging and verbose | 09:49 |
| tomoiaga | in /etc/keystone/keystone.conf | 09:49 |
| tomoiaga | probably the db is not setup correctly, but we will see in a minute | 09:49 |
| tomoiaga | is mysql running and if it is, do you see the keystone database there ? | 09:50 |
| deani | ya i recreated it | 09:50 |
| deani | i min hold on shall i turn on debig too | 09:50 |
| deani | debug too | 09:50 |
| deani | oo i saw the top messsage | 09:51 |
| tomoiaga | I would also try to connect to mysql using the username and password configured in keystone.conf. Also the host should be setup correctly. I see in the pdf that the host is "controller". In case you have not replaced this with the actual IP/Host, this may be a problem. | 09:52 |
| deani | well i kind of suspected that | 09:54 |
| deani | i am connecting to the database with keystone credentials | 09:54 |
| deani | as root i have done these | 09:54 |
| deani | mysql> show databases -> ; +--------------------+ | Database | +--------------------+ | information_schema | | glance | | keystone | | mysql | | test | +--------------------+ 5 rows in set (0.00 sec) | 09:54 |
| deani | @tomoiga: I must confess that today i am ttying with the instructions in http://www.hastexo.com/resources/docs/installing-openstack-essex-20121-ubuntu-1204-precise-pangolin | 09:56 |
| deani | yesterday i tried with the instructions in http://www.hastexo.com/resources/docs/installing-openstack-essex-20121-ubuntu-1204-precise-pangolin | 09:56 |
| deani | but nonethe less the same error | 09:57 |
| tomoiaga | deani: set debug=True si verbose=True in keystone.conf. After that restart keystone to see if any log messages appear in the log file | 09:57 |
| deani | sure | 09:57 |
| *** zhiyan_ is now known as zhiyan | 09:58 | |
| deani | done | 09:58 |
| deani | I think we have narrowed down | 09:59 |
| deani | the problem to the keystone db | 09:59 |
| deani | so what do u want me to see in the db | 09:59 |
| tomoiaga | is keystone connecting to the db correctly ? Or what is the error you see in the logs | 10:00 |
| tomoiaga | you can also try to run: keystone-manage db_sync | 10:00 |
| deani | ok i think the credentials | 10:00 |
| deani | [root@mccvm162 ~]# mysql -ukeystonedbadmin -p Enter password: ERROR 1045 (28000): Access denied for user 'keystonedbadmin'@'localhost' (using password: YES) | 10:00 |
| deani | but i did the keystone-mange db_sync | 10:00 |
| tomoiaga | yeap, try to change them and also set them correctly in keystone.conf after that | 10:00 |
| deani | earlier | 10:01 |
| tomoiaga | keystone-manage db_sync tries to sync the db, it won't change users and passwords | 10:01 |
| deani | ok | 10:01 |
| deani | well i did this as per the URL hastexo | 10:02 |
| deani | mysql -u root <<EOF CREATE DATABASE keystone; GRANT ALL PRIVILEGES ON keystone.* TO 'keystonedbadmin'@'%' IDENTIFIED BY 'Ue0Ud7ra'; EOF | 10:02 |
| deani | so keystone should be another table in the db | 10:02 |
| deani | or it should be a db in itself , i am a bit confused | 10:02 |
| tomoiaga | well, add keystonedbadmin and the password in the keystone.conf file so keystone knows the user and password you set in mysql | 10:03 |
| deani | [sql] connection = mysql://keystonedbadmin:keystone@15.242.129.162/keystone | 10:04 |
| deani | i changed the pwd | 10:04 |
| deani | in both places | 10:04 |
| tomoiaga | this needs to be: mysql://keystonedbadmin:Ue0Ud7ra@15.242.129.162/keystone | 10:04 |
| deani | i mean i did change the pwd in both places | 10:05 |
| deani | so if i do mysql -u keystonedbadmin -p keystone | 10:05 |
| deani | i should be able to log on to the db | 10:05 |
| tomoiaga | yes | 10:05 |
| tomoiaga | it should be -pkeystone if 'keystone' is the password and you want to avoid the password prompt again | 10:06 |
| deani | so i am getting access denied | 10:06 |
| deani | ya | 10:06 |
| tomoiaga | try with -pUe0Ud7ra | 10:06 |
| deani | nahh same | 10:07 |
| deani | so i should restup the db | 10:07 |
| tomoiaga | execute the grant all again | 10:07 |
| deani | as root | 10:07 |
| deani | ? | 10:07 |
| tomoiaga | yes | 10:07 |
| tomoiaga | login to mysql and execute just the grant all on … identified by 'Ue0Ud7ra'; | 10:07 |
| *** dims has quit IRC | 10:08 | |
| *** zhiyan is now known as zhiyan_ | 10:08 | |
| deani | mysql> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \ IDENTIFIED BY 'KEYSTONE_DBPASS'; mysql> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \ IDENTIFIED BY 'KEYSTONE_DBPASS'; | 10:09 |
| deani | shall i change the localhost | 10:09 |
| deani | to reflect my IP | 10:09 |
| deani | and in some text they say to execute both the and some say one | 10:10 |
| deani | i am doing both | 10:10 |
| *** gokrokve has joined #openstack-keystone | 10:11 | |
| tomoiaga | deani: is the keystone server local to the db ? if yes, then since keystone will connect through localhost, you can keep localhost. If keystone is using a remote DB, than yes, you can place the keystone server IP there, or % while you test everything | 10:11 |
| deani | local | 10:12 |
| deani | i am in a single vm | 10:13 |
| tomoiaga | deani: ok, localhost will do | 10:13 |
| deani | so keystone, mysql and glance all 3 will be local | 10:13 |
| deani | ok my keystone.conf is "connection = mysql://keystonedbadmin:keystone@15.242.129.162/keystone" | 10:13 |
| tomoiaga | deani: I see you granted access to 'keystone' and not keystonedbadmin. You may want to change the user in the conf file | 10:14 |
| deani | so the GRANT will be like "GRANT ALL PRIVILEGES ON keystone.* TO 'keystonedbadmin'@'15.242.129.162' IDENTIFIED BY 'keystone'; | 10:14 |
| deani | correct | 10:15 |
| *** gokrokve has quit IRC | 10:15 | |
| tomoiaga | if 15.242.129.162 is your PC IP, than no, just set localhost instead of that. That IP is the IP from which a user is allowed to login. Since keystone is local , it will try to login to the DB from localhost. | 10:15 |
| tomoiaga | GRANT ALL PRIVILEGES ON keystone.* TO 'keystonedbadmin'@'localhost' IDENTIFIED BY 'keystone' | 10:16 |
| tomoiaga | connection = mysql://keystonedbadmin:keystone@localhost/keystone | 10:16 |
| tomoiaga | (ah, I see both had 15.242.129.162, it should have been correct that way too, sorry) | 10:16 |
| deani | ok | 10:16 |
| deani | i guess then i can use "GRANT ALL PRIVILEGES ON keystone.* TO 'keystonedbadmin'@'15.242.129.162' IDENTIFIED BY 'keystone';" | 10:17 |
| tomoiaga | if 15.242.129.162 is your VPS IP, yes | 10:17 |
| deani | yes it is | 10:18 |
| deani | i do not have to be consistent isnt it | 10:18 |
| deani | on conf i can use ip and here local host | 10:18 |
| deani | but i see a point in yr thing i wol always be using localhost | 10:18 |
| deani | so use that consistently oin both places | 10:19 |
| tomoiaga | deani: yeah, localhost should be ok, especially since an IP can change | 10:19 |
| deani | exactly | 10:19 |
| deani | :) | 10:19 |
| *** dims has joined #openstack-keystone | 10:19 | |
| deani | connection = mysql://keystonedbadmin:keystone@localhost/keystone and GRANT ALL PRIVILEGES ON keystone.* TO 'keystonedbadmin'@'localhost' IDENTIFIED BY 'keystone' | 10:21 |
| deani | done | 10:21 |
| deani | i am weak in sql | 10:21 |
| deani | i connected as root | 10:22 |
| deani | and then said use keystone | 10:22 |
| deani | and then i did the grant | 10:22 |
| deani | as per the official guilde they say do this too | 10:22 |
| deani | GRANT ALL PRIVILEGES ON keystone.* TO 'keystonedbadmin'@'%' IDENTIFIED BY 'keystone'; | 10:22 |
| tomoiaga | yes, % means any host, just in case | 10:23 |
| deani | ya | 10:23 |
| deani | how to check if the tables are correctly | 10:23 |
| deani | done | 10:23 |
| tomoiaga | if the connection to mysql works I would do a db_sync again | 10:24 |
| deani | ok | 10:25 |
| deani | show tables got this | 10:25 |
| deani | mysql> show tables; +------------------------+ | Tables_in_keystone | +------------------------+ | ec2_credential | | endpoint | | metadata | | migrate_version | | role | | service | | tenant | | token | | user | | user_tenant_membership | +------------------------+ | 10:25 |
| tomoiaga | yes, should be ok | 10:25 |
| tomoiaga | try to create a user | 10:25 |
| deani | ya | 10:25 |
| deani | sync done | 10:26 |
| deani | hey founnd this | 10:26 |
| deani | my keystone service is dying as soon as i restart it | 10:27 |
| deani | without doing anythign | 10:27 |
| deani | Stopping keystone: [FAILED] Starting keystone: [ OK ] [root@mccvm162 ~]# service openstack-keystone status | 10:27 |
| tomoiaga | check the logs, to see if something new appears there | 10:28 |
| tomoiaga | deani: you can also try to run: keystone-all to see if any errors are printed on the screen | 10:30 |
| *** marcoemorais has joined #openstack-keystone | 10:36 | |
| deani | @tomoiaga: keystone-all is taking forever | 10:37 |
| deani | to complete | 10:37 |
| deani | :( | 10:37 |
| tomoiaga | it won't complete, it will stay running until you hit ctrl+c. The main thing is to see if it's showing any errors or if it's running ok. Try with a second ssh connection to add a user and see if you get any errors in the screen with the keystone-all running. | 10:39 |
| tomoiaga | stop any instance of keystone while you run keystone-all. Run keystone-all, connect to a second ssh console and try to add a user | 10:40 |
| *** marcoemorais has quit IRC | 10:40 | |
| *** dstanek_zzz has joined #openstack-keystone | 10:44 | |
| *** dstanek_zzz is now known as dstanek | 10:44 | |
| *** waterkinfe has joined #openstack-keystone | 10:45 | |
| *** waterkinfe has quit IRC | 10:46 | |
| *** waterkinfe has joined #openstack-keystone | 10:47 | |
| *** waterkinfe has quit IRC | 10:52 | |
| *** waterkinfe has joined #openstack-keystone | 10:52 | |
| deani | hello | 11:08 |
| deani | @tomoiaga | 11:08 |
| deani | u tehre | 11:08 |
| deani | @tomoiaga: i am getting the logs now | 11:10 |
| deani | @tomoiaga: 2014-04-24 16:07:37 DEBUG [eventlet.wsgi.server] (8771) wsgi starting up on http://15.242.129.162:5000/ is where the logs is standing | 11:10 |
| *** gokrokve has joined #openstack-keystone | 11:11 | |
| deani | i will be back in 30 mins | 11:13 |
| *** gokrokve has quit IRC | 11:16 | |
| *** marcoemorais has joined #openstack-keystone | 11:37 | |
| *** marcoemorais has quit IRC | 11:41 | |
| *** chandan_kumar has quit IRC | 11:45 | |
| *** Rob_d has joined #openstack-keystone | 11:49 | |
| Rob_d | hi all, starting a test deploy of icehouse today, I want to test SAML using shibboleth idp 2.4 - any tips? | 11:52 |
| *** tomoiaga has left #openstack-keystone | 11:52 | |
| mhu | Rob_d, you can check this for starters: https://review.openstack.org/#/c/89220/ | 12:01 |
| *** jimbaker has quit IRC | 12:01 | |
| *** jimbaker has joined #openstack-keystone | 12:05 | |
| *** jimbaker has quit IRC | 12:05 | |
| *** jimbaker has joined #openstack-keystone | 12:05 | |
| Rob_d | mhu, thanks | 12:05 |
| *** erecio has joined #openstack-keystone | 12:09 | |
| *** gokrokve has joined #openstack-keystone | 12:12 | |
| *** erecio has quit IRC | 12:13 | |
| *** gokrokve has quit IRC | 12:17 | |
| *** erecio has joined #openstack-keystone | 12:24 | |
| openstackgerrit | Ala Rezmerita proposed a change to openstack/python-keystoneclient: Enable users to manage EC2-credentials on publicURL https://review.openstack.org/77219 | 12:25 |
| *** erecio has quit IRC | 12:27 | |
| marekd | Rob_d: hi, do you have your own IdP installed and running? | 12:30 |
| Rob_d | marejd: I do | 12:31 |
| Rob_d | marekd even^ | 12:32 |
| marekd | Rob_d: ok then :-) | 12:32 |
| marekd | Rob_d: Depending if you already have groups, roles, projects or not you can take a look at this scripts that create required objects - IdP, protocol, mapping, group, project, role. YOu can base on that as I made it for testshib.org public IdP. | 12:34 |
| marekd | Rob_d: https://github.com/zaccone/keystone-federation/tree/setup_infra/requests | 12:34 |
| Rob_d | marekd: this is a great help - you have my thanks **tips hat** | 12:37 |
| *** marcoemorais has joined #openstack-keystone | 12:37 | |
| marekd | Rob_d: No problem :-) | 12:38 |
| *** topol has joined #openstack-keystone | 12:39 | |
| *** erecio has joined #openstack-keystone | 12:40 | |
| *** marcoemorais has quit IRC | 12:42 | |
| *** waterkinfe has quit IRC | 12:45 | |
| *** diegows has joined #openstack-keystone | 12:47 | |
| *** kun_huang has joined #openstack-keystone | 12:56 | |
| *** ayoung has quit IRC | 12:59 | |
| *** gokrokve has joined #openstack-keystone | 13:13 | |
| *** bknudson has quit IRC | 13:14 | |
| *** gokrokve has quit IRC | 13:17 | |
| *** rodrigods has joined #openstack-keystone | 13:24 | |
| *** rodrigods has joined #openstack-keystone | 13:24 | |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Sync test_migrations https://review.openstack.org/80618 | 13:27 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Redundant unique constraint https://review.openstack.org/84447 | 13:27 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Corresponding `nullable` value. https://review.openstack.org/84446 | 13:27 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Migration DB_INIT_VERSION in common place https://review.openstack.org/88016 | 13:27 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Compatible server default value in the models. https://review.openstack.org/84445 | 13:27 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Explicit foreign key indexes. https://review.openstack.org/84444 | 13:28 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Sync on-demand database schemas https://review.openstack.org/84448 | 13:28 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 13:28 |
| openstackgerrit | Alan Pevec proposed a change to openstack/keystone: Refactor service readiness notification https://review.openstack.org/90079 | 13:29 |
| openstackgerrit | Alan Pevec proposed a change to openstack/keystone: Refactor service readiness notification https://review.openstack.org/90079 | 13:31 |
| *** marcoemorais has joined #openstack-keystone | 13:38 | |
| *** lbragstad has joined #openstack-keystone | 13:39 | |
| *** bknudson has joined #openstack-keystone | 13:41 | |
| *** marcoemorais has quit IRC | 13:42 | |
| *** nkinder has quit IRC | 13:43 | |
| *** ayoung has joined #openstack-keystone | 13:49 | |
| *** zhiyan_ is now known as zhiyan | 13:55 | |
| *** joesavak has joined #openstack-keystone | 13:57 | |
| *** gokrokve has joined #openstack-keystone | 14:01 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Add CRUD operations for Federated Protocols. https://review.openstack.org/83829 | 14:12 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Add CRUD operations for Federated Protocols. https://review.openstack.org/83829 | 14:14 |
| *** thedodd has joined #openstack-keystone | 14:15 | |
| *** wchrisj has joined #openstack-keystone | 14:16 | |
| *** wchrisj has left #openstack-keystone | 14:16 | |
| *** richm has joined #openstack-keystone | 14:20 | |
| *** deani has quit IRC | 14:30 | |
| *** nkinder has joined #openstack-keystone | 14:34 | |
| lbragstad | marekd: mind if I add this back in? https://github.com/openstack/keystone/commit/483593461b7082c3e4d97b5771e6aea9b6f12ace | 14:37 |
| openstackgerrit | Matthieu Huin proposed a change to openstack/keystone: More random values for oAuth1 verifier https://review.openstack.org/89612 | 14:38 |
| marekd | lbragstad: well, if you use it - go ahead! | 14:38 |
| *** marcoemorais has joined #openstack-keystone | 14:39 | |
| marekd | lbragstad: I don't know at the moment whether those methods will be removed from V3Controller or not. I did see your discussion and arguments that you have some patches using those methods but I don't know what was eventually the verdict.. | 14:39 |
| lbragstad | marekd: right, me either. | 14:39 |
| marekd | BTW, USA/Canada have some holiday today? | 14:40 |
| lbragstad | marekd: I started working on the api validation stuff and then stumbled across the json schema impl too... so we only really need one implementation | 14:40 |
| marekd | lbragstad: isn't something we already discussed? With you and bknudson I think? | 14:41 |
| lbragstad | marekd: yes, I think we did' | 14:41 |
| lbragstad | did* | 14:41 |
| marekd | lbragstad: I think it was you who pointed out nova has good validation implementation based on top of jsonschema. | 14:42 |
| bknudson | it was earth day a couple days ago | 14:42 |
| *** marcoemorais has quit IRC | 14:43 | |
| marekd | bknudson: and because of the 'earth day' everybody is on holiday today? :P | 14:43 |
| lbragstad | marekd: yeah, I think I'll go back to the json schema impl | 14:44 |
| marekd | lbragstad: now i am puzzled. I thought that was your ultimate goal.. | 14:44 |
| lbragstad | yeah it was, but I got a couple reviews on https://review.openstack.org/#/c/76444/6 so I thought about addressing those | 14:45 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Allow 'description' in V3 Regions to be optional https://review.openstack.org/78658 | 14:48 |
| openstackgerrit | A change was merged to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/88503 | 14:51 |
| *** daneyon has joined #openstack-keystone | 14:53 | |
| dstanek | i'm looking that the exception hierarchy now; does MalformedEndpoint really deserve to be a SecurityError? | 14:55 |
| *** bach has joined #openstack-keystone | 14:58 | |
| *** dims has quit IRC | 15:03 | |
| bknudson | dstanek: what causes MalformedEndpoint to be returned? | 15:03 |
| bknudson | if there's no reason that the user should have to know what the cause was then I think it should be a SecurityError | 15:03 |
| bknudson | or some new type of error that indicates to not tell the user what the prob was | 15:03 |
| dstanek | bknudson: building a catalog response | 15:04 |
| *** chandan_kumar has joined #openstack-keystone | 15:04 | |
| bknudson | I would think that only a 400-range request wasn't a security error | 15:04 |
| dstanek | so i may need to do some surgery :-( format_url probably shouldn't raise HTTP exceptions | 15:04 |
| bknudson | dstanek: I don't think that the user typically needs to know why keystone couldn't build a catalog. So SecurityError seems to make sense unless there was a better one | 15:05 |
| *** dims has joined #openstack-keystone | 15:05 | |
| dstanek | right now i want to use format_url to validate incoming urls to that we can prevent bad things from happening; so i'll proabably just change the exception it raises to be non-HTTP and have the controller catch it and raise a HTTP one | 15:06 |
| *** bach has quit IRC | 15:06 | |
| dstanek | that way during validation i can catch an exception and get a useful message | 15:07 |
| jaosorior | Hi, I've noticed that using the SQL backend, when querying for users, when a certain user has no email set up, it prints the email as null. while this is not the case if the user has no description. Is there a specific reason this is made this way? | 15:08 |
| jaosorior | I was thinking of filtering the null values when the data from the users is gotten | 15:10 |
| Rob_d | jaosorior: you can describe the table - the default value for email is probably null and no value for description | 15:10 |
| jaosorior | yeah, that is indeed the value of the table, I was just wondering if this is the desired output API-wise. That it would actually print the key with a null value, or not print the key at all | 15:12 |
| *** david-lyle has joined #openstack-keystone | 15:16 | |
| *** chandan_kumar has quit IRC | 15:16 | |
| dstanek | jaosorior: where is the email actually stored? | 15:16 |
| boris-42 | bknudson hi | 15:17 |
| boris-42 | bknudson btw http://junodesignsummit.sched.org/event/82bbddb45555dc39fa6029ee56e7dc4e#.U1kqn-aSzpw | 15:17 |
| jaosorior | would it be better to return (api-wise) this -> http://paste.openstack.org/show/76956/ or this -> http://paste.openstack.org/show/76957/ | 15:17 |
| jaosorior | dstanek, at the moment I'm fixing the sql issue where the email is not actually stored, yet, I stumbled upon that, for example, in ldap, the email is stored, but if it's null, it will simply not be displayed. So I'm trying to figure out how to make it consistent. | 15:18 |
| jaosorior | any suggestions? | 15:20 |
| bknudson | boris-42: I'll be there | 15:21 |
| boris-42 | bknudson and I have session for openstack cross service/project profielr | 15:21 |
| boris-42 | bknudson http://junodesignsummit.sched.org/event/82bbddb45555dc39fa6029ee56e7dc4e#.U1kqn-aSzpw | 15:21 |
| boris-42 | bknudson without it it's actually hard to detect where is the issue in code | 15:22 |
| bknudson | boris-42: do you need some kind of request ID | 15:22 |
| bknudson | ? | 15:22 |
| *** bach has joined #openstack-keystone | 15:23 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Ignore broken endpoints in get_catalog https://review.openstack.org/81528 | 15:23 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Ignore broken endpoints in get_v3_catalog https://review.openstack.org/81527 | 15:23 |
| boris-42 | bknudson actually I know there is a work in cross service request ID | 15:23 |
| boris-42 | bknudson but this things works in a bit different way | 15:23 |
| boris-42 | bknudson it has own ids | 15:23 |
| dolphm | dstanek: what makes you prefer the underlined links? http://i.imgur.com/KYhyLRP.png | 15:25 |
| dolphm | s/links/urls/ anyway | 15:25 |
| dstanek | dolphm: nothing really - i could live with either | 15:26 |
| dolphm | dstanek: i find them super noisy, visually speaking | 15:26 |
| dstanek | underlines just make it feel clickable, but don't really provide much other value | 15:26 |
| dstanek | dolphm: i wouldn't mind not having them | 15:27 |
| bknudson | my konsole adds the underline when you move the cursor over the link | 15:27 |
| dolphm | dstanek: are they actually clickable in whatever terminal you use? | 15:27 |
| *** bach has quit IRC | 15:27 | |
| dstanek | dolphm: yes, if i command-click links in iterm2 it will open in the browser | 15:28 |
| dolphm | in OS X, i have to "right" click, and it recognizes it's a link, highlights the whole thing, and gives me an option to open it (but just clicking on it doesn't do anything special) | 15:28 |
| *** bach has joined #openstack-keystone | 15:29 | |
| dstanek | dolphm: what happens if you hold down command and click? | 15:30 |
| dolphm | dstanek: nothing at all | 15:31 |
| dolphm | dstanek: option click == "right" click == two finger tap, though | 15:31 |
| dstanek | odd, maybe i configured something to do that along the way | 15:31 |
| Rob_d | well I can't install on Ubuntu - giving up | 15:32 |
| dstanek | Rob_d: can't install keystone? | 15:32 |
| *** bach has quit IRC | 15:33 | |
| Rob_d | sorry wrong channel - I'm trying Tuskar | 15:33 |
| *** bach has joined #openstack-keystone | 15:36 | |
| jaosorior | dstanek or dolphm, do you guys have any suggestions or insights on what I said above? | 15:40 |
| dolphm | jaosorior: aren't emails stored into 'extra'? | 15:40 |
| dolphm | jaosorior: in sql, anyway | 15:40 |
| dstanek | jaosorior: i think you are putting the email in with a None value and that's why it comes back null? | 15:40 |
| dstanek | dolphm: yes, i don't believe that we have an email column in sql | 15:41 |
| jaosorior | why is this the case? wouldn't it be better to have a column for email? | 15:42 |
| dolphm | jaosorior: what would keystone use email addresses for? | 15:42 |
| jaosorior | well, that is a good point, yet, it seems to be the case that it's added in ldap | 15:42 |
| jaosorior | the bug that I'm trying to address is this one: https://bugs.launchpad.net/keystone/+bug/1306835 | 15:43 |
| uvirtbot | Launchpad bug 1306835 in keystone "V3 list users filter by email address throws exception" [Medium,In progress] | 15:43 |
| jaosorior | I could of course try to get it from "extra" if needed | 15:43 |
| dolphm | jaosorior: it's just not a first class attribute today because openstack doesn't have a hard use case for them. i suspect that first class support for email addresses will open a very large can of worms (validation, authentication by email, etc) | 15:44 |
| openstackgerrit | Marek Denis proposed a change to openstack/identity-api: Add ``user`` object to the mapping rules examples. https://review.openstack.org/90121 | 15:44 |
| jaosorior | Alright, I'll use the "extra" attributes then | 15:45 |
| dstanek | dolphm: i'm going to drop that ssh pull request. i've started using the config file and that works well enough | 15:46 |
| dolphm | dstanek: fair enough | 15:46 |
| *** browne has joined #openstack-keystone | 15:48 | |
| dolphm | jaosorior: i'm not really sure what the best way to solve that bug would be. we shouldn't be raising an exception, obviously, but i'd hesitate to say that any special support for 'email' is the correct solution either (i.e. we could make email a first class attribute in the API, etc, and then i could file the same bug for "maiden_name", for example) | 15:48 |
| *** marekd is now known as marekd|away | 15:48 | |
| dolphm | jaosorior: i think the exception avoided before anything else? | 15:49 |
| jaosorior | Well, email IS an attribute that's specified as queriable | 15:50 |
| jaosorior | In the documentation | 15:50 |
| dstanek | dolphm: what is this doing? http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/controllers.py#n217 | 15:51 |
| dstanek | looks like we anticipate email being firt class? | 15:51 |
| dolphm | dstanek: filterprotected? | 15:51 |
| dolphm | dstanek: oh that's weird... | 15:51 |
| jaosorior | Indeed | 15:52 |
| jaosorior | If it really should not be a first class attribute I could try to fix that also | 15:53 |
| dolphm | dstanek: i can't find any meaningful tests using 'email', even for ldap (the one ldap test asserts that email can be ignored) | 15:57 |
| dolphm | most of the references to 'email' in tests are basically just asserting that arbitrary attributes can be shuffled around | 15:58 |
| dolphm | jaosorior: dstanek: is filterprotected() what's mistakenly trying to access User.email ? | 15:58 |
| *** ericn has joined #openstack-keystone | 15:58 | |
| dolphm | jaosorior: if so, removing email from that list is probably the fix! ^ | 15:59 |
| jaosorior | Fair enough, sounds like a plan then | 15:59 |
| jaosorior | By the way, had anybody gotten the rest suite to work on arch Linux? | 16:01 |
| jaosorior | I've been working on ubuntu but it would also be cool to be able to work on my arch machine | 16:02 |
| *** dims has quit IRC | 16:03 | |
| *** leseb has joined #openstack-keystone | 16:04 | |
| *** dims has joined #openstack-keystone | 16:06 | |
| *** bvandenh has quit IRC | 16:14 | |
| dstanek | dolphm: i don't think removing it would fix it - i think it's the fact that it's being used as a filter | 16:17 |
| *** marcoemorais has joined #openstack-keystone | 16:17 | |
| *** dims has quit IRC | 16:17 | |
| *** dims has joined #openstack-keystone | 16:17 | |
| dolphm | dstanek: but if it's not in that list, i suspect we'd just ignore it as a query string right? | 16:18 |
| dolphm | jaosorior: i'm sure you'd be able to, if you can find all the package deps that you'd need (xml and openssl, stuff, etc) | 16:19 |
| dolphm | jaosorior: you can probably work out what you need from the ubuntu & fedora deps http://docs.openstack.org/developer/keystone/setup.html#installing-dependencies | 16:20 |
| dstanek | dolphm: yeah, it looks like that would be the case - filterprotected is doing more than i thought it would | 16:22 |
| dolphm | jaosorior: ^ | 16:22 |
| ayoung | dstanek, you made thie right call on https://review.openstack.org/#/c/87068/ | 16:23 |
| jaosorior | Should filterprotected be refractors then? | 16:23 |
| ayoung | I am pretty sure that patch would cause a CVE | 16:23 |
| ayoung | jaosorior, dolphm there is a pretty strong argument for using EMail as the login field, and then using that to figure out what domain/IdP a user is in | 16:24 |
| dstanek | ayoung: i'm glad i didn't push it forward then | 16:24 |
| ayoung | dstanek, here's the scenario | 16:24 |
| *** diegows has quit IRC | 16:24 | |
| ayoung | I'm an admin at , say a bank, and I set up an OpenStack impl that talks to corporate LDAP | 16:24 |
| ayoung | I tell people: test this out for me, please | 16:24 |
| ayoung | and I enable this option, then start harvesting passwords. | 16:25 |
| *** chandan_kumar has joined #openstack-keystone | 16:25 | |
| ayoung | yes...if you have full admin rights to the machine, you could do that with code changes already, but this would make it a config file change, and those are managed differently | 16:25 |
| ayoung | for a locked down deployment, this would not fly | 16:25 |
| *** gyee has joined #openstack-keystone | 16:26 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/89235 | 16:27 |
| richm | ayoung: it may be faster to just try it out the openldap debug flag rather than wait/fight for an answer on #openldap . . . | 16:28 |
| ayoung | richm, we did, and found it was dumping passwords in the clear | 16:28 |
| dolphm | ayoung: people already do that, they just use the 'name' attribute | 16:28 |
| ayoung | dolphm, on the email thing? yeah | 16:29 |
| dolphm | ayoung: yes | 16:29 |
| *** bvandenh has joined #openstack-keystone | 16:29 | |
| richm | ayoung: Then you'll have to file a ITS at openldap.org | 16:29 |
| ayoung | dolphm, so had an interesting discussion about this whole thing with my team on Tuesday. | 16:30 |
| dstanek | ayoung: wow, that would be pretty bad | 16:30 |
| ayoung | I'm still pretty strong against shadowing users in a table in Keystone from external IdPs. | 16:31 |
| dstanek | even if you were not trying to be malicious | 16:31 |
| ayoung | The question, then, is if we allow a range of options for deconflicting Ids | 16:31 |
| ayoung | dstanek, ++ | 16:31 |
| dstanek | ayoung: maybe rename the setting to 'ldap_debug_yes_i_know_passwords_will_be_logged_in_clear_text'? :-P | 16:32 |
| ayoung | dstanek, nope | 16:32 |
| ayoung | dstanek, you can't make it a config option | 16:32 |
| *** gokrokve_ has joined #openstack-keystone | 16:32 | |
| ayoung | confitg is managed seperately from code, and this opens up access to people that can make config changes | 16:33 |
| dstanek | nah, i was just kidding | 16:33 |
| ayoung | yeah, just wanted to be clear. If we could drop the simple_bind, then this would be OK | 16:33 |
| ayoung | Or if the simple_bind went by a different path. | 16:33 |
| ayoung | actually, that is probably the right solution: disable debugging for authentication | 16:34 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/89245 | 16:34 |
| ayoung | but even then, I would be worried that someone would enable it down the road | 16:34 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: no one uses macports https://review.openstack.org/90137 | 16:35 |
| *** gokrokve has quit IRC | 16:36 | |
| ayoung | dolphm, what if, for multi-domain support we disallowed loggin in using userid and only allowed usernames, but also allowed an explict email_address as an option? | 16:37 |
| ayoung | and then if we do user_id = sha256(uid, domain_name) we don't provide a way to map backwards? | 16:38 |
| ayoung | If people do need to map backwards, we also support userid = uid@@domainid | 16:39 |
| ayoung | select one or the other is a config option? | 16:39 |
| *** harlowja_away is now known as harlowja | 16:51 | |
| mfisch | ayoung: question on your concern on my review, is there a specific debug setting that will dump logs? | 16:52 |
| mfisch | ayoung: I ask because even when I have it set to -1, which should be ALL I dont see passwords | 16:52 |
| mfisch | ayoung: I can paste a log from when I have full debug enabled, but perhaps it's different depending on server? I'd think though that the underlying library wouldn't log passwords | 16:53 |
| *** bach has quit IRC | 16:54 | |
| ayoung | mfisch, I looked at the output from openldap debug, not Keystone itself | 16:54 |
| ayoung | mfisch, what do you get when an ordinary user logs in? | 16:54 |
| mfisch | ayoung: I just did a user-list after authenticating as my AD user, let me paste the output | 16:55 |
| ayoung | mfisch, just do a token-get | 16:55 |
| mfisch | ok | 16:55 |
| mfisch | give me a minute | 16:55 |
| ayoung | I want to focus it down to the authenticate call. The rest of the stuff happens as admin, which for anyone sane is done using anonymous and read only anyway | 16:56 |
| ayoung | ie !CERN who has been driving read/write LDAP | 16:57 |
| ayoung | mfisch, lets assume for a moment that it is doing the bad thing that I feared. There is a way around it. | 17:00 |
| mfisch | ayoung: PMd you the log | 17:00 |
| mfisch | ayoung: and go ahead | 17:00 |
| ayoung | The simple_bind is only used in the authenticate path. For authenticate, we can explicitly not allow LDAP debugging. | 17:00 |
| ayoung | PM? | 17:01 |
| ayoung | you mean emaiL? | 17:01 |
| ayoung | Ah..scrolled off my screen. got it | 17:01 |
| mfisch | ayoung: just a private message here on IRC, did it not come through? | 17:01 |
| mfisch | ok | 17:01 |
| mfisch | ayoung: as you can see it doesn't say much about the bind | 17:02 |
| mfisch | ayoung: my bind account isnt even called out, user or pass | 17:02 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Validates URL when creating/updating endpoints https://review.openstack.org/90149 | 17:02 |
| ayoung | mfisch, still looking | 17:03 |
| *** Rob_d has quit IRC | 17:03 | |
| *** zhiyan is now known as zhiyan_ | 17:03 | |
| *** thedodd has quit IRC | 17:04 | |
| *** thedodd has joined #openstack-keystone | 17:06 | |
| ayoung | mfisch, I don't know if that is conclusive | 17:06 |
| mfisch | ayoung: I suspect it depends on what the underlying library allows | 17:07 |
| mfisch | ayoung: which might depend on version even | 17:07 |
| ayoung | mfisch, what are you running on? | 17:07 |
| mfisch | ayoung: havana on top of Ubuntu | 17:07 |
| *** gokrokve_ has quit IRC | 17:08 | |
| ayoung | mfisch, you can see what it pulls in by doing this: | 17:09 |
| ayoung | ps -ef | grep keystone to find the pid | 17:10 |
| ayoung | then | 17:10 |
| ayoung | sudo cat /proc/22706/maps | grep ldap | 17:10 |
| ayoung | replace 22706 with your pid | 17:10 |
| ayoung | mfisch, I have a system, I'll try out with your patch. | 17:10 |
| mfisch | ayoung: I am heading out to lunch and to take my kid to school, I | 17:11 |
| mfisch | I'll get back with you in an hour or so | 17:11 |
| ayoung | mfisch, that is fine. I won't sit on this one if it proves to be safe | 17:11 |
| mfisch | ayoung: perfect, my new hire is all lined up with the doc change ready to go | 17:11 |
| *** morganfainberg_Z is now known as morganfainberg | 17:12 | |
| morganfainberg | dstanek, ping | 17:14 |
| morganfainberg | dstanek, re: https://review.openstack.org/#/c/89419/ i think i have a 2 line fix to solve this issue | 17:14 |
| dstanek | morganfainberg: git you push it to gerrit? | 17:17 |
| dstanek | s/git/did/ | 17:17 |
| morganfainberg | dstanek, making sure it works both ways (usedevelop=true/false) and i will | 17:17 |
| morganfainberg | dstanek, give me ... 10 minutes | 17:18 |
| morganfainberg | well, maybe it's 4 lines :P | 17:18 |
| morganfainberg | but it's a slice issue for sure | 17:18 |
| dstanek | cool, thought so | 17:18 |
| *** chandan_kumar has quit IRC | 17:19 | |
| *** chandan_kumar has joined #openstack-keystone | 17:19 | |
| morganfainberg | dolphm, i think everyone else is going to the gerrit spec-repo stuff (well most projects seem to be headed that way). you want to revisit post summit? | 17:21 |
| morganfainberg | dolphm, for keystone | 17:21 |
| *** diegows has joined #openstack-keystone | 17:23 | |
| ericn | I am a noob to Keystone, looking for suggestions on how to begin to contribute here. | 17:25 |
| ericn | I have Keyston source running, and got tox to run as well as spec'd on Fedora 15, etc. | 17:26 |
| *** thedodd has quit IRC | 17:28 | |
| morganfainberg | ericn, Hi! Welcome :). You can take a look at the launchpad bug tracker https://bugs.launchpad.net/keystone if you're interested in tacking some of the bugs | 17:28 |
| morganfainberg | it's always good to see if any of the low-hanging-fruit tagged bugs looks like somehting to tackle | 17:29 |
| morganfainberg | https://bugs.launchpad.net/keystone/+bugs?field.tag=low-hanging-fruit | 17:29 |
| morganfainberg | those often can get you some insight into the workings of keystone. | 17:29 |
| morganfainberg | ericn, if you have questions on the bug, need direction we're pretty friendly around here and happy to help | 17:30 |
| morganfainberg | ericn, make sure you're all setup to contribute (including the CLA signing, etc) https://wiki.openstack.org/wiki/How_To_Contribute | 17:30 |
| ericn | Cool... I did look at the bugs, not much in the low hanging fruit area. | 17:30 |
| *** gyee has quit IRC | 17:31 | |
| ericn | Should I take the on ethat is confirmed? | 17:31 |
| morganfainberg | ericn, yeah we don't always tag as much there (some of the bugs are "low-ish hanging" compared to others but still fairly in depth) | 17:31 |
| morganfainberg | ericn, confirmed and triaged typically mean they aren't being actively worked on (see if it's assigned to someone and hit them up in IRC to see if they are working on it) | 17:32 |
| morganfainberg | low-hanging fruit may be a bad tag, you might have more luck looking at the other bugs. sorry about that. but in either case grab a bug. hit us up here if needed. | 17:33 |
| ericn | OK, there is exactly one non-documentation bug to work through, https://bugs.launchpad.net/keystone/+bug/1255321 | 17:33 |
| uvirtbot | Launchpad bug 1255321 in python-keystoneclient "v3 token requests result in 500 error when run in apache" [High,In progress] | 17:33 |
| morganfainberg | ericn, i also recommend reviewing active code reviews. https://review.openstack.org/#/q/status:open+project:openstack/keystone,n,z and https://review.openstack.org/#/q/status:open+project:openstack/python-keystoneclient,n,z | 17:34 |
| dstanek | ericn: yeah, code reviews will help get familiar with the code be seeing the changes people are making and the commentary from the reviewers | 17:35 |
| morganfainberg | ericn, you can get familiar with the code, the kinds of comments/feedback thats provided (helps understanding with the code standards we use) and finally http://git.openstack.org/cgit/openstack/keystone/tree/HACKING.rst a bit of a primer on stuff | 17:35 |
| ericn | I'll start there, | 17:35 |
| dstanek | ericn: and welcome | 17:35 |
| morganfainberg | dstanek, ++ :) | 17:35 |
| ericn | thanks! | 17:35 |
| morganfainberg | ericn, happy to have you on board! | 17:35 |
| morganfainberg | dstanek, sorry still chekcing my slice logic is sound posting very soon | 17:36 |
| dstanek | morganfainberg: np, i'm not in a rush | 17:36 |
| *** thedodd has joined #openstack-keystone | 17:37 | |
| ericn | Yeah, need to swim in the code a bit before doing too much. Will get back after some code reviews and primer. | 17:37 |
| *** bach has joined #openstack-keystone | 17:38 | |
| *** daneyon has quit IRC | 17:38 | |
| ayoung | ericn, what is your particular interest? | 17:39 |
| *** gokrokve has joined #openstack-keystone | 17:40 | |
| marekd|away | dolphm: https://bugs.launchpad.net/keystone/+bug/1312221 your point was that Keystone should let define rules without maping a user name or I am misunderstanding your comment? | 17:45 |
| uvirtbot | Launchpad bug 1312221 in keystone "Add user objects to mapping rules examples in OS-FEDERATION docs" [Undecided,Incomplete] | 17:45 |
| *** marekd|away is now known as marekd | 17:45 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Make the py33 Jenkins job happy https://review.openstack.org/83565 | 17:45 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: setUp must be called on a fixture's parent first https://review.openstack.org/84051 | 17:45 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fix cache configuration checks https://review.openstack.org/84052 | 17:45 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixed the size limit tests in Python 3 https://review.openstack.org/84053 | 17:45 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixed the policy tests in Python 3 https://review.openstack.org/84054 | 17:45 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: First real Python 3 tests https://review.openstack.org/83834 | 17:45 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds several more tests to the Python 3 test run https://review.openstack.org/84055 | 17:45 |
| dstanek | all that is now based on bknudson's oslo sync | 17:46 |
| bknudson | dstanek: the sync is broken due to a bug in the update tool.... I need to re-do it. | 17:46 |
| bknudson | it replaced oslotest with keystonetest | 17:47 |
| dstanek | really? my tests were still passing | 17:47 |
| *** diegows has quit IRC | 17:48 | |
| dstanek | interesting - looks like those replacements won't kill the tests | 17:48 |
| dstanek | bknudson: was sync fixed? | 17:48 |
| bknudson | it breaks the doc build | 17:48 |
| dstanek | err...update fixed? | 17:48 |
| bknudson | dstanek: https://review.openstack.org/#/c/89449/ | 17:48 |
| bknudson | dstanek: could just check that out and do the update again | 17:49 |
| *** marekd is now known as marekd|away | 17:51 | |
| dstanek | bknudson: i'll do that now | 17:53 |
| ericn | ayoung: I have done a lot of work around authn and tenancy.... at CA Technologies building out their internal platform | 17:55 |
| ayoung | ericn, glad to have you aboard. | 17:56 |
| morganfainberg | dstanek, bknudson, would you prefer an explicit .lstript('.') or assume that a path is pre-pended with . for a string replacement? | 17:56 |
| ayoung | what forms of authn are you focused on ? | 17:56 |
| morganfainberg | dstanek, bknudson, e.g. root.replace(os.sep, '.').lstrip('.') | 17:56 |
| morganfainberg | or skip the lstrip and do the substitution assuming a '.' is at the start? | 17:57 |
| ericn | SAML, OAuth, and SiteMinder SSO | 17:57 |
| morganfainberg | oooh more SAML, OAuth, and SSO experience :) | 17:57 |
| ayoung | yeah...so here's an interesting one for you | 17:57 |
| ericn | We included an authenticated tenant id in a customer header as well. | 17:57 |
| dstanek | morganfainberg: how are you doing the slice? i was anticipating it not leaving a / and the begining of root | 17:58 |
| ayoung | ericn, I'm looking in to how we auth to Horizon, and was wondering if we could replace that with Oauth | 17:58 |
| morganfainberg | dstanek, root[len(keystone_root):] | 17:58 |
| morganfainberg | dstanek, and i'm explicitly adding keystone back in with the stringsub (you did root + 'sql', i'm doing 'keystone%s.sql' % root | 17:58 |
| *** thedodd has quit IRC | 17:59 | |
| ayoung | it turns out there is a mod_auth_form, that we might be able to leverage from Apache HTTPD, and that could do the login to Keystone, and then get the token, so Horizon has somewhere to redierct the user to | 17:59 |
| *** henrynash has joined #openstack-keystone | 17:59 | |
| morganfainberg | dstanek, i don't like the way that looks. | 17:59 |
| morganfainberg | dstanek, i would prefer 'keystone.%s.sql' % root | 17:59 |
| ericn | Horizon is not equivalent to Oauth | 17:59 |
| dstanek | i like 'keystone.%s.sql' % root too | 18:00 |
| morganfainberg | dstanek, i can just .lstrip('.') in the replace part | 18:00 |
| morganfainberg | it works just fine | 18:00 |
| morganfainberg | it's an extra op, but meh. | 18:00 |
| morganfainberg | it's a one-time operation (the walk/import) | 18:01 |
| *** thedodd has joined #openstack-keystone | 18:01 | |
| ericn | That sounds similar to what we did with CA SiteMinder to integrate with OAuth. | 18:02 |
| *** andreaf has quit IRC | 18:02 | |
| ericn | Had a dedicated form on the proxy that was intended only as an API. | 18:03 |
| ericn | but not pretty. | 18:03 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Fix the "search for sql.py" files for db models https://review.openstack.org/90173 | 18:06 |
| morganfainberg | dstanek, ^ | 18:06 |
| ericn | Horizon (and SiteMinder) do not do persistent/revokable authn as needed for mobile and API-only clients, OAuth does | 18:06 |
| morganfainberg | dstanek, added some comments so there is no confusion as to what is intended | 18:07 |
| morganfainberg | dhellmann, https://review.openstack.org/#/c/90173 that should solve your packaging issue directly. I'm still in favor of stevedore, but i think it'll be more work/longer to get that through - i'd like this fixed asap | 18:07 |
| *** amcrn has joined #openstack-keystone | 18:09 | |
| *** praneshp has joined #openstack-keystone | 18:12 | |
| *** bach has quit IRC | 18:14 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Make the py33 Jenkins job happy https://review.openstack.org/83565 | 18:14 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: setUp must be called on a fixture's parent first https://review.openstack.org/84051 | 18:14 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fix cache configuration checks https://review.openstack.org/84052 | 18:14 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixed the size limit tests in Python 3 https://review.openstack.org/84053 | 18:14 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixed the policy tests in Python 3 https://review.openstack.org/84054 | 18:14 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: First real Python 3 tests https://review.openstack.org/83834 | 18:14 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds several more tests to the Python 3 test run https://review.openstack.org/84055 | 18:14 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Sync with oslo-incubator 74ae271 https://review.openstack.org/87980 | 18:14 |
| dstanek | morganfainberg: does that result in keystone..module.sql? | 18:18 |
| *** browne has quit IRC | 18:18 | |
| *** browne has joined #openstack-keystone | 18:19 | |
| *** browne has quit IRC | 18:19 | |
| *** browne has joined #openstack-keystone | 18:19 | |
| jaosorior | I had to go, but, dstanek, dolphm, ayoung, was there any resolution on the email thing? should I remove it then from the filterprotected? | 18:20 |
| morganfainberg | dstanek, without the lstrip | 18:20 |
| morganfainberg | dstanek, but with the lstrip no | 18:20 |
| dstanek | morganfainberg: ah, ok | 18:20 |
| dstanek | we talked about that, but for some reason i didn't see it | 18:20 |
| morganfainberg | lstrip isn't specifically needed, but it makes the substitution less ... "oops this broke" feeling | 18:21 |
| *** henrynash has quit IRC | 18:22 | |
| dstanek | morganfainberg: you could also 'root = root[len(...)+1:]' which is what i expected, but with the lstrip if should be just fine | 18:22 |
| morganfainberg | dstanek, i didn't like the +1 :P | 18:23 |
| morganfainberg | besides, this is more resilient, if someone somehowmanaged to avoid having the / on the front, this code would still work | 18:23 |
| dstanek | any thoughts on https://review.openstack.org/#/c/81659/ ? | 18:23 |
| morganfainberg | with the +1 you'd end up with keystone.ssignment.backends.sql | 18:24 |
| morganfainberg | dstanek, looking now | 18:24 |
| dstanek | morganfainberg: yeah, that is just trying to add test for existing functionality | 18:28 |
| morganfainberg | ok | 18:28 |
| morganfainberg | cool | 18:28 |
| morganfainberg | wasn't sure, we have the disabled callback now too | 18:29 |
| morganfainberg | if this is just on-the-wire refactoring, works for me, *continues review* | 18:29 |
| dstanek | i don't like how i'm looking at the log mesages, but that's because i needed a seam to refactor against | 18:29 |
| morganfainberg | dstanek, right, but it's something we can "fix" going forward. | 18:30 |
| morganfainberg | dstanek, if it gets us from here to there | 18:30 |
| morganfainberg | it's fine | 18:30 |
| morganfainberg | also yay for mock.Mock! | 18:30 |
| *** leseb has quit IRC | 18:30 | |
| *** praneshp_ has joined #openstack-keystone | 18:33 | |
| *** praneshp has quit IRC | 18:35 | |
| *** praneshp_ is now known as praneshp | 18:35 | |
| morganfainberg | dstanek, +2/+A | 18:36 |
| *** thedodd has quit IRC | 18:37 | |
| morganfainberg | bknudson, woo, more debug http://logs.openstack.org/13/90013/1/gate/gate-keystone-python27/affa294/console.html for that odd racy-lilke-condition on the revocation events | 18:38 |
| dstanek | morganfainberg: thx | 18:38 |
| dstanek | nkinder: you around? | 18:38 |
| bknudson | morganfainberg: yes, I looked at it... not sure if it's going to help debug the issue :( | 18:39 |
| morganfainberg | bknudson, yeah that's a beast to read the debug on | 18:39 |
| morganfainberg | we might need a lot more debugging :( | 18:39 |
| morganfainberg | as in, debug on every event added. | 18:40 |
| bknudson | morganfainberg: essentially should try to log the struct before and after | 18:40 |
| morganfainberg | bknudson, yeah. | 18:40 |
| bknudson | we know where the prob is. | 18:40 |
| *** thedodd has joined #openstack-keystone | 18:40 | |
| morganfainberg | bknudson, i'll get that logging into the test case. | 18:40 |
| bknudson | morganfainberg: it's not too bad to work on it with the debugger, can just paste the struct in there to overwrite the current one | 18:40 |
| nkinder | dstanek: yup | 18:40 |
| morganfainberg | bknudson, cool. | 18:40 |
| morganfainberg | bknudson, yeah debugger will help | 18:41 |
| bknudson | unfortunately still don't know what the struct looked like before the new value was added | 18:41 |
| bknudson | I think we're trying to see if there's a value being added with the same timestamp | 18:41 |
| morganfainberg | bknudson, yeah but we're also using a UUID. | 18:41 |
| dstanek | nkinder: i'm looking at https://review.openstack.org/#/c/88517/2/keystone/assignment/backends/ldap.py and noticed your comment about AD at the very bottom of that page | 18:41 |
| bknudson | ... which shouldn't be possible unless your machine is the fastest on the planet | 18:41 |
| morganfainberg | bknudson, falling between CPU ticks | 18:41 |
| morganfainberg | bknudson, i _dont_ think our CI boxes are that fast | 18:42 |
| morganfainberg | just a hunch :P | 18:42 |
| dstanek | nkinder: is case only an issue for that one specific case or is it an issue for the other places that use self.use_dumb_member | 18:42 |
| morganfainberg | bknudson, would including the "old" struct in that message help you? | 18:42 |
| morganfainberg | bknudson, or just a log of each? | 18:42 |
| bknudson | morganfainberg: yes, the old struct, the input, the new struct | 18:43 |
| bknudson | that should be everything we need. | 18:43 |
| morganfainberg | bknudson, cool i'll extend the error message when mismatch occurs to include all three | 18:43 |
| morganfainberg | so we don't explode logs when it succeeds | 18:43 |
| bknudson | morganfainberg: you'll have to make a deep copy of the dict or something. | 18:43 |
| morganfainberg | bknudson, yep | 18:44 |
| morganfainberg | bknudson, that was my plan | 18:44 |
| morganfainberg | i really wish i could dupe this bug locally | 18:44 |
| morganfainberg | would be _so_ much easier | 18:44 |
| *** doddstack has joined #openstack-keystone | 18:46 | |
| ayoung | mfisch, OK, so I think the passwrod thing was due to the CLI using different options to debug BER data, and that option is not set by your code | 18:47 |
| nkinder | dstanek: sorry, was just wrapping up a meeting | 18:47 |
| ayoung | nkinder, can you take a look at a sensitive patch | 18:47 |
| nkinder | ...and now the fire alarm is going off here at work | 18:48 |
| morganfainberg | bknudson, could the revoke_by_user be causing the issue? | 18:48 |
| ayoung | https://review.openstack.org/#/c/87068/ | 18:48 |
| nkinder | ayoung, dstanek: I'll get back to you both in a bit | 18:48 |
| morganfainberg | bknudson, i don't see how... | 18:48 |
| mfisch | ayoung: can you explain that a bit more? BER data? | 18:48 |
| ayoung | nkinder, ignore the firealarm. It is just cfu's lunch | 18:48 |
| ayoung | mfisch, it is just another form of Debugging. | 18:48 |
| *** bach has joined #openstack-keystone | 18:48 | |
| ayoung | Basic encoding Rules? | 18:48 |
| *** thedodd has quit IRC | 18:49 | |
| ayoung | mfisch, try running ldapsearch with debugging on.... | 18:49 |
| ayoung | user the -d 3 option | 18:49 |
| mfisch | ayoung: k | 18:49 |
| mfisch | ayoung: and thar be my password | 18:50 |
| ayoung | :) | 18:50 |
| ayoung | mfisch, but (and I can't take credit for knowing any of this, I'm just the conduit) | 18:50 |
| ayoung | that is set by a diferent option, one not accessable to the python LDAP code | 18:51 |
| mfisch | thats good | 18:51 |
| ayoung | mfisch, I kindof want nkinder to look at it, as he's much more LDAP savvy than I am, and then I'll +2 if he say OK | 18:51 |
| ayoung | but he is on fire right now | 18:52 |
| *** chandan_kumar has quit IRC | 18:52 | |
| mfisch | ayoung: absolutely, there's no hurry from my end, we have until October, I just wanted some eyes on it so thanks | 18:52 |
| bknudson | morganfainberg: I looked over the code once and I couldn't figure out hot it could fail other than the same timestamp. | 18:54 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Expand debugging https://review.openstack.org/90195 | 18:55 |
| morganfainberg | bknudson, i changed the identifiers to be a little easier to pickout. | 18:56 |
| morganfainberg | bknudson, but just added a copy.deepcopy and added it to the message on a mismatch | 18:56 |
| morganfainberg | dstanek, ayoung, https://review.openstack.org/#/c/90195/ could use a pair of eyes so we can get this icky hard-to-find test bug smashed | 18:57 |
| ayoung | morganfainberg, will do... | 19:02 |
| *** kun_huang has quit IRC | 19:02 | |
| ayoung | morganfainberg, what is the bug? | 19:03 |
| *** serverascode has quit IRC | 19:11 | |
| *** dims has quit IRC | 19:11 | |
| *** serverascode has joined #openstack-keystone | 19:13 | |
| *** chandan_kumar has joined #openstack-keystone | 19:15 | |
| *** marcoemorais has quit IRC | 19:17 | |
| *** bvandenh has quit IRC | 19:21 | |
| *** diegows has joined #openstack-keystone | 19:23 | |
| *** chandan_kumar has quit IRC | 19:23 | |
| *** david-lyle_ has joined #openstack-keystone | 19:26 | |
| *** KurtMartin has joined #openstack-keystone | 19:30 | |
| *** kmartin has quit IRC | 19:33 | |
| *** dims has joined #openstack-keystone | 19:33 | |
| *** marcoemorais has joined #openstack-keystone | 19:36 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Make the py33 Jenkins job happy https://review.openstack.org/83565 | 19:43 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: setUp must be called on a fixture's parent first https://review.openstack.org/84051 | 19:43 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fix cache configuration checks https://review.openstack.org/84052 | 19:43 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixed the size limit tests in Python 3 https://review.openstack.org/84053 | 19:43 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixed the policy tests in Python 3 https://review.openstack.org/84054 | 19:43 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: First real Python 3 tests https://review.openstack.org/83834 | 19:43 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds several more tests to the Python 3 test run https://review.openstack.org/84055 | 19:43 |
| openstackgerrit | Christina Darretta proposed a change to openstack/keystone: Removed duplication with list_user_ids_for_project https://review.openstack.org/88621 | 19:45 |
| bknudson | ayoung: https://bugs.launchpad.net/keystone/+bug/1300581 | 19:46 |
| uvirtbot | Launchpad bug 1300581 in keystone "test_revoke.RevokeTreeTests.test_cleanup fails" [Critical,Triaged] | 19:46 |
| morganfainberg | ayoung, ah that, should add related-bug then | 19:47 |
| bknudson | morganfainberg: try a few rechecks before merging it | 19:47 |
| morganfainberg | bknudson, sounds good | 19:47 |
| morganfainberg | oh.. haha hadn't passed yet *doh* | 19:48 |
| bknudson | ya, might as well get a result | 19:48 |
| morganfainberg | recheck if it hasn't passed yet does nothing iirc | 19:48 |
| bknudson | although maybe the py26/27 finished already? | 19:48 |
| morganfainberg | it did and success | 19:48 |
| bknudson | hopefully the deepcopy won't slow it down so it never happens | 19:48 |
| morganfainberg | no error yet | 19:49 |
| morganfainberg | bknudson, seriously hope it's not falling between ticks issue | 19:51 |
| morganfainberg | bknudson, i'd rather something we can actually fix (short of a sleep(0) or similar) | 19:51 |
| *** marekd|away is now known as marekd | 19:52 | |
| ayoung | self._assertEventsMatchIteration(i + 1) | 19:53 |
| ayoung | that should not be getting run from cleanup | 19:53 |
| ayoung | that is a sign of a failing test | 19:53 |
| morganfainberg | ayoung, no the bug says cleanup wasn't occuring therefoere that was failing | 19:53 |
| morganfainberg | should fix the bug, because that isn't the case. we are expecting more entries than there are (3 != 2) | 19:54 |
| morganfainberg | ayoung, also test_cleanup was the test naem. | 19:54 |
| ayoung | hmmm | 19:54 |
| morganfainberg | not something run from addCleanup | 19:54 |
| *** david-lyle_ has quit IRC | 19:56 | |
| ayoung | morganfainberg, ok, my guess is that it is bleedover from the prior test | 19:57 |
| morganfainberg | ayoung, that we're missing a event | 19:59 |
| morganfainberg | we're expecting 3 at that point and only 2 have been added | 19:59 |
| morganfainberg | not the inverse | 19:59 |
| ayoung | morganfainberg, other way round, I'm guesssing | 19:59 |
| morganfainberg | nope, 3 is our expected count | 19:59 |
| morganfainberg | we have 2 | 19:59 |
| morganfainberg | assertEqual(expected, actual) | 20:01 |
| ayoung | yeah... it was from the previous iteration. 'access_token_id=*' should have 3 events under it, but only has two | 20:01 |
| morganfainberg | ok so sure, why did one fall out... and why does it occur very intermittantly | 20:02 |
| ayoung | becasue two of them hae the same expires-at time | 20:02 |
| ayoung | its time related | 20:02 |
| morganfainberg | ayoung, so we're falling between cpu ticks? | 20:02 |
| ayoung | yeah. next levle down the tree is 'expires_at=*' | 20:02 |
| morganfainberg | ayoung, i didn't think our CI systems would be that ... speedy | 20:03 |
| ayoung | _future_time() | 20:04 |
| morganfainberg | right. that calls utcnow() | 20:04 |
| morganfainberg | with a timedelta | 20:04 |
| ayoung | yep.... | 20:04 |
| morganfainberg | are datetime objects not microsecond aware? | 20:05 |
| ayoung | morganfainberg, OK...I think I have better logic | 20:05 |
| morganfainberg | sure | 20:05 |
| morganfainberg | i mean we could use a rand() :P | 20:05 |
| ayoung | morganfainberg, outside the loop, call: ft= _future_time() | 20:05 |
| ayoung | then inside the loop expirey = ft+i | 20:06 |
| morganfainberg | ayoung, hm oh i see just make the loop do a timedelta as well | 20:06 |
| morganfainberg | surer | 20:06 |
| morganfainberg | sure* | 20:06 |
| ayoung | that ensures they are distinct. | 20:06 |
| ayoung | ok...lemme post that | 20:06 |
| *** harlowja is now known as harlowja_away | 20:06 | |
| *** marcoemorais has quit IRC | 20:06 | |
| morganfainberg | if legitimately that is the issue i'll respin this patch to fix it. | 20:07 |
| ayoung | Nah, lemme get credit for it | 20:07 |
| morganfainberg | lol ok works for me | 20:07 |
| ayoung | I'll use your change id | 20:07 |
| morganfainberg | make sure you --reset-author if you want credit | 20:07 |
| morganfainberg | :) | 20:07 |
| *** derek_c has joined #openstack-keystone | 20:08 | |
| morganfainberg | ayoung, dstanek already approved it :P | 20:09 |
| *** stevemar has joined #openstack-keystone | 20:09 | |
| bknudson | while True: print datetime.datetime.utcnow() | 20:09 |
| bknudson | I get a different timestamp every time. | 20:09 |
| *** marcoemorais has joined #openstack-keystone | 20:09 | |
| morganfainberg | bknudson, same | 20:10 |
| morganfainberg | sometimes as little as 4 microseconds difference | 20:10 |
| ayoung | bknudson, if two timestamps are the same it would show this problem. The logic in the test should be changed anyway | 20:10 |
| morganfainberg | but.. still different | 20:10 |
| ayoung | it might get rounded | 20:10 |
| morganfainberg | hm. | 20:10 |
| morganfainberg | wonder if this might be an artifact of running in a VM | 20:13 |
| morganfainberg | the VM doesn't tick increment as reliably as the hardware would | 20:14 |
| morganfainberg | same net solution | 20:14 |
| morganfainberg | make the future_time distinct | 20:14 |
| ayoung | morganfainberg, ++ | 20:14 |
| nkinder | ayoung: checking that review now... | 20:14 |
| morganfainberg | i guess treating a not-even-close-to-RTC the same as something that is a-lot-closer-to-RTC-than-the-VM-timing results in this | 20:15 |
| bknudson | is it showing a problem in the code? could we get 2 events that close together in time? | 20:17 |
| *** topol has quit IRC | 20:18 | |
| bknudson | or are they actually the same event so it's working as designed? | 20:18 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Make test_revoke expiry times distinct https://review.openstack.org/90224 | 20:18 |
| ayoung | bknudson, no, this is a deliberate test to show that we get the right number of revocation event entrys in the tree. It assumes that the expires at times are going to be distinct, which is why the check was failing | 20:18 |
| morganfainberg | bknudson, it would revoke all tokens with a distinct expiry time | 20:18 |
| ayoung | if I made the expires_at value unique, then I would expect that chacke to be | 20:19 |
| bknudson | oh, then the test should make sure the times are distinct. | 20:19 |
| bknudson | use _future_time + i | 20:19 |
| ayoung | self.assertEqual(1, len(self.tree.revoke_map .... | 20:19 |
| morganfainberg | bknudson, ++ yep. | 20:19 |
| ayoung | see ^^ review | 20:19 |
| morganfainberg | i'm going to block the expanded debugging review. | 20:20 |
| morganfainberg | this change should solve it. we'll bring back expanded debugging if needed. | 20:20 |
| ayoung | ++ | 20:20 |
| morganfainberg | ok tossed a -2 on my review. hope your fix is what we need (it should be) | 20:21 |
| nkinder | ayoung: I do think that will result in logged passwords | 20:22 |
| nkinder | ...if you set the level high enough | 20:22 |
| ayoung | nkinder, does not look like it on my system, nor on mfisch es | 20:22 |
| ayoung | nkinder, I have it set to 0xffff | 20:23 |
| nkinder | ok, it depends on what libldap logs (checking) | 20:23 |
| mfisch | I have mine at -1 | 20:23 |
| mfisch | which is the highest in theory | 20:23 |
| ayoung | mfisch, assume python does not try to be smart about -1 | 20:23 |
| ayoung | but that is what DEBUG_ANY maps to in the C header file | 20:23 |
| mfisch | 4095 is my normal level which is fairly high | 20:24 |
| mfisch | 255 is a good enough level for most stuff | 20:24 |
| ayoung | mfisch, question here is not what is good enough, the question is what happens when you need to set the amps to 11. | 20:25 |
| mfisch | ayoung: agree | 20:25 |
| mfisch | where -1 == 11 I think | 20:25 |
| mfisch | I could never figure out for sure though whether those values were standard, is the underlying C library the same for everyone? | 20:26 |
| nkinder | mfisch, ayoung: it looks lik ethe majority of debug logging for bind operations is simply function tracing. Do you see things like "ldap_sasl_bind_s"? | 20:26 |
| ayoung | yeah, I see a sasl_bind, but no params | 20:27 |
| mfisch | yep just that text only pretty much for bind | 20:27 |
| nkinder | yeah, it does log some other stuff in certain cases (mostly SASL binds) | 20:27 |
| nkinder | ldap_sasl_interactive_bind: user selected: %s\n | 20:27 |
| nkinder | but nothing that is a security issue that I can see | 20:27 |
| *** bknudson has quit IRC | 20:28 | |
| nkinder | mfisch: why not add a test that sets logging as high as it goes, does a bind, then checks the log for the password? | 20:29 |
| mfisch | nkinder: for the fake ldap backend? is that useful? | 20:30 |
| ayoung | nope. fakeldap doesn' | 20:30 |
| ayoung | t go through the ldap library | 20:30 |
| mfisch | right | 20:30 |
| mfisch | there's a real ldap test set in there | 20:30 |
| mfisch | IIRC | 20:31 |
| ayoung | mfisch, live_ldap. And bascially that is what we are doing by hand here...I'm just not certain it would provide any real insurance | 20:34 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Make test_revoke expiry times distinct https://review.openstack.org/90224 | 20:35 |
| ayoung | morganfainberg, fixed a type in the commit message. | 20:35 |
| ayoung | and I just saw another...damn I can't tpye | 20:36 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Initial implementation of validator https://review.openstack.org/86483 | 20:36 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on projects https://review.openstack.org/86484 | 20:36 |
| *** bknudson has joined #openstack-keystone | 20:37 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Make test_revoke expiry times distinct https://review.openstack.org/90224 | 20:38 |
| nkinder | ayoung, mfisch: live_ldap would ideally be in the gate. There is value in a test in case we ever get to the point where live ldap is gating. | 20:39 |
| mfisch | I'm nervous that even that test is not enough | 20:41 |
| mfisch | what if we do what ayoung said and dont log the bind | 20:41 |
| ayoung | mfisch, ++ | 20:42 |
| ayoung | write the test, too. | 20:42 |
| nkinder | mfisch: if we don't see anything that valuable from the debug out put of the bind anyway, then it should be fine to not set it for bind ops | 20:43 |
| nkinder | mfisch: we should just have our own log message to say that the bind is occurring instead | 20:44 |
| nkinder | mfisch: that way we're protected if libldap ever changed and started logging passwords | 20:44 |
| *** vhoward has left #openstack-keystone | 20:44 | |
| nkinder | dstanek: ok, back to your question about dumb_member | 20:44 |
| nkinder | dstanek: we only have to worry about any place where we compare a DN string against the dumb_member | 20:45 |
| mfisch | in my setup I have a service account which does the bind, but then I also use creds for my corporate user, I'm not sure where that password check occurs but we'd want to make sure that's not logged either | 20:45 |
| nkinder | dstanek: let me see if there are any spots other than the one you pointed out | 20:45 |
| nkinder | mfisch: it binds as the corporate user too | 20:46 |
| nkinder | mfisch: the comparison is in LDAP | 20:46 |
| nkinder | mfisch: the service account is used to lookup other information | 20:46 |
| nkinder | mfisch: so keystone just passes the user DN and password through to perform an LDAP bind | 20:47 |
| nkinder | dstanek: correction... it's only when we're comparing a string returned from the LDAP server against the dumb_member DN that we have in keystone.conf | 20:48 |
| *** derek_c has quit IRC | 20:48 | |
| openstackgerrit | Alan Pevec proposed a change to openstack/keystone: Refactor service readiness notification https://review.openstack.org/90079 | 20:49 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Initial implementation of validator https://review.openstack.org/86483 | 20:52 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on projects https://review.openstack.org/86484 | 20:52 |
| *** erecio has quit IRC | 20:55 | |
| nkinder | dstanek: I think you're right. It's needed in a few more spots (and tests should be added). | 20:55 |
| nkinder | dstanek: keystone/identity/backends/ldap.py:list_group_users() | 20:56 |
| nkinder | dstanek: keystone/assignment/backends/ldap.py:get_user_dns() | 20:56 |
| nkinder | keystone/assignment/backends/ldap.py:get_role_assignments() | 20:56 |
| nkinder | dstanek: it looks like just those 3 locations | 20:56 |
| *** harlowja_away is now known as harlowja | 21:01 | |
| *** bvandenh has joined #openstack-keystone | 21:05 | |
| *** marcoemorais has quit IRC | 21:05 | |
| bknudson | for some reason I thought that when a token was expired auth_token stored in the cache something that said it was expired | 21:06 |
| bknudson | _cache_store_invalid, ok found it | 21:08 |
| *** marcoemorais has joined #openstack-keystone | 21:09 | |
| *** derek_c has joined #openstack-keystone | 21:12 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: auth_token middleware hashes tokens with configurable algorithm https://review.openstack.org/80398 | 21:13 |
| morganfainberg | bknudson, didn't that one merge? i might be losing my mind. | 21:31 |
| bknudson | morganfainberg: merge conflict | 21:31 |
| morganfainberg | bknudson, ahhhh | 21:31 |
| bknudson | morganfainberg: it was +A but then conflicted with the merge to check the revocation list | 21:31 |
| morganfainberg | bknudson, ok well i'll re+2 that now. | 21:31 |
| bknudson | morganfainberg: I'm working on some updated tests now | 21:31 |
| morganfainberg | ah ok | 21:31 |
| bknudson | the coverage is not as good as I would like | 21:31 |
| *** jaosorior has quit IRC | 21:31 | |
| morganfainberg | well still +2 :) | 21:32 |
| morganfainberg | your "not as good as you'd like" is still damn good | 21:32 |
| bknudson | morganfainberg: also, review carefully because the conflict was significant | 21:32 |
| morganfainberg | oh was it? | 21:32 |
| morganfainberg | bknudson, it doesn't look too hairy | 21:33 |
| bknudson | morganfainberg: it was... the change is still essentially the same. | 21:33 |
| morganfainberg | ah ok | 21:33 |
| morganfainberg | bknudson, i'm looking at it, it looks good to me. i'll down it to a +1 since you're WIP | 21:34 |
| bknudson | morganfainberg: the new old code would "expires = confirm_token_not_expired(data)" even when it got the token from the cache... | 21:34 |
| bknudson | which seems unnecessary | 21:34 |
| bknudson | because _cache_get already checks expiration | 21:34 |
| morganfainberg | ah | 21:35 |
| morganfainberg | i see it. | 21:35 |
| bknudson | so this is why I say look carefully | 21:35 |
| morganfainberg | bknudson, would it make more sense to leverage the confirm_not_expired code path in the cache get? | 21:37 |
| morganfainberg | bknudson, instead of doing the expires logic independantly? | 21:37 |
| morganfainberg | orr... removing that code from the cache_get instead | 21:37 |
| bknudson | I think that code should be in cache_get... no reason to get an expired token | 21:38 |
| bknudson | although if we get an expired token I'm not sure if the cache should get updated?? | 21:38 |
| bknudson | I think this is separate from my patch | 21:38 |
| morganfainberg | bknudson, ++ works for me | 21:39 |
| morganfainberg | i'd argue that we should probably run it through the same code (checking expiration) in either case (whichever way) | 21:39 |
| morganfainberg | mostly so we only update one location if we change how we check expiration | 21:39 |
| bknudson | auth_token needs some refactoring | 21:39 |
| morganfainberg | bknudson, ++ | 21:40 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: auth_token middleware hashes tokens with configurable algorithm https://review.openstack.org/80398 | 21:41 |
| bknudson | I gotta get out of here... sounds like they're tearing down the building. | 21:42 |
| *** bknudson has quit IRC | 21:42 | |
| *** bvandenh has quit IRC | 21:54 | |
| *** dims has quit IRC | 21:56 | |
| *** david-lyle has quit IRC | 21:57 | |
| *** KurtMartin has quit IRC | 22:00 | |
| *** KurtMartin has joined #openstack-keystone | 22:00 | |
| *** marcoemorais has quit IRC | 22:06 | |
| *** amcrn has quit IRC | 22:08 | |
| *** marcoemorais has joined #openstack-keystone | 22:08 | |
| *** dims has joined #openstack-keystone | 22:08 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on projects https://review.openstack.org/86484 | 22:09 |
| *** bach has quit IRC | 22:10 | |
| *** marcoemorais has quit IRC | 22:12 | |
| *** marcoemorais has joined #openstack-keystone | 22:14 | |
| *** joesavak has quit IRC | 22:14 | |
| *** dstanek is now known as dstanek_zzz | 22:16 | |
| *** dstanek_zzz is now known as dstanek | 22:19 | |
| *** ayoung has quit IRC | 22:30 | |
| *** jaosorior has joined #openstack-keystone | 22:30 | |
| *** doddstack has quit IRC | 22:34 | |
| boris-42 | morganfainberg hi | 22:35 |
| morganfainberg | boris-42, hey! | 22:35 |
| morganfainberg | interesting graphs there | 22:35 |
| boris-42 | morganfainberg so we have first gates!! | 22:35 |
| morganfainberg | woohoo!!! | 22:36 |
| morganfainberg | boris-42, thats awesome. very happy to see that | 22:36 |
| boris-42 | http://logs.openstack.org/45/86945/19/check/check-rally-dsvm-rally/f53b058/ | 22:36 |
| boris-42 | morganfainberg so actually I would ask you permission to add this perfromance-check to keystone | 22:36 |
| morganfainberg | boris-42, as part of the check queue i assume. | 22:37 |
| boris-42 | morganfainberg yep it's just as a check non-voting stuff | 22:37 |
| boris-42 | morganfainberg actually take a look at glance https://review.openstack.org/#/c/89798/ | 22:37 |
| morganfainberg | boris-42, i'm totally on board with that | 22:37 |
| boris-42 | morganfainberg you will have file rally-scenarios/glance.yaml | 22:37 |
| boris-42 | keystone.yaml | 22:37 |
| boris-42 | * | 22:37 |
| boris-42 | morganfainberg inside it you may specify any rally benchmarks with any load | 22:38 |
| morganfainberg | right | 22:38 |
| boris-42 | morganfainberg for example that one that I run | 22:38 |
| boris-42 | morganfainberg this one http://pavlovic.me/rally/keystone-users.html | 22:39 |
| boris-42 | morganfainberg ^ it's quite big page =) | 22:39 |
| morganfainberg | yeah i've seen it before | 22:39 |
| boris-42 | morganfainberg I will optimize our graphs | 22:39 |
| boris-42 | morganfainberg to show such a big amount of iterations | 22:39 |
| morganfainberg | very cool. | 22:40 |
| morganfainberg | this will be awesome to have available | 22:40 |
| boris-42 | morganfainberg okay we will add then infra + keystone patch | 22:40 |
| boris-42 | morganfainberg tomorrow | 22:40 |
| morganfainberg | sounds good | 22:40 |
| boris-42 | (it's quite late here lol, 2:40 a.m.) | 22:40 |
| boris-42 | morganfainberg Ok nice=) | 22:40 |
| morganfainberg | i'm very happy to see this before we start working on some of the performance stuff (eg ephemeral tokens) | 22:40 |
| boris-42 | morganfainberg yep yep | 22:40 |
| boris-42 | morganfainberg cause without it it's actually unclear what we are doing | 22:40 |
| morganfainberg | make sure to tag me on the review (ayoung and bknudson as well) | 22:41 |
| boris-42 | morganfainberg thanks | 22:41 |
| morganfainberg | yep. i want to see this kind of data for all the projects (well, incubated and integrated) | 22:41 |
| morganfainberg | i think some metric of performance should be required :) | 22:41 |
| morganfainberg | boris-42, have a good night. i'll look for the patchset to enable for keystone :) | 22:42 |
| boris-42 | morganfainberg so yep | 22:43 |
| boris-42 | morganfainberg that was one of major our goal | 22:43 |
| boris-42 | morganfainberg to simplify benchmarking and getting numbers=) | 22:43 |
| morganfainberg | very pleased to hear that. | 22:43 |
| boris-42 | morganfainberg actually it's quite easy to use | 22:43 |
| morganfainberg | yeah, it looks very straightforward | 22:44 |
| boris-42 | morganfainberg I hope to find some time to make a video=) | 22:44 |
| morganfainberg | great! | 22:44 |
| *** bknudson has joined #openstack-keystone | 22:44 | |
| morganfainberg | bknudson, i assume you escaped before they tore the building down? :P | 22:44 |
| bknudson | morganfainberg: yes, just in time. | 22:44 |
| bknudson | floor cleaner | 22:44 |
| morganfainberg | phew! | 22:44 |
| boris-42 | morganfainberg btw 2 probably interesting sessions for u | 22:44 |
| boris-42 | morganfainberg http://junodesignsummit.sched.org/event/54d25c4c4017ca09ee130821ac93f804#.U1mTyOaSzpx | 22:45 |
| boris-42 | morganfainberg ^ allows to find the source of issue | 22:45 |
| morganfainberg | boris-42, nice. | 22:45 |
| boris-42 | morganfainberg rally juno roadmap http://junodesignsummit.sched.org/event/82bbddb45555dc39fa6029ee56e7dc4e#.U1mUAOaSzpw | 22:45 |
| *** Chicago has joined #openstack-keystone | 22:45 | |
| *** Chicago has joined #openstack-keystone | 22:45 | |
| bknudson | make sure they don't overlap with keystone sessions | 22:45 |
| boris-42 | bknudson yep=) | 22:45 |
| morganfainberg | bknudson, ++ | 22:46 |
| morganfainberg | boris-42, once the schedule is a little less tentative i'll be setitng everything up | 22:46 |
| boris-42 | morganfainberg sure | 22:46 |
| morganfainberg | those two look like places i'll need to be | 22:46 |
| morganfainberg | if at all possible | 22:46 |
| boris-42 | morganfainberg sure sure I will try to ask somebody to make a video | 22:46 |
| morganfainberg | great! | 22:47 |
| *** nkinder has quit IRC | 22:47 | |
| *** jamielennox|away is now known as jamielennox | 22:56 | |
| *** amcrn has joined #openstack-keystone | 22:57 | |
| *** mberlin has quit IRC | 23:01 | |
| *** mberlin has joined #openstack-keystone | 23:02 | |
| *** nkinder has joined #openstack-keystone | 23:03 | |
| *** ayoung has joined #openstack-keystone | 23:13 | |
| dstanek | https://review.openstack.org/#/c/87980/ is passing now! | 23:16 |
| morganfainberg | dstanek, yay! | 23:19 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: auth_token middleware hashes tokens with configurable algorithm https://review.openstack.org/80398 | 23:19 |
| *** lbragstad has quit IRC | 23:20 | |
| *** gokrokve has quit IRC | 23:26 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Enhance tests for auth_token middleware https://review.openstack.org/90251 | 23:38 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: auth_token middleware hashes tokens with configurable algorithm https://review.openstack.org/80398 | 23:38 |
| bknudson | morganfainberg: split out the tests that weren't totally related to the mode change https://review.openstack.org/#/c/90251/ | 23:39 |
| morganfainberg | bknudson, ++ will make it easier to review | 23:39 |
| morganfainberg | bknudson, i looked over the code for the expired tokens (before last revision) and it looks sound | 23:40 |
| bknudson | dstanek: +2 on https://review.openstack.org/#/c/87980/ -- thanks! | 23:43 |
| *** gokrokve has joined #openstack-keystone | 23:46 | |
| dstanek | morganfainberg: i was just looking and https://review.openstack.org/#/c/84444/ too and wondering if the fix should really be alembic | 23:46 |
| dstanek | i'm worried that we'll always have to explicitly name our FK indexes instead of letting the framework do it | 23:48 |
| bknudson | morganfainberg: I'm fine with https://review.openstack.org/#/c/84444/. Tried it out myself and it looks fine to me. | 23:49 |
| bknudson | morganfainberg: you can +A it if it passes your test | 23:49 |
| bknudson | dstanek: at least once the tests go in the tests will catch that we need to name the index | 23:49 |
| dstanek | bknudson: doesn't that review mean we'll always have to explicitly name FK indexes? | 23:49 |
| bknudson | dstanek: I would assume so, for mysql | 23:50 |
| bknudson | until there's a fix to alembic | 23:50 |
| dstanek | it's just weird that we're doing this because of alembic and the only reason (right now) is that we are adding a test to compare model to migration | 23:51 |
| morganfainberg | bknudson, sounds good. i'll spin up a vm and test quickly | 23:51 |
| morganfainberg | bknudson, i am sure it's fine. | 23:51 |
| morganfainberg | bknudson, but these types of changes make me nervous | 23:51 |
| dstanek | morganfainberg: exactly | 23:52 |
| morganfainberg | dstanek, heck i was super nevous about the SQL collapse. | 23:53 |
| morganfainberg | dstanek, but it _seems_ to work fine (and has been tested a good deal now) | 23:53 |
| dstanek | morganfainberg, bknudson: are other projects explicitly nameing the FK indexes? | 23:54 |
| morganfainberg | dstanek, not sure. | 23:54 |
| bknudson | dstanek: how do you name the fk index explicitly? | 23:54 |
| bknudson | without renaming like this change does | 23:55 |
| morganfainberg | bknudson, don't think there is any way to do it | 23:55 |
| dstanek | bknudson: that's a good question - so when adding a new foreign key will the tests always fail because it won't match what is expected? | 23:56 |
| dstanek | hmmm...there was another review that i comment on about this, but there is no renaming here it's adding another index | 23:59 |
| morganfainberg | dstanek, i see a lot of value comparing the model to the schema in the migration tests | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
