| jamielennox | and there's on reason to hide v2/v3password, just for cli and such the default should be discover | 00:00 |
|---|---|---|
| jamielennox | no reason | 00:00 |
| gyee | from usability standpoint, the second one makes more sense | 00:00 |
| gyee | user should not have to specify which plugin to use | 00:00 |
| gyee | CLI users I mean | 00:00 |
| jamielennox | should not specify a version - i agree | 00:01 |
| jamielennox | i don't care if they have to speify --os-auth-plugin | 00:01 |
| jamielennox | because as a user entering information on the CLI you know exactly which auth plugin you want to use | 00:01 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Allow configuring for un-signed revocation list https://review.openstack.org/92727 | 00:01 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Regenerate sample config https://review.openstack.org/92730 | 00:01 |
| gyee | jamielennox, exactly, let me review those two patches | 00:02 |
| gyee | are there any patches I should be looking at? | 00:02 |
| jamielennox | gyee: the last one is still WIP | 00:02 |
| gyee | oh | 00:02 |
| jamielennox | i have some changes locally that i can push up if you like | 00:02 |
| *** sbfox has joined #openstack-keystone | 00:02 | |
| jamielennox | i'm just trying to figure out how it works | 00:02 |
| gyee | jamielennox, please, I would like to get to a point where can start working on client changes | 00:03 |
| gyee | both CLI and lib | 00:03 |
| *** bach has quit IRC | 00:03 | |
| morganfainberg | woot we'll have (at least) a non-vote check for mod_wsgi deployment shortly | 00:03 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Version independent password authentication plugin https://review.openstack.org/81147 | 00:03 |
| jamielennox | gyee: i figure if we can fix the libs then the CLIs will be easy to fix as they become available | 00:04 |
| jamielennox | so i don't know if ^^ is even correct, it was just some changes i had made locally | 00:04 |
| gyee | jamielennox, yes I agree, I figure CLI changes will be a lot more involved as some client may require major refactoring | 00:05 |
| jamielennox | gyee: i'm hoping we never have to do the CLI | 00:05 |
| jamielennox | i intend to hand-hold OSC through the process | 00:05 |
| gyee | oh? | 00:05 |
| jamielennox | i'll provide the ability for other clients CLI | 00:05 |
| jamielennox | but i'm hoping this is a good reason for people to move to OSC | 00:06 |
| jamielennox | gyee: so looking at https://review.openstack.org/#/c/81147/2/keystoneclient/auth/identity/password.py | 00:06 |
| *** bach has joined #openstack-keystone | 00:07 | |
| jamielennox | my concern is what you can correctly ignore in a situation where someone is doing user/pass auth, and doesn't care if it's v2 or v3 | 00:07 |
| jamielennox | if a user specifies a user_domain_id do we quit? if user_domain_id == default_domain_id then we can happily ignore that argument in v2 auth | 00:07 |
| *** bach has quit IRC | 00:07 | |
| *** bach has joined #openstack-keystone | 00:08 | |
| gyee | we should always use v3 as it is backward compatible | 00:08 |
| jamielennox | ? | 00:08 |
| gyee | as clients should not have to parse/interpret token data | 00:08 |
| gyee | all handled by keystoneclient | 00:09 |
| jamielennox | gyee: part of the point of this session object is that the client's shouldn't know what a token is | 00:09 |
| gyee | if client does not specify domain information, we use default domain in auth | 00:09 |
| jamielennox | from the client side we don't know what default domain is | 00:10 |
| gyee | ah, I see what you mean | 00:10 |
| gyee | jamielennox, if user specify user_domain_id and asking for v2 auth, we should error out | 00:12 |
| jamielennox | anyway because auth plugins are seperate from client now we can mix and match auth with client version | 00:12 |
| jamielennox | so we can use a v2 token with a v3 client | 00:12 |
| jamielennox | so *maybe* we don't always push for v3 | 00:12 |
| jamielennox | we say if username and not user_domain_id: use v2 even if v3 is available | 00:12 |
| jamielennox | (assuming v2 is available) | 00:13 |
| gyee | jamielennox, yeah I agree, if all the v3 args are specified, we use v3 | 00:14 |
| gyee | otherwise, we fall back to v2 | 00:14 |
| jamielennox | but there are edge cases like that where, particularly from the CLI, you might want to use v2 auth even if v3 is available | 00:14 |
| gyee | right, in that case, user will have to explicitly tell us what they want | 00:14 |
| gyee | by specifying auth_version or auth plugin to use | 00:15 |
| jamielennox | anyway - this is the reason it is still a WIP, i don't know how we can pick between v2 and v3 | 00:15 |
| gyee | that would be in advanced mode or something | 00:15 |
| gyee | k, let me go through your changes, I think we can make some reasonable assumptions based on the args specified | 00:16 |
| gyee | but provide a way for user to override the default behavoir | 00:16 |
| jamielennox | gyee: cool that would be appreciated | 00:16 |
| *** IanGovett has joined #openstack-keystone | 00:16 | |
| jamielennox | otherwise: https://review.openstack.org/#/c/74599/ and particularly: https://review.openstack.org/#/c/79542/ are what's most needed for next steps i think | 00:17 |
| jamielennox | the CLI options should be a fairly easy refinement of CONF options | 00:18 |
| jamielennox | if not then that's a bug to fix | 00:18 |
| jamielennox | i would like to provide a similar register_argparse_arguments(parser) and auth_plugin_from_argparse(namespace) functions for CLI | 00:19 |
| *** rwsu has joined #openstack-keystone | 00:20 | |
| gyee | jamielennox, are you providing those two in OSC or keystoneclient? | 00:21 |
| jamielennox | keystoneclient | 00:22 |
| gyee | what's namespace? | 00:22 |
| gyee | auth_plugin_from_argparse(namespace) | 00:22 |
| jamielennox | isn't a namespace returned for argparse.parse() | 00:23 |
| jamielennox | it's something like that | 00:23 |
| gyee | ah | 00:23 |
| gyee | k, make sense | 00:23 |
| jamielennox | gyee: i don't know yet how we provide --help for all these CLI arguments | 00:24 |
| jamielennox | if you say --os-auth-plugin password then i can give you --help text and arguments for that | 00:24 |
| *** IanGovett has quit IRC | 00:25 | |
| jamielennox | i don't know if we should iterate over all the plugin options and add the to --help or not | 00:25 |
| *** bach has quit IRC | 00:26 | |
| *** bach has joined #openstack-keystone | 00:26 | |
| gyee | jamielennox, that would required plugins themselves to advertised the args | 00:27 |
| jamielennox | gyee, they do: https://review.openstack.org/#/c/79542/ | 00:28 |
| gyee | jamielennox, U DA MAN! | 00:28 |
| gyee | that's exactly what I was thinking | 00:28 |
| jamielennox | maybe i should turn that into an object rather that a flat function | 00:31 |
| jamielennox | so auth.ConfigParser(CONF) | 00:31 |
| *** bach has quit IRC | 00:31 | |
| jamielennox | and cli = auth.CLIParser() | 00:31 |
| *** bach has joined #openstack-keystone | 00:32 | |
| jamielennox | so you can say cli.get_arguments_for(plugin_name) etc and give a bit finer control over what you do | 00:32 |
| jamielennox | but i'm trying hard to not add anything that doesn't have an explicit use case right now | 00:32 |
| *** bach has quit IRC | 00:34 | |
| gyee | what you have there should be good for now | 00:34 |
| gyee | who knows, we may not be using ConfigParser later on | 00:35 |
| gyee | you want to make it as generic as possible | 00:35 |
| gyee | let the presentation layer be separate | 00:35 |
| jamielennox | right, i was talking to dean about it a while ago and he was saying how it might be best not to do CLI handling in the client | 00:36 |
| jamielennox | because individual clients can do that stuff differently | 00:36 |
| jamielennox | for example a param called token will probably be appended with --os-auth before registered as a CLI opt | 00:36 |
| gyee | right | 00:38 |
| gyee | jamielennox, is there a way to specific which param is required and which one is optional? | 00:38 |
| jamielennox | that decision should be up to the individual cli | 00:38 |
| gyee | https://review.openstack.org/#/c/79542/6/keystoneclient/auth/identity/v3.py | 00:38 |
| jamielennox | gyee: not as yet - it will fail when it gets to the creating/authenticating the plugin, but it's not on the Param | 00:39 |
| gyee | maybe we need to add "optional" here? https://review.openstack.org/#/c/79542/6/keystoneclient/auth/param.py | 00:39 |
| jamielennox | this was just me starting minimal first | 00:39 |
| jamielennox | well the question is how would it be used? | 00:40 |
| jamielennox | in oslo.config.CONF there is no such thing as required, you get a None value and error out | 00:40 |
| gyee | we need to convey that information to the presentation layer | 00:40 |
| jamielennox | in CLI you don't set anything to required because you want to be able to fallback to env[OS_AUTH_WHATEVER] | 00:41 |
| gyee | I see | 00:42 |
| jamielennox | gyee: i'm not anti the idea, but i'd like a real use case | 00:43 |
| gyee | I was think we give the presentation layer as much information as we could so it can do whatever it needs to do | 00:44 |
| gyee | I was thinking this information not just for CLI, perhaps UI as well | 00:44 |
| jamielennox | what do you consider presentation layer here? | 00:44 |
| gyee | CLI and perhaps UI | 00:45 |
| jamielennox | CLI --help, horizon web form? | 00:45 |
| gyee | right | 00:45 |
| gyee | say if I would to provide a dropdown menu to select the auth plugin to use | 00:45 |
| gyee | I may put a * on the required params | 00:45 |
| jamielennox | are you expecting it to be enforced anywhere? | 00:45 |
| gyee | I was expecting some reasonable checking at the presentation layer | 00:46 |
| jamielennox | yea, that's ok, but not enforced by the param or client layer - cause i'm not sure how that would work | 00:46 |
| gyee | just thinking out loud here, but I am not a UI guys so I don't know | 00:46 |
| ayoung | bknudson, so you see that logic you have in the controller? I want that even higher up the stack eventually, and part of the HTTP request content type to say " Give me signed and ompressed data" | 00:47 |
| ayoung | there already is a way to do compression in HTTP, | 00:47 |
| ayoung | but the signed-compressed where the content can be passed in a header is not there | 00:47 |
| ayoung | jamielennox, please drop plugin from the cli verbage. --authn=password | 00:48 |
| jamielennox | gyee: and that was my other concern - so far i've got two fairly limited scenarios where i see this being used, CONF and CLI, and i've been told maybe don't handle the CLI case within client let them do that on there own | 00:48 |
| jamielennox | gyee: i'm sure there are a hundred other useful things that could go onto a param, but i don't know what they are yet and i'm trying not to guess | 00:49 |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Reduce excess LDAP searches https://review.openstack.org/47441 | 00:49 |
| gyee | jamielennox, that's fine, what you have is a very good start | 00:49 |
| jamielennox | ayoung: either, i don't mind | 00:49 |
| jamielennox | ayoung: CLI is not my main concern here | 00:49 |
| ayoung | jamielennox, I was thinking more that you are going to be our proponent to the unified CLI, and that they are going to need this functionality | 00:50 |
| jamielennox | ayoung: right and i've discussed it with dtroyer | 00:50 |
| jamielennox | if i can provide the properties it's his job to figure out how to make them usable | 00:51 |
| jamielennox | what I want first is being able to load ANY auth plugin from CONF | 00:51 |
| jamielennox | so auth_token with kerberos plugin | 00:51 |
| jamielennox | without having to write every one into it | 00:51 |
| gyee | ayoung, you want signed an compressed by be specified by the client? | 00:54 |
| gyee | for revocation list or token? | 00:54 |
| jamielennox | i don't see the point in allowing the client to specify what kind of token they get | 00:55 |
| gyee | jamielennox, oh I agree, just want to make sure | 00:55 |
| *** richm has quit IRC | 00:55 | |
| gyee | for revocation list, sure | 00:55 |
| gyee | jamielennox, should I drop the CLI changes here and do it in a separate patch? https://review.openstack.org/#/c/80124/3/barbicanclient/barbican.py | 00:56 |
| gyee | do it after your patches are landed | 00:56 |
| jamielennox | up to you, barbican indicated they weren't concerned with client API stability yet | 00:57 |
| jamielennox | i agree it's fine to construct the session in shell | 00:57 |
| jamielennox | though you should be constructing the auth plugins there and not the clients. | 00:58 |
| jamielennox | i would kill take over there Client.__init__(session= first argument and make that session mean keystoneclient session | 00:59 |
| jamielennox | hmm, maybe https://review.openstack.org/#/c/80124/3/barbicanclient/test/keystone_client_fixtures.py should be provided from within keystoneclient? | 01:00 |
| gyee | yeah would love to | 01:01 |
| gyee | I think all clients need the same tests | 01:01 |
| ayoung | http://labs.spotify.com/tag/dns/ | 01:06 |
| jamielennox | gyee: commented | 01:07 |
| *** rodrigods_ has quit IRC | 01:08 | |
| gyee | jamielennox, thanks! | 01:09 |
| gyee | jamielennox, I need to step away for an hour or so but I should be able to review the 3 patches by tonight | 01:10 |
| jamielennox | gyee: no worries, if not there's always time next week to go through them :) | 01:10 |
| *** dims has quit IRC | 01:11 | |
| *** dims has joined #openstack-keystone | 01:11 | |
| *** dims has quit IRC | 01:13 | |
| *** dims has joined #openstack-keystone | 01:15 | |
| *** dims has quit IRC | 01:15 | |
| *** xianghui has joined #openstack-keystone | 01:15 | |
| *** dims has joined #openstack-keystone | 01:15 | |
| *** marcoemorais has quit IRC | 01:16 | |
| *** dims has quit IRC | 01:16 | |
| *** dims has joined #openstack-keystone | 01:18 | |
| *** sbfox has quit IRC | 01:19 | |
| *** dims has quit IRC | 01:20 | |
| *** dims has joined #openstack-keystone | 01:21 | |
| *** dims has quit IRC | 01:22 | |
| *** dims has joined #openstack-keystone | 01:22 | |
| *** shakamunyi has joined #openstack-keystone | 01:27 | |
| *** shakamunyi has quit IRC | 01:42 | |
| *** BAKfr has quit IRC | 01:45 | |
| *** nkinder has quit IRC | 01:47 | |
| *** shakamunyi has joined #openstack-keystone | 01:57 | |
| *** harlowja has quit IRC | 02:03 | |
| *** diegows has quit IRC | 02:03 | |
| *** diegows_ has quit IRC | 02:03 | |
| *** harlowja has joined #openstack-keystone | 02:04 | |
| *** bach has joined #openstack-keystone | 02:10 | |
| *** mberlin1 has joined #openstack-keystone | 02:11 | |
| *** gokrokve has quit IRC | 02:11 | |
| *** mberlin has quit IRC | 02:11 | |
| *** shakayumi has joined #openstack-keystone | 02:15 | |
| *** dims has quit IRC | 02:16 | |
| *** dims has joined #openstack-keystone | 02:16 | |
| *** zhiyan_ is now known as zhiyan | 02:17 | |
| *** shakamunyi has quit IRC | 02:19 | |
| *** askb has joined #openstack-keystone | 02:21 | |
| *** amcrn has joined #openstack-keystone | 02:31 | |
| *** dims has quit IRC | 02:37 | |
| *** dims has joined #openstack-keystone | 02:38 | |
| *** dims has quit IRC | 02:40 | |
| *** gokrokve has joined #openstack-keystone | 02:42 | |
| *** harlowja has quit IRC | 02:44 | |
| *** gokrokve_ has joined #openstack-keystone | 02:44 | |
| *** harlowja has joined #openstack-keystone | 02:44 | |
| *** gokrokve has quit IRC | 02:47 | |
| *** gokrokve_ has quit IRC | 02:49 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Regions Management https://review.openstack.org/79096 | 02:54 |
| *** dims has joined #openstack-keystone | 02:54 | |
| *** stevemar has joined #openstack-keystone | 02:54 | |
| *** shakayumi has quit IRC | 03:01 | |
| *** david-lyle has joined #openstack-keystone | 03:02 | |
| ayoung | jamielennox, https://review.openstack.org/#/c/71181/ If you don't mind? | 03:03 |
| *** topol_ has joined #openstack-keystone | 03:04 | |
| *** dims has quit IRC | 03:05 | |
| jamielennox | ayoung: it's ready? | 03:06 |
| ayoung | jamielennox, yeah | 03:07 |
| jamielennox | other than reviews | 03:07 |
| jamielennox | ok, i'll give it a proper going over | 03:07 |
| ayoung | jamielennox, bknudson has been playing with it on devstack, too | 03:07 |
| ayoung | there is a WIP patch for the server | 03:07 |
| *** topol_ is now known as topol | 03:08 | |
| ayoung | jamielennox, https://review.openstack.org/#/c/91145/ | 03:08 |
| jamielennox | ayoung: i'll trust bknudson on the devstack side | 03:10 |
| jamielennox | i'll get a review on it this afternoon, i need to do stevemar's oauth as well | 03:10 |
| stevemar | jamielennox, you are too late! | 03:10 |
| jamielennox | i won't be around tomorrow - flying :) | 03:10 |
| jamielennox | stevemar: oh! sorry, but also good | 03:11 |
| jamielennox | we went over it a lot last time so i didn't expect to have anything to say | 03:11 |
| stevemar | jamielennox, yeah, it's cool, i am hoping to rebase the auth plugin patch soon | 03:13 |
| stevemar | maybe tonight, but i'm lazy and distracted | 03:13 |
| ayoung | I got the pleasure of the +A on that one | 03:15 |
| ayoung | stevemar, perfect mode for reviewing compressed tokens then...I am going to have to do some rework on the revocation events. | 03:15 |
| stevemar | ayoung, good point | 03:16 |
| ayoung | jamielennox, I might need a hand on revocation events testing. I realized I had copied the tests over from the server and just commented out a couple. In the mean time, the CLient Manager grew. So I'm going to need to mock out the response that the client uses | 03:16 |
| stevemar | ayoung, i'll be asking some questions about it then | 03:16 |
| ayoung | stevemar, please do. | 03:16 |
| jamielennox | ayoung sure | 03:21 |
| ayoung | jamielennox, once again, since I am not using the standard managers, the standard tests don't really apply | 03:22 |
| morganfainberg | jamielennox, ah this time you have the brutal flight, don't ya :( | 03:22 |
| ayoung | morganfainberg, he always does | 03:22 |
| morganfainberg | ayoung, he had a less brutal flight to HK than we all did | 03:23 |
| ayoung | Australia to Hong Kong was halfway round the world. | 03:23 |
| jamielennox | morganfainberg: yea, it's going to suck | 03:23 |
| jamielennox | ayoung: not really, was 9 or 10 hours i think | 03:23 |
| ayoung | twas less Brutal. But still brutal. | 03:23 |
| *** david-lyle has quit IRC | 03:23 | |
| morganfainberg | ayoung, iirc was 10hrs vs like 15:P | 03:23 |
| ayoung | I leave at 6:40 and arrive just after 9 thistime | 03:24 |
| morganfainberg | ayoung, just wait, we'll have a summit in aus soon, then his flight will be "great" compared to everyone else' | 03:24 |
| morganfainberg | ayoung, soon = no bearing on reality, just a hunch | 03:24 |
| jamielennox | i leave at 10:30am and get in at 6:25pm | 03:24 |
| morganfainberg | jamielennox, ouch. | 03:24 |
| jamielennox | + whatever the timezone difference is | 03:24 |
| morganfainberg | jamielennox, heh. | 03:24 |
| ayoung | jamielennox, you have your passport all up to date, right? | 03:25 |
| * ayoung has made that mistake before | 03:25 | |
| jamielennox | yep, | 03:25 |
| morganfainberg | ayoung, thats a painful mistake | 03:25 |
| jamielennox | paid my $14 for a visa | 03:25 |
| jamielennox | which is just such a weird number | 03:25 |
| morganfainberg | jamielennox, ... you had to pay... for a visa? | 03:25 |
| jamielennox | umm electronic something waiver something | 03:26 |
| morganfainberg | jamielennox, wierd | 03:26 |
| morganfainberg | jamielennox, and that is a very odd number | 03:26 |
| stevemar | ayoung, morganfainberg should be an easy review: https://review.openstack.org/#/c/89220/ | 03:26 |
| stevemar | jamielennox, ^ | 03:26 |
| jamielennox | stevemar: oh, i've no idea how to configure federation :) | 03:27 |
| stevemar | jamielennox, now you can learn! but if you're not comfy with it, that's cool | 03:28 |
| stevemar | i think dolphm and marekd know if the most, and they are okay with it | 03:28 |
| morganfainberg | stevemar phsaw, easy review!? documentation is hard! :P I need to turn on my grammar parsing part of my brain :P | 03:29 |
| stevemar | It's just, there are folks asking for docs for federation, and i'm getting tired of sending out emails with elaborate steps | 03:29 |
| ayoung | stevemar, um...that is not going to be an easy one. But I'll dig through it in the morning | 03:29 |
| stevemar | morganfainberg, ayoung, i always think doc changes are the easy ones :) | 03:30 |
| ayoung | stevemar, so you didn't split out the shibboleth parts? I guess that is OK. Probably makes sense to have a set of different Apache Config options in one file. | 03:30 |
| *** shakayumi has joined #openstack-keystone | 03:31 | |
| ayoung | stevemar, but I would like to keep all the Shibboleth stuff in one section, so that when we get to mod_lookup_identity or mod_mellon they just each have their own section | 03:31 |
| ayoung | You can carry through the SAML values for the example, though | 03:32 |
| jamielennox | mmm, 22 hours - i shouldn't have calculated that, it's just depressing | 03:33 |
| ayoung | jamielennox, Wow. | 03:34 |
| stevemar | jamielennox, load up a lot of movies on the laptop/tablet | 03:34 |
| stevemar | ayoung, ohh i see what you mean | 03:36 |
| stevemar | ayoung, i think for now, the mod_shib section is good enough, when we actually claim support for mod_lookup and mod_mellon, we can restructure the docs | 03:36 |
| ayoung | stevemar, I think we should get the organization for that right now, otherwise we will end up touching this stuff when we go to add a different module, and that review will be much worse for it. | 03:38 |
| stevemar | ayoung, wouldn't it be just adding a sub-section? | 03:38 |
| ayoung | So long as the mod_shib stuff is all together. I'll need to look closer to see what should be shifted...in the morrow... | 03:39 |
| morganfainberg | stevemar, looks like you're runnign ubuntu | 03:39 |
| morganfainberg | stevemar, do you want to clarify that in the docs? | 03:39 |
| morganfainberg | "service apache2 restart" is not rh/fedora iirc | 03:40 |
| morganfainberg | same w/ the a2ensite etc | 03:40 |
| *** bach has quit IRC | 03:40 | |
| stevemar | morganfainberg, good point! | 03:40 |
| morganfainberg | stevemar, looks like there aren't any rendering errors. let me review verbiage next. | 03:43 |
| ayoung | stevemar, at least now I won't have to deal with rebases on the oauth and regions stuff. Both merged/ | 03:43 |
| morganfainberg | ayoung, ++ | 03:44 |
| morganfainberg | ayoung, i think we also now have mod_wsgi deployment once zuul reloads it's config | 03:44 |
| morganfainberg | ayoung, check* | 03:44 |
| ayoung | OOOH YEAH! | 03:44 |
| morganfainberg | it's non-vote till we're sure it works | 03:44 |
| * ayoung promised he wouldn't cry | 03:44 | |
| morganfainberg | but talking with infra once it's looking good we'll combine it w/ gate checks (probably) e.g. postgres, neutron, something | 03:45 |
| ayoung | morganfainberg, First beer is on me | 03:45 |
| *** gokrokve has joined #openstack-keystone | 03:45 | |
| ayoung | that one earned it | 03:45 |
| morganfainberg | :) | 03:45 |
| morganfainberg | ayoung, lets plan to celebrate once we're gating on it and devstack defaults to mod_wsgi :) | 03:45 |
| morganfainberg | ayoung, we can toast to this success in ATL though! | 03:46 |
| ayoung | we can drink multiple beers | 03:46 |
| morganfainberg | ayoung, I support this messabe | 03:46 |
| morganfainberg | message* | 03:46 |
| ayoung | I though you had gone Gungan on me | 03:46 |
| morganfainberg | ayoung, oh god no. /me cringes | 03:47 |
| ayoung | Bet they put him in a Cameo in SW EP 7 | 03:47 |
| ayoung | Like the ETs in the Senate | 03:47 |
| morganfainberg | ayoung, I'm trying to think positively about EP7! :P | 03:48 |
| ayoung | jamielennox, did you write the crud tests? It looks like magic to me | 03:48 |
| jamielennox | ayoung: no, but i know (mostly) how they work | 03:48 |
| ayoung | returned = self.manager.create(**parameterize(manager_ref)) | 03:48 |
| ayoung | I am trying to emulate a call like that | 03:49 |
| ayoung | but can';t figure out how to get the Manager... | 03:49 |
| jamielennox | so it's like the server | 03:49 |
| jamielennox | there is a base class, and then you mix it into manager specific tests | 03:49 |
| jamielennox | i assume manager is a class atttribute | 03:50 |
| *** gokrokve has quit IRC | 03:50 | |
| ayoung | Ah...OK... | 03:50 |
| ayoung | and I see how the client is created in the Tests Class... | 03:50 |
| ayoung | OK...so far pretty clear. | 03:51 |
| ayoung | jamielennox, OK, I need to split my test into a model portion and a V3 specific portion...that will happen tomorrow. Gnight all | 03:54 |
| morganfainberg | stevemar, commented on the documentation | 04:03 |
| morganfainberg | stevemar, is there a "better" place to link against than github.com? | 04:03 |
| morganfainberg | stevemar, few minor rephrasing comments to help make sure we are as clear as possible. | 04:04 |
| stevemar | github was linked? hmmm | 04:04 |
| morganfainberg | stevemar, you have a bunch of things linking to github (.md files) | 04:04 |
| morganfainberg | stevemar, identity-api? | 04:05 |
| morganfainberg | stevemar, not sure if we have a better place to link to... something openstack.org based maybe? | 04:05 |
| morganfainberg | stevemar, but if we don't no big deal | 04:05 |
| stevemar | ohh the identity api ones | 04:05 |
| stevemar | i'm not sure there is a better spot | 04:05 |
| morganfainberg | stevemar, we might need to ask the lovely doc folks | 04:06 |
| morganfainberg | stevemar, would be better if we linked to o.o instead of github | 04:06 |
| *** topol has quit IRC | 04:08 | |
| *** shakayumi has quit IRC | 04:08 | |
| morganfainberg | stevemar, hmm. we might be missing some data from the API site. | 04:12 |
| morganfainberg | stevemar, http://api.openstack.org/api-ref-identity.html seems to be missing things | 04:12 |
| morganfainberg | stevemar, http://api.openstack.org/api-ref-identity.html#Group_Calls doesn't have the create group info (which the .md has, added by henrynash in 2012) | 04:14 |
| morganfainberg | similarly we're missing data for creating users | 04:14 |
| stevemar | morganfainberg, and we're getting on my case about not futureproofing the structure of a guide :P | 04:16 |
| stevemar | morganfainberg, the api.openstack.org site receives no love | 04:16 |
| morganfainberg | stevemar, hey, the docs look quite good except for what is missing | 04:16 |
| morganfainberg | stevemar, i only _asked_ if there was a better place to link to :P | 04:17 |
| morganfainberg | stevemar, valid response is "nope, github is the best" | 04:17 |
| morganfainberg | stevemar, funny, the PDF version has "adding group" and "adding user" | 04:18 |
| stevemar | morganfainberg, hehe, just gettin on your case for fun | 04:19 |
| morganfainberg | >.> | 04:19 |
| morganfainberg | <.< | 04:19 |
| stevemar | morganfainberg, all your suggestions are great, i think i'll just wait for ayoung to have comments tomorrow so i don't have to submit 2 patches | 04:23 |
| morganfainberg | stevemar, ++ cool | 04:23 |
| stevemar | morganfainberg, do you think adding a sentence about the steps being ubuntu specific is cool at the end of the 'prereqs' section? | 04:29 |
| stevemar | i can't really find a spot to put it | 04:29 |
| *** gokrokve has joined #openstack-keystone | 04:44 | |
| *** zhiyan is now known as zhiyan_ | 04:46 | |
| *** gokrokve has quit IRC | 04:49 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Check that the user is dumb moved to the common method https://review.openstack.org/88517 | 04:58 |
| openstackgerrit | Li Ma proposed a change to openstack/keystone: Password trunction makes password insecure https://review.openstack.org/77325 | 05:19 |
| praneshp | :q | 05:30 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Authenticate via oauth https://review.openstack.org/81981 | 05:30 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Add example script for oauth1 functions https://review.openstack.org/80193 | 05:31 |
| *** chandan_kumar has joined #openstack-keystone | 05:37 | |
| *** marcoemorais has joined #openstack-keystone | 05:38 | |
| *** marcoemorais1 has joined #openstack-keystone | 05:41 | |
| *** marcoemorais has quit IRC | 05:42 | |
| *** stevemar has quit IRC | 05:43 | |
| *** gokrokve has joined #openstack-keystone | 05:44 | |
| *** gokrokve_ has joined #openstack-keystone | 05:46 | |
| *** gokrokve has quit IRC | 05:49 | |
| *** gokrokve_ has quit IRC | 05:50 | |
| *** shakayumi has joined #openstack-keystone | 05:52 | |
| *** tomoiaga has joined #openstack-keystone | 05:57 | |
| *** shakayumi has quit IRC | 05:57 | |
| *** dstanek_zzz is now known as dstanek | 05:59 | |
| *** zhiyan_ is now known as zhiyan | 05:59 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/90288 | 06:01 |
| *** abelur_ has joined #openstack-keystone | 06:02 | |
| *** askb has quit IRC | 06:05 | |
| *** zhiyan is now known as zhiyan_ | 06:05 | |
| *** morganfainberg is now known as morganfainberg_Z | 06:05 | |
| *** gyee has quit IRC | 06:06 | |
| *** zhiyan_ is now known as zhiyan | 06:08 | |
| *** zhiyan has left #openstack-keystone | 06:08 | |
| *** harlowja is now known as harlowja_away | 06:08 | |
| *** zhiyan has joined #openstack-keystone | 06:09 | |
| *** zhiyan is now known as zhiyan_ | 06:12 | |
| *** zhiyan_ is now known as zhiyan | 06:12 | |
| *** jaosorior has joined #openstack-keystone | 06:22 | |
| *** zhiyan is now known as zhiyan_ | 06:30 | |
| *** zhiyan_ is now known as zhiyan | 06:34 | |
| *** zhiyan is now known as zhiyan_ | 06:37 | |
| *** derek_c has joined #openstack-keystone | 06:43 | |
| *** gokrokve has joined #openstack-keystone | 06:44 | |
| *** gokrokve has quit IRC | 06:49 | |
| *** praneshp has quit IRC | 06:58 | |
| *** daneyon has quit IRC | 06:59 | |
| *** ukalifon1 has joined #openstack-keystone | 07:00 | |
| *** praneshp has joined #openstack-keystone | 07:01 | |
| *** praneshp has quit IRC | 07:02 | |
| *** amcrn has quit IRC | 07:06 | |
| *** henrynash has joined #openstack-keystone | 07:11 | |
| *** derek_c has quit IRC | 07:34 | |
| *** derek_c has joined #openstack-keystone | 07:34 | |
| *** abelur_ has quit IRC | 07:37 | |
| *** gokrokve has joined #openstack-keystone | 07:44 | |
| *** gokrokve has quit IRC | 07:49 | |
| *** derek_c has quit IRC | 07:49 | |
| *** dstanek is now known as dstanek_zzz | 07:55 | |
| *** andreaf has joined #openstack-keystone | 08:07 | |
| *** gokrokve has joined #openstack-keystone | 08:44 | |
| *** gokrokve has quit IRC | 08:49 | |
| *** gabriel-bezerra is now known as gabriel-bezerraa | 08:51 | |
| *** gokrokve has joined #openstack-keystone | 09:44 | |
| *** marcoemorais1 has quit IRC | 09:46 | |
| *** gokrokve has quit IRC | 09:49 | |
| *** gokrokve has joined #openstack-keystone | 10:44 | |
| *** amerine_ has joined #openstack-keystone | 10:47 | |
| *** BAKfr has joined #openstack-keystone | 10:48 | |
| *** gokrokve has quit IRC | 10:49 | |
| *** ukalifon1 has quit IRC | 10:55 | |
| *** amerine has quit IRC | 10:55 | |
| *** rodrigods has quit IRC | 10:55 | |
| *** gabriel-bezerraa has quit IRC | 10:55 | |
| *** rodrigods has joined #openstack-keystone | 10:56 | |
| *** rodrigods has quit IRC | 10:56 | |
| *** rodrigods has joined #openstack-keystone | 10:56 | |
| *** gabriel-bezerraa has joined #openstack-keystone | 10:57 | |
| *** ukalifon1 has joined #openstack-keystone | 10:57 | |
| openstackgerrit | Roman Bodnarchuk proposed a change to openstack/keystone: Return 400 in case request body is JSON, but not a dictionary https://review.openstack.org/92809 | 11:00 |
| *** dims has joined #openstack-keystone | 11:12 | |
| *** erecio has quit IRC | 11:23 | |
| *** jamielennox is now known as jamielennox|away | 11:26 | |
| *** gokrokve has joined #openstack-keystone | 11:44 | |
| *** erecio has joined #openstack-keystone | 11:47 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Refactor test_auth trust related tests https://review.openstack.org/92813 | 11:48 |
| *** gokrokve has quit IRC | 11:49 | |
| *** IanGovett has joined #openstack-keystone | 12:04 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add detailed federation configuration docs https://review.openstack.org/89220 | 12:08 |
| *** abelur_ has joined #openstack-keystone | 12:11 | |
| *** abelur_ has quit IRC | 12:11 | |
| marekd | Any particular time when sunday meetup would start? | 12:25 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone: Filter User by project https://review.openstack.org/84136 | 12:30 |
| *** tomoiaga has left #openstack-keystone | 12:32 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone: Filter User by project https://review.openstack.org/84136 | 12:33 |
| *** ayoung has left #openstack-keystone | 12:41 | |
| *** ayoung has joined #openstack-keystone | 12:42 | |
| *** gokrokve has joined #openstack-keystone | 12:44 | |
| *** bknudson has quit IRC | 12:48 | |
| *** gokrokve has quit IRC | 12:49 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone: Filter User by project https://review.openstack.org/84136 | 12:57 |
| *** IanGovett has quit IRC | 13:04 | |
| *** xianghui has quit IRC | 13:07 | |
| *** bknudson has joined #openstack-keystone | 13:09 | |
| marekd | ayoung: o/ | 13:10 |
| ayoung | Oy | 13:10 |
| marekd | you know anything more about that Sunday summit meetup? when does it start? | 13:10 |
| *** david-lyle has joined #openstack-keystone | 13:11 | |
| ayoung | marekd, heh, just whenever people trickle in. Its a travel day | 13:14 |
| ayoung | marekd, I'm not coming in till after 9 PM | 13:14 |
| marekd | ayoung: aha, ok | 13:17 |
| marekd | thanks! | 13:17 |
| ayoung | marekd, what hotel are you stayin at? | 13:17 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add detailed federation configuration docs https://review.openstack.org/89220 | 13:18 |
| marekd | ayoung: Melia Atlanta | 13:19 |
| marekd | ayoung: U ? | 13:20 |
| ayoung | marekd, looking. | 13:20 |
| ayoung | marekd, Omni | 13:27 |
| * ayoung is pretty sure.. | 13:27 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add detailed federation configuration docs https://review.openstack.org/89220 | 13:27 |
| marekd | i guess it's quite close to the Georgia World Congress Center | 13:28 |
| *** chandan_kumar has quit IRC | 13:28 | |
| marekd | ok, just check on google maps :D | 13:28 |
| lbragstad | https://www.google.com/maps/place/Park+Bar/@33.7574754,-84.3950087,16z/data=!4m2!3m1!1s0x88f503809ac65a45:0xb426ee285ed0dda7 | 13:29 |
| *** dstanek_zzz is now known as dstanek | 13:29 | |
| lbragstad | ^ that's the place, right? | 13:29 |
| *** david-lyle has quit IRC | 13:34 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Initial implementation of validator https://review.openstack.org/86483 | 13:40 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 13:40 |
| *** bknudson has quit IRC | 13:41 | |
| *** gokrokve has joined #openstack-keystone | 13:44 | |
| *** chandan_kumar has joined #openstack-keystone | 13:46 | |
| *** gokrokve has quit IRC | 13:48 | |
| *** bknudson has joined #openstack-keystone | 13:54 | |
| *** zhiyan_ is now known as zhiyan | 13:56 | |
| *** stevemar has joined #openstack-keystone | 13:56 | |
| *** gokrokve has joined #openstack-keystone | 14:01 | |
| *** bach has joined #openstack-keystone | 14:02 | |
| *** IanGovett has joined #openstack-keystone | 14:08 | |
| *** stevemar has quit IRC | 14:18 | |
| *** dstanek is now known as dstanek_zzz | 14:23 | |
| *** vhoward has joined #openstack-keystone | 14:31 | |
| *** stevemar has joined #openstack-keystone | 14:32 | |
| *** dstanek_zzz is now known as dstanek | 14:33 | |
| *** chandan_kumar has quit IRC | 14:34 | |
| *** chandan_kumar has joined #openstack-keystone | 14:34 | |
| *** thedodd has joined #openstack-keystone | 14:38 | |
| *** nkinder has joined #openstack-keystone | 14:48 | |
| *** gokrokve has quit IRC | 14:48 | |
| *** gokrokve has joined #openstack-keystone | 14:52 | |
| *** ukalifon2 has joined #openstack-keystone | 15:01 | |
| *** jaosorior has quit IRC | 15:01 | |
| *** andreaf has quit IRC | 15:02 | |
| *** ukalifon1 has quit IRC | 15:04 | |
| *** dims has quit IRC | 15:04 | |
| *** dims has joined #openstack-keystone | 15:05 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add detailed federation configuration docs https://review.openstack.org/89220 | 15:11 |
| marekd | stevemar: ^^ this is for you :-) | 15:11 |
| *** spligak has quit IRC | 15:13 | |
| stevemar | marekd, it is?! | 15:14 |
| stevemar | marekd, hehe, the other sentence was a bit sassy! | 15:15 |
| *** marcoemorais has joined #openstack-keystone | 15:19 | |
| marekd | i know i know. | 15:19 |
| *** marcoemorais has quit IRC | 15:19 | |
| marekd | that's why i told ya it was for you :-) | 15:19 |
| marekd | thanks for +2 | 15:19 |
| *** marcoemorais has joined #openstack-keystone | 15:22 | |
| *** praneshp has joined #openstack-keystone | 15:23 | |
| *** joesavak has joined #openstack-keystone | 15:24 | |
| *** zhiyan is now known as zhiyan_ | 15:26 | |
| *** jsavak has joined #openstack-keystone | 15:29 | |
| *** joesavak has quit IRC | 15:33 | |
| *** chandan_kumar has quit IRC | 15:34 | |
| *** ukalifon2 has quit IRC | 15:34 | |
| *** marcoemorais has quit IRC | 15:35 | |
| *** stevemar has quit IRC | 15:45 | |
| *** gokrokve_ has joined #openstack-keystone | 16:07 | |
| *** stevemar has joined #openstack-keystone | 16:10 | |
| *** gokrokve has quit IRC | 16:11 | |
| *** andreaf has joined #openstack-keystone | 16:21 | |
| *** nkinder has quit IRC | 16:21 | |
| ayoung | lbragstad, I arrive in ATLANTA, GA (ATL) at 9:20 PM. Probably take me an hourish to get to the Hotel. Might not be showing at the Park Bar. | 16:25 |
| lbragstad | ayoung: gotcha, I think bknudson and I leave MN before noon, | 16:25 |
| lbragstad | I think it's only a couple hour flight of u | 16:26 |
| lbragstad | us* | 16:26 |
| *** stevemar has quit IRC | 16:29 | |
| *** stevemar has joined #openstack-keystone | 16:30 | |
| *** dstanek is now known as dstanek_zzz | 16:31 | |
| *** nkinder has joined #openstack-keystone | 16:40 | |
| *** marcoemorais has joined #openstack-keystone | 16:45 | |
| openstackgerrit | Richard Megginson proposed a change to openstack/keystone: better handling for empty/None ldap values https://review.openstack.org/76002 | 16:54 |
| *** gyee has joined #openstack-keystone | 16:56 | |
| *** amerine_ is now known as ameirne | 16:56 | |
| *** ameirne is now known as amerine | 16:56 | |
| amerine | Anyone able to tell me how to get the docs that where here http://api.openstack.org/api-ref.html for Havana? | 16:57 |
| *** harlowja_away is now known as harlowja | 17:01 | |
| *** andreaf has quit IRC | 17:07 | |
| *** htruta has quit IRC | 17:08 | |
| *** richm has joined #openstack-keystone | 17:13 | |
| *** amcrn has joined #openstack-keystone | 17:21 | |
| *** gokrokve_ has quit IRC | 17:21 | |
| *** rodrigods has quit IRC | 17:27 | |
| *** dstanek_zzz is now known as dstanek | 17:29 | |
| *** tsv has joined #openstack-keystone | 17:47 | |
| *** thedodd has quit IRC | 17:50 | |
| *** thedodd has joined #openstack-keystone | 17:54 | |
| *** amcrn_ has joined #openstack-keystone | 17:54 | |
| *** gokrokve has joined #openstack-keystone | 17:54 | |
| *** amcrn has quit IRC | 17:56 | |
| *** bach has quit IRC | 18:00 | |
| stevemar | bknudson, ping | 18:04 |
| bknudson | stevemar: what's up? | 18:04 |
| stevemar | in this change, https://review.openstack.org/#/c/92228/2 did you update tox, or was that automagic? | 18:04 |
| stevemar | same with tools/install_venv_common | 18:04 |
| bknudson | stevemar: I made the change to tox.ini since tox -epep8 was failing | 18:05 |
| bknudson | stevemar: checked the keystone version and noticed it had that | 18:05 |
| bknudson | stevemar: the change to install_venv_common came from update.py. | 18:05 |
| stevemar | bknudson, oh yeah? i never noticed that in the keystone version, good to know. | 18:06 |
| stevemar | bknudson, yeah, i thought he is associated with oslo. cool | 18:06 |
| stevemar | bknudson, uh oh, i started down the rabbit hole, you've got 5 patches strung together | 18:08 |
| bknudson | stevemar: there was a change to https://review.openstack.org/#/c/92228/2/keystoneclient/openstack/common/memorycache.py | 18:09 |
| bknudson | which caused some tests to fail | 18:09 |
| bknudson | so I changed some tests | 18:10 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Initial implementation of validator https://review.openstack.org/86483 | 18:10 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 18:10 |
| bknudson | we'll have to get an un-session together to discuss input validation | 18:10 |
| lbragstad | +1 | 18:11 |
| *** ayoung has quit IRC | 18:13 | |
| *** IanGovett1 has joined #openstack-keystone | 18:17 | |
| *** IanGovett has quit IRC | 18:17 | |
| *** IanGovett1 has quit IRC | 18:17 | |
| *** IanGovett1 has joined #openstack-keystone | 18:17 | |
| stevemar | i think lbragstad's on the right track | 18:17 |
| *** ayoung has joined #openstack-keystone | 18:18 | |
| stevemar | bknudson, another question, is the thinking behind this change: https://review.openstack.org/#/c/92223/1/openstack-common.conf, that we only keep a list of the modules we specifically call out in keystoneclient? | 18:18 |
| *** bach has joined #openstack-keystone | 18:18 | |
| bknudson | stevemar: yes, we only explicitly list what keystoneclient requires (i.e., imports) -- oslo can take care of the other dependencies. | 18:19 |
| stevemar | cool cool | 18:19 |
| bknudson | that way those modules will go away automatically if oslo stops depending on it. | 18:19 |
| bknudson | which I expect to happen as oslo moves modules into libraries | 18:20 |
| *** lbragstad has quit IRC | 18:20 | |
| *** bach has quit IRC | 18:21 | |
| *** BAKfr has quit IRC | 18:21 | |
| *** morganfainberg_Z is now known as morganfainberg | 18:22 | |
| *** bach has joined #openstack-keystone | 18:23 | |
| *** lbragstad has joined #openstack-keystone | 18:24 | |
| *** bach has quit IRC | 18:28 | |
| *** vhoward has left #openstack-keystone | 18:34 | |
| *** derek_c has joined #openstack-keystone | 18:39 | |
| *** bach has joined #openstack-keystone | 18:40 | |
| *** thedodd has quit IRC | 18:41 | |
| *** leseb has joined #openstack-keystone | 18:52 | |
| *** openstackgerrit has quit IRC | 19:04 | |
| *** openstackgerrit has joined #openstack-keystone | 19:05 | |
| *** amcrn_ has quit IRC | 19:07 | |
| *** andreaf has joined #openstack-keystone | 19:10 | |
| *** andreaf has quit IRC | 19:10 | |
| *** andreaf has joined #openstack-keystone | 19:11 | |
| *** leseb has quit IRC | 19:17 | |
| *** thedodd has joined #openstack-keystone | 19:31 | |
| *** leseb has joined #openstack-keystone | 19:32 | |
| *** bach has quit IRC | 19:43 | |
| dolphm | i'm blanking out - can anyone recall the term for "using the network itself as a storage medium" ? (i'm trying to describe the move to ephemeral tokens) | 19:45 |
| *** derek_c has quit IRC | 19:45 | |
| *** bach has joined #openstack-keystone | 19:46 | |
| *** bach has quit IRC | 19:48 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Authenticate via oauth https://review.openstack.org/81981 | 19:51 |
| *** d0ugal has quit IRC | 19:51 | |
| *** leseb has quit IRC | 19:54 | |
| *** jsavak has quit IRC | 20:05 | |
| ayoung | dolphm, " | 20:06 |
| ayoung | Only wimps use tape backup: real men just upload their important stuff on ftp, and let the rest of the world mirror it ;) | 20:06 |
| ayoung | Torvalds, Linus (1996-07-20). Message. linux-kernel mailing list. IU. Retrieved on 2014-04-26. | 20:06 |
| ayoung | " | 20:06 |
| dolphm | ayoung: that's still using traditional storage resources on a server somewhere... which isn't what i'm referring to | 20:07 |
| ayoung | dolphm, in this case though, I would say that the tokens are no longer persisted, but rather we are moving to cryptographic | 20:07 |
| ayoung | verification? | 20:07 |
| openstackgerrit | Fernando Ribeiro proposed a change to openstack/python-keystoneclient: Fix listing of endpoints for a token https://review.openstack.org/91990 | 20:09 |
| *** IanGovett1 has quit IRC | 20:09 | |
| dolphm | meh? http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=6172095&url=http%3A%2F%2Fieeexplore.ieee.org%2Fiel5%2F6171934%2F6172084%2F06172095.pdf%3Farnumber%3D6172095 | 20:12 |
| dolphm | ayoung: ^ | 20:12 |
| ayoung | dolphm, I'm not sure I am with you on this one. What are you implying here? THat you can always retrieve the token from somewhere on the net? | 20:12 |
| ayoung | Ah | 20:12 |
| dolphm | ayoung: no, just that the only place something is persisted is on the network | 20:12 |
| morganfainberg | dolphm, hm. | 20:12 |
| morganfainberg | dolphm, interesting. | 20:13 |
| ayoung | dolphm, but that is not true here. The token is not necessarily "persisted" anywhere | 20:13 |
| ayoung | just that if you happen to find one, you can verify it | 20:13 |
| morganfainberg | dolphm, ayoung, i want to talk about token validators when we get to the summit [on the topic of ephermeral tokens | 20:13 |
| morganfainberg | ] | 20:13 |
| dolphm | i want to say the term is as simple as "network-based storage" but that just renders lots of google results for NAS, etc | 20:13 |
| morganfainberg | dolphm, it's not really "hiding" the cipher though | 20:14 |
| dolphm | morganfainberg: agree | 20:15 |
| ayoung | THe Network is the Computer? Nah. | 20:15 |
| morganfainberg | ayoung, soylent green is people? | 20:15 |
| dolphm | morganfainberg: i don't think 'stenography' is accurate, but it's thematically related | 20:15 |
| morganfainberg | dolphm, Ephemeral is really the best phrasing. | 20:16 |
| morganfainberg | the data can be validated but has a limited life (while being used) | 20:16 |
| ayoung | morganfainberg, well, not really. Tokens are already Ephemeral, they just get written to disk | 20:16 |
| morganfainberg | it's not that it really is ever stored. | 20:16 |
| morganfainberg | ayoung, ++ | 20:16 |
| morganfainberg | ayoung, true | 20:16 |
| *** arborism has joined #openstack-keystone | 20:16 | |
| ayoung | in this case, what he means is that the only place the token is reliably stored is as part of the network protocols that use it | 20:17 |
| *** dstanek is now known as dstanek_zzz | 20:18 | |
| dolphm | ayoung: exactly | 20:18 |
| bknudson | what do you think about advertising "capabilities" in /v2.0/extensions? | 20:18 |
| bknudson | for example, this server supports returning an unsigned revocation list | 20:19 |
| ayoung | bknudson, or MD5 vs SHA256 for hashes? | 20:19 |
| dolphm | bknudson: i've advocated for that in the past, and was convinced it was a bad idea | 20:19 |
| ayoung | bknudson, what is the HTTP way? | 20:20 |
| morganfainberg | bknudson, i would support doing that | 20:20 |
| dolphm | bknudson: although i was looking to introduce a /capabilities on *every* service that clients could make authenticated requests to, in order to discover the subset authorized capabilities at that endpoint | 20:20 |
| morganfainberg | ayoung, dolphm, i asked smart people here and they keep saying "on the wire" is the best phrasing as in: the data only exists on the wire | 20:20 |
| ayoung | I'm mixed | 20:21 |
| dolphm | morganfainberg: nice... | 20:21 |
| bknudson | I think there's a show called "the wire" | 20:21 |
| morganfainberg | bknudson, oh we probably need to never use that phrase again then :P | 20:21 |
| ayoung | the opposite of http://en.wikipedia.org/wiki/Data_at_Rest | 20:22 |
| nkinder | data in action | 20:22 |
| bknudson | ayoung: I'll see if there's anything in http for advertising it | 20:22 |
| morganfainberg | not(data at rest) | 20:22 |
| nkinder | :) | 20:22 |
| morganfainberg | nkinder, data in motion? | 20:22 |
| bknudson | of course the client could just try it and fail, but I'd rather avoid the error message in the keystone server log | 20:22 |
| ayoung | It puts the Data in the Bucket or it gets the hose again. | 20:22 |
| morganfainberg | nkinder, damn, "data in motion" is a real state of data :( | 20:23 |
| morganfainberg | nkinder, shouldn't use that then :P | 20:23 |
| morganfainberg | dolphm, http://en.wikipedia.org/wiki/Data_in_Use | 20:23 |
| nkinder | morganfainberg: you type new articles fast! ;) | 20:24 |
| dolphm | morganfainberg: that's a great way to look at it | 20:24 |
| dolphm | nkinder: ha | 20:24 |
| ayoung | Data on Vacation! | 20:24 |
| morganfainberg | nkinder, >.> | 20:24 |
| dolphm | morganfainberg: so we're just avoiding 'data at rest' | 20:24 |
| morganfainberg | dolphm, sounds right | 20:25 |
| ayoung | dolphm, the token only exists as Data in Use | 20:25 |
| dolphm | ayoung: or in motion | 20:25 |
| ayoung | Yeah, I guess that is not a strict subset | 20:25 |
| ayoung | http://www.imdb.com/title/tt0099141/ | 20:27 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Allow fetching a plaintext revocation list https://review.openstack.org/92727 | 20:28 |
| bknudson | https://review.openstack.org/#/c/92727/4/keystone/service.py is what I was talking about. | 20:28 |
| *** arborism is now known as amcrn | 20:30 | |
| ayoung | bknudson, I would love it if plaintext vs signed was inthe accepts header | 20:38 |
| ayoung | and applied to anything (except for tokens which are always signed) | 20:38 |
| bknudson | ayoung: that makes sense. It's JSON either way | 20:38 |
| ayoung | bknudson, JSON that is ASN1 encoded, signed, compressed, and then Base64 Encoded to be pedantic | 20:39 |
| ayoung | PKIZ for short | 20:39 |
| bknudson | ayoung: the response is {'signed': 'ajsdlkfdsafds'} | 20:39 |
| ayoung | Ohh | 20:39 |
| *** dstanek_zzz is now known as dstanek | 20:39 | |
| bknudson | {"signed": "-----BEGIN CMS-----\nMI | 20:39 |
| ayoung | bknudson, I was young. I needed the money | 20:39 |
| bknudson | ayoung: I'm guessing you wouldn't do it that way today | 20:40 |
| ayoung | bknudson, no. But then, the signed, compressed, and Base64 standard has not yet been published, either, so I don;t have a good standard content type for that | 20:41 |
| bknudson | maybe with HTTP you would do a HEAD request to find out if it supported the representation? | 20:41 |
| ayoung | bknudson, I would make it a client call: give me it signed or give me it unsigned | 20:41 |
| ayoung | bknudson, I mean, tehcniocally, we could make it a request param | 20:41 |
| ayoung | its just not somethjing that can be blanketly applied | 20:42 |
| *** bach has joined #openstack-keystone | 20:44 | |
| *** dstanek is now known as dstanek_zzz | 20:49 | |
| *** bach has quit IRC | 20:53 | |
| *** huats has quit IRC | 21:01 | |
| *** huats has joined #openstack-keystone | 21:04 | |
| *** huats has joined #openstack-keystone | 21:04 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Add example script for oauth1 functions https://review.openstack.org/80193 | 21:05 |
| morganfainberg | ayoung, oops https://review.openstack.org/#/c/92914/1 | 21:13 |
| morganfainberg | ayoung, we should have already been running the non-voting job *wince* | 21:13 |
| morganfainberg | bad regex. | 21:13 |
| * morganfainberg is to blame for that. | 21:13 | |
| ayoung | no blood, no foul | 21:17 |
| morganfainberg | ayoung, ok we should get apache-services check now :) | 21:21 |
| * morganfainberg goes to recheck a patch for fun | 21:21 | |
| ayoung | here's hoping | 21:22 |
| morganfainberg | ayoung, or we might need to wait still for zuul to reread config | 21:22 |
| *** dstanek_zzz is now known as dstanek | 21:23 | |
| morganfainberg | i'll chase down clarkb and get this worked out if it's still not working soon | 21:24 |
| morganfainberg | soon™ | 21:24 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Add example script for oauth1 functions https://review.openstack.org/80193 | 21:26 |
| morganfainberg | dolphm, if you're around some v2-to-v3 general timeline bp questions came up in nova meeting #openstack-meeting | 21:27 |
| stevemar | morganfainberg, ayoung do either of you know how to tell if a gate is broken? would zuul report that? | 21:27 |
| morganfainberg | stevemar, in what way broken? | 21:28 |
| *** derek_c has joined #openstack-keystone | 21:28 | |
| stevemar | morganfainberg, well, last time the oauth stuff merged, stable/havana broke because of library dependency | 21:29 |
| stevemar | i want to make sure the same thing didn't happen again | 21:29 |
| morganfainberg | ayoung, woo the keystoneclient change at the bottom of the check queue now has apache-services tempest! | 21:29 |
| morganfainberg | stevemar, ah we test for that now :) | 21:29 |
| morganfainberg | stevemar, there is a stable tempest run specifically to close that gap | 21:30 |
| stevemar | morganfainberg, yep, i know, and that one is passing! | 21:30 |
| morganfainberg | stevemar, but the way we'd know is... try and merge things to havana | 21:30 |
| morganfainberg | stevemar, so no, zuul doesn't know if something is broken without a change specifically in the queue | 21:30 |
| morganfainberg | stevemar, there might be a bit-rot check (periodic) that would catch it as well. but not 100% sure on that | 21:30 |
| stevemar | morganfainberg, ah, i thought maybe it was automagically run somewhere | 21:30 |
| ayoung | check-tempest-dsvm-full-apache-services: queued | 21:39 |
| ayoung | morganfainberg, that specificially is the reason that, on Tuesday night, I am making Guinness Stout Ice Cream Floats. | 21:40 |
| morganfainberg | ayoung, ++ | 21:41 |
| *** bach has joined #openstack-keystone | 21:44 | |
| *** Chicago has joined #openstack-keystone | 21:47 | |
| *** Chicago has joined #openstack-keystone | 21:47 | |
| *** andreaf_ has joined #openstack-keystone | 21:51 | |
| stevemar | ayoung, i'm glad i'm not the only one who remembers the guinness stout ice cream floats | 21:52 |
| *** rodrigods has joined #openstack-keystone | 21:53 | |
| *** rodrigods has joined #openstack-keystone | 21:53 | |
| *** andreaf has quit IRC | 21:54 | |
| *** rodrigods has quit IRC | 21:58 | |
| *** stevemar has quit IRC | 21:59 | |
| morganfainberg | ayoung, i think we are going to have some cleanup to do to get mod_wsgi deployments to pass tempest. | 22:00 |
| ayoung | morganfainberg, say it ain't so, Joe. | 22:08 |
| ayoung | morganfainberg, file them as bugs. | 22:09 |
| morganfainberg | ayoung, [Thu May 08 21:59:14 2014] [error] [client 127.0.0.1] malformed header from script. Bad header=25PbmUiLCAiaW50ZXJmYWNlIjogImF: main http://logs.openstack.org/27/92727/4/check/check-tempest-dsvm-full-apache-services/d0f16f3/console.html#_2014-05-08_21_59_14_452 | 22:09 |
| morganfainberg | ayoung, trying to figure out the bugs | 22:09 |
| ayoung | morganfainberg, (HTTP 500)? Could it be the token-too-big thing? | 22:10 |
| morganfainberg | ayoung, perhaps | 22:10 |
| morganfainberg | ayoung, http://logs.openstack.org/27/92727/4/check/check-tempest-dsvm-full-apache-services/d0f16f3/logs/screen-key.txt.gz | 22:10 |
| ayoung | morganfainberg, this is all on one machine, so the clocks should be in sync in the logs, right? | 22:12 |
| morganfainberg | ayoung, yes | 22:12 |
| morganfainberg | ayoung, the mod_wsgi logs though don't have microsecond resolution | 22:13 |
| ayoung | yeah | 22:13 |
| morganfainberg | ayoung, something i can fix in apache 2.4 | 22:13 |
| ayoung | ++ | 22:13 |
| *** marcoemorais has quit IRC | 22:13 | |
| morganfainberg | ayoung, [Thu May 08 21:59:14 2014] [error] 32677 DEBUG keystone.middleware.core [-] Auth token not in the request header. Will not build auth context. process_request /opt/stack/new/keystone/keystone/middleware/core.py:271 | 22:14 |
| morganfainberg | ayoung, i am thinking we might be losing the tokens | 22:14 |
| ayoung | XML | 22:14 |
| morganfainberg | ayoung, too large etc | 22:14 |
| ayoung | 2014-05-08 21:58:49.429 | {2} tempest.api.identity.admin.v3.test_tokens.TokensV3TestXML.test_rescope_token [0.738703s] ... FAILED | 22:14 |
| morganfainberg | ayoung, oh oh | 22:14 |
| morganfainberg | ayoung, derp. | 22:14 |
| morganfainberg | ayoung, interesting. | 22:14 |
| ayoung | test_rescope_token | 22:15 |
| ayoung | it might be that it is crossing a threshold | 22:15 |
| morganfainberg | ayoung, yeah. | 22:15 |
| ayoung | not just XML | 22:15 |
| ayoung | tempest.api.orchestration.stacks.test_update.UpdateStackTestJSON.test_stack_update_nochange [0.287952s] ... FAILED | 22:16 |
| ayoung | 2014-05-08 21:59:14.452 | | 22:16 |
| morganfainberg | ayoung, well this at the very least shows us potential problems with mod_wsgi deployments | 22:16 |
| ayoung | ++ | 22:16 |
| morganfainberg | ayoung, it's great to have this! | 22:16 |
| *** marcoemorais has joined #openstack-keystone | 22:16 | |
| morganfainberg | ayoung, aha | 22:16 |
| morganfainberg | ayoung, http://pasteraw.com/4nn8ysxubevs07izfwnty32kpdd9k68 | 22:17 |
| morganfainberg | ayoung, that wont work, PKI token exceeds max request length | 22:17 |
| ayoung | too big | 22:17 |
| morganfainberg | ayoung, yep | 22:17 |
| ayoung | we need compressed tokens | 22:17 |
| morganfainberg | ayoung,++ let me go review that patchset right now | 22:17 |
| ayoung | morganfainberg, ++. jamielennox|away -1ed it last night, but his changes will be miniscule. I'm finishing some testing on revoke events and will loop backaround to compressed, hopefully tonight | 22:18 |
| morganfainberg | ayoung, great! | 22:19 |
| morganfainberg | ayoung we also need revocation events >.> | 22:19 |
| *** dims has quit IRC | 22:23 | |
| *** marcoemorais has quit IRC | 22:29 | |
| openstackgerrit | Fernando Ribeiro proposed a change to openstack/python-keystoneclient: Fix listing of endpoints for a token https://review.openstack.org/91990 | 22:29 |
| *** henrynash has quit IRC | 22:29 | |
| *** marcoemorais has joined #openstack-keystone | 22:30 | |
| *** bknudson has quit IRC | 22:31 | |
| *** nkinder has quit IRC | 22:35 | |
| *** joesavak has joined #openstack-keystone | 22:39 | |
| gyee | ayoung, nkinder, I am also good with https://review.openstack.org/#/c/47441/ | 22:40 |
| *** jsavak has joined #openstack-keystone | 22:40 | |
| *** erecio has quit IRC | 22:42 | |
| *** rodrigods has joined #openstack-keystone | 22:43 | |
| *** joesavak has quit IRC | 22:43 | |
| *** tsv has quit IRC | 22:46 | |
| *** dstanek is now known as dstanek_zzz | 22:54 | |
| *** andreaf_ has quit IRC | 22:58 | |
| *** gokrokve has quit IRC | 23:00 | |
| *** jsavak has quit IRC | 23:09 | |
| *** rodrigods has quit IRC | 23:26 | |
| *** rodrigods has joined #openstack-keystone | 23:26 | |
| *** rodrigods has quit IRC | 23:26 | |
| *** rodrigods has joined #openstack-keystone | 23:26 | |
| *** rodrigods has quit IRC | 23:31 | |
| *** praneshp has quit IRC | 23:35 | |
| *** morganfainberg is now known as morganfainberg_Z | 23:38 | |
| *** rodrigods has joined #openstack-keystone | 23:39 | |
| *** rodrigods has quit IRC | 23:39 | |
| *** rodrigods has joined #openstack-keystone | 23:39 | |
| *** dstanek_zzz is now known as dstanek | 23:39 | |
| *** gokrokve has joined #openstack-keystone | 23:43 | |
| *** praneshp has joined #openstack-keystone | 23:44 | |
| *** thedodd has quit IRC | 23:47 | |
| *** morganfainberg_Z is now known as morganfainberg | 23:49 | |
| *** dstanek is now known as dstanek_zzz | 23:49 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!