| *** amcrn has joined #openstack-keystone | 00:13 | |
| *** openstackgerrit has quit IRC | 00:19 | |
| *** openstackgerrit has joined #openstack-keystone | 00:20 | |
| *** BAKfr has quit IRC | 00:25 | |
| *** openstackgerrit has quit IRC | 00:34 | |
| *** openstackgerrit has joined #openstack-keystone | 00:35 | |
| *** richm has quit IRC | 00:35 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Move DisableModuleFixture to utils https://review.openstack.org/93496 | 00:42 |
|---|---|---|
| *** gokrokve has joined #openstack-keystone | 00:43 | |
| rodrigods | ayoung, time for a +2 today? =) | 00:47 |
| *** gokrokve has quit IRC | 00:48 | |
| *** gordc has joined #openstack-keystone | 00:49 | |
| *** openstackgerrit has quit IRC | 00:49 | |
| *** openstackgerrit has joined #openstack-keystone | 00:50 | |
| *** gordc has quit IRC | 00:52 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: LDAP fix for get_roles_for_user_and_project user=group ID https://review.openstack.org/94470 | 00:56 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Adds function to compare DNs https://review.openstack.org/94513 | 00:56 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add a test for getting grant for a user with a , in ID https://review.openstack.org/94740 | 00:56 |
| bknudson | nkinder: those are the changes as described for master, so the LDAP fix now uses the DN compare functions | 00:57 |
| nkinder | bknudson: what is the new match() change for in 94740? | 01:01 |
| nkinder | bknudson: sorry, _match() | 01:01 |
| bknudson | nkinder: the existing .test_user_id_comma test actually started failing | 01:02 |
| ayoung | rodrigods, heh...I haven't forgotten | 01:03 |
| bknudson | and this was because the fakeldap was dumb about doing the comparison of the attributes for filter matching | 01:03 |
| nkinder | bknudson: ah, ok | 01:03 |
| ayoung | rodrigods, I promised today...gives me about 3 hours.... | 01:03 |
| bknudson | it was only normalizing the value passed in and not the values in the entry | 01:03 |
| rodrigods | ayoung, heheh ok | 01:03 |
| ayoung | rodrigods, but first an expense report for summit | 01:04 |
| rodrigods | ayoung, first things first | 01:06 |
| nkinder | bknudson: everything looks good. I've +1'd them all. | 01:07 |
| nkinder | ayoung: if you have 3 hours, you should have plenty of time left in the day for 3 more +2's for bknudson's patches! :) | 01:07 |
| bknudson | I'll give people time to look at these today and work on the icehouse port in the morning | 01:08 |
| bknudson | and let jenkins run to make sure it doesn't catch something again... at least I ran all the tests this time. | 01:09 |
| rodrigods | bknudson, did you have the change to check the last changes at https://review.openstack.org/#/c/91578/? | 01:09 |
| *** xianghui has quit IRC | 01:09 | |
| bknudson | rodrigods: it's on my list but I don't have time today | 01:10 |
| rodrigods | bknudson, no problem =) | 01:10 |
| nkinder | bknudson: sounds good. Thanks again for getting this all straightened out! | 01:11 |
| rodrigods | bknudson, thanks for your previous comments | 01:11 |
| nkinder | bknudson: I'll look for your icehouse port tomorrow morning and will look it over. | 01:11 |
| *** gabrielbezerra has quit IRC | 01:15 | |
| *** gabrielbezerra has joined #openstack-keystone | 01:15 | |
| *** marcoemorais has quit IRC | 01:16 | |
| *** clu_ has quit IRC | 01:23 | |
| *** diegows has quit IRC | 01:29 | |
| *** gyee has quit IRC | 01:32 | |
| *** hipster has joined #openstack-keystone | 01:36 | |
| *** gokrokve has joined #openstack-keystone | 01:43 | |
| *** gokrokve_ has joined #openstack-keystone | 01:44 | |
| *** gokrokve_ has quit IRC | 01:44 | |
| *** gokrokve_ has joined #openstack-keystone | 01:44 | |
| *** gokrokve has quit IRC | 01:48 | |
| *** gokrokve_ has quit IRC | 01:52 | |
| *** amcrn has quit IRC | 01:57 | |
| *** rodrigods has quit IRC | 01:59 | |
| ayoung | jamielennox, https://review.openstack.org/#/c/91578/8/keystoneclient/v3/assignments.py,cm is he right, or do we have a cleaner way to deal with the not implemented method for a client API? | 02:03 |
| ayoung | line 98 and beyond | 02:03 |
| jamielennox | ayoung: heh, i've wondered whether we should start doing that | 02:04 |
| jamielennox | by importing crudmanager you get all those functions automatically and there's no way to not | 02:04 |
| ayoung | I think I'm going to let it go, then. Its easier than what I did with regions | 02:05 |
| ayoung | Until we cleanup crud manager | 02:05 |
| jamielennox | yea - i don't mind having that | 02:05 |
| ayoung | Which plugin has a good example of how to build query strings? His string handling is ovbisouly too hand-jammed | 02:05 |
| jamielennox | there's too much baggage there | 02:05 |
| jamielennox | so from memory if you just pass kwargs through to super().list() it should handle that for you | 02:06 |
| jamielennox | i'm not sure what the rationale behind building it yourself then passing to _list is | 02:06 |
| jamielennox | but i haven't looked at the review | 02:06 |
| ayoung | 'slright, can kick it back with that guidance | 02:07 |
| jamielennox | why params with . s in them | 02:07 |
| jamielennox | scope.domain.id | 02:07 |
| jamielennox | is that normal? | 02:07 |
| *** clu_ has joined #openstack-keystone | 02:07 | |
| jamielennox | because that could be why | 02:07 |
| *** clu_ has quit IRC | 02:07 | |
| jamielennox | i hate that manager code | 02:08 |
| ayoung | jamielennox, I thought henrynash wrote that role_assignments code | 02:11 |
| ayoung | def list_role_assignments(self, context, filters): has | 02:13 |
| ayoung | @controller.filterprotected('group.id', 'role.id', and so on | 02:13 |
| *** gokrokve has joined #openstack-keystone | 02:14 | |
| ayoung | https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#list-effective-role-assignments-get-role_assignments | 02:15 |
| ayoung | jamielennox, is it just me, or is that the only place we do params like that? | 02:15 |
| jamielennox | ayoung: that's the only place i can think of it | 02:16 |
| jamielennox | the only reason i can think to have done it that way is so that it lines up with how the policy files are written | 02:16 |
| ayoung | need to ask Henry why, but I'm guessing that is messing up the param marshalling | 02:16 |
| jamielennox | it's kinda weird to handle it like that | 02:16 |
| ayoung | "identity:list_role_assignments": "rule:admin_on_domain_filter or rule:admin_on_project_filter", | 02:18 |
| ayoung | jamielennox, yeah, I am guessing that henry used the same format as the flattending dictionary | 02:18 |
| ayoung | flattened | 02:18 |
| *** gokrokve has quit IRC | 02:18 | |
| *** gokrokve has joined #openstack-keystone | 02:20 | |
| ayoung | jamielennox, what do you think about, for fine grained delegation, adding an optional section to a token that matches the rules from the policy file. So even if you have, in that case, rule:admin_on_project_filter the token would only pass if you also had something like "apis" :[ "identity:list_role_assignments"] | 02:20 |
| jamielennox | that's very fine grained | 02:20 |
| jamielennox | umm, i think that would be hard to manage | 02:21 |
| ayoung | It would be explicitly for handing out fine grained delegations without creating a new abstraction | 02:21 |
| jamielennox | what's the case for it | 02:22 |
| jamielennox | i understand if you wanted something like that in the form of trusts where you are just handing something off | 02:22 |
| ayoung | To limit exposure. Right now, the roles are so wide ranging, we basically have "admin" and "member" | 02:22 |
| jamielennox | obviously it would help with interception | 02:22 |
| jamielennox | but you're talking about having the user limit there own abilities | 02:23 |
| jamielennox | i can see the case for service users but service users should be able to do that via roles | 02:23 |
| ayoung | I think that it makes sense for trusts and oauth | 02:23 |
| jamielennox | i guess it could be used setting up like a heat workflow | 02:24 |
| ayoung | but tokens are themselves a form of delegation. So, for instance, you could pass to Nova the ability to fetch something out of glance, but not write to it | 02:24 |
| ayoung | jamielennox, a way of implementing https://blog-nkinder.rhcloud.com/?p=101 | 02:24 |
| *** hipster has quit IRC | 02:25 | |
| ayoung | It might be easier than doing "stacked policy" too | 02:25 |
| *** xianghui has joined #openstack-keystone | 02:27 | |
| jamielennox | hmm, that's kind of a hard thing to enforce generically | 02:28 |
| jamielennox | checking apis | 02:28 |
| jamielennox | what about you change how you look at it, and you make a specific delegation token | 02:29 |
| jamielennox | a delegation token is a token that cannot be used directly for auth but is used in conjunction with another token | 02:30 |
| jamielennox | so for example you communicate to nova, nova must send both the nova token and the delegated token to glance | 02:30 |
| jamielennox | then you can do permission enforcement on glance based on the conjunction | 02:30 |
| jamielennox | hmm | 02:30 |
| jamielennox | hmm - that doesn't rreally work because everything is a delegation token, you can't start the process | 02:31 |
| ayoung | I was thinking along those lines, or just hand nova abunch of tokens, and each one can be used only once | 02:34 |
| ayoung | or a limitd number of times, and then gets stuck in the revocation list | 02:34 |
| ayoung | Instead of one big token, you just have a bunch of tiny ones...or something | 02:35 |
| ayoung | jamielennox, the idea is a role is a big thing, and that operations are based on a subset of the capabilites of a role. We could make roles more fine grainied, but I would think that they should still be descriptive: 'Observer' for someone with readonly access, for example. | 02:39 |
| jamielennox | right, my problem is that we push all this onto the user | 02:40 |
| ayoung | Each of the tasks that Heat has to do would then have a separate trust, with a token listing exactly the operations that the task has to perform | 02:40 |
| jamielennox | adminstrators have this knowledge - the users really don't /shouldn't | 02:40 |
| ayoung | well, no, we would need to provide tooling before this would be usable | 02:40 |
| jamielennox | so things that exist in policy i'm happy to do, but this has you asking for a specific style of token ahead of time | 02:41 |
| ayoung | and the users should get a template for atoken | 02:41 |
| *** mberlin1 has joined #openstack-keystone | 02:43 | |
| ayoung | It limits the exposure on a compute node. So, launching a VM needs to hook that VMs nic up with a port set up by Neutron. But the user already set up the port. Its just the final link that needs to be done by the hypervisor. One and done. And then, if that Hypervisor is compromised, there is not a token left there that can be abused | 02:43 |
| ayoung | Nova api or scheduler could even provide an api to craft the token request on behalf of the user | 02:43 |
| *** morganfainberg is now known as morganfainberg_Z | 02:43 | |
| *** mberlin has quit IRC | 02:44 | |
| jamielennox | we are getting back to a lot of load on keystone | 02:44 |
| ayoung | nope. still done in one token generation call. | 02:44 |
| ayoung | we could even use one token, it just could only be used a limited number of times per endpoint | 02:45 |
| ayoung | say the token is bound to nova, glance, and neutron, with a count of 1 for glance and neutron. Glance performs the download, and then sticks the token in the revocation tree | 02:45 |
| ayoung | its still valid on neutron, just not on glance | 02:45 |
| harlowja_ | ayoung jamielennox do u guys have a check to comment on https://review.openstack.org/#/c/88419/ (maybe when u are free) | 02:48 |
| harlowja_ | i'd like to make sure the domain format is right | 02:49 |
| *** radez is now known as radez_g0n3 | 02:49 | |
| harlowja_ | *see phils comment in that review, i guess we were supposed to find u at the summit but that didn't happen :) | 02:49 |
| jamielennox | harlowja_: why are you exposing domains? | 02:50 |
| harlowja_ | i'm fine with just user,project, but i'd suspect domain would be useful for certain cases (if say juju needs it/could use it) | 02:51 |
| jamielennox | harlowja_: domain should really not need to be expose beyond keystone | 02:52 |
| harlowja_ | k | 02:53 |
| jamielennox | same with from the comments project_domain_name etc all that is a product of using names which aren't unique | 02:54 |
| harlowja_ | can u add that to the review, phil i think thought domain would be useful | 02:54 |
| harlowja_ | sure, names not always unique, but unique at some companies ;) | 02:54 |
| harlowja_ | but agreed, in general they aren't unique | 02:55 |
| *** gabrielb has joined #openstack-keystone | 02:57 | |
| jamielennox | harlowja_: ok added some comments | 03:00 |
| harlowja_ | thx | 03:00 |
| jamielennox | in general i think you only want the user_id and either the domain_id or the project_id depending on what the token is scoped to | 03:00 |
| *** gokrokve_ has joined #openstack-keystone | 03:00 | |
| *** schofield_away has joined #openstack-keystone | 03:01 | |
| harlowja_ | ya, in this case there wouldn't be a token (the metadata is accessible from the things inside the vm), i wouldn't think they'd have the token provided to them but would have to go get one | 03:01 |
| harlowja_ | and this is partially about providing those things enough information to go get one | 03:02 |
| harlowja_ | *one of the usages of it is this* | 03:02 |
| harlowja_ | *other is to provide services that startup in the vm who the vm was created by (for various downstream services) | 03:02 |
| *** xianghui has quit IRC | 03:03 | |
| *** gabrielbezerra has quit IRC | 03:03 | |
| *** anteaya has quit IRC | 03:03 | |
| *** Camisa has quit IRC | 03:03 | |
| *** schofield has quit IRC | 03:03 | |
| *** Camisa has joined #openstack-keystone | 03:03 | |
| *** Camisa has quit IRC | 03:03 | |
| *** Camisa has joined #openstack-keystone | 03:03 | |
| *** schofield_away is now known as schofield | 03:03 | |
| *** Camisa has quit IRC | 03:03 | |
| *** Camisa has joined #openstack-keystone | 03:04 | |
| ayoung | jamielennox, when you get a chance, this one is kindof high priority https://review.openstack.org/#/c/94470/4 | 03:04 |
| ayoung | jamielennox, bknudson and I are both authors on it, so there is a shrinking pool of core reviewers | 03:04 |
| *** Camisa is now known as Guest85258 | 03:04 | |
| *** xianghui has joined #openstack-keystone | 03:05 | |
| *** anteaya has joined #openstack-keystone | 03:05 | |
| jamielennox | but i didn't get through the whole proposal - this is just the general advice | 03:06 |
| jamielennox | ayoung: ergh, ldap | 03:08 |
| *** serverascode has quit IRC | 03:08 | |
| *** gokrokve has quit IRC | 03:09 | |
| *** serverascode has joined #openstack-keystone | 03:10 | |
| *** hipster has joined #openstack-keystone | 03:10 | |
| ayoung | jamielennox, we've had bknudson jdennis nkinder and myself all working on this...its pretty well beat on | 03:11 |
| nkinder | ayoung, jamielennox: yeah, I can answer any questions on it | 03:11 |
| ayoung | nkinder, I'm looking at the https://review.openstack.org/#/c/94513/6/keystone/common/ldap/core.py,cm and it looks prety straight forward | 03:12 |
| ayoung | nkinder, "each AVA of the RDNs must be the equal for the same attribute type. The | 03:14 |
| ayoung | order isn't significant. " why is that? | 03:14 |
| *** sbfox has joined #openstack-keystone | 03:14 | |
| nkinder | ayoung: that's referring to multiple RDNs, for example... | 03:14 |
| nkinder | ayoung: dn: cn=foo+cn=bar,dc=example,dc=com | 03:14 |
| nkinder | that is equivalent to "cn=bar+cn=foo,dc=example,dc=com" | 03:15 |
| ayoung | nkinder, so cn=foo+cn=bar == cn=bar+cn=foo ? | 03:15 |
| ayoung | LDAP is lovely | 03:15 |
| ayoung | nkinder, we really need to get jdennis code upstream. How many times do you think this has been miswritten in Python alone? | 03:16 |
| nkinder | ayoung: my guess is most people just do upper()/lower() and a string comparison | 03:17 |
| nkinder | ayoung: well, it's multiple naming attributes (not one) | 03:17 |
| nkinder | so the order doesn't matter | 03:17 |
| nkinder | ayoung: it's not commonly used | 03:18 |
| jamielennox | nkinder, ayoung: so why delete the test? | 03:20 |
| nkinder | jamielennox: it was previously overriden for ldap | 03:20 |
| nkinder | jamielennox: as it behaved differently. This makes it behave the same as SQL, so the test override was removed | 03:20 |
| *** gokrokve_ has quit IRC | 03:21 | |
| *** boris-42 has quit IRC | 03:23 | |
| jamielennox | so the thing i find weird here is that they've overriden the test which means someone somewhere knew that LDAP behaved differently to SQL | 03:23 |
| jamielennox | the actual LDAP change doesn't seem so bad | 03:23 |
| *** sbfox has quit IRC | 03:24 | |
| nkinder | jamielennox: I thinkit was overridden by the SQL patch, which landed this morning (let me check) | 03:27 |
| nkinder | jamielennox: yep - https://review.openstack.org/#/c/94396/ | 03:28 |
| nkinder | jamielennox: "someone" in this case was bknudson, so he knew it was different since he split the SQL and LDAP work today. | 03:28 |
| *** dstanek is now known as dstanek_zzz | 03:29 | |
| *** dstanek_zzz is now known as dstanek | 03:29 | |
| *** boris-42 has joined #openstack-keystone | 03:29 | |
| jamielennox | nkinder: so how does that review fix the bug? i can read the sql one easily enough | 03:37 |
| jamielennox | but the review would seem to make use (correctly) of the underlying comparison functions | 03:37 |
| jamielennox | but it is the same set of comparisons being made | 03:37 |
| ayoung | jamielennox its in the order of comparisons | 03:38 |
| ayoung | line 92 | 03:38 |
| nkinder | jamielennox: you are looing at this, right? https://review.openstack.org/#/c/94470/4/keystone/assignment/backends/ldap.py | 03:38 |
| ayoung | instead of comparing two ids, we compare two dns | 03:38 |
| ayoung | it used to be self.user._dn_to_id(a.user_dn) | 03:39 |
| jamielennox | nkinder: yes | 03:39 |
| ayoung | which is an id. But the id looses the context. the DN makes sure a user and a group are distinct in this case | 03:39 |
| nkinder | jamielennox: ok, so the original code did a string comparison of the id | 03:40 |
| nkinder | jamielennox: in this case, the id was just an attribute value from ldap like "foo" | 03:40 |
| jamielennox | ayoung: right, but ignoring the subtleties of ldap dn's hte actual operations would apear the same | 03:41 |
| *** praneshp has quit IRC | 03:41 | |
| nkinder | jamielennox: attribute.user_dn contains both user and group DNs | 03:41 |
| nkinder | ...this is despite the face that it's named attribute.user_dn | 03:41 |
| nkinder | s/face/fact/ | 03:41 |
| ayoung | jamielennox, so the id would be ayoung, whereas the dn would be uid=ayoiung,ou=users.... | 03:41 |
| nkinder | so "cn=foo,ou=groups,..." and "cn=foo,ou=users,..." drops the rest of the DN. Calling dn_to_id() makes them both plain "foo". | 03:42 |
| jamielennox | ah | 03:42 |
| nkinder | yeah | 03:42 |
| nkinder | so we just compare the DN, as we have the user DN, and the assignment has a full DN already too. | 03:43 |
| nkinder | jamielennox: ...but, the comparison needs to be smarter than just a string comparison, hence this patch - https://review.openstack.org/#/c/94513/ | 03:43 |
| ayoung | jamielennox, I wrote the original comparitor when there was only users, and it didn't get updated when we added groups. Notice that the groups code was already this way, we just updated from a string compare to a DN compare | 03:44 |
| nkinder | yeah, string compare has issues with things like ',' characters in the attribute value used for id | 03:45 |
| nkinder | that's why we need all of the new DN comparison stuff from the other patch | 03:45 |
| jamielennox | yep, i knew string compare was not right here - though often used | 03:46 |
| jamielennox | alright, +2ed | 03:47 |
| *** stevemar has joined #openstack-keystone | 03:47 | |
| nkinder | jamielennox: please take a look at the chain of patches it depends on | 03:48 |
| nkinder | jamielennox: the DN compare one might seem a bit complex since you're not super familiar with LDAP, but it's not too bad | 03:48 |
| jamielennox | well LDAP names are the same concept as x509 names, so i know the basics | 03:49 |
| jamielennox | (well vice versa) | 03:50 |
| jamielennox | didn't jdennis write a file almost exactly like this ages ago? | 03:51 |
| jamielennox | he had one for der/pem, i thought he had one for ldap as well | 03:51 |
| *** hipster has quit IRC | 03:55 | |
| *** stevemar has quit IRC | 04:15 | |
| *** gokrokve has joined #openstack-keystone | 04:20 | |
| *** marcoemorais has joined #openstack-keystone | 04:21 | |
| *** Abhijeet has joined #openstack-keystone | 04:29 | |
| *** marcoemorais1 has joined #openstack-keystone | 04:32 | |
| *** marcoemorais has quit IRC | 04:34 | |
| ayoung | jamielennox, yes, he did it for FreeIPA, and I want him to resubmit it for Keystone....actually, we were saying it should go to upstream python-ldap | 04:36 |
| ayoung | and...goodnight | 04:36 |
| *** ayoung has quit IRC | 04:36 | |
| *** gokrokve has quit IRC | 04:38 | |
| *** gokrokve has joined #openstack-keystone | 04:44 | |
| *** gokrokve has quit IRC | 04:47 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Check that the user is dumb moved to the common method https://review.openstack.org/88517 | 04:48 |
| *** daneyon has joined #openstack-keystone | 04:48 | |
| *** daneyon has quit IRC | 04:51 | |
| *** daneyon has joined #openstack-keystone | 04:52 | |
| *** gokrokve has joined #openstack-keystone | 05:14 | |
| *** harlowja_ is now known as harlowja_away | 05:17 | |
| *** dstanek is now known as dstanek_zzz | 05:23 | |
| *** daneyon has quit IRC | 05:27 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Check that the user is dumb moved to the common method https://review.openstack.org/88517 | 05:32 |
| *** ukalifon has joined #openstack-keystone | 05:39 | |
| *** praneshp has joined #openstack-keystone | 05:55 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/90288 | 06:00 |
| *** fin09pcap has joined #openstack-keystone | 06:06 | |
| *** dstanek_zzz is now known as dstanek | 06:14 | |
| *** fin09pcap has quit IRC | 06:15 | |
| *** dstanek is now known as dstanek_zzz | 06:24 | |
| *** gokrokve has quit IRC | 06:31 | |
| *** AJaeger has left #openstack-keystone | 06:33 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/91240 | 07:12 |
| *** dstanek_zzz is now known as dstanek | 07:15 | |
| *** BAKfr has joined #openstack-keystone | 07:16 | |
| *** Guest85258 has quit IRC | 07:17 | |
| *** praneshp has quit IRC | 07:23 | |
| *** Abhijeet has quit IRC | 07:23 | |
| *** dstanek is now known as dstanek_zzz | 07:25 | |
| *** Guest85258 has joined #openstack-keystone | 07:27 | |
| *** leseb has joined #openstack-keystone | 07:45 | |
| *** dstanek_zzz is now known as dstanek | 07:54 | |
| *** henrynash has joined #openstack-keystone | 08:00 | |
| *** dstanek is now known as dstanek_zzz | 08:04 | |
| *** dstanek_zzz is now known as dstanek | 08:07 | |
| *** dstanek is now known as dstanek_zzz | 08:17 | |
| *** afazekas_wfp has joined #openstack-keystone | 08:22 | |
| *** d0ugal_ has joined #openstack-keystone | 08:29 | |
| *** jamielennox is now known as jamielennox|away | 08:37 | |
| *** d0ugal_ has quit IRC | 08:39 | |
| *** henrynash has quit IRC | 08:42 | |
| *** d0ugal_ has joined #openstack-keystone | 08:46 | |
| *** andreaf has joined #openstack-keystone | 08:54 | |
| *** marcoemorais1 has quit IRC | 09:03 | |
| *** d0ugal_ has quit IRC | 09:05 | |
| *** dstanek_zzz is now known as dstanek | 09:08 | |
| *** afazekas_wfp is now known as afazekas | 09:11 | |
| *** d0ugal_ has joined #openstack-keystone | 09:14 | |
| *** d0ugal_ has quit IRC | 09:17 | |
| *** dstanek is now known as dstanek_zzz | 09:18 | |
| *** d0ugal_ has joined #openstack-keystone | 09:22 | |
| *** d0ugal has quit IRC | 09:22 | |
| *** d0ugal_ is now known as d0ugal | 09:22 | |
| *** d0ugal has quit IRC | 09:25 | |
| *** d0ugal has joined #openstack-keystone | 09:25 | |
| *** henrynash has joined #openstack-keystone | 09:34 | |
| *** henrynash_ has joined #openstack-keystone | 09:41 | |
| *** henrynash has quit IRC | 09:43 | |
| *** henrynash_ is now known as henrynash | 09:43 | |
| *** dstanek_zzz is now known as dstanek | 10:08 | |
| *** dstanek is now known as dstanek_zzz | 10:18 | |
| *** dstanek_zzz is now known as dstanek | 11:04 | |
| *** xianghui has quit IRC | 11:21 | |
| *** radez_g0n3 is now known as radez | 11:44 | |
| *** radez is now known as radez_g0n3 | 11:44 | |
| *** radez_g0n3 is now known as radez | 11:44 | |
| *** dims has joined #openstack-keystone | 11:53 | |
| *** afaranha has left #openstack-keystone | 11:55 | |
| *** erecio has joined #openstack-keystone | 11:58 | |
| *** rodrigods has joined #openstack-keystone | 12:00 | |
| *** stevemar has joined #openstack-keystone | 12:06 | |
| *** diegows has joined #openstack-keystone | 12:18 | |
| *** dstanek is now known as dstanek_zzz | 12:30 | |
| *** gordc has joined #openstack-keystone | 12:34 | |
| *** rodrigods_ has joined #openstack-keystone | 12:38 | |
| *** afaranha has joined #openstack-keystone | 12:39 | |
| afaranha | Hello, does anyone got this error using keystoneclient in python? http://paste.openstack.org/show/81145/ | 12:39 |
| afaranha | the error is NotFound: The resource could not be found. (HTTP 404) | 12:39 |
| *** rodrigods_ has quit IRC | 12:39 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/identity-api: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/60489 | 12:41 |
| *** ayoung has joined #openstack-keystone | 12:41 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/identity-api: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/60489 | 12:43 |
| *** dstanek_zzz is now known as dstanek | 12:45 | |
| rodrigods | ayoung, saw your comments, have some questions about them. I'll catch up with you later, ok? | 12:53 |
| ayoung | rodrigods, now is ok | 12:53 |
| ayoung | rodrigods, so in general, you don't want to do string manipulations on things like URLs | 12:54 |
| ayoung | there are libraries that do it "right" and we have them | 12:54 |
| rodrigods | ayoung, yeah, I agree. I tried to use urllib.parse.urlencode | 12:54 |
| ayoung | if we had made sensible parameters for the role_assignments it would have worked | 12:54 |
| ayoung | I'd try doing this | 12:54 |
| ayoung | user = {"id": user_id} and see what happends | 12:54 |
| ayoung | happends | 12:55 |
| ayoung | happens | 12:55 |
| * ayoung smarter than keyboard. No me not | 12:55 | |
| rodrigods | ayoung, i know... the issue is with queries without a value | 12:55 |
| ayoung | henrynash, ^^ is your mess. why does role_assignments do params like user.id | 12:55 |
| rodrigods | like the "effective" one for /role_assingments | 12:55 |
| ayoung | hmmm | 12:55 |
| ayoung | so does the dictionary approach work for the others? | 12:56 |
| rodrigods | ayoung, yeah, that's why I'm first using urllib.parse.urlencode for the regular ones | 12:57 |
| ayoung | cool | 12:57 |
| ayoung | there must be something in it for effective | 12:57 |
| rodrigods | ayoung, i tried to find something in the lib that would fit this case, but haven't found =/ | 12:58 |
| *** afazekas is now known as afazekas_mtg | 12:59 | |
| ayoung | is it a true/false thing? | 13:00 |
| rodrigods | yeah | 13:00 |
| rodrigods | but the url accepts just the query key | 13:01 |
| rodrigods | without a value | 13:01 |
| ayoung | What happens if you pass it in =False? http://url?effective=False | 13:01 |
| rodrigods | ayoung, actually I didn't test it =) | 13:02 |
| rodrigods | with effective=true or effective=false | 13:02 |
| rodrigods | but if the positive case works with effective=true we can add the effective key only if the argument is true and do not add it otherwise | 13:03 |
| *** afazekas_mtg has quit IRC | 13:04 | |
| dstanek | stevemar: no details :-( https://blueprints.launchpad.net/keystone/+spec/trusted-attribute-issuing-policy | 13:05 |
| henrynash | ayoung: just on a call, then will look | 13:06 |
| stevemar | dstanek, there is a wiki link under 'full specs' | 13:06 |
| dstanek | stevemar: not much there | 13:08 |
| ayoung | rodrigods, ++ | 13:08 |
| dolphm | we regularly get bugs filed that are red hat packaging issues - where can i direct those people? | 13:09 |
| dstanek | stevemar: i was hoping to at least see how it works with mapping | 13:09 |
| dstanek | dolphm: /dev/null? :-P | 13:09 |
| stevemar | dstanek, that would be nice | 13:09 |
| rodrigods | ayoung, geat, will test this approach, if it works will update the patch | 13:10 |
| dolphm | googling for "rdo bugs" leads to a forum thread of people asking the same question... someone provides a link that seems legit, but it requires login | 13:10 |
| *** thedodd has joined #openstack-keystone | 13:10 | |
| ayoung | dolphm, Bugzilla. I'll get you a link | 13:10 |
| dstanek | stevemar: do you understand what they are trying to do? | 13:10 |
| dolphm | ayoung: https://bugzilla.redhat.com/ ? | 13:10 |
| dolphm | ayoung: or something more specific? | 13:10 |
| ayoung | dolphm, more specific comeing up | 13:11 |
| ayoung | https://bugzilla.redhat.com/enter_bug.cgi?product=RDO | 13:11 |
| ayoung | dolphm, could be Fedora as well, but RDO is probably the right place | 13:12 |
| ayoung | for Fedora it would be https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora | 13:12 |
| dstanek | stevemar: i hate seeing API reviews when there are no code reviews to back it up - smells like BUFD | 13:13 |
| ayoung | dolphm, Component should be openstack-keystone for either | 13:13 |
| ayoung | dstanek, I'm with you on this. | 13:13 |
| dolphm | ayoung: both of those links just get me a login screen | 13:14 |
| ayoung | I'd rather we made everything go in as an extension, then reverse the API doc, and then promote it | 13:14 |
| ayoung | dolphm, I guess I am already logged in | 13:14 |
| ayoung | But don't you need a launchpad login to report bugs upstream in Keystone, too? A Bugzilla account for Red Hat etc packaging is pretty much the norm | 13:15 |
| dolphm | ayoung: our bug database is open at least | 13:15 |
| dolphm | ayoung: but yeah, you need to create an account to file a bug | 13:15 |
| ayoung | dolphm, you can query without a login, just not add | 13:15 |
| dstanek | ayoung: yeah, i feel like once the spec is documented in the API docs it should be available | 13:15 |
| dstanek | you also have the problem of changes needed to the spec because of unforeseen implementation issues | 13:16 |
| *** bknudson has left #openstack-keystone | 13:16 | |
| stevemar | dstanek, apparently they have some code? | 13:16 |
| dolphm | lol if you search bugzilla for RDO bugs, you get an error that says "this list is too long for Red Hat Bugzilla's little mind" | 13:17 |
| ayoung | for example... https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&classification=Community&component=openstack-keystone&list_id=2498066&product=RDO&query_format=advanced | 13:18 |
| *** afazekas_mtg has joined #openstack-keystone | 13:19 | |
| ayoung | dolph ^^ was produced from the Bugzilla search page | 13:19 |
| *** thedodd has quit IRC | 13:19 | |
| ayoung | when I added openstack-keystone as a component | 13:19 |
| ayoung | https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=POST&bug_status=MODIFIED&bug_status=ON_DEV&bug_status=ON_QA&bug_status=VERIFIED&bug_status=RELEASE_PENDING&classification=Community&component=python-keystoneclient&list_id=2498083&product=RDO&query_format=advanced | 13:20 |
| dolphm | that's a really long link lol | 13:20 |
| dolphm | i'm running with https://bugzilla.redhat.com/buglist.cgi?product=RDO | 13:20 |
| ayoung | is pretty much everything for Keystone and client that is in the works | 13:20 |
| ayoung | er... | 13:20 |
| ayoung | dropped keystone.... | 13:21 |
| ayoung | yeah, the links get longer with more query params. Its annoying. We keep a bunch in our internal etherpads for regular discussions | 13:21 |
| ayoung | https://bugzilla.redhat.com/buglist.cgi?classification=Community&component=openstack-keystone&component=python-keystoneclient&list_id=2498100&product=RDO&query_format=advanced | 13:21 |
| ayoung | ^^ drops the status field off, which shows all. Probably can ftrop the &query_format=advanced as well.... | 13:22 |
| ayoung | https://bugzilla.redhat.com/buglist.cgi?classification=Community&component=openstack-keystone&component=python-keystoneclient&list_id=2498100&product=RDO | 13:22 |
| ayoung | list id is also not needed, now that I look | 13:22 |
| ayoung | gets added in though once you search | 13:23 |
| dstanek | stevemar: actually there is some interesting detail hidden in comments https://review.openstack.org/#/c/60489/9/openstack-identity-api/v3/src/markdown/identity-api-v3-os-idp-issuing-policy-ext.md,cm | 13:23 |
| ayoung | https://bugzilla.redhat.com/buglist.cgi?classification=Community&component=openstack-keystone&component=python-keystoneclient&product=RDO | 13:23 |
| ayoung | dolphm, ^^ should be reasonable | 13:23 |
| stevemar | dstanek, ah, i see line 21 has some interesting comments | 13:25 |
| stevemar | dstanek, i'm not keen on the fact that if the list isn't specified, then the mapping fails | 13:27 |
| dstanek | stevemar: what is an untrusted IdP? | 13:28 |
| dstanek | stevemar: the mapping is effectively a while list (similar in concept to a list of trusted attributes) so i don't see the point in the blueprint | 13:29 |
| stevemar | dstanek, i think we already take care of that, by defining idps in /v3/os-federation/identity_providers/{idp} | 13:29 |
| dstanek | if you don't trust the IdP why would you add it? if you don't trust the attribute why would you add a mapping for it? | 13:29 |
| stevemar | dstanek, that's what marekd|away said | 13:30 |
| henrynash | rodrigods: ok, free of my call…can you re-state your issue with role assignment api? | 13:35 |
| *** bknudson has joined #openstack-keystone | 13:37 | |
| *** r-daneel has joined #openstack-keystone | 13:38 | |
| *** nkinder has quit IRC | 13:42 | |
| dolphm | anyone ever tried to append/add Message objects together? | 13:42 |
| lbragstad | dolphm: are you working with translations? i18n stuff? | 13:43 |
| rodrigods | henrynash, is just a question =). Can I use "effective=true", instead of just "effective"? The idea is to use a lib to build the url, and it doesn't handle "valueless" queries | 13:45 |
| henrynash | rodrigods: I think you should be able to yes, let me check quickly for you | 13:45 |
| lbragstad | I know jecarey and jungleboyj (both should be in -dev at some point) did a lot of work with message objects for the i18n translation stuff. | 13:46 |
| lbragstad | so they might have some experience on what you're trying to do | 13:46 |
| henrynash | rodigods: yep, that should work fine | 13:47 |
| dolphm | lbragstad: yes | 13:47 |
| dolphm | lbragstad: trying to merge two translated messages together | 13:47 |
| bknudson | dolphm: my understanding is that if you have a Message with %s and then the sub is a Messsage they'll be recursively translated | 13:48 |
| lbragstad | dolphm: how were you adding them together before? | 13:49 |
| bknudson | e.g., LOG.info(_LI('Message: %s), _LI('Turn off debug you idiot')) | 13:49 |
| dstanek | dolphm: what exactly are you looking to do? | 13:50 |
| bknudson | getting back to https://bugs.launchpad.net/keystone/+bug/1309228 -- | 13:51 |
| uvirtbot | Launchpad bug 1309228 in keystone/icehouse "[OSSA 2014-015] User gets group auth if same id (CVE-2014-0204)" [High,In progress] | 13:51 |
| bknudson | I think I'm going to squash the master changes | 13:51 |
| bknudson | since the OSSA note was already sent out and it only has https://review.openstack.org/94396 and https://review.openstack.org/94470 as the master fixes. | 13:51 |
| bknudson | looks like they all passed tests | 13:53 |
| dolphm | dstanek: pretty much what bknudson just posted | 13:54 |
| dolphm | lbragstad: i'm trying to append a new message | 13:55 |
| dolphm | rather, extend a dynamic message with a static message | 13:55 |
| dolphm | both of which are translated separately | 13:55 |
| bknudson | LOG.info(_LI('%s%s), original_message, _LI('Turn off debug you idiot') if CONF.debug else '') | 13:55 |
| *** joesavak has joined #openstack-keystone | 13:56 | |
| dolphm | bknudson: but i'm not doing it in a LOG call | 13:56 |
| bknudson | _LI('%s%s') % (original_message, _LI(' Turn off debug you idiot') if CONF.debug else '') | 13:58 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: indicate that sensitive messages can be disabled https://review.openstack.org/94871 | 13:58 |
| rodrigods | henrynash, thanks =) | 13:58 |
| dolphm | bknudson: ^ | 13:58 |
| rodrigods | ayoung, will update the patch, hope you give a +2 =) | 13:58 |
| henrynash | rodrigods: np | 13:58 |
| dolphm | bknudson: can i just call translate on them and return the unicode? :-/ | 14:00 |
| bknudson | dolphm: if you know the language to translate to | 14:00 |
| dolphm | bah | 14:00 |
| *** gokrokve has joined #openstack-keystone | 14:01 | |
| bknudson | dolphm: something like - return _('%s%s') % (message or self.message_format % kwargs, amendment or '') | 14:03 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: LDAP fix for get_roles_for_user_and_project user=group ID https://review.openstack.org/94470 | 14:03 |
| bknudson | ^ is the 3 reviews squashed into 1 -- so fixes the problem that was introduced earlier with , in a DN | 14:05 |
| dstanek | stevemar: getting closer! | 14:05 |
| dolphm | bknudson: that failed a bit better, thanks :) | 14:08 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: indicate that sensitive messages can be disabled https://review.openstack.org/94871 | 14:14 |
| dolphm | bknudson: thank you, sir! | 14:14 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: indicate that sensitive messages can be disabled https://review.openstack.org/94871 | 14:15 |
| bknudson | dolphm: thanks for making that change, will make my life easier | 14:15 |
| stevemar | dstanek, getting closer to what? | 14:15 |
| dolphm | bknudson: ha, why? | 14:16 |
| dstanek | stevemar: got a response on my -1 from David | 14:16 |
| bknudson | dolphm: I get the same complaints about sensitive info in the logs when they have debug turned on | 14:20 |
| *** xianghui has joined #openstack-keystone | 14:20 | |
| *** xianghui has quit IRC | 14:21 | |
| dstanek | will y'all kill me if i make a few proposals to *fix* drivers? part of our performance issues are cause by the need to know everything by ID | 14:23 |
| *** afazekas_mtg has quit IRC | 14:24 | |
| *** david-lyle has joined #openstack-keystone | 14:26 | |
| dolphm | dstanek: bp? | 14:27 |
| *** afazekas has joined #openstack-keystone | 14:29 | |
| dstanek | dolphm: i would probably propose a spec - i was hacking on this a bit yesterday so i have a feel for what i want | 14:30 |
| *** nkinder has joined #openstack-keystone | 14:33 | |
| *** browne has joined #openstack-keystone | 14:50 | |
| *** mberlin1 is now known as mberlin | 14:55 | |
| *** thedodd has joined #openstack-keystone | 14:56 | |
| bknudson | dolphm: are we supposed to manually abandon patches? e.g., https://review.openstack.org/#/c/77514/ hasn't been touched for a few week | 15:05 |
| dstanek | bknudson: whoa, Ray Chen is a bit harsh | 15:08 |
| bknudson | dstanek: I wonder where he's getting assertEqual(first, second, msg=None) -- I guess from python docs rather than testtools. | 15:19 |
| dstanek | bknudson: yes, the Python docs don't care about order | 15:20 |
| bknudson | https://review.openstack.org/94470 passed jenkins so if people want to review it -- it's for security fix | 15:23 |
| dstanek | bknudson: the rationale i was given a while back is that testtools expects that order to make messages nicer, but it appears that they don't use this ordering in their own docs | 15:25 |
| bknudson | dstanek: I thought the code was the docs? | 15:26 |
| bknudson | https://github.com/testing-cabal/testtools/blob/master/testtools/testcase.py#L313 | 15:26 |
| *** packet has joined #openstack-keystone | 15:27 | |
| dstanek | bknudson: interesting here http://testtools.readthedocs.org/en/latest/for-test-authors.html they sometimes use the constant first and other time second | 15:27 |
| bknudson | dstanek: -1 on their docs. | 15:28 |
| bknudson | I'm going to use this -- http://testtools.readthedocs.org/en/latest/for-test-authors.html#testcase-patch | 15:29 |
| *** richm has joined #openstack-keystone | 15:33 | |
| openstackgerrit | Juan Manuel Ollé proposed a change to openstack/keystone: Adding Role for an unexisting user should fail. https://review.openstack.org/93982 | 15:36 |
| *** juanmo has joined #openstack-keystone | 15:38 | |
| *** stevemar has quit IRC | 15:38 | |
| *** daneyon has joined #openstack-keystone | 15:44 | |
| *** daneyon has quit IRC | 15:47 | |
| *** dstanek is now known as dstanek_zzz | 15:47 | |
| *** daneyon has joined #openstack-keystone | 15:47 | |
| *** bknudson has quit IRC | 16:00 | |
| *** sbfox has joined #openstack-keystone | 16:02 | |
| *** BAKfr has quit IRC | 16:04 | |
| *** bknudson has joined #openstack-keystone | 16:05 | |
| *** marcoemorais has joined #openstack-keystone | 16:06 | |
| *** gokrokve has quit IRC | 16:10 | |
| *** gokrokve has joined #openstack-keystone | 16:12 | |
| *** amcrn has joined #openstack-keystone | 16:13 | |
| *** dstanek_zzz is now known as dstanek | 16:16 | |
| *** gyee has joined #openstack-keystone | 16:17 | |
| *** afazekas has quit IRC | 16:22 | |
| *** gokrokve has quit IRC | 16:24 | |
| *** daneyon has quit IRC | 16:25 | |
| *** henrynash has quit IRC | 16:25 | |
| *** BAKfr has joined #openstack-keystone | 16:29 | |
| *** henrynash has joined #openstack-keystone | 16:30 | |
| *** sbfox has quit IRC | 16:30 | |
| *** leseb has quit IRC | 16:32 | |
| *** praneshp has joined #openstack-keystone | 16:38 | |
| *** sbfox has joined #openstack-keystone | 16:43 | |
| ayoung | nkinder, lets say a user authenticates to Horizon using SAML, and then, in order to get a Keystone token on behalf of the user, Horizon had to provide the origianl SAML assertion along with its request. The resulting exposue would be the same as S4U2Proxy, right? | 16:44 |
| ayoung | assuming, of course, that the origianl SAML assertion was somehow specified to be used on Horizon in the first place | 16:46 |
| ayoung | <saml:Audience>https://appname.younglogic.com</saml:Audience> | 16:46 |
| ayoung | from http://adam.younglogic.com/resources/adam_example.saml | 16:46 |
| ayoung | nkinder, and openid connect is similar in its approach: http://openid.net/specs/openid-connect-basic-1_0.html#IDToken | 16:50 |
| *** praneshp has left #openstack-keystone | 16:50 | |
| *** praneshp has joined #openstack-keystone | 16:51 | |
| openstackgerrit | Matt Fischer proposed a change to openstack/python-keystoneclient: Add support for extensions-list https://review.openstack.org/92978 | 16:51 |
| *** dstanek is now known as dstanek_zzz | 16:53 | |
| *** harlowja_away is now known as harlowja_ | 16:54 | |
| *** dstanek_zzz is now known as dstanek | 17:00 | |
| ukalifon | ayoung: a little off-topic: If I use a token to get another token, should the new token provide me the same privilages? It seems like it gives me none whatsoever. I get "forbidden" on everything. | 17:03 |
| ayoung | its personal | 17:03 |
| ayoung | did you ask for a new token with any scope? | 17:03 |
| ukalifon | no there was no scope in the request | 17:04 |
| ayoung | then you got back an unscoped token | 17:05 |
| *** nkinder_ has joined #openstack-keystone | 17:05 | |
| *** nkinder_ has quit IRC | 17:05 | |
| ukalifon | ayoung: should I ask for a token that has the same scope as the original? Does an "unscoped token" mean "no privilages"? | 17:07 |
| ayoung | no reason to do that | 17:07 |
| ayoung | it won';t have a long life span | 17:07 |
| ayoung | Horizon currently only holds a token for the current project | 17:07 |
| ayoung | Ideally, they would not do that, but its where we are today: | 17:07 |
| *** Guest85258 has quit IRC | 17:11 | |
| *** Camisa has joined #openstack-keystone | 17:11 | |
| *** Camisa has joined #openstack-keystone | 17:11 | |
| *** gokrokve has joined #openstack-keystone | 17:21 | |
| *** dims has quit IRC | 17:24 | |
| openstackgerrit | A change was merged to openstack/keystone: Fix version links to docs.openstack.org https://review.openstack.org/92653 | 17:39 |
| *** cds has joined #openstack-keystone | 17:41 | |
| *** gyee has quit IRC | 17:53 | |
| *** sbfox has quit IRC | 18:00 | |
| *** sbfox has joined #openstack-keystone | 18:01 | |
| *** dstanek is now known as dstanek_zzz | 18:01 | |
| *** morganfainberg_Z is now known as morganfainberg | 18:02 | |
| nkinder | ukalifon: this describes how authenticating with a token works (along with unscoped tokens) - https://blog-nkinder.rhcloud.com/?p=101 | 18:02 |
| nkinder | ukalifon: it also explains how I think it should be changed in the future. | 18:02 |
| *** dstanek_zzz is now known as dstanek | 18:03 | |
| ukalifon | thanks | 18:03 |
| *** erecio_1 has joined #openstack-keystone | 18:04 | |
| morganfainberg | ayoung, dolphm, we have a specs repo http://git.openstack.org/cgit/openstack/identity-specs/tree/ | 18:04 |
| morganfainberg | ayoung, dolphm, I'll get the base structure in place as a review shortly. | 18:04 |
| morganfainberg | bknudson, nkinder, henrynash, dstanek, lbragstad, ^ | 18:04 |
| ayoung | morganfainberg, take my repo as a starting state? | 18:04 |
| openstackgerrit | A change was merged to openstack/keystone: Reduce log noise on expired tokens https://review.openstack.org/93801 | 18:05 |
| morganfainberg | ayoung, was going to look at yours specifically as part of that basis | 18:05 |
| bknudson | looks pretty sparse | 18:05 |
| ayoung | cool. you might not want the whole history | 18:05 |
| henrynash | morganfainberg: yeeha! | 18:05 |
| nkinder | morganfainberg: great! | 18:05 |
| ayoung | morganfainberg, for example, I have a revert commit in mine you should probably squash | 18:05 |
| lbragstad | morganfainberg: awesome! | 18:05 |
| *** juanmo1 has joined #openstack-keystone | 18:05 | |
| morganfainberg | ayoung, exactly, plus need to get the right structure for ksc | 18:05 |
| *** juanmo has quit IRC | 18:06 | |
| ayoung | morganfainberg, so, we have no grouping mechanism for client specs | 18:06 |
| morganfainberg | all current keystone core are core on the spec repo. | 18:06 |
| *** erecio has quit IRC | 18:06 | |
| ayoung | we don;t target a specific release, so...maybe just "active and implemented" | 18:06 |
| morganfainberg | ayoung, the idea is we will have a "Keystone Client" named repo, and when we release we move implemented BPs to the numbered release | 18:06 |
| ayoung | separate repo? | 18:07 |
| morganfainberg | ayoung, same repo, separate dir | 18:07 |
| ayoung | ok, yeah, that was what I was saying | 18:07 |
| morganfainberg | specs/identity/keystoneclient/<release #>/bp | 18:07 |
| ayoung | morganfainberg, so I can post the whole repo for review.... | 18:07 |
| morganfainberg | ayoung, yours is on github right? | 18:08 |
| ayoung | morganfainberg, https://github.com/admiyo/keystone-specs/ | 18:09 |
| *** ukalifon has quit IRC | 18:10 | |
| morganfainberg | ayoung, do we need a separate template for ksc? | 18:11 |
| ayoung | morganfainberg, how about: eventually? | 18:11 |
| ayoung | like, not right up front, but we should | 18:11 |
| morganfainberg | ayoung, works for me. also there are still some "nova" isms in your template | 18:12 |
| ayoung | the JSON-Schema one had no analog | 18:12 |
| morganfainberg | right. | 18:12 |
| morganfainberg | do we want to keep that in there? it doesn't really make sense at the moment | 18:12 |
| bknudson | keystone should be doing input validation | 18:12 |
| ayoung | morganfainberg, my question was, since it started with the Nova one, should we keep the git history to give credit? | 18:13 |
| morganfainberg | ayoung, too late for that :P | 18:13 |
| *** andreaf has quit IRC | 18:13 | |
| ayoung | Nope | 18:13 |
| ayoung | We could do a merge from the nova repo | 18:13 |
| morganfainberg | ayoung, at this point we'd need to have infra intervene on that, usually you specify a source for the repo when they create it to preserve history | 18:14 |
| morganfainberg | ayoung, gerrit workflow iirc doesn't like people pushing merge commits in | 18:14 |
| ayoung | morganfainberg, if we can commit, we can do it | 18:14 |
| ayoung | but...I can just copy the files over and the initial commit can point to the nova repo | 18:14 |
| bknudson | I think there's different permissions for merge and fast-forward pushes | 18:14 |
| morganfainberg | bknudson, ++ | 18:15 |
| morganfainberg | bknudson, there are, I run a gerrit server today | 18:15 |
| ayoung | morganfainberg, there are 116 commits including mine | 18:17 |
| *** sbfox has quit IRC | 18:17 | |
| morganfainberg | ayoung, example https://github.com/openstack/tripleo-specs another project did it independantly | 18:17 |
| morganfainberg | ayoung, i am fairly certain we can't do a merge commit through gerrit. it complains. | 18:18 |
| openstackgerrit | Matt Fischer proposed a change to openstack/python-keystoneclient: Add support for extensions-list https://review.openstack.org/92978 | 18:20 |
| morganfainberg | ayoung, are you proposing the initial commit or should I? (doesn't matter to me) | 18:23 |
| ayoung | morganfainberg, your call...you have more access to the git repo than I do, as I need to work through gerrit, right? | 18:24 |
| *** dims has joined #openstack-keystone | 18:24 | |
| morganfainberg | ayoung, we have equal access. it has to go through gerrit no matter what | 18:25 |
| *** sbfox has joined #openstack-keystone | 18:25 | |
| ayoung | morganfainberg, You have my repo: reset HEAD to Converted from Nova to Keystone and push, would be my suggestion | 18:26 |
| morganfainberg | ayoung, ++ will propose you can review then. | 18:26 |
| ayoung | morganfainberg, that is 116 patches... | 18:26 |
| openstackgerrit | Rodrigo Duarte Sousa proposed a change to openstack/python-keystoneclient: Add /role_assignments endpoint support https://review.openstack.org/91578 | 18:26 |
| morganfainberg | ayoung, i'm squashing it all. | 18:26 |
| ayoung | alternatively, I can squash and propse | 18:26 |
| ayoung | ok...do that | 18:27 |
| morganfainberg | ayoung, :) | 18:27 |
| ayoung | morganfainberg, it feels wrong, why not ask if there is a way we can do the fork from nova? | 18:27 |
| rodrigods | ayoung, ^^ | 18:30 |
| ayoung | rodrigods, looks much better | 18:31 |
| ayoung | rodrigods, have you attempted to use this from a script yet? | 18:32 |
| rodrigods | ayoung, effective=True? Or the general feature? | 18:32 |
| ayoung | the whole parameter thing, especiall effective | 18:33 |
| *** dstanek is now known as dstanek_zzz | 18:33 | |
| rodrigods | ayoung, yeah... I have a patch in Horizon that already uses this =) | 18:33 |
| *** htruta has joined #openstack-keystone | 18:33 | |
| vhoward | can anyone help point me in the right direction to figure out how to break out my own identity driver for ldap auth so that it can be seperate from the main keystone code base? i'm a bit lost and so far added our own subclass in the keystone/identity directory with a custom name…probably totally wrong lol | 18:33 |
| ayoung | rodrigods, a stand alone script would be very nice | 18:34 |
| rodrigods | ayoung, https://review.openstack.org/#/c/92412/ | 18:34 |
| ayoung | separate patch, or even a paste | 18:34 |
| *** amcrn_ has joined #openstack-keystone | 18:34 | |
| rodrigods | ayoung, ok, will write it here =) | 18:34 |
| *** praneshp_ has joined #openstack-keystone | 18:35 | |
| ayoung | rodrigods, but you've tested it with horizon, which is what I cared about | 18:35 |
| *** amcrn has quit IRC | 18:35 | |
| rodrigods | ayoung, and also: https://review.openstack.org/#/c/91634/2 | 18:37 |
| *** praneshp has quit IRC | 18:37 | |
| *** praneshp_ is now known as praneshp | 18:37 | |
| rodrigods | ayoung, but if you need a standalone script, I can write one here | 18:37 |
| ayoung | rodrigods, please do, but I won't delay review for it. | 18:38 |
| *** erecio_1 has quit IRC | 18:38 | |
| ayoung | rodrigods, now get stevemar to back up his review with a +2 | 18:39 |
| *** erecio_1 has joined #openstack-keystone | 18:39 | |
| *** erecio_1 has quit IRC | 18:40 | |
| *** erecio_1 has joined #openstack-keystone | 18:41 | |
| rodrigods | ayoung, great!!! thanks for your feedback | 18:41 |
| rodrigods | ayoung, will provide a script in a few minutes | 18:41 |
| *** ukalifon1 has joined #openstack-keystone | 18:41 | |
| raildo1 | ayoung: what do i need to review a patch with a +2? hahaha | 18:50 |
| ayoung | raildo1, first, find a patch that already has a +2 | 18:50 |
| nkinder | bknudson: did you mean to change something in patch 5 for https://review.openstack.org/#/c/94470 ? | 18:56 |
| nkinder | bknudson: it looks the same as patch 4. We're you intending to remove the comment about AD? | 18:57 |
| bknudson | nkinder: it's got all the other changes squashed | 18:57 |
| bknudson | nkinder: I forgot to remove the comment | 18:57 |
| bknudson | nkinder: I squashed the changes because there was already an OSSA note sent out saying that the fix for icehouse is in https://review.openstack.org/#/c/94470 | 18:58 |
| bknudson | oops, the fix for juno | 18:58 |
| nkinder | bknudson: ok | 18:58 |
| bknudson | I'd remove the comment in a separate review at this point | 18:58 |
| nkinder | bknudson: yeah, let's put this one to bed | 18:59 |
| *** leseb has joined #openstack-keystone | 19:06 | |
| *** ukalifon1 has quit IRC | 19:10 | |
| ayoung | morganfainberg, can you pull the trigger on https://review.openstack.org/#/c/94470/5 ? | 19:12 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/identity-specs: Initial Commit for Identity-specs repo https://review.openstack.org/94987 | 19:20 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/identity-specs: Initial Commit for Identity-specs repo https://review.openstack.org/94987 | 19:23 |
| *** dstanek_zzz is now known as dstanek | 19:24 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/identity-specs: Initial Commit for Identity-specs repo https://review.openstack.org/94987 | 19:27 |
| *** gordc has left #openstack-keystone | 19:29 | |
| *** serverascode has quit IRC | 19:35 | |
| *** serverascode has joined #openstack-keystone | 19:37 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/identity-specs: Initial Commit for Identity-specs repo https://review.openstack.org/94987 | 19:40 |
| rodrigods | ayoung, here sir: http://paste.openstack.org/show/81180/ | 19:41 |
| morganfainberg | ok initial specs repo commit ready for review. | 19:41 |
| ayoung | rodrigods, very nice. submit it and we'll review it. Put it in python-keystoneclient/examples/scripts. Feel free to tag as a WIP if you are not ready for it to be prime time | 19:42 |
| ayoung | morganfainberg, you rock, sir. | 19:42 |
| morganfainberg | ayoung, there is something wonky in the doc build though | 19:42 |
| morganfainberg | ayoung, http://docs-draft.openstack.org/87/94987/4/check/gate-identity-specs-docs/7932a12/doc/build/html/ doesn't look "right" | 19:42 |
| ayoung | morganfainberg, what looks off? What am I looking for? | 19:43 |
| morganfainberg | ayoung, look at the header | 19:44 |
| ayoung | morganfainberg, didn't get processed, did it | 19:44 |
| morganfainberg | ayoung, ok fixed it next patch incoming | 19:44 |
| morganfainberg | ayoung, yeah | 19:44 |
| ayoung | ==—= | 19:44 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/identity-specs: Initial Commit for Identity-specs repo https://review.openstack.org/94987 | 19:44 |
| *** andreaf has joined #openstack-keystone | 19:44 | |
| morganfainberg | that should do it | 19:44 |
| morganfainberg | hmm | 19:45 |
| dstanek | morganfainberg: what does it mean to re-propose a spec? | 19:47 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/identity-specs: Initial Commit for Identity-specs repo https://review.openstack.org/94987 | 19:47 |
| morganfainberg | dstanek, e.g. if the spec was proposed prior to us adopting the formal structure or for the next release | 19:47 |
| dstanek | morganfainberg: you mean just during the transition to this repo? | 19:49 |
| morganfainberg | dstanek, bascially yes | 19:50 |
| dstanek | it reads like all approved blueprint will have to be re-approved for every release; doesn't even qualify that completed blueprints don't need to be re-approved | 19:51 |
| morganfainberg | dstanek, and if it wasn't completed for say Juno, you'd need to re-propose the spec for K | 19:51 |
| morganfainberg | dstanek, completed blueprints wouldn't need to be re-proposed. | 19:51 |
| morganfainberg | dstanek, if the BP wasn't completed for Juno, it's not a guarantee we'd want it for K (there might be good reasons it wasn't finished). Alternatively, we might just rubberstamp it for the next release | 19:52 |
| morganfainberg | dstanek, feel free to comment, happy to rephrase/fix wording now before we use it :) | 19:52 |
| *** gyee has joined #openstack-keystone | 19:55 | |
| ayoung | morganfainberg, "Idenity Program Specifications" | 20:02 |
| ayoung | http://docs-draft.openstack.org/87/94987/6/check/gate-identity-specs-docs/11acdde/doc/build/html/ | 20:02 |
| morganfainberg | ayoung, this is why we review :) | 20:02 |
| morganfainberg | but Idenity is cooler sounding | 20:02 |
| morganfainberg | >.> | 20:02 |
| *** leseb has quit IRC | 20:03 | |
| gyee | morganfainberg, hooray for the spec repo! :) | 20:03 |
| morganfainberg | ayoung, i'll hold on subsequent patchsets until everyone has given a once over - solve all the issues at once if possible | 20:04 |
| ayoung | ++ | 20:04 |
| morganfainberg | gyee, I totally agree. (though I want storyboard to cover the need for the spec repo longterm tbh) | 20:05 |
| *** cds has quit IRC | 20:10 | |
| *** andreaf has quit IRC | 20:11 | |
| dstanek | morganfainberg: does storyboard capture the conversations like gerrit does? | 20:16 |
| *** dims has quit IRC | 20:16 | |
| *** therve has quit IRC | 20:25 | |
| *** stevemar has joined #openstack-keystone | 20:29 | |
| morganfainberg | dstanek, no idea. probably not yet | 20:31 |
| morganfainberg | dstanek, but storyboard is built for our needs specifically (OpenStack), so I'm sure it could capture the conversations if we wanted it to. | 20:31 |
| *** amcrn_ has quit IRC | 20:32 | |
| *** nkinder has quit IRC | 20:37 | |
| bknudson | shouldn't this little client program work? http://paste.openstack.org/show/81186/ | 20:40 |
| rodrigods | stevemar, time for +2 again? =) https://review.openstack.org/#/c/91578/ | 20:40 |
| bknudson | I also had to set the project_name on the client, then it was happy | 20:43 |
| stevemar | bknudson, what do you mean? | 20:44 |
| bknudson | stevemar: http://paste.openstack.org/show/81186/ -- when I changed the program to also pass the project_name it worked. | 20:44 |
| *** andreaf has joined #openstack-keystone | 20:49 | |
| *** nkinder has joined #openstack-keystone | 20:51 | |
| *** joesavak has quit IRC | 20:52 | |
| bknudson | I wish I knew how the positional decorator was supposed to work -- https://review.openstack.org/#/c/79774/4/keystoneclient/v3/services.py | 20:53 |
| bknudson | is the count supposed to be updated at line 53? | 20:53 |
| bknudson | and why is the count set to 1 at line 40?? | 20:53 |
| *** browne1 has joined #openstack-keystone | 21:02 | |
| *** juanmo1 has quit IRC | 21:03 | |
| *** browne has quit IRC | 21:03 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Session loading from config https://review.openstack.org/95015 | 21:03 |
| *** leseb has joined #openstack-keystone | 21:04 | |
| *** boris-42 has quit IRC | 21:06 | |
| *** boris-42 has joined #openstack-keystone | 21:08 | |
| *** bobt has joined #openstack-keystone | 21:09 | |
| *** bobt_ has joined #openstack-keystone | 21:09 | |
| *** dstanek is now known as dstanek_zzz | 21:16 | |
| *** joesavak has joined #openstack-keystone | 21:17 | |
| *** dstanek_zzz is now known as dstanek | 21:25 | |
| *** rodrigods has quit IRC | 21:26 | |
| *** bobt_ has quit IRC | 21:26 | |
| *** richm has quit IRC | 21:29 | |
| ayoung | bknudson, it positional decoartor is to prevent people from calliing long parameter list functions by order | 21:31 |
| bknudson | ayoung: the lists in https://review.openstack.org/#/c/79774/4/keystoneclient/v3/services.py don't look particularly long | 21:32 |
| ayoung | bknudson, nope. they don't | 21:32 |
| bknudson | although it takes kwargs so it could be long | 21:33 |
| bknudson | also, if you call .create('service_name', 'service_type') you'll get a warning. | 21:33 |
| bknudson | I think it's annoying if an API logs warnings. | 21:34 |
| *** gokrokve has quit IRC | 21:34 | |
| ayoung | bknudson, its a warning so you change your code to remove the warning | 21:35 |
| ayoung | but old code still works | 21:35 |
| bknudson | I think I'd change the logging levels so I don't see it before I'd change the code | 21:35 |
| ayoung | bknudson, I don't think the count is supposed to be updated. Unless you want to be able to add a new positional argument | 21:35 |
| ayoung | .create('service_name', 'service_type' would work if you bumped the count to 2 | 21:36 |
| ayoung | but adding description should not do that. | 21:36 |
| ayoung | I'm guessing 1 is for self | 21:36 |
| bknudson | ayoung: y, I ran the code and am convinced that the count doesn't have to be updated. | 21:36 |
| ayoung | bknudson, any experience with horizon? I'm asking a quesiont in openstack-horizon and getting nothing but echos | 21:37 |
| bknudson | ayoung: no, I haven't been using horizon. | 21:37 |
| ayoung | something has told horizon that It should be talking to neutron and I set up things with no neutron | 21:37 |
| bknudson | doug fish is our horizon expert. | 21:38 |
| bknudson | Looks like he's in -dev | 21:38 |
| *** ayoung is now known as ayoung_afk | 21:45 | |
| *** sbfox has quit IRC | 21:46 | |
| *** leseb has quit IRC | 21:47 | |
| *** erecio_1 has quit IRC | 21:51 | |
| *** leseb has joined #openstack-keystone | 21:53 | |
| *** bobt has quit IRC | 21:53 | |
| *** browne1 has quit IRC | 21:58 | |
| *** browne has joined #openstack-keystone | 22:02 | |
| *** marcoemorais has quit IRC | 22:06 | |
| *** marcoemorais has joined #openstack-keystone | 22:07 | |
| *** marcoemorais has quit IRC | 22:07 | |
| *** marcoemorais has joined #openstack-keystone | 22:08 | |
| *** leseb has quit IRC | 22:08 | |
| *** marcoemorais has quit IRC | 22:09 | |
| *** marcoemorais has joined #openstack-keystone | 22:09 | |
| *** jamielennox|away is now known as jamielennox | 22:11 | |
| *** andreaf has quit IRC | 22:12 | |
| *** nkinder has quit IRC | 22:15 | |
| *** boris-42 has quit IRC | 22:17 | |
| *** david-lyle has quit IRC | 22:18 | |
| *** david-lyle has joined #openstack-keystone | 22:18 | |
| *** david-lyle has quit IRC | 22:19 | |
| *** boris-42 has joined #openstack-keystone | 22:20 | |
| *** joesavak has quit IRC | 22:24 | |
| *** thedodd has quit IRC | 22:36 | |
| *** marcoemorais has quit IRC | 22:37 | |
| *** arborism has joined #openstack-keystone | 22:37 | |
| *** marcoemorais has joined #openstack-keystone | 22:37 | |
| *** sbfox has joined #openstack-keystone | 22:41 | |
| *** dstanek is now known as dstanek_zzz | 22:42 | |
| *** bknudson has quit IRC | 22:44 | |
| *** diegows has quit IRC | 23:04 | |
| *** dstanek_zzz is now known as dstanek | 23:04 | |
| *** schofield is now known as schofield_away | 23:04 | |
| *** sbfox has quit IRC | 23:06 | |
| *** ayoung_afk is now known as ayoung | 23:08 | |
| *** Camisa has quit IRC | 23:10 | |
| *** rodrigods has joined #openstack-keystone | 23:12 | |
| *** dstanek is now known as dstanek_zzz | 23:16 | |
| *** BAKfr has quit IRC | 23:18 | |
| *** rodrigods has quit IRC | 23:19 | |
| *** openstackgerrit has quit IRC | 23:19 | |
| *** rodrigods has joined #openstack-keystone | 23:19 | |
| *** rodrigods has joined #openstack-keystone | 23:19 | |
| *** openstackgerrit has joined #openstack-keystone | 23:20 | |
| *** sbfox has joined #openstack-keystone | 23:37 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/91240 | 23:42 |
| *** praneshp has quit IRC | 23:43 | |
| *** praneshp has joined #openstack-keystone | 23:44 | |
| stevemar | best bknudson comment yet: "2 spaces after a . is this 1980?" | 23:47 |
| morganfainberg | stevemar, ++ | 23:47 |
| *** nkinder has joined #openstack-keystone | 23:47 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/identity-specs: Initial Commit for Identity-specs repo https://review.openstack.org/94987 | 23:49 |
| *** marcoemorais has quit IRC | 23:49 | |
| *** marcoemorais has joined #openstack-keystone | 23:50 | |
| *** marcoemorais has quit IRC | 23:50 | |
| *** r-daneel has quit IRC | 23:50 | |
| *** marcoemorais has joined #openstack-keystone | 23:50 | |
| morganfainberg | stevemar, ^ that should resolve brant's concerns and the typo | 23:50 |
| jamielennox | stevemar: lol | 23:54 |
| gyee | jamielennox, there? | 23:59 |
| jamielennox | yea | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!