| gyee | looking at the session code, doesn't seem it handles token revocation | 00:00 |
|---|---|---|
| gyee | say, session.get() and we got back a 401 | 00:00 |
| gyee | we don't ask the plugin for a new token | 00:00 |
| jamielennox | gyee: https://review.openstack.org/#/c/94529/ | 00:01 |
| jamielennox | i've got it defaulting to don't reauth - i'm not sure which way it should go | 00:02 |
| gyee | ah, nice! | 00:02 |
| gyee | jamielennox, how about a retries param | 00:02 |
| *** bobt has joined #openstack-keystone | 00:02 | |
| gyee | we'll retry for x number of times and if we continue to get 401, we give up | 00:03 |
| *** rodrigods has quit IRC | 00:03 | |
| jamielennox | gyee: i can see retries might make sense in how we use it in auth_token - but in general if you have just gotten a fresh token and it still doesn't work i think you probably want to give up | 00:04 |
| lbragstad | stevemar: ++ | 00:04 |
| gyee | jamielennox, sure, I am fine with that too | 00:05 |
| *** sbfox has quit IRC | 00:06 | |
| jamielennox | anyway auth_token does retries with a back off period - i don't think that's something we should default to | 00:06 |
| *** browne has quit IRC | 00:06 | |
| jamielennox | and it's a fairly easy thing to wrap around a call now | 00:06 |
| *** dstanek_zzz is now known as dstanek | 00:07 | |
| gyee | jamielennox, sure, its at the discretion of the plugin anyway | 00:09 |
| *** browne has joined #openstack-keystone | 00:10 | |
| *** rodrigods has joined #openstack-keystone | 00:10 | |
| gyee | jamielennox, is your append_identity_args() review on the way? | 00:11 |
| jamielennox | gyee: the argparse one? | 00:12 |
| gyee | yes sir | 00:12 |
| jamielennox | i had the start of one on my work computer | 00:12 |
| *** gokrokve has joined #openstack-keystone | 00:12 | |
| jamielennox | i was intending to be there today, however started early and never left :) | 00:13 |
| jamielennox | i'll probably just end up starting it again today | 00:13 |
| jamielennox | i was doing some stuff around OSC just to make sure it would fit in | 00:13 |
| ayoung | gyee, jamielennox one of you pull the trigger on https://review.openstack.org/#/c/94987/7 and get us a spec repo, please? morganfainberg 's done great work, lets keep up the momentum | 00:14 |
| gyee | ayoung, yeah, lemme look | 00:14 |
| ayoung | And there is nothing wrong with putting two spaces after a period. | 00:15 |
| gyee | hahaha | 00:15 |
| gyee | seriously? | 00:15 |
| gyee | ! | 00:15 |
| *** dstanek is now known as dstanek_zzz | 00:17 | |
| *** Camisa has joined #openstack-keystone | 00:17 | |
| *** Camisa has joined #openstack-keystone | 00:17 | |
| jamielennox | ayoung: done | 00:18 |
| ayoung | nice | 00:18 |
| jamielennox | i don't see any problems - but i don't think we'll know what they are until we've used it for a while | 00:18 |
| jamielennox | for example a way to mark a spec as completed would be good | 00:18 |
| ayoung | jamielennox, we really really need to hack on packstack and get it to work with LDAP/FreeIPA. I think that might be the most important thing we can do for Keystone | 00:18 |
| jamielennox | but we can figure that stuff out as we go | 00:18 |
| openstackgerrit | A change was merged to openstack/identity-specs: Initial Commit for Identity-specs repo https://review.openstack.org/94987 | 00:19 |
| ayoung | jamielennox, good point | 00:19 |
| ayoung | If I had an intern this summer, that is what I would have them work on | 00:19 |
| jamielennox | also possibly a client impact | 00:19 |
| jamielennox | so you can prevent people marking a spec as finished until they've done the client side as well | 00:20 |
| ayoung | jamielennox, BTW we still don't have requests-kerberos in global reqs | 00:20 |
| ayoung | client impact...from the server? | 00:20 |
| ayoung | maybe a way to link specs? | 00:20 |
| ayoung | like pairing a client and server spec? | 00:20 |
| jamielennox | no, but if you're doing a spec that exposes an API, are you expecting to add a new manager to the client etc | 00:21 |
| ayoung | ++ | 00:21 |
| *** rodrigods has quit IRC | 00:23 | |
| ayoung | jamielennox, https://review.openstack.org/#/c/84740/ should be good to go, but I need to figure out who can/will approve | 00:24 |
| *** rodrigods has joined #openstack-keystone | 00:24 | |
| jamielennox | ayoung: oh cool, so they did do a py33 compatible release | 00:27 |
| *** xianghui has joined #openstack-keystone | 00:27 | |
| ayoung | yep | 00:27 |
| morganfainberg | ayoung, silly unrelated to anything keystone - you have a home office chair you recommend? | 00:27 |
| * morganfainberg needs a new one. | 00:27 | |
| ayoung | morganfainberg, get a barstool | 00:28 |
| gyee | k, looks like jamielennox a+ already, no need to double tap | 00:28 |
| ayoung | and a standing desk | 00:28 |
| morganfainberg | ayoung, hm. that was one of the options. | 00:28 |
| ayoung | take it from the guy about to turn 43 with lower back pain. | 00:28 |
| ayoung | sitting is the new smoking | 00:28 |
| morganfainberg | ayoung, ++ (l2 compression fracture here, standing helps, but can't do it all day) | 00:28 |
| ayoung | barstool. Means you don't have to move your computer | 00:29 |
| ayoung | I'm building one out of birch | 00:29 |
| jamielennox | ayoung: requests-kerberos doesn't do a travis build on 3.3 | 00:29 |
| morganfainberg | ayoung, cool. thanks for the input :) | 00:29 |
| ayoung | jamielennox, travis? | 00:29 |
| jamielennox | ayoung: seriously? | 00:29 |
| ayoung | jamielennox, is that a python thing? | 00:29 |
| morganfainberg | ayoung, travis-ci | 00:29 |
| gyee | morganfainberg, l2 compression fracture sound painful | 00:30 |
| morganfainberg | ayoung, it's an external ci system that hooks into github decently | 00:30 |
| jamielennox | it's a ci server that links into github | 00:30 |
| ayoung | ah | 00:30 |
| morganfainberg | gyee, snowboarding accident | 00:30 |
| jamielennox | and it's the first thing i look at to tell if 3.3 is supporte | 00:30 |
| jamielennox | d | 00:30 |
| morganfainberg | gyee, happend ~4 yrs ago. but i need to be careful about sitting/standing/etc for work :) | 00:30 |
| ayoung | jamielennox, we got the tests to pass with it | 00:30 |
| ayoung | at least the client unit tests | 00:31 |
| jamielennox | ayoung: so it appears to fail on py3 for me | 00:32 |
| jamielennox | kerberos module | 00:33 |
| jamielennox | ImportError: No module named 'commands' | 00:33 |
| ayoung | jamielennox, so when you said "doesn't do a travis build on 3.3" you mean that they don't test it or that it fails? | 00:33 |
| jamielennox | so they don't test it, i figured if they think the new release supports it i'd just submit a PR | 00:33 |
| ayoung | jamielennox, ah, yeah, they wouldn;t run it, they didn';t have any py33 support prior | 00:33 |
| jamielennox | but it fails | 00:33 |
| jamielennox | yea, but i thought if they were cutting a release based on supporting py3.3 they'd test it | 00:34 |
| ayoung | it really was a case of dolphm bugging him to do it, and crickets...then I did, and he cut it like within hours | 00:34 |
| jamielennox | so it appears to be the fault of the kerberos librar | 00:35 |
| jamielennox | last uploaded: 2011-04-27 | 00:35 |
| ayoung | the python-kerberos lib? | 00:35 |
| jamielennox | yea | 00:35 |
| ayoung | python-kerberos-1.1-13.fc20.x86_64 ? | 00:36 |
| jamielennox | i'm looking at pip | 00:36 |
| jamielennox | it says 1.1.1 | 00:36 |
| jamielennox | ugh, svn | 00:36 |
| jamielennox | i almost forgot how bad svn is, it's cloning user branches | 00:39 |
| *** gokrokve has quit IRC | 00:41 | |
| ayoung | you probably checked out too high in the tree. that is a common problem with the way svn branches | 00:43 |
| *** gokrokve has joined #openstack-keystone | 00:44 | |
| *** gokrokve_ has joined #openstack-keystone | 00:45 | |
| *** joesavak has joined #openstack-keystone | 00:46 | |
| *** arborism has quit IRC | 00:48 | |
| *** gokrokve has quit IRC | 00:49 | |
| *** schofield_away is now known as schofield | 00:50 | |
| *** joesavak has quit IRC | 00:52 | |
| *** rodrigods has quit IRC | 00:56 | |
| *** diegows has joined #openstack-keystone | 00:56 | |
| *** stevemar has quit IRC | 00:57 | |
| jamielennox | ayoung: so i can make it build with python3 | 01:00 |
| jamielennox | testing it - or getting that accepted is another matter | 01:01 |
| ayoung | which version of the kerberos library are you using? | 01:01 |
| jamielennox | svn | 01:02 |
| ayoung | top of tree, no version number? | 01:02 |
| jamielennox | yea, head | 01:02 |
| jamielennox | it's mostly a C binding so it's just some old stuff in the setup.py that isn't py3 compatible | 01:03 |
| ayoung | we don't even have requests-kerberos for python27 right now. I'm not super concerned about 33 yet. We can skip the tests for that in the client until we hav a workable configuration | 01:03 |
| jamielennox | i thought 33 was a requirement of passing into global reqs? | 01:04 |
| ayoung | jose got something working somehow | 01:04 |
| ayoung | yeah, 33 is necessary, just that we might not be able to get the pkc tests working for a kerberos auth plugin due to package stuff. TBH, its been long enough that I don't know the tweaks necessary | 01:05 |
| ayoung | I tested it at one point...let me see what is on my system | 01:05 |
| *** dstanek_zzz is now known as dstanek | 01:08 | |
| gyee | jamielennox, I am mostly good, just a couple of questions https://review.openstack.org/#/c/94529/1/keystoneclient/session.py | 01:09 |
| jamielennox | ayoung: can you activate a trust from v2 auth? | 01:12 |
| ayoung | jamielennox, yes | 01:13 |
| jamielennox | oh, cool - i was expecting a no there | 01:13 |
| ayoung | pretty sure Heat needed that up front | 01:13 |
| ayoung | look in token/controller.py | 01:13 |
| ayoung | I think you pass it without the OS-TRUST extenstion prefix | 01:13 |
| *** r-daneel has joined #openstack-keystone | 01:17 | |
| *** dstanek is now known as dstanek_zzz | 01:18 | |
| jamielennox | do you know if horizon ever did anything to allow creating trusts graphically? i haven't seen it | 01:20 |
| jamielennox | ayoung: internal questions | 01:20 |
| ayoung | nope | 01:20 |
| ayoung | Only via Heat AFAIK | 01:21 |
| *** diegows has quit IRC | 01:31 | |
| *** bobt has quit IRC | 01:35 | |
| *** marcoemorais has quit IRC | 01:36 | |
| *** browne has quit IRC | 01:37 | |
| *** rodrigods has joined #openstack-keystone | 01:48 | |
| *** pack3t has joined #openstack-keystone | 01:51 | |
| rodrigods | jamielennox, the exception raised at https://review.openstack.org/#/c/91578/9/keystoneclient/v3/assignments.py is definitely a problem to you, or you are ok leaving this custom one? | 01:53 |
| jamielennox | rodrigods: i won't block it, but python has an exception for that and i don't see the point in carrying our own | 01:55 |
| jamielennox | and really it doesn't matter what we raise there, you just don't want to let it fall through to the underyling implementation | 01:55 |
| *** packet has quit IRC | 01:58 | |
| *** pack3t is now known as packet | 01:58 | |
| *** r-daneel has quit IRC | 01:59 | |
| rodrigods | jamielennox, ok | 02:03 |
| *** rodrigods has quit IRC | 02:07 | |
| *** dstanek_zzz is now known as dstanek | 02:09 | |
| *** packet has quit IRC | 02:12 | |
| *** zhiyan_ is now known as zhiyan | 02:18 | |
| *** dstanek is now known as dstanek_zzz | 02:19 | |
| *** rodrigods has joined #openstack-keystone | 02:24 | |
| *** rodrigods has quit IRC | 02:24 | |
| *** rodrigods has joined #openstack-keystone | 02:24 | |
| *** rodrigods has quit IRC | 02:28 | |
| *** stevemar has joined #openstack-keystone | 02:40 | |
| *** gyee has quit IRC | 02:40 | |
| *** praneshp has quit IRC | 02:42 | |
| *** mberlin1 has joined #openstack-keystone | 02:42 | |
| *** mberlin has quit IRC | 02:43 | |
| *** stevemar has quit IRC | 02:54 | |
| *** harlowja_ is now known as harlowja_away | 02:55 | |
| morganfainberg | ayoung, you around? | 02:57 |
| morganfainberg | ayoung, nvm | 02:57 |
| *** Abhijeet has joined #openstack-keystone | 03:02 | |
| *** dstanek_zzz is now known as dstanek | 03:09 | |
| jamielennox | morganfainberg: here? | 03:11 |
| morganfainberg | jamielennox, yeah | 03:12 |
| jamielennox | you're generally the only one left by this time | 03:12 |
| morganfainberg | dstanek, just woke up (for a moment at least) | 03:12 |
| morganfainberg | or so irc claims | 03:12 |
| jamielennox | so ages ago we talked about how auth_token using session should reauthenticate the token if it gets a 401 | 03:12 |
| morganfainberg | jamielennox, what can i do for ya? | 03:12 |
| morganfainberg | jamielennox, correct. because... we have that behavior now. | 03:13 |
| jamielennox | (i wonder what that looks like sometimes, maybe IRC on the phone and they bump it at night) | 03:13 |
| jamielennox | ok so i've got a review to do that | 03:13 |
| jamielennox | https://review.openstack.org/#/c/94529/1 | 03:13 |
| jamielennox | i can't decide on whether that behaviour should be the default or not | 03:13 |
| jamielennox | there are definetly times you want it | 03:13 |
| morganfainberg | hm. | 03:14 |
| jamielennox | opinion? | 03:14 |
| *** radez is now known as radez_g0n3 | 03:14 | |
| morganfainberg | jamielennox, i think in most cases the current usecase would assume it is the default to reauth | 03:15 |
| jamielennox | i initially wrote it default on, then swapped, and gyee's comment is to swap bacj | 03:15 |
| jamielennox | right | 03:15 |
| morganfainberg | jamielennox, not saying that it is correct to make that the default, but if you have the requisite information and you get a 401 (only should occur on bad x-subject-token) reauth makes sense | 03:15 |
| jamielennox | but i also think that that is because we've been a little lax in permission management | 03:16 |
| morganfainberg | s/bad/invalid | 03:16 |
| jamielennox | if the 401 is because you don't have the right roles then it doesn't matter how many times you reauth | 03:16 |
| morganfainberg | jamielennox, i think it's 50/50 here | 03:16 |
| jamielennox | x-subject-token? | 03:16 |
| morganfainberg | jamielennox, V3 token validation | 03:17 |
| morganfainberg | jamielennox, x-subject-token is the header (easier to say than the "token that is being validated") | 03:17 |
| morganfainberg | jamielennox, :P | 03:17 |
| jamielennox | yea, i mean i just hadn't thought through the difference, i don't think we differentiate that now | 03:17 |
| morganfainberg | jamielennox, the token being validated vs the auth token? | 03:18 |
| morganfainberg | jamielennox, we absolutely do. | 03:18 |
| morganfainberg | oh wait... i'm inverting it | 03:18 |
| jamielennox | would the 401 response change between X-Auth-Token is invalid and X-Subject-Token is invalid? | 03:18 |
| morganfainberg | x-subject-token would raise 403 if invalid | 03:18 |
| jamielennox | ok | 03:18 |
| morganfainberg | 401 is raised if x-auth-token is bad | 03:18 |
| morganfainberg | i think | 03:18 |
| morganfainberg | *checks* | 03:18 |
| jamielennox | that's a distinction i hope we make everywhere | 03:19 |
| jamielennox | ie Unauthorized if the token is bad, Forbidden if the policies don't work | 03:19 |
| jamielennox | in which case i'd be happy to have reauth by default | 03:19 |
| *** dstanek is now known as dstanek_zzz | 03:19 | |
| morganfainberg | yes that should be the case. i know we "fixed" that in... Havana? | 03:20 |
| morganfainberg | i'm 2x checking still though | 03:20 |
| *** stevemar has joined #openstack-keystone | 03:20 | |
| morganfainberg | jamielennox, ah | 03:21 |
| morganfainberg | no | 03:21 |
| morganfainberg | we 404 for an expired token | 03:22 |
| morganfainberg | or non-validatable token | 03:22 |
| morganfainberg | (not thinking PKI) | 03:22 |
| morganfainberg | ok so lets see. | 03:22 |
| jamielennox | morganfainberg: i'm actually not so worried about the keystoneclient -> keystone case | 03:22 |
| morganfainberg | jamielennox, right but it should be the blueprint for all other cases | 03:22 |
| jamielennox | or auth_token -> keystone | 03:23 |
| jamielennox | yep, and it's how we enforce policy | 03:23 |
| jamielennox | can we differentiate between no permissions, and not these permissions | 03:23 |
| morganfainberg | jamielennox, doesn't look like we can. | 03:24 |
| morganfainberg | jamielennox, https://github.com/openstack/oslo-incubator/blob/master/openstack/common/policy.py#L261 if you get to "enforce" you only have one possible exception to raise | 03:24 |
| morganfainberg | now.. | 03:25 |
| morganfainberg | what does middleware say if token is revoked/expired | 03:25 |
| morganfainberg | jamielennox, looks like we raise the generic: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/middleware/auth_token.py#L379 | 03:26 |
| jamielennox | morganfainberg: but that might be ok | 03:26 |
| morganfainberg | InvalidUserToken | 03:26 |
| morganfainberg | the only time a reauth is really warranted is on expired/revoked token. | 03:26 |
| morganfainberg | reauthing wont matter if you get bounced by policy | 03:27 |
| jamielennox | https://github.com/openstack/keystone/blob/master/keystone/policy/backends/rules.py#L91 | 03:27 |
| morganfainberg | jamielennox, looks like https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/middleware/auth_token.py#L700 401 is what we typically do w/ invalid user token | 03:27 |
| morganfainberg | called from the block: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/middleware/auth_token.py#L634 | 03:28 |
| morganfainberg | jamielennox, so, we should 401 instead of 403 if it's a reauth-capable situation | 03:29 |
| morganfainberg | jamielennox, i think that means allow_reauth is probably ok as the default | 03:29 |
| jamielennox | yea, and that we might need to fix auth_token | 03:29 |
| jamielennox | i don't think we are granular enough there | 03:29 |
| jamielennox | actually no | 03:30 |
| jamielennox | that's right | 03:30 |
| jamielennox | auth_token should still reject with 401 | 03:30 |
| jamielennox | and then policy should reject with 403 | 03:30 |
| morganfainberg | yep | 03:30 |
| jamielennox | ok, so given that all auth_token checks is signature and expiry time anyway that should be fine | 03:30 |
| morganfainberg | jamielennox. yep | 03:31 |
| jamielennox | if auth_token is getting 403 then you're otherwise screwed and you'll find out soon enough without worrying about reauths | 03:31 |
| *** stevemar has quit IRC | 03:31 | |
| jamielennox | ok, default to True | 03:31 |
| morganfainberg | jamielennox, ++ i support this | 03:31 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Auth Plugin invalidation https://review.openstack.org/94529 | 03:36 |
| jamielennox | morganfainberg: fixed ^ | 03:36 |
| jamielennox | morganfainberg: cheers | 03:36 |
| *** dstanek_zzz is now known as dstanek | 04:10 | |
| *** sbfox has joined #openstack-keystone | 04:11 | |
| *** dstanek is now known as dstanek_zzz | 04:20 | |
| *** morganfainberg is now known as morganfainberg_Z | 04:42 | |
| *** schofield is now known as schofield_away | 04:44 | |
| *** marcoemorais has joined #openstack-keystone | 04:48 | |
| *** marcoemorais1 has joined #openstack-keystone | 04:49 | |
| *** marcoemorais has quit IRC | 04:52 | |
| *** dstanek_zzz is now known as dstanek | 05:11 | |
| *** stevemar has joined #openstack-keystone | 05:14 | |
| *** dstanek is now known as dstanek_zzz | 05:21 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/90288 | 06:00 |
| *** stevemar has quit IRC | 06:06 | |
| *** dstanek_zzz is now known as dstanek | 06:12 | |
| *** praneshp has joined #openstack-keystone | 06:18 | |
| *** gokrokve_ has quit IRC | 06:21 | |
| *** dstanek is now known as dstanek_zzz | 06:22 | |
| *** praneshp_ has joined #openstack-keystone | 06:37 | |
| *** praneshp has quit IRC | 06:40 | |
| *** praneshp_ is now known as praneshp | 06:40 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Refactor tests regarding required attributes https://review.openstack.org/92535 | 06:44 |
| *** jaosorior has joined #openstack-keystone | 06:44 | |
| *** zhiyan is now known as zhiyan_ | 06:52 | |
| *** gokrokve has joined #openstack-keystone | 06:52 | |
| *** gokrokve_ has joined #openstack-keystone | 06:54 | |
| *** gokrokve has quit IRC | 06:56 | |
| *** gokrokve_ has quit IRC | 06:59 | |
| *** marcoemorais1 has quit IRC | 07:04 | |
| *** marcoemorais has joined #openstack-keystone | 07:04 | |
| *** zhiyan_ is now known as zhiyan | 07:10 | |
| *** dstanek_zzz is now known as dstanek | 07:13 | |
| *** dstanek is now known as dstanek_zzz | 07:23 | |
| *** amcrn has joined #openstack-keystone | 07:28 | |
| *** BAKfr has joined #openstack-keystone | 07:29 | |
| *** sbfox has quit IRC | 07:32 | |
| *** leseb has joined #openstack-keystone | 07:51 | |
| *** dstanek_zzz is now known as dstanek | 07:54 | |
| *** gokrokve has joined #openstack-keystone | 07:55 | |
| *** rwsu has quit IRC | 07:58 | |
| *** praneshp has quit IRC | 07:58 | |
| *** gokrokve has quit IRC | 08:00 | |
| *** dstanek is now known as dstanek_zzz | 08:04 | |
| *** gokrokve has joined #openstack-keystone | 08:32 | |
| *** amcrn has quit IRC | 08:37 | |
| *** gokrokve has quit IRC | 08:38 | |
| *** xianghui has quit IRC | 08:41 | |
| *** xianghui has joined #openstack-keystone | 08:42 | |
| *** xianghui has quit IRC | 08:43 | |
| *** xianghui has joined #openstack-keystone | 08:44 | |
| *** dstanek_zzz is now known as dstanek | 08:55 | |
| *** xianghui has quit IRC | 08:58 | |
| *** dstanek is now known as dstanek_zzz | 09:05 | |
| *** xianghui has joined #openstack-keystone | 09:05 | |
| *** henrynash_ has joined #openstack-keystone | 09:09 | |
| *** xianghui has quit IRC | 09:10 | |
| *** henrynash has quit IRC | 09:13 | |
| *** henrynash_ is now known as henrynash | 09:13 | |
| *** henrynash_ has joined #openstack-keystone | 09:19 | |
| *** henrynash has quit IRC | 09:20 | |
| *** henrynash_ is now known as henrynash | 09:20 | |
| *** xianghui has joined #openstack-keystone | 09:23 | |
| *** gokrokve has joined #openstack-keystone | 09:33 | |
| openstackgerrit | Jose Castro Leon proposed a change to openstack/python-keystoneclient: Initial kerberos plugin implementation. https://review.openstack.org/74974 | 09:34 |
| *** gokrokve has quit IRC | 09:38 | |
| *** henrynash_ has joined #openstack-keystone | 09:40 | |
| *** henrynash has quit IRC | 09:41 | |
| *** henrynash_ is now known as henrynash | 09:41 | |
| *** dstanek_zzz is now known as dstanek | 09:55 | |
| *** marcoemorais has quit IRC | 09:57 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Session loading from conf and CLI https://review.openstack.org/95015 | 10:01 |
| *** dstanek is now known as dstanek_zzz | 10:05 | |
| *** Abhijeet has quit IRC | 10:20 | |
| *** openstackstatus has quit IRC | 10:20 | |
| *** openstack has joined #openstack-keystone | 10:21 | |
| *** jaosorior has quit IRC | 10:21 | |
| *** openstackstatus has joined #openstack-keystone | 10:21 | |
| *** ChanServ sets mode: +v openstackstatus | 10:21 | |
| *** jaosorior has joined #openstack-keystone | 10:23 | |
| *** andreaf has joined #openstack-keystone | 10:26 | |
| jaosorior | Hi, I'm refactoring the authenticate keystone.auth.controllers.Auth.authenticate_for_token function, is there a specific reason most of the function is surrounded by a "try...except exception.TrustNotFound" ? Or should I just narrow it to where it would actually throw that exception? | 10:27 |
| *** gokrokve has joined #openstack-keystone | 10:34 | |
| *** gokrokve has quit IRC | 10:39 | |
| *** xianghui has quit IRC | 10:44 | |
| *** dstanek_zzz is now known as dstanek | 10:56 | |
| *** zhiyan is now known as zhiyan_ | 10:58 | |
| *** xianghui has joined #openstack-keystone | 11:01 | |
| *** dstanek is now known as dstanek_zzz | 11:06 | |
| openstackgerrit | Jose Castro Leon proposed a change to openstack/keystone: Initial kerberos plugin implementation. https://review.openstack.org/74317 | 11:27 |
| *** dstanek_zzz is now known as dstanek | 11:34 | |
| *** gokrokve has joined #openstack-keystone | 11:34 | |
| *** andreaf_ has joined #openstack-keystone | 11:39 | |
| *** gokrokve has quit IRC | 11:39 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Adds function to compare DNs https://review.openstack.org/94513 | 11:40 |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Add a test for getting grant for a user with a , in ID https://review.openstack.org/94740 | 11:40 |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Check that the user is dumb moved to the common method https://review.openstack.org/88517 | 11:40 |
| *** andreaf_ has quit IRC | 11:55 | |
| *** juanmo has joined #openstack-keystone | 12:02 | |
| *** juanmo has quit IRC | 12:03 | |
| openstackgerrit | Sergey Nikitin proposed a change to openstack/keystone: Fixed wrong behavior when updating tenant with LDAP backends https://review.openstack.org/93386 | 12:03 |
| *** dstanek is now known as dstanek_zzz | 12:04 | |
| openstackgerrit | Rodrigo Duarte Sousa proposed a change to openstack/python-keystoneclient: Add /role_assignments endpoint support https://review.openstack.org/91578 | 12:23 |
| *** rodrigods has joined #openstack-keystone | 12:23 | |
| *** andreaf has quit IRC | 12:25 | |
| *** gordc has joined #openstack-keystone | 12:25 | |
| *** dims has joined #openstack-keystone | 12:28 | |
| *** dims has quit IRC | 12:28 | |
| *** dims has joined #openstack-keystone | 12:33 | |
| *** gokrokve has joined #openstack-keystone | 12:35 | |
| *** rodrigods has quit IRC | 12:37 | |
| *** andreaf_ has joined #openstack-keystone | 12:37 | |
| *** gokrokve has quit IRC | 12:40 | |
| *** rodrigods has joined #openstack-keystone | 12:42 | |
| *** afaranha has quit IRC | 12:43 | |
| *** afaranha has joined #openstack-keystone | 12:44 | |
| *** dstanek_zzz is now known as dstanek | 12:44 | |
| *** radez_g0n3 is now known as radez | 12:51 | |
| *** erecio has joined #openstack-keystone | 12:51 | |
| *** radez is now known as radez_g0n3 | 12:52 | |
| *** radez_g0n3 is now known as radez | 12:52 | |
| *** bknudson has joined #openstack-keystone | 12:55 | |
| jaosorior | O_o | 13:01 |
| *** Ju has quit IRC | 13:07 | |
| *** joesavak has joined #openstack-keystone | 13:07 | |
| *** henrynash has quit IRC | 13:16 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone: Filter User by project https://review.openstack.org/84136 | 13:32 |
| *** ukalifon1 has joined #openstack-keystone | 13:32 | |
| *** gokrokve has joined #openstack-keystone | 13:36 | |
| *** gokrokve has quit IRC | 13:41 | |
| *** r-daneel has joined #openstack-keystone | 13:44 | |
| *** gokrokve has joined #openstack-keystone | 13:49 | |
| *** gokrokve has quit IRC | 13:52 | |
| *** rodrigods_ has joined #openstack-keystone | 13:55 | |
| *** rodrigods_ has quit IRC | 13:55 | |
| *** sbfox has joined #openstack-keystone | 13:59 | |
| ukalifon1 | ayoung: where do I find the file wsgi-keystone.conf? I'm trying to follow the instructions in: http://docs.openstack.org/developer/keystone/apache-httpd.html | 14:03 |
| *** rodrigods_ has joined #openstack-keystone | 14:06 | |
| *** rwsu has joined #openstack-keystone | 14:08 | |
| *** rodrigods_ has quit IRC | 14:10 | |
| *** rodrigods_ has joined #openstack-keystone | 14:11 | |
| ukalifon1 | nkinder: ^^^ can you answer ? | 14:12 |
| *** sbfox has quit IRC | 14:14 | |
| nkinder | ukalifon1: in devstack? | 14:16 |
| nkinder | ukalifon1: it's in /opt/stack/keystone/httpd/ | 14:16 |
| bknudson | ukalifon1: http://git.openstack.org/cgit/openstack-dev/devstack/tree/files/apache-keystone.template | 14:16 |
| nkinder | ukalifon1: you should copy it to /etc/httpd/conf.d | 14:17 |
| ukalifon1 | I'm looking for it in RHWL OSP | 14:17 |
| ukalifon1 | RHEL OSP | 14:17 |
| bknudson | it goes in /etc/apache2/sites-available/keystone | 14:17 |
| bknudson | (which is probably httpd on RHEL) | 14:17 |
| bknudson | Then create a symlink to enable it: ln -s /sites-available/keystone /etc/apache2/sites-enabled/ | 14:18 |
| bknudson | maybe rhel has a different setup for httpd | 14:18 |
| larsks | ukalifon1: You can use "rpm" tp find it: rpm -ql openstack-keystone |grep wsgi | 14:21 |
| larsks | ukalifon1: which gets you: /usr/share/keystone/wsgi-keystone.conf | 14:21 |
| larsks | (I'm actually using RDO/Icehouse, but in theory RHEL OSP should have it in the same place) | 14:21 |
| ukalifon1 | larsks: thanks | 14:22 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Templated v3 catalog https://review.openstack.org/70630 | 14:28 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Templated v3 catalog https://review.openstack.org/70630 | 14:32 |
| *** david-lyle has joined #openstack-keystone | 14:34 | |
| *** rodrigods_ has quit IRC | 14:37 | |
| *** thedodd has joined #openstack-keystone | 14:46 | |
| *** gokrokve has joined #openstack-keystone | 14:49 | |
| *** xianghui has quit IRC | 14:50 | |
| *** gokrokve has quit IRC | 14:54 | |
| BAKfr | Hi. When using a new message, by correcting a bug, is there something to do for i18n ? Edit locale/keystone.pot ? | 15:02 |
| *** packet has joined #openstack-keystone | 15:03 | |
| *** schofield_away is now known as schofield | 15:04 | |
| bknudson | BAKfr: there's a group that does the translation, so they'll provide us with an updated catalog at some point | 15:08 |
| bknudson | BAKfr: so the answer is there's no change required to the message files | 15:08 |
| *** stevemar has joined #openstack-keystone | 15:12 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Templated v3 catalog https://review.openstack.org/70630 | 15:12 |
| BAKfr | bknudson, thanks | 15:13 |
| stevemar | bknudson, updating the templated catalog is something we should definitely do more quickly in v4 =\ | 15:18 |
| *** gokrokve has joined #openstack-keystone | 15:18 | |
| bknudson | stevemar: maybe we thought nobody was using it... | 15:19 |
| bknudson | it still doesn't support everything | 15:19 |
| bknudson | e.g., filtering | 15:19 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/contrib/endpoint_filter/backends | 15:20 |
| bknudson | the endpoint_filter extension only has sql | 15:20 |
| *** gyee has joined #openstack-keystone | 15:23 | |
| stevemar | bknudson, wouldn't that be most of the new contrib work? | 15:23 |
| bknudson | stevemar: I think that's the only one that affects catalog | 15:24 |
| *** ukalifon1 has quit IRC | 15:25 | |
| *** afaranha has quit IRC | 15:28 | |
| *** ukalifon1 has joined #openstack-keystone | 15:29 | |
| *** gabrielb has quit IRC | 15:30 | |
| *** afaranha has joined #openstack-keystone | 15:31 | |
| *** gabrielb has joined #openstack-keystone | 15:33 | |
| *** diegows has joined #openstack-keystone | 15:40 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/91225 | 15:45 |
| *** rodrigods has quit IRC | 15:57 | |
| *** rodrigods has joined #openstack-keystone | 16:01 | |
| *** rodrigods has quit IRC | 16:08 | |
| *** rodrigods has joined #openstack-keystone | 16:08 | |
| BAKfr | As a new contributor, I should do something special in my first commit ? | 16:09 |
| *** rodrigods has quit IRC | 16:09 | |
| BAKfr | Like adding my name to an AUTHOR file ? | 16:09 |
| *** rodrigods has joined #openstack-keystone | 16:10 | |
| *** rodrigods has quit IRC | 16:10 | |
| *** rodrigods has joined #openstack-keystone | 16:10 | |
| *** marcoemorais has joined #openstack-keystone | 16:10 | |
| *** henrynash has joined #openstack-keystone | 16:12 | |
| *** morganfainberg_Z is now known as morganfainberg | 16:12 | |
| *** gokrokve has quit IRC | 16:12 | |
| larsks | BAKfr: Nope. The commit log provides a record of authors :). | 16:15 |
| larsks | You should read https://wiki.openstack.org/wiki/Gerrit_Workflow if you haven't already. | 16:15 |
| *** leseb has quit IRC | 16:19 | |
| BAKfr | larsks, I've already read it. | 16:19 |
| larsks | BAKfr: awesome. | 16:19 |
| *** rodrigods_ has joined #openstack-keystone | 16:20 | |
| morganfainberg | dolphm, bknudson, stevemar, gyee, ayoung, dstanek, nkinder, looks like programs are not winning the spec-repo naming, back to codenames | 16:21 |
| *** jaosorior has quit IRC | 16:21 | |
| bknudson | the name of the spec repo makes no difference to me | 16:23 |
| morganfainberg | bknudson, same, more of a heads up to expect it to be renamed. | 16:24 |
| bknudson | I assume we don't need to get stuff merged before the name is changed? | 16:25 |
| morganfainberg | bknudson, don't think we have anything pending, and if we do, i'll repropose it if needed | 16:26 |
| morganfainberg | bknudson, if the origonal proposer doesn't want to | 16:26 |
| morganfainberg | bknudson, i think we're clear though | 16:26 |
| *** rodrigods_ has quit IRC | 16:28 | |
| gyee | morganfainberg, what's in a name? :) | 16:29 |
| morganfainberg | gyee, :P | 16:30 |
| openstackgerrit | Kevin BernardAllies proposed a change to openstack/keystone: Check that region ID is not an empty string https://review.openstack.org/95212 | 16:34 |
| BAKfr | my first commit :) | 16:36 |
| dstanek | morganfainberg: does that mean me may eventually have multple spec repos? | 16:39 |
| morganfainberg | dstanek, no | 16:39 |
| morganfainberg | dstanek, still one repo per program | 16:39 |
| morganfainberg | but it looks like the primary project gets the name for now. | 16:39 |
| * morganfainberg prefers program name, but not going to argue at the moment | 16:39 | |
| dstanek | morganfainberg: i agree on both counts | 16:40 |
| *** raildo1 has left #openstack-keystone | 16:43 | |
| *** raildo has joined #openstack-keystone | 16:44 | |
| *** henrynash has quit IRC | 16:46 | |
| *** radez is now known as radez_g0n3 | 16:46 | |
| *** shufflebot has joined #openstack-keystone | 16:48 | |
| shufflebot | So I'm currently implementing SSL on keystone on havna via https://github.com/kjtanaka/deploy_havana/wiki/How-to-enable-ssl-on-keystone | 16:49 |
| shufflebot | keystone --insecure token-get and services work appropriately, HOWEVER horizon fails to log in | 16:49 |
| *** radez_g0n3 is now known as radez | 16:49 | |
| shufflebot | and sadly I dont see any logs that help me identify whats going on. Its not in /var/log/httpd/{access.log,error.log} | 16:49 |
| openstackgerrit | Alex Gaynor proposed a change to openstack/python-keystoneclient: Fixed an aparent typo in the code https://review.openstack.org/95214 | 16:50 |
| *** esmute has quit IRC | 16:51 | |
| *** harlowja_away is now known as harlowja_ | 16:55 | |
| *** BAKfr has quit IRC | 16:56 | |
| *** praneshp has joined #openstack-keystone | 17:06 | |
| gyee | morganfainberg, there? | 17:07 |
| *** marcoemorais has quit IRC | 17:09 | |
| *** marcoemorais has joined #openstack-keystone | 17:09 | |
| *** marcoemorais has quit IRC | 17:09 | |
| *** marcoemorais has joined #openstack-keystone | 17:10 | |
| *** marcoemorais has quit IRC | 17:10 | |
| *** esmute has joined #openstack-keystone | 17:10 | |
| *** marcoemorais has joined #openstack-keystone | 17:10 | |
| *** sbfox has joined #openstack-keystone | 17:11 | |
| nkinder | shufflebot: rcrit (who isn't on here now) has been working on SSL stuff lately. He has a write up on configuring it that I can dig up for you. | 17:13 |
| nkinder | shufflebot: http://blog-rcritten.rhcloud.com/?p=5 | 17:14 |
| *** bboris has joined #openstack-keystone | 17:15 | |
| bboris | hi | 17:16 |
| bboris | i have a question about the tokens | 17:16 |
| bboris | why is the token format everywhere like this: aaaaa-bbbbb-ccccc-dddd | 17:16 |
| nkinder | bboris: you are referring to UUID tokens? | 17:17 |
| dolphm | bboris: the last time we used that format for tokens was in diablo - we use the hex digest now instead | 17:17 |
| bboris | i guess i should've typed my question in one line. the tokens in the examples are in the format above, while my tokens are 6 lines long | 17:18 |
| bboris | and i dont know what uuid tokens are | 17:19 |
| bboris | i'm sending POST with curl and a json | 17:19 |
| nkinder | bboris: there are UUID tokens and PKI tokens | 17:19 |
| dolphm | bboris: the docs were written in diablo then, and are uuid-based tokens. keystone uses b64-encoded, pki-signed documents as tokens now | 17:19 |
| bboris | aha | 17:21 |
| nkinder | bboris: the PKI format tokens actually contain information inside of them, such as the roles that a user has on a project. | 17:21 |
| nkinder | bboris: uuid is just an identifier, and you have to ask keystone if it is valid | 17:21 |
| ayoung | bboris, you can blame me for that | 17:21 |
| nkinder | bboris: with pki, you can check the signature to see if it is valid without involving keystone | 17:21 |
| bboris | clever | 17:22 |
| dstanek | bknudson: i don't understand line 345 in https://review.openstack.org/#/c/76901/16/update.py,cm | 17:23 |
| dstanek | bknudson: seems like it is just trying to filter tools | 17:23 |
| dolphm | bboris: http://docs.openstack.org/developer/keystone/configuration.html#pki-or-uuid | 17:23 |
| openstackgerrit | Santiago Baldassin proposed a change to openstack/python-keystoneclient: Add description param to v3 service create/update https://review.openstack.org/79774 | 17:23 |
| *** BAKfr has joined #openstack-keystone | 17:23 | |
| morganfainberg | gyee, back | 17:26 |
| bboris | dolphm: nice, thanks | 17:27 |
| gyee | morganfainber, I was wondering is there a way to transfer ownership of an existing review, I am asking that question in openstack-infra now | 17:27 |
| *** marcoemorais has quit IRC | 17:28 | |
| bknudson | dstanek: seems like _get_modules_in_conf should include install_venv_common, since the returned list is used to check if the modules are in alpha order. | 17:28 |
| ayoung | dolphm, we have Kerberos: https://review.openstack.org/#/c/84740/ | 17:28 |
| morganfainberg | ayoung, tox has fixes merged, next release run_tests will become 100% a wrapper for tox | 17:28 |
| ayoung | morganfainberg, ++ | 17:28 |
| dolphm | ayoung: still no bp reference? | 17:29 |
| shufflebot | nkinder: thanks | 17:29 |
| ayoung | dolphm, there was one in there. Did it get removed? | 17:29 |
| *** marcoemorais has joined #openstack-keystone | 17:29 | |
| bknudson | dstanek: I think the issue is that it gets the list of modules in openstack/common and that doesn't include anything in tools. | 17:29 |
| ayoung | dolphm, must have been removed in a rebase by someone. I added it | 17:29 |
| *** marcoemorais has quit IRC | 17:30 | |
| ayoung | Patch Set 5: Commit message was updated | 17:30 |
| *** marcoemorais has joined #openstack-keystone | 17:30 | |
| bknudson | dstanek: so I think you're right that it's essentially files in tools/ that don't have a corresponding file in openstack/common | 17:30 |
| ayoung | Ah...Maybe I did that with Patch set 6 | 17:30 |
| bknudson | dstanek: maybe it would be better to just add files in tools to the list of modules | 17:30 |
| *** marcoemorais has quit IRC | 17:31 | |
| ayoung | that is the risk of editing the commit message in the web ui. I hadn't pulled it back down to do the other changes request for 6 | 17:31 |
| *** marcoemorais has joined #openstack-keystone | 17:31 | |
| *** marcoemorais has quit IRC | 17:31 | |
| *** marcoemorais has joined #openstack-keystone | 17:32 | |
| dstanek | bknudson: not sure that would work since the comparison is between the modules in the config and the things in keystone/openstack/common | 17:32 |
| *** lbragstad has quit IRC | 17:32 | |
| *** amcrn has joined #openstack-keystone | 17:33 | |
| bknudson | since we've got people around -- would be nice to get https://review.openstack.org/#/c/94470/ merged | 17:34 |
| morganfainberg | bknudson, i am about 75% done reviewing it | 17:35 |
| bknudson | morganfainberg: thanks! | 17:35 |
| morganfainberg | bknudson, spent a good chunk of time last night on it. | 17:35 |
| bknudson | i'll be back online once I get home | 17:35 |
| morganfainberg | bknudson, i have 1 question | 17:35 |
| bknudson | go ahead | 17:35 |
| morganfainberg | is it just the lack of info about the types that makes it so the is_ava_value_equal function ignores the attribute_type? | 17:36 |
| morganfainberg | e.g. just a simplisitic comparitor vs more indepth implementation? | 17:36 |
| bknudson | morganfainberg: yes, it's because of the simplistic implementation | 17:37 |
| morganfainberg | bknudson, that was the only real sticking point i was running into. | 17:37 |
| bknudson | a complete implementation would have to take the attribute_type into consideration | 17:37 |
| morganfainberg | bknudson, let me finish reviewing the tests and we should be good. | 17:37 |
| bknudson | e.g., if the attribute_type was telephoneNumber then it would have to do a different type of comparison | 17:37 |
| morganfainberg | yep | 17:38 |
| morganfainberg | ok, just making sure i was reading that correctly | 17:38 |
| shufflebot | nkinder: that was helpful - nova is now behaving as expected but horizon isn't >_> hrmmm | 17:39 |
| *** bknudson has quit IRC | 17:39 | |
| morganfainberg | gyee, ping https://review.openstack.org/#/c/94470/5 i'd like to have your eyes on this as well. It looks good to me, but I, unfortunately can't spin up a instance at the moment to test (have a bunch of other things i need to get to) | 17:47 |
| morganfainberg | gyee, since you do a bunch of ldap-y stuff your eyes would be good too | 17:48 |
| gyee | morganfainberg, looking | 17:51 |
| gyee | I don't know why we bother to compare DNs as users and groups should have different object classes | 17:53 |
| gyee | comparing DNs sound risky | 17:53 |
| morganfainberg | gyee, the issue is we don't have the objectClass once the query completes | 17:54 |
| morganfainberg | gyee, erm, once we move out of the LDAP specific stuff | 17:54 |
| morganfainberg | gyee, if you're looking at a python object in keystone, what objectclass did it originate from? | 17:55 |
| morganfainberg | gyee, we have the ID which is a partial DN | 17:55 |
| gyee | morganfainberg, yeah, that's problematic, DN is not a reliable to distinguish objects | 17:55 |
| shufflebot | nkinder: thanks that sort of helped - however I'm still stuck with horizon not being able to authenticate | 17:56 |
| gyee | shufflebot, is your ca.pem self-signed? you may need to add it to /etc/ssl/certs/ | 17:56 |
| morganfainberg | gyee, well, i think we have to take suboptimal but better and continue to improve along the way vs. completely broken | 17:56 |
| morganfainberg | gyee, this falls into the former category of a definite improvement, but perhaps not the long-term solution | 17:57 |
| gyee | morganfainberg, yeah unfortunately | 17:57 |
| shufflebot | gyee: it is but I wouldn't think that mattered as OPENSTACK_SSL_NO_VERIFY = True | 17:58 |
| shufflebot | OPENSTACK_SSL_CACERT = '/etc/keystone/ssl/certs/ca.pem' are set | 17:58 |
| morganfainberg | gyee, i'm going to +1 only because i can't do live tests right now, if you think it's not "broken" and is the incremental improvement mind +2/+A? | 17:58 |
| shufflebot | gyee: I'll try it though | 17:58 |
| gyee | morganfainber, sure | 17:58 |
| gyee | sorry I mean morganfainberg | 17:58 |
| morganfainberg | gyee, commented and said i asked you to look at it as well. | 17:59 |
| morganfainberg | gyee, thanks. | 18:00 |
| morganfainberg | need to get back to something on this end (have till end of day to complete it) | 18:00 |
| gyee | morganfainberg, meh, I look forward to the 3 day break :) | 18:00 |
| morganfainberg | gyee, lol | 18:00 |
| shufflebot | gyee: sadly: [Fri May 23 18:46:13 2014] [error] INFO:urllib3.connectionpool:Starting new HTTPS connection (1): $KEYSTONE_ENDPOINT | 18:01 |
| shufflebot | ^ thats what comes up whenever I try to authorize against keystone | 18:01 |
| shufflebot | *throwing config on a gist.. holdon | 18:01 |
| shufflebot | gyee: https://gist.github.com/anonymous/263b4b97216131e0bbe9 | 18:03 |
| *** gokrokve has joined #openstack-keystone | 18:06 | |
| gyee | shufflebot, can you try openssl to see if you can even talk to keystone? | 18:06 |
| gyee | openssl s_client -CAfile /etc/keystone/ssl/certs/ca.pem -connect keystonehost:5000 | 18:06 |
| gyee | also, make sure the horizon process have read access to /etc/keystone/ssl/certs/ca.pem | 18:07 |
| *** radez is now known as radez_g0n3 | 18:10 | |
| dstanek | dolphm: those mid-cycle dates are prettry firm now, right? | 18:12 |
| *** radez_g0n3 is now known as radez | 18:12 | |
| shufflebot | gyee: mmk hangon | 18:18 |
| shufflebot | gyee: the openssl command worked fine. I think it might be the httpd user doesn't have access to the /etc/keystone/ss/certs/ca.pem <-- trying now | 18:20 |
| *** radez is now known as radez_g0n3 | 18:27 | |
| *** bobt has joined #openstack-keystone | 18:31 | |
| *** bknudson has joined #openstack-keystone | 18:33 | |
| *** packet has quit IRC | 18:38 | |
| *** schofield is now known as schofield_away | 18:38 | |
| *** packet has joined #openstack-keystone | 18:39 | |
| *** marcoemorais has quit IRC | 18:45 | |
| *** marcoemorais has joined #openstack-keystone | 18:46 | |
| *** marcoemorais has quit IRC | 18:46 | |
| *** marcoemorais has joined #openstack-keystone | 18:47 | |
| *** marcoemorais has quit IRC | 18:47 | |
| *** marcoemorais has joined #openstack-keystone | 18:48 | |
| *** andreaf_ has quit IRC | 18:48 | |
| *** ukalifon1 has quit IRC | 18:49 | |
| *** marcoemorais has quit IRC | 18:49 | |
| *** marcoemorais has joined #openstack-keystone | 18:49 | |
| bknudson | https://review.openstack.org/#/c/94397/ is the backport to stable/icehouse. There were conflicts | 18:54 |
| nkinder | bknudson: I'll start reviewing now... | 18:57 |
| *** radez_g0n3 is now known as radez | 18:58 | |
| nkinder | bknudson: where were the conflicts? In the fakeldap/test code? | 18:59 |
| nkinder | bknudson: it looks like you had to pull in a little extra stuff in fakeldap | 18:59 |
| bknudson | nkinder: yes, there were conflicts there. | 19:00 |
| bknudson | nkinder: maybe should have backported the fix for , in DN first. | 19:00 |
| bknudson | actually, that might be in review already | 19:00 |
| bknudson | nope, I don't see it | 19:01 |
| bknudson | nkinder: so, I don't think having a user with a , in the ID would work on icehouse anyways. | 19:03 |
| nkinder | why is that? | 19:04 |
| nkinder | because the other fix is missing? | 19:04 |
| nkinder | bknudson: https://bugs.launchpad.net/keystone/+bug/1302106 | 19:05 |
| uvirtbot | Launchpad bug 1302106 in keystone/havana "LDAP non-URL safe characters cause auth failure" [High,Fix committed] | 19:05 |
| nkinder | bknudson: that is in icehouse, so it should work | 19:05 |
| bknudson | nkinder: ah, I must have added the tests in a separate commit. | 19:06 |
| nkinder | bknudson: yep - https://review.openstack.org/#/c/85478/ | 19:08 |
| nkinder | bknudson: the test never went into icehouse | 19:11 |
| bknudson | nkinder: y, I should have suggested that the test review gets merged in with the fix review | 19:11 |
| nkinder | bknudson: there was also another related patch that only went into master - https://review.openstack.org/#/c/87142/ | 19:12 |
| bknudson | nkinder: that covered some other situations where values weren't being escaped for the filter string. Nobody had complained about these ones. | 19:13 |
| bknudson | just seems like good hygiene to generate query strings properly. | 19:14 |
| nkinder | bknudson: ok, so does your proposed patch for icehouse stand as is, or do we need to add the other comma test? | 19:16 |
| bknudson | nkinder: I think the proposed patch stands as is. | 19:17 |
| nkinder | bknudson: ok. I just gave it a +1. | 19:18 |
| bknudson | I've been trying it with devstack and looks like it's working as expected | 19:19 |
| nkinder | bknudson: devstack for icehouse? | 19:26 |
| bknudson | nkinder: turns out that current devstack works with icehouse keystone. | 19:26 |
| bknudson | we'll see how long that lasts. | 19:26 |
| nkinder | bknudson: I've never tried to use branches with devstack | 19:27 |
| bknudson | nkinder: I'll probably need a vm for icehouse | 19:28 |
| bknudson | when it stops working | 19:28 |
| *** thedodd has quit IRC | 19:31 | |
| *** erecio_1 has joined #openstack-keystone | 19:36 | |
| *** erecio has quit IRC | 19:39 | |
| *** sbfox has quit IRC | 19:40 | |
| *** sbfox has joined #openstack-keystone | 19:43 | |
| *** schofield_away is now known as schofield | 19:43 | |
| *** marcoemorais has quit IRC | 19:44 | |
| *** marcoemorais has joined #openstack-keystone | 19:45 | |
| *** radez is now known as radez_g0n3 | 19:46 | |
| *** jsavak has joined #openstack-keystone | 19:51 | |
| openstackgerrit | A change was merged to openstack/keystone: Stronger assertion for test_user_extra_attribute_mapping https://review.openstack.org/87145 | 19:51 |
| *** joesavak has quit IRC | 19:54 | |
| *** erecio_2 has joined #openstack-keystone | 19:58 | |
| *** leseb has joined #openstack-keystone | 19:58 | |
| *** erecio_1 has quit IRC | 20:01 | |
| *** thedodd has joined #openstack-keystone | 20:02 | |
| morganfainberg | dstanek, i think https://review.openstack.org/#/c/77325/16/keystone/common/utils.py the log.info on truncate is still too much noise | 20:07 |
| morganfainberg | dstanek, that log will occur everytime someone authenticates afaict | 20:07 |
| morganfainberg | dstanek, it feels more like a debug log if anything | 20:07 |
| morganfainberg | dstanek, "We're following exactly how you configured your installation to work" doesn't provide a lot of value imo | 20:08 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: install from source docs never actually install the keystone service https://review.openstack.org/95258 | 20:10 |
| dolphm | schofield: https://review.openstack.org/#/c/95258/ | 20:11 |
| rodrigods | bknudson, What do you think about update the docstring at role_assignments patch with: "Is only possible to provide either an user or group, not both. The same is true for domain and project." | 20:11 |
| bknudson | rodrigods: say what the behavior is -- if both user and group are provided then whatever exception is raised. | 20:12 |
| bknudson | if both domain and project are provided then whatever exception is raised. | 20:12 |
| rodrigods | bknudson, ok | 20:12 |
| morganfainberg | dolphm, so after talking at the summit i think the general consensus was to go w/ JSONSchema validation for everything - I'll be trying to hammer that out for tokens here once i'm settled in next week so we always do pki validation (first step to non-persistent) in the server | 20:12 |
| morganfainberg | dolphm, vs protobuf or something else. | 20:12 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: install from source docs never actually install the keystone service https://review.openstack.org/95258 | 20:12 |
| dolphm | schofield: much better https://review.openstack.org/#/c/95258/ | 20:13 |
| dolphm | morganfainberg: ++ but why make non-persistence dependent on validation? | 20:13 |
| *** erecio_2 has quit IRC | 20:14 | |
| shufflebot | gyee: getting this error with nova when running openstakc-status ERROR: hostname '10.192.2.121' doesn't match u'test-control-2' | 20:14 |
| morganfainberg | dolphm, i think i need a way to ensure we have all the data w/o doing the crazy lookups - also we need to be able to have an internal "token format" that can be emitted v2 or v3. basically, avoiding the whole "if v2 -> code path, if v3 -> other code" when validating | 20:14 |
| gyee | shufflebot, that the ssl host validation error? | 20:15 |
| morganfainberg | dolphm, might be easier to convert to a consistent data structure instead of retrofitting a standard structure in once we have non-persistent. -- i think. | 20:15 |
| morganfainberg | dolphm, i guess we could go either way. | 20:16 |
| openstackgerrit | Rodrigo Duarte Sousa proposed a change to openstack/python-keystoneclient: Add /role_assignments endpoint support https://review.openstack.org/91578 | 20:17 |
| *** dstanek is now known as dstanek_zzz | 20:17 | |
| shufflebot | gyee: I'd belive so | 20:17 |
| shufflebot | even though direct nova commands work fine | 20:18 |
| openstackgerrit | Rodrigo Duarte Sousa proposed a change to openstack/python-keystoneclient: Add /role_assignments endpoint support https://review.openstack.org/91578 | 20:21 |
| gyee | shufflebot, I am guess nslookup 10.192.2.121 doesn't match test-control-2 | 20:27 |
| gyee | guessing | 20:27 |
| openstackgerrit | A change was merged to openstack/keystone: LDAP fix for get_roles_for_user_and_project user=group ID https://review.openstack.org/94470 | 20:28 |
| *** doddstack has joined #openstack-keystone | 20:33 | |
| -openstackstatus- NOTICE: Gerrit will be offline for about 20 minutes in order to rename some projects starting at 21:00 UTC. | 20:33 | |
| *** marcoemorais1 has joined #openstack-keystone | 20:35 | |
| *** thedodd has quit IRC | 20:35 | |
| *** dstanek_zzz is now known as dstanek | 20:36 | |
| *** marcoemorais has quit IRC | 20:37 | |
| dstanek | morganfainberg: if would be fine to me to make that a debug, but the patch is less chatty already so i'm also fine with it as-is | 20:38 |
| *** joesavak has joined #openstack-keystone | 20:41 | |
| *** jsavak has quit IRC | 20:44 | |
| *** amerine has quit IRC | 20:44 | |
| *** amerine has joined #openstack-keystone | 20:44 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Remove obsolete note from ldap https://review.openstack.org/95263 | 20:45 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Authenticate via oauth https://review.openstack.org/81981 | 20:46 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Add example script for oauth1 functions https://review.openstack.org/80193 | 20:50 |
| *** gordc has left #openstack-keystone | 20:56 | |
| *** raildo has quit IRC | 20:56 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Add example script for oauth1 functions https://review.openstack.org/80193 | 20:57 |
| *** rodrigods has quit IRC | 20:59 | |
| *** joesavak has quit IRC | 21:03 | |
| *** marcoemorais1 has quit IRC | 21:08 | |
| *** marcoemorais has joined #openstack-keystone | 21:08 | |
| *** jamielennox is now known as jamielennox|away | 21:08 | |
| *** leseb_ has joined #openstack-keystone | 21:23 | |
| *** jamielennox|away is now known as jamielennox | 21:23 | |
| openstackgerrit | A change was merged to openstack/keystone: Regenerate sample config https://review.openstack.org/92730 | 21:23 |
| *** leseb has quit IRC | 21:25 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Fixed an aparent typo in the code https://review.openstack.org/95214 | 21:30 |
| -openstackstatus- NOTICE: Gerrit is offline in order to rename some projects. ETA: 22:00. | 21:35 | |
| *** ChanServ changes topic to "Gerrit is offline in order to rename some projects. ETA: 22:00." | 21:35 | |
| *** leseb_ has quit IRC | 21:42 | |
| *** packet has quit IRC | 21:49 | |
| *** arunkant has quit IRC | 21:50 | |
| *** dstanek is now known as dstanek_zzz | 21:53 | |
| *** harlowja_ is now known as harlowja_away | 21:59 | |
| openstackgerrit | John Dennis proposed a change to openstack/keystone: Add module implementing DN, RDN & AVA objects to improve DN handling https://review.openstack.org/95282 | 22:02 |
| *** mattinator has quit IRC | 22:04 | |
| *** doddstack has quit IRC | 22:11 | |
| *** sbfox1 has joined #openstack-keystone | 22:11 | |
| *** sbfox has quit IRC | 22:12 | |
| *** bknudson has quit IRC | 22:12 | |
| *** bknudson has joined #openstack-keystone | 22:12 | |
| *** openstackgerrit has quit IRC | 22:14 | |
| *** openstackgerrit has joined #openstack-keystone | 22:14 | |
| *** david-lyle has quit IRC | 22:16 | |
| *** nkinder has quit IRC | 22:18 | |
| *** openstackstatus has quit IRC | 22:18 | |
| *** openstack has joined #openstack-keystone | 22:18 | |
| *** harlowja_away is now known as harlowja_ | 22:19 | |
| *** openstackstatus has joined #openstack-keystone | 22:19 | |
| *** ChanServ sets mode: +v openstackstatus | 22:19 | |
| *** sbfox1 has quit IRC | 22:26 | |
| *** gokrokve has quit IRC | 22:26 | |
| *** gokrokve has joined #openstack-keystone | 22:27 | |
| openstackgerrit | Monty Taylor proposed a change to openstack/keystone-specs: Updated gitreview file for repo rename https://review.openstack.org/95293 | 22:28 |
| *** ChanServ changes topic to "Juno-1 June 12th! New formalized Identity-spec process for Juno-2 and beyond blueprints." | 22:28 | |
| *** gokrokve has quit IRC | 22:32 | |
| *** stevemar has quit IRC | 22:32 | |
| openstackgerrit | Monty Taylor proposed a change to openstack/keystone-specs: Updated gitreview file for repo rename https://review.openstack.org/95298 | 22:34 |
| openstackgerrit | Arun Kant proposed a change to openstack/keystone: Adding support for ldap connection pooling.(Work-in-progress) https://review.openstack.org/95300 | 22:42 |
| *** dstanek_zzz is now known as dstanek | 22:44 | |
| *** dstanek is now known as dstanek_zzz | 22:54 | |
| *** dims has quit IRC | 22:56 | |
| *** morganfainberg is now known as morganfainberg_Z | 23:01 | |
| openstackgerrit | A change was merged to openstack/keystone: Mapping engine does not handle regex properly https://review.openstack.org/94518 | 23:19 |
| *** r-daneel has quit IRC | 23:34 | |
| *** bobt has quit IRC | 23:36 | |
| *** dstanek_zzz is now known as dstanek | 23:36 | |
| *** dstanek is now known as dstanek_zzz | 23:46 | |
| *** ozialien has joined #openstack-keystone | 23:56 | |
| *** praneshp has quit IRC | 23:57 | |
| *** derek_c has joined #openstack-keystone | 23:58 | |
| *** praneshp has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!