| *** sbfox has quit IRC | 00:08 | |
| *** amerine has joined #openstack-keystone | 00:16 | |
| *** zhiyan_ is now known as zhiyan | 00:16 | |
| *** marcoemorais has quit IRC | 00:21 | |
| *** leseb has joined #openstack-keystone | 00:22 | |
| *** leseb has quit IRC | 00:27 | |
| *** schofield has quit IRC | 00:28 | |
| *** schofield has joined #openstack-keystone | 00:30 | |
| openstackgerrit | Rodrigo Duarte Sousa proposed a change to openstack/python-keystoneclient: Changes exception raised by v3.trusts.update() https://review.openstack.org/97355 | 00:30 |
|---|---|---|
| *** gokrokve has quit IRC | 00:30 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Trusts Auth Broken in XML https://review.openstack.org/54861 | 00:36 |
| morganfainberg | stevemar, broken huh | 00:37 |
| morganfainberg | :P | 00:37 |
| stevemar | morganfainberg, oh i just updated the commit msg | 00:46 |
| morganfainberg | stevemar, hehe ah | 00:49 |
| *** pheadron has quit IRC | 00:56 | |
| *** pheadron has joined #openstack-keystone | 00:58 | |
| *** gokrokve has joined #openstack-keystone | 01:04 | |
| *** rodrigods_ has quit IRC | 01:09 | |
| *** rodrigods_ has joined #openstack-keystone | 01:12 | |
| *** davlaps has joined #openstack-keystone | 01:16 | |
| *** rodrigods_ has quit IRC | 01:16 | |
| *** browne has quit IRC | 01:17 | |
| *** leseb has joined #openstack-keystone | 01:21 | |
| *** leseb has quit IRC | 01:26 | |
| * morganfainberg restrains self from responding to the Error status code for out of quota errors as needing to use HTTP 402 - Payment required | 01:29 | |
| ayoung | morganfainberg, I see a parallel between your multi-token spec and S4U2Proxy | 01:32 |
| ayoung | In both cases they are "trusted service plus indicator of intention from end user" | 01:33 |
| *** ncoghlan has joined #openstack-keystone | 01:37 | |
| *** morganfainberg is now known as morganfainberg_Z | 01:41 | |
| harlowja | jamielennox u got a sec, just wanted to maybe clear up https://review.openstack.org/#/c/88419/ | 01:43 |
| jamielennox | harlowja: sure, others here are probably interested in that one - i just think i got there first | 01:46 |
| harlowja | jamielennox cool, sooo i think phil and i got confused on that one, about what to expose, what should be exposed (domain not useful?) | 01:47 |
| jamielennox | ok, so i'm not sure from nova's aspect what the vm needs to do | 01:48 |
| jamielennox | my only point was that if you have a project_id a domain is kind of redundant, because a project exists in a domain | 01:48 |
| harlowja | right, so this wouldn't be a nova usage, it would be an app inside the vm that wants to somehow signal out to the rest of the world this information (For example to configure puppet for the X creating user) | 01:49 |
| jamielennox | more that if you are scoped in a project you should never really care about the domain, because there is no assumption that you will have any permissions to do anything on that domain | 01:49 |
| harlowja | sure, lets say its not about permission but about identifying a (user, domain, project) in some other system (puppet in this case) to say uniquely identify the puppet recipe this user 'likes' | 01:50 |
| harlowja | *without said user needing to provide cloud-init data to do the same | 01:50 |
| harlowja | *making user all happy | 01:50 |
| jamielennox | so i guess it stems from: is there a need to expose names | 01:51 |
| jamielennox | once you start trying to refer to things by names you end up with (as you are seeing) you need the domain_id possibly domain_name | 01:52 |
| harlowja | depends on the user (in my case, names a currently also unique) | 01:52 |
| harlowja | *names are | 01:52 |
| jamielennox | which in keystone at least we call project_domain_name to differentiate why you need the domain name | 01:52 |
| jamielennox | yep, and there are definitely cases where that is true - however then there is things like swift recently who started using names as they were nicer and got burned by multi domains | 01:53 |
| jamielennox | then tried to insert a bunch of hacks to try to keep using names | 01:54 |
| harlowja | sure, so instead, provide either a uuid->name api (that is callable) or provide the full set of information (names included) and let the user choose what to use? | 01:54 |
| harlowja | or just provide nothing i guess (the current situation) | 01:56 |
| jamielennox | so most of those uuid->name apis are protected | 01:56 |
| jamielennox | so you can obviously provide as much as you want and let users figure it out, i was just thinking you should provide ids and nothing else | 01:56 |
| jamielennox | make the end users work with ids | 01:57 |
| jamielennox | so you would provide user_id, project_id - anyone with suitable privileges can find more information from that but that way there is no ambiguity | 01:58 |
| harlowja | ya, it'd just be nice if the VM itself had those suitable priviliges | 01:59 |
| *** dims has quit IRC | 01:59 | |
| jamielennox | yea, i honestly don't know if there are security implications of passing through even what you are talking about now | 02:01 |
| jamielennox | so in the case of puppet or some cloud-init, what's wrong with using ids? | 02:02 |
| harlowja | so the case i have is downstream system still uses usernames, if they were say fully integrated with keystone then this wouldn't be needed (but they are legacy) | 02:03 |
| *** praneshp has joined #openstack-keystone | 02:04 | |
| harlowja | so thats my own desire for usernames | 02:04 |
| jamielennox | is this something that can be enforced by changing the policy on keystone to allow puppet to fetch that user information? | 02:04 |
| harlowja | well also requires downstream system to change :) | 02:04 |
| harlowja | which with legacy stuff isn't so easy, ha | 02:04 |
| jamielennox | even before boot? | 02:05 |
| jamielennox | ahh, before puppet starts | 02:05 |
| jamielennox | so your puppet script does a keystone user-get <id> and then feeds that through? | 02:05 |
| harlowja | well right now there exists a patch we have in nova to drop down the username ;) | 02:06 |
| harlowja | into the config-drive | 02:06 |
| harlowja | *and since user-names are unique and company wide, this has gone ok | 02:06 |
| harlowja | but say without that, it would have to do something like the above | 02:06 |
| ayoung | harlowja, can you sneak another value in there for me? | 02:07 |
| jamielennox | nkinder: you here? is there an issue about feeding usernames and such into a starting vm? | 02:07 |
| ayoung | I need an One Time Password | 02:07 |
| harlowja | ayoung sureeeee | 02:07 |
| harlowja | i can sneak anything u want | 02:07 |
| ayoung | harlowja, seriously | 02:07 |
| ayoung | I need to be able to do this: | 02:07 |
| harlowja | lol | 02:07 |
| ayoung | upon VM create, generate an OTP | 02:07 |
| ayoung | can be a UUID4 | 02:07 |
| ayoung | so long as it is random | 02:08 |
| harlowja | then send it to your email? | 02:08 |
| ayoung | then I need to send it to an Identity Provider, as well as to the VM | 02:08 |
| harlowja | hmmm | 02:08 |
| ayoung | and then register the VM with the IdP | 02:08 |
| ayoung | I'm actually serious | 02:08 |
| harlowja | oh, k, serious mode | 02:08 |
| jamielennox | harlowja: so i guess the thing to do is make *another* config option with what you should pass through, because i can see in certain circumstances why user_name is good, but i would suggest you should do it by default | 02:08 |
| jamielennox | *wouldn't | 02:08 |
| ayoung | http://adam.younglogic.com/2013/09/register-vm-freeipa/ harlowja | 02:08 |
| ayoung | I did it with a script before, but its the kind of thing that should not "take over the user data" | 02:09 |
| ayoung | harlowja, designate is already doing something like this to create the A AAAA records for the new VM | 02:10 |
| *** gokrokve has quit IRC | 02:11 | |
| ayoung | harlowja, if the token ID were not a "symetric shared secret" already I would just use it. But that would open up a security hole. | 02:11 |
| harlowja | ya, the OTP thing would seem useful to have nova drop in to the metadata | 02:12 |
| ayoung | harlowja, BTW, there should be no problem providing user, project to the VM, provided it is optional | 02:12 |
| ayoung | there is nothing secret about either | 02:12 |
| ayoung | and the user spinning up the VM would have to opt in to it, but that is ok | 02:12 |
| harlowja | ayoung well i think jamielennox was wondering how really useful it is (which is a valid question) | 02:12 |
| harlowja | in at least my case its currently useful (maybe someday it won't be) | 02:13 |
| jamielennox | harlowja: not really, i'm wondering about what user data should be passed into a vm | 02:13 |
| ayoung | harlowja, what are you planning on doing with that data? | 02:13 |
| jamielennox | and arguing that we should be trying to obscure names in favour of ids because they will screw someone up | 02:14 |
| harlowja | right now its just for interacting with a system that can drop the user, passwd, ssh-key and a bunch of other stuff (this isn't chef/puppet yet) into the vm so they can log right in | 02:14 |
| *** nsquare has quit IRC | 02:14 | |
| harlowja | *unix passwd | 02:14 |
| ayoung | jamielennox, i think the idea is that the VM should be getting project specific resources...which begs the question of "how are they authorized" | 02:15 |
| ayoung | you don;t really want to pass a token in to a VM by default | 02:15 |
| ayoung | harlowja, same reason I want OTP, really. SSO | 02:15 |
| *** davlaps has quit IRC | 02:16 | |
| harlowja | ayoung likely, if this was an OTP that both systems knew about then that would work also | 02:16 |
| ayoung | harlowja, yes, and it would only make sense if that were the case | 02:16 |
| ayoung | harlowja, also, the SSO system really needs to be per project | 02:16 |
| ayoung | coke and pepsi in the same data center should not be working through a common LDAP server | 02:17 |
| jamielennox | ayoung: if you aren't able to pass a token through then passing anything through to the VM related to the way your vm was booted sounds dodgy | 02:17 |
| ayoung | jamielennox, its that the token has other security connotations | 02:17 |
| ayoung | you don;t want the VM spinning up another vm | 02:18 |
| jamielennox | so why isn't all of this being handled by templated boot scripts | 02:18 |
| jamielennox | here is the firstboot script | 02:18 |
| ayoung | jamielennox, you need an external OTP | 02:18 |
| ayoung | the sequence is: | 02:18 |
| jamielennox | its got a %(user_id) field in it that is replaced prior to sending off to the VM | 02:18 |
| ayoung | 1. generate OTP. 2. create vm with OTP 3. Notify FreeIPA with OTP of new host | 02:19 |
| jamielennox | that way it's up to the person who sets up the script what information is transfered into the vm | 02:19 |
| ayoung | yes, there is a race condition, as the FreeIPA server needs to finish before the host can run ipa-client-install | 02:19 |
| ayoung | but you can retry in a loop if needs be | 02:19 |
| ayoung | jamielennox, but you don't want to hijack "user-info" for every VM. You want it to be "autoregister the VM with IPA" and then "run your cusomt initialization" | 02:20 |
| jamielennox | otp = uuid.uuid4().hex, firstboot = bootscript % {'otp': otp, 'user_id': context.user_id, .... } bootscript can know what to do with OTP once in | 02:20 |
| harlowja | jamielennox sure templated user-data/boot-scripts could work, although users really don't remember to fill in user-data and this information is already known in keystone so it doens't exactly feel like its user-data (its more of system-data) | 02:20 |
| jamielennox | harlowja: but if not some sort of user-data script what is going to be receiving all this metadata on the VM end? | 02:21 |
| harlowja | userdata can also be random shellscripts and other stuff, so templating would probably cause issues | 02:21 |
| jamielennox | right, it'd be more involved than a python keyword format | 02:22 |
| harlowja | jamielennox so there is user-data and meta-data that is provided on config-drive/os-metadata-service | 02:22 |
| *** leseb has joined #openstack-keystone | 02:22 | |
| harlowja | metadata already has system information in it | 02:23 |
| *** sbfox has joined #openstack-keystone | 02:23 | |
| jamielennox | is it just saved somewhere? | 02:24 |
| harlowja | nova generates the metadata | 02:24 |
| harlowja | ^ info seems to be more metadata not userdata | 02:25 |
| *** richm has quit IRC | 02:25 | |
| harlowja | with stuff like the following (from a havana vm i think) | 02:25 |
| harlowja | {"admin_pass": "XYZ", "uuid": "ABC", "availability_zone": "nova", "hostname": "blahblah", "launch_index": 0, "network_config": {"content_path": "/content/0000", "name": "network_config"}, "name": "anvil"} | 02:26 |
| jamielennox | i was thinking on the VM side, does it call out to nova to get that, or is it put in a file on the drive? | 02:26 |
| ayoung | harlowja, I would like it to be something that is automated...so it should be from the metadata server | 02:26 |
| harlowja | jamielennox nova writes/provides that info | 02:26 |
| jamielennox | (showing my lack of nova knowledge here) | 02:26 |
| *** xianghui has joined #openstack-keystone | 02:26 | |
| harlowja | np | 02:26 |
| ayoung | the OTP is tricky as two different systems need to get involved: metadata and the notifications | 02:26 |
| harlowja | yup and the downstream system needs to know about the OTP i assume? | 02:27 |
| *** leseb has quit IRC | 02:27 | |
| *** sbfox has quit IRC | 02:28 | |
| harlowja | *which is tough (depending on said system, ha) | 02:28 |
| jamielennox | harlowja: ok, so back to basics, my concern is essentially that any 'name' should be ignored outside of keystone, in the same way you can do volume-type names etc that should be used internally only by there id | 02:30 |
| harlowja | ayoung although the OTP thing and connections into other systems (via notifications or synchrnous? workflow plugins in nova) does seem like a way in the future | 02:30 |
| jamielennox | if there's a reason you must then sure - the data should be available at that point, but it's kind of breaking the abstraction | 02:30 |
| harlowja | jamielennox so a config-option along with this for 'include_names' ? ;) | 02:30 |
| harlowja | ^ or something similar | 02:30 |
| harlowja | *defaulting to off/false | 02:30 |
| jamielennox | and i know there has been talk previously that we should create a new token format that contains nothing but ids so things like swift's screw up can't happen | 02:31 |
| *** shakamunyi has quit IRC | 02:31 | |
| jamielennox | harlowja: if there is no security risk in providing the id then i don't see there's an additional risk to providing the name as well, it's purely a matter of "nothing should be using this" - which is obviously not always the case | 02:32 |
| harlowja | ya | 02:32 |
| ayoung | harlowja, not really...as I said, designate is already doing that. Genreate an DNS name based on the VM name | 02:32 |
| jamielennox | so i guess it's just a matter of people who use this information have to understand the concepts of names in openstack and they could get burnt | 02:32 |
| harlowja | agreed | 02:33 |
| jamielennox | nothing new there i guess | 02:34 |
| harlowja | right, with great power comes great responsibility | 02:34 |
| harlowja | ha | 02:35 |
| harlowja | *for some version of 'great power', lol | 02:35 |
| jamielennox | lol | 02:35 |
| ayoung | harlowja, I'd make it "opt in on a per project basis" | 02:35 |
| harlowja | how's that setting gotten to nova? | 02:36 |
| * harlowja i didn't know this existed (this type of metadata sharing) | 02:37 | |
| harlowja | does the nova context contain all that info, from a quick look it doesn't seem to have project 'metadata' (from keystone) | 02:39 |
| harlowja | anyway i'll bbl, can discuss this more maybe on the review if needed? | 02:42 |
| jamielennox | harlowja: sure - but i'm ok, i was just trying to point out that names are bad | 02:48 |
| harlowja | jamielennox yes, agreed, names bad :) | 02:48 |
| jamielennox | if you need them then i guess it's just a matter of making sure user's know what they're doing | 02:48 |
| harlowja | right | 02:50 |
| topol | morganfainberg you there? | 02:50 |
| *** zhiyan is now known as zhiyan_ | 02:50 | |
| *** mberlin has joined #openstack-keystone | 02:53 | |
| *** mberlin1 has quit IRC | 02:56 | |
| *** zhiyan_ is now known as zhiyan | 03:03 | |
| *** ayoung has quit IRC | 03:11 | |
| *** ayoung_ has quit IRC | 03:11 | |
| *** leseb has joined #openstack-keystone | 03:23 | |
| *** leseb has quit IRC | 03:24 | |
| *** xianghui has quit IRC | 03:25 | |
| *** leseb has joined #openstack-keystone | 03:25 | |
| *** xianghui has joined #openstack-keystone | 03:28 | |
| *** ukalifon has joined #openstack-keystone | 03:29 | |
| *** leseb has quit IRC | 03:29 | |
| *** praneshp has quit IRC | 03:47 | |
| *** packet has quit IRC | 03:54 | |
| *** radez is now known as radez_g0n3 | 03:54 | |
| *** nsquare has joined #openstack-keystone | 04:01 | |
| *** amcrn has quit IRC | 04:01 | |
| *** nsquare has quit IRC | 04:02 | |
| *** nsquare has joined #openstack-keystone | 04:03 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:17 | |
| *** topol has quit IRC | 04:25 | |
| *** leseb has joined #openstack-keystone | 04:26 | |
| *** praneshp has joined #openstack-keystone | 04:29 | |
| *** leseb has quit IRC | 04:30 | |
| *** praneshp_ has joined #openstack-keystone | 04:32 | |
| *** henrynash has joined #openstack-keystone | 04:33 | |
| *** praneshp has quit IRC | 04:34 | |
| *** praneshp_ is now known as praneshp | 04:34 | |
| *** ozialien has quit IRC | 04:36 | |
| *** stevemar2 has joined #openstack-keystone | 04:43 | |
| *** stevemar has quit IRC | 04:43 | |
| openstackgerrit | Brad Topol proposed a change to openstack/keystone: Add instructions for removing pyc files to docs https://review.openstack.org/97140 | 04:45 |
| *** harlowja is now known as harlowja_away | 04:48 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:52 | |
| *** Abhijeet has joined #openstack-keystone | 04:52 | |
| *** zhiyan is now known as zhiyan_ | 05:01 | |
| *** dolphm has quit IRC | 05:03 | |
| *** dolphm has joined #openstack-keystone | 05:04 | |
| *** marcoemorais has joined #openstack-keystone | 05:04 | |
| *** marcoemorais1 has joined #openstack-keystone | 05:06 | |
| *** marcoemorais has quit IRC | 05:08 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: fixed several pep8 issues https://review.openstack.org/93686 | 05:16 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: multi-backend support for identity https://review.openstack.org/74214 | 05:24 |
| *** amcrn has joined #openstack-keystone | 05:26 | |
| *** leseb has joined #openstack-keystone | 05:26 | |
| *** leseb has quit IRC | 05:30 | |
| *** ajayaa has joined #openstack-keystone | 05:37 | |
| *** praneshp has quit IRC | 05:38 | |
| openstackgerrit | Brad Topol proposed a change to openstack/keystone: Add cloud auditing notification documentation https://review.openstack.org/97146 | 05:39 |
| *** praneshp has joined #openstack-keystone | 05:39 | |
| *** derek_c has joined #openstack-keystone | 05:40 | |
| openstackgerrit | Andre Naehring proposed a change to openstack/keystone: Add information regarding HTTPS for SSL enabled endpoints https://review.openstack.org/95545 | 05:40 |
| *** topol has joined #openstack-keystone | 05:46 | |
| topol | stevemar2 dont you ever sleep :-) | 05:47 |
| stevemar2 | topol, meh, it's overrated | 05:47 |
| stevemar2 | how am i stevemar2 again? | 05:48 |
| stevemar2 | i really do not like my isp | 05:48 |
| topol | stevemar2, dunno. but you are now ready to have kids!!! | 05:48 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/97005 | 06:01 |
| *** xianghui has quit IRC | 06:18 | |
| *** topol has quit IRC | 06:28 | |
| *** derek_c has quit IRC | 06:40 | |
| *** sbfox has joined #openstack-keystone | 06:40 | |
| *** xianghui has joined #openstack-keystone | 06:44 | |
| *** xianghui has quit IRC | 06:51 | |
| marekd | jamielennox: no, i didn't. I will try to do it now. Anyway, it looks like it's an error coming from Keystone. Is it even possible to use requests.Session() instead of keystoneclient.session.Session()? | 06:57 |
| *** tomoiaga has joined #openstack-keystone | 06:58 | |
| jamielennox | marekd: no, they are not replaceable, keystoneclient.Session uses a requests.session internally | 06:58 |
| marekd | jamielennox: yes i know | 06:58 |
| marekd | jamielennox: but on the other hand, it uses requests.Session() underneath and basically wraps it... | 06:58 |
| jamielennox | yea, it adds to a requests.Session, so you do need both | 07:00 |
| marekd | jamielennox: ;/ ok, i am going to look into it right about now.. | 07:01 |
| marekd | jamielennox: are you going to be here or logging out? | 07:01 |
| marekd | [in case i need some quick consultancy] | 07:01 |
| jamielennox | i'll be gone in about 15 minutes :) | 07:01 |
| marekd | => so no | 07:02 |
| *** tomoiaga has left #openstack-keystone | 07:06 | |
| *** xianghui has joined #openstack-keystone | 07:08 | |
| *** sbfox has quit IRC | 07:09 | |
| *** gyee has quit IRC | 07:10 | |
| *** BAKfr has joined #openstack-keystone | 07:13 | |
| *** afazekas has joined #openstack-keystone | 07:14 | |
| *** andreaf has joined #openstack-keystone | 07:22 | |
| *** stevemar2 has quit IRC | 07:23 | |
| *** andreaf has quit IRC | 07:26 | |
| ajayaa | Hi. Can I add filters like project_id:(scope.project.id)s in policy for all the apis? | 07:31 |
| *** ncoghlan is now known as ncoghlan_afk | 07:44 | |
| *** ncoghlan_afk is now known as ncoghlan | 07:44 | |
| *** ncoghlan has quit IRC | 07:44 | |
| *** praneshp has quit IRC | 07:50 | |
| marekd | jamielennox: hmmm, the reason for the bug was: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/session.py#L255 | 07:55 |
| marekd | if i change allow_redirects = True, the requests.Session() will work correctly. Now, I really want to to be able to change that value when I call keystoneclient.session.Session.request() method | 07:57 |
| *** xianghui has quit IRC | 08:05 | |
| *** xianghui has joined #openstack-keystone | 08:22 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Allow for using requests.Session() redirections https://review.openstack.org/97428 | 08:22 |
| *** andreaf has joined #openstack-keystone | 08:28 | |
| *** xianghui has quit IRC | 08:45 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: add missing log hints for level C/E/I/W https://review.openstack.org/95381 | 08:49 |
| *** amcrn has quit IRC | 08:49 | |
| *** xianghui has joined #openstack-keystone | 08:58 | |
| *** yfujioka has joined #openstack-keystone | 09:05 | |
| yfujioka | hello | 09:05 |
| yfujioka | I have been trying ldap backend with devstack | 09:05 |
| yfujioka | I couldn't get default project id of user when backend is ldap. | 09:07 |
| yfujioka | is it specification? did I miss configuration? | 09:08 |
| *** fmarco76 has joined #openstack-keystone | 09:13 | |
| *** fmarco76 has left #openstack-keystone | 09:13 | |
| *** marcoemorais1 has quit IRC | 09:22 | |
| marekd | Assuming PKI tokens are used, do services like nova will ever contact Keystone after the request for e.g. a new VM machine will arrives? | 09:27 |
| *** rodrigods_ has joined #openstack-keystone | 09:32 | |
| *** rodrigods_ has quit IRC | 09:46 | |
| *** jaosorior has joined #openstack-keystone | 09:50 | |
| *** gabriel-bezerra has quit IRC | 10:07 | |
| *** tellesnobrega has quit IRC | 10:07 | |
| *** htruta has quit IRC | 10:07 | |
| *** samuelmz has quit IRC | 10:07 | |
| *** rodrigods has quit IRC | 10:07 | |
| *** gabriel-bezerra has joined #openstack-keystone | 10:09 | |
| *** samuelmz has joined #openstack-keystone | 10:09 | |
| *** rodrigods has joined #openstack-keystone | 10:10 | |
| *** htruta has joined #openstack-keystone | 10:11 | |
| *** afaranha has joined #openstack-keystone | 10:13 | |
| *** tellesnobrega has joined #openstack-keystone | 10:13 | |
| *** xianghui has quit IRC | 10:26 | |
| *** nsquare has quit IRC | 10:27 | |
| ajayaa | marekd: there is something called revocation list which is fetched by the middle ware in certain intervals which lists out the revoked tokens. | 10:36 |
| ajayaa | marekd: see this. https://wiki.openstack.org/wiki/PKI-Revoke | 10:38 |
| *** xianghui has joined #openstack-keystone | 10:44 | |
| *** xianghui has quit IRC | 10:50 | |
| *** dims_ has joined #openstack-keystone | 11:14 | |
| ajayaa | Hi. Any idea on how do I list users in a project in keystone v3 api? | 11:20 |
| *** htruta has quit IRC | 11:23 | |
| BAKfr | ajaya, I think you can list user's roles on project, and consider that the user is on the project only if he has at least one role. | 11:28 |
| *** htruta has joined #openstack-keystone | 11:30 | |
| *** Abhijeet has quit IRC | 11:32 | |
| *** diegows has joined #openstack-keystone | 11:39 | |
| marekd | ajayaa: true, forgot to think about that, but, apart from that, when a request for booting a machine arrives to nova, it has all the information in the token and internal config. | 11:39 |
| *** ukalifon has quit IRC | 11:39 | |
| openstackgerrit | Marco Fargetta proposed a change to openstack/keystone-specs: Web Authentication for SAML federated Keystone https://review.openstack.org/96867 | 11:40 |
| openstackgerrit | Marco Fargetta proposed a change to openstack/keystone-specs: Web Authentication for SAML federated Keystone https://review.openstack.org/96867 | 11:43 |
| *** packet has joined #openstack-keystone | 11:55 | |
| *** raildo has joined #openstack-keystone | 11:59 | |
| ajayaa | BAKfr: agee. But I think there should be some way to list users without roles. If an user has multiple roles then the "role-assignment-list" result would be too big. | 12:04 |
| ajayaa | marekd: Yes nova has all the information. afaik things like authentication and authorisation is handled by the middleware which when gives a go-ahead, actual nova service comes into picture. | 12:06 |
| marekd | ajayaa: ok, thanks. | 12:07 |
| *** ukalifon has joined #openstack-keystone | 12:11 | |
| *** packet has quit IRC | 12:11 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Enforce ``saml2`` protocol in Apache config https://review.openstack.org/97479 | 12:17 |
| marekd | dolphm, morganfainberg_Z: easy review ^^ | 12:18 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Enforce ``saml2`` protocol in Apache config https://review.openstack.org/97479 | 12:19 |
| *** zhiyan_ is now known as zhiyan | 12:21 | |
| *** ukalifon has quit IRC | 12:23 | |
| *** zhiyan is now known as zhiyan_ | 12:31 | |
| *** dims_ has quit IRC | 12:31 | |
| *** dims_ has joined #openstack-keystone | 12:32 | |
| *** gordc has joined #openstack-keystone | 12:32 | |
| *** xianghui has joined #openstack-keystone | 12:33 | |
| *** bvandenh has joined #openstack-keystone | 12:47 | |
| *** radez_g0n3 is now known as radez | 12:57 | |
| marekd | lbragstad: https://review.openstack.org/#/c/87849/ -> I think stevemar was right, you will not use it at the moment. Could you please add a comment so the patch could be either processed or abandoned? | 13:03 |
| lbragstad | marekd: sure | 13:04 |
| marekd | lbragstad: thanks. | 13:04 |
| marekd | :-) | 13:04 |
| lbragstad | marekd: no problem, thanks for the reminder | 13:04 |
| *** openstackgerrit has quit IRC | 13:06 | |
| *** openstackgerrit has joined #openstack-keystone | 13:06 | |
| lbragstad | marekd: updated | 13:06 |
| marekd | yep, thanks. dstanek_zzz - I think you can now remove your -2 and we can move it back to the federation. | 13:08 |
| marekd | dstanek_zzz: https://review.openstack.org/#/c/87849/ | 13:10 |
| *** gordc has quit IRC | 13:11 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Cross Backend Unique Idenifiers for User and Group Entities https://review.openstack.org/97492 | 13:15 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Move mutable parameter checking into federation https://review.openstack.org/87849 | 13:15 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Cross Backend Unique Idenifiers for User and Group Entities https://review.openstack.org/97492 | 13:17 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone-specs: Purpose api-validation blueprint https://review.openstack.org/95957 | 13:21 |
| *** hrybacki has joined #openstack-keystone | 13:25 | |
| *** bknudson has joined #openstack-keystone | 13:32 | |
| *** ChanServ sets mode: +o dolphm | 13:33 | |
| ajayaa | dolphm: Hi. How do I list users in a project in keystone v3 api? I could use list-role-assignments. But there was such an api present in v2 but not in v3. | 13:42 |
| dolphm | ajayaa: I believe it's GET /v3/role_assignments?project.id={project_id} | 13:43 |
| ajayaa | Yes it gives you all the roles along with users. | 13:43 |
| ajayaa | dolphm: it gives the roles along with users, right? but in v2 there was /v2.0/tenants/​{tenantId}​/users. There is no such api in v3. Just curious why such an api is not there. | 13:46 |
| *** ayoung has joined #openstack-keystone | 13:47 | |
| ayoung | morganfainberg_Z, when you wake up, there is good news waiting for you. https://github.com/krb5/krb5/commit/d950809ff49e3e7603594186d77135a09ab6b1b2 | 13:49 |
| dolphm | ajayaa: i'm not clear what about the v2 call you're looking for that the v3 call does not provide? the v3 equivalent is actually much more powerful | 13:50 |
| dolphm | or should be, anyway | 13:50 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Cross Backend Unique Idenifiers for User and Group Entities https://review.openstack.org/97492 | 13:51 |
| *** shakamunyi has joined #openstack-keystone | 13:51 | |
| htruta | stevemar, dtroyer: hey :( | 13:52 |
| *** xianghui has quit IRC | 13:52 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: multi-backend support for identity https://review.openstack.org/74214 | 13:54 |
| *** joesavak has joined #openstack-keystone | 13:56 | |
| ajayaa | dolphm: Yes it's powerful but If an user has multiple roles he would appear multiple times in the v3 call. It could be useful to provide an api which would list out just the user names and user ids in a project. | 13:57 |
| ajayaa | dolphm: If you want to list out the users of a project along with their id and email it would take two calls as of now. | 13:58 |
| dolphm | ajayaa: what's the second call, GET /users/{user_id} ? | 14:01 |
| ajayaa | yes. I think you can call GET /users. | 14:04 |
| ajayaa | dolphm, The call " /users" is not documented but the openstack client calls it when you issue "openstack user list" | 14:06 |
| dolphm | ajayaa: it's documented here https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#list-users-get-users | 14:07 |
| lbragstad | isn't it documented here https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#users | 14:07 |
| *** topol has joined #openstack-keystone | 14:07 | |
| dolphm | lbragstad: ++ | 14:07 |
| ajayaa | sorry my bad. I was following http://developer.openstack.org/api-ref-identity-v3.html | 14:08 |
| *** henrynash has quit IRC | 14:11 | |
| *** gordc has joined #openstack-keystone | 14:12 | |
| dolphm | ajayaa: unfortunately that page is full of copy/pasted mistakes from the link above, and is far from complete :( we're trying to figure out how to get rid of it | 14:12 |
| ajayaa | dolphm: okay. Thank you. If I use keystone v3 token with other services such as nova, would they have a problem? I have tried calling a few nova apis with v3 token and they work. | 14:16 |
| ayoung | hrybacki, dolphm http://adam.younglogic.com/2014/06/keystone-tox-cheat-sheet/ | 14:17 |
| hrybacki | ayoung++ | 14:18 |
| lbragstad | ayoung: do you know if there is a community wide tox guide somewhere? | 14:23 |
| dolphm | ajayaa: the latest version of auth_token should take care to handle any differences | 14:23 |
| dolphm | lbragstad: pip install tox; tox # <-- community guide | 14:24 |
| lbragstad | :) good point | 14:24 |
| ayoung | lbragstad, I do not | 14:26 |
| ayoung | I've not seen one, but I have not looked | 14:26 |
| ajayaa | dolphm: Our servers are still running havana. Could the latest auth_token be backported to havana or would it be too much work? | 14:26 |
| dolphm | ajayaa: auth_token lives in the client, so it wouldn't require backporting. just install the latest client | 14:26 |
| lbragstad | ayoung: ok, for some reason I thought I saw one at some point, figure your info would be a good addition | 14:26 |
| dolphm | ajayaa: (on your control plane) | 14:26 |
| *** andreaf has quit IRC | 14:29 | |
| ajayaa | dolphm: The command line script "keystone" doesn't support keystone v3, right? I think I will need to use "openstack" command line script. | 14:34 |
| *** stevemar has joined #openstack-keystone | 14:36 | |
| *** gokrokve has joined #openstack-keystone | 14:36 | |
| ayoung | hrybacki, http://koji.fedoraproject.org/koji/buildinfo?buildID=466643 that is a 1.6.1 RPM ...gonna try it | 14:38 |
| ayoung | dolphm, is there some way we could make tox honor older versions of the stable branches? Something like: tox -epy27i for icehouse and -3py27h for havana? | 14:43 |
| *** ajayaa has quit IRC | 14:45 | |
| ayoung | Backports are expensive in rebuild time | 14:45 |
| *** gordc1 has joined #openstack-keystone | 14:46 | |
| *** gordc has quit IRC | 14:46 | |
| *** rodrigods has quit IRC | 14:47 | |
| lbragstad | ayoung: can't that be accomplished by checking out the stable branch code? | 14:48 |
| ayoung | lbragstad, but then tox rebuilds the venv | 14:48 |
| ayoung | I guess I could do the mv .tox/epy27 .tox/ep27h | 14:48 |
| ayoung | and so forth | 14:48 |
| ayoung | would be nice if tox managed that directly, is all | 14:49 |
| *** dims_ has quit IRC | 14:49 | |
| *** gordc1 is now known as gordc | 14:50 | |
| *** rodrigods has joined #openstack-keystone | 14:51 | |
| ayoung | lbragstad, what is the magic to failfast on tox? | 14:54 |
| ayoung | IE run until first error and then stop | 14:54 |
| dolphm | ayoung: it just passes arguments to the underlying test runner | 14:55 |
| lbragstad | ayoung: testr run --until-failure ? | 14:57 |
| ayoung | hrybacki, libxml2-devel-2.9.1-2.fc20.x86_64 | 14:57 |
| hrybacki | ayoung++ | 14:57 |
| ayoung | lbragstad, with tox? Or just activate the venv and run that | 14:57 |
| lbragstad | you could try it in venv, but tox should do the same thing | 14:58 |
| lbragstad | I've never used that before I don't think | 14:58 |
| ayoung | lbragstad, OK, I'm trying; tox -epy27 -r -- --until-failure | 15:01 |
| ayoung | or should that be | 15:01 |
| ayoung | lbragstad, OK, I'm trying; tox -epy27 -r args --until-failure | 15:01 |
| hrybacki | ayoung, still seems to be crashing on libxml -- same point | 15:01 |
| ayoung | hrybacki, you running tox inside the venv? | 15:02 |
| hrybacki | nope | 15:02 |
| ayoung | shouldn;t matter, though | 15:02 |
| lbragstad | hrybacki: to activate your venv: /opt/stack/keystone$ . .tox/py27/bin/activate | 15:02 |
| ayoung | hrybacki, #include "libxml/xmlversion.h" should be in /usr/include | 15:02 |
| ayoung | is it? | 15:02 |
| lbragstad | your prompt should change: (py27)lbragstad@precise64:/opt/stack/keystone$ | 15:02 |
| ayoung | /usr/include/libxml2/libxml/xmlversion.h | 15:02 |
| ayoung | lbragstad, nah, he' | 15:03 |
| ayoung | 's past that | 15:03 |
| bknudson | https://wiki.openstack.org/wiki/Testr | 15:03 |
| ayoung | problem is with the dependenciesthat are not from pip | 15:03 |
| hrybacki | ayoung, /usr/include/libxml2/ is the closest thing | 15:03 |
| ayoung | hrybacki, rpmquery -f /usr/include/libxml2/libxml/xmlversion.h | 15:03 |
| ayoung | libxml2-devel-2.9.1-2.fc20.x86_64 | 15:03 |
| lbragstad | ayoung: hrybacki there could be conflicts with what is installed already on the system | 15:03 |
| hrybacki | ayoung, libxml2-devel-2.9.1-2.fc20.x86_64 | 15:04 |
| hrybacki | lbragstad, hrm | 15:04 |
| lbragstad | hrybacki: how are you hitting the error? | 15:07 |
| *** yfujioka has quit IRC | 15:08 | |
| hrybacki | lbragstad, ran tox -epy27 | 15:08 |
| lbragstad | have you tried recreating your tox env? | 15:08 |
| hrybacki | so /usr/include/libxml2/libxml/xmlversion.h shows I'm 2.9.1 is installed | 15:08 |
| hrybacki | and the reqs are looking for >= 2.3 | 15:08 |
| hrybacki | how? | 15:08 |
| lbragstad | tox -e py27 --recreate | 15:08 |
| hrybacki | kk | 15:09 |
| marekd | or tox -re <option> | 15:10 |
| lbragstad | marekd: ++ | 15:10 |
| hrybacki | learning all of the things today | 15:10 |
| hrybacki | also failed at the same sport -- pastebin -- http://paste.fedoraproject.org/106841/01808292/ | 15:11 |
| *** joesavak has quit IRC | 15:12 | |
| ayoung | hrybacki, bet it is a dependency | 15:12 |
| ayoung | not libxml/xmlversion.h but something it depends on | 15:12 |
| ayoung | hrybacki, the list of RPMS needed is in devstack | 15:12 |
| bknudson | you have to install some dev packages | 15:12 |
| ayoung | 1 sec | 15:13 |
| hrybacki | ayoung, bknudson++ | 15:13 |
| bknudson | sudo apt-get install -y git git-review | 15:13 |
| ayoung | hrybacki, https://github.com/openstack-dev/devstack/blob/master/files/rpms/keystone | 15:13 |
| bknudson | sudo apt-get install -y libxslt1-dev libmysqlclient-dev | 15:13 |
| ayoung | that is not enought, though | 15:14 |
| ayoung | https://github.com/openstack-dev/devstack/blob/master/files/rpms/general | 15:14 |
| bknudson | that's needed before running devstack | 15:14 |
| ayoung | there are also specific ones for mysql | 15:14 |
| bknudson | at least that's what worked for me | 15:14 |
| marekd | on my debian i had to also install: python-dev libldap2-dev libsasl2-dev libssl-dev zlib-dev libxml2-dev libxslt1-dev | 15:15 |
| *** joesavak has joined #openstack-keystone | 15:15 | |
| lbragstad | ayoung: I had to do sudo yum install mysql-devel to get devstack to work on centOS | 15:18 |
| *** afazekas has quit IRC | 15:20 | |
| hrybacki | lbragstad++ on mysql-devel | 15:24 |
| lbragstad | hrybacki: did that work? | 15:24 |
| hrybacki | find out -- it crashed on sql this time -- seeing how far this run gets it | 15:25 |
| marekd | stevemar: hm, you very likely right about the protocol. I will change the patch, however I think the location should not accept wildcards. | 15:28 |
| stevemar | marekd, yeah, maybe mention that in the change? | 15:29 |
| marekd | stevemar: yeah. | 15:29 |
| stevemar | Note: saml2 may be different in your deployment, but do not use a wildcard value? | 15:30 |
| stevemar | marekd, ^ | 15:30 |
| marekd | stevemar: OK | 15:30 |
| *** pheadron has quit IRC | 15:30 | |
| *** radez is now known as radez_g0n3 | 15:31 | |
| marekd | stevemar: and leave saml2 hardcoded in that <Location> regex? | 15:32 |
| *** pheadron has joined #openstack-keystone | 15:32 | |
| stevemar | marekd, yes, i think so | 15:33 |
| marekd | stevemar: ok | 15:33 |
| marekd | tox'ing. | 15:33 |
| *** gyee has joined #openstack-keystone | 15:34 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Enforce ``saml2`` protocol in Apache config https://review.openstack.org/97479 | 15:36 |
| *** gokrokve has quit IRC | 15:37 | |
| *** bvandenh has quit IRC | 15:43 | |
| *** morganfainberg_Z is now known as morganfainberg | 15:43 | |
| *** andreaf has joined #openstack-keystone | 15:46 | |
| marekd | stevemar: if I make patch X a dependency for patch Y, and X is for some reason -2'ed, is there a way to cleanly undo the dependency in gerrit/git ? | 15:46 |
| marekd | stevemar: I am not sure the allow_redirects for requests.Session() will be +A and that's why I didn't want to make it a dependency for saml authn plugin. | 15:47 |
| stevemar | marekd, ahh, then just call out the patch in the commit msg | 15:47 |
| marekd | stevemar: sure. | 15:48 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Implement SAML2 ECP authentication https://review.openstack.org/92166 | 15:51 |
| *** vhoward has left #openstack-keystone | 15:52 | |
| stevemar | i vote henrynash do all of our specs from now on | 15:55 |
| stevemar | https://review.openstack.org/#/c/97492/3/specs/juno/multi-backend-uuids.rst was such a nice read | 15:55 |
| morganfainberg | stevemar, lol | 15:56 |
| stevemar | morganfainberg, it really was! | 15:56 |
| stevemar | morganfainberg, yours are equally good :) | 15:56 |
| morganfainberg | stevemar, meh. mine are a litte haphazard compared to henry's | 15:57 |
| *** joesavak has quit IRC | 16:01 | |
| *** afazekas has joined #openstack-keystone | 16:04 | |
| *** richm has joined #openstack-keystone | 16:07 | |
| *** BAKfr has quit IRC | 16:08 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Add v2 & v3 API documentation https://review.openstack.org/96242 | 16:10 |
| *** dims_ has joined #openstack-keystone | 16:16 | |
| bknudson | marekd: you can undo the dependency with gerrit/git | 16:18 |
| bknudson | should be able to do a git rebase -i HEAD~2 , remove the commit you don't want | 16:19 |
| bknudson | and then push that with git-review | 16:19 |
| *** dims_ has quit IRC | 16:21 | |
| *** marcoemorais has joined #openstack-keystone | 16:22 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Add v2 & v3 API documentation https://review.openstack.org/96242 | 16:26 |
| *** joesavak has joined #openstack-keystone | 16:29 | |
| *** afaranha has left #openstack-keystone | 16:40 | |
| *** pafuent has joined #openstack-keystone | 16:40 | |
| pafuent | ayoung: Sorry to bother you, but, Did you have time to look deeper at the auth_url issue that I mentioned yesterday? | 16:44 |
| *** harlowja_away is now known as harlowja | 16:45 | |
| *** thedodd has joined #openstack-keystone | 16:45 | |
| *** gokrokve has joined #openstack-keystone | 16:50 | |
| ayoung | pafuent, nope | 16:55 |
| *** 7F1AATB60 has joined #openstack-keystone | 16:58 | |
| *** 7F1AATB60 has quit IRC | 16:59 | |
| *** radez_g0n3 is now known as radez | 16:59 | |
| *** marcoemorais has quit IRC | 16:59 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Initial implementation of validator https://review.openstack.org/86483 | 16:59 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Catalog V3 resources https://review.openstack.org/96266 | 16:59 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 16:59 |
| *** marcoemorais has joined #openstack-keystone | 16:59 | |
| pafuent | ayoung: OK, from my side I'll provide a quick fix for Blazar. If you need more info in order to check if it is a bug please let me know. | 16:59 |
| *** amcrn has joined #openstack-keystone | 17:00 | |
| *** marcoemorais1 has joined #openstack-keystone | 17:00 | |
| *** marcoemorais has quit IRC | 17:04 | |
| *** sbfox has joined #openstack-keystone | 17:07 | |
| *** vhoward has joined #openstack-keystone | 17:08 | |
| morganfainberg | stevemar, ping | 17:10 |
| stevemar | morganfainberg, pong | 17:10 |
| *** henrynash has joined #openstack-keystone | 17:10 | |
| morganfainberg | stevemar, oauth | 17:11 |
| stevemar | morganfainberg, y | 17:11 |
| morganfainberg | stevemar, so that thread you're on... there is a need for long-term delegation | 17:11 |
| morganfainberg | request tokens live for 28800 by default right? | 17:12 |
| stevemar | morganfainberg, if you mark the expires values in the .conf to None they should live forever | 17:12 |
| stevemar | y | 17:12 |
| morganfainberg | stevemar, ah but don't get to control the conf in this case | 17:12 |
| morganfainberg | can't guarantee oauth isn't being used elsewhere | 17:12 |
| stevemar | morganfainberg, bah | 17:12 |
| morganfainberg | stevemar, yeah. | 17:13 |
| morganfainberg | stevemar, hmmm. | 17:13 |
| morganfainberg | stevemar, any thoughts on how to handle this type of scenario? | 17:15 |
| stevemar | morganfainberg, not really, shardy brought up the same problems | 17:15 |
| *** kun_huang has joined #openstack-keystone | 17:16 | |
| stevemar | morganfainberg, i had hoped that places the values in .conf was flexible enough, but apparently not | 17:16 |
| stevemar | morganfainberg, we could make it an optional call in authorize_request_token... | 17:16 |
| *** dims_ has joined #openstack-keystone | 17:17 | |
| stevemar | that is the only step where the authorizing user actually interacts with the REST API | 17:17 |
| stevemar | morganfainberg, i'm assuming it's more important that an access token live longer, than a request token | 17:18 |
| ayoung | morganfainberg, did you see my wakeup message for you? | 17:22 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Cross Backend Unique Idenifiers for User and Group Entities https://review.openstack.org/97492 | 17:23 |
| *** shakamunyi has quit IRC | 17:24 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Cross Backend Unique Idenifiers for User and Group Entities https://review.openstack.org/97492 | 17:24 |
| ayoung | morganfainberg, also, in response to yesterday's conversations about users, backend, and the like...I have not totally given up on multiple LDAP support in its current incarnation without a shadow table entry | 17:25 |
| *** browne has joined #openstack-keystone | 17:26 | |
| ayoung | henrynash, looks good! | 17:29 |
| henrynash | ayoung: getting there….specs rule, me thinks | 17:29 |
| ayoung | ++ | 17:29 |
| ayoung | its nice having the checklist of items to cover | 17:30 |
| ayoung | henrynash, for docs, you can run tex -edocs and see just those errors | 17:30 |
| ayoung | http://logs.openstack.org/14/74214/25/check/gate-keystone-docs/2c8159b/console.html | 17:30 |
| henrynash | yes…was about to go hunt that down! tahnsk | 17:31 |
| ayoung | henrynash, some of them are frustrating...rst rules in the internal comments | 17:31 |
| henrynash | yeah... | 17:31 |
| ayoung | keystone.identity.core.Manager:28: ERROR: Unexpected indentation. | 17:32 |
| ayoung | that is not line 28 of the file, but of the docstring | 17:32 |
| ayoung | line 238 in your patch | 17:33 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Cross Backend Unique Idenifiers for User and Group Entities https://review.openstack.org/97492 | 17:33 |
| ayoung | - there is a single LDAP driver and backward compatible IDs are not | 17:33 |
| ayoung | and then | 17:33 |
| ayoung | required. | 17:33 |
| ayoung | which probably should just align with the hash mark | 17:34 |
| morganfainberg | ayoung, never expect you to give up on an option w/o a shadow table. but for Juno we're going with the mapping table (pluggable of course). if it turns out to be better to drop it for an alternative for the default that's fine :) | 17:35 |
| morganfainberg | ayoung, gives us options and doesn't lock us in. | 17:36 |
| ayoung | morganfainberg, actually, for multiple LDAP, even with the shadow table, I think we'll need it. | 17:36 |
| ayoung | "no lookup in the backend" | 17:36 |
| ayoung | the API is | 17:36 |
| ayoung | accepst userid, projectid and roleid | 17:36 |
| ayoung | they will come in knowing username and the other info | 17:36 |
| ayoung | so...I guess the lookup in LDAP, if successful, will have to put in the shadow table entry | 17:37 |
| morganfainberg | ayoung, yeah. likely | 17:37 |
| henrynash | ayoung: thx | 17:38 |
| morganfainberg | henrynash, yea the specs make it a lot easier to define the targert. | 17:38 |
| morganfainberg | stevemar, i could get a new access token if the request token lived a long time | 17:39 |
| morganfainberg | stevemar, either way it's cut, one of them needs potential to keep living for a long time for this use case. | 17:39 |
| henrynash | morganfainberg: I’m a total convert (but then I always was)…but I just think it will make us much more efficient - i.e. REALLy agree the design upfront and then code reviews are just that | 17:39 |
| stevemar | morganfainberg, i initially set access tokens for a day :( | 17:40 |
| morganfainberg | henrynash, i'd like if it was built into the BP system (e.g. what I hope StoryBoard ends up being) | 17:41 |
| morganfainberg | henrynash, but it's good. | 17:42 |
| morganfainberg | stevemar, any thoughts on how to address this? maybe a way (when authorizing the request token) to say how long the access token can live? | 17:42 |
| morganfainberg | stevemar, if not specified, you get the default | 17:43 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: multi-backend support for identity https://review.openstack.org/74214 | 17:45 |
| morganfainberg | ayoung, gertty is pretty awesome if you've not looked at it | 17:48 |
| morganfainberg | stevemar, topol, ^ (gertty) | 17:49 |
| *** nsquare has joined #openstack-keystone | 17:50 | |
| ayoung | morganfainberg, so...this was why trusts: | 17:51 |
| ayoung | split authentication from authorization | 17:51 |
| ayoung | then trusts can live as long as we need | 17:52 |
| ayoung | and you authenticate as the "user" | 17:52 |
| ayoung | the problem with access tokens is that it lumps the two together | 17:52 |
| morganfainberg | ayoung, unfortunately I'm losing the battle of "needing a user for every single end point that wants to talk to X" | 17:52 |
| ayoung | and we have no unique way to identify Consumers outside of access tokens | 17:52 |
| marekd | bknudson: thanks. I will make the dependencies then. | 17:52 |
| morganfainberg | ayoung, i don't disagree with you at all. | 17:53 |
| ayoung | morganfainberg, I think the answer is outside the scope of the current oauth mechanism | 17:53 |
| ayoung | but it might be in oauth2 | 17:53 |
| morganfainberg | ayoung, and that is 100% acceptable answer | 17:53 |
| morganfainberg | ayoung, if current oauth can do it, great, if not - i'll see what else can | 17:53 |
| ayoung | morganfainberg, we need to merge oauth and trusts, we need a way to identify consumers | 17:54 |
| ayoung | we need a global directory | 17:54 |
| morganfainberg | though, i'm thinking the easiest way is to just tack in limited roles to EC2 credentials [it isn't dying] and work on a real "better solution" - around trusts, etc | 17:54 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Cross Backend Unique Idenifiers for User and Group Entities https://review.openstack.org/97492 | 17:54 |
| morganfainberg | ayoung, we already support EC2 creds, the only thing it doesn't support is restricted roles. | 17:55 |
| morganfainberg | ayoung, very minor change when creating the cred. -- but i would much rather not encourage the use of those things | 17:55 |
| ayoung | morganfainberg, could we make it? | 17:55 |
| morganfainberg | yeah, would be easy to just have a simple "roles_allowed:" and store that in the cred, and when we issue a token force those as the only valid roles. | 17:56 |
| morganfainberg | some extra mechanisms to ensure they are valid for user/<scope> combinations | 17:56 |
| morganfainberg | ayoung, small changeset i think. | 17:56 |
| morganfainberg | i just would rather not encourage those tokens. :P | 17:56 |
| henrynash | morganfainberg: one thing the creds API should support is a user_id filter…then at least we could craete policy that let a user look at his own creds | 17:57 |
| * morganfainberg is biased against EC2Credential crontrib. | 17:57 | |
| ayoung | morganfainberg, what if anything exhcnaged for a token went through a trust configuration, and we didn;t need to exlicitly create trusts, but could inherit trust definitions? Group based trusts? | 17:57 |
| henrynash | morganfainberg: I was going to write-up a quick bp (err.maybe spec :-) ) | 17:57 |
| morganfainberg | ayoung, interesting. | 17:57 |
| morganfainberg | henrynash, we already support it, just don't expose it to non-admin i think. | 17:58 |
| morganfainberg | henrynash, or well.. guard against looking at anyone's credentials | 17:59 |
| henrynash | morganfainberg: but you need to be able to list your entries so that you can read it | 17:59 |
| morganfainberg | henrynash, righr | 17:59 |
| henrynash | morganfainberg: we support the filter in the manager….just not in the controller | 17:59 |
| morganfainberg | henrynash, yah, we need to "fix" that so non-relational credential backends could work | 17:59 |
| henrynash | morhanfainberg: I’ll fix that up | 18:00 |
| morganfainberg | ah meeting time. | 18:00 |
| *** daneyon has joined #openstack-keystone | 18:03 | |
| openstackgerrit | Brad Topol proposed a change to openstack/keystone-specs: Spec for audit support for federation https://review.openstack.org/97581 | 18:06 |
| *** praneshp has joined #openstack-keystone | 18:17 | |
| *** ajayaa has joined #openstack-keystone | 18:38 | |
| *** juanmo has joined #openstack-keystone | 18:45 | |
| *** kun_huang has quit IRC | 18:58 | |
| *** kun_huang has joined #openstack-keystone | 18:58 | |
| *** kun_huang has quit IRC | 19:00 | |
| ayoung | henrynash, I'd be OK with adding to the user_crud extension | 19:00 |
| ayoung | GET /user/byname/{username} | 19:00 |
| ayoung | or something less gross | 19:00 |
| henrynash | ayoung: maybe I’m being dumb…why can’t you just call the manager…where is it you want to call this from? | 19:01 |
| ayoung | henrynash, CLI | 19:01 |
| ayoung | henrynash, as a project administrator, I want to grand a user a role on a proejct | 19:02 |
| ayoung | user has never logged in to open stack before | 19:02 |
| *** praneshp has quit IRC | 19:02 | |
| bknudson | with federation, there might not even be a user | 19:02 |
| henrynash | ayoung: Ok, right | 19:02 |
| ayoung | I can't log in as them, because its LDAP | 19:02 |
| bknudson | just a bag of attrs in a saml doc | 19:02 |
| ayoung | so I need to prepopulate the actor table | 19:02 |
| ayoung | bknudson, not once it is in the actor table it isn't | 19:02 |
| bknudson | what's in the actor table? | 19:03 |
| bknudson | the user's attrs? | 19:03 |
| bknudson | that attrs in the saml doc? | 19:03 |
| openstackgerrit | Juan Manuel Ollé proposed a change to openstack/python-keystoneclient: Keystoneclient create user API should have optional password. https://review.openstack.org/97597 | 19:04 |
| *** praneshp has joined #openstack-keystone | 19:04 | |
| henrynash | ayoung: sorry, on phone | 19:04 |
| jamielennox | morganfainberg: can you kick along: https://review.openstack.org/#/c/81985/ | 19:06 |
| jamielennox | and a quick one for everyone: https://review.openstack.org/#/c/91216/ | 19:07 |
| *** daneyon has quit IRC | 19:08 | |
| *** daneyon has joined #openstack-keystone | 19:08 | |
| morganfainberg | ayoung, do you think you're going to have time to work on the compressed token stuff here soon or should i move the apache_services check job to expirimental until we land everything | 19:08 |
| ayoung | morganfainberg, its coming | 19:09 |
| ayoung | morganfainberg, I just got some help on it... | 19:09 |
| morganfainberg | ayoung, just means you'd need to comment on the review to get the check done instead on everyone's reviews. | 19:09 |
| morganfainberg | ayoung, ok just checking before i start mucking with infra config patches | 19:09 |
| ayoung | I need to drop making it the default, but then figure out what are the right tests to add | 19:09 |
| ayoung | ah..you need it default in order to use it in infra | 19:10 |
| ayoung | move the apache_services check job to experimental | 19:10 |
| ayoung | dolphm, so we really should have an API that exposes get_user_by_name | 19:11 |
| ayoung | its only in authenticate right now | 19:11 |
| dolphm | ayoung: GET /v3/users?name={something} | 19:11 |
| ayoung | dolphm, yeah | 19:11 |
| ayoung | to populate the actors identity mapping table | 19:12 |
| ayoung | dolphm, I'm kindof worried about the effect list users would have first time it is run, if every user is going to trigger an entry in that table. For SQL it would be a migration, but for LDAP.... | 19:12 |
| ayoung | I suspect we are going to have a bit of a transition | 19:13 |
| bknudson | dolphm: I'd expect that to get the users in any domain? | 19:13 |
| ayoung | bknudson, its ok if the query is domain specific | 19:13 |
| dolphm | bknudson: correct, you have to additonally filter by domain_id | 19:13 |
| ayoung | GET /v3/users?name={something}&domain_name={} | 19:14 |
| ayoung | or | 19:14 |
| dolphm | ayoung: domain_id | 19:14 |
| ayoung | GET /v3/users?name={something}&domain_id={} | 19:14 |
| ayoung | dolphm, only if you can get domain_id from domain name | 19:14 |
| bknudson | ok, now keystone knows how to talk to the federation server to get user info? | 19:14 |
| bknudson | identity server | 19:14 |
| dolphm | ayoung: GET /v3/domains?name={domain_name} | 19:14 |
| dolphm | bknudson: no | 19:15 |
| morganfainberg | ayoung, will propose making it expirimental today then, thanks | 19:15 |
| *** htruta has quit IRC | 19:15 | |
| jamielennox | marekd: ping | 19:15 |
| ayoung | dolphm, hmmm, I wonder if we need a policy check on that call. Otherwise, people will start looking "I wonder if Domain = "Pepsi" is in this datacenter. | 19:15 |
| openstackgerrit | Rodrigo Duarte Sousa proposed a change to openstack/python-keystoneclient: Add example script for role_assignments module https://review.openstack.org/97600 | 19:15 |
| rodrigods | ayoung, ^ | 19:16 |
| ayoung | ++ | 19:16 |
| rodrigods | finally the example script you suggested =) | 19:16 |
| jaosorior | Is there any way to log user activity in keystone besides setting the debug option? | 19:16 |
| bknudson | now we need to maintain a bunch of scripts? | 19:16 |
| jaosorior | for auditing | 19:16 |
| bknudson | are there going to be tests so that they get run? | 19:17 |
| dolphm | ayoung: list_domains has a policy entry already | 19:17 |
| dolphm | jaosorior: you should talk to topol | 19:17 |
| topol | o/ | 19:17 |
| ayoung | dolphm, yeah, just not sure we are enforcing that a user needs to have a role in that domain, or a project in that domain, before they get an answer back...would be anexpensive call | 19:17 |
| dolphm | jaosorior: not quite auditing but http://docs.openstack.org/developer/keystone/event_notifications.html | 19:18 |
| topol | Hi jaosorior | 19:18 |
| topol | what do you need | 19:18 |
| dolphm | topol: i don't see any docs on openstack.org about authentication auditing? | 19:18 |
| topol | awesome, a stakeholder | 19:18 |
| rodrigods | bknudson, would be nice to have those scripts for a first time user, IMO | 19:19 |
| bknudson | rodrigods: not if the scripts stop working due to not being tested | 19:19 |
| topol | dolphm, I thought they were added to http://docs.openstack.org/developer/pycadf/ | 19:19 |
| topol | if not that is my bad and I will get that fixed | 19:19 |
| dolphm | topol: wasn't aware of that page either | 19:20 |
| dolphm | jaosorior: i'd also suggest running keystone behind apache and enabling an access log | 19:20 |
| rodrigods | bknudson, i think those scripts are just a type of documentation | 19:20 |
| topol | dolphm, I just posted a doc patch to keystone with that information | 19:20 |
| dolphm | topol: link? | 19:20 |
| rodrigods | bknudson, they can get deprecated, and need maintenance | 19:20 |
| topol | dolphm, #link https://review.openstack.org/#/c/97146/ | 19:22 |
| bknudson | I think we have enough problems maintaining the docs as it is | 19:22 |
| dolphm | topol: #link only works in #openstack-meeting | 19:22 |
| topol | dolphm, sorry, topol is #dumb | 19:22 |
| topol | dolphm, I'll add you as an a reviewer,let me know if we need to advertise http://docs.openstack.org/developer/pycadf/ in places other than where I added it | 19:23 |
| rodrigods | bknudson, the current docs doesn't show how we can use the client, for example | 19:24 |
| rodrigods | or, only shows a really limited set of operations | 19:24 |
| bknudson | rodrigods: right, we need those docs | 19:24 |
| rodrigods | bknudson, and, what's best than a script showing how it works for a dev? | 19:24 |
| rodrigods | =) | 19:24 |
| bknudson | a script that's tested that it works? | 19:25 |
| jaosorior | I'll check the notifications, but dolphm, can you elaborate on the access log? | 19:25 |
| topol | jaosorior, if you have feedback on where we need to add more audit records for keystone let me know. We like stakeholder driven development | 19:25 |
| rodrigods | bknudson, you mean, tests for the example script? can't they become obsolete as well? | 19:25 |
| bknudson | rodrigods: the tests run on every commit, so when it fails we have to fix it to get the code merged | 19:26 |
| dolphm | jaosorior: http://httpd.apache.org/docs/2.2/logs.html#accesslog | 19:26 |
| jaosorior | excellent, I'll check it out and see if there's anything needed | 19:31 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: document keystone-specs instead of LP blueprints in README https://review.openstack.org/97604 | 19:33 |
| rodrigods | bknudson, suggestions on how to test it? | 19:33 |
| jaosorior | But basically we would need to know what user, with what roles are getting tokens, issuing or requesting trusts, and so on. Since auditing in telecom is quite strict | 19:34 |
| bknudson | rodrigods: I guess it would be like the other keystoneclient tests, mocking the keystone server responses for any URLs it hits. | 19:35 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone-specs: use double backticks on literals in README https://review.openstack.org/97605 | 19:35 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Compressed Token Provider https://review.openstack.org/91145 | 19:47 |
| *** hrybacki has quit IRC | 19:51 | |
| *** sbfox has quit IRC | 19:56 | |
| *** sbfox has joined #openstack-keystone | 19:56 | |
| *** hrybacki has joined #openstack-keystone | 19:59 | |
| *** joesavak has quit IRC | 20:04 | |
| *** marcoemorais has joined #openstack-keystone | 20:05 | |
| *** ajayaa has quit IRC | 20:06 | |
| *** marcoemorais has quit IRC | 20:06 | |
| *** marcoemorais2 has joined #openstack-keystone | 20:06 | |
| *** marcoemorais1 has quit IRC | 20:08 | |
| bknudson | https://bugs.launchpad.net/openstack-ci/+bug/1083101 !! | 20:08 |
| uvirtbot | Launchpad bug 1083101 in openstack-ci "Set up private gerrit for security reviews" [High,In progress] | 20:08 |
| lbragstad | nice | 20:09 |
| marekd | jamielennox: what's up. | 20:12 |
| jamielennox | marekd: oh, so what is different between our redirects and requests that it doesn't work for you? | 20:13 |
| jamielennox | i really don't want to make that redirects flag configurable | 20:13 |
| *** topol has quit IRC | 20:14 | |
| marekd | jamielennox: i don't know what happened under the cover, but switching to requests redirections simply worked... | 20:17 |
| jamielennox | marekd: do you have some commands i can issue to debug it? | 20:18 |
| jamielennox | marekd: we handle redirects manually as requests does some interesting browser tricks which we generally don't want in an API, so it might be one of those | 20:19 |
| marekd | jamielennox: in general this: https://review.openstack.org/#/c/92166/ but it needs a working SAML Service Provider, which I have as a VM on my local machine. Let me create SP available from the Internet, so everybody can use it... | 20:20 |
| marekd | jamielennox: i know, i read the docs and I guess one of the requests's trick does the magic here. | 20:20 |
| stevemar | marekd, not one to try and cover up his use of magic | 20:20 |
| marekd | stevemar: whose? | 20:21 |
| stevemar | marekd, your magic | 20:21 |
| marekd | definitely too much magic in all that stuff. | 20:22 |
| jamielennox | marekd: so if you want to check out what's happening you can get the response.history which should give you all the requests that were sent | 20:23 |
| jamielennox | then print out the bodies and the response codes etc | 20:23 |
| marekd | jamielennox: ok, gonna try that | 20:24 |
| marekd | i will keep you updated. | 20:24 |
| jamielennox | marekd: yep, if you can get a good print of the exchange (even with wireshark) and send it to me i can look into it as well | 20:25 |
| marekd | jamielennox: ok | 20:26 |
| *** raildo has left #openstack-keystone | 20:27 | |
| *** hrybacki has quit IRC | 20:31 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Compressed Token Provider https://review.openstack.org/91145 | 20:32 |
| *** joesavak has joined #openstack-keystone | 20:35 | |
| *** erecio has quit IRC | 20:36 | |
| *** erecio has joined #openstack-keystone | 20:42 | |
| *** pheadron has quit IRC | 20:43 | |
| *** pheadron has joined #openstack-keystone | 20:43 | |
| *** joesavak has quit IRC | 20:46 | |
| ayoung | dolphm, can you Approve https://review.openstack.org/#/c/91883/ | 20:47 |
| *** marcoemorais has joined #openstack-keystone | 20:48 | |
| *** pheadron has quit IRC | 20:48 | |
| *** marcoemorais2 has quit IRC | 20:49 | |
| *** marcoemorais1 has joined #openstack-keystone | 20:49 | |
| *** marcoemorais has quit IRC | 20:49 | |
| *** joesavak has joined #openstack-keystone | 20:53 | |
| *** juanmo has quit IRC | 20:54 | |
| dolphm | ayoung: not without a +1 from bknudson :) | 20:57 |
| *** marcoemorais1 has quit IRC | 20:58 | |
| *** marcoemorais has joined #openstack-keystone | 20:58 | |
| ayoung | dolphm, can't fault youthere | 20:58 |
| dolphm | bknudson: consider your +1 to be a +2/+A there | 20:58 |
| ayoung | ++ | 20:58 |
| bknudson | dolphm: ok, will take a look | 20:58 |
| dolphm | bknudson: thanks! | 20:58 |
| *** daneyon has quit IRC | 20:59 | |
| *** daneyon has joined #openstack-keystone | 21:00 | |
| *** marcoemorais1 has joined #openstack-keystone | 21:00 | |
| *** marcoemorais has quit IRC | 21:02 | |
| *** marcoemorais has joined #openstack-keystone | 21:02 | |
| *** marcoemorais has quit IRC | 21:02 | |
| *** marcoemorais1 has quit IRC | 21:03 | |
| *** marcoemorais has joined #openstack-keystone | 21:03 | |
| *** marcoemorais has quit IRC | 21:05 | |
| *** marcoemorais has joined #openstack-keystone | 21:05 | |
| *** pheadron has joined #openstack-keystone | 21:06 | |
| *** marcoemorais has quit IRC | 21:06 | |
| *** marcoemorais has joined #openstack-keystone | 21:07 | |
| stevemar | we need to see more people running tox before pushing to keystone-specs!! | 21:07 |
| dolphm | stevemar: why? | 21:08 |
| *** jsavak has joined #openstack-keystone | 21:09 | |
| dolphm | stevemar: (i don't see how they're really related) | 21:09 |
| *** joesavak has quit IRC | 21:09 | |
| dolphm | stevemar: also, pong | 21:09 |
| stevemar | dolphm, too many white spaces, hard tabs, and ==='s not lining up with titles | 21:09 |
| dolphm | stevemar: oh tox *in* keystone-specs? | 21:09 |
| stevemar | dolphm, isn't that what i said? | 21:09 |
| dolphm | stevemar: i thought you just meant getting people to use tox instead of run_tests.sh in general | 21:10 |
| stevemar | no no | 21:10 |
| dolphm | stevemar: doesn't jenkins -1 then? | 21:10 |
| stevemar | dolphm, yes | 21:10 |
| stevemar | dolphm, but jenkins is super overloaded atm | 21:10 |
| dolphm | stevemar: that job should be quick, at least :-/ | 21:10 |
| stevemar | dolphm, meh, it distracts from the review | 21:11 |
| *** dhellmann has quit IRC | 21:11 | |
| *** dims__ has joined #openstack-keystone | 21:13 | |
| *** dhellmann has joined #openstack-keystone | 21:13 | |
| stevemar | dolphm, and maybe look @ doc/build/html :) | 21:14 |
| stevemar | what do i know, i just work here | 21:14 |
| dolphm | stevemar: i'd almost appreciate if there was a run_tests in that repo that did an open on doc/build/html (is there an index created in that repo?) | 21:14 |
| stevemar | likely | 21:14 |
| dolphm | stevemar: because yes, just because tox passes doesn't mean your rendered RST is readable | 21:15 |
| dolphm | stevemar: as we learned with my accidentally indented paragraph for example :) | 21:15 |
| *** dims_ has quit IRC | 21:15 | |
| *** jsavak has quit IRC | 21:18 | |
| *** pafuent has left #openstack-keystone | 21:31 | |
| *** marcoemorais has quit IRC | 21:32 | |
| *** marcoemorais has joined #openstack-keystone | 21:32 | |
| *** marcoemorais has quit IRC | 21:33 | |
| *** marcoemorais has joined #openstack-keystone | 21:33 | |
| *** joesavak has joined #openstack-keystone | 21:34 | |
| *** marcoemorais has quit IRC | 21:34 | |
| *** marcoemorais has joined #openstack-keystone | 21:35 | |
| *** henrynash has quit IRC | 21:38 | |
| *** gordc has quit IRC | 21:38 | |
| *** marcoemorais1 has joined #openstack-keystone | 21:38 | |
| *** daneyon has quit IRC | 21:39 | |
| *** marcoemorais has quit IRC | 21:39 | |
| *** marcoemorais has joined #openstack-keystone | 21:42 | |
| *** dims__ has quit IRC | 21:42 | |
| *** marcoemorais has quit IRC | 21:42 | |
| *** joesavak has quit IRC | 21:43 | |
| *** marcoemorais has joined #openstack-keystone | 21:44 | |
| *** marcoemorais has quit IRC | 21:44 | |
| *** marcoemorais has joined #openstack-keystone | 21:44 | |
| *** marcoemorais has quit IRC | 21:44 | |
| *** marcoemorais has joined #openstack-keystone | 21:45 | |
| *** marcoemorais1 has quit IRC | 21:45 | |
| *** jaosorior has quit IRC | 21:52 | |
| ayoung | stevemar, why from keystone.openstack.common import jsonutils as json instead of import json? | 21:59 |
| stevemar | jsonutils has much better support for all versions on python | 21:59 |
| stevemar | and we use it everywhere else | 21:59 |
| jamielennox | why not just leave it called jsonutils? we do that everywhere else | 22:00 |
| stevemar | jamielennox, true, | 22:01 |
| stevemar | jamielennox, i'm advocating the use of jsonutils, not just straight up 'import json' | 22:01 |
| *** marcoemorais has quit IRC | 22:02 | |
| *** marcoemorais has joined #openstack-keystone | 22:02 | |
| ayoung | sounds good. I'll make the change | 22:02 |
| jamielennox | yep, i agree on jsonutils, just wasnt sure on rename | 22:02 |
| *** marcoemorais has quit IRC | 22:03 | |
| *** marcoemorais has joined #openstack-keystone | 22:04 | |
| *** joesavak has joined #openstack-keystone | 22:05 | |
| *** henrynash has joined #openstack-keystone | 22:09 | |
| *** joesavak has quit IRC | 22:11 | |
| *** dims has joined #openstack-keystone | 22:12 | |
| *** thedodd has quit IRC | 22:14 | |
| *** rodrigods_ has joined #openstack-keystone | 22:19 | |
| stevemar | jamielennox, that was my bad :) | 22:20 |
| *** bknudson has quit IRC | 22:21 | |
| *** marekd is now known as marekd|away | 22:24 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Compressed Token Provider https://review.openstack.org/91145 | 22:28 |
| ayoung | stevemar, ^^ addresses your points. | 22:28 |
| *** browne has quit IRC | 22:32 | |
| morganfainberg | ayoung, dolphm, https://review.openstack.org/#/c/97638/ | 22:40 |
| ayoung | morganfainberg, care to look at https://review.openstack.org/91145 in response | 22:41 |
| morganfainberg | ayoung, sure. | 22:41 |
| morganfainberg | compressed token provider? | 22:41 |
| ayoung | morganfainberg, hmmm....looking for the zuul job for it | 22:42 |
| ayoung | morganfainberg, is it not getting triggered because it was origianlly a draft? It is not a draft anymore | 22:42 |
| morganfainberg | yeah, drafts are broken | 22:43 |
| morganfainberg | also... you can't submit drafts anymore | 22:43 |
| morganfainberg | ayoung, oh | 22:43 |
| ayoung | morganfainberg, I saw that...but why no Zuul jobs for that patch? Is Zuul stuck? | 22:43 |
| morganfainberg | ... zuulk looks unhappy | 22:43 |
| ayoung | 14 hours is a long time... | 22:44 |
| morganfainberg | Queue lengths: 1207 events, | 22:44 |
| morganfainberg | worse | 22:44 |
| morganfainberg | 1200 events backed up | 22:44 |
| morganfainberg | not just backed up queue | 22:44 |
| morganfainberg | erm check queue | 22:44 |
| morganfainberg | it isn't processing the events atm | 22:44 |
| morganfainberg | yeah -infra is working on it | 22:44 |
| *** marcoemorais has quit IRC | 22:46 | |
| *** marcoemorais has joined #openstack-keystone | 22:46 | |
| *** browne has joined #openstack-keystone | 22:56 | |
| *** praneshp has quit IRC | 22:59 | |
| ayoung | jamielennox, on AUTH_TYPE == 'Negotiate' | 23:01 |
| morganfainberg | ayoung, and zuul caught up | 23:02 |
| ayoung | if you set up apache mod_auth_krb5 with the fallback to basic-auth | 23:02 |
| ayoung | I don't think you get AUTH_TYPE == 'Negotiate' | 23:02 |
| ayoung | cool | 23:03 |
| openstackgerrit | A change was merged to openstack/keystone: Unimplemented get roles by group for project list https://review.openstack.org/76470 | 23:03 |
| *** zhiyan_ is now known as zhiyan | 23:17 | |
| *** zhiyan is now known as zhiyan_ | 23:18 | |
| *** mhu1 has joined #openstack-keystone | 23:20 | |
| *** EmilienM_ has joined #openstack-keystone | 23:20 | |
| *** radez` has joined #openstack-keystone | 23:20 | |
| *** radez has quit IRC | 23:20 | |
| *** mhu has quit IRC | 23:20 | |
| *** mhu1 is now known as mhu | 23:20 | |
| *** andreaf has quit IRC | 23:20 | |
| *** EmilienM has quit IRC | 23:20 | |
| *** EmilienM_ is now known as EmilienM | 23:20 | |
| *** andreaf has joined #openstack-keystone | 23:20 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Kerberos as method name https://review.openstack.org/95989 | 23:24 |
| *** sbfox has quit IRC | 23:25 | |
| openstackgerrit | Arun Kant proposed a change to openstack/keystone: Adding support for ldap connection pooling. https://review.openstack.org/95300 | 23:32 |
| *** henrynash has quit IRC | 23:34 | |
| jamielennox | ayoung: but if you fallback to basic-auth do you want it to pass through the kerberos plugin anyway? | 23:37 |
| *** stevemar has quit IRC | 23:37 | |
| ayoung | jamielennox, nah, decided I didn't and submitted it your way | 23:38 |
| *** bknudson has joined #openstack-keystone | 23:39 | |
| *** marcoemorais has quit IRC | 23:40 | |
| *** marcoemorais has joined #openstack-keystone | 23:40 | |
| *** marcoemorais has quit IRC | 23:41 | |
| *** marcoemorais has joined #openstack-keystone | 23:41 | |
| jamielennox | ayoung: can you have a look at: https://review.openstack.org/#/c/91216/ it's really simple and it keeps being a PITA that it hasn't been merged yet | 23:42 |
| jamielennox | if you +2 it i can badger morganfainberg or someone for the other | 23:42 |
| *** andreaf has quit IRC | 23:42 | |
| ayoung | jamielennox, +2 | 23:45 |
| ayoung | morganfainberg, +2 that would you | 23:45 |
| *** diegows has quit IRC | 23:47 | |
| *** daneyon has joined #openstack-keystone | 23:50 | |
| jamielennox | it's ok, i'll get the next core to speak.... | 23:54 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Basic-Auth middleware https://review.openstack.org/92137 | 23:55 |
| *** gokrokve has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!