| gyee | jamielennox, ping | 00:01 |
|---|---|---|
| jamielennox | gyee: aha! please review ^ | 00:01 |
| gyee | approved | 00:01 |
| jamielennox | :) | 00:01 |
| gyee | jamielennox, can you take a quick look at this one? https://review.openstack.org/#/c/92728/ | 00:02 |
| gyee | still a POC | 00:02 |
| gyee | just want to make sure I am headed in the right direction | 00:02 |
| gyee | don't worry about the test failures right now | 00:02 |
| jamielennox | gyee: in SessionClient you don't need/want to save username/password | 00:04 |
| gyee | jamielennox, I had a TODO there, need shardy to confirm what they are use for | 00:04 |
| gyee | seem like heat is passing them in the headers | 00:05 |
| jamielennox | oh, that's what that's about | 00:05 |
| gyee | jamielennox, I basically followed the same pattern you've established with the nova patch | 00:05 |
| jamielennox | yep, | 00:06 |
| jamielennox | and i was literally just looking at pulling this one back: https://review.openstack.org/#/c/86237/1/keystoneclient/session.py | 00:06 |
| jamielennox | because i did it for cinder: https://review.openstack.org/#/c/95986/ and it's almost exactly the same as well | 00:06 |
| jamielennox | so i think it's reasonable to move most of that to keystoneclient | 00:07 |
| gyee | jamielennox, yeah I agree, I had a few comment there about some of the code should really be in keystoneclient | 00:07 |
| jamielennox | i'm trying to come up with a better name than Binding, it's kind of a decorator pattern but python uses decorator already, it's maybe an adapter | 00:08 |
| gyee | adapter sounds about right | 00:08 |
| jamielennox | can you try doing the shell based on https://review.openstack.org/#/c/95679/1 | 00:09 |
| jamielennox | i had an attempt with keystone CLI but it's really ugly | 00:09 |
| gyee | I could | 00:10 |
| gyee | plan is to do both in parallel | 00:10 |
| gyee | worst case, just need a round of refactoring | 00:10 |
| gyee | just trying to avoid too many moving targets | 00:11 |
| jamielennox | yea, i'm just looking for a fairly clean implementation to make sure my variables are all correct etc | 00:11 |
| *** praneshp has joined #openstack-keystone | 00:11 | |
| jamielennox | this was the keystone attempt: https://review.openstack.org/#/c/95680/1 | 00:12 |
| *** rodrigods_ has quit IRC | 00:12 | |
| gyee | ah | 00:13 |
| gyee | jamielennox, but that one still WIP? | 00:13 |
| gyee | what else is needed? tests? | 00:13 |
| jamielennox | right - it's ugly and we've been telling people to just use OSC so i don't know if i want it to merge or not i just wanted to see if it could be done and what were the problems/what was needed from params | 00:14 |
| jamielennox | tests and i don't know if it's correct | 00:14 |
| gyee | jamielennox, incremental improvement :) | 00:14 |
| gyee | we use OSC when it is ready | 00:14 |
| jamielennox | gyee: anyway i'd like to see another implementation with the auth plugin from CLI stuff to make sure it makes senes | 00:17 |
| gyee | jamielennox, sure, both can be done in parallel. We can easily switch over to auth plugin from CLI when it is ready | 00:18 |
| gyee | I am trying to avoid creating a chain of dependencies | 00:19 |
| jamielennox | right - so long as we don't have to deprecate CLI options in the change | 00:19 |
| gyee | agree | 00:19 |
| jamielennox | gyee: at this point everything i'm working on is multiple patches into the future, generally across multiple projects | 00:19 |
| jamielennox | PITA | 00:19 |
| *** daneyon has quit IRC | 00:20 | |
| gyee | yes, PITA, but all good :) | 00:20 |
| *** radez` is now known as radez_g0n3 | 00:21 | |
| morganfainberg | jamielennox, sorry had to take a phone call or i would have reviewed that | 00:21 |
| jamielennox | morganfainberg: np | 00:22 |
| gyee | jamielennox, any reason why Session.construct() supports both 'verify' and 'insecure' while Session.__init__() only supports 'verify'? | 00:27 |
| gyee | seem like Session.__init__() should support both as construct() is marked as deprecated | 00:28 |
| gyee | most clients still using 'insecure' | 00:28 |
| *** zhiyan_ is now known as zhiyan | 00:28 | |
| jamielennox | I've been trying to break what is old vs new | 00:30 |
| jamielennox | if you are loading something from existing sources then you probably have an insecure variable - so use construct() | 00:30 |
| jamielennox | however if you are writing a new client - just ignore insecure, use the verify parameter it makes more sense | 00:30 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Catalog driver generates v3 catalog from v2 catalog https://review.openstack.org/70630 | 00:31 |
| gyee | jamielennox, but most clients today only supports 'insecure' | 00:34 |
| gyee | I would rather do that insecure to verify dance in one place | 00:34 |
| jamielennox | gyee: right - i removed the deprecated comment from construct for that | 00:35 |
| jamielennox | i need to figure out a better way of passing args to it | 00:35 |
| ayoung | nkinder, https://review.openstack.org/#/dashboard/2218 | 00:35 |
| ayoung | gah | 00:35 |
| ayoung | nkinder, make that https://review.openstack.org/#/c/93060/ | 00:35 |
| ayoung | morganfainberg, got the unit test fixed in "Ability to turn off ldap referral chasing" https://review.openstack.org/#/c/93060/ | 00:36 |
| morganfainberg | ayoung, good! | 00:36 |
| *** ayoung has quit IRC | 00:36 | |
| gyee | jamielennox, k, I'll continue to use construct() then | 00:37 |
| openstackgerrit | A change was merged to openstack/keystone: Update mailmap entry for Brant https://review.openstack.org/94096 | 00:37 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Add role assignments as concept in Client API V3 docs https://review.openstack.org/97345 | 00:37 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Changes exception raised by v3.trusts.update() https://review.openstack.org/97355 | 00:49 |
| *** ozialien has joined #openstack-keystone | 00:51 | |
| *** stevemar has joined #openstack-keystone | 00:53 | |
| *** pheadron has quit IRC | 00:54 | |
| *** pheadron has joined #openstack-keystone | 00:55 | |
| *** sbfox has joined #openstack-keystone | 01:01 | |
| *** marcoemorais has quit IRC | 01:04 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone-specs: Spec for V3 extension advertisement https://review.openstack.org/95973 | 01:11 |
| *** browne has quit IRC | 01:18 | |
| *** richm has quit IRC | 01:23 | |
| *** gokrokve has joined #openstack-keystone | 01:29 | |
| *** praneshp has quit IRC | 01:30 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Initial implementation of validator https://review.openstack.org/86483 | 01:33 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Catalog V3 resources https://review.openstack.org/96266 | 01:33 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 01:33 |
| *** bknudson has quit IRC | 01:37 | |
| *** ayoung has joined #openstack-keystone | 01:41 | |
| *** nsquare has quit IRC | 01:45 | |
| *** amcrn has quit IRC | 01:48 | |
| *** sbfox has quit IRC | 01:53 | |
| *** gokrokve has quit IRC | 01:59 | |
| *** stevemar has quit IRC | 02:01 | |
| *** sbfox has joined #openstack-keystone | 02:09 | |
| *** gyee has quit IRC | 02:27 | |
| *** xianghui has joined #openstack-keystone | 02:29 | |
| *** rodrigods_ has joined #openstack-keystone | 02:30 | |
| *** gokrokve has joined #openstack-keystone | 02:37 | |
| *** xianghui has quit IRC | 02:42 | |
| *** harlowja is now known as harlowja_away | 02:42 | |
| *** xianghui has joined #openstack-keystone | 02:43 | |
| *** dims has quit IRC | 02:45 | |
| *** mberlin1 has joined #openstack-keystone | 02:52 | |
| *** mberlin has quit IRC | 02:54 | |
| *** xianghui has quit IRC | 02:58 | |
| *** gokrokve has quit IRC | 03:09 | |
| *** rwsu has quit IRC | 03:10 | |
| *** xianghui has joined #openstack-keystone | 03:12 | |
| *** xianghui has quit IRC | 03:22 | |
| *** ncoghlan has joined #openstack-keystone | 03:30 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: Cross Backend Unique Identifiers for User and Group Entities https://review.openstack.org/97492 | 03:35 |
| *** xianghui has joined #openstack-keystone | 03:40 | |
| *** Abhijeet__ has joined #openstack-keystone | 03:58 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Session Adapters https://review.openstack.org/86237 | 04:04 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Add service_name to URL discovery https://review.openstack.org/97679 | 04:04 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Create HTTP methods mixin object https://review.openstack.org/97680 | 04:04 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 04:04 |
| *** daneyon has joined #openstack-keystone | 04:10 | |
| *** zhiyan is now known as zhiyan_ | 04:15 | |
| *** xianghui has quit IRC | 04:17 | |
| *** zhiyan_ is now known as zhiyan | 04:17 | |
| morganfainberg | jamielennox, you around | 04:20 |
| morganfainberg | ? | 04:20 |
| morganfainberg | jamielennox, have a quick question regarding use of the session object - it's probably quick | 04:21 |
| jamielennox | yea mate | 04:21 |
| *** xianghui has joined #openstack-keystone | 04:21 | |
| morganfainberg | so.. there is this thread: http://lists.openstack.org/pipermail/openstack-dev/2014-April/033952.html username/domain vs user_id for interacting with other services. | 04:22 |
| morganfainberg | jamielennox, would it be possible to make this ... well "easy" so to speak by leveraging the new session object (feed in the interesting info) vs having all sorts of code to work around it. | 04:22 |
| jamielennox | ok | 04:22 |
| jamielennox | so how deep do i want to go for context, or is robert's message enough? | 04:23 |
| morganfainberg | jamielennox, context is fine as is what thye;re looking for | 04:23 |
| jamielennox | there is no problem now or in furture of using domain_name and username | 04:23 |
| morganfainberg | jamielennox, good, thought so. | 04:24 |
| jamielennox | if you were to do Client(username=xx password=xx user_domain_name=xxx) that's fine | 04:24 |
| jamielennox | session will work that way too | 04:24 |
| morganfainberg | jamielennox, good that was my understanding | 04:24 |
| jamielennox | Password(url, ....) | 04:24 |
| morganfainberg | yep | 04:24 |
| morganfainberg | this was a 2x check to make sure i'm not running off a cliff when i start writing up this email. | 04:25 |
| morganfainberg | jamielennox, as in, we didn't have a gap in the client :) | 04:25 |
| * morganfainberg feels that it's silly to restrict methods to auth to one way or another if both are legitimately supported | 04:27 | |
| morganfainberg | sure, username is mutable [i think], but i don't really care - someone changes a username, it'll fail, just like if you change a password and forget to tell anyone | 04:27 |
| jamielennox | yea, i'd prefer people didn't use the names when you are doing automated work, but we can't stop people so they know the risks.../ | 04:28 |
| morganfainberg | jamielennox, well and in this case because they're orchestrating things, it is really ugly | 04:29 |
| morganfainberg | they know what name they're going to create, but otherwise they need to do like a 2x build. | 04:29 |
| morganfainberg | setup, make names, lookup ids, and then setup again | 04:29 |
| jamielennox | not really, you get the id whenever you create the name | 04:29 |
| jamielennox | so it's just a matter of storing the id at create time | 04:29 |
| morganfainberg | jamielennox, right, i think it's an issue with something needs to already be up by the time they get this far | 04:30 |
| * morganfainberg goes and re-reads the bugs | 04:30 | |
| morganfainberg | oh | 04:31 |
| *** xianghui has quit IRC | 04:32 | |
| morganfainberg | hmmm. | 04:33 |
| morganfainberg | it looks like you can't chain templates in heat | 04:35 |
| morganfainberg | do X in heat, then results from X use to do Y | 04:35 |
| morganfainberg | heat [it looks like] only knows about the undercloud info | 04:36 |
| morganfainberg | so asking keystone "what was that domain id" isn't possible if you're deploying keystone via heat | 04:36 |
| morganfainberg | jamielennox, i want to say it sounds like heat should have a state-of-the-stack stash it can reference based upon actions it took. | 04:37 |
| morganfainberg | jamielennox, though - it would be a lot less code (probably) to just allow interacting via names. | 04:37 |
| jamielennox | i had a conversation in here the other day with someone wanting to use names | 04:38 |
| jamielennox | basically everyone has a reason why it's ok in there situation | 04:38 |
| morganfainberg | we (keystone) don't care name wise, nor does our client | 04:38 |
| morganfainberg | it's the consuming services that care | 04:38 |
| jamielennox | i guarantee it's going to bite people, but if people need it they'll do it anyway | 04:38 |
| morganfainberg | like i said, i think this is a case where we need a "store the result of this in a stash" and allow other parts of the heat stack to consume it. | 04:39 |
| jamielennox | yep, i saw some stuff about the mistral project the other day and that's what it is doing | 04:39 |
| morganfainberg | so deploying heat can ask the stash fro the result of the keystone make domain to know what ID to use (for example | 04:39 |
| morganfainberg | 0 | 04:39 |
| * morganfainberg knows very little about how heat works. | 04:40 | |
| *** rodrigods_ has quit IRC | 04:40 | |
| jamielennox | me too | 04:40 |
| morganfainberg | ugh, i should go learn :P | 04:41 |
| *** daneyon has quit IRC | 04:41 | |
| jamielennox | honestly there are too many projects to know them all | 04:41 |
| morganfainberg | jamielennox, well unless you're triple-o :P | 04:41 |
| jamielennox | i'm also not a deployer so i've not really had to use heat for anything serious | 04:41 |
| *** daneyon has joined #openstack-keystone | 04:41 | |
| morganfainberg | yeah, i was a deployer for a while | 04:41 |
| morganfainberg | but heat wasn't ready in the version i deployed | 04:41 |
| morganfainberg | i think this is solvable with some changes to heat. | 04:42 |
| morganfainberg | it's a question of which changes make the most sense. | 04:42 |
| jamielennox | so are we actually missing something? | 04:42 |
| morganfainberg | jamielennox, don't think we (identity) are | 04:45 |
| morganfainberg | jamielennox, at all. | 04:45 |
| morganfainberg | jamielennox, i think other services are. | 04:45 |
| jamielennox | ok, you just said you could fix it and even if they are using names it is suboptimal but it shouldn't be broken | 04:46 |
| morganfainberg | jamielennox, yeah fix heat / etc | 04:46 |
| morganfainberg | jamielennox, not keystone. | 04:46 |
| morganfainberg | jamielennox, thanks for confirming the client stuff. I was fairly certain but... ugh i'd feel dumb if i didn't 3x check :P | 04:47 |
| *** ncoghlan is now known as ncoghlan_afk | 04:55 | |
| *** ncoghlan_afk is now known as ncoghlan | 05:01 | |
| *** shakamunyi has joined #openstack-keystone | 05:04 | |
| *** stevemar has joined #openstack-keystone | 05:06 | |
| openstackgerrit | Vladimir Eremin proposed a change to openstack/keystone: Keystone compact PKI token https://review.openstack.org/96725 | 05:08 |
| *** praneshp has joined #openstack-keystone | 05:13 | |
| *** daneyon_ has joined #openstack-keystone | 05:15 | |
| *** daneyon has quit IRC | 05:15 | |
| *** rodrigods_ has joined #openstack-keystone | 05:15 | |
| *** xianghui has joined #openstack-keystone | 05:21 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Add spec for non-persistent-tokens https://review.openstack.org/95976 | 05:25 |
| *** rodrigods_ has quit IRC | 05:25 | |
| *** praneshp_ has joined #openstack-keystone | 05:27 | |
| *** ajayaa has joined #openstack-keystone | 05:28 | |
| *** praneshp has quit IRC | 05:29 | |
| *** praneshp_ is now known as praneshp | 05:29 | |
| *** pheadron has quit IRC | 05:36 | |
| *** henrynash has joined #openstack-keystone | 05:45 | |
| *** henrynash has quit IRC | 05:50 | |
| *** pheadron has joined #openstack-keystone | 05:55 | |
| *** stevemar has quit IRC | 05:58 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/97005 | 06:00 |
| *** henrynash has joined #openstack-keystone | 06:01 | |
| *** andreaf has joined #openstack-keystone | 06:03 | |
| *** henrynash has quit IRC | 06:03 | |
| *** Chicago has joined #openstack-keystone | 06:06 | |
| *** Chicago has joined #openstack-keystone | 06:06 | |
| *** daneyon_ has quit IRC | 06:23 | |
| *** henrynash has joined #openstack-keystone | 06:24 | |
| *** daneyon has joined #openstack-keystone | 06:24 | |
| *** daneyon has quit IRC | 06:26 | |
| *** afazekas is now known as _afazekas | 06:29 | |
| *** leseb has joined #openstack-keystone | 06:29 | |
| *** jaosorior has joined #openstack-keystone | 06:35 | |
| *** sbfox has quit IRC | 06:40 | |
| *** amerine has quit IRC | 06:57 | |
| *** henrynash has quit IRC | 07:03 | |
| *** BAKfr has joined #openstack-keystone | 07:12 | |
| openstackgerrit | A change was merged to openstack/keystone: pep8: do not test locale files https://review.openstack.org/97089 | 07:16 |
| *** zhiyan is now known as zhiyan_ | 07:34 | |
| marekd|away | morning all | 07:34 |
| *** marekd|away is now known as marekd | 07:35 | |
| *** toddnni has quit IRC | 07:42 | |
| *** toddnni has joined #openstack-keystone | 07:46 | |
| *** andreaf has quit IRC | 07:55 | |
| openstackgerrit | ChangBo Guo(gcb) proposed a change to openstack/python-keystoneclient: Don't use mock non-exist method assert_called_once https://review.openstack.org/93839 | 07:59 |
| *** afazekas has joined #openstack-keystone | 08:03 | |
| *** ncoghlan is now known as ncoghlan_afk | 08:04 | |
| *** praneshp has quit IRC | 08:06 | |
| *** ncoghlan_afk is now known as ncoghlan | 08:08 | |
| *** shakamunyi has quit IRC | 08:10 | |
| *** ajayaa has quit IRC | 08:32 | |
| *** ajayaa has joined #openstack-keystone | 08:48 | |
| *** openstackgerrit has quit IRC | 08:48 | |
| *** leseb has quit IRC | 08:49 | |
| *** openstackgerrit has joined #openstack-keystone | 08:50 | |
| *** andreaf has joined #openstack-keystone | 09:05 | |
| *** leseb has joined #openstack-keystone | 09:17 | |
| *** xianghui has quit IRC | 09:20 | |
| *** ncoghlan has quit IRC | 09:29 | |
| *** xianghui has joined #openstack-keystone | 09:33 | |
| *** ajayaa has quit IRC | 09:39 | |
| *** ajayaa has joined #openstack-keystone | 09:52 | |
| *** xianghui has quit IRC | 09:54 | |
| *** xianghui has joined #openstack-keystone | 10:09 | |
| *** xianghui has quit IRC | 10:24 | |
| *** leseb has quit IRC | 10:24 | |
| openstackgerrit | Marco Fargetta proposed a change to openstack/keystone-specs: Web Authentication for SAML federated Keystone https://review.openstack.org/96867 | 10:28 |
| *** shakamunyi has joined #openstack-keystone | 10:37 | |
| *** shakamunyi has quit IRC | 10:41 | |
| *** dims_ has joined #openstack-keystone | 10:50 | |
| *** dims_ has quit IRC | 11:14 | |
| *** dims_ has joined #openstack-keystone | 11:20 | |
| *** diegows has joined #openstack-keystone | 11:22 | |
| *** leseb has joined #openstack-keystone | 11:24 | |
| *** Abhijeet__ has quit IRC | 11:41 | |
| *** ukalifon has joined #openstack-keystone | 12:02 | |
| *** juanmo has joined #openstack-keystone | 12:13 | |
| *** radez_g0n3 is now known as radez | 12:23 | |
| *** leseb has quit IRC | 12:23 | |
| *** leseb has joined #openstack-keystone | 12:24 | |
| *** dims_ has quit IRC | 12:29 | |
| *** dims_ has joined #openstack-keystone | 12:29 | |
| *** hrybacki has joined #openstack-keystone | 12:34 | |
| *** leseb has quit IRC | 12:35 | |
| *** leseb has joined #openstack-keystone | 12:42 | |
| *** xianghui has joined #openstack-keystone | 12:44 | |
| *** ajayaa has quit IRC | 12:47 | |
| *** htruta has joined #openstack-keystone | 12:53 | |
| *** gokrokve has joined #openstack-keystone | 13:00 | |
| openstackgerrit | Juan Manuel Ollé proposed a change to openstack/python-keystoneclient: Keystoneclient create user API should have optional password. https://review.openstack.org/97597 | 13:10 |
| *** nkinder has quit IRC | 13:11 | |
| *** joesavak has joined #openstack-keystone | 13:16 | |
| *** shakamunyi has joined #openstack-keystone | 13:17 | |
| *** bknudson has joined #openstack-keystone | 13:18 | |
| openstackgerrit | Eric N. Vander Weele proposed a change to openstack/keystone: Add documentation on LDAP 'user_id_attribute' https://review.openstack.org/93480 | 13:24 |
| *** radez is now known as radez_g0n3 | 13:26 | |
| lbragstad | ayoung: not sure if you'd seen this, kinda related to your blog post from yesterday https://wiki.openstack.org/wiki/Testr | 13:27 |
| dolphm | jamielennox: how broken would the world be if the v3 catalog was potentially missing endpoint ID's? | 13:27 |
| dolphm | jamielennox: ^ regarding: https://review.openstack.org/#/c/70630/ | 13:28 |
| ayoung | lbragstad, thanks | 13:28 |
| lbragstad | mhmm | 13:28 |
| ayoung | dolphm, he's asleep | 13:28 |
| dolphm | ayoung: but it's only like 11p there | 13:28 |
| *** gordc has joined #openstack-keystone | 13:33 | |
| marekd | dolphm: https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-federation-ext.md#request-a-scoped-os-federation-token-post-authtokens -> this token id is the the value from X-Subject-Token from response containing unscoped token, right? | 13:39 |
| dolphm | marekd: yes. 'id' really should have been token_id at least there | 13:40 |
| marekd | dolphm: ok, thanks. | 13:40 |
| ayoung | dolphm, he was at our meeting yesterday 2 PM Eastern | 13:41 |
| *** topol has joined #openstack-keystone | 13:42 | |
| *** nkinder has joined #openstack-keystone | 13:56 | |
| *** raildo has joined #openstack-keystone | 13:59 | |
| ayoung | dolphm, re endpoint_ids...those are probably irrelevant. Most things have to work with the URLs. The place where I was thinking of using endpoint ids was along the lines of tokenbinding, and fetching certificates for endpoints in distributed signing. But both of those could be handled via URLs. The question is what do we do about morganfainberg 's proposal for ID only catalogs, then? | 14:00 |
| *** ukalifon has quit IRC | 14:01 | |
| dolphm | ayoung: right. i'm willing to treat the lack of endpoint IDs here as a bug as long as it doesn't break anything immediately | 14:01 |
| dolphm | ayoung: i have a rewrite in mind for KVS & templated catalog in mind that would fix everything anyway | 14:02 |
| dolphm | would be a juno-3 thing though | 14:02 |
| ayoung | dolphm, all of the cases Ican think of require an URL to talk to the endpoint. The only thing that catalog ids are actually used for AFAIK is the database link from endpoint to service, but that is only service id | 14:03 |
| *** ajayaa has joined #openstack-keystone | 14:05 | |
| *** stevemar has joined #openstack-keystone | 14:19 | |
| *** ajayaa has quit IRC | 14:22 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: update release support warning for domain-specific drivers https://review.openstack.org/97802 | 14:23 |
| *** gordc1 has joined #openstack-keystone | 14:33 | |
| *** leseb has quit IRC | 14:33 | |
| *** gordc has quit IRC | 14:34 | |
| *** rwsu has joined #openstack-keystone | 14:40 | |
| *** andreaf has quit IRC | 14:41 | |
| bknudson | compressed tokens on the way | 14:41 |
| bknudson | my devstack token went from 8k for 4k | 14:41 |
| bknudson | probably still not good enough for those who want an 8-byte token | 14:42 |
| *** thedodd has joined #openstack-keystone | 14:44 | |
| *** rodrigods has quit IRC | 14:46 | |
| *** jaosorior has quit IRC | 14:52 | |
| *** rodrigods has joined #openstack-keystone | 14:54 | |
| *** rodrigods has quit IRC | 14:54 | |
| *** rodrigods has joined #openstack-keystone | 14:54 | |
| *** jsavak has joined #openstack-keystone | 15:03 | |
| *** sbfox has joined #openstack-keystone | 15:03 | |
| *** joesavak has quit IRC | 15:03 | |
| *** leseb has joined #openstack-keystone | 15:04 | |
| *** Chicago has quit IRC | 15:09 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Make sure all the auth plugins agree on the shared identity attributes. https://review.openstack.org/84945 | 15:11 |
| *** radez_g0n3 is now known as radez | 15:13 | |
| *** jdennis has quit IRC | 15:18 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Add v2 & v3 API documentation https://review.openstack.org/96242 | 15:21 |
| dolphm | bknudson: addressed all your comments on ^ | 15:22 |
| *** sbfox has quit IRC | 15:26 | |
| *** gokrokve has quit IRC | 15:29 | |
| *** gokrokve has joined #openstack-keystone | 15:29 | |
| *** jdennis has joined #openstack-keystone | 15:31 | |
| *** joesavak has joined #openstack-keystone | 15:31 | |
| *** jsavak has quit IRC | 15:34 | |
| *** gyee has joined #openstack-keystone | 15:39 | |
| morganfainberg | bknudson, yeah well - sometimes people want a pony too! | 15:41 |
| *** dims_ has quit IRC | 15:42 | |
| *** xianghui has quit IRC | 15:42 | |
| bknudson | morganfainberg: we had horses, now they've got a pony, but they want a toy pony that fits in their pocket. | 15:42 |
| morganfainberg | bknudson, hehehe | 15:44 |
| morganfainberg | topol, ping | 15:44 |
| topol | morganfainberg, hi | 15:45 |
| morganfainberg | topol, sec. | 15:45 |
| dolphm | bknudson: pony on a stick! pony ON A STICK! | 15:45 |
| dolphm | bknudson: stevemar: thanks! | 15:46 |
| dolphm | bknudson: new patch on this btw https://review.openstack.org/#/c/91883/ | 15:46 |
| stevemar | i think the pressures of being PTL have finally gotten to dolphm. Talking about ponies on sticks. | 15:48 |
| * stevemar realizes other people are also talking about ponies... | 15:49 | |
| bknudson | battered and deep fried ... mmm! | 15:49 |
| *** daneyon has joined #openstack-keystone | 15:50 | |
| *** sbfox has joined #openstack-keystone | 15:52 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/96265 | 15:52 |
| stevemar | i think i need an adult | 15:53 |
| stevemar | bknudson, dolphm, are we still considering the "id" only token (https://gist.github.com/dolph/10757712)? given the fact that compressed tokens are in? | 15:54 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: replace domains with ponies https://review.openstack.org/97838 | 15:55 |
| bknudson | what's the size of a compressed ID-only token? seems like it would be < 4k | 15:55 |
| bknudson | I just hope it doesn't pass tempest. | 15:57 |
| dolphm | i love the idea of pony-scoped tokens | 15:57 |
| bknudson | should replace project with pony | 15:57 |
| bknudson | then we could have multiponency | 15:57 |
| dolphm | oh wow. win. | 15:57 |
| gyee | damn I missed the whole pony conversation | 15:58 |
| stevemar | bknudson, i have a bad feeling that ID-only ponytokens wouldn't pass tempest :( | 15:58 |
| gyee | bknudson, thanks for https://review.openstack.org/#/c/84945/ | 15:58 |
| *** amerine has joined #openstack-keystone | 15:59 | |
| dolphm | fixed | 15:59 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: replace projects with ponies in prep for multiponency https://review.openstack.org/97838 | 15:59 |
| stevemar | 2.9K change! | 15:59 |
| stevemar | dolphm, you have outdone yourself | 15:59 |
| bknudson | gyee: I think https://review.openstack.org/#/c/84945/ can be approved once it's passed jenkins | 15:59 |
| gyee | dolphm, holyshit must be a slow day :) | 16:00 |
| dolphm | :param belongs_to: optional identity of the scoped pony | 16:00 |
| dolphm | # user has no pony | 16:01 |
| dolphm | the docs practically write themselves | 16:01 |
| stevemar | dolphm, you even did projects (plural) first with ponies, then s/project/pony. Well done. | 16:01 |
| dolphm | all the sudden henrynash seems quite cruel http://i.imgur.com/qwiOqNs.png | 16:02 |
| dolphm | rofl there's a +1 already | 16:03 |
| *** nkinder has quit IRC | 16:04 | |
| morganfainberg | dolphm, i would expect nothing less. | 16:04 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Cross Backend Unique Idenifiers for User and Group Entities https://review.openstack.org/97492 | 16:04 |
| morganfainberg | dolphm: The whole project/tenant thing wasn't ever clear to me, using equestrian nomenclature is a significant step forwards. | 16:05 |
| morganfainberg | that is awesome. | 16:05 |
| *** jsavak has joined #openstack-keystone | 16:06 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: replace domains & projects with unicorns & ponies https://review.openstack.org/97838 | 16:07 |
| *** afazekas has quit IRC | 16:07 | |
| *** joesavak has quit IRC | 16:07 | |
| *** joesavak has joined #openstack-keystone | 16:08 | |
| dolphm | def list_ponies_in_unicorn(self, unicorn_id): | 16:08 |
| morganfainberg | dolphm, https://review.openstack.org/#/c/97638/ could use your +1 on that. | 16:08 |
| morganfainberg | dolphm, when you have a moment. | 16:08 |
| dolphm | morganfainberg: is it not clear that i don't have time for that? | 16:09 |
| morganfainberg | dolphm, like i said, when you have a moment, ponies and unicorns are far more important at the moment! | 16:09 |
| *** BAKfr has quit IRC | 16:09 | |
| openstackgerrit | A change was merged to openstack/keystone-specs: use double backticks on literals in README https://review.openstack.org/97605 | 16:09 |
| dolphm | i'm really just super hungry and waiting for the lunch vendor to open :( | 16:11 |
| morganfainberg | awww :( | 16:11 |
| dolphm | stevemar: because tacos. | 16:11 |
| morganfainberg | I think i need to go get coffee. | 16:11 |
| *** jsavak has quit IRC | 16:11 | |
| * morganfainberg is sans caffeination at the moment | 16:11 | |
| dolphm | morganfainberg: +1 | 16:12 |
| bknudson | I hope we don't run out of tacos at the hackathon | 16:12 |
| bknudson | or ponies | 16:12 |
| *** gokrokve has quit IRC | 16:13 | |
| morganfainberg | bknudson, i heard dolphm was shipping extra ponies in just for the hackathon | 16:15 |
| morganfainberg | bknudson, gyee, do we need to get the new translation hints system in use yet? or are we waiting on the other patch to land? | 16:17 |
| bknudson | morganfainberg: what other patch? | 16:17 |
| bknudson | morganfainberg: and, are you talking about _LI, _LW, etc? | 16:17 |
| morganfainberg | yeah | 16:17 |
| bknudson | I don't see any reason not to use it. | 16:18 |
| bknudson | somebody has to go in and change all the _()s | 16:18 |
| morganfainberg | bknudson, ok then i will propose a quick follow-up patch to gyee's auth reconciliation one | 16:18 |
| stevemar | someone's line of code count will go up | 16:18 |
| morganfainberg | bknudson, https://review.openstack.org/#/c/95381/ someone did a bunch of it already | 16:18 |
| bknudson | morganfainberg: ok, I hadn't gotten around to that one yet. | 16:19 |
| stevemar | whats the difference between LI, LE, LW, etc? | 16:19 |
| morganfainberg | bknudson, yeah no rush there. let me just add a followup to gyee's and we'll go from there | 16:19 |
| morganfainberg | no need to duplicate work | 16:19 |
| morganfainberg | stevemar, LI = log info | 16:20 |
| gyee | morganfainberg, sounds good | 16:20 |
| bknudson | stevemar: this will put the translations for different level in different files / catalogs | 16:20 |
| morganfainberg | stevemar, etc | 16:20 |
| morganfainberg | it give the translators priority on translating strings | 16:20 |
| morganfainberg | exceptions | 16:20 |
| bknudson | stevemar: so that the translators can focus on the more important changes | 16:20 |
| stevemar | ahhh | 16:20 |
| morganfainberg | ( e.g. _() get the highest prio) | 16:20 |
| bknudson | also there's no translation of debug | 16:20 |
| gyee | morganfainberg, usually we only need to translate extern-facing messages returned by the API | 16:20 |
| stevemar | i see, warning, info, exception, gotcha | 16:20 |
| *** nkinder has joined #openstack-keystone | 16:21 | |
| bknudson | so if you see LOG.debug(_()) that's incorrect now | 16:21 |
| stevemar | why no _LD? | 16:21 |
| gyee | stevemar, debug messages are internal | 16:21 |
| bknudson | stevemar: some might say we should have an _LD even if they aren't translated. | 16:21 |
| stevemar | oh, i guess just don't put _() | 16:21 |
| bknudson | there would be some advantages | 16:21 |
| bknudson | but that's not the way it was done | 16:22 |
| gyee | bknudson, why bother translating internal messages | 16:22 |
| bknudson | gyee: somebody might want to... maybe they have a customer that wants it for whatever reason | 16:22 |
| morganfainberg | stevemar, solution to the convo eysterday about oauth | 16:23 |
| bknudson | or there might be a customer that requires it -- maybe a govt wants to push their language. | 16:23 |
| morganfainberg | stevemar, going to provide some enhancements to the V3 ec2 token contrib (optional) | 16:23 |
| morganfainberg | stevemar, will be a little easier to meet needs and we "already" support it. - that way no one needs to have optionally lingering oauth tokens. | 16:24 |
| *** KnewB has joined #openstack-keystone | 16:30 | |
| KnewB | Is keystone fully support openldap server/ldap 389 ? if yes what all schema are required on ldap server ? | 16:31 |
| gyee | morganfainberg, bknudson, seems like manually adding _LI, _LW, etc is inefficient | 16:33 |
| gyee | can't we do this in log filter? | 16:34 |
| morganfainberg | gyee, no, its not about how the logging works it's how the translation stuff works | 16:34 |
| morganfainberg | _() is called before we get to the logger | 16:34 |
| morganfainberg | gyee, _LW() etc is just replacing _() for log-only messages | 16:35 |
| morganfainberg | if a message gets passed through an exception _() is still the correct translation function (iirc), even if the message also goes through logging | 16:36 |
| gyee | LOG.info(_LI()) seem ugly | 16:36 |
| morganfainberg | you wouldn't say msg = 'string', then log.info(_lw(msg)) and then a line lower raise Exception(_(msg)) | 16:37 |
| morganfainberg | gyee, any less ugly than LOG.info(_(msg)) ? | 16:37 |
| *** gordc1 is now known as gordc | 16:37 | |
| *** dims_ has joined #openstack-keystone | 16:38 | |
| *** yiconglu has joined #openstack-keystone | 16:38 | |
| gyee | morganfainber, maybe just LW() or something | 16:39 |
| yiconglu | Hi, I had some question about the ladp setting in keystone.conf, About the item 'user_domain_id_attribute', I can not find it since Havana release, does it still work now ? | 16:40 |
| yiconglu | And I found a new item 'user_default_project_id_attribute' in the section 'ldap' since Havana release, does this item work as the same function as 'user_domain_id_attribute'? | 16:40 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Use translation hints https://review.openstack.org/97852 | 16:42 |
| *** meera has joined #openstack-keystone | 16:42 | |
| *** dims_ has quit IRC | 16:43 | |
| morganfainberg | yiconglu, as i recall, in havana we determined that LDAP identity backends are explicitly 1 domain, do the user_domain_id_attribute was no longer needed. | 16:44 |
| morganfainberg | yiconglu, so it is not possible to have multiple domains served out of a single identity LDAP back end. | 16:44 |
| morganfainberg | yiconglu, however, there are a few others in this channel that might have a little more detail/insight on this (gyee or ayoung are good resources) | 16:46 |
| morganfainberg | KnewB, Keystone can use 389 / OpenLdap as a backend, i don't believe we have a custom schema. It becomes a question of setting up all the attribute mappings in the keystone.conf in the [ldap] section | 16:47 |
| morganfainberg | KnewB, http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n786 | 16:47 |
| morganfainberg | KnewB, there are a lot of options to set that will help you make use of the available LDAP schemas. | 16:48 |
| *** KnewB has quit IRC | 16:48 | |
| openstackgerrit | Vladimir Eremin proposed a change to openstack/python-keystoneclient: Keystone compact PKI token https://review.openstack.org/97854 | 16:49 |
| *** richm has joined #openstack-keystone | 16:49 | |
| ayoung | yiconglu, yes, morganfainberg is correct | 16:50 |
| yiconglu | thanks to morganfainberg | 16:56 |
| *** browne has joined #openstack-keystone | 16:59 | |
| *** yiconglu has quit IRC | 17:02 | |
| *** joesavak has quit IRC | 17:03 | |
| *** joesavak has joined #openstack-keystone | 17:03 | |
| *** KNewB has joined #openstack-keystone | 17:05 | |
| KNewB | yiconglu, Hi, What document/link you are following to configure the keystone with ldap ? | 17:05 |
| *** shakamunyi has quit IRC | 17:13 | |
| *** nsquare has joined #openstack-keystone | 17:15 | |
| *** gokrokve has joined #openstack-keystone | 17:18 | |
| dolphm | bknudson: according to Yelp, there are 948 mexican restaurants in san antonio, so i don't think we'll run out of tacos | 17:20 |
| morganfainberg | dolphm, but what if we do? | 17:20 |
| dolphm | bknudson: aslo according to yelp, that means about 1 in 5 restaurants are mexican | 17:20 |
| *** dims_ has joined #openstack-keystone | 17:20 | |
| dolphm | morganfainberg: then we'll drive to mexico | 17:20 |
| morganfainberg | good contigency plan | 17:21 |
| dolphm | morganfainberg: or we'll have ponies. they make good tacos, i'll bet | 17:21 |
| *** dims_ has quit IRC | 17:23 | |
| *** dims_ has joined #openstack-keystone | 17:23 | |
| morganfainberg | dolphm, unicorns? | 17:23 |
| *** leseb has quit IRC | 17:24 | |
| *** KNewB has quit IRC | 17:25 | |
| dolphm | morganfainberg: too boney for good tacos, best stewed | 17:25 |
| *** sbfox has quit IRC | 17:27 | |
| *** praneshp has joined #openstack-keystone | 17:28 | |
| openstackgerrit | A change was merged to openstack/keystone: Invalid command referenced in federation documentation https://review.openstack.org/97298 | 17:30 |
| *** sbfox has joined #openstack-keystone | 17:30 | |
| *** sbfox has quit IRC | 17:31 | |
| *** leseb has joined #openstack-keystone | 17:33 | |
| *** harlowja_away is now known as harlowja | 17:39 | |
| *** sbfox has joined #openstack-keystone | 17:40 | |
| *** ukalifon has joined #openstack-keystone | 17:50 | |
| *** sbfox has quit IRC | 17:52 | |
| *** gokrokve has quit IRC | 18:00 | |
| *** leseb has quit IRC | 18:01 | |
| *** amcrn has joined #openstack-keystone | 18:06 | |
| *** sbfox has joined #openstack-keystone | 18:07 | |
| *** praneshp_ has joined #openstack-keystone | 18:08 | |
| *** praneshp has quit IRC | 18:09 | |
| *** praneshp_ is now known as praneshp | 18:09 | |
| arunkant | ayoung, I see you mentioned in review about adding blueprint for https://review.openstack.org/#/c/95300/ . Does this apply for this change considering its a bug fix, no API or new functionality ? | 18:13 |
| ayoung | arunkant, I think you are good | 18:13 |
| ayoung | arunkant, bug should be sufficient | 18:13 |
| arunkant | okay...great as I was in process of adding spec change...good thing I checked with you before adding it..thanks | 18:14 |
| *** jsavak has joined #openstack-keystone | 18:16 | |
| *** joesavak has quit IRC | 18:16 | |
| *** sbfox has quit IRC | 18:29 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Overwrite HelpFormatter constructur to extend argument column https://review.openstack.org/97873 | 18:29 |
| *** leseb has joined #openstack-keystone | 18:31 | |
| *** leseb has quit IRC | 18:33 | |
| *** leseb has joined #openstack-keystone | 18:33 | |
| *** toddnni has quit IRC | 18:36 | |
| *** leseb has quit IRC | 18:38 | |
| *** toddnni has joined #openstack-keystone | 18:39 | |
| browne | can anyone explain what this error means? Authorization Failed: Unable to add token user list (HTTP 500) | 18:40 |
| browne | i get this in Havana using the keystone client when using an admin user, but not with admin token | 18:41 |
| bknudson | browne: using memcache? | 18:42 |
| bknudson | browne: # Exceeded the maximum retry attempts. | 18:43 |
| browne | bknudson: yes. and i suspect that's somehow broken in my setup | 18:43 |
| bknudson | browne: keystone tries to update the user list in tokens, and retries if a separate process modified it at the same time. | 18:43 |
| bknudson | browne: seems like something that should be unlikely to happen | 18:44 |
| browne | bknudson: i have a separate server that hosts memcache, so i wonder if its down | 18:44 |
| browne | bknudson: or misconfigured | 18:45 |
| bknudson | browne: the code looks like it's trying to handle a multi-process conflict but it probably has the same look as server down or misconfigured? | 18:45 |
| bknudson | I'm not very familiar with memcache | 18:46 |
| browne | bknudson: np, this gives me a place to look. thanks! | 18:46 |
| morganfainberg | browne, are you using memcache for the token backend? | 18:46 |
| morganfainberg | browne, and in havana? | 18:46 |
| morganfainberg | browne, you might also have too many active tokens for a given user | 18:47 |
| browne | morganfainberg: yes and yes | 18:47 |
| browne | morganfainberg: i just deployed openstack using vagrant, so probably misconfiguration | 18:48 |
| morganfainberg | browne, ah ok | 18:48 |
| morganfainberg | browne, yeah, just keep in mind that when you hit ... uhm... ~10000 active tokens for a user (can vary for a number of reasons) you might see a similar issue | 18:48 |
| *** toddnni has quit IRC | 18:48 | |
| browne | morganfainberg: ok, thx. what's the solution in that case? token flush? | 18:49 |
| morganfainberg | browne, not that you're likely to have that many in a test environment :) | 18:49 |
| morganfainberg | browne, well, i'd say the best answer is to (preemptively) set the token expiration lower (e.g. 28800 instead of 86400) | 18:50 |
| browne | morganfainberg: ok, i have it at 7200 | 18:50 |
| morganfainberg | browne, ah then you're probably fine | 18:50 |
| lbragstad | morganfainberg: have you played with jsonschema much? | 18:51 |
| morganfainberg | lbragstad, not much, i've been wanting to | 18:51 |
| morganfainberg | lbragstad, and i expect i'm going to need to. | 18:52 |
| *** toddnni has joined #openstack-keystone | 18:52 | |
| lbragstad | ok, just curious... looking into some of the FormatChecker stuff | 18:52 |
| lbragstad | for validating URIs | 18:52 |
| lbragstad | and was wondering if you've hit this? https://groups.google.com/forum/#!topic/jsonschema/_zlfVs80VUg | 18:52 |
| lbragstad | posted what I hit/experienced in the 6th post | 18:53 |
| lbragstad | morganfainberg: I was going to try and find oomichi to see if he's experienced this too... since the nova V3 validator has the same code... | 18:54 |
| morganfainberg | lbragstad, no never saw that, but i've not been playing around iwth it much yet | 18:54 |
| lbragstad | and https://pypi.python.org/pypi/rfc3987/ isnt' pulled into nova | 18:54 |
| lbragstad | ok, sounds good. I'll see what kind of response I get back | 18:54 |
| morganfainberg | lbragstad, keep me posted, let me know if you need me to jump in as well :) | 18:55 |
| lbragstad | morganfainberg: will do | 18:55 |
| morganfainberg | lbragstad, which case i'll jump in and poke it with a sharp stick after learning a lot about it | 18:55 |
| lbragstad | we *might* need that, | 18:55 |
| * morganfainberg goes and writes up an email. | 18:55 | |
| lbragstad | not 100% sure, but this seems like a bug in jsonschema | 18:56 |
| morganfainberg | lbragstad, it might be. | 18:56 |
| morganfainberg | lbragstad, just at a glance | 18:56 |
| *** marcoemorais has joined #openstack-keystone | 19:02 | |
| *** gokrokve has joined #openstack-keystone | 19:10 | |
| bknudson | how did this happen ? https://review.openstack.org/#/c/96265/ -- proposal bot got the reqs wrong? | 19:12 |
| *** andreaf has joined #openstack-keystone | 19:12 | |
| *** ukalifon has quit IRC | 19:13 | |
| ericvw | ayoung: with respect to https://review.openstack.org/#/c/93480, does it make sense to just perform the LDAP query to look up the user? I have seen this approach used by other project LDAP authentication backends. If that approach is taken, an additional configuration flag is not needed and setting the user_id_attribute would work as expected in all future | 19:13 |
| ericvw | configurations. | 19:13 |
| ayoung | ericvw, we can't break existing deployements | 19:14 |
| ayoung | so the default needs to be the existing behavior | 19:14 |
| *** gokrokve has quit IRC | 19:15 | |
| ericvw | Do future releases also need to maintain this backwards compatibility? | 19:15 |
| ayoung | ericvw, CONF.ldap.user_id_attribute_dn=True appends it to the DN, Flase does the lookup with filter=($user_id_attibute=$value) type semantices | 19:15 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Cross Backend Unique Idenifiers for User and Group Entities https://review.openstack.org/97492 | 19:16 |
| ericvw | ayoung, I am happy to dig in and attempt doing that change; unless you have already started | 19:16 |
| schofield | I'm doing an install from source as a learning experience, and I *think* I'm having a problem adding users to roles. The symptom is that "nova list" works but "nova image-list" gives me an error 401. Details here: https://gist.github.com/johnmarkschofield/8035896307cf7cc7f755 . Any troubleshooting suggestions? | 19:17 |
| ayoung | ericvw, nah, if you write it, I can review it | 19:17 |
| ayoung | schofield, does your setup policy for nova and glance require the same role? | 19:17 |
| ericvw | ayoung: I will try to something initially working by tomorrow. Should publish to the same change-id or start a completely different review? | 19:18 |
| ayoung | same change id is fine | 19:18 |
| ayoung | keep the documentation you've written as part of it | 19:18 |
| ayoung | ericvw, it explains why we need the new flag | 19:18 |
| schofield | ayoung: I'm following this doc: http://docs.openstack.org/icehouse/install-guide/install/apt/content/nova-controller.html Both nova and glance users should have role "admin" | 19:18 |
| ericvw | will do | 19:18 |
| ayoung | schofield, what does your policy.json say | 19:18 |
| ayoung | if they both honor 'admin' then you have a different problem | 19:19 |
| ayoung | schofield, might be | 19:19 |
| ayoung | http://adam.younglogic.com/2013/07/troubleshooting-pki-middleware/ | 19:19 |
| schofield | ayoung: Gist updated with policy.json: https://gist.github.com/johnmarkschofield/8035896307cf7cc7f755 | 19:20 |
| *** praneshp has quit IRC | 19:20 | |
| ayoung | schofield, no | 19:20 |
| ayoung | not keystone policy | 19:20 |
| ayoung | glance policy | 19:20 |
| schofield | ayoung: That may be it. Looks like most policies for glance are empty. Updated gist with glance policy.json. What should that file look like? | 19:22 |
| ayoung | schofield, like the is_admin type roles in keystone, I would guess | 19:22 |
| *** sbfox has joined #openstack-keystone | 19:22 | |
| *** Chicago has joined #openstack-keystone | 19:24 | |
| *** Chicago has joined #openstack-keystone | 19:24 | |
| *** sbfox1 has joined #openstack-keystone | 19:25 | |
| schofield | ayoung: I took a look at a working openstack install (done via devstack) and the glance policy.json is identical to the one I've got. Do you still suggest I edit it to add admin role statements to each line? | 19:26 |
| *** sbfox has quit IRC | 19:26 | |
| *** daneyon has quit IRC | 19:31 | |
| *** leseb has joined #openstack-keystone | 19:34 | |
| *** gokrokve has joined #openstack-keystone | 19:36 | |
| *** marcoemorais has quit IRC | 19:37 | |
| *** marcoemorais has joined #openstack-keystone | 19:38 | |
| *** marcoemorais has quit IRC | 19:38 | |
| *** marcoemorais has joined #openstack-keystone | 19:38 | |
| *** leseb has quit IRC | 19:38 | |
| *** marcoemorais has quit IRC | 19:44 | |
| *** marcoemorais has joined #openstack-keystone | 19:44 | |
| morganfainberg | bknudson, ping re: https://review.openstack.org/#/c/86578 is the raise of not_found in the delete_tree_nodes correct behavior? previously it would pass on the query and raise on the delete_s call in the base class .delete() method | 19:46 |
| morganfainberg | bknudson, if this behavior change in the query part isn't an issue, I'm good to +2 that code. | 19:47 |
| bknudson | morganfainberg: if it wasn't mentioned in the commit message then it shouldn't be changing behavior anyways | 19:48 |
| bknudson | this was a refactoring and not meant to change behavior | 19:48 |
| morganfainberg | bknudson, ah it is in the commit message | 19:48 |
| *** hrybacki has quit IRC | 19:48 | |
| morganfainberg | bknudson, but i wanted to be sure (since you reviewed it as well) | 19:49 |
| *** jsavak has quit IRC | 19:49 | |
| openstackgerrit | Vladimir Eremin proposed a change to openstack/python-keystoneclient: Keystone compact PKI token https://review.openstack.org/97854 | 19:49 |
| bknudson | morganfainberg: we might have actually had a reason for doing that (ignore the error) | 19:49 |
| bknudson | for example if it was deleted from another process? | 19:49 |
| morganfainberg | bknudson, that was my thought | 19:49 |
| *** joesavak has joined #openstack-keystone | 19:50 | |
| *** daneyon has joined #openstack-keystone | 19:50 | |
| morganfainberg | did we want to raise an exception because we raced on deletion | 19:50 |
| morganfainberg | bknudson, i'll go ahead an submit my -1 on the review with my question | 19:50 |
| bknudson | returning 404 Not Found wouldn't be appropriate in that case, IMO | 19:50 |
| morganfainberg | hm | 19:51 |
| morganfainberg | eah | 19:51 |
| morganfainberg | yeah* | 19:51 |
| *** jsavak has joined #openstack-keystone | 19:51 | |
| bknudson | morganfainberg: oh, hang on | 19:51 |
| bknudson | so if the server couldn't delete an individual entry it doesn't fail | 19:51 |
| bknudson | it stores up the names and prints out a warning message | 19:51 |
| bknudson | https://review.openstack.org/#/c/86578/13/keystone/common/ldap/core.py | 19:51 |
| bknudson | so it's only the search_base where if that was missing would fail with not found | 19:52 |
| bknudson | which seems appropriate to me | 19:52 |
| bknudson | that's not a race that I would worry about, I'd worry about a race with the sub-entries being deleted | 19:53 |
| morganfainberg | bknudson, ah see this is why i am asking you | 19:53 |
| morganfainberg | and the race on sub-entries is handled | 19:53 |
| morganfainberg | bknudson, nice warning message in the case there was a race no errors raised up | 19:54 |
| morganfainberg | bknudson, thanks, i'm good with a +2 on that then. | 19:54 |
| *** joesavak has quit IRC | 19:54 | |
| openstackgerrit | A change was merged to openstack/keystone: Fix curl example refs in docs https://review.openstack.org/96966 | 20:00 |
| *** topol has quit IRC | 20:04 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Add spec for non-persistent-tokens https://review.openstack.org/95976 | 20:04 |
| *** leseb has joined #openstack-keystone | 20:05 | |
| *** leseb has quit IRC | 20:11 | |
| *** marcoemorais has quit IRC | 20:12 | |
| *** marcoemorais has joined #openstack-keystone | 20:12 | |
| *** sbfox1 has quit IRC | 20:19 | |
| marekd | dolphm morganfainberg ayoung bknudson: Hi. UUID tokens are still to be deprecated in favor of PKI tokens, and this will be happening relatively soon, am I right? | 20:19 |
| morganfainberg | marekd, deprecation timeline is not determined | 20:20 |
| bknudson | marekd: I don't think deprecating UUID tokens is happening any time soon | 20:20 |
| morganfainberg | marekd, but PKI is the "recommended" deployment strategy | 20:20 |
| marekd | morganfainberg: do you think it's reasonable to start working on a new feature assuming that uuid tokens would be used, without support for PKI? | 20:20 |
| bknudson | marekd: I don't remember if it was swift or glance that had a requirement for smaller tokens than we provide with PKI | 20:20 |
| marekd | bknudson: yes, remember that from the design session. | 20:21 |
| bknudson | maybe we can get them to to token hash if they don't like the size of the tokens | 20:21 |
| marekd | bknudson: and that's why i am asking if you are still recommending PKI and trying tu push for them. | 20:21 |
| morganfainberg | marekd, assuming UUID tokens is probably a bad assumption | 20:21 |
| marekd | morganfainberg: thanks. | 20:21 |
| morganfainberg | marekd, i would assume PKI tokens in lieu of UUID (non-persistent backend drive, etc) | 20:22 |
| *** stevemar has quit IRC | 20:22 | |
| morganfainberg | marekd, but the inverse feels like you're artificially limiting yourself | 20:22 |
| marekd | morganfainberg: why? | 20:22 |
| morganfainberg | marekd, we want to remove the persistence backend. | 20:22 |
| morganfainberg | marekd, and i want tokens to never be stored in keystone | 20:22 |
| morganfainberg | marekd, that means you can't use UUID or short-hash of PKI | 20:23 |
| morganfainberg | marekd, i wont stop people from using UUID, but it's a sub-optimal deployment choice once we get non-persistence in | 20:23 |
| marekd | morganfainberg: right. | 20:23 |
| *** hrybacki has joined #openstack-keystone | 20:24 | |
| ayoung | marekd, o Hells no! | 20:25 |
| dolphm | morganfainberg: i don't think we can deprecate uuid in juno though -- too soon | 20:25 |
| morganfainberg | dolphm, correct. | 20:25 |
| ayoung | uuid tokens for what? | 20:25 |
| dolphm | morganfainberg: i was looking at the deprecation bp today - is there *anything* to deprecate this cycle? | 20:25 |
| marekd | morganfainberg: so I am assuming it's not that from version X of Keystone the backedn will be removed. This would indeed mean that uuid are no longer supported. | 20:25 |
| dolphm | marekd: that could happen in the future, but not juno, or k*, or l* | 20:27 |
| morganfainberg | dolphm, hmmmmmm. | 20:27 |
| * morganfainberg thinks. | 20:27 | |
| morganfainberg | dolphm, all XML! | 20:28 |
| dolphm | morganfainberg: we did that already, no? | 20:28 |
| morganfainberg | dolphm, in all seriousness... | 20:28 |
| morganfainberg | dolphm, don't think we have anything to deprecate | 20:28 |
| *** nsquare has quit IRC | 20:28 | |
| dolphm | i also un-prioritized basically all bp's beyond juno-1; we can assign them priorities and release targets as the specs are approved | 20:29 |
| morganfainberg | dolphm, ++ | 20:29 |
| morganfainberg | dolphm, oh, so if i find a bug that was fixed, but the code has already been released... | 20:31 |
| morganfainberg | do i just mark the bug as fix released? | 20:31 |
| morganfainberg | dolphm, i've been trying to do some cleanup on our bugs that have been lingering around for......ever | 20:31 |
| *** jamielennox is now known as jamielennox|away | 20:31 | |
| dolphm | morganfainberg: yeah, just mark them as Fix Released without a target. link to a patch on github or include the hash or change-id if possible | 20:34 |
| morganfainberg | dolphm, thanks. | 20:34 |
| ayoung | given a choice of changing planes in STL, ATL, BWI, BNA, or HOU... guessing I'll take HOU. If things go pear shaped, I can always catch a bus or something, right? | 20:44 |
| morganfainberg | ayoung, i read that as HNL not HOU... was wondering how you convinced the airline to ship you to hawaii on the way to San Antonio | 20:45 |
| *** sbfox has joined #openstack-keystone | 20:45 | |
| morganfainberg | though... K cycle meetup... on an islance in the pacific? anyone? | 20:46 |
| ayoung | Much as I would not mind spending some time in Hawaii, I would not really like fly there from Boston on my way to Texas | 20:46 |
| ayoung | morganfainberg, Avalon | 20:46 |
| morganfainberg | ayoung, i'd telecommute to the hackathon in that case. | 20:46 |
| morganfainberg | ayoung, "oopse" missed my flight to SAN | 20:46 |
| ayoung | morganfainberg, I'm guessing that Summer in Texas is going to make us want to have the next July midcycle in Toronto | 20:47 |
| morganfainberg | ayoung, Peru? | 20:47 |
| ayoung | Peru in July...good skiing, no? | 20:47 |
| morganfainberg | ayoung, thats my thought | 20:47 |
| * morganfainberg patiently awaits credit card to arrive so can book the meetup. | 20:49 | |
| *** pheadron has quit IRC | 20:49 | |
| *** sbfox has quit IRC | 20:50 | |
| morganfainberg | dolphm, i'm getting ERROR: InvocationError: "/bin/bash -c find keystone -type f -regex '.*\\.pot*' -print0| xargs -0 -n 1 msgfmt --check-format -o /dev/null" on pep8 runs on OS X now | 20:50 |
| morganfainberg | dolphm, are you seeing the same? | 20:50 |
| *** sbfox has joined #openstack-keystone | 20:50 | |
| morganfainberg | xargs: msgfmt: No such file or directory | 20:50 |
| bknudson | morganfainberg: install the package with msgfmt | 20:51 |
| dolphm | morganfainberg: bknudson: i have a note on that somehwere, one sec | 20:51 |
| morganfainberg | bknudson, sure, i was curious if this is something missing from test-requires or the like | 20:51 |
| bknudson | it's not a python package | 20:52 |
| morganfainberg | bknudson, ah. *grumble* | 20:52 |
| *** pheadron has joined #openstack-keystone | 20:52 | |
| dolphm | morganfainberg: http://docs.openstack.org/developer/keystone/setup.html brew install gettext | 20:53 |
| morganfainberg | dolphm, ah thanks | 20:53 |
| dolphm | morganfainberg: it's not system specific, but it's under prereq's | 20:53 |
| morganfainberg | right | 20:53 |
| morganfainberg | brew... makes me want a beer | 20:53 |
| openstackgerrit | Juan Manuel Ollé proposed a change to openstack/python-keystoneclient: Keystoneclient create user API should have optional password. https://review.openstack.org/97597 | 20:53 |
| morganfainberg | hmm. | 20:54 |
| *** harlowja has quit IRC | 20:54 | |
| *** harlowja has joined #openstack-keystone | 20:54 | |
| morganfainberg | dolphm, 🍺 does that show up as a beermug? | 20:54 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: install gettext on OS X for msgfmt https://review.openstack.org/97928 | 20:55 |
| dolphm | morganfainberg: ^ | 20:55 |
| dolphm | morganfainberg: and yes, it does | 20:55 |
| morganfainberg | dolphm, awesome. | 20:55 |
| * dolphm runs off to meeting | 20:56 | |
| marekd | dolphm: i also had to install gettext on debian jessie. | 20:57 |
| *** sbfox has quit IRC | 20:58 | |
| *** marcoemorais has quit IRC | 21:01 | |
| *** marcoemorais has joined #openstack-keystone | 21:02 | |
| *** juanmo has quit IRC | 21:02 | |
| *** marcoemorais has quit IRC | 21:03 | |
| *** marcoemorais has joined #openstack-keystone | 21:03 | |
| *** marcoemorais has quit IRC | 21:03 | |
| *** marcoemorais has joined #openstack-keystone | 21:04 | |
| *** amcrn_ has joined #openstack-keystone | 21:07 | |
| *** sbfox has joined #openstack-keystone | 21:08 | |
| *** amcrn has quit IRC | 21:09 | |
| *** Chicago has quit IRC | 21:14 | |
| *** nsquare has joined #openstack-keystone | 21:19 | |
| *** sbfox has quit IRC | 21:20 | |
| *** marcoemorais has quit IRC | 21:23 | |
| *** marcoemorais has joined #openstack-keystone | 21:23 | |
| *** hrybacki has quit IRC | 21:25 | |
| *** marekd is now known as marekd|away | 21:32 | |
| *** marcoemorais1 has joined #openstack-keystone | 21:36 | |
| *** andreaf has quit IRC | 21:40 | |
| *** marcoemorais1 has quit IRC | 21:40 | |
| *** marcoemorais has quit IRC | 21:40 | |
| *** jsavak has quit IRC | 21:44 | |
| *** radez is now known as radez_g0n3 | 21:45 | |
| *** gordc has left #openstack-keystone | 21:51 | |
| *** richm has quit IRC | 21:59 | |
| *** sbfox has joined #openstack-keystone | 22:01 | |
| *** sbfox has quit IRC | 22:11 | |
| *** sbfox has joined #openstack-keystone | 22:11 | |
| *** sbfox has quit IRC | 22:11 | |
| *** daneyon has quit IRC | 22:12 | |
| *** richm has joined #openstack-keystone | 22:13 | |
| *** bknudson has quit IRC | 22:23 | |
| *** amcrn_ has quit IRC | 22:24 | |
| *** thedodd has quit IRC | 22:30 | |
| *** nkinder has quit IRC | 22:31 | |
| *** sbfox has joined #openstack-keystone | 22:32 | |
| *** amcrn has joined #openstack-keystone | 22:40 | |
| *** marcoemorais has joined #openstack-keystone | 22:42 | |
| *** gokrokve has quit IRC | 22:43 | |
| *** daneyon has joined #openstack-keystone | 22:43 | |
| *** dims_ has quit IRC | 22:51 | |
| morganfainberg | gyee, ping you here? | 22:58 |
| morganfainberg | gyee, have a question on a bug you... uh worked on ages ago | 22:59 |
| *** pheadron has quit IRC | 22:59 | |
| gyee | morganfainberg, here | 23:00 |
| morganfainberg | gyee, https://bugs.launchpad.net/keystone/+bug/890411 | 23:01 |
| uvirtbot | Launchpad bug 890411 in keystone "Tenant role conflicts/overlaps can be a security issue" [Medium,Confirmed] | 23:01 |
| gyee | :) | 23:01 |
| gyee | my favor topic | 23:01 |
| morganfainberg | gyee, is... that still an issue? | 23:01 |
| morganfainberg | i can't tell from the comments. | 23:01 |
| morganfainberg | and if it is what i _think_ it is... it's not a bug. | 23:01 |
| gyee | yes, still problematic | 23:01 |
| * morganfainberg is doing cleanup on ancient bugs. | 23:01 | |
| gyee | probably lack of feature | 23:02 |
| morganfainberg | gyee is this the whole namespaced roles argument? | 23:02 |
| gyee | yes | 23:02 |
| morganfainberg | right | 23:02 |
| morganfainberg | i'd like to "kill" this bug because it's not really a bug | 23:02 |
| gyee | hierarchical multiponycy is going to make it much apparent | 23:03 |
| morganfainberg | right but it's still not a bug. | 23:03 |
| morganfainberg | gyee, any issues with pushing this over to "file a spec to fix this lets not treat it as a bug"? | 23:03 |
| gyee | morganfainberg, sounds like a plan | 23:04 |
| morganfainberg | gyee, k marking it as "wont fix" with a comment like "spec plz" | 23:04 |
| morganfainberg | but less obnoxious | 23:04 |
| gyee | we just need to keep track of it in some form | 23:04 |
| * gyee is bracing for battles ahead on role namespacing :) | 23:06 | |
| *** daneyon has quit IRC | 23:08 | |
| *** dims_ has joined #openstack-keystone | 23:08 | |
| *** daneyon has joined #openstack-keystone | 23:09 | |
| *** pheadron has joined #openstack-keystone | 23:12 | |
| morganfainberg | gyee, anyway i think i'm calling it on doing bug cleanup | 23:16 |
| morganfainberg | gyee, i _think_ i just cleaned up most of the invalid / previously fixed bugs | 23:16 |
| gyee | morganfainberg, fantastic! thanks for doing this btw | 23:17 |
| morganfainberg | someone had to. | 23:17 |
| morganfainberg | :) | 23:17 |
| morganfainberg | next i think i'm going to be untargeting / invalidating some folsom, essex and grizzly targeted bugs | 23:17 |
| gyee | morganfainberg, is there a DONT-GIVE-A-SHIT status for the bugs, I would think bugs that are lingered more then two releases should have that status | 23:20 |
| morganfainberg | "wishlist" | 23:20 |
| morganfainberg | :P | 23:20 |
| morganfainberg | i mean | 23:20 |
| gyee | ah | 23:20 |
| morganfainberg | >.> | 23:20 |
| *** sbfox has quit IRC | 23:26 | |
| morganfainberg | gyee, phew. this is slow work going through LP and cleaning all this up | 23:35 |
| morganfainberg | now we have no more bugs open (any state) targeted at folsom or essex | 23:35 |
| gyee | nice! | 23:36 |
| morganfainberg | grizzly also clenaed up | 23:39 |
| morganfainberg | woo, yay, only 297 open bugs now | 23:39 |
| morganfainberg | actually on the topic of "don't give a crap about" if it legitimately is don't give a crap about this bug, we could mark them as wont fix. | 23:40 |
| morganfainberg | but... thats toeing the line a bit | 23:40 |
| *** daneyon has quit IRC | 23:41 | |
| morganfainberg | lol: https://bugs.launchpad.net/keystone/+bug/884451 | 23:41 |
| uvirtbot | Launchpad bug 884451 in keystone "End User Has No "Forgot Password" Option" [Wishlist,Incomplete] | 23:41 |
| gyee | morganfainberg, seriously, for a commercial product, if a bug that's been around for more than two releases, that means either customers don't care or they are no longer customers | 23:41 |
| gyee | either way, close as won't fix | 23:41 |
| gyee | not sure if the the open source world works the same though | 23:42 |
| morganfainberg | it's "incomplete" that is ... afaict the same as wont fix | 23:42 |
| morganfainberg | just was looking through the bugs. | 23:42 |
| *** praneshp has joined #openstack-keystone | 23:42 | |
| morganfainberg | this is another one i'm not sure... | 23:43 |
| morganfainberg | https://bugs.launchpad.net/keystone/+bug/928042 | 23:43 |
| uvirtbot | Launchpad bug 928042 in keystone "clean up some of the various dict.copy() calls so that they don't confuse new developers" [Medium,Triaged] | 23:43 |
| morganfainberg | i mean... we do some of this still... | 23:43 |
| morganfainberg | but. | 23:44 |
| * morganfainberg wonders what a fix that just pulls all of the really random dict.copy stuff out would do | 23:44 | |
| gyee | heh | 23:45 |
| gyee | that's only so much we can do to prevent ppl from shooting themselves | 23:45 |
| gyee | in the foot I mean | 23:45 |
| *** sbfox has joined #openstack-keystone | 23:48 | |
| *** meera has quit IRC | 23:48 | |
| *** diegows has quit IRC | 23:52 | |
| *** topol has joined #openstack-keystone | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
