| jamielennox | morganfainberg: yea i'm just picking those ones out as a base for other things | 00:02 |
|---|---|---|
| jamielennox | the last two i just pushed a small change which is why jenkins hasn't psased yet, but they hvaen't seen a review for a while | 00:02 |
| morganfainberg | jamielennox: *nod* | 00:03 |
| morganfainberg | jamielennox: there is also.. i think an issue that is causing check failures | 00:03 |
| jamielennox | they have follow on reviews that need rebasing as well | 00:03 |
| jamielennox | ergh, again - pass rate is maybe 50% at the moment | 00:03 |
| morganfainberg | right | 00:04 |
| morganfainberg | there is a sqlA issue i think. | 00:04 |
| morganfainberg | pending fix | 00:04 |
| jamielennox | oh, i saw there was a new release | 00:04 |
| jamielennox | this is part of the love/hate of python | 00:04 |
| morganfainberg | oh i am working with infra, hope to have middleware repo tonight / tomorrow | 00:05 |
| morganfainberg | once i confirm it's there and working i'm going to gently -2 the open middleware patches and point them to the new repo, if you don't have an issue with it | 00:05 |
| jamielennox | i'm good with that | 00:07 |
| jamielennox | i won't be at the meeting tomorrow but i'll read the logs later | 00:08 |
| jamielennox | but i'm happy to have the split | 00:08 |
| morganfainberg | jamielennox: great :) | 00:08 |
| *** xianghui has joined #openstack-keystone | 00:09 | |
| *** gokrokve has quit IRC | 00:17 | |
| jamielennox | morganfainberg: also i pu up https://review.openstack.org/#/c/101792/ whicch will impact your logging one, let me know if it makes sense | 00:19 |
| morganfainberg | jamielennox: my logging one is on hold i think... | 00:19 |
| morganfainberg | i need to make sure the django_auth module isn't doing something odd | 00:20 |
| jamielennox | yea, thats why i added this one now | 00:20 |
| jamielennox | it doesnt have tests i just want to see if the idea works | 00:20 |
| morganfainberg | jamielennox: ++ i'll look at this one tonight (after dinner prob) | 00:20 |
| jamielennox | no rush | 00:20 |
| morganfainberg | right-o | 00:21 |
| *** marcoemorais has quit IRC | 00:31 | |
| *** hrybacki has quit IRC | 00:54 | |
| *** topol has joined #openstack-keystone | 01:01 | |
| *** morganfainberg has quit IRC | 01:07 | |
| *** morganfainberg_Z is now known as morganfainberg | 01:07 | |
| *** browne has quit IRC | 01:07 | |
| *** lbragstad has joined #openstack-keystone | 01:20 | |
| *** stevemar has joined #openstack-keystone | 01:22 | |
| *** amcrn has quit IRC | 01:38 | |
| *** nsquare has quit IRC | 01:40 | |
| *** mberlin1 has joined #openstack-keystone | 01:42 | |
| *** mberlin has quit IRC | 01:43 | |
| *** ncoghlan has joined #openstack-keystone | 01:43 | |
| *** xianghui^ has joined #openstack-keystone | 02:06 | |
| *** richm has left #openstack-keystone | 02:07 | |
| *** fyb3r has joined #openstack-keystone | 02:10 | |
| *** xianghui has quit IRC | 02:10 | |
| fyb3r | Found out that my problem was being caused by an issue with MySQL | 02:10 |
| *** dstanek_zzz is now known as dstanek | 02:13 | |
| *** amcrn has joined #openstack-keystone | 02:27 | |
| *** fyb3r has quit IRC | 02:28 | |
| *** amcrn has quit IRC | 02:38 | |
| *** yfujioka has joined #openstack-keystone | 02:42 | |
| openstackgerrit | Justin Shepherd proposed a change to openstack/keystone: Adding an index on token.user_id https://review.openstack.org/102041 | 02:49 |
| *** baffle has quit IRC | 02:55 | |
| *** praneshp has quit IRC | 02:55 | |
| *** baffle has joined #openstack-keystone | 02:56 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: trustor_user_id not available in v2 trust token https://review.openstack.org/101829 | 02:59 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Federating multiple Keystones https://review.openstack.org/100023 | 03:00 |
| *** nkinder has joined #openstack-keystone | 03:07 | |
| *** amcrn has joined #openstack-keystone | 03:07 | |
| *** nsquare has joined #openstack-keystone | 03:08 | |
| *** dims__ has quit IRC | 03:13 | |
| *** dstanek is now known as dstanek_zzz | 03:14 | |
| *** ncoghlan is now known as ncoghlan_afk | 03:15 | |
| *** ncoghlan_afk is now known as ncoghlan | 03:16 | |
| *** zhiyan_ is now known as zhiyan | 03:19 | |
| *** dstanek_zzz is now known as dstanek | 03:19 | |
| *** hrybacki has joined #openstack-keystone | 03:20 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Update keystoneclient code to account for hacking 0.9.2 https://review.openstack.org/100152 | 03:27 |
| *** dstanek is now known as dstanek_zzz | 03:37 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: delete the tokens when deleting ec2 credential https://review.openstack.org/87450 | 03:37 |
| *** dims__ has joined #openstack-keystone | 03:39 | |
| topol | morganfainberg, you there? | 03:40 |
| topol | stevemar you there? | 03:40 |
| stevemar | topol, howdy | 03:40 |
| *** ncoghlan is now known as ncoghlan_afk | 03:40 | |
| topol | Hi stevemar, quick question. So does devstack now default to starting keystone within apache? I was looking at the keystone devstack script and it did not appear to be configurable | 03:41 |
| *** lbragstad has quit IRC | 03:41 | |
| *** dims__ has quit IRC | 03:41 | |
| stevemar | topol, whats the error? | 03:41 |
| stevemar | topol, is it something about oslo.db ? | 03:42 |
| topol | stevemar, no error. just wanted to confirm that devstack now runs a s default keystone deployed as part of HTTPD | 03:42 |
| topol | stevemar, cause thats how I interpreted the devstack keystone script | 03:42 |
| stevemar | topol, jeez, i mis-read that... | 03:43 |
| stevemar | topol, i would say that change isn't in yet | 03:43 |
| stevemar | https://review.openstack.org/#/c/100747/ | 03:43 |
| *** dstanek_zzz is now known as dstanek | 03:43 | |
| openstackgerrit | Justin Shepherd proposed a change to openstack/keystone: Adding an index on token.user_id https://review.openstack.org/102041 | 03:44 |
| stevemar | topol, you can start it by default by setting APACHE_ENABLED_SERVICES=key in localrc devstack file | 03:44 |
| stevemar | topol, but no, the change isn't in yet | 03:45 |
| *** ncoghlan_afk is now known as ncoghlan | 03:46 | |
| topol | stevemar so what is throwing me off is KEYSTONE_USE_MOD_WSGI did not appear to be used in http://devstack.org/lib/keystone.html | 03:46 |
| stevemar | topol, i don't think that change is in either, https://review.openstack.org/#/c/101611/ | 03:47 |
| topol | stevemar, thanks. I could have sworn that had merged | 03:48 |
| topol | stevemar, I am very close to sending the article to you for you to add your polish | 03:49 |
| stevemar | topol, nope. looks like KEYSTONE_USE_MOD_WSGI will replace APACHE_ENABLED_SERVICES though | 03:49 |
| topol | stevemar, thats fine | 03:49 |
| stevemar | topol, awesome, looking forward to it | 03:49 |
| stevemar | topol, gonna review those patches now :) | 03:50 |
| topol | stevemar, we warned its all xml | 03:50 |
| topol | err be warned | 03:50 |
| topol | stevemar, its "old man" authoring :-) | 03:50 |
| stevemar | topol, i am hoping to find some time to try out mareks client side changes for federation | 03:50 |
| stevemar | topol, s'all good | 03:51 |
| topol | stevemar, K | 03:51 |
| *** lbragstad has joined #openstack-keystone | 03:54 | |
| *** hrybacki has quit IRC | 03:57 | |
| *** ncoghlan is now known as ncoghlan_afk | 03:59 | |
| *** dstanek is now known as dstanek_zzz | 04:10 | |
| *** jamielennox is now known as jamielennox|away | 04:13 | |
| *** radez is now known as radez_g0n3 | 04:29 | |
| *** morganfainberg_L has joined #openstack-keystone | 04:41 | |
| *** dims has joined #openstack-keystone | 04:42 | |
| *** gyee has quit IRC | 04:42 | |
| *** gokrokve has joined #openstack-keystone | 04:44 | |
| *** ajayaa has joined #openstack-keystone | 04:45 | |
| *** dims has quit IRC | 04:47 | |
| *** ajayaa has quit IRC | 04:58 | |
| *** ncoghlan_afk is now known as ncoghlan | 05:00 | |
| *** nsquare has quit IRC | 05:01 | |
| *** praneshp has joined #openstack-keystone | 05:04 | |
| *** ajc_ has joined #openstack-keystone | 05:07 | |
| *** lbragstad has quit IRC | 05:07 | |
| *** praneshp_ has joined #openstack-keystone | 05:08 | |
| *** gokrokve_ has joined #openstack-keystone | 05:09 | |
| *** praneshp has quit IRC | 05:09 | |
| *** praneshp_ is now known as praneshp | 05:09 | |
| *** ajayaa has joined #openstack-keystone | 05:10 | |
| *** gokrokve has quit IRC | 05:11 | |
| *** daneyon has joined #openstack-keystone | 05:16 | |
| stevemar | morganfainberg, always with the punny review comments! | 05:22 |
| morganfainberg_L | wut? | 05:25 |
| stevemar | morganfainberg, added 1 more nit! | 05:26 |
| *** topol has quit IRC | 05:26 | |
| *** daneyon has quit IRC | 05:26 | |
| *** daneyon has joined #openstack-keystone | 05:27 | |
| morganfainberg_L | stevemar: i'm lost | 05:27 |
| stevemar | morganfainberg_L, just talking about your devstack change, it's also late, so theres that | 05:32 |
| *** nsquare has joined #openstack-keystone | 05:36 | |
| *** rwsu has quit IRC | 05:41 | |
| *** dims has joined #openstack-keystone | 05:43 | |
| *** dims has quit IRC | 05:47 | |
| *** ncoghlan is now known as ncoghlan_afk | 05:47 | |
| *** nsquare has quit IRC | 05:48 | |
| *** morganfainberg_L has quit IRC | 05:51 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/97005 | 06:00 |
| *** gokrokve_ has quit IRC | 06:08 | |
| *** jaosorior has joined #openstack-keystone | 06:20 | |
| *** harlowja is now known as harlowja_away | 06:20 | |
| *** stevemar has quit IRC | 06:25 | |
| *** ncoghlan_afk is now known as ncoghlan | 06:26 | |
| *** nsquare has joined #openstack-keystone | 06:27 | |
| *** bvandenh has joined #openstack-keystone | 06:29 | |
| *** praneshp has quit IRC | 06:40 | |
| *** dims has joined #openstack-keystone | 06:43 | |
| *** dims has quit IRC | 06:48 | |
| *** daneyon_ has joined #openstack-keystone | 06:48 | |
| *** daneyon has quit IRC | 06:52 | |
| *** daneyon_ has quit IRC | 06:57 | |
| *** amcrn has quit IRC | 07:02 | |
| *** yfujioka has quit IRC | 07:03 | |
| *** marekd|away is now known as marekd | 07:04 | |
| marekd | morganfainberg: thanks for the sso review, starting to looking at it :-) | 07:05 |
| marekd | morganfainberg: (not sure if you are still here) | 07:05 |
| *** daneyon has joined #openstack-keystone | 07:06 | |
| *** openstackgerrit has quit IRC | 07:10 | |
| *** BAKfr has joined #openstack-keystone | 07:11 | |
| *** afazekas is now known as __afazekas | 07:17 | |
| *** gokrokve has joined #openstack-keystone | 07:19 | |
| *** gokrokve has quit IRC | 07:23 | |
| *** andreaf has joined #openstack-keystone | 07:39 | |
| *** nsquare has quit IRC | 07:39 | |
| *** dims_ has joined #openstack-keystone | 07:44 | |
| *** amerine_ has joined #openstack-keystone | 07:44 | |
| *** afazekas has joined #openstack-keystone | 07:46 | |
| *** amerine has quit IRC | 07:47 | |
| *** dims_ has quit IRC | 07:49 | |
| *** amerine has joined #openstack-keystone | 08:09 | |
| *** amerine_ has quit IRC | 08:12 | |
| *** daneyon has quit IRC | 08:19 | |
| *** daneyon has joined #openstack-keystone | 08:23 | |
| *** ncoghlan has quit IRC | 08:24 | |
| *** dims_ has joined #openstack-keystone | 08:45 | |
| *** i159 has joined #openstack-keystone | 08:46 | |
| *** dims_ has quit IRC | 08:50 | |
| *** tziOm has joined #openstack-keystone | 08:59 | |
| marekd | mhu: around? :-) | 09:17 |
| mhu | marekd: hi ! | 09:17 |
| marekd | mhu: just wanted to check what's up :-) | 09:18 |
| marekd | and if you guys want to take over auth part in OSC :-) | 09:18 |
| marekd | mhu: I understand you are busy with some other work but would like to know if you have any plans for development :-) | 09:18 |
| mhu | marekd, sure ! I was actually looking at what was left to be done, we can actually switch to this now | 09:19 |
| marekd | mhu: great. | 09:19 |
| marekd | as i wrote in the e-mail: IDPs are already merged, Mapping are under review, Protocls were not even started | 09:19 |
| marekd | mhu: after we have it, rearchitecting auth mechanism in OSC would be a nice step. | 09:20 |
| marekd | mhu: i think there is a good place for using your imagination as it can be done in plugable and exendable way, i think :-) | 09:20 |
| mhu | marekd, sweet ! we'd be 2 or 3 people working on it so there's room for plenty of ideas | 09:21 |
| mhu | marekd, is anyone working on protocols or is it up for grabs ? | 09:21 |
| marekd | mhu: i would be happy to serve with code reviews :-) as long as you want it of course :-) | 09:21 |
| mhu | marekd, of course ! | 09:21 |
| marekd | mhu: added you as a reviewer to the Mapping CRUD in OSC | 09:22 |
| marekd | mhu: i think you may want to start with that and fix it :-) | 09:22 |
| mhu | marekd, sounds good to me | 09:22 |
| marekd | mhu: well..fix, make it high quality code, because there are some bugs in there :-) | 09:22 |
| marekd | or thing ppl don't like | 09:23 |
| marekd | things* | 09:23 |
| marekd | mhu: BTW, already started wearing red hat at work ? :-) | 09:23 |
| mhu | marekd, I see the news spread fast :) | 09:24 |
| marekd | mhu: among OpenStack community - yes :-) | 09:24 |
| *** zhiyan is now known as zhiyan_ | 09:28 | |
| mhu | marekd, I'll have a talk with the people I work with @CW and let you know how we're advancing | 09:29 |
| mhu | if there's anything else we can help with do not hesitate | 09:29 |
| marekd | mhu: well....reviews of https://review.openstack.org/#/c/83829/ for example. | 09:32 |
| mhu | I've got a big bunch of reviews I need to address, I'll get to that ASAP :) | 09:33 |
| marekd | cool | 09:33 |
| marekd | thanks :-) | 09:35 |
| tziOm | Where can I find examples of integrating my own endpoint with keystone? | 09:39 |
| *** dims_ has joined #openstack-keystone | 09:46 | |
| *** openstackgerrit has joined #openstack-keystone | 09:48 | |
| *** dims_ has quit IRC | 09:51 | |
| *** dims_ has joined #openstack-keystone | 10:46 | |
| openstackgerrit | Marco Fargetta proposed a change to openstack/keystone-specs: Web Authentication for SAML federated Keystone https://review.openstack.org/96867 | 11:03 |
| *** fmarco76 has joined #openstack-keystone | 11:30 | |
| *** diegows has quit IRC | 11:42 | |
| *** ajayaa has quit IRC | 11:50 | |
| *** diegows has joined #openstack-keystone | 11:53 | |
| dvorak | I'm reworking my token flush patchset and I was wondering, is there an easy way to get sqlalchemy to display the queries being run? The stuff I found online about this didn't seem to work, but perhaps I was doing it wrong | 12:00 |
| tziOm | For putting the openstack apis public, will I need multiple ips, or is it common to run through some sort of proxy? I mean .. alot of companies have ports blocked out, and it makes it hard to use ports other than 80 and 443 for api | 12:07 |
| *** stevemar has joined #openstack-keystone | 12:22 | |
| *** gordc has joined #openstack-keystone | 12:26 | |
| *** hrybacki has joined #openstack-keystone | 12:49 | |
| *** ajc_ has quit IRC | 12:50 | |
| *** dstanek_zzz is now known as dstanek | 12:52 | |
| *** erecio has joined #openstack-keystone | 12:55 | |
| *** gordc has quit IRC | 12:55 | |
| *** oomichi has quit IRC | 12:57 | |
| *** richm has joined #openstack-keystone | 13:03 | |
| *** nkinder has quit IRC | 13:10 | |
| *** andreaf has quit IRC | 13:13 | |
| *** dims_ has quit IRC | 13:13 | |
| *** dims_ has joined #openstack-keystone | 13:14 | |
| *** bklei has joined #openstack-keystone | 13:15 | |
| *** bknudson has joined #openstack-keystone | 13:17 | |
| *** joesavak has joined #openstack-keystone | 13:17 | |
| *** dvorak has quit IRC | 13:18 | |
| *** dvorak has joined #openstack-keystone | 13:20 | |
| *** radez_g0n3 is now known as radez | 13:23 | |
| marekd | stevemar: thanks for smashing mapping crud in OSC :_ | 13:32 |
| stevemar | marekd, lol | 13:32 |
| marekd | :-) | 13:32 |
| stevemar | marekd, sorry | 13:32 |
| marekd | stevemar: hehe, no worries. | 13:32 |
| stevemar | marekd, :) nothing too major! | 13:32 |
| marekd | stevemar: do you know if dolphm is hanging around? Or he is on holiday/sth? | 13:33 |
| stevemar | marekd, no idea boss | 13:36 |
| *** lbragstad has joined #openstack-keystone | 13:37 | |
| hrybacki | ayoung: do we know any of the folks in the Glance community? I'm getting tired of pining their channel about the session stuff only to hear echoes. | 13:39 |
| hrybacki | pinging* | 13:39 |
| ayoung | the way I usually do stuff like that is to look in git to see who has committed, and ping those people directly | 13:39 |
| ayoung | a lot of people don;t watch the channel, but will respond to direct pings | 13:40 |
| ayoung | so git log is your friend | 13:40 |
| dstanek | or git blame | 13:41 |
| *** Camisa has quit IRC | 13:41 | |
| hrybacki | damn people and their odd handles | 13:43 |
| *** gordc has joined #openstack-keystone | 13:46 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Corrects minor spelling mistakes https://review.openstack.org/102237 | 13:51 |
| *** nkinder has joined #openstack-keystone | 13:54 | |
| *** gokrokve has joined #openstack-keystone | 14:01 | |
| *** bklei has quit IRC | 14:03 | |
| *** topol has joined #openstack-keystone | 14:04 | |
| *** Kr4zy has joined #openstack-keystone | 14:08 | |
| openstackgerrit | Marcos FermÃn Lobo proposed a change to openstack/keystone: NotImplemented _for_groups functions on LDAP https://review.openstack.org/102244 | 14:08 |
| Kr4zy | I am experiencing internal server error 500 when I host Keystone Icehouse 2014.1-0.9.rc2 on CentOS 6.4 using WSGI on Apache2. Anyone experiencing this issue? | 14:09 |
| Kr4zy | Native Keystone Icehouse works fine | 14:09 |
| dstanek | marekd: i think he's in the office today - he was yesterday | 14:11 |
| marekd | dstanek: ok, thanks :-) | 14:11 |
| *** daneyon has quit IRC | 14:21 | |
| hrybacki | ayoung: were you still thinking we should work toward replacing httplib in glanceclient? If so, can you take a gander at the bottom comment of https://bugs.launchpad.net/python-glanceclient/+bug/1255279 and let me know your thoughts as they directly mention you | 14:21 |
| uvirtbot | Launchpad bug 1255279 in python-glanceclient "glanceclient should use requests" [Undecided,New] | 14:21 |
| ayoung | sure | 14:22 |
| nkinder | ayoung: what's the current state of the policy api? | 14:22 |
| nkinder | ayoung: do any other services actually use it? | 14:22 |
| ayoung | nkinder, I've heard dark tales | 14:22 |
| ayoung | about unspeakable things being done with policy | 14:23 |
| ayoung | These are shrugged off as travellers stories | 14:23 |
| ayoung | dolphm, who is using policy? I know that we don't yet. | 14:23 |
| nkinder | ayoung: I'm assuming the intent is that something like nova would just fetch central policy from keystone instead of requiring policy.json to be managed locally on all compute nodes | 14:23 |
| dolphm | ayoung: /v3/policy ? | 14:23 |
| ayoung | nkinder, yes, but it is not usable yet | 14:23 |
| dolphm | ayoung: policies* | 14:24 |
| ayoung | dolphm, you mentioned that you knew it was in use. | 14:24 |
| nkinder | ayoung: ok, what's missing? | 14:24 |
| ayoung | yeah, poicy API | 14:24 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Implement SAML2 ECP authentication https://review.openstack.org/92166 | 14:24 |
| ayoung | nkinder, a way to get the "right" policy | 14:24 |
| ayoung | policy gets uploaded and assigned a new ID | 14:24 |
| dolphm | ayoung: yes that's the intent. someone from either a stackforge project or 3rd party project was using the API, but that's it | 14:24 |
| ayoung | there is nothing that says which policy id applies to which endpoint | 14:24 |
| nkinder | ok, so the endpoint needs to know the id currently | 14:25 |
| ayoung | nkinder, dolphm and I have been discusing, and henrynash is taking an interest now | 14:25 |
| ayoung | I wrote some BPs/specs, but need to get a clear path forward | 14:25 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Implement SAML2 ECP authentication https://review.openstack.org/92166 | 14:26 |
| *** david-lyle has joined #openstack-keystone | 14:26 | |
| ayoung | nkinder, https://blueprints.launchpad.net/keystone/+spec/endpoint-policy was my first stab at it | 14:26 |
| ayoung | but dolphm realized that we prefeix each rule with the service name | 14:26 |
| ayoung | well, the "good" name | 14:26 |
| ayoung | so keystone policy rulkes start with "identity" | 14:27 |
| ayoung | and nova with compute | 14:27 |
| ayoung | so they could be deployed side by side in the same file | 14:27 |
| marekd | dstanek: https://review.openstack.org/#/c/92166/28/keystoneclient/contrib/auth/v3/saml2.py - i know want to make IdP auth plugins pluggable. By saying IdP plugin I say: the IdP auth step within SAML authN process" How do you like idea of class IdpAuth from the provided link and how do you like idea that such plugin should be initialized and passed before saml2 authN begins (parameter idp_auth_plugin in Saml2UnscopedToken.__init__() ) ? | 14:28 |
| hrybacki | ayoung: apparently they started to port but ran into issues with requests not providing the ability to disable ssl compression https://github.com/kennethreitz/requests/issues/1853 and abandoned the blueprint/change https://review.openstack.org/#/c/23424/ | 14:31 |
| ayoung | hrybacki, yeah, just ignore that | 14:31 |
| ayoung | it turns out it is an operating system configuration | 14:31 |
| ayoung | and it should be | 14:31 |
| hrybacki | mmk | 14:31 |
| ayoung | so we can just use requests and things work right | 14:31 |
| hrybacki | it looks like Fabio did a lot of work, why did they abandon the change? | 14:32 |
| ayoung | hrybacki, because people got on the "compression" bandwagon before we fully understood the problem | 14:33 |
| hrybacki | heh | 14:33 |
| *** Kr4zy_ has joined #openstack-keystone | 14:34 | |
| *** Kr4zy has quit IRC | 14:34 | |
| ayoung | hrybacki, yeah, its one of the side effects of python, or any application language, working to abstract away the operating system. The urge then becomes to reinvent everything in the app language | 14:34 |
| hrybacki | interesting | 14:34 |
| ayoung | I've seen it in depth in Java, Perl, and Python so far. And a Bit of Ruby, too | 14:35 |
| dstanek | marekd: at first glance it looks sane | 14:35 |
| *** fmarco76 has left #openstack-keystone | 14:35 | |
| ayoung | dstanek, I thought you were saying Glance looked sane | 14:35 |
| hrybacki | it looks like most of the work I'd need to do has been done already e.g. https://review.openstack.org/#/c/23424/14/glanceclient/common/http.py | 14:35 |
| marekd | dstanek: ok, cool. | 14:35 |
| ayoung | thought maybe you were slipping | 14:35 |
| dstanek | ayoung: no, i cannot confirm that yet | 14:35 |
| dstanek | ayoung: Ruby likes to reinvent everything, including Ruby | 14:36 |
| ayoung | dstanek, Every language does that | 14:36 |
| ayoung | dstanek, its the same thing I've been battling with the Apache HTTPD effort | 14:36 |
| *** andreaf has joined #openstack-keystone | 14:37 | |
| ayoung | Python should be for business logic, with performance intensive stuff optimized to native code | 14:37 |
| ayoung | and that goes quintuple for crypto | 14:37 |
| ayoung | nkinder, so, on policy, here's how far we've got in discussions | 14:38 |
| ayoung | it is the service user that makes the request for policy | 14:38 |
| marekd | heh, within next 10 OS releases there will be at least one OS project written in GO :P | 14:38 |
| ayoung | the service user has a context | 14:39 |
| ayoung | and we can use that context to select policy | 14:39 |
| ayoung | probably the right scope is to do : look at the service users token. Chose the project from it. Use that project to fetch the proper policy file | 14:40 |
| ayoung | so if you have two endpoint for the same service, and you want them to have different policies, you would have their services users fetch tokens scoped to different projects | 14:40 |
| ayoung | hrybacki, so resurrrect flapper's code | 14:41 |
| ayoung | and lets fine out when the glance team meeting is this week so we can beat them up about it | 14:42 |
| hrybacki | 1000 on Thurs. | 14:42 |
| ayoung | https://wiki.openstack.org/wiki/Meetings/Glance | 14:42 |
| hrybacki | meeting-alt | 14:42 |
| ayoung | cool | 14:42 |
| ayoung | modify the meeting wiki to put this on the agenda | 14:42 |
| ayoung | etherpad for them | 14:42 |
| ayoung | https://etherpad.openstack.org/p/glance-team-meeting-agenda | 14:42 |
| hrybacki | or 2000 rather? | 14:43 |
| ayoung | hrybacki, pingme before hand and we'll make a united front | 14:43 |
| ayoung | 14:00 UTC | 14:44 |
| hrybacki | it alternates, 19th was was 14:00 | 14:44 |
| hrybacki | right? | 14:44 |
| ayoung | http://www.timeanddate.com/worldclock/converter.html | 14:45 |
| *** topol has quit IRC | 14:45 | |
| ayoung | looks like it | 14:45 |
| Kr4zy_ | I am experiencing internal server error 500 when using Apache2 to host Keystone 2014.1-0.9.rc2 using WSGI. Anyone experiencing this? | 14:46 |
| dstanek | Kr4zy_: do you have access to the Apache logs? | 14:50 |
| Kr4zy_ | yeah | 14:51 |
| Kr4zy_ | I have looked | 14:51 |
| Kr4zy_ | dstanek: the logs are not very helpful | 14:51 |
| Kr4zy_ | dstanek: I take that back. | 14:52 |
| openstackgerrit | Justin Shepherd proposed a change to openstack/keystone: Adding an index on token.user_id https://review.openstack.org/102041 | 14:52 |
| Kr4zy_ | dstanek: It said "ImportError: cannot import name deploy" | 14:53 |
| dstanek | Kr4zy_: no stacktrace? | 14:54 |
| Kr4zy_ | dstanek: here is the log : https://gist.github.com/anonymous/cee580c4f8673cd5c300 | 14:57 |
| *** morganfainberg_L has joined #openstack-keystone | 14:58 | |
| morganfainberg_L | mornin | 14:59 |
| marekd | elo | 14:59 |
| Kr4zy_ | dstanek: I currently have python-paste-deploy1.5-1.5.0-5.el6.noarch installed. | 14:59 |
| dstanek | Kr4zy_: it appears that not all of the dependencies were installed - PasteDeply seems to be missing | 14:59 |
| dstanek | Kr4zy_: what happens if you run python and import it? | 14:59 |
| ayoung | Kr4zy_, tokens too big | 15:00 |
| *** bvandenh has quit IRC | 15:00 | |
| Kr4zy_ | dstanek: Traceback (most recent call last): File "<stdin>", line 1, in <module> ImportError: No module named deploy | 15:00 |
| ayoung | Kr4zy_, the service catalog gets above 8k and won't fit in the header between mod_wsgi and theapache process | 15:01 |
| Kr4zy_ | ayoung: how do I fix this? | 15:01 |
| ayoung | Kr4zy_, make a request for a token without a service catalog and see if it works | 15:02 |
| ayoung | Kr4zy_, compressed tokens | 15:02 |
| ayoung | endpoint filtering | 15:02 |
| ayoung | Kr4zy_, I don';t have a perfect answer yet | 15:02 |
| dstanek | Kr4zy_: if you have the package installed that import should work - i have no idea why it wouldn't | 15:02 |
| ayoung | its one of the fires I've been fighting | 15:02 |
| ayoung | Kr4zy_, but... | 15:02 |
| ayoung | <Kr4zy_> \ "ImportError: cannot import name deploy" is not that problem | 15:03 |
| dstanek | ayoung: what makes you think the catalog is too big? | 15:03 |
| ayoung | dstanek, cuz that is the thing everyone else is hitting in HTTPD | 15:03 |
| Kr4zy_ | ayoung: yeah, I was about to ask | 15:03 |
| ayoung | but in this case, not | 15:03 |
| dvorak | Is there an easy way to get SQLAlchemy to print the SQL queries it's generating? I'm trying to rework my token expiration patch set and I'd like to be able to see the queries generated so I can run explain n them and validate they're doing what I think | 15:03 |
| dstanek | Kr4zy_: in Python 'import paste' and 'print paste.__file__' | 15:04 |
| dstanek | dvorak: yes, the logger...jas | 15:04 |
| Kr4zy_ | dstanek: >>> import paste >>> print paste.__file__ Traceback (most recent call last): File "<stdin>", line 1, in <module> AttributeError: 'module' object has no attribute '__file__' | 15:04 |
| dstanek | dvorak: try this http://stackoverflow.com/questions/2950385/debugging-displaying-sql-command-sent-to-the-db-by-sqlalchemy | 15:05 |
| dvorak | yeap, I tried that, but didn't have any luck | 15:05 |
| dvorak | I didn't know if there was some special keystone/openstack magic needed | 15:05 |
| dstanek | dvorak: hmmm...at one time that did work for me. maybe they changed the name of their logger | 15:05 |
| *** jsavak has joined #openstack-keystone | 15:06 | |
| dvorak | maybe I'll try it again, perhaps I did something wrong | 15:06 |
| dstanek | Kr4zy_: wow, wierd. that works fine for me. what about vars(paste)? | 15:07 |
| dstanek | that should have a ton of output | 15:07 |
| Kr4zy_ | dstanek: {'__name__': 'paste', '__doc__': None, '__path__': ['/usr/lib/python2.6/site-packages/paste']} | 15:07 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: the user_tenant_membership table was replaced by "assignment" https://review.openstack.org/102266 | 15:07 |
| dstanek | Kr4zy_: look in /usr/lib/python2.6/site-packages and see if you can find paste deploy | 15:08 |
| *** joesavak has quit IRC | 15:09 | |
| hrybacki | ayoung: for your review/editing https://etherpad.openstack.org/p/keystoneclient_integration_with_component_clients | 15:09 |
| Kr4zy_ | dstanek: I have /usr/lib/python2.6/site-packages/PasteDeploy-1.5.0-py2.6.egg/paste/deploy directory | 15:10 |
| ayoung | hrybacki, link to jamielennox|away 's blog post on sessions | 15:11 |
| dstanek | Kr4zy_: i wonder if your missing an entry in your pth file for paste | 15:11 |
| Kr4zy_ | dstanek: this is what's inside dir https://gist.github.com/anonymous/f869220602095303387b | 15:12 |
| *** daneyon has joined #openstack-keystone | 15:13 | |
| hrybacki | ayoung++ | 15:14 |
| *** gokrokve has quit IRC | 15:14 | |
| dstanek | Kr4zy_: i don't know much about how redhat installs python code, but there are .pth files in site-packages that usually contain directories to be added to the Python path | 15:17 |
| dstanek | Kr4zy_: try this http://dpaste.com/100VV09 | 15:18 |
| Kr4zy_ | dstanek: Traceback (most recent call last): File "<stdin>", line 1, in <module> ImportError: cannot import name deploy | 15:18 |
| *** topol has joined #openstack-keystone | 15:25 | |
| Kr4zy_ | dstanek: I have actually try to import deploy on a working Keystone Havana node and it is showing the same error, but Keystone on WSGI still works. | 15:34 |
| dstanek | Kr4zy_: is there a Python path being set in the Apache file? | 15:35 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fix the order of assertEqual arguments(pemutils, v3_catalog, etc) https://review.openstack.org/77514 | 15:36 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Implement SAML2 ECP authentication https://review.openstack.org/92166 | 15:37 |
| *** gokrokve has joined #openstack-keystone | 15:39 | |
| *** gyee has joined #openstack-keystone | 15:40 | |
| ayoung | dstanek, where can I find oslo.db? | 15:44 |
| ayoung | like, where would devstack expect it to be? | 15:44 |
| Kr4zy_ | dstanek: yeah. I am using Puppet to lay this down. The configuration is similar to the working havana node. | 15:46 |
| *** joesavak has joined #openstack-keystone | 15:46 | |
| dstanek | ayoung: i think it installs it to the system python or in /opt/stack - i don't have a newer devstack | 15:48 |
| ayoung | I just pip installed and worked around it... | 15:48 |
| ayoung | I thin kthat is all it does, but maybe it builds nd installs the pacakge version...guess I really don't care. But thanks | 15:48 |
| dstanek | Kr4zy_: your Apache conf has a Python path? | 15:48 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Service Token Composite Authorization Specification https://review.openstack.org/96315 | 15:49 |
| dstanek | ayoung: :-) | 15:49 |
| *** jsavak has quit IRC | 15:49 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: deprecate LDAP config options for 'tenants' https://review.openstack.org/102278 | 15:51 |
| morganfainberg_L | dolphm: YAY! | 15:54 |
| dolphm | morganfainberg_L: long overdue! | 15:54 |
| morganfainberg_L | dolphm: +++++++1million | 15:57 |
| *** marekd is now known as marekd|away | 15:59 | |
| *** praneshp has joined #openstack-keystone | 16:00 | |
| *** joesavak has quit IRC | 16:00 | |
| *** joesavak has joined #openstack-keystone | 16:00 | |
| *** jsavak has joined #openstack-keystone | 16:01 | |
| morganfainberg_L | ok i need to go get breakfast and run an errand be back for the meeting | 16:01 |
| *** joesavak has quit IRC | 16:05 | |
| *** marcoemorais has joined #openstack-keystone | 16:08 | |
| *** BAKfr has quit IRC | 16:12 | |
| *** bvandenh has joined #openstack-keystone | 16:18 | |
| *** andreaf has quit IRC | 16:18 | |
| *** andreaf has joined #openstack-keystone | 16:19 | |
| *** i159 has quit IRC | 16:22 | |
| *** gokrokve_ has joined #openstack-keystone | 16:22 | |
| *** afazekas has quit IRC | 16:24 | |
| *** dstanek is now known as dstanek_zzz | 16:24 | |
| *** dstanek_zzz is now known as dstanek | 16:25 | |
| *** gokrokve has quit IRC | 16:25 | |
| *** gokrokve_ has quit IRC | 16:32 | |
| *** __afazekas is now known as afazekas | 16:41 | |
| *** jaosorior has quit IRC | 16:42 | |
| *** Kr4zy_ has quit IRC | 16:46 | |
| *** gordc has quit IRC | 16:49 | |
| *** harlowja_away is now known as harlowja | 16:55 | |
| *** henrynash has joined #openstack-keystone | 16:57 | |
| *** bklei has joined #openstack-keystone | 16:59 | |
| *** henrynash has quit IRC | 17:07 | |
| *** elmiko has joined #openstack-keystone | 17:09 | |
| *** gokrokve has joined #openstack-keystone | 17:10 | |
| elmiko | hey all, is there more information about trusts than the wiki page(https://wiki.openstack.org/wiki/Keystone/Trusts) ? | 17:10 |
| *** nsquare has joined #openstack-keystone | 17:11 | |
| lbragstad | elmiko: the identity spec contains information https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-trust-ext.md | 17:11 |
| elmiko | lbragstad: ahh, tyvm :) | 17:12 |
| lbragstad | elmiko: sure thing, specifically information on the trust API | 17:12 |
| elmiko | lbragstad: this looks like what i was looking for, more in-depth api info | 17:13 |
| lbragstad | elmiko: cool, the identity api spec should contain a lot of that information | 17:13 |
| elmiko | lbragstad: ok thanks, i'll need to double check that as well | 17:13 |
| lbragstad | elmiko: no problem | 17:14 |
| dstanek | agenda for today's meeting is very sparse! | 17:17 |
| lbragstad | dstanek: sign stevemar up for another improv dance? | 17:17 |
| stevemar | lbragstad, umm i believe it's the person who says the meeting is sparse is automatically signed up | 17:18 |
| dstanek | lbragstad: he better start prepping - i hear he has a performance at the Hackathon | 17:19 |
| lbragstad | in person!? | 17:19 |
| *** henrynash has joined #openstack-keystone | 17:19 | |
| lbragstad | even better | 17:19 |
| elmiko | lbragstad: i was under the impression that you could list a set of endpoints when creating a trust, is that not the case? | 17:19 |
| dstanek | live streamed over youtube! | 17:19 |
| lbragstad | elmiko: I'm not entirely sure you can do that but ayoung might have more info in it? What are you trying to do? | 17:20 |
| ayoung | elmiko, are you trying to limit a trust token to only a specific set of endpoints? | 17:21 |
| elmiko | lbragstad: i would like to delegate a trust from user A to user B allowing access to a specific Swift object | 17:21 |
| elmiko | ayoung: yea | 17:21 |
| ayoung | elmiko, its only a blueprint today | 17:21 |
| lbragstad | ah, gotcha | 17:21 |
| elmiko | ayoung: doh! | 17:21 |
| ayoung | https://blueprints.launchpad.net/keystone/+spec/endpoint-scoped-tokens | 17:22 |
| ayoung | I know it is obnoxious to say it, but patches welcomed | 17:22 |
| ayoung | that one, especially, would be stellar | 17:22 |
| lbragstad | I think we kind of touched on this topic a little at the summit to... (maybe the notes are in etherpad)? | 17:22 |
| elmiko | ayoung: well, i'll take a look. if i think i can help, i will :) | 17:23 |
| lbragstad | but that was more along the lines of an end user interacting with Swift through Glance, etc.. | 17:23 |
| elmiko | i'm actually looking at this for the sahara project, and i thought it was in place already. but it would really help the problem we are facing lol. | 17:23 |
| ayoung | elmiko, in auth token middleware, when looking to see if a token is valid, we would add the check (subject to a config flag) that the current endpoint is in the token i | 17:24 |
| ayoung | big problem there is that endpoints don't know their own id | 17:24 |
| ayoung | but solvable | 17:24 |
| *** rwsu has joined #openstack-keystone | 17:25 | |
| elmiko | ayoung: this would involve some level of figuring out how to map endpoints into a token id? | 17:26 |
| *** daneyon has quit IRC | 17:29 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Regenerate sample config file https://review.openstack.org/102294 | 17:30 |
| *** gordc has joined #openstack-keystone | 17:32 | |
| *** amcrn has joined #openstack-keystone | 17:32 | |
| dstanek | the amount of specs/reviews i have in next-review is quite staggering ... anyone know of anything critical i should concentrate on | 17:32 |
| dstanek | ? | 17:32 |
| bknudson | dstanek: doesn't next-review order them by importance? | 17:35 |
| *** openstackgerrit has quit IRC | 17:35 | |
| *** openstackgerrit has joined #openstack-keystone | 17:37 | |
| dstanek | bknudson: i don't think so - i think just by last updated - gerrit doesn't have a priority (but it should) | 17:38 |
| bknudson | dstanek: oh, I thought it looked at reviewday data | 17:39 |
| bknudson | http://status.openstack.org/reviews/reviewday.json | 17:39 |
| dstanek | bknudson: neat, what is that score? | 17:40 |
| *** andreaf has quit IRC | 17:40 | |
| bknudson | dstanek: reviewday calculates it... http://git.openstack.org/cgit/openstack-infra/reviewday/tree/reviewday/mergeprop.py#n22 | 17:41 |
| dstanek | bknudson: fixing next-review right now! thanks for the pointer | 17:43 |
| dolphm | bknudson: ( not yet :-/ ) | 17:46 |
| dolphm | dstanek: i have a patch for review day support that isn't merged, if want to start with that | 17:46 |
| dolphm | dstanek: not sure what it needs to merge, but probably not much. i sat on it for a bit comparing sort order with and without review day, and wasn't sure if a reviewday based sort should be the default behavior, or optional | 17:47 |
| dolphm | dstanek: but to answer your original question... i'd say the ones closest to being approved are probably JSON Home https://review.openstack.org/97359 Non-Persistent Tokens https://review.openstack.org/95976 so i'd focus on knocking those out | 17:48 |
| dolphm | (which now that i'm looking at the votes on those, was probably already obvious) | 17:49 |
| dstanek | dolphm: is you patch local or did you push it somewhere? | 17:49 |
| dolphm | dstanek: local at the moment | 17:49 |
| dstanek | dolphm: i +1ed the json home because nobody is assigned to do it, but other than that i think it's good | 17:50 |
| morganfainberg_L | keystonemiddleware repo is up and running | 17:50 |
| dstanek | dolphm: i just read over the spec last night and i'm excited to get that in | 17:50 |
| morganfainberg_L | https://github.com/openstack/keystonemiddleware | 17:50 |
| dstanek | morganfainberg_L: nice | 17:51 |
| morganfainberg_L | dstanek: ++ is we had someone assigned to JSON Home, I'd +2 | 17:51 |
| dolphm | morganfainberg_L: did that have a bp? | 17:51 |
| dstanek | bknudson: if you don't have the time i can take a look at it | 17:51 |
| bknudson | dstanek: I don't think I'll have the time | 17:52 |
| dstanek | dolphm: i don't think so - i think the link was actually invalid - which i took at meaning "this is where it will be" | 17:52 |
| dolphm | dstanek: also, composite tokens looked quite sane last i checked, but i didn't get to take a full pass https://review.openstack.org/#/c/96315/ | 17:52 |
| bknudson | dstanek: but if I can get the v3 extension advertisements done then it would probably be somewhat easy to add on | 17:52 |
| lbragstad | https://blueprints.launchpad.net/openstack/?searchtext=json-home | 17:52 |
| bknudson | dstanek: really the tricky part is getting it to work with GET / ... GET /v3 and GET /v2.0 should be easier | 17:53 |
| *** henrynash has quit IRC | 17:53 | |
| bknudson | maybe JSON-Home would allow GET / to point to GET /v2.0 and GET /v3? That would be easier | 17:53 |
| dstanek | bknudson: have you started to work on that? | 17:54 |
| dolphm | bknudson: what's the challenge with GET / ? | 17:54 |
| bknudson | dstanek: I started work on v3 extension advertisement... | 17:54 |
| bknudson | dolphm: the routers don't see GET / requests | 17:54 |
| bknudson | maybe there's a way to have GET / make an internal request to GET /v2.0 and GET /v3? | 17:55 |
| bknudson | dstanek: dolphm: here was a proof of concept for GET /v3 -- https://review.openstack.org/#/c/95389/2/keystone/contrib/ec2/routers.py | 17:56 |
| *** henrynash has joined #openstack-keystone | 17:57 | |
| dolphm | bknudson: that looks like it would work | 18:00 |
| bknudson | it works for GET /v3 because the extension router is in the pipeline /v3 -- http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone-paste.ini#n102 | 18:00 |
| *** harlowja has quit IRC | 18:04 | |
| *** hrybacki has quit IRC | 18:06 | |
| *** harlowja has joined #openstack-keystone | 18:07 | |
| *** harlowja has quit IRC | 18:07 | |
| *** dims_ has quit IRC | 18:13 | |
| *** dims_ has joined #openstack-keystone | 18:14 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: auth_token cached token handling https://review.openstack.org/96786 | 18:16 |
| *** gordc has quit IRC | 18:22 | |
| *** harlowja has joined #openstack-keystone | 18:26 | |
| *** harlowja has quit IRC | 18:26 | |
| *** Kr4zy has joined #openstack-keystone | 18:26 | |
| *** harlowja has joined #openstack-keystone | 18:26 | |
| *** harlowja has quit IRC | 18:26 | |
| *** harlowja has joined #openstack-keystone | 18:27 | |
| *** harlowja has quit IRC | 18:27 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Imports to fix build warnings https://review.openstack.org/99745 | 18:28 |
| *** gordc has joined #openstack-keystone | 18:28 | |
| Kr4zy | is it a known issue for mod_wsgi to not work with the latest keystone icehouse release? | 18:28 |
| *** harlowja has joined #openstack-keystone | 18:28 | |
| *** harlowja has quit IRC | 18:28 | |
| *** harlowja has joined #openstack-keystone | 18:29 | |
| *** harlowja has quit IRC | 18:29 | |
| *** harlowja has joined #openstack-keystone | 18:29 | |
| *** harlowja has quit IRC | 18:29 | |
| *** marcoemorais has quit IRC | 18:33 | |
| *** marcoemorais has joined #openstack-keystone | 18:34 | |
| *** harlowja has joined #openstack-keystone | 18:34 | |
| *** harlowja has quit IRC | 18:34 | |
| *** henrynash has quit IRC | 18:35 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Doc build fails if warnings https://review.openstack.org/101061 | 18:38 |
| *** harlowja has joined #openstack-keystone | 18:39 | |
| *** harlowja has quit IRC | 18:39 | |
| *** harlowja has joined #openstack-keystone | 18:40 | |
| *** harlowja has quit IRC | 18:40 | |
| *** nkinder has quit IRC | 18:41 | |
| *** harlowja has joined #openstack-keystone | 18:42 | |
| *** erecio has quit IRC | 18:55 | |
| openstackgerrit | A change was merged to openstack/keystone: remove unnecessary word in docs: 'an' https://review.openstack.org/99218 | 18:56 |
| *** hrybacki has joined #openstack-keystone | 18:57 | |
| *** jaosorior has joined #openstack-keystone | 18:58 | |
| *** dstanek is now known as dstanek_lunch | 19:00 | |
| ayoung | gyee, so, no hard requirement on PKI, as it just complicates matters. We an make it optional if you really want, and I have no problem with that | 19:00 |
| *** kwss_ has joined #openstack-keystone | 19:01 | |
| ayoung | but the question is "does an endpoint know its own id or does an endpoint work with the identity of the service user only." | 19:01 |
| gyee | ayoung, sure, I was merely brain farting over there, I haven't completely think through the details yet | 19:01 |
| ayoung | and I kindlik that last option | 19:01 |
| *** morganfainberg_L has quit IRC | 19:01 | |
| ayoung | kind of like | 19:01 |
| *** morganfainberg_L has joined #openstack-keystone | 19:01 | |
| ayoung | gyee, I have a bp for yourthing | 19:01 |
| *** morganfainberg_L has quit IRC | 19:02 | |
| gyee | ayoung, k, will put some thought into it | 19:02 |
| *** morganfainberg_L has joined #openstack-keystone | 19:02 | |
| ayoung | https://blueprints.launchpad.net/keystone/+spec/endpoint-cert gyee | 19:02 |
| ayoung | gyee, but I think that the solution is do it as a service user | 19:02 |
| ayoung | then the keystone server gets a new auth_url that is X509 client cert enforcing | 19:02 |
| ayoung | I have hostname/main hostname/admin hostname/krbb this would be hostname/x509 | 19:03 |
| ayoung | gyee, ^^ and then we can let apache do the heavy lifting | 19:03 |
| ayoung | ther need, then, is to make an x509 client plugin | 19:03 |
| ayoung | gyee, can you write that? | 19:03 |
| ayoung | like jose's kerberos plugin? | 19:04 |
| gyee | ayoung, sure | 19:04 |
| ayoung | gyee, https://review.openstack.org/#/c/74974/ | 19:04 |
| gyee | ayoung, I was thinking cert authorization, no need to issue the token at all | 19:04 |
| ayoung | gyee, I know | 19:04 |
| ayoung | gyee, two steps | 19:04 |
| morganfainberg_L | bknudson: ok, so you're proposing doing a soft import if exists in keystoneclient.middleware, but not having an install dep on keystonemiddleware - ok, when would we change that? i don't see a point in doing so, when we would change that why not just remove ksc middleware | 19:04 |
| gyee | cert -> apache -> middleware mapping -> auth context | 19:04 |
| ayoung | lets get certs to work to get a token first | 19:04 |
| ayoung | so: | 19:05 |
| ayoung | https://review.openstack.org/#/c/95989/ gyee | 19:05 |
| ayoung | we need something like ^^ | 19:05 |
| ayoung | OK? | 19:05 |
| gyee | ayoung, yeah, that's an easy one | 19:05 |
| gyee | ayoung, lemme cook one up | 19:06 |
| ayoung | gyee, I just don't havea client cert setup right now to make it easy, and my team is currently driving through on the Kerberos side | 19:06 |
| ayoung | but I'd be happy to review | 19:06 |
| gyee | ayoung, k, I have apache setup locally, with cert and everything | 19:06 |
| ayoung | client cert is the issue | 19:06 |
| ayoung | you need a CA to issue it | 19:07 |
| *** amerine has quit IRC | 19:07 | |
| bknudson | morganfainberg_L: not a soft import, not sure what the point would be of that? | 19:07 |
| morganfainberg_L | bknudson: i thought you meant to import the middleware to the same location as it was in keystoneclient | 19:08 |
| morganfainberg_L | bknudson: is that not what you were saying? | 19:08 |
| morganfainberg_L | bknudson: if you were saying we just drop the middleware (Eventually) from keystoneclient, that was the plan. just no specific timeline yet | 19:08 |
| morganfainberg_L | hence the need to do security fixes in ksc middleware until that can/does occur | 19:09 |
| *** dims_ has quit IRC | 19:15 | |
| *** dims_ has joined #openstack-keystone | 19:16 | |
| *** ayoung has quit IRC | 19:16 | |
| *** dstanek_lunch is now known as dstanek_lunch_zz | 19:16 | |
| *** dstanek_lunch_zz is now known as dstanek | 19:16 | |
| *** praneshp has quit IRC | 19:22 | |
| bknudson | morganfainberg_L: right, import the middleware. I didn't understand the soft import part? (I thought it meant try the import and don't fail if it doesn't work) | 19:27 |
| bknudson | morganfainberg_L: And I also expected that we'd keep the copy for a little while at least... maybe a few releases of ksc. | 19:28 |
| morganfainberg_L | bknudson: i don't see a reason to even bother importing to the same location as before once we drop the copy | 19:29 |
| morganfainberg_L | bknudson: i think that is why i was confused. | 19:29 |
| morganfainberg_L | bknudson: the way i saw it, keep a copy in keystoneclient, eventually drop it completely and don't even bother importing it to keystoneclient.middleware | 19:29 |
| bknudson | morganfainberg_L: I figured it would just keep working if we did the import & it doesn't really cost anything. | 19:30 |
| bknudson | and it would allow us to not have the copy for as long | 19:30 |
| morganfainberg_L | i doubt it, we'll need to keep a copy unless we update stable/* of projects | 19:30 |
| bknudson | but this is a ways out so can look at it then. | 19:30 |
| morganfainberg_L | yeah lets argue about that when we get there ;) | 19:31 |
| *** harlowja has quit IRC | 19:31 | |
| *** marcoemorais has quit IRC | 19:31 | |
| *** marcoemorais has joined #openstack-keystone | 19:32 | |
| morganfainberg_L | dolphm, bknudson, https://review.openstack.org/#/c/102326/ add to devstack | 19:32 |
| *** marcoemorais has quit IRC | 19:32 | |
| *** marcoemorais has joined #openstack-keystone | 19:32 | |
| bknudson | APT::Acquire::Retries "20"; -- wonder where that came from | 19:34 |
| morganfainberg_L | bknudson: recent change iirc | 19:35 |
| morganfainberg_L | issues with apt servers being unresponsive | 19:35 |
| openstackgerrit | A change was merged to openstack/keystone: deprecate LDAP config options for 'tenants' https://review.openstack.org/102278 | 19:36 |
| openstackgerrit | A change was merged to openstack/keystone: Corrects minor spelling mistakes https://review.openstack.org/102237 | 19:36 |
| *** praneshp has joined #openstack-keystone | 19:37 | |
| *** harlowja has joined #openstack-keystone | 19:37 | |
| *** bklei has quit IRC | 19:37 | |
| *** harlowja_ has joined #openstack-keystone | 19:39 | |
| *** harlowja has quit IRC | 19:42 | |
| bknudson | stevemar: now I'm getting "worlddump.py: error: argument -d/--dir: expected one argument" | 19:44 |
| bknudson | + git clone git://git.openstack.org/openstack/keystonemiddleware.git /opt/stack/keystonemiddleware master | 19:44 |
| bknudson | Too many arguments. | 19:44 |
| bknudson | morganfainberg_L: ^ | 19:44 |
| morganfainberg_L | *blink* | 19:45 |
| morganfainberg_L | wut? | 19:45 |
| stevemar | bknudson, i had to install oslo.db | 19:45 |
| morganfainberg_L | stevemar: old venv? | 19:46 |
| bknudson | stevemar: I've got oslo.db | 19:46 |
| bknudson | I probably cloned it myself | 19:46 |
| stevemar | morganfainberg, when i was using devstack | 19:46 |
| morganfainberg_L | stevemar: oh | 19:46 |
| topol | dolphm, morganfainberg, ayoung, I updated https://wiki.openstack.org/wiki/Keystone to cover all the code review and spec repos | 19:52 |
| *** kwss_ has quit IRC | 19:52 | |
| bknudson | http://docs.openstack.org/developer/keystonemiddleware/ :( | 19:53 |
| stevemar | bknudson, who needs those silly docs anyway! | 19:54 |
| morganfainberg_L | bknudson: might require a merge | 19:54 |
| morganfainberg_L | don't think we run a full test run when initialiing the repo | 19:54 |
| stevemar | dstanek, ping! | 19:54 |
| bknudson | http://git-scm.com/docs/git-clone -- as far as I can tell git clone is working as expected | 19:55 |
| morganfainberg_L | but i'm sure docs folks would know for sure. | 19:55 |
| bknudson | I think its -b <name> that should be used | 19:56 |
| morganfainberg_L | oh did I typo it? | 19:56 |
| bknudson | morganfainberg_L: I don't see how, it's used the same way everywhere | 19:57 |
| morganfainberg_L | ah i see the issue | 19:57 |
| morganfainberg_L | git_clone vs git clone | 19:57 |
| morganfainberg_L | *facepalm | 19:57 |
| bknudson | hehe | 19:57 |
| morganfainberg_L | bknudson: ok thatshould solve it | 19:58 |
| morganfainberg_L | patchset 2. | 19:58 |
| elmiko | i'm looking through some of the spec docs and i'm noticing that in some of the json requests the ids are truncated to 7 characters. is that just docs or is that an openstack thing? | 20:02 |
| morganfainberg_L | elmiko: mostly that is for ease of reading | 20:02 |
| elmiko | cool, thanks morganfainberg_L | 20:03 |
| morganfainberg_L | elmiko: if you included 32 or 64 characters it makes it hard to see, truncating to 7 shows the intent w/o making the line silly long :) | 20:03 |
| elmiko | yea, i just wanted to make sure | 20:03 |
| *** marcoemorais has quit IRC | 20:04 | |
| bknudson | morganfainberg_L: working now | 20:04 |
| morganfainberg_L | bknudson: yay! | 20:04 |
| *** marcoemorais has joined #openstack-keystone | 20:04 | |
| *** marcoemorais has quit IRC | 20:05 | |
| morganfainberg_L | added a couple of more bugs to middleware... you know silly things like update README | 20:05 |
| *** marcoemorais has joined #openstack-keystone | 20:05 | |
| morganfainberg_L | and uh.. test cases for ec2_token middleware :P | 20:05 |
| *** marcoemorais has quit IRC | 20:06 | |
| *** marcoemorais has joined #openstack-keystone | 20:06 | |
| Kr4zy | I am getting TypeError: setup_logging() takes no arguments (1 given) when using Apache2 WSGI to host Keystone Icehouse. Anyone experiencing this? | 20:14 |
| bknudson | paste.filter_factory = keystonemiddleware.auth_token:filter_factory | 20:15 |
| *** dstanek is now known as dstanek_zzz | 20:16 | |
| bknudson | Kr4zy: http://git.openstack.org/cgit/openstack/keystone/tree/httpd/keystone.py#n42 | 20:16 |
| hrybacki | dolphm: looking for some LHF to work on while pushing keystoneclient integration with other components with jamielennox|away / ayoung -- saw this bug https://bugs.launchpad.net/python-keystoneclient/+bug/1318436 you'd commented on -- from the comments I can't tell if it's useful to work on. Thoughts? | 20:16 |
| uvirtbot | Launchpad bug 1318436 in python-keystoneclient "Missing defaults in the create() method in the v2 EndpointManager" [Low,Triaged] | 20:16 |
| dolphm | hrybacki: first of all, what does LHF mean? | 20:17 |
| hrybacki | sorry, low hanging fruit | 20:17 |
| dolphm | hrybacki: ah | 20:18 |
| dolphm | hrybacki: urban dictionary was no help, as the first hit was for LHFS (learn how to fucking spell) lol | 20:18 |
| hrybacki | dolphm: haha, not what I was going for :P | 20:18 |
| dolphm | hrybacki: anyway, i tagged it user-experience which is super high priority for me, but as a bug I think it's technically Low impact | 20:19 |
| Kr4zy | bknudson: I am getting this ImportError: cannot import name backends after using the config from the link. | 20:19 |
| hrybacki | dolphm: think it's a good one for a novice like me to pick at while other stuff is held up? | 20:19 |
| dolphm | hrybacki: absolutely | 20:19 |
| hrybacki | dolphm++ I might have some questions for you later/tomorrow. Was there any other discussion about that bug aside from what is in the comments? Thanks! | 20:20 |
| bknudson | Kr4zy: what release are you on | 20:20 |
| bknudson | morganfainberg_L: I tried setting keystonemiddleware in nova api-paste.ini and it says module not found... | 20:20 |
| bknudson | maybe I need to put it in nova requirements | 20:21 |
| Kr4zy | bknudson: openstack-keystone-2014.1.1-1.el6.noarch. Fixed it using wsgi scripts from http://comments.gmane.org/gmane.comp.cloud.openstack.general/3669 | 20:22 |
| *** fifieldt_ has joined #openstack-keystone | 20:22 | |
| topol | I've reviewed everything there is in https://review.openstack.org/#/q/status:open+project:openstack/keystonemiddleware%20,n,z Im going home now :-) | 20:22 |
| bknudson | Kr4zy: weird | 20:24 |
| dolphm | hrybacki: i don't believe there was any other discussion. feel free to leave comments in the bug - that's probably the best way to reach me asynchronously :P | 20:24 |
| morganfainberg_L | topol: lol | 20:24 |
| *** nkinder has joined #openstack-keystone | 20:24 | |
| hrybacki | dolphm++ Thanks! | 20:25 |
| morganfainberg_L | dolphm: added some starter text to the middleware etherpad | 20:25 |
| morganfainberg_L | need to go get lunch though. | 20:25 |
| *** fifieldt has quit IRC | 20:25 | |
| *** radez is now known as radez_g0n3 | 20:26 | |
| openstackgerrit | A change was merged to openstack/keystone: the user_tenant_membership table was replaced by "assignment" https://review.openstack.org/102266 | 20:26 |
| bknudson | anyone have a tip how I could "install" the keystonemiddleware? | 20:27 |
| morganfainberg_L | bknudson: ? | 20:28 |
| morganfainberg_L | bknudson: pip -e ? | 20:28 |
| bknudson | I'll try it | 20:28 |
| morganfainberg_L | bknudson: should work. should also be installed by devstack if you use that patchset i posted | 20:28 |
| morganfainberg_L | _should_ | 20:28 |
| bknudson | morganfainberg_L: for some reason it wasn't | 20:29 |
| morganfainberg_L | hmm | 20:29 |
| bknudson | morganfainberg_L: I tried adding keystonemiddleware to nova's requirements.txt | 20:29 |
| morganfainberg_L | oh | 20:29 |
| bknudson | figured it would just say it's already installed, but it wasn't | 20:29 |
| morganfainberg_L | hmmm | 20:29 |
| dolphm | bknudson: well it's not on pypi, so requirements.txt won't cause it to be installed, only cause it to fail | 20:30 |
| morganfainberg_L | bknudson: i might have the install below where nova installs. | 20:30 |
| morganfainberg_L | so it would (in that case) fail | 20:30 |
| dolphm | bknudson: (or say it's installed if you did pip -e or setup.py develop) | 20:30 |
| *** marcoemorais has quit IRC | 20:30 | |
| stevemar | dolphm, bknudson morganfainberg what do y'all think of this flow for multiple keystones? | 20:30 |
| stevemar | https://gist.github.com/stevemart/9ed830dd65b6db6bd0d7 | 20:30 |
| *** marcoemorais has joined #openstack-keystone | 20:31 | |
| bknudson | I did pip install -e in keystonemiddleware and now it looks like it's working | 20:31 |
| *** marcoemorais has quit IRC | 20:31 | |
| *** marcoemorais has joined #openstack-keystone | 20:32 | |
| bknudson | -e git://git.openstack.org/openstack/keystonemiddleware.git@14d58e849a5ced3f797d43eea260ae62b6194517#egg=keystonemiddleware-master | 20:32 |
| dolphm | stevemar: why do you need a new auth method at cern? | 20:32 |
| bknudson | does keystonemiddleware need __version__ = pbr.version.VersionInfo('python-keystoneclient').version_string() | 20:33 |
| dolphm | stevemar: specifically, the new service provider scope shouldn't impact my authentication method | 20:33 |
| morganfainberg_L | bknudson: hmm. it might? | 20:34 |
| dolphm | bknudson: pbr.version.VersionInfo('keystonemiddleware').version_string() ? | 20:34 |
| bknudson | dolphm: y, keystoneclient has one | 20:34 |
| bknudson | in __init__ | 20:34 |
| morganfainberg_L | probably | 20:34 |
| dolphm | bknudson: but 'python-keystoneclient' or 'keystonemiddleware'? | 20:34 |
| stevemar | dolphm, i was doing this more for correctness | 20:35 |
| morganfainberg_L | dolphm: keystonemiddleware would be my guess | 20:35 |
| bknudson | dolphm: I assume it would change to keystonemiddleware. | 20:35 |
| bknudson | or is that only needed if you're an API? | 20:36 |
| bknudson | keystone doesn't have it | 20:36 |
| * morganfainberg_L isn't sure | 20:36 | |
| bknudson | and keystone seems to work | 20:37 |
| dolphm | bknudson: oh weird... maybe because of named releases? | 20:37 |
| morganfainberg_L | middleware wont be 'named' releases. so it probably needs it then | 20:37 |
| bknudson | btw, nova started up with keystonemiddleware.auth_token now that it's installed | 20:37 |
| dolphm | bknudson: fwiw, keystone specifies it's version in setup.cfg (version = 2014.2 in master, readying for juno) | 20:38 |
| dolphm | bknudson: i don't know what pbr does with that though | 20:38 |
| morganfainberg_L | maybe setup.cfg is sufficient? | 20:41 |
| morganfainberg_L | this might be something weneed to as mordred | 20:41 |
| morganfainberg_L | or other -infra folks | 20:42 |
| bknudson | global requirements: https://review.openstack.org/#/c/102341/ | 20:44 |
| morganfainberg_L | don't think that will work till we release | 20:44 |
| morganfainberg_L | ooh whoopse | 20:45 |
| morganfainberg_L | https://git.openstack.org/cgit/openstack/keystonemiddleware/tree/setup.cfg#n50 that needs to get fixed | 20:46 |
| *** marekd|away is now known as marekd | 20:46 | |
| bknudson | I wonder how that even works... apps will have to install the translation domain | 20:47 |
| bknudson | maybe auth_token middleware has to do that on startup | 20:47 |
| morganfainberg_L | bknudson: i don't think it works at all in ksc | 20:47 |
| morganfainberg_L | we don't translate | 20:47 |
| morganfainberg_L | maybe we should? | 20:47 |
| morganfainberg_L | *shrug* | 20:47 |
| marekd | stevemar: regarding the flow: i was thinking something similar, due to some technical contstraints...but I indeed would keep CERN-auth step as we have not - token, password, external etc. maybe some indication, like flag may be required so the cern keystone returns 'extended' service catalog. | 20:47 |
| bknudson | oh, we don't have any _() in auth_token middleware? | 20:48 |
| morganfainberg_L | nope | 20:48 |
| morganfainberg_L | no where in ksc | 20:48 |
| openstackgerrit | Justin Shepherd proposed a change to openstack/keystone: Adding an index on token.user_id https://review.openstack.org/102041 | 20:48 |
| bknudson | change to nova: https://review.openstack.org/#/c/102342/ | 20:48 |
| morganfainberg_L | cool! | 20:49 |
| bknudson | we essentially do that for each of the projects. | 20:49 |
| morganfainberg_L | add to devstack gate https://review.openstack.org/#/c/102340/ | 20:49 |
| morganfainberg_L | that is needed before we can add to devstack | 20:49 |
| morganfainberg_L | i think | 20:49 |
| *** dstanek_zzz is now known as dstanek | 20:49 | |
| marekd | stevemar: my idea was: local keystone should only receive assertion or assertion-like object, do the mapping and depending on the mapping decide who and what can do on that cloud. | 20:50 |
| marekd | in other words RAX guys still can decide what cern guys can do. | 20:50 |
| marekd | cern's keystone cannot dictate roles, projects... | 20:50 |
| *** Kr4zy has quit IRC | 20:56 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Regenerate sample config file https://review.openstack.org/102294 | 20:58 |
| *** wchrisj has joined #openstack-keystone | 20:58 | |
| *** topol has quit IRC | 20:59 | |
| dstanek | morganfainberg_L: you're right _redact is very strange here https://review.openstack.org/#/c/101792/3/keystoneclient/auth/identity/v2.py | 21:00 |
| *** hrybacki has quit IRC | 21:00 | |
| morganfainberg_L | dstanek: i really had to think about it to get what it was trying to do | 21:00 |
| morganfainberg_L | wasn't sure if that was brain no-worky (needed caffiene) or just not straight forward | 21:01 |
| dstanek | i don't like how the thing to redact is the first item in path | 21:01 |
| dstanek | morganfainberg_L: and by first i mean last :-) | 21:02 |
| *** bvandenh has quit IRC | 21:06 | |
| *** navid has joined #openstack-keystone | 21:12 | |
| *** dims__ has joined #openstack-keystone | 21:13 | |
| wchrisj | Could someone tell me if the /auth/tokens call against a Keystone endpoint (devstack) should actually return a response that includes a token, if I pass in ONLY username+password? | 21:15 |
| wchrisj | I'm not seeing a token | 21:15 |
| *** hrybacki has joined #openstack-keystone | 21:15 | |
| navid | I am looking to how find the associated federated users with an idp, so when we delete an idp i know which user's token whould be revoked. | 21:16 |
| wchrisj | the corresponding call against the v2 API returns an unscoped token; I would expect to see similar behavior from the v3 API. | 21:16 |
| *** dims_ has quit IRC | 21:16 | |
| *** ChanServ sets mode: +o morganfainberg | 21:16 | |
| wchrisj | morganfainberg_L - do you know? | 21:16 |
| morganfainberg | wchrisj, hrm? | 21:17 |
| navid | Anybody ? | 21:18 |
| navid | knows how to find the list of federated users associated with an idp | 21:18 |
| wchrisj | morganfainberg_L - I woud expect to get a token back from the /auth/tokens call against the v3 API | 21:19 |
| wchrisj | see above | 21:19 |
| dolphm | navid: marekd and stevemar can probably provider better answers, but the answer today is that you have to look per token, and token revocation *events* could match the idp+protocol specified in the token | 21:20 |
| morganfainberg | wchrisj iirc the body should have the token data in it (obviously assuming the correct JSON body in the request), and the X-SUBJECT-TOKEN header should contain the token id | 21:20 |
| marekd | dolphm: i was thinking about matching Identity-Provider from unscoped token with *event* like 'IdP was removed'... | 21:20 |
| marekd | dolphm: yet i don't know exactly how revocation events work and how those events are defined. | 21:21 |
| wchrisj | morganfainberg_L - weird - that's EXACTLY right. Didnt know to look in the headers... any idea why return it in the header rather than the body as in v2? | 21:21 |
| dolphm | marekd: you'd have a revocation event that looked something like {"idp_id": "abc123"} and that's pretty much it | 21:22 |
| dolphm | marekd: auth_token would then reject any tokens coming from that idp | 21:22 |
| morganfainberg | wchrisj, design choice. | 21:22 |
| morganfainberg | wchrisj i don't know all the details of why that was chosed, predates my work on keystone | 21:22 |
| dolphm | marekd: there's also a timestamp involved, though | 21:22 |
| morganfainberg | well predates my heavy involvement | 21:22 |
| wchrisj | morganfainberg_L: ok, thanks! | 21:23 |
| *** amcrn has quit IRC | 21:23 | |
| bknudson | glance change for keystonemiddleware: https://review.openstack.org/#/c/102352/ | 21:23 |
| marekd | dolphm: so i guess that's it - keystoneclient will get that revocation event and match idp_id with OS-FEDERATION['Identity-Provider'] value from the tokens.. | 21:23 |
| marekd | dolphm: it's keystoneclient that should do the work, right? | 21:24 |
| navid | so it should check the tokens and revoke the ones that has the deleted idp @@dolph | 21:24 |
| navid | marekd: Can i ask what do you mean by keystoneclient? | 21:26 |
| morganfainberg_L | dolphm, stevemar, bknudson, topol, dstanek, https://etherpad.openstack.org/p/dev_keystonemiddleware_anouncement obviously needs some more work, input welcome | 21:26 |
| marekd | dolphm: morganfainberg_L: it's keystoneclient that fetches revocation events and invalidates tokens, right? | 21:27 |
| stevemar | marekd, good to know that the CERN auth should stay the same, but there should be an indicator to return 'extended' service catalog, like you said | 21:28 |
| dolphm | marekd: yes, in auth_token (cc- ayoung) | 21:28 |
| marekd | dolphm: thanks! | 21:28 |
| morganfainberg_L | marekd: yes that is the idea | 21:28 |
| bknudson | morganfainberg_L: the announcement looks good to me | 21:28 |
| dolphm | navid: https://github.com/openstack/python-keystoneclient | 21:29 |
| marekd | dolphm: ++ | 21:29 |
| stevemar | marekd, the 'extended' service catalog is normal catalog + whatever we add to service provider? | 21:29 |
| marekd | stevemar: i have some issues with that.... | 21:29 |
| morganfainberg_L | bknudson: ok needs a little work on the impact list for sure. let me see about that | 21:29 |
| navid | @dolphm: thanks | 21:30 |
| marekd | stevemar: i think morganfainberg_L can also have some, since the service catalog can grow easily...think about 'k2k' federation consisting of 10 clouds... | 21:30 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Initial implementation of validator https://review.openstack.org/86483 | 21:30 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Catalog V3 resources https://review.openstack.org/96266 | 21:30 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 resources https://review.openstack.org/86484 | 21:30 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Credential V3 https://review.openstack.org/98522 | 21:30 |
| marekd | stevemar: what do you think about service catalog with all endpoints from all 10 clouds? | 21:30 |
| marekd | stevemar: it will not help to keep pki tokens small :-) | 21:30 |
| stevemar | marekd, i think taht would suck, but i'm having trouble getting an alternative | 21:31 |
| marekd | stevemar: list of federated keystones... | 21:31 |
| marekd | stevemar: still grows, but slightly slower. | 21:31 |
| bknudson | we could put sizelimit middleware in middleware | 21:31 |
| bknudson | or oslo | 21:31 |
| bknudson | cinder.api.middleware.sizelimit:RequestBodySizeLimiter.factory has the same | 21:32 |
| *** jaosorior has quit IRC | 21:32 | |
| marekd | stevemar: but then we don't have that 'transparency', where client is not aware of anything and simply sends request to external nova-api asking for new VM. | 21:32 |
| marekd | because there is no external nova-api in the SC. | 21:32 |
| marekd | client would need to send request to external keystone, asking for new token. and this is *exactly not* what Joe wants... | 21:33 |
| marekd | :) | 21:33 |
| *** marcoemorais has quit IRC | 21:33 | |
| *** amerine has joined #openstack-keystone | 21:34 | |
| *** marcoemorais has joined #openstack-keystone | 21:34 | |
| marekd | hm, maybe we should propose a topic for next keystone meeting ;/ | 21:34 |
| morganfainberg_L | Ok updated the impact section, feel free to markup, muck around with / fix typos, in that draft email | 21:35 |
| morganfainberg_L | i'd like to send it out today if everyone likes it | 21:35 |
| stevemar | marekd, if we have a flag in the auth request, we can have multiple values ... 'regular service catalog, include all external endpoints in SC, or include all federated keystones' | 21:35 |
| *** harlowja_ has quit IRC | 21:36 | |
| marekd | stevemar: good point, but then we will need to implement all the workflows. | 21:36 |
| *** harlowja has joined #openstack-keystone | 21:36 | |
| *** amcrn has joined #openstack-keystone | 21:36 | |
| marekd | stevemar: more - design, implement and bugfix them. | 21:36 |
| jsavak | i like token scoped to local endpoints + federated-keystones... | 21:36 |
| marekd | stevemar: and they all lead us to the same result. | 21:36 |
| marekd | jsavak: Hey Joe! | 21:37 |
| jsavak | and i have to hit federated keystones to get what endpoints i can access there... | 21:37 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Credential V3 https://review.openstack.org/98522 | 21:37 |
| jsavak | hi! : ) | 21:37 |
| marekd | jsavak: but I think this will have some impact on the client. | 21:37 |
| marekd | keystoneclient. | 21:37 |
| jsavak | as long as the local keystone can scope the token appropriately and that is understood by the federated ones | 21:37 |
| jsavak | yes - but the client change is smaller. | 21:37 |
| *** hrybacki has quit IRC | 21:38 | |
| marekd | jsavak: scope to project/domain? | 21:38 |
| stevemar | yeah, should be small change | 21:38 |
| bknudson | we really do need to do something about the size of the token | 21:38 |
| bknudson | PKI is essentially broken on large clouds | 21:38 |
| jsavak | yes, scope to product/domain and potentially role | 21:38 |
| dstanek | bknudson: take the catalog out of it | 21:39 |
| marekd | jsavak: i saw you had some ideas with namespaces etc. I must confess i don't see the big picture how you want to make it work. | 21:39 |
| marekd | jsavak: but... | 21:39 |
| bknudson | dstanek: I think that's the answer too | 21:39 |
| marekd | jsavak: remote keystone would need to validate if the token can be scoped either way. do you agree? | 21:39 |
| dstanek | bknudson: i've always thought that having it in there is a mistake - it's just an optimization that makes other things worse | 21:40 |
| stevemar | bknudson, we already have an option to remove the catalog | 21:40 |
| jsavak | yes - there's like a dual validation... | 21:40 |
| marekd | stevemar: how? | 21:40 |
| jsavak | 1 from the remote keystone to the issuing keystone to verify that the token was issued and is still valid | 21:40 |
| bknudson | there's a ?nocatalog on auth | 21:40 |
| stevemar | Catalog Opt-Out: 'POST /v3/auth/tokens?nocatalog' | 21:40 |
| dstanek | marekd, stevemar, jsavak: how will the remote keystone validate the local keystone's token? a new keystone federation plugin like SAML? | 21:40 |
| jsavak | 2 in the remote keystone itself to veirfy role/project/domain exists as indicated | 21:40 |
| bknudson | but then the client still needs to get a catalog somehow | 21:40 |
| *** hrybacki has joined #openstack-keystone | 21:40 | |
| morganfainberg | dstanek, bknudson ++ yes, the catalog shouldn't be in the token, if we want to enforce what endpoints you can talk to based upon what is in the token, we should be using ids not the whole url (besides the endpoint doesn't know the url anyway) | 21:40 |
| marekd | dstanek: hah, good question. | 21:41 |
| jsavak | dstanek - yes | 21:41 |
| morganfainberg | ii was thinking the catalog should be provided separate from the token data in either case. | 21:41 |
| bknudson | dstanek: keystone uses auth_token middleware | 21:41 |
| marekd | jsavak: but, again...saml by design wants the client to weigh in. | 21:41 |
| bknudson | auth_token would have to be smarter about which keystone to talk to | 21:42 |
| marekd | jsavak: we can somehow 'change' the workflow, but it may bring us some problems. | 21:42 |
| jsavak | sure and the "client will be the remote keystone in this case | 21:42 |
| jsavak | performing the federation flow with the issuing keystone | 21:42 |
| marekd | jsavak: which basicaly means 'keystone impersonates me, Marek Denis'. | 21:42 |
| jsavak | yes - ish! | 21:42 |
| bknudson | morganfainberg: it also bloats the token table. I'm not sure if it would be an API to get the catalog for the token or maybe it would be a catalog ID in the token that could be fetched. | 21:43 |
| jsavak | i "joe" authorize local keystone to act on my behalf to assert my identity to remote-keystone | 21:43 |
| dstanek | jsavak: and then remote keystone gives local keystone a token that it gives back to the user? | 21:44 |
| *** hrybacki has quit IRC | 21:44 | |
| marekd | i'd rather say: I 'marek' authorize remote keystone to login as me, 'marek' and get an assertion. | 21:44 |
| morganfainberg_L | bknudson: x-catalog header? | 21:44 |
| marekd | that's the bigger problem. | 21:44 |
| jsavak | yes - with local keysotne senidng a federation assertion | 21:44 |
| marekd | jsavak: ++ | 21:44 |
| jsavak | marek- cern would not want rackspace to login as you and get an assertion... | 21:45 |
| bknudson | morganfainberg_L: that seems ok, closer to how it's done today | 21:45 |
| jsavak | but you would authorize your cern keystone to act on your behalf and assert your identity to rackspace | 21:45 |
| *** hrybacki has joined #openstack-keystone | 21:45 | |
| morganfainberg_L | this comes back to the token version stuff, we probably need a v4 token that specifies catalog isn't in the token itself | 21:46 |
| marekd | jsavak: wait...it's rax keystone that wants, by using *my* token, get a saml assertion. | 21:46 |
| jsavak | yes - but cern keystone must trust rackspace as a service provider to permit that assertion to be sent | 21:46 |
| marekd | jsavak: yes yes. | 21:48 |
| dstanek | jsavak: is there an example in the spec of this interaction? | 21:49 |
| jsavak | dstanek - yes - it's use case 1 - | 21:49 |
| jsavak | still lots to discuss - but i need to go rescue my kddo from daycare.. :) | 21:49 |
| stevemar | i gotta head out, but i'll leave my machine on, feel free to chat, i'm going to update the spec tonight | 21:49 |
| jsavak | stevemar - thanks for being on top of that. : ) | 21:50 |
| stevemar | jsavak, np, get to rescuing | 21:50 |
| marekd | jsavak: stevemar i think we should all bring in on the table during next keystone meeting. | 21:50 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Update setup.cfg to remove keystoneclient ref https://review.openstack.org/102360 | 21:50 |
| stevemar | marekd, bah, i don't want to wait a week | 21:50 |
| marekd | stevemar: sure, let's organise something this week! | 21:50 |
| stevemar | i'd rather floor -keystone all week | 21:50 |
| stevemar | flood* | 21:50 |
| stevemar | the spec is there, add comments there! | 21:51 |
| stevemar | :D | 21:51 |
| marekd | stevemar: :D | 21:51 |
| marekd | ya know it doesn't work that way :P | 21:51 |
| stevemar | it should! | 21:51 |
| morganfainberg | now lets see what actually breaks tryin to run tests in gate/ci with middleware | 21:51 |
| stevemar | marekd, bbl | 21:51 |
| dstanek | stevemar: the hard thing about the spec process is that it would be much easier with diagrams or whiteboarding | 21:51 |
| marekd | dstanek: or if we all worked in one openspace ;/ | 21:52 |
| stevemar | dstanek, then we put the flow into words or something, that really helped me out | 21:52 |
| marekd | dstanek: btw, you did a great job reviewing SAML2 auth plugins. Waiting for more. | 21:53 |
| marekd | :-) | 21:53 |
| dstanek | stevemar: words are good, but often imprecise and hard to get a good overview | 21:53 |
| dstanek | marekd: flattery will get you nowhere :-) | 21:53 |
| marekd | dstanek: beer, than? :-) | 21:53 |
| marekd | then* | 21:54 |
| dstanek | marekd: yes. beer always works | 21:54 |
| *** hrybacki_ has joined #openstack-keystone | 21:54 | |
| *** hrybacki has quit IRC | 21:55 | |
| *** amcrn has quit IRC | 21:58 | |
| *** amcrn_ has joined #openstack-keystone | 21:58 | |
| elmiko | hey folks, still doing some exploration with trusts and i've got to a jam | 21:59 |
| elmiko | i created a trust between user A in project A and user B in project B | 22:00 |
| marekd | dstanek: btw, did you have a change to take a look at this spec: https://review.openstack.org/#/c/96867/ ? | 22:00 |
| marekd | chance& | 22:00 |
| marekd | * | 22:00 |
| elmiko | and i've consumed the trust by user B | 22:00 |
| elmiko | now, how do i get a token based on the trust in project A? | 22:00 |
| elmiko | trustor=A, trustee=B | 22:00 |
| bknudson | I proposed changes to a bunch of the projects for the switch from keystoneclient.middleware to keystonemiddleware -- https://review.openstack.org/#/q/status:open+topic:keystonemiddleware,n,z | 22:00 |
| marekd | dolphm: still here, btw | 22:02 |
| marekd | ? | 22:02 |
| *** jsavak has quit IRC | 22:03 | |
| *** marekd is now known as marekd|away | 22:15 | |
| *** bknudson has quit IRC | 22:18 | |
| *** elmiko is now known as _elmiko | 22:24 | |
| morganfainberg_L | dolphm, stevemar, topol, dstanek, gyee, anteaya, lbragstad, any final thoughts on draft email before i send to -dev? https://etherpad.openstack.org/p/dev_keystonemiddleware_anouncement | 22:25 |
| gyee | morganfainberg_L, are we providing migration path similar to how we move the ec2 and s3 middleware from keystone to keystoneclient? | 22:29 |
| morganfainberg_L | gyee: the migration is "use the new package" we're not removing the old code, just not providing new development (security fixes only) for the transition | 22:30 |
| morganfainberg_L | gyee: for the middleware sourced frmo keystone (ec2_token) keystone will just import the new package once it's released for transition | 22:30 |
| gyee | I remember we did some import magic | 22:30 |
| morganfainberg_L | we can't for auth_token due to circular dependencies | 22:31 |
| morganfainberg_L | auth_Token relies on code in keystoneclient | 22:31 |
| gyee | ouch! | 22:31 |
| *** daneyon has joined #openstack-keystone | 22:31 | |
| morganfainberg_L | yeah, best option was to freeze the middleware in keystoneclient and deprecate it once the new package is released | 22:31 |
| morganfainberg_L | but no removal of code until down the line | 22:31 |
| gyee | k, should be fine then | 22:32 |
| morganfainberg_L | yep | 22:32 |
| * morganfainberg_L has macbook pro back. | 22:32 | |
| morganfainberg_L | yay! | 22:32 |
| gyee | hopefully we get some formal endorsement | 22:33 |
| gyee | don't want to imagine we have to undeprecate later | 22:33 |
| morganfainberg_L | nahwe wont have to | 22:33 |
| morganfainberg_L | we're not removing the code or breaking anyone | 22:33 |
| *** dstanek is now known as dstanek_zzz | 22:36 | |
| *** dstanek_zzz is now known as dstanek | 22:38 | |
| dstanek | morganfainberg_L: looking | 22:39 |
| morganfainberg | dstanek, feel free to make chnges | 22:43 |
| *** daneyon has quit IRC | 22:43 | |
| morganfainberg | don't need to just put in parens :) | 22:44 |
| *** boris-42 has quit IRC | 22:46 | |
| *** wchrisj has quit IRC | 22:46 | |
| dstanek | morganfainberg: keystoneclient when talking about the Python package and Keystoneclient when talking about the project right? | 22:52 |
| morganfainberg | uh | 22:52 |
| morganfainberg | sure? | 22:52 |
| morganfainberg | :P | 22:52 |
| morganfainberg | probably python-keystoneclient when talking about the package | 22:52 |
| dstanek | k, there are a few places where i'll make that change then | 22:53 |
| morganfainberg | and Keystoneclient when the project | 22:53 |
| morganfainberg | sure | 22:53 |
| *** marcoemorais has quit IRC | 22:53 | |
| *** marcoemorais has joined #openstack-keystone | 22:53 | |
| *** marcoemorais has quit IRC | 22:54 | |
| *** marcoemorais has joined #openstack-keystone | 22:54 | |
| *** marcoemorais1 has joined #openstack-keystone | 22:55 | |
| morganfainberg | woohoo py33 passed | 22:55 |
| morganfainberg | >.> | 22:55 |
| *** marcoemorais2 has joined #openstack-keystone | 22:56 | |
| *** marcoemorais2 has quit IRC | 22:56 | |
| dstanek | morganfainberg: passed? | 22:56 |
| *** marcoemorais2 has joined #openstack-keystone | 22:56 | |
| morganfainberg | i hadn't tested the middleware with py33 until the patch i put up | 22:57 |
| morganfainberg | the whole middleware package that is | 22:57 |
| *** marcoemorais has quit IRC | 22:59 | |
| morganfainberg | dstanek, let me know when you're done | 22:59 |
| *** marcoemorais1 has quit IRC | 22:59 | |
| *** gordc has quit IRC | 23:00 | |
| *** lbragstad has quit IRC | 23:01 | |
| *** boris-42 has joined #openstack-keystone | 23:02 | |
| dstanek | morganfainberg: i'm all done | 23:17 |
| dstanek | morganfainberg: looks good | 23:18 |
| gyee | dstanek, how do I make tox recognize python3? | 23:18 |
| gyee | ERROR: py33: InterpreterNotFound: python3.3 | 23:18 |
| gyee | I have python3 installed but tox can't see it for some reason | 23:18 |
| morganfainberg_L | gyee: not sure | 23:19 |
| morganfainberg_L | gyee: i had it working at one point, haven't re-set thatup yet | 23:20 |
| gyee | morganfainberg_L, you don't run into that error | 23:20 |
| morganfainberg_L | gyee: i did, don't remember how i fixed it | 23:20 |
| morganfainberg_L | i also was running in a VM | 23:20 |
| gyee | lemme muck around with tox.ini to see what's up | 23:21 |
| morganfainberg_L | dstanek: ok .. about to click send | 23:22 |
| dstanek | gyee: is python3 on your path? | 23:22 |
| gyee | dstanek, yes | 23:23 |
| morganfainberg_L | dstanek: subject:[Keystone] Announcing Keystone Middleware Project | 23:24 |
| morganfainberg_L | dstanek: look good? | 23:24 |
| gyee | k, I think this is my problem | 23:24 |
| dstanek | morganfainberg_L: lgtm | 23:24 |
| gyee | ls -al `which python3` | 23:24 |
| gyee | lrwxrwxrwx 1 root root 9 Mar 23 01:17 /usr/bin/python3 -> python3.4 | 23:24 |
| morganfainberg_L | clicking send! | 23:24 |
| gyee | its pointing to python3.4 instead of python3.3 | 23:24 |
| dstanek | gyee: i think you need to have python3.3 on your path | 23:24 |
| dstanek | point it to 3.4 and you should be all good | 23:25 |
| gyee | 3.3 ou mean | 23:25 |
| gyee | its currently pointing to 3.4 | 23:25 |
| dstanek | i think you can just create a python3.3 link that points to python3.4 | 23:25 |
| dstanek | gyee: i think tox just translates py33 to python3.3 | 23:26 |
| morganfainberg_L | dstanek: bah found a typo | 23:26 |
| morganfainberg_L | "Global requirements update <...> will be updated | 23:26 |
| dstanek | morganfainberg_L: lol, that always happens | 23:26 |
| morganfainberg_L | *facepalm* | 23:26 |
| morganfainberg_L | sooo close | 23:27 |
| gyee | dstanek, k, symlink does the trick, but failed to install httpretty package | 23:34 |
| gyee | seem like there are packages that are not python3 compatible | 23:34 |
| dstanek | gyee: yes, lots | 23:36 |
| dstanek | gyee: what are you trying to do? | 23:36 |
| *** daneyon has joined #openstack-keystone | 23:36 | |
| gyee | dstanek, just trying to get rid the unpleasant warnings | 23:36 |
| gyee | oh well | 23:36 |
| dstanek | gyee: :-) i'm pretty close to having something that can run under python3 and be useful | 23:37 |
| dstanek | i have a few reviews for it in gerrit and a couple more locally once those get through | 23:38 |
| gyee | dstanek, excellent! love to have py33 working locally so I can weed out any py33 issues before pushing the stuff to gerrit | 23:40 |
| dstanek | gyee: the biggest problem is that we have a ton of dependency projects that are not py3 friendly yet | 23:41 |
| *** david-lyle has quit IRC | 23:41 | |
| *** david-lyle has joined #openstack-keystone | 23:42 | |
| *** lbragstad has joined #openstack-keystone | 23:43 | |
| *** oomichi has joined #openstack-keystone | 23:45 | |
| *** marcoemorais2 has quit IRC | 23:45 | |
| *** marcoemorais has joined #openstack-keystone | 23:45 | |
| *** marcoemorais has quit IRC | 23:46 | |
| *** marcoemorais has joined #openstack-keystone | 23:46 | |
| *** david-lyle has quit IRC | 23:46 | |
| *** gokrokve has quit IRC | 23:47 | |
| *** jamielennox|away is now known as jamielennox | 23:47 | |
| *** marcoemorais has quit IRC | 23:52 | |
| *** marcoemorais has joined #openstack-keystone | 23:52 | |
| dstanek | gyee: this block is what does the magic https://bitbucket.org/hpk42/tox/src/cefc0fd28dda72ac76a9170b4c586e0eb3f1d124/tox/_config.py?at=default#cl-18 | 23:53 |
| dstanek | do we have a standard way to show params that will be modified by reference in do ccomments? | 23:57 |
| *** harlowja_ has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!