| jamielennox | oh yea! stuff is moving! | 00:00 |
|---|---|---|
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: HEAD responses should return same status as GET https://review.openstack.org/104026 | 00:01 |
| morganfainberg | dolphm, ^ first pass | 00:02 |
| morganfainberg | dolphm, i'll write up a nice ML thread once i see how broken things are. | 00:02 |
| *** david-lyle has quit IRC | 00:05 | |
| *** david-lyle has joined #openstack-keystone | 00:06 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Privatize Everything https://review.openstack.org/104027 | 00:07 |
| jamielennox | morganfainberg, dolphm: ^^ | 00:07 |
| morganfainberg | jamielennox, wow thats a lot of change :P | 00:07 |
| jamielennox | morganfainberg: yea, it gets everywhere | 00:08 |
| jamielennox | if you want me to submit seperate patches that take one thing at a time let me know | 00:08 |
| morganfainberg | not sure if uh that is warranted | 00:08 |
| morganfainberg | but we should prob do the same to the other middlewares | 00:08 |
| morganfainberg | =/ | 00:08 |
| jamielennox | the others should be easier at least | 00:08 |
| morganfainberg | yeah i'll propose the same for s3 | 00:09 |
| jamielennox | memache_crypt is a middleware? | 00:09 |
| morganfainberg | it's only used by middleware | 00:09 |
| morganfainberg | so it probably should be moved to keystonemiddleware.common ? | 00:09 |
| jamielennox | is common private? | 00:10 |
| morganfainberg | shouldn't be | 00:10 |
| morganfainberg | this is something we could keep public | 00:10 |
| jamielennox | can we make a folder called keystonemiddleware._middleware | 00:10 |
| jamielennox | morganfainberg: i dislike that 'could' so much at the moment | 00:10 |
| morganfainberg | why? | 00:10 |
| *** david-lyle has quit IRC | 00:10 | |
| jamielennox | if you don't know a reason for it make it private | 00:10 |
| morganfainberg | i could see other middleware wanting to use it? | 00:11 |
| morganfainberg | shrug | 00:11 |
| morganfainberg | your call | 00:11 |
| morganfainberg | but we could just make it _memcache_crypt and | 00:11 |
| morganfainberg | not export it in __init__ | 00:11 |
| morganfainberg | which we should do the proper __ALL__ in __init__.py | 00:11 |
| jamielennox | other middleware in keystonemiddleware could use it, just not external | 00:11 |
| jamielennox | yea, we should do an __all__ but i don't remember if that's what we decided made things public | 00:11 |
| morganfainberg | sure | 00:12 |
| morganfainberg | it does | 00:12 |
| morganfainberg | if someone does from X import * | 00:12 |
| jamielennox | sorry, if the exclusion from __all__ made it private | 00:12 |
| *** gokrokve has quit IRC | 00:24 | |
| *** dims__ has quit IRC | 00:25 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Privatize Everything https://review.openstack.org/104037 | 00:28 |
| morganfainberg | jamielennox, ^ | 00:28 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Privatize Everything https://review.openstack.org/104037 | 00:29 |
| jamielennox | morganfainberg: heh, https://review.openstack.org/#/c/104037/1/examples/pki/gen_cmsz.py | 00:29 |
| morganfainberg | jamielennox, yeah | 00:29 |
| morganfainberg | search/replace fail | 00:29 |
| morganfainberg | anyway | 00:31 |
| jamielennox | morganfainberg: looks good to me | 00:31 |
| morganfainberg | auth_token is a big change i'll need a bit of time to go over it | 00:31 |
| morganfainberg | the others are relatively small | 00:31 |
| jamielennox | yea, that one was easy | 00:31 |
| morganfainberg | wow we have ... i think a fairly sizable gap in tempest coverage. | 00:33 |
| morganfainberg | looking at https://review.openstack.org/#/c/104026/ i'm seeing a lot of tempest pass evne though i changed a number of HTTP response codes | 00:34 |
| morganfainberg | if the only failure is the 3 failures i'm expecting to see. ... i'm going to be worried we need to get to the grindstone and get some more (a lot more) tempest | 00:35 |
| jamielennox | morganfainberg: it'd be good if there was a tempest framework for tests, things so that we could write unit tests and tempest would see them and execute them against a real server later | 00:37 |
| morganfainberg | jamielennox, that would be hard. | 00:38 |
| *** daneyon has quit IRC | 00:39 | |
| jamielennox | yea | 00:39 |
| *** daneyon has joined #openstack-keystone | 00:39 | |
| *** daneyon has quit IRC | 00:39 | |
| jamielennox | git branch | wc -l | 00:40 |
| jamielennox | 86 | 00:41 |
| jamielennox | :( | 00:41 |
| morganfainberg | heh | 00:42 |
| *** dims__ has joined #openstack-keystone | 00:43 | |
| morganfainberg | jamielennox, i wonder if we should be translating the middleware now that it's separate | 00:44 |
| jamielennox | morganfainberg: how does that work if it's in the pipeline for a server? | 00:45 |
| morganfainberg | dunno | 00:45 |
| morganfainberg | thats why i'm wondering | 00:45 |
| *** achampion has joined #openstack-keystone | 00:45 | |
| morganfainberg | the HTTP response change patch, fails the same way as apache fails now *good thing* | 00:46 |
| morganfainberg | but only the same three errors | 00:46 |
| morganfainberg | which makes me very worried what we're not testing | 00:46 |
| jamielennox | i didn't see the original problem there | 00:46 |
| morganfainberg | GET and HEAD are supposed to return the exact same thing | 00:47 |
| morganfainberg | just HEAD without the body | 00:47 |
| jamielennox | yea | 00:47 |
| jamielennox | what was offending? | 00:47 |
| morganfainberg | including status, headers (content-type, and content-length) | 00:47 |
| morganfainberg | jamielennox, check_user_in_trust | 00:47 |
| morganfainberg | and 'check_token' | 00:47 |
| morganfainberg | and one of the project endpoint assoc calls | 00:48 |
| morganfainberg | project endpoint filter assoc | 00:48 |
| morganfainberg | or ehceck role in trust | 00:48 |
| morganfainberg | one of those | 00:48 |
| jamielennox | they were different or there was no GET registered? | 00:48 |
| jamielennox | i didn't know you could call GET for check_token | 00:48 |
| morganfainberg | the trust and project filter ones were no GET registered | 00:48 |
| morganfainberg | the trust one returned 204 instead of 200 (head had a different code path) | 00:49 |
| morganfainberg | same w/ token | 00:49 |
| morganfainberg | check token is meant to be "is token valid, we don't care about the data" | 00:49 |
| morganfainberg | HEAD = check token | 00:49 |
| morganfainberg | GET = validate (check and return data) | 00:49 |
| morganfainberg | also wsgi.render_response would merrly send body data out on a HEAD request. | 00:50 |
| morganfainberg | so fixed that as well | 00:50 |
| *** dstanek is now known as dstanek_zzz | 00:50 | |
| *** diegows has quit IRC | 00:51 | |
| jamielennox | yea, there are a lot of problems with our wsgi path | 00:51 |
| jamielennox | i would like to get time to look at the pecan thing again, but not sure when that will happen | 00:52 |
| *** xianghui has joined #openstack-keystone | 00:58 | |
| *** mitz_ has joined #openstack-keystone | 01:11 | |
| morganfainberg | jamielennox, bknudson, dolphm, http://lists.openstack.org/pipermail/openstack-dev/2014-July/039132.html | 01:14 |
| morganfainberg | gyee, dstanek_zzz, ^ | 01:14 |
| *** dstanek_zzz is now known as dstanek | 01:17 | |
| morganfainberg | jamielennox, i think we should have a programatic test the does GET and HEAD on the same REST call and verifies the only difference is body itself | 01:17 |
| jamielennox | that would need to be added to every HEAD request though right | 01:18 |
| morganfainberg | every get request | 01:18 |
| jamielennox | i don't think you have to response to HEAD | 01:18 |
| morganfainberg | or well at elast something that tries the GEt and HEAD appropriately | 01:18 |
| jamielennox | just if you response to both they should be the same | 01:18 |
| *** mberlin has quit IRC | 01:18 | |
| morganfainberg | you're supposed to, i think | 01:18 |
| *** marcoemorais has quit IRC | 01:22 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Session loading from CLI options https://review.openstack.org/95678 | 01:25 |
| *** mberlin has joined #openstack-keystone | 01:34 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Federating multiple Keystones https://review.openstack.org/100023 | 01:41 |
| *** gokrokve has joined #openstack-keystone | 01:49 | |
| *** praneshp has quit IRC | 01:54 | |
| *** rodrigods_ has joined #openstack-keystone | 01:56 | |
| *** nsquare has quit IRC | 01:59 | |
| *** nsquare has joined #openstack-keystone | 02:00 | |
| *** nsquare has quit IRC | 02:17 | |
| *** zhiyan_ is now known as zhiyan | 02:22 | |
| *** xianghui has quit IRC | 02:24 | |
| *** dstanek is now known as dstanek_zzz | 02:26 | |
| *** rodrigods_ has quit IRC | 02:27 | |
| lbragstad | quick question on the Policy API. Here https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#policy it says that 'type' can be anything as long as it's a MIME Media Type. | 02:29 |
| lbragstad | For validating that parameter, should I compare against an entire list of possible MIME types? | 02:29 |
| lbragstad | or just make sure that parameter is a string? | 02:30 |
| *** zhiyan is now known as zhiyan_ | 02:30 | |
| *** zhiyan_ is now known as zhiyan | 02:42 | |
| nkinder_ | morganfainberg: interesting finding with HEAD vs. GET... | 02:43 |
| jamielennox | lbragstad: string i think, we can't know all media types | 02:43 |
| morganfainberg | nkinder_, yeah. that was a weird one | 02:43 |
| lbragstad | jamielennox: yeah, that's kind of what I was thinking when I saw http://www.freeformatter.com/mime-types-list.html | 02:43 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: auth tests should not require admin token https://review.openstack.org/101861 | 02:43 |
| jamielennox | lbragstad: regarding that you know the validation object patch i had - if you are still ok with doing it that way you should just incorporate it into the initial patch rather than have me rebase it | 02:45 |
| nkinder_ | morganfainberg: hopefully people are in agreement with your suggestions | 02:46 |
| morganfainberg | nkinder_, i'm wondering if this will be an issue to "fix" or it'll be close enough being in the same 2xx series | 02:46 |
| morganfainberg | nkinder_, ++ we shall see :) | 02:46 |
| nkinder_ | so aside from this, do tempest tests pass with keystone in httpd/mod_wsgi? | 02:46 |
| morganfainberg | nkinder_, they fail in the same way as that review | 02:47 |
| morganfainberg | nkinder_, but otherwise yes | 02:47 |
| nkinder_ | morganfainberg: cool. So close to gate tests in httpd... | 02:47 |
| morganfainberg | nkinder_, exactly | 02:47 |
| *** dstanek_zzz is now known as dstanek | 02:48 | |
| morganfainberg | need that fix patch, 1 tempest fix, and 2 devstack patches to land | 02:48 |
| morganfainberg | all very close | 02:48 |
| *** nsquare has joined #openstack-keystone | 02:48 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: delete association when delete proj or endpoint https://review.openstack.org/87551 | 02:50 |
| *** harlowja is now known as harlowja_away | 02:50 | |
| *** ajc_ has joined #openstack-keystone | 02:50 | |
| lbragstad | jamielennox: you mean with the objects? | 02:52 |
| *** praneshp has joined #openstack-keystone | 02:52 | |
| nkinder_ | morganfainberg: you got your first vote of agreement on the -dev list... | 02:54 |
| morganfainberg | nkinder_, i saw :) | 02:54 |
| *** richm has quit IRC | 02:56 | |
| jamielennox | lbragstad: yep | 02:58 |
| *** xianghui has joined #openstack-keystone | 03:05 | |
| gyee | morganfainberg, ++ | 03:06 |
| gyee | nice piece of investigative work there | 03:06 |
| *** dims__ has quit IRC | 03:09 | |
| *** gyee has quit IRC | 03:10 | |
| *** stevemar has joined #openstack-keystone | 03:20 | |
| *** zhiyan is now known as zhiyan_ | 03:22 | |
| *** zhiyan_ is now known as zhiyan | 03:24 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Add a fixture for Keystone version discovery https://review.openstack.org/99846 | 03:28 |
| *** zhiyan has quit IRC | 03:30 | |
| *** zhiyan has joined #openstack-keystone | 03:37 | |
| *** zhiyan is now known as zhiyan_ | 03:39 | |
| *** zhiyan_ is now known as zhiyan | 03:40 | |
| *** zhiyan is now known as zhiyan_ | 03:46 | |
| *** zhiyan_ is now known as zhiyan | 03:50 | |
| *** praneshp_ has joined #openstack-keystone | 04:01 | |
| *** praneshp has quit IRC | 04:04 | |
| *** praneshp_ is now known as praneshp | 04:04 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Policy V3 API https://review.openstack.org/104065 | 04:21 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Trust V3 API https://review.openstack.org/104066 | 04:21 |
| mrda | hey keystone - I'm looking to implement token expiry in Nova's Ironic driver. I have an HTTPClient object - from this, am I able to get access to the ['token']['expires'] timestamp? I'm grepping code bases but not making much progress. Can anyone point me in the right direction? | 04:35 |
| *** dims__ has joined #openstack-keystone | 04:37 | |
| jamielennox | mrda: what do you mean a HTTPClient object? a keystoneclient HTTPClient? | 04:37 |
| mrda | Yes, I believe it's a keystone HTTPClient | 04:38 |
| jamielennox | first question, how did you acquire a keystoneclient client, didn't token come through from auth_token? | 04:38 |
| mrda | yes, there's the auth_token (or user/pass creds) that is used to obtain the HTTPClient (via a get_client) call | 04:40 |
| mrda | the thing is, is that I want to cache the object and reuse to minimise retrieving the client on every call | 04:41 |
| mrda | so I want to check the expiry | 04:41 |
| jamielennox | so the short answer is there is a client.auth_ref object which is essentially the token | 04:41 |
| jamielennox | auth_ref.expires is a datetime object | 04:42 |
| mrda | so the auth_ref contains the id and expires fields? | 04:42 |
| jamielennox | you can serialize and reload auth_ref | 04:42 |
| *** dims__ has quit IRC | 04:42 | |
| mrda | ok, sounds like that's what I want then | 04:42 |
| jamielennox | yep, auth_ref contains a lot of data | 04:42 |
| jamielennox | see: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/access.py | 04:43 |
| jamielennox | an auth_ref is an AccessInfo, so it also has a method .will_expire_soon(duration) | 04:43 |
| mrda | I think you've just helped unstick me :) | 04:43 |
| mrda | even better - I wrote a similar method to will_expire_soon() which I can discard now. | 04:44 |
| mrda | thanks jamielennox - much appreciated! | 04:44 |
| jamielennox | mrda: no worries | 04:45 |
| *** lbragstad is now known as lbragstad_ | 04:45 | |
| *** dims__ has joined #openstack-keystone | 05:02 | |
| *** dstanek is now known as dstanek_zzz | 05:04 | |
| *** stevemar has quit IRC | 05:05 | |
| *** dims__ has quit IRC | 05:07 | |
| *** afazekas_ has joined #openstack-keystone | 05:21 | |
| *** rwsu has quit IRC | 05:24 | |
| *** chandan_kumar has joined #openstack-keystone | 05:38 | |
| *** dstanek_zzz is now known as dstanek | 05:51 | |
| *** ukalifon has joined #openstack-keystone | 05:55 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/103380 | 06:00 |
| *** dstanek is now known as dstanek_zzz | 06:01 | |
| *** dims__ has joined #openstack-keystone | 06:03 | |
| *** dstanek_zzz is now known as dstanek | 06:06 | |
| *** dims__ has quit IRC | 06:08 | |
| *** dstanek is now known as dstanek_zzz | 06:15 | |
| *** gokrokve has quit IRC | 06:29 | |
| *** jaosorior has joined #openstack-keystone | 06:34 | |
| *** mitz_ has quit IRC | 06:48 | |
| *** mitz_ has joined #openstack-keystone | 06:50 | |
| *** nsquare has quit IRC | 06:51 | |
| *** tkelsey has joined #openstack-keystone | 06:51 | |
| *** gokrokve has joined #openstack-keystone | 07:00 | |
| *** gokrokve_ has joined #openstack-keystone | 07:02 | |
| *** gokrokv__ has joined #openstack-keystone | 07:04 | |
| *** gokrokve has quit IRC | 07:04 | |
| *** gokrokve_ has quit IRC | 07:07 | |
| *** gokrokv__ has quit IRC | 07:08 | |
| *** BAKfr has joined #openstack-keystone | 07:10 | |
| *** mrda is now known as mrda_away | 07:11 | |
| *** marekd|away is now known as marekd | 07:24 | |
| *** afazekas_ is now known as afazekas | 07:25 | |
| marekd | morganfainberg: https://review.openstack.org/#/c/60489/ this patch was landed by Diane, probably by mistake. I didn't know there was ongoing work on keysone-specs, since Kristy was actively changing it...:( | 07:25 |
| *** leseb has joined #openstack-keystone | 07:38 | |
| *** praneshp has quit IRC | 07:38 | |
| *** gokrokve has joined #openstack-keystone | 08:04 | |
| *** dims__ has joined #openstack-keystone | 08:06 | |
| *** gokrokve has quit IRC | 08:09 | |
| *** dims__ has quit IRC | 08:11 | |
| *** oomichi has quit IRC | 08:14 | |
| *** fifieldt_ has joined #openstack-keystone | 08:16 | |
| *** fifieldt has quit IRC | 08:18 | |
| openstackgerrit | Slawomir Gonet proposed a change to openstack/keystone: Ending periods in exception messages deleted https://review.openstack.org/103852 | 08:23 |
| *** gokrokve has joined #openstack-keystone | 08:30 | |
| *** fifieldt_ is now known as fifieldt | 08:31 | |
| *** henrynash has joined #openstack-keystone | 08:32 | |
| *** gokrokve has quit IRC | 08:34 | |
| *** bvandenh has joined #openstack-keystone | 08:48 | |
| *** gokrokve has joined #openstack-keystone | 09:02 | |
| *** leseb has quit IRC | 09:03 | |
| *** leseb has joined #openstack-keystone | 09:03 | |
| *** gokrokve has quit IRC | 09:03 | |
| *** leseb has quit IRC | 09:04 | |
| *** gokrokve has joined #openstack-keystone | 09:04 | |
| *** leseb has joined #openstack-keystone | 09:04 | |
| *** dims__ has joined #openstack-keystone | 09:07 | |
| *** gokrokve has quit IRC | 09:09 | |
| openstackgerrit | A change was merged to openstack/keystone-specs: Update pbr version https://review.openstack.org/103339 | 09:09 |
| *** dims__ has quit IRC | 09:12 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Add identity mapping capability https://review.openstack.org/102430 | 09:16 |
| *** leseb has quit IRC | 09:17 | |
| *** leseb has joined #openstack-keystone | 09:18 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone-specs: Revoke tokens when deleting EC2 credential https://review.openstack.org/103493 | 09:18 |
| *** andreaf has joined #openstack-keystone | 09:24 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: Clean up EP-Filter after delete project/endpoint https://review.openstack.org/87551 | 09:27 |
| *** leseb has quit IRC | 09:27 | |
| *** leseb has joined #openstack-keystone | 09:27 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone-specs: Revoke tokens when deleting EC2 credential https://review.openstack.org/103493 | 09:32 |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/100279 | 09:49 |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: Simplified Mapping for Federated Authentication https://review.openstack.org/100280 | 09:53 |
| openstackgerrit | Zhi Yan Liu proposed a change to openstack/python-keystoneclient: Expose an entry point to list auth_token middleware config options https://review.openstack.org/104128 | 09:54 |
| openstackgerrit | Slawomir Gonet proposed a change to openstack/keystone: Ending periods in exception messages deleted https://review.openstack.org/103852 | 09:56 |
| *** gokrokve has joined #openstack-keystone | 10:02 | |
| *** leseb has quit IRC | 10:05 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Calculate a suitable column width for positional arguments https://review.openstack.org/97873 | 10:05 |
| *** leseb has joined #openstack-keystone | 10:06 | |
| *** gokrokve has quit IRC | 10:07 | |
| *** dims__ has joined #openstack-keystone | 10:08 | |
| *** dims__ has quit IRC | 10:13 | |
| *** leseb has quit IRC | 10:13 | |
| *** leseb has joined #openstack-keystone | 10:13 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Add identity mapping capability https://review.openstack.org/102430 | 10:16 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: multi-backend support for identity https://review.openstack.org/74214 | 10:16 |
| *** leseb has quit IRC | 10:24 | |
| *** leseb has joined #openstack-keystone | 10:25 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Add identity mapping capability https://review.openstack.org/102430 | 10:29 |
| *** dims__ has joined #openstack-keystone | 10:32 | |
| *** henrynash has quit IRC | 10:42 | |
| *** jdennis has quit IRC | 11:01 | |
| *** gokrokve has joined #openstack-keystone | 11:02 | |
| *** gokrokve has quit IRC | 11:08 | |
| *** tellesnobrega has left #openstack-keystone | 11:16 | |
| *** leseb has quit IRC | 11:23 | |
| *** leseb has joined #openstack-keystone | 11:23 | |
| *** leseb has quit IRC | 11:30 | |
| *** leseb has joined #openstack-keystone | 11:31 | |
| *** tkelsey has quit IRC | 11:32 | |
| *** ajc_ has quit IRC | 11:58 | |
| *** gokrokve has joined #openstack-keystone | 12:02 | |
| *** gokrokve has quit IRC | 12:07 | |
| *** bvandenh has quit IRC | 12:08 | |
| marekd | mhu: hey | 12:10 |
| marekd | mhu: i am reading your e-mail and not sure what specs are you talking about? :-) | 12:10 |
| mhu | marekd, i am in a meeting atm, can I get back to you a bit later ? | 12:10 |
| marekd | mhu: anytime! | 12:10 |
| mhu | marekd, thx | 12:10 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Document authentication plugins https://review.openstack.org/84071 | 12:19 |
| *** achampion has quit IRC | 12:27 | |
| *** diegows has joined #openstack-keystone | 12:28 | |
| *** dstanek_zzz is now known as dstanek | 12:29 | |
| *** erecio has joined #openstack-keystone | 12:43 | |
| marekd | dolphm: o/ For public_keys in k2k federation, are you leaning towards any of two options - keeping them in Keystone's backend or using Barbican for that? | 12:44 |
| *** leseb has quit IRC | 12:45 | |
| *** _elmiko is now known as elmiko | 12:45 | |
| *** leseb has joined #openstack-keystone | 12:45 | |
| *** dims__ has quit IRC | 12:52 | |
| *** dims__ has joined #openstack-keystone | 12:53 | |
| *** kwss has joined #openstack-keystone | 12:54 | |
| *** radez_g0n3 is now known as radez | 12:55 | |
| *** leseb has quit IRC | 13:01 | |
| *** leseb has joined #openstack-keystone | 13:01 | |
| *** gokrokve has joined #openstack-keystone | 13:02 | |
| *** chandan_kumar is now known as chandankumar | 13:03 | |
| *** tkelsey has joined #openstack-keystone | 13:05 | |
| *** Gippa has joined #openstack-keystone | 13:06 | |
| *** gokrokve has quit IRC | 13:07 | |
| *** nkinder_ has quit IRC | 13:08 | |
| *** xianghui has quit IRC | 13:12 | |
| *** stevemar has joined #openstack-keystone | 13:13 | |
| *** hrybacki has joined #openstack-keystone | 13:17 | |
| dolphm | marekd: ideally, barbican! | 13:19 |
| marekd | allright, i am doing some reading on that topic. | 13:19 |
| marekd | dolphm: i don know if you had a chance to read k2k specs, but are you okay with dropping saml/oidc in favor of simplyfying thr workflow but creating our own federation-like protocol? | 13:24 |
| marekd | kwss: hey! | 13:26 |
| marekd | kwss: i am not sure if you saw this patch: https://review.openstack.org/#/c/90121/8 | 13:26 |
| marekd | kwss: maybe lack of that info caused you a headache :( | 13:27 |
| rodrigods | marekd, i'm trying to be aware of k2k, are you having meetings in a specified time? or is it more ad-hoc right now? | 13:28 |
| marekd | rodrigods: morganfainberg stevemar dstanek and i discussed once a workflow, but it was rather an ad-hoc meeting. | 13:29 |
| *** topol has joined #openstack-keystone | 13:29 | |
| *** xianghui has joined #openstack-keystone | 13:29 | |
| marekd | rodrigods: there might one soon, but nothing certain yet. | 13:29 |
| stevemar | rodrigods, yeah, just ad-hoc stuff on -keystone | 13:30 |
| marekd | stevemar: oh, hey stevemar | 13:30 |
| stevemar | marekd, i'm back today :D | 13:30 |
| rodrigods | marekd, stevemar thanks... | 13:30 |
| * rodrigods reading the last k2k patch | 13:30 | |
| marekd | stevemar: since you are here...:-) | 13:30 |
| stevemar | marekd, i really need to get eyes on that dox bug i filed! | 13:31 |
| *** joesavak has joined #openstack-keystone | 13:32 | |
| kwss | marekd, I saw it, but I'm not sure determining user ID should be a mapping engine thing :) | 13:32 |
| *** Gippa has quit IRC | 13:32 | |
| marekd | stevemar: because -infra is not fixing it or it;s not them who should fix it? | 13:33 |
| stevemar | marekd, it's not infra who should fix it | 13:34 |
| stevemar | should be the doc folks | 13:34 |
| stevemar | looks like a library they depend on is doing something funny | 13:34 |
| marekd | kwss: i am just thinking about your comment. I think i get the point - you want to use one set of rules to every IdP and I understand why. I also got the impression you want to get rid of per IdP mapping, right? | 13:34 |
| marekd | stevemar: infra, docs, whatever..not keystone, right? | 13:34 |
| dstanek | stevemar: is that the Java stacktrace that I've been seeing? | 13:35 |
| marekd | dstanek: also. | 13:35 |
| kwss | marekd, not necessarily get rid of it completely, as I agree that certain situations would benefit from it, but definitely allowing a global mapping policy as well | 13:35 |
| marekd | kwss: in your spec - are you planning to keep how mapping rules look like? Or the JSON and its structure stays? | 13:35 |
| marekd | kwss: ha! because what I understood was: make one global set of rules, and remove everything else | 13:36 |
| marekd | kwss: e.g. because you don't want to add mapping id when PUTting protocols. | 13:36 |
| kwss | marekd, the current policy structure is fine, it's more how they are assigned | 13:37 |
| marekd | kwss: ok, how would your rules look like? | 13:38 |
| kwss | marekd, I guess there are multiple ways to achieve this, we could extend the current functionality to allow for a global policy in addition, or we remove the PUT and give rules a list of IdPs to apply to | 13:38 |
| stevemar | dstanek, it sure looks like it eh | 13:38 |
| marekd | kwss: yes, but i think in your spec you are proposing to remove setting mapping ids | 13:38 |
| kwss | marekd, I don't think they would have to change at all, just make it so that they can be applied without being linked to an IdP | 13:39 |
| kwss | marekd, you're right, I should update the spec to include both IdP specific and global mappings, I need to check if David has anything to say about this when I meet with him this afternoon, then I'll upload a new patch | 13:40 |
| marekd | kwss: "If I have 100 IdPs configured and all of them issue an email attribute which we map to user: email and an organisation which maps to a *different* group for each IdP then I cannot reuse the policy and must make a new one for each IdP. This results in 100 mappings each with 2 rules (so 200 rules). In this revised version, I make 1 mapping for email and 1 for each IdP specific group, resulting (so 101 rules)" | 13:40 |
| marekd | kwss: that's your comment | 13:40 |
| marekd | :-) | 13:40 |
| marekd | kwss: do you think you could try building a JSON rules you would like to use with let's say 3-4 IdP in the federation? | 13:41 |
| marekd | i can try doing the same. | 13:41 |
| kwss | marekd, I don't think my comment precludes IdP specific mappings, I'm just explaining how some situations would benefit from a global set of rules too | 13:42 |
| kwss | marekd, I'll add an example of this to the next patch of the spec | 13:43 |
| *** leseb has quit IRC | 13:46 | |
| marekd | kwss: http://fpaste.org/114992/ | 13:48 |
| marekd | kwss: this set of rules should always issue userid as email, and different groups depending on the organisation | 13:48 |
| marekd | how would the rules change if we were doing mapping like you are proposing? | 13:49 |
| marekd | kwss: sorry, seccond comment should be "mapping to IdP2" | 13:50 |
| kwss | marekd, The rules would be the same, but we wouldn't have to assign the mapping 100 times | 13:50 |
| marekd | kwss: is it really such a great effort to put extra line since you are already adding the protocol 100 times? | 13:51 |
| *** thedodd has joined #openstack-keystone | 13:51 | |
| kwss | marekd, and if I later write a new policy? | 13:52 |
| marekd | kwss: new policy == new rule? | 13:52 |
| marekd | kwss: so you PATCH the mapping itself... | 13:52 |
| openstackgerrit | Harry Rybacki proposed a change to openstack/python-keystoneclient: Add tests without optional create endpoint params https://review.openstack.org/103229 | 13:53 |
| marekd | stevemar: k2k! | 13:54 |
| dstanek | hrybacki: you around? | 13:54 |
| hrybacki | dstanek: o/ | 13:55 |
| kwss | marekd, even if this is achievable with the current system, it is still extra work and it doesn't make sense to link attribute mapping to a protocol | 13:55 |
| dstanek | hrybacki: looking at your latest now | 13:55 |
| stevemar | marekd, k2k is almost there :) | 13:55 |
| kwss | marekd, the protocol does not determine the semantics of an attribute | 13:55 |
| hrybacki | dstanek: I think I messed up the damn import. Again. | 13:56 |
| marekd | kwss: protocol is rather used to letting idp have multiple mapings. | 13:56 |
| *** miqui has quit IRC | 13:56 | |
| *** nkinder_ has joined #openstack-keystone | 13:56 | |
| marekd | kwss: without that how an we solve my PEPSI/COLA example? | 13:56 |
| dstanek | hrybacki: yeah, also is your JSON correct because both new tests have the same values | 13:56 |
| marekd | stevemar: ehhhh, what do we want to have in extended SC? | 13:56 |
| marekd | stevemar: remote Keystones only, right? | 13:56 |
| kwss | marekd, are pepsi and cola not separate IdPs? | 13:56 |
| hrybacki | dstanek: yep -- it's all dependent on what's being handed to the client.endpoints.create call | 13:57 |
| dstanek | hrybacki: ah, i see | 13:57 |
| marekd | pepsi wants to use my cloud, so does cola. They both issue parameter "DRINK" and both set its value to "SODA". Now, i need map this to PEPSI_SODA project for PEPSI and COCA_SODA for COCA | 13:58 |
| marekd | or cola..whatever | 13:58 |
| hrybacki | that create will post the 'none' for adminurl/internalurl regardless if it gets fed them or not -- just checking to make sure that post is following that rule | 13:58 |
| marekd | so i make independent mappings for COCA and PEPSI and make it work. | 13:58 |
| marekd | how can i achieve it with global rules, applied for *every* IdP ? | 13:59 |
| kwss | marekd, and if we maintain IdP specific mappings in addition to global then this is no problem, but they still should not link to any protocol | 13:59 |
| hrybacki | dstanek: so uuid (newline) httpretty (2newlines) otherstuff ? | 13:59 |
| dstanek | hrybacki: nope, i'm happy with that | 13:59 |
| hrybacki | okay, cool | 13:59 |
| marekd | kwss: this is what i was not witnessing in the spec :( That this global mapping is addition, not replacement. Also because you have removed mapping_id from all API calls, which indicates there are no per-IdP mappings. | 14:00 |
| kwss | marekd, there are multiple ways to do this, to be independent of protocol, we could assign a mapping directly to the IdP, or we could include a list of IdPs to apply to in each rule. I will add this to the next patch but I would like to discuss it with David first. | 14:02 |
| *** gokrokve has joined #openstack-keystone | 14:02 | |
| marekd | kwss: sure. I know there are multiple ways, but I am talking about what i am seeing in the spec and why I am against that way (and hence keeping my -1) :-) | 14:03 |
| marekd | stevemar: ? | 14:03 |
| kwss | marekd, that's fine, I'll address this issue in the next patch, David is in a meeting but I will be seeing him after and I will make sure the next patch is up in the next few hours :) | 14:04 |
| marekd | stevemar: what did you mean by having step A and A' in the userflow? What is IdP and what is ACME? They are both one Keystone, or IdP is shibboleth IdP? | 14:05 |
| marekd | kwss: sure! | 14:05 |
| marekd | I should be available next 3-4 hours, and later maybe at night | 14:05 |
| kwss | marekd, I think IdP and ACME refers to a federated IdP configured into keystone and ACME is the keystone? | 14:06 |
| stevemar | marekd, you got it, idp would be shibboleth | 14:06 |
| stevemar | kwss, yep | 14:06 |
| *** gokrokve has quit IRC | 14:07 | |
| marekd | stevemar: ok, so you are saying we can use icehouse federation as one of authN method for ACME keystone authN | 14:07 |
| stevemar | yeah | 14:07 |
| *** rodrigods has quit IRC | 14:07 | |
| marekd | stevemar: I will leave it up to your decision but I would add a note about that and remove from this diagram. OThewise ppl might get confused, as we are mixing 'federations' here. Especially we also use in k2k bp terms like IdP, but in a different context. | 14:08 |
| marekd | i think some note like "login with local Keystone using all availavle authN methods, including SAML federation" would be fine. | 14:09 |
| marekd | OFC you will be able to make it look more english :P | 14:09 |
| *** achampion has joined #openstack-keystone | 14:09 | |
| marekd | also SAML federation is clearly beyond of the scope of this bp, so why mention in in one of the most important diagrams | 14:10 |
| *** rwsu has joined #openstack-keystone | 14:10 | |
| *** erecio has quit IRC | 14:10 | |
| marekd | I will be back in 20 minutes. | 14:11 |
| *** rodrigods has joined #openstack-keystone | 14:11 | |
| *** marekd is now known as marekd|BBL | 14:11 | |
| mhu | marekd: concerning my mail, I think I was hitting a bad case of over-engineering and made the pb in my head more complex than it really is. I was worried about external auth support, which is not the scope at all ... this review made me realize the mistake: https://review.openstack.org/#/c/84071/ | 14:13 |
| mhu | anyhow, I'll get to it ASAP | 14:13 |
| *** kashyap has left #openstack-keystone | 14:15 | |
| *** vhoward- has joined #openstack-keystone | 14:17 | |
| *** leseb has joined #openstack-keystone | 14:18 | |
| *** vhoward- has left #openstack-keystone | 14:18 | |
| *** ukalifon has quit IRC | 14:18 | |
| stevemar | mhu, everything work out? | 14:20 |
| mhu | stevemar, yeah, I think so | 14:20 |
| mhu | but in any case, should I hit some problems, you'll find me here :) | 14:20 |
| dstanek | hrybacki: re-reading our conversation - yes, change the import - when i said nope i was responding to an earlier comment | 14:21 |
| *** afazekas has quit IRC | 14:21 | |
| hrybacki | dstanek: okay, will patch and review in a min | 14:21 |
| openstackgerrit | Harry Rybacki proposed a change to openstack/python-keystoneclient: Add tests without optional create endpoint params https://review.openstack.org/103229 | 14:23 |
| hrybacki | dstanek: I feel bad for the ci server | 14:23 |
| stevemar | hrybacki, don't worry the CI servers are tough :) | 14:25 |
| *** gokrokve has joined #openstack-keystone | 14:26 | |
| *** gokrokve_ has joined #openstack-keystone | 14:27 | |
| hrybacki | stevemar: I'll keep that in mind :P | 14:27 |
| stevemar | mhu, our mail system is down, but i was going to write back ... for OSC we don't have a specs repo, just write a blueprint up in launchpad | 14:28 |
| mhu | stevemar, thx | 14:28 |
| *** henrynash has joined #openstack-keystone | 14:29 | |
| henrynash | dstanek: if you’re around, https://review.openstack.org/#/c/102430/ is fixed up wrt your comments... | 14:29 |
| *** jdennis has joined #openstack-keystone | 14:29 | |
| *** gokrokve has quit IRC | 14:31 | |
| openstackgerrit | Zhi Yan Liu proposed a change to openstack/keystonemiddleware: Expose an entry point to list auth_token middleware config options https://review.openstack.org/104208 | 14:42 |
| *** gokrokve_ has quit IRC | 14:43 | |
| dstanek | henrynash: +2+A - thanks! | 14:44 |
| henrynash | dstanek: thx | 14:44 |
| marekd|BBL | mhu: aha :-) | 14:46 |
| *** marekd|BBL is now known as marekd | 14:47 | |
| *** gokrokve has joined #openstack-keystone | 14:47 | |
| *** daneyon has joined #openstack-keystone | 14:47 | |
| *** daneyon has quit IRC | 14:47 | |
| *** daneyon has joined #openstack-keystone | 14:48 | |
| marekd | rodrigods: here? | 14:49 |
| marekd | rodrigods: regarding your questions on the k2k bp. | 14:50 |
| *** Chicago has joined #openstack-keystone | 14:50 | |
| marekd | rodrigods: i think we only need Extended Service Catalog consisting of remote Keystones | 14:50 |
| *** andreaf has quit IRC | 14:51 | |
| marekd | nothing more, and this can be easily build from list of registered and enabled SP | 14:51 |
| marekd | Service Providers. | 14:51 |
| rodrigods | marekd, hmm so maybe the description should change over there? | 14:51 |
| marekd | rodrigods: oh, AFAIR we wanted to do something like /auth/tokens?SC=BETA | 14:52 |
| rodrigods | marekd, in which step the user "discovers" BETA? | 14:53 |
| *** tkelsey has quit IRC | 14:54 | |
| marekd | rodrigods: ha good queston. I think it should be either apriori (so somebody told him there is SP BETA), or user should also be able to get full extended SC | 14:54 |
| marekd | with all available Service providers. | 14:55 |
| *** dims__ has quit IRC | 14:55 | |
| *** vhoward- has joined #openstack-keystone | 14:56 | |
| rodrigods | marekd, and this should be triggered after the user decides to burst, right? | 14:56 |
| marekd | what this? | 14:56 |
| marekd | rodrigods:^^? | 14:56 |
| rodrigods | marekd, maybe I lost some discussion, but in the meeting I was watching, the user would decide that it needs to burst to another cloud, and after that, it would access the external service provider | 14:57 |
| rodrigods | the user over there, I mean the client | 14:57 |
| marekd | rodrigods: essentially yes, but in the meantime he would need to ask his local keystone to make that token usable only with BETA | 14:58 |
| rodrigods | marekd, ok, so it's clear that the user needs to discover the list of external service providers at some point, right? | 15:00 |
| rodrigods | maybe it should be added to the spec | 15:00 |
| marekd | rodrigods: point (B) is not enough? | 15:00 |
| marekd | linke ~247 | 15:00 |
| *** mclaren has joined #openstack-keystone | 15:00 | |
| marekd | line | 15:00 |
| rodrigods | marekd, "possible using a query parameter to select an SP." doesn't it mean that it is already sending BETA as query parameter? My point is, when it will even know that BETA exists | 15:02 |
| marekd | rodrigods: or, so this might need to be rephrased. The goal AFAIR was "if you know nothing: get a full SC so you can discover who is available, if you know who you want to use apriori don't fetch full SC" | 15:03 |
| rodrigods | marekd, ++ | 15:04 |
| rodrigods | now it makes sense to me | 15:04 |
| *** tkelsey_ has joined #openstack-keystone | 15:07 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Ensure that in v2 auth tenant_id matches trust https://review.openstack.org/104216 | 15:10 |
| *** gokrokve has quit IRC | 15:10 | |
| stevemar | marekd, rodrigods if the user provides no query params, he gets the normal SC, if he provides &allSC or something, he can get all SP endpoints (but not local ones) | 15:11 |
| *** gokrokve has joined #openstack-keystone | 15:11 | |
| stevemar | if the user knows the SP id, he can do &SP=BETA, and get just that one back | 15:12 |
| stevemar | i think that would work, but why not always go for allSP | 15:12 |
| marekd | stevemar: i was thinking the same. filtering could be good to not always gets back SC with 50 Keystone endpoints (because there are 50 trusted clouds) | 15:13 |
| bknudson | the catalog would get so big that it wouldn't even fit in the token table | 15:14 |
| marekd | bknudson: ++ | 15:16 |
| marekd | bknudson: this is uuid only case, right? | 15:16 |
| *** xianghui has quit IRC | 15:18 | |
| bknudson | tokens are stored in the table whether it's uuid or pki | 15:18 |
| bknudson | so we can get it back on validate | 15:18 |
| *** packet has joined #openstack-keystone | 15:19 | |
| *** dims__ has joined #openstack-keystone | 15:23 | |
| *** gokrokve has quit IRC | 15:25 | |
| *** dims__ has quit IRC | 15:27 | |
| *** dims__ has joined #openstack-keystone | 15:27 | |
| dolphm | stevemar: did canada unplug internet? | 15:34 |
| stevemar | it appears so | 15:35 |
| stevemar | refresh | 15:35 |
| joesavak | yo stevemar | 15:37 |
| sbasam | bknudson/marekd: Can you provide a link to the BP which is proposing the &SP=BETA functionality? It is something we struggle with too. | 15:38 |
| stevemar | yo joesavak | 15:38 |
| marekd | sbasam: https://review.openstack.org/#/c/100023/ | 15:38 |
| openstackgerrit | Zhi Yan Liu proposed a change to openstack/keystonemiddleware: Expose an entry point to list auth_token middleware config options https://review.openstack.org/104208 | 15:38 |
| sbasam | thanks | 15:38 |
| joesavak | so there's some convo about having keystone-only protocol for federation or for k2k dropping saml/oidc... | 15:38 |
| joesavak | great for simplicity for k2k, right? | 15:39 |
| joesavak | but makes it tougher for k2-nonK SP | 15:39 |
| joesavak | ex: local cloud horizon needs to federate to ticketing-as-a-service SP | 15:40 |
| openstackgerrit | A change was merged to openstack/keystone: Add identity mapping capability https://review.openstack.org/102430 | 15:40 |
| joesavak | the idea being batted around is that horizon would ask local keysotne for the federation representation of an identity for the ticket-as-a-service SP | 15:41 |
| joesavak | horizon doesn't need to know saml, oidc, abfab, or anything - it has a token and will ask keystone (the issuer) for a representation of that identity in the federation construct expected by the SP it's federating to | 15:42 |
| joesavak | make sense? | 15:42 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/104018 | 15:42 |
| *** afazekas has joined #openstack-keystone | 15:44 | |
| *** chandankumar has quit IRC | 15:44 | |
| marekd | joesavak: yes, as long as protocols will work that way. in most of SAML IdP implementations you need signed authN request from SP, so IdP knows it is issuing an assertion for a trusted SP. | 15:44 |
| openstackgerrit | Zhi Yan Liu proposed a change to openstack/keystonemiddleware: Expose an entry point to list auth_token middleware config options https://review.openstack.org/104208 | 15:45 |
| marekd | joesavak: so the client is having good 'old' federation. | 15:45 |
| tristanC | Hello folks, we are in the process of publishing and OSSA for https://bugs.launchpad.net/ossa/+bug/1331912. Though stable/havana just failed check-devstack-dsvm-cells. Yet it seems not related... | 15:45 |
| uvirtbot | Launchpad bug 1331912 in keystone "[OSSA 2014-022] V2 Trusts allow trustee to emulate trustor in other projects (CVE-2014-3520)" [High,In progress] | 15:45 |
| tristanC | logs are: https://jenkins02.openstack.org/job/check-devstack-dsvm-cells/8105/consoleFull | 15:45 |
| *** leseb has quit IRC | 15:46 | |
| *** leseb has joined #openstack-keystone | 15:46 | |
| *** leseb has quit IRC | 15:46 | |
| *** leseb has joined #openstack-keystone | 15:47 | |
| boris-42 | jamielennox hi there | 15:47 |
| boris-42 | jamielennox I merged patch to osprofiler https://github.com/stackforge/osprofiler/commit/bb9c01e0dd87e6166d3076921a0ef137c5efd756 | 15:47 |
| boris-42 | jamielennox didn't yet publish new version | 15:47 |
| boris-42 | jamielennox cause some more changes are going to be in lib | 15:47 |
| stevemar | joesavak, as i understand, you are meeting jorge in 10 minutes, he will re-cap you! | 15:53 |
| *** richm has joined #openstack-keystone | 15:53 | |
| *** hrybacki_ has joined #openstack-keystone | 15:54 | |
| joesavak | thanks stevemar | 15:56 |
| *** hrybacki has quit IRC | 15:57 | |
| *** jsavak has joined #openstack-keystone | 15:57 | |
| *** hrybacki_ has quit IRC | 15:58 | |
| *** daneyon_ has joined #openstack-keystone | 15:59 | |
| *** joesavak has quit IRC | 16:00 | |
| dstanek | dolphm: token binding question...if i exchange a token for another more finely scoped token would i still have to provide an additional factor? | 16:00 |
| *** daneyon has quit IRC | 16:02 | |
| *** gyee has joined #openstack-keystone | 16:03 | |
| *** gokrokve has joined #openstack-keystone | 16:06 | |
| dolphm | dstanek: with binding, yes. binding doesn't have any impact on scope | 16:07 |
| *** daneyon_ has quit IRC | 16:07 | |
| morganfainberg | dolphm, ++ | 16:13 |
| dstanek | dolphm: but the resulting scoped token will not need binding right? | 16:13 |
| morganfainberg | bknudson, if i address the two comments you have in jamielennox's privatize review we'd be good to merge it, right? | 16:14 |
| *** BAKfr has quit IRC | 16:14 | |
| dolphm | dstanek: i think it should maintain the requirement for a binding so that it avoids becoming a bearer token; why are you thinking otherwise? | 16:15 |
| dstanek | dolphm: i'm thinking (user presents token + factor to nova) -> (nova uses that to create a token for another service) | 16:15 |
| bknudson | morganfainberg: if it gets middleware released then that's fine by me | 16:15 |
| morganfainberg | bknudson, ok i'm addressing them now | 16:16 |
| bknudson | but I don't know why jamielennox made the change. | 16:16 |
| bknudson | was it required due to the change to the names? | 16:16 |
| dstanek | dolphm: so when nova goes to use the token to get an images for the user it won't have the additional factor | 16:16 |
| *** jsavak has quit IRC | 16:17 | |
| dolphm | dstanek: that's a good question. i don't have an answer... (cc- ayoung jamielennox) | 16:17 |
| *** hrybacki has joined #openstack-keystone | 16:18 | |
| dolphm | dstanek: i'd imagine some bypass mechanism (like trusting nova's signature regardless of token binding), but that sounds like a great attack vector :( | 16:18 |
| * dolphm runs to grab food | 16:19 | |
| *** hi_every_body has joined #openstack-keystone | 16:20 | |
| morganfainberg | bknudson, shouldn't have been required | 16:21 |
| morganfainberg | bknudson, i'm looking at the exception change | 16:21 |
| morganfainberg | the message change meh | 16:21 |
| *** marekd is now known as marekd|away | 16:21 | |
| *** jaosorior has quit IRC | 16:22 | |
| *** hrybacki has quit IRC | 16:22 | |
| *** kwss has quit IRC | 16:25 | |
| dolphm | morganfainberg: we need both the privatize changes to land, i assume? | 16:25 |
| morganfainberg | dolphm, ideally yes | 16:26 |
| morganfainberg | dolphm, which is why i'm working on them now | 16:26 |
| *** daneyon has joined #openstack-keystone | 16:27 | |
| dolphm | morganfainberg: can they either be squashed together or made parallel? | 16:27 |
| morganfainberg | dolphm, easy to squash them. | 16:27 |
| morganfainberg | dolphm, i was worried parallel would conflict since we touched some of the same code. | 16:28 |
| *** hi_every_body has quit IRC | 16:28 | |
| morganfainberg | i'll squash + co-author it | 16:28 |
| *** ukalifon has joined #openstack-keystone | 16:28 | |
| dolphm | morganfainberg: it's one line in auth_token changing an import | 16:28 |
| dolphm | morganfainberg: imports aren't touched in the other patch | 16:29 |
| morganfainberg | dolphm, ah right, was tired last night | 16:29 |
| morganfainberg | dolphm, easy either way | 16:29 |
| bknudson | looks like the server doesn't actually support setting the response content-type | 16:30 |
| bknudson | and the tests don't support having a response content-type different than the request content-type | 16:30 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Privatize Everything https://review.openstack.org/104037 | 16:30 |
| dolphm | bknudson: what are you trying to set the response type to? | 16:31 |
| bknudson | application/json-home | 16:31 |
| dolphm | bknudson: without the client requesting application/json-home? | 16:31 |
| bknudson | also, oauth tries to set the response to application-x-www-urlformencoded | 16:31 |
| morganfainberg | dolphm, ^ split from being dependent | 16:31 |
| dolphm | morganfainberg: cool | 16:31 |
| bknudson | the client requests application/json-home in the Accept header, not content-type | 16:31 |
| bknudson | although it's a get request so there's no content in the request | 16:32 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Privatize Everything https://review.openstack.org/104027 | 16:32 |
| *** david-lyle has joined #openstack-keystone | 16:32 | |
| morganfainberg | bknudson, ^ jamie's without the two changes you commented on. | 16:32 |
| bknudson | but a client could potentially POST application/json and accept xml | 16:32 |
| morganfainberg | bknudson, i don't see why those were made, we can chain them on separately if they are absolutely needed | 16:33 |
| dolphm | bknudson: right... so i guess i'm lost on what's breaking with Accept: application/json-home + Content-Type: application/json-home | 16:33 |
| *** leseb has quit IRC | 16:34 | |
| bknudson | dolphm: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/wsgi.py#n611 | 16:34 |
| bknudson | render_response always adds a Content-Type: application/json | 16:34 |
| *** leseb has joined #openstack-keystone | 16:34 | |
| dolphm | bknudson: made that an optional kwarg? | 16:34 |
| bknudson | dolphm: y, but then the problem is that the tests don't support having a different response type... | 16:35 |
| dolphm | bknudson: if the controller calls render_response itself, the wsgi module won't do it again | 16:35 |
| dolphm | bknudson: ooooh | 16:35 |
| bknudson | anyway, it's just trickier than I thought it would be. | 16:35 |
| bknudson | I think oauth is "broken" in that it doesn't have the right content-type. | 16:35 |
| dolphm | bknudson: they always call assertValidResponse or something.... maybe extend RestfulTestCase or whatever and override that method? | 16:35 |
| dolphm | bknudson: i assume you have a new test module that only tests json home responses? | 16:36 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Service Tokens are really a middleware specification https://review.openstack.org/104257 | 16:36 |
| bknudson | dolphm: eventually will. oauth1 will need the same fix | 16:36 |
| bknudson | dolphm: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/rest.py#n166 | 16:37 |
| bknudson | that check fails if response content-type isn't 'json' | 16:38 |
| bknudson | self.content_type is 'json' | 16:38 |
| bknudson | so maybe can pass in the response content type where restful response is getting done | 16:38 |
| bknudson | expected response content type | 16:39 |
| dolphm | bknudson: in, so application/json works (and application/json-home should work then too?) | 16:39 |
| *** leseb has quit IRC | 16:39 | |
| bknudson | dolphm: y, I don't think that will be the problem. | 16:39 |
| bknudson | but if I fix render_response to support setting the response content-type then oauth tests fail | 16:40 |
| bknudson | because oauth tests set x-www-urlformencoded | 16:40 |
| bknudson | I don't know if the requests are x-www-urlformencoded... can try setting that in the oauth tests. | 16:40 |
| dolphm | bknudson: that seems right for at least one oauth response iirc... stevemar? | 16:40 |
| *** rodrigods has quit IRC | 16:43 | |
| *** marcoemorais has joined #openstack-keystone | 16:43 | |
| *** thedodd has quit IRC | 16:44 | |
| stevemar | bknudson, dolphm IIRC the responses should be x-www-urlformencoded | 16:45 |
| *** marcoemorais has quit IRC | 16:45 | |
| *** rodrigods has joined #openstack-keystone | 16:45 | |
| stevemar | the requests, I'm not sure | 16:45 |
| *** marcoemorais has joined #openstack-keystone | 16:45 | |
| bknudson | stevemar: is that what the server actually sends back? | 16:46 |
| stevemar | bknudson, it should be, i think we over-ride it | 16:46 |
| *** bobt has joined #openstack-keystone | 16:46 | |
| stevemar | bknudson, The HTTP request entity-header includes the "Content-Type" | 16:48 |
| stevemar | header field set to "application/x-www-form-urlencoded". | 16:48 |
| *** marcoemorais1 has joined #openstack-keystone | 16:48 | |
| stevemar | that probably happens under the covers with oauthlib | 16:49 |
| bknudson | stevemar: that's the request? | 16:49 |
| bknudson | stevemar: is that what the tests do, too? | 16:50 |
| *** marcoemorais has quit IRC | 16:50 | |
| *** zhiyan is now known as zhiyan_ | 16:50 | |
| *** daneyon has quit IRC | 16:50 | |
| *** daneyon has joined #openstack-keystone | 16:51 | |
| *** zhiyan_ is now known as zhiyan | 16:51 | |
| bknudson | doesn't look like client.sign(self.base_url + endpoint, ...) sets Content-Type | 16:52 |
| *** harlowja_away is now known as harlowja | 16:52 | |
| *** tkelsey_ has quit IRC | 16:52 | |
| bknudson | I don't see the tests setting the Content-Type to x-www-form-urlencoded ... _get_oauth_token sets application/json | 16:53 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/test_v3_oauth1.py#n80 | 16:53 |
| bknudson | which is doing /auth/tokens anyways | 16:53 |
| *** Chicago has quit IRC | 16:53 | |
| bknudson | the rest don't have a body | 16:53 |
| stevemar | bknudson, i feel like the request is done properly by by oauthlib (in the tests) | 16:55 |
| *** jamielennox is now known as jamielennox|away | 17:02 | |
| morganfainberg | oh Jul4th is friday | 17:02 |
| morganfainberg | haha | 17:02 |
| * morganfainberg just realized why everyone was saying "Have a good holiday weekend" | 17:03 | |
| * morganfainberg facepaws. https://i.chzbgr.com/maxW500/3739566080/hFC30F272/ | 17:03 | |
| morganfainberg | dolphm, you really like your BRZ right? | 17:04 |
| morganfainberg | dolphm, has it been reliable overall? | 17:04 |
| dolphm | morganfainberg: *love* and 100% reliable... | 17:04 |
| morganfainberg | dolphm, i'm looking at ditching my S4 (so pricy) | 17:04 |
| *** leseb has joined #openstack-keystone | 17:04 | |
| dolphm | morganfainberg: it's underpowered, but that just means you can drive at ten tenths all the time | 17:04 |
| morganfainberg | dolphm, brz (or frs, same car, which ever dealer gives a better deal on it) - is on the list i'm considering | 17:05 |
| morganfainberg | dolphm, but i figure i can save > $300/mo by switching cars. | 17:05 |
| dolphm | morganfainberg: it has no grip. oil changes are dead easy. google for "brz/fr-s chirp" <-- a problem a lot of people had including me, but mine went away at about 10k miles | 17:05 |
| morganfainberg | so. shoudl do it :) | 17:06 |
| morganfainberg | dolphm, good to know, will check it out :) | 17:06 |
| dolphm | morganfainberg: you're going to be dissapointed by the power different coming from an s4 | 17:06 |
| *** joesavak has joined #openstack-keystone | 17:06 | |
| dolphm | morganfainberg: just make up for it with more sideways | 17:06 |
| morganfainberg | dolphm, i will be disappointed by _anything_ in that light. but I don't ever drive now | 17:06 |
| morganfainberg | dolphm, i mean i think i avg. 45mi /wk on a big week of driving | 17:07 |
| morganfainberg | most weeks are closer to 0 | 17:07 |
| dolphm | morganfainberg: wow, i do that every day | 17:07 |
| morganfainberg | yeah, no need to spend lots of $ on a car I'm not using. | 17:07 |
| *** zhiyan is now known as zhiyan_ | 17:08 | |
| dolphm | morganfainberg: fr-s has a looser rear-end from the factor, for whatever that's worth | 17:09 |
| dolphm | factory* | 17:09 |
| morganfainberg | good to know | 17:09 |
| morganfainberg | haven't driven the fr-s yet, planning on going to look at cars this weekend now that I know it's the 4th of july | 17:09 |
| *** leseb has quit IRC | 17:09 | |
| dolphm | morganfainberg: lol. when you do, *hold* the left fun button down for like 5 seconds to disengage traction control and stability control. abs requires pulling a fuse | 17:11 |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Ending periods in exception messages deleted https://review.openstack.org/103852 | 17:11 |
| morganfainberg | LOL | 17:11 |
| morganfainberg | good to know | 17:11 |
| dolphm | morganfainberg: http://www.zetaproducts.net/images/products/detail/16.frs.plaque.1.jpg | 17:11 |
| dolphm | morganfainberg: TC off only stays off for like 15 seconds if you just push it. VSC sport just increases the threshold for stability control, but it still kicks in too early... unless maybe it's wet out | 17:12 |
| *** hrybacki has joined #openstack-keystone | 17:13 | |
| *** leseb has joined #openstack-keystone | 17:13 | |
| *** praneshp has joined #openstack-keystone | 17:14 | |
| raildo | morganfainberg: ping | 17:19 |
| morganfainberg | raildo, pong | 17:19 |
| raildo | morganfainberg: I can bother you with my problems about inherited roles now? = P | 17:20 |
| morganfainberg | raildo, absolutely | 17:20 |
| morganfainberg | raildo if we get too deep in i might ask for a coffee break, but otherwise i'm good. | 17:20 |
| raildo | hahaha ok | 17:20 |
| raildo | I was discussing at the meeting of hierarchical multitenancy about inherited roles, and we noticed two possible modifications required in the current implementation: | 17:21 |
| raildo | 1- Currently the inherited role is applied to a domain and is expanded to all projects associated with this domain, I believe that it should be possible to a role be inherited only a part of the hierarchy. for example: I have a hierarchy: domain1.projA.projB.projC, I would like a role that was associated with projB was inherited to projC, but that will not happen. I have to apply to the role projB for domain1 and all projects (up to the | 17:21 |
| raildo | 2- It would be possible to create "private project"? Ie, a inherited role is throughout the hierarchy, but I wish that a role does not have access to a specific project. Is this acceptable? | 17:22 |
| *** amcrn has joined #openstack-keystone | 17:23 | |
| morganfainberg | raildo, we actually talked about this at the summit | 17:23 |
| morganfainberg | raildo, i think we said that a project would have a "no-inherit flag" and anything under that project would get no inheritance from above it | 17:24 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: multi-backend support for identity https://review.openstack.org/74214 | 17:24 |
| morganfainberg | raildo, but nothing prevents that project from providing inheritance for roles to it's children again | 17:24 |
| raildo | ok | 17:25 |
| morganfainberg | raildo, and i actually like that model a lot. it lets us handle the reseller use case | 17:26 |
| morganfainberg | raildo, which was a big part of that discussion | 17:26 |
| raildo | this was my question, looking for a good way to work with resellers. | 17:27 |
| morganfainberg | raildo, there ya go, generally speaking the keystone team seemed to like that approach, where the project would prevent inheritance from above, but could provide inheritance to it's children | 17:29 |
| *** leseb has quit IRC | 17:30 | |
| *** leseb has joined #openstack-keystone | 17:31 | |
| raildo | sounds good to me | 17:32 |
| raildo | morganfainberg: and in relation to a private project, the project may prohibit his father to access it? | 17:33 |
| morganfainberg | raildo, the private project would prevent all inheritance, if a user needs access to the private project (or it's children) an explicit role will need to be granted to that user | 17:34 |
| morganfainberg | raildo, this doesn't stop a cloud admin from doing administrative stuff as needed. | 17:35 |
| *** leseb has quit IRC | 17:35 | |
| morganfainberg | raildo, but explicit grants would be needed on the private project, just like any other project would work. | 17:36 |
| morganfainberg | (non inherited) | 17:36 |
| morganfainberg | bknudson, mind re +2ing https://review.openstack.org/#/c/104037/ | 17:37 |
| bknudson | morganfainberg: oh, it's split out that's why I couldn't find it | 17:41 |
| *** dstanek is now known as dstanek_lunch | 17:41 | |
| morganfainberg | bknudson, hehe yeah | 17:41 |
| bknudson | wish we had tests for ec2_token | 17:42 |
| bknudson | I'm not going to +2 it. | 17:42 |
| raildo | morganfainberg: yes i agree with you but what was discussed was: a project has a role inherited to a child, but for some reason, I want this parent project (inheritable) has no access to child project. Ie disable the inherited role for a specif project. | 17:42 |
| morganfainberg | raildo, what is that use-case | 17:43 |
| morganfainberg | raildo, i am concerned it will get too complex if we explicitly need to list "roles that can or can't inherit" to this specific project | 17:44 |
| bknudson | morganfainberg: had a couple of comments on https://review.openstack.org/#/c/104037/ | 17:44 |
| morganfainberg | raildo, rather than a hard "no inheritance from parents" and just assign explicit grants across. | 17:44 |
| morganfainberg | bknudson, damn it, i thought i fixed those :P | 17:45 |
| morganfainberg | bknudson, yeah bad search/replace on iniital pass | 17:45 |
| morganfainberg | bknudson, thanks! | 17:45 |
| *** leseb has joined #openstack-keystone | 17:45 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Privatize Everything https://review.openstack.org/104037 | 17:47 |
| dolphm | bknudson: i reviewed the first patch by just making sure that every change was just adding underscores to stuff #fail | 17:49 |
| *** openstackgerrit has quit IRC | 17:49 | |
| dolphm | and that unit tests passed :) | 17:49 |
| *** openstackgerrit has joined #openstack-keystone | 17:49 | |
| dolphm | first time i've run tests on openstack/keystonemiddleware :D | 17:49 |
| *** leseb has quit IRC | 17:50 | |
| bknudson | I'm not looking forward to rebasing my refactoring changes, but it should be obvious what the change is | 17:50 |
| raildo | morganfainberg: The use case I see for this is. I have a company that will be a sub-project of a hierarchy. For some NDA, a parent project should not access this project. So even this project has a role inherited from father to other children, he can not access this project. | 17:51 |
| morganfainberg | raildo, i'm not seeing the value add where you wouldn't just use the no-inherit flag | 17:52 |
| morganfainberg | raildo, there is no reason you couldn't have multiple uses of no-inherit in the tree | 17:53 |
| morganfainberg | raildo, W -> X -> Y (no inherit, X's roles don't inherit to Y) -> Z -> Q (no inherit, Z's roles don't inherit to Q) -> R | 17:54 |
| morganfainberg | raildo, the way i see it is a "private / no-inherit flagged" project inherits nothing from above it. | 17:54 |
| *** marcoemorais has joined #openstack-keystone | 17:55 | |
| *** marcoemorais has quit IRC | 17:56 | |
| *** marcoemorais has joined #openstack-keystone | 17:56 | |
| dolphm | morganfainberg: project.private = True | 17:58 |
| morganfainberg | dolphm, ++ | 17:58 |
| *** marcoemorais1 has quit IRC | 17:58 | |
| *** daneyon_ has joined #openstack-keystone | 17:59 | |
| *** daneyon has quit IRC | 18:01 | |
| dolphm | morganfainberg: raildo: stopping RBAC going down the hierarchy at private projects seems intuitive, but the sharing of resources owned by projects high in the hierarchy is a more interesting question IMO. | 18:02 |
| bknudson | stevemar: the oauth response in the tests makes no sense to me... the content-type is 'application/x-www-urlformencoded', but then it looks like it returns a JSON string with the url params | 18:02 |
| dolphm | morganfainberg: raildo: can a glance image owned by the a parent project be used by all projects in the underlying hierarchy, regardless of privacy? | 18:02 |
| bknudson | '"oauth_token=687262bff3e9480cac7f3f08ffb5afa6&oauth_token_secret=a3b4d9a87e214b7fa2635b219c8fe18b&oauth_expires_at=2014-07-03T02:01:13.417012Z"' | 18:03 |
| dolphm | bknudson: is that formencoded and then json encoded? | 18:04 |
| morganfainberg | dolphm, very good question, don't remember if we covered that | 18:04 |
| bknudson | dolphm: that's what it looks like | 18:04 |
| bknudson | I don't know how to use oauth on keystone, otherwise I'd try it | 18:04 |
| bknudson | I'm just looking at the tests | 18:05 |
| stevemar | bknudson, sec, looking something up | 18:05 |
| dolphm | bknudson: i got in touch with another group of folks from fidelity mutual that have implemented hierarchical multitenancy before... and were looking to get the same out of openstack | 18:05 |
| dolphm | err morganfainberg: ^ | 18:05 |
| *** packet has quit IRC | 18:06 | |
| stevemar | bknudson, so it's set here: https://github.com/openstack/keystone/blob/master/keystone/contrib/oauth1/controllers.py#L225 | 18:06 |
| bknudson | stevemar: the problem is that render_response overrides it | 18:06 |
| bknudson | stevemar: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/wsgi.py#n609 | 18:07 |
| bknudson | I don't know what's supposed to happen if you have 2 Content-Types in the headers. | 18:08 |
| *** jdennis has quit IRC | 18:08 | |
| stevemar | bknudson, you said that you're not even seeing the urlencoded one anyway? | 18:09 |
| *** jdennis has joined #openstack-keystone | 18:09 | |
| bknudson | stevemar: the response has '"oauth_token=687262bff3e9480cac7f3f08ffb5afa6&oauth_token_secret=a3b4d9a87e214b7fa2635b219c8fe18b&oauth_expires_at=2014-07-03T02:01:13.417012Z"' | 18:10 |
| bknudson | stevemar: I think we were discussing the request content before. | 18:10 |
| raildo | dolphm: Actually I'm not advocating this idea at the meeting were discussing this idea if it would be possible to create a private project, so I wanted to bring here, to know your opinions. | 18:10 |
| stevemar | bknudson, right. | 18:11 |
| raildo | But I believe if I determine that a project is private. It should work as it was not part of the hierarchy. therefore, this glance image is not inherited. | 18:11 |
| bknudson | stevemar: I'd expect a urlencoded response to be oauth_token=687262bff3e9480cac7f3f08ffb5afa6&oauth_token_secret=a3b4d9a87e214b7fa2635b219c8fe18b&oauth_expires_at=2014-07-03T02:01:13.417012Z | 18:11 |
| bknudson | not "oauth_token=687262bff3e9480cac7f3f08ffb5afa6&oauth_token_secret=a3b4d9a87e214b7fa2635b219c8fe18b&oauth_expires_at=2014-07-03T02:01:13.417012Z" | 18:12 |
| bknudson | there shouldn't be quotes around it | 18:12 |
| stevemar | bknudson, we could change render response, or just use webob.Response at the oauth controller level | 18:13 |
| bknudson | stevemar: I'm working on changing render_response to not set the content-type if it's already set... maybe webob.Response is the better way to go | 18:14 |
| bknudson | because render_response will also JSON-encode | 18:14 |
| bknudson | but this is a change to the oauth response if it's not going to put "" around the response | 18:14 |
| stevemar | bknudson, yeah, would have to change some client code | 18:15 |
| bknudson | ok, so you think it's correct to not have "" around the response body? If so I'll fix it since I'm looking at the code anyways | 18:15 |
| *** hrybacki has quit IRC | 18:16 | |
| stevemar | bknudson, i believe thats the way to go, render_response was over-riding it | 18:17 |
| bknudson | stevemar: ok, I'll keep working on it | 18:18 |
| stevemar | bknudson, i'll make some changes to api-spec and client, did you open a bug? | 18:18 |
| bknudson | stevemar: I didn't open a bug | 18:18 |
| bknudson | the api-spec says it returns a string? | 18:19 |
| bknudson | a JSON string? | 18:19 |
| *** packet has joined #openstack-keystone | 18:19 | |
| dolphm | raildo: that's my intuition as well... but the use cases seem to get complicated enough that we need to consider that to be an option :( | 18:20 |
| dolphm | raildo: we also talked about the parent project's visibility into the resources consumed by a private child hierarchy... like, the parent project should be able to see aggregated quota, for example, but not specifics | 18:22 |
| raildo | dolphm: ++ | 18:22 |
| raildo | dolphm: one guy on CERN is Implementing this part of quotas (and its visibility) in Nova. So far it seems to me is being well implemented. | 18:25 |
| bknudson | stevemar: the spec looks correct -- https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-oauth1-ext.md#supported-signature-methods-hmac-sha1-1 | 18:26 |
| bknudson | Looks like policies also has an issue with content-type in response. | 18:32 |
| stevemar | bknudson, yay not alone! | 18:34 |
| bknudson | nobody uses policies though | 18:34 |
| *** dims__ has quit IRC | 18:37 | |
| *** jsavak has joined #openstack-keystone | 18:40 | |
| rodrigods | anyone has thoughts about http://lists.openstack.org/pipermail/openstack-dev/2014-July/039115.html? =) | 18:41 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Privatize Everything https://review.openstack.org/104037 | 18:42 |
| dolphm | rodrigods: i've read it, but i was sort of confused about why domain-level role inheritance to projects didn't already solve the problem - or maybe i'm misunderstanding the use case? | 18:43 |
| *** joesavak has quit IRC | 18:44 | |
| *** joesavak has joined #openstack-keystone | 18:44 | |
| *** jsavak has quit IRC | 18:47 | |
| *** dims__ has joined #openstack-keystone | 18:47 | |
| morganfainberg | dolphm, i swear we're going to get middleware out the door :P | 18:48 |
| *** hrybacki has joined #openstack-keystone | 18:50 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: multi-backend support for identity https://review.openstack.org/74214 | 18:52 |
| *** dstanek_lunch is now known as dstanek_lunch_zz | 18:55 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: Simplified Mapping for Federated Authentication https://review.openstack.org/100280 | 18:56 |
| *** harlowja is now known as harlowja_away | 18:59 | |
| *** dstanek_lunch_zz is now known as dstanek | 18:59 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: reengineered-federation https://review.openstack.org/104301 | 19:00 |
| *** harlowja_away is now known as harlowja | 19:03 | |
| *** marcoemorais has quit IRC | 19:04 | |
| *** marcoemorais has joined #openstack-keystone | 19:05 | |
| *** marcoemorais has quit IRC | 19:05 | |
| *** marcoemorais has joined #openstack-keystone | 19:05 | |
| dstanek | stevemar: are you still looking into the dox thing? | 19:09 |
| stevemar | dstanek, i've alerted the necessary folk | 19:09 |
| stevemar | dstanek, they are all over it | 19:09 |
| dolphm | morganfainberg: some day! do we have any reason to wait until next week, at least to default to keystonemiddleware everywhere? | 19:11 |
| *** designated has joined #openstack-keystone | 19:12 | |
| dolphm | morganfainberg: i.e. release this week, and then wait to use it beginning of next week? | 19:12 |
| dolphm | is there a newer reference for this somewhere? https://wiki.openstack.org/wiki/LoggingStandards | 19:12 |
| morganfainberg | dolphm, well we need to still get it into global reqs | 19:12 |
| designated | I asked in #openstack-ceilometer but no one is active. Anyone aware of an auth issue with ceilometer-api 2014.1-0ubuntu1.1? just getting the following in ceilometer-api.log WARNING keystoneclient.middleware.auth_token [-] Unable to find authentication token in headers. I have verified configuration is correct multiple times, even recreated the user in keystone. All other services are authenticating just fine against keyst | 19:12 |
| designated | one. | 19:12 |
| dolphm | designated: do you have auth_token in your middleware pipeline twice or something? | 19:13 |
| designated | dolphm, doubtful, but I will check. | 19:13 |
| morganfainberg | dolphm, i figure we release today, get it into global reqs and push on the making it the default (propose changes/get bknudson's changes check/gate) next week | 19:14 |
| morganfainberg | erm, global reqs this week | 19:14 |
| *** nkinder_ has quit IRC | 19:14 | |
| *** leseb has joined #openstack-keystone | 19:14 | |
| morganfainberg | other changes next week / beyond | 19:14 |
| bknudson | I'll have to rebase my changes on the proposal bots | 19:15 |
| afaranha1 | About the inherited_to_projects options in keystone, is there any example on how to use it? | 19:15 |
| dolphm | morganfainberg: ++ | 19:15 |
| afaranha1 | I'm trying to use it but it's not working | 19:15 |
| dolphm | afaranha1: how are you testing whether it's working or not? | 19:16 |
| afaranha1 | dolphm: I enabled the [os_inherit], than created a new domain, a project in this domain, a user in this project and domain and a role | 19:17 |
| designated | dolphm, if you're referring to the [keystone_authtoken] section, there is only one. I followed this guide: http://docs.openstack.org/icehouse/install-guide/install/apt/content/ceilometer-install.html | 19:17 |
| dolphm | designated: can you share your ceilometer paste ini? | 19:17 |
| afaranha1 | after I assign the user to the domain with the role created | 19:17 |
| afaranha1 | than the user to project | 19:18 |
| dstanek | stevemar: cool, that saves me from setting up a doc environment again | 19:18 |
| bknudson | afaranha1: I think there's a config option to enable ti | 19:18 |
| afaranha1 | after this I log as the new user and run the command: PUT localhost:35357/v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/{role_id}/inherited_to_projects | 19:18 |
| afaranha1 | bknudson: Yes, in keystone.conf, I enabled the inherit to true, "[os_inherit] \n enabled = true" | 19:19 |
| dolphm | afaranha1: instead of assigning a role to the user on the domain, you only need to make the PUT call that you just pasted | 19:19 |
| dolphm | afaranha1: but that wouldn't break anything (it's just not necessary) | 19:20 |
| designated | dolphm, there is no ceilometer paste ini, only ceilometer.conf | 19:20 |
| afaranha1 | and restart the keystone, but the table "assignment" keep the value 0 in the "inherited" column | 19:20 |
| dolphm | afaranha1: you do need to set [os_inherit] enabled=true in keystone.conf | 19:20 |
| dolphm | designated: does ceilometer.conf have pipeline configuration? | 19:21 |
| afaranha1 | dolphm: I set it, and also restarted keystone service | 19:21 |
| dolphm | designated: the github source has a paste config https://github.com/openstack/ceilometer/blob/master/etc/ceilometer/api_paste.ini | 19:21 |
| dolphm | designated: you might have it setup differently, i suppose? | 19:22 |
| dolphm | afaranha1: alright, then you just need to request a token for any project in that domain. you should receive the role inherited from the domain in the resulting token | 19:22 |
| designated | dolphm, there is a pipeline.yaml but nothing about authentication in there | 19:22 |
| bknudson | stevemar: did you open a bug for the OAuth 1 response content type? If not I'll open one | 19:22 |
| openstackgerrit | Andreas Jaeger proposed a change to openstack/identity-api: Update to clouddocs-maven-plugin 2.1.1 https://review.openstack.org/104310 | 19:23 |
| designated | dolphm, i followed the most current guide: http://docs.openstack.org/icehouse/install-guide/install/apt/content/ceilometer-install.html. everything is configured in ceilometer.conf | 19:23 |
| dolphm | designated: i'm looking at that file now... i have *no* idea what that is for, but i'm not too familiar with ceilometer | 19:23 |
| dolphm | designated: that's definitely not a paste pipeline | 19:23 |
| dolphm | designated: is there a [pipeline:main] in your ceilometer.conf ? | 19:24 |
| afaranha1 | The problem is that I don't receive it. I receive an empty list when running: GET localhost:35357/v3/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/inherited_to_projects , also in mysql the table "assignment" has all its values in column "inherited" set to 0. | 19:24 |
| stevemar | bknudson, https://bugs.launchpad.net/keystone/+bug/1336910 | 19:25 |
| uvirtbot | Launchpad bug 1336910 in keystone "oauth1 response content type" [Undecided,New] | 19:25 |
| bknudson | thanks! | 19:26 |
| designated | dolphm, no | 19:26 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Modify oauth calls to expect urlencoded responses https://review.openstack.org/104320 | 19:27 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix OAuth1 to not JSON-encode create access token response https://review.openstack.org/104321 | 19:27 |
| stevemar | bknudson, just uploaded mine too ^ | 19:28 |
| bknudson | stevemar: can you try out the fixed client with my change? | 19:29 |
| stevemar | bknudson, mmm, sure let me try, leaving in a bit, but if i don't finish setting everything up i'll continue at night | 19:30 |
| bknudson | no problem | 19:30 |
| *** sigmavirus24 has joined #openstack-keystone | 19:31 | |
| bknudson | stevemar: https://bugs.launchpad.net/keystone/+bug/1336910 -- kind of weird that it assigned keystone to me for your change to keystoneclient | 19:33 |
| uvirtbot | Launchpad bug 1336910 in keystone "oauth1 response content type" [Undecided,New] | 19:33 |
| *** dims__ has quit IRC | 19:33 | |
| stevemar | bknudson, hmph, that is weird | 19:34 |
| * stevemar shrugs | 19:34 | |
| *** leseb has quit IRC | 19:38 | |
| *** leseb has joined #openstack-keystone | 19:38 | |
| rodrigods | dolphm, regarding what said about the email.... yeah... i think we need to think more about it (to stand up for or to abandon) =) | 19:39 |
| *** hrybacki has quit IRC | 19:42 | |
| *** leseb has quit IRC | 19:43 | |
| *** dims has joined #openstack-keystone | 19:44 | |
| morganfainberg | bknudson, dolphm, https://review.openstack.org/#/c/104037/ just cleared check, should be good to go | 19:46 |
| morganfainberg | dolphm, we might need https://review.openstack.org/#/c/104208/ before we release too | 19:48 |
| *** dims_ has joined #openstack-keystone | 19:48 | |
| *** praneshp has quit IRC | 19:49 | |
| *** leseb has joined #openstack-keystone | 19:49 | |
| *** dims has quit IRC | 19:49 | |
| *** marcoemorais has quit IRC | 19:52 | |
| *** marcoemorais has joined #openstack-keystone | 19:52 | |
| *** praneshp has joined #openstack-keystone | 19:54 | |
| *** dims_ has quit IRC | 19:54 | |
| *** dims has joined #openstack-keystone | 19:54 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Calculate a suitable column width for positional arguments https://review.openstack.org/97873 | 19:58 |
| *** dims_ has joined #openstack-keystone | 19:58 | |
| *** mberlin has quit IRC | 19:59 | |
| *** dims has quit IRC | 20:00 | |
| *** marcoemorais has quit IRC | 20:01 | |
| *** marcoemorais has joined #openstack-keystone | 20:02 | |
| *** marcoemorais has quit IRC | 20:02 | |
| *** marcoemorais has joined #openstack-keystone | 20:02 | |
| *** marcoemorais has quit IRC | 20:03 | |
| *** marcoemorais has joined #openstack-keystone | 20:03 | |
| dstanek | morganfainberg: is your work to get Keystone behind Apache in devstack up for review? | 20:04 |
| morganfainberg | dstanek, https://review.openstack.org/#/c/101611/ is needed | 20:04 |
| *** joesavak has quit IRC | 20:04 | |
| morganfainberg | dstanek, https://review.openstack.org/#/c/104026/ [and tempest fixes (not done yet, pendin g ML topic)] | 20:05 |
| *** dims_ has quit IRC | 20:05 | |
| morganfainberg | dstanek, and then https://review.openstack.org/#/c/100747/ | 20:05 |
| *** marcoemorais has quit IRC | 20:05 | |
| *** joesavak has joined #openstack-keystone | 20:05 | |
| dolphm | morganfainberg: that breaks APACHE_ENABLED_SERVICES? | 20:05 |
| *** marcoemorais has joined #openstack-keystone | 20:05 | |
| morganfainberg | dolphm, APACHE_ENABLED_SERVICES is gone | 20:06 |
| morganfainberg | dolphm, each service goes back to it's own toggle | 20:06 |
| *** jsavak has joined #openstack-keystone | 20:06 | |
| dolphm | morganfainberg: what's the benefit of that specific change? | 20:06 |
| morganfainberg | dolphm, it lets us control from devstack-gate more easily the services gated under apache | 20:06 |
| *** dims has joined #openstack-keystone | 20:06 | |
| morganfainberg | dolphm, it also makes it so someone setting APACHE_ENABLED_SERVICES=swift doesn't break keystone's deployment | 20:07 |
| morganfainberg | because they forgot the + | 20:07 |
| morganfainberg | or a comma | 20:07 |
| morganfainberg | dolphm, there is also a global that tells devstack 'use apache for any services that perfers to run under mod_Wsgi' | 20:09 |
| *** harlowja is now known as harlowja_away | 20:09 | |
| dstanek | very, cool - just grabbed all of the patches - thanks morganfainberg | 20:09 |
| *** joesavak has quit IRC | 20:10 | |
| morganfainberg | dstanek, sure thing. | 20:10 |
| morganfainberg | dstanek, don't try and run tempest on the keystone one :P it will fail in ~3 trust checks looking for a 204 | 20:10 |
| *** thedodd has joined #openstack-keystone | 20:10 | |
| dstanek | morganfainberg: i'm ok the just 3 failures - i'm sure i'l cause much more as i muck around | 20:10 |
| morganfainberg | dstanek, hehe | 20:11 |
| morganfainberg | dolphm, dstanek, I'll start proposing the fixes for tempest next week if the ML doesn't seem too upset about it. unless there is a reason not to change 204 -> 200 in those cases | 20:13 |
| bknudson | morganfainberg: that tempest change is going to be complicated since it has to support old releases, too | 20:13 |
| morganfainberg | bknudson, tempest has gone branchless? | 20:13 |
| bknudson | y | 20:13 |
| *** radez is now known as radez_g0n3 | 20:13 | |
| dstanek | bknudson: really? | 20:13 |
| morganfainberg | bknudson, then we will just need to accept 204 or 200 in that case | 20:13 |
| morganfainberg | bknudson, both are legitimately valid then | 20:14 |
| bknudson | sdague didn't like it when I tried that earlier | 20:14 |
| bknudson | but we didn't have branchless tempest then | 20:14 |
| morganfainberg | i'll fight that with him when he complains :) | 20:14 |
| *** mberlin has joined #openstack-keystone | 20:15 | |
| morganfainberg | and tempest failed... for middleware merge *grumble* | 20:15 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Expose an entry point to list auth_token middleware config options https://review.openstack.org/104208 | 20:15 |
| dstanek | do you know what release you are running against so you can make the checks more precise? morganfainberg bknudson | 20:15 |
| bknudson | I'm not sure but I think tempest will know the release | 20:16 |
| bknudson | it's got all sorts of options | 20:16 |
| bknudson | so there could be a specific option for whether it has this bug fix or not | 20:16 |
| dstanek | i wonder what the record is for +1s before and +2s | 20:17 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Expose an entry point to list auth_token middleware config options https://review.openstack.org/104208 | 20:21 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Expose an entry point to list auth_token middleware config options https://review.openstack.org/104208 | 20:23 |
| morganfainberg | bknudson, ^ should solve your comment on the tests | 20:24 |
| morganfainberg | dolphm, the 2 approved make stuff private in middleware and that one ^ should be the last of what is needed bfefore we can release | 20:25 |
| bknudson | morganfainberg: thanks! | 20:26 |
| *** achampion has quit IRC | 20:30 | |
| stevemar | bknudson, OK, verified it, it looks solid | 20:33 |
| stevemar | bknudson, i noticed one thing funny though, i couldn't run it under apache, the oauth headers were all garbled up | 20:33 |
| stevemar | just flat out missing | 20:33 |
| dolphm | stevemar: which headers? | 20:34 |
| stevemar | dolphm, the ones generated by oauthlib | 20:34 |
| bknudson | awesome, thanks! | 20:35 |
| * morganfainberg is off to get breakfast^wlunch^late lunch | 20:35 | |
| *** harlowja_away is now known as harlowja | 20:39 | |
| dolphm | morganfainberg: odd... python setup.py develop is failing in keystonemiddleware for me, but install -> develop works | 20:39 |
| *** topol has quit IRC | 20:40 | |
| morganfainberg | dolphm, *blink* | 20:40 |
| morganfainberg | dolphm, really? | 20:40 |
| dolphm | http://pasteraw.com/h9c4xhu31yid18vzvcifgyh5nkkh2x9 | 20:40 |
| dolphm | morganfainberg: ^ | 20:40 |
| bknudson | worked for me | 20:41 |
| morganfainberg | wheels | 20:41 |
| dolphm | morganfainberg: full log with develop -> install -> develop http://pasteraw.com/au716v3kh8qtf0hlyha4zo1r91r5r8r | 20:41 |
| bknudson | Searching for six==1.7.2 | 20:41 |
| bknudson | I got six==1.7.2 not 1.7.3 | 20:41 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes a Python3 syntax error https://review.openstack.org/102734 | 20:42 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds several more test modules that pass on Py3 https://review.openstack.org/102735 | 20:42 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds a fork of python-ldap for Py3 testing https://review.openstack.org/95827 | 20:42 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes test_exceptions.py for Python3 https://review.openstack.org/102737 | 20:42 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes test_wsgi for Python3 https://review.openstack.org/102736 | 20:42 |
| morganfainberg | yeah the issue is six 1.7.3 is wheels i think | 20:42 |
| morganfainberg | pip handles this fine | 20:43 |
| morganfainberg | setup develop doesn't | 20:43 |
| dolphm | oooh | 20:43 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix OAuth1 to not JSON-encode create access token response https://review.openstack.org/104321 | 20:43 |
| morganfainberg | dolphm, pip install -e . | 20:43 |
| morganfainberg | dolphm, -e does the same as develop | 20:43 |
| dolphm | morganfainberg: that worked | 20:43 |
| bknudson | stevemar: ^ should fix the pep8 issues | 20:43 |
| dolphm | morganfainberg: in a new venv | 20:43 |
| morganfainberg | yep. i ran into the same issue with a clean venv you were having | 20:44 |
| *** stevemar has quit IRC | 20:47 | |
| *** nkinder_ has joined #openstack-keystone | 20:50 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone-specs: JSON Home https://review.openstack.org/97359 | 20:53 |
| *** dims has quit IRC | 20:55 | |
| *** hrybacki has joined #openstack-keystone | 20:58 | |
| *** henrynash has quit IRC | 20:59 | |
| *** dims has joined #openstack-keystone | 21:00 | |
| *** mrda_away is now known as mrda | 21:02 | |
| *** gokrokve has quit IRC | 21:06 | |
| *** arosen has joined #openstack-keystone | 21:06 | |
| arosen | Hi, wondering what's the difference between these two in the body when posting to /v2.0/tokens | 21:07 |
| arosen | -d '{"auth": {"tenantName": "demo", "passwordCredentials": {"username": "demo", "password": "password"}}}' | 21:07 |
| arosen | -d '{"auth": {"passwordCredentials": {"username": "demo", "password": "password"}}}' | 21:08 |
| arosen | They seem to return different things | 21:08 |
| *** gokrokve has joined #openstack-keystone | 21:08 | |
| bknudson | arosen: the first one requests a token scoped to the "demo" project" | 21:09 |
| bknudson | arosen: the second one doesn't request a scope so it could use the user's default project or no project | 21:09 |
| bknudson | (unscoped) | 21:09 |
| arosen | bknudson: thanks. I'm trying to write a client that integrates with keystone but I keep getting a scoped token back which doesn't contain the endpoints. | 21:11 |
| arosen | bknudson: I'm doing: auth = keystoneclient.auth.identity.v2.Password(auth_url, username, password) | 21:11 |
| bknudson | arosen: it's got roles but no endpoints? | 21:11 |
| arosen | session = keystoneclient.session.Session(auth=auth) | 21:12 |
| arosen | yea it returns: | 21:12 |
| bknudson | arosen: do you want an unscoped token? | 21:12 |
| arosen | {"serviceCatalog": [], "user": {"username": "demo", "roles_links": [], "id": "c25be5e9236246babdd316fdd369444a", "roles": [], "name": "demo"}, "metadata": {"is_admin": 0, "roles": []}}} | 21:12 |
| bknudson | arosen: that doesn't have any roles | 21:12 |
| arosen | right, so it looks like i need to get an unscoped token to get this info | 21:13 |
| bknudson | arosen: you need a scoped token | 21:13 |
| *** dims_ has joined #openstack-keystone | 21:13 | |
| *** dims has quit IRC | 21:15 | |
| bknudson | arosen: you should be able to pass in a tenant_name to keystoneclient.auth.identity.v2.Password | 21:15 |
| arosen | bknudson: then i'm passing that session variable to : SessionClient(session, ath=None, interface='publicURL', ...) | 21:15 |
| *** lbragstad_ is now known as lbragstad | 21:17 | |
| arosen | bknudson: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/identity/v2.py#L78 | 21:17 |
| *** gabriel-bezerra has quit IRC | 21:17 | |
| arosen | ah sorry i see i can pass that. The base class takes tenant_name. | 21:17 |
| bknudson | arosen: the docs are terrible. | 21:18 |
| *** gyee has quit IRC | 21:18 | |
| *** dims_ has quit IRC | 21:18 | |
| arosen | bknudson: okay i got it working making auth this: | 21:19 |
| arosen | auth = keystoneclient.auth.identity.v2.Password( auth_url=instance._auth_url, username=instance._username, password=instance._password, tenant_name=instance._project_name) | 21:19 |
| *** afaranha1 has quit IRC | 21:20 | |
| arosen | bknudson: it seems kind of confusing that project_name == tenant_name but I guess that's from times when nova used project_name so we don't have consistent naming? | 21:20 |
| bknudson | arosen: I'm surprised that the v2 plugin doesn't accept project_name. | 21:20 |
| *** rodrigods has quit IRC | 21:21 | |
| openstackgerrit | A change was merged to openstack/keystone: Ensure that in v2 auth tenant_id matches trust https://review.openstack.org/104216 | 21:22 |
| *** afaranha has joined #openstack-keystone | 21:22 | |
| *** d34dh0r53 has joined #openstack-keystone | 21:23 | |
| *** dims has joined #openstack-keystone | 21:31 | |
| *** daneyon_ has quit IRC | 21:32 | |
| *** daneyon has joined #openstack-keystone | 21:32 | |
| *** hrybacki has quit IRC | 21:34 | |
| *** ukalifon has quit IRC | 21:38 | |
| *** rodrigods has joined #openstack-keystone | 21:40 | |
| *** gabriel-bezerra has joined #openstack-keystone | 21:44 | |
| *** leseb has quit IRC | 21:49 | |
| *** leseb has joined #openstack-keystone | 21:50 | |
| *** leseb has quit IRC | 21:54 | |
| *** jamielennox|away is now known as jamielennox | 21:55 | |
| jamielennox | bknudson: it could take project_id/name, but in v2 it was called tenant so i left it consistent - it's pretty easy to add | 22:04 |
| *** elmiko is now known as _elmiko | 22:06 | |
| *** rodrigods_ has joined #openstack-keystone | 22:08 | |
| *** bobt has quit IRC | 22:11 | |
| *** jsavak has quit IRC | 22:11 | |
| *** d34dh0r53 is now known as mostly_d34dh0r53 | 22:16 | |
| *** bklei has joined #openstack-keystone | 22:25 | |
| *** richm has quit IRC | 22:26 | |
| *** otwieracz has quit IRC | 22:33 | |
| *** otwieracz has joined #openstack-keystone | 22:34 | |
| *** rodrigods_ has quit IRC | 22:36 | |
| *** jdennis has quit IRC | 22:42 | |
| *** bklei has quit IRC | 22:44 | |
| *** david-lyle has quit IRC | 22:53 | |
| *** david-lyle has joined #openstack-keystone | 22:54 | |
| *** david-lyle has quit IRC | 22:59 | |
| *** amcrn has quit IRC | 23:04 | |
| *** amcrn has joined #openstack-keystone | 23:05 | |
| *** sigmavirus24 has quit IRC | 23:08 | |
| *** rodrigods_ has joined #openstack-keystone | 23:08 | |
| *** rodrigods_ has quit IRC | 23:11 | |
| openstackgerrit | A change was merged to openstack/keystone: Ending periods in exception messages deleted https://review.openstack.org/103852 | 23:21 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Privatize Everything https://review.openstack.org/104037 | 23:22 |
| *** amerine has quit IRC | 23:31 | |
| *** thedodd has quit IRC | 23:31 | |
| *** gyee has joined #openstack-keystone | 23:33 | |
| *** oomichi has joined #openstack-keystone | 23:45 | |
| arosen | bknudson: do you know if any docs or pointers exist about integrating a new project with keystone? I got my client now passing the auth_token to my server. | 23:52 |
| arosen | Looking to add the keystone middleware server bits now. | 23:52 |
| arosen | looks like things happen via the magic api-paste.ini :) | 23:53 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/identity-api: Updated from global requirements https://review.openstack.org/104383 | 23:54 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/104018 | 23:54 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
