Monday, 2014-07-14

« Sunday, 2014-07-13 Index Tuesday, 2014-07-15 »
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Use jsonutils to load adapter response  https://review.openstack.org/10506500:06
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter  https://review.openstack.org/9768100:06
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Add the 'auth' interface type  https://review.openstack.org/10473400:06
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Test that tenant list function can use auth_url  https://review.openstack.org/10477000:06
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Change unscoped token fallback to be session aware  https://review.openstack.org/10477100:06
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Add v2 Token manager authenticate tests  https://review.openstack.org/10476900:06
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Allow passing kwargs from managers to session  https://review.openstack.org/10665800:06
*** dims has joined #openstack-keystone00:24
*** dims has quit IRC00:28
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Convert httpretty to requests-mock  https://review.openstack.org/10665900:33
openstackgerritA change was merged to openstack/identity-api: Fix wrong json response body for paginated collections  https://review.openstack.org/10664400:37
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Provide an __all__ for auth module  https://review.openstack.org/10452900:37
*** xianghui has joined #openstack-keystone00:55
boris-42jamielennox btw what is your TZ01:19
boris-42jamielennox hi*01:19
*** dims has joined #openstack-keystone01:24
*** dims has quit IRC01:29
jamielennoxboris-42: hey01:48
jamielennoxUTC+1001:48
jamielennoxBrisbane/Australia01:48
boris-42jamielennox ah =)01:48
*** mberlin1 has joined #openstack-keystone01:59
*** mberlin has quit IRC01:59
*** diegows has quit IRC02:08
*** dims has joined #openstack-keystone02:17
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Convert httpretty to requests-mock  https://review.openstack.org/10665902:24
*** Chicago has joined #openstack-keystone02:53
*** morganfainberg_Z is now known as morganfainberg02:54
openstackgerritMarek Denis proposed a change to openstack/python-keystoneclient: Scope unscoped saml2 tokens.  https://review.openstack.org/9970403:16
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Convert httpretty to requests-mock  https://review.openstack.org/10665903:31
*** morganfainberg is now known as morganfainberg_Z03:41
*** topol has joined #openstack-keystone03:43
*** oomichi has quit IRC04:05
openstackgerritA change was merged to openstack/keystonemiddleware: Sync with oslo-incubator 569979adf  https://review.openstack.org/10399904:16
*** stevemar has quit IRC04:31
*** k4n0 has joined #openstack-keystone05:13
*** ajayaa has joined #openstack-keystone05:34
*** ukalifon has joined #openstack-keystone05:41
*** shausy has joined #openstack-keystone05:42
*** niteshselkari has quit IRC05:59
*** topol has quit IRC06:34
*** pheadron has joined #openstack-keystone06:38
*** afazekas|dst has joined #openstack-keystone06:39
*** mat-lowery_ has quit IRC07:08
*** mat-lowery has joined #openstack-keystone07:09
*** tomoiaga has joined #openstack-keystone07:18
*** afazekas|dst has quit IRC07:28
*** bvandenh has quit IRC07:37
*** tomoiaga has quit IRC07:44
*** tomoiaga has joined #openstack-keystone07:44
*** bvandenh has joined #openstack-keystone08:04
*** designated has quit IRC08:29
*** designated has joined #openstack-keystone08:29
*** alex_xu has joined #openstack-keystone08:34
*** Dafna has joined #openstack-keystone08:56
*** xianghui has quit IRC09:12
*** alex_xu has quit IRC09:16
*** jamielennox is now known as jamielennox|away09:17
*** xianghui has joined #openstack-keystone09:21
*** dims has quit IRC09:27
*** tristanC has quit IRC09:31
*** tristanC has joined #openstack-keystone09:32
*** pheadron has quit IRC09:39
*** dims_ has joined #openstack-keystone09:54
*** k4n0 has quit IRC09:57
*** dims_ has quit IRC09:58
openstackgerritKristy Siu proposed a change to openstack/keystone-specs: Adding support for Virtual Organisation Management  https://review.openstack.org/10576909:59
*** kwss has joined #openstack-keystone09:59
*** andreaf has quit IRC10:07
*** k4n0 has joined #openstack-keystone10:11
openstackgerritIlya Pekelny proposed a change to openstack/keystone: Use metadata.create_all() to fill a test database  https://review.openstack.org/9355810:15
openstackgerritIlya Pekelny proposed a change to openstack/keystone: Use metadata.create_all() to fill a test database  https://review.openstack.org/9355810:16
*** k4n0 has quit IRC10:35
*** dims_ has joined #openstack-keystone10:55
*** dims_ has quit IRC10:59
*** Dafna is now known as Dafna_away11:01
*** afazekas|dst has joined #openstack-keystone11:12
*** YorikSar has joined #openstack-keystone11:15
*** x1b2j has quit IRC11:16
*** dims_ has joined #openstack-keystone11:19
*** dims_ has quit IRC11:24
*** andreaf has joined #openstack-keystone11:25
*** kimj has joined #openstack-keystone11:34
*** kimj has quit IRC11:35
*** kimj has joined #openstack-keystone11:36
*** topol has joined #openstack-keystone11:47
*** dims_ has joined #openstack-keystone11:52
*** kwss has quit IRC11:59
*** kwss has joined #openstack-keystone12:04
*** Dafna_away is now known as Dafna12:06
*** diegows has joined #openstack-keystone12:14
*** radez_g0n3 is now known as radez12:22
*** dstanek_zzz is now known as dstanek12:27
openstackgerritMarek Denis proposed a change to openstack/python-keystoneclient: SAML2 wrapper plugin for full federation authN  https://review.openstack.org/10675112:43
openstackgerritAjaya Agrawal proposed a change to openstack/keystonemiddleware: Correct return code  https://review.openstack.org/10601012:46
*** chandankumar has joined #openstack-keystone12:48
*** bknudson has quit IRC12:50
*** shausy has quit IRC12:53
*** jdennis has joined #openstack-keystone12:58
*** alex_xu has joined #openstack-keystone12:58
*** afazekas|dst has quit IRC13:03
*** bknudson has joined #openstack-keystone13:12
*** joesavak has joined #openstack-keystone13:12
*** afazekas|dst has joined #openstack-keystone13:15
*** chandankumar has quit IRC13:18
*** chandankumar has joined #openstack-keystone13:18
*** andreaf has quit IRC13:34
*** andreaf has joined #openstack-keystone13:36
*** samuelmz_ has quit IRC13:41
*** afazekas|dst has quit IRC13:42
*** fifieldt has quit IRC13:45
*** packet has joined #openstack-keystone13:46
*** packet has quit IRC13:46
*** andreaf has quit IRC13:53
*** jdennis has quit IRC14:05
*** topol has quit IRC14:08
*** Redrtff has joined #openstack-keystone14:11
*** Redrtff has quit IRC14:14
*** daneyon has joined #openstack-keystone14:17
*** daneyon has quit IRC14:17
*** daneyon has joined #openstack-keystone14:18
openstackgerritMarek Denis proposed a change to openstack/python-keystoneclient: SAML2 ECP auth plugin  https://review.openstack.org/9216614:18
*** ajayaa has quit IRC14:24
afaranhaHi, do anybody knows where this functionality is implemented in keystone code GET /OS-INHERIT/domains/{domain_id}/groups/{group_id}/roles/inherited_to_projects ?14:27
*** ukalifon has quit IRC14:30
openstackgerrithenry-nash proposed a change to openstack/keystone-specs: Extension to provide a REST API to read configuration options  https://review.openstack.org/10655814:31
*** stevemar has joined #openstack-keystone14:39
*** david-lyle has joined #openstack-keystone14:40
*** kimj has quit IRC14:47
*** morganfainberg_Z is now known as morganfainberg14:51
*** dstanek is now known as dstanek_zzz14:53
*** jdennis has joined #openstack-keystone14:53
morganfainbergmornin14:54
*** thedodd has joined #openstack-keystone14:54
*** richm has joined #openstack-keystone14:55
marekdmorganfainberg: hey14:57
*** joesavak has quit IRC14:57
*** topol has joined #openstack-keystone15:00
*** dstanek_zzz is now known as dstanek15:00
openstackgerritMarek Denis proposed a change to openstack/python-keystoneclient: SAML2 ECP auth plugin  https://review.openstack.org/9216615:01
*** tomoiaga has quit IRC15:06
*** david-lyle has quit IRC15:12
*** afazekas has joined #openstack-keystone15:25
openstackgerritMarek Denis proposed a change to openstack/python-keystoneclient: Scope unscoped saml2 tokens.  https://review.openstack.org/9970415:29
*** david-lyle has joined #openstack-keystone15:30
*** afazekas has quit IRC15:42
stevemarmarekd, i'm going to try your ECP patch now :O15:45
marekdstevemar: lol15:45
stevemarmarekd, does your github repo have a script on how to use the plugin?15:48
marekdstevemar: it had for an old version :( I had sent you an email with the code a long time ago.15:50
marekdstevemar: basically the core didn't change.15:50
stevemarmarekd, OK, i have a script that runs that15:51
openstackgerrithenry-nash proposed a change to openstack/keystone-specs: Extension to provide a REST API to read configuration options  https://review.openstack.org/10655815:53
morganfainbergdolphm, i'm going to press "go" on https://review.openstack.org/#/c/106489/ unless there is a reason not to15:53
morganfainbergbknudson, ^ cc15:53
bknudsonmorganfainberg: what's there works for me.15:54
morganfainbergbknudson, cool.15:54
morganfainbergbknudson, we should definitely improve the catalog building, but that doesn't need to go specifically in there (heck, that might not even need a spec, since it is just internal improvement, bug only?)15:55
morganfainbergbknudson, stevemar, i want to check with you guys, but https://review.openstack.org/#/c/106010/ i don't think an ISE (http 500) is correct if the middleware cannot validate a token, it seems like that should _always_ be 401 (even if it's a keystone cant talke to the db issue)15:56
openstackgerritA change was merged to openstack/keystone-specs: standalone service catalog  https://review.openstack.org/10648915:57
morganfainbergbknudson, stevemar, unless it is legitimately a unhandled error in middleware (e.g. some bad thing that really is 'internal server error' not 'oh we can't talk to that external service)15:57
bknudsonmorganfainberg: seems more secure to use 401.15:57
bknudson(slightly)15:57
morganfainbergi'm thining less security, more "correctness" in this case. (the security benefit seems minimal between the two responses)15:58
stevemaryeah, 401 would be better if it can't validate the token15:58
bknudson503 Service Unavailable might make sense -- http://tools.ietf.org/html/rfc2616#section-10.5.415:58
morganfainberghm.15:59
*** david-lyle has quit IRC15:59
morganfainbergi still feel like it's 401, the token couldn't be validated.15:59
morganfainbergbut 503 is better than generic 500 for sure15:59
*** richm has quit IRC16:02
*** jaosorior has joined #openstack-keystone16:11
*** david-lyle has joined #openstack-keystone16:13
*** spandhe has joined #openstack-keystone16:15
*** richm has joined #openstack-keystone16:15
*** kwss has quit IRC16:22
*** richm has quit IRC16:26
*** andreaf has joined #openstack-keystone16:36
*** radez is now known as radez_g0n316:36
*** spandhe has quit IRC16:39
*** richm has joined #openstack-keystone16:40
*** andreaf has quit IRC16:40
*** spandhe has joined #openstack-keystone16:43
*** marcoemorais has joined #openstack-keystone16:47
*** richm has quit IRC16:49
*** dims_ has quit IRC16:50
*** dims_ has joined #openstack-keystone16:50
*** joesavak has joined #openstack-keystone16:52
*** andreaf has joined #openstack-keystone16:53
*** hyakuhei has joined #openstack-keystone16:56
*** marcoemorais has quit IRC16:59
*** marcoemorais has joined #openstack-keystone17:00
*** marcoemorais has quit IRC17:01
*** marcoemorais has joined #openstack-keystone17:01
*** harlowja_away is now known as harlowja17:03
*** chandankumar has quit IRC17:05
*** richm has joined #openstack-keystone17:07
*** dwaite has joined #openstack-keystone17:17
dwaitesuccessful hackathon?17:20
*** radez_g0n3 is now known as radez17:20
openstackgerritDolph Mathews proposed a change to openstack/keystonemiddleware: default to identity v3  https://review.openstack.org/10681917:25
dolphmdwaite: ++ i wrote a quick summary of things that i'll be expanding on this week http://dolphm.com/outcomes-from-the-openstack-keystone-hackathon-for-juno/17:27
dwaiteahh nice!17:29
dwaitere: ‘initiate federation protocol’ link , do you have any endpoints already to have horizon redirect the browser to keystone for auth?17:31
dwaite(back in 5)17:34
dolphmdwaite: no - IIRC that was one of our work items coming out of that discussion... although marekd and stevemar can probably correct me there17:46
stevemardolphm, dwaite yeah, it's a big to-do, marekd threw up a patch but it's mostly a hack to get web sso working17:48
*** amcrn has joined #openstack-keystone17:49
stevemardolphm, we should answer shardy's email to -dev17:54
*** dims_ has quit IRC17:59
dolphmstevemar: i was thinking the same. i put this patch up to see what will happen https://review.openstack.org/#/c/106819/18:04
dolphmstevemar: i've proposed this change before, but it broke on a few things that we have since fixed. i also don't know the integration coverage we have with keystonemiddleware.auth_token vs keystoneclient.middleware.auth_token yet?18:05
dolphmmorganfainberg: ^18:05
joesavakstevemar, dolphm - what's the next step on https://review.openstack.org/#/c/100023/ ? Sorry I missed Friday hack-a-thon - but does it seem the token-to-saml idea works?18:05
joesavakmarekd ^^18:05
morganfainbergo/18:06
stevemarjoesavak, the next step is to go with the flow we decided here: https://etherpad.openstack.org/p/keystone-juno-hackathon line 19318:06
stevemarupdate the spec, get to hacking18:06
morganfainbergdolphm, until we get a project merged using the keystonemiddleware i want to be very careful about accepting patches. - basically, we need some integrated project (pref. nova?) to use the middleware18:07
morganfainbergdolphm, right now we're not testing it in tempest [no one is _really_ using it]18:07
morganfainbergdolphm, as soon as we have projects on middleware, we should get full integration testing18:07
dolphmmorganfainberg: so, should i propose my change to keystoneclient a proof-of-concept? i don't think it should ever merge there though18:07
dolphmreferring to https://review.openstack.org/#/c/106819/18:08
morganfainbergdolphm, that would work18:08
morganfainbergbut i'd -2 CR it on ksc18:08
morganfainbergjust to be sure it never merges18:08
joesavakah - so no token-saml exchange flow?18:08
joesavaktoken only assertion flow...18:08
openstackgerritDolph Mathews proposed a change to openstack/python-keystoneclient: default to identity v3 - DO NOT MERGE  https://review.openstack.org/10683318:09
dolphmmorganfainberg: done ^18:10
morganfainbergthat should prove it out for us18:11
* morganfainberg continues to poke at the projects so we can get middleware merged tothem.18:12
dwaitedilphm, stevemar - I’d suggest looking at OAuth 2 there, the authorization code flow specifically. Rather than consider it specifically for federation, make an interface where you send the user off to log in, and get back a token18:14
stevemardolphm, ^18:14
dwaitedilphm? yeah, typo :$18:15
stevemardilphm is cool too18:15
dwaitethen you can have basically any authentication logic you want to send a browser user through - federation, multi-factor, etc - entirely as a keystone responsibility18:15
morganfainbergstevemar, dolphm, some initial diff on in-memory token format18:18
morganfainberghttp://dpaste.com/1FEVX91.txt18:18
*** radez is now known as radez_g0n318:18
morganfainbergstevemar, dolphm, trying to simplify where we do lookups when interacting with the token.18:19
morganfainbergstevemar, dolphm, a little more work before i write tests and post that before trying to convert over to using it.18:19
dwaitefor shib specifically, the ‘return list of IDPs’ is more commonly done with WAYF or DS. You may want to make choosing how someone logs into horizon a keystone responsibility as well (own the login page)18:20
dwaitebut thats a harder line to draw since that authentication business logic doesn’t appear to be shared - horizon AFAICT is the only web ui component18:21
*** shakamunyi has joined #openstack-keystone18:21
*** dims_ has joined #openstack-keystone18:25
dolphmmorganfainberg: ++18:26
morganfainbergand descriptors are really really cool18:27
dolphmdwaite: pretty sure WAYF is entirely new to me18:28
*** dims_ has quit IRC18:30
dwaitesince I do more enterprise and consumer markets, its not something I hit often either18:30
*** marcoemorais has quit IRC18:30
dwaiteits more education (like shib is)18:30
*** marcoemorais has joined #openstack-keystone18:32
dwaitestevemar, dolphm since you have taken the approach of using shib and apache filters, you might also be interested in https://github.com/pingidentity/mod_auth_openidc18:32
dolphmdwaite: i think stevemar and i have both checked out that project a bit already :D18:32
dolphmdwaite: what's the status of it? it's been a month or two since i've looked at it18:33
dwaiteactive development18:33
stevemardolphm, dwaite i actually used it at one point for keystone, and got it somewhat working... but still had some issues18:35
stevemarit's being distributed now, which is cool18:35
dwaiteyeah, I think it got into debian after some work18:38
dwaiteI joked with the author that I had code in debian without really knowing it18:38
dwaiteI’m just getting myself more confused trying to explain user/groups/roles + domains/projects18:39
*** ukalifon1 has joined #openstack-keystone18:41
openstackgerritayoung proposed a change to openstack/python-keystoneclient: Use jsonutils to load adapter response  https://review.openstack.org/10506518:48
openstackgerritayoung proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter  https://review.openstack.org/9768118:48
openstackgerritayoung proposed a change to openstack/python-keystoneclient: Add the 'auth' interface type  https://review.openstack.org/10473418:48
openstackgerritayoung proposed a change to openstack/python-keystoneclient: Test that tenant list function can use auth_url  https://review.openstack.org/10477018:48
openstackgerritayoung proposed a change to openstack/python-keystoneclient: Change unscoped token fallback to be session aware  https://review.openstack.org/10477118:48
openstackgerritayoung proposed a change to openstack/python-keystoneclient: Add v2 Token manager authenticate tests  https://review.openstack.org/10476918:48
openstackgerritayoung proposed a change to openstack/python-keystoneclient: unscoped tokens still set auth info in client  https://review.openstack.org/10683818:48
*** joesavak has quit IRC18:49
*** rwsu has joined #openstack-keystone18:51
openstackgerritayoung proposed a change to openstack/python-keystoneclient: Enumerate Projects with Unscoped Tokens  https://review.openstack.org/10683818:51
*** jaosorior has quit IRC18:52
openstackgerritDolph Mathews proposed a change to openstack/keystone: render json examples with syntax highlighting  https://review.openstack.org/10684018:53
openstackgerrithenry-nash proposed a change to openstack/identity-api: Extension to provide a REST API to read configuration options  https://review.openstack.org/10684218:54
stevemardolphm, can you review this patch: https://review.openstack.org/#/c/83829/18:58
openstackgerrithenry-nash proposed a change to openstack/keystone-specs: Extension to provide a REST API to read configuration options  https://review.openstack.org/10655818:58
stevemarit's been done for >10 days now :P18:59
dwaitequestion: are domains definable in ldap?19:00
openstackgerrithenry-nash proposed a change to openstack/keystone-specs: Extension to provide a REST API to read configuration options  https://review.openstack.org/10655819:00
*** amcrn has quit IRC19:00
dolphmdwaite: they used to be sort of - but the answer is no. ldap is a single domain backend19:00
*** henrynash has joined #openstack-keystone19:00
dolphmdwaite: we have a patch either in master or about to be approved to enable multiple ldap backends (one per domain)19:01
dwaiteit looks like users are domain level and inherited by projects, and groups ‘can be’. Are roles?19:01
*** thedodd has quit IRC19:01
dwaitedolphm: I suppose my confusion is figuring out what is per domain vs per project vs both19:02
*** radez_g0n3 is now known as radez19:03
dwaitealso, if groups influence roles19:04
*** mitz_ has quit IRC19:06
openstackgerritDolph Mathews proposed a change to openstack/keystone: project disabled/deleted notification recommendations  https://review.openstack.org/10684519:09
*** ukalifon1 has quit IRC19:09
*** daneyon has quit IRC19:13
stevemardolphm, i think your experiment is working19:14
dwaiteexperiment?19:20
morganfainbergminus the elastic recheck issue, this looks good dolphm: https://review.openstack.org/#/c/106833/19:22
morganfainbergalso, nova has approved the middleware change-over patch from bknudson19:22
stevemardwaite, dolphm was experimenting on getting devstack to run v3 by default...19:23
stevemarmorganfainberg, i agree, it looks good19:24
dwaiteoh that would be nice19:26
*** dims_ has joined #openstack-keystone19:26
dwaitewould the goal be to have v2 off-by-default in juno? :-)19:26
dolphmdwaite: not off by default, but using v3 everywhere by default with v2 available as a fallback19:29
dolphmdwaite: it might be interesting to have it off by default in devstack for a release first19:29
dolphmlike K19:29
dolphmmorganfainberg: COOL! that failed miserably like 6 months ago :) i mostly blame jamielennox|away for the improvement19:30
*** amcrn has joined #openstack-keystone19:31
*** dims_ has quit IRC19:31
morganfainberghmm.  ok now i just need to figure out how to populate the roles for the new token object19:31
* morganfainberg will be happy when there is only _one_ way we populate this data19:32
dwaitedolphm, stevemar: If you have problems with mod_auth_openidc, I suggest hitting up the author19:38
dwaitehe’s been feeling popular lately ;-)19:38
stevemardwaite, i've reached out to hans before, he's pretty awesome19:38
dwaite*nod* I get to work with some pretty awesome people :-)19:39
*** dims_ has joined #openstack-keystone19:41
*** joesavak has joined #openstack-keystone19:43
openstackgerritDolph Mathews proposed a change to openstack/identity-api: use backticks on literal string, not single quotes  https://review.openstack.org/10684919:43
dolphmtrivial doc fix ^19:43
dwaitebbiab19:43
*** dwaite has quit IRC19:44
*** navid has joined #openstack-keystone19:45
*** navid has quit IRC19:50
*** andreaf has quit IRC19:54
stevemardolphm, +2'ed19:54
*** nkinder has joined #openstack-keystone19:55
stevemardolphm, so whats the plan with your v3 changes?19:55
dolphmstevemar: well, i'm surprised it passed.19:56
stevemardolphm, me too kinda19:56
dolphmstevemar: the biggest blocker was returning a v3 catalog to nova, when it only understood a v2 catalog19:56
dolphmjamie fixed that19:56
dolphmthere were a few other little things19:56
dolphmi'm tempted to say we should merge the change to keystonemiddleware and release as 1.1.019:57
dolphmneed to attach to a wishlist bug first though19:57
openstackgerritDolph Mathews proposed a change to openstack/identity-api: The Most Obvious Way to Get a Service Catalog That You Have to See to Believe  https://review.openstack.org/10685419:57
morganfainbergdolphm, i say wait for https://review.openstack.org/#/c/102342/ to merge before we merge that change, but otherwise19:58
morganfainberggtg19:58
morganfainbergdolphm (the v3 one)19:58
dolphmmorganfainberg: ++19:58
dolphmmorganfainberg: i'm not in a rush19:58
morganfainbergdo we want to sneak in the session refactor too for 1.1.0?19:58
morganfainbergstevemar, do you know if you can use a descriptor from within a descriptor? /me is stumbling on wanting to reduce minor amounts of duplicated code20:00
morganfainbergi guess i could just create an object that does it for me.20:00
morganfainbergmeh.20:00
dolphmmorganfainberg: i'm not opposed, but haven't reviewed it yet20:02
*** marcoemorais has quit IRC20:02
*** marcoemorais has joined #openstack-keystone20:03
*** vhoward has left #openstack-keystone20:07
dstanekmorganfainberg: is there any reason you are using getattr here? https://review.openstack.org/#/c/106599/9/tests/unit/test_versionutils.py20:07
morganfainbergdstanek, obnoxiously long line :P20:08
morganfainbergand was being lazy about trying to figure out how to pep8-friedly that20:08
morganfainbergfriendly*20:08
dstanekmorganfainberg: haha, ok20:08
*** dwaite has joined #openstack-keystone20:20
openstackgerritA change was merged to openstack/identity-api: use backticks on literal string, not single quotes  https://review.openstack.org/10684920:20
*** miqui has joined #openstack-keystone20:22
henrynashdstanek, bknudson: did my updates regarding security of https://review.openstack.org/#/c/106558 satisfy your conerns?20:31
bknudsonhenrynash: I'd still like to see a discussion on the -dev mailing list20:32
bknudsonif other projects are willing to do this too then I'm fine with it20:32
*** marcoemorais has quit IRC20:32
*** marcoemorais has joined #openstack-keystone20:33
henrynashbknudson: sure, ok…happy to initiate that…20:33
*** henrynash has quit IRC20:35
*** huats has quit IRC20:35
*** huats has joined #openstack-keystone20:36
*** huats has quit IRC20:36
*** huats has joined #openstack-keystone20:36
*** henrynash has joined #openstack-keystone20:38
*** amcrn has quit IRC20:39
*** dstanek is now known as dstanek_zzz20:41
*** radez is now known as radez_g0n320:43
*** mfainberg_phone has joined #openstack-keystone20:54
*** arborism has joined #openstack-keystone20:59
*** arborism is now known as amcrn20:59
*** harlowja is now known as harlowja_away21:02
*** joesavak has quit IRC21:03
*** marcoemorais has quit IRC21:03
*** marcoemorais has joined #openstack-keystone21:03
*** harlowja_away is now known as harlowja21:03
*** dstanek_zzz is now known as dstanek21:04
dstanekhenrynash, bknudson: i agree21:05
*** marcoemorais has quit IRC21:05
*** marcoemorais has joined #openstack-keystone21:06
*** mfainberg_phone has quit IRC21:15
openstackgerritA change was merged to openstack/python-keystoneclient: Add invalidate doc string to identity plugin  https://review.openstack.org/9955821:23
*** topol has quit IRC21:24
*** joesavak has joined #openstack-keystone21:26
*** dstanek is now known as dstanek_zzz21:28
*** openstackgerrit has quit IRC21:31
*** dstanek_zzz is now known as dstanek21:31
*** openstackgerrit has joined #openstack-keystone21:32
*** dstanek is now known as dstanek_zzz21:40
*** shakamunyi has quit IRC21:40
*** bvandenh has quit IRC21:41
bknudsonmorganfainberg: were you working on a change to hash the tokens logged by keystoneclient?21:41
morganfainbergbknudson, i was, but i scrapped it for the time being21:42
bknudsonmorganfainberg: ok, was wondering why I couldn't find it.21:42
bknudsonmorganfainberg: looks like instead of putting in the change to sha1 the token we decided to boil the ocean instead.21:53
morganfainbergbknudson, heh21:56
morganfainbergbknudson, i think i also was waiting till middleware was split, since the change legitimately needed to go there21:56
stevemarq for folks - anyway to reply to a ML thread when all you have is the link from lists.openstack.org ?21:58
stevemarand not create a new thread...21:58
*** dims__ has joined #openstack-keystone22:05
openstackgerrithenry-nash proposed a change to openstack/keystone-specs: Extension to provide a REST API to read configuration options  https://review.openstack.org/10655822:05
bknudsonmorganfainberg: https://review.openstack.org/#/c/99432 patch set 7 looks good to me.22:05
*** dims_ has quit IRC22:05
bknudsonhow about we take that and work on further optimizations separately?22:06
*** jsavak has joined #openstack-keystone22:09
bknudsonactually, I tried it and it's incomplete as is... the token id is still displayed when you keystone --debug22:09
morganfainbergyeah22:09
bknudsonfrom the POST /v2.0/tokens response22:09
morganfainbergi noticed that :(22:10
bknudsonnothing that can't be fixed22:10
*** joesavak has quit IRC22:11
bknudsonah, this is the stuff in oslo22:13
stevemarhenrynash, whoa you went super short with the spec22:14
henrynashstevemar: so that’s waht ayoung was suggesting…I’m happy to add stuff back in once we agree it is the right thing to do22:15
henrynashstevemar: I think this is what we decided at the hackathon…we start with teh short form22:16
stevemarhenrynash, replied, the short form was just 3 less sections22:16
stevemarhenrynash, you were mis-informed, sir22:16
henrynashoh, so now I am confused22:17
henrynashdolphm: so what did we agree here?22:17
bknudsonI thought we agreed to just accept the problem statement22:17
stevemarthe tests aren't updated to reflect that22:18
stevemarrebooting22:19
*** stevemar has quit IRC22:19
*** jsavak has quit IRC22:21
*** henrynash has quit IRC22:23
dolphmuser_id: context['environment'][authorization.AUTH_CONTEXT_ENV]['user_id']  # this is an ungodly terrible dev experience22:25
*** spandhe has quit IRC22:32
*** spandhe has joined #openstack-keystone22:33
*** alex_xu has quit IRC22:50
*** stevemar has joined #openstack-keystone22:53
openstackgerritBrant Knudson proposed a change to openstack/python-keystoneclient: Do not expose Token IDs in debug output  https://review.openstack.org/10689022:56
bknudsonmorganfainberg: took a stab at also obfuscating the token in the request ^22:57
bknudsonand need to head home22:57
morganfainbergbknudson, sounds good!22:59
morganfainbergi'll take a look at it22:59
bknudsonobviously needs tests, doc updates, etc22:59
morganfainbergbknudson, the other way people are doing is the creditcard way, asdfasdf123XXXXXXXXXX...XXXXXasdfe123423:00
morganfainbergwith a min/max and % of data shown23:00
morganfainbergbknudson, not sure if i like that, hashlib.sha1() just seems so clean in comparison23:01
bknudsonmorganfainberg: from the mailing list discussion I didn't see a resolution to use one or the other.23:01
bknudsonshould put it in a function so it's easy to change.23:01
morganfainbergyeah23:01
morganfainberg++23:01
morganfainbergdolphm, len(context['something']['omg'].get('thing', {}).setdefault('stuff', [thing])[0]['ENV']['user_id']) # how long is the user's id23:02
morganfainberg>.>23:03
dolphmmorganfainberg: any reason why it's not just context['user_id'] ?23:03
dolphmand will i break anything if i rewrite it as such?23:03
dolphmthat's sort of what was supposed to be in context anyway23:03
morganfainbergdolphm, that in keystone or middleware?23:03
dolphmmorganfainberg: keystone23:03
dolphmmorganfainberg: build_auth_context middleware23:03
morganfainbergdolphm, i'd re-write it to be context['user_id']23:04
dolphmmorganfainberg: cool, i shall try that soon23:04
morganfainbergdolphm, i almost have the new KeystoneToken object done. just need to figure out how to populate roles in a sane way (both v2 and v3)23:04
morganfainbergbut it's soooo close.23:04
morganfainbergthen i need to add tests (this is all before actually using it)23:05
morganfainbergit should really help simplify the token code.23:05
*** bknudson has quit IRC23:06
morganfainbergwell, at least consolidate the ick into one place rather than be spread out all over23:06
openstackgerritDolph Mathews proposed a change to openstack/keystone: implement GET /v3/catalog  https://review.openstack.org/10689323:12
*** jamielennox|away is now known as jamielennox23:12
*** david-lyle has quit IRC23:20
*** henrynash has joined #openstack-keystone23:25
*** oomichi has joined #openstack-keystone23:33
*** richm has left #openstack-keystone23:37
openstackgerrithenry-nash proposed a change to openstack/keystone-specs: Extension to provide a REST API to read configuration options  https://review.openstack.org/10655823:38
openstackgerritA change was merged to openstack/python-keystoneclient: Provide an __all__ for auth module  https://review.openstack.org/10452923:42
*** lbragstad has joined #openstack-keystone23:50
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Use jsonutils to load adapter response  https://review.openstack.org/10506523:51
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter  https://review.openstack.org/9768123:51
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Add the 'auth' interface type  https://review.openstack.org/10473423:51
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Enumerate Projects with Unscoped Tokens  https://review.openstack.org/10683823:51
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Test that tenant list function can use auth_url  https://review.openstack.org/10477023:51
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Change unscoped token fallback to be session aware  https://review.openstack.org/10477123:51
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Add v2 Token manager authenticate tests  https://review.openstack.org/10476923:51
morganfainbergjamielennox, ping23:54
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Use jsonutils to load adapter response  https://review.openstack.org/10506523:54
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter  https://review.openstack.org/9768123:54
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Add the 'auth' interface type  https://review.openstack.org/10473423:54
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Enumerate Projects with Unscoped Tokens  https://review.openstack.org/10683823:54
openstackgerritJamie Lennox proposed a change to openstack/python-keystoneclient: Change unscoped token fallback to be session aware  https://review.openstack.org/10477123:54
jamielennoxmorganfainberg: hey23:54
morganfainbergjamielennox, want to ask your opinion about descriptor-magic-stuff23:54
jamielennoxsure, what are you looking at23:55
morganfainbergjamielennox, so i'm building a new token object, and using descriptors to do some of the magic (read: heavy lifting) so it just happens "token.user = <user_id>" and then "token.user" = the ref23:55
morganfainbergjamielennox, erm referencing token.user is now the "token-filtered" ref23:55
jamielennoxmorganfainberg: server side token stuff, or token fixture stuff in client23:55
morganfainbergi'm running into a sticking point with roles23:56
morganfainbergserver side23:56
morganfainbergthis is consolidating the assignment_api stuff and the format token stuff to a single in-memory format23:56
morganfainberghere let mepost a quick diff23:56
jamielennoxmorganfainberg: it's the model in MVC23:56
*** marcoemorais has quit IRC23:57
morganfainbergjamielennox, http://pasteraw.com/qux2mkrxijvqqdxk6egcoe8kc4fubgs23:57
morganfainbergbut yes the Model idea in MVC23:57
*** marcoemorais has joined #openstack-keystone23:57
morganfainbergand i'm using the potisional decorator :)23:58
morganfainbergcause i *can*23:58
*** diegows has quit IRC23:58
morganfainbergjamielennox, so, the question is resolving the roles in a *sane* way between v2 and v323:58
jamielennoxmorganfainberg: wow23:59
morganfainbergshould i just suck it up and do a .populate_roles() method on the KeystoneToken or should it be a descriptor23:59
morganfainbergor somewhere inbetween23:59
« Sunday, 2014-07-13 Index Tuesday, 2014-07-15 »

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!