| jamielennox | so i'd love to see us do a proper MVC or one of the other derivations in keystone - i was working that way with pecan, and got distracted | 00:00 |
|---|---|---|
| jamielennox | my gut reaction there would be that the representation of roles on the token should also be version independant | 00:00 |
| morganfainberg | right | 00:00 |
| morganfainberg | which is what i'm driving for | 00:00 |
| jamielennox | and that it's the controller (/view) that should convert those roles into the appropriate format | 00:00 |
| morganfainberg | it'll be a list that is version independant | 00:00 |
| morganfainberg | the formatter on serializer will need to output the data (eventually perhaps to the controller) | 00:01 |
| morganfainberg | or the formatter object can consume the token model there | 00:01 |
| morganfainberg | i'm just stumbling on the roles because it's not as ... straightforward as the rest of the stuff | 00:02 |
| jamielennox | how so? | 00:02 |
| jamielennox | a role is just an id and a name | 00:02 |
| morganfainberg | right | 00:02 |
| morganfainberg | but it's a list of roles that are derived from groups and user and project combination | 00:03 |
| morganfainberg | domain is simple, it's an id | 00:03 |
| morganfainberg | same w/ user | 00:03 |
| morganfainberg | heck all the values on the token for the most part are non-complex when you get down to it, except roles | 00:04 |
| morganfainberg | there are many of them | 00:04 |
| jamielennox | right, so you can't just add a role object to a list and expect that to work | 00:05 |
| morganfainberg | exactly | 00:05 |
| jamielennox | but at some point here the token representation is only a part of keystone and you can force people (because they're us) into using it correctly and change it later if something makes more sense | 00:05 |
| morganfainberg | i'm _thinking_ the right answer is a method that does the role resolution based upon all the other values. | 00:06 |
| morganfainberg | kindof like .populate_roles() on the V3 data helper | 00:06 |
| jamielennox | this isn't going to be a public interface, if you say you must use add_role() then that's all there is | 00:06 |
| *** bknudson has joined #openstack-keystone | 00:06 | |
| * morganfainberg is trying to get it so internally we never look at more than one type of token except when we serialize and emit | 00:06 | |
| morganfainberg | it'll make it way easier to get to non-persistent tokens. | 00:07 |
| jamielennox | yep, i get the vision - and i'd really like if you make a new top level directory called models and put token as the first object in there | 00:07 |
| jamielennox | might be pushing my luck | 00:07 |
| morganfainberg | sure. we could do that. | 00:07 |
| morganfainberg | instead of token.core | 00:07 |
| morganfainberg | ? | 00:07 |
| jamielennox | yea | 00:07 |
| * morganfainberg doesn't care where it lives | 00:07 | |
| jamielennox | cause i'd like to see models.User, models.Catalog etc | 00:07 |
| morganfainberg | sure. | 00:08 |
| morganfainberg | i can put all the descriptor junk in there as well | 00:08 |
| morganfainberg | might be a bit cleaner | 00:08 |
| jamielennox | i tried this nearly a year ago and got a -2 | 00:08 |
| * morganfainberg was also hoping not to need to dependency inject on the TokenModel itself | 00:08 | |
| morganfainberg | but i think i need to | 00:09 |
| morganfainberg | for roles. | 00:09 |
| * jamielennox had a plan to fix that with pecan :( | 00:09 | |
| morganfainberg | hey, we can get there from here :) | 00:09 |
| jamielennox | so if you are really worried about how people use the list you can make your own iterable object that cannot be added to | 00:10 |
| jamielennox | and fetches the available roles on first call or something | 00:10 |
| jamielennox | I'm concerned at that point about the amount of magic involved, i think you can go too far with python | 00:11 |
| *** bknudson has quit IRC | 00:11 | |
| jamielennox | already we have a whole lot of descriptors that will be a pain if you ever need to step through what happens | 00:12 |
| jamielennox | i don't think i told you but i solved my issue with the generating jsonschema objects and it works nicely - and i'm just not sure if there is a big advantage over simply writing out the jsonschema yourself | 00:12 |
| *** ayoung has joined #openstack-keystone | 00:12 | |
| morganfainberg | jamielennox, right | 00:14 |
| morganfainberg | well i'm trying to keep this compatible (no migrations) with our current token persistence system for a smooth transition | 00:15 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Extension to provide Read-Only REST API access to config https://review.openstack.org/106559 | 00:15 |
| morganfainberg | i don't think i want too much magic going on here. | 00:16 |
| jamielennox | yep | 00:17 |
| ayoung | jamielennox, novaclient --debug is showing me that it is asking for curl -i 'https://ayoungf20packstack.cloudlab.freeipa.org/keystone/main/v3/v2.0/tokens' | 00:17 |
| jamielennox | also positional(0) won't work like that because it will want you to pass self as a kwargs and you can't | 00:17 |
| morganfainberg | i'll just make a .populate_roles() call that we can run as part of the setup of the token model object | 00:17 |
| morganfainberg | jamielennox, ah so position(1)? | 00:17 |
| jamielennox | morganfainberg: yea | 00:17 |
| morganfainberg | done | 00:18 |
| morganfainberg | thanks | 00:18 |
| morganfainberg | i haven't written tests yet, so, i'm sure i'll have all sorts of things that come out of this | 00:18 |
| jamielennox | morganfainberg: so as mentioned i think you don't need to worry too much about things like the role loading yet, it's internal to keystone so it can always be changed later | 00:18 |
| morganfainberg | it was more of an order of operations | 00:18 |
| jamielennox | just do the most logical thing for now and worry about on-demand loading later | 00:18 |
| morganfainberg | i'll just make it a method we can call, it'll load the roles up, and on the .from_primitive() call it'll side-band them in. | 00:19 |
| ayoung | Retrying on HTTP connection exception: HTTPConnectionPool(host='192.168.187.13', port=35357): | 00:19 |
| ayoung | ugh.... | 00:19 |
| *** dstanek_zzz is now known as dstanek | 00:19 | |
| morganfainberg | rather than calling .populate_roles again (since the data will already be serialized) | 00:19 |
| jamielennox | ayoung: you using a session object? | 00:19 |
| jamielennox | morganfainberg: yea, you can fairly easily put a flag on whether that has been done or not | 00:20 |
| jamielennox | ayoung: cause there is no v2/v3 hack in session yet | 00:20 |
| morganfainberg | if self.roles | 00:20 |
| morganfainberg | :P | 00:20 |
| jamielennox | umm, here: https://review.openstack.org/#/c/90632/ | 00:21 |
| *** bknudson has joined #openstack-keystone | 00:24 | |
| bknudson | morganfainberg: https://review.openstack.org/#/c/101792/5/keystoneclient/auth/identity/v2.py | 00:25 |
| bknudson | jamielennox also has a fix for it. | 00:25 |
| morganfainberg | bknudson, ahh | 00:25 |
| bknudson | morganfainberg: that one does a redact rather than obfuscating the password | 00:26 |
| bknudson | I knew I'd seen it somewhere. | 00:27 |
| jamielennox | bknudson: i need to fix that but it feels wrong somehow | 00:28 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Do not expose Token IDs in debug output https://review.openstack.org/106890 | 00:29 |
| bknudson | jamielennox: what do you think of this approach? ^ | 00:29 |
| bknudson | It's only got the v2 plugin. | 00:30 |
| jamielennox | yea, i was thinking that could work as at least all the logging code is in the same place | 00:32 |
| bknudson | essentially it's just passing functions around... could have a function to handle headers too. | 00:33 |
| jamielennox | i was also wondering about passing through a logger object, because then you should be able to add custom filters to it | 00:33 |
| bknudson | request and response headers and body | 00:33 |
| jamielennox | so you create a log object for each plugin that filters out the sensitive data and then just pass through LOG | 00:33 |
| bknudson | jamielennox: that sounds nicely pythony | 00:34 |
| jamielennox | it's a bit more confusing at that point and it means that by the time you get it in the logger it is already a string so you'd have to undo the json to redact it | 00:34 |
| jamielennox | i don't know if that's an issue considering it's a debug call anyway | 00:35 |
| bknudson | y, don't need to worry much about efficiency here | 00:35 |
| jamielennox | bknudson: its a fair bit more effort because i think you need to change the logging formatter or something as well - at which point i kind of got lost | 00:37 |
| bknudson | probably not worth any extra effort. | 00:37 |
| jamielennox | yep, i think the function is probably the right way to go | 00:39 |
| bknudson | jamielennox: I posted comments on https://review.openstack.org/#/c/101792/ | 00:39 |
| bknudson | did you want to change https://review.openstack.org/#/c/101792/ to have a obfuscation function? | 00:39 |
| jamielennox | bknudson: so rebase it on top of yours? | 00:40 |
| jamielennox | or just change it to use a function instead | 00:40 |
| bknudson | jamielennox: just change it to use a function, don't worry about mine | 00:40 |
| jamielennox | yea, ok - i can do that | 00:41 |
| bknudson | sweet | 00:41 |
| ayoung | jamielennox, ugh...ok...so yeah, I am using a session | 00:42 |
| ayoung | but if I call nova client directly, I get the same thing | 00:43 |
| ayoung | V2 url gets a 401 | 00:43 |
| ayoung | v3 url...and uglier error | 00:43 |
| openstackgerrit | henry-nash proposed a change to openstack/identity-api: Extension to provide a REST API to read configuration options https://review.openstack.org/106842 | 00:43 |
| ayoung | but I guess its the V2 one I need for now. | 00:44 |
| ayoung | I'm guessing that the problem is on the auth_token side | 00:44 |
| *** henrynash has quit IRC | 00:44 | |
| ayoung | ag..didn't restart nova after changing auth config... | 00:45 |
| *** dstanek is now known as dstanek_zzz | 00:54 | |
| *** lbragstad has quit IRC | 00:57 | |
| *** dstanek_zzz is now known as dstanek | 01:02 | |
| *** amcrn has quit IRC | 01:02 | |
| *** marcoemorais has quit IRC | 01:13 | |
| *** topol has joined #openstack-keystone | 01:16 | |
| *** nkinder has quit IRC | 01:22 | |
| *** spandhe has quit IRC | 01:54 | |
| morganfainberg | jamielennox, ayoung, is this... a bug? https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L274-L276 it looks like if the first role in the trust is not available we bail out? shouldn't we ... see if any other trust roles are valid before bailing? | 01:55 |
| ayoung | nope | 01:56 |
| ayoung | morganfainberg, anything bad, the whole trust is bad | 01:56 |
| morganfainberg | or is that the intention that if any of the trust roles are invalid the trust is bad | 01:56 |
| morganfainberg | ok | 01:56 |
| stevemar | ayoung, i'd appreciate a look at: https://review.openstack.org/#/c/83829/ | 01:56 |
| ayoung | you got ! | 01:56 |
| *** spandhe has joined #openstack-keystone | 01:56 | |
| stevemar | considering you were good with mareks ECP work, that one should be a no brainer (as it's a kinda a pre-req) :) | 01:56 |
| *** mberlin has joined #openstack-keystone | 01:57 | |
| ayoung | stevemar, +2 +A. now leave me alone! | 01:57 |
| ayoung | Heh | 01:57 |
| stevemar | ayoung, woo hoo! | 01:58 |
| ayoung | stevemar, I have my boss breathing down my neck for Kerberized Horizon. I had to hide out from IRC all day just to get work done | 01:58 |
| ayoung | and it is a mess. | 01:58 |
| *** mberlin1 has quit IRC | 01:59 | |
| stevemar | ayoung, i hear ya, i was just told to get a PoC of k2k working in ... 10 days | 01:59 |
| stevemar | i'll be afk from life for about a week | 01:59 |
| ayoung | stevemar, joy! | 01:59 |
| ayoung | stevemar, sorry if I made that rough for you. K2K should be kept minimal, and I was not super thrilled with the "treat it like an IdP" aspect of what I was hearing | 02:00 |
| *** chandankumar has joined #openstack-keystone | 02:00 | |
| *** dstanek is now known as dstanek_zzz | 02:01 | |
| *** dstanek_zzz is now known as dstanek | 02:03 | |
| *** nkinder has joined #openstack-keystone | 02:03 | |
| stevemar | ayoung, it's cool dude, are you good with the current proposal? https://etherpad.openstack.org/p/keystone-juno-hackathon line 176 | 02:03 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add the new KeystoneTokenModel https://review.openstack.org/106917 | 02:14 |
| morganfainberg | stevemar, *cries a little at the size of the token model change* | 02:15 |
| morganfainberg | i wasn't expecting that to be > 400 lines w/o tests. | 02:15 |
| dstanek | morganfainberg: that's quite a bit :-) | 02:17 |
| morganfainberg | dstanek, yeah and it's still missing the serializer/deserializer bits | 02:17 |
| stevemar | yeesh | 02:17 |
| morganfainberg | dstanek, but token = KeystoneTokenModel(token_id, includes_catalog, is_admin) then just things like token.user = user_id and it loads the data behind the scenes | 02:18 |
| morganfainberg | dstanek, a little magic, but it means we dont have to have 3 places checking the user and extracting the user id from assignment_api when building the token (or is it 2) | 02:18 |
| dstanek | morganfainberg: that'll be nice to have | 02:18 |
| morganfainberg | similar savings on other bits where possible. | 02:19 |
| morganfainberg | the pieces still missing: serialize, from_serialized, and saml2 token mojo | 02:19 |
| morganfainberg | and it _should_ be compatible with our current token persistence without any migratons (SQL) needed | 02:19 |
| morganfainberg | and should be able to load old persistence data when done. | 02:20 |
| morganfainberg | dstanek, i also added a bunch of logic to prevent accidental changes to the in-memory token, should help us be more defensive overall (can't accidently do token.user['id'] = <something> | 02:21 |
| morganfainberg | s/bunch of logic/used a pre-existing class/ | 02:21 |
| morganfainberg | dstanek, i think i need a beer... or three to continue with this :P | 02:25 |
| dstanek | morganfainberg: i spent a lot of time yesterday messing with AST, so i know exactly what you mean | 02:26 |
| morganfainberg | more importantly, i'm _really_ not looking forward to writing these tests. | 02:27 |
| *** chandankumar has quit IRC | 02:30 | |
| *** dims__ has quit IRC | 02:33 | |
| *** topol has quit IRC | 02:39 | |
| *** topol has joined #openstack-keystone | 02:39 | |
| *** openstackgerrit has quit IRC | 02:42 | |
| *** miqui has quit IRC | 02:42 | |
| *** dvorak has quit IRC | 02:42 | |
| *** dstanek has quit IRC | 02:42 | |
| *** dvorak has joined #openstack-keystone | 02:42 | |
| *** miqui has joined #openstack-keystone | 02:42 | |
| *** openstackgerrit has joined #openstack-keystone | 02:43 | |
| *** dstanek has joined #openstack-keystone | 02:44 | |
| *** harlowja is now known as harlowja_away | 02:54 | |
| *** harlowja_away is now known as harlowja | 02:58 | |
| jamielennox | morganfainberg: i saw your comment about another way to provide the 'auth' interface on get_endpoint - i don't know of a better way to do it | 03:03 |
| jamielennox | if you specify the full url then get_endpoint is ignored because you obviously know where you are sending things | 03:03 |
| jamielennox | but at the manager level where this was happening i don't think you have any way to know the auth_url | 03:04 |
| jamielennox | ayoung: grrr, you pushed that client review on top of an out of date chain and so everything got rebased back to the old patches | 03:10 |
| *** dstanek has quit IRC | 03:12 | |
| *** mberlin has quit IRC | 03:12 | |
| *** dwaite has quit IRC | 03:12 | |
| *** tellesnobrega has quit IRC | 03:12 | |
| *** hyakuhei has quit IRC | 03:12 | |
| *** csd has quit IRC | 03:12 | |
| *** anteaya has quit IRC | 03:12 | |
| *** morganfainberg has quit IRC | 03:12 | |
| *** openstackgerrit has quit IRC | 03:12 | |
| *** topol has quit IRC | 03:12 | |
| *** Dafna has quit IRC | 03:12 | |
| *** uvirtbot has quit IRC | 03:12 | |
| *** dvorak has quit IRC | 03:12 | |
| *** stevemar has quit IRC | 03:12 | |
| *** jdennis has quit IRC | 03:12 | |
| *** xianghui has quit IRC | 03:12 | |
| *** mfisch has quit IRC | 03:12 | |
| *** gmurphy has quit IRC | 03:12 | |
| *** akscram has quit IRC | 03:12 | |
| *** gpocentek has quit IRC | 03:12 | |
| *** Mikalv has quit IRC | 03:12 | |
| *** ekarlso has quit IRC | 03:12 | |
| *** shufflebot has quit IRC | 03:12 | |
| *** raildo has quit IRC | 03:12 | |
| *** boris-42 has quit IRC | 03:12 | |
| *** nkinder has quit IRC | 03:12 | |
| *** ayoung has quit IRC | 03:12 | |
| *** designated has quit IRC | 03:12 | |
| *** YorikSar has quit IRC | 03:12 | |
| *** mat-lowery has quit IRC | 03:12 | |
| *** amerine has quit IRC | 03:12 | |
| *** zigo has quit IRC | 03:12 | |
| *** therve has quit IRC | 03:12 | |
| *** redrobot has quit IRC | 03:12 | |
| *** arunkant has quit IRC | 03:12 | |
| *** Ephur has quit IRC | 03:12 | |
| *** mgagne has quit IRC | 03:12 | |
| *** radez_g0n3 has quit IRC | 03:12 | |
| *** comstud has quit IRC | 03:12 | |
| *** mhu has quit IRC | 03:12 | |
| *** dolphm has quit IRC | 03:12 | |
| *** toddnni has quit IRC | 03:12 | |
| *** bknudson has quit IRC | 03:12 | |
| *** oomichi has quit IRC | 03:12 | |
| *** tristanC has quit IRC | 03:12 | |
| *** sudorandom has quit IRC | 03:12 | |
| *** baffle has quit IRC | 03:12 | |
| *** jamielennox has quit IRC | 03:12 | |
| *** jraim has quit IRC | 03:12 | |
| *** jimbaker has quit IRC | 03:12 | |
| *** ciypro|afk has quit IRC | 03:12 | |
| *** ChanServ has quit IRC | 03:12 | |
| *** openstackgerrit has joined #openstack-keystone | 03:20 | |
| *** dvorak has joined #openstack-keystone | 03:20 | |
| *** topol has joined #openstack-keystone | 03:20 | |
| *** nkinder has joined #openstack-keystone | 03:20 | |
| *** mberlin has joined #openstack-keystone | 03:20 | |
| *** bknudson has joined #openstack-keystone | 03:20 | |
| *** ayoung has joined #openstack-keystone | 03:20 | |
| *** oomichi has joined #openstack-keystone | 03:20 | |
| *** stevemar has joined #openstack-keystone | 03:20 | |
| *** dwaite has joined #openstack-keystone | 03:20 | |
| *** hyakuhei has joined #openstack-keystone | 03:20 | |
| *** jdennis has joined #openstack-keystone | 03:20 | |
| *** YorikSar has joined #openstack-keystone | 03:20 | |
| *** tristanC has joined #openstack-keystone | 03:20 | |
| *** xianghui has joined #openstack-keystone | 03:20 | |
| *** Dafna has joined #openstack-keystone | 03:20 | |
| *** designated has joined #openstack-keystone | 03:20 | |
| *** mat-lowery has joined #openstack-keystone | 03:20 | |
| *** tellesnobrega has joined #openstack-keystone | 03:20 | |
| *** sudorandom has joined #openstack-keystone | 03:20 | |
| *** morganfainberg has joined #openstack-keystone | 03:20 | |
| *** amerine has joined #openstack-keystone | 03:20 | |
| *** boris-42 has joined #openstack-keystone | 03:20 | |
| *** baffle has joined #openstack-keystone | 03:20 | |
| *** ekarlso has joined #openstack-keystone | 03:20 | |
| *** mfisch has joined #openstack-keystone | 03:20 | |
| *** gmurphy has joined #openstack-keystone | 03:20 | |
| *** zigo has joined #openstack-keystone | 03:20 | |
| *** uvirtbot has joined #openstack-keystone | 03:20 | |
| *** Mikalv has joined #openstack-keystone | 03:20 | |
| *** gpocentek has joined #openstack-keystone | 03:20 | |
| *** akscram has joined #openstack-keystone | 03:20 | |
| *** raildo has joined #openstack-keystone | 03:20 | |
| *** shufflebot has joined #openstack-keystone | 03:20 | |
| *** comstud has joined #openstack-keystone | 03:20 | |
| *** radez_g0n3 has joined #openstack-keystone | 03:20 | |
| *** mgagne has joined #openstack-keystone | 03:20 | |
| *** Ephur has joined #openstack-keystone | 03:20 | |
| *** arunkant has joined #openstack-keystone | 03:20 | |
| *** redrobot has joined #openstack-keystone | 03:20 | |
| *** therve has joined #openstack-keystone | 03:20 | |
| *** toddnni has joined #openstack-keystone | 03:20 | |
| *** dolphm has joined #openstack-keystone | 03:20 | |
| *** mhu has joined #openstack-keystone | 03:20 | |
| *** ciypro|afk has joined #openstack-keystone | 03:20 | |
| *** dickson.freenode.net sets mode: +oo morganfainberg dolphm | 03:20 | |
| *** jimbaker has joined #openstack-keystone | 03:20 | |
| *** jraim has joined #openstack-keystone | 03:20 | |
| *** jamielennox has joined #openstack-keystone | 03:20 | |
| *** csd has joined #openstack-keystone | 03:20 | |
| *** anteaya has joined #openstack-keystone | 03:20 | |
| *** dstanek has joined #openstack-keystone | 03:22 | |
| *** ChanServ has joined #openstack-keystone | 03:23 | |
| *** dickson.freenode.net sets mode: +o ChanServ | 03:23 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow passing kwargs from managers to session https://review.openstack.org/106658 | 03:24 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Change unscoped token fallback to be session aware https://review.openstack.org/104771 | 03:24 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow passing kwargs from managers to session https://review.openstack.org/106658 | 03:31 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Use jsonutils to load adapter response https://review.openstack.org/105065 | 03:31 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Add the 'auth' interface type https://review.openstack.org/104734 | 03:31 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Test that tenant list function can use auth_url https://review.openstack.org/104770 | 03:31 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Change unscoped token fallback to be session aware https://review.openstack.org/104771 | 03:31 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Add v2 Token manager authenticate tests https://review.openstack.org/104769 | 03:31 |
| *** chandankumar has joined #openstack-keystone | 03:36 | |
| marekd | stevemar: any progress with TFIM ? | 03:52 |
| *** spandhe has quit IRC | 03:59 | |
| stevemar | marekd, not really, we had a 30 minute call, but it was the same result, got a whole bunch of HTML in the idp_response | 04:00 |
| stevemar | i'll continue on it tomorrow, the guy i was talking to, had to go | 04:01 |
| marekd | stevemar: understood | 04:01 |
| marekd | gosh i think i am having some problem with re-adjusting to euro tz ;/ | 04:01 |
| marekd | second day in a row i am waking up ~4 in the morning and cannot really sleep. | 04:02 |
| *** chandankumar has quit IRC | 04:05 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Federating multiple Keystones https://review.openstack.org/100023 | 04:16 |
| stevemar | marekd, ^ | 04:18 |
| stevemar | marekd, eek! | 04:18 |
| stevemar | i was just really tired :( | 04:18 |
| *** amerine_ has joined #openstack-keystone | 04:18 | |
| stevemar | marekd, also https://review.openstack.org/#/c/92166/ should be merged in ..... 2 minutes | 04:20 |
| *** amerine has quit IRC | 04:21 | |
| *** k4n0 has joined #openstack-keystone | 04:27 | |
| *** dims__ has joined #openstack-keystone | 04:31 | |
| *** dims__ has quit IRC | 04:36 | |
| *** dims__ has joined #openstack-keystone | 04:57 | |
| *** chandankumar has joined #openstack-keystone | 04:59 | |
| *** spandhe_ has joined #openstack-keystone | 04:59 | |
| *** dims__ has quit IRC | 05:02 | |
| *** junhongl has joined #openstack-keystone | 05:20 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Add CRUD operations for Federated Protocols. https://review.openstack.org/83829 | 05:27 |
| morganfainberg | well then | 05:28 |
| morganfainberg | i think i found an issue with our dependency injection | 05:28 |
| morganfainberg | *grumbles* | 05:28 |
| morganfainberg | i know i know, you're all shocked | 05:28 |
| *** shausy has joined #openstack-keystone | 05:30 | |
| *** junhongl has quit IRC | 05:35 | |
| stevemar | marekd, yay ^^^^ | 05:39 |
| *** ukalifon has joined #openstack-keystone | 05:48 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add a URL field to region table https://review.openstack.org/106935 | 05:49 |
| *** harlowja is now known as harlowja_away | 05:49 | |
| *** dstanek is now known as dstanek_zzz | 06:00 | |
| *** dstanek_zzz is now known as dstanek | 06:01 | |
| stevemar | marekd, do you have an opinion on what library to use for samlizing the keystone token? | 06:03 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Move auth_token session code to middleware repo https://review.openstack.org/105031 | 06:03 |
| stevemar | i think https://pypi.python.org/pypi/ndg-saml and https://pypi.python.org/pypi/pysaml2 are the top 2 | 06:03 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/106939 | 06:05 |
| morganfainberg | stevemar, don't you hate it when you're too clever for your own good? | 06:06 |
| stevemar | morganfainberg, it's not a good feeling | 06:06 |
| morganfainberg | just ran across it. | 06:06 |
| stevemar | morganfainberg, dependency injection got ya down? | 06:06 |
| morganfainberg | so... interesting fact, dependency injection doesn't work on class-instantiated objects | 06:07 |
| morganfainberg | in testing that is | 06:07 |
| morganfainberg | cause we clear out the dependencies on setup | 06:07 |
| morganfainberg | and object instantiated at the class level would never get the re-injection. | 06:08 |
| morganfainberg | stevemar, example: https://review.openstack.org/#/c/106917/1/keystone/models/token_model.py line 274 | 06:08 |
| morganfainberg | that object wont get injection in tests | 06:09 |
| morganfainberg | fault in our tests + our dependency injection | 06:09 |
| stevemar | morganfainberg, better than fault in icehouse + dependency injection =\ | 06:10 |
| *** dstanek is now known as dstanek_zzz | 06:11 | |
| morganfainberg | problem is... i don't know how to fix it. it would work _fine_ in a real run of keystone | 06:11 |
| morganfainberg | but the whole teardown and re-inject is the issue | 06:11 |
| morganfainberg | and i'm trying to avoid circular imports *facepalm* | 06:12 |
| *** topol has quit IRC | 06:15 | |
| *** nkinder has quit IRC | 06:17 | |
| *** niteshselkari has joined #openstack-keystone | 06:26 | |
| *** niteshselkari has quit IRC | 06:26 | |
| *** niteshselkari has joined #openstack-keystone | 06:27 | |
| *** henrynash has joined #openstack-keystone | 06:30 | |
| niteshselkari | hi all, when we create an user, data goes from horizon to python-keystoneclient, and from keystoneclient to keystone. I know the firrst part ,i.e, horizon to keystoneclient. but i m not getting the second part.. | 06:31 |
| jamielennox | niteshselkari: so what are you not following? | 06:32 |
| jamielennox | morganfainberg: i vote we kill off the dependency injection - it doesn't do anything anyway given we will load it all on first call, better to just load at startup | 06:32 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Extension to provide a REST API to read configuration options https://review.openstack.org/106558 | 06:33 |
| morganfainberg | jamielennox, we should invert the dependency injection | 06:33 |
| jamielennox | morganfainberg: they're just singleton's why not just boot them at __init__ | 06:33 |
| morganfainberg | jamielennox, sill need a way to lookup the singletons | 06:33 |
| jamielennox | global namespace | 06:33 |
| morganfainberg | jamielennox, so @dependency.requires should just give that object access to the magic global namespace | 06:34 |
| jamielennox | catalog.CatalogManager.get_instance() | 06:34 |
| morganfainberg | pretty much, but i'd like to make it so the object registers that it is suppsoed to have access | 06:34 |
| *** spandhe_ has quit IRC | 06:35 | |
| jamielennox | have access? | 06:35 |
| morganfainberg | so we can be clear what is using what, and warn (error?) if something isn't supposed to be using say identity_api but uses it | 06:35 |
| morganfainberg | we don't want drivers -> manager | 06:35 |
| *** henrynash has quit IRC | 06:35 | |
| morganfainberg | so, to help avoid that we should still use the @dependency decorator. | 06:36 |
| jamielennox | that seems like a coding standard thing rather than something that needs to be protected | 06:36 |
| niteshselkari | jamielennox : I want to know, how data, which i entered while creating the user, gets stored in user table of keystone database. How the data flow happens. | 06:36 |
| morganfainberg | just not inject the dep, | 06:36 |
| *** stevemar has quit IRC | 06:37 | |
| morganfainberg | jamielennox, right but if we make it a simple decorator to provide access there is less likelyhood we "miss it" | 06:37 |
| morganfainberg | in a review | 06:37 |
| jamielennox | niteshselkari: so there is a REST API for keystone, keystoneclient marshals up the data and sends it to the appropriate server | 06:37 |
| jamielennox | morganfainberg: miss what? if a driver talks to a manager we're going to notice that, probably with circular imports | 06:38 |
| morganfainberg | jamielennox, i mean identity driver talking to assignment manager | 06:38 |
| morganfainberg | that would be bad. | 06:39 |
| morganfainberg | for various values of bad | 06:39 |
| jamielennox | morganfainberg: meh, seems like something we can easily be doing in review | 06:39 |
| jamielennox | morganfainberg: i'm not worried about fighting you on it - if you've got something that works then that's cool, but it doesn't seem 'necessary' | 06:40 |
| niteshselkari | jamielennox : I know the flow from https://github.com/openstack/horizon/blob/master/openstack_dashboard/dashboards/admin/users/forms.py#L72 to https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/session.py#L65 | 06:44 |
| jamielennox | ok | 06:44 |
| jamielennox | so that's as far as it goes, it sends it out to a http server | 06:45 |
| niteshselkari | jamielennox : what will be the next step..till this point i haven't mentioned the table name anywhere...so how does it finds the appropriate table to store the data (here the table will be users table of keystone database.) | 06:46 |
| jamielennox | niteshselkari: at that point we are still in the horizon process, keystone is a completely other server | 06:47 |
| jamielennox | keystone receives the request, parses the data, everything to do with table names happens on the keystone sid | 06:47 |
| jamielennox | e | 06:47 |
| niteshselkari | jamielennox : so how horizon links with keystone database...? | 06:48 |
| jamielennox | it doesn't, it talks to the keystone REST API and keystone talks to the keystone database | 06:48 |
| niteshselkari | jamielennox : where does horizon talks with keystone REST API...? I want to the location, where this happens..? | 06:51 |
| *** oomichi has quit IRC | 06:51 | |
| jamielennox | that's what keystoneclient does, it creates the packet and then sends it out | 06:51 |
| jamielennox | that's what requests.request does | 06:51 |
| jamielennox | it's a HTTP library | 06:51 |
| niteshselkari | jamielennox : In requests.request(), I m providing url, method and arguments(parameters). How it connects with keystone server | 06:56 |
| jamielennox | niteshselkari: it's a URL you are sending a HTTP request | 06:57 |
| jamielennox | niteshselkari: do you know the basic structure of openstack, the different services communicating over http? | 06:58 |
| *** dims__ has joined #openstack-keystone | 06:59 | |
| *** dstanek_zzz is now known as dstanek | 07:02 | |
| niteshselkari | jamielennox : so from there on where does my control jumps(i.e in keystone) | 07:02 |
| niteshselkari | jamielennox : Not that much clear on that... | 07:03 |
| jamielennox | depends, what call are you making | 07:03 |
| jamielennox | what's the url | 07:03 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Change Keystone dependency injection to reference the registry directly https://review.openstack.org/106951 | 07:04 |
| *** dims__ has quit IRC | 07:04 | |
| morganfainberg | jamielennox, ^ | 07:04 |
| niteshselkari | jamielennox : Now in my case, I am creating an user. So where my control will go..? | 07:04 |
| niteshselkari | jamielennox : in keystone | 07:04 |
| jamielennox | assuming v2 here: https://github.com/openstack/keystone/blob/master/keystone/identity/controllers.py#L60 | 07:05 |
| jamielennox | more or less | 07:05 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Change Keystone dependency injection to reference the registry directly https://review.openstack.org/106951 | 07:07 |
| *** BAKfr has joined #openstack-keystone | 07:08 | |
| *** dstanek is now known as dstanek_zzz | 07:11 | |
| *** oomichi has joined #openstack-keystone | 07:16 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add the new KeystoneTokenModel https://review.openstack.org/106917 | 07:17 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add the new KeystoneTokenModel https://review.openstack.org/106917 | 07:19 |
| *** henrynash has joined #openstack-keystone | 07:22 | |
| *** tkelsey_ has joined #openstack-keystone | 07:26 | |
| *** oomichi has quit IRC | 07:26 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Change Keystone dependency injection to reference the registry directly https://review.openstack.org/106951 | 07:27 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Change Keystone dependency injection to reference the registry directly https://review.openstack.org/106951 | 07:29 |
| *** henrynash has quit IRC | 07:29 | |
| *** henrynash has joined #openstack-keystone | 07:30 | |
| niteshselkari | jamielennox : In https://github.com/openstack/keystone/blob/master/keystone/identity/controllers.py#L82 , where does identity_api is defined | 07:31 |
| jamielennox | niteshselkari: it's the identity manager, how that get's resolved is somewhat complicated | 07:34 |
| *** tomoiaga has joined #openstack-keystone | 07:38 | |
| niteshselkari | jamielennox : from there, what wil be the next step..? | 07:46 |
| *** amcrn has joined #openstack-keystone | 07:52 | |
| *** junhongl has joined #openstack-keystone | 07:59 | |
| *** dims__ has joined #openstack-keystone | 07:59 | |
| *** henrynash has quit IRC | 08:00 | |
| *** bvandenh has joined #openstack-keystone | 08:02 | |
| *** dstanek_zzz is now known as dstanek | 08:02 | |
| *** dims__ has quit IRC | 08:04 | |
| *** henrynash has joined #openstack-keystone | 08:04 | |
| *** dstanek is now known as dstanek_zzz | 08:13 | |
| *** xianghui has quit IRC | 08:13 | |
| *** xianghui has joined #openstack-keystone | 08:26 | |
| *** bvandenh has quit IRC | 08:33 | |
| niteshselkari | tomoiaga : hi, In https://github.com/openstack/keystone/blob/master/keystone/identity/controllers.py#L82 , where does identity_api is defined | 08:39 |
| tomoiaga | niteshselkari: it will help you a lot if you look at how inheritance works in python. In this case, identity_api since it's not defined anywhere in that file, it means it belongs to the parent class (class User(controller.V2Controller)). The parent class is V2Controller from controller. controller is located in common.py in jeystone (in the file you mentioned you have: from keystone.common import controller) | 08:42 |
| tomoiaga | *common.py in keystone | 08:43 |
| BAKfr | niteshselkari, identity_api is added to the class with the decorator @dependency.requires() at https://github.com/openstack/keystone/blob/master/keystone/identity/controllers.py#L29 | 08:43 |
| tomoiaga | niteshselkari: or what BAKfr said, however you still need to have a basic knowlegde on how decorators and inheritance works in python. Otherwise as you can see, you will have to ask a lot of questions | 08:45 |
| *** ajayaa has joined #openstack-keystone | 08:45 | |
| *** bvandenh has joined #openstack-keystone | 08:46 | |
| tomoiaga | niteshselkari: If I'm not mistaken, this is what you are looking for: https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L512 | 08:54 |
| *** oomichi has joined #openstack-keystone | 08:59 | |
| *** dstanek_zzz is now known as dstanek | 09:01 | |
| *** ajayaa has quit IRC | 09:02 | |
| *** dstanek is now known as dstanek_zzz | 09:11 | |
| *** ajayaa has joined #openstack-keystone | 09:18 | |
| *** dims__ has joined #openstack-keystone | 09:29 | |
| *** dims__ has quit IRC | 09:33 | |
| *** ChanServ has quit IRC | 09:55 | |
| *** oomichi has quit IRC | 09:55 | |
| *** amerine_ has quit IRC | 09:55 | |
| *** dstanek_zzz has quit IRC | 09:55 | |
| *** tomoiaga has quit IRC | 09:55 | |
| *** BAKfr has quit IRC | 09:55 | |
| *** shausy has quit IRC | 09:55 | |
| *** k4n0 has quit IRC | 09:55 | |
| *** mberlin has quit IRC | 09:55 | |
| *** dwaite has quit IRC | 09:55 | |
| *** tellesnobrega has quit IRC | 09:55 | |
| *** hyakuhei has quit IRC | 09:55 | |
| *** csd has quit IRC | 09:55 | |
| *** anteaya has quit IRC | 09:55 | |
| *** morganfainberg has quit IRC | 09:56 | |
| *** niteshselkari has quit IRC | 09:56 | |
| *** tkelsey_ has quit IRC | 09:56 | |
| *** openstackgerrit has quit IRC | 09:56 | |
| *** Dafna has quit IRC | 09:56 | |
| *** uvirtbot has quit IRC | 09:56 | |
| *** bvandenh has quit IRC | 09:56 | |
| *** dvorak has quit IRC | 09:56 | |
| *** jdennis has quit IRC | 09:56 | |
| *** mfisch has quit IRC | 09:56 | |
| *** gmurphy has quit IRC | 09:56 | |
| *** akscram has quit IRC | 09:56 | |
| *** gpocentek has quit IRC | 09:56 | |
| *** Mikalv has quit IRC | 09:56 | |
| *** ekarlso has quit IRC | 09:56 | |
| *** shufflebot has quit IRC | 09:56 | |
| *** raildo has quit IRC | 09:56 | |
| *** boris-42 has quit IRC | 09:56 | |
| *** amcrn has quit IRC | 09:56 | |
| *** ayoung has quit IRC | 09:56 | |
| *** designated has quit IRC | 09:56 | |
| *** YorikSar has quit IRC | 09:56 | |
| *** mat-lowery has quit IRC | 09:56 | |
| *** zigo has quit IRC | 09:56 | |
| *** therve has quit IRC | 09:56 | |
| *** redrobot has quit IRC | 09:56 | |
| *** arunkant has quit IRC | 09:56 | |
| *** Ephur has quit IRC | 09:56 | |
| *** mgagne has quit IRC | 09:56 | |
| *** radez_g0n3 has quit IRC | 09:56 | |
| *** comstud has quit IRC | 09:56 | |
| *** mhu has quit IRC | 09:56 | |
| *** dolphm has quit IRC | 09:56 | |
| *** toddnni has quit IRC | 09:56 | |
| *** henrynash has quit IRC | 09:56 | |
| *** bknudson has quit IRC | 09:56 | |
| *** tristanC has quit IRC | 09:56 | |
| *** sudorandom has quit IRC | 09:56 | |
| *** baffle has quit IRC | 09:56 | |
| *** jamielennox has quit IRC | 09:56 | |
| *** jraim has quit IRC | 09:56 | |
| *** jimbaker has quit IRC | 09:56 | |
| *** ciypro|afk has quit IRC | 09:56 | |
| *** huats has quit IRC | 09:56 | |
| *** xianghui has quit IRC | 09:56 | |
| *** junhongl has quit IRC | 09:56 | |
| *** rwsu has quit IRC | 09:56 | |
| *** zhiyan has quit IRC | 09:56 | |
| *** rodrigods has quit IRC | 09:56 | |
| *** dtroyer has quit IRC | 09:56 | |
| *** serverascode has quit IRC | 09:56 | |
| *** Daviey has quit IRC | 09:56 | |
| *** vishy has quit IRC | 09:56 | |
| *** d34dh0r53 has quit IRC | 09:56 | |
| *** esmute has quit IRC | 09:56 | |
| *** tziOm has quit IRC | 09:56 | |
| *** d0ugal has quit IRC | 09:56 | |
| *** jkappert has quit IRC | 09:56 | |
| *** dhellmann has quit IRC | 09:56 | |
| *** med_ has quit IRC | 09:56 | |
| *** ajayaa has quit IRC | 09:56 | |
| *** ukalifon has quit IRC | 09:56 | |
| *** chandankumar has quit IRC | 09:56 | |
| *** miqui has quit IRC | 09:56 | |
| *** afaranha has quit IRC | 09:56 | |
| *** Chicago has quit IRC | 09:56 | |
| *** chmouel has quit IRC | 09:56 | |
| *** ByteSore has quit IRC | 09:56 | |
| *** harlowja_away has quit IRC | 09:56 | |
| *** dhellmann has joined #openstack-keystone | 10:03 | |
| *** jkappert has joined #openstack-keystone | 10:03 | |
| *** d0ugal has joined #openstack-keystone | 10:03 | |
| *** esmute has joined #openstack-keystone | 10:03 | |
| *** tziOm has joined #openstack-keystone | 10:03 | |
| *** vishy has joined #openstack-keystone | 10:03 | |
| *** Daviey has joined #openstack-keystone | 10:03 | |
| *** d34dh0r53 has joined #openstack-keystone | 10:03 | |
| *** serverascode has joined #openstack-keystone | 10:03 | |
| *** dtroyer has joined #openstack-keystone | 10:03 | |
| *** rodrigods has joined #openstack-keystone | 10:03 | |
| *** med_ has joined #openstack-keystone | 10:03 | |
| *** zhiyan has joined #openstack-keystone | 10:03 | |
| *** rwsu has joined #openstack-keystone | 10:03 | |
| *** junhongl has joined #openstack-keystone | 10:03 | |
| *** xianghui has joined #openstack-keystone | 10:03 | |
| *** huats has joined #openstack-keystone | 10:03 | |
| *** amcrn has joined #openstack-keystone | 10:03 | |
| *** oomichi has joined #openstack-keystone | 10:03 | |
| *** bvandenh has joined #openstack-keystone | 10:03 | |
| *** henrynash has joined #openstack-keystone | 10:03 | |
| *** tomoiaga has joined #openstack-keystone | 10:03 | |
| *** tkelsey_ has joined #openstack-keystone | 10:03 | |
| *** BAKfr has joined #openstack-keystone | 10:03 | |
| *** niteshselkari has joined #openstack-keystone | 10:03 | |
| *** shausy has joined #openstack-keystone | 10:03 | |
| *** k4n0 has joined #openstack-keystone | 10:03 | |
| *** amerine_ has joined #openstack-keystone | 10:03 | |
| *** ChanServ has joined #openstack-keystone | 10:03 | |
| *** dstanek has joined #openstack-keystone | 10:03 | |
| *** anteaya has joined #openstack-keystone | 10:03 | |
| *** csd has joined #openstack-keystone | 10:03 | |
| *** jamielennox has joined #openstack-keystone | 10:03 | |
| *** jraim has joined #openstack-keystone | 10:03 | |
| *** jimbaker has joined #openstack-keystone | 10:03 | |
| *** ciypro|afk has joined #openstack-keystone | 10:03 | |
| *** mhu has joined #openstack-keystone | 10:03 | |
| *** dolphm has joined #openstack-keystone | 10:03 | |
| *** toddnni has joined #openstack-keystone | 10:03 | |
| *** therve has joined #openstack-keystone | 10:03 | |
| *** redrobot has joined #openstack-keystone | 10:03 | |
| *** arunkant has joined #openstack-keystone | 10:03 | |
| *** Ephur has joined #openstack-keystone | 10:03 | |
| *** mgagne has joined #openstack-keystone | 10:03 | |
| *** radez_g0n3 has joined #openstack-keystone | 10:03 | |
| *** dickson.freenode.net sets mode: +oo ChanServ dolphm | 10:03 | |
| *** comstud has joined #openstack-keystone | 10:03 | |
| *** shufflebot has joined #openstack-keystone | 10:03 | |
| *** raildo has joined #openstack-keystone | 10:03 | |
| *** akscram has joined #openstack-keystone | 10:03 | |
| *** gpocentek has joined #openstack-keystone | 10:03 | |
| *** Mikalv has joined #openstack-keystone | 10:03 | |
| *** uvirtbot has joined #openstack-keystone | 10:03 | |
| *** zigo has joined #openstack-keystone | 10:03 | |
| *** gmurphy has joined #openstack-keystone | 10:03 | |
| *** mfisch has joined #openstack-keystone | 10:03 | |
| *** ekarlso has joined #openstack-keystone | 10:03 | |
| *** baffle has joined #openstack-keystone | 10:03 | |
| *** boris-42 has joined #openstack-keystone | 10:03 | |
| *** morganfainberg has joined #openstack-keystone | 10:03 | |
| *** sudorandom has joined #openstack-keystone | 10:03 | |
| *** tellesnobrega has joined #openstack-keystone | 10:03 | |
| *** mat-lowery has joined #openstack-keystone | 10:03 | |
| *** designated has joined #openstack-keystone | 10:03 | |
| *** Dafna has joined #openstack-keystone | 10:03 | |
| *** tristanC has joined #openstack-keystone | 10:03 | |
| *** YorikSar has joined #openstack-keystone | 10:03 | |
| *** jdennis has joined #openstack-keystone | 10:03 | |
| *** hyakuhei has joined #openstack-keystone | 10:03 | |
| *** dwaite has joined #openstack-keystone | 10:03 | |
| *** ayoung has joined #openstack-keystone | 10:03 | |
| *** bknudson has joined #openstack-keystone | 10:03 | |
| *** mberlin has joined #openstack-keystone | 10:03 | |
| *** dvorak has joined #openstack-keystone | 10:03 | |
| *** openstackgerrit has joined #openstack-keystone | 10:03 | |
| *** dickson.freenode.net sets mode: +o morganfainberg | 10:03 | |
| *** Chicago has joined #openstack-keystone | 10:03 | |
| *** chmouel has joined #openstack-keystone | 10:03 | |
| *** ByteSore has joined #openstack-keystone | 10:03 | |
| *** harlowja_away has joined #openstack-keystone | 10:04 | |
| *** oomichi has quit IRC | 10:04 | |
| *** ajayaa has joined #openstack-keystone | 10:08 | |
| *** ukalifon has joined #openstack-keystone | 10:08 | |
| *** chandankumar has joined #openstack-keystone | 10:08 | |
| *** miqui has joined #openstack-keystone | 10:08 | |
| *** afaranha has joined #openstack-keystone | 10:08 | |
| *** ajayaa has quit IRC | 10:09 | |
| *** andreaf has joined #openstack-keystone | 10:12 | |
| *** dstanek is now known as dstanek_zzz | 10:12 | |
| *** ajayaa has joined #openstack-keystone | 10:12 | |
| *** afazekas has joined #openstack-keystone | 10:19 | |
| *** dims__ has joined #openstack-keystone | 10:29 | |
| *** dims__ has quit IRC | 10:34 | |
| *** afazekas has quit IRC | 10:38 | |
| *** andreaf has quit IRC | 10:39 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Ensure no double slash in get token URL https://review.openstack.org/104911 | 10:56 |
| *** niteshselkari has quit IRC | 10:57 | |
| *** dstanek_zzz is now known as dstanek | 11:03 | |
| *** i159 has joined #openstack-keystone | 11:10 | |
| *** dstanek is now known as dstanek_zzz | 11:12 | |
| *** dims__ has joined #openstack-keystone | 11:14 | |
| *** k4n0 has quit IRC | 11:15 | |
| *** openstackgerrit has quit IRC | 11:21 | |
| *** tellesnobrega has left #openstack-keystone | 11:21 | |
| *** tellesnobrega has joined #openstack-keystone | 11:22 | |
| *** afazekas has joined #openstack-keystone | 11:24 | |
| *** afazekas has quit IRC | 11:37 | |
| *** diegows has joined #openstack-keystone | 11:41 | |
| *** bvandenh has quit IRC | 11:44 | |
| *** andreaf has joined #openstack-keystone | 11:48 | |
| *** andreaf has quit IRC | 11:53 | |
| *** andreaf has joined #openstack-keystone | 11:54 | |
| *** bvandenh has joined #openstack-keystone | 11:59 | |
| *** dstanek_zzz is now known as dstanek | 12:04 | |
| *** dstanek is now known as dstanek_zzz | 12:13 | |
| *** openstackgerrit has joined #openstack-keystone | 12:17 | |
| *** ajayaa has quit IRC | 12:19 | |
| *** afazekas has joined #openstack-keystone | 12:30 | |
| *** ajayaa has joined #openstack-keystone | 12:31 | |
| tkelsey_ | hey all, does anyone know about openstack-client in here? | 12:36 |
| tkelsey_ | im asking here because im getting an authentication related message from it, probably because I have no idea how to use it properly yet :-) | 12:37 |
| *** afazekas has quit IRC | 12:41 | |
| *** dims__ has quit IRC | 12:44 | |
| *** dims__ has joined #openstack-keystone | 12:45 | |
| *** ajayaa has quit IRC | 12:49 | |
| *** ayoung has quit IRC | 12:52 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone-specs: Hierarchical Multitenacy https://review.openstack.org/101017 | 12:53 |
| *** ajayaa has joined #openstack-keystone | 12:54 | |
| *** bvandenh has quit IRC | 12:56 | |
| *** dstanek_zzz is now known as dstanek | 12:58 | |
| *** alex_xu has joined #openstack-keystone | 12:59 | |
| *** afazekas has joined #openstack-keystone | 13:01 | |
| *** afazekas has quit IRC | 13:05 | |
| *** andreaf has quit IRC | 13:11 | |
| *** dstanek is now known as dstanek_zzz | 13:14 | |
| *** dims__ has quit IRC | 13:16 | |
| *** dims__ has joined #openstack-keystone | 13:22 | |
| *** vhoward has joined #openstack-keystone | 13:23 | |
| *** dstanek_zzz is now known as dstanek | 13:24 | |
| *** bknudson has quit IRC | 13:27 | |
| *** radez_g0n3 is now known as radez | 13:28 | |
| *** openstackgerrit has quit IRC | 13:31 | |
| *** 17SAAF480 has joined #openstack-keystone | 13:32 | |
| *** joesavak has joined #openstack-keystone | 13:33 | |
| *** lbragstad has joined #openstack-keystone | 13:33 | |
| *** ajayaa has quit IRC | 13:34 | |
| *** 17SAAF480 has quit IRC | 13:38 | |
| *** openstackgerrit has joined #openstack-keystone | 13:39 | |
| *** bknudson has joined #openstack-keystone | 13:46 | |
| *** lbragstad has quit IRC | 13:47 | |
| *** lbragstad has joined #openstack-keystone | 13:50 | |
| *** jsavak has joined #openstack-keystone | 13:51 | |
| dstanek | marekd: hi | 13:54 |
| *** joesavak has quit IRC | 13:55 | |
| *** topol has joined #openstack-keystone | 13:56 | |
| *** ajayaa has joined #openstack-keystone | 13:57 | |
| *** afazekas has joined #openstack-keystone | 14:01 | |
| *** ayoung has joined #openstack-keystone | 14:05 | |
| *** jimbaker has quit IRC | 14:05 | |
| marekd | dstanek: hey | 14:08 |
| dstanek | marekd: looking at that ECP review again now | 14:08 |
| *** lbragstad has quit IRC | 14:08 | |
| marekd | thanks! | 14:08 |
| *** lbragstad has joined #openstack-keystone | 14:11 | |
| *** dims__ has quit IRC | 14:19 | |
| *** afazekas has quit IRC | 14:21 | |
| alex_xu | ayoung, hi | 14:24 |
| *** david-lyle has joined #openstack-keystone | 14:30 | |
| *** daneyon has joined #openstack-keystone | 14:38 | |
| *** jsavak has quit IRC | 14:38 | |
| *** daneyon has quit IRC | 14:38 | |
| *** daneyon has joined #openstack-keystone | 14:38 | |
| *** stevemar has joined #openstack-keystone | 14:40 | |
| i159 | bknudson: Hi! I have a question. The https://review.openstack.org/#/c/80630/ patch fell after I had changed an oslo.db version in the requirements file. Why does it fell? | 14:41 |
| *** richm has joined #openstack-keystone | 14:41 | |
| bknudson | i159: "Incompatible requirement found" | 14:42 |
| bknudson | "Requirement oslo.db>=0.3.0 does not match openstack/requirements value oslo.db>=0.2.0" | 14:42 |
| bknudson | i159: the change to requirements.txt needs to be made to the openstack/requirements project first | 14:43 |
| bknudson | https://review.openstack.org/#/q/status:open+project:openstack/requirements,n,z | 14:43 |
| marekd | dstanek: btw, do you have any opinions on asyncio module in Py3? | 14:46 |
| dstanek | marekd: in general or with regards to keystone? | 14:46 |
| marekd | dstanek: in general. | 14:47 |
| dstanek | i think it's nice to finally have something like it in the stdlib | 14:47 |
| *** bklei has joined #openstack-keystone | 14:47 | |
| dstanek | i have only toyed with it, but it feels pretty nice | 14:47 |
| *** thedodd has joined #openstack-keystone | 14:47 | |
| dstanek | stevemar: do you want to take a look at https://review.openstack.org/#/c/92166/ before i +A it? | 14:48 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: implement GET /v3/catalog https://review.openstack.org/106893 | 14:49 |
| stevemar | dstanek, i'm completely cool with it going in, if there are changes in my IdP, i'll supply a patch | 14:49 |
| dstanek | stevemar: sounds good to me | 14:50 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: implement GET /v3/catalog https://review.openstack.org/106893 | 14:50 |
| marekd | dstanek: thanks! | 14:51 |
| ayoung | stevemar, BTW be aware of https://git.fedorahosted.org/git/ipsilon.git as a better way of doing Federation | 14:52 |
| *** dims__ has joined #openstack-keystone | 14:53 | |
| ayoung | https://git.fedorahosted.org/cgit/ipsilon.git/tree/README | 14:53 |
| i159 | bknudson: Oh... Thanks you! | 14:54 |
| *** ajayaa has quit IRC | 14:55 | |
| marekd | ayoung: regarding ipsilon i have a guy who checks various IdP with our keystone | 14:56 |
| marekd | ipsilon is also on a list. | 14:56 |
| marekd | ayoung: so i will handle this and in case some problems get back either to you or Simo | 14:56 |
| ayoung | marekd, sounds good. | 14:57 |
| *** ukalifon has quit IRC | 14:58 | |
| ayoung | marekd, give a shout if you need help getting it set up. I know simo went through it recently with one of our QA members | 14:58 |
| marekd | ayoung: sure | 14:59 |
| marekd | ayoung: thanks. | 14:59 |
| *** dims__ has quit IRC | 15:04 | |
| *** jsavak has joined #openstack-keystone | 15:06 | |
| *** ajayaa has joined #openstack-keystone | 15:07 | |
| *** chandankumar has quit IRC | 15:14 | |
| *** ajayaa has quit IRC | 15:20 | |
| *** openstackgerrit has quit IRC | 15:21 | |
| dstanek | someone is having a bad day - https://review.openstack.org/#/c/96763 | 15:23 |
| morganfainberg | dstanek, wow yeah. | 15:25 |
| tomoiaga | :) | 15:27 |
| bknudson | I don't see the point of accepting anything other than security fixes to the keystone CLI | 15:30 |
| morganfainberg | bknudson, maybe a quick topic for today's meeting? | 15:31 |
| dstanek | ++ that would be good to talk about | 15:32 |
| *** doddstack has joined #openstack-keystone | 15:32 | |
| *** thedodd has quit IRC | 15:32 | |
| dolphm | our agenda is really full btw :( | 15:33 |
| morganfainberg | we could discuss it now! | 15:33 |
| morganfainberg | or hit the ML w/ it | 15:33 |
| tomoiaga | courious about the reasons behind not accepting anything other then security fixes. Is there a new client (e.g. like openstack client) or something else going on ? | 15:33 |
| morganfainberg | if openstackclient can do the work, i don't see a benefit to ksc getting the update cli wise. | 15:34 |
| morganfainberg | tomoiaga, yeah, openstackclient should replace the CLI for all the python-*client libraries | 15:34 |
| morganfainberg | now, if openstackclient doesn't fit the bill (yet) we should ask why it doesnt and if it will soon enough to avoid needing to change the cli in keystoneclient | 15:35 |
| tomoiaga | morganfainberg: as far as I see, openstackclient uses keystone v2 client right now | 15:35 |
| morganfainberg | tomoiaga, it uses the library parts, which is different than the shell parts iirc (*** I might be wrong here, but that was my understanding) | 15:35 |
| tomoiaga | personally I wanted to use openstackclient but I dropped it since there is no reason to use a wrapper for keystoneclient | 15:35 |
| tomoiaga | morganfainberg: ah, sorry, this was related to the shell part. Indeed, the shell part is implemented in openstackclient | 15:37 |
| morganfainberg | tomoiaga, no worries at all :) | 15:37 |
| *** bobt has joined #openstack-keystone | 15:37 | |
| morganfainberg | bknudson, for DI, would you prefer to just reference the single-ton-like thing? or would you rather everything just have it's own instantiation of the controller object? (wasn't clear on your comment) | 15:38 |
| dolphm | tomoiaga: openstack --identity-api-version=3 | 15:38 |
| morganfainberg | bknudson, erm DI removal | 15:38 |
| bknudson | morganfainberg: for DI, pass in the object that the other object needs | 15:39 |
| morganfainberg | bknudson, hm. oh to the constructor? | 15:39 |
| bknudson | we don't need to have more than one instance, just pass it around | 15:39 |
| morganfainberg | right. ok | 15:39 |
| dolphm | tomoiaga: the reason for using openstackclient is to present a unified interface to end users, rather than a bunch of disparate projects with inconsistent UX | 15:39 |
| bknudson | y, pass in the object to the constructor | 15:39 |
| dolphm | basically the same argument has been made for openstacksdk as well | 15:40 |
| morganfainberg | a little different than my proposal, because we have the whole "when does this get instantiated" concept. | 15:40 |
| tomoiaga | dolphm: yes, if this is related to the shell part it makes sense. For some reason I thought this was related to keystoneclient as a whole, my mistake | 15:40 |
| bknudson | morganfainberg: I didn't read the proposal. stopped where it said to. | 15:40 |
| dolphm | tomoiaga: if keystoneclient's python api doesn't support updating a user's default project then we should DEFINITELY fix that - but i don't think that's the case | 15:41 |
| marekd | morganfainberg: btw, did you see websso PoC ? | 15:41 |
| morganfainberg | bknudson, my proposal was just make the @dependency decorator apply an @property that looked at the global registry | 15:41 |
| dolphm | c.users.update(user, default_project_id=new_project) # i think, for a v3 client | 15:41 |
| bknudson | morganfainberg: since I think globals are an abomination I would prefer to get rid of it. | 15:41 |
| morganfainberg | bknudson, the concern would be cases where objects are instantiated on a class level, e.g. descriptors | 15:42 |
| tomoiaga | dolphm: looking at the patch, it's not the case. Only the shell part had the missing argument to update a default user tenant, the library is ok | 15:42 |
| morganfainberg | bknudson, you don't re-build those ever, so in the case of tests, they may get stale managers. | 15:42 |
| dolphm | tomoiaga: cool | 15:42 |
| *** i159 has quit IRC | 15:43 | |
| morganfainberg | marekd, haven't looked in depth at it. | 15:43 |
| morganfainberg | marekd, but i saw work on it. :) | 15:43 |
| bknudson | morganfainberg: get rid of globals and there's no stale anything. | 15:43 |
| dstanek | tomoiaga: dolphm: right the lib is fine - the cli was missing a way to pass the info | 15:43 |
| *** bobt has left #openstack-keystone | 15:43 | |
| morganfainberg | bknudson, so if a descriptor needs idenity_api, how does that work? | 15:44 |
| morganfainberg | bknudson, the descriptor is instantiated at import time, not at runtime | 15:44 |
| marekd | morganfainberg: that's not the point. If we go this way I should *soon* propose a bp (if that's not too late) to fit into J. | 15:44 |
| *** shausy has quit IRC | 15:44 | |
| *** tomoiaga has quit IRC | 15:44 | |
| dolphm | morganfainberg: dstanek: tomoiaga: abandoned the patch & won't fixed the bug | 15:44 |
| bknudson | morganfainberg: a file descriptor? what does that mean? | 15:44 |
| morganfainberg | bknudson, a python descriptor | 15:44 |
| *** andreaf has joined #openstack-keystone | 15:44 | |
| bknudson | never heard of it. seems unnecessary | 15:44 |
| marekd | apparently the other websso bp is not progressing very much and I don't push for that as I don't like that idea 100% | 15:45 |
| morganfainberg | they are used in cases of validation, etc. | 15:45 |
| dolphm | anyone want to review my super awesome GET /v3/catalog spec so i can land an impl this week? :D https://review.openstack.org/#/c/106854/ | 15:45 |
| morganfainberg | they implement __get__ and __set__ magic methods, it allows you to act on the bind action to the variable for instantiations of the class | 15:45 |
| dstanek | morganfainberg: do you have an example of that? | 15:45 |
| morganfainberg | dstanek, i do! | 15:45 |
| dstanek | i'm not a fan of globals either and i hate singletons | 15:46 |
| bknudson | I knew dstanek would agree. | 15:46 |
| morganfainberg | dstanek, bknudson, https://review.openstack.org/#/c/106917/3/keystone/models/token_model.py look at line 253, and the related class on 191 | 15:46 |
| dstanek | morganfainberg: with descriptors i haven't seen a dep like that | 15:46 |
| bknudson | even the design patterns folks think singletons was a mistake | 15:46 |
| morganfainberg | dstanek, bknudson, when you assign to <instantiation of KeystoneTokenModel>.project = project_id, the reference to .project is loaded from the assignment_api | 15:47 |
| morganfainberg | and made available from <instantiation>.project, it was an attempt to limit the token.project = assignment_api.get_project(project_id) or assignment_api.get_project() done in a number of places when building the token | 15:48 |
| morganfainberg | i'm happy to scrap that concept. | 15:48 |
| morganfainberg | if it's hard to read/too complex. | 15:48 |
| dstanek | morganfainberg: so you have 'model.project = "some_id"' and then when you get model.project it's the actual project ref? | 15:49 |
| morganfainberg | dstanek, yep. | 15:49 |
| *** andreaf has quit IRC | 15:50 | |
| morganfainberg | dstanek, mostly it was a concept i was running with to help make a serialization for token_persistence (we can't get rid of it for a while) lighter weight | 15:50 |
| *** andreaf has joined #openstack-keystone | 15:50 | |
| morganfainberg | right now we serialize everything to a json blob and shove it into the DB, and duplicate a lot of data. | 15:50 |
| morganfainberg | (same with memcached) | 15:50 |
| morganfainberg | dstanek, it's a little magical, but we seem to do a lot of "shove data into a dict and pass that around". | 15:53 |
| dstanek | morganfainberg: i have to think about that for a little bit...feels weird to be asymmetrical like that | 15:53 |
| dstanek | morganfainberg: you could always have the descriptor get the instance or *_api from the instance itself | 15:54 |
| morganfainberg | dstanek, hm. yeah we do have instance don't we? good point | 15:55 |
| morganfainberg | dstanek, meh, descriptors are overkill. i'll refactor them out of the next patch. | 15:56 |
| *** bklei has quit IRC | 15:56 | |
| morganfainberg | dstanek, i don't particularly like the design pattern we're using in the v3token data helper, which was what i was trying to avoid. I think i can get around it another way | 15:57 |
| morganfainberg | .build_token() calling ._populateXXX, then .populateXXX, then ... | 15:58 |
| *** vhoward has left #openstack-keystone | 15:58 | |
| marekd | dstanek: since you approved SAML unscoped token do you think you can also take a look at: https://review.openstack.org/#/c/99704/ (way easier to review IMHO) | 15:59 |
| marekd | ayoung: same for you ^^ since you know what's going on | 16:00 |
| dstanek | marekd: sure, i'm almost done with the one i'm working on | 16:01 |
| marekd | dstanek: thanks, appreciated | 16:01 |
| *** lbragstad has quit IRC | 16:02 | |
| *** iartarisi has joined #openstack-keystone | 16:04 | |
| *** lbragstad has joined #openstack-keystone | 16:06 | |
| *** afazekas has joined #openstack-keystone | 16:09 | |
| *** BAKfr has quit IRC | 16:09 | |
| *** chandankumar has joined #openstack-keystone | 16:09 | |
| *** richm has quit IRC | 16:11 | |
| *** richm has joined #openstack-keystone | 16:15 | |
| *** richm has quit IRC | 16:15 | |
| *** stevemar has quit IRC | 16:16 | |
| *** bvandenh has joined #openstack-keystone | 16:16 | |
| *** stevemar has joined #openstack-keystone | 16:16 | |
| *** lbragstad has quit IRC | 16:19 | |
| *** dims__ has joined #openstack-keystone | 16:21 | |
| stevemar | dolphm, you good with current k2k spec? | 16:23 |
| stevemar | or want me to push a new one | 16:23 |
| *** arosen has joined #openstack-keystone | 16:24 | |
| arosen | Hi, I was wondering if anyone has run into this error http://codepad.org/WCQMGwnq ? | 16:25 |
| stevemar | arosen, update your keystoneclient? | 16:28 |
| arosen | stevemar: i still get this if i rm /opt/stack -fr | 16:28 |
| arosen | stevemar: it looks like keystone is using apache now as it's webserver? | 16:29 |
| arosen | in devstack | 16:30 |
| morganfainberg | arosen, yes. | 16:30 |
| stevemar | arosen, yes, in devstack we run apache now | 16:30 |
| stevemar | instead of eventlet | 16:30 |
| stevemar | morganfainberg, i was anticipating some of these config problems with apache :( | 16:30 |
| arosen | brb coffee time | 16:31 |
| morganfainberg | arosen, i've... never seen that before | 16:32 |
| morganfainberg | is keystoneclient not installed? | 16:32 |
| arosen | morganfainberg: it is | 16:34 |
| arosen | >>> import keystoneclient | 16:34 |
| arosen | >>> | 16:34 |
| *** jsavak has quit IRC | 16:34 | |
| morganfainberg | arosen, yeah i've never seen anything like that before | 16:36 |
| morganfainberg | it's like you have a partial or mismatched keystoneclient install | 16:36 |
| morganfainberg | arosen, when you do import keystoneclient like that | 16:37 |
| morganfainberg | what does keystoneclient.__file__ say? | 16:37 |
| arosen | morganfainberg: i restarted apache and now it's able to start. | 16:37 |
| arosen | morganfainberg: but i'm getting this weird error : http://codepad.org/agiGvUjU | 16:37 |
| *** nkinder has joined #openstack-keystone | 16:38 | |
| arosen | In [4]: keystoneclient.__file__ | 16:38 |
| arosen | Out[4]: '/opt/stack/python-keystoneclient/keystoneclient/__init__.pyc' | 16:38 |
| morganfainberg | arosen, it honestly sounds like you have mismatched requirements | 16:38 |
| morganfainberg | arosen, keyring had that issue in one of the versions... | 16:39 |
| morganfainberg | 3. uh.. 3.3? | 16:39 |
| morganfainberg | 3.1? | 16:39 |
| *** richm has joined #openstack-keystone | 16:39 | |
| *** jaosorior has joined #openstack-keystone | 16:39 | |
| *** richm has quit IRC | 16:40 | |
| morganfainberg | arosen, what version of keyring do you have installed? | 16:42 |
| *** richm has joined #openstack-keystone | 16:42 | |
| morganfainberg | arosen, it should be keyring>=2.1,!=3.3 | 16:43 |
| morganfainberg | so, greater than 2.1 but not 3.3 | 16:43 |
| arosen | morganfainberg: I just rm /usr/lib/python2.7/dist-packages /usr/local/lib/python2.7/dist-packages and i'm letting devstack pull all the packages down again. | 16:43 |
| arosen | we'll see if that does the trick | 16:43 |
| morganfainberg | arosen, ok | 16:43 |
| arosen | morganfainberg: thanks for your help | 16:43 |
| morganfainberg | arosen, sure thing | 16:43 |
| arosen | morganfainberg: just curious what the reason for switching to apache? I'm guessing apache is faster? | 16:43 |
| morganfainberg | arosen, it's been our preferred method of deployment for a while. | 16:44 |
| morganfainberg | arosen, it provides concurrency (multiple workers) and allows us to use modules like mod_shib for federation | 16:44 |
| *** iartarisi has quit IRC | 16:44 | |
| morganfainberg | arosen, also, eventlet is a royal PITA | 16:45 |
| arosen | morganfainberg: the only reason I asked is I just recently stole the eventlet webserver from keystone for a new openstack project i'm trying to boot strap https://review.openstack.org/#/c/105882/ | 16:45 |
| morganfainberg | a lot of edgecases / weird issues / pain to debug | 16:45 |
| morganfainberg | and it didn't buy us a lot since a lot of our blocking was/is mysqldb which is _not_ eventlet aware/friendly | 16:45 |
| arosen | morganfainberg: makes sense. I'll have to check out what's needed to run with apache for neutron and congress then :) | 16:45 |
| morganfainberg | similar for ldap | 16:46 |
| morganfainberg | neutron, a lot more work since it was based on nova iirc | 16:46 |
| morganfainberg | in ancient times | 16:46 |
| arosen | morganfainberg: we have that similar problem in neutorn | 16:46 |
| morganfainberg | congress i haven't got an answer since i've never looked at it beyond "I'm concerned with a service that needs to be asked for each policy decision" | 16:46 |
| *** marcoemorais has joined #openstack-keystone | 16:47 | |
| morganfainberg | i haven't heard enough about how congress will work and not be a bottleneck (that we as keystone are trying to dig ourselves out of) that requires each action to say "am I allowed to do this". But to be fair, that was mostly the original proposal and i haven't heard much since | 16:48 |
| boris-42 | morganfainberg bknudson hi guys | 16:48 |
| morganfainberg | boris-42, hello there | 16:48 |
| boris-42 | morganfainberg bknudson I just finished new virtualization tool | 16:48 |
| boris-42 | for profiler | 16:49 |
| boris-42 | http://boris-42.github.io/profiler/ | 16:49 |
| * morganfainberg is going to run off for coffee before meeting time | 16:49 | |
| arosen | morganfainberg: yea we're still trying to figure it out :), our first version we're gearing to just enforce policy retroactively | 16:49 |
| morganfainberg | arosen, uh.. how does that work? | 16:50 |
| arosen | morganfainberg: i think we need to have a middleware component similar to keystone when we want to do proactive. | 16:50 |
| morganfainberg | arosen, ELI5 :), i don't know how you'd say "so uh I already did this action, now undo it" | 16:50 |
| morganfainberg | or am i misunderstanding retroactively? ;) | 16:50 |
| arosen | morganfainberg: just now it will just report back monitoring data that a policy is in violation | 16:51 |
| morganfainberg | i could see it as being more of an audit processor? | 16:51 |
| arosen | morganfainberg: yup, also a useful thing for querying. | 16:51 |
| arosen | Right now if you want to write something that tells you if a specific disk-image is running on a vm that is uplinked to a network that's uplinked to a router connected to the internet it's very hard to do because you have to query all these components for different things. | 16:52 |
| arosen | morganfainberg: btw i'm up and running now with keystone+apache | 16:53 |
| morganfainberg | arosen, cool. | 16:53 |
| arosen | morganfainberg: btw I just got keystone integration added to congress here: https://review.openstack.org/#/c/106911/ | 16:53 |
| morganfainberg | arosen, ther eis a bug still in devstack, i need to fix how apache is restarted (known issue where apache is slow to stop so a start fails) | 16:54 |
| morganfainberg | arosen, are you using keystone as a data source? or as you're using auth_token middleware? | 16:55 |
| arosen | auth for now. | 16:55 |
| * morganfainberg doesn't see the addition of the middleware for auth_token but i could also be sans caffination :P | 16:55 | |
| arosen | morganfainberg: i guess in v3 there are some data-source stuff? | 16:55 |
| morganfainberg | arosen, so you're looking to use the keystone token as authorization to act on congress APIs? | 16:56 |
| arosen | morganfainberg: https://review.openstack.org/#/c/106911/1/etc/api-paste.ini line 25? | 16:56 |
| arosen | morganfainberg: right now yes. | 16:56 |
| morganfainberg | ah switch to keystonemiddleware | 16:56 |
| morganfainberg | don't use keystoneclient :) | 16:56 |
| arosen | morganfainberg: When i started on this last week i don't think keystonemiddleware was out? | 16:56 |
| arosen | i will switch to that though. | 16:57 |
| morganfainberg | arosen, it was merged last week into global requirements | 16:57 |
| arosen | morganfainberg: okay i'll check it out | 16:57 |
| morganfainberg | also make sure you add it to your requirements.txt | 16:57 |
| *** amerine_ is now known as amerine | 16:57 | |
| dstanek | hrm...my Python2.6 tests seem to be having all sorts of issues | 16:57 |
| arosen | morganfainberg: will do. Would be awesome if i could get a review from you guys on it later in the week :) still a wip'ish | 16:57 |
| morganfainberg | arosen, https://review.openstack.org/#/c/102355/ for example converting cinder over to it | 16:58 |
| arosen | working on adding python-congressclient support and keystone+congress at the sametime just to test it all | 16:58 |
| arosen | thanks | 16:58 |
| morganfainberg | dstanek, there is an issue iwth wheels and versions of virtualenv gate was stumbling on stuff | 16:58 |
| morganfainberg | dstanek, not sure what the fix was, but finding issues getting packages installed? | 16:59 |
| dstanek | morganfainberg: that makes sense - i just check and it's much more than mine that failing | 16:59 |
| morganfainberg | from pip | 16:59 |
| morganfainberg | dstanek, so ... if i want to avoid the pattern of ._populate_XXXX() ._populate_XXXX() from the token data stuff... how should i approach it? | 17:01 |
| *** jimbaker` has joined #openstack-keystone | 17:01 | |
| morganfainberg | dstanek, i guess TokenModel.set_project(project_id) ? | 17:01 |
| morganfainberg | something where we just set the values we want so it's way way easier to understand what is going on. | 17:02 |
| dstanek | morganfainberg: looking at the original code now | 17:02 |
| *** jimbaker` is now known as jimbaker | 17:02 | |
| morganfainberg | its the whole "make a dict, pass it to the data helper, then build the token_data, then "create the token" | 17:03 |
| dstanek | morganfainberg: what's the likecycle of the object? it appears that is can be created once and get_token_data() can be called many times with different args | 17:05 |
| morganfainberg | dstanek, that is how it works now. the issue is we interact with the token after it's built and setup to be sent out from keystone | 17:06 |
| morganfainberg | there is a bunch of "if this is a token that looks like X do Y" | 17:06 |
| morganfainberg | I was hoping to make the token we interact with a model we can setup and interact with the same way internally across the board | 17:06 |
| morganfainberg | user is always at "token.user" | 17:07 |
| morganfainberg | project is always at token.project | 17:07 |
| *** amcrn has quit IRC | 17:07 | |
| morganfainberg | not token['token_data']['project'] or [access][token_data][project] (not even thinking about trusts OS-TRUST, vs [trust] | 17:07 |
| morganfainberg | the json-ish format should be only for emitting on an interface that needs it. | 17:08 |
| *** harlowja_away is now known as harlowja | 17:08 | |
| *** doddstack has quit IRC | 17:08 | |
| * morganfainberg can scrap this part of the plan as well, but it's a lot of work to consolidate token storage w/o a unified "format". | 17:09 | |
| dstanek | morganfainberg: that would definitely be cleaner | 17:09 |
| *** lbragstad has joined #openstack-keystone | 17:10 | |
| *** thedodd has joined #openstack-keystone | 17:10 | |
| dstanek | morganfainberg: if you can separate it out it would make it easier to provider versioned tokens | 17:10 |
| *** lbragstad has quit IRC | 17:10 | |
| morganfainberg | dstanek, that is the thought | 17:10 |
| *** lbragstad has joined #openstack-keystone | 17:11 | |
| *** joesavak has joined #openstack-keystone | 17:12 | |
| *** lbragstad has quit IRC | 17:13 | |
| *** lbragstad has joined #openstack-keystone | 17:14 | |
| *** gokrokve has joined #openstack-keystone | 17:19 | |
| *** richm has quit IRC | 17:21 | |
| dstanek | bknudson: jamielennox: on line 86 - https://review.openstack.org/#/c/101792/5/keystoneclient/auth/identity/v2.py - i think it's better to just remove the entire passwordCredentials subtree. thoughts? | 17:24 |
| bknudson | dstanek: what's wrong with the username? | 17:31 |
| *** tkelsey_ has quit IRC | 17:32 | |
| dolphm | topol: morganfainberg: rax stock is down 1.7% today. your move. | 17:32 |
| bknudson | dstanek: are you working on updates to https://review.openstack.org/#/c/101792 ? | 17:32 |
| morganfainberg | dolphm, hehe | 17:33 |
| dstanek | bknudson: i was going to do a quick push to address your comments | 17:33 |
| bknudson | dstanek: I had posted an update to another review that passed in a function for the response... | 17:33 |
| bknudson | and I think jamielennox was ok with that approach. | 17:33 |
| bknudson | we have several proposals to fix the problem. | 17:34 |
| bknudson | dstanek: https://review.openstack.org/#/c/106890/ | 17:34 |
| bknudson | actually it was the request, not the response. | 17:36 |
| bknudson | but it would have to handle the response also | 17:36 |
| bknudson | and also handle headers | 17:36 |
| bknudson | and also handle v3 auth request | 17:36 |
| bknudson | but I'm fine with anything as long as it fixes the problem. | 17:36 |
| dolphm | bknudson: dstanek: can one of your review https://review.openstack.org/#/c/106496/ | 17:37 |
| dolphm | you* | 17:37 |
| dstanek | classe sounds french | 17:38 |
| dstanek | someone's ready to go to paris | 17:38 |
| *** richm has joined #openstack-keystone | 17:40 | |
| *** amcrn has joined #openstack-keystone | 17:40 | |
| *** richm has quit IRC | 17:44 | |
| *** richm has joined #openstack-keystone | 17:46 | |
| dstanek | bknudson: are you going to add the other things that need to be obfuscated? | 17:47 |
| bknudson | dstanek: I should have time to work on it later and I'll look into adding those things. | 17:48 |
| bknudson | so I'd either work on https://review.openstack.org/#/c/106890/ or https://review.openstack.org/#/c/101792 whichever seems further along. | 17:48 |
| bknudson | I don't mind working on something and then abandoning it | 17:49 |
| dstanek | i've addressed your comments (except for the test) on https://review.openstack.org/#/c/101792 | 17:51 |
| dstanek | i'll push it up for you to take a look | 17:51 |
| morganfainberg | dstanek, HAH i didn't even see that typo | 17:56 |
| morganfainberg | classe | 17:56 |
| *** marcoemorais has quit IRC | 18:01 | |
| *** marcoemorais has joined #openstack-keystone | 18:02 | |
| *** daneyon has quit IRC | 18:03 | |
| *** marcoemorais has quit IRC | 18:04 | |
| *** marcoemorais has joined #openstack-keystone | 18:04 | |
| arunkant | ayoung or ?: I am trying to add ldap live test for pool changes. Some of ldap live tests add domain_id attribute in user data in LDAP (openLdap), do I need to add custom schema and/or attribute in my local ldap instance to run existing ldap tests locally? Is there any doc related to live test setup | 18:06 |
| ayoung | arunkant, you should be able to use the existing LDAP schema defitnionws for lilvetest. All you are doing is pooling. Devstack sets up openLDAP with RFC based schemes. | 18:08 |
| arunkant | I am running existing livetest in master branch with local openldap and its failing..so it appears missing some needed setup | 18:08 |
| arunkant | There are 8 tests which are failing couple of them associated with domain_id attribute passed to user which maps to inetOrgPerson class and that does not have domain_id attribute | 18:10 |
| arunkant | ayoung: Where ldap live test run with enabled flag? In normal built, I am guessing that the needed environment variable is not set so live test does not run every time. | 18:14 |
| ayoung | arunkant, no, they must be run by hand | 18:14 |
| ayoung | arunkant, wanted CI around them for a long time, but its been provibitive | 18:14 |
| *** vhoward has joined #openstack-keystone | 18:15 | |
| arunkant | oh..okay. So its quite possible that some of these tests may have existing failures in master as well. Is there a way to check as I see failures locally with master branch | 18:16 |
| *** marcoemorais has quit IRC | 18:19 | |
| *** marcoemorais has joined #openstack-keystone | 18:20 | |
| *** marcoemorais has quit IRC | 18:21 | |
| -openstackstatus- NOTICE: python2.6 jobs are failing due to bug 1342262 "virtualenv>=1.9.1 not found" A fix is out but there are still nodes built on the old stale images | 18:22 | |
| *** ChanServ changes topic to "python2.6 jobs are failing due to bug 1342262 "virtualenv>=1.9.1 not found" A fix is out but there are still nodes built on the old stale images" | 18:22 | |
| ayoung | arunkant, keystone meeting now... | 18:22 |
| *** marcoemorais has joined #openstack-keystone | 18:22 | |
| *** marcoemorais has quit IRC | 18:22 | |
| *** marcoemorais has joined #openstack-keystone | 18:22 | |
| *** david-lyle has quit IRC | 18:34 | |
| *** marcoemorais has quit IRC | 18:35 | |
| bknudson | dolphm: https://bugs.launchpad.net/nova/+bug/1342274 opened for auth_token middleware move to keystonemiddleware | 18:35 |
| uvirtbot | Launchpad bug 1342274 in nova "auth_token middleware in keystoneclient is deprecated" [Undecided,New] | 18:35 |
| *** marcoemorais has joined #openstack-keystone | 18:35 | |
| *** marcoemorais has quit IRC | 18:36 | |
| *** marcoemorais has joined #openstack-keystone | 18:36 | |
| *** marcoemorais has quit IRC | 18:36 | |
| *** marcoemorais has joined #openstack-keystone | 18:36 | |
| *** chandankumar has quit IRC | 18:38 | |
| *** hrybacki has joined #openstack-keystone | 18:38 | |
| afaranha | henrynash: Hello, could you help me with some questions in OS-INHERIT extension? | 18:38 |
| morganfainberg | bknudson, added some more projects to that bug report for you | 18:39 |
| bknudson | morganfainberg: I was wondering where they came from1 | 18:39 |
| henrynash | afaranha: sure..but in keystone meeting right now so may be slow to respond… | 18:39 |
| *** chandankumar has joined #openstack-keystone | 18:39 | |
| morganfainberg | can't seem to add cinder though, it's LP being bitchy though i think | 18:39 |
| bknudson | LP is a bitch | 18:39 |
| vishy | morganfainberg: have you seen this/ | 18:41 |
| vishy | 2014-06-27 02:32:58.334 969 TRACE keystone IntegrityError: (IntegrityError) (1215, 'Cannot add foreign key constraint') "\nCREATE TABLE assignment (\n\ttype ENUM('UserProject','GroupProject','UserDomain','GroupDomain') NOT NULL, \n\tactor_id VARCHAR(64) NOT NULL, \n\ttarget_id VARCHAR(64) NOT NULL, \n\trole_id VARCHAR(64) NOT NULL, \n\tinherited BOOL NOT NULL, \n\tPRIMARY KEY (type, actor_id, target_id, role_id), \n\tFORE | 18:41 |
| vishy | KEY(role_id) REFERENCES role (id), \n\tCHECK (inherited IN (0, 1))\n)\n\n" () | 18:41 |
| afaranha | henrynash: No problem :) | 18:42 |
| afaranha | I'm trying to extend the extension to also make a role assigned to a project to be inherited | 18:42 |
| morganfainberg | vishy, you're finding all the awesome db issues. | 18:42 |
| *** vhoward has left #openstack-keystone | 18:42 | |
| morganfainberg | vishy, i'll dig on this post meeting | 18:43 |
| henrynash | afaranha: ok | 18:43 |
| *** david-lyle has joined #openstack-keystone | 18:45 | |
| afaranha | I made some changes (removed this "If" https://github.com/openstack/keystone/blob/master/keystone/assignment/backends/sql.py#L144 ) and added the routes for project. The API is executed and no error is shown, but the database are not being updated. Is there any other place where I need to make adjustments? | 18:46 |
| afaranha | henrynash: I also have the same problem when I tried to assigned a inherit role to a domain different from the default with a new user, new project and new role, maybe this is a bug or just issues in my server? | 18:48 |
| henrynash | afaranha: so we certainly tests non-default domains… | 18:49 |
| henrynash | afaranha: I’ll look at this at the top of teh hour…. | 18:50 |
| *** marcoemorais has quit IRC | 18:51 | |
| *** marcoemorais has joined #openstack-keystone | 18:51 | |
| vishy | morganfainberg: so i think that one is fixed in stable already | 18:57 |
| morganfainberg | vishy, hm. | 18:58 |
| morganfainberg | vishy, i haven't seen that issue though before and if it's fixed in stable, how is master broken? :P | 18:58 |
| vishy | morganfainberg: this was the cause https://review.openstack.org/#/c/95601/ | 18:59 |
| morganfainberg | vishy, ah so.. it's fixed everywhere? | 18:59 |
| morganfainberg | vishy, or that was only merged to icehouse *is confused* | 18:59 |
| morganfainberg | oh | 19:00 |
| morganfainberg | it's both places | 19:00 |
| morganfainberg | ok | 19:00 |
| morganfainberg | sorry was split-attention here and meeting | 19:00 |
| *** gabriel-bezerra has quit IRC | 19:00 | |
| vishy | yes we are running icehouse but hadn’t updated to stable recently | 19:00 |
| morganfainberg | ahh | 19:00 |
| morganfainberg | ok | 19:00 |
| *** gabriel-bezerra has joined #openstack-keystone | 19:01 | |
| morganfainberg | also have the other utf-8 one proposed to stable/icehouse | 19:01 |
| jamielennox | so this: https://review.openstack.org/#/c/84071/ and this https://review.openstack.org/#/c/105065/ are just short a single +2 or +A so it would be good to include them | 19:01 |
| morganfainberg | waiting for eyes | 19:01 |
| morganfainberg | vishy, https://review.openstack.org/#/c/106486/ | 19:01 |
| morganfainberg | vishy, that was already merged to master | 19:01 |
| jamielennox | dolphm: those ^ would be good, particularly the doc one - everything else can wait for another release | 19:02 |
| henrynash | afaranha: so is this the same thing as vishy is discussing with morganfainberg | 19:03 |
| *** gabriel-bezerra has quit IRC | 19:03 | |
| *** gabriel-bezerra has joined #openstack-keystone | 19:04 | |
| dolphm | morganfainberg: where is the infra team? | 19:04 |
| afaranha | henrynash: Is this a bug? | 19:04 |
| dolphm | morganfainberg: i'm tempted to conduct their meeting for them | 19:04 |
| morganfainberg | dolphm, germany | 19:04 |
| morganfainberg | dolphm, for a meetup | 19:04 |
| dolphm | morganfainberg: then i shall do the honors... | 19:04 |
| morganfainberg | dolphm, heheheh | 19:05 |
| morganfainberg | dolphm, +++++++ | 19:05 |
| henrynash | afaranha: so not that I am aware of….although see the issues that were fixed with the table definition in https://review.openstack.org/#/c/95601/ - even with this fix does it still fail? | 19:05 |
| dolphm | morganfainberg: is jeblair on twitter? | 19:06 |
| afaranha | henrynash: sorry, have to go now, I'll check that later, thank you | 19:07 |
| morganfainberg | hmmm. i know sdague is, and mordred is | 19:07 |
| morganfainberg | let me check | 19:07 |
| henrynash | afaranha: ok | 19:07 |
| morganfainberg | don't see him, but i may not know his handle | 19:07 |
| *** lbragstad has quit IRC | 19:08 | |
| *** gabriel-bezerra has quit IRC | 19:10 | |
| *** gabriel-bezerra has joined #openstack-keystone | 19:10 | |
| morganfainberg | dolphm, bknudson, ayoung, jamielennox, dstanek, https://review.openstack.org/#/c/106951/ changed to reflect direct passing of dependencies to the managers instead of via decorators | 19:17 |
| morganfainberg | openstack-gerrit bot has disappeared | 19:18 |
| *** henrynash has quit IRC | 19:25 | |
| *** bklei has joined #openstack-keystone | 19:29 | |
| dolphm | infra is falling apart | 19:30 |
| *** bklei has quit IRC | 19:31 | |
| dolphm | i keep getting signed out of gerrit | 19:32 |
| *** chandankumar has quit IRC | 19:34 | |
| morganfainberg | dolphm, that sounds like a launchpad issue :P | 19:34 |
| *** gabriel-bezerra has quit IRC | 19:40 | |
| *** gabriel-bezerra has joined #openstack-keystone | 19:41 | |
| bknudson | dolphm: I think that was happening to me yesterday. | 19:42 |
| bknudson | it seemed to be happening because I had 2 tabs open, so I started over. | 19:42 |
| *** openstackgerrit has joined #openstack-keystone | 19:43 | |
| *** ukalifon has joined #openstack-keystone | 19:44 | |
| *** rharwood has joined #openstack-keystone | 19:45 | |
| *** jaosorior has quit IRC | 19:52 | |
| dolphm | bknudson: i always have like 20 tabs open :( | 19:55 |
| dolphm | morganfainberg: bknudson: dear GET /v3/catalog -spec reviewers, herein lies API https://review.openstack.org/#/c/106854/ | 19:57 |
| openstackgerrit | Harry Rybacki proposed a change to openstack/python-keystoneclient: Revocation event API https://review.openstack.org/81166 | 19:58 |
| dolphm | openstackgerrit: morganfainberg: \o/ | 19:58 |
| hrybacki | it lives yet again | 19:59 |
| ayoung | hrybacki, run tox coverage and you can see the lines of the patch that don't have tests. Sopme of the v2 vs v3 code was uncovered, which is the comment in model.py previous revision | 20:06 |
| *** daneyon has joined #openstack-keystone | 20:06 | |
| hrybacki | ayoung: damn, okay | 20:06 |
| dolphm | morganfainberg: thanks | 20:07 |
| *** ukalifon has quit IRC | 20:08 | |
| *** arosen has quit IRC | 20:09 | |
| openstackgerrit | A change was merged to openstack/identity-api: The Most Obvious Way to Get a Service Catalog That You Have to See to Believe https://review.openstack.org/106854 | 20:10 |
| *** topol has quit IRC | 20:11 | |
| *** arosen has joined #openstack-keystone | 20:12 | |
| stevemar | marekd, dolphm morganfainberg dstanek confirmed keystoneclient patch with TFIM! | 20:12 |
| *** arosen has quit IRC | 20:12 | |
| *** arosen has joined #openstack-keystone | 20:12 | |
| stevemar | yay ECP! | 20:12 |
| stevemar | booooya | 20:12 |
| morganfainberg | NOICE | 20:13 |
| dstanek | nice | 20:13 |
| stevemar | on the idp side, my saml guy just enable http-basic-auth support | 20:13 |
| stevemar | and i had to make a small change to the headers that were used | 20:13 |
| morganfainberg | dstanek, ok so i think i'll need to keep a little of the magic dependency stuff for the managers themselves. (controllers etc are easy) | 20:13 |
| stevemar | i'll tell marekd about that, hope we can find one that works for both | 20:14 |
| dolphm | i wish i had a saml guy | 20:14 |
| morganfainberg | dstanek, managers will get instantiated and then iterate through and say "set attributes" no "dependency injection" or hard to follow stuff, just a "we're alive, now go do this" | 20:14 |
| morganfainberg | anything else with dependency needs will just consume the registry | 20:14 |
| dstanek | morganfainberg: that's a good start | 20:16 |
| dolphm | stevemar: what was the bug number of the py26 gate blocker? | 20:16 |
| morganfainberg | dstanek, i really want optional stuff to die :( | 20:17 |
| dolphm | stevemar: nvm https://bugs.launchpad.net/openstack-ci/+bug/1342262 | 20:17 |
| uvirtbot | Launchpad bug 1342262 in openstack-ci "virtualenv>=1.9.1 not found for py26 environments" [Undecided,In progress] | 20:17 |
| morganfainberg | dstanek, i wonder if i can figure out a clean way to make it go away. | 20:17 |
| dstanek | dolphm: is that fixed now so we can start rechecking? | 20:17 |
| dolphm | dstanek: yes | 20:17 |
| morganfainberg | dstanek, it was mostly fixed, just some old nodes were lingering | 20:17 |
| stevemar | dolphm, i gotta admit, a good saml guy is pretty helpful | 20:17 |
| dwaite | dolphm, stevemar: would either of you like to review my slide deck for Cloud Identity Summit on OpenStack/Keystone/Federation? | 20:27 |
| dwaite | and wait, you have another good SAML guy? :-( | 20:28 |
| * dwaite feels replaced | 20:28 | |
| stevemar | dwaite, sure | 20:28 |
| dwaite | msg me an email address. I’ll figure out whether PDF of ppt are better for sharing (I used keynote) | 20:29 |
| stevemar | dwaite, my guy knows nothing about openstack, and he doubles as a product guy too :) | 20:29 |
| dwaite | the nice thing about federation protocols like SAML and OIDC are that they are abstractions on the authentication mechanism. So rather than having to support everything under the sun in keystone, you can just outsource it ;-) | 20:30 |
| dwaite | same way the other components in the system are outsourcing authentication/authorizatino to you | 20:30 |
| *** doddstack has joined #openstack-keystone | 20:31 | |
| marekd | dwaite: correct | 20:31 |
| stevemar | dstanek, is rechecking crazy bugs :( https://bugs.launchpad.net/ubuntu/+source/hal/+bug/99704 | 20:31 |
| uvirtbot | Launchpad bug 99704 in hal "Hardware Information crash (dup-of: 99362)" [Undecided,New] | 20:32 |
| uvirtbot | Launchpad bug 99362 in hal "[apport] hal-device-manager crashed with DBusException in __call__()" [Undecided,Fix released] | 20:32 |
| dstanek | stevemar: oops that was a cut-n-paste error me things | 20:32 |
| dstanek | thinks | 20:32 |
| *** david-lyle has quit IRC | 20:32 | |
| *** thedodd has quit IRC | 20:33 | |
| dstanek | so i currently have 15 open tabs for code reviews....this is going to be a long night | 20:34 |
| *** tomoiaga has joined #openstack-keystone | 20:34 | |
| dwaite | my current role has me doing about two core reviews a year | 20:35 |
| dwaite | I tend to be really good at spotting things, so I used to get sucked into every code review | 20:35 |
| dstanek | dwaite: i'm just waiting for my eyes to start bleeding - at least the code is generally in good shape | 20:41 |
| *** david-lyle has joined #openstack-keystone | 20:44 | |
| *** david-lyle has quit IRC | 20:44 | |
| *** david-lyle has joined #openstack-keystone | 20:44 | |
| stevemar | dstanek, i hope one of those tabs is my patch to make revocation migrate by default :( | 20:45 |
| stevemar | dwaite, i liked your pres! | 20:45 |
| dstanek | stevemar: not sure...got a link? i can always open another tab for you | 20:46 |
| stevemar | dstanek, https://review.openstack.org/#/c/96326/ (under adam) then go down the rabbit hole of dependencies | 20:46 |
| tomoiaga | I believe there is a small issue with keystoneclient when using keystoneclient.client.Client without passing in a session object. The problem appears when get_endpoint is called in httpclient which needs an auth plugin. No auth plugin exists and the client complains about missing an endpoint url in the end. | 20:47 |
| dwaite | stevemar: thanks! did I miss anything? | 20:49 |
| dwaite | is free ice cream being added in the Juno timeframe? | 20:49 |
| dolphm | bknudson: err, did a miss the bug number for the keystonemiddleware swap? | 20:58 |
| bknudson | dolphm: https://bugs.launchpad.net/nova/+bug/1342274 | 20:59 |
| uvirtbot | Launchpad bug 1342274 in neutron "auth_token middleware in keystoneclient is deprecated" [Undecided,In progress] | 20:59 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystonemiddleware: prefer identity API v3 over v2 in auth_token https://review.openstack.org/106819 | 21:01 |
| dstanek | stevemar: did you see the ML thread about Alliance from last week? | 21:03 |
| dolphm | bknudson: thanks! | 21:04 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: SAML2 ECP auth plugin https://review.openstack.org/92166 | 21:04 |
| marekd | stevemar: ayoung dstanek dolphm : text/xml header also worked with pure shibboleth idp | 21:04 |
| marekd | stevemar: ayoung dstanek dolphm: so I need again two +2 and +A for /usr/lib/python2.6/site-packages/keystoneclient | 21:05 |
| marekd | for https://review.openstack.org/92166 | 21:05 |
| dstanek | marekd: did you see Alliance on the ML? | 21:05 |
| marekd | dstanek: i did see the thread, didn't read it carefully yet :( | 21:05 |
| marekd | anything really interesting? | 21:05 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Use jsonutils to load adapter response https://review.openstack.org/105065 | 21:06 |
| *** mhu has quit IRC | 21:07 | |
| *** dolphm has quit IRC | 21:07 | |
| *** toddnni has quit IRC | 21:07 | |
| ayoung | marekd, done | 21:07 |
| dstanek | yeah, i think so. he says it has nothing to do with k2k federation, but i'm pretty sure that's exactly what it is - https://wiki.openstack.org/wiki/Inter_Cloud_Resource_Federation | 21:07 |
| *** mhu1 has joined #openstack-keystone | 21:07 | |
| *** dolphm has joined #openstack-keystone | 21:07 | |
| *** ChanServ sets mode: +o dolphm | 21:07 | |
| *** mhu1 is now known as mhu | 21:07 | |
| *** toddnni has joined #openstack-keystone | 21:07 | |
| marekd | ayoung: thank you. | 21:08 |
| marekd | dstanek: ok, i will read it now, otherwise no way i will fall asleep.... | 21:08 |
| stevemar | marekd, thanks! | 21:08 |
| marekd | stevemar: my pleasure. | 21:08 |
| *** lbragstad has joined #openstack-keystone | 21:09 | |
| *** hrybacki has quit IRC | 21:10 | |
| *** marcoemorais has quit IRC | 21:10 | |
| openstackgerrit | A change was merged to openstack/keystone: Make sure unit tests set the correct log levels https://review.openstack.org/106496 | 21:10 |
| *** marcoemorais has joined #openstack-keystone | 21:10 | |
| *** radez is now known as radez_g0n3 | 21:12 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Scope unscoped saml2 tokens. https://review.openstack.org/99704 | 21:13 |
| *** tomoiaga has left #openstack-keystone | 21:16 | |
| dstanek | marekd: it may not put you to sleep - it's pretty short and simple - but he appears to somewhat address catalog discovery and some other things we've talked about | 21:16 |
| marekd | dstanek: i said that i will not be able to sleep if I don't read it. I am in the middle now. | 21:17 |
| dstanek | marekd: ah, when i saw it i actually thought it would put me to sleep and it's the middle of the day here | 21:17 |
| marekd | hehe | 21:18 |
| marekd | dstanek:do you know what "ICFS service." is? I think Google doesnt... | 21:19 |
| dstanek | marekd: i think inter cloud federation service - i think he coined a new term | 21:20 |
| marekd | ah, ok | 21:20 |
| marekd | makes sense. | 21:20 |
| *** lbragstad has quit IRC | 21:26 | |
| *** jsavak has joined #openstack-keystone | 21:27 | |
| *** joesavak has quit IRC | 21:30 | |
| dolphm | bknudson: there's no warning on __init__ that keystoneclient auth_token is deprecated, is there? | 21:32 |
| bknudson | dolphm: I don't think that's been added. | 21:32 |
| bknudson | I haven't seen it | 21:32 |
| *** henrynash has joined #openstack-keystone | 21:33 | |
| *** hrybacki has joined #openstack-keystone | 21:34 | |
| *** henrynash has quit IRC | 21:34 | |
| *** hrybacki has quit IRC | 21:35 | |
| *** hrybacki has joined #openstack-keystone | 21:35 | |
| marekd | dstanek: most of what was described here looks like we already wanted to do, but instead of creating another service enhance Keystone. Separater service might even make sense in a long term solution, but I dont see why not make Alliance a part of Keystone directly. Also, in particular one use case would make joesava super happy, namely "Resource Access Across Clouds", but they assume remote service would contact their Keystone in case 'fore | 21:36 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/python-keystoneclient: add deprecation warning for auth_token https://review.openstack.org/107182 | 21:39 |
| dolphm | bknudson: fixed & | 21:39 |
| dolphm | ^ | 21:39 |
| *** dims__ has quit IRC | 21:48 | |
| *** bklei has joined #openstack-keystone | 21:49 | |
| *** afazekas has quit IRC | 21:50 | |
| *** marekd is now known as marekd|away | 21:52 | |
| *** bklei has quit IRC | 21:54 | |
| *** gabriel-bezerra has quit IRC | 21:59 | |
| *** gabriel-bezerra has joined #openstack-keystone | 22:00 | |
| *** stevemar has quit IRC | 22:02 | |
| *** daneyon has quit IRC | 22:03 | |
| *** jsavak has quit IRC | 22:05 | |
| *** richm has left #openstack-keystone | 22:07 | |
| *** joesavak has joined #openstack-keystone | 22:08 | |
| *** lbragstad has joined #openstack-keystone | 22:11 | |
| *** lbragstad has quit IRC | 22:13 | |
| *** lbragstad has joined #openstack-keystone | 22:16 | |
| *** marcoemorais has quit IRC | 22:19 | |
| *** marcoemorais has joined #openstack-keystone | 22:20 | |
| *** marcoemorais has quit IRC | 22:21 | |
| *** marcoemorais has joined #openstack-keystone | 22:22 | |
| *** marcoemorais1 has joined #openstack-keystone | 22:24 | |
| *** lbragstad has quit IRC | 22:24 | |
| *** marcoemorais1 has quit IRC | 22:25 | |
| *** marcoemorais2 has joined #openstack-keystone | 22:26 | |
| *** marcoemorais2 has quit IRC | 22:27 | |
| *** marcoemorais has quit IRC | 22:27 | |
| *** marcoemorais has joined #openstack-keystone | 22:27 | |
| *** marcoemorais has quit IRC | 22:27 | |
| *** marcoemorais has joined #openstack-keystone | 22:28 | |
| *** jsavak has joined #openstack-keystone | 22:28 | |
| openstackgerrit | Sam Leong proposed a change to openstack/keystone: Disable a domain will revoke domain scoped tokens https://review.openstack.org/107194 | 22:28 |
| *** mfainberg_phone has joined #openstack-keystone | 22:28 | |
| *** joesavak has quit IRC | 22:29 | |
| *** dstanek is now known as dstanek_zzz | 22:29 | |
| *** doddstack has quit IRC | 22:33 | |
| *** mfainberg_phone has quit IRC | 22:35 | |
| *** jsavak has quit IRC | 22:37 | |
| *** david-lyle has quit IRC | 22:39 | |
| *** stevemar has joined #openstack-keystone | 22:42 | |
| *** marcoemorais has quit IRC | 22:43 | |
| *** dims__ has joined #openstack-keystone | 22:45 | |
| *** dims__ has quit IRC | 22:49 | |
| *** dstanek_zzz is now known as dstanek | 22:50 | |
| *** gokrokve has quit IRC | 22:51 | |
| *** marcoemorais has joined #openstack-keystone | 22:59 | |
| *** stevemar has quit IRC | 23:02 | |
| *** dwaite has quit IRC | 23:03 | |
| alex_xu | ayoung, hi | 23:06 |
| *** dwaite has joined #openstack-keystone | 23:09 | |
| ayoung | alex_xu, sorry to ignore, but I'm on deadline | 23:15 |
| alex_xu | ayoung, it's fine, if you are busy I can ping you next time | 23:15 |
| alex_xu | ayoung, I will ping you next week :) thanks | 23:16 |
| *** harlowja is now known as harlowja_away | 23:16 | |
| *** ayoung has quit IRC | 23:19 | |
| *** alex_xu has quit IRC | 23:20 | |
| *** bknudson has quit IRC | 23:24 | |
| *** diegows has quit IRC | 23:38 | |
| *** diegows has joined #openstack-keystone | 23:40 | |
| *** stevemar has joined #openstack-keystone | 23:52 | |
| openstackgerrit | Sam Leong proposed a change to openstack/keystone: Disable a domain will revoke domain scoped tokens https://review.openstack.org/107194 | 23:53 |
| *** marcoemorais has quit IRC | 23:54 | |
| *** gabriel-bezerra has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!