| jamielennox | just remind me, does roles on an unscoped token make sense in V2? | 00:01 |
|---|---|---|
| *** marcoemorais has joined #openstack-keystone | 00:04 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: SAML2 ECP auth plugin https://review.openstack.org/92166 | 00:05 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: prefer identity API v3 over v2 in auth_token https://review.openstack.org/106819 | 00:05 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/106208 | 00:07 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/106232 | 00:07 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone-specs: Updated from global requirements https://review.openstack.org/106233 | 00:07 |
| *** gabriel-bezerra has joined #openstack-keystone | 00:09 | |
| *** marcoemorais has quit IRC | 00:09 | |
| *** marcoemorais has joined #openstack-keystone | 00:10 | |
| *** marcoemorais has quit IRC | 00:10 | |
| morganfainberg | dstanek, dolphm, stevemar, does it make sense to make the *_api object handle things like .assert_X_enabled ? | 00:10 |
| morganfainberg | dstanek, dolphm, stevemar, trying to consolidate some code. | 00:10 |
| *** marcoemorais has joined #openstack-keystone | 00:11 | |
| stevemar | so like federation_api and .assert_federation_enabled? | 00:11 |
| *** marcoemorais has quit IRC | 00:11 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/106210 | 00:11 |
| *** marcoemorais has joined #openstack-keystone | 00:17 | |
| *** marcoemorais has quit IRC | 00:18 | |
| *** marcoemorais has joined #openstack-keystone | 00:18 | |
| *** marcoemorais has quit IRC | 00:18 | |
| *** marcoemorais has joined #openstack-keystone | 00:19 | |
| *** stevemar has quit IRC | 00:26 | |
| *** stevemar has joined #openstack-keystone | 00:26 | |
| *** marcoemorais has quit IRC | 00:27 | |
| *** marcoemorais has joined #openstack-keystone | 00:28 | |
| *** marcoemorais has quit IRC | 00:28 | |
| *** marcoemorais has joined #openstack-keystone | 00:28 | |
| *** marcoemorais has quit IRC | 00:28 | |
| *** marcoemorais has joined #openstack-keystone | 00:29 | |
| *** harlowja_away is now known as harlowja | 00:30 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use keystoneclient fixtures in middleware tests https://review.openstack.org/107212 | 00:34 |
| *** oomichi has joined #openstack-keystone | 00:42 | |
| *** bknudson has joined #openstack-keystone | 00:43 | |
| *** nkinder has quit IRC | 00:43 | |
| *** topol has joined #openstack-keystone | 00:43 | |
| morganfainberg | stevemar, yeah | 00:50 |
| morganfainberg | stevemar, i'll post up the change, you'll see | 00:51 |
| *** ayoung has joined #openstack-keystone | 00:52 | |
| *** dims__ has joined #openstack-keystone | 00:58 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Sync with oslo-incubator https://review.openstack.org/107217 | 00:59 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Move token_api.unique_id to token_provider_api https://review.openstack.org/107218 | 00:59 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Move keystone.token.default_expire_time to token.provider https://review.openstack.org/107219 | 00:59 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Consolidate `assert_XXX_enabled` type calls to managers https://review.openstack.org/107220 | 00:59 |
| *** dims__ has quit IRC | 01:03 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Update middleware that was moved to keystonemiddleware https://review.openstack.org/106478 | 01:11 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Don't log sensitive auth data https://review.openstack.org/101792 | 01:12 |
| *** bknudson has left #openstack-keystone | 01:17 | |
| ayoung | morganfainberg, how the F(*& do we get decent logging out of Keystone in Apache mode? I'm just getting on wsgi line and the LDAP spew... | 01:24 |
| stevemar | ayoung, yeah, that and debug mode no longer works :( | 01:26 |
| *** gabriel-bezerra has quit IRC | 01:26 | |
| ayoung | stevemar, why? Obviously LDAP and something is capable of logging | 01:26 |
| ayoung | and I see that the log messages get mirrored to /var/log/keystone as well as /var/log/httpd/error_log | 01:27 |
| *** gabriel-bezerra has joined #openstack-keystone | 01:27 | |
| stevemar | ayoung, my main issue is that pdb breakpoints no longer work | 01:27 |
| morganfainberg | ayoung, yes, i need to do some fixes for that | 01:27 |
| ayoung | stevemar, ah, yeah, that. I had a thought about running httpd in a single thread, and then attaching a debugger to it | 01:28 |
| jamielennox | morganfainberg: blueprints don't exist for keystonemiddleware? | 01:29 |
| *** marcoemorais has quit IRC | 01:29 | |
| morganfainberg | jamielennox, i was unable to retarget one, LP errored | 01:30 |
| morganfainberg | jamielennox, otherwise they do | 01:30 |
| jamielennox | https://blueprints.launchpad.net/keystonemiddleware | 01:30 |
| *** marcoemorais has joined #openstack-keystone | 01:30 | |
| morganfainberg | hit refresh | 01:31 |
| jamielennox | cool | 01:31 |
| morganfainberg | :) | 01:31 |
| stevemar | ayoung, how does one attach a debugger to httpd? | 01:33 |
| ayoung | stevemar, carefully | 01:33 |
| ayoung | stevemar, daf3bdae226a76926a8a877e1ed4bd7046f9192d checkout that commit | 01:33 |
| ayoung | it seems to imply that the python process can listen on a port to some sort of remote control from pydev | 01:34 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use keystoneclient fixtures in middleware tests https://review.openstack.org/107212 | 01:34 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Create an Auth Plugin to pass to users https://review.openstack.org/107222 | 01:34 |
| *** bknudson has joined #openstack-keystone | 01:35 | |
| ayoung | stevemar, that is the merge commit, it was actually 0f225743e8644416df2f200d710912c40b7acd47 | 01:37 |
| ayoung | from pydev import pydevd | 01:37 |
| ayoung | pydevd.settrace(CONF.pydev_debug_host, port=CONF.pydev_debug_port, stdoutToServer=True, stderrToServer=True) | 01:38 |
| morganfainberg | stevemar, ayoung, you'll want to make sure there is only 1 worker under apache (total) if you do that. | 01:44 |
| morganfainberg | it would be a config in the mod_wsgi part of the vhost | 01:44 |
| ayoung | morganfainberg, that was the first thing I said | 01:44 |
| morganfainberg | pydevd should stull work even under apache | 01:44 |
| ayoung | morganfainberg, need a non GUI debugger, though | 01:45 |
| ayoung | actually, I guess it would work with remote... | 01:45 |
| morganfainberg | ayoung, use eventlet >.< | 01:45 |
| morganfainberg | :P | 01:45 |
| morganfainberg | but remote should work w/ pydevd and apache | 01:45 |
| ayoung | yep... | 01:45 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Create an Auth Plugin to pass to users https://review.openstack.org/107222 | 01:47 |
| jamielennox | morganfainberg: is there a plan yet to remove the git fetch for keystoneclient in keystone tests? | 01:49 |
| morganfainberg | jamielennox, i want to, just not sure... if / when | 01:50 |
| jamielennox | discovered recently that because of this the stable/icehouse and possibly stable/havana keystone requirements must include the up-to-date requirements of keystoneclient so that the stable tests will run | 01:50 |
| jamielennox | otherwise it pulls in the master client which is new and the dependency for client doesn't exist | 01:51 |
| jamielennox | so dumb | 01:51 |
| morganfainberg | jamielennox, well the ppoint is master _shouldn't_ break stable/havana or stable/icehouse | 01:53 |
| *** mberlin1 has joined #openstack-keystone | 01:56 | |
| *** mberlin has quit IRC | 01:56 | |
| *** diegows has quit IRC | 01:58 | |
| *** xianghui^ has joined #openstack-keystone | 02:00 | |
| *** gokrokve has joined #openstack-keystone | 02:01 | |
| *** stevemar has quit IRC | 02:02 | |
| ayoung | morganfainberg, something is wrong with out logging setup, and I have no idea how it works. | 02:04 |
| morganfainberg | ayoung, logging.conf getting in your way? | 02:07 |
| ayoung | morganfainberg, I have no idea. | 02:07 |
| morganfainberg | that is _usually_ my issue, if i've got a logging.conf running it overrides *everything* | 02:08 |
| ayoung | I see only a few debugging loggin statements, even though keystone.cong has debug=true | 02:08 |
| ayoung | so maybe try moving it out of the way? | 02:08 |
| morganfainberg | it's probably logging.conf | 02:08 |
| morganfainberg | yeah. | 02:08 |
| morganfainberg | also, i think there might be an apache setting? | 02:08 |
| morganfainberg | now that i think about it | 02:08 |
| ayoung | no difference | 02:09 |
| ayoung | I have apache set; LogLevel debug | 02:10 |
| morganfainberg | is this unit tests? or devstack and a fully running keystone? | 02:10 |
| morganfainberg | ok so full run | 02:10 |
| morganfainberg | hm. | 02:10 |
| ayoung | keystone in httpd from packstack | 02:11 |
| morganfainberg | is the logging ending up in horizon's log? | 02:11 |
| morganfainberg | by chance? | 02:11 |
| ayoung | only LDAP | 02:11 |
| ayoung | and the dmp of the config | 02:11 |
| * morganfainberg doesn't use packstack. | 02:11 | |
| ayoung | morganfainberg, no one uses packstack | 02:11 |
| ayoung | but it is the setup from the puppet modules | 02:12 |
| morganfainberg | can you post the keystone.conf? and logging.conf? | 02:12 |
| ayoung | morganfainberg, sure. although I just moved logging.conf out of /etc/keystone and no difference | 02:13 |
| morganfainberg | ok so just keystone.conf | 02:13 |
| * morganfainberg really wanted to go for a bike ride today. but another day recovery = good. *slow*... | 02:13 | |
| ayoung | morganfainberg, http://paste.fedoraproject.org/118306/05476837/ | 02:14 |
| morganfainberg | ayoung, yeah looks sane to me | 02:15 |
| ayoung | morganfainberg, I'm going to drop the log_dir value and see what happens | 02:16 |
| morganfainberg | *nod* | 02:16 |
| morganfainberg | also see if the logs are somehow ending in some _other_ apache log location | 02:16 |
| morganfainberg | hat would be my first guess. | 02:16 |
| ayoung | morganfainberg, Ok, now the same data is going to /var/log/keystone/keystone.log | 02:17 |
| ayoung | keystone.common.ldap.core | 02:17 |
| ayoung | but not much else | 02:17 |
| ayoung | keystone.notifications | 02:17 |
| morganfainberg | it's almost as if something has overridded the log levels | 02:17 |
| ayoung | oslo.db.sqlalchemy.session (one line) | 02:17 |
| ayoung | hmmm | 02:18 |
| ayoung | this was actually a manual Keystone setup, on top of a Horizon setup.... | 02:18 |
| ayoung | I see the horizon stuff goingint into /var/log/horizon/horizon.log | 02:19 |
| ayoung | morganfainberg, default_log_levels=amqp=WARN,amqplib=WARN,boto=WARN,qpid=WARN,sqlalchemy=WARN,suds=INFO,iso8601=WARN,requests.packages.urllib3.connectionpool=WARN | 02:21 |
| ayoung | let me tweak that.... | 02:21 |
| morganfainberg | ayoung, that should be fine actually | 02:22 |
| morganfainberg | no keystone specifics. but eh doesn't hurt to add em i guess | 02:23 |
| ayoung | heh...but setting it explicitly kicked things into gear | 02:23 |
| ayoung | morganfainberg, OK, getting somewhere | 02:24 |
| ayoung | morganfainberg, OK, I'm shutting off everything causing spew, and then I'll turn back on just the packages I want...I think this is the trick we need | 02:25 |
| morganfainberg | i think something is wonky in the deep dark defaults | 02:26 |
| morganfainberg | we had this issue back a while ago, somehow "keystone=Warn" snuck in somewhere | 02:26 |
| morganfainberg | like... early icehouse / late havana iirc | 02:26 |
| ayoung | morganfainberg, so I can turn all the spew off now with | 02:36 |
| *** hrybacki has quit IRC | 02:36 | |
| ayoung | default_log_levels = ['amqp=WARN', 'amqplib=WARN', 'boto=WARN', 'qpid=WARN', 'sqlalchemy=WARN', 'suds=INFO', 'iso8601=WARN', 'requests.packages.urllib3.connectionpool=WARN', 'keystone.common.ldap.core=WARN', 'dogpile.core.dogpile=WARN', 'stevedore.extension=WARN', 'oslo.db.sqlalchemy=WARN', 'routes.middleware=WARN', 'keystone.common.wsgi=WARN', 'keystone.middleware.core=WARN', 'keystone.notifications=WARN'] | 02:36 |
| ayoung | I need to turn something back on, now, but DEBUG doesn't seem to do it | 02:36 |
| ayoung | any idea? | 02:37 |
| morganfainberg | ah. | 02:37 |
| morganfainberg | not too far off from what I did https://review.openstack.org/#/c/106496/2/keystone/tests/core.py | 02:37 |
| morganfainberg | that is what we are using for unit tests and it _seems_ sane-ish | 02:37 |
| morganfainberg | is there a global keystone=XXX value you can set? | 02:38 |
| ayoung | I tried appending keystone.common.controller=DEBUG but nope | 02:41 |
| ayoung | I suspect that there is something else? | 02:42 |
| morganfainberg | try keystone=DEBUG | 02:42 |
| morganfainberg | see how ugly it gets. | 02:42 |
| morganfainberg | or did you try that? | 02:42 |
| ayoung | morganfainberg, # Print more verbose output (set logging level to INFO instead | 02:45 |
| ayoung | # of default WARNING level). (boolean value) | 02:45 |
| ayoung | #verbose=false | 02:45 |
| ayoung | verbose=True | 02:45 |
| ayoung | I wonder if that override debug | 02:45 |
| morganfainberg | oh interesting | 02:46 |
| *** gokrokve has quit IRC | 02:49 | |
| *** marcoemorais has quit IRC | 02:49 | |
| *** dims__ has joined #openstack-keystone | 02:52 | |
| *** gokrokve has joined #openstack-keystone | 02:56 | |
| *** daneyon has joined #openstack-keystone | 03:00 | |
| *** stevemar has joined #openstack-keystone | 03:00 | |
| *** daneyon has quit IRC | 03:00 | |
| *** daneyon has joined #openstack-keystone | 03:01 | |
| *** hrybacki has joined #openstack-keystone | 03:03 | |
| ayoung | morganfainberg, what would you expect the format to be to turn on debugging for a specific python module? | 03:07 |
| morganfainberg | add to the default_log_levels <module_path, e.g. keystone.token.core>=Level | 03:08 |
| morganfainberg | there are other ways to do it, including using logging.conf, but that would be the first place i tried | 03:08 |
| ayoung | not making a bit of difference | 03:08 |
| *** harlowja is now known as harlowja_away | 03:16 | |
| *** ukalifon1 has joined #openstack-keystone | 03:30 | |
| *** gokrokve has quit IRC | 03:30 | |
| *** ukalifon1 has quit IRC | 03:31 | |
| ayoung | jamielennox, if I used the Kerberos plugin, that will only setup a Negotiate call for authentication, no? | 03:32 |
| ayoung | https://review.openstack.org/#/c/74974/10/keystoneclient/contrib/auth/v3/kerberos.py,cm | 03:32 |
| jamielennox | ayoung: yep | 03:32 |
| jamielennox | what else do you need it to do? | 03:32 |
| ayoung | jamielennox, so If Want to turn around and list projects with an unscoped token.... | 03:32 |
| *** gabriel-bezerra has quit IRC | 03:32 | |
| jamielennox | it would work the same as before, once the token has been fetched the kerberos work is done | 03:33 |
| *** gabriel-bezerra has joined #openstack-keystone | 03:33 | |
| ayoung | jamielennox, but the whole URL is kerberos protected, not just /auth/tokens | 03:33 |
| jamielennox | so you need kerberos to be present on every request? | 03:34 |
| *** amcrn has quit IRC | 03:34 | |
| ayoung | morganfainberg, which explains why I was seeing no debugging, as it was getting kicked out by HTTPD | 03:34 |
| jamielennox | i think we discussed this and decided to not worry about that case because it means 3 calls per request | 03:35 |
| ayoung | jamielennox, I need to be able to enable it I think, for the list projects call | 03:35 |
| *** chandankumar has joined #openstack-keystone | 03:35 | |
| ayoung | jamielennox, this is why I want unscoped tokens to return the project list | 03:35 |
| ayoung | can I reset the auth url on a session? | 03:36 |
| jamielennox | there isn't a mechanism for that at the moment | 03:36 |
| jamielennox | auth_url is per plugin | 03:36 |
| jamielennox | what is returned from the ednpoint lookup there will come from the service cataog | 03:37 |
| jamielennox | ugh, no service catalog | 03:37 |
| ayoung | jamielennox, so I would reset the auth_url on the plugin to hack it in? | 03:37 |
| ayoung | I think I can do that...proof of concept for now | 03:37 |
| jamielennox | yea, you can do that | 03:38 |
| jamielennox | the other option is just to pass the full url to the session.get | 03:38 |
| ayoung | I think in the future the auth_plugin needs to be able to affect the request setup | 03:38 |
| jamielennox | if it's a fully qualified URL it won't bother doing lookup | 03:38 |
| ayoung | w00T! | 03:40 |
| ayoung | I just logged in with Kerberos | 03:40 |
| jamielennox | ayoung: yea, that's come up unfortunately it get's a bit nasty | 03:40 |
| ayoung | I'm going to leave it for tonight. We'll work on making it clean tomorrow . And the next day. | 03:41 |
| ayoung | jamielennox, but I would like the option to have a completely kerberized session for the unscoped work | 03:41 |
| ayoung | but thanks...I can sleep now | 03:42 |
| *** ayoung is now known as ayoung_ZZzzZZzzz | 03:42 | |
| jamielennox | ayoung: hmm, not sure how it goes seperating scoped from unscoped requests - that could get werid | 03:42 |
| *** xianghui^^ has joined #openstack-keystone | 03:48 | |
| *** xianghui^ has quit IRC | 03:50 | |
| *** dims__ has quit IRC | 04:10 | |
| *** jaosorior has joined #openstack-keystone | 04:13 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Fix mistakes in token fixtures https://review.openstack.org/107228 | 04:23 |
| stevemar | morganfainberg, please sir, one more review https://review.openstack.org/#/c/96326/11 | 04:31 |
| stevemar | jamielennox, you might want to review https://review.openstack.org/#/c/99704/ to make sure it keystoneclient-centric | 04:34 |
| jamielennox | stevemar: i just noticed that the underlying patch went it | 04:34 |
| jamielennox | s/it/in | 04:34 |
| jamielennox | which is fine except perhaps for https://review.openstack.org/#/c/92166/43/setup.cfg | 04:35 |
| stevemar | jamielennox, yep! | 04:35 |
| jamielennox | i'm not sure if there is a situation where you would want to use an unscoped saml token from the cmdline | 04:35 |
| stevemar | jamielennox, oh? is that something that shouldn't be enabled by default? | 04:35 |
| jamielennox | it's the discovery process, it's how you tell either a config file or cmdline what plugin to laod for a name, so it just depends if marekd|away wants it discoverable like that | 04:36 |
| jamielennox | last i spoke to him he was going to write kind of like a manger plugin that would deal with the scoping for you | 04:36 |
| stevemar | jamielennox, well given the fact that there is no CLI for this, it was probably a mistake | 04:36 |
| jamielennox | stevemar: CLIs are automatic now (or soon) so i'm ont sure | 04:37 |
| jamielennox | i don't have a way to test the SAML so i've not been doing much fo the reviews | 04:38 |
| stevemar | jamielennox, I wish I could help with that :( i've got my env. set up but it's all internal stuff | 04:41 |
| jamielennox | stevemar: i should set one up, i'm supposed to be doing a talk in a couple of weeks about federation - i mean i know the principals and i've watched the code go past but eek | 04:42 |
| stevemar | jamielennox, I commented out the changes to setup.cfg, and it seems to work... | 04:42 |
| stevemar | jamielennox, doesn't seem needed at all | 04:42 |
| stevemar | jamielennox, let me know if you want the slides from our ATL talk, I think I have them somewhere | 04:43 |
| jamielennox | stevemar: you'll need to re-run setup.py develop after commenting it out | 04:43 |
| * stevemar shrugs | 04:45 | |
| stevemar | jamielennox it still works as long as i am running a python script | 04:45 |
| jamielennox | stevemar: yea, it's only needed for loading from config and from cli which we don't implement anywhere yet | 04:47 |
| jamielennox | i'd remove it for now until he's sure he wants/needs it | 04:47 |
| stevemar | jamielennox, i'll toss up a patch | 04:48 |
| *** xianghui^^ has quit IRC | 04:48 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Remove SAML unscoped token auth from setup.cfg https://review.openstack.org/107231 | 04:50 |
| stevemar | jamielennox, ^ | 04:50 |
| *** hrybacki has quit IRC | 04:54 | |
| *** dstanek is now known as dstanek_zzz | 04:54 | |
| *** stevemar has quit IRC | 05:07 | |
| *** chandankumar has quit IRC | 05:16 | |
| *** ukalifon has joined #openstack-keystone | 05:23 | |
| *** shausy has joined #openstack-keystone | 05:26 | |
| *** ajayaa has joined #openstack-keystone | 05:32 | |
| *** ayoung_ZZzzZZzzz has quit IRC | 05:32 | |
| *** andreaf has quit IRC | 05:37 | |
| *** dims__ has joined #openstack-keystone | 05:39 | |
| *** dims__ has quit IRC | 05:44 | |
| *** topol has quit IRC | 05:45 | |
| *** shausy2 has joined #openstack-keystone | 05:46 | |
| *** ayoung_ZZzzZZzzz has joined #openstack-keystone | 05:46 | |
| *** shausy has quit IRC | 05:47 | |
| *** chandankumar has joined #openstack-keystone | 05:58 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/106939 | 06:04 |
| openstackgerrit | Andre Naehring proposed a change to openstack/keystone: Add information regarding HTTPS for SSL enabled endpoints https://review.openstack.org/99278 | 06:14 |
| *** tomoiaga has joined #openstack-keystone | 06:16 | |
| *** dwaite has quit IRC | 06:24 | |
| *** dims__ has joined #openstack-keystone | 06:40 | |
| *** dims__ has quit IRC | 06:45 | |
| *** tkelsey has joined #openstack-keystone | 06:50 | |
| *** arosen has quit IRC | 06:51 | |
| *** arosen has joined #openstack-keystone | 06:51 | |
| *** BAKfr has joined #openstack-keystone | 06:55 | |
| openstackgerrit | Andre Naehring proposed a change to openstack/keystone: Add information regarding HTTPS for SSL enabled endpoints https://review.openstack.org/99278 | 06:56 |
| *** d0ugal has quit IRC | 07:07 | |
| *** d0ugal has joined #openstack-keystone | 07:07 | |
| *** junhongl has quit IRC | 07:25 | |
| openstackgerrit | Andre Naehring proposed a change to openstack/keystone: Add information regarding HTTPS for SSL enabled endpoints https://review.openstack.org/95545 | 07:36 |
| *** bvandenh has quit IRC | 07:40 | |
| *** bvandenh has joined #openstack-keystone | 07:53 | |
| *** ChanServ changes topic to "July 9-11 Hackathon notes https://etherpad.openstack.org/p/keystone-juno-hackathon | Now with 100% gate and check runs on Apache deployed Keystone" | 07:54 | |
| *** afazekas has joined #openstack-keystone | 08:03 | |
| *** mberlin1 has quit IRC | 08:20 | |
| *** mberlin has joined #openstack-keystone | 08:22 | |
| *** arosen has quit IRC | 08:26 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Scope unscoped saml2 tokens. https://review.openstack.org/99704 | 08:29 |
| *** ajayaa has quit IRC | 08:29 | |
| *** ajayaa has joined #openstack-keystone | 08:40 | |
| jamielennox | marekd|away: i posted some comments on the older version of that review ^ | 08:41 |
| marekd|away | looking | 08:41 |
| marekd|away | why am i still marked as ...|away... ? | 08:42 |
| *** marekd|away is now known as marekd | 08:42 | |
| jamielennox | but my main thing is that if you want to do like a 'list projects for token' then you should do that on the unscoped token | 08:42 |
| jamielennox | by the time you are creating a scoped token you should know what project_id/domain_id that you want | 08:43 |
| marekd | how is done in a 'normal workflow' ? | 08:43 |
| marekd | is it done* | 08:44 |
| marekd | when user lists his projects? | 08:44 |
| jamielennox | normal work flow is a bit weird because a plugin can be scoped or unscoped | 08:44 |
| jamielennox | but the idea is you get an unscoped token, you list the available projects, you pick a project and scope a token to it | 08:44 |
| marekd | let me read your comments, ok? | 08:46 |
| marekd | no need for you to repeat yourself here. | 08:46 |
| jamielennox | you can list projects with a scoped token as well - but we really shouldn't be promoting that i think | 08:46 |
| marekd | so what do you suggest? | 08:47 |
| marekd | or, let me suggest sth: | 08:47 |
| marekd | unscoped plugin stays as is. | 08:47 |
| marekd | scoped can only scope | 08:47 |
| marekd | and the wrapper will only list projects/domains providing neither was specified | 08:48 |
| jamielennox | what's your usage for listing if not provided? | 08:48 |
| marekd | hm, not....user should be able to list project/domains if he wants to. | 08:48 |
| jamielennox | at the moment list projects/domain is an explict operation | 08:49 |
| *** gabriel-bezerra has quit IRC | 08:49 | |
| marekd | well, you just authenticatd yourself, and you are not sure what project/domains you can access... | 08:49 |
| marekd | what do you mean by explicit here? | 08:49 |
| jamielennox | yep, i mean it is a different step, it's not done in response to not having enough parameters | 08:49 |
| *** gabriel-bezerra has joined #openstack-keystone | 08:50 | |
| jamielennox | so like you get unscoped then call client.federation.projects() or something to get your list | 08:50 |
| marekd | so it should be separated patch, right? | 08:50 |
| jamielennox | and then you scope it using the information from the client call rather than something embedded in the auth plugin | 08:50 |
| jamielennox | could be a new patch | 08:51 |
| jamielennox | because this isn't specific to SAML right? it's a part of federation | 08:52 |
| marekd | yes | 08:52 |
| marekd | actually you are right... | 08:52 |
| jamielennox | so i'd be looking to put it in /v3/contrib/federation/projects or something | 08:52 |
| marekd | do you expect user to be able to call it from his cli? | 08:53 |
| marekd | something like osc --list-fed-projects | 08:53 |
| jamielennox | could do | 08:53 |
| marekd | ok i will see how it is implemented for normal projects. | 08:53 |
| marekd | hm, so probably new AuthMethod could be required for scoping the token | 08:54 |
| marekd | not whole plugin. | 08:54 |
| marekd | new AuthMethod as it sends 'saml2': <id> instead of 'token': <id> in the req body. | 08:54 |
| jamielennox | ok, if it sends new body then yes you need a new AuthMethod | 08:54 |
| jamielennox | I was thinking after you had the unscoped it would just use tha t | 08:55 |
| marekd | the only reason why i extended whole plugin was the list_projects()/list_domains(), otherwise it was using v3.Token goodness. | 08:55 |
| jamielennox | so why does it specify saml2: to scope an unscoped plugin? surely it just presents it's unscoped token | 08:56 |
| *** junhongl has joined #openstack-keystone | 08:56 | |
| marekd | wait, how use? so you want to make one plugin where unscoped is retrieved and automatically scoped? | 08:56 |
| jamielennox | i'm just wondering if we can use v3.Token for this scoping step - and if not why not | 08:57 |
| jamielennox | i was under the impression that once you had an unscoped token via federation it worked pretty much like any other unscoped token | 08:57 |
| openstackgerrit | Andre Naehring proposed a change to openstack/keystone: Add information regarding HTTPS for SSL enabled endpoints https://review.openstack.org/95545 | 08:58 |
| marekd | well, pretty much | 08:59 |
| marekd | but it doesn't do any db lookups checking users etc. | 08:59 |
| marekd | that's why from the user experience it's almost the same. | 08:59 |
| marekd | https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/saml2.py#L23 | 09:00 |
| marekd | jamielennox: what about my comments in https://review.openstack.org/107231 ? | 09:00 |
| tomoiaga | I wonder if there is a clean way of telling keystoneclient (the library) what endpoint to search for. I see endpoint_filter in the httpclient but from what I gather this is only there to satify unit testing. I want to use v3 for keystone stuff (defined in service catalog with a different name) and leave v2 for nova and others. | 09:01 |
| marekd | jamielennox: still here? | 09:05 |
| marekd | answering your question we can use v3.Token base class but with other AuthMethod class, mainly due to https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-federation-ext.md#request-a-scoped-os-federation-token-post-authtokens which was dictated by https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/saml2.py#L50 | 09:07 |
| marekd | now, my question is whether we should only keep wrapper plugin as a top level plugin registered in setup.cfg | 09:07 |
| jamielennox | marekd: sorry, back | 09:12 |
| marekd | sure | 09:13 |
| marekd | ok, i am removing list_{projects, domains} from the code. | 09:13 |
| jamielennox | tomoiaga: that doesn't really make sense because there is a v2 and a v3 client | 09:13 |
| jamielennox | marekd: regarding the setup.cfg if you want to have them there then that's cool, it just means they'll be available eg keystone --os-auth-plugin v3unscopedsaml ... | 09:14 |
| jamielennox | i'm just not sure it they are useful that way | 09:14 |
| marekd | what's the use for v3.Token today ? | 09:15 |
| jamielennox | yes we need the 3 plugins in code, but i was thinking you probably just exposed the top 'saml' plugin in the setup.cfg | 09:15 |
| jamielennox | you can exchange a token for another token, particularly unscoped -> scoped | 09:15 |
| marekd | right, but when users use it? | 09:15 |
| jamielennox | but partially it's just keeping up with what used to be available in client | 09:15 |
| marekd | how do those users get their unscoped token? do they even use it? | 09:16 |
| jamielennox | marekd: i was thinking it would emulate the existing plugins | 09:16 |
| *** oomichi has quit IRC | 09:16 | |
| marekd | my thinking was: if we allow them to do this now with classy tokens we should also allow for that in federation, and that's all. | 09:16 |
| jamielennox | so for example with v2.Password you give auth_url/user/password and you get an unscoped token | 09:16 |
| jamielennox | if you add a tenant_id you get a scoped token | 09:16 |
| jamielennox | same thing for the saml manager - if you don't specify a project_id/domain_id then you get the unscoped token, if you do it automatically scopes it for you | 09:17 |
| marekd | so basically v2.Password <-> Saml2UnscopedToken and v3.Token <-> Saml2Scopedtoken - they are corresponding somehow. | 09:17 |
| marekd | jamielennox: good point with that scoping behaviour. | 09:18 |
| marekd | i am going to finish wrapper patch today. | 09:18 |
| *** bvandenh has quit IRC | 09:18 | |
| tomoiaga | jamielennox: I may have missunderstood how to define the v3 endpoint in the catalog alongside the v2 endpoint but right now if I use the v3 client it will try to use the v2 endpoint from the catalog for some operations other than authentication | 09:18 |
| *** andreaf has joined #openstack-keystone | 09:19 | |
| jamielennox | so i don't know if they relate that directly because v2.Password and v3.Token both can be scoped or unscoped, federation is simply going to be different to what we have already but i'm trying to emulate the existing behaviour | 09:19 |
| jamielennox | tomoiaga: are you using the session? | 09:19 |
| marekd | jamielennox: eh, i can remove entries from setup.cfg and put only one for wraper. I don't really have strong opinions. I don't think any way is better than another, it all depends on how users will use the tokens. | 09:20 |
| tomoiaga | jamielennox: yes. Let me change the v3 endpoint and try something else (I set the service type to identityv3, most likely this is the issue) | 09:21 |
| jamielennox | marekd: i think for the sake of consistency with the existing endpoints it makes sense to just have the manager one in setup.cfg | 09:22 |
| marekd | jamielennox: ok | 09:22 |
| marekd | i am fine with that. | 09:22 |
| jamielennox | marekd: for every entry we are going to have to explain what it is, and i don't know how to tell people to use Saml2ScopedToken from the cmd line | 09:22 |
| jamielennox | tomoiaga: so unfortunately there is a hack we do in the original client that is still up for review in the session code | 09:23 |
| marekd | jamielennox: so how are they using v3.Token today from cli? | 09:23 |
| jamielennox | --os-auth-plugin v3token --os-auth-url http://url:5000/v3 --os-token XXXXXXXXX | 09:23 |
| jamielennox | tomoiaga: you can see it here: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/client.py#L196-L197 | 09:24 |
| marekd | so the use of Saml2ScopedToken would be exactly the same... | 09:24 |
| jamielennox | tomoiaga: so if it's using the v3 client and it gets a /v2.0 endpoint it knows we have a problem and it strips it | 09:24 |
| marekd | jamielennox: ok, we will remove it from setup.cfg but i am just trying to understand the usecases now | 09:24 |
| jamielennox | tomoiaga: we need this because if we just set the endpoint in the service catalog we'd break the world | 09:25 |
| jamielennox | tomoiaga: https://review.openstack.org/#/c/90632/ is the equivalent hack for sessions but it hasn't landed yet | 09:25 |
| jamielennox | tomoiaga: so if you try by creating the Client(username=XXX) etc it will work, or you have to wait for that to pass | 09:26 |
| tomoiaga | jamielennox: yes, that's a hack :) And yes, I just broke the world in my service catalog trying to have multiple endpoints. That is why I figured it would be nice to be able to specify a service type and name or just name since it makes more sense | 09:26 |
| jamielennox | marekd: ok, if it makes sense to have it be usable like that then keep it in, i just thought that you would have to pass a whole bunch of data around that would make it infeasible from the command line | 09:27 |
| tomoiaga | jamielennox: well, I can overwrite the get_endpoint method from the auth plugin since I have my auth plugin anyway, until a better solution comes along | 09:27 |
| *** andreaf has quit IRC | 09:27 | |
| jamielennox | tomoiaga: if you've got your own plugin then yes that's the best way to handle it for now | 09:28 |
| *** andreaf has joined #openstack-keystone | 09:28 | |
| marekd | jamielennox: it's just --os-auth-plugin v3scopedtoken --os-token XXXXXXX --project-id | 09:28 |
| *** dims__ has joined #openstack-keystone | 09:29 | |
| jamielennox | marekd: ok - make sure you put saml somewhere in that plugin name | 09:31 |
| jamielennox | marekd: the other option is to make the manager know that if it receives an --os-token then skip the unscoped step | 09:31 |
| jamielennox | so rather than need to specify user/pass to the saml plugin you could specify token | 09:32 |
| marekd | hm, yeah. | 09:33 |
| *** dims__ has quit IRC | 09:33 | |
| *** kwss has joined #openstack-keystone | 09:35 | |
| marekd | jamielennox: hm, maybe you are able to answer it in 5 secs: does v3.Token complain if project or domain is not specified? | 09:35 |
| marekd | or in case both are specified | 09:36 |
| marekd | ok it does :-) | 09:36 |
| kwss | marekd, I wonder if you could answer a question for me about keystone-to-keystone federation | 09:38 |
| marekd | kwss: hey, i can try :-) | 09:39 |
| jamielennox | marekd: yea, it does | 09:39 |
| kwss | I'm just catching up on the spec and I notice it says no modifications are required to allow Keystone to consume saml assertions | 09:39 |
| marekd | kwss: yes. | 09:39 |
| kwss | but I thought keystone doesn't directly consume assertions at the moment but via apache | 09:39 |
| jamielennox | not for neither, because technically you could get another unscoped token, but it will complain if both are given | 09:39 |
| marekd | kwss: one moment, i will explain it. | 09:40 |
| kwss | marekd, thanks :) | 09:40 |
| marekd | jamielennox: blah.....let me check what happens if we don't scope such token. | 09:40 |
| marekd | kwss: by saying "Keystone consume assertions" we meant "Keystone on top of apache" | 09:46 |
| marekd | kwss: in other words from the SP perspective Icehouse federation code is completely reused. | 09:46 |
| kwss | marekd: ok, can you directly present a SAML assertion to modshib protected apache2? | 09:47 |
| marekd | the only thing that has changed is that you trade your openstack token for saml2 assertion. | 09:47 |
| marekd | kwss: ha! I thought it was impossible, but apparently it is :-) | 09:48 |
| marekd | kwss: let me find sth for you | 09:48 |
| *** dims__ has joined #openstack-keystone | 09:48 | |
| kwss | marekd, ok thanks so much, I didn't realise it was possible either :) | 09:48 |
| *** gabriel-bezerra has quit IRC | 09:48 | |
| marekd | kwss: http://shibboleth.1660669.n2.nabble.com/Authentication-with-SAML2-assertion-only-td7603547.html | 09:49 |
| *** gabriel-bezerra has joined #openstack-keystone | 09:49 | |
| marekd | it's probably nt the most standard way but definitely it's possible, according to shibboleth guys. | 09:49 |
| kwss | marekd, thta's really interesting stuff, I had no idea :) do you know how it works? do you send it as a post to the protected URL or ?? | 09:51 |
| marekd | kwss: i don't know at this point :( | 09:52 |
| marekd | maybe i will be able to try it soon. | 09:53 |
| boris-42 | jamielennox ping | 09:53 |
| kwss | marekd, ok ^^ I shall be interested to know how it all comes together | 09:53 |
| boris-42 | jamielennox now keystone profiling works out of the box | 09:53 |
| boris-42 | jamielennox https://review.openstack.org/#/c/103420/ | 09:53 |
| marekd | stevemar wants to work on it, he is super optimistic about it. | 09:53 |
| kwss | marekd, I look forward to seeing it! | 09:54 |
| *** ajayaa has quit IRC | 09:59 | |
| marekd | kwss: yeah :-) | 09:59 |
| jamielennox | boris-42: excellent, that's cool - i've been wanting to see some ceilometer interaction | 10:02 |
| boris-42 | jamielennox as well I am going after vacation | 10:03 |
| boris-42 | jamielennox to make plugins that will collect audit info | 10:03 |
| boris-42 | jamielennox e..g auth failures and crud operaiton on resources | 10:04 |
| boris-42 | jamielennox so you can try to test one more time my patch | 10:06 |
| marekd | jamielennox: we are not immune to missing X-Subject-Auth in the response from Keystone? | 10:09 |
| marekd | jamielennox: i was expecting InvalidResponse should be raised, rather that KeyError "missing x-subject-auth" | 10:09 |
| jamielennox | marekd: lol, urgh | 10:09 |
| marekd | jamielennox: what? | 10:10 |
| jamielennox | marekd: sounds like a bug | 10:10 |
| jamielennox | they just keep coming :) | 10:10 |
| *** gabriel-bezerra has quit IRC | 10:10 | |
| marekd | hehe, i will double check it. | 10:10 |
| *** gabriel-bezerra has joined #openstack-keystone | 10:11 | |
| openstackgerrit | Andre Naehring proposed a change to openstack/keystone: Add information regarding HTTPS for SSL enabled endpoints https://review.openstack.org/95545 | 10:13 |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Calculate a suitable column width for positional arguments https://review.openstack.org/97873 | 10:16 |
| *** ajayaa has joined #openstack-keystone | 10:22 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Calculate a suitable column width for positional arguments https://review.openstack.org/97873 | 10:30 |
| *** afazekas has quit IRC | 10:32 | |
| *** andreaf has quit IRC | 10:32 | |
| *** andreaf has joined #openstack-keystone | 10:34 | |
| openstackgerrit | A change was merged to openstack/keystone: Clean up the endpoint filtering configuration docs https://review.openstack.org/106475 | 10:43 |
| openstackgerrit | A change was merged to openstack/keystone: render json examples with syntax highlighting https://review.openstack.org/106840 | 10:43 |
| *** dims__ has quit IRC | 11:10 | |
| *** afazekas has joined #openstack-keystone | 11:12 | |
| *** dims__ has joined #openstack-keystone | 11:13 | |
| *** gabriel-bezerra has quit IRC | 11:19 | |
| *** gabriel-bezerra has joined #openstack-keystone | 11:20 | |
| *** kwss has quit IRC | 11:27 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone-specs: Auth Specific Data https://review.openstack.org/107325 | 11:33 |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: Bump hacking to 0.9.x series https://review.openstack.org/98996 | 11:33 |
| marekd | jamielennox: i am tempted to raise an exception in case neither project nor domain were specified | 11:36 |
| marekd | jamielennox: otherwise kerystone will return HTTP 401 | 11:36 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone-specs: Auth Specific Data https://review.openstack.org/107325 | 11:36 |
| marekd | jamielennox: what do you think? | 11:36 |
| *** diegows has joined #openstack-keystone | 11:38 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: Bump hacking to 0.9.x series https://review.openstack.org/98996 | 11:38 |
| jamielennox | marekd: if it doesn't make sense to use it without a project or domain then that's ok | 11:41 |
| marekd | jamielennox: OK | 11:41 |
| marekd | thanks. | 11:41 |
| jamielennox | marekd: have a look at the spec i just posted ^ | 11:42 |
| jamielennox | will that work for the federation case and the normal case? | 11:42 |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: Bump hacking to 0.9.x series https://review.openstack.org/98996 | 11:42 |
| marekd | jamielennox: nvm, let me finish one thing first and i will look at it | 11:44 |
| jamielennox | marekd: no rush | 11:44 |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Bump hacking to 0.9.x series https://review.openstack.org/107328 | 11:48 |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Calculate a suitable column width for positional arguments https://review.openstack.org/97873 | 11:53 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone-specs: Add a catalog to an unscoped token https://review.openstack.org/107333 | 12:01 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Scope unscoped saml2 tokens. https://review.openstack.org/99704 | 12:20 |
| *** dims__ has quit IRC | 12:28 | |
| *** dims__ has joined #openstack-keystone | 12:30 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/100279 | 12:32 |
| *** jamielennox is now known as jamielennox|away | 12:33 | |
| *** bvandenh has joined #openstack-keystone | 12:34 | |
| *** kwss has joined #openstack-keystone | 12:34 | |
| *** ajayaa has quit IRC | 12:35 | |
| *** bknudson has quit IRC | 12:39 | |
| *** gabriel-bezerra has quit IRC | 12:39 | |
| *** gabriel-bezerra has joined #openstack-keystone | 12:40 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: reengineered-federation https://review.openstack.org/104301 | 12:49 |
| *** ajayaa has joined #openstack-keystone | 12:51 | |
| *** bknudson has joined #openstack-keystone | 12:57 | |
| *** radez_g0n3 is now known as radez | 13:02 | |
| *** dstanek_zzz is now known as dstanek | 13:05 | |
| *** hrybacki has joined #openstack-keystone | 13:06 | |
| *** hrybacki has quit IRC | 13:06 | |
| *** hrybacki has joined #openstack-keystone | 13:06 | |
| marekd | https://pbs.twimg.com/media/BpD9YbYIIAAmOrL.png:large | 13:06 |
| *** dvorak has quit IRC | 13:09 | |
| *** vhoward has joined #openstack-keystone | 13:10 | |
| *** joesavak has joined #openstack-keystone | 13:11 | |
| *** dvorak has joined #openstack-keystone | 13:11 | |
| *** diegows has quit IRC | 13:11 | |
| *** hrybacki has quit IRC | 13:12 | |
| *** hrybacki has joined #openstack-keystone | 13:12 | |
| *** diegows has joined #openstack-keystone | 13:14 | |
| *** ajayaa has quit IRC | 13:20 | |
| *** lbragstad has joined #openstack-keystone | 13:21 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone-specs: reengineered-federation https://review.openstack.org/104301 | 13:26 |
| openstackgerrit | Jeffrey Zhang proposed a change to openstack/keystone: Redirect stdout and stderr when using subprocess https://review.openstack.org/51610 | 13:27 |
| *** stevemar has joined #openstack-keystone | 13:28 | |
| *** hyakuhei has quit IRC | 13:30 | |
| *** diegows has quit IRC | 13:31 | |
| *** hyakuhei has joined #openstack-keystone | 13:38 | |
| afaranha | Hello, Did you have issues when trying to use OS-INHERIT extension to assign a inherit role to a domain different from the default with a new user, new project and new role? | 13:42 |
| afaranha | vishy morganfainberg Do you know something about it? | 13:42 |
| *** diegows has joined #openstack-keystone | 13:43 | |
| openstackgerrit | Clayton O'Neill proposed a change to openstack/keystone: Add pluggable range functions for token flush https://review.openstack.org/101726 | 13:44 |
| chandankumar | Hello, | 13:56 |
| chandankumar | for this review https://review.openstack.org/#/c/107079/ | 13:56 |
| *** topol has joined #openstack-keystone | 13:57 | |
| chandankumar | devstack-bashate gate is failing by giving this: http://fpaste.org/118449/19066140/ | 13:57 |
| chandankumar | here is the console log: https://jenkins05.openstack.org/job/gate-devstack-bashate/73/console | 13:58 |
| chandankumar | What is going wrong here? | 13:58 |
| chandankumar | and how to fix it? | 13:58 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: List federated projects and domains https://review.openstack.org/107393 | 14:04 |
| dstanek | chandankumar: you may have better luck asking in the #openstack-dev channel | 14:05 |
| chandankumar | dstanek, i have asked in infra channel. | 14:05 |
| dstanek | chandankumar: and no response? | 14:05 |
| dstanek | chandankumar: have you run bash8 on your code to see if it fails locally? | 14:06 |
| *** gabriel-bezerra has quit IRC | 14:06 | |
| chandankumar | dstanek, got the response | 14:07 |
| *** gabriel-bezerra has joined #openstack-keystone | 14:07 | |
| chandankumar | dtroyer, it is working in my system | 14:07 |
| *** lbragstad has quit IRC | 14:20 | |
| *** lbragstad has joined #openstack-keystone | 14:22 | |
| *** lbragstad has quit IRC | 14:33 | |
| *** tomoiaga has quit IRC | 14:35 | |
| *** shausy2 has quit IRC | 14:39 | |
| *** richm has joined #openstack-keystone | 14:39 | |
| *** joesavak has quit IRC | 14:47 | |
| *** bvandenh has quit IRC | 14:53 | |
| *** lbragstad has joined #openstack-keystone | 14:54 | |
| *** joesavak has joined #openstack-keystone | 14:54 | |
| *** lbragstad has quit IRC | 14:56 | |
| *** lbragstad has joined #openstack-keystone | 14:58 | |
| *** thedodd has joined #openstack-keystone | 15:01 | |
| stevemar | marekd, ping | 15:03 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Remove SAML unscoped token auth from setup.cfg https://review.openstack.org/107231 | 15:07 |
| morganfainberg | dolphm, do we have the specific docs on *what_v3_keystone_consumption_means_for_other_projects* written down anywhere? (besides heat, they're kind of special) | 15:17 |
| *** gokrokve has joined #openstack-keystone | 15:18 | |
| dolphm | morganfainberg: let me know what's missing here http://docs.openstack.org/developer/keystone/http-api.html | 15:18 |
| morganfainberg | dolphm, perfect, thanks | 15:19 |
| morganfainberg | dolphm, hopefully it's all (with the v2->v3 catalog code) "new features, and it works™" | 15:20 |
| dolphm | morganfainberg: ++ | 15:20 |
| *** david-lyle has joined #openstack-keystone | 15:20 | |
| morganfainberg | joe gordon is asking for some specifics | 15:21 |
| morganfainberg | and i think we're at that point that it is really transparent | 15:21 |
| morganfainberg | but... i want to spend some time to be fore before saying it that bluntly :) | 15:21 |
| *** daneyon_ has joined #openstack-keystone | 15:22 | |
| *** afazekas has quit IRC | 15:23 | |
| *** daneyon has quit IRC | 15:25 | |
| *** afazekas has joined #openstack-keystone | 15:25 | |
| bknudson | the clients need to support identity v3 | 15:26 |
| bknudson | e.g., novaclient needs to be changed to support identity v3 | 15:26 |
| bknudson | and if nova is authenticating to talk to neutron then neutronclient needs to support identity v3 | 15:27 |
| bknudson | and then there's new config options that need to be added for the neutron config | 15:27 |
| bknudson | for the domain for the user and project | 15:28 |
| morganfainberg | bknudson, right. | 15:28 |
| bknudson | which we should be able to switch to using the session options | 15:28 |
| morganfainberg | bknudson, ++ | 15:28 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Document authentication plugins https://review.openstack.org/84071 | 15:30 |
| *** afazekas has quit IRC | 15:35 | |
| dolphm | and that helps ^ | 15:41 |
| stevemar | dolphm, aye it does | 15:42 |
| *** ayoung_ZZzzZZzzz is now known as ayoung | 15:44 | |
| *** gokrokve has quit IRC | 15:45 | |
| stevemar | morganfainberg, dolphm, can you guys look at the keystone2keystone stuff? https://review.openstack.org/#/c/100023 | 15:45 |
| morganfainberg | dolphm, bknudson, FYI: https://bugs.launchpad.net/devstack/+bug/1340660 | 15:46 |
| uvirtbot | Launchpad bug 1340660 in devstack "Apache failed to start in the gate" [Undecided,New] | 15:46 |
| morganfainberg | ~242 hits since july 10th | 15:46 |
| morganfainberg | this is likely a result of us gating on mod_wsgi | 15:46 |
| bknudson | how would adding keystone make apache fail when having horizon didn't? | 15:48 |
| afaranha | Hello, Did you have issues when trying to use OS-INHERIT extension to assign a inherit role to a domain different from the default with a new user, new project and new role? | 15:48 |
| morganfainberg | bknudson, because it's slow to release the port and the initi script thinks apache has stopped | 15:49 |
| morganfainberg | bknudson, so start fails to bind | 15:49 |
| bknudson | keystone is? | 15:49 |
| morganfainberg | long long long standing issue with the init scripts on *every* linux distribution | 15:49 |
| morganfainberg | apache is | 15:49 |
| morganfainberg | if you have even a slight delay between the stop and start calls everything is free. | 15:49 |
| morganfainberg | this is more of an issue when mod_wsgi or similar is used to controll an application under apache | 15:50 |
| morganfainberg | apache wiki says "apachectl restart" resolves this. | 15:50 |
| morganfainberg | but no init scripts use apachectl, they insist on using their own mechanism for controlling the processes | 15:50 |
| *** afazekas has joined #openstack-keystone | 15:51 | |
| dstanek | morganfainberg: that sounds like all kinds of fail | 15:52 |
| morganfainberg | dstanek, yeah, welcome to linux distributions :P | 15:53 |
| *** daneyon_ has quit IRC | 15:56 | |
| *** vhoward has left #openstack-keystone | 15:56 | |
| *** daneyon has joined #openstack-keystone | 15:57 | |
| *** afazekas has quit IRC | 15:57 | |
| dolphm | stevemar: i'm working on a revision to the keystone to keystone spec, since it looks like my diff was never applied. | 15:59 |
| dolphm | stevemar: also reviewing it in the process | 15:59 |
| stevemar | yay | 15:59 |
| stevemar | dolphm, i didnt apply your diff because it was made pre-deciding-saml | 15:59 |
| afaranha | morganfainberg: As yesterday Henrynash told me you had some issues like the one I mentioned above, Could you tell me how did you solve it? | 16:00 |
| dolphm | stevemar: then you should have applied it and moved on from there :P | 16:00 |
| stevemar | dolphm, something something hackathon | 16:00 |
| *** jsavak has joined #openstack-keystone | 16:01 | |
| dolphm | stevemar: review lbragstad's patches for api validation and my get-catalog thing while i do this :D | 16:01 |
| * lbragstad lurks | 16:02 | |
| *** joesavak has quit IRC | 16:02 | |
| dolphm | lbragstad: p.s. burritos downstairs today from freebirds - maybe upstairs too | 16:03 |
| * lbragstad stops lurking and starts wandering | 16:03 | |
| *** daneyon has quit IRC | 16:04 | |
| * dolphm is already hungry | 16:04 | |
| *** daneyon has joined #openstack-keystone | 16:07 | |
| dolphm | jamielennox|away: could use your input on https://bugs.launchpad.net/python-keystoneclient/+bug/1292202 | 16:08 |
| uvirtbot | Launchpad bug 1292202 in python-keystoneclient "keystoneclient appears to ignore --os-cacert option" [Undecided,Incomplete] | 16:08 |
| *** daneyon_ has joined #openstack-keystone | 16:10 | |
| *** kwss has quit IRC | 16:13 | |
| *** chandankumar has quit IRC | 16:13 | |
| *** daneyon has quit IRC | 16:14 | |
| *** mfainberg_phone has joined #openstack-keystone | 16:15 | |
| *** andreaf has quit IRC | 16:17 | |
| dstanek | dolphm: any reason not to remove the dep here any just go with this patch? https://review.openstack.org/#/c/106420 | 16:18 |
| dolphm | dstanek: you'll need to squash them in that case | 16:19 |
| dolphm | dstanek: oh wait, maybe you don't! | 16:19 |
| *** lbragstad has quit IRC | 16:20 | |
| dolphm | dstanek: fixed | 16:21 |
| *** mfainberg_phone has quit IRC | 16:21 | |
| bknudson | is lbragstad working again? | 16:22 |
| *** spandhe has joined #openstack-keystone | 16:23 | |
| dstanek | dolphm: nice | 16:24 |
| stevemar | bknudson, i'd say he's not working very hard since he's not on irc | 16:25 |
| stevemar | bknudson, also he keeps wandering around, probably getting lost in the RAX castle | 16:26 |
| bknudson | I still haven't seen that place | 16:26 |
| dstanek | dolphm: yikes, i tried to run that patch, but it appears that my devstack is busted | 16:29 |
| dstanek | stevemar: he's probably working harder because he's not paying attention to the chatter :-) | 16:30 |
| stevemar | dstanek, i'm sticking to my wandering around the castle story, it's funnier in my head | 16:30 |
| *** spandhe has quit IRC | 16:32 | |
| *** marcoemorais has joined #openstack-keystone | 16:33 | |
| *** jdennis has quit IRC | 16:36 | |
| *** spandhe has joined #openstack-keystone | 16:36 | |
| *** tkelsey has quit IRC | 16:38 | |
| *** gokrokve has joined #openstack-keystone | 16:41 | |
| openstackgerrit | Andre Aranha proposed a change to openstack/keystone: Add tests to OS-INHERIT extension https://review.openstack.org/107439 | 16:44 |
| *** BAKfr has quit IRC | 16:45 | |
| morganfainberg | afaranha, hrm? which issues? | 16:46 |
| dstanek | i'll be back a little later - have to go do some public speaking | 16:48 |
| afaranha | When I'm trying to use OS-INHERIT extension to assign a inherit role to a domain different from the default, with a new user, new project and new role the role assignment is not updated with the new information, when I check in sql the column "inherited" stills 0 | 16:48 |
| morganfainberg | dstanek, that sounds sinister | 16:49 |
| morganfainberg | afaranha, so, from what i've read, you need to post the grant to the OS-INHERIT extension for it to have that flag set. let me 2x check | 16:49 |
| morganfainberg | afaranha, i don't think you create the grant then mark it as inherited | 16:49 |
| morganfainberg | afaranha, give me a few minutes (I dug around in this code not too long ago) | 16:50 |
| dstanek | morganfainberg: nah, a friend's company is replatforming and has been asking people to talk about their expertise - i get to talk about Python | 16:51 |
| morganfainberg | dstanek, so. super sinister! ;) | 16:51 |
| afaranha | I think the 3-4 times I checked it I didn't try to create the role with OS-INHERIT | 16:51 |
| *** lbragstad has joined #openstack-keystone | 16:51 | |
| dstanek | morganfainberg: i have to take out the Java-hate slides! | 16:51 |
| morganfainberg | dstanek, dang! but... those are the best ones! | 16:52 |
| morganfainberg | afaranha, yeah let me 2x check, but i think you create it with OS-INHERIT (we should make this a *not-an-exention* in my opinion, but that is a different topic) | 16:53 |
| morganfainberg | afaranha, yes, https://github.com/openstack/keystone/blob/master/keystone/assignment/routers.py#L140-L144 looks like you create the grant with OS-INHERIT | 16:54 |
| afaranha | morganfainberg: Yes, that's why I'm dealing with it right now, helping in this spec https://review.openstack.org/#/c/101017/ | 16:54 |
| morganfainberg | it calls the same thing as the standard create grant, but i think just sets the value | 16:54 |
| * morganfainberg checks a little further | 16:54 | |
| *** amcrn has joined #openstack-keystone | 16:55 | |
| morganfainberg | afaranha, yep, there is a specific check to see if it came through OS-INHERIT | 16:55 |
| morganfainberg | and that is how that bit is set | 16:55 |
| morganfainberg | wow. uh... that is... | 16:55 |
| *** lbragstad has quit IRC | 16:56 | |
| morganfainberg | that could be not-intuitive i guess | 16:56 |
| afaranha | morganfainberg: I'll check that, thank you. I think it should update the existing grant, am I wrong? | 16:57 |
| afaranha | maybe a blueprint for this, or a blueprint for a update function? | 16:58 |
| *** andreaf has joined #openstack-keystone | 17:01 | |
| morganfainberg | afaranha, well grants are immutable | 17:01 |
| morganfainberg | afaranha, afai | 17:01 |
| morganfainberg | k | 17:01 |
| morganfainberg | so, if you want an inherited one, you create one, if you don't want an inherited one create a non-inherited one | 17:01 |
| morganfainberg | it ensures we don't have "well this grant id now is something totally different" | 17:02 |
| morganfainberg | afaranha, so i'd say no, just create the new grant that is inheritable vs. "change one we have" | 17:02 |
| *** afazekas has joined #openstack-keystone | 17:06 | |
| *** dstanek is now known as dstanek_zzz | 17:06 | |
| afaranha | So, if I have, for example, admin role assigned to default domain, and now I want to set it to be inherited, I have to revoke the assignment to assign it again with inherit = True ? | 17:06 |
| morganfainberg | afaranha, or not revoke it and create a new grant that is inherited | 17:07 |
| morganfainberg | afaranha, if that doesn't work, then it should (and could be a bug) | 17:07 |
| morganfainberg | we don't "update" grants. it's a serious headache. | 17:08 |
| morganfainberg | if you want a new / different grant either delete the old one and issue a new one, or just issue a new one (if the old one is valid still) | 17:08 |
| vishy | morganfainberg: have you been keeping up on the hierarchical multitenancy stuff? | 17:10 |
| vishy | unfortunately I’ve been focusing exclusively on network stuff lately | 17:10 |
| *** andreaf has quit IRC | 17:10 | |
| *** afaranha_ has joined #openstack-keystone | 17:13 | |
| morganfainberg | vishy, i have been trying to, but it's hard to keep track of everything going on | 17:13 |
| morganfainberg | vishy, raildo has been working on that mostly iirc | 17:13 |
| *** openstackgerrit has quit IRC | 17:16 | |
| morganfainberg | no openstackgerrit! come back! | 17:16 |
| morganfainberg | >.> | 17:17 |
| *** openstackgerrit has joined #openstack-keystone | 17:17 | |
| *** harlowja_away is now known as harlowja | 17:18 | |
| *** harlowja is now known as harlowja_away | 17:19 | |
| *** harlowja_away is now known as harlowja | 17:19 | |
| *** hrybacki has quit IRC | 17:20 | |
| *** thedodd has quit IRC | 17:21 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Move keystone.token.default_expire_time to token.provider https://review.openstack.org/107219 | 17:24 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Consolidate `assert_XXX_enabled` type calls to managers https://review.openstack.org/107220 | 17:24 |
| *** andreaf has joined #openstack-keystone | 17:25 | |
| *** marcoemorais has quit IRC | 17:33 | |
| *** shakamunyi has joined #openstack-keystone | 17:39 | |
| *** shakamunyi has quit IRC | 17:39 | |
| *** shakamunyi has joined #openstack-keystone | 17:40 | |
| *** hrybacki has joined #openstack-keystone | 17:41 | |
| *** shakamunyi has quit IRC | 17:42 | |
| *** marcoemorais has joined #openstack-keystone | 17:50 | |
| dolphm | bknudson: lbragstad is mostly trying to get his dev environment setup on his shiny new not-ibm laptop | 17:55 |
| *** lbragstad has joined #openstack-keystone | 17:55 | |
| bknudson | dolphm: I hope he's installing linux. | 17:56 |
| dolphm | bknudson: not that i'm aware of | 17:56 |
| bknudson | maybe we should rewrite keystone in .NET | 17:57 |
| *** lbragstad has quit IRC | 17:58 | |
| *** lbragstad has joined #openstack-keystone | 17:59 | |
| stevemar | did something land between the 12th and 14th that made keystone logs in jenkins go over 50 MB ? | 18:00 |
| *** marcoemorais1 has joined #openstack-keystone | 18:02 | |
| *** marcoemorais1 has quit IRC | 18:03 | |
| *** marcoemorais1 has joined #openstack-keystone | 18:03 | |
| *** marcoemorais1 has quit IRC | 18:03 | |
| *** marcoemorais1 has joined #openstack-keystone | 18:03 | |
| *** marcoemorais has quit IRC | 18:04 | |
| *** bvandenh has joined #openstack-keystone | 18:05 | |
| dolphm | lbragstad: abandon https://review.openstack.org/#/c/98621/ now | 18:05 |
| morganfainberg | stevemar, ?? | 18:05 |
| *** otwieracz has left #openstack-keystone | 18:06 | |
| dolphm | morganfainberg: did you patch to reduce them merge? | 18:06 |
| morganfainberg | dolphm, think so *checks* | 18:06 |
| morganfainberg | dolphm, https://review.openstack.org/#/c/106496/ yep | 18:06 |
| *** tesh has joined #openstack-keystone | 18:07 | |
| tesh | تحذير | 18:07 |
| tesh | warning | 18:07 |
| tesh | you may be watched | 18:07 |
| tesh | do usa&israel use the internet(facebook,youtube,twitter, chat rooms ..ect)to spy?? | 18:07 |
| tesh | do usa&israel use the internet 2 collect informations,,can we call that spying?? | 18:07 |
| tesh | do they record&analyse everything we do on the internet,,can they harm you using these informations?? | 18:07 |
| *** tesh has quit IRC | 18:07 | |
| dolphm | morganfainberg: where is ban button | 18:07 |
| morganfainberg | i have to lookup how to do it on IRC, i always forget | 18:07 |
| lbragstad | dolphm: done, https://review.openstack.org/#/c/98621/ thanks! | 18:08 |
| dolphm | morganfainberg: or they already left the channel? | 18:08 |
| morganfainberg | dolphm, already left, got excess flood | 18:09 |
| lbragstad | dolphm: http://irchelp.org/irchelp/changuide.html scroll down to banning | 18:10 |
| *** dims__ has quit IRC | 18:11 | |
| hrybacki | is https://bugs.launchpad.net/python-keystoneclient/+bug/1066785 still a relevant bug? If so, this should be resolved in middleware now, yes? | 18:13 |
| uvirtbot | Launchpad bug 1066785 in python-keystoneclient "auth_token middleware have twice cache for a valided token" [Low,Triaged] | 18:13 |
| *** morganfainberg sets mode: +b *!awrbgh@197.123.75.191 | 18:13 | |
| morganfainberg | hrybacki, i think bknudson | 18:14 |
| morganfainberg | fixed that one | 18:14 |
| morganfainberg | or has a fix pending to solve that | 18:15 |
| hrybacki | morganfainberg: dang | 18:15 |
| *** gabriel-bezerra has quit IRC | 18:15 | |
| bknudson | morganfainberg: I've got a fix in middleware | 18:15 |
| morganfainberg | i think | 18:15 |
| morganfainberg | bknudson, ++ | 18:15 |
| hrybacki | how do we close that bug? | 18:15 |
| *** gabriel-bezerra has joined #openstack-keystone | 18:16 | |
| bknudson | hrybacki: https://review.openstack.org/#/c/102399/ | 18:16 |
| morganfainberg | checking to make sure it's tracked in middleware | 18:16 |
| bknudson | it's not merged | 18:16 |
| bknudson | view it | 18:16 |
| bknudson | it has to be reviewed | 18:16 |
| hrybacki | Oh, got it | 18:16 |
| bknudson | hmm, maybe https://bugs.launchpad.net/keystonemiddleware/+bug/1289075 is a dup of https://bugs.launchpad.net/python-keystoneclient/+bug/1066785 | 18:17 |
| uvirtbot | Launchpad bug 1289075 in keystonemiddleware "'invalid' tokens redundantly remarked as 'invalid'" [Medium,In progress] | 18:17 |
| morganfainberg | hrybacki, https://bugs.launchpad.net/python-keystoneclient/+bug/1066785 is marked as wont' fix and linked to the middleware bug | 18:19 |
| uvirtbot | Launchpad bug 1066785 in python-keystoneclient "auth_token middleware have twice cache for a valided token" [Low,Triaged] | 18:19 |
| hrybacki | morganfainberg: ++ thank you | 18:19 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: add deprecation warning for auth_token https://review.openstack.org/107182 | 18:20 |
| *** afazekas has quit IRC | 18:20 | |
| *** bvandenh has quit IRC | 18:21 | |
| morganfainberg | stevemar, ayoung, hrybacki, if you're poking at a devstack in the near future maybe look at https://review.openstack.org/#/c/102425/ to stand it up, should make the logs for apache-keystone more... uhm.. like they are under eventlet | 18:23 |
| morganfainberg | ayoung, also, what was the fix lastnight for logging? | 18:23 |
| *** mat-lowery has left #openstack-keystone | 18:23 | |
| ayoung | morganfainberg, heh, the fix was to realize my problem was in apache rejecting the request (Kerberos) before it ever got to Keystone | 18:24 |
| morganfainberg | ayoung, ahhh | 18:24 |
| morganfainberg | ayoung, ok :P | 18:24 |
| ayoung | morganfainberg, the problem is that the auth plugin for Kerberos sets up the connection info. But hat is only used to get a token | 18:24 |
| morganfainberg | got it | 18:24 |
| stevemar | morganfainberg, i'll be trying that out soon | 18:26 |
| morganfainberg | stevemar thanks | 18:26 |
| *** thedodd has joined #openstack-keystone | 18:26 | |
| morganfainberg | stevemar, requires 14.04 (apache 2.4) | 18:26 |
| ayoung | morganfainberg, the good news is that I got Kerberized Horizon to work. http://adam.younglogic.com/2014/07/kerberos-for-horizon-and-keystone/ | 18:27 |
| morganfainberg | otherwise it wont matter | 18:27 |
| morganfainberg | ayoung, nice! | 18:27 |
| ayoung | morganfainberg, yep. Still needs more work, but right now I'm taking an admin day. I have an expense report to fill out and a trip to Europe to plan | 18:27 |
| morganfainberg | ayoung, yep, same here (well, at least an expense report to file) | 18:28 |
| dolphm | someone showed me a trick to download all the logs for a jenkins run - i don't recall what it was. wget --recursive and something? | 18:30 |
| *** dims__ has joined #openstack-keystone | 18:35 | |
| *** andreaf has quit IRC | 18:38 | |
| stevemar | dolphm, wget -r ? | 18:57 |
| *** gabriel-bezerra has quit IRC | 18:57 | |
| stevemar | point to a dir | 18:57 |
| dolphm | stevemar: *clears throat*.... | 18:57 |
| dolphm | stevemar: wget -np -nd -r -l0 --accept gz -e robots=off --follow-tags=ref,a http://logs.openstack.org/06/100006/1/check/check-tempest-dsvm-full/6dbf332/ | 18:57 |
| stevemar | np being no-parent, good call | 18:57 |
| stevemar | fancy | 18:58 |
| dolphm | stevemar: i'm going to wrap this into a tool that also unzips everything | 18:58 |
| *** gabriel-bezerra has joined #openstack-keystone | 18:58 | |
| stevemar | gz zips it? | 18:58 |
| dolphm | stevemar: they're already gz'd | 18:58 |
| stevemar | ah | 18:58 |
| dolphm | stevemar: my current task is to un-gz | 18:58 |
| dolphm | but gunzip doesn't like any of the files | 18:58 |
| stevemar | gzip -d that | 18:58 |
| *** ukalifon has quit IRC | 18:59 | |
| dolphm | oh they're html files | 18:59 |
| stevemar | that would explain why you can't gunzip them | 18:59 |
| dolphm | ls | 18:59 |
| dolphm | whoops | 18:59 |
| dolphm | pasteraw is also mishandling unicode apparently :( http://pasteraw.com/pc85nx361ry6c47hzvl9mtzu34op29q | 19:02 |
| *** marcoemorais1 has quit IRC | 19:07 | |
| *** dims__ has quit IRC | 19:08 | |
| *** topol has quit IRC | 19:11 | |
| *** jaosorior has quit IRC | 19:12 | |
| *** marcoemorais has joined #openstack-keystone | 19:27 | |
| *** lbragstad has quit IRC | 19:34 | |
| *** hrybacki has quit IRC | 19:37 | |
| openstackgerrit | Abhishek Kekane proposed a change to openstack/keystone: Keystone service throws error on SIGHUP signal https://review.openstack.org/107482 | 19:45 |
| *** lbragstad has joined #openstack-keystone | 19:46 | |
| *** Chicago has quit IRC | 19:54 | |
| *** navid has joined #openstack-keystone | 20:00 | |
| navid | hi | 20:00 |
| navid | anybody knows about the kesystoneclient/tests/v3/test_revoke.py it is not in the master | 20:02 |
| navid | so how to test model.py in keystoneclient | 20:02 |
| *** afaranha_ has quit IRC | 20:04 | |
| dolphm | stevemar: https://github.com/dolph/dotfiles/blob/master/bin/logcp | 20:05 |
| stevemar | dolphm, hate those robots | 20:05 |
| dolphm | navid: where *was* that file? | 20:06 |
| stevemar | dolphm, i added a new library (some saml one) to my machine, and added it to requirements.txt, and it shows up in the tox env i'm using... but when i run a test, tox does that silly thing where it runs 0 tests cause of import errors :\ | 20:07 |
| dolphm | stevemar: import error on the new dep? | 20:07 |
| dolphm | stevemar: how do you know it's in the tox env? | 20:07 |
| stevemar | .tox/debug/bin/pip show <library_name> | 20:08 |
| dolphm | .tox/whatever/bin/python -c "import newlib" ? | 20:08 |
| stevemar | dolphm, that works too | 20:09 |
| dolphm | stevemar: debug won't be the tox env that the test runner is using | 20:09 |
| dolphm | stevemar: maybe blow away tox and let it rebuild? | 20:09 |
| stevemar | dolphm, it will be if i use tox -e debug test_name | 20:10 |
| stevemar | dolphm, tried that too | 20:10 |
| stevemar | dolphm, either way, i installed it under py27 too | 20:10 |
| stevemar | bah, i'll blow it all away | 20:11 |
| stevemar | grumble grumble | 20:11 |
| navid | @dolphm: the kesystoneclient/tests/v3/test_revoke.py and this is the review:https://review.openstack.org/#/c/81166/29/keystoneclient/tests/v3/test_revoke.py | 20:13 |
| *** dims has joined #openstack-keystone | 20:14 | |
| dolphm | navid: that file is being added by that review | 20:14 |
| dolphm | navid: use 'git review -d 81166' to check it out | 20:14 |
| navid | @dolphm: thanks | 20:19 |
| *** dstanek_zzz is now known as dstanek | 20:25 | |
| morganfainberg | hmm. | 20:26 |
| * morganfainberg tries to remember the next step in non-persistent tokens. | 20:26 | |
| morganfainberg | ooh i know rm -rf keystone/token/backends , doing it right? | 20:27 |
| dolphm | morganfainberg: ++ | 20:44 |
| *** lbragstad has quit IRC | 20:44 | |
| dolphm | morganfainberg: last step: fix what breaks | 20:44 |
| *** lbragstad has joined #openstack-keystone | 20:45 | |
| *** stevemar has quit IRC | 20:49 | |
| *** andreaf has joined #openstack-keystone | 20:54 | |
| *** diegows has quit IRC | 20:55 | |
| *** mgarza has joined #openstack-keystone | 21:00 | |
| *** afazekas has joined #openstack-keystone | 21:05 | |
| *** diegows has joined #openstack-keystone | 21:12 | |
| *** hrybacki has joined #openstack-keystone | 21:13 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone-specs: Federating multiple Keystones https://review.openstack.org/100023 | 21:16 |
| *** jsavak has quit IRC | 21:21 | |
| *** hrybacki has quit IRC | 21:23 | |
| *** gabriel-bezerra has quit IRC | 21:23 | |
| *** gabriel-bezerra has joined #openstack-keystone | 21:24 | |
| *** radez is now known as radez_g0n3 | 21:31 | |
| *** mrmoje has joined #openstack-keystone | 21:31 | |
| *** tatialchueyr has joined #openstack-keystone | 21:31 | |
| *** marcoemorais has quit IRC | 21:32 | |
| *** marcoemorais1 has joined #openstack-keystone | 21:32 | |
| dolphm | omg so many new transient bugs :'( | 21:38 |
| morganfainberg | dolphm, i know :( | 21:38 |
| *** mrmoje has quit IRC | 21:43 | |
| *** tatialchueyr has quit IRC | 21:49 | |
| *** topol has joined #openstack-keystone | 21:56 | |
| *** gabriel-bezerra has quit IRC | 21:56 | |
| *** gabriel-bezerra has joined #openstack-keystone | 21:56 | |
| *** david-lyle has quit IRC | 22:00 | |
| *** david-lyle has joined #openstack-keystone | 22:01 | |
| *** diegows has quit IRC | 22:05 | |
| *** diegows has joined #openstack-keystone | 22:18 | |
| *** lbragstad has quit IRC | 22:30 | |
| *** dims_ has joined #openstack-keystone | 22:34 | |
| *** bknudson has quit IRC | 22:36 | |
| *** lbragstad has joined #openstack-keystone | 22:37 | |
| *** dims has quit IRC | 22:38 | |
| *** thedodd has quit IRC | 22:45 | |
| *** jamielennox|away is now known as jamielennox | 22:52 | |
| *** mrmoje has joined #openstack-keystone | 22:59 | |
| *** lbragsta_ has joined #openstack-keystone | 23:01 | |
| *** lbragsta_ has quit IRC | 23:01 | |
| *** mrmoje has quit IRC | 23:03 | |
| *** lbragstad has quit IRC | 23:04 | |
| *** gokrokve has quit IRC | 23:04 | |
| *** mrmoje has joined #openstack-keystone | 23:05 | |
| *** gokrokve has joined #openstack-keystone | 23:05 | |
| *** gokrokve has quit IRC | 23:10 | |
| *** mrmoje has quit IRC | 23:10 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone-specs: Auth Specific Data https://review.openstack.org/107325 | 23:14 |
| *** david-lyle has quit IRC | 23:19 | |
| *** afazekas has quit IRC | 23:27 | |
| *** diegows has quit IRC | 23:32 | |
| *** mgarza has quit IRC | 23:42 | |
| *** mgarza has joined #openstack-keystone | 23:43 | |
| *** mgarza has quit IRC | 23:45 | |
| *** mgarza has joined #openstack-keystone | 23:45 | |
| *** miqui has quit IRC | 23:47 | |
| *** mgarza has quit IRC | 23:47 | |
| *** mgarza has joined #openstack-keystone | 23:48 | |
| jamielennox | dolphm: i'd like to get some eyes on https://review.openstack.org/#/c/107228/ which should be fairly simple, then a release? | 23:48 |
| *** hrybacki has joined #openstack-keystone | 23:49 | |
| *** diegows has joined #openstack-keystone | 23:52 | |
| *** diegows has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
