| jamielennox | i have the whole acaedmic paper on role delegation printed out from the guy we met at summit, i really need to read that cause i think it will nail that problem of role scoping | 00:00 |
|---|---|---|
| gyee | role scoping is essential | 00:00 |
| gyee | right now role definition is global and flat | 00:01 |
| jamielennox | yep, i was going to wait for the hierarchical projects to happen before diving into that | 00:01 |
| gyee | hierarchical project needs role scoping | 00:02 |
| * jamielennox seems keen to do anything to get back to server side | 00:02 | |
| jamielennox | so i guess the question is like this, if we were to split keystone such that the token authentication process was different to the CRUD process, which side would listing projects for a token fall on | 00:04 |
| jamielennox | given it's current URL /users/{id}/projects i would say CRUD | 00:04 |
| jamielennox | given my other blueprint of /auth/projects - i could go either way | 00:04 |
| *** ncoghlan is now known as ncoghlan_afk | 00:05 | |
| jamielennox | if you say that the route is purely auth, then it makes sense to use the auth_url to get that data | 00:05 |
| jamielennox | if you say that the route is CRUD related, then you should be using the service catalog to figure out which keystone endpoint to query that data from | 00:06 |
| *** henrynash has quit IRC | 00:06 | |
| jamielennox | and given that the unscoped token should contain a catalog so that it can find that endpoint | 00:06 |
| *** hrybacki_ has joined #openstack-keystone | 00:09 | |
| *** ncoghlan_afk is now known as ncoghlan | 00:10 | |
| gyee | jamielennox, yeah, I don't have a good answer right now | 00:10 |
| gyee | still thinking it through | 00:10 |
| jamielennox | gyee: that's fine, no particular rush i think | 00:11 |
| *** hrybacki has quit IRC | 00:12 | |
| gyee | too many moving parts need to put together | 00:16 |
| * gyee is drawing circles and squares on his board | 00:18 | |
| *** zzzeek has quit IRC | 00:18 | |
| *** gokrokve has quit IRC | 00:23 | |
| *** nkinder has joined #openstack-keystone | 00:24 | |
| *** gokrokve has joined #openstack-keystone | 00:25 | |
| *** gokrokve has quit IRC | 00:26 | |
| *** dims_ has joined #openstack-keystone | 00:27 | |
| *** hrybacki_ has quit IRC | 00:27 | |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Clean up openstack-common.conf https://review.openstack.org/104000 | 00:31 |
| *** xianghuihui has joined #openstack-keystone | 00:34 | |
| *** xianghuihuihui has quit IRC | 00:34 | |
| stevemar | jamielennox, i like your reply, 'muck around in the database, orrrr... use this much simple alternative' | 00:36 |
| jamielennox | stevemar: :) | 00:36 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix revoking a scoped token from an unscoped token https://review.openstack.org/109389 | 00:37 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add a test for revoking a scoped token from an unscoped https://review.openstack.org/109125 | 00:37 |
| morganfainberg | stevemar, 'this one weird alternative' | 00:38 |
| morganfainberg | stevemar, 'discovered by a stay-at-home mom' | 00:40 |
| morganfainberg | stevemar, no? :P | 00:40 |
| stevemar | morganfainberg, 'doctors hate her!' | 00:43 |
| jamielennox | ergh, i thought all that revoked token model stuff in client was still in review, | 00:44 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove trust dependency on token_api https://review.openstack.org/109462 | 00:44 |
| morganfainberg | jamielennox, isn't it? | 00:46 |
| morganfainberg | jamielennox, *doesn't think he approved it* | 00:46 |
| morganfainberg | jamielennox, https://review.openstack.org/#/c/81166/ | 00:46 |
| morganfainberg | ? | 00:46 |
| jamielennox | i was holding up the token model stuff because i didn't want another token abstraction format | 00:46 |
| jamielennox | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/contrib/revoke/model.py | 00:47 |
| morganfainberg | jamielennox, phsaw, it's not being used | 00:47 |
| morganfainberg | *yet* | 00:47 |
| morganfainberg | fix it :) | 00:47 |
| jamielennox | i bet it was in that 0.10 release though | 00:48 |
| morganfainberg | make it use accessinfo or something. | 00:48 |
| morganfainberg | jamielennox, meh, | 00:48 |
| jamielennox | i had that patch | 00:48 |
| morganfainberg | jamielennox, quick get it fixed before 1.11 | 00:48 |
| dstanek | morganfainberg: i tried to read the token coversation, but i got lost. then i got bored | 00:48 |
| morganfainberg | dstanek, i don't think you're missing much at the moment, but there is a spec up that sortof outlines what ayoung-food wants | 00:49 |
| *** cjellick_ has joined #openstack-keystone | 00:49 | |
| dstanek | morganfainberg: other than the cookie one? | 00:49 |
| morganfainberg | dstanek, that was the bulk of the convo | 00:50 |
| morganfainberg | dstanek, the other token convo from this morning was related but not directly | 00:50 |
| jamielennox | i think the spec is kind of misleading | 00:50 |
| morganfainberg | dstanek, it was just a "what does an id-only token really look like, and how big is it" | 00:50 |
| jamielennox | it mentions a whole lot of web stuff that is not relevant to us | 00:50 |
| jamielennox | i think the whole spec can be summed up as "treat a scoped token like a SAML assertion, a service verifies the token, caches it, and issues a UUID to reference it. Further communications with that service use the UUID for auth" | 00:52 |
| *** cjellick has quit IRC | 00:52 | |
| jamielennox | when you say that and stop talking about session cookies i think there is merit in it | 00:53 |
| morganfainberg | jamielennox, maybe | 00:53 |
| morganfainberg | jamielennox, i'm not really convinced though. i think it doesn't *Really* solve the issue that people are complaining about, it solves it... sortof, kindof, but probably wont convince people that it is better than uuid tokens | 00:54 |
| jamielennox | _if_ there is as much concern over token size as ayoung-food thinks | 00:54 |
| *** cjellick_ has quit IRC | 00:54 | |
| morganfainberg | jamielennox, because UUID tokens are small and still work, why would i fight with them. | 00:54 |
| morganfainberg | erm fight with PKI tokens ever | 00:54 |
| morganfainberg | and k2k is going to use SAML (cc stevemar ) if i remember correctly | 00:55 |
| jamielennox | really? interesting | 00:55 |
| morganfainberg | and then just issue a new token for the remote deployment | 00:55 |
| * morganfainberg needs to go, gym time. | 00:55 | |
| stevemar | morganfainberg, thats the plan, we issue a *very* basic SAML token | 00:57 |
| jamielennox | stevemar: why go SAML? | 00:57 |
| dstanek | i guess i just don't understand why the proposal is better than uuid tokens | 00:57 |
| jamielennox | dstanek: i'm not backing it yet, but two things | 00:57 |
| jamielennox | 1. uuid tokens are scoped to a service | 00:58 |
| morganfainberg | dstanek, thats kind of where i am at. we could make UUID tokens a lot better behind the scenes (there is some security things that could be done with cookies..but i think that is something a bit different and *not* really the conversation) | 00:58 |
| stevemar | jamiec, because it's standard, and we already have the other side of the equation done (the service provider side) | 00:58 |
| stevemar | jamielennox, ^ | 00:58 |
| stevemar | jamiec, oops, ignore that | 00:58 |
| jamielennox | 2. you aren't talking to keystone to do uuid validation. that cache is maintained per service, you still get the benefit of PKI for the setup | 00:58 |
| jamielennox | given that auth_token caches UUID tokens i don't know how much of a benefit 2 is | 00:59 |
| dstanek | jamielennox: why can't uuid tokens grow those features? it just seems like we'll add another way to do the same thing...again | 00:59 |
| jamielennox | dstanek: no idea, i've known about this for about an hour and i'm trying to reason it out through a hangover - just saying i think the spec confused more than helped | 01:01 |
| dstanek | jamielennox: definitely | 01:01 |
| morganfainberg | jamielennox, ah the good old hangover + programming | 01:01 |
| dstanek | jamielennox: should we be extra cautious with anything you push today? | 01:02 |
| jamielennox | stevemar: so is it purely so that it can be pushed through mod_shib or similar because it seems like the best format for k2k would be our existing token structure | 01:02 |
| jamielennox | openstack 4th birthday party last night, the tab went further than expected | 01:02 |
| jamielennox | even my parties are work related :( | 01:02 |
| stevemar | jamielennox, at least at those parties it's someone else picking up the tab :D | 01:03 |
| morganfainberg | jamielennox, i haven't ended up hungover from a work party in many jobs | 01:03 |
| morganfainberg | jamielennox, and many years ago. | 01:03 |
| * morganfainberg drinks a lot less these days (not that I drank a ton before) | 01:04 | |
| *** ncoghlan is now known as ncoghlan_afk | 01:08 | |
| dstanek | i hate it when the mistake is so stupid and obvious that you don't see it | 01:10 |
| *** ayoung-food is now known as ayoung | 01:11 | |
| ayoung | morganfainberg, if you replaced the random number key with a hash of the token in that spec, you'd basically have what we have now. | 01:12 |
| ayoung | I only went with the random number to guard against attacks. | 01:12 |
| ayoung | If each service salted the tokens to make a hash differently, the tokens would not be replayable, but...that breaks down pretty quickly | 01:12 |
| *** marcoemorais has quit IRC | 01:12 | |
| dstanek | ayoung: can't you just replay the random number? | 01:13 |
| ayoung | dstanek, yeah, but that is not what I meant by replayable | 01:14 |
| ayoung | I mean that if a user hands a token to nova, and then to glance, glance couldn't turn around and hand the token back to nova again | 01:14 |
| dstanek | ayoung: what prevents that from working? | 01:18 |
| ayoung | dstanek, morganfainberg do you know if you can put something into memcached and refer to it with multiple keys, or do you end up having to duplicated it? | 01:22 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix revoking a scoped token from an unscoped token https://review.openstack.org/109389 | 01:25 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add a test for revoking a scoped token from an unscoped https://review.openstack.org/109125 | 01:25 |
| dstanek | ayoung: you will duplicate it | 01:29 |
| ayoung | dstanek, dang | 01:29 |
| ayoung | dstanek, it would be cool if the hash version and the "lets giveyou a randome number" version could both point at the same data | 01:30 |
| *** gyee has quit IRC | 01:31 | |
| dstanek | memcached is an odd beast | 01:31 |
| dstanek | i've often wondered if we have a high eviction rate in a real environment | 01:32 |
| ayoung | dstanek, I guess we could continue to use the hash as the Session Cookie value. | 01:33 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Add an example of using v3 client with sessions https://review.openstack.org/108839 | 01:34 |
| dstanek | is there any trust between services? when we get a token from a user we want to make sure it's from them, but if the token comes from another service does that matter? | 01:35 |
| ayoung | dstanek, I'm trying to be able to make the answer to that "No." | 01:38 |
| ayoung | As in "No trust between services" | 01:38 |
| ayoung | dstanek, Ideally, the user would determine what they want the remote service to do and say "you can do only this" and that information would be encoded in the token | 01:39 |
| dstanek | ayoung: why not? i don't think you are wrong, i'm just trying to understanc | 01:39 |
| ayoung | dstanek, there is a use case out there from the MOC (Massachussets Open Cloud) where they are trying to create an exchange | 01:40 |
| dstanek | ayoung: and have a well known set of workflows? | 01:40 |
| ayoung | so a user may decide to build a system where different parts come from different vendors | 01:40 |
| ayoung | and user keystone to authorizer it | 01:40 |
| ayoung | authrize | 01:40 |
| ayoung | Yeah, well known workflows, plus parsing the policy files | 01:41 |
| dstanek | ayoung: for examle, we'd have a 'snapshot' workflow where nova gets a token that says 'you can make snapshots with this' | 01:41 |
| dstanek | and that in turn allows nova to use that token against glance because that is a part of the snapshot workflow | 01:41 |
| dstanek | ...at least that's the way i've been trying to conceptualize this | 01:42 |
| ayoung | dstanek, that is what I meant when I wrote http://adam.younglogic.com/2013/07/a-vision-for-keystone/ | 01:42 |
| ayoung | dstanek, in theory, if a user could look at the policy file, they could get a token which says which operations can be performed | 01:42 |
| ayoung | so they send it to nova, and nova sends it to glance. Glance will only allow the operations that are in the token to be performed | 01:43 |
| dstanek | ayoung: i don't think the policy file is the right place for that | 01:44 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Use oslosphinx to generate doc theme https://review.openstack.org/109470 | 01:44 |
| stevemar | dstanek, ^ | 01:44 |
| ayoung | dstanek, its necessary. How else can you map from roles to operations? | 01:44 |
| dstanek | i wouldn't want the user to know how any of the operations are actually carried out - they would just know what they want | 01:44 |
| *** topol has joined #openstack-keystone | 01:45 | |
| *** mberlin1 has joined #openstack-keystone | 01:45 | |
| dstanek | ayoung: i think the user knows they want a snapshot and somewhere in openstack the operator has confugured that to mean something | 01:46 |
| *** mberlin has quit IRC | 01:46 | |
| ayoung | dstanek, with the policy file it is unambiguous. Anything else will be another system to be kept in sync | 01:46 |
| dstanek | ayoung: but a policy file doesn't define what it means to create a snapshot | 01:47 |
| ayoung | dstanek, you may need more information, but with the policy file, if you know the operation, you know the roles you need to specify in the token to prove you have access to the operation | 01:48 |
| ayoung | dstanek, you may need more information, but I think you need the policy file at least | 01:49 |
| *** xianghuihui has quit IRC | 01:52 | |
| *** xianghuihuihui has joined #openstack-keystone | 01:52 | |
| *** ncoghlan_afk is now known as ncoghlan | 01:56 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: remove static files from docs https://review.openstack.org/109472 | 01:57 |
| *** amerine has quit IRC | 02:02 | |
| *** lcheng has quit IRC | 02:03 | |
| *** amerine has joined #openstack-keystone | 02:04 | |
| *** alex_xu has joined #openstack-keystone | 02:07 | |
| bknudson | apparently revocation events are also totally broken with v2 tokens also | 02:09 |
| *** dolphm changes topic to "{"feature_proposal_freeze": "august 21", "feature_freeze": "september 4"}" | 02:09 | |
| dolphm | bknudson: on the client side? | 02:10 |
| bknudson | dolphm: no, it's the server... and I guess the client would be broken too | 02:10 |
| bknudson | if it was trying to compare against revocation events. | 02:10 |
| dolphm | bknudson: what about hte server is broken? | 02:11 |
| bknudson | pp token['expires'] -> datetime.datetime(2014, 7, 25, 3, 8, 28, 521819) | 02:11 |
| bknudson | pp token['expires'] -> datetime.datetime(2014, 7, 25, 3, 9, 58) | 02:11 |
| bknudson | v2 tokens only have the expiration to the nearest second | 02:11 |
| bknudson | I must be wrong about this because otherwise there'd have to be failures all over the place. | 02:13 |
| dolphm | bknudson: so assume worst case when you're enforcing (?) | 02:13 |
| bknudson | dolphm: I added a test here https://review.openstack.org/#/c/109125/4/keystone/tests/test_v3_auth.py | 02:13 |
| bknudson | see line 1338 | 02:13 |
| bknudson | it does a DELETE of the token and then HEAD and the HEAD returns 200 rather than 404 | 02:14 |
| * dolphm is reading... | 02:14 | |
| bknudson | dolphm: I think I can try the worst case... maybe the model could truncate the timestamp | 02:14 |
| bknudson | and v3 could truncate the timestamp | 02:16 |
| dolphm | bknudson: are we marking pki tokens invalid in the backend still? | 02:17 |
| bknudson | dolphm: y, I think the default is to mark pki tokens invalid in the backend. | 02:17 |
| bknudson | I think there's a switch for it. | 02:17 |
| dolphm | bknudson: i suspect that's why you're getting 4xx in the first test instead of 200s | 02:18 |
| bknudson | not just pki tokens but all tokens | 02:18 |
| dolphm | maybe | 02:18 |
| dolphm | bknudson: right | 02:18 |
| bknudson | dolphm: these tests set that switch in their config_overrides() | 02:18 |
| bknudson | dolphm: well, I've got a fix for the issues with v3 tokens | 02:19 |
| bknudson | and it's in the models. | 02:19 |
| bknudson | so I've got that working | 02:19 |
| bknudson | dolphm: https://review.openstack.org/#/c/109389/ | 02:20 |
| *** gabriel-bezerra has quit IRC | 02:20 | |
| bknudson | I've just added a test for v2 tokens and that didn't work as expected either | 02:20 |
| *** bobt has quit IRC | 02:20 | |
| *** gabriel-bezerra has joined #openstack-keystone | 02:21 | |
| dolphm | bknudson: do we really need to differentiate between revoking a "domain_scope_id" and a "domain_id"? | 02:23 |
| bknudson | dolphm: the case that fails if you don't differentiate is if you revoke a domain-scoped token that was gotten from an unscoped token | 02:24 |
| bknudson | and the domain-scoped token is in the user's scope | 02:25 |
| bknudson | I was thinking this might be ok to not handle but then a horizon developer was in here saying that they plan to do exactly that... use domain-scoped tokens from unscoped tokens | 02:26 |
| dolphm | "use domain-scoped tokens from unscoped tokens" that sounds fair | 02:26 |
| dolphm | bknudson: but i don't follow "the domain-scoped token is in the user's scope" | 02:26 |
| bknudson | oh, sorry, I should have said the domain-scoped token is in the user's domain. | 02:27 |
| bknudson | i.e., the domain is scoped to the same domain as the user name | 02:27 |
| bknudson | ahh. | 02:27 |
| bknudson | the token is scoped to the same domain as the user name | 02:28 |
| bknudson | which is what test_revoke_token_from_token does in https://review.openstack.org/#/c/109125/4/keystone/tests/test_v3_auth.py | 02:28 |
| dolphm | bknudson: what does the revocation event look like if you delete a domain-scoped token right now? | 02:30 |
| dolphm | bknudson: and what will it look like after your change? | 02:31 |
| bknudson | dolphm: if you take a look at https://review.openstack.org/#/c/109389/3/keystone/tests/test_revoke.py | 02:32 |
| *** zzzeek has joined #openstack-keystone | 02:32 | |
| bknudson | a domain-scoped token would have 'domain_scope_id=<domain_id>' | 02:32 |
| bknudson | dolphm: currently, a domain-scoped token revocation event doesn't mention the domain | 02:32 |
| bknudson | dolphm: sample with a project-scoped token | 02:32 |
| dolphm | same*? | 02:33 |
| bknudson | dolphm: see this change: https://review.openstack.org/#/c/109389/3/keystone/contrib/revoke/core.py | 02:33 |
| bknudson | in the original code, all it has is use_id and expires_at | 02:33 |
| bknudson | it doesn't have the scope | 02:33 |
| dolphm | bknudson: a domain-scoped token not mentioning the domain is a serious bug | 02:33 |
| dolphm | the revocation event for * | 02:33 |
| dolphm | bknudson: i'm still not convinced we need a new field in the model / event for the domain scope. deleting a domain won't have an expires_at, so lots of tokens will be nuked. deleting a domain-scoped token will have an expires_at and SHOULD have a domain_id and a user_id, so the effect is very narrow. | 02:35 |
| dolphm | bknudson: am i missing some corner case that makes overloading the field too ambiguous? | 02:35 |
| bknudson | dolphm: a token that you get from another token has the same expires_at | 02:36 |
| *** harlowja is now known as harlowja_away | 02:37 | |
| bknudson | and the domain_id can match the user's domain | 02:37 |
| dolphm | if the client gets a project-scoped token, where the project's domain is A, expires at is B, and user is C... i'm sort of okay with that token being denied in response to a domain-scoped token being a deleted where the scope was A, expires at is B, and user is C. | 02:37 |
| dolphm | bknudson: so the unscoped token remains valid, but we might nuke too many "leafs" from that "tree" of tokens (the leafs being scoped tokens) | 02:38 |
| bknudson | dolphm: y, it might not be worth it to change the model | 02:38 |
| bknudson | I think then we'd have to do assignment_domain_id only in the alternatives in https://review.openstack.org/#/c/109389/3/keystone/contrib/revoke/model.py | 02:39 |
| bknudson | if there's an expiration time... | 02:39 |
| bknudson | this code is complicated | 02:39 |
| jamielennox | dolphm: (not too interupt, but as you're here) between https://bugs.launchpad.net/python-keystoneclient/+bug/1347957 and https://review.openstack.org/#/c/101792/ we might need to do another client release | 02:40 |
| uvirtbot | Launchpad bug 1347957 in python-keystoneclient "self-signed cert validation from env variable fails in 0.10" [High,Fix committed] | 02:40 |
| dolphm | jamielennox: sounds like 0.10.1 | 02:42 |
| jamielennox | dolphm: yea, that's fine | 02:42 |
| dolphm | jamielennox: i'll do that right now | 02:43 |
| ayoung | dstanek, I'm being dumb. Of course we use the hash of the token as the key, not a random number. If you can guess that hash, you could have guessed the original token. I'll update the spec with that,and it should make the implementation much friendlier | 02:44 |
| jamielennox | dolphm: are you around to talk about the AUTH_INTERFACE thing? this is fairly late for you to be on irc | 02:45 |
| dolphm | jamielennox: yeah this is late :P i haven't read your email yet though :( | 02:45 |
| jamielennox | dolphm: it got more rambling than i expected :) it was more because our IRC times generally only overlap on meeting days and i got called away last time | 02:47 |
| dolphm | jamielennox: https://launchpad.net/python-keystoneclient/+milestone/0.10.1 | 02:47 |
| jamielennox | dolphm: thanks | 02:47 |
| dolphm | jamielennox: the push to pypi in queued in zuul | 02:47 |
| dolphm | jamielennox: no worries, let me read the email first | 02:48 |
| *** dims_ has quit IRC | 02:48 | |
| dstanek | ayoung: that makes more sense to me | 02:49 |
| dolphm | jamielennox: so you have an example of session.get() in your email... if you were making a session-based call to the auth_url, what would that look like? | 02:50 |
| *** zzzeek has quit IRC | 02:50 | |
| jamielennox | session.get('/path/to', endpoint_type={'service_type': 'service', 'interface': keystoneclient.auth.AUTH_INTERFACE}) | 02:51 |
| jamielennox | i agree with bknudson that we shouldn't use a special 'auth' string there | 02:51 |
| dolphm | jamielennox: so a real call might be session.post('/auth/tokens', endpoint_type={'service_type': 'service', 'interface': keystoneclient.auth.AUTH_INTERFACE}) ? | 02:52 |
| *** ncoghlan is now known as ncoghlan_afk | 02:53 | |
| jamielennox | calling from within the auth plugin like that is a little bit meta - i'm not sure if that would work, but yes the concept is right | 02:53 |
| dolphm | jamielennox: well, the circular dependency between session and plugin is super odd to me | 02:54 |
| dolphm | jamielennox: why do plugins need to use the session again? | 02:55 |
| jamielennox | probably .get('/tenants', endpoint_filter={'service': 'identity', 'interface' keystoneclient.auth.AUTH_INTERFACE, 'version': 2}) is more appropriate | 02:55 |
| jamielennox | dolphm: they need to actually talk to the server to do the auth exchange | 02:55 |
| jamielennox | they also do version discovery | 02:55 |
| dolphm | jamielennox: but version discovery is separate right? | 02:56 |
| dolphm | it's not built directly into the session object | 02:56 |
| jamielennox | it's built into the plugin | 02:56 |
| dolphm | jamielennox: well then a plugin doesn't need the session to do discovery..? | 02:56 |
| jamielennox | processing is built into the plugin via the discovery class, it still needs the session to do the actual fetch of the data | 02:57 |
| *** xianghuihui has joined #openstack-keystone | 02:57 | |
| dolphm | why does the discovery class need a session object? | 02:57 |
| jamielennox | session should be the only way to do HTTP calls, everything that talks over the network is provided the session object | 02:58 |
| *** xianghuihuihui has quit IRC | 02:58 | |
| dolphm | a mantra is not a reason | 02:58 |
| dolphm | what is session providing that httplib2 can't provide? | 02:58 |
| jamielennox | picking up CA certs etc and transport details | 02:59 |
| jamielennox | they're generally provided once via CLI args or CONF or whatever and attached to the session | 02:59 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: add internal delete notification for endpoint https://review.openstack.org/108329 | 03:00 |
| dolphm | jamielennox: the only way this makes sense to me is if an auth plugin IS a session | 03:00 |
| jamielennox | i'm not seeing how that would help | 03:02 |
| dolphm | jamielennox: it helps my mental model to avoid the circular dependency and maintain the session.get(path, endpoint_filter) API | 03:04 |
| jamielennox | so there's not an actual dependency there, session is provided to the plugin as an argument | 03:04 |
| dolphm | jamielennox: can you explain why this would be an insufficient substitute? .get('/tenants', endpoint_filter={'service_type': 'identity', 'interface': 'public', 'version': 2}) | 03:05 |
| dolphm | jamielennox: yeah, that's hiding a circular dependency | 03:05 |
| jamielennox | because we don't have a catalog to provide a 'public' interface in an unscoped token | 03:06 |
| jamielennox | if you look at this review: https://review.openstack.org/#/c/104771/10 which is the dependent of the AUTH_INTERFACE one | 03:07 |
| jamielennox | the main reason i need the AUTH_INTERFACE is not because i ever actually want to have the plugin look itself up | 03:08 |
| jamielennox | it's because in situations where you have an unscoped token i have to send requests to the auth_url | 03:08 |
| dolphm | jamielennox: why can't your magic just be "hey, i don't have a catalog, but i know that the auth_url is a public identity endpoint, so i'll just return that" | 03:09 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: add --rebuild option for ssl/pki_setup https://review.openstack.org/88207 | 03:09 |
| jamielennox | have the plugin return auth_url for 'public' in the case of an unscoped token - sure that would work for this, but take the other functions who want to send requests to a 'public' interface, how do they know if they are really using public or they have an unscoped token and the plugin is faking it for them | 03:11 |
| jamielennox | eg i issue a request for GET /users against the public interface, i should get an error if i am using an unscoped token - if the plugin faked it for me it would mostly work | 03:12 |
| dolphm | jamielennox: why does the caller need to care? it wants a public identity endpoint and shouldnt' have to know the internal state of the plugin | 03:13 |
| dolphm | if i called GET /users and i got a 401, that's my fault, not the plugin's fault | 03:14 |
| jamielennox | a scoped vs unscoped token is something you always have to care about because a lot of things just don't work with unscoped tokens | 03:14 |
| dolphm | jamielennox: correct - and it's MY fault, not the plugins fault in that scenario | 03:14 |
| dolphm | jamielennox: so allow me to shoot myself in the foot | 03:15 |
| jamielennox | the number of calls that are allowed to go to the auth_url is really small and limited to within keystoneclient, exposing that public hack seems like it would cause problems when we could just handle it in the few places where we do actually deal with unscoped tokens | 03:15 |
| dolphm | jamielennox: what problems? | 03:16 |
| jamielennox | well as an example i would need to match that interface == public and that endpoint_type == 'identity' there's nothing to say that the deployment may be using a different endpoint_type name | 03:17 |
| jamielennox | (weak argument recognized) | 03:17 |
| dolphm | jamielennox: especially when service='identity', interface='public' is primarily for authentication | 03:18 |
| dolphm | jamielennox: if i wanted GET /users i should be asking for interface='admin', technically | 03:18 |
| jamielennox | i don't know, it seems more appropriate that if an endpoint is not available (in the case of public) that we should just tell people that there's nothing to send to rather than make a call that's guaranteed to fail | 03:18 |
| jamielennox | only in the v2 API, for the v3 API i'd really like to make the public interface the standard | 03:19 |
| dolphm | jamielennox: then the URLs should be the same; the client should still ask for the appropriate endpoint | 03:19 |
| dolphm | jamielennox: i'd also be happy if the client returned the public endpoint for something if the user asked for an admin endpoint and none was available | 03:20 |
| dolphm | but that's another discussion | 03:20 |
| jamielennox | right, but in the current situation where you would try to do a v3 operation with an unscoped token the client can stop you, if we return the auth_url then everything would be attempted against taht url | 03:21 |
| dolphm | jamielennox: why would the client suppose to know what the remote policy looks like? | 03:23 |
| dolphm | jamielennox: my policy in my personal cloud might be "is_admin": "user_id=1" or whatever | 03:24 |
| jamielennox | point, but then you've made keystoneclient different to all the other clients | 03:25 |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: Cookie for tokens https://review.openstack.org/109295 | 03:25 |
| dolphm | the other clients should behave the same way | 03:25 |
| dolphm | *let me shoot myself in the foot* | 03:25 |
| ayoung | morganfainberg, take a look at the updated version. I think it will make more sense. Thanks for the feedback. | 03:25 |
| jamielennox | but if you want to go down that route what if in my deployment i've called the keystone server type 'users' or something, returning auth_url if interface=='public' and service_type == 'identity' wont work | 03:26 |
| jamielennox | is that the something else you can configure? | 03:26 |
| jamielennox | i'm not sure here if you really care about the distinction or are feeling out the idea | 03:27 |
| *** alex_xu has quit IRC | 03:30 | |
| *** slogan has joined #openstack-keystone | 03:31 | |
| dolphm | jamielennox: the service types should be well known constants | 03:34 |
| openstackgerrit | A change was merged to openstack/keystone: Move token persistence classes to token.persistence module https://review.openstack.org/107561 | 03:35 |
| morganfainberg | dolphm, ^ yay | 03:36 |
| morganfainberg | dolphm, that one was kind of annoying to rebase | 03:37 |
| *** ajayaa has quit IRC | 03:38 | |
| dolphm | morganfainberg: the token model one is basically what's in the client? except one object | 03:38 |
| dolphm | one class* | 03:38 |
| morganfainberg | dolphm, yeah, it's a stop-gap to get the code in | 03:38 |
| *** slogan has quit IRC | 03:38 | |
| morganfainberg | dolphm, once we get things solidified i expect to circle back and work with jamielennox to make both ksc and keystone use the same model | 03:38 |
| morganfainberg | dolphm, and make it better™, i just was worried i wouldn't get the non-persistent stuff done without the start of a model, and so i cribbed most of the work from ksc | 03:39 |
| morganfainberg | and it's simple enough to not make me worry about introducing something crazy / broken | 03:39 |
| dolphm | morganfainberg: i have a -1 on that so far, but still reviewing | 03:40 |
| morganfainberg | dolphm, sure, i'm fine with it needing some work. | 03:40 |
| morganfainberg | dolphm, i actually expect it to need some work during review, but it is a workable first pass. | 03:40 |
| morganfainberg | (e.g. unblocked me so i could get the other work moving) | 03:41 |
| jamielennox | dolphm: i'm not convinced that the inconsistency here is worth it to protect the 3 calls that actually use the auth_url (outside of actually authenticating) | 03:41 |
| jamielennox | dolphm: however i'm hungry and so if you want to override let me know and i'll do it that way | 03:42 |
| jamielennox | s/override/if you prefer | 03:42 |
| dolphm | jamielennox: the UX looks terrible to me | 03:42 |
| jamielennox | it's a very specific case where it matters | 03:43 |
| jamielennox | and hopefully we'll get a catalog in an unscoped token soon - so even then it'll never get called | 03:43 |
| dolphm | jamielennox: and sort of core for keystone | 03:43 |
| jamielennox | i would never expect to see it used outside of keystoneclient | 03:44 |
| jamielennox | anyway going for lunch, it's nearly 2 already | 03:46 |
| *** alex_xu has joined #openstack-keystone | 03:46 | |
| morganfainberg | ayoung, the spec is a bit clearer in proposal now. i'm still not convinced, but we can keep discussing this. | 03:52 |
| ayoung | morganfainberg, I was being overly paranoid with the UUID approach | 03:53 |
| ayoung | this at least lets the service set the hash algorithm, which solves the MD5 issue | 03:53 |
| morganfainberg | ayoung, sure. | 03:53 |
| *** alex_xu has quit IRC | 03:53 | |
| ayoung | But, as I said, it was more to get it recorded and discussed than anything I'm planning on implementing yet | 03:54 |
| *** ayoung has left #openstack-keystone | 03:54 | |
| morganfainberg | ayoung, ++ and i think there is still a good amount to discuss, but i have a *clearer* idea now. | 03:54 |
| morganfainberg | annnnnnnd he's gone | 03:54 |
| stevemar | jamielennox, thx for reviewing dtroyer's osc patch | 03:55 |
| morganfainberg | dolphm, self.get('project', {}).get('domain', {}).get('name') how does that get us a empty dict instead of a string or a None? | 03:56 |
| morganfainberg | dolphm, /me is likely just missing it | 03:57 |
| dolphm | morganfainberg: that was .project_domain_id? | 03:57 |
| morganfainberg | project_domain_name | 03:57 |
| dolphm | morganfainberg: oh; it will return None. nevermind on that one! | 03:57 |
| dolphm | morganfainberg: hmm | 03:58 |
| dolphm | morganfainberg: what was the review link | 03:58 |
| morganfainberg | dolphm, ok just making sure i wasn't missing something super obvious, cause... it's been known to happen from time to time :) | 03:58 |
| morganfainberg | https://review.openstack.org/#/c/106917/9/keystone/models/token_model.py | 03:58 |
| dolphm | morganfainberg: that was the reason for my -1; changed to a +1... i'd still prefer it to be much less defensive | 04:01 |
| morganfainberg | some of that defensive is because the token could be project scoped | 04:01 |
| morganfainberg | or domain scoped, or not scoped | 04:02 |
| morganfainberg | should we always check .project_scoped before looking at project_id? (i'm ok with that) | 04:02 |
| dolphm | morganfainberg: i'd like the explicitness of that | 04:02 |
| morganfainberg | sure. done in next patch. | 04:02 |
| dolphm | morganfainberg: and if it was domain scoped, and some expected attribute wasn' there, that deserves a 500 | 04:02 |
| morganfainberg | works for me :) | 04:03 |
| morganfainberg | and the auth_context is going to be replaced, i just want to make damn sure i'm not breaking something first. | 04:03 |
| dolphm | also note that wasn' is totally a word | 04:03 |
| morganfainberg | dolphm, dude, wasn' sounds like something from texas, i read it as a word! | 04:04 |
| dolphm | morganfainberg: as a member of texas, i can confirm | 04:04 |
| dolphm | morganfainberg: fyi, right before you got on, i released https://launchpad.net/python-keystoneclient/+milestone/0.10.1 | 04:05 |
| morganfainberg | so i figure the steps are: get everything using .validate_token, then fix "auth_context" to use the token_model, and migrate away from .validate_token as appropriate. | 04:05 |
| * morganfainberg is being super paranoid mucking with token stuff. | 04:06 | |
| morganfainberg | if you think it's better to fix auth_context first... i can try and do that. | 04:06 |
| *** alex_xu has joined #openstack-keystone | 04:06 | |
| * morganfainberg isn't being picky, just paranoid :) | 04:07 | |
| morganfainberg | dolphm, ++ woot on password logging fix! | 04:07 |
| dolphm | morganfainberg: the auth_context change is just a nice to have | 04:08 |
| dolphm | the patch would probably be too big if you did that at once | 04:08 |
| morganfainberg | dolphm, oh it would need to be a follow-on. | 04:08 |
| morganfainberg | dolphm, for sure | 04:08 |
| dolphm | morganfainberg: i just read the "and then i hacked the DB and the JSON response was not as expected" bug. nice work! | 04:13 |
| morganfainberg | LOL | 04:14 |
| morganfainberg | dolphm, which bug is that? | 04:14 |
| dolphm | morganfainberg: i don't want to point fingers. extra={"key": "value"} but only "key": "value" appeared in JSON | 04:14 |
| morganfainberg | oh hahaha | 04:15 |
| morganfainberg | *snicker* | 04:15 |
| * dolphm sleep | 04:16 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:19 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add a URL field to region table https://review.openstack.org/106935 | 04:19 |
| morganfainberg | stevemar, i shall bug you tomorrow about tokens. | 04:20 |
| morganfainberg | stevemar, and federation... and special case tokens | 04:20 |
| morganfainberg | stevemar, have a related bug report to the special case tokens: https://bugs.launchpad.net/keystonemiddleware/+bug/1346820 | 04:20 |
| stevemar | morganfainberg, coolio | 04:20 |
| uvirtbot | Launchpad bug 1346820 in keystonemiddleware "Middeware auth_token fails with scoped federated saml token" [Undecided,New] | 04:20 |
| stevemar | bah humbug | 04:21 |
| morganfainberg | stevemar, it's related to the fact federated tokens aren't "really" the same as tokens. they are missing some important data.. like... domain | 04:21 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add a URL field to region table https://review.openstack.org/106935 | 04:21 |
| stevemar | morganfainberg, correct | 04:21 |
| stevemar | the scope part should be the same, domain and project | 04:21 |
| stevemar | morganfainberg, but i guess you are talking about user portion? | 04:22 |
| morganfainberg | stevemar, that means 3 things: breaks auth_token, breaks revocation events, is standing in the way of non-persistent tokens | 04:22 |
| jamielennox | why doesn't it have a domain name? | 04:22 |
| morganfainberg | stevemar, it has *no* domain in the user section | 04:22 |
| morganfainberg | yeah | 04:22 |
| jamielennox | oh user section | 04:22 |
| stevemar | jamielennox, because the user doesn't exist in keystone | 04:22 |
| morganfainberg | stevemar, anyway we shall need to discuss how to solve this tomorrow :) | 04:22 |
| stevemar | alrighty | 04:22 |
| morganfainberg | stevemar, i'm sure we can figure something out | 04:22 |
| stevemar | i'll be here! | 04:23 |
| dstanek | wow..late night chatter! | 04:34 |
| dstanek | i didn't see any examples of print error messages when using the bin/keystone-* scripts - is there some guidance there? | 04:34 |
| *** jamielennox is now known as jamielennox|away | 04:35 | |
| dstanek | specifically my comment about the print here: https://review.openstack.org/#/c/88207/5/keystone/common/openssl.py | 04:35 |
| *** slogan has joined #openstack-keystone | 04:46 | |
| *** ajayaa has joined #openstack-keystone | 05:02 | |
| *** slogan has quit IRC | 05:04 | |
| *** ncoghlan is now known as ncoghlan_afk | 05:09 | |
| *** topol has quit IRC | 05:16 | |
| *** ncoghlan has joined #openstack-keystone | 05:23 | |
| *** jamielennox|away has quit IRC | 05:23 | |
| *** ncoghlan_ has joined #openstack-keystone | 05:23 | |
| *** jamielennox|away has joined #openstack-keystone | 05:24 | |
| *** stevemar has quit IRC | 05:26 | |
| *** ncoghlan has quit IRC | 05:27 | |
| *** ncoghlan_afk has quit IRC | 05:27 | |
| *** vb-awe has joined #openstack-keystone | 05:34 | |
| *** vb-awe has left #openstack-keystone | 05:34 | |
| *** vb-awe has joined #openstack-keystone | 05:35 | |
| *** vb-awe has left #openstack-keystone | 05:35 | |
| *** mberlin1 has quit IRC | 05:45 | |
| *** k4n0 has joined #openstack-keystone | 05:56 | |
| *** chandankumar has joined #openstack-keystone | 05:57 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/106939 | 06:06 |
| *** ukalifon has joined #openstack-keystone | 06:06 | |
| *** tomoiaga has joined #openstack-keystone | 06:09 | |
| *** slogan has joined #openstack-keystone | 06:34 | |
| tomoiaga | hey, finally the session object is in nova, now on to refactoring code, thanks jamielennox ! | 06:43 |
| *** xianghuihui has quit IRC | 06:45 | |
| *** xianghuihui has joined #openstack-keystone | 06:48 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: Clean up EP-Filter after delete project/endpoint https://review.openstack.org/109507 | 06:54 |
| *** ukalifon has quit IRC | 06:56 | |
| openstackgerrit | Alexey Miroshkin proposed a change to openstack/keystone: Check url is in the 'self' link in list responses https://review.openstack.org/109290 | 07:04 |
| *** ajayaa has quit IRC | 07:07 | |
| *** jamielennox|away has quit IRC | 07:16 | |
| *** ajayaa has joined #openstack-keystone | 07:20 | |
| *** gabriel-bezerra has quit IRC | 07:20 | |
| *** gabriel-bezerra has joined #openstack-keystone | 07:21 | |
| *** ncoghlan_ has quit IRC | 07:30 | |
| *** vysakh has joined #openstack-keystone | 07:57 | |
| vysakh | hi.. any one to help me here? | 07:57 |
| vysakh | I have raised a question here (https://ask.openstack.org/en/users/7069/vysakhv90/?sort=inbox§ion=forum) | 07:58 |
| *** henrynash has joined #openstack-keystone | 07:59 | |
| *** gabriel-bezerra has quit IRC | 08:27 | |
| *** gabriel-bezerra has joined #openstack-keystone | 08:28 | |
| tomoiaga | vysakh: the link to the question is a link to your messages inbox | 08:30 |
| *** ajayaa has quit IRC | 08:31 | |
| *** alex_xu has quit IRC | 08:34 | |
| *** mberlin has joined #openstack-keystone | 08:35 | |
| *** ajayaa has joined #openstack-keystone | 08:44 | |
| *** slogan has quit IRC | 08:46 | |
| *** oomichi has quit IRC | 08:49 | |
| vysakh | sorry .. | 08:53 |
| vysakh | https://ask.openstack.org/en/question/43523/dashboard-not-displaying-network-and-object-store/ | 08:53 |
| openstackgerrit | Alexey Miroshkin proposed a change to openstack/keystone: Check url is in the 'self' link in list responses https://review.openstack.org/109290 | 09:02 |
| tomoiaga | vysakh: can you confirm that the services are actually running ? (do you have the endpoints in keystone endpoint-list). I don't remember exactly if Horizon has a mechanism to auto discover neutron for example, if not, you should probably enable it in local_settings (assuming neutron is actually seen in the endpoint lists and is running) | 09:03 |
| *** xianghuihui has quit IRC | 09:04 | |
| vysakh | If the services are running how it can show? Any example? | 09:05 |
| tomoiaga | vysakh: can you run: neutron net-list for example ? | 09:05 |
| *** ajayaa has quit IRC | 09:06 | |
| vysakh | publicURL endpoint for network service not found !!! | 09:06 |
| tomoiaga | vysakh: you also need to add the endpoints for it. However, did you install neutron, or just ran devstack and you assume it installed neutron for you ? | 09:08 |
| vysakh | I have installed devstack first and then did "keystone service-create \--name=neutron \--type=network \--description="Network Service"" | 09:09 |
| *** xianghuihui has joined #openstack-keystone | 09:10 | |
| tomoiaga | vysakh: the keystone service-create only adds a record (just a buch of text) to a database (the one you see in service-list), it doesn't actually install neutron. For example you can service-create —name=whatever —type=nothing —description="some description" and it will work since all it does is to add some records to the database | 09:11 |
| tomoiaga | vysakh: look at https://github.com/openstack-dev/devstack/blob/master/README.md (look for Neutron and ML2 if you want to enable that extension) | 09:13 |
| tomoiaga | vysakh: most likely the same for the other service you mentioned | 09:13 |
| tomoiaga | vysakh: devstack needs to know you want to install neutron in order to install the requires packages and start the daemons on your server | 09:13 |
| tomoiaga | vysakh: devstack will also create the services and endpoints for you, so there is no need to run service-create separately | 09:14 |
| *** mberlin has quit IRC | 09:15 | |
| *** mberlin has joined #openstack-keystone | 09:15 | |
| *** ajayaa has joined #openstack-keystone | 09:17 | |
| vysakh | Okay.. Thanks tomoiaga.. Let me check... | 09:20 |
| *** ajayaa has quit IRC | 09:28 | |
| *** ajayaa has joined #openstack-keystone | 09:29 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: Clean up EP-Filter after delete project/endpoint https://review.openstack.org/109507 | 09:46 |
| *** bvandenh has joined #openstack-keystone | 09:55 | |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Group related methods for LDAP backend https://review.openstack.org/102244 | 10:05 |
| *** xianghuihuihui has joined #openstack-keystone | 10:08 | |
| *** xianghuihui has quit IRC | 10:09 | |
| *** Dafna is now known as Dafna_away | 10:13 | |
| openstackgerrit | Alexey Miroshkin proposed a change to openstack/keystone: Check url is in the 'self' link in list responses https://review.openstack.org/109290 | 10:20 |
| openstackgerrit | A change was merged to openstack/keystone: add internal delete notification for endpoint https://review.openstack.org/108329 | 10:23 |
| *** dims has joined #openstack-keystone | 10:24 | |
| *** amerine has quit IRC | 10:48 | |
| *** xianghuihuihui has quit IRC | 10:48 | |
| *** slogan has joined #openstack-keystone | 10:53 | |
| *** amerine has joined #openstack-keystone | 10:55 | |
| *** ajayaa has quit IRC | 10:57 | |
| *** topol has joined #openstack-keystone | 10:57 | |
| *** Dafna_away is now known as Dafna | 11:03 | |
| *** fish_ has quit IRC | 11:07 | |
| *** fish_ has joined #openstack-keystone | 11:07 | |
| *** xianghui has joined #openstack-keystone | 11:08 | |
| *** slogan has quit IRC | 11:09 | |
| *** ajayaa has joined #openstack-keystone | 11:10 | |
| *** cjellick has joined #openstack-keystone | 11:15 | |
| *** cjellick has quit IRC | 11:16 | |
| *** cjellick has joined #openstack-keystone | 11:17 | |
| openstackgerrit | Alexey Miroshkin proposed a change to openstack/keystone: Check url is in the 'self' link in list responses https://review.openstack.org/109290 | 11:23 |
| *** xianghuihui has joined #openstack-keystone | 11:37 | |
| *** xianghui has quit IRC | 11:37 | |
| *** k4n0 has quit IRC | 11:38 | |
| *** diegows has quit IRC | 11:54 | |
| *** chandan_kumar has joined #openstack-keystone | 12:09 | |
| *** chandan_kumar has quit IRC | 12:09 | |
| *** diegows has joined #openstack-keystone | 12:20 | |
| *** miqui has joined #openstack-keystone | 12:22 | |
| *** dims has quit IRC | 12:23 | |
| *** dims has joined #openstack-keystone | 12:25 | |
| *** ajayaa has quit IRC | 12:33 | |
| *** bvandenh has quit IRC | 12:33 | |
| *** vysakh has quit IRC | 12:36 | |
| raildo | henrynash: ping | 12:44 |
| *** bknudson has quit IRC | 12:49 | |
| henrynash | railod: hi | 12:50 |
| *** russellb is now known as rustlebee | 12:50 | |
| henrynash | raildo: hi | 12:51 |
| *** rwsu has joined #openstack-keystone | 12:56 | |
| *** joesavak has joined #openstack-keystone | 12:58 | |
| *** stevemar has joined #openstack-keystone | 12:59 | |
| *** ayoung has joined #openstack-keystone | 13:03 | |
| raildo | henrynash: ayoung answered your questions in the spec https://review.openstack.org/#/c/101017/ | 13:05 |
| *** bvandenh has joined #openstack-keystone | 13:06 | |
| henrynash | raildo: ok, will look in a bit, thanks | 13:06 |
| *** bknudson has joined #openstack-keystone | 13:07 | |
| *** zzzeek has joined #openstack-keystone | 13:11 | |
| *** radez_g0n3 is now known as radez | 13:12 | |
| *** lbragstad has joined #openstack-keystone | 13:18 | |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/python-keystoneclient: Initial kerberos plugin implementation. https://review.openstack.org/74974 | 13:27 |
| ayoung | raildo, I'd like to see my comment (cleaned up) included into the body of the spec, to clarify that point | 13:30 |
| raildo | ayoung: OK, I'll replace the section that I speak about users for your comments. Thank you :) | 13:32 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Calculate a suitable column width for positional arguments https://review.openstack.org/97873 | 13:37 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Overwrite get_endpoint in Saml2UnscopedToken. https://review.openstack.org/109575 | 13:42 |
| *** bvandenh has quit IRC | 13:43 | |
| *** Chicago has joined #openstack-keystone | 13:49 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Overwrite get_endpoint in Saml2UnscopedToken. https://review.openstack.org/109575 | 13:50 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: List federated projects and domains https://review.openstack.org/107393 | 13:50 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Add the 'auth' interface type https://review.openstack.org/104734 | 13:50 |
| *** ukalifon1 has joined #openstack-keystone | 13:51 | |
| *** gokrokve has joined #openstack-keystone | 14:01 | |
| *** jasondotstar has joined #openstack-keystone | 14:02 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Overwrite get_endpoint in Saml2UnscopedToken. https://review.openstack.org/109575 | 14:03 |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Basic-Auth middleware https://review.openstack.org/92137 | 14:04 |
| *** chandan_kumar has joined #openstack-keystone | 14:07 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: List federated projects and domains https://review.openstack.org/107393 | 14:08 |
| *** chandan_kumar has quit IRC | 14:10 | |
| *** bvandenh has joined #openstack-keystone | 14:10 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add test for revoking a scoped v2 token https://review.openstack.org/109602 | 14:15 |
| *** bvandenh has quit IRC | 14:15 | |
| *** david-lyle has joined #openstack-keystone | 14:18 | |
| *** chandankumar has quit IRC | 14:21 | |
| *** hrybacki has joined #openstack-keystone | 14:32 | |
| *** tomoiaga has quit IRC | 14:33 | |
| ayoung | bknudson, you are making a lot of changes to the revocation events code, but we really need them to happen in the client, not server, versions of model.py | 14:35 |
| bknudson | ayoung: it's easier for me to make them in the server for now | 14:35 |
| ayoung | bknudson, but it will lead to regressions in the client | 14:35 |
| ayoung | when the server uses the client code | 14:36 |
| ayoung | without that, the revocation events are useless | 14:36 |
| bknudson | I'll transfer the changes to the client | 14:36 |
| ayoung | as the remote machines cannot use them | 14:36 |
| ayoung | bknudson, thanks, and lets get the client review moving | 14:36 |
| ayoung | its been malingering for 4 months now | 14:36 |
| ayoung | https://review.openstack.org/#/c/81166/ | 14:36 |
| bknudson | as far as I can tell revocation events are broken as is | 14:37 |
| ayoung | bknudson, so lets fix them in once place | 14:37 |
| ayoung | and thatplace needs to be the client code | 14:38 |
| bknudson | if it requires changes to the model and how they're stored in the database then that will need to be in the server | 14:38 |
| ayoung | we can make the server use the client code and only deal with it in one location, but trying to keep the fixes straight is going to make things really hard | 14:38 |
| bknudson | the server can't use the client code for its database model | 14:39 |
| ayoung | I wish we could have done the work in the client in the first place, but there really was no way to do it without the server side recording | 14:39 |
| ayoung | its a tough problem | 14:39 |
| ayoung | I don't think, though, that we need to change the database for anything I've seen yet. | 14:39 |
| bknudson | well, I really don't understand this issue with revoking a v2 scoped token... there's a test with a v2 unscoped token that works fine | 14:40 |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Initial kerberos plugin implementation. https://review.openstack.org/74317 | 14:40 |
| bknudson | I also think you're right that the database table doesn't have to change... it was just easier to do that than figure out how to build the tree differently | 14:40 |
| marekd | Bug for keystone/doc/* should be filed under Keystone or some other project? | 14:43 |
| bknudson | marekd: I think people are wondering what keystone/doc/* is? | 14:46 |
| marekd | bknudson: https://github.com/openstack/keystone/tree/master/doc | 14:46 |
| marekd | docs for keystone. | 14:47 |
| bknudson | marekd: y, that would be filed in keystone | 14:47 |
| marekd | bknudson: thank you. | 14:47 |
| bknudson | p "%s > %s == %s" % (leaf['issued_before'], token_data['issued_at'], leaf['issued_before'] > token_data['issued_at']) | 14:49 |
| bknudson | unscoped: '2014-07-25 14:18:42.918527 > 2014-07-25 14:18:41.311999 == True' | 14:49 |
| bknudson | scoped: '2014-07-25 14:27:12.459644 > 2014-07-25 14:27:17.077212 == False' | 14:49 |
| bknudson | I don't get it. | 14:49 |
| *** lbragstad has quit IRC | 14:52 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add X-Auth-Token header in federation examples https://review.openstack.org/109614 | 14:53 |
| *** lbragstad has joined #openstack-keystone | 14:55 | |
| *** david-ly_ has joined #openstack-keystone | 14:58 | |
| bknudson | hmmm.. if the token is checked before it's revoked then things work... wonder why that would make a difference? | 14:59 |
| bknudson | caching? | 14:59 |
| *** david-lyle has quit IRC | 14:59 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone-specs: Hierarchical Multitenacy https://review.openstack.org/101017 | 15:04 |
| *** thedodd has joined #openstack-keystone | 15:05 | |
| *** doddstack has joined #openstack-keystone | 15:07 | |
| *** thedodd has quit IRC | 15:10 | |
| *** topol has quit IRC | 15:12 | |
| *** gokrokve_ has joined #openstack-keystone | 15:12 | |
| *** gokrokve has quit IRC | 15:14 | |
| dolphm | ayoung: keystoneclient.common.cms needs to be refactored and documented. badly. | 15:18 |
| ayoung | dolphm, in what ways does it need to be refactored? | 15:20 |
| dolphm | ayoung: it's incomprehensible undocumented mess of spaghetti, so basically in every way that you can use the term "refactor" | 15:20 |
| *** chandankumar has joined #openstack-keystone | 15:21 | |
| ayoung | dolphm, refactor implies not changing the external interfaces. A lot of the functions there are things that I want to go away, but had to leave because they are external: called by both the keystone and keystonclient code | 15:22 |
| dolphm | ayoung: you can't even tell what the external interfaces ARE | 15:22 |
| *** hrybacki has quit IRC | 15:22 | |
| ayoung | dolphm, there is very little in there that is not called externally | 15:23 |
| ayoung | most of it is called from auth_token middleware | 15:23 |
| ayoung | only the signing code is called from Keystone server | 15:23 |
| dolphm | ayoung: well very much of it should be documented as such | 15:23 |
| *** radez is now known as radez_g0n3 | 15:23 | |
| stevemar | lbragstad, ping | 15:26 |
| ayoung | dolphm, probably a good start would be grouping together the functions that are for the old, pki/asn1 format that I would like to deprecate. | 15:26 |
| ayoung | def token_to_cms(signed_text): and def cms_to_token(cms_text): | 15:27 |
| ayoung | and there was some ugliness added by the py33 requirenments to deal with the differences of string handling | 15:28 |
| lbragstad | stevemar: 64 bytes from ord08s12-in-f18.1e100.net (74.125.225.18): icmp_req=1 ttl=63 time=38.0 ms | 15:28 |
| stevemar | hue hue | 15:29 |
| stevemar | lbragstad, question for you abt notifications | 15:29 |
| lbragstad | sure | 15:29 |
| stevemar | lbragstad, is there anyway I can get the user id of the person who issued the request to delete a project? | 15:29 |
| stevemar | the resource is always in the payload | 15:29 |
| lbragstad | stevemar: not currently, no | 15:30 |
| lbragstad | I feel like that falls under the pycadf standard though | 15:30 |
| *** stevemar has quit IRC | 15:30 | |
| *** jasondotstar has quit IRC | 15:30 | |
| ayoung | dolphm, meh, I don't see anything radically changeable, though. | 15:31 |
| *** stevemar has joined #openstack-keystone | 15:31 | |
| ayoung | We can drop the asn1 stuff in a release or two, and the two functions I listed above | 15:31 |
| lbragstad | stevemar: what's your use case? | 15:31 |
| dolphm | ayoung: how about method names, variable names, documentation, and module organization? | 15:31 |
| stevemar | lbragstad, https://review.openstack.org/#/c/109616/1/ceilometer/identity/notifications.py | 15:32 |
| *** chandankumar has quit IRC | 15:33 | |
| *** erecio has joined #openstack-keystone | 15:34 | |
| lbragstad | stevemar: ok, where do you want to store that information? | 15:35 |
| lbragstad | stevemar: you'll end up with something like 'identity.project.deleted', right? | 15:36 |
| lbragstad | stevemar: but you want the user_id injected into the from_notification part? | 15:38 |
| *** erecio has quit IRC | 15:38 | |
| dstanek | i didn't see any examples of print error messages when using the bin/keystone-* scripts - is there some guidance there? | 15:39 |
| stevemar | lbragstad, that's supposed to be the issuing user_id | 15:39 |
| dstanek | specifically my comment about the print here: https://review.openstack.org/#/c/88207/5/keystone/common/openssl.py | 15:39 |
| *** amerine has quit IRC | 15:40 | |
| lbragstad | stevemar: so in Project, you want to call _Base.process_notifications(..., user_id=<person who issued the delete event>, ...) right? | 15:40 |
| morganfainberg | oh new openid thing for lp/ubuntu | 15:42 |
| morganfainberg | weird | 15:42 |
| *** gyee has joined #openstack-keystone | 15:42 | |
| lbragstad | stevemar: I would think you'd have to find a seam in here https://github.com/openstack/keystone/blob/2d3d00e29c7e55b5eef3e37372aae309cf93b22c/keystone/notifications.py#L71-L90 | 15:44 |
| lbragstad | to see if you could pull out | 15:45 |
| lbragstad | of the request that would give that kind of information, and include it in the notifcation | 15:45 |
| lbragstad | notification* | 15:45 |
| *** jasondotstar has joined #openstack-keystone | 15:48 | |
| *** hrybacki has joined #openstack-keystone | 15:51 | |
| dstanek | my next-review count keeps going up. lots of stuff happening the last few days | 15:51 |
| *** Chicago has quit IRC | 15:51 | |
| openstackgerrit | Diane Fleming proposed a change to openstack/identity-api: Add create, update, and delete user to admin API v2.0 https://review.openstack.org/108259 | 15:55 |
| *** dims has quit IRC | 15:56 | |
| *** jasondotstar has quit IRC | 15:57 | |
| lbragstad | dstanek: ++ | 15:57 |
| *** jasondotstar has joined #openstack-keystone | 15:57 | |
| *** ayoung has quit IRC | 15:58 | |
| *** elmiko has joined #openstack-keystone | 15:58 | |
| elmiko | hi folks, is there an easier way to get a list of role names for a client than iterating through the role from the RoleManager and pulling the names out? | 15:59 |
| dolphm | elmiko: something easier than [r['name'] for r in c.roles.list()] ? | 16:00 |
| elmiko | dolphm: agreed that is easy, i just want to make sure i don't put something in that might break. so i'm double checking :) | 16:00 |
| dolphm | elmiko: nope, that shouldn't break! | 16:01 |
| elmiko | awesome :) | 16:01 |
| dolphm | elmiko: every role is guaranteed a name, etc | 16:01 |
| elmiko | ok | 16:01 |
| elmiko | i was mainly concerned that i might be creating code that digs too deep into the RoleManager structure | 16:01 |
| dolphm | oslo meeting is starting; i added the move of pycadf to keystone to the agenda if anyone wants to discuss (cc- bknudson morganfainberg lbragstad topol ) | 16:02 |
| dolphm | elmiko: taht's all public API, so you're very much safe! | 16:02 |
| lbragstad | dolphm: openstack-meeting? | 16:03 |
| elmiko | are there any plans to allow TrustManager.create to take the list from RoleManager.list() instead of just names? | 16:03 |
| bknudson | lbragstad: meeting-alt | 16:03 |
| dolphm | lbragstad: #openstack-meeting-alt actually | 16:03 |
| elmiko | i'll check back later | 16:03 |
| *** topol has joined #openstack-keystone | 16:05 | |
| lbragstad | stevemar: there isn't much in assignment.core:Manager.delete_project for grabbing the user_id | 16:07 |
| *** dims has joined #openstack-keystone | 16:07 | |
| stevemar | lbragstad, i was hoping it's in the context | 16:10 |
| lbragstad | stevemar: checking something else quick | 16:10 |
| lbragstad | Manager in assignment.core doens't have a context | 16:10 |
| dolphm | bknudson: we both just made the exact same comment https://review.openstack.org/#/c/108935/1/keystone/tests/test_sql_upgrade.py | 16:12 |
| *** ayoung has joined #openstack-keystone | 16:13 | |
| bknudson | dolphm: that's great! | 16:13 |
| lbragstad | stevemar: you have the token | 16:19 |
| lbragstad | in the controller layer | 16:19 |
| lbragstad | stevemar: a lot of that info isn't carried into the Manager layer, so you'll probably have to do it there. | 16:20 |
| stevemar | lbragstad, blahhh | 16:21 |
| *** radez_g0n3 is now known as radez | 16:31 | |
| *** amerine has joined #openstack-keystone | 16:36 | |
| *** richm has joined #openstack-keystone | 16:42 | |
| *** slogan has joined #openstack-keystone | 16:46 | |
| openstackgerrit | Sergey Nuzhdin proposed a change to openstack/keystone: Fix invalid self link in get access token https://review.openstack.org/109650 | 16:46 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add the new Keystone TokenModel https://review.openstack.org/106917 | 16:50 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Make token_provider_api contain token persistence https://review.openstack.org/109041 | 16:51 |
| *** lbragstad has quit IRC | 16:51 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove assignment controller dependency on token_api https://review.openstack.org/109162 | 16:51 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Expose token revocation list via token_provider_api https://review.openstack.org/109170 | 16:51 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove ec2 contrib dependency on token_api https://review.openstack.org/109173 | 16:51 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove trust dependency on token_api https://review.openstack.org/109462 | 16:51 |
| morganfainberg | dolphm, ^ that should be a little less defensive now. | 16:52 |
| morganfainberg | (the token model one) | 16:52 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Sample config update https://review.openstack.org/109657 | 16:57 |
| *** gokrokve has joined #openstack-keystone | 16:59 | |
| *** gokrokve_ has quit IRC | 17:02 | |
| *** gokrokve has quit IRC | 17:03 | |
| *** browne has joined #openstack-keystone | 17:04 | |
| browne | question, is domain_specific_driver support in icehouse? the documentation indicates Juno, but the keystone.conf.sample shows the option available in stables/icehouse | 17:11 |
| morganfainberg | browne, it is in icehouse, but there is a *BIG* caveate. | 17:12 |
| morganfainberg | browne, it wont work very well and has a lot of edge-cases | 17:12 |
| morganfainberg | browne, Juno is where we have all the bugs worked out and it should be fully functional | 17:12 |
| browne | morganfainberg: ok, so i guess your recommendation would be to avoid it in icehouse, correct | 17:13 |
| morganfainberg | browne, yes. | 17:13 |
| browne | morganfainberg: ok thanks | 17:13 |
| morganfainberg | browne, you'll pull less hair out that way trying to deal with the weird bugs around it | 17:13 |
| *** hrybacki_ has joined #openstack-keystone | 17:13 | |
| morganfainberg | *rather than dealing with | 17:14 |
| browne | morganfainberg: is there any other way i could split service users from ldap users in icehouse? trying to avoid the requirement of having service users in ldap server | 17:14 |
| *** slogan has quit IRC | 17:14 | |
| morganfainberg | browne, not sure if there is a good way to approach that. | 17:15 |
| browne | morganfainberg: ok np | 17:16 |
| morganfainberg | browne, though someone else here might have a bit more insight (cc stevemar, gyee ) | 17:16 |
| *** hrybacki has quit IRC | 17:16 | |
| *** harlowja_away is now known as harlowja | 17:17 | |
| *** hrybacki_ has quit IRC | 17:18 | |
| *** marcoemorais has joined #openstack-keystone | 17:23 | |
| *** slogan has joined #openstack-keystone | 17:25 | |
| slogan | Any keystone people able to comment on https://ask.openstack.org/en/question/43588/devstack-multi-tenant-and-metadata-service/ ? | 17:25 |
| *** lbragstad has joined #openstack-keystone | 17:28 | |
| gyee | browne, not in IceHouse. But I think henrynash did the magic in Juno to make per-domain backend working in Juno | 17:28 |
| gyee | for IceHouse, you'll need to look at some of the out-of-tree solutions. i.e. http://www.mattfischer.com/blog/?p=576 | 17:28 |
| browne | gyee: ok thx | 17:29 |
| slogan | #join openstack-neutron | 17:33 |
| dstanek | I think I'm going to be heading out in a bit to go to PyOhio! | 17:36 |
| bknudson | dstanek: do you have a presentation? | 17:37 |
| dstanek | bknudson: thankfully not this year.I get to enjoy it | 17:38 |
| dstanek | Is thinking about an open space on OpenStack development | 17:39 |
| *** rwsu has quit IRC | 17:41 | |
| bknudson | I bet that would be a popular booth | 17:43 |
| *** gokrokve has joined #openstack-keystone | 17:45 | |
| dstanek | There will be other people there that are familiar with the process | 17:45 |
| *** amerine has quit IRC | 17:56 | |
| *** ukalifon1 has quit IRC | 17:57 | |
| *** hrybacki has joined #openstack-keystone | 18:03 | |
| *** bknudson has quit IRC | 18:05 | |
| *** gabriel-bezerra has quit IRC | 18:10 | |
| *** gabriel-bezerra has joined #openstack-keystone | 18:11 | |
| dolphm | morganfainberg: topol: bknudson: as a follow up to the oslo meeting http://lists.openstack.org/pipermail/openstack-dev/2014-July/041269.html | 18:11 |
| dstanek | dolphm: if the list is also cool with the change is the a process to bring it to the TC? | 18:13 |
| dolphm | dstanek: the two code reviews linked there must be approved by the TC to merge, so that'll be the next step | 18:13 |
| ayoung | morganfainberg, you have abunch of "remove dependency on token_api" changes that do not remove the @requires tag, andI assume that is intentional. What is the overall plan there? | 18:14 |
| dolphm | ayoung: morganfainberg: actually that sounds like it should have been removed, unless it was intended to not break people who have extended those classes and were still expecting the token_api? | 18:17 |
| ayoung | dolphm, that would be my expecation, but there was something in the comments to the contrary... | 18:17 |
| dolphm | ayoung: link? | 18:18 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Add the 'auth' interface type https://review.openstack.org/104734 | 18:19 |
| ayoung | dolphm, looking... | 18:19 |
| *** slogan_ has joined #openstack-keystone | 18:20 | |
| openstackgerrit | A change was merged to openstack/keystone: Clean up EP-Filter after delete project/endpoint https://review.openstack.org/109507 | 18:21 |
| *** ukalifon1 has joined #openstack-keystone | 18:21 | |
| *** slogan has quit IRC | 18:22 | |
| ayoung | dolphm, https://review.openstack.org/#/c/109173/5/keystone/contrib/ec2/controllers.py,cm | 18:22 |
| ayoung | dolphm, looks like that is the comment, and then it is set at the top level in the wsgi file | 18:23 |
| ayoung | morganfainberg, Nevermind, as I Looked through the code to answer dolphm 's request for the link, I see the general pattern | 18:24 |
| ayoung | its just the ec2 one tha has to carry the link for a while | 18:25 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: remove unused dep: stevedore https://review.openstack.org/109063 | 18:30 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: remove unused dep: prettytable https://review.openstack.org/109059 | 18:30 |
| *** joesavak has quit IRC | 18:33 | |
| stevemar | ayoung, if you have a minute: https://review.openstack.org/#/c/109614/ | 18:41 |
| stevemar | dolphm, ^ | 18:41 |
| *** gabriel-bezerra has quit IRC | 18:47 | |
| *** gabriel-bezerra has joined #openstack-keystone | 18:47 | |
| *** morganfainberg is now known as morganfainberg_Z | 18:53 | |
| *** gabriel-bezerra has quit IRC | 18:53 | |
| *** amerine has joined #openstack-keystone | 18:56 | |
| *** sacharya has joined #openstack-keystone | 18:59 | |
| *** ukalifon1 has quit IRC | 19:00 | |
| *** bknudson has joined #openstack-keystone | 19:02 | |
| *** sacharya has left #openstack-keystone | 19:05 | |
| *** bknudson has quit IRC | 19:06 | |
| *** marcoemorais has quit IRC | 19:07 | |
| *** bobt has joined #openstack-keystone | 19:08 | |
| *** comstud is now known as bearhands | 19:08 | |
| *** gabriel-bezerra has joined #openstack-keystone | 19:11 | |
| *** marcoemorais has joined #openstack-keystone | 19:11 | |
| *** marcoemorais has quit IRC | 19:11 | |
| *** marcoemorais has joined #openstack-keystone | 19:11 | |
| *** bknudson has joined #openstack-keystone | 19:20 | |
| *** gokrokve has quit IRC | 19:28 | |
| bknudson | dstanek: there's a presentation on Heat. | 19:29 |
| lbragstad | bknudson: tried out your patch | 19:35 |
| lbragstad | https://review.openstack.org/#/c/109389/ | 19:35 |
| lbragstad | it works | 19:35 |
| lbragstad | nice job | 19:35 |
| bknudson | lbragstad: y... I still have to re-do it though | 19:35 |
| bknudson | I shouldn't have to change the model. I should be able to create the right kind of events using the fields that are there. | 19:36 |
| bknudson | but now I'm backing up and trying to figure out the issue with v2 tokens... | 19:36 |
| lbragstad | gotcha | 19:36 |
| bknudson | if you do a self.head('/auth/tokens', headers={'X-Subject-Token': token}, expected_status=200) before deleting the v2 token it works | 19:37 |
| bknudson | but if you don't check the token before revoking it then it fails | 19:37 |
| lbragstad | strange | 19:37 |
| bknudson | y, it is | 19:37 |
| bknudson | checking a token shouldn't have any effect on the server | 19:37 |
| bknudson | the state of the server | 19:38 |
| lbragstad | bknudson: so, | 19:38 |
| lbragstad | you get a token, do important stuff, and then validate before you revoke and it work | 19:38 |
| lbragstad | works* | 19:38 |
| lbragstad | but if you revoke without validating it doesn't? | 19:39 |
| bknudson | y... there's a test I can point you at | 19:39 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/test_v3_auth.py#n1304 | 19:39 |
| bknudson | lbragstad: if you comment out that line then the test will fail | 19:40 |
| lbragstad | https://review.openstack.org/#/c/109125/4/keystone/tests/test_v3_auth.py | 19:40 |
| lbragstad | oh | 19:40 |
| lbragstad | bknudson: ... do you think it's anything in format_token? | 19:49 |
| bknudson | I don't know what it could be | 19:50 |
| lbragstad | I'm looking through the token api for v2 | 19:51 |
| *** ayoung has quit IRC | 19:56 | |
| bknudson | maybe it's just because it adds a little bit of time... I should try replacing the extra HEAD req with a sleep. | 19:57 |
| bknudson | no, that doesn't make any sense since I've got breakpoints all over. | 19:59 |
| *** ayoung has joined #openstack-keystone | 20:01 | |
| openstackgerrit | A change was merged to openstack/keystone: Add X-Auth-Token header in federation examples https://review.openstack.org/109614 | 20:01 |
| *** henrynash has quit IRC | 20:01 | |
| *** david-ly_ has quit IRC | 20:02 | |
| *** marcoemorais has quit IRC | 20:03 | |
| *** marcoemorais has joined #openstack-keystone | 20:05 | |
| lbragstad | bknudson: I don't *think* I'm seeing any tests that verify the format_token helper | 20:09 |
| lbragstad | or verify the output anyway | 20:10 |
| bknudson | it looks like the token issued_at is later than it should be... which doesn't make any sense. | 20:12 |
| lbragstad | bknudson: paste? | 20:12 |
| lbragstad | later than it should be wrt? | 20:12 |
| bknudson | lbragstad: I don't have anything that I could paste | 20:13 |
| bknudson | later than what it should be based on when I got the token | 20:13 |
| lbragstad | oh | 20:13 |
| *** henrynash has joined #openstack-keystone | 20:17 | |
| bknudson | the returned token says u'issued_at': u'2014-07-25T20:15:49.320034' and then token_data in is_revoked has 2014-07-25 20:16:22.936034 | 20:17 |
| bknudson | that doesn't make any sense | 20:17 |
| *** slogan_ has quit IRC | 20:18 | |
| *** gokrokve has joined #openstack-keystone | 20:19 | |
| lbragstad | it was revoked 30 seconds after it was issued? | 20:19 |
| *** henrynash has quit IRC | 20:19 | |
| *** slogan_ has joined #openstack-keystone | 20:19 | |
| *** dims has quit IRC | 20:20 | |
| bknudson | lbragstad: it looks like the token's issued_at time changed. | 20:20 |
| *** dims has joined #openstack-keystone | 20:21 | |
| lbragstad | bknudson: when do you see this? | 20:24 |
| lbragstad | when you say 'returned' token, what api call are you making? | 20:24 |
| bknudson | lbragstad: the POST to /v2.0/tokens returned u'issued_at': u'2014-07-25T20:15:49.320034' | 20:25 |
| bknudson | and then later in the HEAD to validate that the token is valid then token_data has 2014-07-25 20:16:22.936034 | 20:25 |
| bknudson | I'd expect the token's issued_at time to not change | 20:26 |
| *** marcoemorais has quit IRC | 20:28 | |
| *** slogan_ has quit IRC | 20:28 | |
| *** marcoemorais has joined #openstack-keystone | 20:29 | |
| *** gordc has joined #openstack-keystone | 20:30 | |
| gordc | dolphm: regarding pycadf-core, is the plan to have that continue on as normal? ie. nominating new members and not bringing in keystone-core team by default? | 20:34 |
| lbragstad | bknudson: you're doing http://docs.openstack.org/api/openstack-identity-service/2.0/content/tokens.html ? | 20:34 |
| dolphm | gordc: don't have a rigid plan; what what you suggest? | 20:34 |
| bknudson | lbragstad: y, that's the original request to get the v2 token | 20:35 |
| lbragstad | yep, I have that | 20:35 |
| lbragstad | what does your -HEAD request look like? | 20:36 |
| gordc | dolphm: is there anyone specifically interested in auditing from keystone team? i wouldn't mind having an extra set of eyes for review (if we expect a lot of work in future) | 20:36 |
| bknudson | lbragstad: it's this one: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/test_v3_auth.py#n1306 | 20:36 |
| bknudson | that actually uses the v3 api and not the v2 api | 20:36 |
| lbragstad | bknudson: right. | 20:36 |
| gordc | also, oslo-core is by default members as well... will that continue on? | 20:37 |
| lbragstad | bknudson: it uses the v3 api with v2 tokens | 20:37 |
| bknudson | lbragstad: y. that should be allowed but maybe it's not being handled correctly | 20:37 |
| *** gabriel-bezerra has quit IRC | 20:37 | |
| dolphm | gordc: besides myself, i would guess maybe stevemar, bknudson and morganfainberg_Z ? | 20:38 |
| bknudson | lbragstad: because it looks like there's calls in the token handling patch that are v3-only. | 20:38 |
| *** gabriel-bezerra has joined #openstack-keystone | 20:38 | |
| dolphm | gordc: i haven't really asked around though, i just know that we've ^ had conversation about audit | 20:38 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L572 | 20:38 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L605 | 20:38 |
| stevemar | dolphm, gordc i can almost guarantee i'll be maintaining pycadf | 20:39 |
| gordc | dolphm: cool cool. i'll just add you for now and we can expand from there? dhellmann, any concerns? | 20:39 |
| stevemar | gordc, not naming names, but someone increased my workload :P | 20:39 |
| dolphm | stevemar: well then we have a volunteer | 20:39 |
| gordc | dhellmann: the above assuming everyone is ok with expanded Keystone scope | 20:40 |
| bknudson | lbragstad: check this out... looks fishy https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L636 | 20:40 |
| bknudson | v3_token_data_helper.get_token_data() doesn't get the issued_at time. | 20:40 |
| bknudson | lbragstad: and then look here: https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L319 | 20:41 |
| bknudson | it sets issued_at to the current time. | 20:41 |
| lbragstad | bknudson: yep | 20:41 |
| lbragstad | but... it's that only v3? | 20:42 |
| lbragstad | v2.0 token does something different | 20:42 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L605 | 20:42 |
| bknudson | lbragstad: take a look at https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L636 again... it says "token ref is created by V2 API" | 20:42 |
| lbragstad | gyee: ping? | 20:43 |
| lbragstad | bknudson: should we hit that path though? | 20:43 |
| lbragstad | that is with a v3 token. | 20:43 |
| lbragstad | this case is using the v3 api with a v2.0 token | 20:43 |
| * lbragstad might be missing something? | 20:43 | |
| lbragstad | in the v2 token case, token_data is populated with token_data = self.v2_token_data_helper.format_token() | 20:44 |
| bknudson | that path is hit. I got there in the debugger | 20:44 |
| bknudson | /opt/stack/keystone/keystone/auth/controllers.py(503)check_token() -> /opt/stack/keystone/keystone/token/provider.py(184)validate_v3_token() | 20:44 |
| lbragstad | ... | 20:45 |
| lbragstad | hmm | 20:45 |
| bknudson | Maybe the v3 means that we want a v3 response and not that the token is necessarily v3 | 20:45 |
| bknudson | I think morganfainberg_Z is going to clean all this up with his token model work | 20:45 |
| gordc | dolphm: while i have you, could you take a look at comment on https://review.openstack.org/#/c/102958/ | 20:45 |
| lbragstad | bknudson: strange | 20:45 |
| gordc | stevemar: name names! this isn't being recorded. | 20:46 |
| lbragstad | bknudson: this path seems like it was built for the POST case and not HEAD | 20:47 |
| gyee | lbragstad, here | 20:47 |
| lbragstad | i.e. Give me a new token, in which case the issued_at time needs to be now, | 20:47 |
| lbragstad | gyee: bknudson and I are hitting a weird (or what seems weird) case with using v2 tokens with the v3 token api | 20:48 |
| dolphm | gordc: how does it have a dependency on other middleware? | 20:48 |
| lbragstad | gyee: if you comment out this line: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/test_v3_auth.py#n1304 | 20:48 |
| lbragstad | that test fails.. | 20:48 |
| gyee | it failed at the next line? | 20:49 |
| lbragstad | gyee: bknudson traced v2 token validation through https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L319 | 20:49 |
| lbragstad | which is for v3 tokens only? | 20:50 |
| gordc | dolphm: so originally when i built middleware, there was a separate middleware that did something similar (notifiermiddleware) | 20:50 |
| gyee | right, anything *_at is v3 stuff | 20:50 |
| *** marekd is now known as marekd|away | 20:50 | |
| gordc | that middleware basically grabs an undefined set of environment variables for each request and builds/sends a notification of it | 20:51 |
| bknudson | I haven't tried this, but I think if you get a V2 token and then validate it using V3 it will return a different issued_at time | 20:51 |
| stevemar | dolphm, gordc speaking of pycadf, did you all want to talk about: https://review.openstack.org/#/c/109060/ | 20:51 |
| bknudson | gyee: ^ is what I think the issue is | 20:51 |
| dolphm | gordc: ah; so the alternative is just to emit the notification from the same piece of middleware? | 20:51 |
| gordc | dolphm: currently the audit middleware inherits the notifiermiddleware and includes the audit event as part of that undefined set of env variables | 20:52 |
| dolphm | stevemar: yeah, it still bothers me that endpoints are considered audit-relevant at all | 20:52 |
| bknudson | lbragstad: maybe you could try that... get a V2 token and then validate it using V3 | 20:52 |
| dolphm | gordc: inherits how? | 20:52 |
| gordc | dolphm: yeah, the alternative is to just emit audit event and ignore all the other env variables notifiermiddleware includes | 20:53 |
| dolphm | gordc: in 102958, AuditMiddleware extends object | 20:53 |
| gordc | dolphm: yeah, that wasn't meant to be reviewed... it was sort of a brain dump before i went on vacation | 20:53 |
| gordc | but that patch is more towards removing dependency on notifiermiddleware | 20:54 |
| gordc | dolphm: the audit middleware in production today is this: https://github.com/openstack/pycadf/blob/master/pycadf/middleware/audit.py | 20:54 |
| dolphm | gordc: ack; one piece of middleware sounds much more attractive if there's no reason for *other* pieces of middleware to add additional data to the audit notification | 20:55 |
| gordc | dolphm: ok, i'll go ahead with single middleware solution | 20:55 |
| gyee | bknudson, but HEAD call should not reconstruct token data | 20:55 |
| gyee | HEAD simply checks for token ID | 20:55 |
| bknudson | gyee: with revocation events, the HEAD call has to reconstruct the token data to check the data against the revocation events | 20:56 |
| bknudson | when we had a revocation list then only the token ID was needed | 20:56 |
| dolphm | gordc: so, today it's keystonemiddleware.auth_token -> pycadf.middleware.audit in the pipeline, right? | 20:57 |
| gordc | dolphm: yep | 20:57 |
| bknudson | lbragstad: I think I've got a fix | 20:57 |
| gordc | it would be the same afterwards since we depend on service catalog. | 20:58 |
| dolphm | gordc: but keystonemiddleware.*.audit is intended to replace pycadf.middleware.audit ? | 20:58 |
| gordc | stevemar: in CADF, for Resources, the id field is required. http://docs.openstack.org/developer/pycadf/specification/resources.html | 20:58 |
| gordc | dolphm: right. i'd probably remove the middleware (and it's dependencies) from pyCADF when we move it to keystonemiddleware | 20:59 |
| dolphm | gordc: cool. does pycadf have a -spec repo somewhere? | 21:00 |
| bknudson | lbragstad: gyee: I'll clean this up and post it since it seems to work. | 21:00 |
| gordc | dolphm: we discussed it but since there wasn't much work being done on it, we didn't create one. | 21:01 |
| gyee | bknudson, you found the problem? | 21:01 |
| gordc | dolphm: do you intend on expanding pyCADF beyond the actual CADF specification? | 21:01 |
| bknudson | gyee: yes, it's essentially also passing along the token's issued_at time here: https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L636 | 21:01 |
| stevemar | gordc, shouldn't we not expand it beyond the spec? | 21:02 |
| dolphm | gordc: no, i mean for the implementation, not the standard | 21:02 |
| gordc | dolphm: yeah, the pyCADF library itself doesn't have a spec... but could if there's a need. | 21:02 |
| gordc | stevemar: the double negative seems like a trick question.lol | 21:02 |
| *** dims has quit IRC | 21:03 | |
| bknudson | we'll probably want to keep matt rutkowski as a core to keep us honest | 21:03 |
| dolphm | gordc: i'm just thinking with a separate core team, a separate spec repo makes sense? or both core teams need +2 on keystone-specs. *shrug* | 21:03 |
| gyee | bknudson, but that's expected though since token is created by V2 | 21:03 |
| gordc | stevemar: i think it should be as lightweight as possible... so just the spec hopefully (unless something else falls under it) | 21:03 |
| bknudson | gyee: a V2 token also has an issued_at time | 21:04 |
| gordc | dolphm: yeah we can create a separate spec repo... was there a specific bp you had in mind that would fall under pyCADF? | 21:04 |
| gyee | bknudson, yeah I see | 21:05 |
| dolphm | gordc: how do people consume the audit notifications, btw? i haven't gotten that far! | 21:05 |
| gordc | i just didn't do it because we didn't really have any bps, just work items to fill gap between implementation and spec. | 21:05 |
| dolphm | gordc: specific bp == moving pycadf middleware to keystoneclient | 21:05 |
| dolphm | err keystonemiddleware | 21:05 |
| lbragstad | bknudson: sure, I can try that | 21:06 |
| gordc | dolphm: right now, because it's tied to notifiermiddleware, the audit event is part of http.request and http.response meters in ceilometer (if middleware is enabled) | 21:06 |
| lbragstad | bknudson: so steps to recreate, 1.) POST to get a token with v2 and note the time 2.) Use HEAD to check the token with v3 and see if the issued-at time changed | 21:07 |
| gordc | dolphm: i guess that's a bp... (i would've snuck that in as a bug) :) | 21:07 |
| bknudson | lbragstad: is there a GET v3 to get the token info? | 21:07 |
| stevemar | dolphm, why not have pycadf specs under the identity-spec umbrella? | 21:07 |
| stevemar | we have middlware and client ones there | 21:07 |
| bknudson | lbragstad: if it's just a HEAD then you're not going to get the data | 21:08 |
| dolphm | stevemar: my only concern with that is how +2's work - if they should be separate core teams then the gerrit permissions should reflect that | 21:08 |
| stevemar | dolphm, honor system? | 21:08 |
| stevemar | dolphm, seems like a lot of hassle | 21:09 |
| stevemar | just my 2c | 21:09 |
| dolphm | stevemar: if we're going to have a seperate core team, it seems like less hassle to have two specs repos | 21:09 |
| lbragstad | bknudson: checking | 21:10 |
| gordc | dolphm: tbh, regardless, i think most of the reviews will be from keystone members.. (plus me) | 21:11 |
| lbragstad | bknudson: there is a GET for /auth/tokens/ in v3 | 21:11 |
| lbragstad | that is what returns the service catalog | 21:11 |
| bknudson | this should be interesting | 21:11 |
| lbragstad | bknudson: http://docs.openstack.org/api/openstack-identity-service/3/content/tokens-1.html | 21:11 |
| lbragstad | bknudson: so, if what you're saying is true, issued_at time for a v2 token using that API shouldn't change unless using HEAD /auth/token | 21:12 |
| lbragstad | s/token/tokens/ | 21:12 |
| gyee | lbragstad, v2 have no issued_at date I don't think | 21:13 |
| bknudson | lbragstad: if what I'm saying is true then the issued_at time in the POST /v2.0/tokens will be different than the issued_at time from GET /auth/tokens | 21:13 |
| gyee | so when we convert a v2 token to v3, we have to pull one our of asses | 21:13 |
| lbragstad | gyee: http://pasteraw.com/37q9v3y80tlydltujo7vwfk7gcabggf | 21:14 |
| bknudson | gyee: lbragstad: my v2 token had an issued_at time | 21:14 |
| lbragstad | bknudson: ^ | 21:14 |
| lbragstad | bknudson: so did mine | 21:14 |
| lbragstad | v2 tokens include all that in the response body | 21:14 |
| gyee | was that added later | 21:15 |
| *** marcoemorais1 has joined #openstack-keystone | 21:15 | |
| gyee | I remember the original doc doesn't have this date | 21:15 |
| bknudson | it might have been | 21:15 |
| bknudson | maybe it was added for revocation events | 21:15 |
| gyee | all the *_at dates are v3 | 21:15 |
| stevemar | dolphm, alright 2 repos | 21:15 |
| lbragstad | bknudson: so with the v3/auth/tokens/ GET, you included the v2 token in X-Subject-Token? | 21:16 |
| lbragstad | right? | 21:16 |
| bknudson | lbragstad: now you should be able to pass that token ID to GET /v3/auth/tokens | 21:16 |
| *** marcoemorais1 has quit IRC | 21:16 | |
| bknudson | lbragstad: yes | 21:16 |
| gyee | k, looks like identity-api doc for v2 is outdated | 21:16 |
| gyee | definitely don't have the issued_at date there | 21:17 |
| bknudson | gyee: the WADLs? | 21:17 |
| *** marcoemorais1 has joined #openstack-keystone | 21:17 | |
| gyee | bknudson, no trace of it anywhere | 21:17 |
| lbragstad | bknudson: http://pasteraw.com/3oycofc541dil3d7hkzhihlcxlthqg4 | 21:18 |
| lbragstad | bknudson: you're right | 21:18 |
| lbragstad | the issued_at time changes | 21:18 |
| bknudson | lbragstad: do you get a different issued_at every time? | 21:18 |
| *** marcoemorais has quit IRC | 21:18 | |
| lbragstad | bknudson: I did between the POST /v2.0/tokens/ and GET /v3/auth/tokens/ calls | 21:19 |
| bknudson | lbragstad: what if you do a GET again with the same token? | 21:19 |
| lbragstad | bknudson: with the same token in X-Subject-Token? | 21:19 |
| bknudson | lbragstad: yes | 21:20 |
| lbragstad | bknudson: yes | 21:20 |
| lbragstad | http://pasteraw.com/9wgyrmawewer1ptv5ct58w7pcrfb7zt | 21:20 |
| lbragstad | it happens on every GET call | 21:20 |
| gyee | figured | 21:20 |
| lbragstad | sweet | 21:21 |
| bknudson | well, mystery solved | 21:21 |
| lbragstad | well /v3/auth/tokens/ GET has a bug | 21:21 |
| bknudson | I feel like a regular Lisbeth Salander | 21:21 |
| dolphm | issued at is changing? | 21:22 |
| gyee | yeah, like a magic 8 ball | 21:22 |
| lbragstad | bknudson: do you have a bug already open? | 21:22 |
| bknudson | lbragstad: I'd open a new bug for this one | 21:23 |
| lbragstad | bknudson: ok, I can do that | 21:23 |
| *** gabriel-bezerra has quit IRC | 21:23 | |
| bknudson | it's probably an OSSA since it means that tokens aren't getting revoked as expected | 21:23 |
| gyee | funny we keep shoehorning these things into v2 :) | 21:24 |
| bknudson | we should just get rid of v2 | 21:24 |
| *** gabriel-bezerra has joined #openstack-keystone | 21:24 | |
| gyee | we won't fix it, nice incentive for ppl to move to v3 :) | 21:25 |
| dolphm | (what's not fixable on v2?) | 21:25 |
| gyee | dolphm, its fixable, it was a joke | 21:26 |
| lbragstad | https://bugs.launchpad.net/keystone/+bug/1348820 | 21:27 |
| uvirtbot | Launchpad bug 1348820 in keystone "Token issued_at time changes on /v3/auth/token GET requests" [Undecided,New] | 21:27 |
| lbragstad | nice catch bknudson | 21:27 |
| lbragstad | gyee: ^ | 21:28 |
| gyee | good stuff! | 21:28 |
| lbragstad | bknudson: it was because of: https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L319 ? | 21:30 |
| bknudson | lbragstad: y, that's where it's getting the new issued_at every tiem. | 21:31 |
| lbragstad | bknudson: ok, noting that in the bug | 21:31 |
| gyee | shit that means the hash is broken too | 21:31 |
| *** gabriel-bezerra has quit IRC | 21:31 | |
| gyee | nm, pki tokens we don't regen | 21:32 |
| *** gabriel-bezerra has joined #openstack-keystone | 21:32 | |
| lbragstad | so, when I read the code, it seems like v2 tokens shouldn't be validated with that path | 21:33 |
| lbragstad | shouldn't it go through: https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L605 | 21:34 |
| lbragstad | ? | 21:34 |
| bknudson | lbragstad: if you do a v3 request it has to return a v3 token response | 21:36 |
| bknudson | even if it was given a v2 token | 21:36 |
| lbragstad | bknudson: gotcha | 21:36 |
| bknudson | that doesn't mean you're wrong that a v3 request could go down that path instead... but at some point the v2 token has to be turned into a v3 token | 21:38 |
| *** gokrokve has quit IRC | 21:38 | |
| *** henrynash has joined #openstack-keystone | 21:42 | |
| lbragstad | bknudson: which is where the format_token stuff comes into play? | 21:43 |
| bknudson | lbragstad: I guess so... it's strange that V2TokenDataHelper has format_token and V3TokenDataHelper has get_token_data | 21:46 |
| lbragstad | bknudson: yeah... that's what I was thinking | 21:46 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add a test for revoking a V2 token without validating first https://review.openstack.org/109602 | 21:48 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix for revoking a V2 token without validating first https://review.openstack.org/109747 | 21:48 |
| *** cjellick has quit IRC | 21:49 | |
| *** gabriel-bezerra has quit IRC | 21:49 | |
| *** cjellick has joined #openstack-keystone | 21:49 | |
| *** gabriel-bezerra has joined #openstack-keystone | 21:50 | |
| *** doddstack has quit IRC | 21:52 | |
| *** jasondotstar has quit IRC | 21:52 | |
| *** elmiko is now known as _elmiko | 21:52 | |
| *** cjellick has quit IRC | 21:54 | |
| *** cjellick has joined #openstack-keystone | 21:54 | |
| *** gokrokve has joined #openstack-keystone | 21:54 | |
| *** cjellick has quit IRC | 21:55 | |
| *** morganfainberg_Z is now known as morganfainberg | 21:55 | |
| *** gokrokve has quit IRC | 21:55 | |
| *** cjellick has joined #openstack-keystone | 21:55 | |
| morganfainberg | bknudson, i'm trying to solve some of it with the tokenmodel | 21:55 |
| morganfainberg | bknudson, but... it's slowish. | 21:56 |
| *** gokrokve has joined #openstack-keystone | 21:56 | |
| morganfainberg | bknudson, lots to get there | 21:56 |
| *** gokrokve has quit IRC | 22:01 | |
| *** marcoemorais1 has quit IRC | 22:03 | |
| *** gokrokve has joined #openstack-keystone | 22:03 | |
| *** marcoemorais has joined #openstack-keystone | 22:05 | |
| morganfainberg | stevemar, ping | 22:08 |
| morganfainberg | stevemar, re: tokens if you're around now | 22:08 |
| stevemar | morganfainberg, pongish | 22:08 |
| stevemar | morganfainberg, here, for a bit anyway | 22:08 |
| morganfainberg | stevemar, ok so for the saml2 token, we don't have domain in the user section | 22:09 |
| morganfainberg | stevemar, this breaks things such as revocation events | 22:09 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add tests related to V2 token issued_at time changing https://review.openstack.org/109602 | 22:09 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix for V2 token issued_at time changing https://review.openstack.org/109747 | 22:09 |
| bknudson | ok, I think this is good for that part of the revocation event fixes | 22:09 |
| morganfainberg | stevemar, any thoughts on ... well. what we should be doing, should we *not* assume a token user has a domain info? | 22:09 |
| henrynash | morganfainberg: hi……in https://review.openstack.org/#/c/106917/10/keystone/tests/unit/token/test_token_model.py, can you explain why you issue, for instance, self.assertTrue(token_data.project_scoped) more than once in a given test? | 22:10 |
| stevemar | morganfainberg, thats not good | 22:10 |
| morganfainberg | henrynash, i check that we're project scoped, then we delete the project scope | 22:10 |
| morganfainberg | henrynash, i think one should be assertFalse, right? | 22:11 |
| stevemar | morganfainberg, well whats the impact in assuming a user does not have a domain section? accidentally look up the wrong user? | 22:11 |
| morganfainberg | stevemar, well more we always *assume* there is a domain with a user (even v2, we have 'default') | 22:11 |
| henrynash | morganfainberg: no that bits correct, but before that….see lines 79 and 88 | 22:11 |
| morganfainberg | henrynash, let me look. | 22:11 |
| stevemar | morganfainberg, no way to skip that part if OS-FEDERATION exists in the dict? | 22:12 |
| morganfainberg | henrynash, ah, copy/paste | 22:12 |
| stevemar | morganfainberg, or actually, we could put the IDP value in there as domain id/name ? | 22:12 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Add test for checking token issued_at time https://review.openstack.org/109757 | 22:12 |
| henrynash | morganfainberg: ok, not wrong, but a bit duplicative…. | 22:12 |
| stevemar | morganfainberg, that's guaranteed to be unique | 22:12 |
| morganfainberg | henrynash, yeah it's just a duplicate that isn't needed | 22:12 |
| morganfainberg | stevemar, hmm. | 22:12 |
| morganfainberg | stevemar, well we need to fix middleware as well | 22:13 |
| lbragstad | bknudson: ^ | 22:13 |
| lbragstad | you can incorporate that if you want | 22:13 |
| bknudson | lbragstad: I updated an existing test in https://review.openstack.org/#/c/109602/ | 22:13 |
| stevemar | morganfainberg, the revocation part? | 22:14 |
| *** gordc has quit IRC | 22:14 | |
| morganfainberg | stevemar, yes and the bug i linked to you this morning | 22:14 |
| bknudson | lbragstad: there was already a test that checked some fields | 22:14 |
| lbragstad | bknudson: ok, cool | 22:14 |
| henrynash | morganfainberg: there’s a similar one for domains in the V2 test….personally I’m ok with a bit of duplication….do you want me to approve, or do you want to fix… | 22:16 |
| morganfainberg | henrynash, i'd be happy to clean it up as a follow-on if that works for you | 22:16 |
| henrynash | morganfainberg: fine | 22:16 |
| morganfainberg | henrynash, but i wouldn't be opposed to you asking it to be fixed first | 22:16 |
| *** lbragsta_ has joined #openstack-keystone | 22:17 | |
| morganfainberg | henrynash, it depends on how important cleaning up the duplication is (if its as a follow-on, I'll post it in a few minutes) | 22:17 |
| henrynash | morganfainberg: let’s get what we have in, since teh duplication is beingn, clean up at will | 22:18 |
| morganfainberg | henrynash, ok i'll post cleanup in a few minutes | 22:18 |
| *** lbragstad has quit IRC | 22:20 | |
| *** lbragsta_ has quit IRC | 22:21 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add a test for revoking a scoped token from an unscoped https://review.openstack.org/109125 | 22:22 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove duplicated asserts https://review.openstack.org/109760 | 22:22 |
| morganfainberg | henrynash, ^ | 22:22 |
| henrynash | morganfainberg: thx | 22:24 |
| *** stevemar has quit IRC | 22:25 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add a test for revoking a scoped token from an unscoped https://review.openstack.org/109125 | 22:32 |
| *** stevemar has joined #openstack-keystone | 22:33 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Endpoint policy extension https://review.openstack.org/99842 | 22:34 |
| *** xianghuihui has quit IRC | 22:35 | |
| *** hrybacki has quit IRC | 22:41 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix revoking a scoped token from an unscoped token https://review.openstack.org/109389 | 22:41 |
| *** amerine has quit IRC | 22:45 | |
| *** amerine has joined #openstack-keystone | 22:45 | |
| *** stevemar has quit IRC | 22:49 | |
| *** xianghuihui has joined #openstack-keystone | 22:51 | |
| openstackgerrit | A change was merged to openstack/keystone: remove static files from docs https://review.openstack.org/109472 | 22:52 |
| *** hrybacki has joined #openstack-keystone | 22:55 | |
| *** morganfainberg is now known as morganfainberg_Z | 22:55 | |
| *** gokrokve has quit IRC | 22:55 | |
| *** harlowja is now known as harlowja_away | 22:58 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix revoking a scoped token from an unscoped token https://review.openstack.org/109389 | 22:59 |
| *** topol has quit IRC | 23:04 | |
| *** harlowja_away is now known as harlowja | 23:06 | |
| *** morganfainberg_Z is now known as morganfainberg | 23:08 | |
| openstackgerrit | A change was merged to openstack/keystone: Add the new Keystone TokenModel https://review.openstack.org/106917 | 23:17 |
| *** gokrokve has joined #openstack-keystone | 23:18 | |
| *** hrybacki has quit IRC | 23:22 | |
| *** gpocente1 has joined #openstack-keystone | 23:24 | |
| *** shuffleb1t has joined #openstack-keystone | 23:24 | |
| *** gpocentek has quit IRC | 23:29 | |
| *** ekarlso has quit IRC | 23:29 | |
| *** shufflebot has quit IRC | 23:29 | |
| *** boris-42 has quit IRC | 23:29 | |
| *** boris-42 has joined #openstack-keystone | 23:31 | |
| *** ekarlso has joined #openstack-keystone | 23:31 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix revoking a scoped token from an unscoped token https://review.openstack.org/109389 | 23:32 |
| *** marcoemorais has quit IRC | 23:34 | |
| *** marcoemorais has joined #openstack-keystone | 23:35 | |
| *** henrynash has quit IRC | 23:37 | |
| *** marcoemorais has quit IRC | 23:39 | |
| *** hrybacki has joined #openstack-keystone | 23:40 | |
| *** stevemar has joined #openstack-keystone | 23:40 | |
| *** marcoemorais has joined #openstack-keystone | 23:41 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix revoking a scoped token from an unscoped token https://review.openstack.org/109389 | 23:50 |
| *** morganfainberg is now known as morganfainberg_Z | 23:51 | |
| *** gokrokve has quit IRC | 23:54 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!