| *** gokrokve has quit IRC | 00:03 | |
| *** topol has joined #openstack-keystone | 00:12 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Remove mox dependency https://review.openstack.org/109887 | 00:38 |
|---|---|---|
| *** diegows has quit IRC | 01:11 | |
| *** mberlin1 has quit IRC | 01:43 | |
| *** mberlin has joined #openstack-keystone | 01:44 | |
| *** xianghui has joined #openstack-keystone | 01:47 | |
| *** dims has quit IRC | 01:52 | |
| *** dims has joined #openstack-keystone | 01:54 | |
| *** hrybacki has joined #openstack-keystone | 01:58 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: Do not consume trust uses when create token fails https://review.openstack.org/103445 | 02:03 |
| *** mtl11 has quit IRC | 02:04 | |
| *** mtl1 has joined #openstack-keystone | 02:04 | |
| *** alex_xu has joined #openstack-keystone | 02:10 | |
| *** dims has quit IRC | 02:14 | |
| *** ncoghlan has joined #openstack-keystone | 02:53 | |
| *** hrybacki has quit IRC | 02:55 | |
| *** gabriel-bezerra has quit IRC | 03:09 | |
| *** gabriel-bezerra has joined #openstack-keystone | 03:10 | |
| *** traz__ has joined #openstack-keystone | 03:14 | |
| traz__ | Hi, I'm trying to integrate swift with keystone. | 03:15 |
| traz__ | The token is generated but I', getting authorization issue when using the token | 03:17 |
| traz__ | Please see : http://paste.openstack.org/show/88339/ http://paste.openstack.org/show/88340/ | 03:18 |
| *** arunkant has quit IRC | 03:18 | |
| *** arunkant has joined #openstack-keystone | 03:18 | |
| jamielennox | traz__: do you have logs from swift? | 03:23 |
| traz__ | we are getting following logs: http://paste.openstack.org/show/88608/ | 03:27 |
| jamielennox | traz__: can you run it with --debug and get the logs again? | 03:29 |
| jamielennox | also perhaps the keystone_authtoken part of your swift cnofig | 03:29 |
| traz__ | In the request to swift is the URL and token passed correctly ? or there is some problem with syntax ? | 03:30 |
| jamielennox | traz__: it looks ok, and i think it is being found in auth token middleware, just want to see what is happening on the swift side that is causing the rejection | 03:33 |
| jamielennox | i'm *guessing* that it might be how you've configured auth_token in swift to talk to keystone | 03:33 |
| *** alex_xu has quit IRC | 03:33 | |
| traz__ | This is the swift configuration file proxy-server.conf : http://paste.openstack.org/show/88609/ | 03:34 |
| jamielennox | i don't think service_host and service_port do anything there but the rest looks ok | 03:37 |
| jamielennox | although i'm not sure exactly what keystone_auth is | 03:38 |
| jamielennox | it doesn't exist in keystoneclient though | 03:39 |
| *** gabriel-bezerra has quit IRC | 03:40 | |
| *** gabriel-bezerra has joined #openstack-keystone | 03:41 | |
| *** alex_xu has joined #openstack-keystone | 03:42 | |
| *** dims has joined #openstack-keystone | 03:54 | |
| traz__ | jamielennox : I removed the keystone from the pipeline -- pipeline = catch_errors healthcheck cache authtoken proxy-server | 03:54 |
| traz__ | and it worked, thanks for pointing that out | 03:55 |
| *** chandankumar has joined #openstack-keystone | 03:55 | |
| jamielennox | traz__: great, glad i could help | 03:56 |
| *** ncoghlan is now known as ncoghlan_afk | 03:57 | |
| *** mitz_ has joined #openstack-keystone | 03:58 | |
| *** mitz has quit IRC | 03:58 | |
| openstackgerrit | Jeffrey Zhang proposed a change to openstack/keystone: Redirect stdout and stderr when using subprocess https://review.openstack.org/51610 | 04:00 |
| *** gabriel-bezerra has quit IRC | 04:06 | |
| *** gabriel-bezerra has joined #openstack-keystone | 04:07 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:54 | |
| *** xianghuihui has joined #openstack-keystone | 04:57 | |
| *** ajayaa has joined #openstack-keystone | 04:58 | |
| *** Guest79468 is now known as gpocentek | 04:58 | |
| *** gpocentek has joined #openstack-keystone | 04:58 | |
| *** xianghui has quit IRC | 04:59 | |
| *** dims has quit IRC | 05:00 | |
| *** xianghuihuihui has joined #openstack-keystone | 05:05 | |
| *** amerine has quit IRC | 05:06 | |
| *** xianghuihui has quit IRC | 05:07 | |
| *** amerine has joined #openstack-keystone | 05:08 | |
| *** jamielennox is now known as jamielennox|away | 05:11 | |
| *** stevemar has quit IRC | 05:11 | |
| *** k4n0 has joined #openstack-keystone | 05:17 | |
| *** topol has quit IRC | 05:34 | |
| *** ncoghlan is now known as ncoghlan_afk | 05:38 | |
| *** jaosorior has joined #openstack-keystone | 05:42 | |
| *** ukalifon has joined #openstack-keystone | 05:44 | |
| *** ukalifon3 has joined #openstack-keystone | 05:50 | |
| *** ukalifon has quit IRC | 05:52 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/106939 | 06:04 |
| *** ncoghlan_afk is now known as ncoghlan | 06:20 | |
| *** tomoiaga has joined #openstack-keystone | 06:30 | |
| *** afazekas is now known as __afazekas | 06:33 | |
| *** bvandenh has joined #openstack-keystone | 06:36 | |
| *** afazekas_ has quit IRC | 06:39 | |
| *** gabriel-bezerra has quit IRC | 06:39 | |
| *** gabriel-bezerra has joined #openstack-keystone | 06:40 | |
| *** dims has joined #openstack-keystone | 06:45 | |
| *** gabriel-bezerra has quit IRC | 06:46 | |
| *** gabriel-bezerra has joined #openstack-keystone | 06:46 | |
| *** dims has quit IRC | 06:49 | |
| *** henrynash has joined #openstack-keystone | 07:03 | |
| *** afazekas_ has joined #openstack-keystone | 07:18 | |
| *** henrynash has quit IRC | 07:20 | |
| *** henrynash has joined #openstack-keystone | 07:32 | |
| *** henrynash has quit IRC | 07:44 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Versioned Endpoint hack for Sessions https://review.openstack.org/90632 | 08:01 |
| *** xianghuihui has joined #openstack-keystone | 08:07 | |
| *** xianghuihuihui has quit IRC | 08:08 | |
| *** bvandenh has quit IRC | 08:19 | |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Catch correct oslo.db exception https://review.openstack.org/108935 | 08:20 |
| *** chmouel has quit IRC | 08:30 | |
| *** bvandenh has joined #openstack-keystone | 08:31 | |
| *** chmouel has joined #openstack-keystone | 08:32 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Overwrite get_endpoint in Saml2UnscopedToken. https://review.openstack.org/109575 | 08:38 |
| *** henrynash has joined #openstack-keystone | 08:40 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: List federated projects and domains https://review.openstack.org/107393 | 08:43 |
| *** ajayaa has quit IRC | 08:44 | |
| *** ajayaa has joined #openstack-keystone | 08:45 | |
| *** henrynash has quit IRC | 08:52 | |
| *** dobson has quit IRC | 09:08 | |
| *** dobson has joined #openstack-keystone | 09:13 | |
| *** alex_xu has quit IRC | 09:14 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: Do not consume trust uses when create token fails https://review.openstack.org/103445 | 09:23 |
| *** ncoghlan has quit IRC | 09:30 | |
| *** gabriel-bezerra has quit IRC | 09:43 | |
| *** gabriel-bezerra has joined #openstack-keystone | 09:44 | |
| *** xianghuihui has quit IRC | 09:46 | |
| *** gabriel-bezerra has quit IRC | 09:54 | |
| *** gabriel-bezerra has joined #openstack-keystone | 09:55 | |
| *** openstackgerrit has quit IRC | 10:01 | |
| *** mitz_ has quit IRC | 10:17 | |
| *** mitz has joined #openstack-keystone | 10:18 | |
| *** mitz has quit IRC | 10:18 | |
| *** mitz has joined #openstack-keystone | 10:20 | |
| *** gabriel-bezerra has quit IRC | 11:05 | |
| *** gabriel-bezerra has joined #openstack-keystone | 11:06 | |
| *** afazekas_ is now known as afazekas | 11:21 | |
| *** cjellick has joined #openstack-keystone | 11:32 | |
| *** cjellick has quit IRC | 11:33 | |
| *** cjellick has joined #openstack-keystone | 11:33 | |
| *** gabriel-bezerra has quit IRC | 11:37 | |
| *** gabriel-bezerra has joined #openstack-keystone | 11:37 | |
| *** gabriel-bezerra has quit IRC | 11:39 | |
| *** gabriel-bezerra has joined #openstack-keystone | 11:40 | |
| *** Simon_sing has joined #openstack-keystone | 11:50 | |
| Simon_sing | hey guys, has anyone working ActiveDirectory + Kerberos Keystone via wsgi in apache? Right now I have working Keystone via WSGI and trying to use base auth to later do kerberos, but can't make it work in python-keystoneclient. | 11:53 |
| *** miqui has quit IRC | 11:54 | |
| *** gabriel-bezerra has quit IRC | 11:56 | |
| *** gabriel-bezerra has joined #openstack-keystone | 11:57 | |
| *** diegows has joined #openstack-keystone | 12:06 | |
| *** chandankumar has quit IRC | 12:34 | |
| *** hrybacki has joined #openstack-keystone | 12:41 | |
| *** gabriel-bezerra has quit IRC | 12:41 | |
| *** erecio has joined #openstack-keystone | 12:42 | |
| *** gabriel-bezerra has joined #openstack-keystone | 12:42 | |
| *** gordc has joined #openstack-keystone | 12:43 | |
| *** vhoward has joined #openstack-keystone | 12:49 | |
| *** k4n0 has quit IRC | 12:50 | |
| *** joesavak has joined #openstack-keystone | 12:50 | |
| *** erecio has quit IRC | 12:51 | |
| *** jasondotstar has joined #openstack-keystone | 12:52 | |
| *** bvandenh has quit IRC | 12:53 | |
| *** erecio has joined #openstack-keystone | 12:59 | |
| *** gabriel-bezerra has quit IRC | 12:59 | |
| *** gabriel-bezerra has joined #openstack-keystone | 13:00 | |
| *** erecio has quit IRC | 13:05 | |
| *** _elmiko is now known as elmiko | 13:05 | |
| *** elmiko has left #openstack-keystone | 13:06 | |
| *** bvandenh has joined #openstack-keystone | 13:06 | |
| *** topol has joined #openstack-keystone | 13:06 | |
| *** lbragstad has joined #openstack-keystone | 13:15 | |
| *** lbragstad has quit IRC | 13:15 | |
| *** lbragstad has joined #openstack-keystone | 13:16 | |
| *** gabriel-bezerra has quit IRC | 13:17 | |
| *** bknudson has quit IRC | 13:18 | |
| *** gabriel-bezerra has joined #openstack-keystone | 13:19 | |
| *** openstackgerrit has joined #openstack-keystone | 13:32 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes a capitalization issue https://review.openstack.org/108811 | 13:37 |
| *** bknudson has joined #openstack-keystone | 13:38 | |
| *** stevemar has joined #openstack-keystone | 13:39 | |
| *** xianghuihui has joined #openstack-keystone | 13:53 | |
| *** dims has joined #openstack-keystone | 13:56 | |
| *** hrybacki has quit IRC | 14:00 | |
| dolphm | there's a bug against pretty much every project that tox 1.7.2's random PYTHONHASHSEED causes test failures - but i'm not seeing any. do we have another workaround (?) or have we just written better tests..? | 14:02 |
| dolphm | https://bugs.launchpad.net/nova/+bug/1348818 | 14:02 |
| uvirtbot | Launchpad bug 1348818 in neutron "Unittests do not succeed with random PYTHONHASHSEED value" [Undecided,In progress] | 14:02 |
| dstanek | bknudson, dolphm: i'm confused by https://review.openstack.org/#/c/108935/2/keystone/tests/test_sql_upgrade.py - will we not know which exception is throw for a give test run? | 14:03 |
| bknudson | dstanek: I believe that oslo.db is in the process of changing which exceptions are thrown | 14:03 |
| dolphm | dstanek: correct | 14:03 |
| *** zzzeek has joined #openstack-keystone | 14:04 | |
| dolphm | bknudson: ++ they're going to stop emitting IntegrityError and start returning DBDuplicateEntry | 14:04 |
| dstanek | so that'll change from one test run to the next? | 14:04 |
| dolphm | dstanek: only if you sync oslo.db in between | 14:04 |
| dolphm | or is oslo.db it's own package now? | 14:04 |
| *** gabriel-bezerra has quit IRC | 14:05 | |
| bknudson | we're using oslo.db from pypi | 14:05 |
| dolphm | dstanek: yeah... so it's for backwards compatibility with older releases | 14:05 |
| *** gabriel-bezerra has joined #openstack-keystone | 14:05 | |
| dstanek | dolphm: ah, ok. backwards compat seem odd for tests | 14:06 |
| dolphm | dstanek: it's just like our changes to tempest to support two responses from keystone for a short duration | 14:06 |
| bknudson | dstanek: it is weird that the only change is in test. | 14:06 |
| dolphm | dstanek: once they can release a new oslo.db without breaking everyone, the FIXME can be removed | 14:07 |
| *** Simon_sing has quit IRC | 14:07 | |
| dolphm | bknudson: ++ this shouldn't be Closes-Bug, this is just a partial fix. @handle_conflicts also needs to know about both | 14:08 |
| *** tristanC_ is now known as tristanC | 14:10 | |
| dstanek | bknudson: yep, you beat me to it. i just grepped for IntegrityError and found that too | 14:11 |
| dolphm | dstanek: you mean acked, right? :P http://beyondgrep.com/ | 14:13 |
| dstanek | dolphm: i say grep as a habit, but the use the ack plugin for vim | 14:14 |
| dolphm | dstanek: i need to get into the habit of using the plugin. i always use it from bash and then have to jump back and forth, or -C <a-lot> | 14:15 |
| boris-42 | dolphm bknudson jamielennox|away hi guys | 14:19 |
| boris-42 | dolphm bknudson jamielennox|away I made one spec for OSprofiler integration, cause it's quite similar for all projects | 14:19 |
| boris-42 | https://review.openstack.org/#/c/103825/3/specs/juno/osprofiler-cross-service-project-profiling.rst | 14:19 |
| boris-42 | dolphm bknudson jamielennox|away ^ if you would like to discuss details now there is common place for that | 14:20 |
| *** joesavak has quit IRC | 14:23 | |
| *** david-lyle has joined #openstack-keystone | 14:28 | |
| *** ukalifon3 has quit IRC | 14:30 | |
| *** diegows has quit IRC | 14:31 | |
| *** topol has quit IRC | 14:36 | |
| *** needscoffee has joined #openstack-keystone | 14:38 | |
| needscoffee | mornin | 14:39 |
| ayoung | needscoffee, you are up early | 14:40 |
| needscoffee | ayoung: not really. usually up about an hour earlier | 14:40 |
| needscoffee | maybe early for being on IRC. | 14:40 |
| needscoffee | stevemar: so any thoughts on the token stuff... ? | 14:41 |
| ayoung | needscoffee, you a nkinder . Early birds by West Coast Coding Cultural Standards (WCCS) | 14:41 |
| ayoung | Sorry, that is WC3S | 14:41 |
| needscoffee | stevemar: do we just special case the federated users and not check domain, but only check idp? | 14:41 |
| needscoffee | ayoung: LOL :) | 14:41 |
| ayoung | needscoffee, check domain where? | 14:42 |
| ayoung | needscoffee, cuz pretty sure the answer to that is no | 14:42 |
| needscoffee | ayoung: revocation events | 14:42 |
| *** ajayaa has quit IRC | 14:42 | |
| *** hrybacki has joined #openstack-keystone | 14:42 | |
| needscoffee | ayoung: the user in federated tokens doesn't have a "domain" | 14:42 |
| needscoffee | it breaks revocation events. | 14:42 |
| ayoung | IdP is not yet in Revocation Events | 14:42 |
| needscoffee | as in.. BOOM can't validate the token | 14:43 |
| *** lbragstad has quit IRC | 14:43 | |
| ayoung | federated tokens should have a domain | 14:43 |
| needscoffee | ayoung: they do, the user does not | 14:43 |
| needscoffee | token['user']['domain'] == keyerror | 14:43 |
| stevemar | correct | 14:43 |
| ayoung | I mean \all users should have a domain. Period. Full Stop. | 14:43 |
| stevemar | then we have to update the toke issued with a domain key | 14:44 |
| stevemar | then comes the question of what value do we attach to it? | 14:45 |
| ayoung | stevemar, and we need to associate domains with the IdP. It can be an implicit relationship if we want: each IdP is a separate domain, | 14:45 |
| stevemar | thats what i was thinking | 14:45 |
| needscoffee | ayoung: stevemar: https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L490-L500 special case token format | 14:45 |
| openstackgerrit | Diane Fleming proposed a change to openstack/identity-api: JSON Home support https://review.openstack.org/109881 | 14:45 |
| ayoung | stevemar, I could see allowing an Idp to support multiple domains, but I would not want to split a domain over multiple IdPs | 14:45 |
| ayoung | stevemar, use the SQL badkend as an example | 14:45 |
| ayoung | it suports multiple domains | 14:45 |
| ayoung | LDAP, OTOH is one backend, one domain | 14:46 |
| ayoung | SAML would start off like LDAP, but, maybe, allow for two different domains in the future from the same IdP based on a mapped value | 14:46 |
| needscoffee | ayoung: i think multiple domains might make it tricky with the user_id mapping | 14:46 |
| ayoung | for Kerberos, that makes a lot of sense: the REALM is part of REMOTE_USER and user_name would be the user part, domain the REALM part | 14:47 |
| ayoung | for Kerberos trusts, that is pretty much the model we are expecting to have to support | 14:47 |
| ayoung | BTW, Kerberos trusts are not Keystone trusts.... | 14:48 |
| needscoffee | ayoung: hehe | 14:48 |
| ayoung | Kerberos is Idp to Idp, Keystone user2user | 14:48 |
| ayoung | lets start with one domain per IdP | 14:48 |
| needscoffee | ayoung: explicit as in in the idp table? | 14:49 |
| needscoffee | ayoung: and how do we manage that migration path? | 14:49 |
| ayoung | needscoffee, lets start with IdPid == domain id | 14:49 |
| ayoung | they are in separate backends, right? | 14:49 |
| needscoffee | ayoung: make it an implicit domain? | 14:49 |
| needscoffee | ayoung: yeah separate tables. | 14:50 |
| needscoffee | ayoung: and separate backends | 14:50 |
| needscoffee | you know. we could just make it a code-construct domain "federated" | 14:50 |
| bknudson | that would be like the default domain | 14:51 |
| needscoffee | bknudson: is that wrong? we could just make this domain a holder for these users. but not a valid target for projects etc | 14:51 |
| openstackgerrit | Diane Fleming proposed a change to openstack/identity-api: Cleanup https://review.openstack.org/109882 | 14:51 |
| bknudson | I don't think it's wrong. | 14:52 |
| bknudson | btw, do we support revoking all tokens for an idp? | 14:52 |
| *** thedodd has joined #openstack-keystone | 14:52 | |
| bknudson | e.g., if you disable an idp | 14:52 |
| needscoffee | bknudson: no, that is on the list to fix | 14:52 |
| bknudson | y, thought we punted on that one | 14:52 |
| needscoffee | bknudson: the thought was that was a revocation event thing | 14:53 |
| dstanek | bknudson: you want https://review.openstack.org/#/c/109602/ merged right? | 14:53 |
| bknudson | making the idp id the user domain id would support that. | 14:53 |
| needscoffee | bknudson: btw, i tagged the mysql timestamp issue to j3. | 14:53 |
| bknudson | dstanek: y, all the issues in that chain are to fix issues with revocation events | 14:53 |
| needscoffee | bknudson: yes it would, it's an easy change either way, which provides the most benefit and the least headache is my only question. | 14:54 |
| *** tomoiaga has quit IRC | 14:54 | |
| dstanek | bknudson: ok, i was you did a -1 with a comment about working on the bug separately and didn't know if you removed the -1 on accident by pusing a new changeset | 14:55 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix revoking a scoped token from an unscoped token https://review.openstack.org/109389 | 14:55 |
| *** lbragstad has joined #openstack-keystone | 14:56 | |
| bknudson | dstanek: I had a patch that was fixing multiple problems and then I noticed I could fix the one problem without the other so I split it out. | 14:56 |
| bknudson | and then I wound up reordering the patches. I think they're right now. | 14:57 |
| needscoffee | ayoung: stevemar: so are there any real reasons we shouldn't do idpid=domain_id (concerns about collisions, other odd interactions)? | 14:57 |
| ayoung | needscoffee, we need to test for collisions, I think, but they should be rare. IdPid and Domain ID are both Keystone specified | 14:58 |
| stevemar | needscoffee, i think it's fine. | 14:58 |
| bknudson | needscoffee: how else would you associate a idp id with a domain ID? something in the mapping? | 14:58 |
| ayoung | if you add a new IdP and it conflicts with an existing domain, you need to reset the IdP | 14:58 |
| ayoung | Or..maybe that should be something explictly required? A migration path where users were in SQL, and you want to move to SAML? | 14:59 |
| ayoung | those can be later additions, though | 14:59 |
| needscoffee | bknudson: the way it is currently impemented, idp doesn't associate to a domain, groups associate to a domain via identity backend | 14:59 |
| needscoffee | bknudson: and you map to a group | 14:59 |
| needscoffee | bknudson: so in theory an idp user could be part of multiple domains | 14:59 |
| bknudson | I don't think it would make sense to use the groups domains. | 15:00 |
| bknudson | but doing a mapping like @us.ibm.com -> domain us and @eu.ibm.com -> domain eu might make sense | 15:00 |
| needscoffee | right, i'm just feeling out if idpid should be the domain id or we should just call all federated users part of the default-like "Federated" domain | 15:00 |
| bknudson | I'm fine with idp ID becomes the domain ID | 15:01 |
| needscoffee | and do revocations on idpid (which is in the token already) | 15:01 |
| bknudson | wouldn't the token have the idp ID as the user's domain? | 15:02 |
| needscoffee | bknudson: yes and it would also have OS-FEDERATED:idp -> idpid | 15:02 |
| needscoffee | or well user['OS-FEDERATED']['identity_provider']['id'] it looks like | 15:04 |
| *** joesavak has joined #openstack-keystone | 15:05 | |
| bknudson | needscoffee: it's not going into the token values for revocation: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/contrib/revoke/model.py#n267 | 15:05 |
| needscoffee | bknudson: no not yet | 15:07 |
| ayoung | needscoffee, I would err on the side of domain being more restrictice than the "Federated Domain" as it is easier to go from smaller to larger. If we endu p having to combine @us.ibm.com and @eu.ibm.com that is simpler than trhying to chisel all of IBM out of the "IDP DOMAIN" | 15:07 |
| needscoffee | ayoung: i don't *think* that use case would change with either implementation | 15:09 |
| needscoffee | ayoung: federated setup would change and you'd auth against the "new" IDP in the combined case, users would still be part of the federated domain. | 15:10 |
| *** gabriel-bezerra has quit IRC | 15:10 | |
| *** gabriel-bezerra has joined #openstack-keystone | 15:10 | |
| needscoffee | ayoung: i'm still thinking it over, once i get my breakfast and coffee, i'll probably have a clearer thought on this | 15:11 |
| ayoung | needscoffee, just remember that once stuff is in Keystone, it is used by lots of systems out there, and that is the binding we need to respect | 15:13 |
| dstanek | dolphm: i'm looking at assignment validation now...were you saying the other day that i shouldn't be able to update a project with a null domain_id? | 15:13 |
| bknudson | dstanek: domain_id should not be nullable | 15:14 |
| dstanek | bknudson: that makes more sense | 15:15 |
| *** topol has joined #openstack-keystone | 15:15 | |
| needscoffee | ayoung: right and i'm concerned that if we are locking up domain ids from a system that isn't controlled by the domain / assignment backend, we're going to run into issues | 15:16 |
| openstackgerrit | Diane Fleming proposed a change to openstack/identity-api: Fix build issue with Identity v2.0 https://review.openstack.org/110017 | 15:16 |
| needscoffee | ayoung: so each domain created has to check to see if it's new id is in the idp backend, and vice versa | 15:16 |
| needscoffee | ayoung: it is triggering the thought that it might be a fraglie setup. | 15:17 |
| ayoung | needscoffee, hmm, I would think the domainid would win out, and we do a migration that all Idp ids go into the domain backend | 15:17 |
| ayoung | add a new Idp, add the domain id at the same time | 15:17 |
| needscoffee | ayoung: that would be bad. i create a domain, it collides with an idp, now that idp is part of the domain | 15:18 |
| needscoffee | ? | 15:18 |
| ayoung | needscoffee, no | 15:18 |
| openstackgerrit | Diane Fleming proposed a change to openstack/identity-api: Cleanup https://review.openstack.org/109882 | 15:18 |
| ayoung | step one, migrate all Idps to have a domainid | 15:18 |
| ayoung | only here do we have the possibility of a clash, and that should be fairly early on | 15:18 |
| needscoffee | ayoung: so... idpid is *sortof* a FK [but not in a sql sense] | 15:19 |
| ayoung | step two, add and Idp, add the corresponding domainids | 15:19 |
| ayoung | yep | 15:19 |
| needscoffee | ayoung: i think that sounds awful | 15:19 |
| ayoung | needscoffee, if we make Idps a core concept, we will make them FKs | 15:19 |
| ayoung | needscoffee, that is the "default" | 15:19 |
| ayoung | needscoffee I would actually do it like this: | 15:19 |
| needscoffee | does federation work with ldap assignment? | 15:20 |
| ayoung | each domain gets and Idp ID value | 15:20 |
| openstackgerrit | Diane Fleming proposed a change to openstack/identity-api: JSON Home support https://review.openstack.org/109881 | 15:20 |
| ayoung | if it is None, it is in the SQL backend | 15:20 |
| ayoung | then, each LDAP source gets a uniqe Identifier | 15:20 |
| ayoung | just tpo grandfather those in | 15:20 |
| openstackgerrit | A change was merged to openstack/keystone: Fixes a capitalization issue https://review.openstack.org/108811 | 15:21 |
| ayoung | but the rest assume that the IdP id points to the IdP table | 15:21 |
| ayoung | and thuse each Idp can support one or more domains | 15:21 |
| *** xianghuihui has quit IRC | 15:21 | |
| ayoung | Now, for the existing Idps, we can set the domainid value to be the same as the IdP id, if we think that things "out there" are going to be already referrring to the IdP id | 15:22 |
| *** gabriel-bezerra has quit IRC | 15:22 | |
| needscoffee | ayoung: i'm missing something "the rest assume that the idp id points to the idp table"? | 15:23 |
| *** gabriel-bezerra has joined #openstack-keystone | 15:23 | |
| ayoung | needs cidde domain.idp_id is a "fkey" to the idp table | 15:23 |
| dolphm | uhh, after upgrading to tox 1.7.2 (i think?): Ran 3978 (+13) tests in 264.692s (-768.156s) | 15:23 |
| needscoffee | ayoung: cidde? | 15:24 |
| ayoung | heh | 15:24 |
| ayoung | needscoffee, that was supposed to be you | 15:25 |
| needscoffee | ah | 15:25 |
| ayoung | needscoffee, domain.idp_id is a "fkey" to the idp table | 15:25 |
| needscoffee | dolphm: that is worrysome | 15:25 |
| dolphm | err, has a very short term memory. i just installed tox 1.7.2 but that was running testr directly lol | 15:27 |
| needscoffee | dolphm: ah | 15:27 |
| needscoffee | still a little odd | 15:27 |
| dolphm | needscoffee: i'll keep poking around | 15:28 |
| dolphm | needscoffee: was trying to repro https://bugs.launchpad.net/keystone/+bug/1348818 | 15:28 |
| uvirtbot | Launchpad bug 1348818 in neutron "Unittests do not succeed with random PYTHONHASHSEED value" [Undecided,In progress] | 15:28 |
| needscoffee | dolphm: ah | 15:28 |
| needscoffee | dolphm: isn't HASHSEED py3.x only? | 15:28 |
| needscoffee | PYTHONHASHSEED | 15:29 |
| dolphm | needscoffee: good question; i'm not familiar with it | 15:29 |
| *** dims has quit IRC | 15:29 | |
| dolphm | needscoffee: https://docs.python.org/2/using/cmdline.html#envvar-PYTHONHASHSEED | 15:29 |
| needscoffee | dolphm: ah | 15:31 |
| needscoffee | dolphm: yep | 15:31 |
| ayoung | needscoffee, http://martinfowler.com/articles/collection-pipeline/ for tokens in the not-too-distant-I-hope-future | 15:35 |
| needscoffee | ayoung: Kilo if someone has cycles to work on it i think | 15:36 |
| ayoung | needscoffee, or maybe it is something that we work into existing features. I think the Token Provider class in tokens/ could be just that | 15:36 |
| ayoung | the /providers then become pieces of the pipeline | 15:37 |
| ayoung | as changes go in, like the Federation mapping thing, we make them more explicit pieces of the pipeline | 15:37 |
| needscoffee | ayoung: it isn't happening in Juno. | 15:37 |
| needscoffee | ayoung: there is too much to be done to re-work that too | 15:37 |
| ayoung | needscoffee, heh, | 15:37 |
| ayoung | needscoffee, so I would say "don;t make it explicitly externally defined" but rather "code it in python" as a first step | 15:38 |
| ayoung | then we can refactor to a pipeline without exposing to the outside world | 15:38 |
| ayoung | only once we have a clean pipeline defined in python do we make it something externally composable | 15:38 |
| needscoffee | ayoung: I'm not committing to that. | 15:38 |
| ayoung | and not make it a big band | 15:38 |
| ayoung | bang | 15:38 |
| needscoffee | ayoung: if someone else has the cycles to do that i'm fine with the attempt, but i see it as a pretty low priority at this point | 15:39 |
| *** david-ly_ has joined #openstack-keystone | 15:40 | |
| *** gyee has joined #openstack-keystone | 15:40 | |
| *** cjellick has quit IRC | 15:40 | |
| ayoung | needscoffee, I think you misunderstand. I say we do it as part of other features, not a deliberate effort at this point | 15:41 |
| needscoffee | ayoung: we already have it mostly in the v3 token data formatter thing | 15:41 |
| ayoung | just so long as we have a clear picture of what it should look like in the end, and we can all understand the goal | 15:41 |
| ayoung | yep, and you've pushed that a long way ahead | 15:42 |
| needscoffee | ayoung: i'm still not committing to it, in fact i am not committing to saying the pipeline is the right answer | 15:42 |
| *** david-ly_ is now known as david-lyle_ | 15:42 | |
| needscoffee | needscoffee: right now i'm staying committed to trying to get non-persistent out the door :) | 15:42 |
| *** cjellick has joined #openstack-keystone | 15:42 | |
| needscoffee | s/needscoffee/ayoung | 15:42 |
| ayoung | ++ | 15:42 |
| *** david-lyle has quit IRC | 15:42 | |
| ayoung | needscoffee, and I to getting Horizon Kerberized | 15:43 |
| needscoffee | ayoung: eyah, so, i think this is a Kilo-ish timeline at best :) | 15:43 |
| ayoung | needscoffee, Oh, yeah. just need to have it demo-able for the next summit | 15:43 |
| ayoung | that should make most of the required work apparent | 15:43 |
| *** gabriel-bezerra has quit IRC | 15:44 | |
| *** gabriel-bezerra has joined #openstack-keystone | 15:45 | |
| needscoffee | ayoung: i mean the pipeline not the kerberize | 15:46 |
| needscoffee | ayoung: because you're busy working on kerberize, etc | 15:46 |
| ayoung | needscoffee, I would say that it should be a design goal, and we get it when we get it | 15:46 |
| ayoung | not that it should be something we explicitly push for, until some asks for it | 15:46 |
| ayoung | just an understood "this is how tokens really should work" | 15:46 |
| needscoffee | ayoung: i think we need to talk that one through at the summit. and on that note, i'm going to go get coffee and breakfast. | 15:47 |
| ayoung | needscoffee, for example, I could probably rewrite the PKIZ provider as a specific pipeline, instead of as a subclass, and it would be much cleaner, without affecting how things are implemented | 15:47 |
| ayoung | ++ | 15:48 |
| ayoung | got for it | 15:48 |
| *** david-lyle_ is now known as david-lyle | 15:52 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Add workaround to support tox 1.7.2 https://review.openstack.org/110039 | 15:56 |
| *** lbragsta_ has joined #openstack-keystone | 15:56 | |
| dolphm | needscoffee: you should be able to run tox 1.7.2 with that ^ | 15:56 |
| bknudson | isn't the point of the bug that the tests are wrong? | 15:57 |
| *** marcoemorais has joined #openstack-keystone | 15:58 | |
| *** marcoemorais has quit IRC | 15:58 | |
| *** lbragstad has quit IRC | 15:59 | |
| *** lbragsta_ has quit IRC | 16:01 | |
| *** lbragstad has joined #openstack-keystone | 16:02 | |
| *** needscoffee has quit IRC | 16:02 | |
| *** marcoemorais has joined #openstack-keystone | 16:03 | |
| *** gabriel-bezerra has quit IRC | 16:06 | |
| *** gabriel-bezerra has joined #openstack-keystone | 16:06 | |
| mtl1 | Hi. Is there a way I can define a self-signed CA file with keystone specifically? I already have OS_CACERT set in my ENV, and every other openstack service I've used it with works, but keystone just keeps giving me "SSL Library Error: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca (SSL alert number 48)" when I do something like keystone endpoint-list. | 16:10 |
| hrybacki | dstanek: when mocking a GET response with httpretty in a test classes setUp() -- where should httpretty.activate be called? | 16:11 |
| dstanek | hrybacki: i think it would still be used as a decorator on the test method | 16:17 |
| hrybacki | dstanek: interesting -- so the decorator didn't work at either the setUp() or the test method itself. | 16:22 |
| hrybacki | But, before registering the URI(s) | 16:23 |
| dstanek | hrybacki: can you paste me an example of what you are doing? | 16:23 |
| hrybacki | httpretty.reset() | 16:23 |
| hrybacki | httpretty.enable() | 16:23 |
| hrybacki | self.addCleanup(httpretty.disable) | 16:23 |
| hrybacki | worked | 16:23 |
| hrybacki | dstanek: running to a meeting but I will as soon as I get back | 16:23 |
| dstanek | hrybacki: ok | 16:23 |
| openstackgerrit | A change was merged to openstack/identity-api: Fix build issue with Identity v2.0 https://review.openstack.org/110017 | 16:24 |
| *** gabriel-bezerra has quit IRC | 16:24 | |
| *** gabriel-bezerra has joined #openstack-keystone | 16:25 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/identity-api: JSON Home support https://review.openstack.org/109881 | 16:25 |
| openstackgerrit | Brant Knudson proposed a change to openstack/identity-api: Cleanup https://review.openstack.org/109882 | 16:25 |
| openstackgerrit | Brant Knudson proposed a change to openstack/identity-api: Cleanup https://review.openstack.org/109882 | 16:25 |
| openstackgerrit | Brant Knudson proposed a change to openstack/identity-api: JSON Home support https://review.openstack.org/109881 | 16:26 |
| *** gabriel-bezerra has quit IRC | 16:28 | |
| *** gabriel-bezerra has joined #openstack-keystone | 16:29 | |
| *** jsavak has joined #openstack-keystone | 16:29 | |
| *** joesavak has quit IRC | 16:32 | |
| *** diegows has joined #openstack-keystone | 16:41 | |
| *** bearhands is now known as comstud | 16:46 | |
| *** jdennis1 has joined #openstack-keystone | 16:47 | |
| *** jdennis has quit IRC | 16:48 | |
| *** shakamunyi has joined #openstack-keystone | 16:54 | |
| *** gabriel-bezerra has quit IRC | 16:59 | |
| *** gabriel-bezerra has joined #openstack-keystone | 17:00 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone-specs: Hierarchical Multitenacy https://review.openstack.org/101017 | 17:02 |
| *** vhoward has left #openstack-keystone | 17:02 | |
| *** rwsu has joined #openstack-keystone | 17:13 | |
| *** diegows has quit IRC | 17:19 | |
| *** harlowja_away is now known as harlowja | 17:20 | |
| *** afazekas has quit IRC | 17:22 | |
| openstackgerrit | A change was merged to openstack/keystone: Add tests related to V2 token issued_at time changing https://review.openstack.org/109602 | 17:27 |
| openstackgerrit | gordon chung proposed a change to openstack/keystonemiddleware: Adding audit middleware to keystonemiddleware https://review.openstack.org/102958 | 17:29 |
| *** mtl1 has quit IRC | 17:30 | |
| *** henrynash has joined #openstack-keystone | 17:31 | |
| *** amcrn has joined #openstack-keystone | 17:34 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: JSON-Home for V3 https://review.openstack.org/103983 | 17:37 |
| *** marcoemorais has quit IRC | 17:37 | |
| *** marcoemorais has joined #openstack-keystone | 17:38 | |
| *** gabriel-bezerra has quit IRC | 17:39 | |
| *** gabriel-bezerra has joined #openstack-keystone | 17:40 | |
| *** __afazekas is now known as afazekas | 17:40 | |
| *** thedodd has quit IRC | 17:41 | |
| *** morganfainberg_Z is now known as morganfainberg | 17:42 | |
| morganfainberg | dolphm, hm. | 17:43 |
| *** henrynash has quit IRC | 17:44 | |
| morganfainberg | bknudson, yes the bug is the tests are wrong, but we're moving to 1.7.2 in gate (i think), meaning we do this like a hacking check, "band-aid" then work on a real fix | 17:44 |
| *** lbragstad has quit IRC | 17:47 | |
| *** ukalifon has joined #openstack-keystone | 17:48 | |
| morganfainberg | dolphm, it doens't look like we're going to have a hard time fixing the tests for PYTHONHASHSEED | 17:52 |
| *** gabriel-bezerra has quit IRC | 17:52 | |
| morganfainberg | dolphm, only ~19 failures. | 17:52 |
| *** gabriel-bezerra has joined #openstack-keystone | 17:53 | |
| *** mtl1 has joined #openstack-keystone | 17:53 | |
| *** gabriel-bezerra has quit IRC | 17:55 | |
| *** gabriel-bezerra has joined #openstack-keystone | 17:56 | |
| dolphm | morganfainberg: but there's a chance we could see additional failures with other seeds... unless you saw the same 19 failures on several runs | 17:57 |
| morganfainberg | dolphm, perhaps. | 17:57 |
| *** shakamunyi has quit IRC | 17:58 | |
| morganfainberg | dolphm, i think i see the core issue here, shoudl be easy to fix these failures. | 17:58 |
| morganfainberg | dolphm, not saying don't merge the tox fix, just seeing the LOE on getting it really fixed as well | 17:58 |
| *** gabriel-bezerra has quit IRC | 17:58 | |
| morganfainberg | basically, looks like our catalog tests are bad (overally) | 17:59 |
| *** marcoemorais has quit IRC | 17:59 | |
| morganfainberg | s/catalog/catlog and versions/ | 17:59 |
| *** marcoemorais has joined #openstack-keystone | 17:59 | |
| *** gabriel-bezerra has joined #openstack-keystone | 18:00 | |
| morganfainberg | dolphm, ah it looks like it is mostly around us using .assertEqual instead of .assertDictEqual | 18:15 |
| morganfainberg | dolphm, chasing these down now to make sure we don't have more. | 18:15 |
| *** jsavak has quit IRC | 18:15 | |
| dolphm | morganfainberg: well that's an easy fix | 18:15 |
| *** joesavak has joined #openstack-keystone | 18:16 | |
| morganfainberg | dolphm, yeah the worst one was the catalog templated one, because the list isn't (for some reason) in the same order, but the id's of the endpoints still match | 18:16 |
| *** thedodd has joined #openstack-keystone | 18:17 | |
| *** gabriel-bezerra has quit IRC | 18:25 | |
| *** gabriel-bezerra has joined #openstack-keystone | 18:26 | |
| *** gabriel-bezerra has quit IRC | 18:27 | |
| *** gabriel-bezerra has joined #openstack-keystone | 18:27 | |
| *** gabriel-bezerra has quit IRC | 18:33 | |
| *** gabriel-bezerra has joined #openstack-keystone | 18:33 | |
| stevemar | gordc, thx for the review, going to upload a new patch! | 18:34 |
| *** gabriel-bezerra has quit IRC | 18:35 | |
| *** gabriel-bezerra has joined #openstack-keystone | 18:36 | |
| *** diegows has joined #openstack-keystone | 18:39 | |
| morganfainberg | dolphm, oh boy, so looks like our hashseed stuff goes a bit deeper, we do a lot of dict -> list of things from dict, and that changes order with the hashseed (duh). this might not be an easy fix. | 18:43 |
| dolphm | morganfainberg: you mean like .values() and .keys()? | 18:44 |
| *** dims_ has joined #openstack-keystone | 18:49 | |
| *** nkinder has quit IRC | 18:52 | |
| *** gabriel-bezerra has quit IRC | 18:52 | |
| *** gabriel-bezerra has joined #openstack-keystone | 18:53 | |
| *** gabriel-bezerra has quit IRC | 18:55 | |
| *** nkinder has joined #openstack-keystone | 18:56 | |
| *** gabriel-bezerra has joined #openstack-keystone | 18:56 | |
| *** gabriel-bezerra has quit IRC | 18:59 | |
| *** gabriel-bezerra has joined #openstack-keystone | 19:00 | |
| *** thedodd has quit IRC | 19:02 | |
| *** thedodd has joined #openstack-keystone | 19:03 | |
| *** ekarlso has quit IRC | 19:04 | |
| openstackgerrit | Sergey Nuzhdin proposed a change to openstack/keystone: Fix invalid self link in get access token https://review.openstack.org/109650 | 19:05 |
| *** topol has quit IRC | 19:06 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone-specs: Hierarchical Multitenacy https://review.openstack.org/101017 | 19:08 |
| *** ukalifon has quit IRC | 19:09 | |
| *** mtl1 has quit IRC | 19:14 | |
| *** lbragstad has joined #openstack-keystone | 19:15 | |
| *** ekarlso has joined #openstack-keystone | 19:16 | |
| *** lbragstad has quit IRC | 19:19 | |
| openstackgerrit | Harry Rybacki proposed a change to openstack/keystonemiddleware: Convert auth_token middleware to use sessions https://review.openstack.org/105031 | 19:22 |
| morganfainberg | dolphm, basically, for i in <dict>, list.append(dict[i]) | 19:25 |
| *** rodrigods has quit IRC | 19:29 | |
| *** rodrigods has joined #openstack-keystone | 19:31 | |
| *** rodrigods has joined #openstack-keystone | 19:31 | |
| dstanek | morganfainberg: what is the problem caused by PYTHONHASHSEED? | 19:31 |
| openstackgerrit | A change was merged to openstack/keystone: Sample config update https://review.openstack.org/109657 | 19:33 |
| openstackgerrit | Diane Fleming proposed a change to openstack/identity-api: Add create, update, and delete user to admin API v2.0 https://review.openstack.org/108259 | 19:33 |
| *** david-lyle has quit IRC | 19:34 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/109002 | 19:34 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/110098 | 19:34 |
| stevemar | gordc, ping | 19:36 |
| ayoung | dstanek, when Horizon calls keystone, it creates a new Client object every time. Right now, it does not hold on to a session object. Should it? How long would a session live? | 19:36 |
| *** topol has joined #openstack-keystone | 19:37 | |
| stevemar | if we do end up using type instead of id for endpoint, do you want it normalized (prefixed with "openstack:")? | 19:37 |
| openstackgerrit | Clayton O'Neill proposed a change to openstack/keystone: Add pluggable range functions for token flush https://review.openstack.org/101726 | 19:37 |
| ayoung | dstanek, I realize this is kindof a jamielennox|away question, but since kc sessions are based on requests session....what would be the right thing in a straight requests approach | 19:37 |
| openstackgerrit | Clayton O'Neill proposed a change to openstack/keystone: Add pluggable range functions for token flush https://review.openstack.org/101726 | 19:37 |
| dstanek | ayoung: i would expect sessions to be held for as long as the token is valid or for as long as the web session is valid (whatever comes first) | 19:39 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/106210 | 19:39 |
| *** david-lyle has joined #openstack-keystone | 19:39 | |
| dstanek | ayoung: can't you recreate a session object from a token? | 19:39 |
| *** mtl1 has joined #openstack-keystone | 19:39 | |
| ayoung | dstanek, yes, I can, so I guess it should be: | 19:40 |
| ayoung | get session, if none, recreate from token, use session to create client | 19:40 |
| dstanek | ayoung: i would expect a session object to be created for every web request to horizon and that horizon would use the same session for anything it does during that web request | 19:41 |
| ayoung | dstanek, I guess I always store the unscoped and scoped tokens in the cookie at a minimum. I guess I could always fetch those things on demand...if not unscoped token, kick to login | 19:41 |
| *** gabriel-bezerra has quit IRC | 19:41 | |
| ayoung | dstanek, ok, I think I can make that happen. A lot of Django is done passing around collections of kwargs | 19:42 |
| *** gabriel-bezerra has joined #openstack-keystone | 19:42 | |
| ayoung | and I'm not certain which of those get persisted where across requests to Horizon | 19:42 |
| dstanek | ayoung: do you have a link? i'm curious because i wouldn't expect that | 19:43 |
| ayoung | yep 1 sec | 19:43 |
| ayoung | dstanek, http://git.openstack.org/cgit/openstack/django_openstack_auth/tree/openstack_auth/utils.py#n108 gets called via acallback from a template inside Django to populate the "list of projects" dropdown | 19:44 |
| ayoung | which is a lovely piece of code, what with embedding the 2.0 auth url, but I digress | 19:45 |
| ayoung | dstanek, so I assume I can stick the session into that dictionary where auth happends | 19:46 |
| ayoung | which is | 19:46 |
| ayoung | http://git.openstack.org/cgit/openstack/django_openstack_auth/tree/openstack_auth/backend.py#n157 | 19:47 |
| *** andreaf has joined #openstack-keystone | 19:48 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/109002 | 19:48 |
| ayoung | dstanek, I have a hacked version in my local repo that does the initial authenitcaiton with a session | 19:49 |
| ayoung | I'm just not certain it makes sense to do request.session['keystone_session'] = kcsession | 19:50 |
| dstanek | ayoung: i don't think it does because that is something that persists across may requests from a user | 19:51 |
| gordc | stevemar: my bad. | 19:51 |
| gordc | stevemar: whatup? | 19:51 |
| stevemar | gordc, same question - if we do end up using type instead of id for endpoint, do you want it normalized (prefixed with "openstack:")? | 19:51 |
| ayoung | dstanek, right, but I don't think there is a "request local dictionary" available | 19:51 |
| gordc | stevemar: yeah, it's probably safe to keep the namespace i would think... even if what's after is of little value | 19:52 |
| dstanek | ayoung: request.keystone_session = kcsession | 19:53 |
| dstanek | ayoung: the trick is finding out who creates it first | 19:53 |
| dstanek | and anything calling keystone would need access to the request | 19:53 |
| *** gabriel-bezerra has quit IRC | 19:56 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Redact tokens in request headers https://review.openstack.org/110117 | 19:57 |
| ayoung | dstanek, it all goes through django_openstack_auth | 19:57 |
| *** gabriel-bezerra has joined #openstack-keystone | 19:58 | |
| *** gabriel-bezerra has quit IRC | 20:00 | |
| *** gabriel-bezerra has joined #openstack-keystone | 20:01 | |
| *** marcoemorais has quit IRC | 20:01 | |
| *** marcoemorais has joined #openstack-keystone | 20:01 | |
| *** andreaf_ has joined #openstack-keystone | 20:03 | |
| *** thedodd has quit IRC | 20:06 | |
| *** andreaf has quit IRC | 20:06 | |
| *** thedodd has joined #openstack-keystone | 20:10 | |
| *** gordc has quit IRC | 20:13 | |
| *** lbragstad has joined #openstack-keystone | 20:13 | |
| *** rm_work has joined #openstack-keystone | 20:13 | |
| openstackgerrit | A change was merged to openstack/identity-api: Add create, update, and delete user to admin API v2.0 https://review.openstack.org/108259 | 20:14 |
| *** doddstack has joined #openstack-keystone | 20:16 | |
| bknudson | looks like v2.0 can finally create users. | 20:16 |
| *** thedodd has quit IRC | 20:16 | |
| *** gordc has joined #openstack-keystone | 20:17 | |
| *** andreaf has joined #openstack-keystone | 20:18 | |
| rm_work | hey guys, I am not very familiar with keystone, but I am writing RBAC rules for another service (policy.json) and am trying to decide what role to use for the thing I'm doing | 20:18 |
| rm_work | I'm trying to identify whether a token belongs to a "cloud admin" user (as opposed to a user who is the admin on their own project/domain/tenant) | 20:19 |
| stevemar | gordc, new patch! | 20:20 |
| rm_work | Can I just use { "service_admin": "role:cloud_service_admin" } and assume that we can get that role created in people's keystone deployments? | 20:20 |
| rm_work | or is there already a role that is commonly used for this purpose? | 20:20 |
| *** andreaf_ has quit IRC | 20:20 | |
| * gordc tries to think of reason not to review that isn't 'too lazy' | 20:21 | |
| *** fifieldt has quit IRC | 20:34 | |
| *** david-lyle has quit IRC | 20:36 | |
| *** bvandenh has quit IRC | 20:39 | |
| *** gabriel-bezerra has quit IRC | 20:39 | |
| *** gabriel-bezerra has joined #openstack-keystone | 20:42 | |
| *** david-lyle has joined #openstack-keystone | 20:44 | |
| *** fifieldt has joined #openstack-keystone | 20:46 | |
| dolphm | rm_work: yes- "admin" | 20:46 |
| dolphm | rm_work: deployers might have their own convention, but "admin" == root, generally | 20:47 |
| rm_work | dolphm: err, except I thought "admin" was a role that any user could have on their own account | 20:47 |
| rm_work | so checking against that role will turn up positive for a whole slew of "end users" | 20:47 |
| dolphm | rm_work: if you treat it that way with default policy.json files, you get root of openstack | 20:48 |
| rm_work | dolphm: like, if i create a new user/tenant, won't that user have role:admin for their tenant? | 20:49 |
| dolphm | rm_work: no, we use "member" (or "_member_") as the default role in that scenario | 20:49 |
| rm_work | ah | 20:49 |
| rm_work | ok, maybe I am tainted by RS:Identity | 20:49 |
| rm_work | so then my assumption for what "admin" role means was wrong | 20:50 |
| rm_work | and this is way simpler than I was making it out to be | 20:50 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Use config fixture from oslo.config https://review.openstack.org/103254 | 20:53 |
| *** lbragstad has quit IRC | 20:58 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Remove fixture from openstack-common.conf https://review.openstack.org/103255 | 21:00 |
| *** marcoemorais has quit IRC | 21:02 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: shorter uuid tokens https://review.openstack.org/110133 | 21:03 |
| *** lbragstad has joined #openstack-keystone | 21:04 | |
| *** gabriel-bezerra has quit IRC | 21:06 | |
| *** rm_work is now known as rm_work|away | 21:07 | |
| *** gabriel-bezerra has joined #openstack-keystone | 21:07 | |
| *** mfainberg_phone has joined #openstack-keystone | 21:13 | |
| *** mfainberg_phone has quit IRC | 21:13 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: shorter uuid tokens https://review.openstack.org/110133 | 21:13 |
| *** gabriel-bezerra has quit IRC | 21:17 | |
| *** gabriel-bezerra has joined #openstack-keystone | 21:18 | |
| *** lbragstad has quit IRC | 21:19 | |
| *** marcoemorais has joined #openstack-keystone | 21:19 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Configurable python-keystoneclient repo https://review.openstack.org/103283 | 21:22 |
| stevemar | dolphm, bknudson morganfainberg can i has review: https://review.openstack.org/#/c/109470/ ? | 21:22 |
| *** jasondotstar has quit IRC | 21:23 | |
| *** gabriel-bezerra has quit IRC | 21:23 | |
| dolphm | stevemar: why did you keep all the templating options? | 21:24 |
| *** gabriel-bezerra has joined #openstack-keystone | 21:25 | |
| dolphm | stevemar: do they all need to stay? / can they still override oslo.sphinx? | 21:25 |
| dolphm | stevemar: and does oslo.sphinx not do html_last_updated_fmt for example? | 21:25 |
| openstackgerrit | Clayton O'Neill proposed a change to openstack/keystone: Add pluggable range functions for token flush https://review.openstack.org/101726 | 21:26 |
| stevemar | dolphm, kept the options to minimize the changes, in case things went south | 21:26 |
| dolphm | stevemar: that's what git uncommit is for | 21:27 |
| stevemar | dolphm, looking at https://github.com/openstack/oslosphinx/tree/master/oslosphinx it only touches the theme and static options | 21:28 |
| dhellmann | if there are other options oslosphinx should be setting, please submit a bug or patch :-) | 21:33 |
| *** lbragstad has joined #openstack-keystone | 21:35 | |
| *** gabriel-bezerra has quit IRC | 21:36 | |
| *** gabriel-bezerra has joined #openstack-keystone | 21:37 | |
| stevemar | dhellmann, i think we're good, not all the projects are using that currently (the html_last_updated option) | 21:37 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Config fixture from oslo-incubator is not used. https://review.openstack.org/103998 | 21:43 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Use config fixture from oslo.config https://review.openstack.org/110138 | 21:43 |
| *** gabriel-bezerra has quit IRC | 21:43 | |
| *** andreaf has quit IRC | 21:44 | |
| *** gabriel-bezerra has joined #openstack-keystone | 21:44 | |
| *** gabriel-bezerra has quit IRC | 21:47 | |
| *** gabriel-bezerra has joined #openstack-keystone | 21:47 | |
| *** topol has quit IRC | 21:48 | |
| *** lbragstad has quit IRC | 21:50 | |
| *** dhellmann_ has joined #openstack-keystone | 21:55 | |
| *** harlowja is now known as harlowja_away | 21:57 | |
| *** dhellmann has quit IRC | 21:57 | |
| *** dhellmann_ is now known as dhellmann | 21:57 | |
| *** stevemar has quit IRC | 22:02 | |
| *** harlowja_away is now known as harlowja | 22:03 | |
| *** marcoemorais has quit IRC | 22:04 | |
| *** marcoemorais1 has joined #openstack-keystone | 22:04 | |
| *** marcoemorais1 has quit IRC | 22:05 | |
| *** marcoemorais has joined #openstack-keystone | 22:05 | |
| *** amcrn has quit IRC | 22:06 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Correct revocation event test for domain_id https://review.openstack.org/109819 | 22:06 |
| *** rm_work|away is now known as rm_work | 22:06 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix revoking domain-scoped tokens https://review.openstack.org/109820 | 22:07 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix revoking a scoped token from an unscoped token https://review.openstack.org/109389 | 22:07 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add a test for revoking a scoped token from an unscoped https://review.openstack.org/109125 | 22:07 |
| *** harlowja has quit IRC | 22:10 | |
| openstackgerrit | A change was merged to openstack/identity-api: Cleanup https://review.openstack.org/109882 | 22:10 |
| *** harlowja has joined #openstack-keystone | 22:11 | |
| *** marcoemorais has quit IRC | 22:12 | |
| *** marcoemorais has joined #openstack-keystone | 22:13 | |
| *** gabriel-bezerra has quit IRC | 22:13 | |
| *** gabriel-bezerra has joined #openstack-keystone | 22:14 | |
| dolphm | bknudson: double checkign on bug 1347318 -- too many tokens are being revoked, as opposed to too few, correct? | 22:15 |
| uvirtbot | Launchpad bug 1347318 in keystone "Revocation events don't handle scoped tokens correctly" [High,In progress] https://launchpad.net/bugs/1347318 | 22:15 |
| *** lbragstad has joined #openstack-keystone | 22:16 | |
| *** lbragsta_ has joined #openstack-keystone | 22:16 | |
| bknudson | dolphm: y, from the description of that one it's revoking too many tokens. | 22:18 |
| bknudson | dolphm: maybe I should open a separate bug for the fix in https://review.openstack.org/#/c/109820/ | 22:19 |
| dolphm | bknudson: can you clarify that in a comment? i don't want it to end up accidentally going down the OSSA road because it's too strict | 22:19 |
| bknudson | dolphm: because that one has a fix for domain-scoped tokens | 22:19 |
| bknudson | I'll open a separate bug for the domain-scoped token revocations | 22:20 |
| *** lbragstad has quit IRC | 22:20 | |
| *** lbragsta_ has quit IRC | 22:21 | |
| openstackgerrit | gordon chung proposed a change to openstack/keystonemiddleware: Adding audit middleware to keystonemiddleware https://review.openstack.org/102958 | 22:24 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix revoking domain-scoped tokens https://review.openstack.org/109820 | 22:26 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix revoking a scoped token from an unscoped token https://review.openstack.org/109389 | 22:26 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Correct revocation event test for domain_id https://review.openstack.org/109819 | 22:26 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add a test for revoking a scoped token from an unscoped https://review.openstack.org/109125 | 22:26 |
| bknudson | dolphm: I opened a separate bug for domain-scoped tokens | 22:27 |
| dolphm | bknudson: thanks | 22:30 |
| dolphm | bknudson: https://review.openstack.org/#/c/109389/13/keystone/token/providers/common.py looks broken to me... | 22:35 |
| dolphm | bknudson: L523 for v3 tokens: project_id = (token.get('tenant') or {}).get('id') | 22:35 |
| bknudson | dolphm: maybe there's a better way to handle the situation... | 22:35 |
| bknudson | but token['tenant'] is actually None | 22:35 |
| dolphm | bknudson: why is it trying to get a tenant from a v3 token? | 22:35 |
| dolphm | bknudson: also, isn't it token['scope']['project']['id'] ? | 22:36 |
| bknudson | dolphm: I'll set a breakpoint and see. | 22:36 |
| dolphm | bknudson: although i have no idea why token has a 'token_data' attribute there either | 22:36 |
| bknudson | token_data has all the stuff | 22:36 |
| dolphm | bknudson: then what is the outer object for? | 22:38 |
| dolphm | what other keys does it have? | 22:38 |
| *** gordc has quit IRC | 22:40 | |
| bknudson | dolphm: http://paste.openstack.org/show/88787/ | 22:40 |
| bknudson | don't steal my token | 22:40 |
| bknudson | dolphm: there's a project in token_data just like there's a domain | 22:41 |
| bknudson | so I could use token_data for both | 22:42 |
| *** doddstack has quit IRC | 22:45 | |
| dolphm | bknudson: ahh this is the redundant garbage from the token backend | 22:45 |
| bknudson | dolphm: it's pretty wacky | 22:48 |
| *** gabriel-bezerra has quit IRC | 22:49 | |
| *** gabriel-bezerra has joined #openstack-keystone | 22:50 | |
| *** gabriel-bezerra has quit IRC | 22:51 | |
| *** gabriel-bezerra has joined #openstack-keystone | 22:51 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/106210 | 22:53 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Mark keystonemiddleware as being a universal wheel https://review.openstack.org/104424 | 22:53 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix revoking a scoped token from an unscoped token https://review.openstack.org/109389 | 22:57 |
| *** vhoward has joined #openstack-keystone | 23:01 | |
| *** marcoemorais has quit IRC | 23:04 | |
| openstackgerrit | Harry Rybacki proposed a change to openstack/keystonemiddleware: Convert auth_token middleware to use sessions https://review.openstack.org/105031 | 23:05 |
| *** marcoemorais has joined #openstack-keystone | 23:05 | |
| *** marcoemorais has quit IRC | 23:06 | |
| *** marcoemorais has joined #openstack-keystone | 23:07 | |
| *** joesavak has quit IRC | 23:08 | |
| hrybacki | jamielennox|away: ping | 23:08 |
| *** hrybacki_ has joined #openstack-keystone | 23:17 | |
| *** hrybacki has quit IRC | 23:21 | |
| *** hrybacki_ has quit IRC | 23:22 | |
| *** david-lyle has quit IRC | 23:31 | |
| *** gabriel-bezerra has quit IRC | 23:31 | |
| *** gabriel-bezerra has joined #openstack-keystone | 23:32 | |
| *** jaosorior has quit IRC | 23:32 | |
| *** jamielennox|away is now known as jamielennox | 23:32 | |
| *** david-lyle has joined #openstack-keystone | 23:32 | |
| *** bknudson has quit IRC | 23:36 | |
| *** david-lyle has quit IRC | 23:36 | |
| jamielennox | good morning world, here are two fairly simple reviews that already have at least a +2 | 23:37 |
| jamielennox | https://review.openstack.org/#/c/107212/ | 23:37 |
| jamielennox | https://review.openstack.org/#/c/109887/ | 23:37 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Versioned Endpoint hack for Sessions https://review.openstack.org/90632 | 23:40 |
| *** fifieldt_ has joined #openstack-keystone | 23:45 | |
| *** fifieldt has quit IRC | 23:45 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!