| *** dims_ has quit IRC | 00:03 | |
| *** marcoemorais has quit IRC | 00:16 | |
| *** hrybacki has joined #openstack-keystone | 00:24 | |
| *** navid_ has joined #openstack-keystone | 00:40 | |
| *** zzzeek has quit IRC | 00:41 | |
| *** marcoemorais has joined #openstack-keystone | 00:43 | |
| *** marcoemorais has quit IRC | 00:43 | |
| *** amerine has quit IRC | 00:48 | |
| *** jdennis1 has quit IRC | 00:51 | |
| *** gyee has quit IRC | 00:52 | |
| hrybacki | jamielennox: ping | 00:53 |
|---|---|---|
| jamielennox | hrybacki: hey | 00:53 |
| jamielennox | i ticked off one of your reviews, and put a comment on another | 00:54 |
| hrybacki | I shot you an email just before headed off of work | 00:54 |
| hrybacki | ++ thank you | 00:54 |
| jamielennox | i'm just going through auth_token now | 00:54 |
| hrybacki | okay | 00:54 |
| hrybacki | it's been quite the chore getting that patch to work | 00:54 |
| openstackgerrit | A change was merged to openstack/keystone: Sqlite files excluded from the repo https://review.openstack.org/109165 | 00:56 |
| *** gabriel-bezerra has quit IRC | 00:58 | |
| *** gabriel-bezerra has joined #openstack-keystone | 00:59 | |
| *** stevemar has joined #openstack-keystone | 01:01 | |
| openstackgerrit | Harry Rybacki proposed a change to openstack/keystone: Update setup docs with Fedora 20 dependencies https://review.openstack.org/106176 | 01:02 |
| hrybacki | damnit | 01:02 |
| openstackgerrit | Harry Rybacki proposed a change to openstack/keystone: Update setup docs with Fedora 19+ dependencies https://review.openstack.org/106176 | 01:03 |
| hrybacki | jamielennox: let me know if why added the property stuff isn't clear | 01:03 |
| *** jdennis has joined #openstack-keystone | 01:05 | |
| *** gabriel-bezerra has quit IRC | 01:06 | |
| hrybacki | jamielennox: Next week is my last week working full time, next Thursday being my last day -- I'd like to get sessions merged before than if possible | 01:06 |
| *** gabriel-bezerra has joined #openstack-keystone | 01:06 | |
| *** alex_xu has joined #openstack-keystone | 01:11 | |
| navid_ | @dolphm: hi | 01:16 |
| *** amerine has joined #openstack-keystone | 01:21 | |
| openstackgerrit | Harry Rybacki proposed a change to openstack/keystone: Update setup docs with Fedora 19+ dependencies https://review.openstack.org/106176 | 01:28 |
| hrybacki | stevemar: good catch -- not sure how that happened | 01:28 |
| * stevemar shrugs at hrybacki | 01:29 | |
| *** amerine has quit IRC | 01:30 | |
| jamielennox | stevemar: is there a spec for keystone-to-keystone that i can't find? | 01:30 |
| stevemar | jamielennox, not sure why you can't find it: https://github.com/openstack/keystone-specs/blob/master/specs/juno/keystone-to-keystone-federation.rst | 01:31 |
| stevemar | i'm playing fast and loose, on laptop with no power connected, might go offline any minute | 01:31 |
| jamielennox | stevemar: ok, for the record the more i do with SAML the less i like it - i don't think k2k via SAML is a good idea | 01:32 |
| stevemar | jamielennox, i wasn't onboard with it either at the beginning, but we drew it out on whiteboards and it made the most sense | 01:33 |
| jamielennox | stevemar: i think it's only because people see apache modules as the ONLY means to do federation | 01:34 |
| jamielennox | stevemar: i think we're going to need an in-python version as well | 01:34 |
| jamielennox | anyway i don't think it'll be me writing the token->saml parsers so it's ok | 01:34 |
| stevemar | jamielennox, i'm looking at that tomorrow | 01:34 |
| jamielennox | stevemar: so it cam up at summit that i think we need like a keystone interface for all these different mod_auth_X plugins such that they write there own landing page and then ask keystone for a token, rather than jam it through our existing auth plugins | 01:36 |
| stevemar | jamielennox, i'm hoping to leverage this library, specifically this part: https://github.com/rohe/pysaml2/blob/master/src/saml2/saml.py#L741-L754 | 01:36 |
| jamielennox | i think if we had something like that then having an in-python handler is just adding the route to the paste pipeline rather than the apache one | 01:36 |
| *** xianghui has joined #openstack-keystone | 01:36 | |
| stevemar | jamielennox, well, the Kent guys are working on that, i believe there is an active patch | 01:37 |
| stevemar | jamielennox, https://review.openstack.org/#/c/105597/ << the keystone code from Kent | 01:38 |
| jamielennox | stevemar: ok, just means i need to follow all this more closely | 01:38 |
| openstackgerrit | A change was merged to openstack/keystone: Fix for V2 token issued_at time changing https://review.openstack.org/109747 | 01:38 |
| jamielennox | ugh, they're still jamming it through the existing auth plugins | 01:39 |
| *** mberlin1 has joined #openstack-keystone | 01:42 | |
| *** rwsu has quit IRC | 01:42 | |
| *** mberlin has quit IRC | 01:43 | |
| stevemar | jamielennox, might be worth crafting an email to them | 01:43 |
| jamielennox | -1 and comments | 01:45 |
| jamielennox | just need to make sure i'm not ignored | 01:45 |
| jamielennox | hopefully as of next week i'll have some time again i might be able to try it myself | 01:46 |
| *** ncoghlan has joined #openstack-keystone | 01:47 | |
| ayoung | hrybacki, why F19 https://review.openstack.org/#/c/106176/ ? | 01:48 |
| hrybacki | ayoung: 19+ | 01:48 |
| ayoung | ah | 01:48 |
| hrybacki | 19/20 rather | 01:48 |
| *** diegows has quit IRC | 01:50 | |
| *** cjellick_ has joined #openstack-keystone | 01:52 | |
| hrybacki | ayoung: docs test fails anyway. Duplicate virtualenv link. Any thoughts on pointing readers to http://www.virtualenv.org/ or https://pypi.python.org/pypi/virtualenv ? | 01:52 |
| ayoung | hrybacki, you act like I actually understand all this Python stuff. Vee env? What is that? | 01:54 |
| ayoung | hrybacki, what broke? | 01:54 |
| hrybacki | ayoung: lol -- virtualenv is referenced by two links, the first is to it's respective PyPi repo and the other to the actual org's website | 01:55 |
| jamielennox | hrybacki: i'd say it doesn't matter and if there is an existing link there you may as well reuse that | 01:55 |
| ayoung | hrybacki, just reduce it to one link, then. | 01:55 |
| *** cjellick has quit IRC | 01:56 | |
| *** cjellick_ has quit IRC | 01:56 | |
| ayoung | hrybacki, is it just complaining that the link is in there twice? Just drop one of them? | 02:03 |
| hrybacki | ayoung: yeah it was a simple thing -- just wasn't sure which link to use | 02:03 |
| hrybacki | opted to stick with original one | 02:03 |
| ayoung | coo | 02:03 |
| *** stevemar has quit IRC | 02:03 | |
| openstackgerrit | Harry Rybacki proposed a change to openstack/keystone: Update setup docs with Fedora 19+ dependencies https://review.openstack.org/106176 | 02:05 |
| *** topol has joined #openstack-keystone | 02:09 | |
| ayoung | jamielennox, ok, right now, Horizon does everything with just cachiung the token. Does it make sense for Horizon to serialize a Keystone Client session (somehow) or to reconstitute the session on each Horizon request? | 02:11 |
| jamielennox | reconstructing the session is cheap, i don't think i'd worry about serializing that | 02:13 |
| ayoung | jamielennox, here's what I learned: to populate the Projects dropdown, it calls http://git.openstack.org/cgit/openstack/django_openstack_auth/tree/openstack_auth/user.py#n220 | 02:13 |
| jamielennox | serializing the auth_plugin probably makes sense because you have discovery cached on there | 02:13 |
| ayoung | and the call to self._authorized_tenants = utils.get_project_list( is in utils.. | 02:13 |
| jamielennox | as well as the catalog and such returned from auth | 02:13 |
| ayoung | http://git.openstack.org/cgit/openstack/django_openstack_auth/tree/openstack_auth/utils.py#n108 | 02:13 |
| jamielennox | that code makes sense | 02:15 |
| ayoung | client = get_keystone_client().Client(*args, **kwargs) | 02:15 |
| ayoung | so I need to replace that call with something that uses a sesssion...and an auth plugin | 02:15 |
| jamielennox | ayoung: i'd have the session passed into the call | 02:16 |
| jamielennox | maintain the plugin elsewhere | 02:16 |
| jamielennox | you'll still need to do some discovery but you can use session.get_endpoint() for that | 02:16 |
| jamielennox | then construct the appropriate client | 02:17 |
| ayoung | jamielennox, discover should happen in authenticate... | 02:17 |
| jamielennox | and return | 02:17 |
| jamielennox | auth and this are two seperate things | 02:17 |
| ayoung | http://git.openstack.org/cgit/openstack/django_openstack_auth/tree/openstack_auth/backend.py#n68 | 02:17 |
| jamielennox | discovery *can* happen in authenticate | 02:17 |
| jamielennox | if you construct a client like that i'm not sure you get discovery anywhere | 02:18 |
| jamielennox | ayoung: so you've got to look at it now as auth and client are no longer linked, you can use a v3 token with a v2 client and vice versa | 02:19 |
| jamielennox | so yes you might do discovery to figure out which auth plugin to use, but you might not | 02:19 |
| jamielennox | but none of that tells you which client you should use | 02:20 |
| *** cjellick has joined #openstack-keystone | 02:22 | |
| ayoung | jamielennox, default to v3 and be done with it I think | 02:22 |
| jamielennox | ayoung: if you want, that's not a decision i can/should make in ksc | 02:23 |
| ayoung | jamielennox, right, that is for django-openstack-auth | 02:23 |
| ayoung | jamielennox, I'm wondering about the persistance of the auth plugin. | 02:24 |
| jamielennox | ayoung: this is something that is definetly going to come up, and i don't have a good answer for | 02:24 |
| ayoung | jamielennox, lets say that it has come up | 02:25 |
| ayoung | I need to solve this | 02:25 |
| jamielennox | so the things worth persisting in an auth plugin are definetly the token and the information from it, the service catalog, and maybe the discovery cache | 02:26 |
| jamielennox | discovery cache is going to be another thing that will come up from the likes of horizon | 02:26 |
| jamielennox | i don't know if you should be allowed to dump out a password though | 02:26 |
| jamielennox | there are arguments for both | 02:27 |
| *** cjellick has quit IRC | 02:31 | |
| ayoung | jamielennox, I want to hold on to the unscoped and scoped tokens | 02:31 |
| ayoung | but...wondering what to do about the service catatlog | 02:32 |
| ayoung | and is there anything else I need to hold on to? | 02:33 |
| jamielennox | ayoung: AccessInfo is just a dict | 02:34 |
| jamielennox | if you can take that from the identity plugins you could trivially make a new plugin that just reused that | 02:35 |
| ayoung | jamielennox, ReuseTokenPlugin? | 02:35 |
| jamielennox | you will get a lot of discovery requests going out, if you can make horizon hold on to the session object that would be best | 02:35 |
| ayoung | no where to hold a Python object | 02:35 |
| jamielennox | at all in horizon? | 02:36 |
| ayoung | jamielennox, nah, not at scale | 02:36 |
| jamielennox | ayoung: it's not going to be one per user, it'll be one object | 02:36 |
| ayoung | the second request might have to repopulate the horizon session from memcache | 02:36 |
| jamielennox | well ideally it would be, i don't think the managers will support that | 02:36 |
| ayoung | discovery? Hmmm yeah, Horizon should do that once at startup | 02:37 |
| jamielennox | ayoung: i cache per url | 02:37 |
| jamielennox | so that when you get an entry in the service catalog it does the lookup then | 02:37 |
| ayoung | jamielennox, you mean for the other clients? | 02:37 |
| ayoung | one for auth_url, and one per service catalog url? | 02:38 |
| jamielennox | ayoung: for everytihng that does discovery through the session/auth_plugin | 02:38 |
| jamielennox | hmm, that's not true | 02:38 |
| jamielennox | for everything that the auth plugin tells you you can use | 02:38 |
| ayoung | jamielennox, Django has the ability to hold on to the client, but then it doesn't use it | 02:41 |
| jamielennox | ayoung: i can see the problem with holding on to every auth plugin | 02:42 |
| jamielennox | what i thought they would reuse is the session object | 02:42 |
| ayoung | jamielennox, yeah we want to toll the Password Auth plugin once it has gotten the token | 02:43 |
| ayoung | toll->toss | 02:43 |
| jamielennox | that's what will give them connection pooling and that's what i expected them to use for discovery caching | 02:43 |
| ayoung | jamielennox, connection pooling and auth plugins seem to be at odds | 02:44 |
| *** gabriel-bezerra has quit IRC | 02:44 | |
| jamielennox | ayoung: not really, they are at different layers | 02:44 |
| jamielennox | this is something i don't think i've communicated very well | 02:44 |
| ayoung | jamielennox, doesn't the session hold on to the auth plugin? | 02:45 |
| *** gabriel-bezerra has joined #openstack-keystone | 02:45 | |
| jamielennox | you can use a session without attaching the auth plugin | 02:45 |
| jamielennox | instead you provide it per request | 02:45 |
| jamielennox | obviously you don't want to pass that through all the managers | 02:45 |
| jamielennox | so the adapter handles that for you | 02:45 |
| ayoung | ok, that sounds more like how we want to use it from horizon | 02:45 |
| jamielennox | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/adapter.py#L63 | 02:45 |
| ayoung | so what about this: | 02:46 |
| jamielennox | so what that means is that when you create novaclient you don't put auth on the session | 02:46 |
| jamielennox | you create the session, you create the auth | 02:46 |
| ayoung | get session from Horizon out of some pool... | 02:46 |
| jamielennox | then you pass them both to nova.client(session=session, auth=auth) | 02:46 |
| ayoung | password_auth = utils.get_keystone_identity().Password(**kwargs) | 02:46 |
| jamielennox | ayoung: pool of 1 | 02:46 |
| ayoung | session = utils.get_kcsession().Session(verify=ca_cert) | 02:46 |
| ayoung | then | 02:46 |
| ayoung | wait... | 02:47 |
| ayoung | session.get_token(password_auth) | 02:47 |
| ayoung | but then I need to make a client... | 02:47 |
| ayoung | client = keystone_client.Client(session=session, debug=settings.DEBUG, insecure=insecure) | 02:47 |
| ayoung | at this point the auth plugin is embedded | 02:48 |
| jamielennox | i'm not sure what you're trying to do there | 02:49 |
| jamielennox | things like ca_cert should come from horizon's config file | 02:50 |
| jamielennox | so you only ever need one of those | 02:50 |
| jamielennox | you can create your password plugin and pass that to whatever you want to use it with | 02:50 |
| jamielennox | you can also rip out password.auth_ref at that point and save/cache that somewhere else for reuse | 02:51 |
| jamielennox | you need your own plugin to bring it back, but it's literally about 5 lines | 02:51 |
| jamielennox | you then pass session and auth as seperate objects any time you want to construct a client | 02:52 |
| jamielennox | note, i don't think that keystoneclient actually takes auth and session seperately yet - i've made sure to do this in the clients i'm converting but i'm not sure about keystoneclient | 02:52 |
| jamielennox | there's a review out that would fix that though i think | 02:53 |
| jamielennox | need to bring it back: https://review.openstack.org/#/c/97681/ | 02:54 |
| jamielennox | otherwise you could short term just add it to the things that HTTPClient takes | 02:54 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 02:57 |
| morganfainberg | hm.. | 02:59 |
| *** stevemar has joined #openstack-keystone | 03:00 | |
| * jamielennox is going for some food | 03:01 | |
| * ayoung even more confused than before I started | 03:04 | |
| *** harlowja is now known as harlowja_away | 03:07 | |
| *** harlowja_away is now known as harlowja | 03:08 | |
| ayoung | jamielennox, I think that the session objects need to be specific to a user. It does not look like it is safe or correct to share session objects. As you said oin your blog: "When working with clients you would first create an authentication object, then create a session object with that authentication and then re-use that session object across all the clients you instantiate." | 03:11 |
| ayoung | So, maybe the right abstraction is that the Horizon User object holds on to the session | 03:12 |
| ayoung | I need to read up a little on how Django Users work. Django- Openstack _auth seems to be extending a Base Django user Object | 03:12 |
| jamielennox | ayoung: right, but i modelled this off of requests sessions | 03:19 |
| jamielennox | so the idea was that you can attach an auth object and you would always be authenticated via that session | 03:19 |
| *** gabriel-bezerra has quit IRC | 03:19 | |
| jamielennox | or you could pass an auth object for calls that you want to be authenticated | 03:19 |
| jamielennox | so long as youre not mixing and matching eiteher should be fine | 03:20 |
| *** gabriel-bezerra has joined #openstack-keystone | 03:20 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Example JSON files should be human-readable https://review.openstack.org/108210 | 03:24 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Example JSON files should be human-readable https://review.openstack.org/108211 | 03:24 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Use keystoneclient fixtures in middleware tests https://review.openstack.org/107212 | 03:24 |
| ayoung | jamielennox, there is Token object in Django OpenStack Auth http://git.openstack.org/cgit/openstack/django_openstack_auth/tree/openstack_auth/user.py#n54 | 03:26 |
| ayoung | That holds the auth info | 03:27 |
| *** cjellick has joined #openstack-keystone | 03:27 | |
| ayoung | auth_ref. | 03:27 |
| ayoung | well, the data from the auth ref | 03:27 |
| *** alex_xu has quit IRC | 03:32 | |
| *** ayoung has quit IRC | 03:33 | |
| jamielennox | ok | 03:34 |
| *** cjellick has quit IRC | 03:36 | |
| *** alex_xu has joined #openstack-keystone | 03:45 | |
| *** stevemar has quit IRC | 03:46 | |
| *** stevemar has joined #openstack-keystone | 03:46 | |
| *** mitz has quit IRC | 04:06 | |
| *** mitz has joined #openstack-keystone | 04:10 | |
| *** chandankumar has joined #openstack-keystone | 04:15 | |
| *** ukalifon1 has joined #openstack-keystone | 04:23 | |
| *** david-lyle has joined #openstack-keystone | 04:25 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:26 | |
| openstackgerrit | A change was merged to openstack/keystone: Update setup docs with Fedora 19+ dependencies https://review.openstack.org/106176 | 04:31 |
| *** gabriel-bezerra has quit IRC | 04:31 | |
| *** gabriel-bezerra has joined #openstack-keystone | 04:31 | |
| *** hrybacki has quit IRC | 04:37 | |
| *** bvandenh has joined #openstack-keystone | 04:45 | |
| *** gabriel-bezerra has quit IRC | 04:45 | |
| *** gabriel-bezerra has joined #openstack-keystone | 04:46 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:48 | |
| *** morganfainberg is now known as morganfainberg_Z | 04:59 | |
| *** david-lyle has quit IRC | 05:00 | |
| *** afazekas is now known as __afazekas | 05:00 | |
| *** david-lyle has joined #openstack-keystone | 05:00 | |
| *** david-lyle has quit IRC | 05:05 | |
| *** david-lyle has joined #openstack-keystone | 05:05 | |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Remove mox dependency https://review.openstack.org/109887 | 05:07 |
| *** david-lyle has quit IRC | 05:12 | |
| *** amerine has joined #openstack-keystone | 05:12 | |
| *** david-lyle has joined #openstack-keystone | 05:12 | |
| *** ajayaa has joined #openstack-keystone | 05:13 | |
| *** david-lyle has quit IRC | 05:17 | |
| *** alex_xu has quit IRC | 05:22 | |
| *** gabriel-bezerra has quit IRC | 05:23 | |
| *** gabriel-bezerra has joined #openstack-keystone | 05:23 | |
| *** afazekas has joined #openstack-keystone | 05:26 | |
| *** harlowja is now known as harlowja_away | 05:26 | |
| *** ncoghlan is now known as ncoghlan_afk | 05:29 | |
| *** gabriel-bezerra has quit IRC | 05:31 | |
| *** gabriel-bezerra has joined #openstack-keystone | 05:31 | |
| *** jaosorior has joined #openstack-keystone | 05:42 | |
| *** topol has quit IRC | 05:52 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert shell tests to httpretty https://review.openstack.org/110210 | 05:57 |
| *** jraim has quit IRC | 06:00 | |
| *** zhiyan has quit IRC | 06:00 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert shell tests to httpretty https://review.openstack.org/110210 | 06:01 |
| *** ctracey has quit IRC | 06:01 | |
| *** serverascode has quit IRC | 06:04 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/106939 | 06:04 |
| *** jraim__ has joined #openstack-keystone | 06:05 | |
| *** zhiyan has joined #openstack-keystone | 06:05 | |
| *** ctracey has joined #openstack-keystone | 06:07 | |
| *** serverascode has joined #openstack-keystone | 06:13 | |
| *** ncoghlan_afk is now known as ncoghlan | 06:16 | |
| *** serverascode has quit IRC | 06:22 | |
| *** ctracey has quit IRC | 06:22 | |
| *** zhiyan has quit IRC | 06:23 | |
| *** jraim__ has quit IRC | 06:24 | |
| *** zhiyan has joined #openstack-keystone | 06:28 | |
| *** jraim__ has joined #openstack-keystone | 06:28 | |
| *** ctracey has joined #openstack-keystone | 06:29 | |
| *** serverascode has joined #openstack-keystone | 06:31 | |
| *** chandankumar has quit IRC | 06:35 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 06:42 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert shell tests to httpretty https://review.openstack.org/110210 | 06:42 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Change unscoped token fallback to be session aware https://review.openstack.org/104771 | 06:42 |
| *** ajayaa has quit IRC | 06:49 | |
| *** bvandenh has quit IRC | 06:52 | |
| *** tomoiaga has joined #openstack-keystone | 07:03 | |
| *** ajayaa has joined #openstack-keystone | 07:09 | |
| *** ncoghlan is now known as ncoghlan_afk | 07:16 | |
| *** ncoghlan_afk is now known as ncoghlan | 07:20 | |
| *** henrynash has joined #openstack-keystone | 07:25 | |
| *** __afazekas has quit IRC | 07:29 | |
| *** stevemar has quit IRC | 07:46 | |
| *** henrynash has quit IRC | 07:48 | |
| *** alex_xu has joined #openstack-keystone | 08:06 | |
| *** ajayaa has quit IRC | 08:09 | |
| openstackgerrit | Ajaya Agrawal proposed a change to openstack/keystone-specs: Fixes a typo. https://review.openstack.org/110230 | 08:15 |
| *** ncoghlan has quit IRC | 08:22 | |
| *** jamielennox is now known as jamielennox|away | 08:23 | |
| *** cjellick has joined #openstack-keystone | 08:24 | |
| *** cjellick has quit IRC | 08:29 | |
| *** ajayaa has joined #openstack-keystone | 08:29 | |
| *** andreaf has joined #openstack-keystone | 08:32 | |
| *** henrynash has joined #openstack-keystone | 08:35 | |
| *** henrynash has quit IRC | 09:11 | |
| *** alex_xu has quit IRC | 09:13 | |
| *** bvandenh has joined #openstack-keystone | 09:17 | |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Catch correct oslo.db exception https://review.openstack.org/108935 | 09:28 |
| *** bvandenh has quit IRC | 09:39 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Use oslosphinx to generate doc theme https://review.openstack.org/109470 | 09:50 |
| *** cjellick has joined #openstack-keystone | 10:02 | |
| *** cjellick has quit IRC | 10:03 | |
| *** cjellick has joined #openstack-keystone | 10:03 | |
| *** marzif has joined #openstack-keystone | 10:23 | |
| openstackgerrit | A change was merged to openstack/keystone: Correct revocation event test for domain_id https://review.openstack.org/109819 | 10:32 |
| *** xianghui has quit IRC | 10:36 | |
| *** toddnni has quit IRC | 10:42 | |
| *** ajayaa has quit IRC | 11:03 | |
| *** ajayaa has joined #openstack-keystone | 11:16 | |
| *** baffle_ is now known as baffle | 11:38 | |
| *** baffle has quit IRC | 11:39 | |
| *** diegows has joined #openstack-keystone | 12:11 | |
| openstackgerrit | Ihar Hrachyshka proposed a change to openstack/keystone: migration: adopt for MySQL Connector https://review.openstack.org/110271 | 12:13 |
| *** miqui has joined #openstack-keystone | 12:18 | |
| *** bvandenh has joined #openstack-keystone | 12:38 | |
| *** gordc has joined #openstack-keystone | 12:41 | |
| *** jasondotstar has joined #openstack-keystone | 12:57 | |
| *** lbragstad has joined #openstack-keystone | 12:57 | |
| *** hrybacki has joined #openstack-keystone | 13:01 | |
| *** bvandenh has quit IRC | 13:03 | |
| *** miqui has quit IRC | 13:14 | |
| *** joesavak has joined #openstack-keystone | 13:16 | |
| *** tomoiaga has quit IRC | 13:19 | |
| *** stevemar has joined #openstack-keystone | 13:28 | |
| *** dims has joined #openstack-keystone | 13:31 | |
| openstackgerrit | Ajaya Agrawal proposed a change to openstack/keystone-specs: Fixes a typo. https://review.openstack.org/110230 | 13:40 |
| *** ajayaa has quit IRC | 13:40 | |
| *** bknudson has joined #openstack-keystone | 13:41 | |
| *** tomoiaga has joined #openstack-keystone | 13:44 | |
| *** lnxnut has joined #openstack-keystone | 13:48 | |
| *** lbragsta_ has joined #openstack-keystone | 13:56 | |
| *** lbragsta_ has quit IRC | 13:57 | |
| *** lbragsta_ has joined #openstack-keystone | 13:58 | |
| *** lbragstad has quit IRC | 13:58 | |
| *** alex_xu has joined #openstack-keystone | 14:08 | |
| openstackgerrit | A change was merged to openstack/keystone-specs: Fixes a typo. https://review.openstack.org/110230 | 14:09 |
| *** chandankumar has joined #openstack-keystone | 14:11 | |
| *** gabriel-bezerra has quit IRC | 14:11 | |
| *** gabriel-bezerra has joined #openstack-keystone | 14:12 | |
| *** dhellmann has quit IRC | 14:17 | |
| *** dhellmann has joined #openstack-keystone | 14:20 | |
| *** gabriel-bezerra has quit IRC | 14:29 | |
| *** david-lyle has joined #openstack-keystone | 14:30 | |
| *** dims has quit IRC | 14:31 | |
| *** david-ly_ has joined #openstack-keystone | 14:31 | |
| *** gabriel-bezerra has joined #openstack-keystone | 14:31 | |
| *** david-ly_ is now known as david-lyle_ | 14:33 | |
| *** david-lyle has quit IRC | 14:35 | |
| *** david-lyle_ is now known as david-lyle | 14:43 | |
| *** chandankumar has quit IRC | 14:43 | |
| *** gabriel-bezerra has quit IRC | 14:47 | |
| *** gabriel-bezerra has joined #openstack-keystone | 14:47 | |
| *** jsavak has joined #openstack-keystone | 14:56 | |
| *** chandankumar has joined #openstack-keystone | 14:58 | |
| *** joesavak has quit IRC | 14:58 | |
| *** morganfainberg_Z is now known as morganfainberg | 15:01 | |
| *** jsavak has quit IRC | 15:04 | |
| *** joesavak has joined #openstack-keystone | 15:04 | |
| *** gabriel-bezerra has quit IRC | 15:05 | |
| *** gabriel-bezerra has joined #openstack-keystone | 15:07 | |
| *** chandankumar has quit IRC | 15:08 | |
| dstanek | lbragsta_: ping | 15:09 |
| *** lbragsta_ is now known as lbragstad | 15:10 | |
| lbragstad | dstanek: pong | 15:10 |
| morganfainberg | lbragstad, dstanek, https://review.openstack.org/#/c/110039/ if you have a moment | 15:11 |
| morganfainberg | stevemar, ^ cc | 15:11 |
| dstanek | morganfainberg: looking now | 15:13 |
| morganfainberg | dstanek, please note my comment. | 15:14 |
| morganfainberg | i just don't want to be the blocker on infra being able to use tox 1.7.2 | 15:14 |
| morganfainberg | we will need to do the same (probably) for keystoneclient and keystonemiddleware | 15:15 |
| dstanek | morganfainberg: haha, where do we do that kind or comparison? | 15:15 |
| morganfainberg | dstanek, all over the catalog | 15:15 |
| dstanek | nice | 15:15 |
| morganfainberg | and those are the only cases i've *found* | 15:15 |
| morganfainberg | but i think we need to create a recursive 'assertDictEqual' method | 15:16 |
| lbragstad | FYI: bugs opened against Keystone this week and status: http://paste.openstack.org/show/88936/ | 15:16 |
| morganfainberg | but yeah [{'endpoint': {'id': 1, [{"interface": "admin", "url": ... }, {"interface": "internal", "url": ...}]}, {'endpoint': {'id': 2, [{"interface": "admin", "url": ... }, {"interface": "internal", "url": ...}]}] | 15:17 |
| morganfainberg | that doesn't *need* to be a list | 15:17 |
| morganfainberg | i'd argue it shouldn't be a list | 15:17 |
| morganfainberg | but changing the format of the catalog would be *bad* | 15:18 |
| morganfainberg | lbragstad, nice | 15:18 |
| openstackgerrit | A change was merged to openstack/keystone-specs: Specification for OpenID Connect https://review.openstack.org/107890 | 15:19 |
| morganfainberg | we should totally get the untriaged bot that triple-o has. | 15:19 |
| morganfainberg | :) | 15:19 |
| morganfainberg | it's kinda cool | 15:19 |
| *** vhoward has left #openstack-keystone | 15:21 | |
| lbragstad | morganfainberg: ? | 15:21 |
| *** vhoward has joined #openstack-keystone | 15:21 | |
| lbragstad | morganfainberg: how often does it run? daily? | 15:21 |
| morganfainberg | i think once a day | 15:21 |
| morganfainberg | or twice a day | 15:21 |
| lbragstad | nice | 15:21 |
| morganfainberg | it repors the bugs to irc | 15:21 |
| * morganfainberg will need to ask the tripleo team about it | 15:22 | |
| lbragstad | dstanek: did you need something? | 15:24 |
| lbragstad | dstanek: pinging earlier? | 15:24 |
| *** cjellick has quit IRC | 15:29 | |
| dstanek | lbragstad: yeah, i put together a string of commits as a proof of concept for object based schema | 15:29 |
| *** cjellick has joined #openstack-keystone | 15:30 | |
| lbragstad | dstanek: sweet | 15:30 |
| dstanek | lbragstad: it was a very interesting process for sure | 15:30 |
| lbragstad | dstanek: and you were able to work around the config import issue? | 15:30 |
| dstanek | lbragstad: not yet, but i know how it can be done; it's just ugly | 15:31 |
| *** hrybacki has quit IRC | 15:31 | |
| lbragstad | dstanek: ok | 15:31 |
| lbragstad | dstanek: do you have it written up as a gist, or? | 15:32 |
| lbragstad | proposed? | 15:32 |
| dstanek | i'll push it up in just a second | 15:32 |
| dstanek | it requires several changes to my schema library that i need to get committed | 15:33 |
| lbragstad | ah | 15:34 |
| lbragstad | dstanek: are we going to include that in the keystone? | 15:34 |
| lbragstad | dstanek: or a separate library, like dolphm suggested? | 15:34 |
| *** cjellick has quit IRC | 15:35 | |
| lbragstad | s/the// | 15:35 |
| dstanek | lbragstad: i would be fine with either - i've already released is separately, but it's really only a single file | 15:35 |
| lbragstad | dstanek: that should be fine? I would think we could keep it that way and just expand on it iff we need to | 15:35 |
| dstanek | lbragstad: i really just wanted to get this proof of concept out of my head - if we use it great and if not then i can at least sleep a little better at night :-) | 15:36 |
| lbragstad | lol | 15:36 |
| lbragstad | dstanek: I think that is the direction that jamielennox|away wanted to go anyway | 15:37 |
| *** zzzeek has joined #openstack-keystone | 15:38 | |
| dstanek | lbragstad: the reason the config stuff is difficult is the decorator | 15:39 |
| lbragstad | yeah | 15:39 |
| lbragstad | I don't think we *need* to have the configuration option in order to complete the validation of the keystone api, but it is nice allowing the user to define the how tight the id_strings should be | 15:40 |
| openstackgerrit | Brant Knudson proposed a change to openstack/identity-api: JSON Home support https://review.openstack.org/109881 | 15:42 |
| *** rwsu has joined #openstack-keystone | 15:42 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes syntax error in tests https://review.openstack.org/110335 | 15:46 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Splits generic validation tests from model tests https://review.openstack.org/110336 | 15:46 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds a dependency on jsd https://review.openstack.org/110337 | 15:46 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Makes domain_id required for projects https://review.openstack.org/110338 | 15:46 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Convert projects from embeded JSON to jsd schemas https://review.openstack.org/110339 | 15:46 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Initial attempt at lazy configs - ugly https://review.openstack.org/110340 | 15:46 |
| dstanek | i need to mark all that as wip | 15:46 |
| morganfainberg | hehe | 15:46 |
| dstanek | lbragstad: here is the difference in how it looks https://review.openstack.org/#/c/110339/ | 15:49 |
| *** cjellick has joined #openstack-keystone | 15:50 | |
| lbragstad | dstanek: I like https://review.openstack.org/#/c/110339/1/keystone/assignment/schema.py | 15:50 |
| *** amcrn has joined #openstack-keystone | 15:51 | |
| dstanek | lbragstad: the thing i'm most unhappy with is the same complaint i have with django models - require vs. nullable | 15:54 |
| lbragstad | we had that issue with regions, I think | 15:54 |
| *** cjellick has quit IRC | 15:54 | |
| dstanek | lbragstad: http://paste.openstack.org/show/88773/ | 15:54 |
| lbragstad | √ | 15:55 |
| lbragstad | https://github.com/openstack/keystone/blob/f4267c1d8b16a2c617edf87bd29ddb8ab81455ec/keystone/catalog/core.py#L89-L92 | 15:55 |
| dstanek | i'm struggling with a usecase for #2 | 15:55 |
| dstanek | and maybe 3 | 15:55 |
| *** cjellick has joined #openstack-keystone | 15:55 | |
| dstanek | no 3 is valid | 15:55 |
| lbragstad | dstanek: a use case for 2 would be region creation | 15:56 |
| lbragstad | the db schema for regions requires a description | 15:56 |
| lbragstad | region.description can't be null, but it doesn't have to be unique | 15:57 |
| lbragstad | so two regions can have the same description string '' | 15:57 |
| lbragstad | dstanek: do you have a usecase for #3? | 15:57 |
| dstanek | lbragstad: but for regions you can't have a null value right? | 15:58 |
| dstanek | #2 forces the key to exist in the object, but allows for a null value | 15:59 |
| lbragstad | dstanek: oh, right | 15:59 |
| lbragstad | yeah, region.description can't be null... | 15:59 |
| lbragstad | https://github.com/openstack/keystone/blob/f4267c1d8b16a2c617edf87bd29ddb8ab81455ec/keystone/common/sql/migrate_repo/versions/037_add_region_table.py#L26 | 16:00 |
| dstanek | so maybe i can get rid of nullable after all. I wanted to just set 'required=True' to mean that the property must be in the object and that it needs an actual value | 16:00 |
| lbragstad | https://github.com/openstack/keystone/blob/f4267c1d8b16a2c617edf87bd29ddb8ab81455ec/keystone/common/sql/migrate_repo/versions/043_fixup_region_description.py#L52 | 16:00 |
| lbragstad | dstanek: ok | 16:01 |
| dstanek | i added it in because one of the existing tests broke...let me see which one | 16:01 |
| *** marcoemorais has joined #openstack-keystone | 16:03 | |
| dstanek | lbragstad: the 'test_create_schema_with_null_string_on_required_fails' test fails because if the original code the uuid was not actually required, but can't be null | 16:06 |
| *** dims has joined #openstack-keystone | 16:08 | |
| lbragstad | looks like the only places where we have nullable=True, from a db perspective, is region.parent_region_id and trust.remaining_uses. | 16:09 |
| dolphm | lbragstad: isn't nullable=True the default? | 16:11 |
| morganfainberg | dolphm, yes | 16:11 |
| dolphm | lbragstad: region description should certainly be nullable | 16:11 |
| lbragstad | I guess I was looking at places were we specify | 16:11 |
| openstackgerrit | A change was merged to openstack/keystone: Add workaround to support tox 1.7.2 https://review.openstack.org/110039 | 16:11 |
| dolphm | lbragstad: do a schema dump from mysql or something that will show that for every column | 16:12 |
| morganfainberg | dolphm, lbragstad, i thought we decided region description would not be nullable | 16:12 |
| dolphm | morganfainberg: refresh me? | 16:12 |
| lbragstad | region.description isn't nullable. | 16:12 |
| morganfainberg | but that the controller would set the value to '' if it was a none | 16:12 |
| dolphm | morganfainberg: ah ++ | 16:13 |
| lbragstad | morganfainberg: ++ | 16:13 |
| lbragstad | yeah, that's taken care of in the Manager | 16:13 |
| dolphm | all the descriptions could behave that way | 16:13 |
| lbragstad | https://github.com/openstack/keystone/blob/f4267c1d8b16a2c617edf87bd29ddb8ab81455ec/keystone/catalog/core.py#L89-L92 | 16:14 |
| *** gyee has joined #openstack-keystone | 16:16 | |
| lbragstad | credential.project_id can be null | 16:17 |
| lbragstad | so can credential.extra | 16:17 |
| dstanek | there are really a few high level cases i think i case about http://paste.openstack.org/show/88951/ (the bottom list) | 16:18 |
| lbragstad | so can domain.extra, endpoint.legacy_endpoint_id, endpoint.region, endpoint.extra, policy.extra, region.extra, region.parent_region_id, a lot of stuff in revocation_event table, role.extra, service.type, service.extra | 16:21 |
| lbragstad | token.expires, token.extra, token.trust_id, token.user_id | 16:22 |
| lbragstad | there are quite a few columns that can be nullable | 16:22 |
| dolphm | dstanek: ++ | 16:22 |
| lbragstad | dstanek: makes sense | 16:23 |
| dolphm | lbragstad: the .extra ones shouldn't be nullable... they should default to '{}' | 16:23 |
| dolphm | lbragstad: but anyway, extra isn't an attribute to be validated at the API layer | 16:23 |
| lbragstad | dolphm: ok, most all .extra columns are nullable | 16:23 |
| dolphm | legacy_endpoint_id is also not exposed to the API | 16:24 |
| lbragstad | dolphm: yeah, we are passing that through with additionalAttributes: true | 16:24 |
| *** jsavak has joined #openstack-keystone | 16:24 | |
| dolphm | i'm not sure why service.type should be nullable - that's quite important | 16:25 |
| lbragstad | dolphm: yeah | 16:25 |
| dolphm | token.expires should be non-nullable, i think (worst case is a token that expires far in the future?) | 16:25 |
| lbragstad | dolphm: quite a bit of stuff in token is | 16:25 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove trust dependency on token_api https://review.openstack.org/109462 | 16:26 |
| dolphm | token.user_id should be non-nullable | 16:26 |
| dolphm | unless that's something to do with federation or something (?) | 16:26 |
| morganfainberg | dolphm, the token schema is all sorts of wacky | 16:26 |
| dolphm | lbragstad: so that leaves endpoint.region, region.parent_region_id, most attributes of revocation events, and token.trust_id | 16:26 |
| dolphm | morganfainberg: ++ | 16:27 |
| dolphm | morganfainberg: that table has a schema? | 16:27 |
| morganfainberg | dolphm, lol | 16:27 |
| lbragstad | dolphm: the user table has some stuff that is nullable too | 16:27 |
| lbragstad | not sure how much that matters | 16:27 |
| morganfainberg | i;d leave the token table alone if we can. | 16:27 |
| *** joesavak has quit IRC | 16:27 | |
| *** gabriel-bezerra has quit IRC | 16:27 | |
| dolphm | lbragstad: user.password? | 16:28 |
| lbragstad | user.password, user.enabled, user.default_project_id | 16:28 |
| lbragstad | are all nullable | 16:28 |
| *** gabriel-bezerra has joined #openstack-keystone | 16:28 | |
| *** gordc is now known as gordc_lunch | 16:32 | |
| *** marcoemorais has quit IRC | 16:33 | |
| morganfainberg | user.password is nullable for some *real* reason i can't remember | 16:34 |
| lbragstad | ssh key pairs? | 16:34 |
| morganfainberg | default_project_id should be nullable | 16:34 |
| morganfainberg | lbragstad, maybe? | 16:34 |
| *** marcoemorais has joined #openstack-keystone | 16:34 | |
| lbragstad | that's the big reason I can think of... | 16:34 |
| morganfainberg | enabled, that should be handled at the manager level - if anything and should not be nullable | 16:34 |
| lbragstad | yeah | 16:34 |
| raildo | gyee: I answered your questions there, if you can take a look https://review.openstack.org/#/c/101017/14/specs/juno/hierarchical_multitenancy.rst | 16:37 |
| gyee | raildo, sure | 16:38 |
| *** gabriel-bezerra has quit IRC | 16:38 | |
| lbragstad | so, should we go through all those tables and switch them? | 16:38 |
| lbragstad | or compensate at the manager layers for each? | 16:38 |
| *** gabriel-bezerra has joined #openstack-keystone | 16:39 | |
| gyee | raildo, I only see patch 14 | 16:44 |
| *** afazekas has quit IRC | 16:44 | |
| *** gabriel-bezerra has quit IRC | 16:48 | |
| *** dims has quit IRC | 16:49 | |
| *** gabriel-bezerra has joined #openstack-keystone | 16:49 | |
| *** dims has joined #openstack-keystone | 16:50 | |
| *** marzif has quit IRC | 16:54 | |
| *** tomoiaga has quit IRC | 16:55 | |
| *** aqweqwe has joined #openstack-keystone | 16:58 | |
| *** aqweqwe has quit IRC | 16:58 | |
| *** gokrokve has joined #openstack-keystone | 17:00 | |
| *** jdennis1 has joined #openstack-keystone | 17:03 | |
| *** gabriel-bezerra has quit IRC | 17:06 | |
| *** jdennis has quit IRC | 17:06 | |
| *** gabriel-bezerra has joined #openstack-keystone | 17:07 | |
| *** ayoung has joined #openstack-keystone | 17:11 | |
| raildo | gyee: I answered the comments in this patch. | 17:17 |
| *** gabriel-bezerra has quit IRC | 17:19 | |
| *** gabriel-bezerra has joined #openstack-keystone | 17:19 | |
| *** nkinder is now known as nkinder_away | 17:21 | |
| *** bvandenh has joined #openstack-keystone | 17:22 | |
| *** gmurphy has quit IRC | 17:26 | |
| *** gabriel-bezerra has quit IRC | 17:27 | |
| *** amerine has quit IRC | 17:27 | |
| *** gabriel-bezerra has joined #openstack-keystone | 17:28 | |
| *** gmurphy has joined #openstack-keystone | 17:29 | |
| *** marekd|away has quit IRC | 17:29 | |
| *** amerine has joined #openstack-keystone | 17:29 | |
| *** marekd|away has joined #openstack-keystone | 17:29 | |
| *** hrybacki has joined #openstack-keystone | 17:30 | |
| *** david-lyle has quit IRC | 17:33 | |
| *** david-lyle has joined #openstack-keystone | 17:33 | |
| *** david-lyle has quit IRC | 17:35 | |
| *** david-lyle has joined #openstack-keystone | 17:36 | |
| *** harlowja_away is now known as harlowja | 17:36 | |
| *** gabriel-bezerra has quit IRC | 17:36 | |
| *** nonameentername has joined #openstack-keystone | 17:36 | |
| *** gabriel-bezerra has joined #openstack-keystone | 17:37 | |
| lbragstad | dstanek: so if we use something like http://paste.openstack.org/show/88969/ for domain and region validation, | 17:37 |
| lbragstad | we will still need separate schemas for the update requests? | 17:38 |
| lbragstad | dstanek: oh wait... never mind | 17:40 |
| dstanek | lbragstad: did you answer yourself? | 17:40 |
| *** chandankumar has joined #openstack-keystone | 17:41 | |
| lbragstad | dstanek: https://review.openstack.org/#/c/110339/1/keystone/common/validation/__init__.py | 17:41 |
| *** gabriel-bezerra has quit IRC | 17:41 | |
| lbragstad | dstanek: so, based on that, in order to use jsd, the schema has to be written for the create case, right? | 17:42 |
| dstanek | lbragstad: yep, I'm moving something similar into the library too | 17:42 |
| lbragstad | and def restful_update_schema() will handle converting that schema to update format | 17:42 |
| *** gabriel-bezerra has joined #openstack-keystone | 17:42 | |
| lbragstad | and not having something like 'name' required in the update request when it should be required for the create request. | 17:43 |
| *** david-lyle has quit IRC | 17:44 | |
| *** topol has joined #openstack-keystone | 17:44 | |
| lbragstad | dstanek: cool, I'm curious to see it in the library | 17:44 |
| *** david-lyle has joined #openstack-keystone | 17:44 | |
| *** henrynash has joined #openstack-keystone | 17:46 | |
| lbragstad | dstanek: are you going to move that utility to jsd.py or into a utils module of jsd? | 17:47 |
| *** amerine_ has joined #openstack-keystone | 17:48 | |
| *** gordc_lunch is now known as gordc | 17:48 | |
| *** david-lyle has quit IRC | 17:49 | |
| *** ukalifon1 has quit IRC | 17:50 | |
| *** amerine has quit IRC | 17:51 | |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: KeyError instead of exception.KeyError https://review.openstack.org/110397 | 17:53 |
| *** gabriel-bezerra has quit IRC | 17:56 | |
| stevemar | gordc, i think i found out why your patch was erroring, made comments | 17:56 |
| *** henrynash has quit IRC | 17:58 | |
| *** gabriel-bezerra has joined #openstack-keystone | 17:58 | |
| *** henrynash has joined #openstack-keystone | 17:58 | |
| gordc | stevemar: yeah it worked with something similar. i guess interpreter doesn't know how to traverse multiple levels? | 17:59 |
| stevemar | gordc, i dunno, it's weird | 18:00 |
| dstanek | lbragstad: i'm not entirely sure yet how it'll look - i'm in the middle of some significant changes | 18:00 |
| gordc | stevemar: too lazy to figure it out. thanks for the help | 18:00 |
| stevemar | np | 18:00 |
| lbragstad | dstanek: ok, let me know if you need anything. I'm looking through the purposed revieews | 18:00 |
| lbragstad | reviews* | 18:01 |
| *** marcoemorais has quit IRC | 18:02 | |
| dstanek | lbragstad: i tried to break it up to tell a story of how i got to the end result | 18:02 |
| *** marcoemorais has joined #openstack-keystone | 18:02 | |
| lbragstad | yep | 18:03 |
| *** david-lyle has joined #openstack-keystone | 18:07 | |
| *** jamielennox|away is now known as jamielennox | 18:07 | |
| *** gabriel-bezerra has quit IRC | 18:10 | |
| *** jorge_munoz has joined #openstack-keystone | 18:10 | |
| *** gabriel-bezerra has joined #openstack-keystone | 18:11 | |
| *** marcoemorais has quit IRC | 18:12 | |
| *** marcoemorais has joined #openstack-keystone | 18:12 | |
| *** topol has quit IRC | 18:13 | |
| *** marcoemorais has quit IRC | 18:13 | |
| *** marcoemorais has joined #openstack-keystone | 18:14 | |
| *** gabriel-bezerra has quit IRC | 18:17 | |
| *** gabriel-bezerra has joined #openstack-keystone | 18:17 | |
| *** marcoemorais has quit IRC | 18:26 | |
| *** marcoemorais has joined #openstack-keystone | 18:26 | |
| *** gabriel-bezerra has quit IRC | 18:27 | |
| *** gabriel-bezerra has joined #openstack-keystone | 18:28 | |
| *** gabriel-bezerra has quit IRC | 18:29 | |
| *** gabriel-bezerra has joined #openstack-keystone | 18:30 | |
| hrybacki | ayoung: can a strong argument be made for either creating the session within AuthProtocol and handing it to IdenitityServer as a param vs creating it when IdentityServer is instantiated in auth_token? | 18:32 |
| ayoung | hrybacki, Keystone meeting happening right now in #openstack-meeting, you might want to monitor. We can discuss after. | 18:34 |
| hrybacki | ayoung: damnit++ | 18:34 |
| *** marekd|away has quit IRC | 18:37 | |
| openstackgerrit | gordon chung proposed a change to openstack/keystonemiddleware: Adding audit middleware to keystonemiddleware https://review.openstack.org/102958 | 18:38 |
| openstackgerrit | gordon chung proposed a change to openstack/keystonemiddleware: Adding audit middleware to keystonemiddleware https://review.openstack.org/102958 | 18:40 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/identity-api: Updated from global requirements https://review.openstack.org/110415 | 18:41 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/109002 | 18:41 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/110098 | 18:41 |
| stevemar | gordc, the patch looks good | 18:43 |
| *** gabriel-bezerra has quit IRC | 18:44 | |
| gordc | stevemar: cool cool. let me know if anything needs to be changed/ | 18:44 |
| *** gabriel-bezerra has joined #openstack-keystone | 18:47 | |
| *** jogo has joined #openstack-keystone | 18:47 | |
| jogo | morganfainberg: ping have a v3 question | 18:47 |
| morganfainberg | jogo, have the keystone meeting going on at the moment, but sure, i'm here (might take a few moments to answer though) | 18:47 |
| morganfainberg | jogo, ask away :) | 18:48 |
| *** bvandenh has quit IRC | 18:48 | |
| *** marekd|away has joined #openstack-keystone | 18:50 | |
| *** gmurphy has quit IRC | 18:50 | |
| jogo | morganfainberg: we are talking about what the final steps are for moving nova to keystone v3 | 18:50 |
| stevemar | jogo, that sounds super exciting | 18:51 |
| jogo | it sounds like we need an update to the policy file to ignore domain scoped tokens? is that correct | 18:51 |
| dims | guess we need to try devstack with nova using v3...or do we already have a switch for that? | 18:51 |
| jogo | morganfainberg: if so, sounds like that is the last thing we need to do | 18:52 |
| morganfainberg | jogo, hm. why are you ignoring domain scoped tokens? and yes that might be the last thing (just switching contexts from meeting, and don't rememebr why domain scope was an issue) | 18:52 |
| dims | morganfainberg, folks were talking about a first pass. what's min needed to switch nova to use v3 api | 18:53 |
| morganfainberg | dims, ah, basically you want to make sure a token is project scoped so the instance goes to the right place | 18:53 |
| morganfainberg | dims, jogo, yes that sounds like the right thing, have policy make sure a token is project scoped not domain scoped coming into nova | 18:54 |
| jamielennox | morganfainberg: i don't think anyone other than keystone really has a us for domain scoped tokens. what would nova do with them? | 18:54 |
| morganfainberg | jamielennox, right | 18:55 |
| dims | morganfainberg, no other code changes needed? | 18:56 |
| dims | as far as we know :) | 18:56 |
| morganfainberg | dims, shouldn't really be. middleware should present all the info you need (in the same manner as v2) to the underlying app (in this case nova) | 18:56 |
| *** david-lyle has quit IRC | 18:57 | |
| *** gmurphy has joined #openstack-keystone | 18:57 | |
| dims | morganfainberg, cool | 18:57 |
| *** david-lyle has joined #openstack-keystone | 18:57 | |
| jogo | morganfainberg: because we can't do 'list all instances in a domain' | 18:57 |
| morganfainberg | jogo, ++ makes sense | 18:58 |
| *** david-lyle has quit IRC | 18:59 | |
| *** david-ly_ has joined #openstack-keystone | 18:59 | |
| jogo | morganfainberg: so can you push up a patch for that | 19:00 |
| morganfainberg | jogo, to make nova poilcy reject domain scoped tokens. i'll see what i can figure out :) | 19:00 |
| morganfainberg | ? | 19:00 |
| jamielennox | morganfainberg: umm, it and httpretty should play well together, the problem is that i put the mock start in the global setUp | 19:00 |
| dolphm | bknudson: that's a useless constant though, 'GET' is never going to change to 'FETCH' or anything | 19:01 |
| morganfainberg | jamielennox, might want to make it a phased rollout, just to help your head not explode everytime something lands and makes you need to update it | 19:01 |
| morganfainberg | jamielennox, it's why i've split up the persistence stuff as much as i have. | 19:01 |
| jamielennox | bknudson: ok, i have a better solution in a newer version (ie call .get() rather than request_uri('GET')) but i had enough trouble getting it in to do an immediate version bump | 19:02 |
| morganfainberg | jamielennox, i don't mind reviewing that patchset, but just trying to save you an issue trying ot get it landed unless we can land it before the next ksc patch lands | 19:02 |
| dolphm | jamielennox: it already needs a rebase; i'd be happy to get it in quickly when it's ready | 19:03 |
| jogo | morganfainberg: sounds good | 19:03 |
| dolphm | jamielennox: like, within the next hour | 19:03 |
| morganfainberg | dolphm, ++ | 19:03 |
| jamielennox | morganfainberg: it's probably ok, if i do the mock start in a per-file setUp then they will play nice together, then at the end i just remove all the individual ones to a global | 19:03 |
| jogo | morganfainberg: so for this spec https://review.openstack.org/#/c/103617/2/specs/juno/support-keystone-v3-api.rst | 19:03 |
| jogo | it sounds like its been done? | 19:03 |
| jogo | or is the neutron stuff not done yet | 19:03 |
| morganfainberg | jamielennox, dolphm, let me know and i'm on the review right away, if we can land it today, score, lets do it in one shot. | 19:04 |
| morganfainberg | jamielennox, dolphm, but otherwise staging it might be a lot easier since you'll rebase only sometimes not anytime something lands | 19:04 |
| morganfainberg | jogo, /me looks | 19:04 |
| jogo | morganfainberg: thanks. If that work wasn't done it sounds like the only issue is the service account for neutron cannot be in the non-default domain | 19:05 |
| morganfainberg | gyee, jamielennox, ^ re jogo 's question on neutronclient | 19:05 |
| gyee | neutronclient is almost there | 19:05 |
| jogo | morganfainberg: and we want to allign the specs with reality for documentation/tracking purposes | 19:05 |
| *** david-ly_ is now known as david-lyle | 19:05 | |
| morganfainberg | jogo, ++ makes sense | 19:06 |
| gyee | morganfainberg, jogo, https://review.openstack.org/#/c/92390/ | 19:06 |
| gyee | just need another +2 | 19:06 |
| jogo | gyee morganfainberg: cool | 19:06 |
| jogo | so we should approve the nova spec then? | 19:06 |
| jogo | morganfainberg: as its happening if we approve it or not. | 19:06 |
| gyee | jogo, yes, user can't do much with a domain-scoped token anyway | 19:07 |
| morganfainberg | jogo, haha, probably going to happen in either case | 19:07 |
| gyee | unless the domain-scoped token contains the "admin" role | 19:07 |
| jogo | morganfainberg: can you chime in on that spec and we can update the spec status | 19:07 |
| morganfainberg | jogo, i'll work on figuring out policy stuff for you guys on that. | 19:07 |
| gyee | in that case, he's admin for the world anyway | 19:07 |
| jogo | morganfainberg: that would be great | 19:07 |
| morganfainberg | jogo, ++ gyee ^ mind chiming in as well re: neutron | 19:07 |
| jogo | gyee: yeah we want to future proof our selves a bit | 19:07 |
| gyee | almost all services have this problem | 19:08 |
| jogo | morganfainberg: heading to lunch, but if you can put all your commntents in that spec we can approve it etc | 19:08 |
| gyee | if user have 'admin' role, he's admin for everybody | 19:08 |
| jogo | gyee: feel free to chime in on tjhe spec | 19:08 |
| morganfainberg | jogo, yep will do. | 19:08 |
| gyee | jogo, k, will do | 19:08 |
| jogo | gyee morganfainberg: thanks! | 19:08 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert httpretty to requests-mock https://review.openstack.org/106659 | 19:08 |
| jamielennox | dolphm, morganfainberg: ^ | 19:09 |
| jamielennox | morganfainberg: sorry, booted from VPN - what question? | 19:09 |
| morganfainberg | jamielennox, gyee answered it | 19:10 |
| *** gabriel-bezerra has quit IRC | 19:12 | |
| *** gabriel-bezerra has joined #openstack-keystone | 19:13 | |
| dolphm | jamielennox: looking now | 19:19 |
| openstackgerrit | A change was merged to openstack/identity-api: Updated from global requirements https://review.openstack.org/110415 | 19:19 |
| dolphm | jamielennox: applies cleanly! | 19:20 |
| jamielennox | dolphm: until the next patch with a httpretty statement lands :) | 19:20 |
| dolphm | jamielennox: is anything gating? | 19:20 |
| jamielennox | not that i'm aware of | 19:20 |
| jamielennox | zuul says no | 19:21 |
| *** chandankumar has quit IRC | 19:24 | |
| *** cjellick has quit IRC | 19:26 | |
| ayoung | jamielennox, is httpretty really that bad? | 19:26 |
| dstanek | ayoung: i | 19:26 |
| dstanek | 'm not a fan | 19:26 |
| jamielennox | ayoung: yes | 19:27 |
| jamielennox | ayoung: enough for me to write a _testing_ library | 19:27 |
| ayoung | jamielennox, this is a problem that I was not aware we had | 19:28 |
| jamielennox | ayoung: so. bad. | 19:28 |
| *** cjellick has joined #openstack-keystone | 19:28 | |
| *** shuffleb1t is now known as shufflebot | 19:28 | |
| *** shufflebot has quit IRC | 19:28 | |
| *** shufflebot has joined #openstack-keystone | 19:28 | |
| *** cjellick has quit IRC | 19:28 | |
| jamielennox | that may be unfair - i've had a lot to do with it, but yes i would like to move away from it | 19:28 |
| *** cjellick has joined #openstack-keystone | 19:29 | |
| jamielennox | it made sense when we were dealing with both httplib and requests, but now we've switched i think this will be much cleaner | 19:29 |
| dstanek | i think it's tests are mostly useless anyway and that we'd be better served moving away | 19:29 |
| dolphm | jamielennox: is token_response() ever used? https://review.openstack.org/#/c/106659/6/keystoneclient/tests/test_auth_token_middleware.py | 19:29 |
| dstanek | we can do better at the domain object level | 19:29 |
| ayoung | dstanek, can you exapnd that statement? | 19:30 |
| *** lbragsta_ has joined #openstack-keystone | 19:31 | |
| *** lbragst__ has joined #openstack-keystone | 19:32 | |
| *** lbragst__ is now known as lbragstad_ | 19:33 | |
| *** lbragsta_ has quit IRC | 19:33 | |
| dstanek | ayoung: about domain layer? | 19:34 |
| *** lbragstad has quit IRC | 19:34 | |
| jamielennox | dstanek: yes, about 3 lines above it | 19:34 |
| jamielennox | above where it is defined | 19:35 |
| jamielennox | it's a calback | 19:35 |
| dstanek | i think that httpretty is a way to sort of go between end-to-end tests and unit tests | 19:36 |
| jamielennox | dstanek: i understand the point, but i have found so many stupid little mistakes in libraries where the mocking layer does something wrong | 19:37 |
| ayoung | dstanek, domain object level is unit test. I think we should be using httpretty or its replacemetn to confirm http level interfaces, not Python | 19:37 |
| dstanek | ayoung: httpretty doesn't confirm http interfaces at all - actually it's the opposite | 19:38 |
| dstanek | if confirms you are hitting the URL you expect and they you tell it what to give you back | 19:38 |
| ayoung | dstanek, it fakes out HTTP responses | 19:38 |
| jamielennox | dstanek: it doesn't confirm them, but it does mean if you get something from the socket it is handled correctly all the way up | 19:38 |
| ayoung | dstanek, I did something comparable in FreeIPA development. We cached json responses from the server so that we could do client side development without a live server | 19:39 |
| ayoung | for Keystone client it is the right tool. | 19:39 |
| dstanek | i just think it promotes more testing on the edges and less unit level testing - not saying we shouldn't use it | 19:40 |
| ayoung | and the server side doesn't tend to use httpretty. More of the opposite: the server gave you back thuis JSON blob | 19:40 |
| *** cjellick_ has joined #openstack-keystone | 19:41 | |
| dstanek | on the server side we don't need to use httpretty because we don't do many service calls | 19:41 |
| *** cjellick_ has quit IRC | 19:41 | |
| dolphm | jamielennox: i don't think i've ever appreciated gerrit's light green vs dark green and light red vs dark red highlighting as much as i do reviewing this | 19:41 |
| ayoung | jamielennox, so your code change is just to replace httpretty with a comparable library for mocking responses that is specific to the "requests" python library, correct? | 19:41 |
| *** gordc has quit IRC | 19:41 | |
| jamielennox | ayoung: yes | 19:42 |
| ayoung | hrybacki, this shouldn't be too bad a rebase. | 19:42 |
| jamielennox | dolphm: it's just a lot of small semantic changes | 19:42 |
| jamielennox | dolphm: it was crap to write | 19:42 |
| hrybacki | ayoung++ | 19:42 |
| ayoung | hrybacki, and he is not proposing it for middleware yet, so it won't affect that patch | 19:43 |
| dolphm | jamielennox: what's the difference between b'' and six.b('') ? | 19:43 |
| hrybacki | ayoung: so the identity_server will always be needed in production -- the lazy loaded (which works now btw) was to resolve the issue with tests caused by determing api version on load messing up the httpretty stuff | 19:44 |
| jamielennox | dolphm: umm, i don't know, probably nothing as of python3.3 | 19:44 |
| *** cjellick has quit IRC | 19:44 | |
| *** gabriel-bezerra has quit IRC | 19:44 | |
| dolphm | jamielennox: what's the difference in py2? | 19:44 |
| hrybacki | so I think the best solution is to remove the lazy loading and hard code the auth_url, like before, until httpretty stuff is replaced | 19:44 |
| hrybacki | than I can submit a followup for determing api version and generating the auth_url then | 19:44 |
| jamielennox | hrybacki: ++ don't confuse the session patch with the one for v3 auth, auth is a follow up | 19:45 |
| dstanek | dolphm: in py2 nothing | 19:45 |
| ayoung | hrybacki, ok, sounds like a plan | 19:45 |
| hrybacki | ayoung, jamielennox unless you see a reason to keep lazy loading | 19:45 |
| *** gabriel-bezerra has joined #openstack-keystone | 19:45 | |
| jamielennox | if the only reason to do lazy loading was to get around the initial auth request then no | 19:46 |
| ayoung | hrybacki, lazy load was the norm before | 19:46 |
| ayoung | die. don't go to keystone inorder to just bring up Nova | 19:46 |
| dstanek | dolphm: the different is betwee 2 and 3 - 2 returns a string because str is bytes and in 3 it returns bytes | 19:46 |
| morganfainberg | dolphm, in py3 b is bytes, b in py2 is str() | 19:46 |
| ayoung | the goal was to not force service ordering for bringup | 19:46 |
| hrybacki | ayoung: are there any possible adverse side effects from lazy loading idenityserver? | 19:47 |
| *** dims has quit IRC | 19:47 | |
| ayoung | hrybacki, no new ones. The existing problem is that if you misconfigure the keystone data, you don't find out until first request | 19:47 |
| hrybacki | would lazy loading stack onto that problem? I'm assuming that's not a behavior we want | 19:48 |
| dolphm | dstanek: morganfainberg: so it's bytes either way in python2 and 3... ? | 19:48 |
| dolphm | b'' is six.b('') # in python 2 and 3 | 19:48 |
| morganfainberg | dolphm, trying to confirm what it is on python 3 | 19:48 |
| jamielennox | ayoung: i think you are talking about different things in lazy loading - you can load the object - we just don't do a HTTP request initially | 19:48 |
| morganfainberg | dolphm, but my guess is ... six.b is superfluous | 19:48 |
| dstanek | dolphm: yes | 19:48 |
| morganfainberg | in most cases | 19:48 |
| *** openstackgerrit has quit IRC | 19:48 | |
| *** gabriel-bezerra has quit IRC | 19:49 | |
| ayoung | jamielennox, he was doing discovery in the init of auth_token | 19:49 |
| ayoung | it forced the call to keystone | 19:49 |
| jamielennox | ayoung: yep, if we don't do auth in this patch then we defer that probelm | 19:49 |
| ayoung | yep | 19:49 |
| dolphm | dstanek: erm http://pasteraw.com/d2rwjc4wdiuuvrtpvmnzdi3x8nqw2fe | 19:49 |
| jamielennox | dolphm: yes, it makes no difference to b'' except possible python 3.0-3.2 which didn't have b'' but which we don't support | 19:49 |
| *** gabriel-bezerra has joined #openstack-keystone | 19:49 | |
| hrybacki | I'll leave lazy loading out for the time being -- I can add it w/o issue if we want it in the follow up | 19:50 |
| *** asmacdo has joined #openstack-keystone | 19:50 | |
| dstanek | dolphm: i think that's an is vs. equal thing | 19:50 |
| jamielennox | dstanek: ++ | 19:50 |
| morganfainberg | dolphm, dstanek, jamielennox, six.b() in python 3 creates bytes() in python2 it's str() | 19:51 |
| morganfainberg | basically... it's not super useful | 19:51 |
| morganfainberg | jamielennox, ah python 3.0-3.2 | 19:51 |
| morganfainberg | yeah tesing on 3.3 and 3.4 | 19:51 |
| *** jasondotstar has quit IRC | 19:51 | |
| dstanek | morganfainberg: exactly | 19:52 |
| dstanek | http://paste.openstack.org/show/88995/ | 19:52 |
| *** jasondotstar has joined #openstack-keystone | 19:52 | |
| morganfainberg | dolphm, <class 'bytes'> | 19:52 |
| morganfainberg | >>> b'a' == six.b('a') | 19:52 |
| morganfainberg | True | 19:52 |
| morganfainberg | in python 3.4 | 19:52 |
| dstanek | that would be true in all versions of Python that support the b prefix | 19:53 |
| morganfainberg | dstanek, ++ | 19:53 |
| morganfainberg | dolphm, 'is' is a bad comparitor in some cases, it checks exact instance not value | 19:53 |
| *** portante has joined #openstack-keystone | 19:54 | |
| portante | morganfainberg: here | 19:55 |
| morganfainberg | portante, so re: Swift and concerns on pki token size | 19:55 |
| portante | k | 19:55 |
| dstanek | six.b isn't useful for literals in code; it's more for passing in a variable and wanting a byte string back | 19:55 |
| morganfainberg | portante, i know some of you talked to ayoung at the summit | 19:55 |
| morganfainberg | portante, is the concern of the token being *large* only for subsequent requests e.g. i request 20 things with the same token | 19:55 |
| portante | yes | 19:55 |
| ayoung | make that "20 separate requests" | 19:55 |
| morganfainberg | portante, or is it a concern for *all* requests (both a single request or multiple requests) | 19:55 |
| *** jorge_munoz has quit IRC | 19:56 | |
| *** lbragstad_ has quit IRC | 19:56 | |
| morganfainberg | portante, e.g. use rA requests 1 thing, with a token and uses a different project (or a different user with a different token) requests 2nd object | 19:56 |
| *** lbragstad has joined #openstack-keystone | 19:56 | |
| morganfainberg | portante, the distinction is reuse of token vs separate requests (different scope / user /etc ) for 1-off requests | 19:57 |
| portante | sec, reading, and internalizing | 19:57 |
| bknudson | dolphm: re https://review.openstack.org/#/c/109389/14/keystone/contrib/revoke/core.py "i assume this is xor - but that should be enforced here" -- do you mean raise an exception if domain_id and project_id are set? | 19:57 |
| morganfainberg | jogo, i need to head to lunch shortly, will work on the nova policy stuff later today, will get comments on the spec before i leave for food | 19:58 |
| dolphm | bknudson: yes | 19:58 |
| bknudson | dolphm: ok. | 19:58 |
| dstanek | morganfainberg: why the distinction? if the token is passed 20 times does it matter if it's the same user or not? | 19:58 |
| dolphm | bknudson: a 500 | 19:58 |
| morganfainberg | dstanek, it matters because a reuse token implies the same user. | 19:59 |
| *** lbragstad has quit IRC | 19:59 | |
| bknudson | dolphm: yep, ok. I'll also make sure that the message with the error gets back to the user! | 19:59 |
| *** lbragstad has joined #openstack-keystone | 19:59 | |
| morganfainberg | dstanek, same scope. so i'm asking for 20 obejcts (separately) with the same authorization. the other one would be 1-off (1 request and done) | 19:59 |
| *** gordc has joined #openstack-keystone | 19:59 | |
| *** gabriel-bezerra has quit IRC | 20:00 | |
| morganfainberg | dstanek, i'm trying to hammer down the specific size-of-request concern swift has so we have it recorded (and fresh in our minds) when discussing PKI vs UUID | 20:00 |
| bknudson | dolphm: so do I need a new exception for that or would raise Exception accomplish it? | 20:00 |
| jogo | morganfainberg: woot! thanks | 20:00 |
| dstanek | morganfainberg: if you take a sample of 20 requests and the tokens are too big i don't see the distinction (same user or different user, 20 large requests are 20 large requests) | 20:00 |
| portante | morganfainberg: it is a concern on the overall size, no matter what the number of requests | 20:01 |
| *** gabriel-bezerra has joined #openstack-keystone | 20:01 | |
| morganfainberg | portante, that was my understanding. thank you :) | 20:01 |
| portante | the number of requests is also a factor, and folks want to reduce that as well | 20:01 |
| dolphm | bknudson: raise keystone.exception.UnexpectedError() | 20:01 |
| bknudson | dolphm: ok. | 20:01 |
| morganfainberg | portante, but i wanted to be sure there wasn't some case i wasn't seeing that swift was expecting | 20:01 |
| dolphm | bknudson: _('Programmer dun goofed.') | 20:01 |
| morganfainberg | portante, hence the question | 20:01 |
| morganfainberg | dolphm, ++ love that error message :) | 20:02 |
| morganfainberg | portante, much appreciated! thnaks for your time | 20:02 |
| portante | morganfainberg: sec | 20:02 |
| morganfainberg | dstanek, yes that was my interpretation | 20:03 |
| dolphm | morganfainberg: gordc: including pycadf in the identity program and renaming the identity program are on the TC agenda for today, meeting just started | 20:05 |
| morganfainberg | dolphm, ah, thanks i'll lurk. | 20:05 |
| *** cjellick has joined #openstack-keystone | 20:06 | |
| *** gabriel-bezerra has quit IRC | 20:06 | |
| *** gabriel-bezerra has joined #openstack-keystone | 20:06 | |
| *** cjellick has quit IRC | 20:07 | |
| *** cjellick has joined #openstack-keystone | 20:07 | |
| jamielennox | morganfainberg, dolphm: some very legitimate nits, thanks for passing it through anyway | 20:07 |
| jamielennox | s/nits/-1s | 20:07 |
| *** gabriel-bezerra has quit IRC | 20:14 | |
| *** gabriel-bezerra has joined #openstack-keystone | 20:14 | |
| *** gabriel-bezerra has quit IRC | 20:18 | |
| *** peluse_ has joined #openstack-keystone | 20:18 | |
| *** gabriel-bezerra has joined #openstack-keystone | 20:19 | |
| *** dims has joined #openstack-keystone | 20:19 | |
| *** david-lyle has quit IRC | 20:22 | |
| *** david-lyle has joined #openstack-keystone | 20:22 | |
| *** david-lyle has quit IRC | 20:27 | |
| *** david-lyle has joined #openstack-keystone | 20:27 | |
| *** gabriel-bezerra has quit IRC | 20:27 | |
| *** gabriel-bezerra has joined #openstack-keystone | 20:28 | |
| *** david-lyle has quit IRC | 20:28 | |
| *** david-lyle has joined #openstack-keystone | 20:29 | |
| *** lnxnut has quit IRC | 20:30 | |
| *** gabriel-bezerra has quit IRC | 20:46 | |
| *** gabriel-bezerra has joined #openstack-keystone | 20:47 | |
| *** lbragstad has quit IRC | 20:48 | |
| *** lbragstad has joined #openstack-keystone | 20:49 | |
| *** lbragstad has quit IRC | 20:53 | |
| *** gabriel-bezerra has quit IRC | 20:57 | |
| *** openstackgerrit has joined #openstack-keystone | 20:58 | |
| morganfainberg | dolphm, one of two things clearly positive there :) | 20:58 |
| dolphm | morganfainberg: yep! | 20:58 |
| bknudson | are we renaming or what? | 20:58 |
| morganfainberg | bknudson, not yet | 20:59 |
| dolphm | bknudson: probably not | 20:59 |
| dolphm | (yet) | 20:59 |
| morganfainberg | bknudson, but we are now +audit | 20:59 |
| morganfainberg | bknudson, or will be once that patch merges | 20:59 |
| dolphm | morganfainberg: well, it's not approved | 20:59 |
| *** gabriel-bezerra has joined #openstack-keystone | 20:59 | |
| morganfainberg | dolphm, true, but it wasn't a "no don't do that" result :) | 20:59 |
| dolphm | we have some homework to do to add some pythonic flair to pycadf though | 20:59 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Config fixture from oslo-incubator is not used. https://review.openstack.org/103998 | 21:00 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Use config fixture from oslo.config https://review.openstack.org/110138 | 21:00 |
| *** gabriel-bezerra has quit IRC | 21:00 | |
| *** gabriel-bezerra has joined #openstack-keystone | 21:01 | |
| morganfainberg | dolphm, it does look very java-eqsue | 21:03 |
| morganfainberg | dolphm, but it isn't bad / hard to follow. | 21:03 |
| dolphm | morganfainberg: it is, but it's consistently done and easy to read | 21:03 |
| morganfainberg | dolphm, yep | 21:03 |
| dolphm | morganfainberg: ++ | 21:03 |
| bknudson | maybe java is just a better language | 21:03 |
| * morganfainberg ducks and looks for the flamewar starting at bknudson's behest | 21:04 | |
| *** lbragstad has joined #openstack-keystone | 21:04 | |
| *** david-lyle has quit IRC | 21:05 | |
| *** david-lyle has joined #openstack-keystone | 21:06 | |
| *** lbragstad has quit IRC | 21:07 | |
| *** lbragstad has joined #openstack-keystone | 21:07 | |
| dolphm | morganfainberg: i'll file the bp to switch pycadf to xml and it'll be perfect | 21:08 |
| morganfainberg | hehe | 21:08 |
| morganfainberg | can we demand it is run in jython at all times? | 21:09 |
| *** david-lyle has quit IRC | 21:10 | |
| *** david-lyle has joined #openstack-keystone | 21:11 | |
| *** gabriel-bezerra has quit IRC | 21:11 | |
| dolphm | $ jython -m pycadf >> event.xml && echo put event.xml | ftp $AUDIT_HOST | 21:11 |
| dolphm | i'll update the docs | 21:11 |
| *** gabriel-bezerra has joined #openstack-keystone | 21:11 | |
| morganfainberg | dolphm, +1million | 21:13 |
| *** david-lyle has quit IRC | 21:15 | |
| *** mrmoje has joined #openstack-keystone | 21:17 | |
| bknudson | why does keystone depend on keystonemiddleware? | 21:17 |
| openstackgerrit | Harry Rybacki proposed a change to openstack/keystonemiddleware: Convert auth_token middleware to use sessions https://review.openstack.org/105031 | 21:17 |
| bknudson | `find keystone -name "*.py" | xargs grep keystonemiddleware` -- nothing | 21:18 |
| *** hrybacki_ has joined #openstack-keystone | 21:22 | |
| jamielennox | marekd|away: ping | 21:22 |
| *** jasondotstar has quit IRC | 21:25 | |
| *** hrybacki has quit IRC | 21:26 | |
| *** hrybacki_ has quit IRC | 21:26 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Remove fixture from openstack-common.conf https://review.openstack.org/103255 | 21:30 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Use config fixture from oslo.config https://review.openstack.org/103254 | 21:30 |
| dolphm | morganfainberg: ttx just noticed that we got 4 zeroes on https://bugs.launchpad.net/keystone/+bug/1350000 | 21:30 |
| uvirtbot | Launchpad bug 1350000 in keystone "UUID is a more friendly default token provider than PKI" [Wishlist,Triaged] | 21:30 |
| morganfainberg | bknudson, https://review.openstack.org/#/c/106478/ | 21:30 |
| morganfainberg | bknudson, i always add the dep before making code changes. | 21:31 |
| dolphm | <jeblair>: i too have no substantive comments other than feeling the bug number is friendly | 21:31 |
| morganfainberg | dolphm, lol! | 21:31 |
| bknudson | morganfainberg: I didn't see it as a dependency on the other review. | 21:31 |
| morganfainberg | bknudson, probably was rebased a couple times since and lost it's direct dep | 21:32 |
| morganfainberg | in gerrit | 21:32 |
| morganfainberg | or *shrug* | 21:32 |
| jamielennox | i think i agree with people that whilst we should incorporate auditing we should still be the 'identity' program | 21:32 |
| * jamielennox runs away | 21:32 | |
| *** notmyname has joined #openstack-keystone | 21:36 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 API https://review.openstack.org/86484 | 21:37 |
| dolphm | morganfainberg: what if we made keystone itself pluggable | 21:37 |
| morganfainberg | dolphm, explain? | 21:38 |
| *** markwash has joined #openstack-keystone | 21:38 | |
| *** gabriel-bezerra has quit IRC | 21:39 | |
| *** gabriel-bezerra has joined #openstack-keystone | 21:40 | |
| dolphm | morganfainberg: i'm just trying to figure out a copout to introduce backwards incompatible everything | 21:40 |
| morganfainberg | dolphm, nice | 21:41 |
| notmyname | I hear this is the place to be | 21:41 |
| lbragstad | dstanek: I rolled https://review.openstack.org/#/c/110335/ into the assignment API patch | 21:41 |
| morganfainberg | notmyname, shhh not so loud, it's a secret to everybody | 21:41 |
| morganfainberg | notmyname, http://www.secrettoeverybody.com/ | 21:42 |
| dstanek | lbragstad: cool, i'll rebase and push in a little bit then | 21:44 |
| lbragstad | dstanek: ok | 21:44 |
| markwash | if we were going to push kerberos or something similar further into the infrastructure of an openstack deployment (rather than just to authenticate token creation), what other protocols would need to be considered? | 21:47 |
| lbragstad | dstanek: I also have https://review.openstack.org/#/c/109098/ | 21:47 |
| markwash | saml maybe? | 21:48 |
| markwash | I don't even know what these protocols mean :-) | 21:48 |
| *** gordc has quit IRC | 21:49 | |
| *** lbragsta_ has joined #openstack-keystone | 21:51 | |
| *** lbragstad has quit IRC | 21:54 | |
| *** lbragsta_ has quit IRC | 21:55 | |
| jamielennox | gyee: still holding your -1 on https://review.openstack.org/#/c/107333/ ? | 21:57 |
| gyee | jamielennox, I don't have anything major objection with it, just concern about the need for it | 21:58 |
| bknudson | I don't know where you're getting the idea that auth_token middleware supports identity api v3... it authenticates with v2 and doesn't support domains. | 21:58 |
| gyee | I won't cry if you guys decided to go ahead with it | 21:58 |
| gyee | bknudson, huh? | 21:59 |
| gyee | bknudson, you mean getting the service user token? | 21:59 |
| bknudson | gyee: yes. | 21:59 |
| gyee | but we are changing it to use session | 22:00 |
| bknudson | gyee: ok... I don't see a proposal to have auth_token support identity v3 | 22:00 |
| bknudson | for auth | 22:00 |
| gyee | for token validation, its already v3 | 22:01 |
| gyee | we'll support service user authentication once the session patch is landed | 22:01 |
| bknudson | gyee: which one? | 22:01 |
| bknudson | gyee: https://review.openstack.org/#/c/105031/ ? | 22:01 |
| gyee | yes | 22:02 |
| *** gabriel-bezerra has quit IRC | 22:02 | |
| bknudson | that patch doesn't add support for v3 auth | 22:02 |
| *** gabriel-bezerra has joined #openstack-keystone | 22:02 | |
| gyee | bknudson, it needs to | 22:02 |
| bknudson | maybe that's a follow-on patch that hasn't been submitted yet | 22:03 |
| gyee | bknudson, want to put on up? Otherwise, I can do it | 22:04 |
| dolphm | $ tox -e py27 && git review #dropsmic | 22:04 |
| gyee | should be a trivial change | 22:04 |
| bknudson | gyee: if you put it up I'll review it. | 22:04 |
| gyee | bknudson, okie dokie | 22:04 |
| bknudson | gyee: jamielennox: can you use the config options code in sessions? | 22:04 |
| jamielennox | bknudson: what do you mean? | 22:05 |
| bknudson | jamielennox: is there code in sessions to generate an auth plugin from config options? | 22:05 |
| bknudson | or that provides config options? | 22:05 |
| jamielennox | yes | 22:05 |
| bknudson | and, can that be used in auth_token middleware? | 22:05 |
| jamielennox | it's in the most recent release | 22:05 |
| jamielennox | bknudson: i need 0.10 in global-requirements: https://review.openstack.org/#/c/108832/ | 22:06 |
| jamielennox | i've added everyone to the review, might need to bug some people in infra for it | 22:07 |
| *** gabriel-bezerra has quit IRC | 22:09 | |
| *** gabriel-bezerra has joined #openstack-keystone | 22:09 | |
| ayoung | jamielennox, I think discovery breaks on auth_url = kwargs.pop('auth_url', session.auth.auth_url) | 22:12 |
| ayoung | it seems that session.auth.auth_url gets evaluated first | 22:13 |
| jamielennox | ayoung: not following, where are you looking? | 22:13 |
| ayoung | so if session.auth is None, it fails, even if kwargs.pop('auth_url') would have returned a value | 22:13 |
| jamielennox | oh | 22:13 |
| jamielennox | you want | 22:13 |
| jamielennox | https://review.openstack.org/#/c/107570/ | 22:14 |
| ayoung | jamielennox, ah...is that in already...my repo must be out of date, but I think I see that change https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/discover.py | 22:14 |
| ayoung | jamielennox, cool, not the same fix, although I think there is something else upstream that would fix it | 22:15 |
| ayoung | in this case, discovery is authenticate: its from cinder | 22:15 |
| ayoung | ah...but not yet authenticated...ok, I'll pull that in. | 22:16 |
| *** jsavak has quit IRC | 22:16 | |
| jamielennox | so discovery being authed is a bit weird but paths like /v1/ for nova are authenticated paths so we default to authenticated | 22:17 |
| jamielennox | otherwise - what are your trying to do? | 22:17 |
| *** henrynash has quit IRC | 22:19 | |
| ayoung | jamielennox, yeah, you just basically rewrote it since last I used this git repo\ | 22:21 |
| jamielennox | heh | 22:21 |
| ayoung | jamielennox, its the kerberos stuff. I had everything working except for cinder.... | 22:21 |
| jamielennox | umm, it still won't automatically get session.auth.auth_url | 22:21 |
| jamielennox | that's not right anyway | 22:21 |
| *** jaosorior has quit IRC | 22:22 | |
| ayoung | jamielennox, that was fixed in ... | 22:24 |
| ayoung | um...wait | 22:26 |
| ayoung | jamielennox, commit 1ccefad0c6815f21ff32af9e774a8271c3ada6c5 introduced that | 22:27 |
| *** gabriel-bezerra has quit IRC | 22:28 | |
| *** gabriel-bezerra has joined #openstack-keystone | 22:29 | |
| *** bknudson has quit IRC | 22:30 | |
| ayoung | jamielennox, with http://paste.openstack.org/show/89033/ I was able to get further: | 22:35 |
| ayoung | jamielennox, I chopped /v3 off the auth url, and then | 22:35 |
| jamielennox | ayoung: that definitely feels like you are using it wrong | 22:36 |
| jamielennox | why don't you know the URL that you want to do discovery on? | 22:36 |
| ayoung | jamielennox, something created a session already | 22:36 |
| ayoung | this is cinder code | 22:36 |
| ayoung | so there is a session, but nothing in it? | 22:36 |
| jamielennox | cinder server has session code? | 22:36 |
| ayoung | /opt/stack/python-cinderclient/cinderclient/shell.py | 22:37 |
| ayoung | yeah | 22:37 |
| jamielennox | oh | 22:37 |
| jamielennox | uh, yea i've seen some of that | 22:37 |
| jamielennox | so what are you trying to do? | 22:37 |
| ayoung | jamielennox, cinder list | 22:37 |
| ayoung | just confirm that cinder works | 22:37 |
| jamielennox | using kerberos | 22:38 |
| ayoung | jamielennox, this started as a packstack install, and little by little I've been hacking it to talk to keysrtone in httpd | 22:38 |
| ayoung | no kerberos here yet | 22:38 |
| jamielennox | so i haven't tried the cinder shell code yet, what is it doing wrong? | 22:38 |
| ayoung | looking | 22:39 |
| jamielennox | because it feels like a cinderclient problem rather than something to fix in ksx | 22:39 |
| jamielennox | ksc | 22:39 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Set default token provider to UUID https://review.openstack.org/110488 | 22:39 |
| ayoung | jamielennox, that may well be true | 22:40 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Convert httpretty to requests-mock https://review.openstack.org/106659 | 22:48 |
| morganfainberg | jamielennox, ^ :) | 22:50 |
| ayoung | jamielennox, https://github.com/openstack/python-cinderclient/blob/master/cinderclient/shell.py#L793 | 22:52 |
| ayoung | so he creats a session in order to do discovery, but the is no auth plugin set. I think maybe just remove the session? | 22:52 |
| *** mtl11 has joined #openstack-keystone | 23:13 | |
| *** mtl1 has quit IRC | 23:14 | |
| *** dims has quit IRC | 23:14 | |
| *** bknudson has joined #openstack-keystone | 23:20 | |
| *** bknudson has quit IRC | 23:25 | |
| *** gabriel-bezerra has quit IRC | 23:25 | |
| *** gabriel-bezerra has joined #openstack-keystone | 23:26 | |
| *** bknudson has joined #openstack-keystone | 23:34 | |
| jamielennox | morganfainberg: woot! have do do it for middleware now | 23:40 |
| jamielennox | ayoung: i think he is discarding the session before it gets to the client | 23:41 |
| jamielennox | cinder doesn't actually have support for session internally | 23:41 |
| jamielennox | wait - they are passing it to the client | 23:43 |
| jamielennox | whoa - wtf | 23:44 |
| jamielennox | :O cinder has gone ahead and adopted the session | 23:45 |
| jamielennox | i forget that none of the other clients care about stability as much as us | 23:47 |
| jamielennox | cinderclient done - no idea if that works | 23:48 |
| *** cjellick has quit IRC | 23:48 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!