| *** david-lyle has quit IRC | 00:03 | |
| lbragstad | dstanek: yep | 00:07 |
|---|---|---|
| lbragstad | sorry about that, I was just about to push that patch | 00:07 |
| lbragstad | dstanek: our keystone/common/serializer.py files looked exactly the same after I fixed the comments :) | 00:08 |
| lbragstad | dstanek: nice work on the tests | 00:10 |
| dstanek | lbragstad: hey, yeah i just went ahead and pushed | 00:11 |
| *** gokrokve has quit IRC | 00:13 | |
| lbragstad | dstanek: thanks | 00:18 |
| *** yasukun has joined #openstack-keystone | 00:18 | |
| *** marcoemorais has quit IRC | 00:24 | |
| ayoung | bknudson, did nkinder talk with you about https://review.openstack.org/#/c/109120/5/keystone/tests/test_v3_auth.py ? Cus it looks like those comments really were for a different patch | 00:24 |
| *** marcoemorais has joined #openstack-keystone | 00:24 | |
| *** marcoemorais has quit IRC | 00:24 | |
| *** marcoemorais has joined #openstack-keystone | 00:24 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: Add OS-FEDERATION section to scoped federation tokens https://review.openstack.org/111873 | 00:34 |
| *** stevemar is now known as maybeiamstevemar | 00:35 | |
| *** shakamunyi has quit IRC | 00:43 | |
| bknudson | ayoung: he commented in the review | 00:49 |
| ayoung | bknudson, was it meant for the othe r review, though? THe revocation events? | 00:49 |
| bknudson | ayoung: no, I thought he was relying on revocation in his tests | 00:49 |
| *** amcrn has quit IRC | 00:51 | |
| *** xianghui has quit IRC | 00:53 | |
| *** gyee has quit IRC | 00:59 | |
| *** xianghui has joined #openstack-keystone | 01:05 | |
| *** richm has quit IRC | 01:19 | |
| *** gokrokve has joined #openstack-keystone | 01:23 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Use token and discovery fixture in identity tests https://review.openstack.org/107554 | 01:32 |
| *** morganfainberg_Z is now known as morganfainberg | 01:35 | |
| openstackgerrit | A change was merged to openstack/keystone: Fix revoking a scoped token from an unscoped token https://review.openstack.org/109389 | 01:37 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Refactor serializer import to XmlBodyMiddleware https://review.openstack.org/111108 | 01:41 |
| *** shakamunyi has joined #openstack-keystone | 01:54 | |
| *** diegows has quit IRC | 01:55 | |
| *** marcoemorais has quit IRC | 02:06 | |
| *** shakamunyi has quit IRC | 02:07 | |
| *** shakamunyi has joined #openstack-keystone | 02:22 | |
| *** jorge_munoz has joined #openstack-keystone | 02:24 | |
| *** gokrokve_ has joined #openstack-keystone | 02:35 | |
| *** gokrokve_ has quit IRC | 02:35 | |
| *** gokrokve_ has joined #openstack-keystone | 02:35 | |
| *** browne has quit IRC | 02:36 | |
| *** hrybacki has joined #openstack-keystone | 02:36 | |
| *** gokrokve has quit IRC | 02:38 | |
| *** gokrokve has joined #openstack-keystone | 02:45 | |
| *** gokrokve_ has quit IRC | 02:49 | |
| *** jorge_munoz has quit IRC | 02:51 | |
| *** hrybacki has quit IRC | 02:51 | |
| *** jimbaker has quit IRC | 02:56 | |
| *** jimbaker has joined #openstack-keystone | 02:56 | |
| *** jimbaker has quit IRC | 02:56 | |
| *** jimbaker has joined #openstack-keystone | 02:56 | |
| *** gokrokve has quit IRC | 03:01 | |
| openstackgerrit | Jeffrey Zhang proposed a change to openstack/keystone: Redirect stdout and stderr when using subprocess https://review.openstack.org/51610 | 03:04 |
| *** jorge_munoz has joined #openstack-keystone | 03:14 | |
| *** browne has joined #openstack-keystone | 03:15 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Refactor serializer import to XmlBodyMiddleware https://review.openstack.org/111108 | 03:19 |
| *** yasukun has quit IRC | 03:25 | |
| *** jorge_munoz has quit IRC | 03:29 | |
| *** jorge_munoz has joined #openstack-keystone | 03:30 | |
| *** gokrokve has joined #openstack-keystone | 03:31 | |
| *** gokrokve_ has joined #openstack-keystone | 03:33 | |
| *** gokrokve has quit IRC | 03:33 | |
| dstanek | the channel has been super quiet lately | 03:38 |
| maybeiamstevemar | dstanek, howdy partner | 03:38 |
| dstanek | maybeiamstevemar: hey | 03:39 |
| dstanek | maybeiamstevemar: maybe not? | 03:39 |
| dstanek | morganfainberg: i hate databases! | 03:40 |
| maybeiamstevemar | dstanek, i added you to a review if that makes ya feel better | 03:41 |
| dstanek | maybeiamstevemar: what review? | 03:41 |
| maybeiamstevemar | dstanek, https://review.openstack.org/#/c/111657/ | 03:41 |
| maybeiamstevemar | dstanek, i've got like 10 open in keystone, just pick one :P | 03:41 |
| *** gokrokve_ has quit IRC | 03:41 | |
| dstanek | maybeiamstevemar: haha, i'll start going through them for ya | 03:42 |
| maybeiamstevemar | woo hoo | 03:42 |
| *** gokrokve has joined #openstack-keystone | 03:42 | |
| dstanek | maybeiamstevemar: this one made me think https://review.openstack.org/#/c/111841/1/keystone/assignment/backends/sql.py - mostly to make sure my comments were coherent | 03:42 |
| dstanek | maybeiamstevemar: i probably shouldn't be doing reviews this late | 03:43 |
| maybeiamstevemar | dstanek, if it helps, most of mine are tiny changes | 03:44 |
| maybeiamstevemar | got an identity-api one queued up too | 03:44 |
| *** gokrokve has quit IRC | 03:46 | |
| openstackgerrit | wanghong proposed a change to openstack/python-keystoneclient: expose the revoke token for V3 https://review.openstack.org/102701 | 03:49 |
| *** gokrokve has joined #openstack-keystone | 03:54 | |
| openstackgerrit | A change was merged to openstack/keystone: Improve instructions about federation https://review.openstack.org/111709 | 03:56 |
| *** ayoung has quit IRC | 03:57 | |
| openstackgerrit | wanghong proposed a change to openstack/python-keystoneclient: expose the revoke token for V3 https://review.openstack.org/102701 | 03:59 |
| morganfainberg | maybeiamstevemar isn't it a holiday | 04:07 |
| morganfainberg | maybeiamstevemar or was... WHY ARE YOU HERE? | 04:07 |
| morganfainberg | dstanek, why do you hate databases? | 04:08 |
| maybeiamstevemar | morganfainberg, it is, but ... i dunno | 04:09 |
| maybeiamstevemar | morganfainberg, i'm off tmrw too | 04:10 |
| *** shausy has joined #openstack-keystone | 04:15 | |
| *** gokrokve has quit IRC | 04:21 | |
| *** gokrokve has joined #openstack-keystone | 04:22 | |
| *** jorge_munoz has left #openstack-keystone | 04:22 | |
| *** yasukun has joined #openstack-keystone | 04:23 | |
| *** gokrokve has quit IRC | 04:26 | |
| *** gokrokve has joined #openstack-keystone | 04:32 | |
| *** k4n0 has joined #openstack-keystone | 04:43 | |
| *** ajayaa has joined #openstack-keystone | 04:46 | |
| *** ajayaa has quit IRC | 04:47 | |
| *** ajayaa has joined #openstack-keystone | 04:50 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Refactor serializer import to XmlBodyMiddleware https://review.openstack.org/111108 | 04:51 |
| *** gokrokve has quit IRC | 04:53 | |
| *** gokrokve has joined #openstack-keystone | 04:54 | |
| *** morganfainberg is now known as morganfainberg_Z | 04:54 | |
| *** gokrokve has quit IRC | 04:58 | |
| *** gokrokve has joined #openstack-keystone | 05:00 | |
| *** jaosorior has joined #openstack-keystone | 05:18 | |
| *** afazekas has quit IRC | 05:19 | |
| *** chandankumar has joined #openstack-keystone | 05:27 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystonemiddleware: Use oslosphinx in keystonemiddlware for documentation https://review.openstack.org/111909 | 05:28 |
| *** browne has quit IRC | 05:29 | |
| *** hrybacki has joined #openstack-keystone | 05:31 | |
| *** ajayaa has quit IRC | 05:33 | |
| *** hrybacki_ has joined #openstack-keystone | 05:38 | |
| *** hrybacki has quit IRC | 05:38 | |
| *** shakamunyi has quit IRC | 05:42 | |
| *** afazekas has joined #openstack-keystone | 05:45 | |
| *** ajayaa has joined #openstack-keystone | 05:53 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/111920 | 06:05 |
| *** gokrokve has quit IRC | 06:06 | |
| *** shakamunyi has joined #openstack-keystone | 06:09 | |
| *** shakamunyi has quit IRC | 06:24 | |
| *** shausy has quit IRC | 06:24 | |
| *** shausy has joined #openstack-keystone | 06:25 | |
| openstackgerrit | Jeffrey Zhang proposed a change to openstack/keystone: Redirect stdout and stderr when using subprocess https://review.openstack.org/51610 | 06:28 |
| *** gokrokve has joined #openstack-keystone | 06:33 | |
| *** gokrokve has quit IRC | 06:34 | |
| *** gokrokve has joined #openstack-keystone | 06:35 | |
| *** gokrokve has quit IRC | 06:40 | |
| *** shakamunyi has joined #openstack-keystone | 06:50 | |
| *** shakamunyi has quit IRC | 06:58 | |
| *** hrybacki_ has quit IRC | 07:14 | |
| *** chandankumar has quit IRC | 07:21 | |
| *** chandankumar has joined #openstack-keystone | 07:23 | |
| *** chandankumar has quit IRC | 07:23 | |
| *** chandankumar has joined #openstack-keystone | 07:24 | |
| openstackgerrit | wanghong proposed a change to openstack/python-keystoneclient: move attributes of v3.client.Client into alphabetical order https://review.openstack.org/111939 | 07:28 |
| *** gokrokve has joined #openstack-keystone | 07:35 | |
| *** gokrokve has quit IRC | 07:40 | |
| *** ajayaa has quit IRC | 07:48 | |
| *** shakamunyi has joined #openstack-keystone | 07:55 | |
| *** rwsu has quit IRC | 07:59 | |
| *** maybeiamstevemar has quit IRC | 08:06 | |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 08:08 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Add docs for how to create an OAuth auth instance https://review.openstack.org/109013 | 08:08 |
| *** shakamunyi has quit IRC | 08:10 | |
| *** ajayaa has joined #openstack-keystone | 08:16 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Surround REMOTE_USER variable name with quotes. https://review.openstack.org/111951 | 08:30 |
| *** gokrokve has joined #openstack-keystone | 08:35 | |
| *** gokrokve has quit IRC | 08:37 | |
| *** gokrokve has joined #openstack-keystone | 08:37 | |
| openstackgerrit | Matthieu Huin proposed a change to openstack/keystone: Check for empty string value in REMOTE_USER https://review.openstack.org/111953 | 08:41 |
| *** gokrokve has quit IRC | 08:41 | |
| marekd | mhu: hey! did you manage to setup your cloud yesterday? | 08:51 |
| marekd | mhu: your federated cloud. | 08:51 |
| mhu | marekd, yep ! Thanks to you | 08:51 |
| marekd | mhu: ehe, you found where the problem was :-) | 08:52 |
| mhu | I get my unscoped tokens alright, and my mapping works correctly | 08:52 |
| marekd | great | 08:52 |
| marekd | !!!! | 08:52 |
| mhu | marekd, yep, therefore the patch I just submitted | 08:52 |
| openstack | marekd: Error: "!!!" is not a valid command. | 08:52 |
| marekd | sorry, openstack | 08:53 |
| marekd | mhu: i just commented on your patch. | 08:53 |
| mhu | marekd, I am in the process of documenting every step that needs to be taken to set up a federation environment, Idp, SP, keystone | 08:53 |
| mhu | I believe it isn't an easy task and the community could use it | 08:54 |
| marekd | mhu: hm, docs on developer.openstack.org are not enough? | 08:54 |
| marekd | mhu: regarding SP at least. | 08:54 |
| marekd | mhu: or..i shall say Keystone side in general. | 08:54 |
| mhu | marekd, they're good as an entry point, but I thought it'd be interesting to get the whole picture | 08:56 |
| marekd | mhu: of course. | 08:56 |
| marekd | i am not trying to discourage you | 08:56 |
| mhu | and also some insights about how to define assertions, for example | 08:56 |
| marekd | uhm. | 08:57 |
| mhu | marekd, no worries | 08:57 |
| marekd | mhu: hah, they are not night owls, they are simply in the different timezone :-) | 08:57 |
| marekd | of, there is one night owl cc/ dolphm | 08:58 |
| mhu | marekd, i will add a test for https://review.openstack.org/111953 but I have to fix something weird with tox and pip first, pip can't seem to fetch the right version of oslo.config from the requirements | 08:59 |
| marekd | :( | 09:00 |
| mhu | therefore I can't run tox on my local changes ... not so great | 09:00 |
| marekd | mhu: have you tried tox -repep8 ? | 09:00 |
| mhu | tox --recreate yes | 09:01 |
| marekd | you can try cloning the keystone repo to other dir, say /tmp and see if that helps. | 09:01 |
| marekd | i mean clone repo from github/openstack | 09:01 |
| mhu | marekd, no success :( | 09:13 |
| marekd | mhu: :L( | 09:13 |
| mhu | pip complains about not finding the right version of oslo.config: "Could not find a version that satisfies the requirement oslo.config>=1.4.0.0a3 (from -r /tmp/keystone/requirements.txt (line 18)) (from versions: 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.3.0)" | 09:14 |
| mhu | which is weird since oslo.config 1.4.0.0a3 has been on pypi for about a month | 09:14 |
| *** oomichi has quit IRC | 09:16 | |
| marekd | mhu: globally i have pip1.4.0.0a3 | 09:16 |
| marekd | but in my virtualenv for py27 i have 1.3.0 | 09:16 |
| mhu | oslo.config you mean ? | 09:16 |
| marekd | oh, yes. | 09:16 |
| marekd | oslo.config | 09:16 |
| marekd | but maybe my env is little bit outdated. | 09:17 |
| mhu | it'd be according to the current requirements | 09:18 |
| marekd | just pip install --upgrade -requirements not in your virtualenv | 09:18 |
| marekd | pip install --upgrade -r requiements.txt -r test-requirements.txt | 09:20 |
| openstackgerrit | A change was merged to openstack/keystone: Fix revocation event handling with MySQL https://review.openstack.org/111106 | 09:25 |
| mhu | marekd, it worked outside of the venv, but I still get the error when running tox ... it's really weird. I'll ask around and see if someone's got an idea | 09:26 |
| marekd | i'd change oslo.config for now | 09:27 |
| marekd | to 1.3 | 09:27 |
| marekd | 1.3.0 | 09:27 |
| mhu | marekd, yeah I can try this, hopefully it won't break stuff | 09:28 |
| marekd | well, then you can always rebuild it with proper requirements | 09:28 |
| marekd | it's only virtual env | 09:28 |
| marekd | it will not affect your global configuration. | 09:28 |
| marekd | rm -rf will do the job. | 09:28 |
| mhu | as long as the tests run :) | 09:29 |
| *** gokrokve has joined #openstack-keystone | 09:36 | |
| *** yasukun has quit IRC | 09:38 | |
| *** gokrokve has quit IRC | 09:43 | |
| *** shakamunyi has joined #openstack-keystone | 09:57 | |
| *** shakamunyi has quit IRC | 10:01 | |
| *** kwss has joined #openstack-keystone | 10:34 | |
| *** gokrokve has joined #openstack-keystone | 10:35 | |
| *** gokrokve has quit IRC | 10:40 | |
| *** chandankumar has quit IRC | 10:42 | |
| *** ajayaa has quit IRC | 10:58 | |
| *** chandankumar has joined #openstack-keystone | 11:00 | |
| *** ajayaa has joined #openstack-keystone | 11:02 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Make email a first class attribute of the user entity. https://review.openstack.org/111982 | 11:25 |
| *** diegows has joined #openstack-keystone | 11:25 | |
| *** gokrokve has joined #openstack-keystone | 11:35 | |
| *** chandankumar has quit IRC | 11:37 | |
| *** shausy2 has joined #openstack-keystone | 11:38 | |
| *** shausy has quit IRC | 11:38 | |
| *** chandankumar has joined #openstack-keystone | 11:38 | |
| *** gokrokve has quit IRC | 11:40 | |
| *** ajayaa has quit IRC | 11:42 | |
| *** shakamunyi has joined #openstack-keystone | 11:48 | |
| *** shakamunyi has quit IRC | 11:58 | |
| *** chandankumar has quit IRC | 12:02 | |
| *** ajayaa has joined #openstack-keystone | 12:02 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Add parent_project_id field https://review.openstack.org/111840 | 12:16 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Add parent_project_id field https://review.openstack.org/111840 | 12:17 |
| *** chandankumar has joined #openstack-keystone | 12:21 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Add parent_project_id field https://review.openstack.org/111840 | 12:25 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Base methods to handle hierarchical projects https://review.openstack.org/111841 | 12:26 |
| *** ajayaa has quit IRC | 12:32 | |
| *** gokrokve has joined #openstack-keystone | 12:35 | |
| *** gokrokve has quit IRC | 12:39 | |
| *** cjellick has joined #openstack-keystone | 12:42 | |
| *** miqui has joined #openstack-keystone | 12:42 | |
| *** cjellick has quit IRC | 12:42 | |
| *** cjellick has joined #openstack-keystone | 12:43 | |
| *** radez_g0n3 is now known as radez | 12:43 | |
| *** cjellick has quit IRC | 12:44 | |
| *** cjellick has joined #openstack-keystone | 12:44 | |
| *** k4n0 has quit IRC | 12:50 | |
| *** henrynash has joined #openstack-keystone | 12:54 | |
| *** tomoiaga has joined #openstack-keystone | 12:55 | |
| *** gordc has joined #openstack-keystone | 13:02 | |
| *** jasondotstar has joined #openstack-keystone | 13:03 | |
| *** ajayaa has joined #openstack-keystone | 13:06 | |
| *** vishy has quit IRC | 13:07 | |
| *** ajayaa has quit IRC | 13:07 | |
| *** comstud has quit IRC | 13:09 | |
| *** vishy has joined #openstack-keystone | 13:09 | |
| *** dtroyer has quit IRC | 13:12 | |
| *** mgagne has quit IRC | 13:12 | |
| *** dhellmann_ is now known as dhellmann | 13:12 | |
| *** mgagne has joined #openstack-keystone | 13:13 | |
| *** mgagne is now known as Guest27295 | 13:13 | |
| *** gordc has quit IRC | 13:14 | |
| *** rharwood has quit IRC | 13:14 | |
| *** jamielennox|away has quit IRC | 13:14 | |
| *** rodrigods has quit IRC | 13:14 | |
| *** nonameentername has quit IRC | 13:14 | |
| *** chmouel has quit IRC | 13:14 | |
| *** morganfainberg_Z has quit IRC | 13:14 | |
| *** comstud has joined #openstack-keystone | 13:14 | |
| *** gordc has joined #openstack-keystone | 13:15 | |
| *** rharwood has joined #openstack-keystone | 13:15 | |
| *** nonameentername has joined #openstack-keystone | 13:15 | |
| *** jamielennox|away has joined #openstack-keystone | 13:15 | |
| *** rodrigods has joined #openstack-keystone | 13:15 | |
| *** chmouel has joined #openstack-keystone | 13:15 | |
| *** morganfainberg_Z has joined #openstack-keystone | 13:15 | |
| *** dickson.freenode.net sets mode: +o morganfainberg_Z | 13:15 | |
| *** dtroyer has joined #openstack-keystone | 13:15 | |
| *** lbragstad has quit IRC | 13:18 | |
| *** vishy has quit IRC | 13:21 | |
| *** lbragstad has joined #openstack-keystone | 13:23 | |
| *** vishy has joined #openstack-keystone | 13:24 | |
| *** joesavak has joined #openstack-keystone | 13:26 | |
| *** dhellmann has quit IRC | 13:32 | |
| *** dhellmann has joined #openstack-keystone | 13:33 | |
| *** gokrokve has joined #openstack-keystone | 13:35 | |
| *** dhellmann has quit IRC | 13:36 | |
| *** dhellmann has joined #openstack-keystone | 13:39 | |
| *** gokrokve has quit IRC | 13:40 | |
| *** shakamunyi has joined #openstack-keystone | 13:42 | |
| *** shakamunyi has quit IRC | 13:49 | |
| *** ajayaa has joined #openstack-keystone | 13:59 | |
| *** shausy2 has quit IRC | 14:00 | |
| *** richm has joined #openstack-keystone | 14:06 | |
| *** ayoung has joined #openstack-keystone | 14:08 | |
| *** vishy has quit IRC | 14:09 | |
| *** gokrokve has joined #openstack-keystone | 14:10 | |
| *** shakamunyi has joined #openstack-keystone | 14:11 | |
| *** vishy has joined #openstack-keystone | 14:12 | |
| *** gokrokve has quit IRC | 14:20 | |
| *** gokrokve has joined #openstack-keystone | 14:21 | |
| *** vhoward has joined #openstack-keystone | 14:21 | |
| *** ajayaa has quit IRC | 14:22 | |
| *** gokrokve has quit IRC | 14:25 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Base methods to handle hierarchical projects https://review.openstack.org/111841 | 14:27 |
| *** david-lyle has joined #openstack-keystone | 14:28 | |
| *** shakamunyi has quit IRC | 14:32 | |
| *** david-ly_ has joined #openstack-keystone | 14:34 | |
| *** david-ly_ is now known as david-lyle_ | 14:35 | |
| *** hrybacki has joined #openstack-keystone | 14:37 | |
| *** david-lyle has quit IRC | 14:38 | |
| *** KimJ has joined #openstack-keystone | 14:41 | |
| *** david-lyle_ is now known as david-lyle | 14:48 | |
| *** henrynash has quit IRC | 14:58 | |
| *** ukalifon has joined #openstack-keystone | 15:03 | |
| *** gokrokve has joined #openstack-keystone | 15:06 | |
| *** chandankumar has quit IRC | 15:07 | |
| *** jorge_munoz has joined #openstack-keystone | 15:10 | |
| *** shakamunyi has joined #openstack-keystone | 15:12 | |
| *** jorge_munoz has quit IRC | 15:13 | |
| *** thedodd has joined #openstack-keystone | 15:14 | |
| *** shausy has joined #openstack-keystone | 15:18 | |
| *** ukalifon has quit IRC | 15:24 | |
| *** doddstack has joined #openstack-keystone | 15:25 | |
| *** thedodd has quit IRC | 15:26 | |
| *** shakamunyi has quit IRC | 15:28 | |
| *** med_ has joined #openstack-keystone | 15:31 | |
| *** med_ has joined #openstack-keystone | 15:31 | |
| *** med_ is now known as Guest26240 | 15:31 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Create, update and delete hierarchical projects https://review.openstack.org/111842 | 15:36 |
| *** jorge_munoz has joined #openstack-keystone | 15:41 | |
| marekd | dstanek: I am having a big XML object (template) which obviously extends 80 character lines. I don't want to break them and put within """ """. Any quick idea how to store this and do this in a Pythonic way? | 15:43 |
| *** jorge_munoz has quit IRC | 15:47 | |
| *** gokrokve_ has joined #openstack-keystone | 15:55 | |
| *** marcoemorais has joined #openstack-keystone | 15:56 | |
| dolphm | *** family emergency - I'll be MIA for today's meetings (keystone & cross project) *** | 15:57 |
| *** shausy has quit IRC | 15:57 | |
| *** jimbaker has quit IRC | 15:58 | |
| hrybacki | the non-discrete preoperties of a DevStack install never cease to amaze me | 15:58 |
| *** gokrokve has quit IRC | 15:58 | |
| *** marcoemorais has quit IRC | 16:02 | |
| *** marcoemorais has joined #openstack-keystone | 16:02 | |
| dstanek | marekd: do you have an example somewhere? | 16:02 |
| dstanek | dolphm: hope things are alright | 16:02 |
| *** jimbaker has joined #openstack-keystone | 16:02 | |
| *** jimbaker has quit IRC | 16:02 | |
| *** jimbaker has joined #openstack-keystone | 16:02 | |
| bknudson | I should have these security fixes for revocation events backported soon. | 16:03 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: SAML2 federated authentication for ADFS. https://review.openstack.org/111771 | 16:06 |
| marekd | dstanek: https://review.openstack.org/#/c/111771/2/keystoneclient/contrib/auth/v3/core.py something like this for now | 16:06 |
| marekd | dstanek: (i used tuple instead of """ """) so it's like one big line for the Python interpreter) | 16:07 |
| bknudson | that's not a tuple. it would need a , to be a tuple. | 16:08 |
| *** jimbaker has quit IRC | 16:08 | |
| dstanek | marekd: why not triple quotes? | 16:08 |
| bknudson | also, we should be using a library to build a document not hardcoding it. | 16:09 |
| marekd | dstanek: because the xml will include \n and when I send them to the server it simply responds with HTTP 500 | 16:09 |
| dstanek | marekd: really? the server won't process XML with newlines? | 16:10 |
| bknudson | it's also dangerous because the replacement text has to be encoded properly | 16:10 |
| marekd | dstanek: i also think it should, but sometimes namespaces are longer than 80 characters | 16:10 |
| marekd | dstanek: i i am guessing "http://blah.blah.blab\n.com/server/claim/blah\n" is not parsed correctly. | 16:11 |
| dstanek | marekd: i'm personally fine with lines that are longer than 80 characters if it's data like this - not sure about the OpenStack stance | 16:12 |
| marekd | pep8 will verylikely complain. | 16:12 |
| bknudson | it won't pass pep8 | 16:12 |
| marekd | bknudson: ++ | 16:12 |
| bknudson | I think you can put a \ at the end of the line for no \n | 16:12 |
| marekd | bknudson: i was thinking the same thing. | 16:13 |
| marekd | bknudson: all in all it will look like a mangled piece of text | 16:13 |
| marekd | without any hierarchy | 16:13 |
| *** stevemar has joined #openstack-keystone | 16:13 | |
| bknudson | marekd: build it using some kind of DOM library | 16:13 |
| bknudson | then the replacements can be done safely | 16:13 |
| marekd | usually such libraries don't obey 80 chars limit. | 16:14 |
| marekd | i think/ | 16:14 |
| marekd | but let me see again. | 16:14 |
| bknudson | I mean you wouldn't even have the string constant, instead create the DOM and convert it to a string. | 16:15 |
| marekd | bknudson: ah | 16:16 |
| marekd | i can do that | 16:16 |
| marekd | bknudson: but one question. | 16:16 |
| marekd | bknudson: the best way to serialize such object? | 16:16 |
| *** openstackstatus has quit IRC | 16:17 | |
| *** openstack has joined #openstack-keystone | 16:17 | |
| bknudson | marekd: serialize it for what? | 16:17 |
| *** openstackstatus has joined #openstack-keystone | 16:18 | |
| *** ChanServ sets mode: +v openstackstatus | 16:18 | |
| bknudson | marekd: https://docs.python.org/2/library/xml.etree.elementtree.html#xml.etree.ElementTree.tostring | 16:18 |
| marekd | bknudson: yeah, i am using that. | 16:18 |
| marekd | but i will need to somehow store ElementTree object so it's ready to be read when I run my code. | 16:19 |
| *** kwss has quit IRC | 16:19 | |
| marekd | i can either manyally prepare ElementTree object, serialize, save to a file and write code: read this, this is the XML object, now make a string out of it" | 16:20 |
| marekd | or i need to save a string const | 16:20 |
| marekd | (and i am doing this now) | 16:20 |
| bknudson | is it too slow to build the ElementTree each time rather than loading it? | 16:21 |
| *** tomoiaga has quit IRC | 16:23 | |
| marekd | i don't think it's too slow but i need some input to build it for instance this ugly creature: https://review.openstack.org/#/c/111771/2/keystoneclient/contrib/auth/v3/core.py | 16:25 |
| marekd | anyways, if you are fine with that i am also fine. | 16:25 |
| bknudson | I'd prefer that we build the XML doc. | 16:26 |
| bknudson | then the XML library will also handle properly escaping | 16:26 |
| marekd | build from input string? | 16:27 |
| bknudson | like def create_adfs_request_security_token_doc(adfs_url, date_created, ... ): envelope = XML.Element('Envelope'); envelope.add_child(XML.Element('Header')); ... | 16:27 |
| bknudson | I don't know what the actual interface is to the XML library. | 16:28 |
| *** henrynash has joined #openstack-keystone | 16:28 | |
| marekd | bknudson: ok i see your point. | 16:28 |
| *** doddstack has quit IRC | 16:30 | |
| *** rwsu has joined #openstack-keystone | 16:43 | |
| dstanek | morganfainberg_Z: i hate relational DBs because you have model data to the lowest common denominator - https://review.openstack.org/#/c/111841/1/keystone/assignment/backends/sql.py | 16:45 |
| *** gyee has joined #openstack-keystone | 16:48 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 16:50 |
| *** gyee has quit IRC | 16:52 | |
| *** marcoemorais has quit IRC | 16:53 | |
| *** marcoemorais has joined #openstack-keystone | 16:53 | |
| *** morganfainberg_Z is now known as morganfainberg | 16:55 | |
| *** gyee has joined #openstack-keystone | 16:55 | |
| morganfainberg | dstanek, ahh | 16:55 |
| *** mrmoje has joined #openstack-keystone | 17:00 | |
| bknudson | I ran into an issue of the backport for the mysql fix... test_revoke's test_cleanup might try to add the same expiration event if it takes < 1 second to get through the loop. | 17:00 |
| bknudson | not sure why we didn't see this in master. | 17:01 |
| *** ajayaa has joined #openstack-keystone | 17:07 | |
| lbragstad | stevemar: lxml should be moved from requirement-py3.txt to test-requirements-py3.txt as well, correct? https://review.openstack.org/#/c/111108/ | 17:22 |
| ayoung | bknudson, I saw that at some point | 17:23 |
| ayoung | I need to refresh my memory, but there is code in the test to deal with that | 17:23 |
| stevemar | lbragstad, me think so | 17:23 |
| lbragstad | stevemar: I removed it from requirements.txt and requirements-py3.txt | 17:23 |
| stevemar | not sure how to -py3 stuff works | 17:23 |
| lbragstad | stevemar: ok, I'll push another patch adding it to test-requirement-py3.txt | 17:23 |
| ayoung | bknudson, adding the same revocation event twice should be harmless. | 17:24 |
| lbragstad | stevemar: I think dstanek is the master mind behind that work | 17:24 |
| ayoung | the way revocations are evaluated, only the "latest" one affects change, and two duplicates would end up being one node in the tree | 17:24 |
| dstanek | lbragstad: stevemar: it's really handled by infra tooling | 17:25 |
| stevemar | dstanek, lbragstad sounds like there is no need to update it then | 17:26 |
| lbragstad | I'll leave as is then | 17:26 |
| dstanek | stevemar: what needs to be updated | 17:26 |
| dstanek | ? | 17:26 |
| lbragstad | moving lxml from requirements to test-requirements | 17:26 |
| stevemar | dstanek, if lbragstad wants to move ^ | 17:26 |
| dstanek | stevemar: lbragstad: ah, you still have to edit manually like you would with the py2 requirements | 17:27 |
| lbragstad | dstanek: we moved lxml from requirements.txt to test-requirements.txt | 17:27 |
| lbragstad | dstanek: wondering if we should do the same for py3 requirements files | 17:27 |
| dstanek | lbragstad: yeah, you'll need to do the same in the py3 files too | 17:27 |
| lbragstad | ok | 17:27 |
| marekd | lbragstad: why are you moving lxml to test-requirements? | 17:29 |
| lbragstad | lxml is still used by unit tests in keystone | 17:29 |
| lbragstad | but is no longer a hard requirement for Kesytone | 17:29 |
| marekd | lbragstad: i am using it. | 17:29 |
| lbragstad | you should still be able to use it | 17:30 |
| marekd | lbragstad: ah forget it :-) i am using it in keystoneclient, LOL | 17:30 |
| marekd | anyway i think we will need it for k2k | 17:30 |
| marekd | ok, nevermind. | 17:31 |
| marekd | do whatever you need to do :-) | 17:31 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Make token_provider_api contain token persistence https://review.openstack.org/109041 | 17:31 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Refactor serializer import to XmlBodyMiddleware https://review.openstack.org/111108 | 17:31 |
| *** abhishek has joined #openstack-keystone | 17:33 | |
| dstanek | stevemar: looking at https://review.openstack.org/#/c/111657 now - how to i know what the format should look like? | 17:37 |
| stevemar | dstanek, line 48, same file | 17:41 |
| morganfainberg | lbragstad, marekd, if we need to move it *back* for k2k, we move it back | 17:43 |
| abhishek | hi all, can any one review this patch, https://review.openstack.org/107482 | 17:43 |
| abhishek | thank you | 17:43 |
| marekd | morganfainberg: yep. | 17:43 |
| *** amcrn has joined #openstack-keystone | 17:43 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Create, update and delete hierarchical projects https://review.openstack.org/111842 | 17:43 |
| dstanek | abhishek: you're reset is still empty | 17:44 |
| dstanek | lol or *your* | 17:44 |
| morganfainberg | abhishek, other question, why remove the .listen() ? | 17:45 |
| abhishek | dstanek:tes | 17:45 |
| abhishek | *yes | 17:45 |
| morganfainberg | abhishek, admittedly i haven't tried it, but i don't see a call to .listen anywhere, is that no longer needed? | 17:45 |
| abhishek | morganfainber:yes its no longer needed | 17:46 |
| dstanek | abhishek: i still don't like putting the listen in the __init__ - i think it is better as a separate method | 17:46 |
| dstanek | morganfainberg: that's because the logic was moved to the class __init__ | 17:47 |
| morganfainberg | dstanek, ah i see it now | 17:47 |
| abhishek | dstanek:but in that case when you send the sighup signal then it will throw the Bad file descritor error | 17:47 |
| morganfainberg | dstanek, ++ i tend to agree | 17:48 |
| dstanek | abhishek: that's only if the listen is called more than once | 17:48 |
| ayoung | marekd, got a question for you. For SAML (WebSSO BP) what if Horizon redirected the user to the SAML login, got the SAML assertion, and then sent the assertion to Keystone to get the token? No WebUI in Keystone. | 17:48 |
| marekd | ayoung: no webui | 17:48 |
| ayoung | marekd, all the WebUI would be confined to Horizon | 17:48 |
| ayoung | we can make an additional changes we need in Keystone to support that, though | 17:49 |
| dstanek | abhishek: why is the reset empty? | 17:49 |
| ayoung | so if the workflow needs to be stared in Keystone, the Horizon webuid could make a call to prep-for-saml | 17:49 |
| dstanek | abhishek: i'm assuming that if the framework is calling it then it's expected to do something | 17:49 |
| marekd | ayoung: gorizon would sinply redirect to Keystone | 17:49 |
| bknudson | ayoung: I'd expect that if the same event was added twice then it would only show up once in the event tree... test_cleanup is counting events in the event_tree. | 17:50 |
| ayoung | marekd, not redirect | 17:50 |
| abhishek | dstanek:right | 17:50 |
| ayoung | bknudson, are you sure the time is identical? | 17:50 |
| marekd | ayoung: redirect, cause you need to fed-authN with the Keystone as a SP | 17:50 |
| abhishek | dstanek:but as such now I haven't found any operation to do in the reset method | 17:50 |
| marekd | ayoung: you don't want Horizon to get your password. | 17:50 |
| ayoung | marekd I know | 17:51 |
| ayoung | it never would | 17:51 |
| abhishek | dstanek:so I have added empty method to remove the attribute error | 17:51 |
| bknudson | ayoung: MySQL truncates the timestamp to the nearest second so I changed the revocation events code to do the same. | 17:51 |
| ayoung | bknudson, no. | 17:51 |
| marekd | ayoung: ok, so how do you see the workflow withour redirections then? | 17:51 |
| ayoung | bknudson, well, maybe ok | 17:51 |
| ayoung | bknudson, could it be straddling a cutoff time? | 17:52 |
| ayoung | like 4.5001 vs 4.4999 | 17:52 |
| bknudson | ayoung: that's the only way the test would pass. So I don't see why it passes on master and not on icehouse | 17:52 |
| ayoung | marekd, OK, user goes to log in to Horizon. They are given the "auth using Federation" option | 17:52 |
| marekd | ayoung: +++ | 17:52 |
| ayoung | Horizon makes the call to Keystone to prep things | 17:53 |
| marekd | ayoung: what call? | 17:53 |
| ayoung | marekd, hand-wavy-new-call | 17:53 |
| dstanek | abhishek: what *should* it do? | 17:53 |
| ayoung | marekd, enough to tell Horizon how to redirect the user to the SAML portal | 17:53 |
| ayoung | then the SAML assertion comes back to Horizon. Horizon takes it and sends it to Keystone to get a token | 17:53 |
| abhishek | dstanek:your concern i right | 17:54 |
| ayoung | bknudson, I know I faced an issue like this | 17:54 |
| marekd | ayoung: ah, something we are gonna use in k2k bp.... | 17:54 |
| abhishek | dstanek:I will address your comments, thank you | 17:54 |
| dstanek | abhishek: np | 17:54 |
| bknudson | ayoung: ah... test_cleanup is different in master. | 17:54 |
| bknudson | let me check the history | 17:55 |
| dstanek | stevemar: is there any reason that new example doesn't have a 'resource_info'? it seems to be in the other ones | 17:55 |
| ayoung | bknudson, if the truncation is happening in the Database, and the event is getting added prior to going into the database, then it won't be truncated | 17:55 |
| marekd | ayoung: i think we have discussed that workflow and one concern was that IdP will issue a saml assertion for Horizon -> Keystone may reject the assertion. | 17:56 |
| morganfainberg | marekd, ++ | 17:56 |
| morganfainberg | marekd, that *may* be worked around somehow, but that as i recall was the concern | 17:56 |
| bknudson | ayoung: this looks like it -- https://github.com/openstack/keystone/commit/5fbb0a28bc40d3e30b416a284cbe63f233cca39e | 17:56 |
| bknudson | I'll include that in the backport | 17:56 |
| marekd | i can see some similarities between this workflow and k2k but in k2k keystone will build a saml assertion and address it for another keystone | 17:57 |
| marekd | ayoung: ^^ | 17:57 |
| dstanek | lbragstad: stevemar: how do deployers know what to include as deps when packaging keystone? | 17:57 |
| dstanek | morganfainberg: bknudson: ayoung: ^ | 17:57 |
| morganfainberg | bknudson, yeah that was an issue we ran across that was intermittant, but could occur, making the times distinct was the solution | 17:57 |
| marekd | in websso Horizon would pass an assertion that was not addressed for Keystone. | 17:57 |
| ayoung | marekd, make sure that the K2K workflow accounts for Horizon, then | 17:57 |
| *** saipandi has joined #openstack-keystone | 17:57 | |
| morganfainberg | dstanek, zigo might have a better idea on that | 17:57 |
| morganfainberg | dstanek, but that is because he helps packaging | 17:58 |
| stevemar | dstanek, when using CADF you get a bit more info, so instead of just resource_info, it's a whole whack of data | 17:58 |
| marekd | ayoung: as i said there is a small difference between websso and k2k. | 17:58 |
| morganfainberg | dstanek, iirc "requirements.txt" is the #1 source | 17:58 |
| stevemar | dstanek, isn't that from requirements.txt? | 17:58 |
| stevemar | morganfainberg, ++ | 17:58 |
| bknudson | dstanek: it's requirements.txt | 17:59 |
| marekd | ayoung: and only thing i could make ad-hoc was asking ppl who wrote some saml stuff - they answered workflow for k2k is feasible...not the most ideal but this should work. | 17:59 |
| dstanek | hmmm...i'm wondering about the impact of moving lxml out of requirements | 17:59 |
| bknudson | dstanek: I think we already do the same thing with some other dependencies | 18:00 |
| bknudson | maybe memcached in keystoneclient/middleware? | 18:00 |
| dstanek | bknudson: yes, there are a couple of things like that, but in this case we are going from bundling lxml to making it optional | 18:01 |
| bknudson | dstanek: good! I'm sick of lxml! | 18:01 |
| dstanek | ++ | 18:01 |
| stevemar | bknudson, and oauthlib in keystoneclient | 18:01 |
| stevemar | aint nobody like lxml | 18:02 |
| *** marcoemorais has quit IRC | 18:04 | |
| *** marcoemorais has joined #openstack-keystone | 18:04 | |
| *** marcoemorais has quit IRC | 18:05 | |
| *** marcoemorais has joined #openstack-keystone | 18:05 | |
| *** afazekas has quit IRC | 18:07 | |
| abhishek | dstanek:I have tried calling server.listen() method from create_server | 18:12 |
| *** jamielennox|away is now known as jamielennox | 18:13 | |
| abhishek | dstanek:create_server() method of bin/keystone-all, but its still raising the Bad file descriptor error | 18:13 |
| dstanek | abhishek: what is raising the exception? | 18:14 |
| abhishek | dstanek:i guess the socket is closed and its trying to listen to the same socket | 18:15 |
| dstanek | abhishek: is listen being called multiple times still? | 18:16 |
| abhishek | dstanek:IMO yes | 18:17 |
| abhishek | dstanek:in eventlet_server.py in start method, self.listen is called agian | 18:19 |
| dstanek | abhishek: why? | 18:19 |
| abhishek | dstanek:when the sighup signal is received then it stops the server and the calls the start method | 18:19 |
| abhishek | dstanek:https://github.com/openstack/oslo-incubator/blob/master/openstack/common/service.py#L484 | 18:24 |
| *** jorge_munoz has joined #openstack-keystone | 18:29 | |
| *** jorge_munoz has quit IRC | 18:30 | |
| *** jorge_munoz has joined #openstack-keystone | 18:32 | |
| *** cjellick has quit IRC | 18:39 | |
| *** jorge_munoz has quit IRC | 18:39 | |
| *** shufflebot has quit IRC | 18:40 | |
| *** shufflebot has joined #openstack-keystone | 18:40 | |
| *** jorge_munoz has joined #openstack-keystone | 18:40 | |
| *** jorge_munoz has quit IRC | 18:41 | |
| *** jorge_munoz has joined #openstack-keystone | 18:41 | |
| *** jorge_munoz has quit IRC | 18:44 | |
| *** cjellick has joined #openstack-keystone | 18:45 | |
| *** cjellick has quit IRC | 18:47 | |
| *** cjellick has joined #openstack-keystone | 18:47 | |
| *** jorge_munoz has joined #openstack-keystone | 18:50 | |
| *** jorge_munoz has quit IRC | 18:58 | |
| *** jorge_munoz has joined #openstack-keystone | 18:59 | |
| openstackgerrit | A change was merged to openstack/keystone: Surround REMOTE_USER variable name with quotes. https://review.openstack.org/111951 | 19:00 |
| marekd | thanks ^ | 19:01 |
| *** hrybacki has quit IRC | 19:03 | |
| *** hrybacki has joined #openstack-keystone | 19:03 | |
| *** ajayaa has quit IRC | 19:03 | |
| *** jorge_munoz has quit IRC | 19:04 | |
| morganfainberg | henrynash, so should we support mapping to domain ids? | 19:05 |
| morganfainberg | henrynash, if i read your last comment? | 19:05 |
| *** jorge_munoz has joined #openstack-keystone | 19:05 | |
| henrynash | morganfaiberg: I think I need to re-think this one through in my head, to be honest…I was never quite sure how we ended up after teh hackathon... | 19:08 |
| henrynash | morganfainberg: in terms of the n:m relationshipds between the various entities (i.e. one mapping table per domain, or is it one mapping table per Idp etc,) | 19:09 |
| morganfainberg | henrynash, ah. | 19:09 |
| henrynash | morganfainberg: just need to get my head roudn it agin | 19:10 |
| morganfainberg | sounds good | 19:10 |
| stevemar | morganfainberg, henrynash bknudson I wanted to bring this up during the meeting but forgot to, what do you all think about notifications for role assignment changes? | 19:12 |
| bknudson | stevemar: that sounds like an auditable event to me | 19:12 |
| *** hrybacki has quit IRC | 19:15 | |
| *** rwsu has quit IRC | 19:18 | |
| *** shufflebot has quit IRC | 19:20 | |
| *** dhellmann is now known as dhellmann_ | 19:22 | |
| *** cjellick has quit IRC | 19:28 | |
| *** cjellick has joined #openstack-keystone | 19:32 | |
| *** cjellick has quit IRC | 19:39 | |
| *** jorge_munoz has quit IRC | 19:40 | |
| *** cjellick has joined #openstack-keystone | 19:40 | |
| *** henrynash has quit IRC | 19:40 | |
| *** marcoemorais has quit IRC | 19:47 | |
| *** marcoemorais has joined #openstack-keystone | 19:47 | |
| *** jorge_munoz has joined #openstack-keystone | 19:47 | |
| *** toddnni has quit IRC | 19:52 | |
| *** toddnni has joined #openstack-keystone | 19:53 | |
| *** rwsu has joined #openstack-keystone | 19:54 | |
| *** abhishek has quit IRC | 19:55 | |
| *** afazekas has joined #openstack-keystone | 19:56 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Isolate get_discovery function https://review.openstack.org/107569 | 19:59 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow unauthenticated discovery https://review.openstack.org/107570 | 19:59 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Version independent password authentication plugin https://review.openstack.org/81147 | 19:59 |
| marekd | jamielennox: dstanek: https://review.openstack.org/#/c/107393/ do you think we can land it today? | 19:59 |
| marekd | Also, core eyes would be appreciated on this too: https://review.openstack.org/#/c/106751/ cc/ jamielennox | 20:01 |
| jamielennox | marekd: looking now | 20:01 |
| marekd | jamielennox: thanks. | 20:01 |
| *** dhellmann_ is now known as dhellmann | 20:02 | |
| *** jorge_munoz has quit IRC | 20:03 | |
| *** cjellick has quit IRC | 20:07 | |
| *** cjellick has joined #openstack-keystone | 20:11 | |
| *** cjellick has quit IRC | 20:15 | |
| *** cjellick has joined #openstack-keystone | 20:16 | |
| jamielennox | marekd: have you tried these saml plugins from a command line or CONF file? | 20:18 |
| *** gokrokve has joined #openstack-keystone | 20:18 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove assignment controller dependency on token_api https://review.openstack.org/109162 | 20:19 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Expose token revocation list via token_provider_api https://review.openstack.org/109170 | 20:19 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove ec2 contrib dependency on token_api https://review.openstack.org/109173 | 20:19 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove trust dependency on token_api https://review.openstack.org/109462 | 20:19 |
| jamielennox | marekd: i don't think they will work | 20:19 |
| marekd | jamielennox: you are talking about options? | 20:20 |
| jamielennox | marekd: yea | 20:20 |
| jamielennox | Saml2Unscoped lines up | 20:20 |
| *** gokrokve_ has quit IRC | 20:20 | |
| jamielennox | but Saml2Wrapper will have a --unscoped-token-auth parameter, and i don't see where that would be used | 20:21 |
| marekd | jamielennox: when i try the code i usually write wrappers, create sessions, create plugin obj and get an unscoped token, but To be honest i didn't try it with options. | 20:21 |
| jamielennox | marekd: this is a bit out of date: https://review.openstack.org/#/c/95680/ but shows basically how they look from a cmdline | 20:22 |
| jamielennox | from a conf file is probably eaier | 20:23 |
| marekd | jamielennox: yeah, but it's simply argparse, nothing really custom? | 20:24 |
| jamielennox | marekd: there is some handling done, but it's argparse | 20:24 |
| marekd | and eventually it will read args from cmdline, and pass them to the plugin constructor. | 20:24 |
| jamielennox | marekd: if you don't care about it for now you can always drop get_options | 20:25 |
| jamielennox | you don't need it if you don't need cmdline or conf file | 20:26 |
| marekd | well i wanted (as we agreed long time ago) saml2wrapper to be a top level auth plugin. | 20:26 |
| jamielennox | yep | 20:26 |
| jamielennox | i agree | 20:27 |
| marekd | so get_options() should stay there. | 20:27 |
| marekd | i left a question for you once: https://review.openstack.org/#/c/106751/4..6/keystoneclient/contrib/auth/v3/saml2.py (bottom of the vesion 4) | 20:28 |
| *** cjellick_ has joined #openstack-keystone | 20:28 | |
| marekd | i think it's not really doable, so we should (must) let users get their unscoped token -> saml2unscoped plugin should also be a top level auth plugin | 20:29 |
| marekd | dstanek: what should i use instead of urllib2 in order to urlencode a string and be Python3 compatible? | 20:29 |
| *** cjellick has quit IRC | 20:31 | |
| jamielennox | ok, so at the least you are missing an option for ecp_implementation, and the unscoped_token_auth parameter will fail | 20:31 |
| marekd | yeah | 20:36 |
| marekd | i will fix that. | 20:36 |
| marekd | apart from that anything eyesburning? | 20:36 |
| marekd | (apart from your comments in general) | 20:37 |
| *** cjellick_ has quit IRC | 20:37 | |
| *** cjellick has joined #openstack-keystone | 20:40 | |
| *** jorge_munoz has joined #openstack-keystone | 20:42 | |
| *** radez is now known as radez_g0n3 | 20:42 | |
| *** kevinbenton has quit IRC | 20:44 | |
| *** cjellick has quit IRC | 20:47 | |
| *** cjellick has joined #openstack-keystone | 20:48 | |
| marekd | jamielennox: is there any way to issue a session cookie from self.requests.register_uri() ? | 20:53 |
| jamielennox | marekd: session cookie? isa it just a header | 20:53 |
| marekd | jamielennox: hm, you are right... | 20:54 |
| *** kevinbenton has joined #openstack-keystone | 20:56 | |
| jamielennox | marekd: if you have an idea for how it should work let me know | 20:58 |
| marekd | jamielennox: you are now talking about...? | 20:58 |
| jamielennox | requests-mock and cookies | 20:59 |
| marekd | jamielennox: nah, setting a header will be probably enough... | 20:59 |
| *** jdennis has quit IRC | 21:02 | |
| marekd | jamielennox: orrr, we could make it work like here: http://docs.python-requests.org/en/latest/user/quickstart/#cookies | 21:03 |
| *** marcoemorais has quit IRC | 21:04 | |
| *** marcoemorais has joined #openstack-keystone | 21:05 | |
| jamielennox | marekd: the goal so far has been to make the register_uri parameters as close to a requests.Respobse as possible | 21:05 |
| jamielennox | text == resp.text | 21:05 |
| jamielennox | status_code == resp.status_code | 21:05 |
| jamielennox | so i should look to do cookies == resp.cookies | 21:05 |
| *** jdennis has joined #openstack-keystone | 21:08 | |
| marekd | yeah | 21:11 |
| *** openstackgerrit has quit IRC | 21:16 | |
| *** openstackgerrit has joined #openstack-keystone | 21:16 | |
| *** cjellick has quit IRC | 21:18 | |
| *** jasondotstar has quit IRC | 21:20 | |
| *** jorge_munoz has quit IRC | 21:20 | |
| *** joesavak has quit IRC | 21:26 | |
| jamielennox | somebody +a https://review.openstack.org/#/c/111621/ please? | 21:28 |
| jamielennox | ^ global requirements bump keystoneclient version in middleware | 21:28 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: SAML2 federated authentication for ADFS. https://review.openstack.org/111771 | 21:28 |
| *** hrybacki has joined #openstack-keystone | 21:30 | |
| *** marekd is now known as marekd|away | 21:31 | |
| *** gordc has quit IRC | 21:38 | |
| dstanek | marekd|away: 'from six.moves import urllib' and 'urllib.parse.urlencode' | 21:43 |
| *** henrynash has joined #openstack-keystone | 21:43 | |
| jamielennox | ayoung: can you do the other +A to ^ | 21:46 |
| ayoung | jamielennox, willdo, one sec | 21:46 |
| *** gokrokve has quit IRC | 21:50 | |
| *** henrynash has quit IRC | 21:51 | |
| dstanek | jamielennox: done | 21:51 |
| jamielennox | dstanek: ta | 21:51 |
| dstanek | jamielennox: will it automatically recheck? | 21:52 |
| jamielennox | dstanek: it should | 21:52 |
| ayoung | jamielennox, dagnabit, you reverified already | 22:01 |
| jamielennox | ayoung: hrybacki's one? | 22:02 |
| ayoung | I was doing the due dilligenvce on what you reproted https://bugs.launchpad.net/nova/+bug/1353131 | 22:02 |
| uvirtbot | Launchpad bug 1353131 in openstack-ci "Failed to commit reservations in gate" [Undecided,New] | 22:02 |
| ayoung | yeah. I thuink it is | 22:02 |
| ayoung | https://bugs.launchpad.net/tempest/+bug/1310597 | 22:02 |
| uvirtbot | Launchpad bug 1310597 in tempest "race between quota setting and quota being enforced" [High,New] | 22:02 |
| ayoung | I didn't thin to refresh, though | 22:02 |
| ayoung | and submitted after you | 22:02 |
| ayoung | ah, well, maybe it will pass gate | 22:03 |
| jamielennox | ayoung: oh, i went through it a bit but didn't recognise anything | 22:03 |
| jamielennox | just tag it onto the bug | 22:03 |
| jamielennox | ayoung: do you mind having a look at https://review.openstack.org/#/c/107555/ as well, it's got a +2 already from bk | 22:06 |
| ayoung | jamielennox, guang has a comment | 22:07 |
| jamielennox | oh | 22:07 |
| ayoung | na, not a hold up | 22:08 |
| ayoung | jamielennox, where's self.MIN_TOKEN_LIFE_SECONDS come from? | 22:08 |
| jamielennox | ayoung: replied, don't think it's a problem with this one | 22:08 |
| jamielennox | ayoung: defined on the class | 22:09 |
| jamielennox | :30 | 22:09 |
| ayoung | jamielennox, 1 second | 22:09 |
| jamielennox | same value as before | 22:09 |
| ayoung | yeah. Is the idea that eventaull that will be something (optionally) read from config ? | 22:10 |
| jamielennox | ayoung: could be, could be overriden from someone in python code | 22:10 |
| jamielennox | i have no long term plans for that | 22:11 |
| jamielennox | add it when needed | 22:11 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add oslo.utils requirement https://review.openstack.org/112156 | 22:12 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Use functions in oslo.utils https://review.openstack.org/112157 | 22:12 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Remove strutils and timeutils from openstack-common.conf https://review.openstack.org/112158 | 22:12 |
| *** david-lyle has quit IRC | 22:46 | |
| *** david-lyle has joined #openstack-keystone | 22:47 | |
| *** david-lyle has quit IRC | 22:51 | |
| *** ayoung has quit IRC | 22:51 | |
| *** saipandi has quit IRC | 22:57 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Add oslo.utils requirement https://review.openstack.org/112164 | 23:02 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Use oslo.utils https://review.openstack.org/112165 | 23:02 |
| *** jaosorior has quit IRC | 23:02 | |
| marekd|away | dstanek: this one's for ya: https://review.openstack.org/#/c/107393/ ;-) | 23:10 |
| *** KimJ has quit IRC | 23:10 | |
| gyee | bknudson, thanks for double checking on the openssl cmd stuff | 23:19 |
| gyee | I though middleware also going through it, lucky it wasn't | 23:19 |
| bknudson | gyee: no problem... could look at how middleware calls openssl to be safe | 23:20 |
| gyee | bknudson, just did, I think we're ok | 23:20 |
| gyee | its using ipc pipe | 23:20 |
| jamielennox | bknudson: regarding the comment on https://review.openstack.org/#/c/107222/2/keystonemiddleware/auth_token.py the reason i didn't name the class is i wasn't making it public | 23:26 |
| jamielennox | do you think it's worth just making it public? | 23:27 |
| bknudson | jamielennox: the base class must be public | 23:27 |
| jamielennox | bknudson: is it sufficient then to put a doc string in that says that __init__ is not a stable interface | 23:27 |
| bknudson | jamielennox: something about it has to be public... its properties and methods? | 23:27 |
| jamielennox | bknudson: not really | 23:28 |
| jamielennox | the idea is that you receive it and then create a session with it later | 23:28 |
| bknudson | jamielennox: oh, it's some opaque object? | 23:28 |
| jamielennox | the only things that are public are the things that are required by the auth plugin interface | 23:28 |
| jamielennox | bknudson: yep | 23:28 |
| bknudson | jamielennox: document that then | 23:28 |
| bknudson | jamielennox: session could be a link to the session class | 23:29 |
| jamielennox | ok, i'll add that to | 23:29 |
| jamielennox | i expect later that i'll need a method by which you can construct the plugin from headers - but i'm not sure yet how that will look so i was just going to keep it private until that was needed | 23:30 |
| *** ncoghlan has joined #openstack-keystone | 23:36 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Create an Auth Plugin to pass to users https://review.openstack.org/107222 | 23:45 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Isolate get_discovery function https://review.openstack.org/107569 | 23:56 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow unauthenticated discovery https://review.openstack.org/107570 | 23:56 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Version independent password authentication plugin https://review.openstack.org/81147 | 23:56 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 23:58 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!